diff --git a/.gitattributes b/.gitattributes
index 2a99890023b..8f4f884295d 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -8,7 +8,19 @@
 /src/cli/bundled-skill-guides.ts text eol=lf
 # Bundled plugin trees are byte-hashed; CRLF checkout would break the pinned hash.
 /resources/plugins/** text eol=lf
-# pnpm hashes every patch byte-for-byte, so a CRLF checkout breaks the install.
+# Relay assets are copied verbatim into the bundle and hashed byte-for-byte into
+# .version, which names the immutable remote install dir. A CRLF checkout makes a
+# Windows-built client disagree with a mac/Linux-built one on the same release,
+# so one host ends up with two relay trees (#17886 review).
+/config/relay-assets/** text eol=lf
+# Pin the bytes so a patch reads and diffs identically on every host. It is NOT
+# what makes the hash right: pnpm hashes a patch LF-normalized, so a CRLF checkout
+# cannot change it. Believing otherwise put a hand-computed raw digest in the
+# lockfile twice and broke every install (#17886).
+# These files are stored LF, which is not always the encoding they were written
+# against -- @vscode/windows-process-tree ships CRLF sources -- so any code that
+# runs `git apply` on one must force `-c core.autocrlf=input` rather than trust
+# the host's setting. See config/scripts/windows-process-tree-gyp-rebuild.mjs.
 /config/patches/*.patch -text
 # The xterm bundle hunks also make a diff nobody can read; review the hand-written
 # source patch under xterm-src/ instead. The sibling patches stay diffable.
diff --git a/.github/actions/install-node-dependencies/action.yml b/.github/actions/install-node-dependencies/action.yml
index e36ec4c65d8..7695d2bec9b 100644
--- a/.github/actions/install-node-dependencies/action.yml
+++ b/.github/actions/install-node-dependencies/action.yml
@@ -77,14 +77,6 @@ runs:
             ;;
         esac
 
-    # pnpm's bundled gyp_main.py is not executable on fresh Linux runners.
-    - name: Use external node-gyp
-      if: runner.os == 'Linux' && inputs.native-runtime != 'none'
-      shell: bash
-      run: |
-        npm install -g node-gyp@11.5.0
-        echo "npm_config_node_gyp=$(npm root -g)/node-gyp/bin/node-gyp.js" >> "$GITHUB_ENV"
-
     - name: Prepare dependency install
       shell: bash
       run: |
@@ -175,6 +167,22 @@ runs:
           node_modules/.pnpm/@vscode+windows-process-tree@*/node_modules/@vscode/windows-process-tree/build
         key: native-modules-${{ runner.os }}-${{ steps.native-cache-scope.outputs.scope }}-${{ runner.arch }}-${{ inputs.native-runtime }}-node${{ steps.requested-node.outputs.node-version || steps.default-node.outputs.node-version }}-${{ hashFiles('pnpm-lock.yaml', '.github/actions/install-node-dependencies/action.yml', 'config/scripts/ensure-native-runtime.mjs', 'config/scripts/rebuild-native-deps.mjs', 'config/patches/node-pty@1.1.0.patch', 'config/patches/@vscode__windows-process-tree@0.8.0.patch') }}
 
+    # pnpm's bundled gyp_main.py is not executable on fresh Linux runners.
+    - name: Use external node-gyp
+      if: runner.os == 'Linux' && inputs.native-runtime != 'none'
+      shell: bash
+      env:
+        NATIVE_RUNTIME: ${{ inputs.native-runtime }}
+        NATIVE_CACHE_HIT: ${{ steps.native-cache-restore.outputs.cache-hit || steps.native-cache-restore-only.outputs.cache-hit }}
+      run: |
+        # A cache hit can contain unusable addons; probe before skipping the rebuild toolchain.
+        if [ "$NATIVE_RUNTIME" = node ] && [ "$NATIVE_CACHE_HIT" = true ] &&
+          node config/scripts/ensure-native-runtime.mjs --check-only; then
+          exit 0
+        fi
+        npm install -g node-gyp@11.5.0
+        echo "npm_config_node_gyp=$(npm root -g)/node-gyp/bin/node-gyp.js" >> "$GITHUB_ENV"
+
     - name: Prepare native runtime
       if: inputs.native-runtime != 'none'
       shell: bash
diff --git a/.github/scripts/e2e-with-window-manager.sh b/.github/scripts/e2e-with-window-manager.sh
new file mode 100644
index 00000000000..d431a039809
--- /dev/null
+++ b/.github/scripts/e2e-with-window-manager.sh
@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+set -euo pipefail
+openbox --sm-disable > /tmp/orca-e2e-window-manager.log 2>&1 &
+wm_pid=$!
+cleanup() {
+  kill "$wm_pid" 2>/dev/null || true
+  wait "$wm_pid" 2>/dev/null || true
+}
+trap cleanup EXIT
+ready=false
+for attempt in {1..100}; do
+  if xprop -root _NET_SUPPORTING_WM_CHECK 2>/dev/null | rg -q 'window id # 0x[1-9a-fA-F]'; then
+    ready=true
+    break
+  fi
+  if ! kill -0 "$wm_pid" 2>/dev/null; then
+    cat /tmp/orca-e2e-window-manager.log
+    exit 1
+  fi
+  sleep 0.1
+done
+if [ "$ready" != true ]; then
+  echo 'Window manager did not acquire the Xvfb root window' >&2
+  exit 1
+fi
+"$@"
diff --git a/.github/workflows/adhoc-mac-build.yml b/.github/workflows/adhoc-mac-build.yml
index d7dd6d5ffb6..3e17eee9b68 100644
--- a/.github/workflows/adhoc-mac-build.yml
+++ b/.github/workflows/adhoc-mac-build.yml
@@ -127,9 +127,12 @@ jobs:
           esac
           # Bare: a work-tree repo refuses to fetch over its own checked-out
           # branch. tree:0 keeps the fetch to the commit graph — no trees, no
-          # blobs — so this stays cheap next to the build it fronts.
+          # blobs — so this stays cheap next to the build it fronts. reftable
+          # because this repo has branches that differ only in casing, and the
+          # files backend cannot store both on a case-insensitive runner disk —
+          # it fails the entire fetch, not just the one ref.
           scratch="$RUNNER_TEMP/vet-requested-ref"
-          git init -q --bare "$scratch"
+          git init -q --bare --ref-format=reftable "$scratch"
           git -C "$scratch" fetch -q --filter=tree:0 "$REPO_URL" '+refs/heads/*:refs/heads/*' '+refs/tags/*:refs/tags/*'
           # Branch first to keep actions/checkout's old tie-break: bare
           # rev-parse would prefer the tag when a branch shares its name.
@@ -157,6 +160,9 @@ jobs:
 
       - name: Checkout the requested ref
         uses: actions/checkout@v6
+        env:
+          # Full-history checkout must also preserve case-twin branch and tag names.
+          GIT_DEFAULT_REF_FORMAT: reftable
         with:
           # Why an input at all rather than just github.ref: the whole point is to
           # build code that has not landed, and the workflow definition itself
diff --git a/.github/workflows/cloud-deploy-relay-production-same-cap-job.yml b/.github/workflows/cloud-deploy-relay-production-same-cap-job.yml
index 6430c3f4793..8ef61507088 100644
--- a/.github/workflows/cloud-deploy-relay-production-same-cap-job.yml
+++ b/.github/workflows/cloud-deploy-relay-production-same-cap-job.yml
@@ -91,7 +91,11 @@ jobs:
           test -n "${CAPACITY_SERVICE_ACCOUNT}"
           test -n "${DIRECTOR_RUNTIME_SERVICE_ACCOUNT}"
 
+      # Full history: the monitor evidence this job verifies is sealed at an ancestor commit,
+      # and the provenance check fails closed on a commit a shallow clone left out.
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       - uses: pnpm/action-setup@v4
         with: { package_json_file: cloud/package.json }
@@ -177,11 +181,12 @@ jobs:
         env:
           ORCA_RELAY_ADMIN_ID_TOKEN: ${{ steps.deploy-auth.outputs.id_token }}
         run: |
-          RETRY_ARGS=()
-          if test "${WAVE_INDEX}" != 0; then RETRY_ARGS=(--retry-freshness); fi
+          # Freshness-only failures are publish lag, not health, on every wave
+          # including the first; the CLI still caps the retry at the wave's
+          # evidence-age budget, so this cannot mutate on aged evidence.
           pnpm incident:relay-preflight -- \
             --state-file "${OUTPUT_DIRECTORY}/relay-${MONITOR_RUN_ID}-dry-run.state.json" \
-            --wave-index "${WAVE_INDEX}" "${RETRY_ARGS[@]}"
+            --wave-index "${WAVE_INDEX}" --retry-freshness
 
       - name: Require durable rehome disabled and exact selector
         env:
@@ -271,10 +276,22 @@ jobs:
         env:
           ORCA_RELAY_ADMIN_ID_TOKEN: ${{ steps.deploy-auth.outputs.id_token }}
         run: |
-          CURRENT_RUNTIME="$(curl --fail-with-body --max-time 30 \
-            --request POST "${CELL_ORIGIN}/v1/admin/runtime-status" \
-            --header "Authorization: Bearer ${ORCA_RELAY_ADMIN_ID_TOKEN}" \
-            --header 'Content-Type: application/json' --data '{"v":1}')"
+          # A single transient 5xx (LB warm-up behind a fresh instance) must not
+          # fail a canary; 4xx (auth, generation mismatch) still fails fast.
+          admin_post() {
+            local out="${RUNNER_TEMP}/$1.json"
+            if ! curl --fail-with-body --max-time 30 \
+              --retry 3 --retry-delay 2 --retry-connrefused --output "${out}" \
+              --request POST "$2" \
+              --header "Authorization: Bearer ${ORCA_RELAY_ADMIN_ID_TOKEN}" \
+              --header 'Content-Type: application/json' --data "$3"; then
+              cat "${out}" >&2
+              return 1
+            fi
+            cat "${out}"
+          }
+          CURRENT_RUNTIME="$(admin_post current-runtime \
+            "${CELL_ORIGIN}/v1/admin/runtime-status" '{"v":1}')"
           # A rollback that failed between template apply and admission restore
           # leaves the cell already on the rollback image; resume from that
           # state instead of demanding the pre-rollback predecessor.
@@ -370,11 +387,9 @@ jobs:
             if .regionalRehomeProtocol == null then "regionalRehomeProtocol" else empty end
           ] | if length > 0 then "runtime predecessor normalized legacy fields=" + join(",") else empty end' \
             <<< "${CURRENT_RUNTIME}"
-          CURRENT_DIRECTOR_STATUS="$(curl --fail-with-body --max-time 30 \
-            --request POST "${DIRECTOR_ORIGIN}/v1/admin/cell-status" \
-            --header "Authorization: Bearer ${ORCA_RELAY_ADMIN_ID_TOKEN}" \
-            --header 'Content-Type: application/json' \
-            --data "$(jq -cn --arg cell "${TARGET_CELL_ID}" '{v:1,cellId:$cell}')")"
+          CURRENT_DIRECTOR_STATUS="$(admin_post current-cell-status \
+            "${DIRECTOR_ORIGIN}/v1/admin/cell-status" \
+            "$(jq -cn --arg cell "${TARGET_CELL_ID}" '{v:1,cellId:$cell}')")"
           SOURCE_INCARNATION="$(jq -er '.status.runtime.cellIncarnation' \
             <<< "${CURRENT_DIRECTOR_STATUS}")"
           if test "${ROLLBACK_RESUME}" = true && ! jq -e \
@@ -418,13 +433,13 @@ jobs:
           # result's generation is authoritative either way.
           ISOLATE_RESULT="$(node dev/scripts/prepare-relay-production-capacity-canary.mjs \
             --director-origin "${DIRECTOR_ORIGIN}" --cell-origin "${CELL_ORIGIN}" \
-            --cell-id "${TARGET_CELL_ID}" --mode isolate)"
+            --cell-id "${TARGET_CELL_ID}" --approved-cells same-cap --mode isolate)"
           echo "${ISOLATE_RESULT}"
           ISOLATE_GENERATION="$(jq -er '.generation' <<< "${ISOLATE_RESULT}")"
           echo "SELECTOR_GENERATION_AFTER_ISOLATE=${ISOLATE_GENERATION}" >> "${GITHUB_ENV}"
           node dev/scripts/prepare-relay-production-capacity-canary.mjs \
             --director-origin "${DIRECTOR_ORIGIN}" --cell-origin "${CELL_ORIGIN}" \
-            --cell-id "${TARGET_CELL_ID}" --mode drain
+            --cell-id "${TARGET_CELL_ID}" --approved-cells same-cap --mode drain
           node dev/scripts/verify-relay-capacity-transition.mjs \
             --director-origin "${DIRECTOR_ORIGIN}" --cell-origin "${CELL_ORIGIN}" \
             --cell-id "${TARGET_CELL_ID}" --hard-cap "${EXPECTED_HARD_CAP}" \
@@ -486,6 +501,7 @@ jobs:
                 --rollback-image "${DESIRED_IMAGE}" \
                 --rehome-director-service-account "${DIRECTOR_RUNTIME_SERVICE_ACCOUNT}" \
                 --rehome-audience https://relay.onorca.dev/v1/admin/host-drain \
+                --regional-rehome-protocol "${DESIRED_REHOME_PROTOCOL}" \
               | jq -e '.changes == 2' >/dev/null
           fi
           gcloud compute instance-groups managed wait-until "${MIG_NAME}" --stable \
@@ -511,7 +527,8 @@ jobs:
               --unobserved-bound "${EXPECTED_UNOBSERVED_BOUND}" --image "${DESIRED_IMAGE}" \
               --rollback-image "${IMAGE_REPOSITORY}@${CURRENT_IMAGE_DIGEST}" \
               --rehome-director-service-account "${DIRECTOR_RUNTIME_SERVICE_ACCOUNT}" \
-              --rehome-audience https://relay.onorca.dev/v1/admin/host-drain
+              --rehome-audience https://relay.onorca.dev/v1/admin/host-drain \
+              --regional-rehome-protocol "${DESIRED_REHOME_PROTOCOL}"
           terraform -chdir=infra/terraform apply -auto-approve \
             "${RUNNER_TEMP}/relay-same-cap.tfplan"
           gcloud compute instance-groups managed wait-until "${MIG_NAME}" --stable \
@@ -532,6 +549,20 @@ jobs:
         env:
           ORCA_RELAY_ADMIN_ID_TOKEN: ${{ steps.post-auth.outputs.id_token }}
         run: |
+          # A single transient 5xx (LB warm-up behind a fresh instance) must not
+          # fail a canary; 4xx (auth, generation mismatch) still fails fast.
+          admin_post() {
+            local out="${RUNNER_TEMP}/$1.json"
+            if ! curl --fail-with-body --max-time 30 \
+              --retry 3 --retry-delay 2 --retry-connrefused --output "${out}" \
+              --request POST "$2" \
+              --header "Authorization: Bearer ${ORCA_RELAY_ADMIN_ID_TOKEN}" \
+              --header 'Content-Type: application/json' --data "$3"; then
+              cat "${out}" >&2
+              return 1
+            fi
+            cat "${out}"
+          }
           node dev/scripts/verify-relay-capacity-transition.mjs \
             --director-origin "${DIRECTOR_ORIGIN}" --cell-origin "${CELL_ORIGIN}" \
             --cell-id "${TARGET_CELL_ID}" --hard-cap "${EXPECTED_HARD_CAP}" \
@@ -539,19 +570,15 @@ jobs:
             --heartbeat fresh --admission migration-only --draining forbidden \
             --activity allowed --expected-image-digests "${DESIRED_IMAGE_DIGEST}" \
             --regional-rehome-protocol "${DESIRED_REHOME_PROTOCOL}" --timeout-ms 900000
-          TARGET_RUNTIME="$(curl --fail-with-body --max-time 30 \
-            --request POST "${CELL_ORIGIN}/v1/admin/runtime-status" \
-            --header "Authorization: Bearer ${ORCA_RELAY_ADMIN_ID_TOKEN}" \
-            --header 'Content-Type: application/json' --data '{"v":1}')"
+          TARGET_RUNTIME="$(admin_post target-runtime \
+            "${CELL_ORIGIN}/v1/admin/runtime-status" '{"v":1}')"
           jq -e --arg digest "${DESIRED_IMAGE_DIGEST}" \
             --argjson protocol "${DESIRED_REHOME_PROTOCOL}" \
             '.imageDigest == $digest and (.regionalRehomeProtocol // 0) == $protocol' \
             <<< "${TARGET_RUNTIME}" >/dev/null
-          TARGET_DIRECTOR_STATUS="$(curl --fail-with-body --max-time 30 \
-            --request POST "${DIRECTOR_ORIGIN}/v1/admin/cell-status" \
-            --header "Authorization: Bearer ${ORCA_RELAY_ADMIN_ID_TOKEN}" \
-            --header 'Content-Type: application/json' \
-            --data "$(jq -cn --arg cell "${TARGET_CELL_ID}" '{v:1,cellId:$cell}')")"
+          TARGET_DIRECTOR_STATUS="$(admin_post target-cell-status \
+            "${DIRECTOR_ORIGIN}/v1/admin/cell-status" \
+            "$(jq -cn --arg cell "${TARGET_CELL_ID}" '{v:1,cellId:$cell}')")"
           TARGET_INCARNATION="$(jq -er '.status.runtime.cellIncarnation' \
             <<< "${TARGET_DIRECTOR_STATUS}")"
           if test "${ROLLBACK_RESUME}" = true; then
@@ -588,7 +615,7 @@ jobs:
           echo "MUTATION_STARTED=true" >> "${GITHUB_ENV}"
           ACTIVATE_RESULT="$(node dev/scripts/prepare-relay-production-capacity-canary.mjs \
             --director-origin "${DIRECTOR_ORIGIN}" --cell-origin "${CELL_ORIGIN}" \
-            --cell-id "${TARGET_CELL_ID}" --mode activate)"
+            --cell-id "${TARGET_CELL_ID}" --approved-cells same-cap --mode activate)"
           echo "${ACTIVATE_RESULT}"
           SELECTOR_GENERATION_AFTER_ACTIVATE="$(jq -er '.generation' \
             <<< "${ACTIVATE_RESULT}")"
@@ -627,7 +654,7 @@ jobs:
           test "${MUTATION_STARTED:-false}" = true || exit 0
           ISOLATE_RESULT="$(node dev/scripts/prepare-relay-production-capacity-canary.mjs \
             --director-origin "${DIRECTOR_ORIGIN}" --cell-origin "${CELL_ORIGIN}" \
-            --cell-id "${TARGET_CELL_ID}" --mode isolate)"
+            --cell-id "${TARGET_CELL_ID}" --approved-cells same-cap --mode isolate)"
           echo "${ISOLATE_RESULT}"
           # The isolate result carries the authoritative post-isolate generation;
           # fixed offsets are wrong whenever an earlier isolate was a no-op.
diff --git a/.github/workflows/cloud-deploy-relay-production-same-cap.yml b/.github/workflows/cloud-deploy-relay-production-same-cap.yml
index 1994966d083..fba5df0dcb9 100644
--- a/.github/workflows/cloud-deploy-relay-production-same-cap.yml
+++ b/.github/workflows/cloud-deploy-relay-production-same-cap.yml
@@ -87,13 +87,18 @@ jobs:
   gate:
     if: ${{ vars.ORCA_CLOUD_OPERATIONS_ENABLED == 'true' && (github.ref == 'refs/heads/main') }}
     runs-on: blacksmith-2vcpu-ubuntu-2204
-    timeout-minutes: 10
+    # Headroom for the full-history checkout the canary provenance check needs.
+    timeout-minutes: 15
     environment: production
     outputs:
       cells: ${{ steps.wave.outputs.cells }}
       job-mode: ${{ steps.wave.outputs.job-mode }}
     steps:
+      # Full history: the canary authority a batch verifies is sealed at an ancestor commit, and
+      # the provenance check fails closed on a commit a shallow clone left out.
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       - uses: actions/setup-node@v4
         with: { node-version: 24 }
diff --git a/.github/workflows/cloud-operate-relay-production-rehome-job.yml b/.github/workflows/cloud-operate-relay-production-rehome-job.yml
index 682953af5e7..fdb1aca45e0 100644
--- a/.github/workflows/cloud-operate-relay-production-rehome-job.yml
+++ b/.github/workflows/cloud-operate-relay-production-rehome-job.yml
@@ -95,7 +95,11 @@ jobs:
               ;;
           esac
 
+      # Full history: the monitor evidence this job verifies is sealed at an ancestor commit,
+      # and the provenance check fails closed on a commit a shallow clone left out.
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       - uses: actions/setup-node@v4
         with:
diff --git a/.github/workflows/cloud-verify.yml b/.github/workflows/cloud-verify.yml
index f0cc2df2bad..e2ba9407ac4 100644
--- a/.github/workflows/cloud-verify.yml
+++ b/.github/workflows/cloud-verify.yml
@@ -25,9 +25,10 @@ defaults:
     working-directory: cloud
 
 jobs:
+  # Public-repository hosted runners preserve Blacksmith allowance for macOS.
   security:
     name: Secret scan
-    runs-on: blacksmith-2vcpu-ubuntu-2204
+    runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
         with:
@@ -53,7 +54,7 @@ jobs:
   # Compiles the workspace. No Postgres service: nothing here reaches a
   # database, and the service container costs ~13s of startup.
   build:
-    runs-on: blacksmith-4vcpu-ubuntu-2204
+    runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
 
@@ -73,7 +74,7 @@ jobs:
   # package it needs through the relay pretest hook, so it does not depend on
   # `pnpm build` having run.
   test:
-    runs-on: blacksmith-4vcpu-ubuntu-2204
+    runs-on: ubuntu-22.04
     services:
       postgres:
         image: postgres:16-alpine
@@ -107,7 +108,7 @@ jobs:
   # Fork pull requests reach this job, so it never configures a backend, never plans, and never
   # holds a credential. Only the relay root ships here; foundation and apps stay private.
   terraform:
-    runs-on: blacksmith-2vcpu-ubuntu-2204
+    runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
 
diff --git a/.github/workflows/dev-channel-win-build.yml b/.github/workflows/dev-channel-win-build.yml
index e16a50f1c3c..89fda2ebef9 100644
--- a/.github/workflows/dev-channel-win-build.yml
+++ b/.github/workflows/dev-channel-win-build.yml
@@ -149,9 +149,12 @@ jobs:
           fi
           # Reachability is the trust test: GitHub serves PR-only commits by SHA,
           # so resolving the object is not proof a branch or tag of this repo
-          # reaches it. Bare + tree:0 keeps this to the commit graph.
+          # reaches it. Bare + tree:0 keeps this to the commit graph; reftable
+          # because branches that differ only in casing cannot both be stored by
+          # the files backend on a case-insensitive runner disk, which fails the
+          # entire fetch rather than the one ref.
           scratch="$RUNNER_TEMP/vet-requested-ref"
-          git init -q --bare "$scratch"
+          git init -q --bare --ref-format=reftable "$scratch"
           git -C "$scratch" fetch -q --filter=tree:0 "$REPO_URL" '+refs/heads/*:refs/heads/*' '+refs/tags/*:refs/tags/*'
           if ! git -C "$scratch" rev-parse --verify --quiet "$REQUESTED_SHA^{commit}" >/dev/null; then
             echo "::error::Commit $REQUESTED_SHA is not in stablyai/orca."
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index 3560d302a79..a94a7ea2ba5 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -27,6 +27,10 @@ on:
         description: Ref to check out (defaults to the workflow ref)
         required: false
         type: string
+      test_files:
+        description: JSON array of specs to run; empty runs the full suite
+        required: false
+        type: string
   schedule:
     # Why: GitHub cron uses UTC; these slots map to 10am and 3pm
     # America/Phoenix for the default-branch E2E run.
@@ -146,7 +150,7 @@ jobs:
       # Native cache misses need the compiler, Electron needs Xvfb, and paired
       # Quick Open needs ripgrep. Install them in one apt transaction per shard.
       - name: Install native build and headless UI tools
-        run: sudo apt-get update && sudo apt-get install -y build-essential fonts-noto-cjk python3 ripgrep xvfb zsh
+        run: sudo apt-get update && sudo apt-get install -y build-essential fonts-noto-cjk python3 ripgrep xvfb zsh openbox x11-utils
 
       - uses: ./.github/actions/install-node-dependencies
         with:
@@ -167,7 +171,7 @@ jobs:
       # ORCA_E2E_FORWARD_APP_LOGS keeps startup failures visible when Electron
       # launches but never creates a BrowserWindow.
       - name: Run E2E tests (${{ matrix.shard_name }})
-        run: xvfb-run --auto-servernum env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 ORCA_E2E_WEB_CLIENT=1 ORCA_RELAY_PATH="$GITHUB_WORKSPACE/out/relay" pnpm run test:e2e --shard=${{ matrix.shard }}
+        run: xvfb-run --auto-servernum bash .github/scripts/e2e-with-window-manager.sh env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 ORCA_E2E_WEB_CLIENT=1 ORCA_RELAY_PATH="$GITHUB_WORKSPACE/out/relay" pnpm run test:e2e --shard=${{ matrix.shard }}
 
       # Why: Playwright retains traces/screenshots only on failure. Uploading
       # them as an artifact makes post-mortem debugging on CI possible without
@@ -201,7 +205,7 @@ jobs:
         # unbounded inventory fallback; the paired fixture exercises that real boundary.
         # Why openssh-client: the Docker-SSH fixture shells out to ssh/ssh-keygen, and this
         # lane now receives those specs from pr.yml's SSH source mapping.
-        run: sudo apt-get update && sudo apt-get install -y build-essential fonts-noto-cjk openssh-client python3 ripgrep xvfb zsh
+        run: sudo apt-get update && sudo apt-get install -y build-essential fonts-noto-cjk openssh-client python3 ripgrep xvfb zsh openbox x11-utils
 
       - uses: ./.github/actions/install-node-dependencies
         with:
@@ -241,7 +245,7 @@ jobs:
           if grep -l '@headful' "${TEST_FILES[@]}" >/dev/null; then
             E2E_PROJECT_ARGS+=(--project=electron-headful)
           fi
-          xvfb-run --auto-servernum env "${E2E_ENV[@]}" \
+          xvfb-run --auto-servernum bash .github/scripts/e2e-with-window-manager.sh env "${E2E_ENV[@]}" \
             pnpm run test:e2e "${TEST_FILES[@]}" --workers=1 "${E2E_PROJECT_ARGS[@]}"
 
       - name: Upload Playwright traces
@@ -278,7 +282,7 @@ jobs:
           ref: ${{ inputs.ref || github.ref }}
 
       - name: Install native build and headless UI tools
-        run: sudo apt-get update && sudo apt-get install -y build-essential fonts-noto-cjk openssh-client python3 xvfb zsh
+        run: sudo apt-get update && sudo apt-get install -y build-essential fonts-noto-cjk openssh-client python3 ripgrep xvfb zsh openbox x11-utils
 
       - uses: ./.github/actions/install-node-dependencies
         with:
@@ -293,7 +297,7 @@ jobs:
       # Why: this is the release-path proof that the deployed Linux relay keeps
       # its PTY and explorer live across a real watcher SIGSEGV.
       - name: Run Docker SSH watcher isolation E2E
-        run: xvfb-run --auto-servernum env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e:ssh-docker-watcher-isolation
+        run: xvfb-run --auto-servernum bash .github/scripts/e2e-with-window-manager.sh env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e:ssh-docker-watcher-isolation
 
       # Why: Playwright empties test-results/ when it starts, so each step here used to
       # destroy the previous step's traces. Only the last lane's failure was ever
@@ -310,7 +314,7 @@ jobs:
       # readiness across live SSH, headed paired, and headless serve topologies.
       - name: Run Docker SSH terminal parking + startup readiness E2E
         if: always()
-        run: xvfb-run --auto-servernum env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e:ssh-docker-terminal-parking
+        run: xvfb-run --auto-servernum bash .github/scripts/e2e-with-window-manager.sh env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e:ssh-docker-terminal-parking
 
       - name: Keep terminal-parking traces
         if: always()
@@ -326,7 +330,7 @@ jobs:
       # legible as an SSH-named failure.
       - name: Run remaining Docker SSH E2E
         if: always()
-        run: xvfb-run --auto-servernum env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e:ssh-docker
+        run: xvfb-run --auto-servernum bash .github/scripts/e2e-with-window-manager.sh env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e:ssh-docker
 
       - name: Keep remaining-ssh-docker traces
         if: always()
diff --git a/.github/workflows/golden-e2e-experiment.yml b/.github/workflows/golden-e2e-experiment.yml
index d46c80033fa..11cfa866c67 100644
--- a/.github/workflows/golden-e2e-experiment.yml
+++ b/.github/workflows/golden-e2e-experiment.yml
@@ -98,12 +98,17 @@ jobs:
           $env:SKIP_BUILD = '1'
           $env:ORCA_E2E_FORWARD_APP_LOGS = '1'
           pnpm run --if-present test:e2e:workspace-session-golden
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           pnpm run --if-present test:e2e:windows-fresh-startup-golden
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           pnpm run --if-present test:e2e:tab-bar-agent-launch-golden
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           if (Test-Path tests/e2e/golden-fresh-profile-terminal.spec.ts) {
             pnpm run test:e2e -- tests/e2e/golden-fresh-profile-terminal.spec.ts tests/e2e/golden-shell-command.spec.ts
+            if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           }
           pnpm run --if-present test:e2e:source-control-golden
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
 
       - name: Upload Playwright traces
         if: failure()
diff --git a/.github/workflows/hourly-mac-build.yml b/.github/workflows/hourly-mac-build.yml
index ac3af92a3bc..c300b2543b8 100644
--- a/.github/workflows/hourly-mac-build.yml
+++ b/.github/workflows/hourly-mac-build.yml
@@ -26,7 +26,7 @@ name: Hourly macOS Dev Build
 #   HOURLY_RELEASE_APP_ID           the App's numeric id
 #   HOURLY_RELEASE_APP_PRIVATE_KEY  the App's .pem private key
 #
-# Installation tokens live one hour, which is why this mints twice. Install and
+# Installation tokens live one hour, so the build job mints twice. Install and
 # build need no token at all, and notarization can hold the publish step for tens
 # of minutes; minting again once the build is done starts the clock at the first
 # call that actually uses it rather than burning a third of it on `pnpm install`.
@@ -60,33 +60,15 @@ env:
   HOURLY_RETAIN_COUNT: 72
 
 jobs:
-  build-hourly-mac:
+  # Avoid occupying the limited Mac pool when main has not moved.
+  preflight:
     if: github.repository == 'stablyai/orca'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
     outputs:
-      tag: ${{ steps.release.outputs.tag }}
-      version: ${{ steps.hourly.outputs.version }}
+      should_build: ${{ steps.freshness.outputs.should_build }}
       head_sha: ${{ steps.freshness.outputs.head_sha }}
-      published: ${{ steps.publish_live.outcome == 'success' && 'true' || 'false' }}
-    runs-on: blacksmith-6vcpu-macos-15
-    # Why 150: it must exceed the worst case the retry budgets below can produce
-    # (install 3x10 + publish 2x45 = 120, plus ~25 for checkout/build/verify), or
-    # the job is killed mid-retry and no cleanup step runs at all. A typical run
-    # is far shorter — this is the notary queue's tail, not its median.
-    timeout-minutes: 150
-    env:
-      NODE_OPTIONS: --max-old-space-size=4096
     steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          ref: main
-          fetch-depth: 0
-          # Why: this job only reads stablyai/orca and never pushes; every write
-          # goes to the hourly repo through a minted App token passed by env.
-          # Not persisting the checkout credential shrinks the blast radius if a
-          # build step is compromised (zizmor: artipacked).
-          persist-credentials: false
-
       - name: Mint hourly repo token
         id: app_token
         uses: actions/create-github-app-token@v2
@@ -95,18 +77,19 @@ jobs:
           private-key: ${{ secrets.HOURLY_RELEASE_APP_PRIVATE_KEY }}
           owner: stablyai
           repositories: orca-hourly
+          permission-contents: read
 
-      # Why: main is often idle overnight. Rebuilding an unchanged commit burns a
-      # runner hour and adds a redundant tag to the retention window.
       - name: Check whether main moved since the last hourly
         id: freshness
         shell: bash
         env:
           GH_TOKEN: ${{ steps.app_token.outputs.token }}
+          MAIN_REPO_TOKEN: ${{ github.token }}
           FORCED: ${{ github.event_name == 'workflow_dispatch' && inputs.force }}
         run: |
           set -euo pipefail
-          head_sha="$(git rev-parse HEAD)"
+          head_sha="$(GH_TOKEN="$MAIN_REPO_TOKEN" gh api "repos/$GITHUB_REPOSITORY/commits/main" --jq .sha)"
+          [[ "$head_sha" =~ ^[0-9a-f]{40}$ ]] || { echo "::error::Could not resolve main"; exit 1; }
           echo "head_sha=$head_sha" >>"$GITHUB_OUTPUT"
           if [[ "$FORCED" == "true" ]]; then
             echo "should_build=true" >>"$GITHUB_OUTPUT"
@@ -133,21 +116,55 @@ jobs:
             echo "main moved to $head_sha (last hourly built $last_sha); building."
           fi
 
+  build-hourly-mac:
+    needs: preflight
+    if: needs.preflight.outputs.should_build == 'true'
+    outputs:
+      tag: ${{ steps.release.outputs.tag }}
+      version: ${{ steps.hourly.outputs.version }}
+      head_sha: ${{ needs.preflight.outputs.head_sha }}
+      published: ${{ steps.publish_live.outcome == 'success' && 'true' || 'false' }}
+    runs-on: blacksmith-6vcpu-macos-15
+    # Why 150: it must exceed the worst case the retry budgets below can produce
+    # (install 3x10 + publish 2x45 = 120, plus ~25 for checkout/build/verify), or
+    # the job is killed mid-retry and no cleanup step runs at all. A typical run
+    # is far shorter — this is the notary queue's tail, not its median.
+    timeout-minutes: 150
+    env:
+      NODE_OPTIONS: --max-old-space-size=4096
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ needs.preflight.outputs.head_sha }}
+          fetch-depth: 0
+          # Why: this job only reads stablyai/orca and never pushes; every write
+          # goes to the hourly repo through a minted App token passed by env.
+          # Not persisting the checkout credential shrinks the blast radius if a
+          # build step is compromised (zizmor: artipacked).
+          persist-credentials: false
+
+      - name: Mint hourly repo token
+        id: app_token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.HOURLY_RELEASE_APP_ID }}
+          private-key: ${{ secrets.HOURLY_RELEASE_APP_PRIVATE_KEY }}
+          owner: stablyai
+          repositories: orca-hourly
+
       - name: Setup pnpm
-        if: steps.freshness.outputs.should_build == 'true'
         uses: pnpm/setup@v2
         with:
           install: false
 
       - name: Setup Node.js
-        if: steps.freshness.outputs.should_build == 'true'
         uses: actions/setup-node@v6
         with:
           node-version-file: package.json
           cache: pnpm
 
       - name: Cache electron-builder downloads
-        if: steps.freshness.outputs.should_build == 'true'
         uses: actions/cache@v5
         with:
           path: |
@@ -158,7 +175,6 @@ jobs:
             electron-builder-mac-
 
       - name: Install dependencies
-        if: steps.freshness.outputs.should_build == 'true'
         uses: nick-fields/retry@v4
         with:
           timeout_minutes: 10
@@ -169,7 +185,6 @@ jobs:
       # Why: signing is what makes an hourly installable over an existing Orca, so
       # a missing cert must fail here rather than after a 20-minute build.
       - name: Verify macOS signing environment
-        if: steps.freshness.outputs.should_build == 'true'
         run: node config/scripts/verify-macos-release-env.mjs
         env:
           CSC_LINK: ${{ secrets.MAC_CERTS }}
@@ -180,7 +195,6 @@ jobs:
 
       - name: Compute hourly version
         id: hourly
-        if: steps.freshness.outputs.should_build == 'true'
         shell: bash
         env:
           GH_TOKEN: ${{ steps.app_token.outputs.token }}
@@ -211,7 +225,7 @@ jobs:
             node config/scripts/hourly-build-version.mjs \
             >"$RUNNER_TEMP/hourly-identity.txt"
           grep -E '^(version|build_number)=' "$RUNNER_TEMP/hourly-identity.txt"
-          # Why check rather than trust: the checkout above pins `ref: main`, but a
+          # Why check rather than trust: the checkout above pins the resolved main commit, but a
           # workflow_dispatch runs this file from whatever branch was dispatched. A
           # branch that edits this step while main still has the old script yields
           # an empty name and an untitled release — silent, and only visible once
@@ -223,7 +237,6 @@ jobs:
           cat "$RUNNER_TEMP/hourly-identity.txt" >>"$GITHUB_OUTPUT"
 
       - name: Build app
-        if: steps.freshness.outputs.should_build == 'true'
         run: pnpm build:release
         env:
           NODE_OPTIONS: --max-old-space-size=4096
@@ -239,7 +252,6 @@ jobs:
       # part the full budget.
       - name: Re-mint hourly repo token for publish
         id: app_token_publish
-        if: steps.freshness.outputs.should_build == 'true'
         uses: actions/create-github-app-token@v2
         with:
           app-id: ${{ secrets.HOURLY_RELEASE_APP_ID }}
@@ -249,13 +261,12 @@ jobs:
 
       - name: Create hourly release
         id: release
-        if: steps.freshness.outputs.should_build == 'true'
         shell: bash
         env:
           GH_TOKEN: ${{ steps.app_token_publish.outputs.token }}
           TAG: v${{ steps.hourly.outputs.version }}
           NAME: ${{ steps.hourly.outputs.name }}
-          SHA: ${{ steps.freshness.outputs.head_sha }}
+          SHA: ${{ needs.preflight.outputs.head_sha }}
         run: |
           set -euo pipefail
           # Kept at 12 even though the title shows 7: the freshness check above
@@ -291,7 +302,6 @@ jobs:
           echo "tag=$TAG" >>"$GITHUB_OUTPUT"
 
       - name: Publish hourly macOS artifacts
-        if: steps.freshness.outputs.should_build == 'true'
         uses: nick-fields/retry@v4
         with:
           # Why 45 like the release pipeline: an attempt is pack + notarize +
@@ -322,7 +332,6 @@ jobs:
       # release missing that manifest is a tag the picker offers and the download
       # 404s on, so fail loudly instead of leaving a broken entry.
       - name: Verify update manifest published
-        if: steps.freshness.outputs.should_build == 'true'
         shell: bash
         env:
           GH_TOKEN: ${{ steps.app_token_publish.outputs.token }}
@@ -352,7 +361,6 @@ jobs:
       # means the picker can never offer a release whose assets are incomplete.
       - name: Publish the verified release
         id: publish_live
-        if: steps.freshness.outputs.should_build == 'true'
         shell: bash
         env:
           GH_TOKEN: ${{ steps.app_token_publish.outputs.token }}
diff --git a/.github/workflows/mobile.yml b/.github/workflows/mobile.yml
index 59f6cf20bf4..6dbfc02aa3c 100644
--- a/.github/workflows/mobile.yml
+++ b/.github/workflows/mobile.yml
@@ -15,8 +15,13 @@ on:
       # Why: this job holds the only checks that load the Fastfile, so edits to
       # it or to the release workflow it guards must re-run them.
       - '.github/workflows/mobile.yml'
+      - '.github/actions/install-node-dependencies/**'
       - '.github/workflows/mobile-ios-release.yml'
 
+concurrency:
+  group: mobile-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   verify:
     runs-on: ubuntu-latest
@@ -35,10 +40,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6
 
-      - name: Setup Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version-file: package.json
+      - uses: ./.github/actions/install-node-dependencies
 
       # bundler-cache installs mobile/Gemfile.lock, so this job is also what
       # proves the pinned fastlane the release workflow depends on still
@@ -50,23 +52,6 @@ jobs:
           bundler-cache: true
           working-directory: mobile
 
-      - name: Setup pnpm
-        uses: pnpm/setup@v2
-        with:
-          install: false
-
-      # Why: the mobile typecheck imports shared types from ../src/shared, and
-      # some of those files import runtime deps (tweetnacl, ws) resolved from
-      # the repo-root node_modules. Without a root install, tsc fails with
-      # "Cannot find module 'tweetnacl'/'ws'". Mobile is a separate pnpm project
-      # (not in the root workspace), so this is a distinct install.
-      # --ignore-scripts skips the root postinstall (Electron native-module
-      # rebuild) which is irrelevant to a type-only check and would only add
-      # time and failure surface on this ubuntu mobile runner.
-      - name: Install root dependencies
-        working-directory: .
-        run: pnpm install --frozen-lockfile --ignore-scripts
-
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
diff --git a/.github/workflows/performance-contracts.yml b/.github/workflows/performance-contracts.yml
new file mode 100644
index 00000000000..d45d8b8f45a
--- /dev/null
+++ b/.github/workflows/performance-contracts.yml
@@ -0,0 +1,63 @@
+name: Performance contracts
+
+on:
+  schedule:
+    - cron: '15 9 * * *'
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - '.github/workflows/performance-contracts.yml'
+      - 'config/vitest.performance.config.ts'
+      - 'config/oxlint-performance-audit.json'
+      - 'config/oxlint-plugins/*performance.mjs'
+      - 'config/oxlint-plugins/quadratic-buffer-concat.mjs'
+      - 'config/scripts/*-plugin.test.mjs'
+      # Keep in sync with the contract list in config/vitest.performance.config.ts;
+      # without these a rename lands green and only breaks the next nightly.
+      - 'src/main/sqlite/sync-database.test.ts'
+      - 'src/main/runtime/orchestration/db/row-column-lists.test.ts'
+      - 'src/relay/fs-path-metadata-symlink-concurrency.test.ts'
+      - 'src/renderer/src/components/editor/rich-markdown-list-tokenizers.test.ts'
+      - 'src/renderer/src/components/editor/rich-markdown-lowlight-cache.test.ts'
+      - 'src/renderer/src/components/terminal-pane/agent-completion-coordinator-queued-inspection-disposal.test.ts'
+      - 'src/renderer/src/lib/pane-manager/pane-terminal-output-scheduler-queue-retention.test.ts'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: performance-contracts-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  contracts:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/install-node-dependencies
+      - name: Run operation-count and retention contracts
+        run: pnpm test:perf:contracts --reporter=default --reporter=json --outputFile=performance-contracts.json
+      # Source-only scan: identical on every OS, so run it once.
+      - name: Audit production performance patterns
+        if: always() && matrix.os == 'ubuntu-latest'
+        shell: bash
+        run: pnpm --silent audit:perf > performance-audit.json
+      - uses: actions/upload-artifact@v7
+        if: always()
+        with:
+          name: performance-contracts-${{ matrix.os }}
+          path: performance-contracts.json
+          if-no-files-found: error
+      - uses: actions/upload-artifact@v7
+        if: always() && matrix.os == 'ubuntu-latest'
+        with:
+          name: performance-audit
+          path: performance-audit.json
+          if-no-files-found: error
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index ca1651325c9..bd655eb801a 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -41,6 +41,10 @@ jobs:
       managed_hook_node18: ${{ steps.filter.outputs.managed_hook_node18 }}
       package: ${{ steps.filter.outputs.package }}
       package_windows: ${{ steps.filter.outputs.package_windows }}
+      e2e_should_run: ${{ steps.e2e_filter.outputs.should_run }}
+      test_files: ${{ steps.e2e_filter.outputs.test_files }}
+      ssh_source_changed: ${{ steps.e2e_filter.outputs.ssh_source_changed }}
+      native_ime_source_changed: ${{ steps.e2e_filter.outputs.native_ime_source_changed }}
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -66,6 +70,38 @@ jobs:
           printf '%s\n' "$CHANGED"
           printf '%s\n' "$CHANGED" | node config/scripts/pr-code-change-scope.mjs | tee -a "$GITHUB_OUTPUT"
 
+      # Reuse the path-detector checkout instead of queuing another runner.
+      - name: Filter changed E2E specs
+        id: e2e_filter
+        if: github.event.pull_request.draft != true && steps.filter.outputs.should_run == 'true'
+        run: |
+          set -euo pipefail
+          BASE="${{ github.event.pull_request.base.sha }}"
+          HEAD="${{ github.event.pull_request.head.sha }}"
+          CHANGED="$(git diff --name-only --diff-filter=AMCR --merge-base "$BASE" "$HEAD")"
+          # Source routes are executable contracts so a test can prove exact
+          # authorities, exclusions, and sentinels without evaluating workflow shell.
+          TEST_FILES_JSON="$(printf '%s\n' "$CHANGED" | node config/scripts/pr-e2e-source-routing.mjs)"
+          echo "test_files=$TEST_FILES_JSON" >> "$GITHUB_OUTPUT"
+          # Why a separate signal: the Docker-SSH lane must trigger on SSH source, not on a
+          # spec name surviving in a route's list. Same routes, so the two cannot drift.
+          SSH_SOURCE_CHANGED="$(printf '%s\n' "$CHANGED" | node config/scripts/pr-e2e-source-routing.mjs --ssh-source)"
+          echo "ssh_source_changed=$SSH_SOURCE_CHANGED" >> "$GITHUB_OUTPUT"
+          echo "SSH source changed: $SSH_SOURCE_CHANGED"
+          # Why its own signal: the real-IME lane is a whole ibus session, not a spec, so it must
+          # trigger on IME source rather than on a spec name in some route's list.
+          NATIVE_IME_SOURCE_CHANGED="$(printf '%s\n' "$CHANGED" | node config/scripts/pr-e2e-source-routing.mjs --native-ime-source)"
+          echo "native_ime_source_changed=$NATIVE_IME_SOURCE_CHANGED" >> "$GITHUB_OUTPUT"
+          echo "Native IME source changed: $NATIVE_IME_SOURCE_CHANGED"
+          SHOULD_RUN="$(printf '%s\n' "$CHANGED" | node config/scripts/pr-e2e-source-routing.mjs --reusable-workflow)"
+          if [ "$SHOULD_RUN" = true ]; then
+            echo "should_run=true" >> "$GITHUB_OUTPUT"
+            echo "Changed E2E specs: $TEST_FILES_JSON"
+          else
+            echo "should_run=false" >> "$GITHUB_OUTPUT"
+            echo "No specs requiring the reusable E2E workflow"
+          fi
+
   static_analysis:
     name: static analysis
     needs: [code_paths]
@@ -712,7 +748,11 @@ jobs:
       - name: Package unpacked app
         env:
           ORCA_REUSE_PREPARED_NATIVE_RUNTIME: '1'
-        run: pnpm exec electron-builder --config config/electron-builder.config.cjs --linux AppImage deb rpm --x64 --publish never
+        # PR artifacts are only inspected locally; gzip avoids release-size xz compression.
+        run: >-
+          pnpm exec electron-builder --config config/electron-builder.config.cjs
+          --linux AppImage deb rpm --x64 --publish never
+          --config.deb.compression=gz --config.rpm.compression=gzip
 
       - name: Verify root-package marker payloads
         run: |
@@ -792,10 +832,13 @@ jobs:
             node_modules/.pnpm/@vscode+windows-process-tree@*/node_modules/@vscode/windows-process-tree/build
           key: native-modules-${{ runner.os }}-${{ steps.deps.outputs.native-cache-scope }}-${{ runner.arch }}-node-node${{ steps.deps.outputs.node-version }}-${{ hashFiles('pnpm-lock.yaml', '.github/actions/install-node-dependencies/action.yml', 'config/scripts/ensure-native-runtime.mjs', 'config/scripts/rebuild-native-deps.mjs', 'config/patches/node-pty@1.1.0.patch', 'config/patches/@vscode__windows-process-tree@0.8.0.patch') }}
 
+      # vitest runs here directly rather than through `pnpm test`, so the addon
+      # assertions only hold once install-node-dependencies has rebuilt natives.
       - name: Test Windows-specific boundaries
         run: >-
           pnpm exec vitest run --config config/vitest.config.ts
           config/scripts/rebuild-native-deps.test.mjs
+          config/scripts/rebuild-native-deps-windows-process-tree.test.mjs
           src/main/browser/browser-client-page-renderer-lifecycle.electron.test.ts
           src/main/browser/browser-route-tcp-egress.electron.test.ts
           src/main/browser/browser-route-webrtc-egress.electron.test.ts
@@ -804,9 +847,14 @@ jobs:
           src/main/providers/windows-conpty-wide-char-duplication.node-pty.test.ts
           src/main/providers/pty-repaint-wide-char-buffer.node-pty.test.ts
           src/shared/child-process/windows-command-line.win32.test.ts
+          src/shared/child-process/windows-cmd-shim-resolution.test.ts
+          src/shared/child-process/windows-cmd-shim-resolution.win32.test.ts
           src/main/agent-hooks/windows-hook-payload-delivery.test.ts
+          src/main/agent-hooks/windows-direct-cmd-hook-command.test.ts
           src/main/windows/windows-pty-job.win32.test.ts
           src/main/windows/windows-host-job.win32.test.ts
+          src/main/windows/windows-process-tree-command-line-patch.test.ts
+          src/main/windows-live-tree-kill.win32.test.ts
           src/main/wsl/wsl-runner.test.ts
           src/main/wsl/wsl-guest-environment.test.ts
           src/main/wsl/wsl-invocation-boundary.test.ts
@@ -814,14 +862,18 @@ jobs:
           src/main/wsl/wsl-w1-w3-contract.test.ts
           src/shared/source-scan/source-tree-scan.test.ts
           src/main/cli/wsl-cli-powershell-boundary.test.ts
+          src/main/computer/desktop-script-runtime-host.win32.test.ts
           src/main/cursor/hook-service.test.ts
           src/main/orca-profiles/profile-index-store.test.ts
           src/main/startup/windows-install-dir-acl-repair.win32.test.ts
           src/main/runtime/repo-worktree-admin-fingerprint.test.ts
           src/main/runtime/worktree-scan-admin-fingerprint-gate.test.ts
           src/shared/secure-file-fsync-flags.test.ts
+          src/shared/secure-path-windows-acl.win32.test.ts
+          src/main/runtime/unreadable-secret-store-preservation.win32.test.ts
           src/main/ipc/pty-codex-account-attribution.test.ts
           src/main/ipc/pty-spawn-env-codex-resume-provenance.test.ts
+          src/relay/windows-port-scan.win32.test.ts
 
       # Why the :parallel variant: identical to build:release except the three
       # electron-vite targets overlap instead of running back to back. The Linux package
@@ -860,65 +912,10 @@ jobs:
       - name: Smoke packaged CLI
         run: node config/scripts/smoke-packaged-cli.mjs --app-dir=dist/win-unpacked
 
-  # Why: PR E2E is advisory and only validates changed specs; scheduled and
-  # release runs retain full-suite coverage.
-  e2e-paths:
-    name: detect changed e2e specs
-    needs: [code_paths]
-    runs-on: ubuntu-latest
-    if: github.event.pull_request.draft != true && needs.code_paths.outputs.should_run == 'true'
-    # Why: detector only needs to read the checkout; do not inherit repo defaults.
-    permissions:
-      contents: read
-    outputs:
-      should_run: ${{ steps.filter.outputs.should_run }}
-      test_files: ${{ steps.filter.outputs.test_files }}
-      ssh_source_changed: ${{ steps.filter.outputs.ssh_source_changed }}
-      native_ime_source_changed: ${{ steps.filter.outputs.native_ime_source_changed }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          # Why blob:none: full history is needed for the merge-base diff, but historical
-          # file contents are not. Blobs are ~89% of this repo's pack, and Git fetches the
-          # few this job actually reads on demand.
-          fetch-depth: 0
-          filter: blob:none
-          persist-credentials: false
-
-      - name: Filter changed E2E specs
-        id: filter
-        run: |
-          set -euo pipefail
-          BASE="${{ github.event.pull_request.base.sha }}"
-          HEAD="${{ github.event.pull_request.head.sha }}"
-          CHANGED="$(git diff --name-only --diff-filter=AMCR --merge-base "$BASE" "$HEAD")"
-          # Source routes are executable contracts so a test can prove exact
-          # authorities, exclusions, and sentinels without evaluating workflow shell.
-          TEST_FILES_JSON="$(printf '%s\n' "$CHANGED" | node config/scripts/pr-e2e-source-routing.mjs)"
-          echo "test_files=$TEST_FILES_JSON" >> "$GITHUB_OUTPUT"
-          # Why a separate signal: the Docker-SSH lane must trigger on SSH source, not on a
-          # spec name surviving in a route's list. Same routes, so the two cannot drift.
-          SSH_SOURCE_CHANGED="$(printf '%s\n' "$CHANGED" | node config/scripts/pr-e2e-source-routing.mjs --ssh-source)"
-          echo "ssh_source_changed=$SSH_SOURCE_CHANGED" >> "$GITHUB_OUTPUT"
-          echo "SSH source changed: $SSH_SOURCE_CHANGED"
-          # Why its own signal: the real-IME lane is a whole ibus session, not a spec, so it must
-          # trigger on IME source rather than on a spec name in some route's list.
-          NATIVE_IME_SOURCE_CHANGED="$(printf '%s\n' "$CHANGED" | node config/scripts/pr-e2e-source-routing.mjs --native-ime-source)"
-          echo "native_ime_source_changed=$NATIVE_IME_SOURCE_CHANGED" >> "$GITHUB_OUTPUT"
-          echo "Native IME source changed: $NATIVE_IME_SOURCE_CHANGED"
-          if [ "$TEST_FILES_JSON" != '[]' ]; then
-            echo "should_run=true" >> "$GITHUB_OUTPUT"
-            echo "Changed E2E specs: $TEST_FILES_JSON"
-          else
-            echo "should_run=false" >> "$GITHUB_OUTPUT"
-            echo "No changed E2E specs"
-          fi
-
   e2e:
     name: e2e
-    needs: e2e-paths
-    if: needs.e2e-paths.outputs.should_run == 'true'
+    needs: code_paths
+    if: needs.code_paths.outputs.e2e_should_run == 'true'
     # Why: reusable e2e.yml only checkouts, builds, and uploads artifacts.
     permissions:
       contents: read
@@ -927,8 +924,8 @@ jobs:
       # The synthetic pull-request merge ref can disappear while this reusable
       # workflow is queued. The head SHA is immutable and works for every PR.
       ref: ${{ github.event.pull_request.head.sha }}
-      test_files: ${{ needs.e2e-paths.outputs.test_files }}
-      ssh_source_changed: ${{ needs.e2e-paths.outputs.ssh_source_changed }}
+      test_files: ${{ needs.code_paths.outputs.test_files }}
+      ssh_source_changed: ${{ needs.code_paths.outputs.ssh_source_changed }}
 
   # Why this is not in verify's needs: it is the first PR-gate run of a harness whose reliability
   # is only known from nightly main runs (20/20 green, 2026-08-09..2026-08-29, p50 3m25s). It
@@ -938,8 +935,8 @@ jobs:
   # require `success || skipped` outside the strict loop — see the note on `e2e`.
   terminal_ime_native:
     name: real IME
-    needs: e2e-paths
-    if: needs.e2e-paths.outputs.native_ime_source_changed == 'true'
+    needs: code_paths
+    if: needs.code_paths.outputs.native_ime_source_changed == 'true'
     # Why: the reusable workflow only checks out, builds, and uploads artifacts.
     permissions:
       contents: read
diff --git a/.github/workflows/release-cut.yml b/.github/workflows/release-cut.yml
index 6f888c3a512..c2124d12990 100644
--- a/.github/workflows/release-cut.yml
+++ b/.github/workflows/release-cut.yml
@@ -809,13 +809,7 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TAG: ${{ needs.cut.outputs.tag }}
-        run: |
-          if gh release view "$TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
-            echo "Release $TAG already exists."
-            exit 0
-          fi
-
-          node config/scripts/create-draft-release.mjs "$TAG"
+        run: node config/scripts/create-draft-release.mjs "$TAG"
 
   terminal-rendering-golden:
     needs: cut
@@ -858,16 +852,17 @@ jobs:
         if: runner.os == 'Linux'
         run: sudo apt-get update && sudo apt-get install -y build-essential python3 xvfb
 
-      - name: Setup Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version-file: package.json
-
       - name: Setup pnpm
         uses: pnpm/setup@v2
         with:
           install: false
 
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: package.json
+          cache: pnpm
+
       # Why: Linux terminal golden E2E uses the same native install path as
       # release CI, which needs pnpm to bypass its non-executable gyp_main.py.
       - name: Use external node-gyp to avoid pnpm's bundled copy (Linux only)
@@ -1074,16 +1069,17 @@ jobs:
         if: runner.os == 'Linux'
         run: sudo apt-get update && sudo apt-get install -y build-essential python3 xvfb
 
-      - name: Setup Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version-file: package.json
-
       - name: Setup pnpm
         uses: pnpm/setup@v2
         with:
           install: false
 
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: package.json
+          cache: pnpm
+
       # Why: keep the non-blocking evidence lane on the same Linux native
       # install path as the blocking golden and release build jobs.
       - name: Use external node-gyp to avoid pnpm's bundled copy (Linux only)
@@ -1425,6 +1421,17 @@ jobs:
           command: ${{ matrix.release_command }}
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # Why: the NSIS uninstaller only exists inside electron-builder's
+          # uninstaller pass, which deletes it right after embedding it. The sign
+          # hook in config/scripts/windows-uninstaller-signing.cjs copies it out
+          # here so it can ride the inner-binaries SignPath request below.
+          # Why runner.temp and never the workspace: `files` in
+          # config/electron-builder.config.cjs is all-negation, so app-builder
+          # prepends `**/*` and packs whatever is left in the checkout root. This
+          # step retries up to 3 times; attempt 1 writes the file after packing,
+          # but attempts 2 and 3 would then pack the unsigned uninstaller into
+          # app.asar - the exact defect this chain exists to remove.
+          ORCA_WIN_UNINSTALLER_EXPORT_PATH: ${{ runner.temp }}\uninstaller-signing\unsigned\orca-uninstaller.exe
 
       - name: Verify Windows node-pty ConPTY runtime
         if: matrix.platform == 'win' && github.run_attempt == 1
@@ -1451,7 +1458,10 @@ jobs:
       # Why: SignPath cannot deep-sign inside NSIS installers, so inner PE
       # files (Orca.exe, node-pty *.node, DLLs) are signed via a separate zip
       # request, then the installer is rebuilt from the signed tree before the
-      # existing installer signing request below. Every step in this chain is
+      # existing installer signing request below. The NSIS uninstaller rides
+      # this same request (it is the MDE update cluster: old-uninstaller.exe /
+      # Uninstall Orca.exe), captured through electron-builder's sign hook and
+      # swapped back in during the rebuild — no third approval wait. Every step is
       # fail-open (continue-on-error + outcome gating): any failure ships the
       # original installer with unsigned inner binaries, exactly like releases
       # did before this chain existed. Rehearsed end to end in run 28988432001
@@ -1498,6 +1508,36 @@ jobs:
           Write-Host "Skipped $($skipped.Count) already-signed files:"
           $skipped | ForEach-Object { Write-Host "  $_" }
 
+          # Why the uninstaller rides this request: it is the file MDE flagged in
+          # the whole update cluster (old-uninstaller.exe / Uninstall Orca.exe),
+          # and folding it in here costs no extra approval wait. Why it is kept
+          # out of inner-signing-list.txt: that list drives the copy-back into
+          # dist/win-unpacked, and the uninstaller does not live there — it is
+          # re-injected through the sign hook during the rebuild instead.
+          # Why this name and not "Uninstall Orca.exe": the restore loop below
+          # matches staged files by suffix (`-like "*$relative"`) and takes the
+          # first hit, so any staged path ending in "Orca.exe" is separated from
+          # the real Orca.exe only by Get-ChildItem's enumeration order. That
+          # order happens to favour the root file today, but it is not a
+          # documented guarantee; a name that cannot suffix-match is.
+          # Why the whole block is caught rather than just Test-Path'd: this
+          # step's outcome gates the upload of every inner binary, so a locked
+          # file or a full disk here would cost all of them their signatures -
+          # worse than shipping no uninstaller signature at all.
+          try {
+            $exportedUninstaller = Join-Path $env:RUNNER_TEMP 'uninstaller-signing\unsigned\orca-uninstaller.exe'
+            if (Test-Path -LiteralPath $exportedUninstaller) {
+              $uninstallerStagePath = Join-Path $stage.FullName 'uninstaller\orca-uninstaller.exe'
+              New-Item -ItemType Directory -Force -Path (Split-Path $uninstallerStagePath) -ErrorAction Stop | Out-Null
+              Copy-Item -LiteralPath $exportedUninstaller -Destination $uninstallerStagePath -Force -ErrorAction Stop
+              Write-Host 'Staged the NSIS uninstaller for signing: uninstaller\orca-uninstaller.exe'
+            } else {
+              Write-Host "::warning::No exported NSIS uninstaller at $exportedUninstaller; this release ships an unsigned uninstaller (fail-open)."
+            }
+          } catch {
+            Write-Host "::warning::Could not stage the NSIS uninstaller ($_); this release ships an unsigned uninstaller (fail-open)."
+          }
+
       - name: Upload unsigned inner binaries for SignPath
         id: upload-unsigned-inner
         if: matrix.platform == 'win' && github.run_attempt == 1 && steps.stage-inner.outcome == 'success'
@@ -1642,6 +1682,31 @@ jobs:
             throw "Signed inner artifact did not round-trip cleanly ($($failures.Count) failures)."
           }
 
+      # Why gated separately from the inner restore above: if SignPath's
+      # windows-inner-binaries-zip artifact configuration does not (yet) cover the
+      # uninstaller/ directory, the uninstaller comes back missing. That must cost
+      # only the uninstaller signature — the rebuild below still runs and still
+      # ships the signed inner binaries, exactly as it does today.
+      - name: Restore signed uninstaller for the installer rebuild
+        id: restore-signed-uninstaller
+        if: matrix.platform == 'win' && github.run_attempt == 1 && steps.restore-signed-inner.outcome == 'success'
+        continue-on-error: true
+        shell: pwsh
+        run: |
+          $signed = Get-ChildItem -Path signed-inner -Recurse -File -Filter 'orca-uninstaller.exe' |
+            Select-Object -First 1
+          if ($null -eq $signed) {
+            throw 'SignPath did not return uninstaller/orca-uninstaller.exe; check the windows-inner-binaries-zip artifact configuration covers it.'
+          }
+          $signature = Get-AuthenticodeSignature -FilePath $signed.FullName
+          if ($null -eq $signature.SignerCertificate) {
+            throw 'The returned NSIS uninstaller carries no signature.'
+          }
+          $signedDir = Join-Path $env:RUNNER_TEMP 'uninstaller-signing\signed'
+          New-Item -ItemType Directory -Force -Path $signedDir | Out-Null
+          Copy-Item -LiteralPath $signed.FullName -Destination (Join-Path $signedDir 'orca-uninstaller.exe') -Force
+          Write-Host ("{0,-14} uninstaller  <{1}>" -f $signature.Status, $signature.SignerCertificate.Subject)
+
       # Why this step exists: electron-builder's CopyElevateHelper re-copies a
       # pristine elevate.exe from its download cache over resources\elevate.exe
       # on EVERY nsis pack — including the --prepackaged rebuild below — which
@@ -1651,9 +1716,12 @@ jobs:
       # no-op. Known quirk: the cache persists across releases via actions/cache,
       # so later runs may see elevate.exe as already signed and skip staging it —
       # that is fine (the signature is timestamped) and the evidence gate checks
-      # elevate.exe in the shipped installer unconditionally. If this ever causes
-      # trouble, delete this step; the only effect is elevate.exe shipping
-      # unsigned again, which the evidence gate will flag.
+      # elevate.exe in the shipped installer unconditionally.
+      #
+      # The cache lookup lives in a script because the inline path this step used
+      # (`<cache>\nsis`) matches no app-builder-lib layout, and `SilentlyContinue`
+      # plus `exit 0` turned that miss into a green step — v1.4.193 and v1.4.194
+      # shipped an unsigned elevate.exe that way. A miss now fails the step.
       - name: Replace cached elevate.exe with the signed copy
         id: sign-elevate-cache
         if: matrix.platform == 'win' && github.run_attempt == 1 && steps.restore-signed-inner.outcome == 'success'
@@ -1665,20 +1733,26 @@ jobs:
             Write-Host '::warning::No elevate.exe in win-unpacked resources; nothing to protect from the rebuild clobber.'
             exit 0
           }
+          # Why this guard stays: windows-signing-rehearsal.yml shares the
+          # electron-builder-win-<lockfile hash> cache key with this workflow, so a
+          # test-certificate elevate.exe must never be staged into a release cache.
           $signature = Get-AuthenticodeSignature -FilePath $signed
           $subject = if ($null -eq $signature.SignerCertificate) { '<none>' } else { $signature.SignerCertificate.Subject }
           if ($signature.Status -ne 'Valid' -or $subject -notlike '*CN=SignPath Foundation*') {
             Write-Host "::warning::win-unpacked elevate.exe is not SignPath-signed ($($signature.Status), $subject); skipping cache swap."
             exit 0
           }
-          $cached = @(Get-ChildItem "$env:LOCALAPPDATA\electron-builder\Cache\nsis" -Recurse -Filter elevate.exe -ErrorAction SilentlyContinue)
-          if ($cached.Count -eq 0) {
-            Write-Host '::warning::No cached elevate.exe found (electron-builder cache layout changed?); the rebuild will pack the unsigned copy and the evidence gate will flag it.'
-            exit 0
-          }
-          foreach ($file in $cached) {
-            Copy-Item -Path $signed -Destination $file.FullName -Force
-            Write-Host "Replaced $($file.FullName) with the SignPath-signed copy."
+          node config/scripts/replace-cached-nsis-elevate.mjs $signed
+          if ($LASTEXITCODE -ne 0) {
+            $message = 'Cached elevate.exe swap found nothing to replace; the rebuilt installer ships an unsigned UAC elevation helper (issue #7785).'
+            if ($env:GITHUB_STEP_SUMMARY) {
+              try {
+                Add-Content -Path $env:GITHUB_STEP_SUMMARY -Value "**Windows elevate.exe cache swap:** FAILED — $message" -ErrorAction Stop
+              } catch {
+                Write-Host "::warning::Could not write the elevate.exe swap verdict to the job summary: $_"
+              }
+            }
+            throw $message
           }
 
       - name: Rebuild NSIS installer from signed unpacked app
@@ -1686,6 +1760,11 @@ jobs:
         if: matrix.platform == 'win' && github.run_attempt == 1 && steps.restore-signed-inner.outcome == 'success'
         continue-on-error: true
         shell: pwsh
+        env:
+          # Why unconditional: the sign hook keys off the file existing, which it
+          # only does when the restore step above succeeded. A missing file logs a
+          # warning and embeds the freshly built unsigned uninstaller instead.
+          ORCA_WIN_UNINSTALLER_SIGNED_PATH: ${{ runner.temp }}\uninstaller-signing\signed\orca-uninstaller.exe
         run: |
           # Why: keep the pre-rebuild artifacts so a failed rebuild can fall
           # back to shipping them unchanged (fail-open).
@@ -1716,6 +1795,7 @@ jobs:
         with:
           name: orca-windows-unsigned-${{ needs.cut.outputs.tag }}
           path: dist/orca-windows-setup.exe
+          compression-level: 0
           if-no-files-found: error
 
       # Why: SignPath Foundation production certificates require manual review,
@@ -1876,6 +1956,7 @@ jobs:
         env:
           ORCA_WINDOWS_INNER_SIGNATURE_REQUIRED: 'false'
           INNER_SIGNING_COMPLETED: ${{ steps.rebuild-nsis-signed.outcome == 'success' }}
+          UNINSTALLER_SIGNING_COMPLETED: ${{ steps.restore-signed-uninstaller.outcome == 'success' }}
         run: |
           $required = $env:ORCA_WINDOWS_INNER_SIGNATURE_REQUIRED -eq 'true'
 
@@ -1956,6 +2037,39 @@ jobs:
             if ($targets -notcontains 'resources\elevate.exe') {
               $targets += 'resources\elevate.exe'
             }
+            # Why the uninstaller is not in $targets: NSIS embeds it in its own
+            # compressed data section (`File /oname=${UNINSTALL_FILENAME}` in
+            # app-builder-lib templates/nsis/include/installer.nsh), not in the
+            # app 7z payload extracted above - the bundled 7za cannot see it.
+            # What the receipt proves and does not: the digest comparison is
+            # equal by construction (the hook digests the bytes it copied from
+            # this same file), so the real signal is that the receipt exists at
+            # all - the import leg ran, and these are the bytes it embedded. The
+            # signature check below is the part with teeth. The shipped-artifact
+            # check lives in windows-signing-rehearsal.yml, which installs the
+            # installer and inspects the uninstaller it drops on disk.
+            if ($env:UNINSTALLER_SIGNING_COMPLETED -eq 'true') {
+              $signedUninstaller = Join-Path $env:RUNNER_TEMP 'uninstaller-signing\signed\orca-uninstaller.exe'
+              $receipt = "$signedUninstaller.embedded-sha256"
+              if (-not (Test-Path -LiteralPath $receipt)) {
+                $failures.Add('the sign hook did not embed the signed uninstaller into the rebuilt installer')
+              } else {
+                $embedded = (Get-Content -LiteralPath $receipt -Raw).Trim()
+                $actual = (Get-FileHash -LiteralPath $signedUninstaller -Algorithm SHA256).Hash.ToLowerInvariant()
+                $signature = Get-AuthenticodeSignature -FilePath $signedUninstaller
+                $subject = if ($null -eq $signature.SignerCertificate) { '<none>' } else { $signature.SignerCertificate.Subject }
+                $line = "{0,-14} {1}  <{2}>" -f $signature.Status, 'Uninstall Orca.exe (embedded)', $subject
+                $report.Add($line)
+                Write-Host $line
+                if ($embedded -ne $actual) {
+                  $failures.Add("the rebuilt installer embedded different uninstaller bytes than the signed one ($embedded vs $actual)")
+                } elseif ($signature.Status -ne 'Valid' -or $subject -notlike '*CN=SignPath Foundation*') {
+                  $failures.Add("not signed by SignPath Foundation: Uninstall Orca.exe ($($signature.Status), $subject)")
+                }
+              }
+            } else {
+              Write-Host '::warning::The NSIS uninstaller was not signed on this run; it is excluded from the evidence gate (fail-open).'
+            }
             foreach ($relative in $targets) {
               $path = Join-Path $root $relative
               if (-not (Test-Path $path)) {
@@ -1988,7 +2102,9 @@ jobs:
               Add-GateEvidence "VERDICT: FAILED — $message"
               Add-GateSummary "FAILED — $message"
             } else {
-              $ok = "All $($targets.Count) inner binaries in the shipped installer are signed by SignPath Foundation."
+              # $report, not $targets: the embedded uninstaller is reported but
+              # is not one of the extracted payload targets.
+              $ok = "All $($report.Count) checked binaries are signed by SignPath Foundation."
               Add-GateEvidence "VERDICT: PASSED — $ok"
               Add-GateSummary "PASSED — $ok"
               Write-Host $ok
diff --git a/.github/workflows/release-ref-validation.yml b/.github/workflows/release-ref-validation.yml
new file mode 100644
index 00000000000..6995f9db174
--- /dev/null
+++ b/.github/workflows/release-ref-validation.yml
@@ -0,0 +1,38 @@
+name: Release ref validation
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/adhoc-mac-build.yml'
+      - '.github/workflows/dev-channel-win-build.yml'
+      - '.github/workflows/release-ref-validation.yml'
+      - 'config/scripts/workflow-ref-reachability.test.mjs'
+      - 'config/scripts/workflow-ref-mirror-case-safety.test.mjs'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-ref-validation-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  validate:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-15, windows-2022]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/install-node-dependencies
+      - name: Verify case-twin refs and release trust boundary
+        run: >-
+          pnpm exec vitest run --config config/vitest.config.ts
+          config/scripts/workflow-ref-reachability.test.mjs
+          config/scripts/workflow-ref-mirror-case-safety.test.mjs
+          config/scripts/dev-channel-windows-workflow-contract.test.mjs
diff --git a/.github/workflows/skill-update-roundtrip.yml b/.github/workflows/skill-update-roundtrip.yml
index 71fcf264f69..96de1101275 100644
--- a/.github/workflows/skill-update-roundtrip.yml
+++ b/.github/workflows/skill-update-roundtrip.yml
@@ -22,6 +22,10 @@ on:
       - main
     paths: *skill-roundtrip-paths
 
+concurrency:
+  group: skill-roundtrip-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   roundtrip:
     strategy:
@@ -41,7 +45,9 @@ jobs:
     steps:
       - uses: actions/checkout@v6
         with:
+          # Historical skill snapshots need tags, but only their blobs are read.
           fetch-depth: 0
+          filter: blob:none
           persist-credentials: false
       - uses: actions/setup-node@v6
         with:
diff --git a/.github/workflows/terminal-ime-e2e.yml b/.github/workflows/terminal-ime-e2e.yml
index b9957b2daa9..1ab905d8783 100644
--- a/.github/workflows/terminal-ime-e2e.yml
+++ b/.github/workflows/terminal-ime-e2e.yml
@@ -38,23 +38,9 @@ jobs:
           xfwm4
           xvfb
 
-      - name: Setup Node.js
-        uses: actions/setup-node@v6
+      - uses: ./.github/actions/install-node-dependencies
         with:
-          node-version-file: package.json
-
-      - name: Setup pnpm
-        uses: pnpm/setup@v2
-        with:
-          install: false
-
-      - name: Use external node-gyp to avoid pnpm bundled copy
-        run: |
-          npm install -g node-gyp@11.5.0
-          echo "npm_config_node_gyp=$(npm root -g)/node-gyp/bin/node-gyp.js" >> "$GITHUB_ENV"
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+          native-runtime: electron
 
       - name: Build Electron app for E2E
         run: pnpm exec electron-vite build --mode e2e
diff --git a/.github/workflows/terminal-perf.yml b/.github/workflows/terminal-perf.yml
index 38d0a25bbb7..72a0fec8992 100644
--- a/.github/workflows/terminal-perf.yml
+++ b/.github/workflows/terminal-perf.yml
@@ -67,16 +67,17 @@ jobs:
       - name: Install native build tools and xvfb
         run: sudo apt-get update && sudo apt-get install -y build-essential python3 xvfb zsh
 
-      - name: Setup Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version-file: package.json
-
       - name: Setup pnpm
         uses: pnpm/setup@v2
         with:
           install: false
 
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: package.json
+          cache: pnpm
+
       # Why: this scheduled/manual workflow uses the same native install path as
       # PR and E2E CI, which needs pnpm to bypass its bundled gyp_main.py.
       - name: Use external node-gyp to avoid pnpm's bundled copy
diff --git a/.github/workflows/windows-signing-rehearsal.yml b/.github/workflows/windows-signing-rehearsal.yml
index 54b751908dc..90ab8db137c 100644
--- a/.github/workflows/windows-signing-rehearsal.yml
+++ b/.github/workflows/windows-signing-rehearsal.yml
@@ -3,9 +3,11 @@
 # Why: SignPath cannot deep-sign inside NSIS installers, so shipping signed
 # inner binaries (Orca.exe, node-pty *.node, DLLs — see issue #7785) requires
 # a two-request flow: sign the unpacked PE files first, then build the NSIS
-# installer from the signed tree, then sign the installer. This workflow
-# rehearses that entire flow from a branch, end to end, without publishing
-# anything — so the release pipeline on main is never at risk while we verify.
+# installer from the signed tree, then sign the installer. The NSIS uninstaller
+# rides that same first request — it is captured through electron-builder's sign
+# hook and swapped back in during the rebuild — so it adds no third approval.
+# This workflow rehearses that entire flow from a branch, end to end, without
+# publishing anything — so the release pipeline on main is never at risk.
 #
 # Runs only via manual dispatch. Use the test-signing policy for iteration
 # (auto-approved test certificate) and release-signing to rehearse the
@@ -81,15 +83,27 @@ jobs:
         env:
           NODE_OPTIONS: --max-old-space-size=4096
 
-      - name: Package unpacked Windows app
+      # Why a full --win build and not --dir: the NSIS uninstaller only exists
+      # inside the installer build, and it is the file the MDE update cluster
+      # flags. --dir would never produce it, so the rehearsal would not rehearse
+      # the uninstaller leg at all. This mirrors release-cut's first Windows pass.
+      - name: Package Windows app and export the NSIS uninstaller
         shell: pwsh
+        env:
+          # runner.temp, never the workspace: the all-negation `files` list in
+          # config/electron-builder.config.cjs packs whatever is left in the
+          # checkout root into app.asar.
+          ORCA_WIN_UNINSTALLER_EXPORT_PATH: ${{ runner.temp }}\uninstaller-signing\unsigned\orca-uninstaller.exe
         run: |
           node config/scripts/ensure-native-runtime.mjs --runtime=electron
           if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
-          pnpm exec electron-builder --config config/electron-builder.config.cjs --win --dir --publish never
+          pnpm exec electron-builder --config config/electron-builder.config.cjs --win --publish never
           if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           if (-not (Test-Path 'dist/win-unpacked/Orca.exe')) {
-            throw 'electron-builder --dir did not produce dist/win-unpacked/Orca.exe'
+            throw 'electron-builder --win did not produce dist/win-unpacked/Orca.exe'
+          }
+          if (-not (Test-Path -LiteralPath $env:ORCA_WIN_UNINSTALLER_EXPORT_PATH)) {
+            throw "The sign hook did not export the NSIS uninstaller to $env:ORCA_WIN_UNINSTALLER_EXPORT_PATH"
           }
 
       # Why: only unsigned PE files go to SignPath. Files that already carry a
@@ -132,6 +146,17 @@ jobs:
           Write-Host "Skipped $($skipped.Count) already-signed files:"
           $skipped | ForEach-Object { Write-Host "  $_" }
 
+          # Why kept out of inner-signing-list.txt: that list drives the copy-back
+          # into dist/win-unpacked, and the uninstaller does not live there — it is
+          # re-injected through the electron-builder sign hook during the rebuild.
+          # No catch here, unlike the release job: the rehearsal exists to prove
+          # the flow, so a staging failure must fail it loudly.
+          $exportedUninstaller = Join-Path $env:RUNNER_TEMP 'uninstaller-signing\unsigned\orca-uninstaller.exe'
+          $uninstallerStagePath = Join-Path $stage.FullName 'uninstaller\orca-uninstaller.exe'
+          New-Item -ItemType Directory -Force -Path (Split-Path $uninstallerStagePath) | Out-Null
+          Copy-Item -LiteralPath $exportedUninstaller -Destination $uninstallerStagePath -Force
+          Write-Host 'Staged the NSIS uninstaller for signing: uninstaller\orca-uninstaller.exe'
+
       - name: Upload unsigned inner binaries for SignPath
         id: upload-unsigned-inner
         uses: actions/upload-artifact@v7
@@ -200,8 +225,27 @@ jobs:
             throw "Signed inner artifact did not round-trip cleanly ($($failures.Count) failures)."
           }
 
+      - name: Restore signed uninstaller for the installer rebuild
+        shell: pwsh
+        run: |
+          $signed = Get-ChildItem -Path signed-inner -Recurse -File -Filter 'orca-uninstaller.exe' |
+            Select-Object -First 1
+          if ($null -eq $signed) {
+            throw 'SignPath did not return uninstaller/orca-uninstaller.exe; check the inner-binaries artifact configuration covers it.'
+          }
+          $signature = Get-AuthenticodeSignature -FilePath $signed.FullName
+          if ($null -eq $signature.SignerCertificate) {
+            throw 'The returned NSIS uninstaller carries no signature.'
+          }
+          $signedDir = Join-Path $env:RUNNER_TEMP 'uninstaller-signing\signed'
+          New-Item -ItemType Directory -Force -Path $signedDir | Out-Null
+          Copy-Item -LiteralPath $signed.FullName -Destination (Join-Path $signedDir 'orca-uninstaller.exe') -Force
+          Write-Host ("{0,-14} uninstaller  <{1}>" -f $signature.Status, $signature.SignerCertificate.Subject)
+
       - name: Build NSIS installer from signed unpacked app
         shell: pwsh
+        env:
+          ORCA_WIN_UNINSTALLER_SIGNED_PATH: ${{ runner.temp }}\uninstaller-signing\signed\orca-uninstaller.exe
         run: |
           pnpm exec electron-builder --config config/electron-builder.config.cjs --win --publish never --prepackaged "$env:GITHUB_WORKSPACE\dist\win-unpacked"
           if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
@@ -215,6 +259,7 @@ jobs:
         with:
           name: orca-windows-installer-unsigned-${{ github.run_id }}
           path: dist/orca-windows-setup.exe
+          compression-level: 0
           if-no-files-found: error
 
       - name: Submit Windows installer signing request
@@ -288,20 +333,33 @@ jobs:
         run: |
           $report = New-Object System.Collections.Generic.List[string]
           $failures = New-Object System.Collections.Generic.List[string]
+          $advisories = New-Object System.Collections.Generic.List[string]
           $requireValid = $env:SIGNING_POLICY -eq 'release-signing'
 
-          function Test-Signature([string]$label, [string]$path) {
+          # -Advisory records a problem without failing the run. It exists for
+          # exactly one file (resources\elevate.exe, below) and must not be
+          # widened casually: the point of this workflow is to fail when signing
+          # is broken.
+          function Test-Signature([string]$label, [string]$path, [switch]$Advisory) {
             $signature = Get-AuthenticodeSignature -FilePath $path
             $subject = if ($null -eq $signature.SignerCertificate) { '<none>' } else { $signature.SignerCertificate.Subject }
             $line = "{0,-14} {1}  <{2}>" -f $signature.Status, $label, $subject
             $script:report.Add($line)
             Write-Host $line
+            $problem = $null
             if ($null -eq $signature.SignerCertificate -or $signature.Status -eq 'NotSigned') {
-              $script:failures.Add("unsigned: $label")
+              $problem = "unsigned: $label"
             } elseif ($script:requireValid -and $signature.Status -ne 'Valid') {
-              $script:failures.Add("not Valid under release-signing: $label ($($signature.Status))")
+              $problem = "not Valid under release-signing: $label ($($signature.Status))"
             } elseif ($script:requireValid -and $subject -notlike '*CN=SignPath Foundation*') {
-              $script:failures.Add("unexpected signer: $label ($subject)")
+              $problem = "unexpected signer: $label ($subject)"
+            }
+            if ($null -eq $problem) { return }
+            if ($Advisory) {
+              $script:advisories.Add($problem)
+              Write-Host "::warning::$problem - known pre-existing issue, not failing the rehearsal"
+            } else {
+              $script:failures.Add($problem)
             }
           }
 
@@ -323,21 +381,155 @@ jobs:
           & $7za x 'dist/orca-windows-setup.exe' '-oextracted-app' -y | Out-Null
 
           $root = Resolve-Path 'extracted-app'
+          # The receipt only proves the import leg ran; it cannot prove what NSIS
+          # embedded, because the uninstaller lives in a compressed NSIS data
+          # section rather than the app 7z payload above and the bundled 7za has
+          # no NSIS handler. So the rehearsal - unlike the release job, which
+          # must not mutate the runner it publishes from - goes all the way: it
+          # installs the installer silently and inspects the uninstaller the
+          # installer actually wrote to disk. That is the file MDE flags.
+          $signedUninstaller = Join-Path $env:RUNNER_TEMP 'uninstaller-signing\signed\orca-uninstaller.exe'
+          $receipt = "$signedUninstaller.embedded-sha256"
+          if (-not (Test-Path -LiteralPath $receipt)) {
+            $failures.Add('the sign hook did not embed the signed uninstaller into the rebuilt installer')
+          } else {
+            Test-Signature 'relayed: orca-uninstaller.exe' $signedUninstaller
+          }
+
+          # Why a full 7-Zip attempt first: it is non-invasive. The runner image
+          # ships the complete 7z.exe, which - unlike the reduced 7za - has an
+          # NSIS handler. If it cannot read the section either, fall back to a
+          # real silent install.
+          $installedUninstaller = $null
+          $installedVia = $null
+          $expectedDigest = if (Test-Path -LiteralPath $receipt) { (Get-Content -LiteralPath $receipt -Raw).Trim() } else { $null }
+          $full7z = 'C:\Program Files\7-Zip\7z.exe'
+          if (Test-Path -LiteralPath $full7z) {
+            New-Item -ItemType Directory -Path nsis-extract -Force | Out-Null
+            & $full7z x -tnsis 'dist/orca-windows-setup.exe' '-onsis-extract' -y 2>&1 | Out-Null
+            $installedUninstaller = Get-ChildItem -Path nsis-extract -Recurse -File -Filter 'Uninstall*.exe' -ErrorAction SilentlyContinue |
+              Select-Object -First 1
+            # Why the digest guard before trusting this route: 7-Zip's NSIS
+            # handler emits partial or garbled output on some NSIS builds, and a
+            # truncated extract would score NotSigned and fail the rehearsal as
+            # "the shipped uninstaller is unsigned" when nothing is wrong. Only
+            # trust it when it reproduces the bytes the relay embedded; otherwise
+            # fall through to the install route, which is ground truth. A name
+            # miss (the handler labelling the entry by its source name) falls
+            # through the same way.
+            if ($null -ne $installedUninstaller -and $null -ne $expectedDigest -and
+                (Get-FileHash -LiteralPath $installedUninstaller.FullName -Algorithm SHA256).Hash.ToLowerInvariant() -ne $expectedDigest) {
+              Write-Host "7-Zip's NSIS output did not match the relayed digest; falling back to a silent install."
+              $installedUninstaller = $null
+            }
+            if ($null -ne $installedUninstaller) {
+              $installedVia = "7-Zip's NSIS handler"
+              Write-Host "Read the embedded uninstaller with 7-Zip's NSIS handler: $($installedUninstaller.FullName)"
+            } else {
+              Write-Host "7-Zip's NSIS handler did not yield a usable uninstaller; falling back to a silent install."
+            }
+          }
+
+          if ($null -eq $installedUninstaller) {
+            # Nothing here is published, so mutating this runner is free.
+            # Why -PassThru and a bounded wait rather than -Wait: a bare -Wait on
+            # an installer that ever prompts hangs to the job's 360-minute cap.
+            $installerProcess = Start-Process -FilePath (Resolve-Path 'dist/orca-windows-setup.exe') -ArgumentList '/S' -PassThru
+            if (-not $installerProcess.WaitForExit(300000)) {
+              $installerProcess | Stop-Process -Force -ErrorAction SilentlyContinue
+              $failures.Add('the silent install did not exit within 5 minutes; it is likely prompting')
+            }
+            # Why a poll rather than one Stop-Process: the oneClick installer
+            # launches the app as it finishes, so Orca.exe can appear *after* the
+            # installer process exits. A single silenced Stop-Process would miss
+            # it and leave Orca plus orca-terminal-daemon.exe holding handles
+            # under %LOCALAPPDATA%\Programs for the rest of the job.
+            for ($attempt = 0; $attempt -lt 20; $attempt++) {
+              $running = @(Get-Process -Name 'Orca' -ErrorAction SilentlyContinue)
+              if ($running.Count -gt 0) {
+                $running | Stop-Process -Force -ErrorAction SilentlyContinue
+                break
+              }
+              Start-Sleep -Milliseconds 500
+            }
+            Get-Process -Name 'orca-terminal-daemon' -ErrorAction SilentlyContinue |
+              Stop-Process -Force -ErrorAction SilentlyContinue
+            $installedUninstaller = Get-ChildItem -Path "$env:LOCALAPPDATA\Programs" -Recurse -File -Filter 'Uninstall*.exe' -ErrorAction SilentlyContinue |
+              Where-Object { $_.FullName -like '*Orca*' } |
+              Select-Object -First 1
+            if ($null -ne $installedUninstaller) { $installedVia = 'a silent install' }
+          }
+
+          if ($null -eq $installedUninstaller) {
+            $failures.Add('could not obtain the uninstaller the installer ships; neither 7-Zip nor a silent install produced it')
+          } else {
+            # Why this digest comparison is the point of the whole rehearsal:
+            # unlike the release job's, it hashes a file NSIS itself wrote out
+            # rather than the file the hook copied, so it is the only check that
+            # proves the shipped installer embedded the SignPath-signed bytes. On
+            # the 7-Zip route the guard above already forced equality; on the
+            # install route this is the first time it is tested.
+            if ($null -ne $expectedDigest) {
+              $shippedDigest = (Get-FileHash -LiteralPath $installedUninstaller.FullName -Algorithm SHA256).Hash.ToLowerInvariant()
+              if ($shippedDigest -ne $expectedDigest) {
+                $failures.Add("the uninstaller the installer ships is not the relayed one (via $installedVia): $shippedDigest vs $expectedDigest")
+              }
+            }
+            Test-Signature "shipped: Uninstall Orca.exe (via $installedVia)" $installedUninstaller.FullName
+          }
+
           foreach ($relative in Get-Content 'inner-signing-list.txt') {
             $path = Join-Path $root $relative
             if (-not (Test-Path $path)) {
               $failures.Add("missing from installer payload: $relative")
               continue
             }
-            Test-Signature "installed: $relative" $path
+            # Why elevate.exe alone is advisory: app-builder-lib re-copies the
+            # pristine cached elevate.exe over resources\elevate.exe on EVERY nsis
+            # pack - AppPackageHelper.packArch calls elevateHelper.copy() before
+            # buildAppPackage (nsisUtil.js), and CopyElevateHelper.copy does
+            # `copyFile(elevatePath, outFile, false)` then `signIf(outFile)`, which
+            # signs nothing because this build configures no certificate. So the
+            # signed copy restored into win-unpacked is clobbered by the rebuild.
+            # This predates the uninstaller relay and is not caused by it: with no
+            # `sign` hook, signIf already returned false at "no signing info
+            # identified" (windowsSignToolManager.js), so no signtool call was
+            # displaced. release-cut.yml mitigates it separately by pre-seeding the
+            # electron-builder cache ("Replace cached elevate.exe with the signed
+            # copy"); this workflow has no such step, which is why the clobber is
+            # visible here and not there. Mirroring that step here would not help:
+            # it only swaps when the copy is already Valid and SignPath-signed, so
+            # it no-ops under the test certificate.
+            #
+            # DO NOT relax that Valid + SignPath-signed guard to make this
+            # rehearsal go green. This workflow and release-cut.yml share the
+            # cache key `electron-builder-win-<lockfile hash>`, and that guard is
+            # the only thing stopping a test certificate from being seeded into
+            # the cache a real release restores from. Shipping users a binary
+            # signed by "Test certificate for 'Orca agent ide [OSS]'" is worse
+            # than shipping it unsigned.
+            #
+            # Fixing elevate.exe belongs in its own PR - it is a UAC elevation
+            # helper, and it deserves more scrutiny than a footnote in an
+            # uninstaller change.
+            if ($relative -eq 'resources\elevate.exe') {
+              Test-Signature "installed: $relative" $path -Advisory
+            } else {
+              Test-Signature "installed: $relative" $path
+            }
           }
 
+          if ($advisories.Count -gt 0) {
+            $report.Add('')
+            $report.Add('ADVISORY (known pre-existing, did not fail this run):')
+            $advisories | ForEach-Object { $report.Add("  $_") }
+          }
           Set-Content -Path 'signing-evidence.txt' -Value ($report -join "`n")
           if ($failures.Count -gt 0) {
             $failures | ForEach-Object { Write-Host "::error::$_" }
             throw "Signing rehearsal failed with $($failures.Count) problems."
           }
-          Write-Host "All $((Get-Content 'inner-signing-list.txt').Count) inner binaries plus the installer are signed."
+          Write-Host "All checked binaries are signed, including the uninstaller the installer writes to disk ($($advisories.Count) advisory)."
 
       - name: Upload rehearsal evidence and installer
         if: always()
diff --git a/.gitignore b/.gitignore
index 8be3fc5b6f4..6722fc5ae54 100644
--- a/.gitignore
+++ b/.gitignore
@@ -110,6 +110,8 @@ docs/**
 !docs/reference/macos-press-and-hold.md
 !docs/reference/orcad-operations.md
 !docs/reference/relay-grace-time-reconfiguration.md
+!docs/reference/windows-cmd-shim-resolution.md
+!docs/reference/windows-daemon-host-relocation.md
 !docs/reference/windows-edr-posture.md
 !docs/reference/windows-process-enumeration.md
 !docs/reference/wsl-runner-verification.md
diff --git a/.oxlintrc.json b/.oxlintrc.json
index 77a7e43e807..03cc659f494 100644
--- a/.oxlintrc.json
+++ b/.oxlintrc.json
@@ -2,6 +2,10 @@
   "$schema": "./node_modules/oxlint/configuration_schema.json",
   "plugins": ["typescript", "react", "react-hooks", "react-perf", "unicorn"],
   "jsPlugins": [
+    {
+      "name": "sort-comparator-performance",
+      "specifier": "./config/oxlint-plugins/sort-comparator-performance.mjs"
+    },
     {
       "name": "mobile-pairing",
       "specifier": "./config/oxlint-plugins/mobile-pairing-qrcode-import.mjs"
@@ -23,6 +27,7 @@
     "correctness": "error"
   },
   "rules": {
+    "sort-comparator-performance/no-repeated-collator": "warn",
     "app-store-performance/require-selector": "error",
     "app-store-performance/no-identity-selector": "error",
     "app-store-performance/no-fresh-selector-result": "error",
diff --git a/AGENTS.md b/AGENTS.md
index 8b0156ba6b1..b0947da0c2f 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -4,6 +4,12 @@ All UI work — layout, color, typography, spacing, component selection, UX beha
 
 ## Electron UI Validation
 
+Always run tests and agent-launched apps in the background with `ORCA_BACKGROUND_LAUNCH=1`.
+Never steal monitor focus or reveal test windows: no `show()`, `showInactive()`, `bringToFront()`,
+`app.focus()`, or OS activation. Use CDP screenshots of hidden renderers. Keep native-focus and
+visible-window tests paused on the user's desktop; run them on an isolated display or CI.
+Rebuild modified launch-policy code before running an app; stale build wrappers are not safe.
+
 Use the `$electron` skill and Playwright CDP for rendered Orca UI checks. Do not use computer-use for Orca UI validation.
 
 # Style
@@ -47,8 +53,9 @@ Orca targets macOS, Linux, and Windows. Keep all platform-dependent behavior beh
 - **Shortcut labels in UI**: Display `⌘` / `⇧` on Mac and `Ctrl+` / `Shift+` on other platforms.
 - **File paths**: Use `path.join` or Electron/Node path utilities — never assume `/` or `\`.
 - **Windows setup scripts**: the setup/issue-command runner is a `.cmd` batch file unless the script starts with a `#!` line — never derive that from the user's terminal-shell preference, and never launch a `.cmd` runner with a bare `cmd.exe /c` from a Git Bash pane (MSYS rewrites the `/c`). See [`docs/reference/windows-setup-shell.md`](./docs/reference/windows-setup-shell.md).
-- **Windows child processes**: start them through `runProcess`/`spawnProcess` in `src/shared/child-process/` — never `child_process` directly. It pins `windowsHide`, refuses `shell: true`, and encodes `.cmd`/`.bat` arguments so neither `CommandLineToArgvW` nor `cmd.exe` mangles them. A ratchet test fails on any new direct import.
+- **Windows child processes**: start them through `runProcess`/`spawnProcess` in `src/shared/child-process/` — never `child_process` directly. It pins `windowsHide`, refuses `shell: true`, and encodes `.cmd`/`.bat` arguments so neither `CommandLineToArgvW` nor `cmd.exe` mangles them. A ratchet test fails on any new direct import. Recognised npm/pnpm `.cmd` shims are resolved to their real target so the spawn skips `cmd.exe` entirely; see [`docs/reference/windows-cmd-shim-resolution.md`](./docs/reference/windows-cmd-shim-resolution.md) before adding a shim shape or debugging one.
 - **Windows process enumeration**: read the table through `src/main/windows/windows-process-table.ts`, never by forking `powershell.exe`. See [`docs/reference/windows-process-enumeration.md`](./docs/reference/windows-process-enumeration.md).
+- **Windows daemon-host relocation**: the terminal daemon runs from a copy of the app runtime under `%LOCALAPPDATA%`, which is what survives an auto-update. Before touching that copy, its exe name, or the NSIS uninstall macro, read [`docs/reference/windows-daemon-host-relocation.md`](./docs/reference/windows-daemon-host-relocation.md).
 - **Windows EDR signal**: don't add `-ExecutionPolicy Bypass`, `-EncodedCommand`, `cmd.exe /c` with escaped free text, per-operation interpreter spawning, or runtime `Add-Type` compilation without reading [`docs/reference/windows-edr-posture.md`](./docs/reference/windows-edr-posture.md) first — behavioural EDR scores each of those, and being signed does not clear them.
 - **WSL commands**: build argv with `buildWslExecArgs` (always `--exec` — under `--`, `wsl.exe` expands `$name` in every argument and silently rewrites the script), and fence anything whose stdout you parse with `buildWslCapturedLoginShellCommand`, because the interactive login shell prints the distro banner to stdout. See [`docs/reference/wsl-command-execution.md`](./docs/reference/wsl-command-execution.md).
 - **Linux native modules**: keep the glibc floor at Ubuntu 20.04 / glibc 2.31. A module compiled from source on a newer runner can reference symbol versions absent on the floor and crash the app on startup. See [`docs/reference/linux-glibc-compatibility.md`](./docs/reference/linux-glibc-compatibility.md); packaging fails if a bundled native binary needs newer glibc.
diff --git a/README.md b/README.md
index 7a3cbe2360c..2ae59035da8 100644
--- a/README.md
+++ b/README.md
@@ -238,9 +238,9 @@ Pair with your desktop app to monitor and steer your agents from your phone.
 
 - **Discord:** Join the community on **[Discord](https://discord.gg/fzjDKHxv8Q)**.
 - **Twitter / X:** Follow **[@orca_build](https://x.com/orca_build)** for updates and announcements.
-- **WeChat:** Scan to join the Orca community WeChat group 8.
+- **WeChat:** Scan to join the Orca community WeChat group 8. Group 8 may be full; if so, scan the Group 9 QR code instead.
 
-  <img src="docs/assets/wechat-qr-group8.jpg" alt="WeChat group 8 QR code for the Orca community" width="160" />
+  <img src="docs/assets/wechat-qr-group8.jpg" alt="WeChat group 8 QR code for the Orca community" width="160" />&nbsp;&nbsp;<img src="docs/assets/wechat-qr-group9.jpg" alt="WeChat group 9 QR code for the Orca community" width="160" />
 
 - **Feedback &amp; Ideas:** We ship fast. Missing something? [Request a new feature](https://github.com/stablyai/orca/issues).
 - **Privacy:** See the [privacy &amp; telemetry docs](https://www.onorca.dev/docs/telemetry) for what anonymous usage data Orca collects and how to opt out.
diff --git a/cloud/apps/relay-ops/src/incident-live-preflight-cli.test.ts b/cloud/apps/relay-ops/src/incident-live-preflight-cli.test.ts
index 18ee4495078..b642d3cc3e1 100644
--- a/cloud/apps/relay-ops/src/incident-live-preflight-cli.test.ts
+++ b/cloud/apps/relay-ops/src/incident-live-preflight-cli.test.ts
@@ -6,7 +6,10 @@ import {
   livePreflightGcloud,
   runIncidentLivePreflight
 } from './incident-live-preflight-cli.js'
-import type { IncidentSample } from './incident-monitor.js'
+import {
+  INCIDENT_MONITOR_THRESHOLDS,
+  type IncidentSample
+} from './incident-monitor.js'
 import type { AdmissionSelector } from './incident-selector.js'
 
 const directories: string[] = []
@@ -69,6 +72,7 @@ function sample(): IncidentSample {
     expectedSelector: selector,
     cells: [{
       cellId: 'production-gce-c1',
+      region: 'us-central1',
       runtimeKnown: true,
       powered: true,
       expectedAdmissionState: 'existing-only'
@@ -250,6 +254,30 @@ describe('relay incident live preflight', () => {
     )).rejects.toThrow('cloud-monitoring/threshold_max')
   })
 
+  // Why: a frozen wave has to name what froze it without re-reading the sample.
+  it('names the signal and its numbers in the failure message', async () => {
+    const slowCell = sample()
+    slowCell.sources['active-probe']!.signals[
+      'cell.production-gce-c1.latency_ms'
+    ]!.value = 2_568
+    await expect(runIncidentLivePreflight(
+      ['--state-file', stateFile()],
+      { now: () => now, collect: async () => slowCell }
+    )).rejects.toThrow(
+      'relay live preflight failed: active-probe/threshold_max cell.production-gce-c1.latency_ms observed=2568 threshold=2000'
+    )
+
+    // A failure with no signal keeps the source/code token and drops the rest.
+    const stale = sample()
+    stale.sources['active-probe']!.observedAt = new Date(now - 60_001).toISOString()
+    await expect(runIncidentLivePreflight(
+      ['--state-file', stateFile()],
+      { now: () => now, collect: async () => stale }
+    )).rejects.toThrow(
+      'relay live preflight failed: active-probe/source_stale observed=60001 threshold=60000'
+    )
+  })
+
   it('enforces the signed migration policy', async () => {
     const inactiveTarget = sample()
     inactiveTarget.sources['director-admin']!.signals[
@@ -313,7 +341,7 @@ describe('relay incident live preflight', () => {
   it('retries freshness-only failures when explicitly requested', async () => {
     const stale = sample()
     stale.sources['cloud-monitoring']!.signals['cloud_sql.cpu']!.observedAt =
-      new Date(now - 180_001).toISOString()
+      new Date(now - (INCIDENT_MONITOR_THRESHOLDS.cloudDataMaxAgeMs + 1)).toISOString()
     const missing = sample()
     delete missing.sources['relay-logs']
     const collect = vi.fn()
@@ -331,11 +359,44 @@ describe('relay incident live preflight', () => {
     expect(wait).toHaveBeenNthCalledWith(2, 15_000)
   })
 
+  it('retries a first-wave stale sample and passes on the fresh one', async () => {
+    const stale = sample()
+    stale.sources['cloud-monitoring']!.signals['cloud_sql.cpu']!.observedAt =
+      new Date(now - (INCIDENT_MONITOR_THRESHOLDS.cloudDataMaxAgeMs + 1)).toISOString()
+    const collect = vi.fn().mockResolvedValueOnce(stale).mockResolvedValueOnce(sample())
+    const wait = vi.fn(async () => undefined)
+    await expect(runIncidentLivePreflight(
+      ['--state-file', stateFile(), '--wave-index', '0', '--retry-freshness'],
+      { now: () => now, collect, wait }
+    )).resolves.toBeUndefined()
+    expect(collect).toHaveBeenCalledTimes(2)
+    expect(wait).toHaveBeenCalledOnce()
+  })
+
+  it('stops retrying when the next wait would exceed the evidence-age bound', async () => {
+    const completedAt = now - 290_000
+    const stale = sample()
+    stale.sources['cloud-monitoring']!.observedAt = new Date(now - (INCIDENT_MONITOR_THRESHOLDS.cloudDataMaxAgeMs + 1)).toISOString()
+    const collect = vi.fn(async () => stale)
+    const wait = vi.fn(async () => undefined)
+    await expect(runIncidentLivePreflight(
+      ['--state-file', stateFile('strict', {
+        startedAt: new Date(completedAt - 17 * 60_000).toISOString(),
+        windowStartedAt: new Date(completedAt - 16 * 60_000).toISOString(),
+        lastSampleAt: new Date(completedAt - 30_000).toISOString(),
+        completedAt: new Date(completedAt).toISOString()
+      }), '--retry-freshness'],
+      { now: () => now, collect, wait }
+    )).rejects.toThrow('cloud-monitoring/source_stale')
+    expect(collect).toHaveBeenCalledOnce()
+    expect(wait).not.toHaveBeenCalled()
+  })
+
   it('does not retry a threshold failure', async () => {
     const unhealthy = sample()
     unhealthy.sources['cloud-monitoring']!.signals['cloud_sql.cpu']!.value = 0.9
     unhealthy.sources['cloud-monitoring']!.signals['cloud_sql.cpu']!.observedAt =
-      new Date(now - 180_001).toISOString()
+      new Date(now - (INCIDENT_MONITOR_THRESHOLDS.cloudDataMaxAgeMs + 1)).toISOString()
     const collect = vi.fn(async () => unhealthy)
     const wait = vi.fn(async () => undefined)
     await expect(runIncidentLivePreflight(
@@ -348,7 +409,7 @@ describe('relay incident live preflight', () => {
 
   it('fails closed after the bounded freshness retry window', async () => {
     const stale = sample()
-    stale.sources['cloud-monitoring']!.observedAt = new Date(now - 180_001).toISOString()
+    stale.sources['cloud-monitoring']!.observedAt = new Date(now - (INCIDENT_MONITOR_THRESHOLDS.cloudDataMaxAgeMs + 1)).toISOString()
     const collect = vi.fn(async () => stale)
     const wait = vi.fn(async () => undefined)
     await expect(runIncidentLivePreflight(
diff --git a/cloud/apps/relay-ops/src/incident-live-preflight-cli.ts b/cloud/apps/relay-ops/src/incident-live-preflight-cli.ts
index e82627a3e80..c277325ed84 100644
--- a/cloud/apps/relay-ops/src/incident-live-preflight-cli.ts
+++ b/cloud/apps/relay-ops/src/incident-live-preflight-cli.ts
@@ -7,7 +7,9 @@ import { suppliedIdentityToken } from './incident-monitor-cli.js'
 import { AdmissionSelectorSchema, type AdmissionSelector } from './incident-selector.js'
 import {
   evaluateIncidentSample,
+  FRESHNESS_FAILURE_CODES,
   preDrainDryRunPassed,
+  type IncidentFailure,
   type IncidentSample
 } from './incident-monitor.js'
 import { createIncidentSampleCollector } from './incident-monitor-sources.js'
@@ -18,12 +20,6 @@ const MONITOR_EVIDENCE_MAX_AGE_MS = 5 * 60_000
 // Matches the same-cap cell job timeout-minutes; bounds each predecessor wave.
 const WAVE_PREDECESSOR_TIMEOUT_MS = 75 * 60_000
 const WAVE_INDEX_PATTERN = /^[0-3]$/
-const FRESHNESS_FAILURE_CODES = new Set([
-  'signal_missing',
-  'signal_stale',
-  'source_missing',
-  'source_stale'
-])
 
 export function livePreflightGcloud(
   gcloud: ReturnType<typeof createGcloudClient>,
@@ -74,6 +70,17 @@ const PreflightStateSchema = z.object({
   }
 })
 
+// Keep the source/code prefix other tooling matches on, then name the signal and
+// its numbers so a frozen wave is attributable without re-reading the sample.
+function describeFailure(failure: IncidentFailure): string {
+  const detail = [
+    failure.signal,
+    failure.observed === undefined ? null : `observed=${failure.observed}`,
+    failure.threshold === undefined ? null : `threshold=${failure.threshold}`
+  ].filter((part): part is string => part !== null && part !== undefined)
+  return [`${failure.source}/${failure.code}`, ...detail].join(' ')
+}
+
 export async function runIncidentLivePreflight(
   argv: string[],
   dependencies: {
@@ -173,10 +180,14 @@ export async function runIncidentLivePreflight(
     const freshnessOnly = evaluation.failures.every((failure) =>
       FRESHNESS_FAILURE_CODES.has(failure.code)
     )
-    if (!freshnessOnly || attempt === attempts) {
+    // Waiting must never carry the mutation past the same evidence-age bound
+    // the entry check enforces, so the wave budget also caps the retry window.
+    const budgetExhausted =
+      now() + FRESHNESS_RETRY_INTERVAL_MS - completedAt > maxEvidenceAgeMs
+    if (!freshnessOnly || attempt === attempts || budgetExhausted) {
       throw new Error(
         `relay live preflight failed: ${evaluation.failures
-          .map((failure) => `${failure.source}/${failure.code}`)
+          .map(describeFailure)
         .join(',')}`
       )
     }
diff --git a/cloud/apps/relay-ops/src/incident-monitor-cli.test.ts b/cloud/apps/relay-ops/src/incident-monitor-cli.test.ts
index 3e1f20a3cbb..31e5a131d35 100644
--- a/cloud/apps/relay-ops/src/incident-monitor-cli.test.ts
+++ b/cloud/apps/relay-ops/src/incident-monitor-cli.test.ts
@@ -44,6 +44,7 @@ function sample(at: number): IncidentSample {
     expectedSelector: selector,
     cells: [{
       cellId,
+      region: 'us-central1',
       runtimeKnown: true,
       powered: true,
       expectedAdmissionState: 'general'
diff --git a/cloud/apps/relay-ops/src/incident-monitor-cli.ts b/cloud/apps/relay-ops/src/incident-monitor-cli.ts
index e090be7ea58..adfe6cad480 100644
--- a/cloud/apps/relay-ops/src/incident-monitor-cli.ts
+++ b/cloud/apps/relay-ops/src/incident-monitor-cli.ts
@@ -50,6 +50,8 @@ const StateSchema = z.object({
   continuityEvents: z.array(z.object({
     recordedAt: z.string(),
     windowSequence: z.number().int().nonnegative(),
+    // Pre-2026-09-05 state files predate tolerated freshness gaps.
+    tolerated: z.boolean().default(false),
     failures: z.array(z.object({
       code: z.string(),
       source: z.enum(['active-probe', 'cloud-monitoring', 'relay-logs', 'director-admin']),
diff --git a/cloud/apps/relay-ops/src/incident-monitor-sources.test.ts b/cloud/apps/relay-ops/src/incident-monitor-sources.test.ts
index 09b7b16fa45..93000131327 100644
--- a/cloud/apps/relay-ops/src/incident-monitor-sources.test.ts
+++ b/cloud/apps/relay-ops/src/incident-monitor-sources.test.ts
@@ -93,7 +93,7 @@ describe('incident monitor sources', () => {
   })
 
   it('zero-fills an expired sparse lock-wait point', async () => {
-    let pointAt = now - INCIDENT_MONITOR_THRESHOLDS.cloudDataMaxAgeMs
+    let pointAt = now - INCIDENT_MONITOR_THRESHOLDS.cloudLockWaitCarryMs
     const fetchImpl: typeof fetch = async () => Response.json({
       timeSeries: [{
         points: [{
@@ -141,7 +141,7 @@ describe('incident monitor sources', () => {
 
   it('freshens a sparse zero without masking a recent nonzero lock wait', async () => {
     let value = 0
-    const pointAt = now - INCIDENT_MONITOR_THRESHOLDS.cloudDataMaxAgeMs
+    const pointAt = now - INCIDENT_MONITOR_THRESHOLDS.cloudLockWaitCarryMs
     const readAt = now + 11_879
     const fetchImpl: typeof fetch = async () => Response.json({
       timeSeries: [{
@@ -317,6 +317,49 @@ describe('incident monitor sources', () => {
     }, endAt)).toBeNull()
   })
 
+  // Why: the per-region cell latency bar is only correct if the tfvars region
+  // reaches the evaluator on every cell expectation.
+  it('carries the configured region onto every cell expectation', async () => {
+    const gcloud: GcloudClient = {
+      accessToken: async () => 'unused',
+      identityToken: async () => 'unused'
+    }
+    const selector = {
+      generation: 1,
+      membership: {
+        existingOnly: [],
+        migrationOnly: [],
+        general: productionCells
+      }
+    }
+    const fetchImpl: typeof fetch = async (_input, init) => {
+      const body = JSON.parse(String(init?.body)) as { cellId?: string; sourceCellId?: string }
+      if (!body.cellId && !body.sourceCellId) return Response.json({ selector })
+      if (body.cellId) {
+        return Response.json({
+          status: {
+            enabled: true,
+            connectionCapacity: { hardCap: 600 },
+            runtime: { lastHeartbeatAt: now - 1_000, heartbeatFresh: true }
+          }
+        })
+      }
+      return Response.json({
+        blocked: 0,
+        blockedExpiredUnregistered: 0,
+        registeredTargetInactive: 0
+      })
+    }
+    const result = await directorSignals('production', selector, gcloud, now, fetchImpl)
+    const regionById = new Map(result.cells.map((cell) => [cell.cellId, cell.region]))
+    expect(regionById.get('production-gce-c1')).toBe('us-central1')
+    expect(regionById.get('production-gce-c27')).toBe('asia-east2')
+    expect(result.cells).toHaveLength(productionCells.length)
+    for (const cell of RELAY_OPS_ENVIRONMENTS.production.cells) {
+      expect(regionById.get(cell.cellId)).toBe(cell.region)
+    }
+  })
+
   it('aggregates admin state without returning tokens or response identities', async () => {
     const identityToken = 'secret.header.signature'
     const sensitiveIdentity = 'user@example.test'
diff --git a/cloud/apps/relay-ops/src/incident-monitor-sources.ts b/cloud/apps/relay-ops/src/incident-monitor-sources.ts
index 0b78c2c4f6b..a93c01b6099 100644
--- a/cloud/apps/relay-ops/src/incident-monitor-sources.ts
+++ b/cloud/apps/relay-ops/src/incident-monitor-sources.ts
@@ -95,7 +95,7 @@ export const GOOGLE_METRICS: GoogleMetricDefinition[] = [
       'resource.type="cloudsql_database" AND metric.label."wait_event_type"="Lock"',
     aggregation: 'latest-max',
     emptyIsZero: true,
-    zeroAfterMs: INCIDENT_MONITOR_THRESHOLDS.cloudDataMaxAgeMs
+    zeroAfterMs: INCIDENT_MONITOR_THRESHOLDS.cloudLockWaitCarryMs
   },
   {
     signal: 'cloud_sql.deadlocks',
@@ -558,6 +558,7 @@ export async function directorSignals(
     selector,
     cells: statuses.map(({ cell }) => ({
       cellId: cell.cellId,
+      region: cell.region,
       runtimeKnown: true,
       powered: true,
       expectedAdmissionState: selectorCellState(expectedSelector, cell.cellId)
diff --git a/cloud/apps/relay-ops/src/incident-monitor.test.ts b/cloud/apps/relay-ops/src/incident-monitor.test.ts
index 4e1da9fab26..c1a073cde4a 100644
--- a/cloud/apps/relay-ops/src/incident-monitor.test.ts
+++ b/cloud/apps/relay-ops/src/incident-monitor.test.ts
@@ -2,6 +2,7 @@ import { describe, expect, it } from 'vitest'
 import {
   evaluateIncidentSample,
   INCIDENT_CHECKPOINT_MINUTES,
+  INCIDENT_FRESHNESS_TOLERANCE_SAMPLES,
   INCIDENT_MONITOR_THRESHOLDS,
   INCIDENT_PRE_DRAIN_MAX_LINEAGE_MS,
   initialIncidentMonitorState,
@@ -32,6 +33,7 @@ function healthySample(at = startedAt): IncidentSample {
     expectedSelector: selector,
     cells: [{
       cellId: 'production-gce-c1',
+      region: 'us-central1',
       runtimeKnown: true,
       powered: true,
       expectedAdmissionState: 'general'
@@ -150,6 +152,52 @@ describe('incident monitor evaluator', () => {
     })
   })
 
+  // Why: an asia-east2 cell's /ready reaches auth and Cloud SQL in us-central1, so
+  // from the US runner it measures p50 0.88 s / max 2.7 s and the flat 2 000 bar
+  // froze three healthy gates on 2026-09-05 (c27 at 2568/2668/2685 ms).
+  it('holds cell endpoint latency to a per-region bar', () => {
+    const asiaTail = healthySample()
+    asiaTail.cells[0]!.region = 'asia-east2'
+    asiaTail.sources['active-probe']!.signals['cell.production-gce-c1.latency_ms'] =
+      signal(2_685)
+    expect(evaluateIncidentSample(asiaTail, startedAt)).toMatchObject({
+      status: 'green',
+      failures: []
+    })
+
+    const asiaIncident = healthySample()
+    asiaIncident.cells[0]!.region = 'asia-east2'
+    asiaIncident.sources['active-probe']!.signals['cell.production-gce-c1.latency_ms'] =
+      signal(4_001)
+    expect(evaluateIncidentSample(asiaIncident, startedAt)).toMatchObject({
+      status: 'freeze',
+      failures: [
+        expect.objectContaining({
+          code: 'threshold_max',
+          source: 'active-probe',
+          signal: 'cell.production-gce-c1.latency_ms',
+          observed: 4_001,
+          threshold: 4_000
+        })
+      ]
+    })
+
+    const usIncident = healthySample()
+    usIncident.sources['active-probe']!.signals['cell.production-gce-c1.latency_ms'] =
+      signal(2_001)
+    expect(evaluateIncidentSample(usIncident, startedAt)).toMatchObject({
+      status: 'freeze',
+      failures: [
+        expect.objectContaining({
+          code: 'threshold_max',
+          signal: 'cell.production-gce-c1.latency_ms',
+          observed: 2_001,
+          threshold: 2_000
+        })
+      ]
+    })
+  })
+
   it('allows missing auth readiness and legacy existing-only connections', () => {
     const sample = healthySample()
     const legacySelector = {
@@ -182,12 +230,49 @@ describe('incident monitor evaluator', () => {
       code: 'source_missing',
       source: 'relay-logs'
     })
-    const stale = healthySample(startedAt - 180_001)
+    const stale = healthySample(
+      startedAt - INCIDENT_MONITOR_THRESHOLDS.cloudDataMaxAgeMs - 1
+    )
     const failures = evaluateIncidentSample(stale, startedAt).failures
     expect(failures.some((failure) => failure.source === 'cloud-monitoring')).toBe(true)
     expect(failures.some((failure) => failure.source === 'active-probe')).toBe(true)
   })
 
+  // Why: production run 33944873727 at 2026-09-05T04:46:09Z read
+  // cloud_sql.lock_waits 189 286 ms old and restarted a 15-minute window on
+  // Google's publish lag. Cloud SQL documents 60 s sampling plus up to 165 s of
+  // invisibility, so that age is Google's clock, not our fleet.
+  it('reads a 189-second cloud signal as fresh and holds the other sources at 180 s', () => {
+    const lagged = healthySample()
+    lagged.sources['cloud-monitoring']!.signals['cloud_sql.lock_waits'] =
+      signal(0, startedAt - 189_286)
+    expect(evaluateIncidentSample(lagged, startedAt)).toMatchObject({
+      status: 'green',
+      failures: []
+    })
+    const laggedDirector = healthySample()
+    laggedDirector.sources['director-admin']!.observedAt =
+      new Date(startedAt - 189_286).toISOString()
+    expect(evaluateIncidentSample(laggedDirector, startedAt).failures).toContainEqual(
+      expect.objectContaining({ code: 'source_stale', source: 'director-admin' })
+    )
+  })
+
+  it('still fails a cloud signal past the documented publish lag', () => {
+    const dark = healthySample()
+    dark.sources['cloud-monitoring']!.signals['cloud_sql.lock_waits'] = signal(
+      0,
+      startedAt - INCIDENT_MONITOR_THRESHOLDS.cloudDataMaxAgeMs - 1
+    )
+    expect(evaluateIncidentSample(dark, startedAt).failures).toContainEqual(
+      expect.objectContaining({
+        code: 'signal_stale',
+        source: 'cloud-monitoring',
+        signal: 'cloud_sql.lock_waits'
+      })
+    )
+  })
+
   it('freezes on SQL, director, relay pool, heartbeat, and migration breaches', () => {
     const sample = healthySample()
     sample.sources['cloud-monitoring']!.signals['cloud_sql.cpu'] = signal(0.81)
@@ -363,12 +448,14 @@ describe('incident monitor evaluator', () => {
     ] = signal(0)
     sample.cells.push({
       cellId: 'production-gce-c2',
+      region: 'us-central1',
       runtimeKnown: true,
       powered: true,
       expectedAdmissionState: 'general'
     })
     sample.cells.push({
       cellId: 'production-gce-c3',
+      region: 'us-central1',
       runtimeKnown: true,
       powered: true,
       expectedAdmissionState: 'general'
@@ -592,7 +679,7 @@ describe('incident monitor lifecycle', () => {
     'restarts a %i-minute continuous window after stale telemetry',
     async (durationMinutes) => {
       let now = startedAt
-      let staleInjected = false
+      let staleSamples = INCIDENT_FRESHNESS_TOLERANCE_SAMPLES + 1
       const checkpoints: Array<[number, number]> = []
       const state = initialIncidentMonitorState({
         incidentId: 'incident-1',
@@ -612,9 +699,11 @@ describe('incident monitor lifecycle', () => {
           now += ms
         },
         collect: async () => {
-          if (!staleInjected && now === startedAt + 5 * 60_000) {
-            staleInjected = true
-            return healthySample(now - 180_001)
+          if (staleSamples > 0 && now >= startedAt + 5 * 60_000) {
+            staleSamples--
+            return healthySample(
+              now - INCIDENT_MONITOR_THRESHOLDS.cloudDataMaxAgeMs - 1
+            )
           }
           return healthySample(now)
         },
@@ -623,16 +712,20 @@ describe('incident monitor lifecycle', () => {
           checkpoints.push([summary.windowSequence, summary.checkpointMinute])
         }
       })
+      const restartMinute = 5 + INCIDENT_FRESHNESS_TOLERANCE_SAMPLES + 1
       expect(result.windowSequence).toBe(1)
       expect(result.windowStartedAt).toBe(
-        new Date(startedAt + 6 * 60_000).toISOString()
+        new Date(startedAt + restartMinute * 60_000).toISOString()
       )
       expect(result.completedAt).toBe(
-        new Date(startedAt + (durationMinutes + 6) * 60_000).toISOString()
+        new Date(startedAt + (durationMinutes + restartMinute) * 60_000).toISOString()
       )
       expect(result.sampleCount).toBe(durationMinutes + 1)
-      expect(result.continuityEvents).toHaveLength(1)
-      expect(result.continuityEvents[0]!.failures).toEqual(
+      expect(result.continuityEvents.map((event) => event.tolerated)).toEqual([
+        ...Array<boolean>(INCIDENT_FRESHNESS_TOLERANCE_SAMPLES).fill(true),
+        false
+      ])
+      expect(result.continuityEvents.at(-1)!.failures).toEqual(
         expect.arrayContaining([
           expect.objectContaining({ code: 'source_stale' })
         ])
@@ -642,6 +735,188 @@ describe('incident monitor lifecycle', () => {
     }
   )
 
+  // Why: run 33944873727 on 2026-09-05 restarted at 04:46:09Z on a single
+  // 189-second cloud reading and then blew the 25-minute lineage cap, so a
+  // green fleet produced no verdict at all. One unread sample now continues the
+  // window; the sample is still checked against every threshold it can read.
+  it('carries a 15-minute window through a single stale cloud sample', async () => {
+    let now = startedAt
+    const state = initialIncidentMonitorState({
+      incidentId: 'incident-1',
+      environment: 'production',
+      expectedSelector: selector,
+      preDrainDryRun: true,
+      migrationPolicy: 'strict',
+      recoverySourceCellId: null,
+      capacityCellId: null,
+      startedAt: new Date(startedAt).toISOString(),
+      durationMinutes: 15,
+      intervalMs: 60_000
+    })
+    const result = await runIncidentMonitor(state, {
+      now: () => now,
+      wait: async (ms) => {
+        now += ms
+      },
+      collect: async () => {
+        const sample = healthySample(now)
+        if (now === startedAt + 10 * 60_000) {
+          sample.sources['cloud-monitoring']!.signals['cloud_sql.lock_waits'] =
+            signal(0, now - INCIDENT_MONITOR_THRESHOLDS.cloudDataMaxAgeMs - 1)
+        }
+        return sample
+      },
+      persist: async () => {},
+      checkpoint: async () => {}
+    })
+    expect(result.windowSequence).toBe(0)
+    expect(result.windowStartedAt).toBe(new Date(startedAt).toISOString())
+    expect(result.completedAt).toBe(new Date(startedAt + 15 * 60_000).toISOString())
+    expect(result.sampleCount).toBe(16)
+    expect(result.frozenAt).toBeNull()
+    expect(result.continuityEvents).toEqual([{
+      recordedAt: new Date(startedAt + 10 * 60_000).toISOString(),
+      windowSequence: 0,
+      tolerated: true,
+      failures: [expect.objectContaining({
+        code: 'signal_stale',
+        source: 'cloud-monitoring',
+        signal: 'cloud_sql.lock_waits'
+      })]
+    }])
+    expect(preDrainDryRunPassed(result)).toBe(true)
+  })
+
+  it('gives a signal a fresh budget only after it reads fresh again', async () => {
+    let now = startedAt
+    const staleMinutes = new Set([3, 5, 6, 9, 10])
+    const state = initialIncidentMonitorState({
+      incidentId: 'incident-1',
+      environment: 'production',
+      expectedSelector: selector,
+      preDrainDryRun: true,
+      migrationPolicy: 'strict',
+      recoverySourceCellId: null,
+      capacityCellId: null,
+      startedAt: new Date(startedAt).toISOString(),
+      durationMinutes: 15,
+      intervalMs: 60_000
+    })
+    const result = await runIncidentMonitor(state, {
+      now: () => now,
+      wait: async (ms) => {
+        now += ms
+      },
+      collect: async () => {
+        const sample = healthySample(now)
+        if (staleMinutes.has((now - startedAt) / 60_000)) {
+          sample.sources['cloud-monitoring']!.signals['cloud_sql.lock_waits'] =
+            signal(0, now - INCIDENT_MONITOR_THRESHOLDS.cloudDataMaxAgeMs - 1)
+        }
+        return sample
+      },
+      persist: async () => {},
+      checkpoint: async () => {}
+    })
+    expect(result.windowSequence).toBe(0)
+    expect(result.continuityEvents).toHaveLength(staleMinutes.size)
+    expect(result.continuityEvents.every((event) => event.tolerated)).toBe(true)
+    expect(preDrainDryRunPassed(result)).toBe(true)
+  })
+
+  it('does not hand a resumed monitor a fresh tolerance budget', async () => {
+    let now = startedAt + 3 * 60_000
+    const resumed = {
+      ...initialIncidentMonitorState({
+        incidentId: 'incident-1',
+        environment: 'production',
+        expectedSelector: selector,
+        preDrainDryRun: true,
+        migrationPolicy: 'strict',
+        recoverySourceCellId: null,
+        capacityCellId: null,
+        startedAt: new Date(startedAt).toISOString(),
+        durationMinutes: 15,
+        intervalMs: 60_000
+      }),
+      windowStartedAt: new Date(startedAt).toISOString(),
+      lastSampleAt: new Date(startedAt + 2 * 60_000).toISOString(),
+      sampleCount: 3,
+      totalSampleCount: 3,
+      continuityEvents: Array.from(
+        { length: INCIDENT_FRESHNESS_TOLERANCE_SAMPLES },
+        (_, index) => ({
+          recordedAt: new Date(startedAt + (index + 1) * 60_000).toISOString(),
+          windowSequence: 0,
+          tolerated: true,
+          failures: [{
+            code: 'signal_stale',
+            source: 'cloud-monitoring' as const,
+            signal: 'cloud_sql.lock_waits'
+          }]
+        })
+      )
+    }
+    const stop = new Error('stop after the resumed sample')
+    await expect(runIncidentMonitor(resumed, {
+      now: () => now,
+      wait: async () => {
+        throw stop
+      },
+      collect: async () => {
+        const sample = healthySample(now)
+        sample.sources['cloud-monitoring']!.signals['cloud_sql.lock_waits'] =
+          signal(0, now - INCIDENT_MONITOR_THRESHOLDS.cloudDataMaxAgeMs - 1)
+        return sample
+      },
+      persist: async (state) => {
+        expect(state.windowSequence).toBe(1)
+        expect(state.windowStartedAt).toBeNull()
+        expect(state.continuityEvents.at(-1)!.tolerated).toBe(false)
+      },
+      checkpoint: async () => {}
+    })).rejects.toThrow(stop)
+  })
+
+  it('freezes on a threshold breach that arrives with a tolerated stale signal', async () => {
+    let now = startedAt
+    const state = initialIncidentMonitorState({
+      incidentId: 'incident-1',
+      environment: 'production',
+      expectedSelector: selector,
+      preDrainDryRun: true,
+      migrationPolicy: 'strict',
+      recoverySourceCellId: null,
+      capacityCellId: null,
+      startedAt: new Date(startedAt).toISOString(),
+      durationMinutes: 15,
+      intervalMs: 60_000
+    })
+    const result = await runIncidentMonitor(state, {
+      now: () => now,
+      wait: async (ms) => {
+        now += ms
+      },
+      collect: async () => {
+        const sample = healthySample(now)
+        if (now === startedAt + 2 * 60_000) {
+          sample.sources['cloud-monitoring']!.signals['cloud_sql.lock_waits'] =
+            signal(0, now - INCIDENT_MONITOR_THRESHOLDS.cloudDataMaxAgeMs - 1)
+          sample.sources['cloud-monitoring']!.signals['cloud_sql.cpu'] = signal(0.81, now)
+        }
+        return sample
+      },
+      persist: async () => {},
+      checkpoint: async () => {}
+    })
+    expect(result.frozenAt).toBe(new Date(startedAt + 2 * 60_000).toISOString())
+    expect(result.failures).toContainEqual(expect.objectContaining({
+      code: 'threshold_max',
+      signal: 'cloud_sql.cpu'
+    }))
+    expect(preDrainDryRunPassed(result)).toBe(false)
+  })
+
   it('resets at the next fresh sample after a runner gap', async () => {
     let now = startedAt + 10 * 60_000
     const state = {
@@ -690,13 +965,21 @@ describe('incident monitor lifecycle', () => {
       durationMinutes: 15,
       intervalMs: 60_000
     })
+    let staleSamples = INCIDENT_FRESHNESS_TOLERANCE_SAMPLES + 1
     const result = await runIncidentMonitor(state, {
       now: () => now,
       wait: async (ms) => {
         now += ms
       },
-      collect: async () =>
-        healthySample(now === startedAt + 10 * 60_000 ? now - 180_001 : now),
+      collect: async () => {
+        if (staleSamples > 0 && now >= startedAt + 10 * 60_000) {
+          staleSamples--
+          return healthySample(
+            now - INCIDENT_MONITOR_THRESHOLDS.cloudDataMaxAgeMs - 1
+          )
+        }
+        return healthySample(now)
+      },
       persist: async () => {},
       checkpoint: async () => {}
     })
@@ -706,7 +989,7 @@ describe('incident monitor lifecycle', () => {
     )
     expect(result.frozenAt).not.toBeNull()
     expect(result.windowSequence).toBe(1)
-    expect(result.sampleCount).toBe(15)
+    expect(result.sampleCount).toBe(13)
     expect(result.failures).toContainEqual({
       code: 'continuity_deadline_exceeded',
       source: 'active-probe',
diff --git a/cloud/apps/relay-ops/src/incident-monitor.ts b/cloud/apps/relay-ops/src/incident-monitor.ts
index a121568d918..0887bb2d1ee 100644
--- a/cloud/apps/relay-ops/src/incident-monitor.ts
+++ b/cloud/apps/relay-ops/src/incident-monitor.ts
@@ -1,3 +1,4 @@
+import type { RelayOpsRegion } from './environment-config.js'
 import {
   exactAdmissionSelector,
   type AdmissionSelector,
@@ -6,10 +7,39 @@ import {
 
 export const INCIDENT_MONITOR_THRESHOLDS = {
   activeProbeMaxAgeMs: 60_000,
-  cloudDataMaxAgeMs: 180_000,
+  // Why: Cloud Monitoring publishes on Google's clock, not ours. Per the metric
+  // list read 2026-09-05, Cloud Run instance_count / cpu / memory /
+  // max_request_concurrencies / request_count are "Sampled every 60 seconds.
+  // After sampling, data is not visible for up to 120 seconds" (60+120=180 s),
+  // and Cloud SQL cpu / memory / num_backends / backends_in_wait /
+  // deadlock_count say "up to 165 seconds" (60+165=225 s). Window-sum signals
+  // age differently: observedAt is the newest point in the 5-minute query
+  // window, so a label series that stops emitting reads as 300 s old while its
+  // summed value is still complete. 330 s clears the worst of the three (the
+  // 300 s query window) plus ~30 s of collect-to-evaluate latency. The old
+  // 180 s bar restarted healthy 15-minute windows at 181 s, 189 s and 255 s on
+  // 2026-09-04/05, once burning the whole 25-minute lineage with no verdict.
+  cloudDataMaxAgeMs: 330_000,
+  // Why: the director admin API answers live on our own request, so hold its
+  // freshness bar where it sat while it shared cloudDataMaxAgeMs.
+  directorAdminMaxAgeMs: 180_000,
+  // Why: how long a nonzero backends-in-wait point is carried before it reads as
+  // zero. Held at the pre-2026-09-05 cloud bar: carrying it for the full
+  // cloudDataMaxAgeMs would hand the evaluator a point older than its own
+  // freshness bar as soon as collection latency is added.
+  cloudLockWaitCarryMs: 180_000,
   relayLogMaxAgeMs: 180_000,
   heartbeatMaxAgeMs: 45_000,
   endpointLatencyMs: 2_000,
+  // Why: a cell's /ready fetches the auth JWKS and runs SELECT 1 against Cloud SQL,
+  // both in us-central1, so from the US runner asia-east2 cells measure p50 0.88 s /
+  // max 2.7 s against 0.08-0.5 s for us-central1. The flat 2 000 bar froze three
+  // healthy 15-minute gates on 2026-09-05 (c27 at 2568/2668/2685 ms); hard faults
+  // are still caught by the .health/.ready equal-1 checks and the 8 s fetch timeout.
+  cellEndpointLatencyMs: {
+    'us-central1': 2_000,
+    'asia-east2': 4_000
+  } as const satisfies Record<RelayOpsRegion, number>,
   cloudSqlCpuUtilization: 0.8,
   cloudSqlMemoryUtilization: 0.9,
   // Why: healthy latest-sum backends idle near 100 but spike to 216 in 1-minute
@@ -106,6 +136,7 @@ export type IncidentSource = {
 
 export type IncidentCellExpectation = {
   cellId: string
+  region: RelayOpsRegion
   runtimeKnown: boolean
   powered: boolean
   expectedAdmissionState: AdmissionState
@@ -175,6 +206,7 @@ export type IncidentMonitorState = {
   continuityEvents: {
     recordedAt: string
     windowSequence: number
+    tolerated: boolean
     failures: IncidentFailure[]
   }[]
   frozenAt: string | null
@@ -307,7 +339,7 @@ const SOURCE_MAX_AGE: Record<IncidentSourceName, number> = {
   'active-probe': INCIDENT_MONITOR_THRESHOLDS.activeProbeMaxAgeMs,
   'cloud-monitoring': INCIDENT_MONITOR_THRESHOLDS.cloudDataMaxAgeMs,
   'relay-logs': INCIDENT_MONITOR_THRESHOLDS.relayLogMaxAgeMs,
-  'director-admin': INCIDENT_MONITOR_THRESHOLDS.cloudDataMaxAgeMs
+  'director-admin': INCIDENT_MONITOR_THRESHOLDS.directorAdminMaxAgeMs
 }
 
 function ageMs(timestamp: string, nowMs: number): number {
@@ -384,7 +416,7 @@ function checkCell(
       'active-probe',
       probe,
       `cell.${cell.cellId}.latency_ms`,
-      INCIDENT_MONITOR_THRESHOLDS.endpointLatencyMs,
+      INCIDENT_MONITOR_THRESHOLDS.cellEndpointLatencyMs[cell.region],
       'max'
     ],
     [
@@ -608,14 +640,59 @@ function checkpointMinutes(durationMinutes: number): number[] {
   return INCIDENT_CHECKPOINT_MINUTES.filter((minute) => minute <= durationMinutes)
 }
 
-const CONTINUITY_FAILURE_CODES = new Set([
-  'collector_failed',
-  'monitor_gap',
+// Freshness-only failures: we could not read a signal this sample. Distinct from
+// collector_failed / monitor_gap, where the whole sample is absent.
+export const FRESHNESS_FAILURE_CODES = new Set([
+  'signal_missing',
   'signal_stale',
   'source_missing',
   'source_stale'
 ])
 
+const CONTINUITY_FAILURE_CODES = new Set([
+  'collector_failed',
+  'monitor_gap',
+  ...FRESHNESS_FAILURE_CODES
+])
+
+// Why: Cloud Monitoring overshoots its own publish bar, and one unread sample is
+// not evidence of an unhealthy fleet. Under the 25-minute lineage cap a restart
+// past minute 10 costs the entire verdict, so a healthy fleet produced none on
+// 2026-09-05. A signal may miss this many consecutive samples before the window
+// restarts; the sample is still evaluated against every threshold it can read,
+// and a threshold breach still freezes the run outright.
+export const INCIDENT_FRESHNESS_TOLERANCE_SAMPLES = 2
+
+function freshnessKey(failure: IncidentFailure): string {
+  return `${failure.source}/${failure.signal ?? '*'}`
+}
+
+// Rebuild the per-signal tolerated streak from the trailing continuity events so a
+// resumed monitor cannot hand a signal a fresh budget.
+function resumeFreshnessStreaks(
+  state: IncidentMonitorState
+): Map<string, number> {
+  const events = state.continuityEvents
+  const streaks = new Map<string, number>()
+  const last = events[events.length - 1]
+  if (!last?.tolerated) return streaks
+  for (const key of new Set(last.failures.map(freshnessKey))) {
+    let streak = 0
+    let laterAt: number | null = null
+    for (let index = events.length - 1; index >= 0; index--) {
+      const event = events[index]!
+      const recordedAt = Date.parse(event.recordedAt)
+      if (!event.tolerated) break
+      if (laterAt !== null && laterAt - recordedAt > state.intervalMs * 1.5) break
+      if (!event.failures.some((failure) => freshnessKey(failure) === key)) break
+      streak++
+      laterAt = recordedAt
+    }
+    streaks.set(key, streak)
+  }
+  return streaks
+}
+
 function resetContinuousWindow(
   state: IncidentMonitorState,
   recordedAt: string,
@@ -631,6 +708,7 @@ function resetContinuousWindow(
   state.continuityEvents.push({
     recordedAt,
     windowSequence: state.windowSequence,
+    tolerated: false,
     failures
   })
 }
@@ -681,6 +759,7 @@ export async function runIncidentMonitor(
     await dependencies.persist(state)
     return state
   }
+  const freshnessStreaks = resumeFreshnessStreaks(state)
   while (state.completedAt === null) {
     if (dependencies.now() > lineageDeadlineMs) {
       completeContinuityDeadline(state, dependencies.now(), lineageStartMs)
@@ -715,9 +794,34 @@ export async function runIncidentMonitor(
     const thresholdFailures = evaluation.failures.filter((failure) =>
       !CONTINUITY_FAILURE_CODES.has(failure.code)
     )
-    if (continuityFailures.length > 0) {
+    const toleratedKeys = new Set(
+      state.windowStartedAt !== null &&
+        continuityFailures.length > 0 &&
+        continuityFailures.every((failure) => FRESHNESS_FAILURE_CODES.has(failure.code))
+        ? continuityFailures.map(freshnessKey)
+        : []
+    )
+    for (const key of [...freshnessStreaks.keys()]) {
+      if (!toleratedKeys.has(key)) freshnessStreaks.delete(key)
+    }
+    let tolerated = toleratedKeys.size > 0
+    for (const key of toleratedKeys) {
+      const streak = (freshnessStreaks.get(key) ?? 0) + 1
+      freshnessStreaks.set(key, streak)
+      if (streak > INCIDENT_FRESHNESS_TOLERANCE_SAMPLES) tolerated = false
+    }
+    if (continuityFailures.length > 0 && !tolerated) {
+      freshnessStreaks.clear()
       resetContinuousWindow(state, evaluation.evaluatedAt, continuityFailures)
     } else {
+      if (tolerated) {
+        state.continuityEvents.push({
+          recordedAt: evaluation.evaluatedAt,
+          windowSequence: state.windowSequence,
+          tolerated: true,
+          failures: continuityFailures
+        })
+      }
       if (state.windowStartedAt === null) {
         state.windowStartedAt = evaluation.evaluatedAt
       }
diff --git a/cloud/apps/relay-ops/src/resource-inventory.test.ts b/cloud/apps/relay-ops/src/resource-inventory.test.ts
index 6d8b3070c98..e2cfa13dccb 100644
--- a/cloud/apps/relay-ops/src/resource-inventory.test.ts
+++ b/cloud/apps/relay-ops/src/resource-inventory.test.ts
@@ -13,6 +13,41 @@ const runService = {
   latestReadyRevision: 'projects/project/revisions/revision-one'
 }
 
+const sleepingStagingGcloud: GcloudClient = { accessToken: async () => 'a'.repeat(40) }
+
+// Staging's Cloud SQL is stopped, so this inventory reads REST only and probes no endpoint.
+type MigOutcome = 'ok' | 'throw' | 'missing'
+const sleepingStagingFetch = (migOutcome: (migName: string) => MigOutcome): typeof fetch =>
+  async (input) => {
+    const url = new URL(String(input))
+    if (url.hostname === 'run.googleapis.com') return Response.json(runService)
+    if (url.hostname === 'sqladmin.googleapis.com') return Response.json({
+      state: 'STOPPED',
+      databaseVersion: 'POSTGRES_17',
+      settings: { activationPolicy: 'NEVER', availabilityType: 'ZONAL', tier: 'db-custom-1-3840' }
+    })
+    if (url.hostname === 'certificatemanager.googleapis.com') return Response.json({
+      managed: { domains: ['*.relay-staging.onorca.dev'], state: 'ACTIVE' }
+    })
+    if (url.pathname.includes('/instanceGroupManagers/')) {
+      const name = url.pathname.split('/').at(-1)!
+      const outcome = migOutcome(name)
+      if (outcome === 'throw') throw new TypeError('fetch failed')
+      if (outcome === 'missing') return new Response(null, { status: 404 })
+      return Response.json({
+        name,
+        targetSize: 0,
+        size: '0',
+        instanceGroup: `projects/project/zones/zone/instanceGroups/${name}`,
+        instanceTemplate: `projects/project/global/instanceTemplates/template-${name}`,
+        status: { isStable: true }
+      })
+    }
+    if (url.pathname.includes('/instanceTemplates/')) return Response.json({ properties: {} })
+    if (url.pathname.endsWith('/getHealth')) return Response.json([])
+    throw new Error(`Unexpected request to ${url.hostname}${url.pathname}`)
+  }
+
 describe('readResourceInventory', () => {
   it('does not delay a healthy endpoint sample', async () => {
     let calls = 0
@@ -23,8 +58,10 @@ describe('readResourceInventory', () => {
         calls += 1
         return new Response(null, { status: 200 })
       },
-      async () => {
-        waits += 1
+      {
+        wait: async () => {
+          waits += 1
+        }
       }
     )
 
@@ -45,8 +82,10 @@ describe('readResourceInventory', () => {
         calls.set(path, call)
         return new Response(null, { status: path === '/ready' && call === 1 ? 503 : 200 })
       },
-      async (ms) => {
-        waits.push(ms)
+      {
+        wait: async (ms) => {
+          waits.push(ms)
+        }
       }
     )
 
@@ -65,17 +104,130 @@ describe('readResourceInventory', () => {
         calls += 1
         return new Response(null, { status: 503 })
       },
-      async (ms) => {
-        waits.push(ms)
+      {
+        wait: async (ms) => {
+          waits.push(ms)
+        }
       }
     )
 
     expect(result.health).toBe(false)
     expect(result.ready).toBe(false)
     expect(calls).toBe(4)
+    // A refusing endpoint is a reading, so only the independent retry runs.
     expect(waits).toEqual([11_000])
   })
 
+  it('treats a thrown fetch as no reading and re-asks that path once', async () => {
+    const calls: string[] = []
+    const waits: number[] = []
+    const result = await probeEndpointHealth(
+      'https://c9.relay.onorca.dev',
+      async (input) => {
+        const path = new URL(String(input)).pathname
+        calls.push(path)
+        if (path === '/health' && calls.filter((call) => call === '/health').length === 1) {
+          throw new TypeError('fetch failed')
+        }
+        return new Response(null, { status: 200 })
+      },
+      {
+        wait: async (ms) => {
+          waits.push(ms)
+        }
+      }
+    )
+
+    expect(result.health).toBe(true)
+    expect(result.ready).toBe(true)
+    expect(calls.filter((call) => call === '/health')).toEqual(['/health', '/health'])
+    expect(waits).toEqual([1_000])
+  })
+
+  it('fails closed when both attempts of a path throw', async () => {
+    const calls: string[] = []
+    const waits: number[] = []
+    const result = await probeEndpointHealth(
+      'https://c9.relay.onorca.dev',
+      async (input) => {
+        const path = new URL(String(input)).pathname
+        calls.push(path)
+        if (path === '/health') throw new TypeError('fetch failed')
+        return new Response(null, { status: 200 })
+      },
+      {
+        wait: async (ms) => {
+          waits.push(ms)
+        }
+      }
+    )
+
+    expect(result.health).toBe(false)
+    expect(calls.filter((call) => call === '/health')).toHaveLength(4)
+    expect(waits).toEqual([1_000, 11_000, 1_000])
+  })
+
+  it('accepts an auth-shaped endpoint that serves no readiness path', async () => {
+    const calls: string[] = []
+    const waits: number[] = []
+    const result = await probeEndpointHealth(
+      'https://login.onorca.dev',
+      async (input) => {
+        const path = new URL(String(input)).pathname
+        calls.push(path)
+        return new Response(null, { status: path === '/ready' ? 404 : 200 })
+      },
+      {
+        requiresReady: false,
+        wait: async (ms) => {
+          waits.push(ms)
+        }
+      }
+    )
+
+    expect(result.health).toBe(true)
+    expect(result.ready).toBeNull()
+    expect(calls).toEqual(['/health'])
+    expect(waits).toEqual([])
+  })
+
+  it('still requires readiness for the director and cells', async () => {
+    const waits: number[] = []
+    const result = await probeEndpointHealth(
+      'https://relay.onorca.dev',
+      async (input) => new Response(null, {
+        status: new URL(String(input)).pathname === '/ready' ? 503 : 200
+      }),
+      {
+        wait: async (ms) => {
+          waits.push(ms)
+        }
+      }
+    )
+
+    expect(result.health).toBe(true)
+    expect(result.ready).toBe(false)
+    expect(waits).toEqual([11_000])
+  })
+
+  it('measures latency as the answering round trip, not the retry delay', async () => {
+    let healthCalls = 0
+    const result = await probeEndpointHealth(
+      'https://c9.relay.onorca.dev',
+      async (input) => {
+        if (new URL(String(input)).pathname !== '/health') return new Response(null, { status: 200 })
+        healthCalls += 1
+        if (healthCalls === 1) throw new TypeError('fetch failed')
+        return new Response(null, { status: 200 })
+      },
+      { wait: async (ms) => await new Promise((resolve) => setTimeout(resolve, Math.min(ms, 60))) }
+    )
+
+    expect(result.health).toBe(true)
+    expect(result.latencyMs).not.toBeNull()
+    expect(result.latencyMs!).toBeLessThan(60)
+  })
+
   it('uses aggregate REST inventory without probing sleeping staging endpoints', async () => {
     const gcloud: GcloudClient = { accessToken: async () => 'a'.repeat(40) }
     let publicProbeCalls = 0
@@ -132,6 +284,74 @@ describe('readResourceInventory', () => {
     expect(JSON.stringify(result)).not.toContain('SECRET_TEXT')
   })
 
+  it('re-asks a MIG read that failed once before calling a cell powered-unknown', async () => {
+    const parkedCell = RELAY_OPS_ENVIRONMENTS.staging.cells[0]!
+    const waits: number[] = []
+    let parkedMigCalls = 0
+    const result = await readResourceInventory(
+      RELAY_OPS_ENVIRONMENTS.staging,
+      sleepingStagingGcloud,
+      sleepingStagingFetch((migName) => {
+        if (!migName.endsWith(parkedCell.hostname)) return 'ok'
+        parkedMigCalls += 1
+        return parkedMigCalls === 1 ? 'throw' : 'ok'
+      }),
+      { wait: async (ms) => { waits.push(ms) } }
+    )
+
+    const parked = result.cells.find((cell) => cell.cellId === parkedCell.cellId)!
+    // The MIG was fine and parked at zero; one transient read must not erase that reading.
+    expect(parked.targetSize).toBe(0)
+    expect(parkedMigCalls).toBe(2)
+    expect(waits).toEqual([1_000])
+    expect(result.warnings).toEqual([])
+  })
+
+  it('reports a MIG unavailable only when the retry fails too', async () => {
+    const parkedCell = RELAY_OPS_ENVIRONMENTS.staging.cells[0]!
+    const waits: number[] = []
+    let parkedMigCalls = 0
+    const result = await readResourceInventory(
+      RELAY_OPS_ENVIRONMENTS.staging,
+      sleepingStagingGcloud,
+      sleepingStagingFetch((migName) => {
+        if (!migName.endsWith(parkedCell.hostname)) return 'ok'
+        parkedMigCalls += 1
+        return 'throw'
+      }),
+      { wait: async (ms) => { waits.push(ms) } }
+    )
+
+    const parked = result.cells.find((cell) => cell.cellId === parkedCell.cellId)!
+    expect(parked.targetSize).toBeNull()
+    expect(parked.backendHealth).toBe('unknown')
+    expect(parkedMigCalls).toBe(2)
+    expect(waits).toEqual([1_000])
+    expect(result.warnings).toEqual([
+      `${parkedCell.hostname.toUpperCase()} MIG inventory is unavailable.`
+    ])
+  })
+
+  it('does not re-ask a MIG read the API answered with 404', async () => {
+    const missingCell = RELAY_OPS_ENVIRONMENTS.staging.cells[0]!
+    const waits: number[] = []
+    let missingMigCalls = 0
+    const result = await readResourceInventory(
+      RELAY_OPS_ENVIRONMENTS.staging,
+      sleepingStagingGcloud,
+      sleepingStagingFetch((migName) => {
+        if (!migName.endsWith(missingCell.hostname)) return 'ok'
+        missingMigCalls += 1
+        return 'missing'
+      }),
+      { wait: async (ms) => { waits.push(ms) } }
+    )
+
+    expect(result.cells.find((cell) => cell.cellId === missingCell.cellId)!.targetSize).toBeNull()
+    expect(missingMigCalls).toBe(1)
+    expect(waits).toEqual([])
+  })
+
   it('represents missing credentials as unknown inventory, never sleeping', async () => {
     const gcloud: GcloudClient = {
       accessToken: async () => { throw new Error('sensitive context') }
diff --git a/cloud/apps/relay-ops/src/resource-inventory.ts b/cloud/apps/relay-ops/src/resource-inventory.ts
index 62ed3fd862b..da490685198 100644
--- a/cloud/apps/relay-ops/src/resource-inventory.ts
+++ b/cloud/apps/relay-ops/src/resource-inventory.ts
@@ -102,6 +102,9 @@ export type ResourceInventory = {
 
 const unavailableEndpoint = (): EndpointHealth => ({ health: null, ready: null, latencyMs: null })
 const independentEndpointRetryDelayMs = 11_000
+const transientProbeRetryDelayMs = 1_000
+const sleep = async (ms: number): Promise<void> =>
+  await new Promise((resolvePromise) => setTimeout(resolvePromise, ms))
 
 function finalSegment(value: string): string {
   return value.split('/').at(-1) ?? value
@@ -120,6 +123,12 @@ function parseService(value: unknown): ServiceInventory {
   }
 }
 
+class GoogleApiError extends Error {
+  constructor(readonly status: number) {
+    super(`Google API returned ${status}`)
+  }
+}
+
 async function googleRequest(
   fetchImpl: typeof fetch,
   token: string,
@@ -134,45 +143,97 @@ async function googleRequest(
     },
     signal: AbortSignal.timeout(30_000)
   })
-  if (!response.ok) throw new Error(`Google API returned ${response.status}`)
+  if (!response.ok) throw new GoogleApiError(response.status)
   return await response.json()
 }
 
-async function endpointProbe(origin: string, fetchImpl: typeof fetch): Promise<EndpointHealth> {
-  const startedAt = performance.now()
-  const check = async (path: '/health' | '/ready'): Promise<boolean> => {
+// A 404 is the API's answer about the resource; anything else is the absence of a reading, so re-ask.
+async function readOnceMore(
+  read: () => Promise<unknown>,
+  wait: (ms: number) => Promise<void>
+): Promise<unknown> {
+  try {
+    return await read()
+  } catch (error) {
+    if (error instanceof GoogleApiError && error.status === 404) throw error
+    await wait(transientProbeRetryDelayMs)
+    return await read()
+  }
+}
+
+// A reading the endpoint actually produced: ok is its answer, latencyMs is that answer's round trip.
+type PathReading = { ok: boolean; latencyMs: number | null }
+
+async function probePath(
+  origin: string,
+  path: '/health' | '/ready',
+  fetchImpl: typeof fetch,
+  wait: (ms: number) => Promise<void>
+): Promise<PathReading> {
+  // null means the request never produced an answer (DNS/TCP/TLS failure or the 8s abort).
+  const attempt = async (): Promise<PathReading | null> => {
+    const startedAt = performance.now()
     try {
       const response = await fetchImpl(`${origin}${path}`, {
         redirect: 'error',
         signal: AbortSignal.timeout(8_000)
       })
-      return response.ok
+      return { ok: response.ok, latencyMs: Math.round(performance.now() - startedAt) }
     } catch {
-      return false
+      return null
     }
   }
-  const [health, ready] = await Promise.all([check('/health'), check('/ready')])
-  return { health, ready, latencyMs: Math.round(performance.now() - startedAt) }
+  const first = await attempt()
+  if (first) return first
+  // A thrown fetch is the absence of a reading, not an unhealthy answer, so re-ask before concluding.
+  await wait(transientProbeRetryDelayMs)
+  return (await attempt()) ?? { ok: false, latencyMs: null }
+}
+
+async function endpointProbe(
+  origin: string,
+  fetchImpl: typeof fetch,
+  requiresReady: boolean,
+  wait: (ms: number) => Promise<void>
+): Promise<EndpointHealth> {
+  const [health, ready] = await Promise.all([
+    probePath(origin, '/health', fetchImpl, wait),
+    requiresReady ? probePath(origin, '/ready', fetchImpl, wait) : null
+  ])
+  // Latency is the slowest answering round trip in this probe; retry delays are not serving latency.
+  const latencies = [health.latencyMs, ready?.latencyMs ?? null].filter(
+    (value): value is number => value !== null
+  )
+  return {
+    health: health.ok,
+    ready: ready ? ready.ok : null,
+    latencyMs: latencies.length > 0 ? Math.max(...latencies) : null
+  }
+}
+
+export type EndpointProbeOptions = {
+  // Auth serves no /ready by design, so it is judged on /health and latency alone.
+  requiresReady?: boolean
+  wait?: (ms: number) => Promise<void>
 }
 
 export async function probeEndpointHealth(
   origin: string,
   fetchImpl: typeof fetch,
-  wait: (ms: number) => Promise<void> = async (ms) =>
-    await new Promise((resolvePromise) => setTimeout(resolvePromise, ms))
+  options: EndpointProbeOptions = {}
 ): Promise<EndpointHealth> {
-  const first = await endpointProbe(origin, fetchImpl)
-  if (
-    first.health &&
-    first.ready &&
-    first.latencyMs !== null &&
-    first.latencyMs <= INCIDENT_MONITOR_THRESHOLDS.endpointLatencyMs
-  ) {
-    return first
-  }
+  const requiresReady = options.requiresReady ?? true
+  const wait = options.wait ?? sleep
+  const accepted = (probe: EndpointHealth): boolean =>
+    probe.health === true &&
+    (!requiresReady || probe.ready === true) &&
+    probe.latencyMs !== null &&
+    probe.latencyMs <= INCIDENT_MONITOR_THRESHOLDS.endpointLatencyMs
+  const first = await endpointProbe(origin, fetchImpl, requiresReady, wait)
+  if (accepted(first)) return first
   // Outwait Relay's ten-second readiness cache before treating the retry as independent.
   await wait(independentEndpointRetryDelayMs)
-  return await endpointProbe(origin, fetchImpl)
+  return await endpointProbe(origin, fetchImpl, requiresReady, wait)
 }
 
 function imageDigest(template: z.infer<typeof TemplateSchema>): string | null {
@@ -285,11 +346,17 @@ function unavailableInventory(environment: RelayOpsEnvironment, warning: string)
   }
 }
 
+export type ResourceInventoryOptions = {
+  wait?: (ms: number) => Promise<void>
+}
+
 export async function readResourceInventory(
   environment: RelayOpsEnvironment,
   gcloud: GcloudClient,
-  fetchImpl: typeof fetch = fetch
+  fetchImpl: typeof fetch = fetch,
+  options: ResourceInventoryOptions = {}
 ): Promise<ResourceInventory> {
+  const wait = options.wait ?? sleep
   let token: string
   try {
     token = await gcloud.accessToken()
@@ -316,7 +383,10 @@ export async function readResourceInventory(
       token,
       `https://certificatemanager.googleapis.com/v1/projects/${environment.project}/locations/global/certificates/${environment.certificateName}`
     ),
-    ...environment.cells.map((cell) => googleRequest(fetchImpl, token, migUrl(cell)))
+    // One transient Compute read must never become a verdict on a cell's power state.
+    ...environment.cells.map((cell) =>
+      readOnceMore(async () => await googleRequest(fetchImpl, token, migUrl(cell)), wait)
+    )
   ])
   const warnings: string[] = []
   const directorValue = parsed(settled[0]!, RunServiceSchema, 'Director service inventory is unavailable.', warnings)
@@ -338,7 +408,8 @@ export async function readResourceInventory(
     ? [unavailableEndpoint(), unavailableEndpoint()]
     : await Promise.all([
         probeEndpointHealth(environment.directorOrigin, fetchImpl),
-        probeEndpointHealth(environment.authOrigin, fetchImpl)
+        // The auth service exposes no /ready, so requiring it would fail every first probe.
+        probeEndpointHealth(environment.authOrigin, fetchImpl, { requiresReady: false })
       ])
   const cells = await Promise.all(environment.cells.map((cell, index) =>
     readCell(environment, cell, migValues[index] ?? null, token, fetchImpl)
diff --git a/cloud/apps/relay/src/assignment-connection-headroom-postgres.test.ts b/cloud/apps/relay/src/assignment-connection-headroom-postgres.test.ts
index 6ac9521c3d6..80a74a47eeb 100644
--- a/cloud/apps/relay/src/assignment-connection-headroom-postgres.test.ts
+++ b/cloud/apps/relay/src/assignment-connection-headroom-postgres.test.ts
@@ -44,6 +44,12 @@ describePostgres('PostgreSQL assignment connection headroom', () => {
         `DELETE FROM relay_assignments
          WHERE user_id LIKE 'connection-headroom-postgres-%'`
       )
+      // A snapshot left by an aborted run rejects the replayed watermark
+      // with stale_connection_snapshot.
+      await database.query(
+        `DELETE FROM relay_cell_connection_snapshots WHERE cell_id = ?`,
+        [cell.id]
+      )
       await database.query(
         `DELETE FROM relay_cell_connection_runtime WHERE cell_id = ?`,
         [cell.id]
diff --git a/cloud/apps/relay/src/assignment-control-supersession-postgres.test.ts b/cloud/apps/relay/src/assignment-control-supersession-postgres.test.ts
index 10193b78cc6..cf8819686b5 100644
--- a/cloud/apps/relay/src/assignment-control-supersession-postgres.test.ts
+++ b/cloud/apps/relay/src/assignment-control-supersession-postgres.test.ts
@@ -38,6 +38,10 @@ describePostgres('PostgreSQL control supersession', () => {
         [identity.userId]
       )
       await database.query(`DELETE FROM relay_assignments WHERE user_id = ?`, [identity.userId])
+      // A snapshot left by an aborted run rejects the replayed watermark with stale_connection_snapshot.
+      await database.query(`DELETE FROM relay_cell_connection_snapshots WHERE cell_id = ?`, [
+        cell.id
+      ])
       await database.query(`DELETE FROM relay_cell_connection_runtime WHERE cell_id = ?`, [cell.id])
       await database.query(`DELETE FROM relay_cell_connection_limits WHERE cell_id = ?`, [cell.id])
       await database.query(`DELETE FROM relay_cell_runtime WHERE cell_id = ?`, [cell.id])
diff --git a/cloud/apps/relay/src/assignment-store.ts b/cloud/apps/relay/src/assignment-store.ts
index d0517d46746..226df9b3984 100644
--- a/cloud/apps/relay/src/assignment-store.ts
+++ b/cloud/apps/relay/src/assignment-store.ts
@@ -645,9 +645,17 @@ export class RelayAssignmentStore {
   ): Promise<RelayAssignment | null> {
     const now = this.now()
     return await this.database.transaction(async (transaction) => {
-      const lockedCells = inventoryFirst
-        ? await this.lockCellInventory(transaction, lockMode)
+      // Why: the retry exists to take a cell row before the assignment row, the
+      // order placement uses. It only ever needs the one cell this host is
+      // pinned to, so read the pin unlocked and lock that row alone; taking all
+      // 23 queued every sticky refresh in the fleet behind every other one.
+      const pinnedCellId = inventoryFirst
+        ? await this.pinnedCellId(transaction, identity)
         : undefined
+      const lockedCells =
+        pinnedCellId === undefined
+          ? undefined
+          : await this.lockCellRows(transaction, [pinnedCellId], lockMode)
       const existing = await this.assignmentRow(transaction, identity, inventoryFirst)
       if (!existing) return null
       const activityLeases = await this.lockAssignmentActivities(transaction, identity, true)
@@ -661,6 +669,11 @@ export class RelayAssignmentStore {
       }
 
       const currentCellId = text(existing, 'cell_id')
+      // The pin moved between the unlocked read and the assignment lock, so the
+      // row held is the wrong one. Same recovery as losing the lock: retry.
+      if (pinnedCellId !== undefined && pinnedCellId !== currentCellId) {
+        throw new Error('database_lock_unavailable')
+      }
       const hadControl = holdsControlLease(
         activityLeases,
         currentCellId,
@@ -701,14 +714,9 @@ export class RelayAssignmentStore {
       if (hadControl) {
         await this.touchAssignment(transaction, identity, leaseExpiresAt, now)
       } else {
-        const nextReservation = integer(currentRow, 'reserved_requests') + 1
-        if (nextReservation > integer(currentRow, 'capacity_requests')) {
-          throw new Error('relay_capacity_exhausted')
-        }
-        await transaction.query(
-          `UPDATE relay_cells SET reserved_requests = ?, updated_at = ? WHERE cell_id = ?`,
-          [nextReservation, now, currentCellId]
-        )
+        // Delta, not the value read from the snapshot: an absolute write here
+        // would clobber any concurrent movement of the same counter.
+        await this.adjustCellReservationAtomically(transaction, currentCellId, 1)
         await this.adjustActivityCount(transaction, identity, 'control', 1, leaseExpiresAt, now)
         await this.insertPendingControlLease(
           transaction,
@@ -3202,8 +3210,7 @@ export class RelayAssignmentStore {
         )
         const requestDelta = ACTIVITY_REQUEST_UNITS[kind] * (after - before)
         if (requestDelta !== 0) {
-          await this.lockCellInventory(transaction, 'request')
-          await this.adjustCellReservation(transaction, text(row, 'cell_id'), requestDelta)
+          await this.adjustCellReservationAtomically(transaction, text(row, 'cell_id'), requestDelta)
         }
       })
     })
@@ -3263,9 +3270,12 @@ export class RelayAssignmentStore {
         }
         const units = ACTIVITY_REQUEST_UNITS[input.kind]
         if (existing) {
-          await this.lockCellInventory(transaction, 'request')
+          // Why: a client-chosen activity id can move between cells, so lock the
+          // one or two rows this path touches in cell_id order, the same order
+          // placement takes the inventory in, and no cycle can form.
+          await this.lockCellRows(transaction, [text(existing, 'cell_id'), input.cellId])
           await this.removeActivityLease(transaction, identity, existing, now)
-          await this.adjustCellReservation(transaction, input.cellId, units)
+          await this.adjustCellReservationAtomically(transaction, input.cellId, units)
         }
         await this.adjustActivityCount(transaction, identity, input.kind, 1, expiresAt, now)
         await transaction.query(
@@ -3580,8 +3590,7 @@ export class RelayAssignmentStore {
             )
             await this.touchAssignment(transaction, identity, expiresAt, now)
           } else {
-            await this.lockCellInventory(transaction, 'request')
-            await this.adjustCellReservation(transaction, input.cellId, 1)
+            await this.adjustCellReservationAtomically(transaction, input.cellId, 1)
             await this.adjustActivityCount(transaction, identity, 'control', 1, expiresAt, now)
             await transaction.query(
               `INSERT INTO relay_assignment_activity_leases
@@ -6863,13 +6872,24 @@ export class RelayAssignmentStore {
           targetCellId
         ]
       )
-      const cells = await this.lockCellInventory(transaction, 'pool-default')
+      // Only the two cells this repairs need holding. The id set below is an
+      // existence check against a table that only reconcileCells writes, so it
+      // reads unlocked instead of dragging the other 21 rows into the section.
+      const cellIds = new Set(
+        (await transaction.query(`SELECT cell_id FROM relay_cells`)).map((row) =>
+          text(row, 'cell_id')
+        )
+      )
+      const cells = await this.lockCellRows(
+        transaction,
+        [sourceCellId, targetCellId],
+        'pool-default'
+      )
       const assignmentKeys = new Set(
         assignments.map((row) =>
           assignmentKey(text(row, 'user_id'), text(row, 'relay_host_id'))
         )
       )
-      const cellIds = new Set(cells.map((row) => text(row, 'cell_id')))
       const assignmentCounts = new Map<
         string,
         { counts: Record<AssignmentActivityKind, number>; leaseExpiresAt: number }
@@ -6923,9 +6943,7 @@ export class RelayAssignmentStore {
         )
       }
 
-      for (const row of cells.filter((cell) =>
-        [sourceCellId, targetCellId].includes(text(cell, 'cell_id'))
-      )) {
+      for (const row of cells) {
         const cellId = text(row, 'cell_id')
         const expected = cellUnits.get(cellId) ?? 0
         if (expected > integer(row, 'capacity_requests')) {
@@ -6954,6 +6972,43 @@ export class RelayAssignmentStore {
     return rows
   }
 
+  // Per-connection paths touch one or two cells. Locking exactly those rows,
+  // in the same ascending order the inventory lock uses (ORDER BY fixes the
+  // row-lock order), keeps them off the fleet-wide lock without a cycle.
+  // The wait policy follows the caller for the same reason the inventory lock's
+  // does: a sweep must not fail terminally on ordinary contention. Hold time is
+  // deliberately not sampled here — the metric tracks the fleet-wide lock these
+  // rows replace, and mixing in short single-row holds would flatter it.
+  private async lockCellRows(
+    database: RelayDatabase,
+    cellIds: string[],
+    mode: CellInventoryLockMode = 'request'
+  ): Promise<SqlRow[]> {
+    const distinct = [...new Set(cellIds)]
+    const { measureHoldMs: _sampled, ...wait } = cellInventoryLockOptions(mode)
+    return await database.queryLocked(
+      `SELECT * FROM relay_cells WHERE cell_id IN (${distinct.map(() => '?').join(', ')})
+       ORDER BY cell_id ASC`,
+      distinct,
+      wait
+    )
+  }
+
+  // Unlocked on purpose: this only names the row to lock next, and the caller
+  // re-checks the pin once the assignment row is held.
+  private async pinnedCellId(
+    database: RelayDatabase,
+    identity: AssignmentIdentity
+  ): Promise<string | undefined> {
+    const row = (
+      await database.query(
+        `SELECT cell_id FROM relay_assignments WHERE user_id = ? AND relay_host_id = ?`,
+        [identity.userId, identity.relayHostId]
+      )
+    )[0]
+    return row ? text(row, 'cell_id') : undefined
+  }
+
   private async lockGeneralCellInventory(
     database: RelayDatabase,
     mode: CellInventoryLockMode
@@ -6972,10 +7027,11 @@ export class RelayAssignmentStore {
 
   private async leastLoadedCell(
     database: RelayDatabase,
-    lockedCells: SqlRow[] | undefined,
+    // Required: the one caller has already locked the inventory it selects from,
+    // and an optional parameter left a second fleet-wide lock reachable here.
+    rows: SqlRow[],
     preferredRegion: RelayRegion
   ): Promise<CellRow | null> {
-    const rows = lockedCells ?? (await this.lockCellInventory(database, 'pool-default'))
     const regions = new Map(
       (await database.query(`SELECT cell_id, region FROM relay_cell_regions`)).map((row) => [
         text(row, 'cell_id'),
@@ -7590,7 +7646,10 @@ export class RelayAssignmentStore {
     ) {
       throw new Error('activity_lease_shape_mismatch')
     }
-    const cells = await this.lockCellInventory(database, 'request')
+    // Why: this recomputes one cell's reservation from its leases, so only that
+    // row needs to be held; the 23-row inventory lock here serialised every
+    // desktop control rebind in the fleet behind every other one.
+    const cellRow = (await this.lockCellRows(database, [cellId]))[0]
     await database.query(
       `DELETE FROM relay_assignment_activity_leases
        WHERE user_id = ? AND relay_host_id = ? AND activity_kind = 'control'
@@ -7611,7 +7670,6 @@ export class RelayAssignmentStore {
         [cellId]
       )
     )[0]!
-    const cellRow = cells.find((cell) => text(cell, 'cell_id') === cellId)
     const cellUnits = integer(cellUnitsRow, 'request_units')
     if (!cellRow) throw new Error('assigned_cell_missing')
     if (cellUnits > integer(cellRow, 'capacity_requests')) {
diff --git a/cloud/apps/relay/src/cell-inventory-lock-census.test.ts b/cloud/apps/relay/src/cell-inventory-lock-census.test.ts
index 8ca7cee55f5..0ac4c8225e3 100644
--- a/cloud/apps/relay/src/cell-inventory-lock-census.test.ts
+++ b/cloud/apps/relay/src/cell-inventory-lock-census.test.ts
@@ -18,17 +18,21 @@ type CensusEntry = { method: string; mode: CensusMode; reach: Reachability }
 // assignment-store.ts, in source order. A new site fails this test until it is
 // classified here, which is the point.
 const CENSUS: CensusEntry[] = [
-  { method: 'assignStickyOnce', mode: 'caller', reach: 'both' },
+  // assignStickyOnce is gone from this list: its retry now locks only the row
+  // the host is pinned to (lockCellRows), which is what a sticky refresh
+  // touches. Placement below is the one genuinely fleet-wide decision left.
   { method: 'assignOnce', mode: 'caller', reach: 'both' },
   { method: 'assignOnce', mode: 'caller', reach: 'both' },
   { method: 'assignOnce', mode: 'nowait', reach: 'both' },
   { method: 'assignOnce', mode: 'nowait', reach: 'both' },
   { method: 'assignOnce', mode: 'nowait', reach: 'both' },
   { method: 'refreshDrainMigrationLeasesOnce', mode: 'request', reach: 'request' },
-  // Reachable from neither: changeActivity has no production callers, only tests.
-  { method: 'changeActivity', mode: 'request', reach: 'orphan' },
-  { method: 'acquireActivity', mode: 'request', reach: 'request' },
-  { method: 'activateControl', mode: 'request', reach: 'request' },
+  // changeActivity, acquireActivity, activateControl and
+  // removeSupersededSameCellControls no longer take the inventory: they lock
+  // only the one or two cell rows they touch, in cell_id order (lockCellRows),
+  // so they cannot cycle with placement's ordered inventory lock, and the
+  // 23-row lock there had serialised every reconnect in the fleet behind every
+  // other one.
   { method: 'startEvacuation', mode: 'request', reach: 'request' },
   { method: 'completeEvacuationFromDeadSourceOnce', mode: 'request', reach: 'request' },
   { method: 'completeEvacuationFromDeadSourceOnce', mode: 'nowait', reach: 'request' },
@@ -47,9 +51,33 @@ const CENSUS: CensusEntry[] = [
   { method: 'abortExpiredEvacuations', mode: 'nowait', reach: 'sweep' },
   { method: 'releaseExpiredActivityLeases', mode: 'nowait', reach: 'sweep' },
   { method: 'releaseExpiredActivity', mode: 'nowait', reach: 'sweep' },
-  { method: 'reconcileReservationAccounting', mode: 'pool-default', reach: 'both' },
-  { method: 'leastLoadedCell', mode: 'pool-default', reach: 'both' },
-  { method: 'removeSupersededSameCellControls', mode: 'request', reach: 'request' }
+  // reconcileReservationAccounting and leastLoadedCell are gone too: the first
+  // repairs exactly two cells' counters and now holds only those rows, and the
+  // second selects from the inventory its single caller has already locked.
+]
+
+// Every inline `FROM relay_cells ... FOR UPDATE` outside the named lock helpers,
+// in source order: whole-table locks in reconciliation and sticky placement,
+// and single-row locks for a cell the method is already scoped to (heartbeat,
+// fence, drain generation, configuration, or a reservation adjust that runs
+// under a lock its caller already holds). A new inline lock fails the census
+// below until it is listed here; per-connection paths that touch more than one
+// cell go through lockCellRows so the order is fixed.
+const NAMED_LOCK_HELPERS = ['lockCellInventory', 'lockGeneralCellInventory', 'lockCellRows']
+
+const INLINE_CELL_LOCK_SITES = [
+  'reconcileCellsWithOptions',
+  'assignStickyOnce',
+  'recordCellHeartbeat',
+  'attestCellFence',
+  'adoptLegacyCellFence',
+  'commitLegacyCellFenceAdoption',
+  'prepareCellFenceAttempt',
+  'attestCellFenceAttempt',
+  'attestCellFenceAttempt',
+  'configureCell',
+  'assertDrainCellGeneration',
+  'adjustCellReservation'
 ]
 
 // The background sweeps, and nothing else. A method reachable from one of these
@@ -151,6 +179,42 @@ describe('cell inventory lock call-site census', () => {
     )
   })
 
+  // Why: the census only sees lockCellInventory calls, so a hand-written
+  // `relay_cells ... FOR UPDATE` would escape classification entirely.
+  it('routes every relay_cells row lock through a named lock helper', () => {
+    const lines = storeSource()
+    const rawSites: string[] = []
+    // Whole statements, not a fixed window: a wide column list or a raw
+    // FOR UPDATE inside query() must not slip past.
+    const source = lines.join('\n')
+    const bounds: { name: string; start: number }[] = []
+    lines.forEach((line, index) => {
+      const declaration = DECLARATION.exec(line)
+      if (declaration) bounds.push({ name: declaration[1]!, start: index })
+    })
+    const methodAt = (offset: number): string => {
+      const lineIndex = source.slice(0, offset).split('\n').length - 1
+      let name = '<module>'
+      for (const bound of bounds) if (bound.start <= lineIndex) name = bound.name
+      return name
+    }
+    const tick = String.fromCharCode(96)
+    const statementCall = new RegExp(
+      '\\.(queryLocked|query)\\(\\s*' + tick + '([^' + tick + ']*)' + tick,
+      'g'
+    )
+    for (const call of source.matchAll(statementCall)) {
+      const statement = call[2]!
+      if (!/\bFROM\s+relay_cells\b/.test(statement)) continue
+      const locks = call[1] === 'queryLocked' || /\bFOR\s+UPDATE\b/.test(statement)
+      if (!locks) continue
+      const method = methodAt(call.index)
+      if (NAMED_LOCK_HELPERS.includes(method)) continue
+      rawSites.push(method)
+    }
+    expect(rawSites).toEqual(INLINE_CELL_LOCK_SITES)
+  })
+
   it('leaves no call site taking the inventory without naming a mode', () => {
     const source = readFileSync(new URL('./assignment-store.ts', import.meta.url), 'utf8')
     const unclassified = source
diff --git a/cloud/apps/relay/src/cell-inventory-per-cell-locking-postgres.test.ts b/cloud/apps/relay/src/cell-inventory-per-cell-locking-postgres.test.ts
new file mode 100644
index 00000000000..8c0ebd73f32
--- /dev/null
+++ b/cloud/apps/relay/src/cell-inventory-per-cell-locking-postgres.test.ts
@@ -0,0 +1,206 @@
+import { afterAll, beforeAll, describe, expect, it } from 'vitest'
+import { RelayAssignmentStore } from './assignment-store.js'
+import { openRelayDatabase, type RelayDatabase } from './database.js'
+
+const databaseUrl = process.env.ORCA_RELAY_TEST_POSTGRES_URL
+const describePostgres = databaseUrl ? describe : describe.skip
+
+// Sorted ascending, and the host is pinned to the LAST id on purpose: the
+// fleet-wide lock is one ordered scan, so it holds every earlier row while it
+// waits on the pinned one. Pinning to the first id would make the two locking
+// models indistinguishable.
+const cells = ['a', 'b', 'c'].map((suffix) => ({
+  id: `percell-postgres-${suffix}`,
+  url: `https://percell-postgres-${suffix}.example.com`,
+  capacityRequests: 1_000,
+  connectionHardCap: 600 as const,
+  connectionUnobservedBound: 50
+}))
+const [cellA, cellB, cellC] = cells as [(typeof cells)[0], (typeof cells)[0], (typeof cells)[0]]
+const identity = { userId: 'percell-postgres-user', relayHostId: 'percellhost00001' }
+
+function heartbeat(cell: (typeof cells)[number]) {
+  return {
+    cellId: cell.id,
+    cellUrl: cell.url,
+    cellIncarnation: '11111111-1111-4111-8111-111111111111',
+    startedAt: 50,
+    ready: true,
+    observedRequests: 0,
+    totalConnections: 0,
+    inFlightConnections: 0,
+    reservedConnectionUnits: 0,
+    enforcedConnectionUnits: 0,
+    connectionInclusionWatermark: 1,
+    connectionHardCap: 600 as const,
+    connectionUnobservedBound: 50
+  }
+}
+
+describePostgres('PostgreSQL per-cell inventory locking', () => {
+  const databases: RelayDatabase[] = []
+
+  beforeAll(async () => {
+    for (let index = 0; index < 3; index++) {
+      databases.push(await openRelayDatabase({ databaseUrl, dataDir: '' }))
+    }
+  })
+
+  async function removeTestRows(database: RelayDatabase): Promise<void> {
+    await database.query(
+      `DELETE FROM relay_control_connection_reservations WHERE user_id LIKE 'percell-postgres-%'`
+    )
+    for (const table of [
+      'relay_assignment_activity_leases',
+      'relay_post_drain_migration_pins',
+      'relay_assignment_migration_incarnations',
+      'relay_assignment_migrations',
+      'relay_assignment_region_preferences',
+      'relay_assignments'
+    ]) {
+      await database.query(`DELETE FROM ${table} WHERE user_id LIKE 'percell-postgres-%'`)
+    }
+    for (const cell of cells) {
+      for (const table of [
+        'relay_cell_connection_snapshots',
+        'relay_cell_connection_runtime',
+        'relay_cell_connection_limits',
+        'relay_cell_runtime',
+        'relay_cells'
+      ]) {
+        await database.query(`DELETE FROM ${table} WHERE cell_id = ?`, [cell.id])
+      }
+    }
+  }
+
+  afterAll(async () => {
+    if (databases[0]) await removeTestRows(databases[0])
+    for (const connection of databases) await connection.close()
+  })
+
+  async function pinHostToLastCell(store: RelayAssignmentStore): Promise<void> {
+    await store.reconcileCells(cells)
+    for (const cell of cells) await store.recordCellHeartbeat(heartbeat(cell))
+    await store.setCellEnabled(cellA.id, false)
+    await store.setCellEnabled(cellB.id, false)
+    const assignment = await store.assign(identity)
+    expect(assignment.cellId).toBe(cellC.id)
+    await store.setCellEnabled(cellA.id, true)
+    await store.setCellEnabled(cellB.id, true)
+  }
+
+  async function lockWaiterAppeared(database: RelayDatabase): Promise<boolean> {
+    const deadline = Date.now() + 4_000
+    while (Date.now() < deadline) {
+      const rows = await database.query(
+        `SELECT count(*) AS waiting FROM pg_stat_activity
+         WHERE datname = current_database() AND wait_event_type = 'Lock'`
+      )
+      if (Number(rows[0]!.waiting) > 0) return true
+      await new Promise((resolve) => setTimeout(resolve, 10))
+    }
+    return false
+  }
+
+  // Why: a sticky refresh whose first NOWAIT probe loses retries by taking a
+  // cell row before the assignment row. That retry used to take the whole
+  // inventory, so one busy cell stalled every other cell's reconnects.
+  it('waits only on the pinned cell row while refreshing a sticky assignment', async () => {
+    await removeTestRows(databases[0]!)
+    const store = new RelayAssignmentStore(databases[0]!, () => 100)
+    await pinHostToLastCell(store)
+    // A host whose control lease was already reaped still holds its pin; that
+    // is the shape that reaches the cell-row probe instead of touchAssignment.
+    await databases[0]!.query(
+      `DELETE FROM relay_assignment_activity_leases WHERE user_id = ?`,
+      [identity.userId]
+    )
+
+    let releaseRow!: () => void
+    const rowReleased = new Promise<void>((resolve) => {
+      releaseRow = resolve
+    })
+    let rowHeld!: () => void
+    const rowHeldPromise = new Promise<void>((resolve) => {
+      rowHeld = resolve
+    })
+    const holder = databases[1]!.transaction(async (transaction) => {
+      await transaction.queryLocked(`SELECT * FROM relay_cells WHERE cell_id = ?`, [cellC.id])
+      rowHeld()
+      await rowReleased
+    })
+    await rowHeldPromise
+
+    const refresh = store.assign(identity)
+    expect(await lockWaiterAppeared(databases[2]!)).toBe(true)
+    // The refresh is blocked on cell C. Every earlier row must still be free:
+    // the ordered fleet-wide scan would be holding both of them by now.
+    const heldWhileRefreshWaits: string[] = []
+    await databases[2]!.transaction(async (transaction) => {
+      for (const cell of [cellA, cellB]) {
+        try {
+          await transaction.queryLocked(
+            `SELECT * FROM relay_cells WHERE cell_id = ?`,
+            [cell.id],
+            { failIfUnavailable: true }
+          )
+        } catch {
+          heldWhileRefreshWaits.push(cell.id)
+        }
+      }
+    })
+    releaseRow()
+    await holder
+
+    expect(heldWhileRefreshWaits).toEqual([])
+    expect((await refresh).cellId).toBe(cellC.id)
+  }, 15_000)
+
+  // Why: the counter moves by a delta now instead of an absolute value read
+  // from a snapshot, so concurrent movement on the same cell must still sum.
+  it('keeps a cell reservation exact under concurrent same-cell activity', async () => {
+    await removeTestRows(databases[0]!)
+    const store = new RelayAssignmentStore(databases[0]!, () => 100)
+    await store.reconcileCells(cells)
+    for (const cell of cells) await store.recordCellHeartbeat(heartbeat(cell))
+    await store.setCellEnabled(cellA.id, false)
+    await store.setCellEnabled(cellB.id, false)
+
+    const hosts = Array.from({ length: 6 }, (_, index) => ({
+      userId: `percell-postgres-user-${index}`,
+      relayHostId: `percellhost0000${index}`
+    }))
+    const stores = databases.map((database) => new RelayAssignmentStore(database, () => 100))
+    await Promise.all(hosts.map((host, index) => stores[index % stores.length]!.assign(host)))
+
+    // One splice each (2 units) on the same cell, from three connections at once.
+    await Promise.all(
+      hosts.map((host, index) =>
+        stores[index % stores.length]!.acquireActivity(host, {
+          activityId: `splice:percell-${index}`,
+          kind: 'splice',
+          cellId: cellC.id
+        })
+      )
+    )
+    const afterAcquire = await databases[0]!.query(
+      `SELECT reserved_requests FROM relay_cells WHERE cell_id = ?`,
+      [cellC.id]
+    )
+    // 6 pending control grants + 6 splices at 2 units each.
+    expect(Number(afterAcquire[0]!.reserved_requests)).toBe(6 + 12)
+
+    await Promise.all(
+      hosts.map((host, index) =>
+        stores[index % stores.length]!.releaseActivity(host, `splice:percell-${index}`)
+      )
+    )
+    const afterRelease = await databases[0]!.query(
+      `SELECT reserved_requests FROM relay_cells WHERE cell_id = ?`,
+      [cellC.id]
+    )
+    expect(Number(afterRelease[0]!.reserved_requests)).toBe(6)
+    await store.setCellEnabled(cellA.id, true)
+    await store.setCellEnabled(cellB.id, true)
+  }, 15_000)
+})
diff --git a/cloud/apps/relay/src/control-rebind-inventory-lock-postgres.test.ts b/cloud/apps/relay/src/control-rebind-inventory-lock-postgres.test.ts
new file mode 100644
index 00000000000..e990ac1ed1a
--- /dev/null
+++ b/cloud/apps/relay/src/control-rebind-inventory-lock-postgres.test.ts
@@ -0,0 +1,260 @@
+import { afterAll, beforeAll, describe, expect, it } from 'vitest'
+import { RelayAssignmentStore } from './assignment-store.js'
+import { openRelayDatabase, type RelayDatabase } from './database.js'
+
+const databaseUrl = process.env.ORCA_RELAY_TEST_POSTGRES_URL
+const describePostgres = databaseUrl ? describe : describe.skip
+
+// Three cells: the inventory lock covers more than the rows a move touches, and
+// a high-to-low move exposes any lock taken out of cell_id order.
+const cells = [
+  {
+    id: 'rebind-inventory-postgres-a',
+    url: 'https://rebind-inventory-postgres-a.example.com',
+    capacityRequests: 1_000,
+    connectionHardCap: 600 as const,
+    connectionUnobservedBound: 50
+  },
+  {
+    id: 'rebind-inventory-postgres-b',
+    url: 'https://rebind-inventory-postgres-b.example.com',
+    capacityRequests: 1_000,
+    connectionHardCap: 600 as const,
+    connectionUnobservedBound: 50
+  },
+  {
+    id: 'rebind-inventory-postgres-c',
+    url: 'https://rebind-inventory-postgres-c.example.com',
+    capacityRequests: 1_000,
+    connectionHardCap: 600 as const,
+    connectionUnobservedBound: 50
+  }
+]
+const identity = { userId: 'rebind-inventory-postgres-user', relayHostId: 'rebindinvhost001' }
+
+function heartbeat(cell: (typeof cells)[number]) {
+  return {
+    cellId: cell.id,
+    cellUrl: cell.url,
+    cellIncarnation: '11111111-1111-4111-8111-111111111111',
+    startedAt: 50,
+    ready: true,
+    observedRequests: 0,
+    totalConnections: 0,
+    inFlightConnections: 0,
+    reservedConnectionUnits: 0,
+    enforcedConnectionUnits: 0,
+    connectionInclusionWatermark: 1,
+    connectionHardCap: 600 as const,
+    connectionUnobservedBound: 50
+  }
+}
+
+// Why: every desktop control rebind used to take the fleet-wide relay_cells
+// FOR UPDATE lock, so a rebind on one cell queued behind whatever held any
+// other cell's row, until COMMIT (55P03 at the request bound). A rebind only
+// touches its own cell row, so it must proceed while another cell's row is
+// held elsewhere.
+describePostgres('PostgreSQL control rebind under a held cell row', () => {
+  const databases: RelayDatabase[] = []
+
+  beforeAll(async () => {
+    databases.push(
+      await openRelayDatabase({ databaseUrl, dataDir: '' }),
+      await openRelayDatabase({ databaseUrl, dataDir: '' })
+    )
+  })
+
+  async function removeTestRows(database: RelayDatabase): Promise<void> {
+    await database.query(
+      `DELETE FROM relay_control_connection_reservations WHERE user_id = ?`,
+      [identity.userId]
+    )
+    for (const table of [
+      'relay_assignment_activity_leases',
+      'relay_post_drain_migration_pins',
+      'relay_assignment_migration_incarnations',
+      'relay_assignment_migrations',
+      'relay_assignments'
+    ]) {
+      await database.query(`DELETE FROM ${table} WHERE user_id = ?`, [identity.userId])
+    }
+    for (const cell of cells) {
+      for (const table of [
+        'relay_cell_connection_snapshots',
+        'relay_cell_connection_runtime',
+        'relay_cell_connection_limits',
+        'relay_cell_runtime',
+        'relay_cells'
+      ]) {
+        await database.query(`DELETE FROM ${table} WHERE cell_id = ?`, [cell.id])
+      }
+    }
+  }
+
+  afterAll(async () => {
+    if (databases[0]) await removeTestRows(databases[0])
+    for (const connection of databases) await connection.close()
+  })
+
+  it("rebinds and supersedes a control while another cell's row is held", async () => {
+    // A prior aborted run leaves connection snapshots that reject a replayed watermark.
+    await removeTestRows(databases[0]!)
+    const store = new RelayAssignmentStore(databases[0]!, () => 100)
+    await store.reconcileCells(cells)
+    for (const cell of cells) await store.recordCellHeartbeat(heartbeat(cell))
+    // Pin the host to cell A so placement is deterministic.
+    await store.setCellEnabled(cells[1]!.id, false)
+    await store.setCellEnabled(cells[2]!.id, false)
+    const assignment = await store.assign(identity)
+    expect(assignment.cellId).toBe(cells[0]!.id)
+    await store.setCellEnabled(cells[1]!.id, true)
+    await store.setCellEnabled(cells[2]!.id, true)
+    await store.activateControl(identity, {
+      cellId: cells[0]!.id,
+      assignmentEpoch: assignment.assignmentEpoch,
+      generation: 1,
+      connectionInclusionWatermark: 10
+    })
+
+    // Hold only cell B's row on a second connection, the way a rebind on B
+    // does, for longer than the request-path lock bound.
+    let releaseInventory!: () => void
+    const inventoryReleased = new Promise<void>((resolve) => {
+      releaseInventory = resolve
+    })
+    let inventoryHeld!: () => void
+    const inventoryHeldPromise = new Promise<void>((resolve) => {
+      inventoryHeld = resolve
+    })
+    const holder = databases[1]!.transaction(async (transaction) => {
+      await transaction.queryLocked(`SELECT * FROM relay_cells WHERE cell_id = ?`, [cells[1]!.id])
+      inventoryHeld()
+      await inventoryReleased
+    })
+    await inventoryHeldPromise
+
+    // A generation-2 rebind on cell A supersedes generation 1. It must not
+    // wait on cell B's row.
+    const startedAt = Date.now()
+    const blockedStatement = async (): Promise<string> => {
+      const rows = await databases[1]!.query(
+        `SELECT left(query, 160) AS q FROM pg_stat_activity
+         WHERE datname = current_database() AND wait_event_type = 'Lock'`
+      )
+      return rows.map((row) => String(row.q)).join(' | ')
+    }
+    const timeout = new Promise<never>((_, reject) =>
+      setTimeout(
+        () =>
+          void blockedStatement().then((statement) =>
+            reject(new Error(`rebind on cell A blocked behind cell B's row: ${statement}`))
+          ),
+        2_000
+      )
+    )
+    const rebound = await Promise.race([
+      store.activateControl(identity, {
+        cellId: cells[0]!.id,
+        assignmentEpoch: assignment.assignmentEpoch,
+        generation: 2,
+        connectionInclusionWatermark: 11
+      }),
+      timeout
+    ])
+    const elapsedMs = Date.now() - startedAt
+    releaseInventory()
+    await holder
+
+    expect(rebound).toBe(`control:${cells[0]!.id}:2`)
+    expect(elapsedMs).toBeLessThan(2_000)
+    const controls = await databases[0]!.query(
+      `SELECT activity_id FROM relay_assignment_activity_leases
+       WHERE user_id = ? AND activity_kind = 'control' ORDER BY activity_id`,
+      [identity.userId]
+    )
+    expect(controls).toEqual([{ activity_id: `control:${cells[0]!.id}:2` }])
+    const reserved = await databases[0]!.query(
+      `SELECT reserved_requests FROM relay_cells WHERE cell_id = ?`,
+      [cells[0]!.id]
+    )
+    expect(Number(reserved[0]!.reserved_requests)).toBe(1)
+  }, 15_000)
+
+  // Why: a phone's activity id is client-chosen and can follow the host across
+  // a migration, so acquireActivity may touch two cell rows. Moving from the
+  // higher cell to the lower one is where an unordered lock cycles with
+  // placement's ascending inventory lock (reproduced live before this fix).
+  it('moves an activity from a higher cell to a lower one in cell_id order', async () => {
+    await removeTestRows(databases[0]!)
+    const [cellA, cellB, cellC] = cells as [typeof cells[0], typeof cells[0], typeof cells[0]]
+    const store = new RelayAssignmentStore(databases[0]!, () => 100)
+    await store.reconcileCells(cells)
+    for (const cell of cells) await store.recordCellHeartbeat(heartbeat(cell))
+    await store.setCellEnabled(cellA.id, false)
+    await store.setCellEnabled(cellB.id, false)
+    const assignment = await store.assign(identity)
+    expect(assignment.cellId).toBe(cellC.id)
+    await store.setCellEnabled(cellA.id, true)
+    await store.setCellEnabled(cellB.id, true)
+    const activityId = 'splice:rebind-inventory-postgres'
+    await store.acquireActivity(identity, { activityId, kind: 'splice', cellId: cellC.id })
+    // The migration makes B authoritative; the lease still sits on C.
+    const migration = await store.startEvacuation(identity, cellB.id)
+    expect(migration.targetCellId).toBe(cellB.id)
+
+    // Hold B elsewhere. An ordered move locks B first and queues here holding
+    // nothing else. Locking C first (the old lease's row, as an unordered move
+    // does) or the whole inventory (which takes A) shows up as a held row.
+    let releaseRow!: () => void
+    const rowReleased = new Promise<void>((resolve) => {
+      releaseRow = resolve
+    })
+    let rowHeld!: () => void
+    const rowHeldPromise = new Promise<void>((resolve) => {
+      rowHeld = resolve
+    })
+    const heldWhileMoverWaits: string[] = []
+    const holder = databases[1]!.transaction(async (transaction) => {
+      await transaction.queryLocked(`SELECT * FROM relay_cells WHERE cell_id = ?`, [cellB.id])
+      rowHeld()
+      await rowReleased
+      for (const cell of [cellA, cellC]) {
+        try {
+          await transaction.queryLocked(`SELECT * FROM relay_cells WHERE cell_id = ?`, [cell.id], {
+            failIfUnavailable: true
+          })
+        } catch {
+          heldWhileMoverWaits.push(cell.id)
+        }
+      }
+    })
+    await rowHeldPromise
+    const move = store.acquireActivity(identity, { activityId, kind: 'splice', cellId: cellB.id })
+    let moved = false
+    void move.then(() => {
+      moved = true
+    })
+    await new Promise((resolve) => setTimeout(resolve, 250))
+    expect(moved).toBe(false)
+    releaseRow()
+    await holder
+    await move
+    expect(heldWhileMoverWaits).toEqual([])
+
+    const reservations = await databases[0]!.query(
+      `SELECT cell_id, reserved_requests FROM relay_cells
+       WHERE cell_id IN (?, ?, ?) ORDER BY cell_id ASC`,
+      [cellA.id, cellB.id, cellC.id]
+    )
+    const reserved = reservations.map((row) => [String(row.cell_id), Number(row.reserved_requests)])
+    expect(reserved).toEqual([
+      [cellA.id, 0],
+      // Migration grant plus the moved splice, as in the SQLite origin-scoped
+      // reservation case: the lock change did not alter accounting.
+      [cellB.id, 6],
+      // The sticky grant stays on the source until the migration completes.
+      [cellC.id, 1]
+    ])
+  }, 15_000)
+})
diff --git a/cloud/apps/relay/src/database-postgres-timeout.test.ts b/cloud/apps/relay/src/database-postgres-timeout.test.ts
index 7aba1234f7f..c9021a9ef18 100644
--- a/cloud/apps/relay/src/database-postgres-timeout.test.ts
+++ b/cloud/apps/relay/src/database-postgres-timeout.test.ts
@@ -2,7 +2,10 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
 const fakes = vi.hoisted(() => ({
   configs: [] as Array<Record<string, unknown>>,
-  query: vi.fn(async () => ({ rows: [], rowCount: 0 })),
+  // Pool construction and pool shutdown interleaved, so "the schema pool is
+  // gone before the serving pool opens" is checkable rather than assumed.
+  lifecycle: [] as string[],
+  query: vi.fn(async (_sql: string) => ({ rows: [], rowCount: 0 })),
   release: vi.fn(),
   end: vi.fn(async () => undefined)
 }))
@@ -13,20 +16,37 @@ vi.mock('pg', () => ({
       totalCount = 1
       idleCount = 1
       waitingCount = 0
-      end = fakes.end
       on = vi.fn()
       connect = vi.fn(async () => ({ query: fakes.query, release: fakes.release }))
+      private readonly label: string
 
       constructor(config: Record<string, unknown>) {
         fakes.configs.push(config)
+        this.label = `max=${String(config.max)} statement_timeout=${String(config.statement_timeout)}`
+        fakes.lifecycle.push(`open ${this.label}`)
+      }
+
+      async end(): Promise<void> {
+        fakes.lifecycle.push(`end ${this.label}`)
+        await fakes.end()
       }
     }
   }
 }))
 
-import { openRelayDatabase } from './database.js'
+import { openRelayDatabase, relayPostgresStatementTimeoutMs } from './database.js'
 import { applyPostgresSchema } from './postgres-schema-startup.js'
 
+const SCHEMA_POOL = {
+  max: 1,
+  application_name: 'orca-relay/director/director/schema',
+  connectionTimeoutMillis: 2_000,
+  // Why: DDL must not inherit the request deadline.
+  statement_timeout: 0,
+  lock_timeout: 1_000,
+  idle_in_transaction_session_timeout: 5_000
+}
+
 afterEach(() => {
   vi.restoreAllMocks()
 })
@@ -34,9 +54,11 @@ afterEach(() => {
 describe('PostgreSQL relay deadlines', () => {
   beforeEach(() => {
     fakes.configs.length = 0
+    fakes.lifecycle.length = 0
     fakes.query.mockClear()
     fakes.release.mockClear()
     fakes.end.mockClear()
+    delete process.env.ORCA_RELAY_POSTGRES_STATEMENT_TIMEOUT_MS
   })
 
   it('bounds pool acquisition, statements, locks, and abandoned transactions', async () => {
@@ -48,6 +70,7 @@ describe('PostgreSQL relay deadlines', () => {
     })
 
     expect(fakes.configs).toEqual([
+      expect.objectContaining(SCHEMA_POOL),
       expect.objectContaining({
         max: 3,
         application_name: 'orca-relay/director/director',
@@ -59,6 +82,110 @@ describe('PostgreSQL relay deadlines', () => {
     ])
     await database.close()
   })
+
+  // Why: an untimed session left open would be a standing way for request work
+  // to escape the deadline this whole pool config exists to enforce.
+  it('closes the untimed schema pool before the serving pool opens', async () => {
+    const database = await openRelayDatabase({
+      databaseUrl: 'postgresql://relay:secret@127.0.0.1:5432/relay',
+      dataDir: './unused',
+      poolMax: 3,
+      applicationName: 'orca-relay/director/director'
+    })
+
+    expect(fakes.lifecycle).toEqual([
+      'open max=1 statement_timeout=0',
+      'end max=1 statement_timeout=0',
+      'open max=3 statement_timeout=5000'
+    ])
+    await database.close()
+  })
+
+  it('applies the schema on the untimed pool, never on the serving one', async () => {
+    fakes.query.mockClear()
+    const ddl: string[] = []
+    fakes.query.mockImplementation(async (sql: string) => {
+      // Every statement issued before the serving pool exists is schema work.
+      if (fakes.lifecycle.length === 1) ddl.push(sql)
+      return { rows: [], rowCount: 0 }
+    })
+    const database = await openRelayDatabase({
+      databaseUrl: 'postgresql://relay:secret@127.0.0.1:5432/relay',
+      dataDir: './unused'
+    })
+
+    expect(ddl.length).toBeGreaterThan(0)
+    // Statements can open with a leading `--` rationale comment.
+    const body = (statement: string): string =>
+      statement.replace(/^(?:\s*--[^\n]*\n)*\s*/, '')
+    expect(ddl.every((statement) => /^CREATE\b/i.test(body(statement)))).toBe(true)
+    // The backfill is DML, so it stays on the deadline-bearing serving pool.
+    expect(ddl.some((statement) => statement.includes('INSERT INTO'))).toBe(false)
+    await database.close()
+  })
+
+  it('takes the serving statement deadline from the environment', async () => {
+    process.env.ORCA_RELAY_POSTGRES_STATEMENT_TIMEOUT_MS = '2500'
+
+    const database = await openRelayDatabase({
+      databaseUrl: 'postgresql://relay:secret@127.0.0.1:5432/relay',
+      dataDir: './unused'
+    })
+
+    expect(fakes.configs).toEqual([
+      expect.objectContaining({ statement_timeout: 0 }),
+      expect.objectContaining({ statement_timeout: 2_500 })
+    ])
+    await database.close()
+  })
+
+  it.each(['0', '-1', '2.5', 'soon', ' '])(
+    'refuses %s as a statement deadline instead of running unbounded',
+    (value) => {
+      expect(() =>
+        relayPostgresStatementTimeoutMs({ ORCA_RELAY_POSTGRES_STATEMENT_TIMEOUT_MS: value })
+      ).toThrow('invalid_statement_timeout')
+    }
+  )
+
+  it.each([undefined, ''])('defaults to 5s when the environment says %s', (value) => {
+    expect(
+      relayPostgresStatementTimeoutMs(
+        value === undefined ? {} : { ORCA_RELAY_POSTGRES_STATEMENT_TIMEOUT_MS: value }
+      )
+    ).toBe(5_000)
+  })
+
+  // Why: a statement deadline that reaches the caller as a crash converts a
+  // transient stall into a failed assignment. It aborts the transaction exactly
+  // as a lock timeout does, so it belongs on the same bounded retry.
+  it('retries a statement timeout on a fresh client', async () => {
+    vi.spyOn(console, 'warn').mockImplementation(() => undefined)
+    const database = await openRelayDatabase({
+      databaseUrl: 'postgresql://relay:secret@127.0.0.1:5432/relay',
+      dataDir: './unused'
+    })
+    let attempts = 0
+
+    const result = await database.transaction(async (transaction) => {
+      attempts += 1
+      if (attempts === 1) {
+        await transaction.query('SELECT 1')
+        throw Object.assign(new Error('canceling statement due to statement timeout'), {
+          code: '57014'
+        })
+      }
+      return 'committed'
+    })
+
+    expect(result).toBe('committed')
+    expect(attempts).toBe(2)
+    expect(console.warn).toHaveBeenCalledWith(
+      expect.stringContaining('"event":"orca_relay_postgres_transaction_retry"')
+    )
+    expect(console.warn).toHaveBeenCalledWith(expect.stringContaining('"code":"57014"'))
+    await database.close()
+  })
 })
 
 describe('PostgreSQL schema startup', () => {
diff --git a/cloud/apps/relay/src/database-statement-timeout-postgres.test.ts b/cloud/apps/relay/src/database-statement-timeout-postgres.test.ts
new file mode 100644
index 00000000000..6b7ebb0334e
--- /dev/null
+++ b/cloud/apps/relay/src/database-statement-timeout-postgres.test.ts
@@ -0,0 +1,98 @@
+import { afterAll, beforeAll, describe, expect, it } from 'vitest'
+import { openRelayDatabase, type RelayDatabase } from './database.js'
+
+const databaseUrl = process.env.ORCA_RELAY_TEST_POSTGRES_URL
+const describePostgres = databaseUrl ? describe : describe.skip
+const applicationName = 'orca-relay/statement-timeout-postgres'
+
+describePostgres('PostgreSQL statement deadline', () => {
+  const databases: RelayDatabase[] = []
+
+  beforeAll(async () => {
+    databases.push(await openRelayDatabase({ databaseUrl, dataDir: '' }))
+  })
+
+  afterAll(async () => {
+    for (const database of databases) await database.close()
+  })
+
+  it('serves requests under the configured deadline', async () => {
+    const database = await openRelayDatabase({ databaseUrl, dataDir: '', statementTimeoutMs: 300 })
+    databases.push(database)
+
+    expect(await database.query(`SELECT current_setting('statement_timeout') AS statement_timeout`)).toEqual([
+      { statement_timeout: '300ms' }
+    ])
+  })
+
+  // Why: a real 57014 aborts the transaction exactly as a lock timeout does. If
+  // it escapes the bounded retry it becomes a failed assignment instead of a
+  // slow one.
+  it('retries a real statement timeout on a fresh client', async () => {
+    const database = await openRelayDatabase({ databaseUrl, dataDir: '', statementTimeoutMs: 300 })
+    databases.push(database)
+    let attempts = 0
+
+    const result = await database.transaction(async (transaction) => {
+      attempts += 1
+      if (attempts === 1) await transaction.query(`SELECT pg_sleep(2)`)
+      return attempts
+    })
+
+    expect(result).toBe(2)
+  }, 15_000)
+
+  // Why: DDL runs on its own untimed connection. relay_invites carries a
+  // CREATE INDEX IF NOT EXISTS, which (unlike CREATE TABLE IF NOT EXISTS)
+  // really does queue behind an ACCESS EXCLUSIVE lock on the table.
+  it('applies the schema behind a held ACCESS EXCLUSIVE lock', async () => {
+    let releaseTable!: () => void
+    const tableReleased = new Promise<void>((resolve) => {
+      releaseTable = resolve
+    })
+    let tableHeld!: () => void
+    const tableHeldPromise = new Promise<void>((resolve) => {
+      tableHeld = resolve
+    })
+    const holder = databases[0]!.transaction(async (transaction) => {
+      await transaction.query(`LOCK TABLE relay_invites IN ACCESS EXCLUSIVE MODE`)
+      tableHeld()
+      await tableReleased
+    })
+    await tableHeldPromise
+
+    const opening = openRelayDatabase({
+      databaseUrl,
+      dataDir: '',
+      applicationName,
+      // Far too short for a blocked DDL; the serving pool wears it, the schema
+      // connection must not.
+      statementTimeoutMs: 200
+    })
+    const blockedOnSchemaConnection = async (): Promise<boolean> => {
+      const deadline = Date.now() + 4_000
+      while (Date.now() < deadline) {
+        const rows = await databases[0]!.query(
+          `SELECT count(*) AS waiting FROM pg_stat_activity
+           WHERE datname = current_database() AND wait_event_type = 'Lock'
+             AND application_name = ?`,
+          [`${applicationName}/schema`]
+        )
+        if (Number(rows[0]!.waiting) > 0) return true
+        await new Promise((resolve) => setTimeout(resolve, 10))
+      }
+      return false
+    }
+    const blocked = await blockedOnSchemaConnection()
+    releaseTable()
+    await holder
+
+    const database = await opening
+    databases.push(database)
+    expect(blocked).toBe(true)
+    // The serving pool still carries the short deadline it was opened with.
+    expect(await database.query(`SELECT current_setting('statement_timeout') AS statement_timeout`)).toEqual([
+      { statement_timeout: '200ms' }
+    ])
+  }, 15_000)
+})
diff --git a/cloud/apps/relay/src/database.ts b/cloud/apps/relay/src/database.ts
index 326ab010ccb..2558831ca64 100644
--- a/cloud/apps/relay/src/database.ts
+++ b/cloud/apps/relay/src/database.ts
@@ -796,12 +796,34 @@ class PostgresTransaction implements RelayDatabase {
 const POSTGRES_TRANSACTION_ATTEMPTS = 3
 const POSTGRES_RETRY_MAX_DELAY_MS = 25
 const POSTGRES_CONNECTION_TIMEOUT_MS = 2_000
-const POSTGRES_STATEMENT_TIMEOUT_MS = 5_000
+// Derivation: a control renewal must land inside its own 30s tick
+// (RELAY_PROTOCOL_LIMITS.controlPingIntervalMs * 2), and a transaction gets
+// POSTGRES_TRANSACTION_ATTEMPTS tries, so the worst case a renewal can spend in
+// Postgres is attempts * timeout. 5s keeps that at 15s, half the tick, and still
+// leaves room for the connect timeout above.
+export const POSTGRES_STATEMENT_TIMEOUT_MS = 5_000
 const POSTGRES_IDLE_TRANSACTION_TIMEOUT_MS = 5_000
 
+export function relayPostgresStatementTimeoutMs(
+  env: NodeJS.ProcessEnv = process.env
+): number {
+  const configured = env.ORCA_RELAY_POSTGRES_STATEMENT_TIMEOUT_MS
+  if (configured === undefined || configured === '') return POSTGRES_STATEMENT_TIMEOUT_MS
+  const milliseconds = Number(configured)
+  // 0 is PostgreSQL's "no timeout"; refusing it keeps the deadline this exists
+  // to enforce from being disabled by a typo in an environment variable.
+  if (!Number.isInteger(milliseconds) || milliseconds < 1) {
+    throw new Error('invalid_statement_timeout')
+  }
+  return milliseconds
+}
+
 function retryablePostgresTransactionError(error: unknown): boolean {
   const code = String((error as { code?: unknown }).code)
-  return code === '40P01' || code === '40001' || code === '55P03'
+  // 57014 is the pool statement_timeout firing. It aborts the transaction the
+  // same way a lock timeout does, so it belongs on the bounded retry path
+  // rather than surfacing as a terminal failure to the caller.
+  return code === '40P01' || code === '40001' || code === '55P03' || code === '57014'
 }
 
 export function isRelayDatabaseTransientError(error: unknown): boolean {
@@ -963,11 +985,36 @@ async function applySchema(database: RelayDatabase): Promise<void> {
   }
 }
 
-async function applySchemaWithPostgresRetries(database: RelayDatabase): Promise<void> {
-  await applyPostgresSchema(
-    SCHEMA.split(';').filter((statement) => statement.trim()),
-    async (statement) => await database.query(statement)
-  )
+// Why: DDL is not a request. A CREATE INDEX on a grown table legitimately runs
+// longer than the request statement_timeout, and inheriting that timeout would
+// make every startup fail at the same statement instead of finishing once. One
+// short-lived connection of its own, ended before the serving pool opens, keeps
+// the untimed session off the request path entirely.
+async function applySchemaOnUntimedPool(
+  databaseUrl: string,
+  applicationName: string | undefined
+): Promise<void> {
+  const pool = new pg.Pool({
+    connectionString: databaseUrl,
+    max: 1,
+    application_name: applicationName ? `${applicationName}/schema` : undefined,
+    connectionTimeoutMillis: POSTGRES_CONNECTION_TIMEOUT_MS,
+    statement_timeout: 0,
+    // Kept: a DDL blocked behind another director's ACCESS EXCLUSIVE lock must
+    // yield to the bounded schema retry instead of holding the connection.
+    lock_timeout: POSTGRES_LOCK_TIMEOUT_MS,
+    idle_in_transaction_session_timeout: POSTGRES_IDLE_TRANSACTION_TIMEOUT_MS
+  })
+  absorbPostgresIdleClientErrors(pool)
+  const database = new PostgresDatabase(pool)
+  try {
+    await applyPostgresSchema(
+      SCHEMA.split(';').filter((statement) => statement.trim()),
+      async (statement) => await database.query(statement)
+    )
+  } finally {
+    await database.close().catch(() => undefined)
+  }
 }
 
 async function backfillRelayCellRegions(database: RelayDatabase): Promise<void> {
@@ -983,15 +1030,17 @@ export async function openRelayDatabase(input: {
   dataDir: string
   poolMax?: number
   applicationName?: string
+  statementTimeoutMs?: number
 }): Promise<RelayDatabase> {
   let database: RelayDatabase
   if (input.databaseUrl) {
+    await applySchemaOnUntimedPool(input.databaseUrl, input.applicationName)
     const pool = new pg.Pool({
       connectionString: input.databaseUrl,
       max: input.poolMax ?? 10,
       application_name: input.applicationName,
       connectionTimeoutMillis: POSTGRES_CONNECTION_TIMEOUT_MS,
-      statement_timeout: POSTGRES_STATEMENT_TIMEOUT_MS,
+      statement_timeout: input.statementTimeoutMs ?? relayPostgresStatementTimeoutMs(),
       lock_timeout: POSTGRES_LOCK_TIMEOUT_MS,
       idle_in_transaction_session_timeout: POSTGRES_IDLE_TRANSACTION_TIMEOUT_MS
     })
@@ -1004,8 +1053,7 @@ export async function openRelayDatabase(input: {
     database = new SqliteDatabase(sqlite)
   }
   try {
-    if (input.databaseUrl) await applySchemaWithPostgresRetries(database)
-    else await applySchema(database)
+    if (!input.databaseUrl) await applySchema(database)
     await backfillRelayCellRegions(database)
     return database
   } catch (error) {
diff --git a/cloud/apps/relay/src/host-close-reason-memory.test.ts b/cloud/apps/relay/src/host-close-reason-memory.test.ts
new file mode 100644
index 00000000000..2985e6f1a1d
--- /dev/null
+++ b/cloud/apps/relay/src/host-close-reason-memory.test.ts
@@ -0,0 +1,82 @@
+import { ASSIGNMENT_LIMITS, RELAY_HOST_CLOSE_REASON } from '@orca-cloud/relay-contract'
+import { describe, expect, it } from 'vitest'
+import { HostCloseReasonMemory } from './host-close-reason-memory.js'
+
+function memoryAt(clock: { now: number }): HostCloseReasonMemory {
+  return new HostCloseReasonMemory(() => clock.now)
+}
+
+describe('HostCloseReasonMemory', () => {
+  it('remembers only reasons it knows', () => {
+    const clock = { now: 1_000 }
+    const memory = memoryAt(clock)
+
+    memory.record('a', RELAY_HOST_CLOSE_REASON.SIGNED_OUT)
+    memory.record('b', 'quitting')
+    memory.record('c', Buffer.alloc(0))
+    memory.record('d', undefined)
+
+    expect(memory.read('a')).toBe(RELAY_HOST_CLOSE_REASON.SIGNED_OUT)
+    expect(memory.read('b')).toBeNull()
+    expect(memory.read('c')).toBeNull()
+    expect(memory.read('d')).toBeNull()
+  })
+
+  it('accepts the reason as the Buffer a ws close delivers', () => {
+    const clock = { now: 1_000 }
+    const memory = memoryAt(clock)
+
+    memory.record('a', Buffer.from(RELAY_HOST_CLOSE_REASON.SIGNED_OUT))
+
+    expect(memory.read('a')).toBe(RELAY_HOST_CLOSE_REASON.SIGNED_OUT)
+  })
+
+  it('expires an entry once its host may have been rebalanced away', () => {
+    const clock = { now: 1_000 }
+    const memory = memoryAt(clock)
+    memory.record('a', RELAY_HOST_CLOSE_REASON.SIGNED_OUT)
+
+    clock.now += ASSIGNMENT_LIMITS.dormantTtlMs - 1
+    expect(memory.read('a')).toBe(RELAY_HOST_CLOSE_REASON.SIGNED_OUT)
+
+    clock.now += 1
+    expect(memory.read('a')).toBeNull()
+    expect(memory.size()).toBe(0)
+  })
+
+  it('forgets on demand', () => {
+    const clock = { now: 1_000 }
+    const memory = memoryAt(clock)
+    memory.record('a', RELAY_HOST_CLOSE_REASON.SIGNED_OUT)
+
+    memory.forget('a')
+
+    expect(memory.read('a')).toBeNull()
+  })
+
+  it('drops the oldest survivors rather than growing without bound', () => {
+    const clock = { now: 1_000 }
+    const memory = memoryAt(clock)
+    for (let index = 0; index < 50_050; index++) {
+      memory.record(`host-${index}`, RELAY_HOST_CLOSE_REASON.SIGNED_OUT)
+    }
+
+    expect(memory.size()).toBe(50_000)
+    expect(memory.read('host-0')).toBeNull()
+    expect(memory.read('host-50049')).toBe(RELAY_HOST_CLOSE_REASON.SIGNED_OUT)
+  })
+
+  it('re-recording refreshes recency so a live host is not evicted first', () => {
+    const clock = { now: 1_000 }
+    const memory = memoryAt(clock)
+    memory.record('a', RELAY_HOST_CLOSE_REASON.SIGNED_OUT)
+    memory.record('b', RELAY_HOST_CLOSE_REASON.SIGNED_OUT)
+    memory.record('a', RELAY_HOST_CLOSE_REASON.SIGNED_OUT)
+
+    expect([...['a', 'b'].map((key) => memory.read(key))]).toEqual([
+      RELAY_HOST_CLOSE_REASON.SIGNED_OUT,
+      RELAY_HOST_CLOSE_REASON.SIGNED_OUT
+    ])
+    expect(memory.size()).toBe(2)
+  })
+})
diff --git a/cloud/apps/relay/src/host-close-reason-memory.ts b/cloud/apps/relay/src/host-close-reason-memory.ts
new file mode 100644
index 00000000000..ed01aacd666
--- /dev/null
+++ b/cloud/apps/relay/src/host-close-reason-memory.ts
@@ -0,0 +1,72 @@
+import {
+  ASSIGNMENT_LIMITS,
+  relayHostCloseReasonFrom,
+  type RelayHostCloseReason
+} from '@orca-cloud/relay-contract'
+
+// Retention matches the dormant assignment TTL: past it the host may have been
+// rebalanced onto another cell, so this cell is no longer the one a phone asks.
+const RETENTION_MS = ASSIGNMENT_LIMITS.dormantTtlMs
+// A fleet-wide auth outage signs out every host at once; the cap bounds that
+// burst well above any single cell's host count without becoming a leak.
+const MAX_ENTRIES = 50_000
+
+// Why in-memory and not Postgres: a phone reaches the cell its host's assignment
+// row already names, which is the same cell that watched the control socket
+// close. Losing this on a cell restart degrades to the pre-existing generic
+// verdict, so the failure mode is the old behaviour rather than a wrong one.
+export class HostCloseReasonMemory {
+  private readonly entries = new Map<string, { reason: RelayHostCloseReason; expiresAt: number }>()
+
+  constructor(private readonly now: () => number = Date.now) {}
+
+  // Silently ignores anything that is not a known reason, which is every close
+  // from a host that predates the field and every abrupt 1006.
+  record(key: string, reason: unknown): void {
+    const parsed = relayHostCloseReasonFrom(reason)
+    if (!parsed) {
+      return
+    }
+    this.entries.delete(key)
+    this.entries.set(key, { reason: parsed, expiresAt: this.now() + RETENTION_MS })
+    this.evict()
+  }
+
+  forget(key: string): void {
+    this.entries.delete(key)
+  }
+
+  read(key: string): RelayHostCloseReason | null {
+    const entry = this.entries.get(key)
+    if (!entry) {
+      return null
+    }
+    if (entry.expiresAt <= this.now()) {
+      this.entries.delete(key)
+      return null
+    }
+    return entry.reason
+  }
+
+  size(): number {
+    return this.entries.size
+  }
+
+  private evict(): void {
+    const now = this.now()
+    for (const [key, entry] of this.entries) {
+      if (entry.expiresAt > now) {
+        break
+      }
+      this.entries.delete(key)
+    }
+    // Insertion order is recency order (record deletes before setting), so the
+    // head is always the oldest survivor.
+    for (const key of this.entries.keys()) {
+      if (this.entries.size <= MAX_ENTRIES) {
+        break
+      }
+      this.entries.delete(key)
+    }
+  }
+}
diff --git a/cloud/apps/relay/src/host-session-client-accept.test.ts b/cloud/apps/relay/src/host-session-client-accept.test.ts
new file mode 100644
index 00000000000..83b6c21f997
--- /dev/null
+++ b/cloud/apps/relay/src/host-session-client-accept.test.ts
@@ -0,0 +1,382 @@
+import { EventEmitter } from 'node:events'
+import { RELAY_CLOSE_CODE } from '@orca-cloud/relay-contract'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type WebSocket from 'ws'
+import type { RelayAssignmentStore } from './assignment-store.js'
+import type { RelayConfig } from './config.js'
+import type { CredentialReservation, RelayCredentialStore } from './credential-store.js'
+import {
+  CONTROL_LEASE_JITTER_MS,
+  CONTROL_LEASE_MS,
+  HostSessionRegistry
+} from './host-session-registry.js'
+import type { RelayRuntimeObserver } from './relay-observability.js'
+import type { RelayTokenClaims } from './relay-token-verifier.js'
+import { ProcessQueuedByteBudget } from './splice-forwarder.js'
+
+// Incident 2026-09-04 ~01:05Z: the phone's dial bound ran out while the cell was
+// still inside acceptClient's serialized Postgres phase (cell-inventory lock
+// contention). The cell then finished the work for a socket nobody held, holding
+// an activity lease for the 10s attach deadline before its timer unwound it, and
+// logged `host_data_reservation_already_bound`.
+
+class FakeSocket extends EventEmitter {
+  readonly OPEN = 1
+  readonly CLOSING = 2
+  readonly CLOSED = 3
+  readyState = this.OPEN
+  readonly send = vi.fn()
+  readonly close = vi.fn((code?: number, reason?: string) => {
+    this.readyState = this.CLOSED
+    this.emit('close', code, Buffer.from(reason ?? ''))
+  })
+  readonly terminate = vi.fn(() => {
+    this.readyState = this.CLOSED
+    this.emit('close')
+  })
+}
+
+const config = {
+  port: 8080,
+  publicUrl: 'https://relay-c3.example.com',
+  cellUrl: 'https://relay-c3.example.com',
+  authIssuer: 'https://auth.example.com',
+  authAudience: 'orca-relay',
+  jwksUrl: 'https://auth.example.com/jwks',
+  assignmentSigningKey: new Uint8Array(32),
+  role: 'cell',
+  cellId: 'production-gce-c3',
+  cells: [{ id: 'production-gce-c3', url: 'https://relay-c3.example.com', capacityRequests: 4_000 }],
+  adminAudience: 'https://relay-c3.example.com/v1/admin/drain',
+  deployServiceAccount: 'deploy@example.com',
+  runtimeServiceAccount: 'runtime@example.com',
+  adminJwksUrl: 'https://auth.example.com/admin-jwks',
+  databasePoolMax: 10,
+  publicAssignmentsEnabled: true,
+  publicAssignmentConcurrency: 2,
+  publicAssignmentQueueMax: 128,
+  publicAssignmentWaitMs: 4_000,
+  publicResolveConcurrency: 1,
+  publicResolveWaitMs: 5_000,
+  publicAssignmentRetryAfterSeconds: 5,
+  dataDir: './test-data'
+} satisfies RelayConfig
+
+const identity = {
+  sub: 'user-1',
+  prof: 'profile-1',
+  relayHostId: 'abcdefghijklmnop',
+  purpose: 'host-control',
+  exp: 4_102_444_800
+} satisfies RelayTokenClaims
+
+function deferred<T>(): { promise: Promise<T>; resolve: (value: T) => void } {
+  let resolve!: (value: T) => void
+  const promise = new Promise<T>((next) => (resolve = next))
+  return { promise, resolve }
+}
+
+const reservation: CredentialReservation = {
+  userId: identity.sub,
+  relayHostId: identity.relayHostId,
+  credentialKind: 'resume',
+  relayDeviceId: 'device-1',
+  tokenHash: 'hash',
+  reservationId: 'reservation-1',
+  leaseExpiresAt: Date.now() + 60_000,
+  acceptedCredentialVersion: 2,
+  acceptedAs: 'current'
+}
+
+function harness(options: { random?: () => number; now?: () => number } = {}) {
+  const acquireActivity = vi.fn().mockResolvedValue(undefined)
+  const releaseActivity = vi.fn().mockResolvedValue(true)
+  const assignments = {
+    activateControl: vi.fn().mockResolvedValue('control:production-gce-c3:1'),
+    markMigrationTargetRegistered: vi.fn().mockResolvedValue(undefined),
+    resolve: vi.fn().mockResolvedValue({ cellId: config.cellId }),
+    acquireActivity,
+    renewControlActivity: vi.fn().mockResolvedValue(undefined),
+    releaseActivity
+  } as unknown as RelayAssignmentStore
+  const store = {
+    resolveResume: vi.fn().mockResolvedValue({ userId: identity.sub }),
+    reserveCredential: vi.fn().mockResolvedValue(reservation),
+    failReservation: vi.fn().mockResolvedValue(undefined)
+  }
+  const observer = {
+    recordAuth: vi.fn(),
+    recordForwardedBytes: vi.fn(),
+    recordHttp: vi.fn(),
+    recordReconnect: vi.fn(),
+    recordSql: vi.fn(),
+    recordClientAcceptAbandoned: vi.fn()
+  } satisfies RelayRuntimeObserver
+  const registry = new HostSessionRegistry(
+    config,
+    vi.fn(),
+    store as unknown as RelayCredentialStore,
+    assignments,
+    new ProcessQueuedByteBudget(),
+    observer,
+    options.now,
+    options.random
+  )
+  const activate = (
+    registry as unknown as {
+      activate: (
+        socket: WebSocket,
+        identity: RelayTokenClaims,
+        existing: null,
+        generation: number,
+        rebind: boolean,
+        assignmentEpoch: number,
+        appVersion: string
+      ) => Promise<void>
+    }
+  ).activate.bind(registry)
+  return { registry, store, assignments, acquireActivity, releaseActivity, observer, activate }
+}
+
+async function activeHost(h: ReturnType<typeof harness>): Promise<FakeSocket> {
+  const control = new FakeSocket()
+  await h.activate(control as unknown as WebSocket, identity, null, 1, false, 1, '1.4.197')
+  return control
+}
+
+describe('client accept abandoned mid-DB-phase', () => {
+  beforeEach(() => vi.useFakeTimers())
+  afterEach(() => {
+    vi.clearAllTimers()
+    vi.useRealTimers()
+  })
+
+  it('stops after a slow activity acquire when the phone already hung up', async () => {
+    const h = harness()
+    const control = await activeHost(h)
+    const slowAcquire = deferred<void>()
+    h.acquireActivity.mockReturnValueOnce(slowAcquire.promise)
+    const capacity = { bind: vi.fn(), release: vi.fn() }
+    const client = new FakeSocket()
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined)
+    try {
+      const accepting = h.registry.acceptClient(
+        client as unknown as WebSocket,
+        identity.relayHostId,
+        'credential',
+        capacity
+      )
+      await vi.advanceTimersByTimeAsync(0)
+      expect(h.acquireActivity).toHaveBeenCalledOnce()
+      // The phone's 12s bound fires while the cell still waits on Postgres.
+      client.close(1000, 'client bound')
+      capacity.release()
+      slowAcquire.resolve()
+      await accepting
+
+      // No conn-open reached the desktop; nothing pending; the lease it just took is
+      // released instead of leaking to expiry cleanup; bind never throws.
+      expect(control.send).not.toHaveBeenCalledWith(expect.stringContaining('conn-open'))
+      expect(capacity.bind).not.toHaveBeenCalled()
+      const session = h.registry.get({ userId: identity.sub, relayHostId: identity.relayHostId })
+      expect(session?.pendingConns.size).toBe(0)
+      expect(h.store.failReservation).toHaveBeenCalledWith(reservation)
+      expect(h.releaseActivity).toHaveBeenCalledWith(
+        { userId: identity.sub, relayHostId: identity.relayHostId },
+        expect.stringMatching(/^confirmation:/)
+      )
+      expect(h.observer.recordClientAcceptAbandoned).toHaveBeenCalledWith(
+        'activity',
+        expect.any(Number)
+      )
+      const line = warn.mock.calls.map((call) => String(call[0])).find((entry) =>
+        entry.includes('orca_relay_client_accept_abandoned')
+      )
+      expect(line).toBeDefined()
+      expect(JSON.parse(line!)).toMatchObject({ stage: 'activity' })
+      expect(line).not.toContain(identity.relayHostId)
+    } finally {
+      warn.mockRestore()
+      h.registry.drain(0)
+      vi.advanceTimersByTime(0)
+    }
+  })
+
+  it('stops after a slow credential reservation without acquiring an activity lease', async () => {
+    const h = harness()
+    await activeHost(h)
+    const slowReserve = deferred<CredentialReservation>()
+    h.store.reserveCredential.mockReturnValueOnce(slowReserve.promise)
+    const client = new FakeSocket()
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined)
+    try {
+      const accepting = h.registry.acceptClient(
+        client as unknown as WebSocket,
+        identity.relayHostId,
+        'credential'
+      )
+      await vi.advanceTimersByTimeAsync(0)
+      client.close(1000, 'client bound')
+      slowReserve.resolve(reservation)
+      await accepting
+
+      expect(h.acquireActivity).not.toHaveBeenCalled()
+      expect(h.store.failReservation).toHaveBeenCalledWith(reservation)
+      expect(h.observer.recordClientAcceptAbandoned).toHaveBeenCalledWith(
+        'credential',
+        expect.any(Number)
+      )
+    } finally {
+      warn.mockRestore()
+      h.registry.drain(0)
+      vi.advanceTimersByTime(0)
+    }
+  })
+
+  it('stops after a slow resume lookup before starting the invite and assignment lookups', async () => {
+    const h = harness()
+    await activeHost(h)
+    const store = h.store as typeof h.store & { resolveInviteForMove: ReturnType<typeof vi.fn> }
+    store.resolveInviteForMove = vi.fn().mockResolvedValue(null)
+    const slowResume = deferred<null>()
+    h.store.resolveResume.mockReturnValueOnce(slowResume.promise)
+    const resolveAssignment = (h.assignments as unknown as { resolve: ReturnType<typeof vi.fn> })
+      .resolve
+    resolveAssignment.mockClear()
+    const client = new FakeSocket()
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined)
+    try {
+      const accepting = h.registry.acceptClient(
+        client as unknown as WebSocket,
+        identity.relayHostId,
+        'credential'
+      )
+      await vi.advanceTimersByTimeAsync(0)
+      client.close(1000, 'client bound')
+      slowResume.resolve(null)
+      await accepting
+
+      expect(store.resolveInviteForMove).not.toHaveBeenCalled()
+      expect(resolveAssignment).not.toHaveBeenCalled()
+      expect(h.store.reserveCredential).not.toHaveBeenCalled()
+      expect(h.observer.recordClientAcceptAbandoned).toHaveBeenCalledWith(
+        'assignment',
+        expect.any(Number)
+      )
+    } finally {
+      warn.mockRestore()
+      h.registry.drain(0)
+      vi.advanceTimersByTime(0)
+    }
+  })
+
+  it('stops after a slow same-cell assignment resolve, before reserving a credential', async () => {
+    const h = harness()
+    await activeHost(h)
+    const resolveAssignment = (h.assignments as unknown as { resolve: ReturnType<typeof vi.fn> })
+      .resolve
+    const slowResolve = deferred<{ cellId: string }>()
+    resolveAssignment.mockReturnValueOnce(slowResolve.promise)
+    const client = new FakeSocket()
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined)
+    try {
+      const accepting = h.registry.acceptClient(
+        client as unknown as WebSocket,
+        identity.relayHostId,
+        'credential'
+      )
+      await vi.advanceTimersByTimeAsync(0)
+      client.close(1000, 'client bound')
+      // A correct, same-cell assignment: only the closed socket stops the accept.
+      slowResolve.resolve({ cellId: config.cellId })
+      await accepting
+
+      // Proves the accept reached the third guard, not the first.
+      expect(resolveAssignment).toHaveBeenCalled()
+      expect(h.store.reserveCredential).not.toHaveBeenCalled()
+      expect(h.observer.recordClientAcceptAbandoned).toHaveBeenCalledWith(
+        'assignment',
+        expect.any(Number)
+      )
+    } finally {
+      warn.mockRestore()
+      h.registry.drain(0)
+      vi.advanceTimersByTime(0)
+    }
+  })
+
+  it('still opens the connection when the phone is holding on', async () => {
+    const h = harness()
+    const control = await activeHost(h)
+    const capacity = { bind: vi.fn(), release: vi.fn() }
+    const client = new FakeSocket()
+    await h.registry.acceptClient(
+      client as unknown as WebSocket,
+      identity.relayHostId,
+      'credential',
+      capacity
+    )
+    expect(control.send).toHaveBeenCalledWith(expect.stringContaining('"type":"conn-open"'))
+    expect(capacity.bind).toHaveBeenCalledOnce()
+    expect(h.observer.recordClientAcceptAbandoned).not.toHaveBeenCalled()
+    expect(client.close).not.toHaveBeenCalled()
+    h.registry.drain(0)
+    vi.advanceTimersByTime(0)
+  })
+})
+
+describe('control lease jitter', () => {
+  beforeEach(() => vi.useFakeTimers())
+  afterEach(() => {
+    vi.clearAllTimers()
+    vi.useRealTimers()
+  })
+
+  it('grants a lease uniformly around its mean so cohorts drift apart at the same mean rate', async () => {
+    const now = 1_700_000_000_000
+    const helloAck = (socket: FakeSocket) =>
+      JSON.parse(
+        String(socket.send.mock.calls.find((call) => String(call[0]).includes('host-hello-ack'))![0])
+      ) as { leaseExpiresAt: number }
+
+    const shortest = harness({ now: () => now, random: () => 0 })
+    const shortestAck = helloAck(await activeHost(shortest))
+    const centered = harness({ now: () => now, random: () => 0.5 })
+    const centeredAck = helloAck(await activeHost(centered))
+    const longestRoll = 0.999999
+    const longest = harness({ now: () => now, random: () => longestRoll })
+    const longestAck = helloAck(await activeHost(longest))
+
+    // Pinned, not bounded: a jitter clamped to one side still satisfies an upper
+    // bound, so only the exact top of the band proves it is symmetric.
+    const longestOffset = Math.floor((longestRoll * 2 - 1) * CONTROL_LEASE_JITTER_MS)
+    expect(shortestAck.leaseExpiresAt).toBe(now + CONTROL_LEASE_MS - CONTROL_LEASE_JITTER_MS)
+    expect(centeredAck.leaseExpiresAt).toBe(now + CONTROL_LEASE_MS)
+    expect(longestAck.leaseExpiresAt).toBe(now + CONTROL_LEASE_MS + longestOffset)
+    shortest.registry.drain(0)
+    centered.registry.drain(0)
+    longest.registry.drain(0)
+    vi.advanceTimersByTime(0)
+  })
+
+  it('rebinds re-roll the jitter instead of pinning the cohort phase', async () => {
+    const now = 1_700_000_000_000
+    let roll = 0
+    const h = harness({ now: () => now, random: () => roll })
+    const first = await activeHost(h)
+    const session = h.registry.get({ userId: identity.sub, relayHostId: identity.relayHostId })!
+    const firstLease = session.leaseExpiresAt
+    roll = 0.75
+    const rebind = new FakeSocket()
+    await (
+      h.registry as unknown as {
+        activate: (...args: unknown[]) => Promise<void>
+      }
+    ).activate(rebind as unknown as WebSocket, identity, session, 1, true, 1, '1.4.197')
+    expect(session.leaseExpiresAt).toBe(now + CONTROL_LEASE_MS + CONTROL_LEASE_JITTER_MS / 2)
+    expect(session.leaseExpiresAt).not.toBe(firstLease)
+    expect(first.close).toHaveBeenCalledWith(RELAY_CLOSE_CODE.PEER_DROPPED, 'control rebound')
+    h.registry.drain(0)
+    vi.advanceTimersByTime(0)
+  })
+})
diff --git a/cloud/apps/relay/src/host-session-registry.ts b/cloud/apps/relay/src/host-session-registry.ts
index 11b7d1de030..1b7ed3df4af 100644
--- a/cloud/apps/relay/src/host-session-registry.ts
+++ b/cloud/apps/relay/src/host-session-registry.ts
@@ -14,7 +14,8 @@ import {
   HostHelloSchema,
   InviteCreateSchema,
   RELAY_PROTOCOL_LIMITS,
-  RELAY_CLOSE_CODE
+  RELAY_CLOSE_CODE,
+  type RelayHostCloseReason
 } from '@orca-cloud/relay-contract'
 import nacl from 'tweetnacl'
 import type WebSocket from 'ws'
@@ -25,9 +26,10 @@ import {
   RelayCredentialStore,
   type CredentialReservation
 } from './credential-store.js'
+import { HostCloseReasonMemory } from './host-close-reason-memory.js'
 import { relayHostLogDigest } from './relay-host-log-digest.js'
 import type { RelayTokenClaims } from './relay-token-verifier.js'
-import type { RelayRuntimeObserver } from './relay-observability.js'
+import type { RelayClientAcceptStage, RelayRuntimeObserver } from './relay-observability.js'
 import type { PendingHostDataReservation } from './relay-connection-ledger.js'
 import { closeRelayWebSocket } from './relay-websocket-close.js'
 import { ProcessQueuedByteBudget, wireSplice } from './splice-forwarder.js'
@@ -127,9 +129,23 @@ function send(socket: WebSocket, type: string, message: object): void {
 // stalled predecessor only accumulates doomed sockets.
 const ACTIVATION_QUEUE_WAIT_MS = 30_000
 
+// Why: this lease bounds how long a host lingers on a cell after a missed drain,
+// and rebinding it is the only passive rebalancing we have, so it has to stay
+// finite. 6h keeps both properties while cutting control-activation traffic on
+// the contended cell-inventory lock ~6x; the relay JWT (5 min, refreshed by the
+// desktop) and the 75s silence watchdog are enforced separately, so a longer
+// grant authorizes nothing extra. Symmetric jitter walks same-minute reconnect
+// cohorts apart across cycles without changing the mean rebind rate.
+export const CONTROL_LEASE_MS = 6 * 60 * 60 * 1000
+export const CONTROL_LEASE_JITTER_MS = 30 * 60 * 1000
+
 export class HostSessionRegistry {
   private readonly sessions = new Map<string, HostSession>()
   private readonly activationQueues = new Map<string, Promise<void>>()
+  // Why it outlives `sessions`: the orphan grace deletes the session within 30s,
+  // but a signed-out desktop never comes back, so the phone that asks minutes
+  // later would otherwise find nothing to explain its rejection with.
+  private readonly hostCloseReasons = new HostCloseReasonMemory(() => this.now())
   private draining = false
 
   constructor(
@@ -139,9 +155,16 @@ export class HostSessionRegistry {
     private readonly assignments: RelayAssignmentStore,
     private readonly queuedByteBudget: ProcessQueuedByteBudget,
     private readonly observer: RelayRuntimeObserver,
-    private readonly now: () => number = Date.now
+    private readonly now: () => number = Date.now,
+    private readonly random: () => number = Math.random
   ) {}
 
+  // Uniform over [CONTROL_LEASE_MS - jitter, CONTROL_LEASE_MS + jitter).
+  private controlLeaseExpiresAt(): number {
+    const offset = Math.floor((this.random() * 2 - 1) * CONTROL_LEASE_JITTER_MS)
+    return this.now() + CONTROL_LEASE_MS + offset
+  }
+
   async acceptClient(
     socket: WebSocket,
     hostId: string,
@@ -153,10 +176,31 @@ export class HostSessionRegistry {
       this.rejectClient(socket, RELAY_CLOSE_CODE.DRAINING)
       return
     }
+    // Why: the accept runs several serialized Postgres calls behind the contended
+    // cell-inventory lock, and phones bound their dial. Finishing the work for a
+    // phone that already hung up took an activity lease held for the 10s attach
+    // deadline, then failed at bind with host_data_reservation_already_bound.
+    const acceptStartedAt = this.now()
+    const abandonedByClient = (stage: RelayClientAcceptStage, cleanup?: () => void): boolean => {
+      if (socket.readyState === socket.OPEN) return false
+      capacityReservation?.release()
+      cleanup?.()
+      const elapsedMs = this.now() - acceptStartedAt
+      this.observer.recordClientAcceptAbandoned?.(stage, elapsedMs)
+      console.warn(
+        JSON.stringify({ event: 'orca_relay_client_accept_abandoned', stage, elapsedMs })
+      )
+      return true
+    }
     if (this.config.role === 'cell') {
-      const outerIdentity =
-        (await this.store.resolveResume(hostId, credential)) ??
-        (await this.store.resolveInviteForMove(hostId, credential))
+      // Each lookup is its own pooled round trip; stop between them once the phone
+      // has left instead of running the rest of the chain for nobody.
+      let outerIdentity = await this.store.resolveResume(hostId, credential)
+      if (abandonedByClient('assignment')) return
+      if (!outerIdentity) {
+        outerIdentity = await this.store.resolveInviteForMove(hostId, credential)
+        if (abandonedByClient('assignment')) return
+      }
       const assignment = outerIdentity
         ? await this.assignments.resolve({ userId: outerIdentity.userId, relayHostId: hostId })
         : null
@@ -166,6 +210,7 @@ export class HostSessionRegistry {
         this.rejectClient(socket, RELAY_CLOSE_CODE.WRONG_CELL)
         return
       }
+      if (abandonedByClient('assignment')) return
     }
     const reservation = await this.store.reserveCredential(hostId, credential)
     if (!reservation) {
@@ -175,7 +220,9 @@ export class HostSessionRegistry {
       return
     }
     this.observer.recordAuth(true)
-    const session = this.sessions.get(this.key(reservation.userId, hostId))
+    if (abandonedByClient('credential', () => this.failReservationBestEffort(reservation))) return
+    const sessionKey = this.key(reservation.userId, hostId)
+    const session = this.sessions.get(sessionKey)
     if (
       !session ||
       session.state !== 'active' ||
@@ -184,7 +231,13 @@ export class HostSessionRegistry {
     ) {
       capacityReservation?.release()
       await this.store.failReservation(reservation)
-      this.rejectClient(socket, RELAY_CLOSE_CODE.HOST_OFFLINE)
+      // The only rejection that can name a cause: the host is genuinely absent.
+      // The attach-deadline 4404 below fires while control is still connected.
+      this.rejectClient(
+        socket,
+        RELAY_CLOSE_CODE.HOST_OFFLINE,
+        this.hostCloseReasons.read(sessionKey)
+      )
       return
     }
     if (session.activeConnIds.size + session.pendingConns.size >= 8) {
@@ -214,6 +267,14 @@ export class HostSessionRegistry {
         return
       }
     }
+    if (
+      abandonedByClient('activity', () => {
+        this.failReservationBestEffort(reservation)
+        if (credentialActivityId) this.releaseActivityBestEffort(identity, credentialActivityId)
+      })
+    ) {
+      return
+    }
     const attachTimer = setTimeout(() => {
       session.pendingConns.delete(connId)
       capacityReservation?.release()
@@ -727,7 +788,7 @@ export class HostSessionRegistry {
       existing.socket = socket
       existing.state = existing.regionalDrainAttemptId ? 'drain-only' : 'active'
       existing.appVersion = appVersion
-      existing.leaseExpiresAt = this.now() + 55 * 60 * 1000
+      existing.leaseExpiresAt = this.controlLeaseExpiresAt()
       existing.lastPongAt = this.now()
       existing.activityRenewalDueAt =
         this.now() + RELAY_PROTOCOL_LIMITS.controlPingIntervalMs
@@ -778,7 +839,7 @@ export class HostSessionRegistry {
       appVersion,
       state: 'active',
       socket,
-      leaseExpiresAt: this.now() + 55 * 60 * 1000,
+      leaseExpiresAt: this.controlLeaseExpiresAt(),
       orphanTimer: null,
       heartbeatTimer: null,
       lastPongAt: this.now(),
@@ -793,7 +854,10 @@ export class HostSessionRegistry {
       regionalDrainTimer: null,
       regionalDrainExpiresAt: null
     }
-    this.sessions.set(this.key(identity.sub, identity.relayHostId), session)
+    const sessionKey = this.key(identity.sub, identity.relayHostId)
+    // A host that proved itself again is not signed out, whatever it said last.
+    this.hostCloseReasons.forget(sessionKey)
+    this.sessions.set(sessionKey, session)
     this.wireActiveControl(session)
     this.sendHelloAck(session)
   }
@@ -813,6 +877,11 @@ export class HostSessionRegistry {
     })
     socket.once('close', (code, reason) => {
       this.observer.recordControlClose?.(code)
+      // Guarded on identity: a predecessor retired by a rebind must not stamp a
+      // cause onto the live session that replaced it.
+      if (session.socket === socket) {
+        this.hostCloseReasons.record(this.key(session.identity.sub, session.relayHostId), reason)
+      }
       // One line per control close makes reconnect churners attributable by
       // host digest without exposing the raw relay host id.
       console.warn(
@@ -1187,9 +1256,16 @@ export class HostSessionRegistry {
     if (session.socket) send(session.socket, 'control-error', { ...(reqId ? { reqId } : {}), code })
   }
 
-  private rejectClient(socket: WebSocket, code: number): void {
+  // hostCloseReason rides the WebSocket close reason, never relay-hello: every
+  // shipped phone parses relay-hello with a strict schema that rejects an
+  // unknown key, and none of them read the close reason at all.
+  private rejectClient(
+    socket: WebSocket,
+    code: number,
+    hostCloseReason?: RelayHostCloseReason | null
+  ): void {
     send(socket, 'relay-hello', { ok: false, code })
-    closeRelayWebSocket(socket, code, 'relay connection rejected')
+    closeRelayWebSocket(socket, code, hostCloseReason ?? 'relay connection rejected')
   }
 
   private releaseControlActivity(session: HostSession): void {
diff --git a/cloud/apps/relay/src/host-signed-out-rejection.test.ts b/cloud/apps/relay/src/host-signed-out-rejection.test.ts
new file mode 100644
index 00000000000..0f8542c960f
--- /dev/null
+++ b/cloud/apps/relay/src/host-signed-out-rejection.test.ts
@@ -0,0 +1,206 @@
+import { EventEmitter } from 'node:events'
+import {
+  CONTROL_CONTINUITY_LIMITS,
+  RELAY_CLOSE_CODE,
+  RELAY_HOST_CLOSE_REASON
+} from '@orca-cloud/relay-contract'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type WebSocket from 'ws'
+import type { RelayAssignmentStore } from './assignment-store.js'
+import type { RelayConfig } from './config.js'
+import type { RelayCredentialStore } from './credential-store.js'
+import { HostSessionRegistry } from './host-session-registry.js'
+import type { RelayRuntimeObserver } from './relay-observability.js'
+import type { RelayTokenClaims } from './relay-token-verifier.js'
+import { ProcessQueuedByteBudget } from './splice-forwarder.js'
+
+class FakeSocket extends EventEmitter {
+  readonly OPEN = 1
+  readonly CLOSED = 3
+  readyState = this.OPEN
+  readonly send = vi.fn()
+  readonly close = vi.fn((code?: number, reason?: string) => {
+    this.readyState = this.CLOSED
+    this.emit('close', code, Buffer.from(reason ?? ''))
+  })
+  readonly terminate = vi.fn(() => {
+    this.readyState = this.CLOSED
+    this.emit('close', 1006, Buffer.alloc(0))
+  })
+}
+
+const config = {
+  port: 8080,
+  publicUrl: 'https://relay-c3.example.com',
+  cellUrl: 'https://relay-c3.example.com',
+  authIssuer: 'https://auth.example.com',
+  authAudience: 'orca-relay',
+  jwksUrl: 'https://auth.example.com/jwks',
+  assignmentSigningKey: new Uint8Array(32),
+  role: 'cell',
+  cellId: 'production-gce-c3',
+  cells: []
+} as unknown as RelayConfig
+
+const identity = {
+  sub: 'user-1',
+  prof: 'profile-1',
+  org: 'org-1',
+  relayHostId: 'AbCdEf0123_-xyZ9'
+} as unknown as RelayTokenClaims
+
+const reservation = {
+  userId: identity.sub,
+  relayHostId: identity.relayHostId,
+  credentialKind: 'resume',
+  relayDeviceId: 'device-1',
+  leaseExpiresAt: Date.now() + 60_000
+}
+
+function createRegistry() {
+  const store = {
+    resolveResume: vi.fn().mockResolvedValue({ userId: identity.sub }),
+    reserveCredential: vi.fn().mockResolvedValue(reservation),
+    failReservation: vi.fn().mockResolvedValue(undefined)
+  }
+  const assignments = {
+    activateControl: vi.fn().mockResolvedValue('control:production-gce-c3:1'),
+    markMigrationTargetRegistered: vi.fn().mockResolvedValue(undefined),
+    resolve: vi.fn().mockResolvedValue({ cellId: config.cellId }),
+    acquireActivity: vi.fn().mockResolvedValue(undefined),
+    renewControlActivity: vi.fn().mockResolvedValue(undefined),
+    releaseActivity: vi.fn().mockResolvedValue(true)
+  } as unknown as RelayAssignmentStore
+  const observer = {
+    recordAuth: vi.fn(),
+    recordForwardedBytes: vi.fn(),
+    recordHttp: vi.fn(),
+    recordReconnect: vi.fn(),
+    recordSql: vi.fn(),
+    recordControlClose: vi.fn(),
+    recordSpliceClose: vi.fn()
+  } satisfies RelayRuntimeObserver
+  const registry = new HostSessionRegistry(
+    config,
+    vi.fn(),
+    store as unknown as RelayCredentialStore,
+    assignments,
+    new ProcessQueuedByteBudget(),
+    observer
+  )
+  const activate = (socket: WebSocket, generation: number): Promise<void> =>
+    (
+      registry as unknown as {
+        activate: (
+          socket: WebSocket,
+          identity: RelayTokenClaims,
+          existing: null,
+          generation: number,
+          rebind: boolean,
+          assignmentEpoch: number,
+          appVersion: string
+        ) => Promise<void>
+      }
+    ).activate(socket, identity, null, generation, false, 1, '1.4.173')
+  return { registry, activate }
+}
+
+async function dialPhone(registry: HostSessionRegistry): Promise<FakeSocket> {
+  const phone = new FakeSocket()
+  await registry.acceptClient(phone as unknown as WebSocket, identity.relayHostId, 'credential')
+  return phone
+}
+
+// The 4404 hello body is unchanged: every shipped phone parses it with a strict
+// schema, so the cause has to ride the close frame instead.
+const HOST_OFFLINE_HELLO = JSON.stringify({
+  type: 'relay-hello',
+  ok: false,
+  code: RELAY_CLOSE_CODE.HOST_OFFLINE
+})
+
+describe('host sign-out reason on phone rejection', () => {
+  beforeEach(() => vi.useFakeTimers())
+  afterEach(() => {
+    vi.clearAllTimers()
+    vi.useRealTimers()
+  })
+
+  it('names the sign-out to a phone that arrives after the host is gone', async () => {
+    const { registry, activate } = createRegistry()
+    const control = new FakeSocket()
+    await activate(control as unknown as WebSocket, 1)
+
+    control.close(1000, RELAY_HOST_CLOSE_REASON.SIGNED_OUT)
+    vi.advanceTimersByTime(CONTROL_CONTINUITY_LIMITS.orphanGraceMs + 1)
+
+    const phone = await dialPhone(registry)
+    expect(phone.send).toHaveBeenCalledWith(HOST_OFFLINE_HELLO)
+    expect(phone.close).toHaveBeenCalledWith(
+      RELAY_CLOSE_CODE.HOST_OFFLINE,
+      RELAY_HOST_CLOSE_REASON.SIGNED_OUT
+    )
+  })
+
+  it('says nothing when the host died without naming a cause', async () => {
+    const { registry, activate } = createRegistry()
+    const control = new FakeSocket()
+    await activate(control as unknown as WebSocket, 1)
+
+    control.terminate()
+    vi.advanceTimersByTime(CONTROL_CONTINUITY_LIMITS.orphanGraceMs + 1)
+
+    const phone = await dialPhone(registry)
+    expect(phone.close).toHaveBeenCalledWith(
+      RELAY_CLOSE_CODE.HOST_OFFLINE,
+      'relay connection rejected'
+    )
+  })
+
+  it('ignores a close reason the host invented', async () => {
+    const { registry, activate } = createRegistry()
+    const control = new FakeSocket()
+    await activate(control as unknown as WebSocket, 1)
+
+    control.close(1000, 'signed-out-ish')
+    vi.advanceTimersByTime(CONTROL_CONTINUITY_LIMITS.orphanGraceMs + 1)
+
+    const phone = await dialPhone(registry)
+    expect(phone.close).toHaveBeenCalledWith(
+      RELAY_CLOSE_CODE.HOST_OFFLINE,
+      'relay connection rejected'
+    )
+  })
+
+  it('forgets the sign-out once the host proves itself again', async () => {
+    const { registry, activate } = createRegistry()
+    const control = new FakeSocket()
+    await activate(control as unknown as WebSocket, 1)
+    control.close(1000, RELAY_HOST_CLOSE_REASON.SIGNED_OUT)
+    vi.advanceTimersByTime(CONTROL_CONTINUITY_LIMITS.orphanGraceMs + 1)
+
+    const reconnected = new FakeSocket()
+    await activate(reconnected as unknown as WebSocket, 2)
+    // Drop it abruptly, as a network death would, so only the stale memory
+    // could still name a cause.
+    reconnected.terminate()
+    vi.advanceTimersByTime(CONTROL_CONTINUITY_LIMITS.orphanGraceMs + 1)
+
+    const phone = await dialPhone(registry)
+    expect(phone.close).toHaveBeenCalledWith(
+      RELAY_CLOSE_CODE.HOST_OFFLINE,
+      'relay connection rejected'
+    )
+  })
+
+  // A live host is present: the 4404 there is an attach deadline, not absence.
+  it('never names a cause while the host control is connected', async () => {
+    const { registry, activate } = createRegistry()
+    const control = new FakeSocket()
+    await activate(control as unknown as WebSocket, 1)
+
+    const phone = await dialPhone(registry)
+    expect(phone.close).not.toHaveBeenCalled()
+    expect(control.send).toHaveBeenCalledWith(expect.stringContaining('"type":"conn-open"'))
+  })
+})
diff --git a/cloud/apps/relay/src/postgres-transaction-recovery.test.ts b/cloud/apps/relay/src/postgres-transaction-recovery.test.ts
index a49c07d2e7d..ae9d52a7c86 100644
--- a/cloud/apps/relay/src/postgres-transaction-recovery.test.ts
+++ b/cloud/apps/relay/src/postgres-transaction-recovery.test.ts
@@ -503,12 +503,19 @@ describePostgres('PostgreSQL transaction recovery', () => {
     const directorLockOrder: string[] = []
     const assignmentDatabase = new TransactionProbeDatabase(database, async (phase, sql) => {
       if (phase === 'before') {
-        if (sql.includes('FROM relay_assignments WHERE user_id = ?')) {
+        // Only locked statements reach this hook, so classifying the pin read
+        // is what proves it stays unlocked: if it ever grows a FOR UPDATE it
+        // shows up in the order below instead of silently joining the queue.
+        if (sql.includes('SELECT cell_id FROM relay_assignments')) {
+          directorLockOrder.push('pin-read')
+        } else if (sql.includes('FROM relay_assignments WHERE user_id = ?')) {
           directorLockOrder.push('assignment')
         } else if (sql.includes('FROM relay_assignment_activity_leases')) {
           directorLockOrder.push('activity')
         } else if (sql.includes('FROM relay_cells ORDER BY')) {
           directorLockOrder.push('cell-inventory')
+        } else if (sql.includes('FROM relay_cells WHERE cell_id IN')) {
+          directorLockOrder.push('cell-rows')
         } else if (sql.includes('FROM relay_cells WHERE cell_id = ?')) {
           directorLockOrder.push('cell')
         }
@@ -530,11 +537,14 @@ describePostgres('PostgreSQL transaction recovery', () => {
     })
     await expect(legacyTransaction).resolves.toBeUndefined()
     expect(assignmentDatabase.attempts).toBe(2)
+    // The retry still takes a cell row before the assignment row — the order
+    // that avoids the legacy cycle — but only the pinned row, never the
+    // inventory.
     expect(directorLockOrder).toEqual([
       'assignment',
       'activity',
       'cell',
-      'cell-inventory',
+      'cell-rows',
       'assignment',
       'activity'
     ])
diff --git a/cloud/apps/relay/src/relay-observability.test.ts b/cloud/apps/relay/src/relay-observability.test.ts
index 2b9ceb0b72a..fc8a4fcb4af 100644
--- a/cloud/apps/relay/src/relay-observability.test.ts
+++ b/cloud/apps/relay/src/relay-observability.test.ts
@@ -195,16 +195,23 @@ describe('relay observability', () => {
     observability.recordControlClose(4402)
     observability.recordSpliceClose('host-oversize-frame')
     observability.recordSpliceClose('queue-limit')
+    observability.recordClientAcceptAbandoned('activity', 14_250.4)
+    observability.recordClientAcceptAbandoned('activity', 2_000)
+    observability.recordClientAcceptAbandoned('credential', 3_000)
     observability.flush(counts)
     observability.flush(counts)
 
     expect(entries[0]).toMatchObject({
       controlClosesByCodeDelta: { 1006: 2, 4402: 1 },
-      spliceClosesByTriggerDelta: { 'host-oversize-frame': 1, 'queue-limit': 1 }
+      spliceClosesByTriggerDelta: { 'host-oversize-frame': 1, 'queue-limit': 1 },
+      clientAcceptsAbandonedByStageDelta: { activity: 2, credential: 1 },
+      clientAcceptAbandonedMsMax: 14_250.4
     })
     expect(entries[1]).toMatchObject({
       controlClosesByCodeDelta: {},
-      spliceClosesByTriggerDelta: {}
+      spliceClosesByTriggerDelta: {},
+      clientAcceptsAbandonedByStageDelta: {},
+      clientAcceptAbandonedMsMax: 0
     })
   })
 
diff --git a/cloud/apps/relay/src/relay-observability.ts b/cloud/apps/relay/src/relay-observability.ts
index 2266217d607..59ff437e40b 100644
--- a/cloud/apps/relay/src/relay-observability.ts
+++ b/cloud/apps/relay/src/relay-observability.ts
@@ -64,8 +64,12 @@ export interface RelayRuntimeObserver {
   }): void
   recordControlClose?(code: number): void
   recordSpliceClose?(trigger: string): void
+  recordClientAcceptAbandoned?(stage: RelayClientAcceptStage, elapsedMs: number): void
 }
 
+// Which serialized accept step the phone had already hung up behind.
+export type RelayClientAcceptStage = 'assignment' | 'credential' | 'activity'
+
 type RelayMetricDeltas = {
   forwardedBytes: number
   authSuccesses: number
@@ -87,6 +91,8 @@ type RelayMetricDeltas = {
   unavailableRegions: Record<string, number>
   controlClosesByCode: Record<string, number>
   spliceClosesByTrigger: Record<string, number>
+  clientAcceptsAbandonedByStage: Record<string, number>
+  clientAcceptAbandonedMsMax: number
   controlRenewalLatenciesMs: number[]
   controlRenewalsByOutcome: Record<string, number>
   controlActivityRecoveries: number
@@ -116,6 +122,8 @@ const emptyDeltas = (): RelayMetricDeltas => ({
   unavailableRegions: {},
   controlClosesByCode: {},
   spliceClosesByTrigger: {},
+  clientAcceptsAbandonedByStage: {},
+  clientAcceptAbandonedMsMax: 0,
   controlRenewalLatenciesMs: [],
   controlRenewalsByOutcome: {},
   controlActivityRecoveries: 0,
@@ -228,6 +236,14 @@ export class RelayObservability implements RelayRuntimeObserver {
       (this.deltas.spliceClosesByTrigger[trigger] ?? 0) + 1
   }
 
+  recordClientAcceptAbandoned(stage: RelayClientAcceptStage, elapsedMs: number): void {
+    increment(this.deltas.clientAcceptsAbandonedByStage, stage)
+    this.deltas.clientAcceptAbandonedMsMax = Math.max(
+      this.deltas.clientAcceptAbandonedMsMax,
+      elapsedMs
+    )
+  }
+
   start(readCounts: () => RelayProcessCounts, intervalMs = 30_000): void {
     if (this.timer) return
     this.eventLoop.enable()
@@ -289,6 +305,8 @@ export class RelayObservability implements RelayRuntimeObserver {
       unavailableRegionsDelta: deltas.unavailableRegions,
       controlClosesByCodeDelta: deltas.controlClosesByCode,
       spliceClosesByTriggerDelta: deltas.spliceClosesByTrigger,
+      clientAcceptsAbandonedByStageDelta: deltas.clientAcceptsAbandonedByStage,
+      clientAcceptAbandonedMsMax: Number(deltas.clientAcceptAbandonedMsMax.toFixed(3)),
       sqlQueriesDelta: deltas.sqlQueries,
       sqlFailuresDelta: deltas.sqlFailures,
       sqlLatencyMsMax: Number(deltas.sqlLatencyMsMax.toFixed(3)),
diff --git a/cloud/apps/relay/src/relay-server.ts b/cloud/apps/relay/src/relay-server.ts
index 32a83962d81..6331b584b1b 100644
--- a/cloud/apps/relay/src/relay-server.ts
+++ b/cloud/apps/relay/src/relay-server.ts
@@ -88,6 +88,7 @@ export function createRelayServer(
   database: RelayDatabase,
   options: {
     now?: () => number
+    random?: () => number
     connectionLedgerLimits?: { hardCap: number; controlReserve: number }
     cellIncarnation?: string
   } = {}
@@ -123,7 +124,8 @@ export function createRelayServer(
     assignments,
     queuedBytes,
     observability,
-    options.now
+    options.now,
+    options.random
   )
   const app = createRelayApp(config, {
     store,
diff --git a/cloud/dev/fixtures/terraform-root-partition/families.json b/cloud/dev/fixtures/terraform-root-partition/families.json
index 9664c1eb299..dfe100fd2dd 100644
--- a/cloud/dev/fixtures/terraform-root-partition/families.json
+++ b/cloud/dev/fixtures/terraform-root-partition/families.json
@@ -133,10 +133,15 @@
     "google_logging_metric.relay_snapshot",
     "google_monitoring_alert_policy.relay_assignment_5xx",
     "google_monitoring_alert_policy.relay_assignment_edge_429",
+    "google_monitoring_alert_policy.relay_cell_process_exit",
+    "google_monitoring_alert_policy.relay_cloud_nat_port_drops",
     "google_monitoring_alert_policy.relay_cloud_sql_backends",
+    "google_monitoring_alert_policy.relay_cloud_sql_checkpoint_loop",
+    "google_monitoring_alert_policy.relay_cloud_sql_disk",
     "google_monitoring_alert_policy.relay_custom",
     "google_monitoring_alert_policy.relay_gce_connection_headroom",
     "google_monitoring_alert_policy.relay_postgres_retry_exhausted",
+    "google_monitoring_dashboard.relay_incident",
     "google_project_iam_custom_role.github_production_relay_capacity_mutation",
     "google_project_iam_custom_role.github_relay_asia_topology_mutation",
     "google_project_iam_custom_role.github_relay_asia_topology_read",
diff --git a/cloud/dev/scripts/operate-relay-regional-rehome.mjs b/cloud/dev/scripts/operate-relay-regional-rehome.mjs
index 2ccce39926d..3887408520f 100644
--- a/cloud/dev/scripts/operate-relay-regional-rehome.mjs
+++ b/cloud/dev/scripts/operate-relay-regional-rehome.mjs
@@ -1,4 +1,5 @@
 import { pathToFileURL } from 'node:url'
+import { fetchAdminOnceMore } from './relay-admin-transient-retry.mjs'
 import { inspectAdmissionSelector } from './relay-admission-selector.mjs'
 
 const DIRECTOR_ORIGIN = 'https://relay.onorca.dev'
@@ -229,15 +230,20 @@ export async function recoverRegionalRehomeEnable(config, post) {
 export async function operateRegionalRehome(config, dependencies = {}) {
   const fetchImpl = dependencies.fetch ?? fetch
   const post = dependencies.post ?? (async (path, body) => await responseJson(
-    await fetchImpl(`${config.directorOrigin}${path}`, {
-      method: 'POST',
-      headers: {
-        authorization: `Bearer ${config.token}`,
-        'content-type': 'application/json'
+    // Generation-guarded writes make a retry a no-op or an explicit mismatch, never a double apply.
+    await fetchAdminOnceMore(
+      fetchImpl,
+      `${config.directorOrigin}${path}`,
+      {
+        method: 'POST',
+        headers: {
+          authorization: `Bearer ${config.token}`,
+          'content-type': 'application/json'
+        },
+        body: JSON.stringify(body)
       },
-      body: JSON.stringify(body),
-      signal: AbortSignal.timeout(30_000)
-    }),
+      { wait: dependencies.wait }
+    ),
     path
   ))
   if (config.mode === 'recover-enable') {
diff --git a/cloud/dev/scripts/operate-relay-regional-rehome.test.mjs b/cloud/dev/scripts/operate-relay-regional-rehome.test.mjs
index 8ffe38dfe09..bfea6769ec4 100644
--- a/cloud/dev/scripts/operate-relay-regional-rehome.test.mjs
+++ b/cloud/dev/scripts/operate-relay-regional-rehome.test.mjs
@@ -263,3 +263,55 @@ test('main executes recovery mode and emits verified disabled control', async ()
     control: control(6, false)
   })
 })
+
+test('retries a transient 503 on the director control endpoint', async () => {
+  const config = parseRegionalRehomeArguments(
+    argumentsFor('inspect'),
+    { ORCA_RELAY_ADMIN_ID_TOKEN: 'token' }
+  )
+  const paths = []
+  let selectorCalls = 0
+  const result = await operateRegionalRehome(config, {
+    wait: async () => {},
+    fetch: async (url) => {
+      const path = new URL(url).pathname
+      paths.push(path)
+      if (path === '/v1/admin/admission-selector/status') {
+        selectorCalls += 1
+        // The first read of each admin path 503s the way a warming instance does.
+        if (selectorCalls === 1) return new Response('warming up', { status: 503 })
+        return Response.json({ selector: { generation: 11, membership } })
+      }
+      if (paths.filter((value) => value === path).length === 1) {
+        return new Response('warming up', { status: 503 })
+      }
+      return Response.json({ v: 1, control: control(4, false) })
+    }
+  })
+  assert.equal(result.control.generation, 4)
+  assert.deepEqual(paths, [
+    '/v1/admin/admission-selector/status',
+    '/v1/admin/admission-selector/status',
+    '/v1/admin/regional-rehome-control',
+    '/v1/admin/regional-rehome-control'
+  ])
+})
+
+test('fails when both attempts at the director control endpoint return 503', async () => {
+  const config = parseRegionalRehomeArguments(
+    argumentsFor('inspect'),
+    { ORCA_RELAY_ADMIN_ID_TOKEN: 'token' }
+  )
+  let calls = 0
+  await assert.rejects(
+    operateRegionalRehome(config, {
+      wait: async () => {},
+      fetch: async () => {
+        calls += 1
+        return new Response('warming up', { status: 503 })
+      }
+    }),
+    /returned 503/
+  )
+  assert.equal(calls, 2)
+})
diff --git a/cloud/dev/scripts/prepare-relay-production-capacity-canary.mjs b/cloud/dev/scripts/prepare-relay-production-capacity-canary.mjs
index 5791c9f20e6..7967d164e4b 100644
--- a/cloud/dev/scripts/prepare-relay-production-capacity-canary.mjs
+++ b/cloud/dev/scripts/prepare-relay-production-capacity-canary.mjs
@@ -1,10 +1,12 @@
 import { pathToFileURL } from 'node:url'
+import { fetchAdminOnceMore } from './relay-admin-transient-retry.mjs'
 import {
   applyExactAdmissionSelector,
   inspectAdmissionSelector,
   membershipWithStates,
   selectorCellState
 } from './relay-admission-selector.mjs'
+import { SAME_CAP_CELLS } from './relay-production-same-cap-wave.mjs'
 
 const DIRECTOR_ORIGIN = 'https://relay.onorca.dev'
 export const PRODUCTION_CAPACITY_CELL_IDS = [
@@ -30,6 +32,9 @@ function cellOrigin(cellId) {
   return `https://${cellId.slice('production-gce-'.length)}.relay.onorca.dev`
 }
 
+// The same-cap roll covers the Asia cells the US-only capacity rollout never touches.
+const APPROVED_CELL_LISTS = { 'same-cap': SAME_CAP_CELLS }
+
 export function parseProductionCapacityCellArguments(argv) {
   const values = {}
   for (let index = 0; index < argv.length; index += 2) {
@@ -41,8 +46,15 @@ export function parseProductionCapacityCellArguments(argv) {
   if (!['isolate', 'drain', 'activate'].includes(values.mode)) {
     throw new Error('--mode must be isolate, drain, or activate')
   }
+  const approvedList = values['approved-cells']
+  if (approvedList !== undefined && !APPROVED_CELL_LISTS[approvedList]) {
+    throw new Error('--approved-cells is not a known allowlist')
+  }
+  const approvedCellIds = approvedList === undefined
+    ? PRODUCTION_CAPACITY_CELL_IDS
+    : APPROVED_CELL_LISTS[approvedList]
   const cellId = values['cell-id']
-  if (!PRODUCTION_CAPACITY_CELL_IDS.includes(cellId)) {
+  if (!approvedCellIds.includes(cellId)) {
     throw new Error('production capacity target is not approved')
   }
   const expectedCellOrigin = cellOrigin(cellId)
@@ -72,12 +84,16 @@ export async function prepareProductionCapacityCell(config, overrides = {}) {
   if (!token || token.length > 8_192) throw new Error('admin identity token is unavailable')
   const postAt = async (origin, path, body) =>
     await responseJson(
-      await fetchImpl(`${origin}${path}`, {
-        method: 'POST',
-        headers: { authorization: `Bearer ${token}`, 'content-type': 'application/json' },
-        body: JSON.stringify(body),
-        signal: AbortSignal.timeout(30_000)
-      }),
+      await fetchAdminOnceMore(
+        fetchImpl,
+        `${origin}${path}`,
+        {
+          method: 'POST',
+          headers: { authorization: `Bearer ${token}`, 'content-type': 'application/json' },
+          body: JSON.stringify(body)
+        },
+        { wait: overrides.wait }
+      ),
       path
     )
   const post = async (path, body) => await postAt(config.directorOrigin, path, body)
diff --git a/cloud/dev/scripts/prepare-relay-production-capacity-canary.test.mjs b/cloud/dev/scripts/prepare-relay-production-capacity-canary.test.mjs
index c5d0a9db3bc..274a60d2198 100644
--- a/cloud/dev/scripts/prepare-relay-production-capacity-canary.test.mjs
+++ b/cloud/dev/scripts/prepare-relay-production-capacity-canary.test.mjs
@@ -104,6 +104,47 @@ describe('production Relay capacity cell admission', () => {
       '--cell-id', 'production-gce-c7',
       '--mode', 'isolate'
     ]), /origin is not exact/)
+    assert.throws(() => parseProductionCapacityCellArguments([
+      '--director-origin', 'https://relay.onorca.dev',
+      '--cell-origin', 'https://c27.relay.onorca.dev',
+      '--cell-id', 'production-gce-c27',
+      '--mode', 'isolate'
+    ]), /not approved/)
+  })
+
+  it('admits the same-cap Asia cells only under the same-cap allowlist', () => {
+    for (const cellId of ['production-gce-c27', 'production-gce-c28', 'production-gce-c29']) {
+      const hostname = cellId.slice('production-gce-'.length)
+      assert.deepEqual(parseProductionCapacityCellArguments([
+        '--director-origin', 'https://relay.onorca.dev',
+        '--cell-origin', `https://${hostname}.relay.onorca.dev`,
+        '--cell-id', cellId,
+        '--approved-cells', 'same-cap',
+        '--mode', 'isolate'
+      ]), {
+        directorOrigin: 'https://relay.onorca.dev',
+        cellOrigin: `https://${hostname}.relay.onorca.dev`,
+        cellId,
+        mode: 'isolate'
+      })
+    }
+    for (const cellId of ['production-gce-c17', 'production-gce-c18', 'production-gce-c30']) {
+      const hostname = cellId.slice('production-gce-'.length)
+      assert.throws(() => parseProductionCapacityCellArguments([
+        '--director-origin', 'https://relay.onorca.dev',
+        '--cell-origin', `https://${hostname}.relay.onorca.dev`,
+        '--cell-id', cellId,
+        '--approved-cells', 'same-cap',
+        '--mode', 'isolate'
+      ]), /not approved/)
+    }
+    assert.throws(() => parseProductionCapacityCellArguments([
+      '--director-origin', 'https://relay.onorca.dev',
+      '--cell-origin', 'https://c27.relay.onorca.dev',
+      '--cell-id', 'production-gce-c27',
+      '--approved-cells', 'every-cell',
+      '--mode', 'isolate'
+    ]), /not a known allowlist/)
   })
 
   it('isolates only the selected cell without depending on its runtime', async () => {
@@ -170,4 +211,42 @@ describe('production Relay capacity cell admission', () => {
       /irreversible/
     )
   })
+
+  it('retries a transient 503 on the cell drain endpoint', async () => {
+    let calls = 0
+    const result = await prepareProductionCapacityCell(
+      { ...config, mode: 'drain' },
+      {
+        token: 'token',
+        wait: async () => {},
+        fetch: async (url) => {
+          assert.equal(new URL(url).pathname, '/v1/admin/drain')
+          calls += 1
+          if (calls === 1) return response({ error: 'warming up' }, 503)
+          return response({ v: 1, draining: true })
+        }
+      }
+    )
+    assert.equal(calls, 2)
+    assert.deepEqual(result, { changed: false, drained: true })
+  })
+
+  it('fails when both drain attempts return a transient 503', async () => {
+    let calls = 0
+    await assert.rejects(
+      prepareProductionCapacityCell(
+        { ...config, mode: 'drain' },
+        {
+          token: 'token',
+          wait: async () => {},
+          fetch: async () => {
+            calls += 1
+            return response({ error: 'warming up' }, 503)
+          }
+        }
+      ),
+      /returned 503/
+    )
+    assert.equal(calls, 2)
+  })
 })
diff --git a/cloud/dev/scripts/probe-relay-rehome-trust.mjs b/cloud/dev/scripts/probe-relay-rehome-trust.mjs
index 7500d8bd14c..9a7d505d4bb 100644
--- a/cloud/dev/scripts/probe-relay-rehome-trust.mjs
+++ b/cloud/dev/scripts/probe-relay-rehome-trust.mjs
@@ -1,4 +1,5 @@
 import { pathToFileURL } from 'node:url'
+import { fetchAdminOnceMore } from './relay-admin-transient-retry.mjs'
 
 const PRODUCTION_CELL = /^production-gce-c(?:7|8|9|10|13|14|15|16|19|20|21|22|23|24|25|26)$/
 const DIRECTOR_ORIGIN = 'https://relay.onorca.dev'
@@ -35,7 +36,8 @@ export function parseRehomeTrustProbeArguments(argv, environment = process.env)
 
 export async function probeRehomeTrust(config, dependencies = {}) {
   const fetchImpl = dependencies.fetch ?? fetch
-  const response = await fetchImpl(
+  const response = await fetchAdminOnceMore(
+    fetchImpl,
     `${config.directorOrigin}/v1/admin/regional-rehome-trust-probe`,
     {
       method: 'POST',
@@ -47,9 +49,9 @@ export async function probeRehomeTrust(config, dependencies = {}) {
         v: 1,
         sourceCellId: config.cellId,
         sourceCellIncarnation: config.cellIncarnation
-      }),
-      signal: AbortSignal.timeout(30_000)
-    }
+      })
+    },
+    { wait: dependencies.wait }
   )
   const body = await response.json().catch(() => ({}))
   if (!response.ok) {
diff --git a/cloud/dev/scripts/probe-relay-rehome-trust.test.mjs b/cloud/dev/scripts/probe-relay-rehome-trust.test.mjs
index 509e9d53c7d..7d7b2cd95ac 100644
--- a/cloud/dev/scripts/probe-relay-rehome-trust.test.mjs
+++ b/cloud/dev/scripts/probe-relay-rehome-trust.test.mjs
@@ -68,3 +68,46 @@ test('rejects partial or mismatched proof', async () => {
     /incomplete/
   )
 })
+
+const provenProbe = {
+  v: 1,
+  dedicatedIdentity: {
+    firstOutcome: 'host-not-connected',
+    secondOutcome: 'host-not-connected',
+    accepted: true,
+    idempotent: true
+  },
+  sharedRuntimeIdentityRejected: true,
+  proven: true
+}
+
+test('retries a transient 503 on the trust probe and proves on the second answer', async () => {
+  const config = parseRehomeTrustProbeArguments(argv, environment)
+  let calls = 0
+  const result = await probeRehomeTrust(config, {
+    wait: async () => {},
+    fetch: async () => {
+      calls += 1
+      if (calls === 1) return new Response('warming up', { status: 503 })
+      return Response.json(provenProbe)
+    }
+  })
+  assert.equal(calls, 2)
+  assert.equal(result.proven, true)
+})
+
+test('fails when both trust-probe attempts return a transient 503', async () => {
+  const config = parseRehomeTrustProbeArguments(argv, environment)
+  let calls = 0
+  await assert.rejects(
+    probeRehomeTrust(config, {
+      wait: async () => {},
+      fetch: async () => {
+        calls += 1
+        return new Response('warming up', { status: 503 })
+      }
+    }),
+    /returned 503/
+  )
+  assert.equal(calls, 2)
+})
diff --git a/cloud/dev/scripts/relay-admin-endpoint-retry-workflow.test.mjs b/cloud/dev/scripts/relay-admin-endpoint-retry-workflow.test.mjs
new file mode 100644
index 00000000000..196fff9edf3
--- /dev/null
+++ b/cloud/dev/scripts/relay-admin-endpoint-retry-workflow.test.mjs
@@ -0,0 +1,43 @@
+import assert from 'node:assert/strict'
+import { readFileSync } from 'node:fs'
+import { test } from 'node:test'
+import { fileURLToPath } from 'node:url'
+import { relayWorkflowUrl } from './relay-repository.mjs'
+
+const WORKFLOWS = [
+  'deploy-relay-production-same-cap-job.yml',
+  'operate-relay-production-rehome-job.yml'
+]
+
+function workflow(name) {
+  return readFileSync(fileURLToPath(relayWorkflowUrl(name)), 'utf8')
+}
+
+// A single transient 5xx from a warming instance behind the global load balancer
+// must not fail a canary, so no admin endpoint may be read by a bare curl.
+test('no admin endpoint is reached by a curl without a bounded retry', () => {
+  for (const name of WORKFLOWS) {
+    for (const invocation of workflow(name).split(/\bcurl\b/).slice(1)) {
+      const flags = invocation.split('\n          }')[0]
+      assert.match(flags, /--retry 3 --retry-delay 2 --retry-connrefused/, name)
+      assert.match(flags, /--max-time 30/, name)
+      // --retry-all-errors would also retry 401, 403, and 409, which are final.
+      assert.doesNotMatch(flags, /--retry-all-errors/, name)
+    }
+  }
+})
+
+test('every retried admin request captures only the final attempt body', () => {
+  const job = workflow('deploy-relay-production-same-cap-job.yml')
+  // --fail-with-body writes every failed attempt to stdout, so a retried
+  // request must land in a file curl truncates per attempt.
+  assert.match(job, /--output "\$\{out\}"/)
+  assert.equal(job.split('admin_post() {').length - 1, 2)
+  for (const call of [
+    /CURRENT_RUNTIME="\$\(admin_post current-runtime/,
+    /CURRENT_DIRECTOR_STATUS="\$\(admin_post current-cell-status/,
+    /TARGET_RUNTIME="\$\(admin_post target-runtime/,
+    /TARGET_DIRECTOR_STATUS="\$\(admin_post target-cell-status/
+  ]) assert.match(job, call)
+  assert.doesNotMatch(job, /\$\(curl /)
+})
diff --git a/cloud/dev/scripts/relay-admin-transient-retry.mjs b/cloud/dev/scripts/relay-admin-transient-retry.mjs
new file mode 100644
index 00000000000..9995be96a8f
--- /dev/null
+++ b/cloud/dev/scripts/relay-admin-transient-retry.mjs
@@ -0,0 +1,29 @@
+// A single transient 5xx (load-balancer warm-up behind a fresh instance) must not fail a
+// deploy step. 4xx is never retried: auth and generation-mismatch answers are final.
+const TRANSIENT_STATUSES = [500, 502, 503, 504]
+const RETRY_DELAY_MS = 2_000
+const REQUEST_TIMEOUT_MS = 30_000
+
+export function isTransientAdminStatus(status) {
+  return TRANSIENT_STATUSES.includes(status)
+}
+
+// Each attempt gets its own timeout budget, so a reused signal cannot abort the retry.
+export async function fetchAdminOnceMore(fetchImpl, url, init, overrides = {}) {
+  const wait = overrides.wait ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)))
+  const timeoutMs = overrides.timeoutMs ?? REQUEST_TIMEOUT_MS
+  const retryDelayMs = overrides.retryDelayMs ?? RETRY_DELAY_MS
+  const attempt = async () =>
+    await fetchImpl(url, { ...init, signal: AbortSignal.timeout(timeoutMs) })
+  let response
+  try {
+    response = await attempt()
+  } catch {
+    await wait(retryDelayMs)
+    return await attempt()
+  }
+  if (!isTransientAdminStatus(response.status)) return response
+  await response.arrayBuffer?.().catch(() => undefined)
+  await wait(retryDelayMs)
+  return await attempt()
+}
diff --git a/cloud/dev/scripts/relay-admin-transient-retry.test.mjs b/cloud/dev/scripts/relay-admin-transient-retry.test.mjs
new file mode 100644
index 00000000000..ec041084344
--- /dev/null
+++ b/cloud/dev/scripts/relay-admin-transient-retry.test.mjs
@@ -0,0 +1,130 @@
+import assert from 'node:assert/strict'
+import { test } from 'node:test'
+import { fetchAdminOnceMore } from './relay-admin-transient-retry.mjs'
+
+const url = 'https://relay.onorca.dev/v1/admin/cell-status'
+const init = { method: 'POST', body: '{"v":1}' }
+
+function recordingWait(waits) {
+  return async (ms) => { waits.push(ms) }
+}
+
+test('a single transient 5xx is retried and the second answer is returned', async () => {
+  const waits = []
+  const statuses = [503, 200]
+  let calls = 0
+  const response = await fetchAdminOnceMore(
+    async () => {
+      calls += 1
+      const status = statuses.shift()
+      return new Response(JSON.stringify({ ok: status === 200 }), { status })
+    },
+    url,
+    init,
+    { wait: recordingWait(waits) }
+  )
+  assert.equal(calls, 2)
+  assert.equal(response.status, 200)
+  assert.deepEqual(waits, [2_000])
+  assert.deepEqual(await response.json(), { ok: true })
+})
+
+test('a connection failure is retried and the second answer is returned', async () => {
+  const waits = []
+  let calls = 0
+  const response = await fetchAdminOnceMore(
+    async () => {
+      calls += 1
+      if (calls === 1) throw new TypeError('fetch failed')
+      return Response.json({ ok: true })
+    },
+    url,
+    init,
+    { wait: recordingWait(waits) }
+  )
+  assert.equal(calls, 2)
+  assert.equal(response.status, 200)
+  assert.deepEqual(waits, [2_000])
+})
+
+test('two transient failures surface the second answer without a third attempt', async () => {
+  let calls = 0
+  const response = await fetchAdminOnceMore(
+    async () => {
+      calls += 1
+      return new Response('down', { status: 503 })
+    },
+    url,
+    init,
+    { wait: async () => {} }
+  )
+  assert.equal(calls, 2)
+  assert.equal(response.status, 503)
+})
+
+test('two connection failures rethrow the second error', async () => {
+  let calls = 0
+  await assert.rejects(
+    fetchAdminOnceMore(
+      async () => {
+        calls += 1
+        throw new TypeError(`fetch failed ${calls}`)
+      },
+      url,
+      init,
+      { wait: async () => {} }
+    ),
+    /fetch failed 2/
+  )
+  assert.equal(calls, 2)
+})
+
+test('4xx is final: auth and generation-mismatch answers are never retried', async () => {
+  for (const status of [400, 401, 403, 404, 409, 429]) {
+    let calls = 0
+    const response = await fetchAdminOnceMore(
+      async () => {
+        calls += 1
+        return new Response('no', { status })
+      },
+      url,
+      init,
+      { wait: async () => { throw new Error('must not wait') } }
+    )
+    assert.equal(calls, 1, `status ${status} must not be retried`)
+    assert.equal(response.status, status)
+  }
+})
+
+test('each attempt carries its own unexpired timeout signal', async () => {
+  const signals = []
+  await fetchAdminOnceMore(
+    async (_url, attemptInit) => {
+      signals.push(attemptInit.signal)
+      return new Response('down', { status: 502 })
+    },
+    url,
+    init,
+    { wait: async () => {}, timeoutMs: 30_000 }
+  )
+  assert.equal(signals.length, 2)
+  assert.notEqual(signals[0], signals[1])
+  assert.equal(signals[1].aborted, false)
+})
+
+test('the caller init is forwarded unchanged apart from the signal', async () => {
+  let seen
+  await fetchAdminOnceMore(
+    async (seenUrl, attemptInit) => {
+      seen = { seenUrl, attemptInit }
+      return Response.json({})
+    },
+    url,
+    { method: 'POST', headers: { authorization: 'Bearer t' }, body: '{"v":1}' },
+    { wait: async () => {} }
+  )
+  assert.equal(seen.seenUrl, url)
+  assert.equal(seen.attemptInit.method, 'POST')
+  assert.deepEqual(seen.attemptInit.headers, { authorization: 'Bearer t' })
+  assert.equal(seen.attemptInit.body, '{"v":1}')
+})
diff --git a/cloud/dev/scripts/relay-evidence-code-provenance.mjs b/cloud/dev/scripts/relay-evidence-code-provenance.mjs
new file mode 100644
index 00000000000..233a8139b85
--- /dev/null
+++ b/cloud/dev/scripts/relay-evidence-code-provenance.mjs
@@ -0,0 +1,94 @@
+import { spawnSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+import {
+  RELAY_REPOSITORY_ROOT,
+  relayTreePath,
+  relayWorkflowPath
+} from './relay-repository.mjs'
+
+const SHA = /^[a-f0-9]{40}$/
+
+// Every file that decides how relay evidence is produced, sealed, verified, and then spent against
+// production; identical content across two commits is what makes the older commit's verdict binding.
+export const TRUSTED_EVIDENCE_CODE_PATHS = [
+  // Produces and seals the 15-minute dry-run evidence.
+  relayWorkflowPath('monitor-relay-production.yml'),
+  relayWorkflowPath('monitor-relay-production-job.yml'),
+  // Download it, verify its authority, and mutate production on it.
+  relayWorkflowPath('deploy-relay-production-same-cap.yml'),
+  relayWorkflowPath('deploy-relay-production-same-cap-job.yml'),
+  relayWorkflowPath('operate-relay-production-rehome.yml'),
+  relayWorkflowPath('operate-relay-production-rehome-job.yml'),
+  // Sealing, verification, the wave/canary authority, and the path constants below.
+  relayTreePath('dev/scripts/relay-evidence-code-provenance.mjs'),
+  relayTreePath('dev/scripts/relay-monitor-evidence.mjs'),
+  relayTreePath('dev/scripts/relay-production-same-cap-wave.mjs'),
+  relayTreePath('dev/scripts/relay-repository.mjs'),
+  // Every other script those jobs run against live production.
+  relayTreePath('dev/scripts/infra.mjs'),
+  relayTreePath('dev/scripts/operate-relay-regional-rehome.mjs'),
+  relayTreePath('dev/scripts/prepare-relay-production-capacity-canary.mjs'),
+  relayTreePath('dev/scripts/probe-relay-rehome-trust.mjs'),
+  relayTreePath('dev/scripts/validate-relay-capacity-plan.mjs'),
+  relayTreePath('dev/scripts/verify-relay-capacity-transition.mjs'),
+  // The monitor itself and the live preflight recheck, plus anything that changes their behaviour.
+  relayTreePath('apps/relay-ops'),
+  relayTreePath('package.json'),
+  relayTreePath('pnpm-lock.yaml'),
+  relayTreePath('pnpm-workspace.yaml'),
+  // The Cloud SQL rollout lease every mutation job takes and releases.
+  '.github/actions/cloud-sql-rollout-lease'
+]
+
+function git(root, args) {
+  const result = spawnSync('git', ['-C', root, ...args], { encoding: 'utf8' })
+  if (result.error) throw new Error('relay evidence provenance cannot run git')
+  return result
+}
+
+/**
+ * Accepts evidence sealed at a different commit only when the current commit descends from it and
+ * every trusted path is byte-identical, so the verdict provably came from this exact code. Anything
+ * git cannot answer (no checkout, unknown commit, shallow clone) fails closed.
+ */
+export function requireSameEvidenceCode({
+  sealedSha,
+  currentSha,
+  label,
+  repositoryRoot = fileURLToPath(RELAY_REPOSITORY_ROOT)
+}) {
+  if (!SHA.test(sealedSha ?? '') || !SHA.test(currentSha ?? '')) {
+    throw new Error(`${label} commit is invalid`)
+  }
+  if (sealedSha === currentSha) return
+  if (git(repositoryRoot, ['rev-parse', '--git-dir']).status !== 0) {
+    throw new Error(`${label} commit cannot be compared without a git checkout`)
+  }
+  for (const sha of [sealedSha, currentSha]) {
+    if (git(repositoryRoot, ['rev-parse', '--verify', '--quiet', `${sha}^{commit}`]).status !== 0) {
+      throw new Error(
+        `${label} commit ${sha} is unknown to this checkout; check out with fetch-depth: 0`
+      )
+    }
+  }
+  const ancestry = git(repositoryRoot, ['merge-base', '--is-ancestor', sealedSha, currentSha])
+  if (ancestry.status === 1) {
+    throw new Error(`${label} commit ${sealedSha} is not an ancestor of ${currentSha}`)
+  }
+  if (ancestry.status !== 0) {
+    throw new Error(`${label} commit ancestry could not be determined`)
+  }
+  const diff = git(repositoryRoot, [
+    'diff',
+    '--name-only',
+    sealedSha,
+    currentSha,
+    '--',
+    ...TRUSTED_EVIDENCE_CODE_PATHS
+  ])
+  if (diff.status !== 0) throw new Error(`${label} commit comparison failed`)
+  const changed = diff.stdout.split('\n').filter(Boolean)
+  if (changed.length > 0) {
+    throw new Error(`${label} code changed after it was sealed: ${changed.join(',')}`)
+  }
+}
diff --git a/cloud/dev/scripts/relay-monitor-evidence.mjs b/cloud/dev/scripts/relay-monitor-evidence.mjs
index 7f387663f60..26eb37d0d4d 100644
--- a/cloud/dev/scripts/relay-monitor-evidence.mjs
+++ b/cloud/dev/scripts/relay-monitor-evidence.mjs
@@ -2,6 +2,7 @@ import { createHash } from 'node:crypto'
 import { chmod, readFile, readdir, stat, writeFile } from 'node:fs/promises'
 import { basename, join, resolve } from 'node:path'
 import { pathToFileURL } from 'node:url'
+import { requireSameEvidenceCode } from './relay-evidence-code-provenance.mjs'
 
 const SAFE_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{1,127}$/
 const SHA = /^[a-f0-9]{40}$/
@@ -102,7 +103,7 @@ export async function createEvidenceManifest(argv) {
   return manifest
 }
 
-async function readAndVerifyManifest(directory, expected) {
+async function readAndVerifyManifest(directory, expected, sameCodeCommit) {
   const manifest = JSON.parse(
     await readFile(join(directory, 'evidence-manifest.json'), 'utf8')
   )
@@ -111,11 +112,23 @@ async function readAndVerifyManifest(directory, expected) {
     manifest.incidentId !== expected.incidentId ||
     manifest.runId !== expected.runId ||
     manifest.runAttempt !== expected.runAttempt ||
-    manifest.commitSha !== expected.commitSha ||
-    manifest.mode !== expected.mode
+    !SHA.test(manifest.commitSha ?? '') ||
+    manifest.mode !== expected.mode ||
+    (!sameCodeCommit && manifest.commitSha !== expected.commitSha)
   ) {
     throw new Error('relay monitor evidence provenance does not match')
   }
+  // Unrelated merges land on main every few minutes, so the deployer resolves a newer commit than
+  // the monitor it must trust; identical monitor and mutation code is the property the SHA stood in
+  // for. Restore and mutation keep the exact-SHA bind: both run at the commit that sealed them.
+  if (sameCodeCommit) {
+    requireSameEvidenceCode({
+      sealedSha: manifest.commitSha,
+      currentSha: expected.commitSha,
+      label: 'relay monitor evidence',
+      ...sameCodeCommit
+    })
+  }
   const names = Object.keys(manifest.files ?? {})
   if (!names.includes(`${expected.incidentId}.state.json`)) {
     throw new Error('relay monitor evidence has no durable state')
@@ -209,12 +222,12 @@ function validCompletedDryRunState(state, expected, nowMs, maxAgeMs) {
   )
 }
 
-export async function verifyDryRunAuthority(argv, now = Date.now) {
+export async function verifyDryRunAuthority(argv, now = Date.now, repositoryRoot) {
   const values = argumentsByName(argv)
   const directory = resolve(values.directory ?? '')
   const expected = provenance(values)
   if (expected.mode !== 'dry-run') throw new Error('relay mutation requires dry-run evidence')
-  const manifest = await readAndVerifyManifest(directory, expected)
+  const manifest = await readAndVerifyManifest(directory, expected, { repositoryRoot })
   const state = JSON.parse(
     await readFile(join(directory, `${expected.incidentId}.state.json`), 'utf8')
   )
diff --git a/cloud/dev/scripts/relay-monitor-evidence.test.mjs b/cloud/dev/scripts/relay-monitor-evidence.test.mjs
index 45116761119..43d2ac02763 100644
--- a/cloud/dev/scripts/relay-monitor-evidence.test.mjs
+++ b/cloud/dev/scripts/relay-monitor-evidence.test.mjs
@@ -1,9 +1,15 @@
 import assert from 'node:assert/strict'
-import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { execFileSync } from 'node:child_process'
+import { mkdir, mkdtemp, readFile, rm, stat, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
-import { join } from 'node:path'
+import { dirname, join } from 'node:path'
 import test from 'node:test'
-import { relayWorkflowPath, relayWorkflowUrl } from './relay-repository.mjs'
+import { TRUSTED_EVIDENCE_CODE_PATHS } from './relay-evidence-code-provenance.mjs'
+import {
+  RELAY_REPOSITORY_ROOT,
+  relayWorkflowPath,
+  relayWorkflowUrl
+} from './relay-repository.mjs'
 import {
   createEvidenceManifest,
   verifyDryRunAuthority,
@@ -12,7 +18,7 @@ import {
 } from './relay-monitor-evidence.mjs'
 
 const now = Date.parse('2026-07-28T12:00:00.000Z')
-const provenance = [
+const provenanceFor = (commitSha) => [
   '--incident-id',
   'relay-123',
   '--run-id',
@@ -20,10 +26,11 @@ const provenance = [
   '--run-attempt',
   '1',
   '--commit-sha',
-  'a'.repeat(40),
+  commitSha,
   '--mode',
   'dry-run'
 ]
+const provenance = provenanceFor('a'.repeat(40))
 const selector = {
   generation: 2,
   membership: {
@@ -513,3 +520,157 @@ test('monitor uses a reusable job so exact job_workflow_ref is present', async (
   assert.match(job, /workflow_call:/)
   assert.match(job, /environment: production/)
 })
+
+function gitIn(root, ...args) {
+  return execFileSync('git', ['-C', root, ...args], { encoding: 'utf8' }).trim()
+}
+
+// A real repository shaped like main under unrelated merge traffic: one sealed commit, a
+// descendant that only touched untrusted files, a descendant that touched the monitor, and a
+// sibling that never descended from the seal.
+async function trustedCodeRepository() {
+  const root = await mkdtemp(join(tmpdir(), 'relay-evidence-repository-'))
+  gitIn(root, 'init', '--quiet')
+  gitIn(root, 'config', 'user.email', 'relay@example.test')
+  gitIn(root, 'config', 'user.name', 'Relay Evidence Test')
+  gitIn(root, 'config', 'commit.gpgsign', 'false')
+  const commit = async (path, body, message) => {
+    await mkdir(dirname(join(root, path)), { recursive: true })
+    await writeFile(join(root, path), body)
+    gitIn(root, 'add', '--all')
+    gitIn(root, 'commit', '--quiet', '--no-verify', '--message', message)
+    return gitIn(root, 'rev-parse', 'HEAD')
+  }
+  const base = await commit(
+    'cloud/apps/relay-ops/src/incident-monitor.ts',
+    'export const v = 1\n',
+    'monitor'
+  )
+  const sealed = await commit('README.md', 'base\n', 'base')
+  const sameCode = await commit('README.md', 'an unrelated merge\n', 'unrelated')
+  const changedCode = await commit(
+    'cloud/apps/relay-ops/src/incident-monitor.ts',
+    'export const v = 2\n',
+    'monitor change'
+  )
+  // Branches before the seal, so the seal is not in its history even though its code matches.
+  gitIn(root, 'checkout', '--quiet', '--detach', base)
+  const sibling = await commit('README.md', 'a divergent line\n', 'divergent')
+  return { root, sealed, sameCode, changedCode, sibling }
+}
+
+const authorityAt = (directory, commitSha, repositoryRoot) => verifyDryRunAuthority(
+  [
+    '--directory',
+    directory,
+    ...provenanceFor(commitSha),
+    '--required-migration-policy',
+    'strict'
+  ],
+  () => now,
+  repositoryRoot
+)
+
+test('accepts dry-run evidence sealed by identical code at an ancestor commit', async () => {
+  const repository = await trustedCodeRepository()
+  const directory = await evidenceDirectory()
+  try {
+    await createEvidenceManifest([
+      '--directory',
+      directory,
+      ...provenanceFor(repository.sealed)
+    ])
+    // An exact match never consults git: a root with no checkout at all still verifies.
+    await assert.doesNotReject(authorityAt(directory, repository.sealed, directory))
+    await assert.doesNotReject(authorityAt(directory, repository.sameCode, repository.root))
+  } finally {
+    await rm(repository.root, { recursive: true, force: true })
+    await rm(directory, { recursive: true, force: true })
+  }
+})
+
+test('rejects dry-run evidence whose monitor code or lineage differs', async () => {
+  const repository = await trustedCodeRepository()
+  const directory = await evidenceDirectory()
+  try {
+    await createEvidenceManifest([
+      '--directory',
+      directory,
+      ...provenanceFor(repository.sealed)
+    ])
+    await assert.rejects(
+      authorityAt(directory, repository.changedCode, repository.root),
+      /code changed after it was sealed: cloud\/apps\/relay-ops\/src\/incident-monitor\.ts/
+    )
+    await assert.rejects(
+      authorityAt(directory, repository.sibling, repository.root),
+      /is not an ancestor of/
+    )
+    // Fails closed: a shallow clone that never fetched the sealed commit proves nothing.
+    await assert.rejects(
+      authorityAt(directory, 'f'.repeat(40), repository.root),
+      /unknown to this checkout/
+    )
+    // Fails closed: no checkout to compare against.
+    await assert.rejects(
+      authorityAt(directory, repository.sameCode, directory),
+      /cannot be compared without a git checkout/
+    )
+  } finally {
+    await rm(repository.root, { recursive: true, force: true })
+    await rm(directory, { recursive: true, force: true })
+  }
+})
+
+test('keeps restore and mutation bound to the exact sealing commit', async () => {
+  const repository = await trustedCodeRepository()
+  const directory = await evidenceDirectory()
+  try {
+    await createEvidenceManifest([
+      '--directory',
+      directory,
+      ...provenanceFor(repository.sealed)
+    ])
+    await assert.rejects(
+      verifyRestoredEvidence([
+        '--directory',
+        directory,
+        ...provenanceFor(repository.sameCode)
+      ]),
+      /provenance does not match/
+    )
+    await assert.rejects(
+      verifyMutationEvidence(
+        [
+          '--directory',
+          directory,
+          ...provenanceFor(repository.sameCode),
+          '--mutation-mode',
+          'execute',
+          '--source-cell-id',
+          'c1',
+          '--director-origin',
+          'https://relay.example'
+        ],
+        { ORCA_RELAY_ADMIN_ID_TOKEN: 'aaa.bbb.ccc' },
+        async () => Response.json({ selector }),
+        () => now
+      ),
+      /provenance does not match/
+    )
+  } finally {
+    await rm(repository.root, { recursive: true, force: true })
+    await rm(directory, { recursive: true, force: true })
+  }
+})
+
+// A trusted path that no longer exists silently stops being compared, so the same-code rule would
+// pass over code it was written to pin.
+test('every trusted provenance path exists in this checkout', async () => {
+  for (const path of TRUSTED_EVIDENCE_CODE_PATHS) {
+    await assert.doesNotReject(
+      stat(new URL(path, RELAY_REPOSITORY_ROOT)),
+      `${path} is missing`
+    )
+  }
+})
diff --git a/cloud/dev/scripts/relay-production-same-cap-wave.mjs b/cloud/dev/scripts/relay-production-same-cap-wave.mjs
index e391c4c4381..6e84c1c9104 100644
--- a/cloud/dev/scripts/relay-production-same-cap-wave.mjs
+++ b/cloud/dev/scripts/relay-production-same-cap-wave.mjs
@@ -1,5 +1,6 @@
 import { readFileSync } from 'node:fs'
 import { pathToFileURL } from 'node:url'
+import { requireSameEvidenceCode } from './relay-evidence-code-provenance.mjs'
 
 export const SAME_CAP_CELLS = [
   'production-gce-c7', 'production-gce-c8', 'production-gce-c9', 'production-gce-c10',
@@ -85,10 +86,10 @@ export function canaryAuthority(input) {
   }
 }
 
-export function verifyCanaryAuthority(authority, expected) {
+export function verifyCanaryAuthority(authority, expected, repositoryRoot) {
   if (
     authority?.v !== 1 ||
-    authority.commitSha !== expected.commitSha ||
+    !/^[0-9a-f]{40}$/.test(authority.commitSha ?? '') ||
     authority.runId !== expected.runId ||
     authority.targetDigest !== expected.targetDigest ||
     authority.rollbackDigest !== expected.rollbackDigest ||
@@ -96,6 +97,14 @@ export function verifyCanaryAuthority(authority, expected) {
     authority.rehomeGeneration !== Number(expected.rehomeGeneration) ||
     !SAME_CAP_CELLS.includes(authority.cellId)
   ) throw new Error('canary authority does not match this batch')
+  // The batch dispatch resolves main after the canary sealed, so bind to the same code, not the
+  // same SHA; every field above still pins this batch to that exact canary.
+  requireSameEvidenceCode({
+    sealedSha: authority.commitSha,
+    currentSha: expected.commitSha,
+    label: 'relay same-cap canary authority',
+    repositoryRoot
+  })
   return authority
 }
 
diff --git a/cloud/dev/scripts/relay-production-same-cap-wave.test.mjs b/cloud/dev/scripts/relay-production-same-cap-wave.test.mjs
index 0b45ae85a99..d636c324b33 100644
--- a/cloud/dev/scripts/relay-production-same-cap-wave.test.mjs
+++ b/cloud/dev/scripts/relay-production-same-cap-wave.test.mjs
@@ -1,4 +1,8 @@
 import assert from 'node:assert/strict'
+import { execFileSync } from 'node:child_process'
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { dirname, join } from 'node:path'
 import { test } from 'node:test'
 import {
   canaryAuthority,
@@ -104,3 +108,66 @@ test('seals and verifies canary authority for later batches', () => {
     rehomeGeneration: '4'
   }), /does not match/)
 })
+
+function gitIn(root, ...args) {
+  return execFileSync('git', ['-C', root, ...args], { encoding: 'utf8' }).trim()
+}
+
+async function canaryRepository() {
+  const root = await mkdtemp(join(tmpdir(), 'relay-same-cap-canary-'))
+  gitIn(root, 'init', '--quiet')
+  gitIn(root, 'config', 'user.email', 'relay@example.test')
+  gitIn(root, 'config', 'user.name', 'Relay Wave Test')
+  gitIn(root, 'config', 'commit.gpgsign', 'false')
+  const commit = async (path, body, message) => {
+    await mkdir(dirname(join(root, path)), { recursive: true })
+    await writeFile(join(root, path), body)
+    gitIn(root, 'add', '--all')
+    gitIn(root, 'commit', '--quiet', '--no-verify', '--message', message)
+    return gitIn(root, 'rev-parse', 'HEAD')
+  }
+  const sealed = await commit(
+    'cloud/dev/scripts/relay-production-same-cap-wave.mjs',
+    'export const v = 1\n',
+    'wave'
+  )
+  const sameCode = await commit('README.md', 'an unrelated merge\n', 'unrelated')
+  const changedCode = await commit(
+    'cloud/dev/scripts/relay-production-same-cap-wave.mjs',
+    'export const v = 2\n',
+    'wave change'
+  )
+  return { root, sealed, sameCode, changedCode }
+}
+
+test('a batch trusts a canary sealed by identical code at an ancestor commit', async () => {
+  const repository = await canaryRepository()
+  try {
+    const authority = canaryAuthority({
+      cellIds: 'production-gce-c7',
+      targetDigest,
+      rollbackDigest,
+      confirmation: `ROLL_RELAY_SAME_CAP ${targetDigest} production-gce-c7`,
+      commitSha: repository.sealed,
+      runId: '42',
+      selectorGeneration: '11',
+      rehomeGeneration: '4'
+    })
+    const verifyAt = (commitSha, repositoryRoot) => verifyCanaryAuthority(authority, {
+      commitSha,
+      runId: '42',
+      targetDigest,
+      rollbackDigest,
+      selectorGeneration: '13',
+      rehomeGeneration: '4'
+    }, repositoryRoot)
+    assert.equal(verifyAt(repository.sameCode, repository.root).cellId, 'production-gce-c7')
+    assert.throws(
+      () => verifyAt(repository.changedCode, repository.root),
+      /code changed after it was sealed/
+    )
+    assert.throws(() => verifyAt('f'.repeat(40), repository.root), /unknown to this checkout/)
+  } finally {
+    await rm(repository.root, { recursive: true, force: true })
+  }
+})
diff --git a/cloud/dev/scripts/relay-regional-rehome-workflow.test.mjs b/cloud/dev/scripts/relay-regional-rehome-workflow.test.mjs
index e31403f6dd6..a77ab93cf15 100644
--- a/cloud/dev/scripts/relay-regional-rehome-workflow.test.mjs
+++ b/cloud/dev/scripts/relay-regional-rehome-workflow.test.mjs
@@ -73,7 +73,10 @@ test('same-cap wrapper is reusable, canary-bound, and sequential', () => {
     job,
     /--rollback-image "\$\{DESIRED_IMAGE\}" \\\n {16}--rehome-director-service-account "\$\{DIRECTOR_RUNTIME_SERVICE_ACCOUNT\}"/
   )
-  assert.match(job, /host-drain \\\n {14}\| jq -e '\.changes == 2' >\/dev\/null/)
+  assert.match(
+    job,
+    /host-drain \\\n {16}--regional-rehome-protocol "\$\{DESIRED_REHOME_PROTOCOL\}" \\\n {14}\| jq -e '\.changes == 2' >\/dev\/null/
+  )
   assert.match(job, /resume requires the isolated migration-only cell/)
   assert.match(job, /test "\$\{TARGET_INCARNATION\}" = "\$\{SOURCE_INCARNATION\}"/)
   assert.match(job, /\(.regionalRehomeProtocol \/\/ 0\) == \$protocol/)
@@ -92,7 +95,11 @@ test('same-cap wrapper is reusable, canary-bound, and sequential', () => {
   // age checks must scale by wave or cell_2+ can never pass; the bound's
   // per-wave step is the cell job timeout, so the two must move together.
   assert.match(job, /--required-migration-policy strict \\\n            --wave-index "\$\{WAVE_INDEX\}"/)
-  assert.match(job, /dry-run\.state\.json" \\\n            --wave-index "\$\{WAVE_INDEX\}" "\$\{RETRY_ARGS\[@\]\}"/)
+  // Wave 0 must retry freshness-only failures too: one Cloud Monitoring publish
+  // lag at the sample instant is not health evidence, and single-shot wave 0
+  // failed a whole batch on a series that was fresh again a minute later.
+  assert.match(job, /dry-run\.state\.json" \\\n            --wave-index "\$\{WAVE_INDEX\}" --retry-freshness/)
+  assert.doesNotMatch(job, /RETRY_ARGS/)
   assert.match(job, /timeout-minutes: 75/)
   // Both age gates step by the cell job timeout above; the constant is
   // duplicated across the two languages, so pin each copy to it.
diff --git a/cloud/dev/scripts/relay-repository.mjs b/cloud/dev/scripts/relay-repository.mjs
index 7e8b01e4799..040acef5fe5 100644
--- a/cloud/dev/scripts/relay-repository.mjs
+++ b/cloud/dev/scripts/relay-repository.mjs
@@ -1,4 +1,6 @@
 import { readFileSync } from 'node:fs'
+import { relative } from 'node:path'
+import { fileURLToPath } from 'node:url'
 
 // Single place naming the repository the Relay workflows live in and where their files sit. The
 // public-repo copy moves this tree under cloud/, prefixes every workflow filename, and changes the
@@ -11,6 +13,19 @@ export const RELAY_WORKFLOW_FILE_PREFIX = 'cloud-'
 // this tree moves under cloud/, so the depth changes at the copy even though the layout does not.
 export const RELAY_WORKFLOW_DIRECTORY = new URL('../../../.github/workflows/', import.meta.url)
 
+// Repository root, derived from the one directory above that already tracks the copy's depth.
+export const RELAY_REPOSITORY_ROOT = new URL('../../', RELAY_WORKFLOW_DIRECTORY)
+
+// Repository-relative path for a file in this tree. The prefix is 'cloud/' here and empty where
+// the tree is the repository root, so callers naming git paths never restate the layout.
+export function relayTreePath(suffix) {
+  const prefix = relative(
+    fileURLToPath(RELAY_REPOSITORY_ROOT),
+    fileURLToPath(new URL('../../', import.meta.url))
+  ).split(/[\\/]/).filter(Boolean)
+  return [...prefix, suffix].join('/')
+}
+
 export function relayWorkflowFile(name) {
   return `${RELAY_WORKFLOW_FILE_PREFIX}${name}`
 }
diff --git a/cloud/dev/scripts/relay-same-cap-script-census.test.mjs b/cloud/dev/scripts/relay-same-cap-script-census.test.mjs
new file mode 100644
index 00000000000..743aef7fc2d
--- /dev/null
+++ b/cloud/dev/scripts/relay-same-cap-script-census.test.mjs
@@ -0,0 +1,217 @@
+import assert from 'node:assert/strict'
+import { spawnSync } from 'node:child_process'
+import { readFileSync } from 'node:fs'
+import { describe, it } from 'node:test'
+import { parseProductionCapacityCellArguments } from './prepare-relay-production-capacity-canary.mjs'
+import { SAME_CAP_CELLS } from './relay-production-same-cap-wave.mjs'
+import { readRelayWorkflow } from './relay-repository.mjs'
+import { validateCapacityPlan } from './validate-relay-capacity-plan.mjs'
+
+const workflow = readRelayWorkflow('deploy-relay-production-same-cap-job.yml')
+const capacityWorkflow = readRelayWorkflow('deploy-relay-production-capacity-job.yml')
+const production = readFileSync(
+  new URL('../../infra/terraform/environments/production.tfvars', import.meta.url),
+  'utf8'
+)
+const REHOME_SOURCE_CELLS = rehomeSourceCells()
+const DIRECTOR_IDENTITY = 'relay-director@onorca-cloud.iam.gserviceaccount.com'
+const AUDIENCE = 'https://relay.onorca.dev/v1/admin/host-drain'
+const ROLLBACK_IMAGE = `us-central1-docker.pkg.dev/p/orca-cloud/relay@sha256:${'d'.repeat(64)}`
+const TARGET_IMAGE = `us-central1-docker.pkg.dev/p/orca-cloud/relay@sha256:${'e'.repeat(64)}`
+
+// The startup template emits rehome trust only for cells in this list, so it is what decides
+// whether a cell's plan may carry those lines at all.
+function rehomeSourceCells() {
+  const start = production.indexOf('relay_region_rehome_source_cell_ids = [')
+  assert.notEqual(start, -1, 'production.tfvars has no rehome source cell list')
+  const end = production.indexOf(']', start)
+  assert.notEqual(end, -1, 'the rehome source cell list is unterminated')
+  return new Set(
+    [...production.slice(start, end).matchAll(/"([^"]+)"/g)].map(([, cell]) => cell)
+  )
+}
+
+function startupScript({ cap, image, trusted }) {
+  return [
+    `  printf 'ORCA_RELAY_CELL_CONNECTION_HARD_CAP=%s\\n' '${cap}'`,
+    `  printf 'ORCA_RELAY_CELL_CONNECTION_UNOBSERVED_BOUND=%s\\n' '60'`,
+    ...(trusted ? [
+      `  printf 'ORCA_RELAY_REHOME_DIRECTOR_SERVICE_ACCOUNT=%s\\n' '${DIRECTOR_IDENTITY}'`,
+      `  printf 'ORCA_RELAY_REHOME_AUDIENCE=%s\\n' '${AUDIENCE}'`
+    ] : []),
+    `printf 'ORCA_RELAY_IMAGE_DIGEST=%s\\n' '${image.split('@')[1]}'`,
+    `docker pull '${image}'`,
+    'docker run --detach \\',
+    '  --name orca-relay \\',
+    `  '${image}'`
+  ].join('\n')
+}
+
+// The exact shape the apply step's plan has: template replaced, MIG rebound to it.
+function rollPlan({ cellId, cap, protocol }) {
+  return {
+    configuration: {
+      root_module: {
+        resources: [{
+          address: 'google_compute_instance_group_manager.relay_gce_cell',
+          expressions: {
+            version: [{
+              instance_template: {
+                references: [
+                  'google_compute_instance_template.relay_gce_cell',
+                  'each.key'
+                ]
+              },
+              name: { constant_value: 'primary' }
+            }]
+          }
+        }]
+      }
+    },
+    resource_changes: [
+      {
+        address: `google_compute_instance_template.relay_gce_cell[${JSON.stringify(cellId)}]`,
+        change: {
+          actions: ['create', 'delete'],
+          before: {
+            metadata_startup_script: startupScript({
+              cap,
+              image: ROLLBACK_IMAGE,
+              trusted: protocol === 1
+            })
+          },
+          after: {
+            metadata_startup_script: startupScript({
+              cap,
+              image: TARGET_IMAGE,
+              trusted: protocol === 1
+            }),
+            self_link: null
+          },
+          after_unknown: { self_link: true }
+        }
+      },
+      {
+        address: `google_compute_instance_group_manager.relay_gce_cell[${JSON.stringify(cellId)}]`,
+        change: {
+          actions: ['update'],
+          before: { target_size: 1, version: [{ instance_template: 'old' }] },
+          after: { target_size: 1, version: [{ instance_template: null }] },
+          after_unknown: { version: [{ instance_template: true }] }
+        }
+      }
+    ]
+  }
+}
+
+function hostname(cellId) {
+  return cellId.slice('production-gce-'.length)
+}
+
+// The job resolves cap and region from the cell id before any admin call; run that block alone.
+function resolveCellShape(cellId) {
+  const start = workflow.indexOf('          TARGET_HOSTNAME="${TARGET_CELL_ID#production-gce-}"')
+  assert.notEqual(start, -1, 'the same-cap cell shape block is missing')
+  const end = workflow.indexOf('\n          esac\n', start)
+  assert.notEqual(end, -1, 'the same-cap cell shape block has no esac')
+  const script = workflow.slice(start, end + '\n          esac'.length).replace(/^ {10}/gm, '')
+  return spawnSync('bash', [
+    '-euo',
+    'pipefail',
+    '-c',
+    `${script}\necho "\${EXPECTED_REGION} \${EXPECTED_HARD_CAP}"`
+  ], { env: { ...process.env, TARGET_CELL_ID: cellId }, encoding: 'utf8' })
+}
+
+describe('same-cap roll scripts accept every same-cap cell', () => {
+  it('parses every wave cell through the same-cap canary allowlist', () => {
+    for (const cellId of SAME_CAP_CELLS) {
+      for (const mode of ['isolate', 'drain', 'activate']) {
+        assert.deepEqual(parseProductionCapacityCellArguments([
+          '--director-origin', 'https://relay.onorca.dev',
+          '--cell-origin', `https://${hostname(cellId)}.relay.onorca.dev`,
+          '--cell-id', cellId,
+          '--approved-cells', 'same-cap',
+          '--mode', mode
+        ]), {
+          directorOrigin: 'https://relay.onorca.dev',
+          cellOrigin: `https://${hostname(cellId)}.relay.onorca.dev`,
+          cellId,
+          mode
+        })
+      }
+    }
+  })
+
+  it('resolves a cap and region for every wave cell and refuses anything else', () => {
+    for (const cellId of SAME_CAP_CELLS) {
+      const resolved = resolveCellShape(cellId)
+      assert.equal(resolved.status, 0, `${cellId}: ${resolved.stderr}`)
+      assert.match(resolved.stdout.trim(), /^(us-central1 1000|asia-east2 3000)$/)
+    }
+    assert.equal(resolveCellShape('production-gce-c17').status, 1)
+    assert.equal(resolveCellShape('production-gce-c30').status, 1)
+  })
+
+  it('passes the same-cap allowlist on every canary invocation the job runs', () => {
+    const invocations = workflow.split('prepare-relay-production-capacity-canary.mjs').slice(1)
+    assert.equal(invocations.length, 4)
+    for (const invocation of invocations) {
+      const lines = invocation.split('\n')
+      const end = lines.findIndex((line) => !line.endsWith('\\'))
+      const call = lines.slice(0, end + 1).join(' ')
+      assert.match(call, /--approved-cells same-cap/)
+      assert.match(call, /--mode (isolate|drain|activate)/)
+    }
+  })
+
+  it('passes this cell\'s rehome protocol on every plan validation the job runs', () => {
+    const invocations = workflow.split('validate-relay-capacity-plan.mjs').slice(1)
+    assert.equal(invocations.length, 2)
+    for (const invocation of invocations) {
+      const lines = invocation.split('\n')
+      const end = lines.findIndex((line) => !line.trimEnd().endsWith('\\'))
+      const call = lines.slice(0, end + 1).join(' ')
+      assert.match(call, /--mode same-cap-cell/)
+      assert.match(call, /--regional-rehome-protocol "\$\{DESIRED_REHOME_PROTOCOL\}"/)
+    }
+  })
+
+  it('validates a correct plan for every wave cell at that cell\'s rehome protocol', () => {
+    for (const cellId of SAME_CAP_CELLS) {
+      const [region, cap] = resolveCellShape(cellId).stdout.trim().split(' ')
+      const protocol = REHOME_SOURCE_CELLS.has(cellId) ? 1 : 0
+      assert.equal(protocol, region === 'us-central1' ? 1 : 0, cellId)
+      const config = {
+        mode: 'same-cap-cell',
+        cellId,
+        hardCap: Number(cap),
+        unobservedBound: 60,
+        image: TARGET_IMAGE,
+        rollbackImage: ROLLBACK_IMAGE,
+        rehomeDirectorServiceAccount: DIRECTOR_IDENTITY,
+        rehomeAudience: AUDIENCE,
+        regionalRehomeProtocol: String(protocol)
+      }
+      const plan = rollPlan({ cellId, cap, protocol })
+      assert.deepEqual(
+        validateCapacityPlan(plan, config),
+        { mode: 'same-cap-cell', changes: 2 },
+        cellId
+      )
+      // The other protocol must reject the same plan, or the flag decides nothing.
+      assert.throws(
+        () => validateCapacityPlan(plan, {
+          ...config,
+          regionalRehomeProtocol: String(1 - protocol)
+        }),
+        /reviewed image and capacity/,
+        cellId
+      )
+    }
+  })
+
+  it('leaves the US-only capacity job on the default allowlist', () => {
+    assert.doesNotMatch(capacityWorkflow, /--approved-cells/)
+  })
+})
diff --git a/cloud/dev/scripts/validate-relay-capacity-plan.mjs b/cloud/dev/scripts/validate-relay-capacity-plan.mjs
index 7307295d206..294e85ae31d 100644
--- a/cloud/dev/scripts/validate-relay-capacity-plan.mjs
+++ b/cloud/dev/scripts/validate-relay-capacity-plan.mjs
@@ -4,7 +4,18 @@ import { pathToFileURL } from 'node:url'
 const SERVICE_ACCOUNT_EMAIL =
   /^[a-z][a-z0-9-]{4,28}[a-z0-9]@[a-z0-9-]+\.iam\.gserviceaccount\.com$/
 
-function parseArguments(argv) {
+const REHOME_CONFIG =
+  /^  printf 'ORCA_RELAY_REHOME_(?:DIRECTOR_SERVICE_ACCOUNT|AUDIENCE)=%s\\n' '[^'\n]+'$/
+
+// Only cells listed as regional rehome sources get rehome trust lines in their startup script.
+function rehomeProtocol({ regionalRehomeProtocol }) {
+  if (![0, 1, '0', '1'].includes(regionalRehomeProtocol)) {
+    throw new Error('same-cap Terraform plan has an invalid regional rehome protocol')
+  }
+  return Number(regionalRehomeProtocol)
+}
+
+export function parseCapacityPlanArguments(argv) {
   const values = {}
   for (let index = 0; index < argv.length; index += 2) {
     const key = argv[index]
@@ -31,8 +42,12 @@ function parseArguments(argv) {
     values.mode === 'same-cap-cell' &&
     (!values['rollback-image'] ||
       !values['rehome-director-service-account'] ||
-      !values['rehome-audience'])
+      !values['rehome-audience'] ||
+      !['0', '1'].includes(values['regional-rehome-protocol']))
   ) throw new Error('same-cap validation requires rollback image and rehome trust config')
+  if (values.mode !== 'same-cap-cell' && values['regional-rehome-protocol'] !== undefined) {
+    throw new Error('--regional-rehome-protocol applies only to same-cap-cell validation')
+  }
   if (values.mode === 'same-cap-image' && !values['rollback-image']) {
     throw new Error('same-cap image validation requires a rollback image')
   }
@@ -51,7 +66,8 @@ function parseArguments(argv) {
     capacityServiceAccount: values['capacity-service-account'],
     rollbackImage: values['rollback-image'],
     rehomeDirectorServiceAccount: values['rehome-director-service-account'],
-    rehomeAudience: values['rehome-audience']
+    rehomeAudience: values['rehome-audience'],
+    regionalRehomeProtocol: values['regional-rehome-protocol']
   }
 }
 
@@ -175,15 +191,13 @@ function normalizedStartupScript(
     /^  printf 'ORCA_RELAY_CELL_CONNECTION_(?:HARD_CAP|UNOBSERVED_BOUND)=%s\\n' '[0-9]+'$/
   const capacityIdentity =
     /^  printf 'ORCA_RELAY_CAPACITY_SERVICE_ACCOUNT=%s\\n' '[a-z][a-z0-9-]{4,28}[a-z0-9]@[a-z0-9-]+\.iam\.gserviceaccount\.com'$/
-  const rehomeConfig =
-    /^  printf 'ORCA_RELAY_REHOME_(?:DIRECTOR_SERVICE_ACCOUNT|AUDIENCE)=%s\\n' '[^'\n]+'$/
   return script
     .split('\n')
     .filter(
       (line) =>
         (preserveCapacity || !capacityAssignment.test(line)) &&
         (!stripCapacityIdentity || !capacityIdentity.test(line)) &&
-        (!stripRehomeConfig || !rehomeConfig.test(line))
+        (!stripRehomeConfig || !REHOME_CONFIG.test(line))
     )
     .join('\n')
     .replaceAll(image, '<relay-image>')
@@ -213,7 +227,8 @@ function requireDesiredStartupScript(script, config) {
       `  printf 'ORCA_RELAY_CAPACITY_SERVICE_ACCOUNT=%s\\n' '${config.capacityServiceAccount}'`
     ])
   }
-  if (config.mode === 'same-cap-cell') {
+  const rehomeTrusted = config.mode === 'same-cap-cell' && rehomeProtocol(config) === 1
+  if (rehomeTrusted) {
     expected.push(
       [
         /^  printf 'ORCA_RELAY_REHOME_DIRECTOR_SERVICE_ACCOUNT=%s\\n' '[^'\n]+'$/,
@@ -225,9 +240,15 @@ function requireDesiredStartupScript(script, config) {
       ]
     )
   }
+  // A protocol-0 cell is not a rehome source, so gaining any rehome trust line is real drift.
+  const unexpectedRehome =
+    config.mode === 'same-cap-cell' &&
+    !rehomeTrusted &&
+    lines.some((line) => REHOME_CONFIG.test(line))
   if (
     typeof script !== 'string' ||
     relayImage(script) !== config.image ||
+    unexpectedRehome ||
     expected.some(([pattern, line]) => !hasExactSingleAssignment(lines, pattern, line))
   ) {
     throw new Error('cell plan does not contain the reviewed image and capacity')
@@ -450,6 +471,9 @@ export function validateCapacityPlan(plan, config) {
   ) {
     throw new Error('capacity Terraform plan has an invalid service account')
   }
+  if (config.mode === 'same-cap-cell') {
+    rehomeProtocol(config)
+  }
   if (
     config.mode === 'same-cap-cell' &&
     (!SERVICE_ACCOUNT_EMAIL.test(config.rehomeDirectorServiceAccount ?? '') ||
@@ -504,7 +528,7 @@ export function validateCapacityPlan(plan, config) {
 }
 
 export function main(argv = process.argv.slice(2)) {
-  const config = parseArguments(argv)
+  const config = parseCapacityPlanArguments(argv)
   const plan = JSON.parse(readFileSync(0, 'utf8'))
   process.stdout.write(`${JSON.stringify({ event: 'relay_capacity_plan_verified', ...validateCapacityPlan(plan, config) })}\n`)
 }
diff --git a/cloud/dev/scripts/validate-relay-capacity-plan.test.mjs b/cloud/dev/scripts/validate-relay-capacity-plan.test.mjs
index 207285dc570..fb6ccb57e1c 100644
--- a/cloud/dev/scripts/validate-relay-capacity-plan.test.mjs
+++ b/cloud/dev/scripts/validate-relay-capacity-plan.test.mjs
@@ -1,6 +1,9 @@
 import assert from 'node:assert/strict'
 import { test } from 'node:test'
-import { validateCapacityPlan as validateCapacityPlanRaw } from './validate-relay-capacity-plan.mjs'
+import {
+  parseCapacityPlanArguments,
+  validateCapacityPlan as validateCapacityPlanRaw
+} from './validate-relay-capacity-plan.mjs'
 
 const config = {
   cellId: 'staging-gce-c3',
@@ -466,7 +469,8 @@ test('same-cap mode preserves 1000/60 while adding only the reviewed trust confi
     image,
     rollbackImage,
     rehomeDirectorServiceAccount: directorIdentity,
-    rehomeAudience: audience
+    rehomeAudience: audience,
+    regionalRehomeProtocol: '1'
   }
   assert.deepEqual(
     validateCapacityPlan({ resource_changes: [template, manager] }, sameCapConfig),
@@ -644,3 +648,134 @@ test('same-cap mode preserves 1000/60 while adding only the reviewed trust confi
     { mode: 'same-cap-image', changes: 1, changeKind: 'manager-convergence' }
   )
 })
+
+test('protocol-0 same-cap cells roll without rehome trust lines', () => {
+  const rollbackImage = `us-docker.pkg.dev/project/relay/image@sha256:${'d'.repeat(64)}`
+  const image = `us-docker.pkg.dev/project/relay/image@sha256:${'e'.repeat(64)}`
+  const directorIdentity = 'relay-director@project.iam.gserviceaccount.com'
+  const audience = 'https://relay.example.com/v1/admin/host-drain'
+  const startup = ({ selectedImage, trust = false }) => [
+    `  printf 'ORCA_RELAY_CELL_CONNECTION_HARD_CAP=%s\\n' '3000'`,
+    `  printf 'ORCA_RELAY_CELL_CONNECTION_UNOBSERVED_BOUND=%s\\n' '60'`,
+    `  printf 'ORCA_RELAY_CELL_REGION=%s\\n' 'asia-east2'`,
+    ...(trust ? [
+      `  printf 'ORCA_RELAY_REHOME_DIRECTOR_SERVICE_ACCOUNT=%s\\n' '${directorIdentity}'`,
+      `  printf 'ORCA_RELAY_REHOME_AUDIENCE=%s\\n' '${audience}'`
+    ] : []),
+    `printf 'ORCA_RELAY_IMAGE_DIGEST=%s\\n' '${selectedImage.split('@')[1]}'`,
+    `docker pull '${selectedImage}'`,
+    'docker run --detach \\',
+    '  --name orca-relay \\',
+    `  '${selectedImage}'`
+  ].join('\n')
+  const template = {
+    address: 'google_compute_instance_template.relay_gce_cell["production-gce-c27"]',
+    change: {
+      actions: ['create', 'delete'],
+      before: { metadata_startup_script: startup({ selectedImage: rollbackImage }) },
+      after: { metadata_startup_script: startup({ selectedImage: image }), self_link: null },
+      after_unknown: { self_link: true }
+    }
+  }
+  const manager = {
+    address: 'google_compute_instance_group_manager.relay_gce_cell["production-gce-c27"]',
+    change: {
+      actions: ['update'],
+      before: { target_size: 1, version: [{ instance_template: 'old' }] },
+      after: { target_size: 1, version: [{ instance_template: null }] },
+      after_unknown: { version: [{ instance_template: true }] }
+    }
+  }
+  const asiaConfig = {
+    cellId: 'production-gce-c27',
+    hardCap: 3_000,
+    unobservedBound: 60,
+    mode: 'same-cap-cell',
+    image,
+    rollbackImage,
+    rehomeDirectorServiceAccount: directorIdentity,
+    rehomeAudience: audience,
+    regionalRehomeProtocol: '0'
+  }
+  assert.deepEqual(
+    validateCapacityPlan({ resource_changes: [template, manager] }, asiaConfig),
+    { mode: 'same-cap-cell', changes: 2 }
+  )
+  const gainsTrust = structuredClone(template)
+  gainsTrust.change.after.metadata_startup_script = startup({
+    selectedImage: image,
+    trust: true
+  })
+  assert.throws(
+    () => validateCapacityPlan({ resource_changes: [gainsTrust, manager] }, asiaConfig),
+    /reviewed image and capacity/
+  )
+  // Under protocol 1 that same script is the reviewed roll: trust is added, not drift.
+  assert.deepEqual(
+    validateCapacityPlan(
+      { resource_changes: [gainsTrust, manager] },
+      { ...asiaConfig, regionalRehomeProtocol: '1' }
+    ),
+    { mode: 'same-cap-cell', changes: 2 }
+  )
+  // A protocol-1 cell whose script has no rehome lines is the pre-existing failure, unchanged.
+  assert.throws(
+    () => validateCapacityPlan(
+      { resource_changes: [template, manager] },
+      { ...asiaConfig, regionalRehomeProtocol: '1' }
+    ),
+    /reviewed image and capacity/
+  )
+  for (const protocol of [undefined, '', '2', 'yes']) {
+    assert.throws(
+      () => validateCapacityPlan(
+        { resource_changes: [template, manager] },
+        { ...asiaConfig, regionalRehomeProtocol: protocol }
+      ),
+      /invalid regional rehome protocol/
+    )
+  }
+})
+
+test('the rehome protocol argument is required by same-cap-cell mode alone', () => {
+  const image = `us-docker.pkg.dev/project/relay/image@sha256:${'e'.repeat(64)}`
+  const rollbackImage = `us-docker.pkg.dev/project/relay/image@sha256:${'d'.repeat(64)}`
+  const sameCapArguments = (...extra) => [
+    '--mode', 'same-cap-cell',
+    '--cell-id', 'production-gce-c27',
+    '--hard-cap', '3000',
+    '--unobserved-bound', '60',
+    '--image', image,
+    '--rollback-image', rollbackImage,
+    '--rehome-director-service-account', 'relay-director@project.iam.gserviceaccount.com',
+    '--rehome-audience', 'https://relay.onorca.dev/v1/admin/host-drain',
+    ...extra
+  ]
+  assert.equal(
+    parseCapacityPlanArguments(sameCapArguments('--regional-rehome-protocol', '0'))
+      .regionalRehomeProtocol,
+    '0'
+  )
+  assert.throws(
+    () => parseCapacityPlanArguments(sameCapArguments()),
+    /requires rollback image and rehome trust config/
+  )
+  for (const protocol of ['', '2', 'true']) {
+    assert.throws(
+      () => parseCapacityPlanArguments(sameCapArguments('--regional-rehome-protocol', protocol)),
+      /requires rollback image and rehome trust config/
+    )
+  }
+  assert.throws(
+    () => parseCapacityPlanArguments([
+      '--mode', 'bootstrap-cell',
+      '--cell-id', 'staging-gce-c3',
+      '--hard-cap', '1000',
+      '--unobserved-bound', '60',
+      '--image', image,
+      '--capacity-service-account', 'orca-cap@onorca-cloud.iam.gserviceaccount.com',
+      '--regional-rehome-protocol', '0'
+    ]),
+    /applies only to same-cap-cell validation/
+  )
+})
diff --git a/cloud/dev/scripts/verify-relay-capacity-transition.mjs b/cloud/dev/scripts/verify-relay-capacity-transition.mjs
index e5ebe77d45f..b81ea15afb3 100644
--- a/cloud/dev/scripts/verify-relay-capacity-transition.mjs
+++ b/cloud/dev/scripts/verify-relay-capacity-transition.mjs
@@ -1,4 +1,5 @@
 import { pathToFileURL } from 'node:url'
+import { fetchAdminOnceMore } from './relay-admin-transient-retry.mjs'
 
 const CAPACITY_PROTOCOL = 2
 
@@ -378,9 +379,12 @@ export async function verifyCapacityTransition(config, overrides = {}) {
   const token = overrides.token ?? process.env.ORCA_RELAY_ADMIN_ID_TOKEN
   if (!token || token.length > 8_192) throw new Error('admin identity token is unavailable')
   const health = await responseJson(
-    await fetchImpl(`${config.directorOrigin}/health`, {
-      signal: AbortSignal.timeout(15_000)
-    }),
+    await fetchAdminOnceMore(
+      fetchImpl,
+      `${config.directorOrigin}/health`,
+      {},
+      { wait, timeoutMs: 15_000 }
+    ),
     'director health'
   )
   if (health.ok !== true || health.connectionCapacityProtocol !== CAPACITY_PROTOCOL) {
@@ -394,12 +398,16 @@ export async function verifyCapacityTransition(config, overrides = {}) {
     lastObservation = { runtimeAvailable: runtime !== null }
     if ((runtime === null) === (config.runtime === 'unavailable')) {
       const result = await responseJson(
-        await fetchImpl(`${config.directorOrigin}/v1/admin/cell-status`, {
-          method: 'POST',
-          headers: { authorization: `Bearer ${token}`, 'content-type': 'application/json' },
-          body: JSON.stringify({ v: 1, cellId: config.cellId }),
-          signal: AbortSignal.timeout(30_000)
-        }),
+        await fetchAdminOnceMore(
+          fetchImpl,
+          `${config.directorOrigin}/v1/admin/cell-status`,
+          {
+            method: 'POST',
+            headers: { authorization: `Bearer ${token}`, 'content-type': 'application/json' },
+            body: JSON.stringify({ v: 1, cellId: config.cellId })
+          },
+          { wait }
+        ),
         'cell status'
       )
       const status = result.status
diff --git a/cloud/dev/scripts/verify-relay-capacity-transition.test.mjs b/cloud/dev/scripts/verify-relay-capacity-transition.test.mjs
index fb865257c4a..e596ffbced7 100644
--- a/cloud/dev/scripts/verify-relay-capacity-transition.test.mjs
+++ b/cloud/dev/scripts/verify-relay-capacity-transition.test.mjs
@@ -1094,3 +1094,77 @@ test('does not retry a rejected cell admin token', async () => {
   )
   assert.equal(waits, 0)
 })
+
+test('retries a transient 503 on the director cell-status read', async () => {
+  const base = harness()
+  const statusCalls = []
+  const result = await verifyCapacityTransition(config, {
+    token: 'masked-token',
+    wait: async () => {},
+    fetch: async (url, options) => {
+      const path = new URL(url).pathname
+      if (path !== '/v1/admin/cell-status') return await base(url, options)
+      statusCalls.push(path)
+      if (statusCalls.length === 1) return new Response('warming up', { status: 503 })
+      return await base(url, options)
+    }
+  })
+  assert.equal(statusCalls.length, 2)
+  assert.equal(result.cellId, config.cellId)
+})
+
+test('fails when both director cell-status attempts return a transient 503', async () => {
+  const base = harness()
+  let statusCalls = 0
+  await assert.rejects(
+    verifyCapacityTransition(config, {
+      token: 'masked-token',
+      wait: async () => {},
+      fetch: async (url, options) => {
+        const path = new URL(url).pathname
+        if (path !== '/v1/admin/cell-status') return await base(url, options)
+        statusCalls += 1
+        return new Response('warming up', { status: 503 })
+      }
+    }),
+    /cell status returned 503/
+  )
+  assert.equal(statusCalls, 2)
+})
+
+test('retries a transient 503 on the director health preflight', async () => {
+  const base = harness()
+  let healthCalls = 0
+  const result = await verifyCapacityTransition(config, {
+    token: 'masked-token',
+    wait: async () => {},
+    fetch: async (url, options) => {
+      const path = new URL(url).pathname
+      if (path !== '/health') return await base(url, options)
+      healthCalls += 1
+      if (healthCalls === 1) return new Response('warming up', { status: 503 })
+      return await base(url, options)
+    }
+  })
+  assert.equal(healthCalls, 2)
+  assert.equal(result.cellId, config.cellId)
+})
+
+test('fails when both director health attempts return a transient 503', async () => {
+  const base = harness()
+  let healthCalls = 0
+  await assert.rejects(
+    verifyCapacityTransition(config, {
+      token: 'masked-token',
+      wait: async () => {},
+      fetch: async (url, options) => {
+        const path = new URL(url).pathname
+        if (path !== '/health') return await base(url, options)
+        healthCalls += 1
+        return new Response('warming up', { status: 503 })
+      }
+    }),
+    /director health returned 503/
+  )
+  assert.equal(healthCalls, 2)
+})
diff --git a/cloud/docs/relay-improvement-checklist-2026-09.md b/cloud/docs/relay-improvement-checklist-2026-09.md
new file mode 100644
index 00000000000..91f1cc742ef
--- /dev/null
+++ b/cloud/docs/relay-improvement-checklist-2026-09.md
@@ -0,0 +1,189 @@
+# Relay improvement: implementation checklist, lanes, and disruption
+
+Companion to [`relay-improvement-roadmap-2026-09.md`](./relay-improvement-roadmap-2026-09.md) (item numbers
+match). This file answers three questions per item: what are the concrete steps, what can run in parallel,
+and will a user notice.
+
+## Status as of 2026-09-04 22:30Z
+
+Three buckets. "Merged" means the code is on `main` and nothing in production has changed yet. "Deployed" means users are already getting it. "Awaiting owner" means I will not touch production without a go.
+
+**Deployed to production**
+- Auth instance cap 20 + dead-family audit fix (orca-cloud #474) as revision `orca-cloud-auth-00031-tox`.
+- Dynamic NAT ports in both regions (stablyai/orca #18693). Zero drops and zero proxy dial errors since.
+- Nine alert policies with log metrics: 4 auth (#475), 3 relay Cloud SQL/NAT (#18693), 1 cell process-exit (#18717), all on the relay Slack channel.
+
+**Merged, ships with the next relay cell image roll (Roll 1 carries `519f4914`; Roll 2 needs a fresh image build)**
+- Per-cell inventory locks, delta counters, pool `statement_timeout` (#18722). Roll 2.
+- Cells dial Cloud SQL with `--private-ip` when configured (#18720). Inert until 2.1 applies.
+- Phone shows a clear "sign in on the desktop again" state when the desktop is signed out (#18698).
+
+**Merged, ships with the next auth deploy**
+- Refresh rotation grace window (orca-cloud #478). Startup adds one nullable column (brief exclusive lock on `refresh_tokens`).
+- Pruning job code (orca-cloud #476) is in the image; the job itself is Terraform-disabled until 1.2.
+
+**Merged, ships with the next desktop release**
+- Never replay a refresh token after a timeout; ±10 % jitter on relay lease renewal (#18719).
+- Renderer learns when a cloud session is revoked (#18694).
+
+**Merged, not applied**
+- Incident dashboard (#18717) blocked behind the runtime-metric label drift (5.x first item).
+- Monitor probe fix (#18723) is live in the workflow; the same-cap roll gate has not yet produced a green dry-run since.
+
+**Awaiting owner go (production mutations)**
+1. Roll 1 cell image roll (1.1): dry-run gate, then c8 canary, then batches.
+2. Auth deploy carrying #478 (3.1): quiet minute for the column add.
+3. orca-cloud #477 private IP (2.1): merge arms an instance restart and a one-way door. Recommendation: hold.
+4. Runtime-metric `region` label drift (5.x): intentional replacement of 21 metrics, or drop the label.
+5. Enable pruning (1.2): first budget 20k rows; needs a Terraform apply.
+6. Paging channel for auth alerts (5.2): needs the destination from you.
+
+**Open code follow-ups (no gate, nobody assigned)**
+- Monitor summary Markdown does not render `tolerated: true` continuity events (added by #18798); the state artifact has them, the checkpoint table does not.
+- Relay container boot races the `cloud-sql-proxy` sidecar: c13's fresh container exited twice (`applyPostgresSchema` connection timeout, 2 s each) before the proxy was listening. Make schema apply wait for the proxy or order the containers.
+- `cloud-deploy-relay-production-capacity-job.yml` (~line 416) has the same wave-0 single-shot preflight carve-out that #18778 removes from the same-cap job; its single-evidence path never retries freshness-only failures.
+- `cloud/package.json` `test` names every dev-script test file explicitly; an unregistered `*.test.mjs` is silently never run in CI (found by #18769). Needs a glob or a ratchet that fails on an unlisted test file.
+- Same-cap job's verify step uses bare `curl --fail-with-body` against the just-rolled cell; one 503 at the LB warm-up edge failed c8 canary #2 (run 33935407461) after the transition verifier had already passed. Needs a bounded retry, same rule as #18723/#18740.
+- `verify-mutation` in `cloud-deploy-relay-production.yml`, the multi-target workflow, and the capacity workflow still binds to an exact commit; same exposure #18754 fixed for the same-cap and rehome paths.
+- `incident-live-preflight-cli.ts` reports only `source/code` (`active-probe/threshold_max`) with no signal name or observed value, so a failed mutation preflight (c27 recovery #3, run 33986948522) cannot be attributed to an endpoint without an out-of-band probe. Print the signal and observed/threshold pair. Related: the 2 000 ms `endpointLatencyMs` bar is shared by US and Asia cells while Asia /health round trips from a US runner sit at 0.7–1.3 s idle; consider a per-region bar or the p50 of the gate window instead of one shot. Gates #44 and #45 (2026-09-05) both froze on `cell.production-gce-c27.latency_ms` at 2.6–2.7 s with c28 showing the identical tail under operator probes; the bar is now blocking Asia rolls. **Fix: stablyai/orca #18877** (per-region `cellEndpointLatencyMs`, us-central1 2 000 / asia-east2 4 000, plus signal/observed/threshold in preflight messages). Residual: `probeEndpointHealth` in `resource-inventory.ts` still uses the flat 2 000 bar to decide whether to retry after the 10 s readiness-cache wait, so a healthy Asia cell over 2 s costs one extra probe per sample (latency, not verdict); thread the region bar into the retry decision.
+- The root oxlint config ignores `cloud/**`, so `check:code-quality:changed` never inspects relay-ops or the cloud dev scripts; typecheck + vitest is the only gate there.
+- Monitor bars that froze on non-health today: `directorInstancesMin: 5` with `latest-sum` (one-minute instance recycle), `endpointLatencyMs: 2000` on a US-runner probe to asia-east2, `cloudDataMaxAgeMs: 180000` vs Cloud Monitoring publish lag up to 255 s. Recalibrate with a week of data.
+- `parsed()` in `resource-inventory.ts` still returns null on a 200 with a malformed MIG body; a second path to `runtime_power_unknown`.
+- Deploy script strips `ORCA_CLOUD_REFRESH_TOKEN_TTL_DAYS` on every release (3.1 first item).
+- `assignOnce` placement lock still global (4.1 remainder).
+- Region preference (4.2), retries-bar recalibration after a week of Roll 2 data (4.4), pruner `stopReason` alert (1.5).
+- Full apps-root apply for 4 unrelated drifts (1.4), from a host with the 1Password account.
+
+## Uplift ranking (reliability gained per unit of effort)
+
+| Rank | Item | Why it ranks here |
+|---|---|---|
+| 1 | 1.1 cell image roll | Removes the only crash mode we have seen in production. 22 of 23 cells still have it. One afternoon. |
+| 2 | 3.1 refresh rotation grace window | Turns the entire "slow auth → mass sign-out" class into a slowdown. One day. |
+| 3 | 4.1 inventory lock contention | The floor under every 503 and slow phone accept, every day, not just incidents. One week. |
+| — | 2.2 relay/auth database split | **Deferred 2026-09-04** to ~2026-11-01. Biggest structural fix, but the concrete cause is fixed and alerts now page; see roadmap 2.2 for re-open triggers. |
+| 4 | 1.2 + 1.3 pruning and reclaim | Defuses the 63 M-row time bomb. Low effort, mostly waiting. |
+| 5 | 5.1 + 5.2 crash alert, page a human | Cheapest detection uplift; today's incident ran 4 h unpaged. |
+| 6 | 2.1 private IP | Durable version of a fix that already landed (dynamic NAT ports). Do it on the existing instance. |
+| 7 | 4.3 + 3.2 desktop hardening | Small, ride the normal desktop release. |
+| 8 | 4.2, 4.4, 5.4, 1.4, 1.5 | Housekeeping and quality-of-life. |
+
+## The shared bottleneck: cell rolls
+
+Every change to what runs on a cell (image, proxy flag, env, relay code) needs a same-cap roll: drain →
+recreate → verify, one wave at a time, gated by the 15-minute monitor, about an afternoon. Each wave forces
+the desktops on that cell to re-dial (c7 canary: 807 controls re-dialed in ~10 s) and phones on those
+desktops reconnect on their normal retry. Users see a few seconds of "reconnecting" per wave.
+
+So batch. Two rolls, not five:
+
+- **Roll 1 (now):** current image only (1.1). Do not wait for anything else.
+- **Roll 2 (week 2–3):** proxy `--private-ip` (2.1) + relay pool `statement_timeout` (2.3) + lock-contention
+  fix (4.1), all in one image/template. Prerequisite: 2.1's peering and private IP exist first.
+
+## Lanes (independent; different people can own them)
+
+```
+Lane A  data plane   1.1 roll ──────────────────► Roll 2 (2.1 flag + 2.3 + 4.1) ──► 4.4 recalibrate
+Lane B  auth/DB      1.2 enable pruning ──(10 d)──► 1.3 reclaim      3.1 grace window (any time)
+Lane C  network      2.1 peering + private IP ─────┐ (feeds Roll 2)   (2.2 DB split deferred)
+Lane D  desktop      3.2 no same-token retry, 4.3 lease jitter (any release; wire-compatible)
+Lane E  observability 1.5, 5.1, 5.2, 5.4 (Terraform only, any time)
+Lane F  director     4.2 region preference (Cloud Run deploy, any time)
+Misc                 1.4 full apps-root apply (any time; see its check)
+```
+
+Hard dependencies: Roll 2 waits on 2.1's network work; 1.3 waits on 1.2 finishing. Everything else is
+independent. (2.2 deferred; if revived, do it after 2.1 so the new instance is private from day one.)
+
+## Disruption summary
+
+| Item | User-visible? | What they see | Mitigation |
+|---|---|---|---|
+| 1.1 / Roll 2 | **Yes, transient** | Per wave, desktops on that cell reconnect within seconds; phones follow on retry. | Waves gated by the monitor; run in the US night. Already rehearsed on c7. |
+| 1.2 pruning | No | Background deletes, 5k rows per batch. | Small first budget; watch `stopReason` and Cloud SQL write throughput. Stop the scheduler if checkpoint alerts fire. |
+| 1.3 reclaim | **Depends on tool** | `VACUUM FULL` takes an exclusive lock on `refresh_tokens`: sign-in and refresh block for its duration (minutes to tens of minutes on 16 GB). `pg_repack` holds only brief locks. | Use `pg_repack`. If VACUUM FULL, announce a maintenance window. |
+| 1.4 full apps apply | Should be none, **verify** | Terraform will create a new auth revision (env added). Traffic is pinned to `00031-tox` by name, so the new revision should receive 0 %. | Confirm in the plan that no `traffic` change appears. If it does, stop: the Terraform image variable is not the serving image. |
+| 1.5, 5.x alerts | No | | |
+| 2.1 private IP | **Yes, certain** | Google: "Configuring an existing Cloud SQL instance to use private IP causes the instance to restart, resulting in downtime." No in-place path, HA does not avoid it. Expect 1–2 min DB unavailability: sign-in fails, relay renewals retry. **One-way door**: private IP cannot be disabled and the VPC link cannot be removed once set. The proxy flag change rides Roll 2. | Off-peak; only after Roll 1 (old image dies on a 2 min DB blip). Owner decision required before the foundation apply. |
+| 2.2 DB split (deferred) | **Yes, scheduled** | Relay unavailable for the cutover (drain all cells → copy relay tables → flip `DATABASE_URL` → restart). Minutes if rehearsed. Desktops and phones reconnect automatically after. | Rehearse on staging; do it in the US night; announce. |
+| 2.3 statement timeout | No beyond Roll 2 | | |
+| 3.1 grace window | No | Auth deploys are no-traffic candidate → smoke → promote. | Security trade-off: a stolen token replayed inside the window is served once instead of revoking. 60 s is the usual choice. |
+| 3.2, 4.3 desktop | No | Normal app update. | |
+| 4.1 lock fix | No beyond Roll 2 | | Verify against real Postgres on 55440 with concurrent probes before shipping. |
+| 4.2 region preference | **Minor, Asia users** | Phones that start being placed in Asia reconnect once to a nearer cell. | Roll out behind the existing region-preference flag. |
+| 4.4 | No | | |
+
+## Checklists
+
+### 1.1 Cell image roll (Roll 1)
+- [x] Confirm fleet is quiet: 15-min monitor dry-run passes. #19 green 23:07:53Z (run 33927238469). Canary then failed the evidence provenance check because main moved during the gate; re-gating with a same-commit chain.
+- [x] Confirm director is on 519f4914 and c7 on 85bf6799 (confirmed 2026-09-04 via instance-template census; 20 serving cells still on `5aedbca5`) (`verify` mode of the same-cap workflow).
+- [x] Dispatch `cloud-deploy-relay-production-same-cap` waves per the plan in the findings doc; one wave, verify, next. Done 2026-09-05 01:14Z–22:27Z: c8 canary, US batches c9–c10, c13–c16, c19–c26 at protocol 1, then Asia c27 (recovered via `mode=rollback` re-entry after gate freezes on the flat latency bar, fixed by #18877), c28, c29 as single-cell canaries at protocol 0.
+- [x] After each wave: the transition verifier passed at migration-only and again at general on every cell (assignments carried, heartbeat fresh, hard cap 3 000); no `container die` fleet-wide across the whole roll. The 4408/1006 burst per wave was not measured separately; the verifier's assignment count before and after each restart is the recovery evidence recorded.
+- [x] Record image census in the findings doc. 2026-09-05 22:27Z: all 19 general cells on `519f4914` except c7 on `85bf6799`; existing-only c1–c6, c11, c12 and migration-only c17, c18 untouched on their older images by design. Selector at gen 148.
+
+### 1.2 Enable pruning
+- [x] `auth_token_pruner_image` = digest of `orca-cloud-auth-00031-tox` (`343a0915…`; it contains the entrypoint). orca-cloud #479 merged.
+- [x] `auth_token_pruner_enabled = true`, `auth_token_pruner_max_rows_per_run = 20000` for the first day (orca-cloud #479).
+- [x] Targeted plan asserted 9 create / 0 change / 0 destroy. Applied 2026-09-05 02:06Z.
+- [x] Trigger one run by hand; read the summary event. 02:18Z: `time-budget`, 73 batches, 365k scanned, 1 040 deleted (1 021 revoked, 19 expired), no errors. Scan-bound.
+- [ ] Raise the budget to the default 200k after a clean day; watch Cloud SQL write MB/s and the checkpoint alert.
+- [ ] 1.5: log metric + policy on `stopReason != complete`.
+
+### 1.3 Reclaim
+- [ ] Wait for steady-state runs deleting ~0 rows.
+- [ ] `pg_repack -t refresh_tokens` off-peak (needs the extension; check `pg_available_extensions`). Not `VACUUM FULL` without a window.
+- [ ] Confirm table + index size and `disk/utilization` dropped.
+
+### 1.4 Full apps-root apply
+- [ ] Run from CI or a host with the 1Password account (local plan fails on the Cloudflare data source).
+- [ ] Plan shows exactly the four known drifts and **no traffic change** on `google_cloud_run_v2_service.auth`.
+- [ ] Apply; confirm `status.traffic` still pins `00031-tox` at 100 %.
+
+### 2.1 Private IP (PRs open: orca-cloud #477 foundation, stablyai/orca #18720 relay flag)
+- [ ] **Owner decision**: the foundation apply restarts the instance and is irreversible on Google's side. Merging #477 arms the next foundation apply; hold the merge until the window is chosen.
+- [ ] Director is out of scope: it uses the Cloud Run built-in connector (managed Google path, not the relay VPC NAT), so it consumed none of the exhausted ports; moving it needs Direct VPC egress + a separate DSN secret. Own PR if ever wanted.
+- [ ] Step 7 (`ipv4_enabled=false`) is blocked until humans have IAP/bastion access and the director is moved; it breaks both today.
+- [ ] Allocate a `/24` private services range on the relay VPC; `google_service_networking_connection`.
+- [ ] Add `ip_configuration.private_network` to `google_sql_database_instance.auth` (foundation root). Plan must show update, not replace.
+- [ ] Apply off-peak; expect a possible restart. Watch auth 5xx alert and relay `sqlFailures`.
+- [ ] Cell template: proxy args add `--private-ip` (code merged #18720; flag not set). Director: Direct VPC egress or connector, then the same flag. Both ride Roll 2.
+- [ ] After Roll 2: NAT `port_usage` for relay gateways drops to ~0; then consider `ipv4_enabled = false` (removes the public IP; breaks the local `cloud-sql-proxy --token` workflow unless it also goes private).
+
+### 2.2 Database split (deferred to ~2026-11-01; checklist kept for when it is revived)
+- [ ] New `google_sql_database_instance.relay` (private IP from day one, its own size and flags). Staging first.
+- [ ] Relay schema applies cleanly to an empty instance (it does at startup).
+- [ ] Rehearsal on staging: drain → `pg_dump` relay tables → restore → flip `relay_database_url` secret → restart director + cells → phones/desktops reconnect. Time it.
+- [ ] Production: announce a window; same steps; verify `orca_relay_runtime_metrics` controls recover to pre-cutover count.
+- [ ] Update `production-cloud-sql-app-consumers` budget test and both alert policies' `database_id`.
+
+### 2.3 Relay pool statement timeout (merged stablyai/orca #18722; ships Roll 2)
+- [x] `statement_timeout` on the relay `pg.Pool` (5 s, env-configurable; schema pool untimed; `57014` retryable), below the control-renewal deadline; DDL on an untimed connection (same pattern as auth #476).
+- [x] Postgres test on 55440: a held lock fails the query fast and the bounded retry takes over.
+
+### 3.1 Refresh rotation grace window (orca-cloud #478 merged 2026-09-04; deploy pending owner go)
+- [ ] Fix the deploy-script env strip for `ORCA_CLOUD_REFRESH_TOKEN_TTL_DAYS` (pre-existing; found by #478).
+- [x] `rotateRefreshToken`: if `rotated_at` within 60 s and not revoked, return the existing successor (idempotent), no revoke, no audit.
+- [x] Outside the window or a third presentation: unchanged (revoke + audit).
+- [x] Tests: replay inside window returns same successor; outside revokes; concurrent double-present yields one successor.
+- [x] Deploy via `deploy-auth-production` (candidate → smoke → promote). Deployed 2026-09-04 23:15Z as `orca-cloud-auth-00035-gos`, cap 20 kept, 0 5xx; `successor_material` column present; sealed successors being written. (candidate → smoke → promote).
+
+### 3.2 / 4.3 Desktop (merged stablyai/orca #18719; ships next desktop release)
+- [x] 3.2: on refresh timeout, re-read stored session before retrying; do not re-send a token already rotated locally.
+- [x] 4.3: ±10 % jitter on control lease renewal; unit test on the distribution; wire-compatible (server accepts early renewals already).
+
+### 4.1 Lock contention (partial: stablyai/orca #18722 merged; ships Roll 2)
+- [x] Replace the global `FOR UPDATE` over `relay_cells` with per-cell row locks; counters delta-only. Remaining: `assignOnce` placement lock is still global (optimistic snapshot follow-up). with per-cell row locks or `pg_advisory_xact_lock(cell)`; counters delta-only.
+- [x] Postgres tests on 55440 with concurrent probes (in #18722). Staging load run still owed; `postgres_retries` per hour drops in staging load run.
+- [ ] Ships in Roll 2; then 4.4 recalibrates the retries bar from a week of data.
+
+### 4.2 Region preference
+- [ ] Director: honor requested region when the preferred region has headroom, else sticky. Behind the existing flag.
+- [ ] Measure with `orca_relay_runtime_metrics` region counters before/after.
+
+### 5.x Observability
+- [x] **Relay-root runtime-metric drift**: resolved by dropping the `region` label to match live state (stablyai/orca #18734). Applied 2026-09-04 23:11Z: 8 never-applied `control_*` renewal metrics + the incident dashboard created, 0 destroyed, 21 live metrics untouched.
+- [x] 5.1 `container die` log metric per cell (`relay_cell_process_exit`, applied 2026-09-04 via #18717), > 3 / 15 min, relay channel.
+- [ ] 5.2 Add a paging channel (**needs owner input**: destination) to `auth_alert_notification_channels` for refresh rejections + latency.
+- [x] 5.4 One dashboard (applied 2026-09-04 23:11Z): `orca_relay_cloud_sql_wal_checkpoint`, NAT drops, `orca_auth_refresh_401`, summed `controls`.
diff --git a/cloud/docs/relay-improvement-roadmap-2026-09.md b/cloud/docs/relay-improvement-roadmap-2026-09.md
new file mode 100644
index 00000000000..64f33c69a70
--- /dev/null
+++ b/cloud/docs/relay-improvement-roadmap-2026-09.md
@@ -0,0 +1,67 @@
+# Relay improvement roadmap (written 2026-09-04, after the auth/relay outage)
+
+Owner-facing list of what is left to make the relay more robust, in priority order. Evidence and history
+for every item is in [`relay-reconnect-2026-09-findings.md`](./relay-reconnect-2026-09-findings.md)
+(Findings 1–13). Everything already landed on 2026-09-04 is listed at the end so this file is complete on
+its own.
+
+## 1. Finish what 2026-09-04 started (this week)
+
+| # | Item | Why | How | Size |
+|---|---|---|---|---|
+| 1.1 | **Roll all 23 cells onto the current relay image** | Every cell still runs the image that exits the whole process on a Postgres connect timeout (Finding 6). The fixed image runs only on the director and c7. Any future DB stall repeats the 200-crashes-in-48h pattern. | `cloud-deploy-relay-production-same-cap` waves, gated by the 15-min monitor. Roll inputs and canary results are in the findings doc ("Roll inputs", "Canary blast radius"). | one afternoon |
+| 1.2 | **Enable the refresh_tokens pruning job** (orca-cloud #476, merged, off) | `refresh_tokens` is 63 M rows / 26 GB and grows forever; its size is what turned a slow disk into a sign-out storm (Finding 13). | Build an auth image from main (the 21:04Z deploy already contains the entrypoint: `orca-cloud-auth-00031-tox`, digest `343a0915…`), set `auth_token_pruner_enabled = true` and the image digest in `infra/terraform-apps/environments/production.tfvars`, apply targeted. First run with a small `auth_token_pruner_max_deleted_rows`. Watch the run summary's `stopReason`, not the exit code. ~48 M rows drain in ~10 days at 200k/hour. | 1 hour + 10 days of watching |
+| 1.3 | **Reclaim the disk after pruning** | Deletes leave dead tuples; the 16 GB table does not shrink on its own. | `pg_repack` (or `VACUUM FULL` in a maintenance window; it takes an exclusive lock) on `refresh_tokens` off-peak, after 1.2 finishes. | 1 evening |
+| 1.4 | **Full Terraform apply of the orca-cloud apps root** | The production plan carries four drifts from other merged work: `ORCA_CLOUD_REFRESH_TOKEN_TTL_DAYS` env on the auth service (#476), a skill-share log exclusion filter change, skill pressure threshold 16→8, an artifacts bucket lifecycle rule. Locally it also fails on the 1Password Cloudflare data source. | Run from CI or a machine with the 1Password account; review the four drifts as ordinary changes. | 30 min |
+| 1.5 | **Alert on the pruning job** | A run that only ever times out exits 0 and reads as green. | Log metric on the job's summary event where `stopReason != "complete"`, policy on the relay channel. | 1 hour |
+
+## 2. Remove the shared fate between auth and relay (2.1 and 2.3 this quarter; 2.2 deferred)
+
+| # | Item | Why | How | Size |
+|---|---|---|---|---|
+| 2.1 | **Private IP for Cloud SQL, `--private-ip` on the cell proxies** (do this on the existing shared instance; do not wait for 2.2) | Cells reach the database's public IP through Cloud NAT. Dynamic port allocation (landed) raised the ceiling from 64 to 4096 ports per VM, but the NAT is still in the path and its logs are still the only place port exhaustion shows up (Finding 11). | Add a private IP to `orca-cloud-auth-db` (foundation root, orca-cloud), peer the relay VPC, switch the proxy flag in the cell template, roll. | 1–2 days |
+| 2.2 | **Split the relay database from the auth database** — *DEFERRED 2026-09-04 (owner decision): revisit ~2026-11-01 once pruning is done and there is a month of alert history* | One Cloud SQL instance serves `orca_auth`, `orca_relay`, `orca_push`, `orca_skills`. The auth table's growth stalled the relay for a day (Findings 10, 13). Deferral rationale: the concrete cause is fixed (disk 250 GB, WAL 16 GB, index, pruning), 2.3 + 1.1 turn a future stall into retries, and the checkpoint/disk/headroom alerts now page. Re-open if the checkpoint-loop or connection-headroom alert fires, or a large new auth-side table is planned. | New instance for `orca_relay`; migrate with a short relay drain. Relay state is small so the cutover is minutes. | 1–2 weeks incl. rehearsal on staging |
+| 2.3 | **Statement timeouts on the relay pool** (the auth pool got one in #476) | A relay query stuck behind a checkpoint fsync should fail fast and let the bounded retry take over rather than hold a pool slot for seconds. | `statement_timeout` on the relay `pg.Pool` in `cloud/apps/relay`, tuned under the lease renewal deadline. | half a day |
+
+## 3. Make the desktop refresh path forgiving (next 2 weeks)
+
+| # | Item | Why | How | Size |
+|---|---|---|---|---|
+| 3.1 | **Refresh-token rotation grace window** | The server revokes the whole family the first time a just-rotated token is presented again. On 2026-09-04 that turned a 30 s server slowdown into 21,605 sign-outs. A short window (e.g. 60 s) where the immediately-previous token is still accepted, returning the same new token, is standard practice. | In `apps/auth/src/tokens/refresh-tokens.ts`: accept `rotated_at` within the window, return the successor instead of revoking. Keep true reuse (outside the window, or a third presentation) as revocation. | 1 day incl. tests |
+| 3.2 | **Do not retry `/refresh` with the same token on timeout** | Desktop's 30 s `CLOUD_REQUEST_TIMEOUT_MS` expiring is treated like a network error and retried with a token the server may already have rotated. | In `src/main/orca-profiles/profile-cloud-session-refresh.ts`: on timeout, re-read the stored session first, and prefer a longer single attempt for the refresh call specifically. | half a day |
+| 3.3 | **Un-revoke is impossible; make sign-out recovery obvious instead** | Server-side un-revoke does not help because the desktop deletes its local token on the 401. Landed: desktop notices immediately (#18694) and the phone says "desktop signed out" (#18698). | Nothing more unless we want a re-auth deep link from the phone to the desktop. | — |
+
+## 4. Chronic relay issues already characterised
+
+| # | Item | Why | How | Size |
+|---|---|---|---|---|
+| 4.1 | **Cell-inventory lock contention** (partial: PR #18722 narrowed the remaining non-placement sites; `assignOnce` placement lock is the follow-up) | `postgres_retries` is a global `FOR UPDATE` over the 23-row `relay_cells` table with a 1 s `lock_timeout`; it is the floor under every 503 and every slow phone accept (Findings 2, 5; memory `relay-cell-inventory-lock-contention`). | Per-cell row locks or an advisory lock keyed by cell; move capacity counters to delta writes. Verify against real Postgres on 55440. | 1 week |
+| 4.2 | **Region preference is mostly inert** | Phones request an Asia cell on ~19 % of attempts and get one ~6 % of the time; the sticky lane wins silently, so Asia users ride the US path more than intended (memory `relay-region-preference-mostly-inert`). | Let a region preference override stickiness when the preferred region has headroom; measure with `orca_relay_runtime_metrics` region counters. | 2–3 days |
+| 4.3 | **Desktop lease-rotation waves** | A cell recreate seeds a fleet-wide 1006/4408 reconnect burst ~54 min later, every ~54 min (Finding 3). | Jitter the desktop control lease renewal by ±10 % so the cohort spreads out. | half a day, desktop + wire-compatible |
+| 4.4 | **Raise `postgres_retries` gate calibration** | The 300 bar was recalibrated (PR #18580) but should track the post-lock-fix baseline once 4.1 lands. | Re-derive from a week of `orca_relay_postgres_transaction_retry` counts. | 1 hour |
+
+## 5. Observability still missing
+
+| # | Item | Why | How |
+|---|---|---|---|
+| 5.1 | **Cell crash-rate alert** | 201 process exits in 48 h with no page (Finding 6). | Log metric on `container die` for `resource.type="gce_instance"` relay cells, > 3 per 15 min per cell. In `cloud/infra/terraform/relay-observability.tf`. |
+| 5.2 | **Page a person for auth alerts** | Today's four auth policies (orca-cloud #475) route to the relay Slack channel only. A repeat of 2026-09-04 deserves a page. | Add a PagerDuty/phone notification channel to `auth_alert_notification_channels` for refresh rejections and latency. |
+| 5.3 | **Pruning job alert** | See 1.5. | |
+| 5.4 | **Dashboard that puts the four signals side by side** | Diagnosis took hours because checkpoint state, NAT drops, auth 401 rate, and fleet controls live in four consoles. | One Cloud Monitoring dashboard: `orca_relay_cloud_sql_wal_checkpoint`, NAT `dropped_sent_packets_count`, `orca_auth_refresh_401`, summed `controls`. |
+
+## Landed on 2026-09-04 (for completeness)
+
+- Auth service cap 2 → 20 (service-level manual scaling removed); Cloud SQL disk 49 → 250 GB PD-SSD;
+  `max_wal_size` 16384; partial index `refresh_tokens_family_unrevoked` built concurrently by hand.
+- orca-cloud #474: the above in Terraform + deploy workflow; replayed dead token answers 401 without
+  re-revoking or re-auditing. Deployed as `orca-cloud-auth-00031-tox` 21:04Z.
+- orca-cloud #475: auth alerts (refresh 401 > 100/5 min, 429 > 20/5 min, 5xx > 10/5 min, p99 > 10 s). Applied.
+- orca-cloud #476: batched `refresh_tokens` pruner (disabled), auth pool `statement_timeout` 10 s, schema
+  DDL on an untimed connection.
+- stablyai/orca #18693: both relay NATs on dynamic port allocation 64..4096 (applied US 21:01Z, Asia 21:05Z);
+  alerts for Cloud SQL WAL-checkpoint loop, disk > 70 %, NAT `OUT_OF_RESOURCES` drops. Applied.
+- stablyai/orca #18694: desktop learns of a revoked session immediately, panes re-fetch on mount, pairing
+  notice says "Sign in again to use Orca Relay".
+- stablyai/orca #18698: phone shows "Desktop signed out — sign in to Orca on your desktop to reconnect" via
+  the WebSocket close reason (only additive slot old phones tolerate).
+- Director on image 519f4914; c7 on 85bf6799; other 22 cells still on the old image (see 1.1).
diff --git a/cloud/docs/relay-incident-monitor.md b/cloud/docs/relay-incident-monitor.md
index 870c95dd413..8a8dfda1495 100644
--- a/cloud/docs/relay-incident-monitor.md
+++ b/cloud/docs/relay-incident-monitor.md
@@ -73,6 +73,13 @@ for a committed forward-recovery gate. Durable files default to
 gap resets the active window at the next fresh sample and preserves the prior
 window evidence. A threshold freeze never clears automatically.
 
+A signal that reads missing or stale may miss up to two consecutive samples
+without restarting the window. The sample still counts and is still checked
+against every threshold it can read, and each tolerated gap is recorded in
+`continuityEvents` with `tolerated: true`. A third consecutive miss of the same
+signal, a failed collector, a runner gap, or any threshold breach restarts or
+freezes as before.
+
 A production candidate or multi-target mutation must download the exact
 dry-run artifact by workflow run ID and attempt. It verifies the artifact
 hashes and provenance, requires a green completed 15-minute state no older
@@ -89,7 +96,8 @@ durably marked consumed before mutation and cannot authorize another run.
 | Signal | Freeze condition |
 | --- | ---: |
 | Active probe age | over 60 seconds |
-| Cloud/log data age | over 180 seconds |
+| Cloud Monitoring data age | over 330 seconds |
+| Relay log and director admin data age | over 180 seconds |
 | Cell heartbeat age | over 45 seconds |
 | Endpoint latency | over 2,000 ms |
 | Cloud SQL CPU | over 80% |
@@ -155,6 +163,25 @@ heartbeats, and matching live admission.
   separate it from today's baseline; the exhausted-retry bar (incident peak
   467 vs bar 300), director concurrency, and the pool bars carry that role.
   Re-tighten after the fleet is on the 500 ms lock wait.
+- Raised the Cloud Monitoring freshness bar from 180 s to 330 s and let a
+  freshness-only failure miss up to two consecutive samples without restarting
+  the window (2026-09-05). Basis: Google's metric list documents Cloud Run
+  `request_count`, `container/instance_count`, `container/cpu/utilizations`,
+  `container/memory/utilizations` and `container/max_request_concurrencies` as
+  "Sampled every 60 seconds. After sampling, data is not visible for up to 120
+  seconds", and Cloud SQL `database/cpu/utilization`,
+  `database/memory/utilization`, `database/postgresql/num_backends`,
+  `database/postgresql/backends_in_wait` and `database/postgresql/deadlock_count`
+  as "up to 165 seconds", so the newest visible point is up to 180 s and 225 s
+  old respectively. Window-sum signals age further: `observedAt` is the newest
+  point in the 5-minute query window, so a label series that stops emitting
+  reads as 300 s old while its summed value is complete. The old bar sat under
+  all three. Production on 2026-09-04/05 restarted healthy 15-minute windows at
+  181 s and 255 s (`auth.errors`, run 33928912676) and at 189 s
+  (`cloud_sql.lock_waits`, run 33944873727), and the last of those then blew the
+  25-minute lineage cap at 1 500 004 ms, so a green fleet produced no verdict.
+  The director admin bar stays at 180 s and the nonzero lock-wait carry window
+  stays at 180 s; both publish on our own cadence.
 - Recalibrated the exhausted-PostgreSQL-retry freeze from 0 to 300 per five
   minutes (2026-09-04). Basis: #18521 cut the request-path cell-inventory
   lock wait from the 1 s pool `lock_timeout` to 500 ms, so contended waiters
diff --git a/cloud/docs/relay-reconnect-2026-09-findings.md b/cloud/docs/relay-reconnect-2026-09-findings.md
new file mode 100644
index 00000000000..580a4da84d8
--- /dev/null
+++ b/cloud/docs/relay-reconnect-2026-09-findings.md
@@ -0,0 +1,1002 @@
+# Relay reconnect investigation: findings and evidence
+
+Working notes for the 2026-09-04 mobile relay reconnect incident and the cell roll that follows.
+Kept current across context compactions. Newest section first. All times UTC. Host ids are log digests,
+never raw ids. Nothing here is a production mutation record unless the "Mutations" section says so.
+
+## Status board
+
+| Item | State | Where |
+|---|---|---|
+| PR #18565 relay accept abandonment + lease jitter + desktop rotation spread + phone probe fail-fast | Open, CI fully green again after the doc move (05:45Z), CodeRabbit + Pullfrog cleared, 3 review rounds; not merged (owner has not asked) | https://github.com/stablyai/orca/pull/18565 |
+| PR #18569 monitor `relayPostgresRetryExhausted` 0 -> 300 | **Merged** 2026-09-04 ~04:20Z as 4101505b6b | https://github.com/stablyai/orca/pull/18569 |
+| Same-cap `verify` of c7 (read-only) | **Passed** run 33836527159 | confirms identities, selector gen 110, rehome gen 12, protocol 1, digests |
+| Monitor dry-run #1 | Froze min 5: `relay.postgres_retries` 380 > 300 | run 33836470590 |
+| Monitor dry-run #2 | Green to min 13, froze 04:49Z: `director.concurrency` 76.7 > 64 (six-cell crash storm, Finding 6) | run 33837160275 |
+| Monitor dry-run #3 | Froze min 3 at 05:01Z: `relay.postgres_retries` 339 > 300; no crash, concurrency 5–8 | run 33838698725 |
+| Owner decision 2026-09-04 ~05:10Z | **Option B approved**: "you can raise the bar. or remove it altogether ... whats the most logical move". Kept the bar (removal would leave contention unwatched during the roll) and recalibrated from measured data. | this thread |
+| PR #18580 monitor `relayPostgresRetries` 300 -> 2000 | Open, awaiting CI; mutation-checked (300 fails the new test) | https://github.com/stablyai/orca/pull/18580 |
+| PR #18565 CI | Was red on `root directory guard` because this findings file sat at repo root; moved to `cloud/docs/` in 8ebff89106 | |
+| PR #18580 | **Merged** 2026-09-04 05:23Z as 79d5fb469a (Pullfrog cancelled by the merge; independent Opus review requested instead, per owner) | |
+| Monitor dry-run #4 | Froze min 12 at 05:37:35Z: `cell.production-gce-c27.health`/`.ready` = 0. Retries green all 12 samples under the new 2000 bar. Cause: c27 (asia-east2) container died 3x 05:37:00–05:38:01Z, Finding 6 crash class. | run 33840364323 |
+| Monitor dry-run #5 | Froze at sample 1 (05:41Z): c27 health/ready still 0. MIG autoheal `recreateInstance` on c27 fired 05:38:12Z after the 3 crashes; instance RECREATING, process up with 0 controls (was ~395). Second c27 recreate in 7 h (Finding 3 seed pattern). Waiting for c27 to settle before dry-run #6. | run 33841327879 |
+| Monitor dry-run #6 | **Passed** 06:06:31Z: 16 samples, no freeze (started 05:47:42Z) | run 33841783747 attempt 1 |
+| c7 `canary-apply` | **Succeeded.** Dispatched 06:07:15Z; drain 06:10Z; MIG recreate 06:16–06:23Z; new image listening 06:23:42Z; verify + trust proof passed; restored to `admission=general` 06:25:21Z; canary authority sealed. c7 is on `85bf6799…`. | run 33843071283 |
+| PR #18581 doc reconcile (Aug 23 figure: 2,200–3,000 raw log lines vs 1,510 on the gate metric) | **Merged** | https://github.com/stablyai/orca/pull/18581 |
+| Same-cap `verify` c7 target=519f4914 rollback=85bf6799, gen 112 | **Passed** (read-only) | run 33856355648 |
+| Monitor dry-run #7 (gen 112) | Froze at sample 1 (09:05:31Z): `director.errors` 4 > 0, the four 2.0 s pg-connect 500s from the 09:00 cascade still inside the 5-min delta window. Dispatched 4 min too early. | run 33856521278 |
+| Monitor dry-run #8 (gen 112) | Green for 15 of 16 samples (09:09:38–09:24), froze on the final sample 09:25:22Z: `director.errors` 1 > 0. The one 500 was `/v1/admin/evacuation-status` at 09:23:50Z, 2.01 s latency = director pg-connect timeout, called by **the monitor's own collector** (`incident-monitor-sources.ts:492`). First evacuation-status 500 since Sep 1. The gate froze on a request it made itself. | run 33856905229 |
+| Monitor dry-run #9 (gen 112) | Froze: c13/c23 crashed 50 s after dispatch, then c14/c20/c9 at 09:34. | run 33858650691 |
+| Monitor dry-run #10 | Dispatched 09:46:13Z; froze at sample 5 (09:56:59Z): `director.errors` 12. All twelve at 09:55:17–21Z, 0.8–2.1 s latency, 10 on `/v1/regions` + 2 on `/v1/assign`; c16 and c8 crashed at 09:55:19 in the same second. A single 4-second Postgres connect stall hit director and cells together. | run 33859947207 |
+| Monitor dry-run #11 | Froze at sample 2 (10:08:07Z): `director.concurrency` 79.8 > 64, the c8/c20 re-dial. They crashed 10:05:54, 3 s before the waiter's quiet check passed (log ingestion lag). | run 33861578009 |
+| Monitor dry-run #12 | Dispatched 10:17:38Z after 10 quiet min; froze at sample 2 (10:19:24Z): `cell.production-gce-c16.health` 0. c16 did **not** crash (no container die, MIG NONE/HEALTHY, readiness=true throughout, `/health` 200 in 230 ms at 10:21). At 10:19:07–16 it logged "control activity renewal failed" x4 and a burst of 1006 closes, sqlFailures 1 -> 14, sqlLatencyMsMax 2588: a pg stall on the old image that did not reach the unhandled path. The probe's single fetch (30 s timeout) came back unavailable during that stall and `unavailableIsZero` turned it into health=0. | run 33862504601 |
+| Monitor dry-run #13 | Green 14 of 16 samples (10:48:38–11:03), froze 11:04:43Z: c9 crashed 11:04:23, c28 11:04:25 (then looped 11:05:04, 11:05:41); c15 probe also read 0 (stall, no crash). Missed by ~90 s. **Dispatched by hand 10:48:15Z** into a 43-min crash lull (last die 10:05:54; last director 500 10:31:49). The re-armed waiter never fired: its MIG-stable check used `grep -vc True`, which exits 1 when nothing matches, so `&&` short-circuited on the *healthy* case. Waiter armed 10:20Z: 10-min quiet + every MIG stable + 60 s recheck, then dispatch, then canary c7 on green. Held at 10:24 and 10:31 by lone director `/v1/assign` 500s (2 s pg-connect stalls, no cell crash). Director 500 events since 08:46: 6 (gaps 2.7/21/31/29/7.6 min). At 10:39 the waiter was re-armed with a 6-min director-500 window (the monitor's own delta is 5 min) instead of 10, since the gate only needs the 15 min *after* dispatch to be clean. Cell crashes have stopped since 10:05 (33+ min, longest gap since 08:40). 12 dry-runs: 1 pass (#6), 11 freezes, none on a real fleet-health regression. | Cascade gaps since 09:00: 31, 2.9, 5.1, 16.1, 4.0 min (median 5); a 15-min clean window is ~28% per attempt at this rate. | |
+| Monitor dry-run #14 | Dispatched 11:26:53Z by the fixed waiter (first autonomous dispatch); c14, c23, c25, c15, c24, c19 died 11:30:59–11:31:08 (six cells, 13 min after the last cascade). Froze on c8 (and others) health/ready probes. Waiter re-armed 11:06Z (grep bug fixed: `grep -c` under `|| true`), same chain; held through the 11:17 cascade and c14/c28 recreates. 13 dry-runs: 1 pass, 12 freezes. Since 08:40: 10 cascades, 75 container dies, gaps 20/31/3/5/16/4/6.5/58/13 min; only 3 windows of >=17 clean minutes existed in 2.6 h, and dry-runs hit two of them (#6 passed, #13 lost the third by 90 s). |
+| Monitor dry-run #15 | Waiter armed 11:33Z (6-min director-500 window, 8-min crash window, all MIGs stable), chained canary; still holding at 12:04Z. Since 11:00: 8 cascades, 98 dies, gaps 13/13.6/3.6/14.5/4.4/6.1/3.0 min, **max gap 14.5 min**, so no 15-min clean window has existed in the last hour. 14 dry-runs: 1 pass, 13 freezes. |
+| Monitor dry-run #15 verdict | Dispatched 12:28:49Z; froze at sample 2 (12:30:41Z): **12 cells** health/ready = 0 at once (c4, c5, c7, c10, c15, c16, c18, c20, c22, c25, c27, c28), including c4/c5 (0 controls all day, `/health` 200 in 190 ms a minute later) and c7 (new image). Six old-image cells also crashed 12:30:02–21. This was a fleet-wide SQL stall, not a cascade: every cell's `sqlLatencyMsMax` hit 4–6 s (c7 4865, director 5140), director pool waiting 1258, 15 cell pg-connect timeouts, director sqlFailures 92. Cloud SQL CPU 0.73, backends 160, new connections normal, memory 0.46, so the *instance* was not saturated; something held the database for ~5 s. Postgres log 12:31:23–28 shows a burst of `could not obtain lock on row in relation "relay_cells"` from NOWAIT (single-row and full-inventory) sweeps, i.e. the row locks were held during recovery. Cloud SQL transactions/min flat (~30k), reads flat,
+network flat: the database was neither busy nor saturated, it was *waiting*. The stall bracket
+(12:30:02–12:30:41) is where every cell's SQL max hit 4–6 s at once. Lock retries in that window were
+ordinary (49/29/13 per min). Best reading: a ~5 s Postgres-side wait event shared by every session
+(lock on a hot row held across a long transaction, or an instance-level pause), not CPU/IO. Cell
+`sqlLatencyMsMax` was already 1.5–2.2 s fleet-wide in the four minutes before, i.e. the old cells' 1 s
+`lock_timeout` plus queueing. | run 33872946111 |
+| Monitor dry-run #16 | Dispatched 12:38:57Z; froze at sample 1 (12:40:11Z): `cell.production-gce-c27.latency_ms` 2071 > 2000, a fifth distinct freeze signal, the probe's own round-trip absorbing a checkpoint sync. **Loop stopped by me at 12:41Z**: with the disk in the checkpoint loop (Finding 10) no bar can hold for 15 min, so further dry-runs only burn the shared rollout lease. 16 dry-runs: 1 pass, 15 freezes. Re-arm after the disk change lands. |
+| Cloud SQL checkpoint loop | **Broke on its own 12:39–12:45Z**: disk writes 48 -> 4 MB/s at 12:39 with transactions and network flat and no Cloud SQL operation; 12:40:17 checkpoint synced 0.047 s; 12:45:53 checkpoint was `time`-triggered again (first since 11:55) with sync 0.096 s and write spread over 269 s. Cause of the break unknown (most likely WAL fell back under `max_wal_size` once a burst of full-page writes aged out). It can re-enter the loop on the next large checkpoint; the disk-size fix remains the durable one. |
+| Monitor dry-run #17 | Dispatched ~12:49Z (all guards clean); froze at sample 1 (12:52:05Z): `director.errors` 4, from the c9/c22 crash loop that began 12:50:34, ~90 s after dispatch. Checkpoints stayed healthy (85 ms), so this is the old image's baseline crash rate, not the disk. 17 dry-runs: 1 pass, 16 freezes. |
+| Monitor dry-run #18 | **Dispatched by mistake 13:48:56Z into the outage**: my gcloud credentials expired ~13:45Z, every guard query returned empty, and the waiter's `grep -c . || true` read empty as "quiet". Froze at sample 1 (13:49:43Z) on `director.ready=0`, `auth.health=0`, and cell probes; no canary dispatched, no production mutation. All waiter loops killed at 13:51Z. Lesson: a quiet-window check must fail closed when its data source errors. Waiter had been re-armed 12:53Z. |
+| Gate decision | Owner asked at 09:36Z to choose: A keep looping / B recalibrate `directorErrors` 0 -> small n / C human bypass. Ten dry-runs, four froze on this bar. Recommendation B+A. Note: B alone would not have passed #9 or #10 (cell health probes and a 12-error burst); it fixes the single-500 false freezes (#7, #8) only. | |
+| Batch roll | **Deferred by plan**: roll once with the lock-fix image instead of twice. | |
+| PR #18606 lock removal (root cause) | **Merged** 09:2xZ as 7b108abf71 after review, fix, re-verify; CI green | https://github.com/stablyai/orca/pull/18606 |
+| Image publish for 7b108abf71 | **Done** 08:36:49Z run 33854111305: `sha256:519f4914217f08cabcdcd34825965db8473ec37c6591553a3af0d65dcdeeb183` | |
+| Director deploy on 519f4914 | **Succeeded** 08:45Z run 33854355791; serving `orca-cloud-relay-00570-siv`, rollback tag on 00569-ret (also 519f4914), 00565-fes (85bf6799) still deployable. Dispatched 08:37:45Z (blue/green; prior revision 00565-fes on 85bf6799 kept as rollback). Note: `predecessor-image-digest` is a required input even with bootstrap=false; pass the serving digest. | `cloud-deploy-relay-production-director.yml` |
+| c7 on new image, 2 h in | 817 controls, **0 container die** since restore (was ~1 per 15 min on old image); `sqlLatencyMsMax` still 1.0 s = lock wait unchanged, which #18606 targets | |
+| Terraform alert `relay_postgres_retry_exhausted` at `> 0` | Firing continuously since #18521; recalibration not done (own change) | `cloud/infra/terraform/relay-observability.tf:447,469` |
+
+## Mutations performed (complete list)
+
+1. Merged PR #18569 to main (code/docs only).
+2. Merged PR #18580 and #18581 to main (monitor bar + docs).
+2b. Merged PR #18606 to main (relay lock change; no serving effect until the image is deployed).
+2c. Dispatched `cloud-publish-relay-production` for 7b108abf71 (builds and pushes an image; changes nothing serving). Done: 519f4914.
+2d. Dispatched `cloud-deploy-relay-production-director` on 519f4914 (preserve placement, no prune, rehome gen 12). Succeeded 08:45Z; serving revision 00570-siv. Rollback: `gcloud run services update-traffic orca-cloud-relay --region us-central1 --to-revisions orca-cloud-relay-00565-fes=100` (85bf6799, still Ready). Not needed so far.
+3. 2026-09-04 06:07:15Z: dispatched `cloud-deploy-relay-production-same-cap` `canary-apply` for production-gce-c7 only (run 33843071283). Completed successfully 06:26Z: c7 isolated, drained (807 controls re-dialed), template + MIG rolled to 85bf6799, verified, restored to general admission. Selector generation advanced 110 -> 112 (isolate + restore).
+4. Nothing else. Both monitor dispatches were `mode=dry-run` (read-only). The same-cap dispatch was `mode=verify` (read-only, confirmed by step gates `if: inputs.mode != 'verify'` on every mutating step).
+
+## Finding 6 (2026-09-04 ~05:00Z): the old cell image crashes the whole process on a Postgres connect timeout
+
+**This is the most important open finding.** The 23 GCE cells run image `sha256:5aedbca5…` = orca-cloud
+commit e3e92d95d3 (2026-08-14). In that build `beginProof` is called as `void this.beginProof(...)`.
+When `verifyCellAssignment` inside it throws (pg-pool `timeout exceeded when trying to connect`, 2 s
+`connectionTimeoutMillis`), the rejection is unhandled and Node exits 1. Docker restarts the container
+in ~1 s, but every control on that cell (~800 hosts) drops and re-dials `/v1/assign` at once.
+
+Evidence, cell c7 instance 4545742188814054238, 2026-09-04:
+
+```
+04:46:47.951 stderr [orca-relay] control activity renewal failed   (x5)
+04:46:49.527 stderr Error: timeout exceeded when trying to connect
+             at pg-pool/index.js:45:11
+             at async PostgresPoolPressure.connect (postgres-pool-pressure.js:30:20)
+             at async PostgresDatabase.query (database.js:645:24)
+             at async RelayAssignmentStore.verifyCellAssignment (assignment-store.js:2024:22)
+             at async HostSessionRegistry.beginProof (host-session-registry.js:376:15)
+04:46:49.527 stderr Node.js v24.19.0
+04:46:49.835 dockerd: container die … exitCode=1 image=…relay@sha256:5aed…
+04:46:50.258 dockerd: container start
+04:46:52.761 stdout [orca-relay] listening on https://c7.relay.onorca.dev
+```
+
+2026-09-04 05:36:59–05:38:01Z: c27 died 3x in 62 s plus one other instance (5464389947731541178); this froze dry-run #4 on c27's health probe.
+
+Fleet-wide `container die … exitCode=1` on the relay image, last 48 h: **201 events on 19 instances**
+(c28 x38, c29 x37, c27 x19). Hourly counts track the lock-contention curve (peak 23/h at 21Z Sep 3).
+Every one has the same `Node.js v24…` crash banner. On 2026-09-04 04:46:35–04:47:41Z six cells
+(c7, c8, c19, c21, c22, c25) died within 66 s: ~4,800 hosts re-dialed, `/v1/assign` returned 16,321
+503s in one minute (baseline ~20), director concurrency hit 85 (Cloud Run cap 80), Cloud SQL
+`new_connection_count` 119 -> 287/min. Fleet recovered by 04:51Z. That is what froze dry-run #2.
+
+Fix status: `guardSessionTask` wrapping `beginProof` landed in orca-cloud #436 (2026-08-27) and is in
+the target image `sha256:85bf6799…` (main 11aace8dec). The roll is the fix. Not caused by anything in
+this session: the same-cap verify finished ~04:25Z and never reached a mutating step; no compute
+operations exist for those instances; heap/event-loop were flat before the crash.
+
+Autoheal amplifier: MIG health check is `/health` every 10 s, timeout 5 s, unhealthy after 3, so a
+crash loop of ~30 s+ triggers `compute.instances.repair.recreateInstance`. All ~20 recreates in the
+48 h to 2026-09-04 05:40Z were the three Asia cells (c27 x6, c28 x7, c29 x8; gcloud prints local
+-07:00 times). c27 recreated 05:38:12Z after 3 crashes in 62 s; its ~395 controls went to 0 and the
+monitor's `cell.production-gce-c27.health/ready` probe read 0 for the whole recreate (~several min),
+freezing dry-runs #4 and #5. Each recreate also seeds a Finding 3 rotation cohort. Rolling the Asia
+cells early in the batch phase should be weighed against the canary-first rule; c7 stays the canary.
+
+Implication for the gate: the monitor's `director.concurrency` freeze is *correctly* detecting these
+crash storms. A dry-run only passes in a 15-minute window with no cell crash, roughly 1 in 3 windows
+at current rates. Retrying in quiet hours is legitimate; the bar is not wrong.
+
+## Finding 5: `relay.postgres_retries` at 300 is 3x under today's baseline
+
+Retries per 5 min, cells + director, last 24 h: p50 579, p90 1039, p99 1398, max 1505; **65% of
+windows over 300**. Quiet hours (03–08Z) p50 235, max 512. When the 300 bar was set (2026-08-26)
+healthy bursts reached 234. Baseline has roughly tripled in 10 days. Skill notes say do not raise this
+bar; I have not. Best odds for a clean 15 min are 02–04Z and 17–18Z (9/12 five-minute windows under
+300 in each).
+
+## Finding 4: exhausted-retry bar was the wrong single blocker (fixed)
+
+`relayPostgresRetryExhausted: 0` never cleared after #18521 reached the director (22:12Z Sep 3): 236/236
+five-minute windows non-zero; post-#18521 p50 42 / p90 147 / max 220; Aug 23 incident peak 467.
+Recalibrated to 300 in #18569 (merged). Dry-run #1 immediately revealed Finding 5 behind it.
+
+## Finding 3: the 00:50Z control-close wave was desktop lease rotation, not a rollout
+
+2026-09-04 00:49–00:51Z: 2,745 control closes on 19 instances; 1157/1632 code 1006 and 973/1030 code
+4408 `control rebound` had ageMs in the 53-minute bin. Relay grants a flat 55 min lease; desktops
+rebind 60–120 s early; so every host that (re)connected in the same minute rebinds as one cohort
+forever. Seed: c27 MIG autoheal recreate 23:23Z (`compute.instances.repair.recreateInstance`) dumped
+~420 controls. Harmonics at 23:55, 00:04, 00:25, 00:49Z. Each rebind is an `activateControl`
+transaction that can take the inventory lock. Fix in #18565: relay lease 55 min ± 5 min (symmetric,
+so mean rebind rate unchanged), desktop early window 1–6 min.
+
+## Finding 2: fleet-wide lock contention, worse on Sep 3
+
+| window | 55P03 retries/h (cells) | cell sqlFailures/h |
+|---|---|---|
+| Sep 2 18Z – Sep 3 07Z | 660–1470 | 680–1620 |
+| Sep 3 08Z–16Z | 3600–7100 | 3700–7700 |
+| Sep 3 23Z | 7468 | 7585 |
+
+100% of sampled retries are 55P03; director phase is `cell-inventory`. Every cell pins
+`sqlLatencyMsMax` at 1.0–1.2 s = the pre-#18521 1 s pool `lock_timeout`. Not load (controls flat
+~26k, Cloud SQL CPU 46–53%). No `cloud-*` workflow explains the 08Z step. The lock is a global
+`SELECT * FROM relay_cells FOR UPDATE` (23 rows) taken by assignment, control activation, activity
+acquire, and sweeps, held to COMMIT.
+
+## Finding 1: root cause of the phone's 24 s hang (the original symptom)
+
+`acceptClient` runs four serialized Postgres calls; the fourth (`acquireActivity`) contends for the
+global lock. Under contention the cell finishes after the phone's 12 s bound, then
+`PendingHostDataReservation.bind` throws `host_data_reservation_already_bound` because the phone's
+close already released the reservation. Every "first frame handler failed already_bound" line is that
+post-mortem (31 events 23:06–01:01Z across 12 instances). Fix in #18565: abandon the accept after each
+DB step once the socket is closed; new event `orca_relay_client_accept_abandoned {stage, elapsedMs}`
+and metric fields `clientAcceptsAbandonedByStageDelta` / `clientAcceptAbandonedMsMax`. Phone side:
+direct probe now fails fast on `reconnecting` so relay recovery is not queued behind three doomed
+LAN redials (~3.5 s saved per foreground). #18518 (merged, not yet on the phone) covers the
+stage-aware dial bound.
+
+Host 666077865f2e: stable throughout. 4408 rotation 00:27:45Z; 1006 quit 00:52:24Z on old adhoc;
+sticky reassignment to c27 00:52:35Z on new build; rotation closes 01:44:55Z and 02:23:15Z with
+splices intact. No drain/4404/wrong-cell.
+
+## Finding 7 (2026-09-04 ~05:10Z): retries bar recalibration basis (PR #18580)
+
+Chose 2000 over removal. The metric is the gate's own source (`orca_relay_postgres_retries`
+log metric, director + cells summed per five minutes, ALIGN_DELTA 300 s):
+
+| window | p50 | p90 | p99 | max | > 300 |
+|---|---|---|---|---|---|
+| 2026-09-01 | 56 | 105 | 206 | 456 | 0% |
+| 2026-09-02 | 109 | 186 | 294 | 377 | 1% |
+| 2026-09-03 | 430 | 924 | 1320 | 1504 | 55% |
+| 2026-09-04 to 05Z | 285 | 1012 | 1211 | 1211 | 44% |
+
+15-minute pass rate, last 24 h: bar 300 -> 22%, 800 -> 66%, 1000 -> 86%, 1500 -> 99%, 2000 -> 100%.
+Aug 23 incident on this metric: 1510 then 646 (single windows), so retries no longer separate an
+incident from baseline; exhausted (467 vs bar 300; healthy 72 h max 184), director concurrency,
+and pool bars carry that role. Note: my earlier "p99 1398 / 65% over 300" in Finding 5 came from
+raw log line counts; the metric-based numbers above are what the gate actually evaluates.
+Baseline tripled between Sep 2 and Sep 3 with no deploy; still unexplained (Finding 2).
+
+## Decision needed from the owner (resolved: B)
+
+The same-cap roll is blocked only by the monitor gate, and the gate is blocked by `relayPostgresRetries: 300`
+(Finding 5: 65% of windows breach it; even the 04:55Z quiet window hit 339). Three options:
+
+- A. Keep waiting for a naturally quiet 15 min. Odds per attempt ~1 in 3 in quiet hours, lower by day.
+  Each attempt is free and read-only. Could take hours.
+- B. Recalibrate `relayPostgresRetries` from measured data, same method as #18569: 24 h p99 is 1398, the
+  Aug 23 incident ran 2200–3000, so ~1500 clears healthy windows with ~1.5–2x incident separation
+  (less margin than the exhausted bar had). Overrides the "do not raise" note in the skill facts.
+  Argument for: the roll being gated is the thing that reduces retries. Argument against: the bar is
+  doing its job of saying contention is high.
+- C. A human dispatches the roll with a different gate policy. Not something I can or should do.
+
+My recommendation: B, with the number chosen from the table in Finding 5 and the roll following
+immediately so the bar can be re-tightened after the fleet is on the 500 ms lock wait.
+
+## Finding 12 (2026-09-04 13:12Z): **INCIDENT IN PROGRESS. The auth service is at its 2-instance cap and rejecting 90% of desktop token calls with 429; the relay fleet has emptied.**
+
+Timeline: 13:04–13:06 the old-image cascades and NAT stalls drove ~1,400 desktops to re-dial. Their relay
+JWTs (5-min TTL) expired mid-storm, so they hit `orca-cloud-auth` `/v1/desktop/auth/refresh` and
+`/v1/desktop/auth/relay-token` together. The auth service is Cloud Run `maxScale=2`, `concurrency=80`,
+1 vCPU throttled (`auth_max_instances = 2` in orca-cloud `infra/terraform-apps/environments/production.tfvars`,
+applied by `deploy-auth-production.yml`). Both instances pinned at concurrency 85 from 13:02; from 13:07
+Cloud Run's front door returns **429 "no available instance"** (0 s latency, never reaches the container):
+12,045 at 13:07, 54,292 at 13:08, 46,025 at 13:08, 42,529 at 13:09. Sep 3 total auth 429s: **0**.
+Without a fresh relay token every desktop's `/v1/assign` gets 401 (1,433 distinct hosts 401'd, 0 got 200
+since 13:07) and every cell closes its control with `4401 relay authorization expired`. Fleet controls:
+13,375 (12:55) -> 7,633 (13:08) -> **249 (13:12)**, splices 1. Auth container CPU 0.15–0.5, so the cap is
+the limit, not the code. Every desktop is now in its refresh-retry loop hammering the same 2 instances:
+this is a self-sustaining thundering herd and will not clear on its own. At 13:14Z: fleet **30 controls**
+across 23 cells; successful relay-token issuance 5,000–6,500/min until 13:05, then 1,059 / 734 / 733 /
+443 / 220 / 214 / 148 / **4** per minute through 13:13; auth 429s 54k -> 25k/min only because desktops
+are backing off, not because the service recovered. Note `AUTH_MAX_INSTANCES: 2` is also hardcoded in
+orca-cloud `.github/workflows/deploy-auth-production.yml` (lines 33–34), so a redeploy would re-pin it;
+change both the workflow env and the tfvars.
+
+**Immediate mitigation (owner action, not applied):** raise the auth service's max instances. Fastest:
+`gcloud run services update orca-cloud-auth --region us-central1 --max-instances 20` (or `10`, matching
+the other apps' `max_instances = 10`), then land the same in `auth_max_instances` so Terraform does not
+revert it. Auth is stateless behind Cloud SQL (`refresh_tokens` table); backends 210 of 400, so 20
+instances x a small pool is within budget. Also consider the desktop's refresh backoff: it re-dials on
+401 immediately with no jitter, so a 429 storm sustains itself.
+
+**13:51Z status: my gcloud session lost auth at ~13:45Z; all production monitoring from this session is
+blind until re-authenticated (`gcloud auth login`, interactive). Last confirmed state 13:40Z: fleet 0
+controls, auth maxScale 2, 7,600 auth 429/min. All autonomous dispatch loops are stopped.**
+
+**17:19Z–17:21Z MITIGATION APPLIED (owner said "fix it NOW").** State at 17:19Z, four hours in: all 23
+cells at 0 controls, auth 429 ~2,000/min, auth 2xx ~40/min, and the 2xx that got through took 13–28 s
+(both instances saturated). Mutation 1: `gcloud run services update orca-cloud-auth --max-instances 20`
+created revision `orca-cloud-auth-00018-4jc` (same image `auth@sha256:1710ff6c`, same env/concurrency,
+only maxScale 2 -> 20) but the service pins traffic to `00023-qud` **by revision name**, so the new revision
+was immediately `Retired` and nothing changed. Mutation 2 (17:21:30Z): `gcloud run services update-traffic
+--to-revisions orca-cloud-auth-00018-4jc=100`. Lesson: the auth service's traffic block is name-pinned
+(the deploy workflow does an explicit traffic switch), so a bare `services update` never reaches users.
+Terraform still says `auth_max_instances = 2`; the next `deploy-auth-production.yml` run will revert this
+unless the tfvars and the workflow's `AUTH_MAX_INSTANCES` are changed first.
+
+## Finding 13 (2026-09-04 17:19Z–18:10Z): **the auth outage is a database problem, not (only) a Cloud Run cap; `refresh_tokens` has 63 M rows and reuse-revokes scan whole families**
+
+Mutations this window (all online, no restarts, all by hand in project onorca-cloud):
+1. 17:19Z `gcloud run services update orca-cloud-auth --max-instances 20` → new revision `00018-4jc`, but traffic is
+   pinned by revision name so it was `Retired`; 17:21:30Z `update-traffic --to-revisions 00018-4jc=100`.
+2. Still 2 instances at 17:31Z: the SERVICE has its own `scaling.maxInstanceCount=2` in **manual scaling mode**
+   (`run.googleapis.com/maxScale: '2'` on service metadata, set by Terraform `infra/terraform-apps/auth.tf`), which
+   overrides the revision cap. `--scaling=auto` then `--max 20` at 17:31:45Z. Instances 2→20 by 17:38Z; 429s fell
+   6,000/2 min → 60/2 min at 17:36Z and controls briefly reached 11.
+3. Then latency, not capacity, became the wall: every refresh took 100+ s inside Postgres (desktop client timeout
+   is 30 s, `CLOUD_REQUEST_TIMEOUT_MS`), so 20 instances × 80 concurrency filled again with requests nobody was
+   waiting for, and 429s returned (~1,500/2 min from 17:40Z).
+4. 17:27Z Cloud SQL disk 62 GB → 250 GB (IOPS ceiling 1,470 → ~7,500). 18:00Z `max_wal_size` 1.5 GB → 16 GB
+   (the checkpoint loop: `checkpoint starting: wal` every 45–60 s since 13:06Z).
+5. 18:07Z `CREATE INDEX CONCURRENTLY refresh_tokens_family_unrevoked ON refresh_tokens(family_id) WHERE
+   revoked_at IS NULL` (an earlier attempt with `AND rotated_at IS NULL` was wrong for the revoke predicate; its
+   invalid remnant `refresh_tokens_family_live` was dropped).
+
+Evidence: `refresh_tokens` = 63.3 M live tuples, 16 GB table + 10 GB indexes; every refresh inserts a row and
+nothing ever deletes (30-day TTL rows are never pruned). Query Insights 17:33–17:39Z: `UPDATE refresh_tokens SET
+revoked_at = $1 WHERE family_id = $2 AND revoked_at IS NULL` = 21,000 s of execution per 6 min, ~90–120 k rows
+updated per minute; io_time 15,000 s read; pg_stat_activity 180+ backends in `IO/DataFileRead` on that statement,
+200 backends total for orca_auth (20 instances × pool max 10). `session-refresh-reuse-detected` audit events per
+hour: ~100 all day → 8,805 (13Z), 15,511, 19,486, 24,897, 26,935 (17Z). Mechanism: a desktop's refresh times out
+client-side at 30 s, the server had already rotated the token, the desktop retries with the same token, the
+server calls that reuse and revokes the family (Bitmap scan on `refresh_tokens_family` + heap filter over every
+row the family ever had), then the desktop retries the dead token again, and each retry re-runs the same
+full-family scan (already-revoked families short-circuit nowhere). Reuse-detected 401 also **signs the user out**
+on the desktop (`isOrcaCloudAuthFailure` → `clearCloudSessionIfUnchanged`), so every user who hit this during the
+outage must sign in again.
+
+Durable fixes (orca-cloud PR in preparation on branch `auth-revoke-only-live-tokens`): `AUTH_MAX_INSTANCES` and
+`auth_max_instances` → 20; Terraform disk 250 + `max_wal_size=16384`; the partial index in the schema; an
+`already-revoked` short-circuit in `rotateRefreshToken` that skips the family UPDATE and the audit insert. Still
+open after that: prune `refresh_tokens` (expired or revoked rows older than N days), a server-side statement
+timeout shorter than the desktop's 30 s so the client and server agree on failure, and an alert on auth 429s.
+
+**19:11Z RESOLVED at the database layer.** `refresh_tokens_family_unrevoked` went valid at 19:11:17Z (build
+18:07–19:11, two full table scans of 2.1 M blocks under load). Within 60 s: refresh latency 100 s → 0.1 s, auth 429
+→ 0, active orca_auth backends 200 → 2, checkpoints back on the 5-min timer (`checkpoint starting: time` at 18:35,
+18:41, 19:00, 19:11). Director `/v1/assign` returning 200. Fleet controls 0 → 17 by 19:14Z.
+
+**Residual: mass sign-out.** 19:11–19:14Z: 3,857 refresh 401s from 3,829 distinct IPs, then near zero. Every one is
+a desktop whose family was revoked by reuse-detection during the outage; the desktop clears its cloud session on
+401 (`clearCloudSessionIfUnchanged`) and stops retrying. Those users must sign in again before the relay sees
+them. Fresh `/session` sign-ins: 1, 5, 3 per minute at 19:10–19:12. Recovery of controls is now paced by users
+signing in, not by infrastructure. Total `session-refresh-reuse-detected` events 13:00–19:00Z ≈ 100k, against a
+~100/hour baseline.
+**Affected-user count (19:22Z, from `refresh_tokens`):** 23,318 live token families revoked in the window,
+**21,605 distinct users**. Only ~3,800 desktops had seen their 401 by 19:15Z; the rest were closed or asleep
+and will find themselves signed out on next launch, so sign-ins will trickle for days.
+
+**Desktop UX finding (owner's own Mac, 19:22Z):** a revoked desktop keeps showing the account card as
+"Connected" and the pairing pane as "Orca Relay: Unavailable" / `relay_control_not_active` indefinitely; the
+local trace writes no relay events. Only quit + relaunch surfaced the sign-out prompt, after which sign-in →
+relay-token → `/v1/assign` 200 (0.15 s) → working pairing, all within 10 s. Follow-ups: the relay coordinator's
+401 path should flip the account card to reconnect-required immediately, and the pairing error should say "Sign
+in again to use Relay" when the cause is an auth failure. Announcement wording: "If Relay shows Unavailable, quit
+and reopen Orca, then sign in when prompted."
+
+orca-cloud PR #474 (branch `auth-revoke-only-live-tokens`): caps → 20, disk 250 / max_wal_size 16384 in
+Terraform, partial index in the schema, `already-revoked` short-circuit. Do not deploy auth to any environment
+with a large `refresh_tokens` before building the index concurrently there.
+
+**Wave 1 of the roadmap (2026-09-04 21:35Z onward):** five Opus agents in isolated worktrees: 3.1 grace window
+(orca-cloud), 4.1+2.3 relay locks + pool timeout, 3.2+4.3 desktop refresh/jitter, 5.1+5.4 observability,
+2.1 private IP (plan only, both repos). First back: stablyai/orca PR #18717 (crash alert + dashboard). Its key
+finding: cell exits log to `cos_system` with uppercase `jsonPayload.MESSAGE` and `SYSLOG_IDENTIFIER=docker`,
+so every earlier `jsonPayload.message:"container die"` count in this doc that read 0 was querying the wrong
+field. Verified: 87 exits 12–13Z on the agent's filter, 0 in the last 6 h. Monitor dry-run 33922255205
+dispatched 21:41Z as the Roll 1 gate.
+Dry-run 33922255205 froze at 21:46Z on `signal_missing cloud_sql.backends`. Cause: Cloud Monitoring published
+no `num_backends` point for the auth instance between 21:40 and 21:46 (every other minute of the last 100 has
+one; measured directly via the timeSeries API). A Google-side publish gap, not a database or monitor defect;
+the monitor's freeze-on-missing rule is correct. The 12–13Z monitor failures were a different cause (active
+probes reading 0 during the crash cascade). Re-dispatched at 21:50Z.
+Dry-run #2 (33922844671) froze at 21:52:21Z on `auth.health observed 0` — verdict read from the state.json
+artifact, not the log (the log only prints checkpoints). Auth served `/health` 200 continuously, including the
+21:52:05 probe. Cause: the probe requires `/health` AND `/ready` on the first attempt; auth has no `/ready`
+(404 by design), so every auth sample takes the forced 11 s retry, and on the third sample the retry fetch threw
+at the network layer on the runner (no request reached Cloud Run) and `check()` recorded the exception as
+health=false. Neither freeze was fleet health. Fix delegated (relay-ops: a thrown fetch is not a reading; auth
+does not require `/ready`). **Sequencing constraint for Roll 1:** monitor evidence must be < 5 min old at
+canary dispatch, so the owner's go must precede the dry-run, and a green dry-run must be followed by the
+canary dispatch immediately.
+
+stablyai/orca PR #18719 (3.2 + 4.3, desktop): the replay engine was not the refresh function but
+`RelayAuthCoordinator.scheduleRetry`, since `shouldRetryRelayConnectionError` treats any non-HTTP error
+(including a refresh `TimeoutError`) as retryable and re-reads the same stored token on backoff. Fix: refresh
+gets one 60 s attempt; an ambiguous failure (no status line) records the token and blocks re-sending it for
+30 s (bounded, not permanent); definitive 5xx gets exactly one retry after re-reading the store; a 401 on an
+ambiguously-attempted token logs `orca_cloud_refresh_possible_replay`. Lease renewal gets ±10 % full jitter
+(base shrunk so the latest sample stays ≥ 90 s before expiry); server resets the full 55-min TTL on any rebind
+(`host-session-registry.ts:736-743`) so early renewal is free. Verified the retry-path claim and both server
+cites against main.
+
+2.1 private IP: orca-cloud PR #477 (foundation: servicenetworking API, /24 peering range 10.42.128.0, private
+network on the instance, `prevent_destroy`; real production plan 3 add / 1 in-place change, staging unchanged)
+and stablyai/orca PR #18720 (relay: `relay_cloud_sql_private_ip` variable, conditional `--private-ip` in the
+cell startup template; default false renders byte-identical to main). Findings that change the plan: Google
+states the private-IP change **restarts the instance** with no in-place path, and it is a one-way door (cannot
+disable private IP or remove the network link). The director uses the Cloud Run built-in connector, not the
+relay VPC NAT, so it never consumed the exhausted ports and is out of scope. Disabling public IP later breaks
+the local proxy workflow and the director. #18720 merges (inert); #477 held for owner decision.
+
+4.1 + 2.3 relay: stablyai/orca PR #18722. Premise correction: #18521 and #18606 had already bounded and
+narrowed most of the fleet-wide lock before today; what remained were the sticky-refresh retry (all 23 rows →
+the one pinned row), reservation reconciliation (23 → the 2 involved rows), a dead pool-default fallback, and
+an absolute counter write (→ delta with capacity guard). Placement (`assignOnce`) deliberately keeps the
+ordered inventory lock: least-loaded selection is fleet-wide and dynamic target-only locking previously caused
+cross-cell cycles; converting it to optimistic snapshot + conditional delta is the remaining 55P03 floor and a
+follow-up. Pool `statement_timeout` was already 5 s but hardcoded; now env-configurable, `57014` added to the
+retryable set (it was terminal before), schema DDL on an untimed max:1 pool. Independently re-ran the new and
+adjacent suites here against 55440: 66/66. Harness note: 55440 is not idempotent across full runs (2
+pre-existing failures on a second run); reset the schema between runs. Rollout: director first, watch
+`orca_relay_postgres_transaction_exhausted` and `cellInventoryHoldMsP95` before cells.
+
+#18719 first CI run failed only on `windows-host-job.win32.test.ts` (EPERM on temp-dir cleanup), a Windows
+PTY test the PR does not touch and which no other recent run failed on; rerun dispatched rather than waved.
+
+3.1 grace window: orca-cloud PR #478 merged (not yet deployed; deploy is an owner gate because the startup
+schema apply adds a nullable column to `refresh_tokens` with a brief ACCESS EXCLUSIVE). Semantics: within
+`ORCA_CLOUD_REFRESH_ROTATION_GRACE_MS` (60 s default, 300 s cap, 0 = off) a re-presented rotated token gets the
+SAME successor refresh token + a fresh access token, no revoke, no audit, provided the successor is still the
+live head. Third presentation / outside window / revoked family: unchanged (revoke + audit). Successor plaintext
+is stored sealed (AES-256-GCM, key = HKDF of the predecessor token; the DB never holds the key). Cost stated
+plainly: a stolen token replayed inside 60 s is served once instead of tripping detection; DB-read + stolen
+predecessor recovers the successor offline until pruned. Rotation now runs in one transaction (proved by a
+forced-INSERT-failure rollback test; the 8-way race alone did not kill the non-transactional mutant). Verified
+locally 27/27 incl. the Postgres suite against 55440, and CI ran it on PG 16 and 17 (4/4 each, not skipped).
+Deploy wiring: env is set by BOTH Terraform and the deploy workflow, with a test pinning all three sources to
+one value. **Pre-existing bug surfaced:** the deploy script strips every env var it does not own, so the
+Terraform-set `ORCA_CLOUD_REFRESH_TOKEN_TTL_DAYS` (from #476) silently reverts to the compiled default on each
+release. Latent only because both defaults are 30. Follow-up: add it to `authEnvironment` + the workflow env.
+
+Monitor probe fix: stablyai/orca PR #18723. A thrown fetch (DNS/TCP/TLS/8 s abort) is now "no reading" and is
+re-asked once after 1 s; only a second throw is `false`. A non-ok HTTP answer is still `false` with no extra
+retry. `latencyMs` is the slowest answering round trip, never a sleep. `requiresReady` is per endpoint: auth
+(no `/ready` by design) is judged on `/health` + latency; director and cells unchanged. No threshold or rule
+touched; `auth.ready` had no consumer. 81/81 relay-ops tests and 9/9 evidence-script tests locally. The monitor
+runs at `main` head, so once merged the next dry-run uses it.
+
+Applying #18717 (22:10Z): the cell-exit log metric `orca_relay_cell_process_exit` is created; the alert policy
+raced descriptor propagation (404) and is being retried. **Not applied, deliberately:** the dashboard. Its
+targeted plan drags in `google_logging_metric.relay_snapshot[*]`, and that plan is `32 to add, 21 to destroy`:
+the Terraform source adds a `region` label to every runtime metric (`EXTRACT(jsonPayload.region)`) which the
+live metrics do not have, and a label change on a log metric is a delete+create. Replacing 21 live metrics
+resets their history and would blank the 14 existing relay alert policies during the swap. That is
+pre-existing drift in the relay root (unapplied since the region work), not something #18717 introduced. It
+needs its own reviewed apply in a quiet window, ideally with the runtime-metric replacement acknowledged as
+intentional. Dashboard apply waits on that.
+
+**Wave 1 closed 22:20Z.** Merged: orca-cloud #478 (grace window); stablyai/orca #18717 (crash alert +
+dashboard TF), #18719 (desktop no-replay + jitter), #18720 (private-IP flag, off), #18722 (relay per-cell
+locks + pool timeout), #18723 (monitor probe fix). Applied to production: cell-exit log metric + alert policy.
+Held for owner: orca-cloud #477 private IP (restart, one-way); the dashboard apply (behind the runtime-metric
+label drift); the auth deploy carrying #478; Roll 1. Every wave-1 code change now sits on main un-deployed:
+the next relay image build carries #18722 + #18723's monitor runs at main head already; the next auth deploy
+carries #478.
+
+**Landing (2026-09-04 20:50Z–21:02Z, owner: "if you are confident the cloud changes are valid, you can land them"):**
+
+- Merged: orca-cloud #474, #475, #476; stablyai/orca #18693, #18694, #18698. Neither repo has branch
+  protection or environment reviewers; `verify` / `cloud-verify` green on main after each.
+- Applied to production by targeted saved plans (each plan asserted create-only / exact-attribute before
+  apply, via `terraform show -json`): 4 relay resources (WAL-checkpoint log metric + 3 alert policies), 8 auth
+  resources (3 log metrics, propagation sleep, 4 alert policies), and the us-central1 NAT
+  (`enable_dynamic_port_allocation` false→true, ports 64..4096). Google's docs: switching to dynamic does not
+  break existing connections when max ≥ 1024 and max ≥ old min; only lowering max or reverting to static is
+  disruptive. asia-east2 NAT deliberately left for after a US soak.
+- Not applied: the untargeted apps-root plan also carries 4 unrelated drifts (`ORCA_CLOUD_REFRESH_TOKEN_TTL_DAYS`
+  env on the auth service from #476, a skill log exclusion filter change, skill pressure threshold 16→8, an
+  artifacts bucket lifecycle rule) and fails on the 1Password Cloudflare data source locally. The foundation
+  root plans clean (disk 250 / max_wal_size already match). Those drifts belong to whoever runs the next full
+  apps apply in CI.
+- `deploy-auth-production` on main 8034955 (run 33919143723) **succeeded 21:04Z**: serving revision
+  `orca-cloud-auth-00031-tox` at 100%, previous `00018-4jc`, cap 20, smoke passed on both URLs. First 15 min on
+  the new revision: 31×200 / 1×401 on `/refresh`, max latency 56 ms, no 5xx. The new
+  `refresh_token_prune_cursor` table exists, so the new schema applied.
+- US NAT soak (21:01–21:06Z): 0 drops, 0 proxy dial errors, 0 cell exits, port_usage 11, sqlMax ~1.07 s.
+  Asia NAT then applied 21:05:28Z from the pre-verified saved plan (same three attributes). The deploy script strips env vars it does not own, so the Terraform
+  TTL var will not be on the new revision until the full apps apply lands; the auth code defaults to 30 d.
+- Terraform locally needs `GOOGLE_OAUTH_ACCESS_TOKEN="$(gcloud auth print-access-token)"`; ADC is stale.
+
+**Alerting + NAT follow-ups (19:58Z, superseded by the landing block above):**
+
+- stablyai/orca PR #18693 (`relay-nat-ports-and-sql-alerts`): both relay NATs switch to dynamic port
+  allocation (64–4096 per VM); new relay-channel alerts for the Cloud SQL WAL checkpoint loop (log metric on
+  `checkpoint starting: wal`, > 3 per 5 min), Cloud SQL disk > 70%, and NAT `OUT_OF_RESOURCES` drops. No
+  existing workflow applies these resources; the PR body carries the targeted plan.
+- orca-cloud PR #475 (`auth-observability-alerts`): log metrics + policies for auth refresh 401 (> 100 per 5
+  min; Sep 3 baseline 20–80 per hour), 429 (> 20 per 5 min; baseline 0), 5xx (> 10 per 5 min), and Cloud Run
+  p99 latency > 10 s. Production routes to the relay Slack channel.
+- Desktop stale auth-status fix: stablyai/orca PR #18694 (`desktop-cloud-session-revoked-status`). Main pushes
+  an auth-status-changed IPC when a 401 clears the session; panes re-fetch on mount; the pairing notice says
+  "Your Orca account session expired. Sign in again to use Orca Relay" and hides Retry. StrictMode regression
+  test verified red on the old guard. Does not help desktops already revoked today (session cleared before
+  this code); it fixes every future revocation.
+- orca-cloud PR #476 (`auth-refresh-token-pruning`): batched `refresh_tokens` pruner as a scheduled Cloud Run
+  job (revoked rows kept 30 d, rotated rows 60 d against a 30 d TTL, 5k-row batches, 200 ms pauses, persisted
+  cursor, per-run budget) plus a 10 s `statement_timeout` on the auth request pool with schema DDL on an
+  untimed connection. Merges cleanly onto #474 and does not need its index (walks the primary key;
+  EXPLAIN-asserted no seq scan). CI ran the Postgres integration tests for real on PG 16 and 17. Ships
+  `auth_token_pruner_enabled = false` in both environments: enabling needs an image digest from a build that
+  contains the new entrypoint. Operating rules once enabled: monitor the run summary's `stopReason` and
+  `deletedRows`, not the exit code (a run that only ever times out exits 0); ~48 M rows drain in ~10 days at
+  200k/hour; deleting them leaves dead tuples, so the 16 GB is not reclaimed without a separate VACUUM FULL or
+  pg_repack pass, which is its own change.
+- Phone-side copy when the desktop is signed out: stablyai/orca PR #18698 (`phone-desktop-signed-out-reason`).
+  Real path traced: the director resolves the phone to the host's last cell (durable assignment row), and the
+  cell's `acceptClient` rejects with 4404. The only additive slot every shipped peer tolerates is the WebSocket
+  close *reason* (relay-hello and resolve schemas are zod strict; a new close code drops old phones off the
+  host-offline cadence). Desktop closes its control with reason `signed-out` only when the cloud session is gone
+  (null context after a 401, or explicit sign-out); quit and relaunch stay reasonless. Cell remembers it per
+  host for the dormant-assignment TTL, forgets on re-auth, and echoes it as the 4404 close reason; phone
+  renders "Desktop signed out — sign in to Orca on your desktop to reconnect" with the same retry cadence.
+  Old×new matrix in the PR body; nothing changes for any old peer. Merges cleanly with #18694.
+
+## What actually blocks the roll now (12:58Z summary for the owner)
+
+0. **Cloud NAT ports** (Finding 11, found 12:55Z): every us-central1 cell reaches Cloud SQL's public IP
+   through a NAT with the default 64 ports/VM; port_usage pinned at 64 and 1,514 dropped SYNs to
+   Cloud SQL:3307 in one 4-min window. This is the 2 s connect stall that kills old-image cells and is
+   still active after the disk loop broke. Fix: `min_ports_per_vm = 1024` (or dynamic allocation) on
+   `google_compute_router_nat.relay_gce` in `cloud/infra/terraform/relay-gce-foundation.tf`, targeted
+   apply; durable fix is a private IP on the Cloud SQL instance. Online, no VM restart.
+1. **Cloud SQL disk** (Finding 10): 49 GB PD-SSD saturated since 11:58Z, checkpoint loop, fleet-wide
+   4–6 s stalls every ~45 s. Fix: bigger disk and/or `max_wal_size`. Owner: `stablyai/orca-cloud`
+   `infra/terraform-foundation/database.tf` `google_sql_database_instance.auth` (no `disk_size`,
+   `disk_autoresize`, or `database_flags` set today, so Terraform is at defaults: 10 GB initial, autoresize
+   grew it to 49 GB). Add `disk_size = 200` (+ `disk_autoresize = true`) and optionally
+   `database_flags { name = "max_wal_size" value = "4096" }`; production tfvars are
+   `infra/terraform-foundation/environments/production.tfvars`; applied by `deploy-production.yml` in
+   that repo. Online, no restart for disk; `max_wal_size` is also a non-restart flag. Note Terraform
+   `disk_size` below the live 49 GB would be a destructive shrink, so 200 is safe and 49 is the floor. **This is now the first thing to do**; nothing else can pass a
+   15-min gate while it persists, and it is also what is killing the old-image cells several times an hour.
+2. **Old cell image** (Finding 6): dies on every stall. Fixed by rolling 519f4914 (canary inputs ready).
+3. **Gate policy**: `directorErrors: 0` and per-cell health probes freeze on any single stall. Recalibrate
+   after 1 and 2, or bypass by hand for the canary.
+
+## Plan agreed with the owner (2026-09-04 ~06:45Z), in execution order
+
+Owner: "feel free to improve operations to make things more effective ... continue driving everything e2e
+until this process is complete." Owner has had multi-day experiences with cell rolls and does not want a
+9-hour sequential roll.
+
+1. **Lock-removal PR** (root cause). *Status 08:55Z: pushed as branch `relay-single-row-reservation`
+   (2 commits). Opus adversarial review found one real defect: `acquireActivity` moving a client-chosen
+   activity id across cells locked the old cell's row before the new one, cycling with placement's
+   ascending inventory lock (reviewer reproduced it as paired 55P03s on real Postgres; no 40P01 because
+   lock_timeout == deadlock_timeout == 1 s). Fixed with `lockCellRows` (ordered, 500 ms bound); census now
+   fails on any inline `relay_cells FOR UPDATE` outside the named helpers. Three-cell Postgres test moves
+   an activity high->low while the target row is held; 5/5 revert-mutants fail it. 480 SQLite tests +
+   tsc green. Also fixed a pre-existing test leak (`relay_cell_connection_snapshots`) that made
+   `assignment-control-supersession-postgres` fail on reruns. Reviewer re-verified 65569be3de: cycle
+   repro completes in 7 ms (was 1022 ms + paired 55P03); no remaining out-of-order pair in the store;
+   flagged two evasions in the new census guard, closed in the third commit (whole-statement scan,
+   covers query() too, mutation-checked with both evasions). Headroom Postgres test's one failure is
+   pre-existing on main (verified by swapping in main's store).* Make `activateControl` superseded-control cleanup, `acquireActivity`
+   existing-lease branch, and `changeActivity` use the existing single-row
+   `adjustCellReservationAtomically` instead of the 23-row `lockCellInventory`. Keep the global lock only
+   for placement (`resolve`/assignment) and sweeps. Real-Postgres contention test on port 55440.
+2. **Faster same-cap rollout workflow.** (a) paced drain instead of `graceMs: 0` so a cell's ~800 hosts
+   re-dial over minutes, not one second (director cap is 5 x 80 = 400 in-flight); (b) cells in a batch run
+   in parallel once drains are paced; (c) post-canary batches use a short freshness check instead of a new
+   15-min dry-run, since the in-job safety recheck already runs before each drain; (d) job timeout > 75 min.
+   Target: 22 cells in ~6 batches x ~25 min.
+3. **Build image** with (1) merged, then one roll of the fleet with (2). Asia cells c27/c28/c29 first.
+4. Re-tighten the monitor retries bar; recalibrate the Terraform exhausted alert.
+5. Consider deleting the 55-min control lease rebind entirely (no recorded reason; liveness is the 75 s
+   watchdog + 90 s activity lease). Separate PR after (1) so its effect is measurable.
+
+## Faster same-cap rollout: design (step 2 of the plan), from reading the real limits
+
+What actually bounds parallelism today (measured on the c7 canary, run 33843071283):
+
+| step | c7 duration | bound by |
+|---|---|---|
+| prechecks (recheck, backend init, resolve, verify) | 43 s | none |
+| isolate + drain + transition wait | 7 min | drain is `graceMs: 0`; `verify-relay-capacity-transition --activity restart-safe` polls until leases drain |
+| Terraform template + MIG recreate + wait-until stable | 8 min | GCE recreate; per cell, independent |
+| verify new incarnation + trust proof + restore | 1.5 min | none |
+
+Real constraints: (1) the director is 5 x 80 = 400 in-flight `/v1/assign`; a `graceMs: 0` drain of ~800
+hosts pins it at cap for ~2 min (observed 79.75/84.75 p99). (2) `production-cloud-sql-rollout` lease and
+workflow concurrency group serialise the whole run, by design, and the per-cell job shares it via
+`holder-key`. Nothing else forbids parallel cells.
+
+Changes, smallest first:
+1. **Paced drain.** `HostSessionRegistry.drain(graceMs)` already sends `drain {graceMs}` and closes each
+   session after `graceMs`, but the desktop's `handleDrain` re-dials immediately regardless of graceMs
+   (`relay-origin-pool.ts:150-162`), so graceMs only delays the *close*, not the stampede. Fix on the
+   cell: stagger the drain *send* across sessions over a window (e.g. 800 sessions over 120 s = ~7/s),
+   which needs no desktop change and works for every desktop version in the field. New admin body field
+   `spreadMs` (optional, default 0 keeps today's behaviour); canary script passes `spreadMs: 120000`.
+   Requires the cell to be on an image with the change, so it applies to batches after the first
+   post-lock-fix roll, not to this one.
+2. **Parallel cells in a batch.** In `cloud-deploy-relay-production-same-cap.yml` make `cell_2..cell_4`
+   `needs: [gate]` instead of chaining, gated on the same evidence (drop the `+75 min x wave-index`
+   allowance, it exists only because of chaining). Each job already takes the rollout lease with the
+   run's `holder-key`, so they re-enter it rather than fail. With paced drains, 4 cells x ~800 hosts
+   over 120 s is ~27 dials/s, well under the director cap. Raise `timeout-minutes` to 90.
+3. **Post-canary batches skip the 15-min dry-run.** The in-job "Recheck aggregate SQL, pool,
+   reconnect, migration, and selector safety" step (`pnpm incident:relay-preflight`) already runs a
+   live one-shot check before each drain. For `batch-apply` with a sealed `canary-run-id` from the
+   same commit, accept a dry-run of any age (the canary's) plus that live recheck; keep the 15-min
+   requirement for `canary-apply`. Change lands in `relay-monitor-evidence.mjs verify-authority` +
+   `relay-production-same-cap-wave.mjs` + their node:test suites.
+
+**Correction after reading the cell job (07:35Z):** (2) parallel cells is not a flag flip. Each cell job
+asserts the exact selector generation `expected + 2 x wave-index` and exact memberships derived from
+predecessors having completed (`ISOLATED_*`/`RESTORED_*` in the job, `applyExactAdmissionSelector`
+compare-and-swap), and all cells share one Terraform state lock. Making that concurrent means a batch-level
+isolate/restore in the gate and a rewrite of the 650-line job's expectations. That is the multi-day trap
+the owner described. Deferred.
+
+What is cheap and removes most of the wall-clock: (3). The per-batch 15-min dry-run costs 15 min each
+*and* fails ~50% of the time on old-image crashes, which is where hours go. Implement: `batch-apply` with a
+verified canary authority accepts a passed dry-run up to 6 h old and may re-use one already consumed
+(the consumed-marker check exists to stop replaying stale evidence; the canary binding plus the in-job
+live preflight at drain time replace it). Files: `relay-monitor-evidence.mjs` (`--after-canary`),
+`incident-live-preflight-cli.ts` (same flag), the same-cap workflow + job, and both test suites.
+Revised expectation: 22 cells = 6 sequential batches x ~70 min = ~7 h wall-clock but *unattended-safe*
+and with one dry-run total, versus today's 6 dry-runs at ~50% each. (1) paced drain rides the lock-fix
+image.
+
+## Recommended next steps (superseded by the plan above; kept for history)
+
+1. Resolve the gate decision above, then: monitor dry-run -> c7 `canary-apply` only -> verify -> stop.
+   Each rolled cell leaves the Finding 6 crash class.
+2. Merge #18565; publish; a later same-cap roll carries it to cells.
+3. Remove the global inventory lock from per-connection paths (`acquireActivity` existing-lease
+   branch, `activateControl` superseded-control cleanup, `changeActivity`) by using the existing
+   `adjustCellReservationAtomically` single-row update. Own PR, after the roll.
+4. Recalibrate the Terraform alert `relay_postgres_retry_exhausted` to 300/300 s (observability root).
+5. Whether to raise `relayPostgresRetries` is a human call; the data is in Finding 5.
+
+## Canary blast radius (read before dispatching c7)
+
+- What `canary-apply` does to c7, in order: isolate (selector -> migration-only, no new
+  assignments), `/v1/admin/drain graceMs:0` (every control on c7 re-dials the director and is
+  reassigned), Terraform template + MIG update to the target image, wait stable, verify new
+  incarnation + exact digest + protocol, prove per-host trust, restore c7 to general admission.
+  On any failure c7 is left isolated (migration-only) with rehome disabled; nothing else is touched.
+- c7 at 05:20Z: 788 controls, 5 splices, 800 connections. So ~790 desktops re-dial once. The fleet
+  already absorbs this exact event 201 times / 48 h uncontrolled (Finding 6); the controlled version
+  isolates first, so no new assignment lands on c7 mid-roll. Expect a director concurrency blip, not
+  a freeze-class one (six cells at once gave 85; one cell should stay well under 64).
+- Precedent: the identical workflow (pre-move, in orca-cloud) ran 9 successful `apply` canaries and
+  batches on 2026-08-27 (last: c20 -> 5aedbca5). Its failures that day all stopped at the read-only
+  "Recheck aggregate SQL..." or "Require durable rehome disabled" step, before `MUTATION_STARTED`.
+  The moved copy in this repo has one run: the read-only `verify` of c7 (passed, including WIF auth).
+- c7 side note: MIG autoheal recreated the c7 instance four times on 2026-09-01 08:02-08:42 PDT
+  at ~13 min spacing. Same crash class as Finding 6 (health check failing during restart loops).
+
+### Canary observed effect (c7 drain, 2026-09-04 06:10Z)
+
+- c7 807 controls -> 0 between 06:08:52Z and 06:10:52Z. Director `/v1/assign`: 200s 32 (06:09) -> 2628 (06:10)
+  -> 340 (06:11); 5xx 1969 (06:10) -> 31 (06:11). Director max-concurrency p99 7.9 -> 79.75 (06:10) -> 84.75
+  (06:11), i.e. at the Cloud Run cap of 80 for ~2 min. My pre-dispatch estimate ("well under 64") was wrong.
+- Confounder: c10 (us-central1, instance 2803000337345335589) crashed 06:09:56Z on the old-image class
+  (Node.js banner + container die), so ~1,600 hosts re-dialed in the same minute, not ~800. Coincidental;
+  the fleet has one of these every ~15 min.
+- Recovery: 06:13 903 / 06:14 1471 assign 200s from 640 distinct desktop IPs; 503s 78 -> 183 -> 29/min.
+  No cell crash 06:12–06:16Z. Drain step passed ~06:16Z; template/MIG apply started.
+- 06:16:03–06:17:08Z, during c7's template apply (not its drain): c27 (x4) and c29 (x3) crash-looped on the
+  old-image pg-pool connect timeout in `beginProof`, both MIGs autoheal-recreated (c27's second recreate in
+  40 min). Fleet 23 -> 21 reporting cells, controls 13286 -> 12462, assign 503s 1000/min at 06:17, director
+  concurrency p99 74.8. Cloud SQL CPU 0.70 max, backends 174 max (bar 250). Same multi-cell pattern occurred
+  at 01:31Z (4 cells) and 04:47Z (5 cells) with nothing rolling; the c7 drain's SQL load 6 min earlier may
+  have nudged the pool timeouts but the class is pre-existing. c7 MIG RECREATING onto new template
+  `…20260904061618…` = the expected image swap.
+- 06:20Z: 849 assign 503s. Closes 06:19:30–06:21: 162x1006 age<5min (hosts bouncing off the recreating
+  c27/c29), 73x4408 + 53x1006 in the 50-min age bin (Finding 3 rotation cohort). Not roll-caused.
+  c7 MIG `recreating=1` on the new template since 06:16:18Z; c27 and c29 MIGs also RECREATING (autoheal).
+- 06:23:16Z c7 instance restarted in place (MIG RECREATE keeps name/id relay-c7-bwjc / 4545742188814054238),
+  pulled `relay@sha256:85bf6799…` 06:23:37Z, listening + readiness true 06:23:42Z. Apply step passed 06:24Z;
+  verify step running. Isolate -> ready on new image took ~14 min end to end.
+- Post-restore c7 on new image (06:25:42–06:26:42Z): controls 143 -> 273 -> 377 refilling, sqlQueries
+  ~1,500/30 s, `sqlLatencyMsMax` 518 -> 1003 -> 1155 ms, still 55P03 `cell-inventory` retries. So the new
+  image alone does not remove lock waits; the request-path 500 ms cap from #18521 applies to the director's
+  paths, and cell-side `acquireActivity`/`activateControl` still ride the global lock (step 3 in next steps).
+  Watch: does c7's sqlLatencyMsMax settle below the old 1.0–1.2 s pin once refill finishes, and does c7 stop
+  appearing in `container die` (the real win: guardSessionTask).
+- 08:25Z (2 h after restore): c7 817 controls, 0 crashes since 06:25Z. Fleet crashes last 2 h: c27 x6,
+  c28 x5, all old-image Asia cells. The new image stops the crash class as predicted; it does not move
+  lock latency (c7 sqlLatencyMsMax 1005 ms), which is #18606's job.
+- Implication for the batch phase: every drain will push director concurrency past the monitor's 64 bar
+  for ~1-2 min. The batch job rechecks safety *before* it drains (read-only step), so that is fine per wave,
+  but never run a monitor dry-run concurrently with a wave, and prefer batches of 2 over 4 until the fleet
+  is on the new image and the crash class is gone.
+
+## Post-merge dispatch plan for #18606 (image -> director -> cells)
+
+1. `gh workflow run cloud-publish-relay-production.yml --ref main -f mode=publish` (after the squash lands
+   on main). Resolve the digest by tag, never by parsing the log (it mixes relay and fence-broker digests):
+   `gcloud artifacts docker images describe us-central1-docker.pkg.dev/onorca-cloud/orca-cloud/relay:sha-<merge-sha> --format='value(image_summary.digest)'`.
+2. Director: `gh workflow run cloud-deploy-relay-production-director.yml --ref main -f image-digest=<new>
+   -f regional-placement-mode=preserve -f prune-incompatible-revisions=false -f expected-rehome-generation=12
+   -f bootstrap-runtime-identity=false -f predecessor-image-digest=<currently serving digest>`
+   (no monitor evidence needed; requires rehome disabled at gen 12, which it is). Last run 33826514754 used
+   the same shape. Watch director `orca_relay_postgres_transaction_retry` per minute before/after.
+3. Cells: same-cap `verify` c7 with target=<new>, rollback=85bf6799; fresh dry-run; `canary-apply` c7;
+   then batches (3 per batch, Asia c27/c29/c28 first). Each batch: new dry-run unless the batch-reuse
+   change (design section above) has shipped.
+
+## Finding 8 (2026-09-04 08:40Z): ten-cell crash cascade during the director deploy, not caused by it
+
+Timeline: candidate revision 00570-siv created 08:38:39Z, first log 08:39:20Z; traffic still 100% on
+00565-fes through 08:43 (assign logs by revision). Cell crashes: c28 (5031087219978409220) looped 08:37:55–
+08:40:07 (9x), then at 08:40:20–08:40:45Z **ten** instances died within 25 s (c10 2803…, 5110…, 532…, 5464…,
+7536…, 7726…, 8671…, 8928…, 8966…). All old-image `beginProof` pg-pool timeouts. Fleet controls 13,423 ->
+6,157 by 08:43; assign 503s 3,912 (08:42) and 4,624 (08:43) per minute, director concurrency 85 (cap 80),
+Cloud Run autoscaled 5 -> 10 instances, Cloud SQL CPU 0.55 -> 0.99. Deploy finished cleanly at 08:45Z with
+the new director taking the tail of the storm; by 08:46 503s were ~30/15 s, controls 7,913 and rising,
+director lock retries 29/min (vs 105–157/min pre-deploy) and exhausted 2/min (vs 65/min at 08:36).
+Same class as 01:31Z (4 cells) and 04:47Z (5 cells) today; this was the biggest. c7, on the new image
+since 06:25Z, did not crash. What triggered the pool timeouts fleet-wide at 08:40 is not established; Cloud
+SQL CPU was 0.78–0.88 in the minutes before, the highest of the day, so the cells' 2 s connect timeout is
+the plausible tipping point under a busy database. Every cell still on 5aedbca5 remains exposed to this.
+
+## Finding 9 (2026-09-04 08:56Z): #18606 on the director cut lock retries ~10x
+
+`orca_relay_postgres_retries` per 5 min, director only: 08:21–08:41 windows 419–689 (old image, incl. the
+crash storm); 08:46/08:51/08:56 (new image 519f4914, refilling ~7k hosts): **61 / 69 / 54**. Exhausted:
+104–178 -> **11 / 14 / 12**. Inventory hold p95 ~200 ms, max 255 ms, ~366 holds/min. Cells (still old
+image) 17–44 -> 0–3, because the director no longer holds the 23-row lock on their behalf. This is the
+first direct measurement of the root-cause fix under real load. Cloud SQL CPU peaked 0.99 during the
+cascade and is decaying (0.86 at 08:55); the monitor freezes above 0.80, so no dry-run until it clears.
+
+Fourth cascade 09:00:12–09:00:18Z: c23, c8, c16, c26, c22 (five cells, 11 container-die events in 6 s,
+all `5aedbca5`, exitCode 1, Node banner, pg-pool `client closed the connection` burst right before). Cloud
+SQL CPU 0.84 -> 0.78 in the preceding minutes, director concurrency 18–22 (idle), so this one fired
+*without* a database or director spike. Fleet had just recovered to 13,015. Cadence today: 01:31 (4),
+04:47 (5), 08:40 (10), 09:00 (5), 09:31 (c13, c23), 09:34 (c23 again, c14, c20, c9; c14/c20 crash-looping),
+09:39 (c21, c24), 09:55 (c16, c8), 09:59 (c20), 10:05 (c8, c20), 10:19 (c16 stalled, no crash), then a 58-min
+lull, 11:04 (c9; c28 died 13x in 4 min, autoheal recreate 11:09Z, its 3rd recreate today), 11:17 (c10, c28
+again, c22, c23, c14 x9 looping; 23 dies in ~90 s; fleet 13.3k -> 10.8k), 11:31 (c14, c23, c25, c15, c24, c19), 11:34 (c20, c26, c29 x4, c14, c27 x3, c25; fleet 13.1k -> 10.3k).
+Three cascades in 17 min. 11:38–11:45 c27 crash-looped 17x and c28 4x (Asia cells), c29 recreating.
+11:59 (c21, c9, c10, c23), 12:02 (c19; 4,109 assign 503s that minute, mostly hosts bouncing off the
+recreating cells, code 1006 age<5min x217), 12:09–12:12 (c19, c27 x6, c28 x5, c13, c22, c15, c26, c14;
+8 cells, c27/c28 recreating again). Cloud SQL CPU 0.62–0.85 through it. 12:20 (six more cells). Cascade
+cadence since 11:00 is now ~every 8 min; the waiter has held correctly the whole time and there has been
+no dispatchable window. Loop continues unattended; findings stop logging each cascade from here unless the
+class changes. Every cell that has died today is on 5aedbca5; c7 (85bf6799,
+5.5 h) has not. Cell dies per hour today:
+01Z 5, 02Z 7, 03Z 4, 04Z 7, 05Z 4, 06Z 9, 07Z 11, 08Z 30, 09Z 26, 10Z 2, 11Z 68+ (to 11:42).
+Director concurrency pinned at 85 for 09:32–09:33; 503s 4,141 and 4,396 per minute. 09:39: c21, c24
+(2,870 503s). Crashes per instance 08:10–09:40Z: c28 x14, c27 x5, c23 x5, c22 x4, c14 x4, c13/c20 x3,
+then c26/c9/c24/c16/c8 x2. Mean gap between cascades since 08:40: ~12 min. Every 15-min gate attempt
+now has well under even odds; the c7-style canary that ends this needs a gate it can pass. The old image is now cascading roughly hourly regardless of load; the
+only cell on a fixed image (c7) has 0 crashes in 2.5 h across all four.
+
+Director 500s: 4 in the 09:00 window, all 2.0 s latency on `/v1/assign` or `/v1/resolve` = pg-pool connect
+timeout surfacing as a 500. Pre-existing (Sep 3: 03h/08h/16h one each, same 2.0 s shape; 06:09Z today on
+the old image during the c7 drain). The monitor's `directorErrors: 0` bar freezes on any of these, so a
+dry-run needs a 15-min window with none; at ~1 per cascade that is a real but modest constraint.
+
+**Gate observation (09:26Z):** `directorErrors: 0` counts every non-503 5xx on the director, including
+the monitor's own admin calls. The director on 519f4914 still sees an occasional 2.0 s pg-pool connect
+timeout (~1 per 20 min under today's Cloud SQL load), which surfaces as a 500 on whichever request drew
+it. Two consecutive dry-runs (#7, #8) froze on exactly this: one, isolated, 2 s 500. That bar was set for
+"unexpected director 5xx"; a single connect timeout that the client retries is not an incident. Candidate
+recalibration (own PR, not done): `directorErrors` 0 -> 2 per 5 min, or exclude the monitor's own
+user-agent. Not changing it unasked; noting that at ~3 per hour the 15-min gate passes ~1 in 2 attempts.
+
+**Did the director deploy make cells crash more? (checked 09:45Z)** Cell `container die` per 30 min:
+06:00 9, 07:00 2, 07:30 9, **08:30 30** (director candidate 08:38, traffic 08:43–08:45; the 10-cell burst
+was 08:40:20, before the move), 09:00 11, 09:30 12. Per hour today 05:4 06:9 07:11 08:30 09:23 vs Sep 3
+same hours 2/7/8. So today is 2–3x worse than yesterday and was rising before the deploy; after the deploy
+it is ~11–12 per 30 min, in line with 06:00–07:30. Cloud SQL backends (~230 max) and new connections
+(~5k/30 min) are flat across the deploy. Latest crash (c21 09:39:11) is `Connection terminated due to
+connection timeout` with cause `Connection terminated unexpectedly` in `verifyCellAssignment` <-
+`beginProof`, the same unhandled path. Conclusion: no evidence the deploy worsened it; the old image's
+crash rate simply climbed all day. Director lock retries stayed ~10x lower after the deploy.
+
+**Checkpoint-phase check (10:00Z, negative result):** Postgres checkpoints complete every 5 min at ~:07.
+Cell crashes bucketed by phase within that 5-min cycle show a mild :00–:29 s cluster today (22 of 103)
+that is absent on Sep 3 (7 of 114), so checkpoints are not the trigger. Disk write bytes in cascade
+minutes are at or below the median except 09:00. Cloud SQL memory 0.47, transaction rate flat. The
+09:55 stall (11 director + 4 cell pg-connect timeouts in the same 4 s) came with `could not obtain lock
+on row in relation "relay_cells"` from a NOWAIT sweep at 09:55:36, i.e. someone was holding the full
+inventory at that moment. On the new director that can only be placement or a sweep; on the old cells it
+is still every rebind. What stalls *connections* (not locks) for 2 s fleet-wide remains unexplained;
+Cloud SQL is `db-custom-4-15360` REGIONAL PD_SSD 49 GB at 0.5–0.75 CPU when it happens.
+
+**Stall census (10:01Z):** 33 pg-connect-timeout stall events today (clusters of timeouts < 20 s apart).
+Before 08:35 they were 1–9 timeouts each and 10–60 min apart; from 08:35 the big ones are 16, 22, 21,
+17 timeouts and 5–30 min apart. No second-of-minute phase (start seconds spread across all buckets), so
+not a fixed timer. Cloud SQL backends by state at 09:55: active peaked 42 at 09:52, idle-in-transaction
+≤ 10, nothing near the 400 ceiling; memory 0.47; disk normal. Each stall is a few seconds where *new*
+connections to Cloud SQL (via the auth proxy socket) time out at the 2 s `connectionTimeoutMillis`,
+hitting every process that happens to need a fresh pool connection in that window. Old-image cells die
+on it (unhandled), new-image director logs a 2 s 500 and continues. Root cause of the stall itself is
+outside the relay code (Cloud SQL proxy or instance); not chased further here.
+
+## Finding 10 (2026-09-04 12:40Z): Cloud SQL disk write saturation since 11:58Z is driving the stalls
+
+`orca-cloud-auth-db` is `db-custom-4-15360` on a **49 GB PD-SSD** (81% used). PD-SSD performance scales
+with size: 49 GB gives roughly 1,470 write IOPS and ~23 MB/s write throughput. Measured:
+
+| | before 11:58Z | 11:59Z onward |
+|---|---|---|
+| disk write MB/s | 4–6 | **30–50** (over the ~23 MB/s cap) |
+| disk write IOPS | 500–800 | 800–1,475 (at the ~1,470 cap in 11:59, 12:15, 12:24, 12:34) |
+| checkpoint `sync=` | 0.07–0.2 s (Sep 3 max 0.65 s, 290 checkpoints) | 2–20 s; 27 of 39 checkpoints in 12Z were >= 2 s |
+| checkpoints per hour | 12 (timed, every 5 min) | 39 (WAL-triggered, every ~45 s; `write=` fell from 270 s to 30 s) |
+| Cloud SQL CPU / memory | 0.5–0.8 / 0.47 | same (not the bottleneck) |
+
+Every 4 s+ fleet-wide SQL stall since 11:04 (11:04, 11:17, 11:31, 11:34, 12:09, 12:10, 12:18, 12:20,
+12:30) sits inside a slow checkpoint `sync` window; the 12:30:49 checkpoint synced 5.88 s (longest file
+5.47 s), matching the 12:30:02–41 stall. During fsync the WAL writer stalls and every session waits, which
+is why the stall hit all 23 cells and the director at once regardless of the relay lock changes. The
+old-image cells then die on the pool timeout; the new image survives. What raised write volume ~8x at
+11:58Z is not established (autovacuum ran on every relay table 11:55–11:57 and checkpoints are being
+forced by WAL volume, so a write amplifier inside Postgres is the leading candidate; relay transaction
+rate and Cloud SQL network bytes were flat). This is the first cause found today that is *upstream* of
+the relay code and it explains the afternoon acceleration (11Z 68 dies, 12Z 47 by 12:34).
+
+Corrections after digging (12:45Z): relay query volume, renewals, reconnects, and assignments per 5 min
+were **flat** across 11:58 (sqlQ ~330k, renewals ~115k), so the relay did not start writing more. WAL
+recycling per checkpoint went 7 -> 10–11 files (16 MB each) at 45 s intervals, i.e. WAL output rose from
+~0.4 MB/s to ~4 MB/s while data-file writes rose to 30–50 MB/s; checkpoints switched from `time` to `wal`
+triggered at 11:58:24. No Postgres slow-statement or "checkpoints too frequently" lines. This is
+write amplification inside Postgres (full-page writes after each of the now-frequent checkpoints on
+hot pages, plus autovacuum on every relay table each minute) on a disk too small for its IOPS ceiling,
+not new relay load. Instance label `managed_by=terraform`, created 2026-07-09; the instance resource is
+**not** in `cloud/infra/terraform` (only the database, user, and secret are, via
+`local.relay_database_instance_name`), so it lives in the other Terraform root (orca-cloud, per
+[[orca-cloud-terraform-split-findings]]). `storageAutoResize=true` with limit 0, so Cloud SQL will grow
+the disk only when it fills, not when IOPS saturate; disk is 81% full.
+
+Onset precisely: the 11:55:37 `time` checkpoint wrote 67,258 buffers (10.5% of shared_buffers, the
+day's largest) over 163 s and completed 11:58:24. Every checkpoint since has been `wal`-triggered at
+~45 s spacing (`max_wal_size` reached), each writing 13–20k buffers with 9–11 WAL files recycled. This is a
+self-sustaining loop: a checkpoint completes -> every subsequent write to a hot page emits a full-page
+image into WAL -> WAL fills `max_wal_size` in ~45 s -> next checkpoint -> repeat. The relay's hot rows
+(`relay_cells`, `relay_assignments`, activity leases, cell runtime) are updated tens of thousands of
+times a minute, so full-page-write amplification is large. Before 11:58 the 5-min timed checkpoints kept
+WAL well under the limit; a one-off larger checkpoint tipped it over and the disk's write ceiling keeps
+it there. Query Insights: io_time +30% in the 12:00 bucket, lock_time flat.
+
+**Owning workflow / mitigation (not applied):** raise the Cloud SQL data disk (PD-SSD IOPS and MB/s scale
+linearly with GB; 49 -> 200 GB roughly quadruples the ceiling, online, no restart) in the Terraform root
+that owns `google_sql_database_instance` for `orca-cloud-auth-db`, applied through that root's workflow.
+A second, flag-level lever is raising `max_wal_size` (default 1 GB) so timed checkpoints resume; that is
+also a Cloud SQL instance setting in the owning Terraform root. Per the standing rule, not applied from
+this session. Until then the fleet-wide 4–6 s stalls recur on
+every slow checkpoint sync, the old-image cells die on each one, and no 15-min gate window will exist.
+
+## Finding 11 (2026-09-04 12:55Z): **Cloud NAT port exhaustion** on the us-central1 cells is the second stall class
+
+`google_compute_router_nat.relay_gce` (us-central1, `AUTO_ONLY` IPs, no `min_ports_per_vm`, no dynamic
+port allocation, i.e. the default **64 ports per VM**). `router.googleapis.com/nat/port_usage` per VM
+hit **64 = the cap** in exactly the minutes the cells' Cloud SQL proxies logged `dial tcp
+35.188.82.89:3307: i/o timeout` (12:20–12:22, 12:41–12:43, 12:51–12:53), and
+`nat/dropped_sent_packets_count` went 0 -> 56/552/590, 82/272/133, 395/1565/1842 in those same minutes.
+Hourly: port_usage max was 25–50 all of Sep 3 and until 10Z today, 64 in 11Z and 12Z; dropped packets 0
+until 11Z (219), then 5,491 in 12Z. Open NAT connections rose 400–600 -> 815–874. Every cell's Cloud SQL
+traffic egresses through this NAT to the instance's public IP (the instance has no private IP:
+`ipv4Enabled=true`, `privateNetwork` unset). When a VM's 64 ports fill, new TCP SYNs to 3307 are dropped,
+the proxy's dial times out, and the relay pool's 2 s `connectionTimeoutMillis` fires: that is the exact
+2 s stall the old image dies on and the new director surfaces as a 500. The dial timeouts hit c7 and c8
+hardest because they carry the most controls and open the most DB connections.
+
+What raised port demand today: each old-image crash re-opens a full pool through fresh NAT ports, the
+autoheal recreates do the same, and the 55P03 retry storms keep more connections mid-transaction, so
+crashes and NAT exhaustion feed each other. This is why the afternoon accelerated even after the disk
+loop broke at 12:39.
+
+**Owning change (not applied):** `cloud/infra/terraform/relay-gce-foundation.tf`
+`google_compute_router_nat.relay_gce` (this repo): set `min_ports_per_vm = 1024` (or enable
+`enable_dynamic_port_allocation = true` with `max_ports_per_vm = 4096`) and, if needed, add manual NAT IPs
+(each IP supplies 64,512 ports across VMs). Online change, no VM restart. The durable fix is giving the
+Cloud SQL instance a **private IP** and pointing the proxy at `--private-ip`, which takes DB traffic off
+NAT entirely; that is a Cloud SQL instance change in the orca-cloud foundation root plus a startup-script
+flag here. Per the standing rule, not applied from this session.
+
+Direct proof: `resource.type="nat_gateway" AND jsonPayload.allocation_status="DROPPED"` shows **1,514
+dropped allocations to 35.188.82.89:3307** in 12:50–12:54 alone, every one of them the Cloud SQL public
+IP. The NAT has zero manual IPs (AUTO_ONLY) and no port settings in Terraform, so it is at Google's
+default 64 ports/VM. No workflow in this repo applies `relay-gce-foundation.tf` broadly (the roll
+workflows apply cell templates with `-target`), so the NAT change needs a targeted apply of
+`google_compute_router_nat.relay_gce`, which is an owner-run Terraform step.
+
+Original write-up of the symptom before the NAT correlation follows.
+
+The 12:50:30–12:50:50 stall (every cell 3.7–3.9 s SQL max, six old-image cells died) happened with
+checkpoints healthy (85 ms) and disk at 6 MB/s, so it is not Finding 10. The cells' Cloud SQL Auth Proxy
+logged `failed to connect to instance: dial error: dial tcp 35.188.82.89:3307: i/o timeout`. Count of
+those per hour today: 08Z 1, 11Z 15, **12Z 416**; all of Sep 3: 4. Cloud SQL `up`/backends/connections
+did not blip. So new TCP connections to the instance's public IP on 3307 are timing out from the cells'
+proxies in bursts, which is exactly the "2 s connect timeout" the old image dies on. Query Insights for
+12:49–12:54 attributes 1,380 s of lock wait to the placement CTE (`WITH assignment_state AS
+MATERIALIZED …`) and 469 s to the single-row reservation UPDATE: the lock queue is the *consequence* of
+connections stalling mid-transaction, not the cause. Not chased further; candidates are the proxy's
+connection churn under the crash loops (each recreated cell opens a fresh pool) and the instance's
+public-IP path. Relay code cannot fix this; it is Cloud SQL / network. Dial timeouts by minute today: 12:20 24, 12:21
+66, 12:41 22, 12:42 6, 12:51 160, 12:52 137, i.e. bursts of 20–160 s each, and they hit c7 (new image,
+89 today) and c8 (93) hardest, so it is not the old image's connection churn either. Cloud SQL `up`=1
+throughout. The proxy dials the instance's public IP `35.188.82.89:3307`; a burst of i/o timeouts to a
+healthy instance points at the path (public-IP egress / NAT / proxy connection limits), not at Postgres.
+That is the same 2 s that the old image dies on and that the new director surfaces as a 500.
+
+## Roll inputs (verified by the read-only `verify` run)
+
+**Image census from instance templates, 2026-09-04 21:45Z (authoritative, read from `gcloud compute
+instance-templates`):** 20 serving cells on `5aedbca5` (c8, c9, c10, c13–c16, c19–c29) — the image that exits
+the process on a Postgres connect timeout (Finding 6); c7 on `85bf6799`; c4, c5, c17, c18 (draining /
+migration-only) on `0e83408b` / `36a56b10`; c1, c2, c3, c6, c11, c12 (existing-only) on Jul/Aug images. Target
+for Roll 1 is `519f4914` (director already on it). Monitor dry-run dispatched 21:45Z as the roll gate; waves
+require owner go.
+
+
+- target-image-digest `sha256:519f4914217f08cabcdcd34825965db8473ec37c6591553a3af0d65dcdeeb183` (lock fix; supersedes 85bf6799 as target)
+- previous target `sha256:85bf67993869a769642995d0863f4c2b6b569c3850c2d8390ec2ca5f2b179e28` (c7 is on this; use as c7's rollback)
+- rollback-image-digest `sha256:5aedbca5c86de24c8b4d4bf7e3b444b76c712f281ede916cb9d90f70cad1e563`
+- target/rollback rehome protocol 1 / 1; expected-rehome-generation 12; selector generation **112** (110 before the c7 canary)
+- existing-only c1,c11,c12,c2,c3,c4,c5,c6; migration-only c17,c18; general c10,c13–c16,c19–c29,c7,c8,c9
+- confirmation for canary: `ROLL_RELAY_SAME_CAP <target-digest> production-gce-c7`
+- monitor evidence is single-use and must be < 5 min old at dispatch (plus 75 min per predecessor wave)
+- monitor dry-run dispatch (read-only, runs at `main` head so a merged bar change applies immediately):
+  `gh workflow run cloud-monitor-relay-production.yml --ref main -f mode=dry-run -f expected-selector-generation=110
+  -f expected-existing-only-cells=<existing-only list> -f expected-migration-only-cells=production-gce-c17,production-gce-c18
+  -f expected-general-cells=<general list> -f migration-policy=strict -f recovery-source-cell-id=none -f capacity-cell-id=none`
+
+## Queries that worked (copy-paste)
+
+- Cell metrics: `resource.type="gce_instance" AND jsonPayload.event="orca_relay_runtime_metrics"`
+- Container crashes: `resource.type="gce_instance" AND jsonPayload.MESSAGE:"container die" AND jsonPayload.MESSAGE:"relay@sha256"`
+- Crash banner: `resource.type="gce_instance" AND jsonPayload.message:"Node.js v24"`
+- Retries: `jsonPayload.event="orca_relay_postgres_transaction_retry"` (no resource filter to get both)
+- Director lines are `textPayload`; cell lines are `jsonPayload.message`
+- Cloud Run concurrency: Monitoring API `run.googleapis.com/container/max_request_concurrencies`
+- Dry-run final state: download artifact `relay-monitor-dry-run-<run>-<attempt>`, read `*.state.json` (the log's `schemaVersion` lines are only checkpoints, not the final verdict)
+
+## 2026-09-04 22:50Z onward: owner go received; driving the gates
+
+Owner: "sure, feel free to drive these." Sequence chosen: Roll 1 first (highest uplift), auth deploy with
+#478 second, pruner enable third, label drift resolved by matching Terraform to live state, #477 still held.
+
+| Step | Result |
+| --- | --- |
+| Monitor dry-run #19 (gen 112, strict) | **Passed** 23:07:53Z, run 33927238469 attempt 1. First green since the probe fix (#18723). 16 samples, no freeze. Dispatched 22:51:33Z after confirming: 0 `container die` in 3 h, director 5xx in the last 4 h were all 503s (excluded by the `director.errors` filter). |
+| c8 `canary-apply` onto 519f4914 (rollback 5aedbca5) | **Failed at 23:09:07Z before any mutation**: `relay monitor evidence provenance does not match` in `verify-authority`. Run 33928330631. Gate job passed, `cell_1 / rollout` failed on the manifest check, `seal_canary` skipped, lease released. Cause: the manifest binds `commitSha`; the dry-run ran at main `264c9ed8d2`, the canary dispatched at `--ref main` resolved to `4fab8e2f15` because unrelated PRs merged to main during the 15-minute gate. Verified no side effects: c8 MIG still on template `…c8-20260827…` (5aedbca5), stable, 25 controls; no `/v1/admin/drain` or isolate calls in the director log. |
+| Constraint learned | Both workflows must run at the **same main commit**. The production environment's deployment branch policy allows only `main`, and the job gates on `github.ref == 'refs/heads/main'`, so a pinned tag/branch is not an option. Any merge to stablyai/orca main during the 15-minute dry-run invalidates the evidence. Mitigation for the retry: dispatch the canary within seconds of the green, and do not merge anything to stablyai/orca main myself during the window. A durable fix (accept evidence whose commit is an ancestor with identical workflow/script content) is a follow-up, not a same-day change to a safety check. |
+| Label drift (5.x) | Resolved by dropping the `region` label from Terraform to match the 21 live metrics (stablyai/orca #18734, merged). Targeted plan asserted `27 no-op, 9 create, 0 destroy`; applied 23:11Z: 8 `orca_relay_control_*` renewal metrics that had never been applied, plus `google_monitoring_dashboard.relay_incident`. `orca_relay_controls` createTime unchanged (2026-07-13), label extractors unchanged. |
+| Pruner enable (1.2) | orca-cloud #479 merged: `auth_token_pruner_enabled = true`, image digest of `00031-tox`, `max_rows_per_run = 20000`. Targeted plan asserted 9 create / 0 change / 0 destroy (job, scheduler at `41 * * * *` UTC, two service accounts, five IAM grants). **Not yet applied**: waiting until the roll canary has landed so the first hourly run does not overlap a drain. |
+| Auth deploy with #478 (3.1) | Dispatched 23:13Z from orca-cloud main `f0fa4b5` (run 33928663526). Candidate startup adds nullable `successor_material` under a brief ACCESS EXCLUSIVE lock. |
+| Auth deploy result | **Succeeded** 23:15:37Z: `orca-cloud-auth-00035-gos` serving 100 %, cap 20 preserved, 0 5xx. `refresh_tokens.successor_material` present (nullable text); 298 sealed successors written in the first 15 min against 924 rotations; `session-refresh-reuse-detected` at baseline (5 / 15 min). Grace window is live. |
+| Monitor dry-run #20 | Froze 23:35:38Z on `runtime_power_unknown cell.production-gce-c11.powered`. Two window restarts earlier (23:24, 23:25) on `signal_stale auth.errors` (Cloud Monitoring publish lag 181–255 s vs 180 s bar). Cause: one transient rejection of the per-cell MIG GET in `readResourceInventory` yields `targetSize: null` → `runtimeKnown=false` → hard freeze. c11 is a parked existing-only cell (MIG size 0, stable) and was fine. Not fleet health. Fix delegated: stablyai/orca #18740 (retry the MIG read once, mirroring #18723). Run 33928912676. |
+| Monitor dry-run #21 | **Green** 23:54Z at main `8064d1f991`, but main had moved to `0a821e5bc8` during the window; the chain re-gated instead of dispatching (the canary would have failed provenance again). Run 33930229711. |
+| Monitor dry-run #22 | **Green** 00:10Z at `0a821e5bc8`; main moved to `2e80972450`. Re-gated. Run 33931177390. |
+| Monitor dry-run #23 | Froze 00:18:31Z on `cell.production-gce-c29.latency_ms` 2635 > 2000, the probe's own round-trip from a US runner to asia-east2; c29 controls 17→19 and `sqlLatencyMsMax` flat ~1050 through the minute, no crash, no checkpoint stall. c29 probe max was 0 in the three previous gates, so a one-off. Run 33932092775. |
+| Blocking constraint | Main receives unrelated merges every 5–10 min (23:08, 23:15, 23:17, 23:40, 23:42, …). A 15-min gate bound to an exact commit cannot be consumed under that traffic. Delegated a durable fix: `verify-authority` accepts evidence whose commit is an ancestor of the canary commit **and** has no diff on the monitor/deployer trusted paths; fails closed on shallow clones or unknown commits. Chain re-armed on dry-run #24 (run 33932679796) meanwhile. |
+| Monitor dry-run #24 | Froze 00:28:00Z on `director.instances` 4 < 5. Cloud Run active-instance count read 4 for exactly one minute (00:27), 5 in every other minute for 3 h; min/max scale is pinned at 5; no new revision. A routine single-instance recycle. Not fleet health. Bar `directorInstancesMin: 5` with `latest-sum` cannot tolerate that; recalibrate to 4 or use a 3-min window minimum (follow-up, not same-day). Run 33932679796. Chain dispatched #25 (run 33933193511) at `86cd327749`. |
+| Monitor dry-run #25 | **Green** 00:46Z at `86cd327749`; main moved to `8096cb2803`. Fourth green gate lost to unrelated main traffic (#19, #21, #22, #25). Run 33933193511. Chain's re-gate #26 (run 33934079533) cancelled by me. |
+| Fixes merged 00:55Z | stablyai/orca #18740 (MIG inventory read retried once before `runtime_power_unknown`; 2 tests) and #18754 (`verify-authority` and the batch canary authority accept evidence sealed at an **ancestor** commit when every trusted monitor/deployer path is byte-identical; fails closed on shallow clones and unknown commits; deploy/rehome jobs now check out with `fetch-depth: 0`; 5 new tests, 18/18 pass). Reviewed both diffs; trusted-path set verified to exist on main. |
+| Monitor dry-run #27 | Dispatched 00:56Z at `74ad08ec66` (first gate whose evidence the new rule can consume). Run 33934541092. Chain re-armed with the same ancestor + identical-trusted-code rule so an unrelated merge no longer forces a re-gate. |
+| Monitor dry-run #27 | **Green** 01:11:35Z at `74ad08ec66`; main had moved to `38bde20121` with identical trusted code, so the new rule (#18754) let the chain dispatch. Run 33934541092. |
+| c8 `canary-apply` #2 (run 33935407461) | Provenance check **passed** (first consumption of ancestor evidence). Isolate → gen 113, drain, template+MIG applied 01:14–01:22, new c8 came up on `519f4914` and `relay_capacity_transition_verified` (migration-only, image exact, heartbeat fresh) at 01:23:50. Then the step's next call, `curl --fail-with-body` to c8 `/v1/admin/runtime-status`, got a **503 with a 27-byte body** at 01:23:51 and the step exited 22. Director `cell-status` at 01:23:50.8 returned 200; c8's own logs show nothing at that second; c8 health/ready both 200 seconds later; backend HEALTHY (the health check had just flipped TIMEOUT→HEALTHY at 01:22:16 and UNKNOWN→HEALTHY at 01:23:47 as the new instance warmed). Read: a single 503 at the load-balancer/warm-up edge on a curl with no retry, on a cell that was already verified healthy one line earlier. Failsafe ran: c8 kept **migration-only**, rehome control disabled, selector gen 113. c8 is serving (40 controls at 01:39, sqlLatencyMsMax ~30 ms) on the target image, just not admitted for general traffic. Nothing to roll back. |
+| Recovery | The job has an explicit resume path: `mode=rollback` with `rollback-image-digest` = the image the cell already runs skips isolate/apply, verifies, and restores general admission (`ROLLBACK_RESUME=true`). Dispatched gate #28 (run 33936966508) at gen 113 with c8 in migration-only; on green the chain dispatches that resume for c8 with rollback digest `519f4914` and target `5aedbca5` (the validator only requires them to differ). |
+| Follow-up | The verify step's bare `curl --fail-with-body` needs the same "no reading is not a verdict" retry the monitor got (#18723/#18740); a 503 immediately after `verify-relay-capacity-transition` passed is not evidence of a bad cell. |
+| Monitor dry-run #28 | **Green** 01:58:59Z at gen 113 with c8 in migration-only. Run 33936966508. |
+| c8 recovery (run 33937756402, `mode=rollback`, rollback digest = 519f4914) | **Succeeded** 02:02Z. `ROLLBACK_RESUME=true` path: isolate/apply skipped, converged-Terraform check passed, verify passed (`relay_capacity_transition_verified` general, image `519f4914`, heartbeat fresh), activate → **gen 114**, c8 general. No restart, no drain. c8 at 43 controls, sqlLatencyMsMax 36 ms. **c8 is the second cell on 519f4914** (with c7 on 85bf6799). Because the recovery ran as `rollback`, `seal_canary` was skipped, so no canary authority exists for a `batch-apply`; the next cell runs as another `canary-apply`. |
+| Merged 02:05Z | stablyai/orca #18769: bounded retries on every admin-endpoint curl/fetch in the same-cap job and the rehome/canary/verify scripts (`--retry 3 --retry-delay 2 --retry-connrefused`, per-attempt bodies to a file; script helper 2 attempts on network error or 500/502/503/504 only; 4xx never retried; 650/650 tests). Trusted-path change, so the next gate runs at a commit containing it. |
+| Pruner enabled (1.2) | Terraform applied 02:06Z (8 creates, then the deploy-identity job IAM grant after a propagation 404, 9/9). Job `orca-cloud-auth-token-pruner`, image `343a0915…`, scheduler `41 * * * *` UTC, budget 20 000 rows/run. First run by hand (exec `sf5ct`): cold start 3m20s, then `stopReason: time-budget` at 480 s: 73 batches, 365 000 scanned, **1 040 deleted** (1 021 revoked, 19 expired, 0 rotated), ~6.4 s/batch of 5 000, `completedFullPass: false`. No errors, no lock-wait or checkpoint alert. Scan-bound, not budget-bound: at this pace a full pass over the table takes many hourly runs, and the row budget is never the limiter. Leave the budget alone; watch hourly runs for `stopReason` and a rising `deletedRows` as the cursor reaches the rotated backlog. |
+| Monitor dry-run #29 | **Green** 02:20:58Z at gen 114, main `e2b70a5eba` (contains #18740, #18754, #18769). Run 33938052374. |
+| c9 `canary-apply` (run 33938818286) | **Succeeded end to end** 02:21–02:34Z: isolate → gen 115, drain, template+MIG to `519f4914`, verify passed on the first try (retry-hardened step), trust proof, activate → **gen 116**, general. `seal_canary` **succeeded**: batch authority now exists. c9 at 38 controls, sqlLatencyMsMax 33 ms. No `container die` in 30 min. Three cells on new images (c7 `85bf6799`, c8 and c9 `519f4914`); 17 serving cells still on `5aedbca5`. |
+| Monitor dry-run #30 | Dispatched 02:36Z at gen 116 (run 33939533990). On green the chain dispatches **batch 1**: `batch-apply` c10,c13,c14,c15 bound to canary run 33938818286 (sealed at gen 116, same commit `e2b70a5eba`). Preflight: all four on `5aedbca5`, MIGs stable, no crash in 20 min. Sequential cells inside the job (wave-index 0..3), each with its own isolate/drain/apply/verify/restore, so ~12 min per cell, ~50 min total. |
+| Monitor dry-run #30 verdict | **Green** 02:52:15Z at gen 116, `e2b70a5eba`. |
+| Batch 1 (run 33940290163) | Dispatched 02:52:27Z: `batch-apply` c10,c13,c14,c15, canary authority run 33938818286, same commit. |
+| Batch 1 attempt 1 (run 33940290163) | **Failed at 02:54:39Z in the live preflight, before any mutation**: `relay live preflight failed: cloud-monitoring/signal_stale`. The step's `--retry-freshness` (5 attempts, 15 s apart, freshness-only codes) is passed only for `WAVE_INDEX != 0`; the first cell takes a single sample, so one Cloud Monitoring publish lag > 180 s at that instant fails the batch. Every candidate series was current again by the time I checked. c10 untouched (template `…c10-20260827…`, 47 controls), no selector write, gen still 116, failsafe no-op. Gate #31 dispatched 02:57Z (run 33940508865); chain re-dispatches the same batch (canary authority 33938818286 still valid: same gen 116, same commit). Fix delegated: wave 0 gets the same freshness retry. |
+| Monitor dry-run #31 | **Green** 03:13:26Z at gen 116; main at `cb7f7dd11a` with identical trusted code. Run 33940508865. |
+| Batch 1 attempt 2 (run 33941253533) | Dispatched 03:13:38Z: c10,c13,c14,c15, canary authority 33938818286. Runs at `cb7f7dd11a` (batch authority is accepted across the ancestor since trusted paths are unchanged). |
+| Merged 03:14Z | stablyai/orca #18778: `--retry-freshness` on every same-cap wave including the first, and the retry loop now stops before the next wait would push evidence past the wave's age bound (it was checked only at entry before). Twin carve-out in the capacity job filed as a follow-up. |
+| Batch 1 cell 1 (c10) | **Succeeded** 03:14–03:27Z (preflight, drain, apply, verify, restore). c13 started 03:27Z. |
+| Batch 1 cell 2 (c13) | **Succeeded** 03:27–03:38Z. c14 started 03:38Z. |
+| Batch 1 cell 3 (c14) | **Succeeded** 03:38–03:50Z. c15 started 03:50Z. |
+| Batch 1 complete (run 33941253533) | **All four succeeded** 03:13–04:00Z: c10, c13, c14, c15 on `519f4914`, selector **gen 124**. Fleet at 936 controls, 23 cells. Two `container die` at 03:35:41/44 were **c13's new container** exiting during boot (`applyPostgresSchema` → `Connection terminated due to connection timeout`, exit 1, 2 s runtime each) because the `cloud-sql-proxy` sidecar had not finished starting; the third start at 03:35:45 succeeded and c13 has been serving since (57 controls). A boot-order race in the container spec, not a serving-cell crash. Follow-up: schema pool should wait for the proxy socket, or the container should depend on the proxy's readiness. **8 cells on new images** (c7 85bf6799; c8, c9, c10, c13, c14, c15 519f4914), 12 on `5aedbca5`: c16, c19–c26 (US), c27–c29 (Asia). |
+| Monitor dry-run #32 | **Green** 04:19:50Z at gen 124, main `436ef827dd` (contains #18778). Run 33943539025. |
+| c16 `canary-apply` (run 33944255902) | Dispatched 04:20:02Z. On success it seals the authority for batch 2 (c19,c20,c21,c22). |
+| c16 canary (run 33944255902) | **Succeeded** 04:20–04:32Z, activate → gen 126, batch authority sealed. 9 cells on new images. |
+| Monitor dry-run #33 | Failed 04:58:56Z on `continuity_deadline_exceeded` (1 500 004 ms > 1 500 000 ms). One `signal_stale cloud_sql.lock_waits` at 04:46 (189 s vs 180 s bar, Cloud Monitoring publish lag) restarted the 15-min window at sample 12; the restart could not complete inside the 25-min continuity cap. No health failure at any sample; no `container die` since c16's own boot race at 04:30. Run 33944873727. Chain re-gates. Note for recalibration: `cloudDataMaxAgeMs: 180000` vs observed Cloud Monitoring publish lag of 181–255 s has now cost three gates (#20 twice, #33). |
+| Freshness recalibration | stablyai/orca #18798 (open, merge after batch 2 dispatch): `cloudDataMaxAgeMs` 180 s → 330 s, derived from Google's documented visibility delays (Cloud Run 60+120 s, Cloud SQL 60+165 s) and the 5-min window-sum query (a label series that stops emitting reads as up to 300 s old while its sum is complete, which is the 255 s `auth.errors` case) plus ~30 s collect latency. Director-admin and the lock-wait carry keep their own 180 s pins. A freshness-only failure may miss 2 consecutive samples without restarting the window; the sample still counts and is still threshold-checked; a 3rd miss, collector failure, runner gap, or any breach restarts/freezes as before. 92/92 tests. |
+| Monitor dry-run #34 | **Green** 05:17:31Z at gen 126, `436ef827dd`. Run 33946093029. |
+| Batch 2 (run 33946819345) | Dispatched 05:17:43Z: c19,c20,c21,c22, canary authority 33944255902 (c16). |
+| Merged 05:19Z | stablyai/orca #18798 (freshness bar 330 s + two-sample tolerance). Next gate runs at a commit containing it. |
+| Batch 2 cell 1 (c19) | **Succeeded** 05:19–05:32Z. c20 started. |
+| Batch 2 cell 2 (c20) | **Succeeded** 05:32–05:43Z. c21 started. |
+| Batch 2 cell 3 (c21) | **Succeeded** 05:43–05:59Z. c22 started. |
+| Batch 2 complete (run 33946819345) | **All four succeeded** 05:17–06:12Z: c19, c20, c21, c22 on `519f4914`, selector **gen 134**. Fleet at 1 090 controls, 23 cells, refresh 401s at baseline (1–4 per 3 min). One `container die` at 06:08:45 was **c22's new container** exiting during boot (exit 1, 2 s runtime; started 06:08:43, restarted 06:08:46 and serving since), the same proxy-sidecar boot race seen on c13 and c16. No serving-cell crash. **Census: 15 of 23 serving cells on new images** (c7 `85bf6799`; c8–c10, c13–c16, c19–c22 `519f4914`), 7 on `5aedbca5`: c23–c26 (US), c27–c29 (Asia). Next: gate at gen 134 → canary c23 → batch c24,c25,c26; then canary c27 → batch c28,c29. |
+| Monitor dry-run #35 | **Green** 06:32:01Z at gen 134, `b33d1972bc` (contains #18798, first gate at the 330 s freshness bar). Run 33949334606. |
+| c23 `canary-apply` (run 33950075843) | Dispatched 06:32:13Z at main `b0c67eaf88` (ancestor gate SHA, identical trusted code). On success it seals the authority for batch 3 (c24,c25,c26). |
+| c23 canary (run 33950075843) | **Succeeded** 06:32–06:46Z, activate → gen 136, batch authority sealed. No `container die` during boot. 16 of 23 serving cells on new images; 6 on `5aedbca5` (c24–c26 US, c27–c29 Asia). |
+| Monitor dry-run #36 | Dispatched 06:46Z at gen 136, run 33950746574 (`58553bfe1c`). On green the chain dispatches batch 3 (c24,c25,c26) under canary authority 33950075843. |
+| Monitor dry-run #36 result | **Green** 07:02:49Z at gen 136, `58553bfe1c`. |
+| Batch 3 (run 33951468008) | Dispatched 07:03Z: c24,c25,c26, canary authority 33950075843 (c23). |
+| Batch 3 cell 1 (c24) | **Succeeded** 07:04–07:18Z. c25 started. |
+| Batch 3 cell 2 (c25) | **Succeeded** 07:18–07:31Z. c26 started. |
+| Batch 3 complete (run 33951468008) | **All three succeeded** 07:03–07:44Z: c24, c25, c26 on `519f4914`, selector **gen 142**. Fleet at ~1 230 controls, 23 cells, refresh 401s at baseline. **Zero `container die`** during the batch (no boot race on c24–c26). **All 20 US serving cells now on new images** (c7 `85bf6799`; c8–c10, c13–c16, c19–c26 `519f4914`). Remaining on `5aedbca5`: c27, c28, c29 (asia-east2, probe hard cap 3000 ms). |
+| Monitor dry-run #37 | Dispatched 07:48Z at gen 142, run 33953555224 (`4c5077d57a`). On green the chain dispatches the c27 canary (first Asia cell). |
+| Monitor dry-run #37 result | **Green** 08:04:24Z at gen 142, `4c5077d57a`. |
+| c27 `canary-apply` (run 33954264945) | Dispatched 08:04Z, first Asia cell (asia-east2-a). On success it seals the authority for batch 4 (c28,c29). |
+| c27 canary (run 33954264945) | **Failed closed before any mutation** 08:07:25Z at "Verify exact current generation, digest, cap, and rollback point": `runtime predecessor mismatch fields=regionalRehomeProtocol`. **Operator input error, not a cell fault**: the chain script hardcoded `target-rehome-protocol=1 / rollback-rehome-protocol=1` for every cell, but `relay_region_rehome_source_cell_ids` lists only the 16 US cells (c7–c10, c13–c16, c19–c26), so the Asia startup template omits `ORCA_RELAY_REHOME_*` and c27–c29 report protocol 0 by design. `MUTATION_STARTED` never set, failsafe no-op, selector stays gen 142, c27 still serving on `5aedbca5`, no `container die`. Gate #37 evidence consumed. Fix: chain script now takes `PROTO`; Asia round dispatches with protocol 0 (the per-host trust proof step is protocol-gated and skips, as designed for non-source cells). Follow-up: the job already reads `relay_region_rehome_source_cell_ids`; it could derive the expected protocol from membership instead of trusting the operator input. |
+| Monitor dry-run #38 | Dispatched 08:12Z at gen 142, run 33954621425 (`e95d247be1`). On green the chain dispatches the c27 canary with protocol 0. |
+| Monitor dry-run #38 result | **Green** 08:28:36Z at gen 142, `e95d247be1`. |
+| c27 `canary-apply` #2 (run 33955359385) | Dispatched 08:28Z with `target/rollback-rehome-protocol=0`. |
+| c27 canary #2 (run 33955359385) | **Failed closed, no mutation** 08:31:19Z. Predecessor check passed with protocol 0; the isolate step then died at argument parsing: `production capacity target is not approved`. The same-cap job shells out to `prepare-relay-production-capacity-canary.mjs` for isolate/drain/activate, whose `PRODUCTION_CAPACITY_CELL_IDS` allowlist is the 16 US capacity cells (c7–c26), while the same-cap wave validator (`SAME_CAP_CELLS`) approves all 19 serving cells including c27–c29. The Asia cells have never been through this job (their Aug 14 rollout used the asia-topology workflow). Both the isolate step and the failsafe threw before any HTTP call, so `MUTATION_STARTED=true` was written but nothing was isolated: selector stays gen 142, c27 general and serving on `5aedbca5`, no `container die`. Gate #38 evidence consumed. Fix: stablyai/orca #18811 (`--approved-cells same-cap` on all four invocations, default unchanged for the US capacity job, census test over every `SAME_CAP_CELLS` member × isolate/drain/activate + the job's cell-shape bash block; 525/525 script tests). Sweep of the other job scripts found no further Asia blocker; gate #39 (run 33955668701) dispatched at gen 142 to prove the selector is unchanged before the next attempt. |
+| Monitor dry-run #39 | **Green** 08:51:28Z at gen 142: independent proof the selector was untouched by both failed c27 attempts. Not used for dispatch (its commit predates #18811). |
+| Merged 08:51Z | stablyai/orca #18811 → main `12e05203a4`. |
+| Monitor dry-run #40 | Dispatched 08:51Z at gen 142 on main `12e05203a4` (contains #18811), run 33956408337. On green the chain dispatches the c27 canary, protocol 0, third attempt. |
+| Monitor dry-run #40 result | **Green** 09:08:03Z at gen 142, `12e05203a4`. |
+| c27 `canary-apply` #3 (run 33957151726) | Dispatched 09:08Z, protocol 0, on main containing #18811. |
+| c27 canary #3 (run 33957151726) | **Failed after isolate; failsafe held** 09:17:21Z. Live check 09:26Z: c27 at 0 controls (drained), template still `…20260814235757`, c28/c29 absorbed the hosts (37 each), fleet 1 404 controls / 23 cells, refresh 401s baseline, no `container die` in 60 m. Predecessor check and allowlist passed; isolate → **gen 143** (c27 migration-only), drain sent (graceMs 0, hosts reconnected via director to c28/c29/US). Terraform plan built correctly (template replace + MIG update to `519f4914`), then `validate-relay-capacity-plan.mjs --mode same-cap-cell` rejected it: `cell plan does not contain the reviewed image and capacity`. Its same-cap rule demands exactly one `ORCA_RELAY_REHOME_DIRECTOR_SERVICE_ACCOUNT` and one `ORCA_RELAY_REHOME_AUDIENCE` printf in the startup script; Asia templates omit both because c27–c29 are not rehome sources (same root as attempt 1, third US-only assumption in the job). **No apply ran**: c27 template unchanged, still `5aedbca5`, isolated and draining (drain is one-way in-process; only a restart clears it). Failsafe re-asserted migration-only at gen 143 and rehome disabled. Recovery plan: fix validator (protocol-0 path: require the rehome lines *absent*), merge, gate at gen 143, then `mode=rollback` with rollback-image=`519f4914` (the failed-canary re-entry path; accepts draining + migration-only) to restart c27 onto the target image and restore it; then single-cell canaries for c28 and c29 (batch needs ≥2 cells). |
+| Plan-validator fix | stablyai/orca #18818 (merged 09:41Z → main `9f2a9a248e`): `validate-relay-capacity-plan.mjs --regional-rehome-protocol 0|1` in same-cap-cell mode; protocol 0 requires the rehome lines *absent*, protocol 1 unchanged; both plan-validation calls in the job pass `DESIRED_REHOME_PROTOCOL`; census test now validates a correct plan for every `SAME_CAP_CELLS` member at its tfvars-derived protocol. 529/529. Residual: the operator-supplied protocol is still unbound for Asia cells (no `SOURCE_CELLS` cross-check outside us-central1), so a wrong value fails late at plan validation rather than early; deriving it from membership is the checklist follow-up. |
+| Monitor dry-run #41 | Dispatched 09:42Z at gen 143 (c27 expected migration-only) on main `9f2a9a248e` (contains #18811 + #18818), run 33958728141. On green: c27 recovery via `mode=rollback`, rollback-image `519f4914`, protocol 0, confirmation `ROLL_BACK_RELAY_SAME_CAP`. |
+| Monitor dry-run #41 result | **Green** 09:58:51Z at gen 143, `9f2a9a248e`. |
+| c27 recovery #1 (run 33959789773, `mode=rollback`) | **Failed closed, no mutation** 10:09:21Z at `Verify monitor evidence provenance`: `relay monitor dry-run authority is incomplete or stale`. The dry-run authority is valid for 5 min after `completedAt` at wave 0 (`EVIDENCE_MAX_AGE_MS`); the gate completed 09:58:51Z but the operator poller (20 s `gh run view` loop) only observed completion at 10:07:09Z during a local network outage, so the dispatch landed at 10:07:11Z, 8 m 20 s after completion. Failed before the rollout lease, isolate, or any Terraform step; c27 unchanged (migration-only, drained, `5aedbca5`, gen 143). Every prior canary dispatched ≤15 s after gate green, so this is a dispatch-latency miss, not a job defect; the freshness bound behaved as designed. |
+| Monitor dry-run #42 | Dispatched 18:39Z at gen 143 on main `af82126058` (trusted paths byte-identical to `9f2a9a248e`), run 33984753269. Recovery script re-armed behind it (same `mode=rollback` onto `519f4914`, protocol 0). |
+| Monitor dry-run #42 result | **Green** 18:55:47Z at gen 143, `af82126058`. |
+| c27 recovery #2 (run 33985902062, `mode=rollback`) | **Failed closed, no mutation** 19:05:02Z, same `authority is incomplete or stale`. Dispatch landed 19:02:39Z, 6 m 52 s after the gate completed. Root cause of both misses is the operator laptop sleeping during the 15 min gate wait (`pmset -g log`: asleep 18:52:28Z → 19:02:17Z; the morning miss coincided with a sleep/dark-wake cycle too), so the 20 s poller never ran inside the 5 min window. Not a job or evidence defect: the freshness bound did its job. Operator fix: poller now runs under `caffeinate -i`. |
+| Monitor dry-run #43 | Dispatched 19:06Z at gen 143 on main `af82126058`, run 33986121849. Recovery armed behind it under `caffeinate`. |
+| Monitor dry-run #43 result | **Green** 19:22:53Z at gen 143, `af82126058`. |
+| c27 recovery #3 (run 33986948522, `mode=rollback`) | **Failed closed, no mutation** 19:25:48Z. Dispatched 13 s after gate green (authority accepted this time), then the live preflight recheck failed: `relay live preflight failed: active-probe/threshold_max`. That is the 2 000 ms `endpointLatencyMs` bar on one endpoint's slowest /health or /ready round trip from the runner (8 s fetch timeout, one retry). The error names no endpoint and the job log prints none; gate #43 had zero failures across 16 samples, so this was a transient probe slow-down in the ~3 min between gate and preflight. Live probe 19:32Z from the operator: director and auth ~130–190 ms, US cells ≤540 ms, Asia cells 690–1 315 ms (c28/c29 /health ~1.3 s, the closest to the bar; c27 ~0.9 s). Existing-only cells c1–c3, c6, c11, c12 return 503 on both paths as expected (unpowered). Failed before the rollout lease, isolate, or any Terraform step; c27 unchanged. Follow-up (checklist): preflight should print the failing signal and observed value. |
+| Monitor dry-run #44 | Dispatched 19:33Z at gen 143 on main `062db77118`, run 33987646501. Recovery re-armed behind it. |
+| Monitor dry-run #44 result | **Frozen red** 19:50:01Z after 13 samples: `active-probe/threshold_max cell.production-gce-c27.latency_ms observed=2568 threshold=2000`. No other failure, no continuity event, no `container die` fleet-wide in 60 m. `/health` is a static JSON reply (`app.ts`), so the slow round trip was `/ready` (the probe reports the max of the two) or the path to the cell. Cloud SQL logs for 19:49:38Z–19:51:58Z show six `could not obtain lock on row in relation "relay_cells"` errors and a time-triggered checkpoint completing at 19:50:36Z (write phase 270 s, the spread target, not a stall). c27 is drained with 0 controls, so its `/ready` dependency check was the only thing it was doing. Recovery script stopped as designed (no auto re-gate). Operator probe 19:53Z: c27 and c28 both bimodal, ~0.27 s or ~0.89 s per `/health` from the US, identical shape, nothing c27-specific. Attributing the one 2.6 s sample to the same shared-DB contention that produced the lock errors is the best available reading; the retry at gate #45 tests whether it recurs. |
+| Monitor dry-run #45 | Dispatched 19:53Z at gen 143 on main `062db77118`, run 33988383401. Recovery re-armed behind it. |
+| Monitor dry-run #45 result | **Frozen red** 19:54:47Z after 3 samples, same signal: `cell.production-gce-c27.latency_ms observed=2668 threshold=2000`. Two gates in a row now attribute a >2 s round trip to c27 while every other cell passes. |
+| c27 `/ready` tail analysis | `/health` is static; `/ready` (`relay-readiness.ts`) fetches the auth JWKS (2 s timeout) then runs `SELECT 1`, cached 10 s. Operator probes 19:57Z–20:00Z, 15 each from the US: c27 and c28 have the **same** tail (0.27 s / 0.88 s modes, then 1.3 s, then 2.17–2.27 s at the top); US cells c8/c20 sit at 0.08–0.18 s. Auth JWKS latency over the last hour: 400 requests, max 20 ms, none over 1 s. So the tail is cell→Cloud SQL (US) round trips plus the runner→Asia hop, not auth and not c27-specific; c27 is drained (0 controls) so nothing local competes. Cloud SQL `could not obtain lock on row in relation "relay_cells"` runs at 17–78 per 10 min all day (NOWAIT inventory locks, expected under placement bursts) with no spike in the failing minutes. The bar (`endpointLatencyMs` 2 000 ms, one shot per minute, max of two paths) leaves Asia cells ~10% of samples from tripping; the gate got unlucky twice on c27 and lucky on c28/c29. Not a health finding. |
+| Monitor dry-run #46 | Dispatched 20:01Z at gen 143 on main `062db77118`, run 33988810139. Recovery re-armed behind it. If this also freezes on an Asia probe, the next move is a per-region latency bar (or p50 over the window) in `incident-monitor.ts`, reviewed and merged before further Asia gates rather than retrying blindly. |
+| Monitor dry-run #46 result | **Frozen red** 20:07:44Z after 7 samples, third time on `cell.production-gce-c27.latency_ms` (observed 2 685). Operator 40-sample `/ready` probe per Asia cell at 20:10Z: c27 p50 0.88 s / p90 2.15 s / max 2.26 s / 6 over 2 s; c28 p50 0.88 / p90 1.25 / max 2.25 / 1 over; c29 p50 0.88 / p90 0.89 / max 1.27 / 0 over. All 200. `/ready` (`relay-readiness.ts`) fetches the auth JWKS in us-central1 then `SELECT 1` on Cloud SQL in us-central1, so an Asia cell's readiness is two trans-Pacific hops plus the runner→Asia hop; the fleet-wide 2 000 ms bar was calibrated on US cells (0.08–0.5 s). c27 being drained and idle has no local load, so this is path latency, not health. **Stopped retrying gates.** Fix in flight: per-region `cell.<id>.latency_ms` bar (us-central1 stays 2 000, asia-east2 4 000; hard faults still caught by the health/ready equal-1 checks and the 8 s probe timeout) plus attributable preflight failure messages, via review + CI before the next Asia gate. |
+| Merged 20:33Z | stablyai/orca #18877 → main `a3c1d32995`: per-region `cellEndpointLatencyMs` (us-central1 2 000, asia-east2 4 000; director/auth rules and the `endpointLatencyMs` key unchanged), region carried from tfvars onto every cell expectation, preflight failures now print `source/code signal observed= threshold=`. relay-ops 95/95, cloud suite 633 + 529 + 148 green. |
+| Monitor dry-run #47 | Dispatched 20:34Z at gen 143 on main `a3c1d32995` (first gate with the per-region bar), run 33989896150. Recovery re-armed behind it. |
+| Monitor dry-run #47 result | **Green** 20:38:09Z at gen 143 on `a3c1d32995`: first gate under the per-region bar, 16/16 samples, no Asia latency failure. |
+| c27 recovery #4 (run 33990715317, `mode=rollback`) | **Success** 20:51Z. Dispatched 13 s after gate green. Isolate re-asserted migration-only at gen 143 (already isolated, no change), Terraform applied the same-cap template `…20260905204141` and the MIG replaced the instance, new incarnation on `519f4914`, protocol 0, transition verifier passed at migration-only (1 180 assignments carried, hard cap 3 000, heartbeat fresh), then activate → **gen 144**, c27 general, verifier passed again. No `container die` fleet-wide 19:55Z–20:52Z. c27 now runs the target image; c28/c29 remain on `5aedbca5` (template `…20260814235757`). |
+| Monitor dry-run #48 | Dispatched 20:53Z at gen 144 (c27 back in general, MIG = c17,c18) on main `61ebffa86e` (trusted paths identical to `a3c1d32995`), run 33991385880. On green the chain dispatches the c28 `canary-apply`, protocol 0. |
+| Monitor dry-run #48 result | **Green** 21:08Z at gen 144, 16/16 samples, no Asia latency failure. Main had moved to `5cec2c2dfc`; the chain verified the trusted paths were identical to the gate commit and dispatched 12 s after green. |
+| c28 canary (run 33992169289, `canary-apply`) | **Success** 21:27Z. Isolate → migration-only at **gen 145**, drain already clear, verifier passed on the old image (1 220 assignments carried, hard cap 3 000, heartbeat fresh), Terraform applied same-cap template `…20260905211352`, new incarnation on `519f4914` at protocol 0, verifier passed again at migration-only, activate → **gen 146**, c28 general, verifier passed (1 219 assignments). Seal step recorded the canary. No `container die` fleet-wide 21:08Z–21:30Z. Only c29 remains on `5aedbca5`. |
+| Monitor dry-run #49 | Dispatched 21:33Z at gen 146 (c28 back in general, MIG = c17,c18) on main `dce5ebd83d` (trusted paths identical to `a3c1d32995`), run 33993075948. On green the chain dispatches the c29 `canary-apply`, protocol 0, the last Roll 1 cell. |
+| Monitor dry-run #49 result | **Frozen red** 21:52:24Z, `active-probe/continuity_deadline_exceeded observed=1500005 threshold=1500000`. One continuity event at 21:41:27Z, `cloud-monitoring/collector_failed` (a Cloud Monitoring read failed, not tolerated), which reset the continuous window at sample 14; the restarted window reached 10 samples before the 25-minute lineage cap (`INCIDENT_PRE_DRAIN_MAX_LINEAGE_MS`) expired. No health failure in any of the 25 samples, no Asia latency failure, no `container die`. Monitor-side transient, not a fleet finding. The chain re-gated automatically after its 2-minute back-off. |
+| Monitor dry-run #50 | Dispatched 21:54Z at gen 146 on main `51eed5a1bc`, run 33994385666. **Green** 22:10Z, 16/16 samples. Main had moved to `d7767fb196`; trusted paths identical to `a3c1d32995`. Chain dispatched the c29 `canary-apply` (run 33995164002, protocol 0) 12 s after green. |
+| c29 canary (run 33995164002, `canary-apply`) | **Success** 22:27Z. Isolate → migration-only at **gen 147**, verifier passed on the old image (1 199 assignments), Terraform applied same-cap template `…20260905221622`, new incarnation on `519f4914` at protocol 0, verifier passed at migration-only, activate → **gen 148**, c29 general, verifier passed (1 199 assignments carried). No `container die` fleet-wide 22:11Z–22:30Z. |
+| **Roll 1 complete** | Image census 22:30Z from MIG templates: c8–c10, c13–c16, c19–c29 on `519f4914` (18 cells); c7 on `85bf6799` (the earlier rehearsal image, carries the same fix); existing-only c1–c6, c11, c12 and migration-only c17, c18 untouched by design. No serving cell remains on `5aedbca5`. Selector gen 148, membership unchanged from the start of the roll. Zero relay container exits fleet-wide across the roll (01:14Z–22:30Z). Gates used: #19–#50; freezes were all monitor-side (provenance, freshness, flat Asia latency bar, one Cloud Monitoring collector failure), none a fleet health finding. Roll 2 (fresh image with #18722 + #18720) is the next data-plane step and waits on the owner's private-IP window decision. |
+
+## Roll 2 (image `4916ed67`, 2026-09-06)
+
+| Step | Result | Evidence |
+|---|---|---|
+| Docs split | #18958 merged `3bb038a185` (findings, checklist, roadmap, Roll 2 plan). | |
+| Code PR | #18959 merged `61b09b7a02` (rebase of #18565 onto main; desktop rotation change dropped since #18719 shipped a proportional version). Two Opus review rounds: round 1 caught the mobile fail-fast rejecting on any socket close (one AP flap would book the 60 s cooldown) → 2 s grace, re-armed once on `handshaking`; round 2 caught a removed jitter assertion that let a one-sided jitter pass → exact pin on the top of the band. Control lease 55 min → 6 h ± 30 min. | |
+| Image publish | run 34002233801 → `sha256:4916ed676d8389f694a648e750f1112d9002d68c84a1e0c7af828d5af129de62`; mirrored to staging (run 34002326150). | |
+| Staging cell smoke | **Dropped.** Staging C4 is pinned to the Asia launch digest by `relay-staging-c4-refresh-workflow.test.mjs` (with production c27–c29 tfvars and the C4 recovery workflow) and the only C4 image-refresh path pins its accepted predecessor to an older digest. Re-pinning all of it for a smoke widens into the Asia launch machinery; #18969 closed. Roll 2 follows the Roll 1 path: director first, c7 as the rehearsal cell. | |
+| Director deploy | run 34002673626 **success** 01:02Z: serving `orca-cloud-relay-00575-leq` on `4916ed67`, `00574-wag` (same image) tagged `selector-rollback`, `00569-ret` (`519f4914`) still deployable. Baseline before: 1 director Postgres retry in the prior hour, 0 `container die`. | |
+| c7 `verify` (read-only) | run 34002885408 dispatched 01:03Z, target `4916ed67`, rollback `85bf6799`, protocol 1, gen 148. | |
diff --git a/cloud/docs/relay-roll2-plan-2026-09.md b/cloud/docs/relay-roll2-plan-2026-09.md
new file mode 100644
index 00000000000..f84de39163f
--- /dev/null
+++ b/cloud/docs/relay-roll2-plan-2026-09.md
@@ -0,0 +1,154 @@
+# Relay Roll 2 and close-out plan (2026-09-05)
+
+Owner-approved scope 2026-09-05: finish the relay reliability work with one more cell image roll,
+deferring the Cloud SQL private-IP move (2.1, orca-cloud #477) to a separate owner decision. Roll 1
+is complete (see `relay-reconnect-2026-09-findings.md`, "Roll 1 complete"); every serving cell runs
+`519f4914` except c7 on `85bf6799`.
+
+Estimate: about two working days of effort over one week of calendar time. The cell roll itself is
+6 to 7 hours of mostly unattended wall clock, run in the US night.
+
+## Phase 0. Land the code (half a day, no production change)
+
+### 0a. Split PR #18565
+
+The branch mixes three relay/mobile/desktop fixes with the operator record. Split so the record
+lands regardless of how the code review goes.
+
+- **Docs PR** (new branch off main): `relay-reconnect-2026-09-findings.md`,
+  `relay-improvement-checklist-2026-09.md`, `relay-improvement-roadmap-2026-09.md`, this file.
+  Docs only, merge on CI green.
+- **Code PR** (rebase #18565 onto main, resolve two conflicts):
+  - `cloud/apps/relay/src/host-session-registry.ts`: conflict with #18698 (signed-out signal).
+    Keep both; the accept-abandonment and lease changes are orthogonal to the signed-out path.
+  - `src/main/runtime/relay/relay-origin-pool.ts`: **drop this branch's version**. #18719 already
+    merged the desktop early-window jitter (1 to 6 min). Also drop
+    `relay-session-broker.test.ts` additions that only exercise the dropped change.
+  - Keep: relay accept abandonment (`orca_relay_client_accept_abandoned` event), relay-side lease
+    jitter, mobile direct-probe fail-fast, and their tests.
+
+### 0b. Lengthen the control lease (same code PR)
+
+In `cloud/apps/relay/src/host-session-registry.ts`:
+
+```
+CONTROL_LEASE_MS        = 6 * 60 * 60 * 1000   // was 55 min
+CONTROL_LEASE_JITTER_MS = 30 * 60 * 1000       // was 5 min
+```
+
+Why 6 h: the lease bounds how long a host stays on a cell after a missed drain and is the only
+passive rebalancing; 6 h keeps both and cuts control-activation traffic on the inventory lock by
+about 6x. Nothing else depends on it: the relay JWT (5 min) is refreshed by the desktop on its own
+schedule and liveness is the 75 s silence watchdog. Wire-safe: the relay sends `leaseExpiresAt` in
+the hello ack and old desktops schedule from that value.
+
+Update the comment above the constants and the three assertions in
+`host-session-client-accept.test.ts` that pin the lease arithmetic. Check that nothing in
+`cloud/apps/relay-ops` or the monitor thresholds assumes a 55 min rotation period (grep
+`55`, `CONTROL_LEASE`, `rotation`).
+
+### 0c. Review and merge
+
+Review rounds per the standing process (Opus review, then Codex pass). Merge order: docs PR first
+(no dependency), then the code PR. Record the merge SHA of the code PR; that is the Roll 2 image
+source.
+
+## Phase 1. Build and stage the image (half a day)
+
+Roll 2 image = code PR merge SHA. It carries, relative to `519f4914`:
+
+| Change | PR | Effect |
+|---|---|---|
+| Per-cell inventory locks, delta counters | #18722 | Removes the global `relay_cells FOR UPDATE` behind the phone accept hang |
+| Relay pool `statement_timeout` 5 s | #18722 | A relay query can no longer hang a cell |
+| Accept abandonment | #18565 | Cell stops finishing accepts for phones that already closed |
+| Control lease 6 h ± 30 min | #18565 | Fewer, spread-out rebinds |
+| `--private-ip` proxy flag support | #18720 | Code only; flag stays unset until 2.1 |
+
+Steps, in order (from the findings doc's post-merge dispatch plan):
+
+1. `gh workflow run cloud-publish-relay-production.yml --ref main -f mode=publish`. Resolve the
+   digest by tag, not from the log:
+   `gcloud artifacts docker images describe us-central1-docker.pkg.dev/onorca-cloud/orca-cloud/relay:sha-<merge-sha> --format='value(image_summary.digest)'`.
+2. Staging: `cloud-deploy-relay-staging.yml` with the new digest; paired phone plus desktop smoke
+   (connect, background, reconnect). Confirm `orca_relay_client_accept_abandoned` appears only when
+   a client closes early, and that `sqlLatencyMsMax` no longer pins at the lock timeout.
+3. Director: `cloud-deploy-relay-production-director.yml -f image-digest=<new>
+   -f regional-placement-mode=preserve -f prune-incompatible-revisions=false
+   -f expected-rehome-generation=12 -f bootstrap-runtime-identity=false
+   -f predecessor-image-digest=<serving digest>`. Blue/green; prior revision stays as rollback.
+   Watch director `orca_relay_postgres_transaction_retry` per minute before and after. The director
+   goes first so the per-cell locks are live before any cell restart burst.
+4. Same-cap `verify` mode against c7 with target=<new>, rollback=`519f4914`. Read-only.
+
+Go/no-go for Phase 2: director serving the new image for at least 30 min, retries per minute at or
+below the pre-deploy baseline, no `container die`, no auth 5xx.
+
+## Phase 2. Roll the cells (one US night, mostly unattended)
+
+Same machinery as Roll 1: `cloud-monitor-relay-production.yml` dry-run gate, then
+`cloud-deploy-relay-production-same-cap.yml`. Cells roll one at a time by design (exact selector
+assertions, single Terraform state, and one cell's ~1.2k-host reconnect burst per restart). Do not
+add parallelism for this roll.
+
+Inputs: target=<new digest>, rollback=`519f4914` (c7: rollback=`85bf6799`). Selector membership is
+unchanged from the end of Roll 1 (gen 148; existing-only c1–c6, c11, c12; migration-only c17, c18).
+
+Order:
+
+1. **c7 canary** (`canary-apply`, protocol 1). c7 is the rehearsal cell and the only one not on
+   `519f4914`.
+2. **c8 canary**, then **batch c9, c10, c13, c14**.
+3. **c15 canary**, then **batch c16, c19, c20, c21**.
+4. **c22 canary**, then **batch c23, c24, c25, c26**.
+5. **Asia c27, c28, c29** as three single canaries at protocol 0 (`PROTO=0`). Batch mode cannot
+   take Asia cells yet and needs at least two cells.
+
+Each batch needs a same-commit canary authority; each wave needs a fresh 15 min gate. Use the
+chain script pattern from Roll 1 (wait gate green, check trusted-path ancestry, dispatch within 5 min,
+log `CANARY <run> <status>`) under `caffeinate -i`. Budget: 11 to 13 min per cell plus 15 min per gate,
+about 6 to 7 h total.
+
+Per wave checks (same as Roll 1): transition verifier passes at migration-only and again at general
+with assignments carried; no `container die` fleet-wide; selector generation advances by exactly 2
+per cell. After the Asia cells: image census from MIG templates; every general cell on the new digest.
+
+Failure handling: a failed canary re-enters through `mode=rollback` with rollback-digest = desired
+image (Roll 1 c27 pattern). A gate freeze on an Asia latency probe despite the 4 000 ms bar is a
+stop-and-investigate, not a retry. Monitor-side freezes (freshness, continuity deadline) re-gate
+after a 2 min back-off; the chain does this on its own.
+
+Record every gate and wave in the findings doc as in Roll 1.
+
+## Phase 3. After the roll (spread over the following week)
+
+- **4.4 Recalibrate the retries bar.** After one week of `orca_relay_postgres_transaction_retry`
+  on the new image, re-derive the `postgres_retries` monitor threshold from the new baseline
+  (PR against `cloud/apps/relay-ops/src/incident-monitor.ts` thresholds). About 2 h.
+- **1.2 Pruner budget.** Raise `auth_token_pruner_max_rows_per_run` to the default 200k after a
+  clean day; watch Cloud SQL write MB/s and the checkpoint alert. Then **1.5** log metric plus
+  policy on `stopReason != complete`.
+- **1.3 Reclaim.** Once pruner runs delete ~0 rows: `pg_repack -t refresh_tokens` off-peak (check
+  `pg_available_extensions` first; not `VACUUM FULL`). Confirm table, index, and `disk/utilization`
+  dropped.
+- **Monitor residuals** already in the checklist: `probeEndpointHealth` retry decision still uses the
+  flat 2 000 ms bar; operator protocol unbound for Asia; `probe-relay-rehome-trust` regex.
+- Update the checklist status header; tick 2.3, 4.1, 4.3 relay-side as deployed.
+
+## Deferred, owner decision required
+
+- **2.1 Private IP** (orca-cloud #477). One-way door with a Cloud SQL restart. When chosen: apply the
+  foundation off-peak, then a template-only change that sets the `--private-ip` proxy flag. That is
+  another cell roll unless bundled with a future image.
+- **5.2 Paging channel** for auth alerts: needs a destination.
+- **Parallel cell rolls** (2 or 3 at a time): about 1.5 days (relax exact-selector assertions to
+  "exact except in-flight", single coordinator Terraform apply, parallel job shape, tests). Only
+  worth building if more image rolls are planned after Roll 2, and only once the per-cell locks are
+  live so a multi-cell reconnect burst is safe.
+- **2.2 Database split**: deferred to ~2026-11-01.
+
+## Not in this plan
+
+Desktop and mobile changes already merged (#18719 desktop early-window jitter and no same-token
+refresh retry; #18565 mobile fail-fast once merged) ship with the next desktop and mobile releases
+on their own schedules. No relay action needed.
diff --git a/cloud/infra/terraform/relay-gce-cells.tf b/cloud/infra/terraform/relay-gce-cells.tf
index d6b7f3351f9..a4505ba2e37 100644
--- a/cloud/infra/terraform/relay-gce-cells.tf
+++ b/cloud/infra/terraform/relay-gce-cells.tf
@@ -242,6 +242,7 @@ resource "google_compute_instance_template" "relay_gce_cell" {
     artifact_registry_host          = "${var.region}-docker.pkg.dev"
     relay_image                     = each.value.image
     cloud_sql_proxy_image           = var.relay_gce_cloud_sql_proxy_image
+    cloud_sql_private_ip            = var.relay_cloud_sql_private_ip
     # Keep cell-only plans independent from unrelated database configuration drift.
     cloud_sql_connection_name = local.relay_database_connection_name
   })
diff --git a/cloud/infra/terraform/relay-gce-foundation.tf b/cloud/infra/terraform/relay-gce-foundation.tf
index aab3b4579eb..a8d64b3fcea 100644
--- a/cloud/infra/terraform/relay-gce-foundation.tf
+++ b/cloud/infra/terraform/relay-gce-foundation.tf
@@ -42,6 +42,12 @@ resource "google_compute_router_nat" "relay_gce" {
   router                             = google_compute_router.relay_gce[0].name
   nat_ip_allocate_option             = "AUTO_ONLY"
   source_subnetwork_ip_ranges_to_nat = "LIST_OF_SUBNETWORKS"
+  # Cells reach Cloud SQL's public IP through this NAT. The static default of 64 ports per VM
+  # filled during the 2026-09-04 incident and every cell's proxy dial timed out at once.
+  enable_dynamic_port_allocation      = true
+  enable_endpoint_independent_mapping = false
+  min_ports_per_vm                    = 64
+  max_ports_per_vm                    = 4096
 
   subnetwork {
     name                    = google_compute_subnetwork.relay_gce[0].id
@@ -85,6 +91,12 @@ resource "google_compute_router_nat" "relay_gce_additional" {
   router                             = google_compute_router.relay_gce_additional[each.key].name
   nat_ip_allocate_option             = "AUTO_ONLY"
   source_subnetwork_ip_ranges_to_nat = "LIST_OF_SUBNETWORKS"
+  # Cells reach Cloud SQL's public IP through this NAT. The static default of 64 ports per VM
+  # filled during the 2026-09-04 incident and every cell's proxy dial timed out at once.
+  enable_dynamic_port_allocation      = true
+  enable_endpoint_independent_mapping = false
+  min_ports_per_vm                    = 64
+  max_ports_per_vm                    = 4096
 
   subnetwork {
     name                    = google_compute_subnetwork.relay_gce_additional[each.key].id
diff --git a/cloud/infra/terraform/relay-gce-startup.sh.tftpl b/cloud/infra/terraform/relay-gce-startup.sh.tftpl
index f593d94e9e5..a77466f2169 100644
--- a/cloud/infra/terraform/relay-gce-startup.sh.tftpl
+++ b/cloud/infra/terraform/relay-gce-startup.sh.tftpl
@@ -109,6 +109,9 @@ docker run --detach \
   --user 0:0 \
   --volume "$${cloudsql_dir}:/cloudsql" \
   '${cloud_sql_proxy_image}' \
+%{ if cloud_sql_private_ip ~}
+  --private-ip \
+%{ endif ~}
   --unix-socket=/cloudsql \
   '${cloud_sql_connection_name}'
 
diff --git a/cloud/infra/terraform/relay-observability.tf b/cloud/infra/terraform/relay-observability.tf
index a8fa4276eb2..6bc938100c6 100644
--- a/cloud/infra/terraform/relay-observability.tf
+++ b/cloud/infra/terraform/relay-observability.tf
@@ -37,6 +37,16 @@ locals {
       description = "Relay PostgreSQL transactions that exhausted bounded retry."
       filter      = "((resource.type=\"cloud_run_revision\" AND (${local.relay_service_log_filter})) OR resource.type=\"gce_instance\") AND jsonPayload.event=\"orca_relay_postgres_transaction_exhausted\""
     }
+    cell_process_exit = {
+      # The docker event stream is the only per-exit line: the relay's own crash footer only
+      # appears for unhandled rejections, and `container start` also counts healthy first boots.
+      description = "Relay cell container exits, one Docker `container die` event per process exit."
+      filter      = "resource.type=\"gce_instance\" AND logName=\"projects/${var.project_id}/logs/cos_system\" AND jsonPayload.SYSLOG_IDENTIFIER=\"docker\" AND jsonPayload.MESSAGE:\"container die\" AND jsonPayload.MESSAGE:\"name=orca-relay)\""
+    }
+    cloud_sql_wal_checkpoint = {
+      description = "Cloud SQL checkpoints triggered by WAL volume instead of the timed schedule; a sustained run is the fsync loop that stalled every relay process at once on 2026-09-04."
+      filter      = "resource.type=\"cloudsql_database\" AND resource.labels.database_id=\"${var.project_id}:${local.relay_database_instance_name}\" AND textPayload:\"checkpoint starting: wal\""
+    }
   }
 
   relay_runtime_metrics = {
@@ -201,7 +211,8 @@ resource "google_logging_metric" "relay_snapshot" {
   label_extractors = {
     role    = "EXTRACT(jsonPayload.role)"
     cell_id = "EXTRACT(jsonPayload.cellId)"
-    region  = "EXTRACT(jsonPayload.region)"
+    # No region label: adding one replaces all 21 live metrics (label change = delete+create),
+    # which resets history and blanks the relay alert policies during the swap.
   }
 
   metric_descriptor {
@@ -220,12 +231,6 @@ resource "google_logging_metric" "relay_snapshot" {
       value_type  = "STRING"
       description = "Durable relay cell identifier."
     }
-
-    labels {
-      key         = "region"
-      value_type  = "STRING"
-      description = "Coarse Relay region."
-    }
   }
 
   bucket_options {
@@ -523,3 +528,280 @@ resource "google_monitoring_alert_policy" "relay_cloud_sql_backends" {
     mime_type = "text/markdown"
   }
 }
+
+resource "google_monitoring_alert_policy" "relay_cloud_sql_checkpoint_loop" {
+  project               = var.project_id
+  display_name          = "Orca Relay: Cloud SQL checkpoint loop"
+  combiner              = "OR"
+  enabled               = true
+  notification_channels = var.relay_alert_notification_channels
+
+  conditions {
+    display_name = "WAL-triggered checkpoints above 3 in 5 minutes"
+
+    condition_threshold {
+      filter          = "resource.type=\"cloudsql_database\" AND metric.type=\"logging.googleapis.com/user/orca_relay_cloud_sql_wal_checkpoint\""
+      comparison      = "COMPARISON_GT"
+      threshold_value = 3
+      duration        = "300s"
+
+      aggregations {
+        alignment_period     = "300s"
+        per_series_aligner   = "ALIGN_SUM"
+        cross_series_reducer = "REDUCE_SUM"
+      }
+
+      trigger {
+        count = 1
+      }
+    }
+  }
+
+  documentation {
+    content   = "Healthy operation is one timed checkpoint every 5 minutes. Repeated `checkpoint starting: wal` lines mean WAL is outrunning `max_wal_size` and every checkpoint fsync stalls all relay SQL for seconds. Check `checkpoint complete` sync= times and disk write throughput against the PD-SSD ceiling; the fix is disk size and `max_wal_size` in the Terraform root that owns the instance (orca-cloud `infra/terraform-foundation`)."
+    mime_type = "text/markdown"
+  }
+
+  depends_on = [google_logging_metric.relay_incident]
+}
+
+resource "google_monitoring_alert_policy" "relay_cloud_sql_disk" {
+  project               = var.project_id
+  display_name          = "Orca Relay: Cloud SQL disk utilization"
+  combiner              = "OR"
+  enabled               = true
+  notification_channels = var.relay_alert_notification_channels
+
+  conditions {
+    display_name = "Cloud SQL disk above 70%"
+
+    condition_threshold {
+      filter          = "resource.type=\"cloudsql_database\" AND resource.label.\"database_id\"=\"${var.project_id}:${local.relay_database_instance_name}\" AND metric.type=\"cloudsql.googleapis.com/database/disk/utilization\""
+      comparison      = "COMPARISON_GT"
+      threshold_value = 0.7
+      duration        = "600s"
+
+      aggregations {
+        alignment_period   = "300s"
+        per_series_aligner = "ALIGN_MAX"
+      }
+
+      trigger {
+        count = 1
+      }
+    }
+  }
+
+  documentation {
+    content   = "The shared auth/relay Cloud SQL disk is filling. `refresh_tokens` is the largest table and grows without pruning; grow the disk (IOPS scale with size) before it reaches the WAL checkpoint loop, and prune revoked token rows."
+    mime_type = "text/markdown"
+  }
+}
+
+resource "google_monitoring_alert_policy" "relay_cloud_nat_port_drops" {
+  count = local.relay_gce_configured ? 1 : 0
+
+  project               = var.project_id
+  display_name          = "Orca Relay: Cloud NAT port exhaustion"
+  combiner              = "OR"
+  enabled               = true
+  notification_channels = var.relay_alert_notification_channels
+
+  conditions {
+    display_name = "NAT packets dropped for lack of ports"
+
+    condition_threshold {
+      filter          = "resource.type=\"nat_gateway\" AND resource.label.\"gateway_name\"=monitoring.regex.full_match(\"${local.relay_gce_name}(-.*)?\") AND metric.type=\"router.googleapis.com/nat/dropped_sent_packets_count\" AND metric.label.\"reason\"=\"OUT_OF_RESOURCES\""
+      comparison      = "COMPARISON_GT"
+      threshold_value = 0
+      duration        = "120s"
+
+      aggregations {
+        alignment_period     = "60s"
+        per_series_aligner   = "ALIGN_SUM"
+        cross_series_reducer = "REDUCE_SUM"
+        group_by_fields      = ["resource.label.\"gateway_name\""]
+      }
+
+      trigger {
+        count = 1
+      }
+    }
+  }
+
+  documentation {
+    content   = "Relay cells reach Cloud SQL's public IP through this NAT. Port exhaustion makes every cell's Cloud SQL Auth Proxy dial time out at once, which reads as a fleet-wide SQL stall with a healthy database. Check `nat/port_usage` per VM and raise `max_ports_per_vm` in `relay-gce-foundation.tf`, or move the database to a private IP."
+    mime_type = "text/markdown"
+  }
+}
+
+resource "google_monitoring_alert_policy" "relay_cell_process_exit" {
+  project               = var.project_id
+  display_name          = "Orca Relay: cell process exits"
+  combiner              = "OR"
+  enabled               = true
+  notification_channels = var.relay_alert_notification_channels
+
+  conditions {
+    display_name = "Cell container exits above 3 in 15 minutes"
+
+    condition_threshold {
+      filter          = "resource.type=\"gce_instance\" AND metric.type=\"logging.googleapis.com/user/orca_relay_cell_process_exit\""
+      comparison      = "COMPARISON_GT"
+      threshold_value = 3
+      duration        = "0s"
+
+      aggregations {
+        alignment_period     = "900s"
+        per_series_aligner   = "ALIGN_SUM"
+        cross_series_reducer = "REDUCE_SUM"
+        group_by_fields      = ["resource.label.\"instance_id\""]
+      }
+
+      trigger {
+        count = 1
+      }
+    }
+  }
+
+  documentation {
+    content   = "A Relay GCE cell restarted its container more than three times in 15 minutes. Each exit drops every host and phone on that cell, and 201 exits went unpaged over 48 h on 2026-09-04. The instance hostname is `relay-<cell>-<suffix>`; read `jsonPayload.MESSAGE` on `cos_system` for the exit code and the container's own stderr for the stack before blaming MIG autoheal or load. A same-capacity roll is the remedy when the running image is behind."
+    mime_type = "text/markdown"
+  }
+
+  depends_on = [google_logging_metric.relay_incident]
+}
+
+# Why: the four signals that had to be assembled by hand during the 2026-09-04 incident.
+resource "google_monitoring_dashboard" "relay_incident" {
+  project = var.project_id
+
+  dashboard_json = jsonencode({
+    displayName = "Orca Relay: incident overview"
+    mosaicLayout = {
+      columns = 12
+      tiles = [
+        {
+          xPos   = 0
+          yPos   = 0
+          width  = 3
+          height = 4
+          widget = {
+            title = "Cloud SQL WAL checkpoints"
+            xyChart = {
+              dataSets = [{
+                plotType   = "LINE"
+                targetAxis = "Y1"
+                timeSeriesQuery = {
+                  timeSeriesFilter = {
+                    filter = "metric.type=\"logging.googleapis.com/user/orca_relay_cloud_sql_wal_checkpoint\" AND resource.type=\"cloudsql_database\""
+                    aggregation = {
+                      alignmentPeriod    = "300s"
+                      perSeriesAligner   = "ALIGN_SUM"
+                      crossSeriesReducer = "REDUCE_SUM"
+                    }
+                  }
+                }
+              }]
+              yAxis = {
+                label = "checkpoints"
+                scale = "LINEAR"
+              }
+            }
+          }
+        },
+        {
+          xPos   = 3
+          yPos   = 0
+          width  = 3
+          height = 4
+          widget = {
+            title = "Cloud NAT dropped packets"
+            xyChart = {
+              dataSets = [{
+                plotType   = "LINE"
+                targetAxis = "Y1"
+                timeSeriesQuery = {
+                  timeSeriesFilter = {
+                    filter = "metric.type=\"router.googleapis.com/nat/dropped_sent_packets_count\" AND resource.type=\"nat_gateway\" AND resource.label.\"gateway_name\"=monitoring.regex.full_match(\"${local.relay_gce_name}(-.*)?\")"
+                    aggregation = {
+                      alignmentPeriod    = "60s"
+                      perSeriesAligner   = "ALIGN_SUM"
+                      crossSeriesReducer = "REDUCE_SUM"
+                      groupByFields      = ["resource.label.\"gateway_name\"", "metric.label.\"reason\""]
+                    }
+                  }
+                }
+              }]
+              yAxis = {
+                label = "packets"
+                scale = "LINEAR"
+              }
+            }
+          }
+        },
+        {
+          xPos   = 6
+          yPos   = 0
+          width  = 3
+          height = 4
+          widget = {
+            title = "Auth refresh 401s"
+            xyChart = {
+              dataSets = [{
+                plotType   = "LINE"
+                targetAxis = "Y1"
+                timeSeriesQuery = {
+                  timeSeriesFilter = {
+                    filter = "metric.type=\"logging.googleapis.com/user/orca_auth_refresh_401\""
+                    aggregation = {
+                      alignmentPeriod    = "300s"
+                      perSeriesAligner   = "ALIGN_SUM"
+                      crossSeriesReducer = "REDUCE_SUM"
+                    }
+                  }
+                }
+              }]
+              yAxis = {
+                label = "rejections"
+                scale = "LINEAR"
+              }
+            }
+          }
+        },
+        {
+          xPos   = 9
+          yPos   = 0
+          width  = 3
+          height = 4
+          widget = {
+            title = "Standing desktop controls (fleet sum)"
+            xyChart = {
+              dataSets = [{
+                plotType   = "LINE"
+                targetAxis = "Y1"
+                timeSeriesQuery = {
+                  timeSeriesFilter = {
+                    # ALIGN_MEAN, not ALIGN_SUM: each process reports its standing control count once per interval.
+                    filter = "metric.type=\"logging.googleapis.com/user/orca_relay_controls\""
+                    aggregation = {
+                      alignmentPeriod    = "300s"
+                      perSeriesAligner   = "ALIGN_MEAN"
+                      crossSeriesReducer = "REDUCE_SUM"
+                    }
+                  }
+                }
+              }]
+              yAxis = {
+                label = "controls"
+                scale = "LINEAR"
+              }
+            }
+          }
+        }
+      ]
+    }
+  })
+
+  depends_on = [google_logging_metric.relay_incident, google_logging_metric.relay_snapshot]
+}
diff --git a/cloud/infra/terraform/variables.tf b/cloud/infra/terraform/variables.tf
index 68f6c555bd3..91f67e8ebe0 100644
--- a/cloud/infra/terraform/variables.tf
+++ b/cloud/infra/terraform/variables.tf
@@ -468,6 +468,12 @@ variable "relay_gce_fenced_cells" {
   default     = []
 }
 
+variable "relay_cloud_sql_private_ip" {
+  type        = bool
+  description = "Dial Cloud SQL over its private IP inside this VPC instead of its public IP through Cloud NAT. Requires the foundation root's private services access peering to be applied first; a cell that cannot reach the private IP never becomes ready."
+  default     = false
+}
+
 variable "relay_gce_cloud_sql_proxy_image" {
   type        = string
   description = "Digest-pinned Cloud SQL Auth Proxy image used by private relay workers."
diff --git a/cloud/package.json b/cloud/package.json
index c75d027d3d2..62dbadc7455 100644
--- a/cloud/package.json
+++ b/cloud/package.json
@@ -21,7 +21,7 @@
     "load:relay:recovery-gate": "node dev/scripts/run-relay-recovery-wave-gate.mjs",
     "ops:relay": "pnpm --filter @orca-cloud/relay-ops dev",
     "pretest": "node --test dev/scripts/capture-terraform-plan-baseline.test.mjs dev/scripts/operate-relay-asia-admission.test.mjs dev/scripts/prepare-relay-asia-director-cells.test.mjs dev/scripts/prepare-relay-asia-topology-input.test.mjs dev/scripts/production-cloud-sql-rollout-lock.test.mjs dev/scripts/read-relay-serving-regional-placement-version.test.mjs dev/scripts/relay-asia-admission-workflow.test.mjs dev/scripts/relay-asia-rollout-evidence.test.mjs dev/scripts/relay-asia-topology-workflow.test.mjs dev/scripts/relay-cloud-sql-connection-budget.test.mjs dev/scripts/relay-load-reader-evidence.test.mjs dev/scripts/relay-staging-deploy-identity.test.mjs dev/scripts/sanitize-relay-asia-admission-result.test.mjs dev/scripts/terraform-root-partition.test.mjs dev/scripts/validate-relay-asia-topology-plan.test.mjs ../.github/actions/cloud-sql-rollout-lease/action-contract.test.mjs ../.github/actions/cloud-sql-rollout-lease/storage-lease.test.mjs",
-    "test": "pnpm -r test && node --test dev/scripts/classify-relay-production-capacity-director.test.mjs dev/scripts/classify-relay-staging-bootstrap.test.mjs dev/scripts/deploy-relay-blue-green.test.mjs dev/scripts/deploy-relay-gce-candidate.test.mjs dev/scripts/deploy-relay-gce-multi-target.test.mjs dev/scripts/github-smoke-token.test.mjs dev/scripts/infra.test.mjs dev/scripts/operate-relay-regional-rehome.test.mjs dev/scripts/power-staging-relay.test.mjs dev/scripts/prepare-relay-capacity-canary.test.mjs dev/scripts/prepare-relay-production-capacity-canary.test.mjs dev/scripts/probe-relay-legacy-admission.test.mjs dev/scripts/probe-relay-rehome-trust.test.mjs dev/scripts/production-cell-image-digest-consistency.test.mjs dev/scripts/read-relay-production-capacity-identity.test.mjs dev/scripts/relay-admission-selector.test.mjs dev/scripts/relay-gce-terraform-fence.test.mjs dev/scripts/relay-load-connection-failure.test.mjs dev/scripts/relay-load-control-peer.test.mjs dev/scripts/relay-load-director-capacity-gate.test.mjs dev/scripts/relay-load-model.test.mjs dev/scripts/relay-load-phase-barrier.test.mjs dev/scripts/relay-load-placement-boundary.test.mjs dev/scripts/relay-load-profile.test.mjs dev/scripts/relay-load-rebind-boundary.test.mjs dev/scripts/relay-load-region-behavior.test.mjs dev/scripts/relay-load-request-unit-boundary.test.mjs dev/scripts/relay-load-run-lifecycle.test.mjs dev/scripts/relay-monitor-evidence.test.mjs dev/scripts/relay-production-capacity-wave.test.mjs dev/scripts/relay-production-capacity-workflow.test.mjs dev/scripts/relay-production-identity-boundaries.test.mjs dev/scripts/relay-production-same-cap-wave.test.mjs dev/scripts/relay-public-workflow-contract.test.mjs dev/scripts/relay-recovery-wave-gate.test.mjs dev/scripts/relay-region-observation-evidence.test.mjs dev/scripts/relay-regional-rehome-workflow.test.mjs dev/scripts/relay-rehome-aggregate-evidence.test.mjs dev/scripts/relay-repository.test.mjs dev/scripts/relay-staging-c4-refresh-workflow.test.mjs dev/scripts/relay-staging-capacity-identity.test.mjs dev/scripts/staging-relay-apply-guard.test.mjs dev/scripts/validate-relay-capacity-plan.test.mjs dev/scripts/verify-relay-capacity-transition.test.mjs dev/scripts/verify-relay-legacy-bootstrap.test.mjs dev/scripts/workload-identity-attribute-conditions.test.mjs",
+    "test": "pnpm -r test && node --test dev/scripts/classify-relay-production-capacity-director.test.mjs dev/scripts/classify-relay-staging-bootstrap.test.mjs dev/scripts/deploy-relay-blue-green.test.mjs dev/scripts/deploy-relay-gce-candidate.test.mjs dev/scripts/deploy-relay-gce-multi-target.test.mjs dev/scripts/github-smoke-token.test.mjs dev/scripts/infra.test.mjs dev/scripts/operate-relay-regional-rehome.test.mjs dev/scripts/power-staging-relay.test.mjs dev/scripts/prepare-relay-capacity-canary.test.mjs dev/scripts/prepare-relay-production-capacity-canary.test.mjs dev/scripts/probe-relay-legacy-admission.test.mjs dev/scripts/probe-relay-rehome-trust.test.mjs dev/scripts/production-cell-image-digest-consistency.test.mjs dev/scripts/read-relay-production-capacity-identity.test.mjs dev/scripts/relay-admin-endpoint-retry-workflow.test.mjs dev/scripts/relay-admin-transient-retry.test.mjs dev/scripts/relay-admission-selector.test.mjs dev/scripts/relay-gce-terraform-fence.test.mjs dev/scripts/relay-load-connection-failure.test.mjs dev/scripts/relay-load-control-peer.test.mjs dev/scripts/relay-load-director-capacity-gate.test.mjs dev/scripts/relay-load-model.test.mjs dev/scripts/relay-load-phase-barrier.test.mjs dev/scripts/relay-load-placement-boundary.test.mjs dev/scripts/relay-load-profile.test.mjs dev/scripts/relay-load-rebind-boundary.test.mjs dev/scripts/relay-load-region-behavior.test.mjs dev/scripts/relay-load-request-unit-boundary.test.mjs dev/scripts/relay-load-run-lifecycle.test.mjs dev/scripts/relay-monitor-evidence.test.mjs dev/scripts/relay-production-capacity-wave.test.mjs dev/scripts/relay-production-capacity-workflow.test.mjs dev/scripts/relay-production-identity-boundaries.test.mjs dev/scripts/relay-production-same-cap-wave.test.mjs dev/scripts/relay-public-workflow-contract.test.mjs dev/scripts/relay-recovery-wave-gate.test.mjs dev/scripts/relay-region-observation-evidence.test.mjs dev/scripts/relay-regional-rehome-workflow.test.mjs dev/scripts/relay-rehome-aggregate-evidence.test.mjs dev/scripts/relay-repository.test.mjs dev/scripts/relay-same-cap-script-census.test.mjs dev/scripts/relay-staging-c4-refresh-workflow.test.mjs dev/scripts/relay-staging-capacity-identity.test.mjs dev/scripts/staging-relay-apply-guard.test.mjs dev/scripts/validate-relay-capacity-plan.test.mjs dev/scripts/verify-relay-capacity-transition.test.mjs dev/scripts/verify-relay-legacy-bootstrap.test.mjs dev/scripts/workload-identity-attribute-conditions.test.mjs",
     "typecheck": "pnpm -r typecheck"
   },
   "devDependencies": {
diff --git a/cloud/packages/relay-contract/src/host-close-reason.ts b/cloud/packages/relay-contract/src/host-close-reason.ts
new file mode 100644
index 00000000000..3a5abde3f00
--- /dev/null
+++ b/cloud/packages/relay-contract/src/host-close-reason.ts
@@ -0,0 +1,18 @@
+// Mirror of src/shared/relay-host-close-reason.ts in the Orca app repo half.
+// A host control socket may close with one of these as its WebSocket close
+// reason; the cell records it so a later phone rejection can name the cause.
+// Anything else (including the empty reason of an abrupt 1006) means "unknown",
+// which is what every peer that predates this file sends.
+export const RELAY_HOST_CLOSE_REASON = {
+  SIGNED_OUT: 'signed-out'
+} as const
+
+export type RelayHostCloseReason =
+  (typeof RELAY_HOST_CLOSE_REASON)[keyof typeof RELAY_HOST_CLOSE_REASON]
+
+const REASONS: readonly string[] = Object.values(RELAY_HOST_CLOSE_REASON)
+
+export function relayHostCloseReasonFrom(value: unknown): RelayHostCloseReason | null {
+  const text = typeof value === 'string' ? value : (value?.toString() ?? '')
+  return REASONS.includes(text) ? (text as RelayHostCloseReason) : null
+}
diff --git a/cloud/packages/relay-contract/src/index.ts b/cloud/packages/relay-contract/src/index.ts
index 2a7d7d0feda..aab3b53b5f3 100644
--- a/cloud/packages/relay-contract/src/index.ts
+++ b/cloud/packages/relay-contract/src/index.ts
@@ -5,6 +5,7 @@ export * from './control-messages.js'
 export * from './control-continuity.js'
 export * from './credential-messages.js'
 export * from './director-messages.js'
+export * from './host-close-reason.js'
 export * from './host-proof-transcript.js'
 export * from './persistence-invariants.js'
 export * from './protocol-limits.js'
diff --git a/config/docker/cli-launch-contract/Dockerfile b/config/docker/cli-launch-contract/Dockerfile
index f6a618a8ece..c90cbcd979c 100644
--- a/config/docker/cli-launch-contract/Dockerfile
+++ b/config/docker/cli-launch-contract/Dockerfile
@@ -6,8 +6,13 @@ ARG LIBASOUND_PACKAGE=libasound2t64
 ENV DEBIAN_FRONTEND=noninteractive
 
 # Install Electron's link-time libraries without adding a display server or FUSE.
-RUN apt-get update \
-  && apt-get install -y --no-install-recommends \
+# Why: archive.ubuntu.com mid-sync returns Hash Sum mismatch / wrong-size indexes and stalls per-package fetches; retry with bounded timeouts and drop half-synced lists between attempts.
+RUN for attempt in 1 2 3 4 5; do \
+      apt-get -o Acquire::Retries=5 -o Acquire::http::Timeout=30 update && break; \
+      if [ "$attempt" = 5 ]; then exit 100; fi; \
+      rm -rf /var/lib/apt/lists/*; sleep 20; \
+    done \
+  && apt-get -o Acquire::Retries=5 -o Acquire::http::Timeout=30 install -y --no-install-recommends \
     bash \
     ca-certificates \
     coreutils \
diff --git a/config/docker/headless-pairing/Dockerfile b/config/docker/headless-pairing/Dockerfile
index 03664f68b0d..e4b4cafeefc 100644
--- a/config/docker/headless-pairing/Dockerfile
+++ b/config/docker/headless-pairing/Dockerfile
@@ -5,8 +5,13 @@ ARG LIBASOUND_PACKAGE=libasound2t64
 
 ENV DEBIAN_FRONTEND=noninteractive
 
-RUN apt-get update \
-  && apt-get install -y --no-install-recommends \
+# Why: archive.ubuntu.com mid-sync returns Hash Sum mismatch / wrong-size indexes and stalls per-package fetches; retry with bounded timeouts and drop half-synced lists between attempts.
+RUN for attempt in 1 2 3 4 5; do \
+      apt-get -o Acquire::Retries=5 -o Acquire::http::Timeout=30 update && break; \
+      if [ "$attempt" = 5 ]; then exit 100; fi; \
+      rm -rf /var/lib/apt/lists/*; sleep 20; \
+    done \
+  && apt-get -o Acquire::Retries=5 -o Acquire::http::Timeout=30 install -y --no-install-recommends \
     bash \
     ca-certificates \
     dbus-x11 \
diff --git a/config/docker/headless-serve-shutdown/Dockerfile b/config/docker/headless-serve-shutdown/Dockerfile
index 13b1ed2b69f..8ee7b942499 100644
--- a/config/docker/headless-serve-shutdown/Dockerfile
+++ b/config/docker/headless-serve-shutdown/Dockerfile
@@ -2,8 +2,13 @@ FROM ubuntu@sha256:678c6550cc43645e08669028bc177f50be4e7c5b8cca677067b1914d4afc7
 
 ENV DEBIAN_FRONTEND=noninteractive
 
-RUN apt-get update \
-  && apt-get install -y --no-install-recommends \
+# Why: archive.ubuntu.com mid-sync returns Hash Sum mismatch / wrong-size indexes and stalls per-package fetches; retry with bounded timeouts and drop half-synced lists between attempts.
+RUN for attempt in 1 2 3 4 5; do \
+      apt-get -o Acquire::Retries=5 -o Acquire::http::Timeout=30 update && break; \
+      if [ "$attempt" = 5 ]; then exit 100; fi; \
+      rm -rf /var/lib/apt/lists/*; sleep 20; \
+    done \
+  && apt-get -o Acquire::Retries=5 -o Acquire::http::Timeout=30 install -y --no-install-recommends \
     bash \
     ca-certificates \
     dbus-x11 \
diff --git a/config/electron-builder.config.cjs b/config/electron-builder.config.cjs
index ebf4d275678..7e0009b3a24 100644
--- a/config/electron-builder.config.cjs
+++ b/config/electron-builder.config.cjs
@@ -19,6 +19,7 @@ const {
 } = require('./scripts/verify-packaged-node-pty-job-ownership.cjs')
 const { verifySkillsCliRuntime } = require('./scripts/verify-skills-cli-runtime.cjs')
 const { verifyStaticAppImagePackage } = require('./scripts/static-appimage-package-contract.cjs')
+const { signWindowsUninstallerViaSignPath } = require('./scripts/windows-uninstaller-signing.cjs')
 
 // Why: dev-channel builds must carry the *release* identity — same bundle id,
 // Developer ID signature, and notarization ticket — or Squirrel.Mac refuses to
@@ -401,9 +402,17 @@ module.exports = {
     // name is absent. An unsigned build that still claimed 'SignPath Foundation'
     // would therefore reject its own channel's next build — and its way back to
     // stable with it. Dropping it is what makes dev→dev and dev→stable work.
-    ...(isWinDevChannel
-      ? { verifyUpdateCodeSignature: false }
-      : { signtoolOptions: { publisherName: 'SignPath Foundation' } }),
+    // Why a sign hook on a build that does not sign: it is the only moment
+    // electron-builder exposes the NSIS uninstaller (built in its own makensis
+    // pass, embedded, then deleted). The hook signs nothing — it relays the file
+    // to and from the CI SignPath request, and is inert when the relay env vars
+    // are unset, so local and dev builds are unaffected. publisherName stays on
+    // its existing channel split above.
+    signtoolOptions: {
+      sign: signWindowsUninstallerViaSignPath,
+      ...(isWinDevChannel ? {} : { publisherName: 'SignPath Foundation' })
+    },
+    ...(isWinDevChannel ? { verifyUpdateCodeSignature: false } : {}),
     extraResources: [
       ...commonExtraResources,
       ...createPackagedRuntimeNodeModuleResources('win32'),
diff --git a/config/nsis/orca-installer-hooks.nsh b/config/nsis/orca-installer-hooks.nsh
index ca80c99fc6d..d89439073ab 100644
--- a/config/nsis/orca-installer-hooks.nsh
+++ b/config/nsis/orca-installer-hooks.nsh
@@ -49,22 +49,48 @@
 ; ---------------------------------------------------------------------------
 ; Clean up the relocated terminal daemon on a REAL uninstall.
 ;
-; Why: the daemon host is deliberately copied to a distinct image name
-; (orca-terminal-daemon.exe) under %LOCALAPPDATA%\Orca\daemon-host so that app
-; UPDATES cannot kill it — that relocation is what keeps terminals alive across
-; updates. The same design means a normal uninstall's process sweep and file
-; removal both miss it, leaving an orphaned daemon plus its runtime copy behind.
+; Why: the daemon host is deliberately copied OUT of the install dir into
+; %LOCALAPPDATA%\Orca\daemon-host so that app UPDATES cannot kill it —
+; electron-builder's kill sweep selects processes whose image path is under
+; $INSTDIR, and that relocation is what keeps terminals alive across updates.
+; The same design means a normal uninstall's process sweep and file removal both
+; miss it, leaving an orphaned daemon plus its runtime copy behind.
 ;
 ; The ${isUpdated} guard is essential: electron-builder runs this uninstaller as
 ; part of uninstallOldVersion on EVERY update, and killing the daemon there would
 ; defeat the whole feature. Only clean up on a genuine uninstall.
 ;
-; The image name and the LOCALAPPDATA folder name must stay in sync with
-; DAEMON_HOST_EXE_NAME and LOCAL_HOST_ROOT_NAME in
-; src/main/daemon/daemon-host-relocation.ts.
+; The LOCALAPPDATA folder name must stay in sync with LOCAL_HOST_ROOT_NAME in
+; src/main/daemon/daemon-host-relocation.ts. See
+; docs/reference/windows-daemon-host-relocation.md.
 !macro customUnInstall
   ${ifNot} ${isUpdated}
-    nsExec::Exec 'taskkill /F /IM orca-terminal-daemon.exe'
+    Push $0
+    Push $1
+    Push $2
+    ; The host exe is a verbatim copy of the app exe, so the app's own image name
+    ; reaches it; the second name covers hosts left by builds that renamed the copy.
+    ; Filtered to the current user like upstream's per-user KILL_PROCESS, so an
+    ; elevated machine-wide uninstall cannot reach another logged-on user's session.
+    ; NSIS expands USERNAME itself: routing through cmd.exe only to get %USERNAME%
+    ; would add two interpreter spawns to the uninstall path for nothing.
+    ReadEnvStr $1 USERNAME
+    ${if} $1 == ""
+      ; Measured: taskkill rejects an empty filter value outright ("The search filter
+      ; cannot be recognized") and kills nothing, so with no USERNAME to scope by,
+      ; kill unfiltered rather than not at all. USERNAME is set in every session an
+      ; uninstaller runs in, so this is a backstop, not the expected path.
+      StrCpy $2 ""
+    ${else}
+      StrCpy $2 '/FI "USERNAME eq $1"'
+    ${endIf}
+    nsExec::Exec 'taskkill /F /IM "${APP_EXECUTABLE_FILENAME}" $2'
+    Pop $0
+    nsExec::Exec 'taskkill /F /IM "orca-terminal-daemon.exe" $2'
+    Pop $0
+    Pop $2
+    Pop $1
+    Pop $0
     ; Give the OS a moment to release the image lock before removing the tree.
     Sleep 500
     RMDir /r "$LOCALAPPDATA\Orca\daemon-host"
diff --git a/config/oxlint-performance-audit.json b/config/oxlint-performance-audit.json
new file mode 100644
index 00000000000..2912c6b8e03
--- /dev/null
+++ b/config/oxlint-performance-audit.json
@@ -0,0 +1,35 @@
+{
+  "$schema": "../node_modules/oxlint/configuration_schema.json",
+  "plugins": [],
+  "categories": {
+    "correctness": "off",
+    "suspicious": "off",
+    "pedantic": "off",
+    "perf": "off",
+    "style": "off",
+    "restriction": "off",
+    "nursery": "off"
+  },
+  "jsPlugins": [
+    {
+      "name": "app-store-performance",
+      "specifier": "../config/oxlint-plugins/app-store-performance.mjs"
+    },
+    {
+      "name": "quadratic-buffer-concat",
+      "specifier": "../config/oxlint-plugins/quadratic-buffer-concat.mjs"
+    },
+    {
+      "name": "sort-comparator-performance",
+      "specifier": "../config/oxlint-plugins/sort-comparator-performance.mjs"
+    }
+  ],
+  "rules": {
+    "app-store-performance/require-selector": "warn",
+    "app-store-performance/no-identity-selector": "warn",
+    "app-store-performance/no-fresh-selector-result": "warn",
+    "quadratic-buffer-concat/no-loop-carried-concat": "warn",
+    "sort-comparator-performance/no-repeated-collator": "warn"
+  },
+  "ignorePatterns": ["**/node_modules", "**/dist", "**/out", "**/*.test.*", "**/*.spec.*"]
+}
diff --git a/config/oxlint-plugins/sort-comparator-performance.mjs b/config/oxlint-plugins/sort-comparator-performance.mjs
new file mode 100644
index 00000000000..cd3444cf65f
--- /dev/null
+++ b/config/oxlint-plugins/sort-comparator-performance.mjs
@@ -0,0 +1,60 @@
+const FUNCTION_TYPES = new Set([
+  'ArrowFunctionExpression',
+  'FunctionExpression',
+  'FunctionDeclaration'
+])
+
+function propertyName(node) {
+  if (node?.type !== 'MemberExpression') {
+    return null
+  }
+  if (!node.computed && node.property.type === 'Identifier') {
+    return node.property.name
+  }
+  return node.property.type === 'Literal' ? node.property.value : null
+}
+
+function isInlineSortComparator(node) {
+  for (let parent = node.parent; parent; parent = parent.parent) {
+    if (!FUNCTION_TYPES.has(parent.type)) {
+      continue
+    }
+    const call = parent.parent
+    return (
+      call?.type === 'CallExpression' &&
+      call.arguments[0] === parent &&
+      ['sort', 'toSorted'].includes(propertyName(call.callee))
+    )
+  }
+  return false
+}
+
+function isCollatorConstruction(node) {
+  return (
+    node.callee?.object?.type === 'Identifier' &&
+    node.callee.object.name === 'Intl' &&
+    propertyName(node.callee) === 'Collator'
+  )
+}
+
+function createRule(context) {
+  function inspect(node) {
+    const optionedComparison =
+      node.type === 'CallExpression' &&
+      propertyName(node.callee) === 'localeCompare' &&
+      node.arguments.length >= 3
+    if ((optionedComparison || isCollatorConstruction(node)) && isInlineSortComparator(node)) {
+      context.report({
+        node,
+        message:
+          'Create one Intl.Collator before sorting and reuse its compare method; resolving collation options inside the comparator repeats setup for every comparison. Preserve the locale, options, and tie-breaker.'
+      })
+    }
+  }
+  return { CallExpression: inspect, NewExpression: inspect }
+}
+
+export default {
+  meta: { name: 'sort-comparator-performance' },
+  rules: { 'no-repeated-collator': { create: createRule } }
+}
diff --git a/config/patches/@vscode__windows-process-tree@0.8.0.patch b/config/patches/@vscode__windows-process-tree@0.8.0.patch
index 10780f5288a..fe5e4be44b1 100644
--- a/config/patches/@vscode__windows-process-tree@0.8.0.patch
+++ b/config/patches/@vscode__windows-process-tree@0.8.0.patch
@@ -27,15 +27,424 @@ index 855bd4b86f0a3c18c7594212c0e42b6e35bc4001..33774e7ae296f0de39dd94156673c9e7
                  "/guard:cf",
                  "/sdl",
 diff --git a/src/process.cc b/src/process.cc
-index 3eea92077c4d1d433119361d5c432881859131e9..1998f4addd4d7e9aba946ea6f7f7a4a5d13291bc 100644
+index 3eea92077c4d1d433119361d5c432881859131e9..738775f6fcdfb676054386fe34c0380327ed1863 100644
 --- a/src/process.cc
 +++ b/src/process.cc
-@@ -37,7 +37,7 @@ uint32_t GetRawProcessList(std::vector<ProcessInfo>& process_info,
-         process_info.push_back(std::move(pinfo));
-         process_count++;
-       }
+@@ -1,108 +1,112 @@
+-/*---------------------------------------------------------------------------------------------
+- *  Copyright (c) Microsoft Corporation. All rights reserved.
+- *  Licensed under the MIT License. See License.txt in the project root for license information.
+- *--------------------------------------------------------------------------------------------*/
+-
+-#include "process.h"
+-#include "process_commandline.h"
+-
+-#include <tlhelp32.h>
+-#include <psapi.h>
+-#include <limits>
+-
+-uint32_t GetRawProcessList(std::vector<ProcessInfo>& process_info,
+-                           DWORD process_data_flags) {
+-  // Fetch the PID and PPIDs
+-  PROCESSENTRY32 process_entry = { 0 };
+-  DWORD parent_pid = 0;
+-  uint32_t process_count = 0;
+-  HANDLE snapshot_handle = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
+-  process_entry.dwSize = sizeof(PROCESSENTRY32);
+-  if (Process32First(snapshot_handle, &process_entry)) {
+-    do {
+-      if (process_entry.th32ProcessID != 0) {
+-        ProcessInfo pinfo;
+-        pinfo.pid = process_entry.th32ProcessID;
+-        pinfo.ppid = process_entry.th32ParentProcessID;
+-
+-        if (MEMORY & process_data_flags) {
+-          GetProcessMemoryUsage(pinfo);
+-        }
+-
+-        if (COMMANDLINE & process_data_flags) {
+-          GetProcessCommandLine(pinfo);
+-        }
+-
+-        strcpy(pinfo.name, process_entry.szExeFile);
+-        process_info.push_back(std::move(pinfo));
+-        process_count++;
+-      }
 -    } while (process_count < 1024 && Process32Next(snapshot_handle, &process_entry));
+-  }
+-
+-  CloseHandle(snapshot_handle);
+-  return process_count;
+-}
+-
+-void GetProcessMemoryUsage(ProcessInfo& process_info) {
+-  DWORD pid = process_info.pid;
+-  HANDLE hProcess;
+-  PROCESS_MEMORY_COUNTERS pmc;
+-
+-  hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, false, pid);
+-
+-  if (hProcess == NULL) {
+-    return;
+-  }
+-
+-  if (GetProcessMemoryInfo(hProcess, &pmc, sizeof(pmc))) {
+-    process_info.memory = (DWORD)pmc.WorkingSetSize;
+-  }
+-
+-  CloseHandle(hProcess);
+-}
+-
+-// Per documentation, it is not recommended to add or subtract values from the FILETIME
+-// structure, or to cast it to ULARGE_INTEGER as this can cause alignment faults on 64-bit Windows.
+-// Copy the high and low part to a ULARGE_INTEGER and peform arithmetic on that instead.
+-// See https://msdn.microsoft.com/en-us/library/windows/desktop/ms724284(v=vs.85).aspx
+-ULONGLONG GetTotalTime(const FILETIME* kernelTime, const FILETIME* userTime) {
+-  ULARGE_INTEGER kt, ut;
+-  kt.LowPart = (*kernelTime).dwLowDateTime;
+-  kt.HighPart = (*kernelTime).dwHighDateTime;
+-
+-  ut.LowPart = (*userTime).dwLowDateTime;
+-  ut.HighPart = (*userTime).dwHighDateTime;
+-
+-  return kt.QuadPart + ut.QuadPart;
+-}
+-
+-void GetCpuUsage(Cpu& cpu_info, bool first_pass) {
+-  DWORD pid = cpu_info.pid;
+-  HANDLE hProcess;
+-
+-  hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, false, pid);
+-
+-  if (hProcess == NULL) {
+-    return;
+-  }
+-
+-  FILETIME creationTime, exitTime, kernelTime, userTime;
+-  FILETIME sysIdleTime, sysKernelTime, sysUserTime;
+-  if (GetProcessTimes(hProcess, &creationTime, &exitTime, &kernelTime, &userTime)
+-    && GetSystemTimes(&sysIdleTime, &sysKernelTime, &sysUserTime)) {
+-    if (first_pass) {
+-      cpu_info.initialProcRunTime = GetTotalTime(&kernelTime, &userTime);
+-      cpu_info.initialSystemTime = GetTotalTime(&sysKernelTime, &sysUserTime);
+-    } else {
+-      ULONGLONG endProcTime = GetTotalTime(&kernelTime, &userTime);
+-      ULONGLONG endSysTime = GetTotalTime(&sysKernelTime, &sysUserTime);
+-
+-      cpu_info.cpu = 100.0 * (endProcTime - cpu_info.initialProcRunTime) / (endSysTime - cpu_info.initialSystemTime);
+-    }
+-  } else {
+-    cpu_info.cpu = std::numeric_limits<double>::quiet_NaN();
+-  }
+-
+-  CloseHandle(hProcess);
++/*---------------------------------------------------------------------------------------------
++ *  Copyright (c) Microsoft Corporation. All rights reserved.
++ *  Licensed under the MIT License. See License.txt in the project root for license information.
++ *--------------------------------------------------------------------------------------------*/
++
++#include "process.h"
++#include "process_commandline.h"
++
++#include <tlhelp32.h>
++#include <psapi.h>
++#include <limits>
++
++uint32_t GetRawProcessList(std::vector<ProcessInfo>& process_info,
++                           DWORD process_data_flags) {
++  // Fetch the PID and PPIDs
++  PROCESSENTRY32 process_entry = { 0 };
++  DWORD parent_pid = 0;
++  uint32_t process_count = 0;
++  HANDLE snapshot_handle = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
++  process_entry.dwSize = sizeof(PROCESSENTRY32);
++  if (Process32First(snapshot_handle, &process_entry)) {
++    do {
++      if (process_entry.th32ProcessID != 0) {
++        // Value-initialize: `memory` is otherwise stack garbage when the flag is unset.
++        ProcessInfo pinfo{};
++        pinfo.pid = process_entry.th32ProcessID;
++        pinfo.ppid = process_entry.th32ParentProcessID;
++
++        if (MEMORY & process_data_flags) {
++          GetProcessMemoryUsage(pinfo);
++        }
++
++        if (COMMANDLINE & process_data_flags) {
++          GetProcessCommandLine(pinfo);
++        }
++
++        strcpy(pinfo.name, process_entry.szExeFile);
++        process_info.push_back(std::move(pinfo));
++        process_count++;
++      }
 +    } while (Process32Next(snapshot_handle, &process_entry));
-   }
- 
-   CloseHandle(snapshot_handle);
++  }
++
++  CloseHandle(snapshot_handle);
++  return process_count;
++}
++
++void GetProcessMemoryUsage(ProcessInfo& process_info) {
++  DWORD pid = process_info.pid;
++  HANDLE hProcess;
++  PROCESS_MEMORY_COUNTERS pmc;
++
++  // PROCESS_VM_READ is never used here -- GetProcessMemoryInfo reads counters the
++  // kernel keeps, not the address space -- and acquiring it is what EDR scores.
++  hProcess = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, false, pid);
++
++  if (hProcess == NULL) {
++    return;
++  }
++
++  if (GetProcessMemoryInfo(hProcess, &pmc, sizeof(pmc))) {
++    process_info.memory = (DWORD)pmc.WorkingSetSize;
++  }
++
++  CloseHandle(hProcess);
++}
++
++// Per documentation, it is not recommended to add or subtract values from the FILETIME
++// structure, or to cast it to ULARGE_INTEGER as this can cause alignment faults on 64-bit Windows.
++// Copy the high and low part to a ULARGE_INTEGER and peform arithmetic on that instead.
++// See https://msdn.microsoft.com/en-us/library/windows/desktop/ms724284(v=vs.85).aspx
++ULONGLONG GetTotalTime(const FILETIME* kernelTime, const FILETIME* userTime) {
++  ULARGE_INTEGER kt, ut;
++  kt.LowPart = (*kernelTime).dwLowDateTime;
++  kt.HighPart = (*kernelTime).dwHighDateTime;
++
++  ut.LowPart = (*userTime).dwLowDateTime;
++  ut.HighPart = (*userTime).dwHighDateTime;
++
++  return kt.QuadPart + ut.QuadPart;
++}
++
++void GetCpuUsage(Cpu& cpu_info, bool first_pass) {
++  DWORD pid = cpu_info.pid;
++  HANDLE hProcess;
++
++  // GetProcessTimes needs no more than PROCESS_QUERY_LIMITED_INFORMATION.
++  hProcess = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, false, pid);
++
++  if (hProcess == NULL) {
++    return;
++  }
++
++  FILETIME creationTime, exitTime, kernelTime, userTime;
++  FILETIME sysIdleTime, sysKernelTime, sysUserTime;
++  if (GetProcessTimes(hProcess, &creationTime, &exitTime, &kernelTime, &userTime)
++    && GetSystemTimes(&sysIdleTime, &sysKernelTime, &sysUserTime)) {
++    if (first_pass) {
++      cpu_info.initialProcRunTime = GetTotalTime(&kernelTime, &userTime);
++      cpu_info.initialSystemTime = GetTotalTime(&sysKernelTime, &sysUserTime);
++    } else {
++      ULONGLONG endProcTime = GetTotalTime(&kernelTime, &userTime);
++      ULONGLONG endSysTime = GetTotalTime(&sysKernelTime, &sysUserTime);
++
++      cpu_info.cpu = 100.0 * (endProcTime - cpu_info.initialProcRunTime) / (endSysTime - cpu_info.initialSystemTime);
++    }
++  } else {
++    cpu_info.cpu = std::numeric_limits<double>::quiet_NaN();
++  }
++
++  CloseHandle(hProcess);
+ }
+\ No newline at end of file
+diff --git a/src/process_commandline.cc b/src/process_commandline.cc
+index ea822b120e8038a4803e34647042f08f4aaf5ca1..25907c0bf542bed6c72b1b462b19bcf3210c3cfd 100644
+--- a/src/process_commandline.cc
++++ b/src/process_commandline.cc
+@@ -1,67 +1,125 @@
+-/*---------------------------------------------------------------------------------------------
+- *  Copyright (c) Microsoft Corporation. All rights reserved.
+- *  Licensed under the MIT License. See License.txt in the project root for license information.
+- *--------------------------------------------------------------------------------------------*/
+-
+-#include "process.h"
+-#include "process_commandline.h"
+-#include <windows.h>
+-#include <winternl.h>
+-#include <iostream>
+-
+-bool GetProcessCommandLine(ProcessInfo& process_info) {
+-  HINSTANCE ntdll = GetModuleHandleW(L"ntdll.dll");
+-  if (!ntdll) {
+-    return false;
+-  }
+-
+-  decltype(NtQueryInformationProcess)* nt_query_information_process =
+-      reinterpret_cast<decltype(NtQueryInformationProcess)*>(
+-          GetProcAddress(ntdll, "NtQueryInformationProcess"));
+-
+-  if (!nt_query_information_process) {
+-    return false;
+-  }
+-
+-  PROCESS_BASIC_INFORMATION pbi{};
+-  PEB peb = {NULL};
+-  RTL_USER_PROCESS_PARAMETERS process_parameters = {NULL};
+-
+-  // Get process handle
+-  DWORD pid = process_info.pid;
+-  HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, pid);
+-  if (hProcess == INVALID_HANDLE_VALUE) {
+-    return false;
+-  }
+-
+-  // Get Process Environment Block (PEB)
+-  NTSTATUS status = nt_query_information_process(hProcess, ProcessBasicInformation, &pbi, sizeof(pbi), nullptr);
+-  if (NT_SUCCESS(status) && pbi.PebBaseAddress) {
+-    // Read PEB
+-    if (ReadProcessMemory(hProcess, pbi.PebBaseAddress, &peb, sizeof(peb), nullptr)) {
+-      // Read the processs parameters
+-      if (ReadProcessMemory(hProcess, peb.ProcessParameters, &process_parameters, sizeof(RTL_USER_PROCESS_PARAMETERS), nullptr)) {
+-        if (process_parameters.CommandLine.Length > 0) {
+-          std::wstring buffer;
+-          buffer.resize(process_parameters.CommandLine.Length / sizeof(wchar_t));
+-          if (ReadProcessMemory(hProcess, process_parameters.CommandLine.Buffer, &buffer[0], process_parameters.CommandLine.Length, nullptr)) {
+-            int wide_length = static_cast<int>(buffer.length());
+-            int charcount = WideCharToMultiByte(CP_UTF8, 0, buffer.data(), wide_length,
+-                                      NULL, 0, NULL, NULL);
+-            if (charcount) {
+-              process_info.commandLine.resize(static_cast<size_t>(charcount));
+-              WideCharToMultiByte(CP_UTF8, 0, buffer.data(), wide_length,
+-                                  &process_info.commandLine[0], charcount,
+-                                  NULL, NULL);
+-            }
+-            CloseHandle(hProcess);
+-            return true;
+-          }
+-        }
+-      }
+-    }
+-  }
+-
+-  CloseHandle(hProcess);
+-  return false;
+-}
++/*---------------------------------------------------------------------------------------------
++ *  Copyright (c) Microsoft Corporation. All rights reserved.
++ *  Licensed under the MIT License. See License.txt in the project root for license information.
++ *--------------------------------------------------------------------------------------------*/
++
++#include "process.h"
++#include "process_commandline.h"
++#include <windows.h>
++#include <winternl.h>
++#include <vector>
++
++namespace {
++
++// Windows 8.1 and later hand back a process's command line as a UNICODE_STRING
++// the kernel builds, needing only PROCESS_QUERY_LIMITED_INFORMATION.
++//
++// There is deliberately no PEB fallback. Reading the command line out of the
++// target's address space -- opening it for VM reads and then chaining
++// memory reads across every pid on a timer -- is the credential-dumping
++// primitive this reader exists to not perform, so it is absent from the binary
++// rather than one anomalous NTSTATUS away. Electron's floor is Windows 10, so
++// every OS Orca supports has this class; if a hooked ntdll refuses it anyway,
++// the command line comes back empty, which callers already handle, instead of
++// silently reinstating the primitive on exactly the instrumented machines this
++// reader was written for.
++const ULONG kProcessCommandLineInformation = 60;
++
++const NTSTATUS kStatusInfoLengthMismatch = static_cast<NTSTATUS>(0xC0000004L);
++const NTSTATUS kStatusBufferTooSmall = static_cast<NTSTATUS>(0xC0000023L);
++
++// A command line is a UNICODE_STRING, whose Length is a USHORT, so the kernel
++// can never need more than the header plus 64 KiB. Refusing anything larger
++// keeps a bogus size from throwing bad_alloc out of a scan that has already
++// walked most of the table.
++const ULONG kMaxCommandLineBytes = sizeof(UNICODE_STRING) + 0xFFFF + sizeof(wchar_t);
++
++// winternl.h's PROCESSINFOCLASS does not name class 60 and its enumerator range
++// stops far short of it, so the class travels as a ULONG rather than a cast enum.
++typedef NTSTATUS(NTAPI* NtQueryInformationProcessFn)(HANDLE, ULONG, PVOID, ULONG, PULONG);
++
++// ntdll ships no import library for this entry point; it has to be resolved.
++NtQueryInformationProcessFn ResolveNtQueryInformationProcess() {
++  HMODULE ntdll = GetModuleHandleW(L"ntdll.dll");
++  if (!ntdll) {
++    return nullptr;
++  }
++  return reinterpret_cast<NtQueryInformationProcessFn>(
++      GetProcAddress(ntdll, "NtQueryInformationProcess"));
++}
++
++NtQueryInformationProcessFn NtQueryInformationProcessEntry() {
++  static NtQueryInformationProcessFn entry = ResolveNtQueryInformationProcess();
++  return entry;
++}
++
++bool StoreCommandLineUtf8(ProcessInfo& process_info, const wchar_t* data, size_t wide_length) {
++  if (wide_length == 0) {
++    return false;
++  }
++  int length = static_cast<int>(wide_length);
++  int charcount = WideCharToMultiByte(CP_UTF8, 0, data, length, NULL, 0, NULL, NULL);
++  if (!charcount) {
++    return false;
++  }
++  process_info.commandLine.resize(static_cast<size_t>(charcount));
++  WideCharToMultiByte(CP_UTF8, 0, data, length, &process_info.commandLine[0], charcount, NULL,
++                      NULL);
++  return true;
++}
++
++}  // namespace
++
++bool GetProcessCommandLine(ProcessInfo& process_info) {
++  NtQueryInformationProcessFn query = NtQueryInformationProcessEntry();
++  if (!query) {
++    return false;
++  }
++
++  HANDLE process = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE, process_info.pid);
++  if (process == NULL) {
++    return false;
++  }
++
++  ULONG size = 0;
++  NTSTATUS status = query(process, kProcessCommandLineInformation, nullptr, 0, &size);
++  if (NT_SUCCESS(status)) {
++    // Nothing was written, so there is no command line to read.
++    CloseHandle(process);
++    return false;
++  }
++  if (status != kStatusInfoLengthMismatch && status != kStatusBufferTooSmall) {
++    CloseHandle(process);
++    return false;
++  }
++  if (size < sizeof(UNICODE_STRING) || size > kMaxCommandLineBytes) {
++    CloseHandle(process);
++    return false;
++  }
++
++  std::vector<unsigned char> buffer(size);
++  status = query(process, kProcessCommandLineInformation, &buffer[0], size, &size);
++  CloseHandle(process);
++  if (!NT_SUCCESS(status)) {
++    return false;
++  }
++
++  // Header and characters arrive in one allocation, but treat the header as
++  // untrusted: a hooked ntdll is the case this reader is written for, and an
++  // unchecked Buffer/Length here would be an over-read encoded straight into JS.
++  // Bound against buffer.size(), never `size` -- the second query overwrote it.
++  const UNICODE_STRING* command_line = reinterpret_cast<const UNICODE_STRING*>(&buffer[0]);
++  const unsigned char* begin = &buffer[0];
++  const unsigned char* end = begin + buffer.size();
++  const unsigned char* chars = reinterpret_cast<const unsigned char*>(command_line->Buffer);
++  if (chars == nullptr || chars < begin + sizeof(UNICODE_STRING) || chars > end ||
++      command_line->Length > static_cast<ULONG>(end - chars)) {
++    return false;
++  }
++
++  // True only when a command line was actually stored, so "empty" and "not
++  // recovered" stay the same answer they were before this reader replaced the
++  // PEB read. `src/process.cc` discards the result either way.
++  return StoreCommandLineUtf8(process_info, command_line->Buffer,
++                              command_line->Length / sizeof(wchar_t));
++}
diff --git a/config/patches/node-pty@1.1.0.patch b/config/patches/node-pty@1.1.0.patch
index ff474f7d95e..8f5045b932a 100644
--- a/config/patches/node-pty@1.1.0.patch
+++ b/config/patches/node-pty@1.1.0.patch
@@ -603,7 +603,7 @@ index 7b4b9e1f990fbf95b51528bb56dc9717f5b87532..2ae787c5bd4f3eba470584dc658a01a5
  }
  #endif
 diff --git a/src/win/conpty.cc b/src/win/conpty.cc
-index 7b286d3d644c26141df516929703aa6e129df4b2..ec6bf3932c65b89c013ff133dc6bf46a6a4082ce 100644
+index 7b286d3d644c26141df516929703aa6e129df4b2..4aed260dd68e6a171dcfd349e9a7c5c97209248e 100644
 --- a/src/win/conpty.cc
 +++ b/src/win/conpty.cc
 @@ -18,6 +18,7 @@
@@ -614,7 +614,7 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..ec6bf3932c65b89c013ff133dc6bf46a
  #include <vector>
  #include <Windows.h>
  #include <strsafe.h>
-@@ -44,12 +45,29 @@ struct pty_baton {
+@@ -44,12 +45,39 @@ struct pty_baton {
    HANDLE hOut;
    HPCON hpc;
  
@@ -630,22 +630,32 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..ec6bf3932c65b89c013ff133dc6bf46a
 +  // refused to create or assign one (an outer job without breakaway rights),
 +  // in which case callers fall back to their pre-job behaviour.
 +  HANDLE hJob = nullptr;
++
++  // Orca: teardown needs BOTH the shell's death and an explicit kill() before
++  // the baton can be freed, so each side records that it has run. Whichever
++  // arrives second frees it. Freeing on the shell's death alone -- what this
++  // file did before -- destroyed the only record of `hpc` while
++  // ClosePseudoConsole was still owed, which is why a self-exiting shell
++  // leaked its pseudoconsole and the console host it reaps (#18601 / F24).
++  bool shellExited = false;
++  bool consoleClosed = false;
  
    pty_baton(int _id, HANDLE _hIn, HANDLE _hOut, HPCON _hpc) : id(_id), hIn(_hIn), hOut(_hOut), hpc(_hpc) {};
  };
  
  static std::vector<std::unique_ptr<pty_baton>> ptyHandles;
-+// Orca: guards the job accessors below against the exit watcher thread. It does
-+// NOT make the whole table safe -- PtyResize/PtyClear/PtyKill read it unlocked,
-+// as they always have -- but it closes the window this patch opened, where the
-+// watcher can close hShell/hJob and free the baton between a lookup and its use.
++// Orca: guards the job accessors below, and PtyKill, against the exit watcher
++// thread. It does NOT make the whole table safe -- PtyResize and PtyClear still
++// read it unlocked, as they always have -- but it closes the window this patch
++// opened, where the watcher can close hShell/hJob and free the baton between a
++// lookup and its use.
 +// Handle VALUES are recycled aggressively, so an unguarded read could pass the
 +// shell-pid check against an unrelated process and terminate the wrong job.
 +static std::mutex ptyJobMutex;
  static volatile LONG ptyCounter;
  
  static pty_baton* get_pty_baton(int id) {
-@@ -102,8 +120,27 @@ void SetupExitCallback(Napi::Env env, Napi::Function cb, pty_baton* baton) {
+@@ -102,8 +130,31 @@ void SetupExitCallback(Napi::Env env, Napi::Function cb, pty_baton* baton) {
      // Get process exit code.
      GetExitCodeProcess(baton->hShell, (LPDWORD)(&exit_event->exit_code));
      // Clean up handles
@@ -665,9 +675,13 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..ec6bf3932c65b89c013ff133dc6bf46a
 +      // Why inside the lock: erasing frees the baton the job accessors hold a
 +      // pointer to. Note remove_pty_baton must not be an assert() argument --
 +      // NDEBUG would compile the call away and leak every baton.
-+      const bool removed = remove_pty_baton(baton->id);
-+      assert(removed);
-+      (void)removed;
++      baton->shellExited = true;
++      if (baton->consoleClosed) {
++        const bool removed = remove_pty_baton(baton->id);
++        assert(removed);
++        (void)removed;
++      }
++      // Else PtyKill has not run yet and still owns hpc. It frees the baton.
 +    }
 +    // Why the lock ends here: BlockingCall below waits on the JS thread, and the
 +    // JS thread can be waiting on ptyJobMutex inside PtyTerminateJob. Holding
@@ -675,7 +689,7 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..ec6bf3932c65b89c013ff133dc6bf46a
  
      auto status = tsfn.BlockingCall(exit_event, callback); // In main thread
      switch (status) {
-@@ -409,6 +446,15 @@ static Napi::Value PtyConnect(const Napi::CallbackInfo& info) {
+@@ -409,6 +460,15 @@ static Napi::Value PtyConnect(const Napi::CallbackInfo& info) {
      throw errorWithCode(info, "UpdateProcThreadAttribute failed");
    }
  
@@ -691,7 +705,7 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..ec6bf3932c65b89c013ff133dc6bf46a
    PROCESS_INFORMATION piClient{};
    fSuccess = !!CreateProcessW(
        nullptr,
-@@ -416,7 +462,10 @@ static Napi::Value PtyConnect(const Napi::CallbackInfo& info) {
+@@ -416,7 +476,10 @@ static Napi::Value PtyConnect(const Napi::CallbackInfo& info) {
        nullptr,                      // lpProcessAttributes
        nullptr,                      // lpThreadAttributes
        false,                        // bInheritHandles VERY IMPORTANT that this is false
@@ -703,7 +717,7 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..ec6bf3932c65b89c013ff133dc6bf46a
        envArg,                       // lpEnvironment
        mutableCwd.get(),             // lpCurrentDirectory
        &siEx.StartupInfo,            // lpStartupInfo
-@@ -426,8 +475,47 @@ static Napi::Value PtyConnect(const Napi::CallbackInfo& info) {
+@@ -426,8 +489,47 @@ static Napi::Value PtyConnect(const Napi::CallbackInfo& info) {
      throw errorWithCode(info, "Cannot create process");
    }
  
@@ -753,7 +767,7 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..ec6bf3932c65b89c013ff133dc6bf46a
    if (useConptyDll && fLoadedDll)
    {
      PFNRELEASEPSEUDOCONSOLE const pfnReleasePseudoConsole = (PFNRELEASEPSEUDOCONSOLE)GetProcAddress(
-@@ -440,6 +528,8 @@ static Napi::Value PtyConnect(const Napi::CallbackInfo& info) {
+@@ -440,6 +542,8 @@ static Napi::Value PtyConnect(const Napi::CallbackInfo& info) {
  
    // Update handle
    handle->hShell = piClient.hProcess;
@@ -762,7 +776,91 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..ec6bf3932c65b89c013ff133dc6bf46a
  
    // Close the thread handle to avoid resource leak
    CloseHandle(piClient.hThread);
-@@ -567,6 +657,143 @@ static Napi::Value PtyKill(const Napi::CallbackInfo& info) {
+@@ -544,29 +648,215 @@ static Napi::Value PtyKill(const Napi::CallbackInfo& info) {
+   int id = info[0].As<Napi::Number>().Int32Value();
+   const bool useConptyDll = info[1].As<Napi::Boolean>().Value();
+ 
+-  const pty_baton* handle = get_pty_baton(id);
++  // Orca: resolve the DLL BEFORE touching any baton state, for the same reason
++  // PtyConnect does it before creating anything. LoadConptyDll throws when
++  // conpty.dll is missing, and a throw after consoleClosed was set would strand
++  // the pseudoconsole permanently: the retry would find the work already
++  // claimed and do nothing. Only the useConptyDll path can throw here; the
++  // other returns kernel32.
++  HANDLE hLibrary = LoadConptyDll(info, useConptyDll);
++  PFNCLOSEPSEUDOCONSOLE pfnClosePseudoConsole = nullptr;
++  if (hLibrary != nullptr) {
++    pfnClosePseudoConsole = (PFNCLOSEPSEUDOCONSOLE)GetProcAddress(
++      (HMODULE)hLibrary,
++      useConptyDll ? "ConptyClosePseudoConsole" : "ClosePseudoConsole");
++  }
+ 
+-  if (handle != nullptr) {
+-    HANDLE hLibrary = LoadConptyDll(info, useConptyDll);
+-    bool fLoadedDll = hLibrary != nullptr;
+-    if (fLoadedDll)
+-    {
+-      PFNCLOSEPSEUDOCONSOLE const pfnClosePseudoConsole = (PFNCLOSEPSEUDOCONSOLE)GetProcAddress(
+-        (HMODULE)hLibrary,
+-        useConptyDll ? "ConptyClosePseudoConsole" : "ClosePseudoConsole");
+-      if (pfnClosePseudoConsole)
+-      {
+-        pfnClosePseudoConsole(handle->hpc);
++  // Orca: the baton now outlives the shell, so this runs on a self-exited pty
++  // too -- that is the whole point. Take what we need under the lock: the
++  // watcher thread nulls hShell the moment the shell dies, and TerminateProcess
++  // on a handle it just closed is an invalid-handle operation. Duplicating
++  // rather than reordering keeps upstream's close-then-terminate sequence.
++  HPCON hpc = nullptr;
++  HANDLE hShellDup = nullptr;
++  bool owed = false;
++  {
++    std::lock_guard<std::mutex> guard(ptyJobMutex);
++    pty_baton* handle = get_pty_baton(id);
++    // Why the consoleClosed check: a second kill() would otherwise close the
++    // same pseudoconsole twice. Upstream relied on the baton being gone.
++    if (handle != nullptr && !handle->consoleClosed) {
++      hpc = handle->hpc;
++      owed = true;
++      handle->consoleClosed = true;
++      // Null hShell means a self-exited pty, where there is nothing to kill.
++      if (useConptyDll && handle->hShell != nullptr) {
++        if (!DuplicateHandle(GetCurrentProcess(), handle->hShell, GetCurrentProcess(),
++                             &hShellDup, 0, FALSE, DUPLICATE_SAME_ACCESS)) {
++          // Why terminate here instead of skipping: a failed duplication leaves
++          // hShellDup null, which is indistinguishable from the self-exit case,
++          // and skipping would leave the shell RUNNING after its pane closed --
++          // a worse outcome than the leak this all exists to fix. hShell is
++          // valid under this lock and TerminateProcess does not block, so the
++          // only cost is that this rare path kills before the console closes.
++          hShellDup = nullptr;
++          TerminateProcess(handle->hShell, 1);
++        }
++      }
++      if (handle->shellExited) {
++        const bool removed = remove_pty_baton(id);
++        assert(removed);
++        (void)removed;
+       }
++      // Else the shell is still running and the watcher frees the baton.
+     }
+-    if (useConptyDll) {
+-      TerminateProcess(handle->hShell, 1);
++  }
++
++  // Why outside the lock: ClosePseudoConsole blocks until the conout side has
++  // drained, and the watcher must be able to take the lock while it does.
++  if (owed) {
++    if (pfnClosePseudoConsole)
++    {
++      pfnClosePseudoConsole(hpc);
++    }
++    if (hShellDup != nullptr) {
++      TerminateProcess(hShellDup, 1);
++      CloseHandle(hShellDup);
+     }
+   }
+ 
    return env.Undefined();
  }
  
@@ -808,9 +906,11 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..ec6bf3932c65b89c013ff133dc6bf46a
 + * Orca: the pids still alive in this pty's tree, straight from the kernel.
 + *
 + * Descendant liveness for a tree that is still tracked, including children that
-+ * detached from the console. Once the shell exits the baton is gone, so this
-+ * returns null rather than an empty list -- null means "no answer", never
-+ * "they died". Also returns null when no job was assigned.
++ * detached from the console. Once the shell exits the watcher nulls hJob, which
++ * ownsShell rejects, so this returns null rather than an empty list -- null
++ * means "no answer", never "they died". (The baton itself now outlives the
++ * shell, until kill() runs; hJob is what makes the answer null.) Also returns
++ * null when no job was assigned.
 + *
 + * Does not include the ConPTY console host: CreatePseudoConsole spawns it
 + * before this job exists, so it is not a member and ClosePseudoConsole is what
@@ -906,7 +1006,7 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..ec6bf3932c65b89c013ff133dc6bf46a
  /**
  * Init
  */
-@@ -577,6 +804,9 @@ Napi::Object init(Napi::Env env, Napi::Object exports) {
+@@ -577,6 +867,9 @@ Napi::Object init(Napi::Env env, Napi::Object exports) {
    exports.Set("resize", Napi::Function::New(env, PtyResize));
    exports.Set("clear", Napi::Function::New(env, PtyClear));
    exports.Set("kill", Napi::Function::New(env, PtyKill));
@@ -917,7 +1017,7 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..ec6bf3932c65b89c013ff133dc6bf46a
  };
  
 diff --git a/lib/windowsPtyAgent.js b/lib/windowsPtyAgent.js
-index a358ffb..fb3a96f 100644
+index a358ffb177357e177661033c1b092f9c9d0e5f5a..26c2a4c58799ce649f5113131e4c52f7ed2d87ad 100644
 --- a/lib/windowsPtyAgent.js
 +++ b/lib/windowsPtyAgent.js
 @@ -136,6 +136,9 @@ var WindowsPtyAgent = /** @class */ (function () {
@@ -930,6 +1030,20 @@ index a358ffb..fb3a96f 100644
                  this._outSocket.readable = false;
                  this._getConsoleProcessList().then(function (consoleProcessList) {
                      consoleProcessList.forEach(function (pid) {
+@@ -154,9 +157,10 @@ var WindowsPtyAgent = /** @class */ (function () {
+                 // Close the input write handle to signal the end of session.
+                 this._inSocket.destroy();
+                 this._ptyNative.kill(this._pty, this._useConptyDll);
+-                this._outSocket.on('data', function () {
+-                    _this._conoutSocketWorker.dispose();
+-                });
++                // Orca: dispose unconditionally, as the non-DLL branch above does.
++                // Waiting for another 'data' event leaks the conout worker on every
++                // self-exiting shell, because no more data ever arrives (F24).
++                this._conoutSocketWorker.dispose();
+             }
+         }
+         else {
 diff --git a/lib/windowsTerminal.js b/lib/windowsTerminal.js
 index 3c38f89..e20b3e6 100644
 --- a/lib/windowsTerminal.js
@@ -1015,7 +1129,7 @@ index 3c38f89..e20b3e6 100644
 \ No newline at end of file
 +//# sourceMappingURL=windowsTerminal.js.map
 diff --git a/src/windowsPtyAgent.ts b/src/windowsPtyAgent.ts
-index d705444..ce611b8 100644
+index d7054449516f0c9a62af351c2caa17331206d530..0c28a32e2e1db2b3f208ddde8443cd4e67bb1ad6 100644
 --- a/src/windowsPtyAgent.ts
 +++ b/src/windowsPtyAgent.ts
 @@ -143,6 +143,9 @@ export class WindowsPtyAgent {
@@ -1028,6 +1142,20 @@ index d705444..ce611b8 100644
          this._outSocket.readable = false;
          this._getConsoleProcessList().then(consoleProcessList => {
            consoleProcessList.forEach((pid: number) => {
+@@ -159,9 +162,10 @@ export class WindowsPtyAgent {
+         // Close the input write handle to signal the end of session.
+         this._inSocket.destroy();
+         (this._ptyNative as IConptyNative).kill(this._pty, this._useConptyDll);
+-        this._outSocket.on('data', () => {
+-          this._conoutSocketWorker.dispose();
+-        });
++        // Orca: dispose unconditionally, as the non-DLL branch above does.
++        // Waiting for another 'data' event leaks the conout worker on every
++        // self-exiting shell, because no more data ever arrives (F24).
++        this._conoutSocketWorker.dispose();
+       }
+     } else {
+       // Because pty.kill closes the handle, it will kill most processes by itself.
 diff --git a/src/windowsTerminal.ts b/src/windowsTerminal.ts
 index 13f6c6d..eda63c8 100644
 --- a/src/windowsTerminal.ts
diff --git a/config/performance-audit.md b/config/performance-audit.md
new file mode 100644
index 00000000000..f105bfbe787
--- /dev/null
+++ b/config/performance-audit.md
@@ -0,0 +1,38 @@
+# Performance regression checks
+
+`pnpm --silent audit:perf > performance-audit.json` scans production `src/` with
+the existing app-store and buffer-concatenation rules plus the sort-comparator
+rule. Warnings are advisory in this full inventory; tool/parser failures fail.
+New warning findings on changed lines fail `pnpm check:code-quality:changed`.
+Tests, generated files, `mobile/` and `cloud/` are outside this source audit.
+
+The sort rule detects optioned `localeCompare` and `Intl.Collator` construction
+inside inline `sort`/`toSorted` callbacks. Construct one collator outside the
+callback, preserving locale, options and tie-breakers. If the locale changes at
+runtime, reconstruct at the next sort or key the cache by locale. Bare comparisons
+and standalone equality checks are allowed. There is no autofix or interprocedural
+analysis: named comparators, aliases, custom methods and deferred callbacks need
+manual review. A warning identifies repeated setup, not proof of visible lag.
+
+`pnpm test:perf:contracts` runs the explicit selection in
+`vitest.performance.config.ts`: SQLite statement reuse and schema parity, relay
+filesystem concurrency, tokenizer rejection, highlighting cache, queued
+cancellation, terminal backing-memory retention and detector fixtures. Missing
+listed files fail configuration loading. Tests run serially, without retries,
+and inherit the full suite's setup and forced-GC support. This makes existing
+regression coverage easy to run and attribute; it does not create new workload
+coverage by itself.
+
+`.github/workflows/performance-contracts.yml` runs daily and manually on Linux,
+macOS and Windows, and on PRs changing this tooling or any listed contract file.
+It uploads per-OS JSON test results, plus the source inventory once from Linux
+because that scan is OS-independent. Its schedule starts after merge. Run the existing
+`test:e2e:terminal-perf:scale:report` for rendered typing/frame budgets and
+`test:e2e:ssh-docker-perf` for real transport behavior. Relay unit tests do not
+measure SSH RTT, WSL scheduling or a packaged Electron renderer.
+
+To extend coverage, select a production-path regression with an operation-count,
+identity, queue-admission or retained-memory oracle. Confirm it fails with the
+old behavior. Use controlled, counterbalanced benchmark samples for timings;
+avoid new machine-dependent millisecond gates in the normal unit suite. A green
+source scan and these contracts cannot establish that the whole app is fast.
diff --git a/config/relay-assets/node-pty-1.1.0-windows-pty-teardown-patch.cjs b/config/relay-assets/node-pty-1.1.0-windows-pty-teardown-patch.cjs
new file mode 100644
index 00000000000..1e908754dc6
--- /dev/null
+++ b/config/relay-assets/node-pty-1.1.0-windows-pty-teardown-patch.cjs
@@ -0,0 +1,205 @@
+const { createHash } = require('node:crypto')
+const { readFileSync, renameSync, rmSync, writeFileSync } = require('node:fs')
+const { join, resolve } = require('node:path')
+
+/**
+ * Release the ConPTY teardown handles a relay's npm-installed node-pty never releases.
+ *
+ * Two files, and the ORDER of one of the edits is the whole fix.
+ *
+ * `windowsPtyAgent.js` -- `kill()` flips `readable` on both sockets and destroys neither.
+ * `_cleanUpProcess` destroys `_outSocket`, so the conout handle comes back; nothing ever destroys
+ * `_inSocket`, and it wraps a real Windows named-pipe handle from `fs.openSync(term.conin, 'w')`.
+ * Every terminal leaks one File handle for the life of the host process.
+ *
+ * The obvious fix -- and the placement `config/patches/node-pty@1.1.0.patch` uses -- releases it at
+ * the TOP of the branch, before `_getConsoleProcessList()` forks and before the native kill. That is
+ * measurably worse than leaving the leak alone: teardown aborts partway, the forked console-list
+ * agent is never reaped, and both pipe handles stay alive instead of one. This asset releases it at
+ * the END of the branch instead, after the fork and the kill have already happened.
+ *
+ * Measured on a Windows SSH host, 20 spawn/kill cycles, handles bucketed by NT object type
+ * (identical numbers standalone and through a real relay). Every row is the NON-DLL branch, which
+ * is the branch a relay runs -- see the divergence note below for why that matters:
+ *
+ *   published node-pty        File +1/terminal,  Process flat
+ *   desktop patch placement   File +2/terminal,  Process +1/terminal   <-- 3x WORSE
+ *   released last (here)      File flat,         Process flat
+ *
+ * `windowsTerminal.js` carries the desktop's error-listener hunks verbatim. The conin listener is
+ * what keeps a pipe error retiring one terminal instead of the host -- its own comment names the
+ * failure mode: "Without a listener, Node promotes errors such as write EAGAIN to uncaughtException".
+ * It is not what fixes the leak (adding it changed nothing on its own), but it is the guard that
+ * makes destroying conin safe at all.
+ *
+ * Why this ships as a relay asset rather than only in config/patches/node-pty@1.1.0.patch: pnpm
+ * patches do not cross the SSH boundary -- a relay host runs the tree `npm install` put there.
+ *
+ * DELIBERATE DIVERGENCE FROM THE DESKTOP, AND WHY IT IS NOT A DESKTOP-TERMINAL BUG: the two hosts
+ * do not run the same branch of `kill()`. node-pty defaults `_useConptyDll` to false
+ * (`windowsPtyAgent.js`). Every desktop site that opens a terminal pane sets it true --
+ * `local-pty-utils.ts` (two) and `native-pty-spawn.ts` -- as does the `windows-conpty-warmup.ts`
+ * warm-up, so all of those take the `else` branch, where UPSTREAM ALREADY destroys the input
+ * socket. The relay passes no such option (`src/relay/pty-handler.ts`), so it takes the
+ * `!useConptyDll` branch -- the one this asset and the desktop patch both edit.
+ *
+ * THE DESKTOP IS NOT ENTIRELY OFF THAT BRANCH. Two desktop sites omit the option and so run it
+ * too: the hidden rate-limit probes in `src/main/rate-limits/claude-pty.ts` and
+ * `codex-pty-rate-limit-probe.ts`. Both recur -- their fetchers poll -- and both tear down through
+ * `kill()`, so this hunk is live on the desktop, just never for a pane a user can see. Do not
+ * restate this as "the desktop never executes that branch": that sentence stood here for two
+ * revisions and is false.
+ *
+ * What the numbers above therefore do NOT cover: they were measured on relay-style spawn/kill
+ * cycles. Whether the early placement costs the same +2 File / +1 Process across a probe's
+ * lifecycle is UNMEASURED -- plausible, not established, and worth measuring before anyone quotes
+ * a desktop figure. What IS settled is the claim this comment replaced: that the desktop patch made
+ * every Windows user worse off ON EVERY TERMINAL. Terminals take the DLL branch, and the harness
+ * that produced that claim defaulted into the branch it was not trying to measure.
+ *
+ * The divergence is therefore about which branch each host runs for the workload that matters, not
+ * about a regression in the terminals users open. The test still pins it, because a future "sync
+ * the patches" would put the early placement onto the relay's branch, where it does cost +2 File
+ * and +1 Process per terminal.
+ *
+ * If you extend this enumeration, grep for `node-pty` rather than for a static import: those two
+ * probes were missed three times because they use `await import('node-pty')`.
+ *
+ * THE SELF-EXIT LEAK: FIXED FOR THE DESKTOP BY #18635, STILL LIVE ON A RELAY. A terminal that exits
+ * on its own is also torn down through `kill()` -- both hosts call `destroy()` on natural exit and
+ * `WindowsTerminal.destroy()` is `kill()` -- but the shell is already gone by then, so the ordering
+ * this asset relies on does not hold. Measured over 20 self-exit cycles on the NON-DLL branch:
+ * published +3 File/+1 Process per terminal, desktop patch placement +2/+1, this tree +2/+1. This
+ * asset does not close it.
+ *
+ * #18635 does, in `config/patches/node-pty@1.1.0.patch`: the baton outlives the shell so `PtyKill`
+ * still reaches `ClosePseudoConsole`, plus an unconditional conout dispose on the DLL branch. That
+ * fix does not reach a Windows relay, and no hunk in THIS file can carry it, because it is mostly
+ * NATIVE (`src/win/conpty.cc`) and this asset only rewrites `lib/*.js`. Three delivery paths exist
+ * and none currently covers Windows:
+ *
+ *   - the pnpm patch does not cross the SSH boundary -- the remote `npm install` yields upstream's
+ *     unpatched node-pty;
+ *   - the orcad prebuild matrix has no win32 entry (`MATRIX_SLOTS`,
+ *     `config/scripts/build-orcad-prebuilds.mjs`), so no Windows binary is ever compiled from
+ *     patched source to ship;
+ *   - a relay asset CAN patch native source and rebuild on the host -- that is exactly what
+ *     `node-pty-1.1.0-master-cloexec-patch.cjs` does -- but it returns
+ *     `skipped:unsupported-platform` for anything but linux/darwin. Extending it to win32 means
+ *     requiring an MSVC toolchain on the relay host, a far heavier precondition than on Linux,
+ *     where node-gyp already runs at install time.
+ *
+ * So a Windows SSH relay still leaks a pseudoconsole per self-exiting terminal, and closing it is a
+ * DELIVERY problem, not another hunk here. Do not read #18635's flat self-exit relay numbers as
+ * covering deployed relays: they were measured against a locally rebuilt binary, so they describe
+ * the relay CODE PATH on a patched tree, not the tree a relay host actually installs.
+ */
+
+const EXPECTED_NODE_PTY_VERSION = '1.1.0'
+
+/** Each entry is one published file, its patched form, and the edits between them. */
+const PATCH_TARGETS = [
+  {
+    relativePath: ['lib', 'windowsPtyAgent.js'],
+    originalSha256: '8636d16b38266112204061a22b135734177c242837982fd3a4055be726efa64a',
+    patchedSha256: '1e23ef480569e73706e3ab4f5482c7e553c76f51414ae8e7b0bdcc2fd75f7280',
+    replacements: [
+      [
+        '                this._ptyNative.kill(this._pty, this._useConptyDll);\n                this._conoutSocketWorker.dispose();\n',
+        '                this._ptyNative.kill(this._pty, this._useConptyDll);\n                this._conoutSocketWorker.dispose();\n                // Orca: released AFTER the console-list fork and the native kill, not before them.\n                // Destroying conin first aborts teardown partway -- measured on a Windows SSH relay\n                // as +2 File and +1 Process handles per terminal, against +1 File unpatched.\n                this._inSocket.destroy();\n'
+      ]
+    ]
+  },
+  {
+    relativePath: ['lib', 'windowsTerminal.js'],
+    originalSha256: 'c3a65716f53fed0135a8a633373d5f9c2ab092544d651f27ef0a67096dd3bcd9',
+    patchedSha256: '8247ecd69be8b18257050fb026b290024612c5ffc6d492ff1d46f81e613be2cf',
+    replacements: [
+      [
+        '        _this._agent = new windowsPtyAgent_1.WindowsPtyAgent(file, args, parsedEnv, cwd, _this._cols, _this._rows, false, opt.useConpty, opt.useConptyDll, opt.conptyInheritCursor);\n        _this._socket = _this._agent.outSocket;\n        // Not available until `ready` event emitted.\n        _this._pid = _this._agent.innerPid;',
+        "        _this._agent = new windowsPtyAgent_1.WindowsPtyAgent(file, args, parsedEnv, cwd, _this._cols, _this._rows, false, opt.useConpty, opt.useConptyDll, opt.conptyInheritCursor);\n        _this._socket = _this._agent.outSocket;\n        // Attach before readiness so a broken ConPTY output pipe cannot be unhandled.\n        _this._socket.on('error', function (err) {\n            var code = err && err.code;\n            // PTY output can report EPIPE before `_close()` wins the race.\n            _this._close();\n            if (code === 'EPIPE' || code === 'ERR_STREAM_PUSH_AFTER_EOF' || code === 'ERR_STREAM_DESTROYED') {\n                return;\n            }\n            // EIO, happens when someone closes our child process: the only process\n            // in the terminal.\n            // node < 0.6.14: errno 5\n            // node >= 0.6.14: read EIO\n            if (typeof code === 'string') {\n                if (~code.indexOf('errno 5') || ~code.indexOf('EIO'))\n                    return;\n            }\n            // Throw anything else.\n            if (_this.listeners('error').length < 2) {\n                throw err;\n            }\n        });\n        // Not available until `ready` event emitted.\n        _this._pid = _this._agent.innerPid;"
+      ],
+      [
+        "                }\n            });\n            // Shutdown if `error` event is emitted.\n            _this._socket.on('error', function (err) {\n                // Close terminal session.\n                _this._close();\n                // EIO, happens when someone closes our child process: the only process\n                // in the terminal.\n                // node < 0.6.14: errno 5\n                // node >= 0.6.14: read EIO\n                if (err.code) {\n                    if (~err.code.indexOf('errno 5') || ~err.code.indexOf('EIO'))\n                        return;\n                }\n                // Throw anything else.\n                if (_this.listeners('error').length < 2) {\n                    throw err;\n                }\n            });\n            // Cleanup after the socket is closed.\n            _this._socket.on('close', function () {",
+        "                }\n            });\n            // Cleanup after the socket is closed.\n            _this._socket.on('close', function () {"
+      ],
+      [
+        '        _this._readable = true;\n        _this._writable = true;\n        _this._forwardEvents();\n        return _this;',
+        "        _this._readable = true;\n        _this._writable = true;\n        // A ConPTY input-pipe error must retire only this terminal. Without a listener, Node promotes\n        // errors such as write EAGAIN to uncaughtException and kills every PTY in the daemon.\n        _this._agent.inSocket.on('error', function () {\n            if (!_this._writable) {\n                return;\n            }\n            _this._close();\n            try {\n                _this._agent.kill();\n            }\n            catch (_a) {\n                // The failing pipe may have raced process exit; the terminal is already unwritable.\n            }\n        });\n        _this._forwardEvents();\n        return _this;"
+      ],
+      [
+        'exports.WindowsTerminal = WindowsTerminal;\n//# sourceMappingURL=windowsTerminal.js.map',
+        'exports.WindowsTerminal = WindowsTerminal;\n//# sourceMappingURL=windowsTerminal.js.map\n'
+      ]
+    ]
+  }
+]
+
+function inspectTarget(relayDir, target) {
+  const nodePtyDir = resolve(relayDir, 'node_modules', 'node-pty')
+  const packageJson = JSON.parse(readFileSync(join(nodePtyDir, 'package.json'), 'utf8'))
+  if (packageJson.version !== EXPECTED_NODE_PTY_VERSION) {
+    throw new Error(
+      `Refusing to patch node-pty ${packageJson.version}; expected ${EXPECTED_NODE_PTY_VERSION}`
+    )
+  }
+  const filePath = join(nodePtyDir, ...target.relativePath)
+  return { filePath, source: readFileSync(filePath, 'utf8') }
+}
+
+function assertPatchedNodePtyWindowsTeardown(relayDir = process.cwd()) {
+  for (const target of PATCH_TARGETS) {
+    const inspected = inspectTarget(relayDir, target)
+    if (sourceSha256(inspected.source) !== target.patchedSha256) {
+      throw new Error(
+        `node-pty ConPTY teardown release is not installed in ${target.relativePath.join('/')}`
+      )
+    }
+  }
+}
+
+function patchNodePtyWindowsTeardown(relayDir = process.cwd()) {
+  for (const target of PATCH_TARGETS) {
+    const inspected = inspectTarget(relayDir, target)
+    const sourceHash = sourceSha256(inspected.source)
+    if (sourceHash === target.patchedSha256) {
+      continue
+    }
+    if (sourceHash !== target.originalSha256) {
+      throw new Error(
+        `Refusing to patch unexpected node-pty source in ${target.relativePath.join('/')}`
+      )
+    }
+    let patchedSource = inspected.source
+    for (const [from, to] of target.replacements) {
+      // Why the count check: an anchor that matched twice would patch the wrong site silently, and
+      // the hash below would then reject a tree this script had already rewritten.
+      if (patchedSource.split(from).length - 1 !== 1) {
+        throw new Error(`Refusing to patch ${target.relativePath.join('/')}; anchor is not unique`)
+      }
+      patchedSource = patchedSource.replace(from, to)
+    }
+    const temporaryPath = `${inspected.filePath}.orca-patch-${process.pid}`
+    // Why: a terminated remote install must leave either known source version recoverable on reconnect.
+    try {
+      writeFileSync(temporaryPath, patchedSource)
+      renameSync(temporaryPath, inspected.filePath)
+    } finally {
+      rmSync(temporaryPath, { force: true })
+    }
+  }
+  assertPatchedNodePtyWindowsTeardown(relayDir)
+}
+
+function sourceSha256(source) {
+  return createHash('sha256').update(source).digest('hex')
+}
+
+if (require.main === module) {
+  patchNodePtyWindowsTeardown()
+}
+
+module.exports = {
+  assertPatchedNodePtyWindowsTeardown,
+  patchNodePtyWindowsTeardown
+}
diff --git a/config/reliability-gates.jsonc b/config/reliability-gates.jsonc
index b7905fa0419..d48a239354f 100644
--- a/config/reliability-gates.jsonc
+++ b/config/reliability-gates.jsonc
@@ -10,6 +10,102 @@
     }
   },
   "gates": [
+    {
+      "id": "terminal-output.prestarted-shell-snapshot-adoption",
+      "title": "Prestarted shell adoption paints covered output once",
+      "maturity": "experimental",
+      "protection": "partial",
+      "owner": "terminal-runtime",
+      "layer": "renderer-transport-and-live-electron",
+      "surfaces": [
+        "backend-created first terminal",
+        "daemon snapshot adoption",
+        "deferred live output"
+      ],
+      "platforms": ["macos", "linux", "windows"],
+      "providers": ["local", "daemon", "wsl", "ssh", "remote-runtime"],
+      "coveredPlatforms": ["macos", "linux", "windows"],
+      "coveredProviders": ["local", "daemon", "wsl"],
+      "coverageNotes": "macOS daemon-backed Electron journey verifies same PID and terminal identity plus rendered output. Focused renderer contracts pass on Linux, Windows and WSL. Neighboring SSH model and replay contracts pass locally; no new live SSH or paired-runtime journey.",
+      "motivatingLinks": [
+        "https://github.com/user-attachments/assets/e8c6d1dc-6150-4c3d-b55a-3d12efefdd04",
+        "https://github.com/user-attachments/assets/b0328f88-34ac-4d51-8119-9efe17072435"
+      ],
+      "invariant": "Adopting a prestarted terminal preserves its existing process and paints snapshot-covered startup output once while retaining subsequent live output. Missing sequence proof or blank snapshots must not authorize dropping output.",
+      "oracle": "Pass snapshot sequence and proven zero keyboard flags through real IPC transport projection. Deliver snapshot-covered and newer output before reattach resolves; drain replay parse callbacks and require one startup marker and the newer output. Repeat with no sequence and blank snapshot to retain unproven bytes. In Electron select a prestarted workspace, type a generated marker and compare PID and stable terminal identities before and after.",
+      "commands": [
+        "pnpm test src/renderer/src/components/terminal-pane/pty-transport-connect-spawn.test.ts src/renderer/src/components/terminal-pane/pty-connection-deferred-reattach-live-output.test.ts",
+        "pnpm test src/renderer/src/components/terminal-pane/pty-transport-connect-spawn.test.ts src/renderer/src/components/terminal-pane/pty-connection-deferred-reattach-live-output.test.ts src/renderer/src/components/terminal-pane/pty-connection-hidden-snapshot-live-overlap.test.ts src/renderer/src/components/terminal-pane/pty-connection-replay-payload-handling.test.ts src/renderer/src/components/terminal-pane/pty-connection/reattach-payload-ssh-reconnect-model-paint.test.ts",
+        "pnpm test src/renderer/src/components/terminal-pane/pty-connection src/renderer/src/components/terminal-pane/pty-transport"
+      ],
+      "testFiles": [
+        "src/renderer/src/components/terminal-pane/pty-transport-connect-spawn.test.ts",
+        "src/renderer/src/components/terminal-pane/pty-connection-deferred-reattach-live-output.test.ts"
+      ],
+      "assertionRefs": [
+        {
+          "file": "src/renderer/src/components/terminal-pane/pty-transport-connect-spawn.test.ts",
+          "assertions": [
+            "zero and nonzero snapshot sequence and proven zero keyboard flags survive IPC projection"
+          ]
+        },
+        {
+          "file": "src/renderer/src/components/terminal-pane/pty-connection-deferred-reattach-live-output.test.ts",
+          "assertions": [
+            "startup output covered by the snapshot is painted once",
+            "new output remains visible",
+            "legacy unsequenced and blank snapshots retain bytes"
+          ]
+        }
+      ],
+      "evidenceRuns": [
+        {
+          "date": "2026-09-04",
+          "runner": "local",
+          "platform": "macos",
+          "command": "pnpm test src/renderer/src/components/terminal-pane/pty-transport-connect-spawn.test.ts src/renderer/src/components/terminal-pane/pty-connection-deferred-reattach-live-output.test.ts src/renderer/src/components/terminal-pane/pty-connection-hidden-snapshot-live-overlap.test.ts src/renderer/src/components/terminal-pane/pty-connection-replay-payload-handling.test.ts src/renderer/src/components/terminal-pane/pty-connection/reattach-payload-ssh-reconnect-model-paint.test.ts",
+          "result": "passed",
+          "durationSeconds": 2.34,
+          "summary": "5 suites / 48 tests pass. Focused 2-suite runs independently pass 27 tests on Linux, Windows and WSL."
+        },
+        {
+          "date": "2026-09-04",
+          "runner": "local",
+          "platform": "macos",
+          "command": "pnpm test src/renderer/src/components/terminal-pane/pty-connection src/renderer/src/components/terminal-pane/pty-transport",
+          "result": "passed",
+          "durationSeconds": 5.67,
+          "summary": "Broader connection/transport gate: 77 files and 813 tests passed, including neighboring restore, reconnect, input and replay behavior. Log: artifacts/worktree-create/orca-draft-replay-broader-gate.log."
+        }
+      ],
+      "runtimeBudget": {
+        "p95Seconds": 15,
+        "scope": "focused renderer transport and deferred-adoption contracts"
+      },
+      "flakeHistory": {
+        "status": "unknown",
+        "evidence": "Focused local and remote runs pass; no CI soak history."
+      },
+      "redGreenEvidence": {
+        "status": "partial",
+        "evidence": "Metadata tests fail before forwarding. Corrected parse-draining regression observes two startup markers when the baseline installation is removed, and one after restoration. Initial missing-live-output failure was a harness parse-drain omission and is not red proof. Before/fixed Electron screenshots show duplicate/single startup output."
+      },
+      "performanceBudget": {
+        "required": true,
+        "evidence": "Reuses existing snapshot baseline reconciliation with no new scan, timer or subprocess. Corrected daemon-backed rendered trial reaches replay at 116.6 ms and generated keyboard output at 177 ms after selecting the prestarted workspace. This measures selection/adoption, not ordinary composer creation."
+      },
+      "promotionCriteria": [
+        "Meet manifest CI and soak policy.",
+        "Retain intentional-break and rendered identity/output proof.",
+        "Exercise live SSH and paired-runtime snapshot adoption before claiming full provider coverage."
+      ],
+      "knownGaps": [
+        "Composer draft creation and cancellation are not implemented by this gate.",
+        "No new live SSH, Windows or WSL UI run; remote evidence is focused contract tests.",
+        "Mixed-version snapshots without sequence proof intentionally retain legacy behavior."
+      ],
+      "demotionRule": "Keep experimental or demote if adoption duplicates covered output, drops newer or unproven output, changes terminal ownership, or flakes without explanation."
+    },
     {
       "id": "cmd-j-tabs.host-qualified-candidate-ownership",
       "title": "Cmd-J tab candidates retain execution-host ownership",
@@ -2855,7 +2951,7 @@
         "https://github.com/stablyai/orca/pull/13876"
       ],
       "invariant": "Opening one HTML preview from a paired client renders the workspace document in exactly one client-local browser tab, located by that document and served over the orca-preview scheme. The client gains exactly that one browser workspace and it is the document one — blank where a URL page carries a URL, named by the document, with the chip naming the file — while the host gains no browser page at all, neither in its own page registry nor in the tab snapshot its clients publish into. The preview occupies its own split without taking focus from the source editor; an explicit click activates it, and closing it removes only the preview. Following a document from a file link is the other half of that switch and does move the reader to it, tab group included, whether the preview is new or already open, because opening a file is a request to look at it. A document tab quit with the client comes back as the same row on a grant the relaunched client mints afresh. A preview is named by the browser page it is open in, not by a namespace of its own, and the page registry has two halves: a workspace-document guest is registered in its own map and is absent from the browsing one entirely. That absence is the fence. Page, session and profile management, agent tab enumeration and command targeting, download routing and certificate attribution all read the browsing map directly, in more places than a per-channel guard could be remembered in, so none of them can name a document page and none of them carries a guard. Browser tools the reader drives (element grab, hover describe, selection capture, the annotation viewport bridge) are the one operation that legitimately spans the halves, and they go through the single authority that reads both, keyed by the page and its hosting renderer. The halves are disjoint in both directions: browsing registration refuses a page the document half already holds, and minting a grant refuses a page the browsing half already holds, so one id can never name a surface in both. The headless backend acts on that refusal by destroying the window it had already opened rather than leaving a policy-less page behind an id nothing can drive, keeping nothing under that id for its own shutdown to hand back. Registration refuses on the same terms when the guest it was asked about is already gone. The exit door is guarded in both its halves: a preview withdraws by revoking its grant and never through the unregister channel, so a page the document half holds arriving there is refused before either the registration teardown or the grab-state disposal beside it, which would otherwise drop the intent an in-flight preview grab compares by identity and leave that grab answering ok without ever arming its guest. A bridge request whose guest does not resolve is refused without tearing down the page it named, so a misaddressed request cannot cancel a healthy page's in-flight downloads and grabs. The annotation viewport bridge resolves its guest when its serialized op actually runs rather than when the request arrived, so a cross-process navigation while it waited cannot leave the bridge installed in a retired guest while the reader looks at a new one. State main keys by a preview's page is disposed when that page's grant is revoked, which is the only signal a preview's surface is gone. A tool asking for a page whose guest has not attached yet waits for that registration and arms when it arrives, rather than answering not-ready at the reader; that wait resolves only the request already naming this page, never the worktree-wide or any-tab waits the CLI and agents use to ask for a browser tab to drive. Handing the previewed document to the reader's own machine routes on the owners its grant was minted against — the file's own connection owner and the worktree's own runtime owner, neither read from the tab's stored fields. Only a document proven to live on this machine reaches the client OS; one with a resolved remote owner is downloaded first; and one whose owner cannot be resolved at all, workspace root included, is refused with a message naming that, because the download route would otherwise read the same absolute path on the client and hand back a same-named local file under the remote document's name. A runtime-owned path that falls outside its worktree root is refused by that route itself and surfaces as a failure toast rather than a download. Nothing the document does writes a file to this machine either: the preview partition denies downloads outright instead of routing them through the browser download flow, which has no page to attribute a preview's bytes to and would otherwise reserve a name in this desktop's Downloads folder and write them there unprompted. That refusal is visible to the reader and invisible to the document: the preview's shell carries a fixed sentence saying downloads are off, published at most once per preview per interval so a document asking in a loop cannot fill Orca's chrome, while the page itself gets back exactly what it got before, which is nothing. The sentence names no file, because the document chooses the name it offers; and a refusal never takes the document away the way an entry document's own failure does, whatever it names. A preview is a browser tab, not an editor tab in a preview mode: it is named the way a browser tab is named — by the document it shows when that document declares a title, and by the file it shows when it does not — while the chip goes on naming the file and the host whatever the document calls itself. A title is refused on the same terms the url is: a document that declares none has Chromium report the grant URL as its title, and that title is stored, mirrored onto the tab and written to disk, so anything carrying the scheme falls back to the file instead. It is created by the preview action as a page located by its document, it carries the workspace-relative path copy the editor's path header owned, and closing it revokes the grant that made the document readable while a URL tab closing beside it revokes nothing. Chrome persisted by builds that made previews editor tabs is dropped on restore rather than coming back naming a surface no restore can produce, and the ordinary editor tab for the same document is left alone. A document tab is held back at the mobile publish boundary — no client holds its grant, and the wire has no tab kind for it — while an ordinary browser tab beside it still publishes. It is held back from the group projection that publishes tab order, recency and group activity as well as from the tab list itself, so no published group names a tab the phone is never sent. A browser page can be located by a workspace document instead of a URL, and the document is the whole of its stored identity. The grant and the orca-preview URL that document is served over are minted when the page mounts and replaced by a hard reload, so neither is ever written to the page's url, mirrored onto its tab, persisted or published: such a page's url is the blank URL from creation through restore, including when a session written elsewhere carries a grant URL in, and what the session carries is the worktree and path a restored page mints afresh against today's owners. Every door onto a page's url holds that line — creation, the title update, and the navigation commit alike — so a report about a document page cannot give it a URL it never had, and the title fallback and the loading affordance follow the url each door actually wrote. The mirror carries the document too, so a tab entry cannot go on naming a document its active page has left. Every guest in the app is policy-attached through one door: a workspace document takes a restricted profile there rather than a separate installer beside it, so the attachment bookkeeping that door owns — what registration refuses, and what teardown frees — covers a preview on the same terms as a browsing page, and a preview takes none of the browsing machinery that door installs. That authority answers from the moment the embedder hands the guest over rather than only after a later navigation: the guest binds to the grant it is already showing, so the tools reach the document the reader opened and not just one they navigated to. A read the host reports as truncated or over-cap is refused rather than served partially, and a document outside the paired worktree is refused with a message naming that boundary instead of a bare read failure. The rendered document reaches nothing off-machine on its own: every served response carries a self-only content security policy, the preview session cancels any request that is not in-document, subframes cannot navigate outside the grant, a guest no document has yet bound to a grant may not navigate at all, the guest gathers no ICE candidates, and an SSH path that canonicalizes outside the grant root is refused before it is read. The one route out is a link the reader presses: a trusted click on an anchor, reported by the preview's own preload from a guest still bound to a live grant, leaves as an Orca browser tab rather than a native window or a dead click — and only after the reader confirms the exact destination URL, so a document cannot spend a single stray press exfiltrating what it can read into a link it authored. The preview hands its guest that focus itself whenever it is the surface the reader is in — a browsing page gets it from the chrome around it, and a preview has no chrome to get it from — and it does so only then, so a preview mounted behind a terminal or an editor never takes the keyboard from what the reader is actually in. It offers again when the window itself takes focus back and nothing in the embedder has claimed that focus, because another app coming to the front lands focus on the embedder rather than the guest and the route out would otherwise stay shut until something remounted the pane — while the same window focus also arrives when the reader presses a tab, that being the guest's own blur returning, and taking focus back from there would fight the reader for their own click. Nothing else does. A navigation or popup the document starts by itself is swallowed whatever else is happening, including immediately after a genuine press elsewhere in the document, so a page that can read its grant cannot hand it to a browser tab; a middle click opens nothing; and a fragment link is answered inside the document. A preview attach carries the preview preload and no renderer-supplied one, and no other attach path can acquire it. A subresource the workspace will not send degrades the document to a notice naming that file, never to a failure panel over a page that rendered. A grant outlives neither the tab that owns it nor the renderer document that minted it, and only the trusted renderer can mint or revoke one. For the browser creations this gate still owns, owner-pinned creation returns the canonical host page identity before navigation readiness; delayed navigation cannot turn a created page into an unidentifiable failure or a duplicate retry. Capability rejection before host mutation must preserve the original error, issue no RPC, surface a failure toast, and remove only a caller-declared newly-created empty split. Post-create reconciliation failure requires exact rollback; ambiguous rollback rejects without local fallback.",
-      "oracle": "In paired Electron, write an HTML fixture that declares its own title on the host, invoke the Explorer preview action on the client, and require the document text to be readable out of the orca-preview guest before judging any absence. With that presence established, require the client to hold exactly one browser workspace more than its baseline and that workspace to be the document one: page and tab url blank, the document path mirrored onto both, the tab named by the document's title, the chip naming the file, no editor row of the retired preview species anywhere, and the guest URL carrying the orca-preview scheme. Ask the host through its own page registry as well as through the tab snapshot, and in the same run open an ordinary URL browser tab from the same client and require that one to arrive in both — the presence precondition without which “the host gained nothing” is satisfied just as well by an oracle that cannot see browser pages at all. Require the preview to sit in a group other than the source editor's while the active group and tab remain the source editor's. Then click away to the terminal, click the preview tab, require it to reactivate and still render, close it with its own X, and require the document tab to be gone while the host still holds only the URL tab and the source group, source editor and terminal survive. Quit the client with a document tab open and relaunch it on the same profile: require the same workspace row to come back, blank and named by the document, rendering the document again over a grant URL that differs from the one that was quit, with no preview-scheme or document-named page anywhere in what the host holds. Prove the halves are live by flipping one product property at a time and requiring the run to fail: publish document workspaces to the host like ordinary ones, and stop mirroring the document onto the workspace row. Have the fixture document attempt its own egress on every load — an unattended window.open and location.href to an off-machine URL, plus an inline ICE gathering probe — and require the same baseline counts and a candidate count of zero, so the document's own attempts are measured rather than assumed. Then, as a separate phase after the close oracle has already run, bring the client window to the front, press the document's heading with a real mouse event, and require the document to report that the same press drove it to attempt a second window.open and location.href while both browser counts stay at that phase's baseline and nothing routes — the case a recent-input gate cannot distinguish from the press's own effect. Only then press the target=_blank link with a real mouse event and require both a recorded routing call that returned success and a browser count above that baseline, with the preview tab still open. Drive the preload's click policy as a unit oracle over a real document: a dispatched click, a trusted press on an external anchor, an anchor reached through what it wraps, an SVG animated href, a sibling preview link, fragment and percent-encoded fragment targets, a bare hash, and a middle click. Create a browser page located by a workspace document, handing creation a live grant URL, and require its stored url, its mirrored tab url and the written session payload all to be blank with no orca-preview string anywhere in what was written, while an ordinary page created the same way keeps the URL it was given and asks for the address bar the document page never does. Parse the written page and tab through the session schema and require the document to survive both halves. Hydrate them back and require the document page to return blank and still named — including when its page row was salvaged away and only the tab's own copy remains, and when a foreign session carried a grant URL into both rows. Drive the mirror across a page switch out of the document and back, and across a repair in which the document is the only mirrored field that differs. Name a document page from its document and require the tab to take that name, name it with an empty title and require the file, name it with a live grant URL and require the file again with no preview scheme anywhere in the written session, and require an ordinary blank browser tab beside it to still be called New Tab. Dispatch a title update out of a rendered preview's own guest and require it to reach the page state while the identity chip still reads the document's workspace-relative path. Attach a browsing guest and a workspace-document guest through the same method in one run and require the browsing one to take clicked-link routing, popup handling and anti-detection while the document guest takes none of them, stays inside the grant it is showing, denies every window it asks for, and is dropped from the page-keyed document registry by the same teardown that frees its id for a later attach. Register a browsing guest and attach a workspace-document guest in one run against the real manager, require the one door to answer each page with the guest of its own half, and require the document page to be absent from the browsing map and from its enumeration. Drive both browsing registration entry points with a page the document half already holds and require them to register nothing, and drive the mint channel with a page the browsing half already holds and require it to refuse; and drive the offscreen one with a guest that is missing and with one already destroyed, requiring the same refusal. Arm a grab on a live preview target, drive the unregister channel at that same target in the window before the queued operation runs, and require the grab to reach the guest anyway — then drive the same sequence for an ordinary browser page and require its grab state to be disposed after all. Hold one viewport-bridge op open, queue a second behind it, swap the page's guest while that second op waits, and require the injection to land in the guest the page has then. Revoke a grant after a tool has run against its page and require that page's grab state to be cancelled and disposed. Ask a tool for a document page whose guest has not attached, require the request to park in the registration wait, attach the guest, and require the same request to arm on it; require a page nothing ever renders to answer not-ready once that wait elapses. With a document open, ask a tool for a browsing page id and require it to be answered by the browsing half or not at all, with the same channel reaching the document guest under the page it really renders. Drive open-externally for a document whose per-file owner is remote while the workspace-scoped owner is unresolved, for a runtime-owned worktree whose preview tab carries no runtime id of its own, and for a worktree that resolves no runtime owner while the tab still carries one, requiring the download route in each; and for an owner that cannot be resolved at all, and for an unknown workspace root while nothing names another host, requiring a refusal that neither opens nor downloads. Drive the headless backend with a page the document half already holds and require it to reject, destroy the window, and unregister nothing — then shut the backend down and require it still to have unregistered nothing. Navigate a bound preview guest at a second grant through both latch events and require it to stay on the grant it bound to. Mount a preview while a renderer drag is already in flight and require its guest to be click-through at the moment it is appended, not a turn later. Render the editor panel shell in each remaining tab mode and require the path header exactly where the surface does not already name itself. Drive the preview action and require a browser tab located by the document rather than an editor tab, require a second open of the same document to activate the tab it is already in, and require closing that tab to revoke its grant while a URL tab closed beside it revokes none. Hydrate a session carrying preview chrome from a build that made previews editor tabs and require it dropped while the ordinary editor tab for the same document survives. Publish a worktree holding a document tab and a URL tab and require only the URL tab to reach the mobile snapshot. Install the shared partition policies for a preview partition and for an ordinary browsing partition in the same run, fire each one's own will-download listener, and require the preview's to cancel while the browsing one still reaches the download router — then require the preview protocol installer to be what asks for that deny. In the same run, require the cancelled download to raise a reader-facing notice and the routed one to raise none. Drive that notice directly for a guest bound to a live grant, for repeated attempts inside and outside its interval, for two previews at once, and for a contents no preview is bound to; require the guest registry to name the bound grant for a live preview guest and nothing for a contents that is not one, has committed no document, or is gone. Drive the shell with a refusal and require one fixed sentence, still one row after three more refusals, standing beside an asset failure rather than being counted with it, gone behind the failure panel, and ignored when it names another preview's grant. Drive the main-side report gate directly for a sender that is no preview guest, a guest with no bound or a revoked grant, a genuine press Electron's webview focus flag misreports as unfocused, and non-web URLs; drive the reader-facing confirmation for accept, cancel, and a confirmed tab the browser refuses; and drive will-attach-webview in both preload directions. Run the per-owner reader, grant-containment, scheme-admission, guest-policy, and plan-routing contracts as unit oracles, including a host-reported truncation, an over-cap binary, and an out-of-worktree paired path. Drive the reader-facing component with the payloads the reader can actually produce — the entry document fails only as truncated or unreadable, a subresource additionally as a refused format — and require the asset case to leave the guest mounted. Drive the closed-tab cleanup hook, the window installer, and the grant IPC handlers directly, requiring the grant to be released when the preview tab closes, cleared at window creation and on a cross-document main-frame navigation, and refused to any sender that is not the trusted renderer. For the browser creations this gate still owns, run the unchanged contract oracle for direct create and side-preview callers with absent status, unknown capabilities, and a mixed-version host, requiring the original unsupported error or visible toast, zero RPCs, and no retained new split; hold a real navigation response beyond the 15-second client deadline after host creation and require the first RPC to return the exact host inventory page ID, one host page, and no retry; repeat reconciliation faults against headless serve and retain the separate exact-page reconciliation rollback oracle.",
+      "oracle": "In paired Electron, write an HTML fixture that declares its own title on the host, invoke the Explorer preview action on the client, and require the document text to be readable out of the orca-preview guest before judging any absence. With that presence established, require the client to hold exactly one browser workspace more than its baseline and that workspace to be the document one: page and tab url blank, the document path mirrored onto both, the tab named by the document's title, the chip naming the file, no editor row of the retired preview species anywhere, and the guest URL carrying the orca-preview scheme. Ask the host through its own page registry as well as through the tab snapshot, and in the same run open an ordinary URL browser tab from the same client and require that one to arrive in both — the presence precondition without which “the host gained nothing” is satisfied just as well by an oracle that cannot see browser pages at all. Require the preview to sit in a group other than the source editor's while the active group and tab remain the source editor's. Then click away to the terminal, click the preview tab, require it to reactivate and still render, close it with its own X, and require the document tab to be gone while the host still holds only the URL tab and the source group, source editor and terminal survive. Quit the client with a document tab open and relaunch it on the same profile: require the same workspace row to come back, blank and named by the document, rendering the document again over a grant URL that differs from the one that was quit, with no preview-scheme or document-named page anywhere in what the host holds. Prove the halves are live by flipping one product property at a time and requiring the run to fail: publish document workspaces to the host like ordinary ones, and stop mirroring the document onto the workspace row. Have the fixture document attempt its own egress on every load — an unattended window.open and location.href to an off-machine URL, plus an inline ICE gathering probe — and require the same baseline counts and a candidate count of zero, so the document's own attempts are measured rather than assumed. Then, as a separate phase after the close oracle has already run, bring the client window to the front, press the document's heading with a real mouse event, and require the document to report that the same press drove it to attempt a second window.open and location.href while both browser counts stay at that phase's baseline and nothing routes — the case a recent-input gate cannot distinguish from the press's own effect. Only then press the target=_blank link with a real mouse event and require both a recorded routing call that returned success and a browser count above that baseline, with the preview tab still open. Drive the preload's click policy as a unit oracle over a real document: a dispatched click, a trusted press on an external anchor, an anchor reached through what it wraps, an SVG animated href, a sibling preview link, fragment and percent-encoded fragment targets, a bare hash, and a middle click. Create a browser page located by a workspace document, handing creation a live grant URL, and require its stored url, its mirrored tab url and the written session payload all to be blank with no orca-preview string anywhere in what was written, while an ordinary page created the same way keeps the URL it was given and asks for the address bar the document page never does. Parse the written page and tab through the session schema and require the document to survive both halves. Hydrate them back and require the document page to return blank and still named — including when its page row was salvaged away and only the tab's own copy remains, and when a foreign session carried a grant URL into both rows. Drive the mirror across a page switch out of the document and back, and across a repair in which the document is the only mirrored field that differs. Name a document page from its document and require the tab to take that name, name it with an empty title and require the file, name it with a live grant URL and require the file again with no preview scheme anywhere in the written session, and require an ordinary blank browser tab beside it to still be called New Tab. Dispatch a title update out of a rendered preview's own guest and require it to reach the page state while the identity chip still reads the document's workspace-relative path. Attach a browsing guest and a workspace-document guest through the same method in one run and require the browsing one to take clicked-link routing, popup handling and auth-identity detach tracking while the document guest takes none of them, stays inside the grant it is showing, denies every window it asks for, and is dropped from the page-keyed document registry by the same teardown that frees its id for a later attach. Register a browsing guest and attach a workspace-document guest in one run against the real manager, require the one door to answer each page with the guest of its own half, and require the document page to be absent from the browsing map and from its enumeration. Drive both browsing registration entry points with a page the document half already holds and require them to register nothing, and drive the mint channel with a page the browsing half already holds and require it to refuse; and drive the offscreen one with a guest that is missing and with one already destroyed, requiring the same refusal. Arm a grab on a live preview target, drive the unregister channel at that same target in the window before the queued operation runs, and require the grab to reach the guest anyway — then drive the same sequence for an ordinary browser page and require its grab state to be disposed after all. Hold one viewport-bridge op open, queue a second behind it, swap the page's guest while that second op waits, and require the injection to land in the guest the page has then. Revoke a grant after a tool has run against its page and require that page's grab state to be cancelled and disposed. Ask a tool for a document page whose guest has not attached, require the request to park in the registration wait, attach the guest, and require the same request to arm on it; require a page nothing ever renders to answer not-ready once that wait elapses. With a document open, ask a tool for a browsing page id and require it to be answered by the browsing half or not at all, with the same channel reaching the document guest under the page it really renders. Drive open-externally for a document whose per-file owner is remote while the workspace-scoped owner is unresolved, for a runtime-owned worktree whose preview tab carries no runtime id of its own, and for a worktree that resolves no runtime owner while the tab still carries one, requiring the download route in each; and for an owner that cannot be resolved at all, and for an unknown workspace root while nothing names another host, requiring a refusal that neither opens nor downloads. Drive the headless backend with a page the document half already holds and require it to reject, destroy the window, and unregister nothing — then shut the backend down and require it still to have unregistered nothing. Navigate a bound preview guest at a second grant through both latch events and require it to stay on the grant it bound to. Mount a preview while a renderer drag is already in flight and require its guest to be click-through at the moment it is appended, not a turn later. Render the editor panel shell in each remaining tab mode and require the path header exactly where the surface does not already name itself. Drive the preview action and require a browser tab located by the document rather than an editor tab, require a second open of the same document to activate the tab it is already in, and require closing that tab to revoke its grant while a URL tab closed beside it revokes none. Hydrate a session carrying preview chrome from a build that made previews editor tabs and require it dropped while the ordinary editor tab for the same document survives. Publish a worktree holding a document tab and a URL tab and require only the URL tab to reach the mobile snapshot. Install the shared partition policies for a preview partition and for an ordinary browsing partition in the same run, fire each one's own will-download listener, and require the preview's to cancel while the browsing one still reaches the download router — then require the preview protocol installer to be what asks for that deny. In the same run, require the cancelled download to raise a reader-facing notice and the routed one to raise none. Drive that notice directly for a guest bound to a live grant, for repeated attempts inside and outside its interval, for two previews at once, and for a contents no preview is bound to; require the guest registry to name the bound grant for a live preview guest and nothing for a contents that is not one, has committed no document, or is gone. Drive the shell with a refusal and require one fixed sentence, still one row after three more refusals, standing beside an asset failure rather than being counted with it, gone behind the failure panel, and ignored when it names another preview's grant. Drive the main-side report gate directly for a sender that is no preview guest, a guest with no bound or a revoked grant, a genuine press Electron's webview focus flag misreports as unfocused, and non-web URLs; drive the reader-facing confirmation for accept, cancel, and a confirmed tab the browser refuses; and drive will-attach-webview in both preload directions. Run the per-owner reader, grant-containment, scheme-admission, guest-policy, and plan-routing contracts as unit oracles, including a host-reported truncation, an over-cap binary, and an out-of-worktree paired path. Drive the reader-facing component with the payloads the reader can actually produce — the entry document fails only as truncated or unreadable, a subresource additionally as a refused format — and require the asset case to leave the guest mounted. Drive the closed-tab cleanup hook, the window installer, and the grant IPC handlers directly, requiring the grant to be released when the preview tab closes, cleared at window creation and on a cross-document main-frame navigation, and refused to any sender that is not the trusted renderer. For the browser creations this gate still owns, run the unchanged contract oracle for direct create and side-preview callers with absent status, unknown capabilities, and a mixed-version host, requiring the original unsupported error or visible toast, zero RPCs, and no retained new split; hold a real navigation response beyond the 15-second client deadline after host creation and require the first RPC to return the exact host inventory page ID, one host page, and no retry; repeat reconciliation faults against headless serve and retain the separate exact-page reconciliation rollback oracle.",
       "commands": [
         "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime-browser.test.ts src/main/runtime/rpc/methods/browser.test.ts src/renderer/src/lib/file-preview.test.ts src/renderer/src/runtime/web-session-browser-placement.test.ts src/renderer/src/runtime/web-runtime-session.test.ts src/renderer/src/runtime/web-session-tabs-sync.test.ts src/renderer/src/runtime/remote-server-parity.test.ts",
         "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/runtime/web-runtime-browser-materialization.test.ts",
@@ -17922,6 +18018,139 @@
         "The sentinel changes a pane title within an existing layout; concurrent split and close conflicts remain separate coverage."
       ],
       "demotionRule": "Demote if a failed push suppresses an identical retry, a successful equal write resumes redundant churn, or the routed observer journey flakes without a diagnosed cause."
+    },
+    {
+      "id": "ssh.docker-recovery-and-resource-lifecycle",
+      "title": "Docker SSH reconnect, host faults, listing and watcher lifecycle",
+      "maturity": "experimental",
+      "protection": "partial",
+      "owner": "terminal-runtime",
+      "layer": "electron-docker-ssh",
+      "surfaces": [
+        "SSH terminal recovery",
+        "SSH remote resource ownership",
+        "remote file listing",
+        "remote explorer watcher recovery",
+        "Electron test process cleanup"
+      ],
+      "platforms": ["macos", "linux", "windows"],
+      "providers": ["ssh"],
+      "coveredPlatforms": ["macos"],
+      "coveredProviders": ["ssh"],
+      "coverageNotes": "A macOS Electron client drives a Linux Docker SSH execution host. The six-spec suite passed ten enabled cases with clean worker exit (5.2m). The formerly skipped frozen-host input case now waits for recovered authority before sending input and passed four separate executions (one initial and three repetitions). The existing flooded-shell fixme remains an explicitly reproduced application gap.",
+      "motivatingLinks": [
+        "https://github.com/stablyai/orca/issues/18018",
+        "https://github.com/stablyai/orca/pull/18546",
+        "https://github.com/stablyai/orca/issues/12547"
+      ],
+      "invariant": "Transport loss and frozen-host silence must preserve the remote session; host relay loss may rebind a pane without accumulating reattachable leases. Reconnects must preserve usable terminal content, bounded PTYs/fds/processes, complete large listings, and independently recoverable watcher processes. Electron test shutdown must release inherited pipes after confirmed root exit without closing live-process pipes.",
+      "oracle": "Poll a changed connected SSH authority after injected faults, then require terminal output and appropriate PTY identity. Read remote process/fd state, listFiles replies, and rendered explorer rows. Resolve Playwright cleanup only after the root process exits and its inherited pipes close; live-process pipes remain untouched.",
+      "commands": [
+        "ORCA_E2E_SSH_DOCKER=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/ssh-docker-transport-drop-recovery.spec.ts tests/e2e/ssh-docker-half-open-link.spec.ts tests/e2e/ssh-docker-quick-open-large-listing.spec.ts tests/e2e/ssh-docker-reconnect-pane-restore.spec.ts tests/e2e/ssh-docker-resource-accumulation.spec.ts tests/e2e/ssh-docker-watcher-isolation.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
+        "pnpm exec vitest run --config config/vitest.config.ts tests/e2e/helpers/electron-process-shutdown.unit.test.ts"
+      ],
+      "testFiles": [
+        "tests/e2e/ssh-docker-transport-drop-recovery.spec.ts",
+        "tests/e2e/ssh-docker-half-open-link.spec.ts",
+        "tests/e2e/ssh-docker-quick-open-large-listing.spec.ts",
+        "tests/e2e/ssh-docker-reconnect-pane-restore.spec.ts",
+        "tests/e2e/ssh-docker-resource-accumulation.spec.ts",
+        "tests/e2e/ssh-docker-watcher-isolation.spec.ts",
+        "tests/e2e/helpers/electron-process-shutdown.unit.test.ts"
+      ],
+      "assertionRefs": [
+        {
+          "file": "tests/e2e/ssh-docker-transport-drop-recovery.spec.ts",
+          "assertions": [
+            "preserves transport-drop PTY and scrollback, replaces relay-loss binding, and keeps one reattachable lease per pane"
+          ]
+        },
+        {
+          "file": "tests/e2e/ssh-docker-half-open-link.spec.ts",
+          "assertions": [
+            "leaves connected after host freeze and renders process-produced output after recovery"
+          ]
+        },
+        {
+          "file": "tests/e2e/ssh-docker-quick-open-large-listing.spec.ts",
+          "assertions": [
+            "returns both a bounded client page and a complete legacy-client remote listing"
+          ]
+        },
+        {
+          "file": "tests/e2e/ssh-docker-reconnect-pane-restore.spec.ts",
+          "assertions": [
+            "restores shell scrollback and full-screen output and opens a usable fresh tab"
+          ]
+        },
+        {
+          "file": "tests/e2e/ssh-docker-resource-accumulation.spec.ts",
+          "assertions": [
+            "keeps remote pts devices, relay fds, process counts and inherited master fds bounded"
+          ]
+        },
+        {
+          "file": "tests/e2e/ssh-docker-watcher-isolation.spec.ts",
+          "assertions": [
+            "keeps rendered explorer changes and terminal output live after watcher crash and repairs a deleted watcher artifact"
+          ]
+        },
+        {
+          "file": "tests/e2e/helpers/electron-process-shutdown.unit.test.ts",
+          "assertions": [
+            "releases inherited pipes after confirmed exit, including prior exit",
+            "retains live-process pipes on shutdown timeout"
+          ]
+        }
+      ],
+      "evidenceRuns": [
+        {
+          "date": "2026-09-05",
+          "runner": "local",
+          "platform": "macos",
+          "result": "passed",
+          "command": "pnpm exec vitest run --config config/vitest.config.ts tests/e2e/helpers/electron-process-shutdown.unit.test.ts",
+          "durationSeconds": 0.168,
+          "summary": "All three shutdown regression tests passed; disabling pipe release fails the first two by timeout. Two half-open Electron repetitions separately passed in 1.7m without worker teardown timeout."
+        },
+        {
+          "date": "2026-09-05",
+          "runner": "local",
+          "platform": "macos",
+          "result": "passed",
+          "command": "ORCA_E2E_SSH_DOCKER=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/ssh-docker-transport-drop-recovery.spec.ts tests/e2e/ssh-docker-half-open-link.spec.ts tests/e2e/ssh-docker-quick-open-large-listing.spec.ts tests/e2e/ssh-docker-reconnect-pane-restore.spec.ts tests/e2e/ssh-docker-resource-accumulation.spec.ts tests/e2e/ssh-docker-watcher-isolation.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
+          "durationSeconds": 312,
+          "summary": "Six specs: ten passed, two existing fixme skipped, clean worker shutdown. Baseline same enabled suite: ten passed but worker teardown timed out (7.3m)."
+        }
+      ],
+      "runtimeBudget": {
+        "p95Seconds": 420,
+        "scope": "per Electron Docker test; measured suite p95 and CI soak not yet established"
+      },
+      "flakeHistory": {
+        "status": "flaky",
+        "evidence": "Baseline: ten enabled tests passed, two fixme skipped, worker teardown timed out (7.3m). After pipe cleanup: ten passed and worker exited cleanly (5.2m); two half-open repeats passed (1.7m). The formerly skipped thaw-input case failed before its recovered-authority wait and passed 1+3 executions afterward (56.9s + 2.6m). Flood failed both its original input oracle and a strengthened producer-completion oracle after recovery."
+      },
+      "redGreenEvidence": {
+        "status": "partial",
+        "evidence": "Disabling exited-process pipe release causes two shutdown contract tests to time out; restoring it passes 3/3. Baseline Docker worker teardown failed; final six-spec enabled run and half-open repeats exit successfully. Frozen-host input fails without the post-thaw recovered-authority wait and passes four runs with it. Full product fault/recovery mutation coverage and CI history remain missing."
+      },
+      "performanceBudget": {
+        "required": true,
+        "evidence": "Test-only bounded pipe destruction and authority polling; no production polling, subprocesses, or runtime work added. Remote resources are counted instead of using wall-clock leak thresholds."
+      },
+      "promotionCriteria": [
+        "Require complete six-spec repeat runs with clean worker shutdown.",
+        "Resolve the remaining #18018 flooded-shell reproduction and remove its fixme marker.",
+        "Collect CI runtime and flake history plus product red/green evidence before blocking."
+      ],
+      "knownGaps": [
+        "The disconnected 48MB flood still loses its relay channel: original post-flood input marker failed in 60s, and waiting for the finite producer completion marker failed in 120s. It remains an explicit #18018 fixme reproduction; frozen-host input is re-enabled after four successful runs.",
+        "Linux and Windows desktop clients, WSL, folder workspaces, paired runtimes and live agent CLIs are not exercised by these Docker specs.",
+        "Some legacy assertions inspect terminal serialization or backing state rather than rendered DOM; no blanket visual coverage claim.",
+        "No p95 CI history or full product mutation proof."
+      ],
+      "demotionRule": "Keep experimental while any recovery reproduction fails or any teardown, identity, resource-count, or rendered oracle flakes; never promote by extending sleeps or retries."
     }
   ]
 }
diff --git a/config/scripts/agent-inspection-cadence-batching-benchmark.mjs b/config/scripts/agent-inspection-cadence-batching-benchmark.mjs
new file mode 100644
index 00000000000..128627676c4
--- /dev/null
+++ b/config/scripts/agent-inspection-cadence-batching-benchmark.mjs
@@ -0,0 +1,139 @@
+#!/usr/bin/env node
+// Counts how many whole-host process-table captures the agent-completion cadence costs.
+//
+// Local panes all resolve out of one TTL-deduped snapshot, and the inspection queue collapses
+// every shared-observation task enqueued in the same tick onto a single capture. So the capture
+// count is the number of DISTINCT wake instants across panes, not the number of pane wakes.
+//
+// This drives the production interval picker (`nextCadenceInspectionDelayMs`) against a baseline
+// that reproduces the pre-change ±10% jitter, over a simulated wall-clock window.
+import { spawnSync } from 'node:child_process'
+import fs from 'node:fs'
+import nodeModule from 'node:module'
+import path from 'node:path'
+import process from 'node:process'
+import { fileURLToPath } from 'node:url'
+
+if (!process.execArgv.includes('--experimental-transform-types')) {
+  const result = spawnSync(
+    process.execPath,
+    ['--experimental-transform-types', '--no-warnings', import.meta.filename],
+    { stdio: 'inherit' }
+  )
+  process.exit(result.status ?? 1)
+}
+
+nodeModule.registerHooks({
+  resolve(specifier, context, nextResolve) {
+    if (specifier.startsWith('.') && !/\.[cm]?[jt]s$/.test(specifier) && context.parentURL) {
+      const candidate = new URL(`${specifier}.ts`, context.parentURL)
+      if (fs.existsSync(fileURLToPath(candidate))) {
+        return { url: candidate.href, shortCircuit: true }
+      }
+    }
+    return nextResolve(specifier, context)
+  }
+})
+
+const ROOT = path.resolve(import.meta.dirname, '../..')
+const WINDOW_MS = Number(process.env.ORCA_INSPECTION_BENCH_WINDOW_MS ?? '60000')
+const PANE_COUNTS = (process.env.ORCA_INSPECTION_BENCH_PANES ?? '1,2,4,8')
+  .split(',')
+  .map((value) => Number(value.trim()))
+
+if (!Number.isSafeInteger(WINDOW_MS) || WINDOW_MS <= 0) {
+  throw new Error(`ORCA_INSPECTION_BENCH_WINDOW_MS must be a positive integer, got ${WINDOW_MS}`)
+}
+for (const paneCount of PANE_COUNTS) {
+  if (!Number.isSafeInteger(paneCount) || paneCount <= 0) {
+    throw new Error(`ORCA_INSPECTION_BENCH_PANES entries must be positive, got ${paneCount}`)
+  }
+}
+
+const { nextCadenceInspectionDelayMs } = await import(
+  path.join(ROOT, 'src/renderer/src/components/terminal-pane/agent-completion-poll-interval.ts')
+)
+const { POLL_TIER_INTERVAL_MS } = await import(
+  path.join(ROOT, 'src/renderer/src/components/terminal-pane/agent-completion-poll-cadence.ts')
+)
+const { PROCESS_TABLE_SNAPSHOT_MAX_STALENESS_MS } = await import(
+  path.join(ROOT, 'src/shared/process-table-snapshot-reader.ts')
+)
+
+// Pre-change: independent ±10% jitter per pane, re-rolled on every reschedule.
+function baselineDelayMs(baseMs) {
+  return Math.round(baseMs * (1 + (Math.random() * 0.2 - 0.1)))
+}
+
+function simulate(paneCount, baseMs, pickDelay) {
+  const startedAt = 1_700_000_000_000
+  const wakes = []
+  for (let pane = 0; pane < paneCount; pane += 1) {
+    // Panes mount at arbitrary moments, which is what spreads them apart in the first place.
+    let clock = startedAt + Math.floor(Math.random() * baseMs)
+    while ((clock += pickDelay(baseMs, clock)) < startedAt + WINDOW_MS) {
+      wakes.push(clock)
+    }
+  }
+  // A wake is served from the snapshot the previous capture produced until that snapshot's TTL
+  // lapses, so the TTL window starts at the capture, not on an epoch grid.
+  let captures = 0
+  let snapshotExpiresAt = -Infinity
+  for (const wakeAt of wakes.sort((left, right) => left - right)) {
+    if (wakeAt >= snapshotExpiresAt) {
+      captures += 1
+      snapshotExpiresAt = wakeAt + PROCESS_TABLE_SNAPSHOT_MAX_STALENESS_MS
+    }
+  }
+  return captures
+}
+
+function medianOf(rounds, run) {
+  const samples = Array.from({ length: rounds }, run).sort((left, right) => left - right)
+  return samples[Math.floor(samples.length / 2)]
+}
+
+const baseMs = POLL_TIER_INTERVAL_MS.idle
+console.log(
+  `Agent-completion cadence — whole-host \`ps\` captures over ${WINDOW_MS / 1000}s at the idle tier (${baseMs}ms)\n`
+)
+console.log('| visible panes | before | after | reduction |')
+console.log('| --- | --- | --- | --- |')
+for (const paneCount of PANE_COUNTS) {
+  const before = medianOf(21, () => simulate(paneCount, baseMs, baselineDelayMs))
+  const after = medianOf(21, () =>
+    simulate(paneCount, baseMs, (base, now) =>
+      nextCadenceInspectionDelayMs({
+        baseMs: base,
+        hasConsecutiveErrors: false,
+        alignToSharedGrid: true,
+        now
+      })
+    )
+  )
+  // A window shorter than one cadence tier can leave the baseline at zero; reporting a
+  // percentage off that divides by zero and prints a meaningless reduction.
+  const reduction = before > 0 ? `${(((before - after) / before) * 100).toFixed(0)}%` : 'n/a'
+  console.log(`| ${paneCount} | ${before} | ${after} | ${reduction} |`)
+}
+
+// Detection latency must not regress: the grid deadline is always within one interval.
+let worstDelay = 0
+for (let sample = 0; sample < 100_000; sample += 1) {
+  const now = 1_700_000_000_000 + sample * 7
+  worstDelay = Math.max(
+    worstDelay,
+    nextCadenceInspectionDelayMs({
+      baseMs,
+      hasConsecutiveErrors: false,
+      alignToSharedGrid: true,
+      now
+    })
+  )
+}
+if (worstDelay > baseMs) {
+  throw new Error(`grid alignment delayed a poll to ${worstDelay}ms, above the ${baseMs}ms tier`)
+}
+console.log(
+  `\nWorst observed wait: ${worstDelay}ms (tier interval ${baseMs}ms) — no inspection is ever delayed.`
+)
diff --git a/config/scripts/benchmark-browser-tunnel-framing.mjs b/config/scripts/benchmark-browser-tunnel-framing.mjs
new file mode 100644
index 00000000000..e91fd0887f6
--- /dev/null
+++ b/config/scripts/benchmark-browser-tunnel-framing.mjs
@@ -0,0 +1,110 @@
+import assert from 'node:assert/strict'
+import { execFileSync } from 'node:child_process'
+import { readFileSync } from 'node:fs'
+import { stripTypeScriptTypes } from 'node:module'
+import { performance } from 'node:perf_hooks'
+
+// Run from the worktree root: node config/scripts/benchmark-browser-tunnel-framing.mjs [base-ref]
+const path = 'src/shared/browser-network-tunnel-stream-framing.ts'
+const baselineRef = process.argv[2] ?? 'HEAD'
+const beforeSource = execFileSync('git', ['show', `${baselineRef}:${path}`], {
+  encoding: 'utf8'
+})
+const afterSource = readFileSync(path, 'utf8')
+const load = (source) =>
+  import(
+    `data:text/javascript;base64,${Buffer.from(
+      stripTypeScriptTypes(source, { mode: 'transform' })
+    ).toString('base64')}`
+  )
+const before = await load(beforeSource)
+const after = await load(afterSource)
+
+function measure(module, chunks, payload, repetitions) {
+  let frameCount = 0
+  let lastFrame
+  const onFrame = (frame) => {
+    frameCount++
+    lastFrame = frame
+  }
+  const onError = (error) => {
+    throw error
+  }
+  const run = () => {
+    const decoder = new module.BrowserNetworkTunnelStreamFrameDecoder(onFrame, onError)
+    for (const chunk of chunks) {
+      decoder.feed(chunk)
+    }
+  }
+  run()
+  assert.deepEqual(lastFrame, payload)
+  const samples = []
+  for (let sample = 0; sample < 5; sample++) {
+    const start = performance.now()
+    for (let iteration = 0; iteration < repetitions; iteration++) {
+      run()
+    }
+    samples.push((performance.now() - start) / repetitions)
+  }
+  assert.equal(frameCount, 1 + 5 * repetitions)
+  return samples.sort((a, b) => a - b)[2]
+}
+
+function countCopies(module, chunks) {
+  const originalSet = Uint8Array.prototype.set
+  const originalSlice = Uint8Array.prototype.slice
+  let copied = 0
+  Uint8Array.prototype.set = function (source, offset) {
+    copied += source.length
+    return originalSet.call(this, source, offset)
+  }
+  Uint8Array.prototype.slice = function (...args) {
+    const result = originalSlice.apply(this, args)
+    copied += result.length
+    return result
+  }
+  try {
+    const decoder = new module.BrowserNetworkTunnelStreamFrameDecoder(
+      () => {},
+      (error) => {
+        throw error
+      }
+    )
+    for (const chunk of chunks) {
+      decoder.feed(chunk)
+    }
+  } finally {
+    Uint8Array.prototype.set = originalSet
+    Uint8Array.prototype.slice = originalSlice
+  }
+  return copied
+}
+
+const rows = []
+for (const [payloadBytes, chunkBytes, repetitions] of [
+  [1, 5, 10000],
+  [64 * 1024, 65540, 1000],
+  [64 * 1024, 4096, 100],
+  [64 * 1024, 256, 25],
+  [64 * 1024, 16, 5],
+  [64 * 1024, 1, 1]
+]) {
+  const payload = Uint8Array.from({ length: payloadBytes }, (_, index) => index % 251)
+  const encoded = before.encodeBrowserNetworkTunnelStreamFrame(payload)
+  const chunks = []
+  for (let offset = 0; offset < encoded.length; offset += chunkBytes) {
+    chunks.push(encoded.subarray(offset, offset + chunkBytes))
+  }
+  const beforeMs = measure(before, chunks, payload, repetitions)
+  const afterMs = measure(after, chunks, payload, repetitions)
+  rows.push({
+    payloadBytes,
+    chunkBytes,
+    beforeMs: +beforeMs.toFixed(6),
+    afterMs: +afterMs.toFixed(6),
+    speedup: +(beforeMs / afterMs).toFixed(2),
+    beforeCopiedBytes: countCopies(before, chunks),
+    afterCopiedBytes: countCopies(after, chunks)
+  })
+}
+console.log(JSON.stringify({ node: process.version, baselineRef, rows }, null, 2))
diff --git a/config/scripts/benchmark-cli-error-imports.mjs b/config/scripts/benchmark-cli-error-imports.mjs
new file mode 100644
index 00000000000..a4648f84aec
--- /dev/null
+++ b/config/scripts/benchmark-cli-error-imports.mjs
@@ -0,0 +1,121 @@
+import assert from 'node:assert/strict'
+import { createRequire } from 'node:module'
+import { existsSync, realpathSync } from 'node:fs'
+import { delimiter, join, resolve } from 'node:path'
+
+// Emit each revision with tsc -p config/tsconfig.cli.json --outDir <dir> --composite false --incremental false.
+// Run: node config/scripts/benchmark-cli-error-imports.mjs <before-dir> <after-dir>
+const [beforeDir, afterDir] = process.argv.slice(2)
+assert.ok(beforeDir && afterDir, 'Pass distinct before and after TypeScript output directories.')
+assert.notEqual(
+  realpathSync(beforeDir),
+  realpathSync(afterDir),
+  'Do not compare a build to itself.'
+)
+const entries = {
+  before: join(resolve(beforeDir), 'cli', 'index.js'),
+  after: join(resolve(afterDir), 'cli', 'index.js')
+}
+for (const entry of Object.values(entries)) {
+  assert.ok(existsSync(entry), `Missing emitted CLI: ${entry}`)
+}
+
+const { runProcessSync } = createRequire(import.meta.url)(
+  join(resolve(afterDir), 'shared', 'child-process', 'run-process.js')
+)
+
+const child = String.raw`
+  const { performance } = require('node:perf_hooks')
+  const { writeSync } = require('node:fs')
+  const { createHash } = require('node:crypto')
+  const { basename } = require('node:path')
+  let stdout = '', stderr = ''
+  process.stdout.write = (text) => { stdout += text; return true }
+  process.stderr.write = (text) => { stderr += text; return true }
+  const started = performance.now()
+  const cli = require(process.argv[1])
+  const importMs = performance.now() - started
+  cli.main(JSON.parse(process.argv[2])).then(() => {
+    const totalMs = performance.now() - started
+    const modules = Object.keys(require.cache)
+    writeSync(1, JSON.stringify({
+      importMs, totalMs, modules: modules.length,
+      featureFormatters: modules.filter((file) => ['browser', 'terminal', 'project', 'automation', 'workspace', 'computer'].some((name) => basename(file) === name + '-format.js')),
+      stdout: createHash('sha256').update(stdout).digest('hex'),
+      stderr: createHash('sha256').update(stderr).digest('hex'),
+      exitCode: process.exitCode || 0
+    }))
+    process.exitCode = 0
+  }).catch((error) => { writeSync(2, String(error)); process.exitCode = 1 })
+`
+const cases = [
+  ['--help'],
+  ['help', 'terminal', 'read'],
+  ['does-not-exist'],
+  ['computer', 'click', '--does-not-exist'],
+  ['does-not-exist', '--json']
+]
+const median = (values) => [...values].sort((a, b) => a - b)[Math.floor(values.length / 2)]
+const summarize = (samples) => ({
+  importMs: median(samples.map((sample) => sample.importMs)),
+  totalMs: median(samples.map((sample) => sample.totalMs)),
+  modules: samples[0].modules
+})
+const rows = []
+for (const args of cases) {
+  const samples = { before: [], after: [] }
+  let expected
+  for (let run = 0; run < 22; run++) {
+    for (const variant of run % 2 ? ['after', 'before'] : ['before', 'after']) {
+      const result = runProcessSync({
+        program: process.execPath,
+        args: ['-e', child, entries[variant], JSON.stringify(args)],
+        timeoutMs: 30_000,
+        env: {
+          ...process.env,
+          NODE_PATH: [resolve('node_modules'), process.env.NODE_PATH]
+            .filter(Boolean)
+            .join(delimiter)
+        }
+      })
+      assert.equal(result.timedOut, false, 'CLI child timed out.')
+      assert.equal(result.code, 0, result.stderr)
+      const sample = JSON.parse(result.stdout)
+      const output = { stdout: sample.stdout, stderr: sample.stderr, exitCode: sample.exitCode }
+      expected ??= output
+      assert.deepEqual(output, expected, `${variant} output changed for ${args.join(' ')}`)
+      if (variant === 'after') {
+        assert.deepEqual(
+          sample.featureFormatters,
+          [],
+          'Help and syntax errors must skip feature formatters.'
+        )
+      }
+      if (run >= 2) {
+        samples[variant].push(sample)
+      }
+    }
+  }
+  assert.ok(samples.after[0].modules < samples.before[0].modules, 'Expected fewer loaded modules.')
+  rows.push({
+    args,
+    before: summarize(samples.before),
+    after: summarize(samples.after),
+    output: expected,
+    samples
+  })
+}
+console.log(
+  JSON.stringify(
+    {
+      node: process.version,
+      platform: process.platform,
+      measurement:
+        'Fresh-process import + main; excludes process creation; warmed filesystem; 2 warmups and 20 samples per variant, alternating order.',
+      entries,
+      rows
+    },
+    null,
+    2
+  )
+)
diff --git a/config/scripts/benchmark-cli-response-framing.mjs b/config/scripts/benchmark-cli-response-framing.mjs
new file mode 100644
index 00000000000..40aab8d08f7
--- /dev/null
+++ b/config/scripts/benchmark-cli-response-framing.mjs
@@ -0,0 +1,128 @@
+import assert from 'node:assert/strict'
+import { execFileSync } from 'node:child_process'
+import { EventEmitter } from 'node:events'
+import { readFileSync } from 'node:fs'
+import Module from 'node:module'
+import { dirname, resolve } from 'node:path'
+import { performance } from 'node:perf_hooks'
+import { build } from 'esbuild'
+
+// Run from the worktree root: node config/scripts/benchmark-cli-response-framing.mjs <base-ref>
+const sourcePath = 'src/cli/runtime/transport.ts'
+const baselineRef = process.argv[2]
+assert.ok(baselineRef, 'Pass the pre-change transport revision as base-ref.')
+const beforeSource = execFileSync('git', ['show', `${baselineRef}:${sourcePath}`], {
+  encoding: 'utf8'
+})
+let chunks = []
+
+async function loadTransport(source) {
+  const built = await build({
+    stdin: { contents: source, loader: 'ts', resolveDir: dirname(resolve(sourcePath)) },
+    bundle: true,
+    platform: 'node',
+    format: 'cjs',
+    write: false,
+    logLevel: 'silent'
+  })
+  const module = new Module(resolve(sourcePath))
+  const originalRequire = module.require.bind(module)
+  module.require = (name) => {
+    if (name === 'node:crypto') {
+      return { randomUUID: () => 'benchmark-request' }
+    }
+    if (name !== 'node:net') {
+      return originalRequire(name)
+    }
+    return {
+      createConnection() {
+        const socket = new EventEmitter()
+        socket.setEncoding = () => {}
+        socket.end = () => {}
+        socket.destroy = () => {}
+        socket.write = () => {
+          for (const chunk of chunks) {
+            socket.emit('data', chunk)
+          }
+        }
+        queueMicrotask(() => socket.emit('connect'))
+        return socket
+      }
+    }
+  }
+  module._compile(built.outputFiles[0].text, resolve(sourcePath))
+  return module.exports.sendRequest
+}
+
+const before = await loadTransport(beforeSource)
+const after = await loadTransport(readFileSync(sourcePath, 'utf8'))
+const metadata = {
+  runtimeId: 'benchmark-runtime',
+  authToken: 'benchmark-token',
+  transports: [{ kind: 'unix', endpoint: 'injected-socket' }]
+}
+const run = (sendRequest) => sendRequest(metadata, 'terminal.read', {}, 30000)
+
+async function measure(sendRequest, payloadBytes, repetitions) {
+  const warmup = await run(sendRequest)
+  assert.equal(warmup.result.data.length, payloadBytes)
+  const samples = []
+  for (let sample = 0; sample < 5; sample++) {
+    const start = performance.now()
+    for (let iteration = 0; iteration < repetitions; iteration++) {
+      await run(sendRequest)
+    }
+    samples.push((performance.now() - start) / repetitions)
+  }
+  return samples.sort((a, b) => a - b)[2]
+}
+
+async function searchedCharacters(sendRequest) {
+  const original = String.prototype.indexOf
+  let searched = 0
+  String.prototype.indexOf = function (needle, position) {
+    if (needle === '\n') {
+      searched += this.length - (position ?? 0)
+    }
+    return original.call(this, needle, position)
+  }
+  try {
+    await run(sendRequest)
+  } finally {
+    String.prototype.indexOf = original
+  }
+  return searched
+}
+
+const rows = []
+for (const [payloadBytes, chunkChars, repetitions] of [
+  [32, 65536, 1000],
+  [1024 * 1024, 2 * 1024 * 1024, 20],
+  [1024 * 1024, 65536, 10],
+  [1024 * 1024, 4096, 5],
+  [4 * 1024 * 1024, 4096, 2],
+  [4 * 1024 * 1024, 256, 1]
+]) {
+  const line = `${JSON.stringify({
+    id: 'benchmark-request',
+    ok: true,
+    result: { data: 'x'.repeat(payloadBytes) },
+    _meta: { runtimeId: 'benchmark-runtime' }
+  })}\n`
+  chunks = []
+  for (let offset = 0; offset < line.length; offset += chunkChars) {
+    chunks.push(line.slice(offset, offset + chunkChars))
+  }
+  const beforeMs = await measure(before, payloadBytes, repetitions)
+  const afterMs = await measure(after, payloadBytes, repetitions)
+  rows.push({
+    payloadBytes,
+    chunkChars,
+    beforeMs: +beforeMs.toFixed(6),
+    afterMs: +afterMs.toFixed(6),
+    speedup: +(beforeMs / afterMs).toFixed(2),
+    beforeSearchedCharacters: await searchedCharacters(before),
+    afterSearchedCharacters: await searchedCharacters(after)
+  })
+}
+console.log(JSON.stringify({ node: process.version, baselineRef, rows }, null, 2))
diff --git a/config/scripts/benchmark-explorer-dotfile-filter.mjs b/config/scripts/benchmark-explorer-dotfile-filter.mjs
new file mode 100644
index 00000000000..e66a0ceb5af
--- /dev/null
+++ b/config/scripts/benchmark-explorer-dotfile-filter.mjs
@@ -0,0 +1,165 @@
+import assert from 'node:assert/strict'
+import { readFileSync } from 'node:fs'
+import Module from 'node:module'
+import { resolve } from 'node:path'
+import { performance } from 'node:perf_hooks'
+import { build } from 'esbuild'
+
+// Pass the pre-change file-explorer-entries.ts snapshot as the only argument.
+const baselinePath = process.argv[2]
+assert.ok(baselinePath, 'Pass a pre-change file-explorer-entries.ts snapshot.')
+const entry = 'src/renderer/src/components/right-sidebar/file-explorer-entries.ts'
+const baseline = readFileSync(baselinePath, 'utf8')
+assert.notEqual(baseline, readFileSync(entry, 'utf8'), 'Do not compare the source to itself.')
+
+async function load(useBaseline) {
+  const result = await build({
+    stdin: {
+      contents: `export { isDotfileRelativePath } from './${entry}';
+export { createNameFilteredFileExplorerProjection } from './src/renderer/src/components/right-sidebar/file-explorer-name-filter-projection.ts';`,
+      resolveDir: process.cwd(),
+      loader: 'ts'
+    },
+    bundle: true,
+    platform: 'node',
+    format: 'cjs',
+    write: false,
+    logLevel: 'silent',
+    alias: { '@': resolve('src/renderer/src') },
+    plugins: useBaseline
+      ? [
+          {
+            name: 'baseline-dotfile-predicate',
+            setup(builder) {
+              builder.onLoad({ filter: /file-explorer-entries\.ts$/ }, () => ({
+                contents: baseline,
+                loader: 'ts'
+              }))
+            }
+          }
+        ]
+      : []
+  })
+  const module = new Module(resolve('dotfile-benchmark.cjs'))
+  module.paths = Module._nodeModulePaths(process.cwd())
+  module._compile(result.outputFiles[0].text, module.id)
+  return module.exports
+}
+
+const versions = [await load(true), await load(false)]
+let parityCases = 0
+function check(path, depth) {
+  assert.equal(
+    versions[0].isDotfileRelativePath(path),
+    versions[1].isDotfileRelativePath(path),
+    path
+  )
+  parityCases++
+  if (depth > 0) {
+    for (const character of ['.', '/', '\\', 'a', '\n']) {
+      check(path + character, depth - 1)
+    }
+  }
+}
+check('', 8)
+
+function measure(functions, iterations = 1) {
+  let sink = 0
+  const run = (fn) => {
+    for (let i = 0; i < iterations; i++) {
+      sink += Number(fn())
+    }
+  }
+  for (const fn of functions) {
+    for (let warmup = 0; warmup < 3; warmup++) {
+      run(fn)
+    }
+  }
+  const samples = [[], []]
+  for (let round = 0; round < 11; round++) {
+    for (const variant of round % 2 ? [1, 0] : [0, 1]) {
+      const start = performance.now()
+      run(functions[variant])
+      samples[variant].push(performance.now() - start)
+    }
+  }
+  return {
+    beforeMs: samples[0].sort((a, b) => a - b)[5],
+    afterMs: samples[1].sort((a, b) => a - b)[5],
+    iterations,
+    sink
+  }
+}
+
+const predicates = []
+for (const path of [
+  'a',
+  '.env',
+  'packages/pkg/src/file.tsx',
+  `a${'.'.repeat(254)}`,
+  `${'/'.repeat(4096)}.`,
+  `${'../'.repeat(1000)}file.ts`,
+  '😀/.你好',
+  '\n/.\n'
+]) {
+  check(path, 0)
+  predicates.push({
+    pathLength: path.length,
+    prefix: path.slice(0, 40),
+    ...measure(
+      versions.map((version) => () => version.isDotfileRelativePath(path)),
+      10_000
+    )
+  })
+}
+
+const projections = []
+for (const count of [1000, 10_000, 100_000]) {
+  for (const query of ['nonmatching-needle', 'file-42']) {
+    const args = {
+      ignoredSet: new Set(['unrelated']),
+      nameFilter: {
+        query,
+        relativePaths: Array.from(
+          { length: count },
+          (_, i) => `packages/package-${i % 50}/src/components/section-${i % 10}/file-${i}.tsx`
+        )
+      },
+      showDotfiles: false,
+      showGitIgnoredFiles: false,
+      worktreePath: '/workspace'
+    }
+    const functions = versions.map(
+      (version) => () => version.createNameFilteredFileExplorerProjection(args)
+    )
+    const rows = functions.map((fn) => {
+      const projection = fn()
+      return Array.from({ length: projection.getVisibleCount() }, (_, i) =>
+        projection.getRowAtIndex(i)
+      )
+    })
+    assert.deepEqual(rows[0], rows[1])
+    projections.push({
+      count,
+      query,
+      visibleRows: rows[0].length,
+      ...measure(functions.map((fn) => () => fn().getVisibleCount()))
+    })
+  }
+}
+console.log(
+  JSON.stringify(
+    {
+      node: process.version,
+      platform: process.platform,
+      baselinePath: resolve(baselinePath),
+      parityCases,
+      samples: 11,
+      warmups: 3,
+      predicates,
+      projections
+    },
+    null,
+    2
+  )
+)
diff --git a/config/scripts/benchmark-sentinel-retention.mjs b/config/scripts/benchmark-sentinel-retention.mjs
new file mode 100644
index 00000000000..93564eeac01
--- /dev/null
+++ b/config/scripts/benchmark-sentinel-retention.mjs
@@ -0,0 +1,72 @@
+import { strict as assert } from 'node:assert'
+import { EventEmitter } from 'node:events'
+import { mkdtemp, rm } from 'node:fs/promises'
+import { createRequire } from 'node:module'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { build } from 'esbuild'
+
+if (!global.gc) {
+  throw new Error('Run with node --expose-gc')
+}
+const root = resolve(import.meta.dirname, '../..')
+const directory = await mkdtemp(join(tmpdir(), 'orca-sentinel-retention-'))
+const output = join(directory, 'sentinel.cjs')
+try {
+  await build({
+    stdin: {
+      contents: `export {waitForSentinel} from './src/main/ssh/ssh-relay-deploy-helpers';
+export {RELAY_SENTINEL} from './src/main/ssh/relay-protocol';`,
+      resolveDir: root,
+      loader: 'ts'
+    },
+    bundle: true,
+    platform: 'node',
+    format: 'cjs',
+    packages: 'external',
+    banner: {
+      js: `var require = require('node:module').createRequire(${JSON.stringify(join(root, 'package.json'))});`
+    },
+    outfile: output
+  })
+  const { waitForSentinel, RELAY_SENTINEL } = createRequire(import.meta.url)(output)
+  const held = []
+  const banners = []
+  for (let i = 0; i < 100; i++) {
+    const channel = Object.assign(new EventEmitter(), {
+      stderr: new EventEmitter(),
+      stdin: { write: () => true },
+      close: () => {}
+    })
+    const pending = waitForSentinel(channel)
+    banners.push(feedBanner(channel))
+    channel.emit('data', Buffer.from(RELAY_SENTINEL))
+    const transport = await pending
+    const received = []
+    transport.onData((bytes) => received.push(bytes.toString()))
+    channel.emit('data', Buffer.from('frame'))
+    assert.deepEqual(received, ['frame'])
+    held.push({ channel, transport })
+  }
+  await new Promise((resolve) => setImmediate(resolve))
+  for (let i = 0; i < 5; i++) {
+    global.gc()
+  }
+  const retained = banners.filter((reference) => reference.deref() !== undefined).length
+  console.log(
+    JSON.stringify({
+      connections: held.length,
+      bannerBytes: 65536,
+      retainedBannerBuffers: retained,
+      retainedBannerBytes: retained * 65536
+    })
+  )
+} finally {
+  await rm(directory, { recursive: true, force: true })
+}
+
+function feedBanner(channel) {
+  const banner = Buffer.alloc(65536, 120)
+  channel.emit('data', banner)
+  return new WeakRef(banner.buffer)
+}
diff --git a/config/scripts/benchmark-skill-depth.mjs b/config/scripts/benchmark-skill-depth.mjs
new file mode 100644
index 00000000000..1ebb606f93c
--- /dev/null
+++ b/config/scripts/benchmark-skill-depth.mjs
@@ -0,0 +1,122 @@
+import assert from 'node:assert/strict'
+import { readFileSync } from 'node:fs'
+import * as fs from 'node:fs/promises'
+import Module from 'node:module'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { performance } from 'node:perf_hooks'
+import { build } from 'esbuild'
+
+// Pass a pre-change skill-root-file-walk.ts snapshot as the only argument.
+const baselinePath = process.argv[2]
+const brokenLinks = process.argv.includes('--broken')
+assert.ok(baselinePath, 'Pass a pre-change skill-root-file-walk.ts snapshot.')
+const entry = 'src/main/skills/skill-root-file-walk.ts'
+const baseline = readFileSync(baselinePath, 'utf8')
+assert.notEqual(baseline, readFileSync(entry, 'utf8'), 'Do not compare the source to itself.')
+let statCalls = 0
+
+async function load(useBaseline) {
+  const result = await build({
+    entryPoints: [entry],
+    bundle: true,
+    platform: 'node',
+    format: 'cjs',
+    write: false,
+    logLevel: 'silent',
+    plugins: useBaseline
+      ? [
+          {
+            name: 'baseline-skill-depth',
+            setup(builder) {
+              builder.onLoad({ filter: /skill-root-file-walk\.ts$/ }, () => ({
+                contents: baseline,
+                loader: 'ts'
+              }))
+            }
+          }
+        ]
+      : []
+  })
+  const module = new Module(resolve('skill-depth-benchmark.cjs'))
+  module.paths = Module._nodeModulePaths(process.cwd())
+  const originalRequire = module.require.bind(module)
+  module.require = (name) =>
+    name === 'node:fs/promises'
+      ? {
+          ...fs,
+          stat: (...args) => {
+            statCalls++
+            return fs.stat(...args)
+          }
+        }
+      : originalRequire(name)
+  module._compile(result.outputFiles[0].text, module.id)
+  return module.exports.findSkillFiles
+}
+
+const before = await load(true)
+const after = await load(false)
+const median = (values) => values.sort((a, b) => a - b)[Math.floor(values.length / 2)]
+const temporaryRoot = await fs.mkdtemp(join(tmpdir(), 'orca-skill-depth-benchmark-'))
+try {
+  for (const links of [0, 8, 100, 1000]) {
+    const root = join(temporaryRoot, String(links))
+    const edge = join(root, 'a', 'b', 'c', 'd')
+    const target = join(temporaryRoot, 'target')
+    await fs.mkdir(edge, { recursive: true })
+    await fs.mkdir(target, { recursive: true })
+    await fs.writeFile(join(target, 'SKILL.md'), 'skill')
+    await fs.writeFile(join(edge, 'SKILL.md'), 'edge')
+    for (let index = 0; index < links; index++) {
+      await fs.symlink(
+        brokenLinks ? join(target, 'missing') : target,
+        join(edge, `link${index}`),
+        process.platform === 'win32' ? 'junction' : 'dir'
+      )
+    }
+    for (const depth of [4, 5]) {
+      const timings = { before: [], after: [] }
+      const counts = {}
+      let rows
+      for (let sample = 0; sample < 13; sample++) {
+        const versions =
+          sample % 2
+            ? [
+                ['after', after],
+                ['before', before]
+              ]
+            : [
+                ['before', before],
+                ['after', after]
+              ]
+        for (const [name, walk] of versions) {
+          statCalls = 0
+          const start = performance.now()
+          const result = await walk(root, depth)
+          const elapsed = performance.now() - start
+          if (rows) {
+            assert.deepEqual(result, rows)
+          }
+          rows = result
+          counts[name] = statCalls
+          if (sample >= 2) {
+            timings[name].push(elapsed)
+          }
+        }
+      }
+      console.log(
+        JSON.stringify({
+          links,
+          brokenLinks,
+          depth,
+          statCalls: counts,
+          rows: rows.length,
+          medianMs: { before: median(timings.before), after: median(timings.after) }
+        })
+      )
+    }
+  }
+} finally {
+  await fs.rm(temporaryRoot, { recursive: true, force: true })
+}
diff --git a/config/scripts/benchmark-tab-group-repair.mjs b/config/scripts/benchmark-tab-group-repair.mjs
new file mode 100644
index 00000000000..17a1161fc4c
--- /dev/null
+++ b/config/scripts/benchmark-tab-group-repair.mjs
@@ -0,0 +1,80 @@
+import { strict as assert } from 'node:assert'
+import { mkdtemp, readFile, rm } from 'node:fs/promises'
+import { createRequire } from 'node:module'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { performance } from 'node:perf_hooks'
+import { build } from 'esbuild'
+
+const root = resolve(import.meta.dirname, '../..')
+const source = join(root, 'src/renderer/src/store/slices/tab-group-reference-repair.ts')
+const directory = await mkdtemp(join(tmpdir(), 'orca-tab-repair-'))
+const current = await readFile(source, 'utf8')
+const indexed = `const orderedTabIds = new Set(group.tabOrder)
+    const missingTabIds = ownedTabIds.filter((tabId) => !orderedTabIds.has(tabId))`
+assert(current.includes(indexed), 'Expected indexed implementation')
+try {
+  const implementations = []
+  for (const baseline of [true, false]) {
+    const outfile = join(directory, baseline ? 'before.cjs' : 'after.cjs')
+    await build({
+      stdin: {
+        contents: baseline
+          ? current.replace(
+              indexed,
+              'const missingTabIds = ownedTabIds.filter((tabId) => !group.tabOrder.includes(tabId))'
+            )
+          : current,
+        resolveDir: resolve(source, '..'),
+        loader: 'ts'
+      },
+      bundle: true,
+      platform: 'node',
+      format: 'cjs',
+      outfile,
+      alias: { '@': join(root, 'src/renderer/src') }
+    })
+    implementations.push(createRequire(import.meta.url)(outfile).appendOwnedTabIdsToGroups)
+  }
+  const rows = []
+  for (const count of [1, 10, 100, 1_000, 10_000]) {
+    for (const missing of [false, true]) {
+      const ids = Array.from({ length: count }, (_, i) => `tab-${i}`)
+      const groups = [
+        { id: 'group', worktreeId: 'workspace', activeTabId: null, tabOrder: ids, recentTabIds: [] }
+      ]
+      const owners = new Map(ids.map((id) => [missing ? `missing-${id}` : id, 'group']))
+      assert.deepEqual(implementations[0](groups, owners), implementations[1](groups, owners))
+      const iterations = Math.max(1, Math.floor(10_000 / count))
+      const samples = [[], []]
+      for (let sample = -3; sample < 11; sample++) {
+        for (const index of sample % 2 === 0 ? [0, 1] : [1, 0]) {
+          const start = performance.now()
+          for (let i = 0; i < iterations; i++) {
+            implementations[index](groups, owners)
+          }
+          const elapsed = (performance.now() - start) / iterations
+          if (sample >= 0) {
+            samples[index].push(elapsed)
+          }
+        }
+      }
+      rows.push({
+        count,
+        missing,
+        iterations,
+        beforeMs: samples[0].sort((a, b) => a - b)[5],
+        afterMs: samples[1].sort((a, b) => a - b)[5]
+      })
+    }
+  }
+  console.log(
+    JSON.stringify(
+      { node: process.version, platform: process.platform, samples: 11, warmups: 3, rows },
+      null,
+      2
+    )
+  )
+} finally {
+  await rm(directory, { recursive: true, force: true })
+}
diff --git a/config/scripts/benchmark-transcript-reverse-lines.mjs b/config/scripts/benchmark-transcript-reverse-lines.mjs
new file mode 100644
index 00000000000..e9d370d1839
--- /dev/null
+++ b/config/scripts/benchmark-transcript-reverse-lines.mjs
@@ -0,0 +1,124 @@
+import assert from 'node:assert/strict'
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import Module from 'node:module'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { performance } from 'node:perf_hooks'
+import { build } from 'esbuild'
+
+const entry = 'src/shared/agent-hook-listener/transcript-reader.ts'
+assert.ok(process.argv[2], 'Pass a pre-change transcript-reader.ts snapshot.')
+const baseline = readFileSync(process.argv[2], 'utf8')
+assert.notEqual(baseline, readFileSync(entry, 'utf8'), 'Do not compare the source to itself.')
+
+async function load(useBaseline) {
+  const result = await build({
+    stdin: {
+      contents: `export * from './${entry}';
+export { extractAssistantTextFromLine } from './src/shared/agent-hook-listener/transcript-entry-text.ts';`,
+      resolveDir: process.cwd(),
+      loader: 'ts'
+    },
+    bundle: true,
+    platform: 'node',
+    format: 'cjs',
+    write: false,
+    logLevel: 'silent',
+    plugins: useBaseline
+      ? [
+          {
+            name: 'baseline-transcript-reader',
+            setup(builder) {
+              builder.onLoad({ filter: /transcript-reader\.ts$/ }, () => ({
+                contents: baseline,
+                loader: 'ts'
+              }))
+            }
+          }
+        ]
+      : []
+  })
+  const module = new Module(resolve('transcript-benchmark.cjs'))
+  module.paths = Module._nodeModulePaths(process.cwd())
+  module._compile(result.outputFiles[0].text, module.id)
+  return module.exports
+}
+
+const versions = [await load(true), await load(false)]
+function measure(functions, iterations) {
+  let sink = 0
+  const run = (fn) => {
+    for (let i = 0; i < iterations; i++) {
+      sink += fn()?.length ?? 0
+    }
+  }
+  for (const fn of functions) {
+    for (let i = 0; i < 3; i++) {
+      run(fn)
+    }
+  }
+  const samples = [[], []]
+  for (let round = 0; round < 11; round++) {
+    for (const index of round % 2 ? [1, 0] : [0, 1]) {
+      const start = performance.now()
+      run(functions[index])
+      samples[index].push((performance.now() - start) / iterations)
+    }
+  }
+  return {
+    beforeMs: samples[0].sort((a, b) => a - b)[5],
+    afterMs: samples[1].sort((a, b) => a - b)[5],
+    iterations,
+    sink
+  }
+}
+
+const cases = [
+  ['tiny', `${JSON.stringify({ role: 'assistant', content: 'hello' })}\n`, 10000],
+  ['64KiB line', `${JSON.stringify({ role: 'assistant', content: 'x'.repeat(65500) })}\n`, 100],
+  [
+    '4MiB line',
+    `${JSON.stringify({ role: 'assistant', content: 'x'.repeat(4 * 1024 * 1024 - 40) })}\n`,
+    10
+  ],
+  [
+    '1000 short tool lines',
+    Array.from({ length: 1000 }, () =>
+      JSON.stringify({ role: 'tool', content: 'x'.repeat(100) })
+    ).join('\n'),
+    50
+  ],
+  [
+    'Unicode line',
+    `${JSON.stringify({ role: 'assistant', content: '😀漢字'.repeat(16000) })}\n`,
+    100
+  ],
+  [
+    'leading and trailing blank lines',
+    `\n\r\n${JSON.stringify({ role: 'assistant', content: 'hello' })}\n\n`,
+    10000
+  ]
+]
+const directory = mkdtempSync(join(tmpdir(), 'orca-transcript-benchmark-'))
+try {
+  for (const [name, text, iterations] of cases) {
+    const file = join(directory, 'transcript.jsonl')
+    writeFileSync(file, text)
+    const scanners = versions.map(
+      (v) => () => v.findLastExtractedTranscriptLineText(text, v.extractAssistantTextFromLine)
+    )
+    const readers = versions.map((v) => () => v.readLastAssistantFromTranscriptOnce(file))
+    assert.equal(scanners[0](), scanners[1](), name)
+    assert.equal(readers[0](), readers[1](), name)
+    console.log(
+      JSON.stringify({
+        name,
+        bytes: Buffer.byteLength(text),
+        scanner: measure(scanners, iterations),
+        warmFileReader: measure(readers, Math.min(iterations, 100))
+      })
+    )
+  }
+} finally {
+  rmSync(directory, { recursive: true, force: true })
+}
diff --git a/config/scripts/build-relay.mjs b/config/scripts/build-relay.mjs
index 289c7a957bd..4d408712f97 100644
--- a/config/scripts/build-relay.mjs
+++ b/config/scripts/build-relay.mjs
@@ -57,6 +57,13 @@ const NODE_PTY_CONSOLE_LIST_PATCH_SOURCE = join(
   'relay-assets',
   NODE_PTY_CONSOLE_LIST_PATCH_FILENAME
 )
+const NODE_PTY_WINDOWS_TEARDOWN_PATCH_FILENAME = 'node-pty-1.1.0-windows-pty-teardown-patch.cjs'
+const NODE_PTY_WINDOWS_TEARDOWN_PATCH_SOURCE = join(
+  ROOT,
+  'config',
+  'relay-assets',
+  NODE_PTY_WINDOWS_TEARDOWN_PATCH_FILENAME
+)
 const NODE_PTY_MASTER_CLOEXEC_PATCH_FILENAME = 'node-pty-1.1.0-master-cloexec-patch.cjs'
 const NODE_PTY_MASTER_CLOEXEC_PATCH_SOURCE = join(
   ROOT,
@@ -132,6 +139,10 @@ for (const platform of RELAY_BUILD_PLATFORMS) {
       NODE_PTY_CONSOLE_LIST_PATCH_SOURCE,
       join(outDir, NODE_PTY_CONSOLE_LIST_PATCH_FILENAME)
     )
+    copyFileSync(
+      NODE_PTY_WINDOWS_TEARDOWN_PATCH_SOURCE,
+      join(outDir, NODE_PTY_WINDOWS_TEARDOWN_PATCH_FILENAME)
+    )
   }
   copyFileSync(
     NODE_PTY_MASTER_CLOEXEC_PATCH_SOURCE,
diff --git a/config/scripts/build-windows-process-tree-relay-addon.mjs b/config/scripts/build-windows-process-tree-relay-addon.mjs
index d3b9db939cd..9243f5a5b78 100644
--- a/config/scripts/build-windows-process-tree-relay-addon.mjs
+++ b/config/scripts/build-windows-process-tree-relay-addon.mjs
@@ -32,6 +32,8 @@ import {
 import { join, resolve } from 'node:path'
 import { RELAY_WINDOWS_PROCESS_TREE_FILENAME } from '../../src/shared/relay-artifacts.ts'
 import {
+  ensureWindowsProcessTreeCommandLinePatch,
+  inspectWindowsProcessTreeAddon,
   nodeGypRebuildInvocation,
   stageWindowsProcessTreeNodeAddonApiHeaders,
   WINDOWS_PROCESS_TREE_PACKAGE_DIR as PACKAGE_DIR
@@ -89,6 +91,13 @@ function assertPatchApplied() {
         'config/patches/@vscode__windows-process-tree@0.8.0.patch; run pnpm install.'
     )
   }
+  if (processCc.includes('OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ')) {
+    throw new Error(
+      'src/process.cc still takes PROCESS_VM_READ for memory or CPU counters it never reads ' +
+        'from the address space. pnpm did not apply ' +
+        'config/patches/@vscode__windows-process-tree@0.8.0.patch; run pnpm install.'
+    )
+  }
 }
 
 // pnpm can materialize this CRLF package without applying its patch. Repair the
@@ -123,6 +132,13 @@ function applyWindowsProcessTreeBuildFixes() {
     ''
   )
   processCc = processCc.replace(/process_count < 1024 && /, '')
+  // The memory and CPU readers only ever call GetProcessMemoryInfo/GetProcessTimes,
+  // which need no more than PROCESS_QUERY_LIMITED_INFORMATION; taking VM_READ is
+  // what EDR scores.
+  processCc = processCc.replaceAll(
+    'OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, false, pid)',
+    'OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, false, pid)'
+  )
 
   if (bindingGyp !== originalBinding) {
     writeFileSync(bindingPath, bindingGyp)
@@ -131,7 +147,8 @@ function applyWindowsProcessTreeBuildFixes() {
     writeFileSync(processPath, processCc)
   }
   stageWindowsProcessTreeNodeAddonApiHeaders(PACKAGE_DIR)
-  if (bindingGyp !== originalBinding || processCc !== originalProcess) {
+  const repairedCommandLine = ensureWindowsProcessTreeCommandLinePatch(PACKAGE_DIR)
+  if (bindingGyp !== originalBinding || processCc !== originalProcess || repairedCommandLine) {
     console.warn('[windows-process-tree] Repaired un-applied pnpm patch hunks before build.')
   }
 }
@@ -173,6 +190,14 @@ function main() {
   if (!existsSync(built)) {
     throw new Error(`node-gyp reported success but ${built} is missing.`)
   }
+  // Why check the artifact and not only the source: the source checks above run
+  // before node-gyp, and a stale build directory can outlive them.
+  if (inspectWindowsProcessTreeAddon(built) === 'unpatched') {
+    throw new Error(
+      'The built addon still calls ReadProcessMemory, so it did not come from the patched ' +
+        'command-line reader. A relay would get the primitive MDE scores as credential dumping.'
+    )
+  }
   const machine = readPeMachine(built)
   if (machine !== PE_MACHINE[arch]) {
     throw new Error(
diff --git a/config/scripts/ci-native-toolchain.test.mjs b/config/scripts/ci-native-toolchain.test.mjs
new file mode 100644
index 00000000000..e35437da77c
--- /dev/null
+++ b/config/scripts/ci-native-toolchain.test.mjs
@@ -0,0 +1,69 @@
+import { execFileSync } from 'node:child_process'
+import { chmodSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { parse } from 'yaml'
+import { describe, expect, it } from 'vitest'
+
+const steps = parse(readFileSync('.github/actions/install-node-dependencies/action.yml', 'utf8'))
+  .runs.steps
+const toolchain = steps.find((step) => step.name === 'Use external node-gyp')
+
+describe('CI native toolchain preparation', () => {
+  it('probes only after both cache restore variants and before native rebuilding', () => {
+    const index = steps.indexOf(toolchain)
+    for (const id of ['native-cache-restore', 'native-cache-restore-only']) {
+      expect(index).toBeGreaterThan(steps.findIndex((step) => step.id === id))
+      expect(toolchain.env.NATIVE_CACHE_HIT).toContain(`steps.${id}.outputs.cache-hit`)
+    }
+    expect(index).toBeLessThan(steps.findIndex((step) => step.name === 'Prepare native runtime'))
+    expect(toolchain.if).toBe("runner.os == 'Linux' && inputs.native-runtime != 'none'")
+  })
+
+  // The action's toolchain workaround only runs in Linux Bash.
+  it.skipIf(process.platform === 'win32').each([
+    ['node', 'true', '0', false],
+    ['node', 'true', '1', true],
+    ['node', 'false', '0', true],
+    ['node', '', '0', true],
+    ['electron', 'true', '0', true],
+    ['electron', 'false', '0', true]
+  ])('runtime=%s cache=%s probe=%s installs=%s', (runtime, hit, probeStatus, installs) => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-ci-native-toolchain-'))
+    const log = join(directory, 'commands')
+    const environment = join(directory, 'github-env')
+    try {
+      writeFileSync(log, '')
+      writeFileSync(environment, '')
+      for (const [name, source] of [
+        ['node', 'echo "node $*" >> "$COMMAND_LOG"\nexit "$PROBE_STATUS"'],
+        ['npm', 'echo "npm $*" >> "$COMMAND_LOG"\nif [ "$1" = root ]; then echo /global; fi']
+      ]) {
+        const path = join(directory, name)
+        writeFileSync(path, `#!/bin/sh\n${source}\n`)
+        chmodSync(path, 0o755)
+      }
+      execFileSync('bash', ['-e', '-o', 'pipefail', '-c', toolchain.run], {
+        env: {
+          ...process.env,
+          PATH: `${directory}:${process.env.PATH}`,
+          NATIVE_RUNTIME: runtime,
+          NATIVE_CACHE_HIT: hit,
+          PROBE_STATUS: probeStatus,
+          COMMAND_LOG: log,
+          GITHUB_ENV: environment
+        }
+      })
+      const commands = readFileSync(log, 'utf8')
+      expect(commands.includes('npm install -g node-gyp@11.5.0')).toBe(installs)
+      expect(commands.includes('node config/scripts/ensure-native-runtime.mjs --check-only')).toBe(
+        runtime === 'node' && hit === 'true'
+      )
+      expect(readFileSync(environment, 'utf8')).toBe(
+        installs ? 'npm_config_node_gyp=/global/node-gyp/bin/node-gyp.js\n' : ''
+      )
+    } finally {
+      rmSync(directory, { recursive: true, force: true })
+    }
+  })
+})
diff --git a/config/scripts/cli-runtime-client-deferral-equivalence.mjs b/config/scripts/cli-runtime-client-deferral-equivalence.mjs
index f443bf3b9f9..a231b5ba75a 100644
--- a/config/scripts/cli-runtime-client-deferral-equivalence.mjs
+++ b/config/scripts/cli-runtime-client-deferral-equivalence.mjs
@@ -2,7 +2,7 @@
 // Equivalence check for deferring the RuntimeClient module graph in the CLI.
 //
 // Builds the CLI twice with the REAL tsc emit — once from the working tree and
-// once with the seven touched files restored from git HEAD~ (the pre-deferral
+// once with the touched files restored from git HEAD~ (the pre-deferral
 // implementation) — then compares stdout, stderr and exit code BYTE FOR BYTE
 // across a matrix of invocations.
 //
@@ -13,7 +13,7 @@
 //
 // Usage: node config/scripts/cli-runtime-client-deferral-equivalence.mjs [--baseline <rev>]
 import { execFileSync, spawnSync } from 'node:child_process'
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync, readFileSync } from 'node:fs'
+import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync, readFileSync } from 'node:fs'
 import { join, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
@@ -21,8 +21,11 @@ const REPO = fileURLToPath(new URL('../..', import.meta.url))
 
 // The files this change touches. Restoring exactly these from the baseline rev
 // reconstructs the old implementation without disturbing anything else.
+// Files absent at the baseline (e.g. cli-error.ts, split out of format.ts
+// later) are removed for the baseline build and put back afterwards.
 const TOUCHED = [
   'src/cli/args.ts',
+  'src/cli/cli-error.ts',
   'src/cli/dispatch.ts',
   'src/cli/flags.ts',
   'src/cli/format.ts',
@@ -72,12 +75,16 @@ function buildTree(label, baselineRev) {
     if (baselineRev) {
       for (const file of TOUCHED) {
         const path = join(REPO, file)
-        restored.push([path, readFileSync(path)])
-        const old = execFileSync('git', ['show', `${baselineRev}:${file}`], {
+        restored.push([path, existsSync(path) ? readFileSync(path) : null])
+        const old = spawnSync('git', ['show', `${baselineRev}:${file}`], {
           cwd: REPO,
           maxBuffer: 64 * 1024 * 1024
         })
-        writeFileSync(path, old)
+        if (old.status === 0) {
+          writeFileSync(path, old.stdout)
+        } else {
+          rmSync(path, { force: true })
+        }
       }
     }
     execFileSync(
@@ -97,7 +104,11 @@ function buildTree(label, baselineRev) {
     )
   } finally {
     for (const [path, contents] of restored) {
-      writeFileSync(path, contents)
+      if (contents === null) {
+        rmSync(path, { force: true })
+      } else {
+        writeFileSync(path, contents)
+      }
     }
   }
   return join(outDir, 'cli/index.js')
diff --git a/config/scripts/create-draft-release.mjs b/config/scripts/create-draft-release.mjs
index 3412a118491..1732e9a1e8a 100644
--- a/config/scripts/create-draft-release.mjs
+++ b/config/scripts/create-draft-release.mjs
@@ -128,10 +128,14 @@ export async function createDraftRelease({
     throw new Error('token is required')
   }
 
-  const previousTag = latestPreviousPublishedDesktopReleaseTag(
-    await fetchRepoReleases(repo, token, fetchImpl),
-    tag
-  )
+  const releases = await fetchRepoReleases(repo, token, fetchImpl)
+  const existingRelease = releases.find((release) => release?.tag_name === tag)
+  if (existingRelease && existingRelease.draft !== true) {
+    log(`Release ${tag} already exists and is published.`)
+    return
+  }
+
+  const previousTag = latestPreviousPublishedDesktopReleaseTag(releases, tag)
   const generateNotesBody = {
     tag_name: tag,
     target_commitish: tag,
@@ -156,24 +160,90 @@ export async function createDraftRelease({
     typeof releaseNotes.name === 'string' && releaseNotes.name.length > 0 ? releaseNotes.name : tag
   const prerelease = tag.includes('-rc.')
 
-  // Why: GitHub's generated release notes can exceed the release body API
-  // limit, so create with a bounded body. Omit target_commitish because the
-  // release-cut tag already exists and GitHub rejects the tag name there.
-  await githubJson(fetchImpl, `https://api.github.com/repos/${repo}/releases`, token, {
-    method: 'POST',
-    body: JSON.stringify({
-      tag_name: tag,
-      name,
-      body,
-      draft: true,
-      prerelease
+  if (existingRelease) {
+    if (!Number.isInteger(existingRelease.id)) {
+      throw new Error(`Draft release ${tag} is missing a GitHub release id`)
+    }
+    // Why: the listing is a snapshot; the draft can be published while notes
+    // generate, and patching then overwrites a live release body.
+    const currentRelease = await githubJson(
+      fetchImpl,
+      `https://api.github.com/repos/${repo}/releases/${existingRelease.id}`,
+      token
+    )
+    if (currentRelease?.draft !== true) {
+      log(`Release ${tag} was published while notes were generated; leaving it unchanged.`)
+      return
+    }
+    // Why: the PATCH endpoint supports no conditional/versioned update, so the
+    // GET above cannot close the window. The PATCH response reports the state we
+    // actually wrote to; if publication won, put the published body back.
+    const patchedRelease = await githubJson(
+      fetchImpl,
+      `https://api.github.com/repos/${repo}/releases/${existingRelease.id}`,
+      token,
+      {
+        method: 'PATCH',
+        body: JSON.stringify({ body })
+      }
+    )
+    if (patchedRelease?.draft !== true) {
+      const publishedBody = typeof currentRelease.body === 'string' ? currentRelease.body : ''
+      if (publishedBody === body) {
+        log(`Release ${tag} was published while notes were patched; its body is unchanged.`)
+        return
+      }
+      // Why: the rollback must not clobber a body written after our PATCH, so
+      // restore only while the release still carries exactly what we wrote.
+      const releaseBeforeRollback = await githubJson(
+        fetchImpl,
+        `https://api.github.com/repos/${repo}/releases/${existingRelease.id}`,
+        token
+      )
+      if (releaseBeforeRollback?.body !== body) {
+        log(
+          `Release ${tag} was published and its body changed again while notes were patched; leaving the newer body in place.`
+        )
+        return
+      }
+      await githubJson(
+        fetchImpl,
+        `https://api.github.com/repos/${repo}/releases/${existingRelease.id}`,
+        token,
+        {
+          method: 'PATCH',
+          body: JSON.stringify({ body: publishedBody })
+        }
+      )
+      log(
+        `Release ${tag} was published while notes were patched; restored its published body and left the generated notes unapplied.`
+      )
+      return
+    }
+  } else {
+    // Why: GitHub's generated release notes can exceed the release body API
+    // limit, so create with a bounded body. Omit target_commitish because the
+    // release-cut tag already exists and GitHub rejects the tag name there.
+    await githubJson(fetchImpl, `https://api.github.com/repos/${repo}/releases`, token, {
+      method: 'POST',
+      body: JSON.stringify({
+        tag_name: tag,
+        name,
+        body,
+        draft: true,
+        prerelease
+      })
     })
-  })
+  }
 
   if (generatedBody.length !== body.length) {
-    log(`Created draft release ${tag} with truncated generated notes (${body.length} chars).`)
+    log(
+      `${existingRelease ? 'Updated' : 'Created'} draft release ${tag} with truncated generated notes (${body.length} chars).`
+    )
   } else {
-    log(`Created draft release ${tag} with generated notes (${body.length} chars).`)
+    log(
+      `${existingRelease ? 'Updated' : 'Created'} draft release ${tag} with generated notes (${body.length} chars).`
+    )
   }
 }
 
diff --git a/config/scripts/create-draft-release.test.mjs b/config/scripts/create-draft-release.test.mjs
index b330ccb9423..911ac00be63 100644
--- a/config/scripts/create-draft-release.test.mjs
+++ b/config/scripts/create-draft-release.test.mjs
@@ -132,7 +132,7 @@ describe('createDraftRelease', () => {
   it('creates a draft release with bounded generated notes', async () => {
     const fetchImpl = vi
       .fn()
-      .mockResolvedValueOnce(jsonResponse([release('v1.4.35'), release('v1.4.36')]))
+      .mockResolvedValueOnce(jsonResponse([release('v1.4.35')]))
       .mockResolvedValueOnce(jsonResponse({ name: 'v1.4.36', body: 'a'.repeat(130_000) }))
       .mockResolvedValueOnce(jsonResponse({ tag_name: 'v1.4.36', draft: true }))
 
@@ -184,7 +184,7 @@ describe('createDraftRelease', () => {
   it('marks rc tags as prereleases', async () => {
     const fetchImpl = vi
       .fn()
-      .mockResolvedValueOnce(jsonResponse([release('v1.4.36'), release('v1.4.36-rc.1')]))
+      .mockResolvedValueOnce(jsonResponse([release('v1.4.36')]))
       .mockResolvedValueOnce(jsonResponse({ name: 'v1.4.36-rc.1', body: 'notes' }))
       .mockResolvedValueOnce(jsonResponse({ tag_name: 'v1.4.36-rc.1', draft: true }))
 
@@ -200,10 +200,136 @@ describe('createDraftRelease', () => {
     expect(createBody.prerelease).toBe(true)
   })
 
+  it('regenerates notes for an existing draft release', async () => {
+    const fetchImpl = vi
+      .fn()
+      .mockResolvedValueOnce(
+        jsonResponse([release('v1.4.35'), release('v1.4.36', { draft: true, id: 42 })])
+      )
+      .mockResolvedValueOnce(jsonResponse({ name: 'v1.4.36', body: 'notes' }))
+      .mockResolvedValueOnce(jsonResponse({ id: 42, draft: true, body: 'stale' }))
+      .mockResolvedValueOnce(jsonResponse({ id: 42, draft: true, body: 'notes' }))
+
+    await createDraftRelease({
+      repo: 'stablyai/orca',
+      tag: 'v1.4.36',
+      token: 'token',
+      fetchImpl,
+      log: vi.fn()
+    })
+
+    expect(fetchImpl).toHaveBeenNthCalledWith(
+      3,
+      'https://api.github.com/repos/stablyai/orca/releases/42',
+      expect.not.objectContaining({ method: expect.anything() })
+    )
+    expect(fetchImpl).toHaveBeenNthCalledWith(
+      4,
+      'https://api.github.com/repos/stablyai/orca/releases/42',
+      expect.objectContaining({ method: 'PATCH', body: JSON.stringify({ body: 'notes' }) })
+    )
+  })
+
+  it('skips the update when the draft was published while notes were generated', async () => {
+    const fetchImpl = vi
+      .fn()
+      .mockResolvedValueOnce(
+        jsonResponse([release('v1.4.35'), release('v1.4.36', { draft: true, id: 42 })])
+      )
+      .mockResolvedValueOnce(jsonResponse({ name: 'v1.4.36', body: 'notes' }))
+      .mockResolvedValueOnce(jsonResponse({ id: 42, draft: false }))
+
+    await createDraftRelease({
+      repo: 'stablyai/orca',
+      tag: 'v1.4.36',
+      token: 'token',
+      fetchImpl,
+      log: vi.fn()
+    })
+
+    expect(fetchImpl).toHaveBeenCalledTimes(3)
+    expect(fetchImpl).toHaveBeenNthCalledWith(
+      3,
+      'https://api.github.com/repos/stablyai/orca/releases/42',
+      expect.not.objectContaining({ method: expect.anything() })
+    )
+  })
+
+  it('restores the published body when publication lands between the check and the patch', async () => {
+    const log = vi.fn()
+    const fetchImpl = vi
+      .fn()
+      .mockResolvedValueOnce(
+        jsonResponse([release('v1.4.35'), release('v1.4.36', { draft: true, id: 42 })])
+      )
+      .mockResolvedValueOnce(jsonResponse({ name: 'v1.4.36', body: 'notes' }))
+      .mockResolvedValueOnce(jsonResponse({ id: 42, draft: true, body: 'hand-written notes' }))
+      .mockResolvedValueOnce(jsonResponse({ id: 42, draft: false, body: 'notes' }))
+      .mockResolvedValueOnce(jsonResponse({ id: 42, draft: false, body: 'notes' }))
+      .mockResolvedValueOnce(jsonResponse({ id: 42, draft: false, body: 'hand-written notes' }))
+
+    await createDraftRelease({
+      repo: 'stablyai/orca',
+      tag: 'v1.4.36',
+      token: 'token',
+      fetchImpl,
+      log
+    })
+
+    expect(fetchImpl).toHaveBeenCalledTimes(6)
+    expect(fetchImpl).toHaveBeenNthCalledWith(
+      6,
+      'https://api.github.com/repos/stablyai/orca/releases/42',
+      expect.objectContaining({
+        method: 'PATCH',
+        body: JSON.stringify({ body: 'hand-written notes' })
+      })
+    )
+    expect(log).toHaveBeenCalledWith(expect.stringContaining('restored its published body'))
+  })
+
+  it('leaves a body written after the patch in place instead of rolling it back', async () => {
+    const log = vi.fn()
+    const fetchImpl = vi
+      .fn()
+      .mockResolvedValueOnce(
+        jsonResponse([release('v1.4.35'), release('v1.4.36', { draft: true, id: 42 })])
+      )
+      .mockResolvedValueOnce(jsonResponse({ name: 'v1.4.36', body: 'notes' }))
+      .mockResolvedValueOnce(jsonResponse({ id: 42, draft: true, body: 'hand-written notes' }))
+      .mockResolvedValueOnce(jsonResponse({ id: 42, draft: false, body: 'notes' }))
+      .mockResolvedValueOnce(jsonResponse({ id: 42, draft: false, body: 'newer published body' }))
+
+    await createDraftRelease({
+      repo: 'stablyai/orca',
+      tag: 'v1.4.36',
+      token: 'token',
+      fetchImpl,
+      log
+    })
+
+    expect(fetchImpl).toHaveBeenCalledTimes(5)
+    expect(log).toHaveBeenCalledWith(expect.stringContaining('leaving the newer body in place'))
+  })
+
+  it('preserves notes on an existing published release', async () => {
+    const fetchImpl = vi.fn().mockResolvedValueOnce(jsonResponse([release('v1.4.36', { id: 42 })]))
+
+    await createDraftRelease({
+      repo: 'stablyai/orca',
+      tag: 'v1.4.36',
+      token: 'token',
+      fetchImpl,
+      log: vi.fn()
+    })
+
+    expect(fetchImpl).toHaveBeenCalledTimes(1)
+  })
+
   it('omits previous_tag_name for the first desktop release so notes fall back to the GitHub default', async () => {
     const fetchImpl = vi
       .fn()
-      .mockResolvedValueOnce(jsonResponse([release('v1.4.36'), release('mobile-v0.0.12')]))
+      .mockResolvedValueOnce(jsonResponse([release('mobile-v0.0.12')]))
       .mockResolvedValueOnce(jsonResponse({ name: 'v1.4.36', body: 'notes' }))
       .mockResolvedValueOnce(jsonResponse({ tag_name: 'v1.4.36', draft: true }))
 
diff --git a/config/scripts/electron-builder-markdown-associations.test.mjs b/config/scripts/electron-builder-markdown-associations.test.mjs
index 7ae3b1c9428..58f6f8d8865 100644
--- a/config/scripts/electron-builder-markdown-associations.test.mjs
+++ b/config/scripts/electron-builder-markdown-associations.test.mjs
@@ -103,14 +103,24 @@ describe('electron-builder markdown file associations', () => {
 
   // Why: this include was renamed from daemon-host-uninstall.nsh to carry the markdown
   // hooks too. electron-builder allows only one include, so a merge that drops the daemon
-  // sweep would silently orphan a running orca-terminal-daemon.exe on every uninstall.
+  // sweep would silently orphan a running daemon host on every uninstall.
+  //
+  // Asserted against comment-stripped script, and on the app exe name first: the relocated
+  // host is a verbatim copy of the app exe (daemonHostExeName, daemon-host-relocation.ts),
+  // so a macro that kills only orca-terminal-daemon.exe matches no running process. The
+  // prose above the macro names both, so a toContain over the raw file proves nothing.
   it('keeps the daemon-host uninstall sweep across the include rename', async () => {
-    const hooks = await readInstallerHooks()
+    const script = stripNsisCommentLines(await readInstallerHooks())
 
-    expect(hooks).toContain('orca-terminal-daemon.exe')
-    expect(hooks).toContain('$LOCALAPPDATA\\Orca\\daemon-host')
+    expect(script).toMatch(/taskkill[^\n]*\/IM\s+"?\$\{APP_EXECUTABLE_FILENAME\}"?/)
+    // Legacy name, so hosts left by builds that renamed the copy still get reaped.
+    expect(script).toMatch(/taskkill[^\n]*\/IM\s+"?orca-terminal-daemon\.exe"?/)
+    // Scopes both kills to the uninstalling user: an elevated machine-wide uninstall must
+    // not reach another logged-on user's session.
+    expect(script).toMatch(/\/FI\s+"USERNAME eq /)
+    expect(script).toContain('$LOCALAPPDATA\\Orca\\daemon-host')
     // Without this guard, uninstallOldVersion would kill the daemon on every update —
     // defeating the relocation that keeps terminals alive across updates.
-    expect(hooks).toMatch(/\$\{ifNot\}\s+\$\{isUpdated\}/)
+    expect(script).toMatch(/\$\{ifNot\}\s+\$\{isUpdated\}/)
   })
 })
diff --git a/config/scripts/ensure-native-runtime.mjs b/config/scripts/ensure-native-runtime.mjs
index a4cc6db8843..b2a47b99d5b 100644
--- a/config/scripts/ensure-native-runtime.mjs
+++ b/config/scripts/ensure-native-runtime.mjs
@@ -5,6 +5,12 @@ import { createRequire } from 'node:module'
 import { existsSync, readFileSync } from 'node:fs'
 import { release } from 'node:os'
 import { basename, dirname, resolve } from 'node:path'
+import {
+  ensureWindowsProcessTreeCommandLinePatch,
+  inspectWindowsProcessTreeAddon,
+  stageWindowsProcessTreeNodeAddonApiHeaders,
+  windowsProcessTreeAddonPath
+} from './windows-process-tree-gyp-rebuild.mjs'
 
 const require = createRequire(import.meta.url)
 const { assertNodePtyJobOwnership } = require('./node-pty-job-ownership.cjs')
@@ -253,11 +259,18 @@ function collectNativeModuleFailures() {
 
 function loadNativeModule(moduleName) {
   if (moduleName === '@vscode/windows-process-tree') {
-    // A bare require already loads the .node addon on win32, so it catches an
-    // ABI mismatch on its own. What it cannot catch is a snapshot that comes
-    // back empty -- the shape a blocked CreateToolhelp32Snapshot produces --
-    // so check the addon actually enumerates before calling the runtime healthy.
+    // A bare require loads the .node addon on win32, so it catches an ABI
+    // mismatch on its own. What it cannot catch is *which* addon loaded: the
+    // published tarball ships a prebuilt built from unpatched source that is
+    // node-addon-api, so it requires cleanly and then reads every process's
+    // command line out of its address space. Check the binary, not the load.
     require(moduleName)
+    if (inspectWindowsProcessTreeAddon(windowsProcessTreeAddonPath()) === 'unpatched') {
+      throw new Error(
+        'the loaded addon still calls ReadProcessMemory, so it was not built from the patched ' +
+          'source. Rebuild it (pnpm run rebuild:electron) rather than using the published prebuild.'
+      )
+    }
     return
   }
   if (moduleName === 'windows-native-registry') {
@@ -368,6 +381,14 @@ function getWindowsBuildNumber() {
 function rebuildNodeRuntimeModules(moduleNames) {
   for (const moduleName of moduleNames) {
     const moduleDir = dirname(require.resolve(`${moduleName}/package.json`))
+    if (moduleName === '@vscode/windows-process-tree') {
+      // Why before node-gyp: this module is rebuilt precisely because the
+      // binary was the unpatched one, and pnpm materializes it unpatched often
+      // enough that compiling the source as-is would just rebuild the same
+      // reader and fail the verify pass.
+      ensureWindowsProcessTreeCommandLinePatch(moduleDir)
+      stageWindowsProcessTreeNodeAddonApiHeaders(moduleDir)
+    }
     console.warn(`[native-runtime] Rebuilding ${moduleName} with node-gyp.`)
     runPnpm(['exec', 'node-gyp', 'rebuild'], { cwd: moduleDir })
     if (moduleName === 'node-pty' && process.platform === 'win32') {
diff --git a/config/scripts/ensure-native-runtime.test.mjs b/config/scripts/ensure-native-runtime.test.mjs
index ea6e876e619..973e2f6852d 100644
--- a/config/scripts/ensure-native-runtime.test.mjs
+++ b/config/scripts/ensure-native-runtime.test.mjs
@@ -12,6 +12,7 @@ import { tmpdir } from 'node:os'
 import { delimiter, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { describe, expect, it } from 'vitest'
+import { copyScriptWithLocalModules } from './script-module-dependencies.mjs'
 
 const sourceScriptPath = fileURLToPath(new URL('./ensure-native-runtime.mjs', import.meta.url))
 const sourceNodePtyJobOwnershipPath = fileURLToPath(
@@ -27,7 +28,6 @@ describe('ensure-native-runtime', () => {
       const logPath = join(projectDir, 'native-runtime.log')
       const markerPath = join(projectDir, 'rebuilt.marker')
       const binDir = join(projectDir, 'bin')
-      copyFileSync(sourceScriptPath, scriptPath)
       writeFakeNativeModules(projectDir)
       writeNodePtyPatchFile(projectDir)
       writeFakePnpm(binDir)
@@ -67,7 +67,6 @@ describe('ensure-native-runtime', () => {
         const logPath = join(projectDir, 'native-runtime.log')
         const markerPath = join(projectDir, 'rebuilt.marker')
         const binDir = join(projectDir, 'bin')
-        copyFileSync(sourceScriptPath, scriptPath)
         writeFakeNativeModules(projectDir, { windowsRegistryRequiresMarker: true })
         writeNodePtyPatchFile(projectDir)
         writeFakePnpm(binDir)
@@ -102,7 +101,6 @@ describe('ensure-native-runtime', () => {
         const logPath = join(projectDir, 'native-runtime.log')
         const markerPath = join(projectDir, 'rebuilt.marker')
         const binDir = join(projectDir, 'bin')
-        copyFileSync(sourceScriptPath, scriptPath)
         writeLoadableNativeModules(projectDir)
         writeNodePtyPatchFile(projectDir)
         writeFakePnpm(binDir)
@@ -137,7 +135,6 @@ describe('ensure-native-runtime', () => {
         const logPath = join(projectDir, 'native-runtime.log')
         const markerPath = join(projectDir, 'rebuilt.marker')
         const binDir = join(projectDir, 'bin')
-        copyFileSync(sourceScriptPath, scriptPath)
         writeLoadableNativeModules(projectDir)
         writeNodePtyPatchFile(projectDir)
         writePatchedNodePtyBuildArtifacts(projectDir)
@@ -171,7 +168,6 @@ describe('ensure-native-runtime', () => {
         const logPath = join(projectDir, 'native-runtime.log')
         const markerPath = join(projectDir, 'rebuilt.marker')
         const binDir = join(projectDir, 'bin')
-        copyFileSync(sourceScriptPath, scriptPath)
         writeLoadableNativeModules(projectDir, { nativeDir: '../build/Release/' })
         writeNodePtyPatchFile(projectDir)
         writePatchedNodePtyBuildArtifacts(projectDir)
@@ -198,7 +194,9 @@ describe('ensure-native-runtime', () => {
 
 function mkTempProject() {
   const projectDir = mkdtempSync(join(tmpdir(), 'orca-native-runtime-'))
-  mkdirSync(join(projectDir, 'config', 'scripts'), { recursive: true })
+  // Walked, not listed: the script imports windows-process-tree-gyp-rebuild.mjs, and a fixture
+  // missing it fails every case with a module-resolution error instead of the defect under test.
+  copyScriptWithLocalModules(sourceScriptPath, join(projectDir, 'config', 'scripts'))
   copyFileSync(
     sourceNodePtyJobOwnershipPath,
     join(projectDir, 'config', 'scripts', 'node-pty-job-ownership.cjs')
diff --git a/config/scripts/file-explorer-deletion-roots-benchmark.mjs b/config/scripts/file-explorer-deletion-roots-benchmark.mjs
new file mode 100644
index 00000000000..d276964861b
--- /dev/null
+++ b/config/scripts/file-explorer-deletion-roots-benchmark.mjs
@@ -0,0 +1,75 @@
+import assert from 'node:assert/strict'
+import { join } from 'node:path'
+import { performance } from 'node:perf_hooks'
+import { fileURLToPath } from 'node:url'
+import { build } from 'esbuild'
+
+const root = fileURLToPath(new URL('../..', import.meta.url))
+const bundled = await build({
+  stdin: {
+    contents: `export { selectDeletionRoots } from './file-explorer-batch-deletion';
+      export { isPathEqualOrDescendant } from './file-explorer-paths';`,
+    resolveDir: join(root, 'src/renderer/src/components/right-sidebar'),
+    loader: 'ts'
+  },
+  alias: { '@': join(root, 'src/renderer/src') },
+  bundle: true,
+  platform: 'node',
+  format: 'esm',
+  write: false,
+  logLevel: 'silent'
+})
+const { selectDeletionRoots, isPathEqualOrDescendant } = await import(
+  `data:text/javascript;base64,${Buffer.from(bundled.outputFiles[0].text).toString('base64')}`
+)
+
+// Original production selector; both paths use the same path-comparison implementation.
+function original(nodes) {
+  return nodes.filter(
+    (n) =>
+      !nodes.some(
+        (other) => other !== n && other.isDirectory && isPathEqualOrDescendant(n.path, other.path)
+      )
+  )
+}
+
+function measure(run, nodes) {
+  for (let index = 0; index < 3; index++) {
+    run(nodes)
+  }
+  const samples = []
+  for (let index = 0; index < 11; index++) {
+    const start = performance.now()
+    run(nodes)
+    samples.push(performance.now() - start)
+  }
+  return samples.sort((a, b) => a - b)[5]
+}
+
+const results = []
+for (const [fileCount, directoryCount] of [
+  [100, 0],
+  [1000, 0],
+  [5000, 0],
+  [5000, 5],
+  [0, 100]
+]) {
+  const nodes = Array.from({ length: fileCount + directoryCount }, (_, index) => ({
+    name: `item-${index}`,
+    path: `/repo/item-${index}`,
+    relativePath: `item-${index}`,
+    isDirectory: index >= fileCount,
+    depth: 0
+  }))
+  const expected = original(nodes)
+  const actual = selectDeletionRoots(nodes)
+  assert.equal(actual.length, expected.length)
+  actual.forEach((node, index) => assert.equal(node, expected[index]))
+  results.push({
+    fileCount,
+    directoryCount,
+    beforeMs: measure(original, nodes),
+    afterMs: measure(selectDeletionRoots, nodes)
+  })
+}
+console.log(JSON.stringify({ node: process.version, platform: process.platform, results }, null, 2))
diff --git a/config/scripts/hourly-preflight-workflow.test.mjs b/config/scripts/hourly-preflight-workflow.test.mjs
new file mode 100644
index 00000000000..2bec40b329b
--- /dev/null
+++ b/config/scripts/hourly-preflight-workflow.test.mjs
@@ -0,0 +1,91 @@
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { parse } from 'yaml'
+import { runProcess } from '../../src/shared/child-process/run-process'
+
+const workflow = parse(
+  readFileSync(new URL('../../.github/workflows/hourly-mac-build.yml', import.meta.url), 'utf8')
+)
+const preflight = workflow.jobs.preflight
+const freshness = preflight.steps.find((step) => step.id === 'freshness')
+const head = 'abcdef0123'.repeat(4)
+
+async function checkFreshness(overrides = {}) {
+  const directory = mkdtempSync(join(tmpdir(), 'hourly-preflight-'))
+  const output = join(directory, 'output')
+  try {
+    const result = await runProcess({
+      program: 'bash',
+      args: [
+        '-c',
+        `gh() {
+          case "$1 $2" in
+            "api "*) printf '%s\\n' "$HEAD_SHA" ;;
+            "release list") printf '%s\\n' "$LAST_TAG" ;;
+            "release view") printf '%s\\n' "$LAST_SHA" ;;
+            *) return 1 ;;
+          esac
+        }
+        ${freshness.run}`
+      ],
+      env: {
+        ...process.env,
+        GITHUB_OUTPUT: output,
+        GITHUB_REPOSITORY: 'stablyai/orca',
+        MAIN_REPO_TOKEN: 'main-token',
+        HOURLY_REPO: 'stablyai/orca-hourly',
+        HEAD_SHA: head,
+        LAST_TAG: 'previous-hourly',
+        LAST_SHA: head.slice(0, 12),
+        FORCED: 'false',
+        ...overrides
+      }
+    })
+    return {
+      exitCode: result.code,
+      stderr: result.stderr,
+      stdout: result.stdout,
+      output: result.code === 0 ? readFileSync(output, 'utf8') : ''
+    }
+  } finally {
+    rmSync(directory, { recursive: true, force: true })
+  }
+}
+
+describe('hourly build preflight', () => {
+  it('gates Mac allocation and pins the checkout and downstream identity', () => {
+    const build = workflow.jobs['build-hourly-mac']
+    expect(preflight['runs-on']).toBe('ubuntu-latest')
+    expect(preflight.steps.some((step) => step.uses?.startsWith('actions/checkout'))).toBe(false)
+    expect(
+      preflight.steps.find((step) => step.id === 'app_token').with['permission-contents']
+    ).toBe('read')
+    expect(build.needs).toBe('preflight')
+    expect(build.if).toBe("needs.preflight.outputs.should_build == 'true'")
+    expect(build.steps.find((step) => step.name === 'Checkout').with.ref).toBe(
+      build.outputs.head_sha
+    )
+    expect(build.outputs.head_sha).toBe('${{ needs.preflight.outputs.head_sha }}')
+    expect(build.steps.find((step) => step.id === 'release').env.SHA).toBe(build.outputs.head_sha)
+    expect(workflow.concurrency).toEqual({ group: 'hourly-mac-build', 'cancel-in-progress': false })
+  })
+
+  it.each([
+    ['unchanged', {}, false],
+    ['changed', { LAST_SHA: '123456789012' }, true],
+    ['forced', { FORCED: 'true' }, true],
+    ['first build', { LAST_TAG: '' }, true],
+    ['missing prior identity', { LAST_SHA: '' }, true]
+  ])('%s main selects the expected build decision', async (_name, env, shouldBuild) => {
+    const result = await checkFreshness(env)
+    expect(result.exitCode, `${result.stdout} ${result.stderr}`).toBe(0)
+    expect(result.output).toBe(`head_sha=${head}\nshould_build=${shouldBuild}\n`)
+  })
+
+  it('fails closed when main cannot be resolved, even when forced', async () => {
+    const result = await checkFreshness({ HEAD_SHA: '', FORCED: 'true' })
+    expect(result.exitCode).not.toBe(0)
+  })
+})
diff --git a/config/scripts/locale-collator-sort-benchmark.mjs b/config/scripts/locale-collator-sort-benchmark.mjs
index 8a68331bd44..3d34466532a 100644
--- a/config/scripts/locale-collator-sort-benchmark.mjs
+++ b/config/scripts/locale-collator-sort-benchmark.mjs
@@ -3,10 +3,12 @@
 import { performance } from 'node:perf_hooks'
 import { fileURLToPath } from 'node:url'
 import { createJiti } from 'jiti'
+import { buildCounterbalancedSchedule } from './counterbalanced-benchmark-schedule.mjs'
 
-const ROUND_COUNT = 5
+const ROUND_COUNT = 6
 const MIN_ROUND_MS = 120
 const jiti = createJiti(import.meta.url, {
+  jsx: true,
   alias: { '@': fileURLToPath(new URL('../../src/renderer/src', import.meta.url)) }
 })
 const { compareBaseSensitivityLocaleText } = await jiti.import(
@@ -15,6 +17,10 @@ const { compareBaseSensitivityLocaleText } = await jiti.import(
 const { sortJiraIssues } = await jiti.import(
   '../../src/renderer/src/components/jira-issue-sorter.ts'
 )
+const { sortAutomationListViewItems } = await jiti.import(
+  '../../src/renderer/src/components/automations/automation-list-view.ts'
+)
+const { getIntlLocale } = await jiti.import('../../src/renderer/src/i18n/i18n.ts')
 
 let randomState = 0x9e3779b9
 function random() {
@@ -83,20 +89,21 @@ function measurePair(before, after) {
   const afterIterations = calibrate(after)
   const beforeSamples = []
   const afterSamples = []
-  for (let round = 0; round < ROUND_COUNT; round += 1) {
-    if (round % 2 === 0) {
-      beforeSamples.push(measureRound(before, beforeIterations))
-      afterSamples.push(measureRound(after, afterIterations))
-    } else {
-      afterSamples.push(measureRound(after, afterIterations))
-      beforeSamples.push(measureRound(before, beforeIterations))
+  for (const pair of buildCounterbalancedSchedule(ROUND_COUNT, 'before', 'after')) {
+    for (const arm of pair) {
+      if (arm === 'before') {
+        beforeSamples.push(measureRound(before, beforeIterations))
+      } else {
+        afterSamples.push(measureRound(after, afterIterations))
+      }
     }
   }
-  const middle = Math.floor(ROUND_COUNT / 2)
-  return {
-    beforeMs: beforeSamples.sort((a, b) => a - b)[middle],
-    afterMs: afterSamples.sort((a, b) => a - b)[middle]
+  const median = (samples) => {
+    samples.sort((a, b) => a - b)
+    const middle = samples.length / 2
+    return (samples[middle - 1] + samples[middle]) / 2
   }
+  return { beforeMs: median(beforeSamples), afterMs: median(afterSamples) }
 }
 
 function assertSameOrder(before, after, label) {
@@ -111,7 +118,9 @@ function assertSameOrder(before, after, label) {
 }
 
 const pad = (value, width) => String(value).padStart(width)
-console.log('Renderer locale sort, ms per sort (median of 5 rounds). Lower is better.')
+console.log(
+  'Renderer locale sort, ms per sort (median of 6 counterbalanced rounds). Lower is better.'
+)
 console.log(
   `${pad('mode', 9)} ${pad('items', 7)} ${pad('per-call', 11)} ${pad('reused', 11)} ${pad('speedup', 9)}`
 )
@@ -145,3 +154,31 @@ for (const count of [10, 50, 250]) {
 console.log(
   '\n36 rows matches the Linear page size, 50 matches the picker/Jira scale, and\n250 is a stress case. Both arms assert identical output before timing.'
 )
+
+for (const count of [10, 100, 1000]) {
+  const items = makeBaseSensitivityValues(count).map((name, index) => ({
+    id: `automation-${index}`,
+    name,
+    lastRunAt: null
+  }))
+  const before = () => {
+    const locale = getIntlLocale()
+    function compare(left, right) {
+      return (
+        left.name.localeCompare(right.name, locale, { sensitivity: 'base' }) ||
+        left.id.localeCompare(right.id)
+      )
+    }
+    return [...items].sort(compare).map((item) => item.id)
+  }
+  const after = () =>
+    sortAutomationListViewItems(items, { field: 'name', direction: 'asc' }).map((item) => item.id)
+  assertSameOrder(before, after, `automation ${count}`)
+  const { beforeMs, afterMs } = measurePair(before, after)
+  console.log(
+    `${pad('automation', 10)} ${pad(count, 7)} ${pad(`${beforeMs.toFixed(3)} ms`, 11)} ${pad(`${afterMs.toFixed(3)} ms`, 11)} ${pad(`${(beforeMs / afterMs).toFixed(1)}x`, 9)}`
+  )
+}
+console.log(
+  'Automation arm calls the production sorter; 1000 rows is a scaling fixture, not a measured user inventory. No timing gate.'
+)
diff --git a/config/scripts/locale-ko-key-overrides.json b/config/scripts/locale-ko-key-overrides.json
index f368ecc3cbc..bf5f62d1fa5 100644
--- a/config/scripts/locale-ko-key-overrides.json
+++ b/config/scripts/locale-ko-key-overrides.json
@@ -492,7 +492,7 @@
     "ko": "agent CLI를 찾지 못했습니다. 하나를 설치하거나 설정에서 기본 agent를 선택하세요."
   },
   "auto.components.Terminal.7958465754": {
-    "ko": "실행 중인 프로세스가 있는 로컬 terminals이 있습니다. 그래도 창을 닫으시겠습니까?"
+    "ko": "실행 중인 프로세스가 있는 terminals이 있습니다. 그래도 창을 닫으시겠습니까?"
   },
   "auto.components.Terminal.cdc9ac4b2d": {
     "ko": "편집기"
diff --git a/config/scripts/mobile-file-ranking-benchmark.mjs b/config/scripts/mobile-file-ranking-benchmark.mjs
new file mode 100644
index 00000000000..68ac5b9d977
--- /dev/null
+++ b/config/scripts/mobile-file-ranking-benchmark.mjs
@@ -0,0 +1,53 @@
+import assert from 'node:assert/strict'
+import { execFileSync } from 'node:child_process'
+import { readFileSync } from 'node:fs'
+import { stripTypeScriptTypes } from 'node:module'
+import { performance } from 'node:perf_hooks'
+
+const baseline = process.argv[2]
+if (!baseline) {
+  throw new Error('Usage: node config/scripts/mobile-file-ranking-benchmark.mjs <baseline-ref>')
+}
+async function load(source) {
+  const js = stripTypeScriptTypes(source, { mode: 'transform' })
+  return await import(`data:text/javascript;base64,${Buffer.from(js).toString('base64')}`)
+}
+function measure(fn, paths, query) {
+  for (let warmup = 0; warmup < 10; warmup++) {
+    fn(paths, query, 16)
+  }
+  const samples = []
+  for (let i = 0; i < 9; i++) {
+    const start = performance.now()
+    fn(paths, query, 16)
+    samples.push(performance.now() - start)
+  }
+  return samples.sort((a, b) => a - b)[4]
+}
+const results = []
+for (const [file, name] of [
+  ['src/main/runtime/runtime-mobile-file-path-search.ts', 'rankRuntimeMobileFilePaths'],
+  ['mobile/src/session/mobile-native-chat-autocomplete.ts', 'rankSuggestions']
+]) {
+  const before = (
+    await load(execFileSync('git', ['show', `${baseline}:${file}`], { encoding: 'utf8' }))
+  )[name]
+  const after = (await load(readFileSync(file, 'utf8')))[name]
+  for (const count of [100, 100000]) {
+    const paths = Array.from(
+      { length: count },
+      (_, i) => `src/components/workspace/group-${i % 100}/file-${i}.tsx`
+    )
+    for (const query of ['file-9', 'missing', 'workspace']) {
+      assert.deepEqual(after(paths, query, 16), before(paths, query, 16))
+      results.push({
+        function: name,
+        paths: count,
+        query,
+        beforeMs: measure(before, paths, query),
+        afterMs: measure(after, paths, query)
+      })
+    }
+  }
+}
+console.log(JSON.stringify({ node: process.version, platform: process.platform, results }, null, 2))
diff --git a/config/scripts/mobile-markdown-placeholder-benchmark.mjs b/config/scripts/mobile-markdown-placeholder-benchmark.mjs
new file mode 100644
index 00000000000..20280e5a8d2
--- /dev/null
+++ b/config/scripts/mobile-markdown-placeholder-benchmark.mjs
@@ -0,0 +1,58 @@
+import assert from 'node:assert/strict'
+import { execFileSync } from 'node:child_process'
+import { readFileSync } from 'node:fs'
+import { dirname, resolve } from 'node:path'
+import { performance } from 'node:perf_hooks'
+import { build } from 'esbuild'
+
+const sourcePath = 'mobile/src/components/mobile-markdown-preview-html.ts'
+const baselineRef = process.argv[2]
+if (!baselineRef) {
+  throw new Error(
+    'Usage: node config/scripts/mobile-markdown-placeholder-benchmark.mjs <baseline-ref>'
+  )
+}
+async function load(source) {
+  const result = await build({
+    stdin: { contents: source, resolveDir: dirname(resolve(sourcePath)), loader: 'ts' },
+    bundle: true,
+    write: false,
+    platform: 'node',
+    format: 'esm'
+  })
+  return (
+    await import(
+      `data:text/javascript;base64,${Buffer.from(result.outputFiles[0].text).toString('base64')}`
+    )
+  ).normalizeMobileMarkdownPreviewHtml
+}
+const before = await load(
+  execFileSync('git', ['show', `${baselineRef}:${sourcePath}`], { encoding: 'utf8' })
+)
+const after = await load(readFileSync(sourcePath, 'utf8'))
+function measure(fn, input, repeats) {
+  const samples = []
+  for (let run = 0; run < repeats; run++) {
+    const start = performance.now()
+    fn(input)
+    samples.push(performance.now() - start)
+  }
+  return samples.sort((a, b) => a - b)[Math.floor(samples.length / 2)]
+}
+const results = []
+for (const [shape, input] of [
+  ['ordinary Markdown', '# Hello\n\n<p>Use `Array<string>` and <b>bold</b>.</p>'],
+  ...[2048, 8192, 16384].map((length) => [
+    `${length} underscore collision`,
+    `\uE000ORCA_MD_CODE_${'_'.repeat(length)}0\uE000 and \`Array<string>\``
+  ])
+]) {
+  assert.equal(after(input), before(input))
+  results.push({
+    shape,
+    bytes: Buffer.byteLength(input),
+    beforeMs: measure(before, input, 5),
+    afterMs: measure(after, input, 15)
+  })
+}
+console.log(JSON.stringify({ node: process.version, platform: process.platform, results }, null, 2))
diff --git a/config/scripts/node-pty-windows-pty-teardown-patch.test.mjs b/config/scripts/node-pty-windows-pty-teardown-patch.test.mjs
new file mode 100644
index 00000000000..ba3e64bfa2f
--- /dev/null
+++ b/config/scripts/node-pty-windows-pty-teardown-patch.test.mjs
@@ -0,0 +1,223 @@
+// The relay's copy of the ConPTY teardown release, and the guard that keeps it in lockstep with
+// `config/patches/node-pty@1.1.0.patch`. pnpm patches do not cross the SSH boundary, so a relay runs
+// the tree `npm install` put there, and every terminal on a Windows SSH host leaked one File handle
+// for the life of the relay process.
+//
+// The ORDER of the conin release is the fix. Releasing it at the top of the branch -- the placement
+// the desktop patch uses -- was measured at 3x WORSE than shipping nothing (File +2/terminal and a
+// new Process +1/terminal); releasing it after the console-list fork and the native kill is flat.
+//
+// Those numbers are the `!useConptyDll` branch, which is the branch a RELAY runs. Every desktop
+// site that opens a terminal pane sets `useConptyDll: true` and takes the other branch, where
+// upstream already destroys the input socket. Two hidden rate-limit probes
+// (`src/main/rate-limits/claude-pty.ts`, `codex-pty-rate-limit-probe.ts`) do omit the option and so
+// do run this hunk, but no user-visible pane does. The divergence pinned below is about which
+// branch each host runs for terminals -- not about a regression in the panes users open.
+import { createRequire } from 'node:module'
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+
+const require = createRequire(import.meta.url)
+const {
+  assertPatchedNodePtyWindowsTeardown,
+  patchNodePtyWindowsTeardown
+} = require('../relay-assets/node-pty-1.1.0-windows-pty-teardown-patch.cjs')
+const projectDir = resolve(import.meta.dirname, '..', '..')
+const cleanupDirs = []
+
+const PATCHED_FILES = ['windowsPtyAgent.js', 'windowsTerminal.js']
+
+/** The hunks config/patches/node-pty@1.1.0.patch adds to the installed desktop tree. */
+const DESKTOP_HUNKS = {
+  'windowsPtyAgent.js': [
+    [
+      [
+        '                this._inSocket.readable = false;',
+        '                // The non-DLL path previously only flipped `readable`, leaving the',
+        '                // conin PipeWrap alive until the host exited (#947).',
+        '                this._inSocket.destroy();',
+        '                this._outSocket.readable = false;',
+        ''
+      ].join('\n'),
+      [
+        '                this._inSocket.readable = false;',
+        '                this._outSocket.readable = false;',
+        ''
+      ].join('\n')
+    ],
+    // The useConptyDll branch, which only the DESKTOP runs -- the relay takes the
+    // non-DLL branch above, where the dispose is already unconditional. Listed here
+    // so un-applying still yields published; the relay asset needs no counterpart.
+    [
+      [
+        '                // Orca: dispose unconditionally, as the non-DLL branch above does.',
+        "                // Waiting for another 'data' event leaks the conout worker on every",
+        '                // self-exiting shell, because no more data ever arrives (F24).',
+        '                this._conoutSocketWorker.dispose();',
+        ''
+      ].join('\n'),
+      [
+        "                this._outSocket.on('data', function () {",
+        '                    _this._conoutSocketWorker.dispose();',
+        '                });',
+        ''
+      ].join('\n')
+    ]
+  ],
+  'windowsTerminal.js': [
+    [
+      '        // Attach before readiness so a broken ConPTY output pipe cannot be unhandled.',
+      null
+    ],
+    ['        // A ConPTY input-pipe error must retire only this terminal.', null]
+  ]
+}
+
+function desktopPath(file) {
+  return join(projectDir, 'node_modules', 'node-pty', 'lib', file)
+}
+
+afterEach(() => {
+  for (const dir of cleanupDirs.splice(0)) {
+    rmSync(dir, { recursive: true, force: true })
+  }
+})
+
+describe('Windows SSH relay node-pty ConPTY teardown patch', () => {
+  // Why reconstruct rather than vendor upstream: the installed tree IS the published file plus the
+  // desktop's hunks, so un-applying them yields upstream exactly -- and pinning that against this
+  // asset's own hashes is what fails loudly if either side of the pair moves.
+  it('takes the desktop error listeners verbatim', () => {
+    const fixture = writeNodePtyFixture('1.1.0')
+    patchNodePtyWindowsTeardown(fixture.root)
+
+    expect(readFileSync(join(fixture.libDir, 'windowsTerminal.js'), 'utf8')).toBe(
+      readFileSync(desktopPath('windowsTerminal.js'), 'utf8')
+    )
+  })
+
+  // The one hunk that must NOT match the desktop patch, and the reason is measured, not stylistic:
+  // on the branch a relay runs, releasing conin before `_getConsoleProcessList()` forks aborts
+  // teardown partway. Desktop terminal panes take the other branch, so no pane is affected either
+  // way; what this guards is a patch sync putting the early placement onto the relay's branch.
+  it('releases conin after the console-list fork, unlike the desktop patch placement', () => {
+    const fixture = writeNodePtyFixture('1.1.0')
+    patchNodePtyWindowsTeardown(fixture.root)
+    const patched = readFileSync(join(fixture.libDir, 'windowsPtyAgent.js'), 'utf8')
+
+    const branch = patched.slice(
+      patched.indexOf('if (!this._useConptyDll) {'),
+      patched.indexOf('else {', patched.indexOf('if (!this._useConptyDll) {'))
+    )
+    expect(branch).toContain('this._inSocket.destroy();')
+    expect(branch.indexOf('this._inSocket.destroy();')).toBeGreaterThan(
+      branch.indexOf('this._conoutSocketWorker.dispose();')
+    )
+    expect(branch.indexOf('this._inSocket.destroy();')).toBeGreaterThan(
+      branch.indexOf('this._getConsoleProcessList()')
+    )
+    // Pinned so a future "sync the relay asset to config/patches" cannot copy the early placement
+    // onto the relay's branch, where it costs +2 File and +1 Process per terminal.
+    expect(patched).not.toBe(readFileSync(desktopPath('windowsPtyAgent.js'), 'utf8'))
+  })
+
+  it('installs and verifies idempotently', () => {
+    const fixture = writeNodePtyFixture('1.1.0')
+
+    patchNodePtyWindowsTeardown(fixture.root)
+    const once = PATCHED_FILES.map((file) => readFileSync(join(fixture.libDir, file), 'utf8'))
+    for (const file of PATCHED_FILES) {
+      expect(existsSync(`${join(fixture.libDir, file)}.orca-patch-${process.pid}`)).toBe(false)
+    }
+    expect(() => assertPatchedNodePtyWindowsTeardown(fixture.root)).not.toThrow()
+
+    patchNodePtyWindowsTeardown(fixture.root)
+    expect(PATCHED_FILES.map((file) => readFileSync(join(fixture.libDir, file), 'utf8'))).toEqual(
+      once
+    )
+  })
+
+  it('refuses a different package version or unexpected source', () => {
+    const wrongVersion = writeNodePtyFixture('1.2.0-beta.11')
+    expect(() => patchNodePtyWindowsTeardown(wrongVersion.root)).toThrow('expected 1.1.0')
+
+    for (const file of PATCHED_FILES) {
+      const drifted = writeNodePtyFixture('1.1.0')
+      const path = join(drifted.libDir, file)
+      writeFileSync(path, `${readFileSync(path, 'utf8')}\n// drift`)
+      expect(() => patchNodePtyWindowsTeardown(drifted.root)).toThrow('unexpected node-pty')
+    }
+  })
+
+  it('refuses a half-applied tree, so one file cannot pass for both', () => {
+    for (const file of PATCHED_FILES) {
+      const partial = writeNodePtyFixture('1.1.0')
+      const fixture = writeNodePtyFixture('1.1.0')
+      patchNodePtyWindowsTeardown(fixture.root)
+      writeFileSync(join(partial.libDir, file), readFileSync(join(fixture.libDir, file), 'utf8'))
+      expect(() => assertPatchedNodePtyWindowsTeardown(partial.root)).toThrow('is not installed')
+    }
+  })
+})
+
+/** A published node-pty tree, rebuilt by un-applying the desktop hunks from the installed one. */
+function writeNodePtyFixture(version) {
+  const root = mkdtempSync(join(projectDir, '.node-pty-teardown-patch-test-'))
+  cleanupDirs.push(root)
+  const libDir = join(root, 'node_modules', 'node-pty', 'lib')
+  mkdirSync(libDir, { recursive: true })
+  writeFileSync(join(root, 'node_modules', 'node-pty', 'package.json'), JSON.stringify({ version }))
+  for (const file of PATCHED_FILES) {
+    const desktop = readFileSync(desktopPath(file), 'utf8')
+    for (const [marker] of DESKTOP_HUNKS[file]) {
+      expect(desktop).toContain(marker)
+    }
+    writeFileSync(join(libDir, file), unapplyDesktopHunks(file, desktop))
+  }
+  return { root, libDir }
+}
+
+/**
+ * Reverse of the published-to-desktop transform.
+ *
+ * `windowsTerminal.js` is taken verbatim from the desktop, so the asset's own replacement table is
+ * the transform and reversing it is exact. `windowsPtyAgent.js` deliberately diverges, so its
+ * published form is rebuilt from the desktop hunk instead -- which is also what makes this file the
+ * place that notices if the desktop hunk itself ever moves.
+ */
+function unapplyDesktopHunks(file, desktop) {
+  if (file === 'windowsPtyAgent.js') {
+    let published = desktop
+    for (const [patched, original] of DESKTOP_HUNKS[file]) {
+      expect(published.split(patched).length - 1).toBe(1)
+      published = published.replace(patched, original)
+    }
+    return published
+  }
+  const asset = readFileSync(
+    join(projectDir, 'config', 'relay-assets', 'node-pty-1.1.0-windows-pty-teardown-patch.cjs'),
+    'utf8'
+  )
+  const { PATCH_TARGETS } = loadPatchTargets(asset)
+  const target = PATCH_TARGETS.find((entry) => entry.relativePath.at(-1) === file)
+  expect(target).toBeDefined()
+  let published = desktop
+  for (const [from, to] of target.replacements.toReversed()) {
+    expect(published.split(to).length - 1).toBe(1)
+    published = published.replace(to, from)
+  }
+  return published
+}
+
+function loadPatchTargets(assetSource) {
+  const module = { exports: {} }
+  const factory = new Function(
+    'module',
+    'exports',
+    'require',
+    `${assetSource}\nmodule.exports.PATCH_TARGETS = PATCH_TARGETS`
+  )
+  factory(module, module.exports, require)
+  return module.exports
+}
diff --git a/config/scripts/patched-dependencies-frozen-install.test.mjs b/config/scripts/patched-dependencies-frozen-install.test.mjs
new file mode 100644
index 00000000000..89f98ef074b
--- /dev/null
+++ b/config/scripts/patched-dependencies-frozen-install.test.mjs
@@ -0,0 +1,155 @@
+import {
+  cpSync,
+  copyFileSync,
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  writeFileSync
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { isAbsolute, join, parse, resolve } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { runProcessSync } from '../../src/shared/child-process/run-process.ts'
+import { resolveCliCommand } from '../../src/shared/node-cli-command-resolution.ts'
+import { removeTreeSync } from '../../src/shared/windows-transient-lock-removal.ts'
+import { resolvePnpmCliInvocation } from './pnpm-cli-invocation.mjs'
+
+/**
+ * Run the command that actually consumes the patch hashes.
+ *
+ * A hash comparison is not this check. `@vscode/windows-process-tree@0.8.0` shipped
+ * twice with a hand-computed `sha256(patchBytes)` in the lockfile, and two separate
+ * reviews "verified" it by recomputing the same number the same wrong way. pnpm
+ * hashes the **LF-normalized** content, so a CRLF patch makes the raw digest a value
+ * pnpm will never produce, and `--frozen-lockfile` dies with
+ * ERR_PNPM_LOCKFILE_CONFIG_MISMATCH on every runner. An independent check that
+ * repeats the original assumption is not independent; only the installer is.
+ *
+ * `--lockfile-only --ignore-scripts` keeps it to the resolution pnpm rejects on,
+ * with no node_modules and no native builds.
+ */
+const PROJECT_DIR = resolve(import.meta.dirname, '../..')
+const WINDOWS_PROCESS_TREE_PATCH = '@vscode__windows-process-tree@0.8.0.patch'
+
+/**
+ * Which pnpm to run belongs to pnpm-cli-invocation.mjs, not to this file: naming
+ * the Windows shim here is what windows-cmd-shim-spawn-boundary.test.mjs rejects.
+ * Its `shell` is dropped on purpose -- runProcessSync refuses that flag and
+ * already drives a shim through the interpreter itself.
+ */
+function resolvePnpmInvocation() {
+  const { command, prefixArgs } = resolvePnpmCliInvocation()
+  if (isAbsolute(command)) {
+    return existsSync(command) ? { program: command, prefixArgs } : null
+  }
+  // Bare name only when npm_execpath is unset (bare `vitest`, not `pnpm test`).
+  // Drop the extension so the shared resolver tries every executable form of it.
+  const resolved = resolveCliCommand(parse(command).name)
+  return isAbsolute(resolved) ? { program: resolved, prefixArgs } : null
+}
+
+describe('patched dependencies', () => {
+  it('installs with --frozen-lockfile, which is what validates every patch hash', () => {
+    const pnpm = resolvePnpmInvocation()
+    expect(pnpm, 'pnpm must be installed; it is the only thing that can check this').not.toBeNull()
+
+    // A copy, because a --frozen-lockfile run still rewrites parts of the
+    // lockfile this repo does not track, and the real one must not move.
+    const scratch = mkdtempSync(join(tmpdir(), 'orca-frozen-install-'))
+    try {
+      for (const file of ['package.json', 'pnpm-lock.yaml', 'pnpm-workspace.yaml']) {
+        copyFileSync(join(PROJECT_DIR, file), join(scratch, file))
+      }
+      mkdirSync(join(scratch, 'config'), { recursive: true })
+      cpSync(join(PROJECT_DIR, 'config', 'patches'), join(scratch, 'config', 'patches'), {
+        recursive: true
+      })
+
+      const result = runProcessSync({
+        program: pnpm.program,
+        args: [
+          ...pnpm.prefixArgs,
+          'install',
+          '--frozen-lockfile',
+          '--lockfile-only',
+          '--ignore-scripts'
+        ],
+        cwd: scratch,
+        timeoutMs: 300_000
+      })
+
+      expect(result.code, `${result.stdout}\n${result.stderr}`).toBe(0)
+    } finally {
+      removeTreeSync(scratch)
+    }
+    // The 300s spawn budget is only reachable if the case is allowed to take it;
+    // config/vitest.config.ts caps every case at 30s by default.
+  }, 300_000)
+
+  /**
+   * `--lockfile-only` resolves; it never applies a patch. So the case above is
+   * bounded to hash consistency, and the actual question -- can pnpm still put
+   * the patched reader on disk? -- had nothing covering it.
+   *
+   * One package, patch applied for real, assert the marker landed. Scoped to the
+   * single dependency so it stays a ~2s check rather than a full install.
+   */
+  it('materializes the patched command-line reader on a real install', () => {
+    const pnpm = resolvePnpmInvocation()
+    expect(pnpm, 'pnpm must be installed; it is the only thing that can check this').not.toBeNull()
+
+    const scratch = mkdtempSync(join(tmpdir(), 'orca-patch-apply-'))
+    try {
+      mkdirSync(join(scratch, 'config', 'patches'), { recursive: true })
+      copyFileSync(
+        join(PROJECT_DIR, 'config', 'patches', WINDOWS_PROCESS_TREE_PATCH),
+        join(scratch, 'config', 'patches', WINDOWS_PROCESS_TREE_PATCH)
+      )
+      writeFileSync(
+        join(scratch, 'package.json'),
+        `${JSON.stringify(
+          {
+            name: 'orca-patch-apply-probe',
+            version: '1.0.0',
+            dependencies: { '@vscode/windows-process-tree': '0.8.0' }
+          },
+          null,
+          2
+        )}\n`
+      )
+      writeFileSync(
+        join(scratch, 'pnpm-workspace.yaml'),
+        'packages: []\n' +
+          'patchedDependencies:\n' +
+          `  '@vscode/windows-process-tree@0.8.0': config/patches/${WINDOWS_PROCESS_TREE_PATCH}\n`
+      )
+
+      const result = runProcessSync({
+        program: pnpm.program,
+        args: [...pnpm.prefixArgs, 'install', '--no-frozen-lockfile', '--ignore-scripts'],
+        cwd: scratch,
+        timeoutMs: 300_000
+      })
+      expect(result.code, `${result.stdout}\n${result.stderr}`).toBe(0)
+
+      const materialized = readFileSync(
+        join(
+          scratch,
+          'node_modules',
+          '@vscode',
+          'windows-process-tree',
+          'src',
+          'process_commandline.cc'
+        ),
+        'utf8'
+      )
+      expect(materialized).toContain('kProcessCommandLineInformation')
+      // The whole point of the patch: the upstream reader is gone, not merely
+      // supplemented.
+      expect(materialized).not.toContain('ReadProcessMemory')
+    } finally {
+      removeTreeSync(scratch)
+    }
+  }, 300_000)
+})
diff --git a/config/scripts/pr-code-change-scope.mjs b/config/scripts/pr-code-change-scope.mjs
index f5a73f6239f..3089d376b2a 100644
--- a/config/scripts/pr-code-change-scope.mjs
+++ b/config/scripts/pr-code-change-scope.mjs
@@ -213,12 +213,18 @@ const LINUX_PACKAGE_TESTS = [
 const WINDOWS_PACKAGE_TESTS = [
   ...LINUX_PACKAGE_TESTS,
   'config/scripts/rebuild-native-deps.test.mjs',
+  'config/scripts/rebuild-native-deps-windows-process-tree.test.mjs',
   'src/main/providers/windows-conpty-wide-char-duplication.node-pty.test.ts',
   'src/main/providers/pty-repaint-wide-char-buffer.node-pty.test.ts',
   'src/shared/child-process/windows-command-line.win32.test.ts',
+  'src/shared/child-process/windows-cmd-shim-resolution.test.ts',
+  'src/shared/child-process/windows-cmd-shim-resolution.win32.test.ts',
   'src/main/agent-hooks/windows-hook-payload-delivery.test.ts',
+  'src/main/agent-hooks/windows-direct-cmd-hook-command.test.ts',
   'src/main/windows/windows-pty-job.win32.test.ts',
   'src/main/windows/windows-host-job.win32.test.ts',
+  'src/main/windows/windows-process-tree-command-line-patch.test.ts',
+  'src/main/windows-live-tree-kill.win32.test.ts',
   'src/main/wsl/wsl-runner.test.ts',
   'src/main/wsl/wsl-guest-environment.test.ts',
   'src/main/wsl/wsl-invocation-boundary.test.ts',
@@ -226,14 +232,18 @@ const WINDOWS_PACKAGE_TESTS = [
   'src/main/wsl/wsl-w1-w3-contract.test.ts',
   'src/shared/source-scan/source-tree-scan.test.ts',
   'src/main/cli/wsl-cli-powershell-boundary.test.ts',
+  'src/main/computer/desktop-script-runtime-host.win32.test.ts',
   'src/main/cursor/hook-service.test.ts',
   'src/main/orca-profiles/profile-index-store.test.ts',
   'src/main/startup/windows-install-dir-acl-repair.win32.test.ts',
   'src/main/runtime/repo-worktree-admin-fingerprint.test.ts',
   'src/main/runtime/worktree-scan-admin-fingerprint-gate.test.ts',
   'src/shared/secure-file-fsync-flags.test.ts',
+  'src/shared/secure-path-windows-acl.win32.test.ts',
+  'src/main/runtime/unreadable-secret-store-preservation.win32.test.ts',
   'src/main/ipc/pty-codex-account-attribution.test.ts',
-  'src/main/ipc/pty-spawn-env-codex-resume-provenance.test.ts'
+  'src/main/ipc/pty-spawn-env-codex-resume-provenance.test.ts',
+  'src/relay/windows-port-scan.win32.test.ts'
 ]
 
 const DESKTOP_IRRELEVANT_PREFIXES = [
diff --git a/config/scripts/pr-code-change-scope.test.mjs b/config/scripts/pr-code-change-scope.test.mjs
index 4642372135c..f31822e5b93 100644
--- a/config/scripts/pr-code-change-scope.test.mjs
+++ b/config/scripts/pr-code-change-scope.test.mjs
@@ -414,10 +414,11 @@ describe('PR Checks skip wiring', () => {
   })
 
   it('skips e2e detection on docs-only PRs without dropping the draft gate', () => {
-    expect(prWorkflow.jobs['e2e-paths'].needs).toEqual(['code_paths'])
-    expect(prWorkflow.jobs['e2e-paths'].if).toBe(
-      "github.event.pull_request.draft != true && needs.code_paths.outputs.should_run == 'true'"
+    const filter = prWorkflow.jobs.code_paths.steps.find((step) => step.id === 'e2e_filter')
+    expect(filter.if).toBe(
+      "github.event.pull_request.draft != true && steps.filter.outputs.should_run == 'true'"
     )
+    expect(prWorkflow.jobs['e2e-paths']).toBeUndefined()
   })
 
   it('lets verify pass skipped jobs the classifier turned off', () => {
diff --git a/config/scripts/pr-e2e-gate-contract.test.mjs b/config/scripts/pr-e2e-gate-contract.test.mjs
index ceac6b8cc6e..41f9338ab75 100644
--- a/config/scripts/pr-e2e-gate-contract.test.mjs
+++ b/config/scripts/pr-e2e-gate-contract.test.mjs
@@ -39,7 +39,7 @@ const nativeImeSpec = readFileSync(
   'utf8'
 )
 
-const filterStep = prWorkflow.jobs['e2e-paths'].steps.find(
+const filterStep = prWorkflow.jobs.code_paths.steps.find(
   (step) => step.name === 'Filter changed E2E specs'
 )
 const rollbackStep = prWorkflow.jobs.static_analysis.steps.find(
@@ -106,16 +106,16 @@ describe('PR E2E gate contract', () => {
     // Why: without this the job could lose its filter and run on every PR — the
     // cost the path filter exists to avoid — while the gate assertions above
     // stay green.
-    expect(prWorkflow.jobs.e2e.needs).toBe('e2e-paths')
-    expect(prWorkflow.jobs.e2e.if).toBe("needs.e2e-paths.outputs.should_run == 'true'")
-    expect(prWorkflow.jobs['e2e-paths'].outputs.should_run).toBe(
-      '${{ steps.filter.outputs.should_run }}'
+    expect(prWorkflow.jobs.e2e.needs).toBe('code_paths')
+    expect(prWorkflow.jobs.e2e.if).toBe("needs.code_paths.outputs.e2e_should_run == 'true'")
+    expect(prWorkflow.jobs.code_paths.outputs.e2e_should_run).toBe(
+      '${{ steps.e2e_filter.outputs.should_run }}'
     )
-    expect(prWorkflow.jobs['e2e-paths'].outputs.test_files).toBe(
-      '${{ steps.filter.outputs.test_files }}'
+    expect(prWorkflow.jobs.code_paths.outputs.test_files).toBe(
+      '${{ steps.e2e_filter.outputs.test_files }}'
     )
     expect(prWorkflow.jobs.e2e.with.ref).toBe('${{ github.event.pull_request.head.sha }}')
-    expect(prWorkflow.jobs.e2e.with.test_files).toBe('${{ needs.e2e-paths.outputs.test_files }}')
+    expect(prWorkflow.jobs.e2e.with.test_files).toBe('${{ needs.code_paths.outputs.test_files }}')
   })
 
   it('enforces every job verify depends on', () => {
@@ -360,11 +360,11 @@ describe('PR E2E gate contract', () => {
     expect(sshLaneCondition).toContain("inputs.ssh_source_changed == 'true' ||")
 
     expect(e2eWorkflow.on.workflow_call.inputs.ssh_source_changed.type).toBe('string')
-    expect(prWorkflow.jobs['e2e-paths'].outputs.ssh_source_changed).toBe(
-      '${{ steps.filter.outputs.ssh_source_changed }}'
+    expect(prWorkflow.jobs.code_paths.outputs.ssh_source_changed).toBe(
+      '${{ steps.e2e_filter.outputs.ssh_source_changed }}'
     )
     expect(prWorkflow.jobs.e2e.with.ssh_source_changed).toBe(
-      '${{ needs.e2e-paths.outputs.ssh_source_changed }}'
+      '${{ needs.code_paths.outputs.ssh_source_changed }}'
     )
     expect(filterStep.run).toContain('pr-e2e-source-routing.mjs --ssh-source')
     expect(filterStep.run).toContain('ssh_source_changed=$SSH_SOURCE_CHANGED')
@@ -565,12 +565,12 @@ describe('PR E2E gate contract', () => {
     expect(prWorkflow.jobs.terminal_ime_native.uses).toBe(
       './.github/workflows/terminal-ime-e2e.yml'
     )
-    expect(prWorkflow.jobs.terminal_ime_native.needs).toBe('e2e-paths')
+    expect(prWorkflow.jobs.terminal_ime_native.needs).toBe('code_paths')
     expect(prWorkflow.jobs.terminal_ime_native.if).toBe(
-      "needs.e2e-paths.outputs.native_ime_source_changed == 'true'"
+      "needs.code_paths.outputs.native_ime_source_changed == 'true'"
     )
-    expect(prWorkflow.jobs['e2e-paths'].outputs.native_ime_source_changed).toBe(
-      '${{ steps.filter.outputs.native_ime_source_changed }}'
+    expect(prWorkflow.jobs.code_paths.outputs.native_ime_source_changed).toBe(
+      '${{ steps.e2e_filter.outputs.native_ime_source_changed }}'
     )
     expect(filterStep.run).toContain('pr-e2e-source-routing.mjs --native-ime-source')
     expect(filterStep.run).toContain('native_ime_source_changed=$NATIVE_IME_SOURCE_CHANGED')
@@ -636,13 +636,8 @@ describe('PR E2E gate contract', () => {
       .filter((spec) => nativeGateExpression.test(readFileSync(join(projectDir, spec), 'utf8')))
     expect(nativeGatedSpecs.length).toBeGreaterThan(0)
 
-    // Why exempt: the digit repro needs a nested gnome-shell, which no hosted runner provides
-    // (headless mutter never answers RemoteDesktop.CreateSession); the macOS spec needs a real
-    // macOS input source, and no macOS runner exists on any PR or scheduled lane.
-    const unreachableSpecs = new Set([
-      'tests/e2e/terminal-hangul-terminating-digit-native.spec.ts',
-      'tests/e2e/terminal-macos-2set-korean-native.spec.ts'
-    ])
+    // The macOS spec needs a native input source; PR and scheduled IME lanes use Linux.
+    const unreachableSpecs = new Set(['tests/e2e/terminal-macos-2set-korean-native.spec.ts'])
     const unclaimed = nativeGatedSpecs.filter(
       (spec) => !unreachableSpecs.has(spec) && !nativeImeRunner.includes(spec)
     )
@@ -682,8 +677,13 @@ describe('PR E2E gate contract', () => {
 
     // Why pin the titles: the runner requires one receipt per name, so a rename that nobody
     // mirrored here would fail the lane loudly instead of quietly halving it.
+    const nativeDigitSpec = readFileSync(
+      join(projectDir, 'tests/e2e/terminal-hangul-terminating-digit-native.spec.ts'),
+      'utf8'
+    )
+    expect(nativeDigitSpec).toContain('appendImeEngagementReceipt(testInfo.title, trace)')
     for (const title of EXPECTED_NATIVE_IME_TESTS) {
-      expect(nativeImeSpec, title).toContain(title)
+      expect(nativeImeSpec + nativeDigitSpec, title).toContain(title)
     }
   })
 
diff --git a/config/scripts/pr-e2e-native-only-routing.test.mjs b/config/scripts/pr-e2e-native-only-routing.test.mjs
new file mode 100644
index 00000000000..b6c3662cd1d
--- /dev/null
+++ b/config/scripts/pr-e2e-native-only-routing.test.mjs
@@ -0,0 +1,33 @@
+import { readFileSync } from 'node:fs'
+import { describe, expect, it } from 'vitest'
+import { parse } from 'yaml'
+import { hasNativeImeSourceChange, shouldRunReusablePrE2e } from './pr-e2e-source-routing.mjs'
+
+const workflow = parse(readFileSync('.github/workflows/pr.yml', 'utf8'))
+const filterStep = workflow.jobs.code_paths.steps.find((step) => step.id === 'e2e_filter')
+
+describe('native-only PR E2E routing', () => {
+  it('avoids generic E2E allocation for native-only changes while preserving its IME lane', () => {
+    for (const file of [
+      'tests/e2e/terminal-ibus-hangul-native.spec.ts',
+      'config/scripts/run-terminal-ibus-hangul-e2e.mjs'
+    ]) {
+      expect(hasNativeImeSourceChange([file])).toBe(true)
+      expect(shouldRunReusablePrE2e([file])).toBe(false)
+    }
+    expect(shouldRunReusablePrE2e([])).toBe(false)
+    for (const spec of [
+      'tests/e2e/ssh-startup-exec-readiness.spec.ts',
+      'tests/e2e/paired-startup-exec-readiness.spec.ts',
+      'tests/e2e/terminal-ime-exact-byte.spec.ts',
+      'tests/e2e/future.spec.ts'
+    ]) {
+      expect(shouldRunReusablePrE2e([spec])).toBe(true)
+      expect(shouldRunReusablePrE2e(['tests/e2e/terminal-ibus-hangul-native.spec.ts', spec])).toBe(
+        true
+      )
+    }
+    expect(filterStep.run).toContain('pr-e2e-source-routing.mjs --reusable-workflow')
+    expect(filterStep.run).toContain('if [ "$SHOULD_RUN" = true ]; then')
+  })
+})
diff --git a/config/scripts/pr-e2e-source-routing.mjs b/config/scripts/pr-e2e-source-routing.mjs
index 78814b663cb..5b698fb0b42 100644
--- a/config/scripts/pr-e2e-source-routing.mjs
+++ b/config/scripts/pr-e2e-source-routing.mjs
@@ -217,6 +217,16 @@ export function hasNativeImeSourceChange(changedPaths) {
   ).some((route) => changedPaths.some(route.matches))
 }
 
+export function shouldRunReusablePrE2e(changedPaths) {
+  // Native IME has its own workflow; SSH still runs inside the reusable workflow.
+  return (
+    hasSshSourceChange(changedPaths) ||
+    selectPrE2eSpecs(changedPaths).some(
+      (spec) => spec !== 'tests/e2e/terminal-ibus-hangul-native.spec.ts'
+    )
+  )
+}
+
 if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
   let input = ''
   process.stdin.setEncoding('utf8')
@@ -226,6 +236,8 @@ if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href)
   const changedPaths = input.split(/\r?\n/).filter(Boolean)
   if (process.argv.includes('--ssh-source')) {
     process.stdout.write(`${hasSshSourceChange(changedPaths)}\n`)
+  } else if (process.argv.includes('--reusable-workflow')) {
+    process.stdout.write(`${shouldRunReusablePrE2e(changedPaths)}\n`)
   } else if (process.argv.includes('--native-ime-source')) {
     process.stdout.write(`${hasNativeImeSourceChange(changedPaths)}\n`)
   } else {
diff --git a/config/scripts/quick-open-exclusion-benchmark.mjs b/config/scripts/quick-open-exclusion-benchmark.mjs
new file mode 100644
index 00000000000..399302c5a2b
--- /dev/null
+++ b/config/scripts/quick-open-exclusion-benchmark.mjs
@@ -0,0 +1,60 @@
+import assert from 'node:assert/strict'
+import { performance } from 'node:perf_hooks'
+import { build } from 'esbuild'
+
+const bundled = await build({
+  entryPoints: ['src/shared/quick-open-filter.ts'],
+  bundle: true,
+  platform: 'node',
+  format: 'esm',
+  write: false,
+  logLevel: 'silent'
+})
+const { shouldExcludeQuickOpenRelPath: after } = await import(
+  `data:text/javascript;base64,${Buffer.from(bundled.outputFiles[0].text).toString('base64')}`
+)
+// Original production predicate, including its exact boundary check.
+function before(relPath, prefixes) {
+  for (const prefix of prefixes) {
+    if (relPath === prefix) {
+      return true
+    }
+    if (relPath.length > prefix.length && relPath.startsWith(`${prefix}/`)) {
+      return true
+    }
+  }
+  return false
+}
+const files = Array.from(
+  { length: 100000 },
+  (_, index) => `src/components/group-${index % 100}/file-${index}.tsx`
+)
+function run(fn, prefixes) {
+  let excluded = 0
+  for (const file of files) {
+    excluded += Number(fn(file, prefixes))
+  }
+  return excluded
+}
+function measure(fn, prefixes) {
+  run(fn, prefixes)
+  const samples = []
+  for (let index = 0; index < 5; index++) {
+    const start = performance.now()
+    run(fn, prefixes)
+    samples.push(performance.now() - start)
+  }
+  return samples.sort((a, b) => a - b)[2]
+}
+const results = []
+for (const count of [0, 10, 100, 500]) {
+  const prefixes = Array.from({ length: count }, (_, index) => `nested-worktrees/worktree-${index}`)
+  assert.equal(run(after, prefixes), run(before, prefixes))
+  results.push({
+    files: files.length,
+    exclusions: count,
+    beforeMs: measure(before, prefixes),
+    afterMs: measure(after, prefixes)
+  })
+}
+console.log(JSON.stringify({ node: process.version, platform: process.platform, results }, null, 2))
diff --git a/config/scripts/rebuild-native-deps-node-pty.test.mjs b/config/scripts/rebuild-native-deps-node-pty.test.mjs
index 09e38853371..871732dd53d 100644
--- a/config/scripts/rebuild-native-deps-node-pty.test.mjs
+++ b/config/scripts/rebuild-native-deps-node-pty.test.mjs
@@ -4,6 +4,8 @@ import { join } from 'node:path'
 import { describe, expect, it } from 'vitest'
 
 import {
+  gitLineEndingEnv,
+  initGitWorkTree,
   mkTempProject,
   runRebuildScript,
   writeFakeElectronRebuild,
@@ -14,7 +16,8 @@ import {
   writeFakeWindowsProcessTreeWithNodeAddonApi,
   writeFakeWindowsRegistry,
   writeNodePtyPatchFile,
-  writePatchedNodePtyBuildArtifacts
+  writePatchedNodePtyBuildArtifacts,
+  writeWindowsProcessTreePatchFile
 } from './rebuild-native-deps-test-fixtures.mjs'
 
 describe('rebuild-native-deps patched node-pty rebuild', () => {
@@ -85,6 +88,91 @@ describe('rebuild-native-deps patched node-pty rebuild', () => {
     }
   })
 
+  const commandLineSourcePath = (projectDir) =>
+    join(
+      projectDir,
+      'node_modules',
+      '@vscode',
+      'windows-process-tree',
+      'src',
+      'process_commandline.cc'
+    )
+
+  // Why inside a git work tree: `git apply` run under one prefixes patch paths
+  // with the cwd-relative prefix, silently skips what does not match, and still
+  // exits 0. The package dir is always under the project root in production, so
+  // a fixture in %TEMP% alone would pass while the real repair did nothing.
+  //
+  // Why both line-ending modes: the patch is stored LF while upstream ships this
+  // source CRLF, so whether the pre-image matches depends on `core.autocrlf` --
+  // and under `false`, Git's own built-in default, it did not. The repair blinds
+  // git to the repo, so that value comes from global config, i.e. from whichever
+  // option the developer's installer wrote. Pinning both makes the case cover the
+  // host that breaks rather than the host that happens to run it.
+  for (const autocrlf of ['false', 'true']) {
+    it(`repairs an un-applied command-line patch in a work tree (autocrlf=${autocrlf})`, () => {
+      const projectDir = mkTempProject()
+
+      try {
+        initGitWorkTree(projectDir)
+        writeFakeUsableElectronPackage(projectDir, { platform: 'win32' })
+        writeFakeElectronRebuild(projectDir)
+        writeFakeNodePtyConptyPayload(projectDir, 'x64')
+        writeFakeWindowsProcessTreeWithNodeAddonApi(projectDir, {
+          commandLinePatchApplied: false
+        })
+        writeWindowsProcessTreePatchFile(projectDir)
+
+        const result = runRebuildScript(
+          projectDir,
+          {
+            npm_config_platform: 'win32',
+            npm_config_arch: 'x64',
+            ...gitLineEndingEnv(autocrlf)
+          },
+          ['--platform=win32', '--arch=x64', '--force']
+        )
+
+        expect(result.status, result.stderr).toBe(0)
+        expect(readFileSync(commandLineSourcePath(projectDir), 'utf8')).toContain(
+          'kProcessCommandLineInformation'
+        )
+      } finally {
+        removeTreeSync(projectDir)
+      }
+    })
+  }
+
+  // Why fail rather than build: an unpatched command-line reader compiles fine
+  // and then opens every process with PROCESS_VM_READ to walk its PEB, which is
+  // the primitive the patch exists to remove.
+  it('refuses a Windows rebuild when the command-line patch cannot be applied', () => {
+    const projectDir = mkTempProject()
+
+    try {
+      initGitWorkTree(projectDir)
+      writeFakeUsableElectronPackage(projectDir, { platform: 'win32' })
+      writeFakeElectronRebuild(projectDir)
+      writeFakeNodePtyConptyPayload(projectDir, 'x64')
+      writeFakeWindowsProcessTreeWithNodeAddonApi(projectDir, { commandLinePatchApplied: false })
+      // No patch file, so the repair has nothing to apply.
+
+      const result = runRebuildScript(
+        projectDir,
+        { npm_config_platform: 'win32', npm_config_arch: 'x64' },
+        ['--platform=win32', '--arch=x64', '--force']
+      )
+
+      expect(result.status).not.toBe(0)
+      expect(result.stderr).toContain('process_commandline.cc')
+      expect(readFileSync(commandLineSourcePath(projectDir), 'utf8')).not.toContain(
+        'kProcessCommandLineInformation'
+      )
+    } finally {
+      removeTreeSync(projectDir)
+    }
+  })
+
   it('restores the ConPTY runtime payload after a Windows Electron rebuild', () => {
     const projectDir = mkTempProject()
 
@@ -256,4 +344,37 @@ describe('rebuild-native-deps patched node-pty rebuild', () => {
       }
     }
   )
+
+  // The binary this step produces is the one copied into the packaged app. The
+  // relay build checks its own artifact and ensure-native-runtime checks what it
+  // loads; nothing checked this one, so a rebuild that quietly emitted the
+  // upstream reader shipped. Both non-clean states have to fail, which is the
+  // caller the tri-state was missing: after a rebuild that reported success, an
+  // absent binary is a broken build, not an absence to shrug at.
+  for (const [addon, expected] of [
+    ['unpatched', 'still imports ReadProcessMemory'],
+    ['none', 'is not there']
+  ]) {
+    it(`fails a Windows rebuild that leaves ${addon} windows-process-tree bytes`, () => {
+      const projectDir = mkTempProject()
+
+      try {
+        writeFakeUsableElectronPackage(projectDir, { platform: 'win32' })
+        writeFakeElectronRebuild(projectDir, { addon })
+        writeFakeNodePtyConptyPayload(projectDir, 'x64')
+        writeFakeWindowsProcessTreeWithNodeAddonApi(projectDir)
+
+        const result = runRebuildScript(
+          projectDir,
+          { npm_config_platform: 'win32', npm_config_arch: 'x64' },
+          ['--platform=win32', '--arch=x64', '--force']
+        )
+
+        expect(result.status).not.toBe(0)
+        expect(result.stderr).toContain(expected)
+      } finally {
+        removeTreeSync(projectDir)
+      }
+    })
+  }
 })
diff --git a/config/scripts/rebuild-native-deps-test-fixtures.mjs b/config/scripts/rebuild-native-deps-test-fixtures.mjs
index 585e7a58ef2..2cb7d8ba8b4 100644
--- a/config/scripts/rebuild-native-deps-test-fixtures.mjs
+++ b/config/scripts/rebuild-native-deps-test-fixtures.mjs
@@ -1,5 +1,12 @@
 import { spawnSync } from 'node:child_process'
-import { chmodSync, copyFileSync, mkdirSync, mkdtempSync, writeFileSync } from 'node:fs'
+import {
+  chmodSync,
+  copyFileSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  writeFileSync
+} from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { fileURLToPath } from 'node:url'
@@ -15,6 +22,68 @@ const sourceNodePtyJobOwnershipPath = fileURLToPath(
 const sourceWindowsProcessTreeGypRebuildPath = fileURLToPath(
   new URL('./windows-process-tree-gyp-rebuild.mjs', import.meta.url)
 )
+const sourceWindowsProcessTreePatchPath = fileURLToPath(
+  new URL('../patches/@vscode__windows-process-tree@0.8.0.patch', import.meta.url)
+)
+
+/**
+ * The command-line reader as it is *before* the patch, taken from the patch's
+ * own pre-image so no upstream copy has to be vendored.
+ *
+ * Written back as **CRLF**, which is what `@vscode/windows-process-tree@0.8.0`
+ * actually ships: all 67 pre-image lines of this file carried a CR before the
+ * patch was normalized to LF. Rebuilding it with the patch's current newline
+ * instead would make fixture and patch agree by construction, on any encoding —
+ * which is exactly how a repair that cannot apply to the real package passed
+ * this suite.
+ */
+function unpatchedWindowsProcessTreeCommandLineSource() {
+  const lines = readFileSync(sourceWindowsProcessTreePatchPath, 'utf8').split('\n')
+  const start = lines.findIndex((line) =>
+    line.startsWith('diff --git a/src/process_commandline.cc ')
+  )
+  const rest = lines.slice(start + 1)
+  const end = rest.findIndex((line) => line.startsWith('diff --git '))
+  const preImage = (end === -1 ? rest : rest.slice(0, end))
+    .filter((line) => line.startsWith(' ') || line.startsWith('-'))
+    .filter((line) => !line.startsWith('---'))
+    .map((line) => line.slice(1).replace(/\r$/, ''))
+    .join('\r\n')
+  // Splitting drops the file's own trailing newline as an empty element, and
+  // `git apply` needs the bytes exact.
+  return `${preImage}\r\n`
+}
+
+/**
+ * Pin `core.autocrlf` for a spawned repair, whatever the host is set to.
+ *
+ * The repair blinds git to the surrounding repo with `GIT_DIR`, so the value it
+ * sees comes from global/system config — on a Git for Windows box that is
+ * whichever line-ending option the installer wrote, and `false` (Git's built-in
+ * default, "checkout as-is") is the one the repair used to fail under. A global
+ * config in a temp HOME outranks the system file, so this is deterministic
+ * rather than whatever the developer happens to have.
+ */
+export function gitLineEndingEnv(autocrlf) {
+  const home = mkdtempSync(join(tmpdir(), `orca-git-home-${autocrlf}-`))
+  writeFileSync(join(home, '.gitconfig'), `[core]\n\tautocrlf = ${autocrlf}\n`)
+  return { HOME: home, USERPROFILE: home }
+}
+
+/** Production always runs the repair from inside a work tree; `git apply` behaves differently there. */
+export function initGitWorkTree(projectDir) {
+  for (const args of [['init'], ['config', 'user.email', 'a@b.c'], ['config', 'user.name', 't']]) {
+    spawnSync('git', args, { cwd: projectDir, encoding: 'utf8' })
+  }
+}
+
+export function writeWindowsProcessTreePatchFile(projectDir) {
+  mkdirSync(join(projectDir, 'config', 'patches'), { recursive: true })
+  copyFileSync(
+    sourceWindowsProcessTreePatchPath,
+    join(projectDir, 'config', 'patches', '@vscode__windows-process-tree@0.8.0.patch')
+  )
+}
 
 export function mkTempProject() {
   const projectDir = mkdtempSync(join(tmpdir(), 'orca-rebuild-native-deps-'))
@@ -143,17 +212,46 @@ if (${JSON.stringify(createExecutable)}) {
   )
 }
 
-export function writeFakeElectronRebuild(projectDir, { logPathEnv = null } = {}) {
+/** Bytes that stand in for a compiled addon's import table. */
+const FAKE_ADDON_BYTES = {
+  clean: 'MZ\0ntdll.dll\0NtQueryInformationProcess\0',
+  unpatched: 'MZ\0KERNEL32.dll\0ReadProcessMemory\0'
+}
+
+/**
+ * A rebuild that produces nothing leaves no addon to inspect, and the script now
+ * asserts the binary it just built is a patched one. Emit a stand-in so the
+ * fixture models a rebuild that actually succeeded. `addon` picks which kind,
+ * because "produced the upstream reader" and "produced nothing" are both real
+ * outcomes that assertion has to tell apart.
+ */
+export function writeFakeElectronRebuild(projectDir, { logPathEnv = null, addon = 'clean' } = {}) {
   const rebuildDir = join(projectDir, 'node_modules', '@electron', 'rebuild')
   mkdirSync(rebuildDir, { recursive: true })
   writeFileSync(join(rebuildDir, 'package.json'), JSON.stringify({ type: 'module' }))
+  const emitAddon =
+    addon === 'none'
+      ? ''
+      : `
+  const packageDir = join('node_modules', '@vscode', 'windows-process-tree')
+  if (existsSync(join(packageDir, 'package.json'))) {
+    mkdirSync(join(packageDir, 'build', 'Release'), { recursive: true })
+    writeFileSync(
+      join(packageDir, 'build', 'Release', 'windows_process_tree.node'),
+      ${JSON.stringify(FAKE_ADDON_BYTES[addon])}
+    )
+  }`
+  const emitImports =
+    addon === 'none'
+      ? ''
+      : "import { existsSync, mkdirSync, writeFileSync } from 'node:fs'\nimport { join } from 'node:path'\n"
   writeFileSync(
     join(rebuildDir, 'index.js'),
     logPathEnv
       ? `
 import { appendFileSync } from 'node:fs'
-
-export async function rebuild(options) {
+${emitImports}
+export async function rebuild(options) {${emitAddon}
   const logPath = process.env[${JSON.stringify(logPathEnv)}]
   if (!logPath) {
     return
@@ -171,7 +269,10 @@ export async function rebuild(options) {
   )
 }
 `
-      : 'export async function rebuild() {}\n'
+      : `${emitImports}
+export async function rebuild() {${emitAddon}
+}
+`
   )
 }
 
@@ -271,12 +372,22 @@ export function writeFakeWindowsProcessTree(projectDir) {
   writeFileSync(join(processTreeDir, 'index.js'), 'module.exports = {}\n')
 }
 
-export function writeFakeWindowsProcessTreeWithNodeAddonApi(projectDir) {
+export function writeFakeWindowsProcessTreeWithNodeAddonApi(
+  projectDir,
+  { commandLinePatchApplied = true } = {}
+) {
   const processTreeDir = join(projectDir, 'node_modules', '@vscode', 'windows-process-tree')
   const nodeAddonApiDir = join(processTreeDir, 'node_modules', 'node-addon-api')
   mkdirSync(nodeAddonApiDir, { recursive: true })
   writeFileSync(join(processTreeDir, 'package.json'), '{"dependencies":{"node-addon-api":"*"}}\n')
   writeFileSync(join(processTreeDir, 'index.js'), 'module.exports = {}\n')
+  mkdirSync(join(processTreeDir, 'src'), { recursive: true })
+  writeFileSync(
+    join(processTreeDir, 'src', 'process_commandline.cc'),
+    commandLinePatchApplied
+      ? '// kProcessCommandLineInformation = 60\n'
+      : unpatchedWindowsProcessTreeCommandLineSource()
+  )
   writeFileSync(join(nodeAddonApiDir, 'package.json'), '{"name":"node-addon-api"}\n')
   writeFileSync(join(nodeAddonApiDir, 'napi.h'), '// napi.h\n')
   writeFileSync(join(nodeAddonApiDir, 'napi-inl.h'), '// napi-inl.h\n')
diff --git a/config/scripts/rebuild-native-deps-windows-process-tree.test.mjs b/config/scripts/rebuild-native-deps-windows-process-tree.test.mjs
new file mode 100644
index 00000000000..4f98c1b092d
--- /dev/null
+++ b/config/scripts/rebuild-native-deps-windows-process-tree.test.mjs
@@ -0,0 +1,103 @@
+import { spawn } from 'node:child_process'
+import { appendFileSync, copyFileSync, existsSync, mkdirSync } from 'node:fs'
+import { createRequire } from 'node:module'
+import { join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { removeTreeSync } from '../../src/shared/windows-transient-lock-removal.ts'
+
+import {
+  mkTempProject,
+  runRebuildScript,
+  writeFakeElectronRebuild,
+  writeFakeNodePtyConptyPayload,
+  writeFakeUsableElectronPackage,
+  writeFakeWindowsProcessTreeWithNodeAddonApi
+} from './rebuild-native-deps-test-fixtures.mjs'
+
+const require = createRequire(import.meta.url)
+
+/** A real loadable addon, so the OS holds the same lock a running Orca holds. */
+function repoAddonPath() {
+  try {
+    const entry = require.resolve('@vscode/windows-process-tree')
+    const built = join(entry, '..', '..', 'build', 'Release', 'windows_process_tree.node')
+    return existsSync(built) ? built : null
+  } catch {
+    return null
+  }
+}
+
+/**
+ * Stage a stale addon and keep it loaded, exactly as a running Orca does.
+ *
+ * The bytes are the repo's own patched build with the flagged import appended,
+ * because the guard keys on that symbol and the patched binary does not carry
+ * it. Trailing bytes are PE overlay, so the file still loads.
+ */
+async function stageLoadedStaleAddon(projectDir) {
+  const source = repoAddonPath()
+  const releaseDir = join(
+    projectDir,
+    'node_modules',
+    '@vscode',
+    'windows-process-tree',
+    'build',
+    'Release'
+  )
+  mkdirSync(releaseDir, { recursive: true })
+  const stale = join(releaseDir, 'windows_process_tree.node')
+  copyFileSync(source, stale)
+  appendFileSync(stale, 'ReadProcessMemory')
+
+  const holder = spawn(
+    process.execPath,
+    ['-e', 'require(process.argv[1]); process.send("held"); setInterval(() => {}, 1000)', stale],
+    { stdio: ['ignore', 'ignore', 'ignore', 'ipc'] }
+  )
+  await new Promise((resolve, reject) => {
+    holder.once('message', resolve)
+    holder.once('exit', () => reject(new Error('the addon holder exited before loading')))
+  })
+  return holder
+}
+
+// Why an end-to-end run: the defect was purely one of placement. The guard threw
+// a real EPERM, and the classifier that turns that into "close running Orca"
+// already existed -- the throw simply happened before the try that reaches it.
+// Only the whole script exercises that.
+describe.runIf(process.platform === 'win32')('rebuild-native-deps stale addon under lock', () => {
+  it.skipIf(!repoAddonPath())(
+    'reports a locked stale addon as a Windows file lock instead of an EPERM stack',
+    async () => {
+      const projectDir = mkTempProject()
+      let holder
+
+      try {
+        writeFakeUsableElectronPackage(projectDir, { platform: 'win32' })
+        writeFakeElectronRebuild(projectDir)
+        writeFakeNodePtyConptyPayload(projectDir, process.arch)
+        writeFakeWindowsProcessTreeWithNodeAddonApi(projectDir)
+        holder = await stageLoadedStaleAddon(projectDir)
+
+        const result = runRebuildScript(
+          projectDir,
+          {
+            npm_lifecycle_event: 'postinstall',
+            npm_config_platform: 'win32',
+            npm_config_arch: process.arch
+          },
+          ['--platform=win32', `--arch=${process.arch}`, '--force']
+        )
+
+        expect(result.stderr).toContain(
+          'Close running Orca/Electron/dev processes for this worktree'
+        )
+        // Non-strict postinstall soft-exits on a lock; the next dev/start re-checks.
+        expect(result.status, result.stderr).toBe(0)
+      } finally {
+        holder?.kill()
+        removeTreeSync(projectDir)
+      }
+    }
+  )
+})
diff --git a/config/scripts/rebuild-native-deps.mjs b/config/scripts/rebuild-native-deps.mjs
index 3b17683e831..863aac850a1 100644
--- a/config/scripts/rebuild-native-deps.mjs
+++ b/config/scripts/rebuild-native-deps.mjs
@@ -20,7 +20,12 @@
 
 import { rebuild } from '@electron/rebuild'
 import { execFileSync, spawnSync } from 'node:child_process'
-import { stageWindowsProcessTreeNodeAddonApiHeaders } from './windows-process-tree-gyp-rebuild.mjs'
+import {
+  ensureWindowsProcessTreeCommandLinePatch,
+  inspectWindowsProcessTreeAddon,
+  stageWindowsProcessTreeNodeAddonApiHeaders,
+  windowsProcessTreeAddonPath
+} from './windows-process-tree-gyp-rebuild.mjs'
 import {
   copyFileSync,
   existsSync,
@@ -141,15 +146,21 @@ if (!ignoreModules.includes('cpu-features')) {
   }
 }
 
-if (
-  rebuildPlatform === 'win32' &&
-  modulesToRebuild.includes('@vscode/windows-process-tree') &&
-  existsSync(join(projectDir, 'node_modules', '@vscode', 'windows-process-tree', 'package.json'))
-) {
-  stageWindowsProcessTreeNodeAddonApiHeaders()
-}
-
 try {
+  // Why inside the try: the patch guard deletes a stale addon binary, and that
+  // delete fails EPERM when the addon is loaded -- exactly the running-Orca case
+  // the catch below is written for. Outside, it aborted `pnpm install` with a
+  // raw stack instead of the "close running Orca/Electron processes" message.
+  if (
+    rebuildPlatform === 'win32' &&
+    modulesToRebuild.includes('@vscode/windows-process-tree') &&
+    existsSync(join(projectDir, 'node_modules', '@vscode', 'windows-process-tree', 'package.json'))
+  ) {
+    stageWindowsProcessTreeNodeAddonApiHeaders()
+    if (ensureWindowsProcessTreeCommandLinePatch()) {
+      console.warn('[rebuild] Repaired the un-applied windows-process-tree command-line patch.')
+    }
+  }
   await rebuild({
     buildPath: projectDir,
     electronVersion,
@@ -165,6 +176,7 @@ try {
     force: true
   })
   restoreNodePtyWindowsConptyRuntime()
+  assertWindowsProcessTreeAddonIsPatched()
 } catch (/** @type {any} */ err) {
   console.error('[rebuild] Native module rebuild failed:', err?.message ?? err)
   if (isWindowsNativeLockError(err)) {
@@ -184,6 +196,40 @@ try {
   process.exit(1)
 }
 
+/**
+ * The binary this rebuild just produced is the one the packaged app ships.
+ *
+ * The relay build asserts its own artifact and `ensure-native-runtime.mjs`
+ * asserts what it loads, but nothing checked the addon that gets copied into the
+ * packaged `node_modules` -- so a rebuild that silently produced the upstream
+ * reader would reach users. Anything but `clean` fails: after a rebuild that
+ * reported success the binary must exist, so `missing` is a broken build, not an
+ * absence to shrug at. This is the caller that needs the state to be a state and
+ * not a boolean.
+ */
+function assertWindowsProcessTreeAddonIsPatched() {
+  if (
+    rebuildPlatform !== 'win32' ||
+    !modulesToRebuild.includes('@vscode/windows-process-tree') ||
+    !existsSync(join(projectDir, 'node_modules', '@vscode', 'windows-process-tree', 'package.json'))
+  ) {
+    return
+  }
+  const addonPath = windowsProcessTreeAddonPath()
+  const state = inspectWindowsProcessTreeAddon(addonPath)
+  if (state === 'clean') {
+    return
+  }
+  throw new Error(
+    state === 'missing'
+      ? `the rebuild reported success but ${addonPath} is not there, so the packaged app would ` +
+          'ship no windows-process-tree addon at all.'
+      : `${addonPath} still imports ReadProcessMemory, so it was not built from the patched ` +
+          'command-line reader. The packaged app would carry the primitive MDE scores as ' +
+          'credential dumping.'
+  )
+}
+
 function restoreNodePtyWindowsConptyRuntime() {
   if (rebuildPlatform !== 'win32' || !onlyModules.includes('node-pty')) {
     return
diff --git a/config/scripts/redactor-environment-lines-benchmark.mjs b/config/scripts/redactor-environment-lines-benchmark.mjs
new file mode 100644
index 00000000000..71aebf9fe88
--- /dev/null
+++ b/config/scripts/redactor-environment-lines-benchmark.mjs
@@ -0,0 +1,47 @@
+import assert from 'node:assert/strict'
+import { readFileSync } from 'node:fs'
+import { stripTypeScriptTypes } from 'node:module'
+import { performance } from 'node:perf_hooks'
+import { redactString } from '../../src/main/observability/redactor.ts'
+
+// Supply an unchanged redactor.ts snapshot to measure the actual previous production function.
+const baselinePath = process.argv[2]
+if (!baselinePath) {
+  throw new Error(
+    'Usage: node config/scripts/redactor-environment-lines-benchmark.mjs <baseline-redactor.ts>'
+  )
+}
+const baselineSource = stripTypeScriptTypes(readFileSync(baselinePath, 'utf8'))
+const { redactString: before } = await import(
+  `data:text/javascript;base64,${Buffer.from(baselineSource).toString('base64')}`
+)
+function median(fn, input, repeats) {
+  const samples = []
+  for (let run = 0; run < repeats; run++) {
+    const started = performance.now()
+    fn(input)
+    samples.push(performance.now() - started)
+  }
+  return samples.sort((a, b) => a - b)[Math.floor(samples.length / 2)]
+}
+const rows = []
+for (const [shape, input] of [
+  ['8KiB blank lines', '\n'.repeat(8192)],
+  ['16KiB blank lines', '\n'.repeat(16384)],
+  ['32KiB blank lines', '\n'.repeat(32768)],
+  ['32KiB blank lines then invalid key', `${'\n'.repeat(32768)}lowercase`],
+  ['ordinary env', 'FOO=value\nBAR=other\n'],
+  ['ordinary message', 'Cannot read directory /workspace/source: file not found']
+]) {
+  assert.equal(redactString(input), before(input))
+  const beforeMs = median(before, input, 3)
+  const afterMs = median(redactString, input, 15)
+  rows.push({
+    shape,
+    bytes: Buffer.byteLength(input),
+    beforeMs,
+    afterMs,
+    speedup: beforeMs / afterMs
+  })
+}
+console.log(JSON.stringify({ node: process.version, platform: process.platform, rows }, null, 2))
diff --git a/config/scripts/relay-asset-line-ending-pin.test.mjs b/config/scripts/relay-asset-line-ending-pin.test.mjs
new file mode 100644
index 00000000000..3384aa9b88a
--- /dev/null
+++ b/config/scripts/relay-asset-line-ending-pin.test.mjs
@@ -0,0 +1,82 @@
+import { execFileSync } from 'node:child_process'
+import { resolve } from 'node:path'
+import { RELAY_ARTIFACTS } from '../../src/shared/relay-artifacts.ts'
+import { describe, expect, it } from 'vitest'
+
+/**
+ * Guard the `.gitattributes` pin that keeps `config/relay-assets` on LF.
+ *
+ * `core.autocrlf=true` ships in the Git-for-Windows system config, so without a
+ * pin a Windows runner checks these out as CRLF. build-relay.mjs copies them
+ * verbatim into the bundle and hashes them byte-for-byte into `.version`, which
+ * names the immutable remote relay directory -- so a Windows-built client and a
+ * mac/Linux-built one disagree on the same release, and one SSH host ends up with
+ * two relay trees, each paying its own remote native-dep compile.
+ *
+ * Measured on v1.4.197: master-cloexec-patch.cjs shipped at 11229 bytes from the
+ * mac runner and 11547 (= 11229 + 318 lines) from the Windows one.
+ */
+const projectDir = resolve(import.meta.dirname, '../..')
+
+function git(args) {
+  return execFileSync('git', args, { cwd: projectDir, encoding: 'utf8' })
+}
+
+/** `git check-attr -z` emits NUL-separated path/attr/value triples. */
+function eolAttributes(paths) {
+  const fields = git(['check-attr', '-z', 'eol', '--', ...paths]).split('\0')
+  const found = new Map()
+  for (let index = 0; index + 2 < fields.length; index += 3) {
+    found.set(fields[index], fields[index + 2])
+  }
+  return found
+}
+
+/**
+ * Keyed off the manifest, not a directory: build-relay refuses to emit an
+ * artifact absent from RELAY_ARTIFACTS, so relocating an asset cannot slip
+ * past this the way a path glob would. esbuild bundles have no tracked
+ * source and contribute no hits, so they need no classifying.
+ */
+function trackedManifestSources() {
+  const paths = new Set()
+  for (const { filename } of RELAY_ARTIFACTS) {
+    const hits = git(['ls-files', '-z', '--', `*/${filename}`])
+      .split('\0')
+      .filter(Boolean)
+    for (const path of hits) {
+      paths.add(path)
+    }
+  }
+  return [...paths]
+}
+
+describe('config/relay-assets line-ending pin', () => {
+  it('pins every tracked relay artifact source to LF', () => {
+    const assets = trackedManifestSources()
+    expect(assets.length).toBeGreaterThan(0)
+
+    const attributes = eolAttributes(assets)
+    const unpinned = assets.filter((path) => attributes.get(path) !== 'lf')
+
+    expect(
+      unpinned,
+      'A relay asset left on the platform default gets CRLF on a Windows runner, ' +
+        'which changes the .version hash and splits one release across two remote ' +
+        'relay directories. Pin it in .gitattributes.'
+    ).toEqual([])
+  })
+
+  // Why: the assertion above only sees files that exist today. These fix the
+  // pattern itself -- broad enough to cover a file added tomorrow, narrow enough
+  // not to claim neighbours.
+  it.each([
+    ['config/relay-assets/example.cjs', 'lf'],
+    ['config/relay-assets/nested/deeper/example.cjs', 'lf'],
+    ['config/relay-assets/example.txt', 'lf'],
+    ['config/relay-assets-extra/example.cjs', 'unspecified'],
+    ['vendor/config/relay-assets/example.cjs', 'unspecified']
+  ])('resolves %s to eol=%s', (path, expected) => {
+    expect(eolAttributes([path]).get(path)).toBe(expected)
+  })
+})
diff --git a/config/scripts/relay-frame-buffer-benchmark.mjs b/config/scripts/relay-frame-buffer-benchmark.mjs
new file mode 100644
index 00000000000..24d7b565400
--- /dev/null
+++ b/config/scripts/relay-frame-buffer-benchmark.mjs
@@ -0,0 +1,62 @@
+#!/usr/bin/env node
+import assert from 'node:assert/strict'
+import { readFileSync } from 'node:fs'
+import { stripTypeScriptTypes } from 'node:module'
+import { performance } from 'node:perf_hooks'
+
+// Pass the pre-change source saved with git show <base>:src/shared/relay-frame-buffer.ts.
+const baselinePath = process.argv[2]
+if (!baselinePath) {
+  throw new Error('Usage: node config/scripts/relay-frame-buffer-benchmark.mjs <baseline.ts>')
+}
+async function load(source) {
+  return (
+    await import(
+      `data:text/javascript;base64,${Buffer.from(stripTypeScriptTypes(source)).toString('base64')}`
+    )
+  ).RelayFrameBuffer
+}
+const Before = await load(readFileSync(baselinePath, 'utf8'))
+const After = await load(
+  readFileSync(new URL('../../src/shared/relay-frame-buffer.ts', import.meta.url), 'utf8')
+)
+function median(values) {
+  return values.sort((a, b) => a - b)[Math.floor(values.length / 2)]
+}
+for (const count of [1, 256, 16384, 65536]) {
+  const chunks = Array.from({ length: count }, (_, index) => Buffer.alloc(64, index % 256))
+  const expected = Buffer.concat(chunks)
+  for (const mode of ['take', 'discard']) {
+    const times = [[], []]
+    for (let round = 0; round < 9; round += 1) {
+      for (const arm of round % 2 === 0 ? [0, 1] : [1, 0]) {
+        const FrameBuffer = arm === 0 ? Before : After
+        const buffer = new FrameBuffer()
+        for (const chunk of chunks) {
+          buffer.append(chunk)
+        }
+        const start = performance.now()
+        const output = buffer[mode](expected.length)
+        times[arm].push(performance.now() - start)
+        if (mode === 'take') {
+          assert.deepEqual(output, expected)
+        }
+        assert.equal(buffer.length, 0)
+        buffer.append(Buffer.from('tail'))
+        assert.equal(buffer.drain().toString(), 'tail')
+      }
+    }
+    const beforeMs = median(times[0]),
+      afterMs = median(times[1])
+    console.log(
+      JSON.stringify({
+        mode,
+        chunks: count,
+        bytes: expected.length,
+        beforeMs,
+        afterMs,
+        speedup: beforeMs / afterMs
+      })
+    )
+  }
+}
diff --git a/config/scripts/renderer-quadratic-scan-benchmark.mjs b/config/scripts/renderer-quadratic-scan-benchmark.mjs
new file mode 100644
index 00000000000..681b6cf8550
--- /dev/null
+++ b/config/scripts/renderer-quadratic-scan-benchmark.mjs
@@ -0,0 +1,364 @@
+#!/usr/bin/env node
+// Benchmarks four renderer projections that scaled worse than linearly with user data, each on a
+// path that reruns per keystroke or per store write.
+//
+// Scenarios 1, 3 and 4 time the production export against a hand-written reproduction of the
+// pre-change shape and assert both agree first. Scenario 2 is MODELLED on both sides: the
+// projection lives inside the `useTabGroupItemProjections` React hook and cannot be imported
+// without a renderer, so it reproduces the before/after loops rather than driving production.
+import { spawnSync } from 'node:child_process'
+import { transformSync } from 'esbuild'
+import { performance } from 'node:perf_hooks'
+import fs from 'node:fs'
+import nodeModule from 'node:module'
+import path from 'node:path'
+import process from 'node:process'
+import { fileURLToPath, pathToFileURL } from 'node:url'
+
+if (!process.execArgv.includes('--experimental-transform-types')) {
+  const result = spawnSync(
+    process.execPath,
+    ['--experimental-transform-types', '--no-warnings', import.meta.filename],
+    { stdio: 'inherit' }
+  )
+  process.exit(result.status ?? 1)
+}
+
+const ROOT = path.resolve(import.meta.dirname, '../..')
+const RENDERER = path.join(ROOT, 'src/renderer/src')
+
+nodeModule.registerHooks({
+  resolve(specifier, context, nextResolve) {
+    if (!context.parentURL) {
+      return nextResolve(specifier, context)
+    }
+    const candidates = specifier.startsWith('@/')
+      ? ['.ts', '.tsx', '/index.ts', '/index.tsx', ''].map(
+          (suffix) => path.join(RENDERER, specifier.slice(2)) + suffix
+        )
+      : specifier.startsWith('.') && !/\.[cm]?[jt]sx?$/.test(specifier)
+        ? ['.ts', '.tsx'].map((suffix) =>
+            fileURLToPath(new URL(specifier + suffix, context.parentURL))
+          )
+        : []
+    const resolved = candidates.find((file) => fs.existsSync(file) && fs.statSync(file).isFile())
+    return resolved
+      ? { url: pathToFileURL(resolved).href, shortCircuit: true }
+      : nextResolve(specifier, context)
+  },
+  // Node strips types from .ts but not .tsx; the sidebar row model transitively imports icons.
+  load(url, context, nextLoad) {
+    if (url.endsWith('.tsx')) {
+      const source = fs.readFileSync(fileURLToPath(url), 'utf8')
+      const { code } = transformSync(source, { loader: 'tsx', format: 'esm', jsx: 'automatic' })
+      return { format: 'module', source: code, shortCircuit: true }
+    }
+    if (url.endsWith('.json') && !url.includes('/node_modules/')) {
+      const source = fs.readFileSync(fileURLToPath(url), 'utf8')
+      return { format: 'module', source: `export default ${source}`, shortCircuit: true }
+    }
+    return nextLoad(url, context)
+  }
+})
+
+const importRenderer = (relativePath) =>
+  import(pathToFileURL(path.join(RENDERER, relativePath)).href)
+
+function envInt(name, fallback) {
+  const value = Number(process.env[name] ?? fallback)
+  if (!Number.isSafeInteger(value) || value <= 0) {
+    throw new Error(`${name} must be a positive integer, got ${value}`)
+  }
+  return value
+}
+
+const KEYSTROKES = envInt('ORCA_QUADRATIC_BENCH_KEYSTROKES', 12)
+const WORKTREES = envInt('ORCA_QUADRATIC_BENCH_WORKTREES', 300)
+const TABS = envInt('ORCA_QUADRATIC_BENCH_TABS', 60)
+const OPEN_FILES = envInt('ORCA_QUADRATIC_BENCH_OPEN_FILES', 120)
+const CHANGED_FILES = envInt('ORCA_QUADRATIC_BENCH_CHANGED_FILES', 5000)
+const SIDEBAR_ROWS = envInt('ORCA_QUADRATIC_BENCH_SIDEBAR_ROWS', 600)
+const SIDEBAR_REPOS = envInt('ORCA_QUADRATIC_BENCH_SIDEBAR_REPOS', 80)
+if (SIDEBAR_REPOS > SIDEBAR_ROWS) {
+  throw new Error(
+    'ORCA_QUADRATIC_BENCH_SIDEBAR_REPOS must not exceed ORCA_QUADRATIC_BENCH_SIDEBAR_ROWS'
+  )
+}
+
+function timeRounds(run, rounds = 7) {
+  run()
+  const samples = Array.from({ length: rounds }, () => {
+    const start = performance.now()
+    run()
+    return performance.now() - start
+  }).sort((left, right) => left - right)
+  return samples[Math.floor(rounds / 2)]
+}
+
+function repeat(times, run) {
+  return () => {
+    let last
+    for (let round = 0; round < times; round += 1) {
+      last = run()
+    }
+    return last
+  }
+}
+
+const results = []
+function compare({ label, scale, drives, before, after }) {
+  if (JSON.stringify(before()) !== JSON.stringify(after())) {
+    throw new Error(`${label}: baseline disagreed with the indexed shape`)
+  }
+  results.push({ label, scale, drives, beforeMs: timeRounds(before), afterMs: timeRounds(after) })
+}
+
+// ------------------------------------------------- 1. workspace board search index
+
+const { buildWorkspaceBoardPaletteDocuments, matchWorkspaceBoardWorktrees } = await importRenderer(
+  'components/sidebar/workspace-kanban-search.ts'
+)
+
+const repoMap = new Map([
+  ['repo-1', { id: 'repo-1', name: 'orca', path: '/tmp/orca', branch: 'main' }]
+])
+const boardWorktrees = Array.from({ length: WORKTREES }, (_, index) => ({
+  id: `repo-1::/tmp/worktree-${index}`,
+  repoId: 'repo-1',
+  path: `/tmp/worktree-${index}`,
+  branch: `feature/search-target-${index}`,
+  title: `Workspace ${index} search target`,
+  isMain: false
+}))
+const queries = Array.from({ length: KEYSTROKES }, (_, index) => 'search'.slice(0, (index % 6) + 1))
+const matchAll = (documents) =>
+  queries.map((query) => [
+    ...matchWorkspaceBoardWorktrees({ worktrees: boardWorktrees, query, repoMap, documents })
+  ])
+
+compare({
+  label: 'workspace board filter (per keystroke burst)',
+  scale: `${WORKTREES} worktrees x ${KEYSTROKES} keystrokes`,
+  drives: 'production',
+  // Omitting `documents` is the pre-change shape: the index is rebuilt inside every match.
+  before: () => matchAll(undefined),
+  // The hook memoizes the index on [worktrees, repoMap]; only the match reruns per keystroke.
+  after: () => matchAll(buildWorkspaceBoardPaletteDocuments({ worktrees: boardWorktrees, repoMap }))
+})
+
+// ------------------------------------------------- 2. tab-group projections (modelled)
+
+const groupTabs = Array.from({ length: TABS }, (_, index) => ({
+  id: `tab-${index}`,
+  entityId: `entity-${index}`,
+  contentType: index % 3 === 0 ? 'editor' : 'terminal'
+}))
+const openFiles = Array.from({ length: OPEN_FILES }, (_, index) => ({
+  id: `entity-${index}`,
+  path: `/tmp/file-${index}.ts`
+}))
+const tabOrder = groupTabs.map((tab) => tab.id)
+// Production memoizes each index on its own source list, so a unified-tab write reuses it.
+const openFileById = new Map(openFiles.map((item) => [item.id, item]))
+const groupTabById = new Map(groupTabs.map((item) => [item.id, item]))
+
+function tabProjections(findOpenFile, findGroupTab) {
+  const editorItems = groupTabs
+    .filter((item) => item.contentType === 'editor')
+    .map((item) => findOpenFile(item.entityId))
+    .filter((file) => file !== undefined)
+  const order = tabOrder.map((itemId) => findGroupTab(itemId)?.entityId ?? itemId)
+  return [editorItems, order]
+}
+
+compare({
+  label: 'tab-group projections (per unified-tab write)',
+  scale: `${TABS} tabs x ${OPEN_FILES} open files`,
+  drives: 'modelled',
+  before: repeat(200, () =>
+    tabProjections(
+      (id) => openFiles.find((candidate) => candidate.id === id),
+      (id) => groupTabs.find((candidate) => candidate.id === id)
+    )
+  ),
+  after: repeat(200, () =>
+    tabProjections(
+      (id) => openFileById.get(id),
+      (id) => groupTabById.get(id)
+    )
+  )
+})
+
+// ------------------------------------------------- 3. source-control tree build
+
+const { buildSourceControlTree } = await importRenderer(
+  'components/right-sidebar/source-control-tree.ts'
+)
+const { normalizeRelativePath } = await importRenderer('lib/path.ts')
+const { splitPathSegments } = await importRenderer('components/right-sidebar/path-tree.ts')
+const { compareFileNames } = await import(
+  pathToFileURL(path.join(ROOT, 'src/shared/file-name-sort.ts')).href
+)
+
+const changedEntries = Array.from({ length: CHANGED_FILES }, (_, index) => ({
+  path: `src/area-${index % 20}/module-${index % 60}/nested/deep/part-${index % 7}/file-${index}.ts`
+}))
+
+// Pre-change `buildSourceControlTree`: identical except each ancestor path is re-joined.
+function buildSourceControlTreeBefore(area, entries) {
+  const makeDirectory = (dirPath, name, depth) => ({
+    type: 'directory',
+    key: `dir::${area}::${dirPath}`,
+    name,
+    path: dirPath,
+    area,
+    depth,
+    fileCount: 0,
+    children: [],
+    directoryChildren: new Map()
+  })
+  const root = makeDirectory('', '', -1)
+  for (const entry of entries) {
+    const normalizedPath = normalizeRelativePath(entry.path)
+    const segments = splitPathSegments(normalizedPath)
+    if (segments.length === 0) {
+      continue
+    }
+    let parent = root
+    for (let index = 0; index < segments.length - 1; index += 1) {
+      const name = segments[index]
+      const dirPath = segments.slice(0, index + 1).join('/')
+      let dir = parent.directoryChildren.get(name)
+      if (!dir) {
+        dir = makeDirectory(dirPath, name, index)
+        parent.directoryChildren.set(name, dir)
+        parent.children.push(dir)
+      }
+      parent = dir
+    }
+    parent.children.push({
+      type: 'file',
+      key: `${area}::${entry.path}`,
+      name: segments.at(-1),
+      path: normalizedPath,
+      entry,
+      area,
+      depth: segments.length - 1
+    })
+  }
+  const finalize = (node) => {
+    const directories = node.children.filter((child) => child.type === 'directory').map(finalize)
+    const files = node.children.filter((child) => child.type === 'file')
+    directories.sort((a, b) => compareFileNames(a.name, b.name))
+    files.sort((a, b) => compareFileNames(a.entry.path, b.entry.path))
+    const { directoryChildren: _, ...rest } = node
+    return {
+      ...rest,
+      fileCount: files.length + directories.reduce((count, dir) => count + dir.fileCount, 0),
+      children: [...directories, ...files]
+    }
+  }
+  return finalize(root).children
+}
+
+compare({
+  label: 'source-control tree build (per filter keystroke)',
+  scale: `${CHANGED_FILES} changed files`,
+  drives: 'production',
+  before: () => buildSourceControlTreeBefore('unstaged', changedEntries),
+  after: () => buildSourceControlTree('unstaged', changedEntries)
+})
+
+// ------------------------------------------------- 4. sidebar header boundaries
+
+const { getRepoHeaderSectionEndByRepoId } = await importRenderer(
+  'components/sidebar/worktree-header-section-boundaries.ts'
+)
+const { estimateRenderRowSize } = await importRenderer(
+  'components/sidebar/worktree-list/viewport/virtual-rows.ts'
+)
+
+const headerRowIndexes = new Set(
+  Array.from({ length: SIDEBAR_REPOS }, (_, repo) =>
+    Math.floor((repo * SIDEBAR_ROWS) / SIDEBAR_REPOS)
+  )
+)
+const sidebarRows = Array.from({ length: SIDEBAR_ROWS }, (_, index) =>
+  headerRowIndexes.has(index)
+    ? {
+        type: 'header',
+        key: `repo:${index}`,
+        label: '',
+        count: 0,
+        tone: '',
+        repo: { id: `repo-${index}` }
+      }
+    : { type: 'item', rowKey: `wt:${index}`, sectionKey: '', depth: 0, groupDepth: 0 }
+)
+const headerRepoIds = sidebarRows.filter((row) => row.type === 'header').map((row) => row.repo.id)
+const boundaryArgs = {
+  rows: sidebarRows,
+  firstHeaderIndex: 0,
+  // What `getSidebarOrderedRepoHeaderIdsByBucket` yields for repos outside any project group.
+  sidebarRepoHeaderIdsByBucket: new Map([['ungrouped', headerRepoIds]]),
+  repoHeaderBucketByRepoId: new Map(headerRepoIds.map((id) => [id, 'ungrouped']))
+}
+
+// Pre-change `getRepoHeaderSectionEndByRepoId`: a findIndex and an indexOf per header row.
+function getRepoHeaderSectionEndByRepoIdBefore(args) {
+  const rowStarts = []
+  let offset = 0
+  for (let index = 0; index < args.rows.length; index += 1) {
+    rowStarts[index] = offset
+    offset += estimateRenderRowSize(args.rows, index, args.firstHeaderIndex, null)
+  }
+  rowStarts[args.rows.length] = offset
+  const sectionEndByRepoId = new Map()
+  for (let index = 0; index < args.rows.length; index += 1) {
+    const row = args.rows[index]
+    const repoId = row?.type === 'header' ? row.repo?.id : undefined
+    if (!repoId) {
+      continue
+    }
+    const bucketKey = args.repoHeaderBucketByRepoId.get(repoId)
+    const bucketRepoIds = bucketKey ? args.sidebarRepoHeaderIdsByBucket.get(bucketKey) : undefined
+    const bucketIndex = bucketRepoIds?.indexOf(repoId) ?? -1
+    const nextRepoId = bucketIndex >= 0 ? bucketRepoIds?.[bucketIndex + 1] : undefined
+    let endIndex = -1
+    if (nextRepoId) {
+      endIndex = args.rows.findIndex((r) => r.type === 'header' && r.repo?.id === nextRepoId)
+    } else {
+      endIndex = args.rows.length
+      for (let next = index + 1; next < args.rows.length; next += 1) {
+        if (args.rows[next]?.type === 'header' || args.rows[next]?.type === 'host-header') {
+          endIndex = next
+          break
+        }
+      }
+    }
+    sectionEndByRepoId.set(
+      repoId,
+      rowStarts[endIndex >= 0 ? endIndex : args.rows.length] ?? rowStarts[args.rows.length] ?? 0
+    )
+  }
+  return sectionEndByRepoId
+}
+
+compare({
+  label: 'sidebar header boundaries (per row-model rebuild)',
+  scale: `${SIDEBAR_REPOS} repos x ${SIDEBAR_ROWS} rows`,
+  drives: 'production',
+  before: repeat(50, () => [...getRepoHeaderSectionEndByRepoIdBefore(boundaryArgs)]),
+  after: repeat(50, () => [...getRepoHeaderSectionEndByRepoId(boundaryArgs)])
+})
+
+// -------------------------------------------------
+
+console.log('Renderer quadratic-scan removals\n')
+console.log('| projection | drives | scale | before | after | |')
+console.log('| --- | --- | --- | --- | --- | --- |')
+for (const row of results) {
+  console.log(
+    `| ${row.label} | ${row.drives} | ${row.scale} | ${row.beforeMs.toFixed(2)} ms | ${row.afterMs.toFixed(2)} ms | ${(row.beforeMs / row.afterMs).toFixed(1)}x |`
+  )
+}
diff --git a/config/scripts/replace-cached-nsis-elevate.mjs b/config/scripts/replace-cached-nsis-elevate.mjs
new file mode 100644
index 00000000000..fcd1a7323d4
--- /dev/null
+++ b/config/scripts/replace-cached-nsis-elevate.mjs
@@ -0,0 +1,260 @@
+#!/usr/bin/env node
+
+// Why: electron-builder re-runs `CopyElevateHelper.copy` on every NSIS pack, so the
+// release rebuild overwrites the SignPath-signed `resources/elevate.exe` with the
+// unsigned copy sitting in the electron-builder toolset cache. The release workflow
+// swapped the cached copy first, but searched `<cache>/nsis` — a directory no current
+// app-builder-lib layout creates (real ones are `<cache>/nsis-3.0.4.1/nsis-3.0.4.1-<hash>/`
+// and `<cache>/nsis@<toolset>/nsis-bundle-<v>-<hash>/`), so the swap silently found
+// nothing and v1.4.193/v1.4.194 shipped an unsigned UAC elevation helper.
+
+import { copyFileSync, readdirSync, statSync } from 'node:fs'
+import { createRequire } from 'node:module'
+import { homedir, platform as osPlatform, tmpdir } from 'node:os'
+import { join, parse, resolve } from 'node:path'
+
+const require = createRequire(import.meta.url)
+
+const ELEVATE_EXE = 'elevate.exe'
+
+// `nsis` (the layout the old hardcoded path assumed), `nsis-3.0.4.1` (legacy bundle via
+// `getBinFromUrl`), `nsis@1.2.1` (unified bundle). Not `customNsisBinary`: the
+// `nsis-<version>` key `getBinFromCustomLoc` builds is only `getBin`'s in-process promise
+// key, and the extract dir is named for the custom URL's parent segment, which need not
+// start with `nsis` at all. Only the app-builder-lib probe covers that layout — which is
+// why the probe, not this scan, is what decides whether the swap succeeded.
+const NSIS_RELEASE_DIR = /^nsis(?:[-@].*)?$/i
+
+// elevate.exe lives at the bundle root, one level under the release dir. The legacy
+// bundle carries thousands of files under Contrib/, so an unbounded walk is both slow
+// and a way to match something that is not a toolset copy.
+const MAX_DEPTH = 3
+
+function isFile(path) {
+  try {
+    return statSync(path).isFile()
+  } catch {
+    return false
+  }
+}
+
+/**
+ * Mirrors `getCacheDirectory` in app-builder-lib's `out/util/electronGet.js`, which is what
+ * decides where the NSIS bundle is unpacked. Kept as a local port rather than an import
+ * because the swap must still resolve a cache root when app-builder-lib cannot be loaded.
+ */
+export function resolveElectronBuilderCacheDir({
+  env = process.env,
+  platform = osPlatform(),
+  home = homedir(),
+  temp = tmpdir()
+} = {}) {
+  const override = env.ELECTRON_BUILDER_CACHE?.trim()
+  if (override && parse(override).root) {
+    return override
+  }
+  if (platform === 'darwin') {
+    return join(home, 'Library', 'Caches', 'electron-builder')
+  }
+  if (platform === 'win32') {
+    const localAppData = env.LOCALAPPDATA?.trim()
+    // https://github.com/electron-userland/electron-builder/issues/1164
+    const isSystemUser =
+      localAppData?.toLowerCase().includes('\\windows\\system32\\') === true ||
+      env.USERNAME?.trim().toLowerCase() === 'system'
+    if (!localAppData || isSystemUser) {
+      return join(temp, 'electron-builder-cache')
+    }
+    return join(localAppData, 'electron-builder', 'Cache')
+  }
+  const xdgCache = env.XDG_CACHE_HOME
+  return xdgCache && parse(xdgCache).root
+    ? join(xdgCache, 'electron-builder')
+    : join(home, '.cache', 'electron-builder')
+}
+
+function collectElevateFiles(dir, depth, found) {
+  let entries
+  try {
+    entries = readdirSync(dir, { withFileTypes: true })
+  } catch {
+    return found
+  }
+  for (const entry of entries) {
+    const path = join(dir, entry.name)
+    if (entry.isFile()) {
+      if (entry.name.toLowerCase() === ELEVATE_EXE) {
+        found.push(path)
+      }
+    } else if (entry.isDirectory() && depth > 1) {
+      collectElevateFiles(path, depth - 1, found)
+    }
+  }
+  return found
+}
+
+/**
+ * Every cached `elevate.exe` under an NSIS release directory of `cacheDir`, plus the
+ * `ELECTRON_BUILDER_NSIS_DIR` override copy when that is set.
+ */
+export function findCachedElevatePaths(cacheDir, { env = process.env } = {}) {
+  const found = []
+  const overrideDir = env.ELECTRON_BUILDER_NSIS_DIR?.trim()
+  if (overrideDir && isFile(join(overrideDir, ELEVATE_EXE))) {
+    found.push(join(overrideDir, ELEVATE_EXE))
+  }
+  let entries
+  try {
+    entries = readdirSync(cacheDir, { withFileTypes: true })
+  } catch {
+    return found
+  }
+  for (const entry of entries) {
+    if (entry.isDirectory() && NSIS_RELEASE_DIR.test(entry.name)) {
+      collectElevateFiles(join(cacheDir, entry.name), MAX_DEPTH, found)
+    }
+  }
+  return found
+}
+
+/**
+ * The exact path `CopyElevateHelper` will pack, asked of app-builder-lib itself. Returns the
+ * failure instead of logging it: an unavailable probe leaves the directory scan as the only
+ * signal, and the caller has to say that out loud rather than quietly passing.
+ */
+export async function resolveToolsetElevatePath(projectDir = process.cwd()) {
+  try {
+    const configPath = require.resolve(resolve(projectDir, 'config/electron-builder.config.cjs'))
+    const config = require(configPath)
+    const { getNsisElevatePath } = require('app-builder-lib/out/toolsets/windows.js')
+    const path = await getNsisElevatePath(config.toolsets?.nsis, config.nsis?.customNsisBinary)
+    return { path, error: null }
+  } catch (error) {
+    return { path: null, error: error.message }
+  }
+}
+
+/**
+ * Replaces every cached copy rather than picking one. Which bundle the rebuild packs
+ * depends on the toolset version resolved at pack time, and each cached copy is an
+ * unsigned `elevate.exe` that a later pack could reach for; the helper is a standalone
+ * UAC shim, not coupled to the NSIS version around it, so overwriting all of them is safe.
+ *
+ * `toolsetReplaced` is the signal that matters. A non-empty `replaced` only says that some
+ * cached copy was rewritten, which a stale release directory carried in by the
+ * `electron-builder-win-` prefix restore can satisfy on its own.
+ */
+export async function replaceCachedElevateHelpers({
+  signedPath,
+  cacheDir = resolveElectronBuilderCacheDir(),
+  projectDir = process.cwd(),
+  env = process.env,
+  probe = resolveToolsetElevatePath
+} = {}) {
+  if (!isFile(signedPath)) {
+    throw new Error(`Signed elevate.exe not found: ${signedPath}`)
+  }
+  const targets = new Set(findCachedElevatePaths(cacheDir, { env }))
+  const { path: toolsetPath, error: toolsetError } = await probe(projectDir)
+  if (toolsetPath != null && isFile(toolsetPath)) {
+    targets.add(toolsetPath)
+  }
+
+  const replaced = []
+  for (const target of targets) {
+    copyFileSync(signedPath, target)
+    replaced.push(target)
+  }
+  return {
+    replaced,
+    cacheDir,
+    toolsetPath,
+    toolsetError,
+    toolsetReplaced: toolsetPath != null && replaced.includes(toolsetPath)
+  }
+}
+
+/**
+ * The annotations and exit code a swap result earns. Split out so every branch is testable
+ * without a subprocess — including the one that made this defect class possible, where the
+ * step passes because *a* cached copy was replaced while the copy the rebuild packs was not.
+ */
+export function summarizeSwap({ replaced, cacheDir, toolsetPath, toolsetError, toolsetReplaced }) {
+  if (toolsetPath != null && !toolsetReplaced) {
+    return {
+      annotations: [
+        {
+          level: 'error',
+          message:
+            `app-builder-lib resolves the elevate.exe the NSIS rebuild will pack to ${toolsetPath}, ` +
+            'but that path could not be replaced, so the installer will ship an unsigned UAC ' +
+            'elevation helper.'
+        }
+      ],
+      exitCode: 1
+    }
+  }
+  if (replaced.length === 0) {
+    return {
+      annotations: [
+        {
+          level: 'error',
+          message:
+            `No cached elevate.exe found under ${cacheDir}; the NSIS rebuild will pack the unsigned ` +
+            'helper and ship an unsigned UAC elevation binary. The electron-builder toolset cache ' +
+            'layout has changed — update config/scripts/replace-cached-nsis-elevate.mjs.'
+        }
+      ],
+      exitCode: 1
+    }
+  }
+  if (toolsetPath == null) {
+    // A green step must never quietly mean "the authoritative check did not run". The scan
+    // alone is satisfiable by a stale release directory that the `electron-builder-win-`
+    // prefix restore carried across a lockfile change, while the bundle the rebuild actually
+    // packs sits in a directory this scan does not match.
+    return {
+      annotations: [
+        {
+          level: 'warning',
+          message:
+            'Could not ask app-builder-lib which elevate.exe the NSIS rebuild will pack ' +
+            `(${toolsetError}); replaced ${replaced.length} copies found by scanning ${cacheDir} ` +
+            'alone, which a stale release directory can satisfy while the packed copy stays unsigned.'
+        }
+      ],
+      exitCode: 0
+    }
+  }
+  return { annotations: [], exitCode: 0 }
+}
+
+// Why an exit code and not a warning: a swap that misses the copy the rebuild packs exits
+// before that rebuild restores the unsigned helper, so a silent success here is
+// indistinguishable from a release that shipped a signed one — which is how this went
+// unnoticed for two releases. The workflow step is `continue-on-error`, so this annotates
+// loudly without making a release unbuildable.
+if (import.meta.filename === process.argv[1]) {
+  const signedPath = process.argv[2]
+  if (!signedPath) {
+    process.stderr.write('Usage: replace-cached-nsis-elevate.mjs <signed-elevate.exe>\n')
+    process.exit(2)
+  }
+  try {
+    const result = await replaceCachedElevateHelpers({ signedPath })
+    const { annotations, exitCode } = summarizeSwap(result)
+    for (const { level, message } of annotations) {
+      process.stdout.write(`::${level}::${message}\n`)
+    }
+    if (exitCode === 0) {
+      for (const path of result.replaced) {
+        const role = path === result.toolsetPath ? ' (the copy app-builder-lib will pack)' : ''
+        process.stdout.write(`Replaced ${path} with the SignPath-signed copy.${role}\n`)
+      }
+    }
+    process.exit(exitCode)
+  } catch (error) {
+    process.stdout.write(`::error::Could not replace the cached elevate.exe: ${error.message}\n`)
+    process.exit(1)
+  }
+}
diff --git a/config/scripts/replace-cached-nsis-elevate.test.mjs b/config/scripts/replace-cached-nsis-elevate.test.mjs
new file mode 100644
index 00000000000..a88461703c3
--- /dev/null
+++ b/config/scripts/replace-cached-nsis-elevate.test.mjs
@@ -0,0 +1,364 @@
+import { spawnSync } from 'node:child_process'
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readdirSync,
+  readFileSync,
+  rmSync,
+  writeFileSync
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { parse } from 'yaml'
+
+import {
+  findCachedElevatePaths,
+  replaceCachedElevateHelpers,
+  resolveElectronBuilderCacheDir,
+  summarizeSwap
+} from './replace-cached-nsis-elevate.mjs'
+
+// The probe is app-builder-lib asking itself where the packed elevate.exe lives; injected
+// here so no test needs the network or a warm toolset cache.
+const probeFound = (path) => async () => ({ path, error: null })
+const probeUnavailable = async () => ({ path: null, error: 'app-builder-lib not loadable' })
+
+const projectRoot = resolve(import.meta.dirname, '../..')
+const scriptPath = join(projectRoot, 'config/scripts/replace-cached-nsis-elevate.mjs')
+
+let scratch
+
+beforeEach(() => {
+  scratch = mkdtempSync(join(tmpdir(), 'orca elevate swap '))
+})
+
+afterEach(() => {
+  rmSync(scratch, { recursive: true, force: true })
+})
+
+function makeCache(...relativeFiles) {
+  const cacheDir = join(scratch, 'Cache')
+  for (const relative of relativeFiles) {
+    const path = join(cacheDir, ...relative.split('/'))
+    mkdirSync(join(path, '..'), { recursive: true })
+    writeFileSync(path, 'unsigned-elevate')
+  }
+  mkdirSync(cacheDir, { recursive: true })
+  return cacheDir
+}
+
+describe('cached elevate.exe swap covers the real electron-builder layouts', () => {
+  // Why these exact shapes: `downloadBuilderToolset` unpacks to
+  // `<cache>/<releaseName>/<archive basename>-<url hash>/`, and `releaseName` is
+  // `nsis-3.0.4.1` on the legacy bundle (`getBinFromUrl`) and `nsis@<toolset>` on the
+  // unified bundle. The release workflow searched `<cache>/nsis`, which matches none of
+  // them. `customNsisBinary` is deliberately absent — see the probe suite below.
+  it.each([
+    ['legacy bundle', 'nsis-3.0.4.1/nsis-3.0.4.1-1mx3n/elevate.exe'],
+    ['unified bundle', 'nsis@1.2.1/nsis-bundle-3.12-k4d9x/elevate.exe'],
+    ['bare nsis release dir', 'nsis/nsis-3.0.4.1/elevate.exe']
+  ])('finds the cached helper in the %s layout', (_label, relative) => {
+    const cacheDir = makeCache(relative)
+    expect(findCachedElevatePaths(cacheDir, { env: {} })).toEqual([
+      join(cacheDir, ...relative.split('/'))
+    ])
+  })
+
+  it('leaves other toolsets and the raw download dir alone', () => {
+    const cacheDir = makeCache(
+      'winCodeSign/winCodeSign-2.6.0-abc12/elevate.exe',
+      'downloads/nsis/elevate.exe'
+    )
+    expect(findCachedElevatePaths(cacheDir, { env: {} })).toEqual([])
+  })
+
+  // `nsis-resources-3.4.1` matches the release-dir pattern and is scanned. Documented
+  // rather than excluded: `getLegacyNsisResourcesBin` ships plugins, never an elevate.exe,
+  // so the over-match costs one cheap directory read and nothing else. Narrowing the
+  // pattern to exclude it would be a guess about a name app-builder-lib owns.
+  it('scans the resources bundle too, which ships no helper to find', () => {
+    expect(
+      findCachedElevatePaths(makeCache('nsis-resources-3.4.1/plugins/x86-unicode/nsProcess.dll'), {
+        env: {}
+      })
+    ).toEqual([])
+
+    const planted = 'nsis-resources-3.4.1/nsis-resources-3.4.1-p8w1z/elevate.exe'
+    const cacheDir = makeCache(planted)
+    expect(findCachedElevatePaths(cacheDir, { env: {} })).toEqual([
+      join(cacheDir, ...planted.split('/'))
+    ])
+  })
+
+  // The rebuild picks one bundle, and nothing outside app-builder-lib knows which.
+  // Replacing every cached copy is the deliberate answer to that ambiguity.
+  it('replaces every cached copy when several bundles are present', async () => {
+    const cacheDir = makeCache(
+      'nsis-3.0.4.1/nsis-3.0.4.1-1mx3n/elevate.exe',
+      'nsis@1.2.1/nsis-bundle-3.12-k4d9x/elevate.exe'
+    )
+    const signed = join(scratch, 'signed-elevate.exe')
+    writeFileSync(signed, 'signpath-signed-elevate')
+
+    const { replaced } = await replaceCachedElevateHelpers({
+      signedPath: signed,
+      cacheDir,
+      env: {},
+      probe: probeUnavailable
+    })
+
+    expect(replaced).toHaveLength(2)
+    for (const path of replaced) {
+      expect(readFileSync(path, 'utf8')).toBe('signpath-signed-elevate')
+    }
+  })
+
+  it('covers the ELECTRON_BUILDER_NSIS_DIR override copy', () => {
+    const overrideDir = join(scratch, 'nsis-override')
+    mkdirSync(overrideDir, { recursive: true })
+    writeFileSync(join(overrideDir, 'elevate.exe'), 'unsigned-elevate')
+    const cacheDir = makeCache()
+
+    expect(
+      findCachedElevatePaths(cacheDir, { env: { ELECTRON_BUILDER_NSIS_DIR: overrideDir } })
+    ).toEqual([join(overrideDir, 'elevate.exe')])
+  })
+
+  it('resolves the cache root the same way app-builder-lib does', () => {
+    expect(
+      resolveElectronBuilderCacheDir({
+        env: { LOCALAPPDATA: 'C:\\Users\\runneradmin\\AppData\\Local' },
+        platform: 'win32'
+      })
+    ).toBe(join('C:\\Users\\runneradmin\\AppData\\Local', 'electron-builder', 'Cache'))
+    expect(resolveElectronBuilderCacheDir({ env: {}, platform: 'darwin', home: '/Users/a' })).toBe(
+      join('/Users/a', 'Library', 'Caches', 'electron-builder')
+    )
+    expect(resolveElectronBuilderCacheDir({ env: { ELECTRON_BUILDER_CACHE: '/mnt/cache' } })).toBe(
+      '/mnt/cache'
+    )
+  })
+
+  // Proof against the layout actually on disk, not just the fixtures. Cross-checked
+  // against an independent unbounded walk so a search that scopes itself wrongly
+  // cannot pass by finding nothing — which is exactly how the inline path passed.
+  // Skipped only where no NSIS bundle has been downloaded into the cache yet.
+  it('finds every elevate.exe the real electron-builder cache holds', (ctx) => {
+    const cacheDir = resolveElectronBuilderCacheDir()
+    if (!existsSync(cacheDir)) {
+      // Reported as skipped, never as passed: this is the one test that checks the scan
+      // against a layout nobody wrote down, and a silent no-op here is the suite
+      // confirming itself. The Linux unit-test job has no electron-builder cache.
+      ctx.skip()
+      return
+    }
+    const walk = (dir) =>
+      readdirSync(dir, { withFileTypes: true }).flatMap((entry) => {
+        const path = join(dir, entry.name)
+        if (entry.isDirectory()) {
+          return walk(path)
+        }
+        return entry.name.toLowerCase() === 'elevate.exe' ? [path] : []
+      })
+    const onDisk = walk(cacheDir)
+    if (onDisk.length === 0) {
+      ctx.skip()
+      return
+    }
+    expect(findCachedElevatePaths(cacheDir, { env: {} }).sort()).toEqual(onDisk.sort())
+  })
+})
+
+describe('the probe, not the scan, decides whether the swap worked', () => {
+  // Why the probe is load-bearing: `getBinFromCustomLoc` passes `nsis-<version>` to `getBin`
+  // as its in-process promise key only — the extract dir is named for the custom URL's parent
+  // segment, so a customNsisBinary bundle can sit outside `nsis*` entirely.
+  it('covers a custom bundle the directory scan cannot match', async () => {
+    const relative = 'orca-nsis-mirror/nsis-custom-3.11-0zqp2/elevate.exe'
+    const cacheDir = makeCache(relative)
+    const packed = join(cacheDir, ...relative.split('/'))
+    const signed = join(scratch, 'signed-elevate.exe')
+    writeFileSync(signed, 'signpath-signed-elevate')
+
+    expect(findCachedElevatePaths(cacheDir, { env: {} })).toEqual([])
+
+    const result = await replaceCachedElevateHelpers({
+      signedPath: signed,
+      cacheDir,
+      env: {},
+      probe: probeFound(packed)
+    })
+
+    expect(result.toolsetReplaced).toBe(true)
+    expect(readFileSync(packed, 'utf8')).toBe('signpath-signed-elevate')
+    expect(summarizeSwap(result)).toEqual({ annotations: [], exitCode: 0 })
+  })
+
+  // The shape that reproduced the hole: release-cut.yml restores the toolset cache with
+  // `restore-keys: electron-builder-win-`, so a stale release directory survives a lockfile
+  // change. Replacing that stale copy satisfies `replaced.length > 0` on its own while the
+  // bundle the rebuild packs sits in a directory the scan never matches.
+  it('does not call a stale directory a success when the packed bundle is unmatched', async () => {
+    const stale = 'nsis-3.0.4.1/nsis-3.0.4.1-1mx3n/elevate.exe'
+    const packed = 'builder-nsis@4.0.0/nsis-bundle-4.0-k4d9x/elevate.exe'
+    const cacheDir = makeCache(stale, packed)
+    const signed = join(scratch, 'signed-elevate.exe')
+    writeFileSync(signed, 'signpath-signed-elevate')
+
+    const result = await replaceCachedElevateHelpers({
+      signedPath: signed,
+      cacheDir,
+      env: {},
+      probe: probeUnavailable
+    })
+
+    // The scan rewrote only the stale copy; the one that would be packed is untouched.
+    expect(result.replaced).toEqual([join(cacheDir, ...stale.split('/'))])
+    expect(readFileSync(join(cacheDir, ...packed.split('/')), 'utf8')).toBe('unsigned-elevate')
+
+    // So the run must not look clean.
+    const { annotations, exitCode } = summarizeSwap(result)
+    expect(exitCode).toBe(0)
+    expect(annotations).toHaveLength(1)
+    expect(annotations[0].level).toBe('warning')
+    expect(annotations[0].message).toContain('Could not ask app-builder-lib')
+  })
+
+  it('fails when the probe names a copy that could not be replaced', () => {
+    const summary = summarizeSwap({
+      replaced: ['C:/cache/nsis-3.0.4.1/nsis-3.0.4.1-1mx3n/elevate.exe'],
+      cacheDir: 'C:/cache',
+      toolsetPath: 'C:/cache/nsis@2.0.0/nsis-bundle-4.0-k4d9x/elevate.exe',
+      toolsetError: null,
+      toolsetReplaced: false
+    })
+
+    expect(summary.exitCode).toBe(1)
+    expect(summary.annotations[0].level).toBe('error')
+    expect(summary.annotations[0].message).toContain('will pack')
+  })
+
+  it('fails when nothing at all was replaced', () => {
+    const summary = summarizeSwap({
+      replaced: [],
+      cacheDir: 'C:/cache',
+      toolsetPath: null,
+      toolsetError: 'app-builder-lib not loadable',
+      toolsetReplaced: false
+    })
+
+    expect(summary.exitCode).toBe(1)
+    expect(summary.annotations[0].level).toBe('error')
+    expect(summary.annotations[0].message).toContain('No cached elevate.exe found')
+  })
+})
+
+describe('a cached elevate.exe miss is not silent', () => {
+  // ELECTRON_BUILDER_NSIS_DIR short-circuits app-builder-lib's own resolution before
+  // any download, so the probe fails offline instead of fetching the NSIS bundle.
+  function runScript(cacheDir, nsisDir, signedPath) {
+    return spawnSync(process.execPath, [scriptPath, signedPath], {
+      cwd: projectRoot,
+      encoding: 'utf8',
+      env: {
+        ...process.env,
+        ELECTRON_BUILDER_CACHE: cacheDir,
+        ELECTRON_BUILDER_NSIS_DIR: nsisDir
+      }
+    })
+  }
+
+  it('exits non-zero with an ::error:: annotation when no cached copy is found', () => {
+    const cacheDir = makeCache()
+    const emptyNsisDir = join(scratch, 'empty-nsis')
+    mkdirSync(emptyNsisDir, { recursive: true })
+    const signed = join(scratch, 'signed-elevate.exe')
+    writeFileSync(signed, 'signpath-signed-elevate')
+
+    const result = runScript(cacheDir, emptyNsisDir, signed)
+
+    expect(result.status).toBe(1)
+    expect(result.stdout).toContain('::error::No cached elevate.exe found')
+  })
+
+  it('warns on the scan-only path so green never means the probe was skipped', () => {
+    const cacheDir = makeCache('nsis-3.0.4.1/nsis-3.0.4.1-1mx3n/elevate.exe')
+    const emptyNsisDir = join(scratch, 'empty-nsis')
+    mkdirSync(emptyNsisDir, { recursive: true })
+    const signed = join(scratch, 'signed-elevate.exe')
+    writeFileSync(signed, 'signpath-signed-elevate')
+
+    const result = runScript(cacheDir, emptyNsisDir, signed)
+
+    expect(result.status).toBe(0)
+    expect(result.stdout).not.toContain('::error::')
+    expect(result.stdout).toContain('::warning::Could not ask app-builder-lib')
+    expect(
+      readFileSync(join(cacheDir, 'nsis-3.0.4.1', 'nsis-3.0.4.1-1mx3n', 'elevate.exe'), 'utf8')
+    ).toBe('signpath-signed-elevate')
+  })
+
+  // The healthy release-job path: app-builder-lib answers, so the copy it will pack is the
+  // one that gets replaced and there is nothing to warn about.
+  it('exits clean when the probe resolves the copy the rebuild will pack', () => {
+    const cacheDir = makeCache()
+    const nsisDir = join(scratch, 'nsis-bundle')
+    mkdirSync(nsisDir, { recursive: true })
+    writeFileSync(join(nsisDir, 'elevate.exe'), 'unsigned-elevate')
+    const signed = join(scratch, 'signed-elevate.exe')
+    writeFileSync(signed, 'signpath-signed-elevate')
+
+    const result = runScript(cacheDir, nsisDir, signed)
+
+    expect(result.status).toBe(0)
+    expect(result.stdout).not.toContain('::error::')
+    expect(result.stdout).not.toContain('::warning::')
+    expect(result.stdout).toContain('the copy app-builder-lib will pack')
+    expect(readFileSync(join(nsisDir, 'elevate.exe'), 'utf8')).toBe('signpath-signed-elevate')
+  })
+})
+
+describe('release-cut.yml swaps the cached elevate.exe through the resolver', () => {
+  function swapStep() {
+    const workflow = parse(
+      readFileSync(join(projectRoot, '.github/workflows/release-cut.yml'), 'utf8')
+    )
+    const step = workflow.jobs.build.steps.find(
+      (candidate) => candidate.name === 'Replace cached elevate.exe with the signed copy'
+    )
+    expect(step).toBeDefined()
+    return step
+  }
+
+  it('delegates the cache lookup to the script instead of an inline path', () => {
+    const step = swapStep()
+    expect(step.run).toContain('node config/scripts/replace-cached-nsis-elevate.mjs $signed')
+    // The hardcoded miss that shipped v1.4.193/v1.4.194 unsigned.
+    expect(step.run).not.toContain('electron-builder\\Cache\\nsis')
+    expect(step.run).not.toContain('-ErrorAction SilentlyContinue')
+  })
+
+  it('fails the step when the swap reports a miss', () => {
+    const step = swapStep()
+    // Matched as an executed statement: downgrading this to a Write-Host restores
+    // the silent fail-open that let the unsigned helper ship.
+    expect(step.run).toMatch(/if \(\$LASTEXITCODE -ne 0\) \{/)
+    expect(step.run).toMatch(/^\s*throw \$message\s*$/m)
+    expect(step.run).toContain('GITHUB_STEP_SUMMARY')
+  })
+
+  // Why kept: windows-signing-rehearsal.yml shares the electron-builder-win-<hash>
+  // cache key, so dropping this guard would let a test certificate reach a release cache.
+  it('still refuses to stage anything but a SignPath-signed helper', () => {
+    const step = swapStep()
+    expect(step.run).toContain("$signature.Status -ne 'Valid'")
+    expect(step.run).toContain("$subject -notlike '*CN=SignPath Foundation*'")
+  })
+
+  // The inner-signing chain stays fail-open: a loud red step, not an unbuildable release.
+  it('keeps the step unable to fail the release job', () => {
+    expect(swapStep()['continue-on-error']).toBe(true)
+  })
+})
diff --git a/config/scripts/repo-icon-source-href-benchmark.mjs b/config/scripts/repo-icon-source-href-benchmark.mjs
new file mode 100644
index 00000000000..76c42d261b4
--- /dev/null
+++ b/config/scripts/repo-icon-source-href-benchmark.mjs
@@ -0,0 +1,55 @@
+import assert from 'node:assert/strict'
+import { performance } from 'node:perf_hooks'
+import { extractIconHref } from '../../src/main/repo-icon-source-href.ts'
+
+// Original production expressions, preserved for the before/after measurement.
+const html =
+  /<link\b(?=[^>]*\brel=["'](?:icon|shortcut icon)["'])(?=[^>]*\bhref=["']([^"'?]+))[^>]*>/i
+const object =
+  /(?=[^}]*\brel\s*:\s*["'](?:icon|shortcut icon)["'])(?=[^}]*\bhref\s*:\s*["']([^"'?]+))[^}]*/i
+const original = (source) => source.match(html)?.[1] ?? source.match(object)?.[1] ?? null
+
+function measurePair(source) {
+  original(source)
+  extractIconHref(source)
+  const beforeSamples = []
+  const afterSamples = []
+  for (let run = 0; run < 5; run++) {
+    const measurements = [
+      [original, beforeSamples],
+      [extractIconHref, afterSamples]
+    ]
+    if (run % 2 === 1) {
+      measurements.reverse()
+    }
+    for (const [fn, samples] of measurements) {
+      const started = performance.now()
+      fn(source)
+      samples.push(performance.now() - started)
+    }
+  }
+  return {
+    beforeMs: beforeSamples.sort((a, b) => a - b)[2],
+    afterMs: afterSamples.sort((a, b) => a - b)[2]
+  }
+}
+
+const results = []
+for (const size of [8192, 16384, 32768]) {
+  for (const shape of ['no icon', 'rel without href', 'unterminated link starts']) {
+    const source =
+      shape === 'unterminated link starts'
+        ? '<link '.repeat(Math.floor(size / 6))
+        : 'a'.repeat(size) + (shape === 'rel without href' ? ' rel:"icon"' : '')
+    assert.equal(extractIconHref(source), original(source))
+    const { beforeMs, afterMs } = measurePair(source)
+    results.push({
+      shape,
+      bytes: Buffer.byteLength(source),
+      beforeMs,
+      afterMs,
+      speedup: beforeMs / afterMs
+    })
+  }
+}
+console.log(JSON.stringify({ node: process.version, platform: process.platform, results }, null, 2))
diff --git a/config/scripts/run-electron-vite-dev.mjs b/config/scripts/run-electron-vite-dev.mjs
index dfb0a0aceb7..c520083cb6a 100644
--- a/config/scripts/run-electron-vite-dev.mjs
+++ b/config/scripts/run-electron-vite-dev.mjs
@@ -616,7 +616,7 @@ if (!isHelpOrVersion && process.env.ORCA_DEV_INSTANCE_LABEL) {
 // Why: automation launches this app while someone is working; announce that the
 // window will come up without taking the foreground so the mode is visible in logs.
 if (!isHelpOrVersion && process.env.ORCA_BACKGROUND_LAUNCH === '1') {
-  console.error('[orca-dev] Background launch: window shows without stealing focus')
+  console.error('[orca-dev] Background launch: window stays off screen; automate through CDP')
 }
 let forwardedExtras = []
 if (!userPassedPort && !isHelpOrVersion) {
diff --git a/config/scripts/run-headless-linux-pairing-docker.mjs b/config/scripts/run-headless-linux-pairing-docker.mjs
index 635c66348cc..799b8d73ab1 100644
--- a/config/scripts/run-headless-linux-pairing-docker.mjs
+++ b/config/scripts/run-headless-linux-pairing-docker.mjs
@@ -70,7 +70,7 @@ function valueAfter(flag) {
 
 function buildImage(image) {
   console.log(`Building ${image.name} fixture...`)
-  docker([
+  const buildArgs = [
     'build',
     '--build-arg',
     `BASE_IMAGE=${image.base}`,
@@ -81,7 +81,16 @@ function buildImage(image) {
     '-t',
     image.tag,
     '.'
-  ])
+  ]
+  // Why: apt fetches from archive.ubuntu.com stall or fail mid-sync; a second build usually lands on a healthy index.
+  try {
+    docker(buildArgs)
+  } catch (error) {
+    console.error(
+      `${error instanceof Error ? error.message : String(error)}\nRetrying docker build once...`
+    )
+    docker(buildArgs)
+  }
 }
 
 function extractAppImage(image) {
diff --git a/config/scripts/run-headless-serve-shutdown-docker.mjs b/config/scripts/run-headless-serve-shutdown-docker.mjs
index 184713c41a0..d8dcdd345ad 100755
--- a/config/scripts/run-headless-serve-shutdown-docker.mjs
+++ b/config/scripts/run-headless-serve-shutdown-docker.mjs
@@ -43,7 +43,7 @@ const artifactVolume = `orca-headless-serve-shutdown-${suffix}`
 const sha256 = createHash('sha256').update(readFileSync(appImage)).digest('hex')
 
 try {
-  docker([
+  const buildArgs = [
     'build',
     '--platform',
     platform,
@@ -52,7 +52,15 @@ try {
     '-t',
     image,
     shutdownDockerDirectory
-  ])
+  ]
+  // Why: apt fetches from archive.ubuntu.com stall or fail mid-sync; a second build usually lands on a healthy index.
+  const firstBuild = docker(buildArgs, { allowFailure: true })
+  if (firstBuild.status !== 0) {
+    process.stderr.write(
+      `${firstBuild.stdout}${firstBuild.stderr}\ndocker build failed with status ${firstBuild.status}; retrying once...\n`
+    )
+    docker(buildArgs)
+  }
   docker(['volume', 'create', artifactVolume])
   runDesktopStartupOracle({ image, appImage, platform })
   docker([
diff --git a/config/scripts/run-linux-cli-launch-contract-docker.mjs b/config/scripts/run-linux-cli-launch-contract-docker.mjs
index 901e0877e85..bd414947026 100755
--- a/config/scripts/run-linux-cli-launch-contract-docker.mjs
+++ b/config/scripts/run-linux-cli-launch-contract-docker.mjs
@@ -173,20 +173,26 @@ function runCase(caseName) {
 
 function buildImage() {
   console.log(`Building ${tag}…`)
-  docker(
-    [
-      'build',
-      ...dockerPlatformArgs,
-      '--build-arg',
-      `BASE_IMAGE=${base}`,
-      '-f',
-      'config/docker/cli-launch-contract/Dockerfile',
-      '-t',
-      tag,
-      'config/docker/cli-launch-contract'
-    ],
-    { timeoutMs: BUILD_TIMEOUT_MS }
-  )
+  const buildArgs = [
+    'build',
+    ...dockerPlatformArgs,
+    '--build-arg',
+    `BASE_IMAGE=${base}`,
+    '-f',
+    'config/docker/cli-launch-contract/Dockerfile',
+    '-t',
+    tag,
+    'config/docker/cli-launch-contract'
+  ]
+  // Why: apt fetches from archive.ubuntu.com stall or fail mid-sync; a second build usually lands on a healthy index.
+  try {
+    docker(buildArgs, { timeoutMs: BUILD_TIMEOUT_MS })
+  } catch (error) {
+    console.error(
+      `${error instanceof Error ? error.message : String(error)}\nRetrying docker build once…`
+    )
+    docker(buildArgs, { timeoutMs: BUILD_TIMEOUT_MS })
+  }
 }
 
 // Extract unprivileged so chrome-sandbox is not root-owned setuid.
diff --git a/config/scripts/run-terminal-ibus-hangul-e2e.mjs b/config/scripts/run-terminal-ibus-hangul-e2e.mjs
index 8bfdb0e2ae6..669f7744b39 100644
--- a/config/scripts/run-terminal-ibus-hangul-e2e.mjs
+++ b/config/scripts/run-terminal-ibus-hangul-e2e.mjs
@@ -199,7 +199,8 @@ async function runInsideSession(evidenceDir) {
         'test:e2e:headful',
         '--workers=1',
         '--',
-        'tests/e2e/terminal-ibus-hangul-native.spec.ts'
+        'tests/e2e/terminal-ibus-hangul-native.spec.ts',
+        'tests/e2e/terminal-hangul-terminating-digit-native.spec.ts'
       ],
       {
         cwd: projectDir,
diff --git a/config/scripts/session-write-hot-path-benchmark.mjs b/config/scripts/session-write-hot-path-benchmark.mjs
new file mode 100644
index 00000000000..361e7eb7098
--- /dev/null
+++ b/config/scripts/session-write-hot-path-benchmark.mjs
@@ -0,0 +1,221 @@
+#!/usr/bin/env node
+// Benchmarks two CPU costs `setLocalWorkspaceSession` pays on every session write — the write
+// that fires on something as ordinary as clicking between two terminal split panes.
+//
+//   1. capTerminalScrollbackSessionBuffer — UTF-8 budget scan per retained scrollback buffer
+//   2. remapPaneKeys                      — pane-key map rebuild that steady state throws away
+//
+// The snapshot disk rewrite on the same path is measured separately (#18764).
+//
+// Each scenario runs the production export against a baseline that reproduces the pre-change
+// shape, so the reported speedup cannot drift away from what production actually does.
+import { spawnSync } from 'node:child_process'
+import { performance } from 'node:perf_hooks'
+import fs from 'node:fs'
+import nodeModule from 'node:module'
+import path from 'node:path'
+import process from 'node:process'
+import { fileURLToPath } from 'node:url'
+
+if (!process.execArgv.includes('--experimental-transform-types')) {
+  const result = spawnSync(
+    process.execPath,
+    ['--experimental-transform-types', '--no-warnings', import.meta.filename],
+    { stdio: 'inherit' }
+  )
+  process.exit(result.status ?? 1)
+}
+
+// The app's TS sources import siblings without an extension; Node's ESM resolver needs it.
+nodeModule.registerHooks({
+  resolve(specifier, context, nextResolve) {
+    if (specifier.startsWith('.') && !/\.[cm]?[jt]s$/.test(specifier) && context.parentURL) {
+      const candidate = new URL(`${specifier}.ts`, context.parentURL)
+      if (fs.existsSync(fileURLToPath(candidate))) {
+        return { url: candidate.href, shortCircuit: true }
+      }
+    }
+    return nextResolve(specifier, context)
+  }
+})
+
+const ROOT = path.resolve(import.meta.dirname, '../..')
+const ROUNDS = Number(process.env.ORCA_SESSION_WRITE_BENCH_ROUNDS ?? '9')
+const LEAVES = Number(process.env.ORCA_SESSION_WRITE_BENCH_LEAVES ?? '8')
+const PANE_KEYS = Number(process.env.ORCA_SESSION_WRITE_BENCH_PANE_KEYS ?? '2000')
+
+for (const [name, value] of [
+  ['ORCA_SESSION_WRITE_BENCH_ROUNDS', ROUNDS],
+  ['ORCA_SESSION_WRITE_BENCH_LEAVES', LEAVES],
+  ['ORCA_SESSION_WRITE_BENCH_PANE_KEYS', PANE_KEYS]
+]) {
+  if (!Number.isSafeInteger(value) || value <= 0) {
+    throw new Error(`${name} must be a positive integer, got ${value}`)
+  }
+}
+
+const { capTerminalScrollbackSessionBuffer } = await import(
+  path.join(ROOT, 'src/shared/workspace-session-terminal-buffers.ts')
+)
+const { TERMINAL_SCROLLBACK_SESSION_BUFFER_BYTE_LIMIT } = await import(
+  path.join(ROOT, 'src/shared/terminal-scrollback-limits.ts')
+)
+const { remapAcknowledgedAgentPaneKeys } = await import(
+  path.join(ROOT, 'src/main/persistence/restoring-sessions/pane-key-remapping.ts')
+)
+const { clampUtf8TextTail, measureUtf8ByteLength } = await import(
+  path.join(ROOT, 'src/shared/utf8-byte-limits.ts')
+)
+const { isTerminalLeafId, makePaneKey, parsePaneKey } = await import(
+  path.join(ROOT, 'src/shared/stable-pane-id.ts')
+)
+
+function median(samples) {
+  const sorted = [...samples].sort((left, right) => left - right)
+  return sorted[Math.floor(sorted.length / 2)]
+}
+
+function timeRounds(run) {
+  const samples = []
+  run()
+  for (let round = 0; round < ROUNDS; round += 1) {
+    const start = performance.now()
+    run()
+    samples.push(performance.now() - start)
+  }
+  return median(samples)
+}
+
+function report(label, baselineMs, currentMs, extra = '') {
+  const speedup = baselineMs / currentMs
+  console.log(
+    `${label}\n  before ${baselineMs.toFixed(3)} ms → after ${currentMs.toFixed(3)} ms  (${speedup.toFixed(1)}x)${extra}`
+  )
+  return speedup
+}
+
+// ---------------------------------------------------------------- scenario 1
+
+// Verbatim pre-change capTerminalScrollbackSessionBuffer; measureUtf8ByteLength itself is unchanged.
+function baselineCapScrollbackBuffer(buffer) {
+  if (
+    buffer.length <= TERMINAL_SCROLLBACK_SESSION_BUFFER_BYTE_LIMIT &&
+    !measureUtf8ByteLength(buffer, {
+      stopAfterBytes: TERMINAL_SCROLLBACK_SESSION_BUFFER_BYTE_LIMIT
+    }).exceededLimit
+  ) {
+    return buffer
+  }
+  return clampUtf8TextTail(buffer, TERMINAL_SCROLLBACK_SESSION_BUFFER_BYTE_LIMIT).text
+}
+
+// A terminal that has been running a while sits at the cap, which is the case that scanned in full.
+const scrollbackLine = `${''}build output line with a path /Users/dev/project/src/index.ts and a status ok\n`
+let atCapBuffer = ''
+while (atCapBuffer.length < TERMINAL_SCROLLBACK_SESSION_BUFFER_BYTE_LIMIT) {
+  atCapBuffer += scrollbackLine
+}
+atCapBuffer = atCapBuffer.slice(0, TERMINAL_SCROLLBACK_SESSION_BUFFER_BYTE_LIMIT)
+
+if (capTerminalScrollbackSessionBuffer(atCapBuffer) !== baselineCapScrollbackBuffer(atCapBuffer)) {
+  throw new Error('scrollback cap disagreed with the baseline implementation')
+}
+
+// The session write runs the prune twice, once per retained leaf.
+const CAP_CALLS_PER_WRITE = LEAVES * 2
+const capBaselineMs = timeRounds(() => {
+  for (let call = 0; call < CAP_CALLS_PER_WRITE; call += 1) {
+    baselineCapScrollbackBuffer(atCapBuffer)
+  }
+})
+const capCurrentMs = timeRounds(() => {
+  for (let call = 0; call < CAP_CALLS_PER_WRITE; call += 1) {
+    capTerminalScrollbackSessionBuffer(atCapBuffer)
+  }
+})
+
+console.log(
+  `Session-write hot path — ${LEAVES} retained scrollback leaves, ${PANE_KEYS} accumulated pane keys\n`
+)
+report(
+  `1. scrollback UTF-8 budget scan (${CAP_CALLS_PER_WRITE} calls/write @ ${(atCapBuffer.length / 1024).toFixed(0)} KB)`,
+  capBaselineMs,
+  capCurrentMs
+)
+
+// ---------------------------------------------------------------- scenario 2
+
+const paneKeys = {}
+const leafIdByInputLeafIdByTabId = new Map()
+for (let index = 0; index < PANE_KEYS; index += 1) {
+  const tabId = `tab-${index % 64}`
+  const leafId = `${(index % 64).toString(16).padStart(8, '0')}-0000-4000-8000-${index.toString(16).padStart(12, '0')}`
+  paneKeys[makePaneKey(tabId, leafId)] = index
+  let leaves = leafIdByInputLeafIdByTabId.get(tabId)
+  if (!leaves) {
+    leaves = new Map()
+    leafIdByInputLeafIdByTabId.set(tabId, leaves)
+  }
+  // Steady state: a stable UUID leaf maps to itself.
+  leaves.set(leafId, leafId)
+}
+
+// Verbatim pre-change remapPaneKeys: parses every key, then rebuilds the object regardless.
+function baselineRemapPaneKeys(values, remap) {
+  if (!values || Object.keys(values).length === 0) {
+    return { values, changed: false }
+  }
+  let changed = false
+  const next = {}
+  const setValue = (paneKey, value) => {
+    const existing = next[paneKey]
+    next[paneKey] = existing === undefined ? value : Math.max(existing, value)
+  }
+  for (const [paneKey, value] of Object.entries(values)) {
+    if (parsePaneKey(paneKey)) {
+      setValue(paneKey, value)
+      continue
+    }
+    const delimiter = paneKey.indexOf(':')
+    if (delimiter <= 0 || delimiter === paneKey.length - 1) {
+      setValue(paneKey, value)
+      continue
+    }
+    const tabId = paneKey.slice(0, delimiter)
+    const remappedLeafId = remap.get(tabId)?.get(paneKey.slice(delimiter + 1))
+    if (!remappedLeafId || !isTerminalLeafId(remappedLeafId)) {
+      setValue(paneKey, value)
+      continue
+    }
+    try {
+      setValue(makePaneKey(tabId, remappedLeafId), value)
+      changed = true
+    } catch {
+      setValue(paneKey, value)
+    }
+  }
+  return { values: next, changed }
+}
+
+// The write remaps three of these maps: acknowledgements, activity cutoffs, manual unread.
+const REMAP_CALLS_PER_WRITE = 3
+const remapBaselineMs = timeRounds(() => {
+  for (let call = 0; call < REMAP_CALLS_PER_WRITE; call += 1) {
+    baselineRemapPaneKeys(paneKeys, leafIdByInputLeafIdByTabId)
+  }
+})
+const remapCurrentMs = timeRounds(() => {
+  for (let call = 0; call < REMAP_CALLS_PER_WRITE; call += 1) {
+    remapAcknowledgedAgentPaneKeys(paneKeys, leafIdByInputLeafIdByTabId)
+  }
+})
+const remapResult = remapAcknowledgedAgentPaneKeys(paneKeys, leafIdByInputLeafIdByTabId)
+if (remapResult.changed || remapResult.acknowledgements !== paneKeys) {
+  throw new Error('steady-state remap should return the input map untouched')
+}
+report(
+  `2. pane-key remap (${REMAP_CALLS_PER_WRITE} maps/write @ ${PANE_KEYS} keys)`,
+  remapBaselineMs,
+  remapCurrentMs,
+  '  — and 3 discarded objects/write become 0'
+)
diff --git a/config/scripts/skill-description-length.test.mjs b/config/scripts/skill-description-length.test.mjs
new file mode 100644
index 00000000000..e7a9db79541
--- /dev/null
+++ b/config/scripts/skill-description-length.test.mjs
@@ -0,0 +1,39 @@
+import { readdirSync, readFileSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { parse } from 'yaml'
+
+const skillsDir = resolve(import.meta.dirname, '../../skills')
+// Why: the Agent Skills spec caps `description` at 1024 chars and conforming installers
+// reject the whole skill (#17935); the frontmatter is what the installer parses, so check it.
+const MAX_DESCRIPTION_LENGTH = 1024
+
+function readDescription(skillName) {
+  const skillMarkdown = readFileSync(join(skillsDir, skillName, 'SKILL.md'), 'utf8')
+  const frontmatter = /^---\r?\n([\s\S]*?)\r?\n---\r?\n/u.exec(skillMarkdown)?.[1]
+
+  expect(frontmatter, `${skillName}: missing frontmatter`).toBeDefined()
+
+  return parse(frontmatter ?? '').description
+}
+
+describe('bundled skill descriptions', () => {
+  const skillNames = readdirSync(skillsDir, { withFileTypes: true })
+    .filter((entry) => entry.isDirectory())
+    .map((entry) => entry.name)
+
+  it('discovers the bundled skills', () => {
+    expect(skillNames).toContain('orchestration')
+  })
+
+  it.each(skillNames)('%s keeps description within the Agent Skills spec limit', (name) => {
+    const description = readDescription(name)
+
+    expect(typeof description, `${name}: description must be a string`).toBe('string')
+    expect(description.trim().length, `${name}: description is empty`).toBeGreaterThan(0)
+    expect(
+      description.length,
+      `${name}: description is ${description.length} chars`
+    ).toBeLessThanOrEqual(MAX_DESCRIPTION_LENGTH)
+  })
+})
diff --git a/config/scripts/sort-comparator-performance-plugin.test.mjs b/config/scripts/sort-comparator-performance-plugin.test.mjs
new file mode 100644
index 00000000000..a9319c6238d
--- /dev/null
+++ b/config/scripts/sort-comparator-performance-plugin.test.mjs
@@ -0,0 +1,45 @@
+import path from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { runOxlintPluginOnSource } from './oxlint-plugin-test-runner.mjs'
+
+function lint(source) {
+  return runOxlintPluginOnSource({
+    pluginName: 'sort-comparator-performance',
+    pluginPath: path.resolve('config/oxlint-plugins/sort-comparator-performance.mjs'),
+    rules: { 'sort-comparator-performance/no-repeated-collator': 'warn' },
+    source
+  })
+}
+
+describe('sort comparator performance', () => {
+  it('reports repeated collation setup in inline sort and toSorted callbacks', () => {
+    const findings = lint(`
+      rows.sort((a, b) => a.name.localeCompare(b.name, locale, { sensitivity: 'base' }))
+      rows.toSorted(function (a, b) { return new Intl.Collator('sv').compare(a, b) })
+      rows['sort']((a, b) => Intl.Collator('en', { numeric: true }).compare(a, b))
+      rows.sort((a, b) => a['localeCompare'](b, undefined, options))
+    `)
+    expect(findings).toHaveLength(4)
+    expect(
+      findings.every(
+        (finding) => finding.code === 'sort-comparator-performance(no-repeated-collator)'
+      )
+    ).toBe(true)
+  })
+
+  it('allows one collator per sort, bare comparisons, and unrelated callbacks', () => {
+    expect(
+      lint(`
+      const collator = new Intl.Collator(locale, options)
+      rows.sort((a, b) => collator.compare(a.name, b.name) || a.id.localeCompare(b.id))
+      rows.toSorted(collator.compare)
+      const equal = a.localeCompare(b, undefined, { sensitivity: 'accent' }) === 0
+      rows.map(a => new Intl.Collator(a.locale))
+      rows.sort((a, b) => {
+        function deferred() { return new Intl.Collator(locale) }
+        return a - b
+      })
+    `)
+    ).toEqual([])
+  })
+})
diff --git a/config/scripts/source-string-blanking-benchmark.mjs b/config/scripts/source-string-blanking-benchmark.mjs
new file mode 100644
index 00000000000..de677b9baa9
--- /dev/null
+++ b/config/scripts/source-string-blanking-benchmark.mjs
@@ -0,0 +1,79 @@
+import assert from 'node:assert/strict'
+import { execFileSync } from 'node:child_process'
+import { stripTypeScriptTypes } from 'node:module'
+import { performance } from 'node:perf_hooks'
+import { blankStringContents as after } from '../../src/shared/source-scan/source-tree-scan.ts'
+
+const ref = process.argv[2]
+if (!ref) {
+  throw new Error('Usage: node config/scripts/source-string-blanking-benchmark.mjs <baseline-ref>')
+}
+const source = execFileSync('git', ['show', `${ref}:src/shared/source-scan/source-tree-scan.ts`], {
+  encoding: 'utf8'
+})
+const { blankStringContents: before } = await import(
+  `data:text/javascript;base64,${Buffer.from(stripTypeScriptTypes(source)).toString('base64')}`
+)
+const tokens = [
+  'a',
+  '/',
+  '*',
+  ' ',
+  '\n',
+  '\r',
+  '\t',
+  '\u00a0',
+  '\u2028',
+  '"',
+  "'",
+  '`',
+  '${',
+  '}',
+  '{',
+  '\\',
+  '(',
+  ')',
+  '[',
+  ']',
+  '=',
+  '+',
+  '-',
+  ';'
+]
+let seed = 173
+for (let sample = 0; sample < 3000; sample++) {
+  let input = ''
+  for (let token = 0; token < 40; token++) {
+    seed = (Math.imul(seed, 1664525) + 1013904223) >>> 0
+    input += tokens[seed % tokens.length]
+  }
+  assert.equal(after(input), before(input), JSON.stringify(input))
+  assert.equal(after(input, true), before(input, true), JSON.stringify(input))
+}
+function measure(fn, input) {
+  const samples = []
+  for (let run = 0; run < 3; run++) {
+    const start = performance.now()
+    fn(input)
+    samples.push(performance.now() - start)
+  }
+  return samples.sort((a, b) => a - b)[1]
+}
+const results = []
+for (const lines of [100, 1000, 5000, 10000]) {
+  const input = 'const x = value / 2;\n'.repeat(lines)
+  assert.equal(after(input), before(input))
+  results.push({
+    lines,
+    bytes: Buffer.byteLength(input),
+    beforeMs: measure(before, input),
+    afterMs: measure(after, input)
+  })
+}
+console.log(
+  JSON.stringify(
+    { node: process.version, platform: process.platform, differentialCases: 3000, results },
+    null,
+    2
+  )
+)
diff --git a/config/scripts/terminal-ime-engagement-receipt.mjs b/config/scripts/terminal-ime-engagement-receipt.mjs
index 9ad5255d235..8f0732908c1 100644
--- a/config/scripts/terminal-ime-engagement-receipt.mjs
+++ b/config/scripts/terminal-ime-engagement-receipt.mjs
@@ -13,7 +13,8 @@ export const IME_ENGAGEMENT_RECEIPT_ENV = 'ORCA_E2E_IME_ENGAGEMENT_RECEIPT'
 /** The tests that must each leave a receipt. Pinned so deleting one cannot quietly shrink the lane. */
 export const EXPECTED_NATIVE_IME_TESTS = [
   'forwards the issue exact-byte sequence without loss or duplication',
-  'forwards the issue sentence stress sequence without leaked ASCII'
+  'forwards the issue sentence stress sequence without leaked ASCII',
+  'a digit typed right after a Hangul syllable reaches the pty'
 ]
 
 function parseReceipts(text) {
diff --git a/config/scripts/terminal-ime-engagement-receipt.test.mjs b/config/scripts/terminal-ime-engagement-receipt.test.mjs
index 04161339a0f..613abc2ffae 100644
--- a/config/scripts/terminal-ime-engagement-receipt.test.mjs
+++ b/config/scripts/terminal-ime-engagement-receipt.test.mjs
@@ -4,7 +4,7 @@ import {
   verifyImeEngagementReceipts
 } from './terminal-ime-engagement-receipt.mjs'
 
-const [firstTest, secondTest] = EXPECTED_NATIVE_IME_TESTS
+const [firstTest, secondTest, thirdTest] = EXPECTED_NATIVE_IME_TESTS
 
 function receipt(test, overrides = {}) {
   return JSON.stringify({
@@ -18,9 +18,11 @@ function receipt(test, overrides = {}) {
 
 describe('verifyImeEngagementReceipts', () => {
   it('accepts a run where every expected test observed real composition', () => {
-    expect(verifyImeEngagementReceipts(`${receipt(firstTest)}\n${receipt(secondTest)}\n`)).toEqual(
-      []
-    )
+    expect(
+      verifyImeEngagementReceipts(
+        `${receipt(firstTest)}\n${receipt(secondTest)}\n${receipt(thirdTest)}\n`
+      )
+    ).toEqual([])
   })
 
   // The failure this whole mechanism exists for: Playwright reports a skipped test as a pass, so
@@ -35,13 +37,20 @@ describe('verifyImeEngagementReceipts', () => {
 
   it('rejects a partial run where only one test reached the engine', () => {
     expect(verifyImeEngagementReceipts(`${receipt(firstTest)}\n`)).toEqual([
-      `no engagement receipt for "${secondTest}" — it was skipped, filtered out, or renamed`
+      `no engagement receipt for "${secondTest}" — it was skipped, filtered out, or renamed`,
+      `no engagement receipt for "${thirdTest}" — it was skipped, filtered out, or renamed`
+    ])
+  })
+
+  it('requires the digit receipt even when both original native tests passed', () => {
+    expect(verifyImeEngagementReceipts(`${receipt(firstTest)}\n${receipt(secondTest)}\n`)).toEqual([
+      `no engagement receipt for "${thirdTest}" — it was skipped, filtered out, or renamed`
     ])
   })
 
   it('rejects a run that typed keys but never opened a composition', () => {
     const problems = verifyImeEngagementReceipts(
-      `${receipt(firstTest, { compositionStart: 0 })}\n${receipt(secondTest)}\n`
+      `${receipt(firstTest, { compositionStart: 0 })}\n${receipt(secondTest)}\n${receipt(thirdTest)}\n`
     )
     expect(problems).toEqual([
       `"${firstTest}" recorded no compositionstart — the IME never engaged`
@@ -50,7 +59,7 @@ describe('verifyImeEngagementReceipts', () => {
 
   it('rejects a composition that produced no Hangul, which a latin passthrough would satisfy', () => {
     const problems = verifyImeEngagementReceipts(
-      `${receipt(firstTest, { hangulComposition: 0 })}\n${receipt(secondTest)}\n`
+      `${receipt(firstTest, { hangulComposition: 0 })}\n${receipt(secondTest)}\n${receipt(thirdTest)}\n`
     )
     expect(problems).toEqual([
       `"${firstTest}" recorded no Hangul composition data — the engine produced no syllables`
@@ -59,7 +68,7 @@ describe('verifyImeEngagementReceipts', () => {
 
   it('rejects a renamed test rather than counting it toward coverage', () => {
     const problems = verifyImeEngagementReceipts(
-      `${receipt(firstTest)}\n${receipt(secondTest)}\n${receipt('some new scenario')}\n`
+      `${receipt(firstTest)}\n${receipt(secondTest)}\n${receipt(thirdTest)}\n${receipt('some new scenario')}\n`
     )
     expect(problems).toEqual([
       'unexpected engagement receipt for "some new scenario" — update EXPECTED_NATIVE_IME_TESTS'
@@ -68,7 +77,7 @@ describe('verifyImeEngagementReceipts', () => {
 
   it('reports a truncated receipt rather than parsing around it', () => {
     const problems = verifyImeEngagementReceipts(
-      `${receipt(firstTest)}\n{"test":"trunc\n${receipt(secondTest)}\n`
+      `${receipt(firstTest)}\n{"test":"trunc\n${receipt(secondTest)}\n${receipt(thirdTest)}\n`
     )
     expect(problems).toEqual(['malformed receipt line: {"test":"trunc'])
   })
diff --git a/config/scripts/terminal-partial-escape-tail-benchmark.mjs b/config/scripts/terminal-partial-escape-tail-benchmark.mjs
new file mode 100644
index 00000000000..0337daa4e9d
--- /dev/null
+++ b/config/scripts/terminal-partial-escape-tail-benchmark.mjs
@@ -0,0 +1,88 @@
+#!/usr/bin/env node
+// Times the partial-escape-tail fold that runs once per PTY chunk for every terminal against a
+// baseline with the pre-change shape (unconditional concat + per-code-unit walk). Equivalence is
+// proven over a corpus first, so the reported speedup cannot come from the gate changing the answer.
+import { performance } from 'node:perf_hooks'
+import {
+  advancePartialEscapeTail,
+  extractPartialEscapeTail,
+  MAX_PARTIAL_ESCAPE_TAIL_LENGTH
+} from '../../src/shared/terminal-partial-escape-tail.ts'
+
+const CHUNK_BYTES = 16 * 1024
+const CHUNKS = 640
+const ROUNDS = 7
+
+function baselineAdvance(pendingTail, chunk) {
+  const tail = extractPartialEscapeTail(pendingTail + chunk)
+  return tail.length > MAX_PARTIAL_ESCAPE_TAIL_LENGTH ? '' : tail
+}
+
+const chunkOf = (line) => line.repeat(Math.ceil(CHUNK_BYTES / line.length)).slice(0, CHUNK_BYTES)
+const escFreeChunk = chunkOf('[build] compiled src/renderer/src/components/thing.tsx in 12ms\n')
+const colouredChunk = chunkOf(
+  '\x1b[32m[build]\x1b[0m compiled src/renderer/src/components/thing.tsx in 12ms\n'
+)
+
+// Every state the scanner can be left in, plus the boundaries the gate must not swallow.
+const PIECES = [
+  '',
+  'plain output\n',
+  '\x1b[32mgreen\x1b[0m',
+  '\x1b[3',
+  '\x1b]0;title\x07',
+  '\x1b]0;partial',
+  '\x1bP dcs payload',
+  '\x1b',
+  '\x18',
+  '\x1a',
+  '\x1b]8;;https://example.com\x1b\\',
+  '\x1b]8;;https://example.com\x1b',
+  '\x1b(B',
+  '\x1b(',
+  '\x1b[1;2;3',
+  escFreeChunk
+]
+let checked = 0
+for (const pending of PIECES.map((piece) => extractPartialEscapeTail(piece))) {
+  for (const chunk of PIECES) {
+    const expected = baselineAdvance(pending, chunk)
+    const actual = advancePartialEscapeTail(pending, chunk)
+    if (expected !== actual) {
+      throw new Error(
+        `gate changed the tracked tail: ${JSON.stringify({ pending, chunk, expected, actual })}`
+      )
+    }
+    checked += 1
+  }
+}
+
+function medianMs(advance, chunk) {
+  // First sample is the warm-up and is discarded.
+  const samples = Array.from({ length: ROUNDS + 1 }, () => {
+    const start = performance.now()
+    let tail = ''
+    for (let index = 0; index < CHUNKS; index += 1) {
+      tail = advance(tail, chunk)
+    }
+    return performance.now() - start
+  })
+  return samples.slice(1).sort((left, right) => left - right)[Math.floor(ROUNDS / 2)]
+}
+
+const megabytes = ((CHUNK_BYTES * CHUNKS) / 1024 / 1024).toFixed(1)
+console.log(
+  `Partial-escape-tail fold: ${CHUNKS} x ${CHUNK_BYTES / 1024} KB chunks (${megabytes} MB), ${checked} equivalence cases verified\n`
+)
+console.log('| stream shape | before | after | |')
+console.log('| --- | --- | --- | --- |')
+for (const [label, chunk] of [
+  ['ESC-free (build logs, `cat`, piped output)', escFreeChunk],
+  ['SGR-coloured output (gate does not apply)', colouredChunk]
+]) {
+  const before = medianMs(baselineAdvance, chunk)
+  const after = medianMs(advancePartialEscapeTail, chunk)
+  console.log(
+    `| ${label} | ${before.toFixed(2)} ms | ${after.toFixed(2)} ms | ${(before / after).toFixed(1)}x |`
+  )
+}
diff --git a/config/scripts/verify-dev-channel-packaging.test.mjs b/config/scripts/verify-dev-channel-packaging.test.mjs
index 63e1c7d5b0c..8e5a00f48e1 100644
--- a/config/scripts/verify-dev-channel-packaging.test.mjs
+++ b/config/scripts/verify-dev-channel-packaging.test.mjs
@@ -53,6 +53,19 @@ describe('electron-builder dev-channel identity', () => {
     expect(config.win.verifyUpdateCodeSignature).toBe(false)
   })
 
+  // Why on every channel: the hook is the only handle electron-builder gives on
+  // the NSIS uninstaller, and it signs nothing — it relays the file to and from
+  // the CI SignPath request. Carrying it must not drag a publisherName onto a
+  // dev build, which is the failure the split above exists to prevent.
+  it('carries the uninstaller sign hook without changing publisherName semantics', () => {
+    for (const env of [{}, WIN_ADHOC_ENV]) {
+      const config = loadConfigWithEnv(env)
+      expect(typeof config.win.signtoolOptions.sign).toBe('function')
+    }
+    expect(loadConfigWithEnv({}).win.signtoolOptions.publisherName).toBe('SignPath Foundation')
+    expect(loadConfigWithEnv(WIN_ADHOC_ENV).win.signtoolOptions.publisherName).toBeUndefined()
+  })
+
   it.each([
     ['hourly', { ORCA_WIN_HOURLY: '1' }, 'orca-hourly'],
     ['daily', { ORCA_WIN_DAILY: '1' }, 'orca-daily'],
diff --git a/config/scripts/verify-localization-catalog.mjs b/config/scripts/verify-localization-catalog.mjs
index 002a84360f6..a73e9d5e3cc 100644
--- a/config/scripts/verify-localization-catalog.mjs
+++ b/config/scripts/verify-localization-catalog.mjs
@@ -11,7 +11,12 @@ import { repairTranslatedValue } from './locale-translation-policy.mjs'
 
 const SOURCE_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mts', '.cts'])
 const SKIP_PATH_PARTS = new Set(['.git', 'dist', 'node_modules', 'out', '__snapshots__', 'assets'])
-const LOCALIZATION_FUNCTION_NAMES = new Set(['t', 'translate', 'translateMain', 'translateSearchKeyword'])
+const LOCALIZATION_FUNCTION_NAMES = new Set([
+  't',
+  'translate',
+  'translateMain',
+  'translateSearchKeyword'
+])
 const PLACEHOLDER_RE = /\{\{[^}]+\}\}/g
 const LOCALES_RELATIVE_DIR = path.join('src', 'renderer', 'src', 'i18n', 'locales')
 export const LOCALIZATION_SOURCE_ROOTS = [
diff --git a/config/scripts/windows-process-tree-gyp-rebuild.mjs b/config/scripts/windows-process-tree-gyp-rebuild.mjs
index c815407d6d0..20d91e55497 100644
--- a/config/scripts/windows-process-tree-gyp-rebuild.mjs
+++ b/config/scripts/windows-process-tree-gyp-rebuild.mjs
@@ -9,7 +9,8 @@
  * hop escapes the store and configure fails with "node_addon_api.gyp not
  * found" (run 32999886072).
  */
-import { copyFileSync, mkdirSync, realpathSync } from 'node:fs'
+import { execFileSync } from 'node:child_process'
+import { copyFileSync, existsSync, mkdirSync, readFileSync, realpathSync, rmSync } from 'node:fs'
 import { createRequire } from 'node:module'
 import { dirname, join, resolve } from 'node:path'
 
@@ -22,6 +23,16 @@ export const WINDOWS_PROCESS_TREE_PACKAGE_DIR = join(
   'windows-process-tree'
 )
 
+export const WINDOWS_PROCESS_TREE_PATCH_PATH = join(
+  ROOT,
+  'config',
+  'patches',
+  '@vscode__windows-process-tree@0.8.0.patch'
+)
+
+/** Only the patched reader defines this; the upstream one walks the PEB. */
+const COMMAND_LINE_PATCH_MARKER = 'kProcessCommandLineInformation'
+
 export const WINDOWS_PROCESS_TREE_NODE_ADDON_API_HEADERS = [
   'napi.h',
   'napi-inl.h',
@@ -39,6 +50,119 @@ export function nodeGypRebuildInvocation(arch, packageDir = WINDOWS_PROCESS_TREE
   }
 }
 
+/** The binary the addon actually loads. */
+export function windowsProcessTreeAddonPath(packageDir = WINDOWS_PROCESS_TREE_PACKAGE_DIR) {
+  return join(packageDir, 'build', 'Release', 'windows_process_tree.node')
+}
+
+/** The import whose absence tells the patched binary from the published prebuilt. */
+const FLAGGED_IMPORT = 'ReadProcessMemory'
+
+/**
+ * Does this compiled addon still carry the flagged primitive?
+ *
+ * The patched reader never calls `ReadProcessMemory`, so the symbol is absent
+ * from its import table; the upstream build imports it. That makes this a
+ * property of the binary rather than of the source next to it, which matters
+ * because the published tarball ships a *loadable* prebuilt built from
+ * unpatched source: it is node-addon-api, so it satisfies a bare `require()`
+ * under both Node and Electron, and a skipped rebuild would use it.
+ *
+ * Tri-state, not a predicate: a binary that is not there has not been cleared,
+ * and a boolean makes "absent" indistinguishable from "verified clean" at every
+ * call site. Takes the binary path so the relay's staged addon -- which sits
+ * beside the bundle, with no package around it -- gets the same check.
+ *
+ * @param {string} addonPath
+ * @returns {'clean' | 'unpatched' | 'missing'}
+ */
+export function inspectWindowsProcessTreeAddon(addonPath) {
+  if (!existsSync(addonPath)) {
+    return 'missing'
+  }
+  return readFileSync(addonPath).includes(FLAGGED_IMPORT) ? 'unpatched' : 'clean'
+}
+
+/**
+ * Refuse to compile or load the upstream command-line reader.
+ *
+ * Unpatched, it opens every process with `PROCESS_VM_READ` and walks the PEB to
+ * recover the command line -- the primitive MDE scores as credential dumping,
+ * and the reason this package is patched at all. pnpm has been seen
+ * materializing this CRLF package with its patch missing, so repair the source
+ * from the patch file, and drop any binary that predates the repair.
+ */
+export function ensureWindowsProcessTreeCommandLinePatch(
+  packageDir = WINDOWS_PROCESS_TREE_PACKAGE_DIR
+) {
+  const source = join(packageDir, 'src', 'process_commandline.cc')
+  if (!existsSync(source)) {
+    throw new Error(
+      `${source} is missing, so the command-line patch cannot be verified. Run pnpm install.`
+    )
+  }
+  let repaired = false
+
+  if (!readFileSync(source, 'utf8').includes(COMMAND_LINE_PATCH_MARKER)) {
+    try {
+      execFileSync(
+        'git',
+        [
+          // Why force the line-ending mode: the patch is stored LF (a contract
+          // test forbids CR bytes in it), but upstream ships this source CRLF,
+          // so its pre-image lines and the file's differ by a CR. Under
+          // `core.autocrlf=false` -- Git's own built-in default, and what
+          // "checkout as-is" selects in the Git for Windows installer -- git
+          // compares them literally, the hunk does not match, and the repair
+          // throws. `input` normalizes line endings for that comparison and
+          // nothing else, so a hunk whose real content drifted is still
+          // rejected. Measured: without it, apply exits 1 at autocrlf=false and
+          // 0 at true/input; with it, 0 for CRLF and LF sources under all three.
+          '-c',
+          'core.autocrlf=input',
+          'apply',
+          '--include=src/process_commandline.cc',
+          WINDOWS_PROCESS_TREE_PATCH_PATH
+        ],
+        {
+          cwd: realpathSync(packageDir),
+          stdio: 'pipe',
+          // Why blind git to the repo: run inside a work tree, `git apply`
+          // prefixes patch paths with the cwd-relative prefix, silently skips
+          // everything that does not match -- and still exits 0. The package
+          // dir is always under the project root, so without this the repair
+          // reports success and changes nothing.
+          env: { ...process.env, GIT_DIR: join(packageDir, '.orca-no-such-git-dir') }
+        }
+      )
+    } catch (error) {
+      throw new Error(
+        'src/process_commandline.cc still reads the PEB, and repairing it from ' +
+          `${WINDOWS_PROCESS_TREE_PATCH_PATH} failed: ${error?.message ?? error}. Run pnpm install.`
+      )
+    }
+    if (!readFileSync(source, 'utf8').includes(COMMAND_LINE_PATCH_MARKER)) {
+      throw new Error(
+        'src/process_commandline.cc still reads the PEB after repair, so the patch did not ' +
+          'apply. Run pnpm install.'
+      )
+    }
+    repaired = true
+  }
+
+  // A binary from before the repair -- or the tarball's own prebuilt -- would
+  // otherwise survive a skipped rebuild and load the flagged reader anyway.
+  // Deleting it can fail EPERM against a loaded (memory-mapped) addon, which
+  // `force: true` does not cover -- it only swallows ENOENT. That throw is the
+  // caller's to classify as a Windows file lock, so it must not be swallowed.
+  if (inspectWindowsProcessTreeAddon(windowsProcessTreeAddonPath(packageDir)) === 'unpatched') {
+    rmSync(windowsProcessTreeAddonPath(packageDir), { force: true })
+    repaired = true
+  }
+
+  return repaired
+}
+
 // Patched binding.gyp includes deps/node-addon-api; the tarball does not ship those headers.
 export function stageWindowsProcessTreeNodeAddonApiHeaders(
   packageDir = WINDOWS_PROCESS_TREE_PACKAGE_DIR
diff --git a/config/scripts/windows-process-tree-gyp-rebuild.test.mjs b/config/scripts/windows-process-tree-gyp-rebuild.test.mjs
index f4820e9430a..f2939b71179 100644
--- a/config/scripts/windows-process-tree-gyp-rebuild.test.mjs
+++ b/config/scripts/windows-process-tree-gyp-rebuild.test.mjs
@@ -10,8 +10,9 @@ import {
 } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join, resolve } from 'node:path'
-import { describe, expect, it } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
 import {
+  inspectWindowsProcessTreeAddon,
   nodeGypRebuildInvocation,
   stageWindowsProcessTreeNodeAddonApiHeaders,
   WINDOWS_PROCESS_TREE_NODE_ADDON_API_HEADERS,
@@ -59,3 +60,40 @@ describe('windows-process-tree node-gyp rebuild', () => {
     }
   })
 })
+
+describe('inspecting a compiled windows-process-tree addon', () => {
+  let dir
+
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), 'orca-windows-process-tree-addon-'))
+  })
+  afterEach(() => {
+    rmSync(dir, { recursive: true, force: true })
+  })
+
+  it('reports a binary that still imports ReadProcessMemory as unpatched', () => {
+    const addonPath = join(dir, 'windows_process_tree.node')
+    writeFileSync(addonPath, Buffer.from('MZ\0\0KERNEL32.dll\0ReadProcessMemory\0', 'binary'))
+    expect(inspectWindowsProcessTreeAddon(addonPath)).toBe('unpatched')
+  })
+
+  it('reports a binary without the import as clean', () => {
+    const addonPath = join(dir, 'windows_process_tree.node')
+    writeFileSync(addonPath, Buffer.from('MZ\0\0ntdll.dll\0NtQueryInformationProcess\0', 'binary'))
+    expect(inspectWindowsProcessTreeAddon(addonPath)).toBe('clean')
+  })
+
+  // The whole point of the tri-state: absence is not evidence of safety, and a
+  // boolean made "there is no binary" indistinguishable from "checked, clean".
+  it('reports an absent binary as missing rather than clean', () => {
+    expect(inspectWindowsProcessTreeAddon(join(dir, 'windows_process_tree.node'))).toBe('missing')
+  })
+
+  it('inspects whatever path it is handed, including a relay-staged addon', () => {
+    // The relay loads `./windows-process-tree.node` beside its bundle, which is
+    // nowhere near a node_modules package directory.
+    const staged = join(dir, 'windows-process-tree.node')
+    writeFileSync(staged, Buffer.from('MZ\0\0ReadProcessMemory\0', 'binary'))
+    expect(inspectWindowsProcessTreeAddon(staged)).toBe('unpatched')
+  })
+})
diff --git a/config/scripts/windows-signing-workflow-contract.test.mjs b/config/scripts/windows-signing-workflow-contract.test.mjs
index 37edc2196d4..c321db8cfd2 100644
--- a/config/scripts/windows-signing-workflow-contract.test.mjs
+++ b/config/scripts/windows-signing-workflow-contract.test.mjs
@@ -1,4 +1,5 @@
 import { readFileSync } from 'node:fs'
+import { createRequire } from 'node:module'
 import { join, resolve } from 'node:path'
 import { describe, expect, it } from 'vitest'
 import { parse } from 'yaml'
@@ -212,6 +213,7 @@ describe('Windows signing workflow contract', () => {
       'Notify Slack that inner-binary signing is waiting for approval',
       'Download signed inner binaries from SignPath',
       'Restore signed inner binaries into unpacked app',
+      'Restore signed uninstaller for the installer rebuild',
       'Replace cached elevate.exe with the signed copy',
       'Rebuild NSIS installer from signed unpacked app'
     ]
@@ -222,3 +224,235 @@ describe('Windows signing workflow contract', () => {
     }
   })
 })
+
+// Why these exist: the NSIS uninstaller is generated inside electron-builder's
+// uninstaller pass and deleted immediately after being embedded, so the only way
+// CI can sign it is the export/import relay through win.signtoolOptions.sign.
+// Every link is asserted here the way Orca.exe and conpty_console_list.node are.
+describe('Windows NSIS uninstaller signing', () => {
+  const releaseSteps = () => readWorkflow('.github/workflows/release-cut.yml').jobs.build.steps
+  const stepNamed = (steps, name) => steps.find((step) => step.name === name)
+
+  const EXPORT_ENV = 'ORCA_WIN_UNINSTALLER_EXPORT_PATH'
+  const SIGNED_ENV = 'ORCA_WIN_UNINSTALLER_SIGNED_PATH'
+
+  it('exports the uninstaller from the first Windows build', () => {
+    const build = stepNamed(releaseSteps(), 'Build Windows release artifacts')
+
+    expect(build.env[EXPORT_ENV]).toContain('uninstaller-signing')
+    expect(build.env[EXPORT_ENV]).toContain('orca-uninstaller.exe')
+  })
+
+  // Why this is a test and not a comment: `files` in the electron-builder config
+  // is all-negation, so app-builder packs whatever is left in the checkout root.
+  // These steps retry, and a retried attempt would pack an unsigned .exe into
+  // app.asar — the very defect this chain removes. Every relay path must live
+  // outside the checkout.
+  it('keeps every relay path out of the packed checkout', () => {
+    const relayEnvValues = [
+      ...releaseSteps(),
+      ...readWorkflow('.github/workflows/windows-signing-rehearsal.yml').jobs.rehearse.steps
+    ].flatMap((step) => [step.env?.[EXPORT_ENV], step.env?.[SIGNED_ENV]].filter(Boolean))
+
+    expect(relayEnvValues.length).toBe(4)
+    for (const value of relayEnvValues) {
+      expect(value).toContain('runner.temp')
+      expect(value).not.toContain('github.workspace')
+    }
+
+    const relayScripts = [
+      ...releaseSteps(),
+      ...readWorkflow('.github/workflows/windows-signing-rehearsal.yml').jobs.rehearse.steps
+    ]
+      .map((step) => step.run ?? '')
+      .filter((run) => run.includes('uninstaller-signing'))
+
+    expect(relayScripts.length).toBeGreaterThan(0)
+    for (const run of relayScripts) {
+      // Why count occurrences rather than assert `toContain` once: a step
+      // carrying two relay paths could root the first in RUNNER_TEMP and leave
+      // the second bare-relative — which resolves against the checkout, and is
+      // exactly the shape of the defect this test exists to catch.
+      const mentions = run.match(/uninstaller-signing/g) ?? []
+      const rooted = run.match(/Join-Path \$env:RUNNER_TEMP 'uninstaller-signing/g) ?? []
+
+      expect(rooted.length, run).toBe(mentions.length)
+      expect(run).not.toContain('$env:GITHUB_WORKSPACE')
+    }
+  })
+
+  it('stages the uninstaller into the same request as the inner binaries', () => {
+    const stage = stepNamed(releaseSteps(), 'Stage unsigned inner PE files for signing')
+
+    expect(stage.run).toContain('uninstaller-signing\\unsigned\\orca-uninstaller.exe')
+    expect(stage.run).toContain('uninstaller\\orca-uninstaller.exe')
+    // No third SignPath request: exactly two submissions, as budgeted for the
+    // 1h + 4h approval waits inside the 360-minute job cap.
+    const submissions = releaseSteps().filter(
+      (step) => step.uses === 'signpath/github-action-submit-signing-request@v2'
+    )
+    expect(submissions).toHaveLength(2)
+  })
+
+  // A staged-but-unreturned uninstaller must not fail the inner chain, or a
+  // SignPath artifact-configuration gap would cost the inner-binary signatures.
+  it('keeps the uninstaller out of the inner-binary copy-back list', () => {
+    const stage = stepNamed(releaseSteps(), 'Stage unsigned inner PE files for signing')
+    const restoreInner = stepNamed(
+      releaseSteps(),
+      'Restore signed inner binaries into unpacked app'
+    )
+
+    expect(stage.run).not.toMatch(/\$list\.Add\(['"]uninstaller/)
+    expect(restoreInner.run).not.toContain('orca-uninstaller.exe')
+  })
+
+  // This step's outcome gates the upload of every inner binary, so a filesystem
+  // error while staging the uninstaller must not escape — otherwise one
+  // uninstaller-specific failure costs every inner-binary signature, which is
+  // strictly worse than the behaviour before this chain existed.
+  it('cannot let an uninstaller staging failure cost the inner-binary signatures', () => {
+    const stage = stepNamed(releaseSteps(), 'Stage unsigned inner PE files for signing')
+    const uninstallerBlock = stage.run.slice(stage.run.indexOf('$exportedUninstaller'))
+
+    expect(stage.run).toMatch(/try \{[\s\S]*\$exportedUninstaller[\s\S]*\} catch \{/)
+    expect(uninstallerBlock).toContain('::warning::Could not stage the NSIS uninstaller')
+    expect(uninstallerBlock).not.toContain('throw')
+    // Explicit, so the catch does not silently depend on GitHub's
+    // $ErrorActionPreference='Stop' default for `shell: pwsh`.
+    expect(uninstallerBlock).toContain('New-Item -ItemType Directory -Force -Path (Split-Path')
+    expect(uninstallerBlock).toMatch(/New-Item[^\r\n]*-ErrorAction Stop/)
+    expect(uninstallerBlock).toMatch(/Copy-Item[^\r\n]*-ErrorAction Stop/)
+    // The upload it gates still keys off this step, so the catch is load-bearing.
+    expect(stepNamed(releaseSteps(), 'Upload unsigned inner binaries for SignPath').if).toContain(
+      "steps.stage-inner.outcome == 'success'"
+    )
+  })
+
+  it('re-injects the signed uninstaller into the rebuilt installer', () => {
+    const steps = releaseSteps()
+    const restore = stepNamed(steps, 'Restore signed uninstaller for the installer rebuild')
+    const rebuild = stepNamed(steps, 'Rebuild NSIS installer from signed unpacked app')
+    const names = steps.map((step) => step.name)
+
+    expect(restore.if).toContain('github.run_attempt == 1')
+    expect(restore.if).toContain("steps.restore-signed-inner.outcome == 'success'")
+    expect(restore.run).toContain('orca-uninstaller.exe')
+    expect(names.indexOf(restore.name)).toBeLessThan(names.indexOf(rebuild.name))
+    expect(rebuild.env[SIGNED_ENV]).toContain('uninstaller-signing')
+    // The rebuild must not depend on the uninstaller leg: a missing signed
+    // uninstaller ships today's installer, it does not skip the rebuild.
+    expect(rebuild.if).not.toContain('restore-signed-uninstaller')
+  })
+
+  // NSIS hides the uninstaller in a compressed data section the bundled 7za
+  // cannot read, so the gate proves it from the sign hook's digest receipt
+  // instead of extracting it — and only when the relay actually ran.
+  it('reports the embedded uninstaller in the inner-binary evidence gate', () => {
+    const gate = stepNamed(releaseSteps(), 'Verify Windows inner binary signatures')
+
+    expect(gate.env.UNINSTALLER_SIGNING_COMPLETED).toBe(
+      "${{ steps.restore-signed-uninstaller.outcome == 'success' }}"
+    )
+    expect(gate.run).toContain('.embedded-sha256')
+    expect(gate.run).toContain("$env:UNINSTALLER_SIGNING_COMPLETED -eq 'true'")
+    expect(gate.run).toContain('not signed by SignPath Foundation: Uninstall Orca.exe')
+    // The uninstaller must not join the 7z payload loop, which cannot see it.
+    expect(gate.run).not.toContain("$targets += 'Uninstall Orca.exe'")
+  })
+
+  it('rehearses the uninstaller leg end to end', () => {
+    const steps = readWorkflow('.github/workflows/windows-signing-rehearsal.yml').jobs.rehearse
+      .steps
+    const names = steps.map((step) => step.name)
+    const pack = stepNamed(steps, 'Package Windows app and export the NSIS uninstaller')
+    const rebuild = stepNamed(steps, 'Build NSIS installer from signed unpacked app')
+    const verify = stepNamed(steps, 'Verify signatures end to end')
+
+    // --dir never produces an uninstaller, so the rehearsal has to build the
+    // installer the way release-cut's first Windows pass does.
+    expect(pack.run).toContain('--win --publish never')
+    expect(pack.run).not.toContain('--dir')
+    expect(pack.env[EXPORT_ENV]).toContain('orca-uninstaller.exe')
+    expect(names).toContain('Restore signed uninstaller for the installer rebuild')
+    expect(rebuild.env[SIGNED_ENV]).toContain('orca-uninstaller.exe')
+    expect(verify.run).toContain('.embedded-sha256')
+    // The receipt only proves the import leg ran. The rehearsal is where the
+    // shipped uninstaller itself gets checked — the release job cannot install
+    // onto the runner it publishes from.
+    expect(verify.run).toContain('shipped: Uninstall Orca.exe')
+    expect(verify.run).toContain('-tnsis')
+    expect(verify.run).toContain("-ArgumentList '/S'")
+  })
+
+  // This workflow is the merge gate, so it must not be able to fail on its own
+  // artefact: 7-Zip's NSIS handler is unreliable enough that its output has to
+  // be corroborated before a signature verdict is drawn from it.
+  it('never lets an unreliable extract fail the rehearsal', () => {
+    const steps = readWorkflow('.github/workflows/windows-signing-rehearsal.yml').jobs.rehearse
+      .steps
+    const verify = stepNamed(steps, 'Verify signatures end to end')
+
+    // The 7-Zip route is only trusted when it reproduces the relayed bytes;
+    // otherwise it falls through to the install route rather than failing.
+    expect(verify.run).toContain(
+      'Write-Host "7-Zip\'s NSIS output did not match the relayed digest; falling back to a silent install."'
+    )
+    expect(verify.run).toMatch(/\$installedUninstaller = \$null\r?\n\s*\}/)
+
+    // The comparison that is not tautological: a file NSIS wrote out, against
+    // the digest the sign hook recorded.
+    expect(verify.run).toContain('$shippedDigest -ne $expectedDigest')
+    expect(verify.run).toContain('the uninstaller the installer ships is not the relayed one')
+
+    // An installer that prompts must not hang to the 360-minute job cap, and
+    // the app it launches must not outlive the step holding install-dir handles.
+    expect(verify.run).toContain('-PassThru')
+    expect(verify.run).toContain('$installerProcess.WaitForExit(300000)')
+    expect(verify.run).toContain('the silent install did not exit within 5 minutes')
+    expect(verify.run).toMatch(/for \(\$attempt = 0; \$attempt -lt 20; \$attempt\+\+\)/)
+    expect(verify.run).toContain("Get-Process -Name 'orca-terminal-daemon'")
+  })
+
+  // resources\elevate.exe is downgraded to advisory because app-builder-lib's
+  // CopyElevateHelper clobbers it on every nsis pack — a pre-existing defect
+  // that predates the uninstaller relay and is being tracked separately. The
+  // escape hatch it needed is the kind that quietly grows until the gate
+  // asserts nothing, so pin it to exactly that one file.
+  it('confines the advisory escape hatch to elevate.exe', () => {
+    const steps = readWorkflow('.github/workflows/windows-signing-rehearsal.yml').jobs.rehearse
+      .steps
+    const verify = stepNamed(steps, 'Verify signatures end to end')
+    const advisoryCalls = verify.run
+      .split('\n')
+      .filter((line) => line.includes('-Advisory') && line.includes('Test-Signature'))
+
+    expect(advisoryCalls).toHaveLength(1)
+    expect(advisoryCalls[0]).toContain('installed: $relative')
+    expect(verify.run).toContain("if ($relative -eq 'resources\\elevate.exe')")
+
+    // Both uninstaller verdicts stay fatal — the whole point of the gate.
+    for (const call of ['relayed: orca-uninstaller.exe', 'shipped: Uninstall Orca.exe']) {
+      const line = verify.run
+        .split('\n')
+        .find((it) => it.includes(`Test-Signature`) && it.includes(call))
+      expect(line, call).toBeDefined()
+      expect(line, call).not.toContain('-Advisory')
+    }
+
+    // An advisory must still reach the evidence artifact, or downgrading it
+    // becomes indistinguishable from deleting the check.
+    expect(verify.run).toContain('ADVISORY (known pre-existing')
+    expect(verify.run).toContain('$script:advisories.Add($problem)')
+  })
+
+  it('wires the electron-builder sign hook that the relay depends on', () => {
+    const require = createRequire(import.meta.url)
+    const configPath = resolve(projectDir, 'config/electron-builder.config.cjs')
+    delete require.cache[require.resolve(configPath)]
+    const config = require(configPath)
+
+    expect(typeof config.win.signtoolOptions.sign).toBe('function')
+    delete require.cache[require.resolve(configPath)]
+  })
+})
diff --git a/config/scripts/windows-uninstaller-signing.cjs b/config/scripts/windows-uninstaller-signing.cjs
new file mode 100644
index 00000000000..c3243b4581a
--- /dev/null
+++ b/config/scripts/windows-uninstaller-signing.cjs
@@ -0,0 +1,111 @@
+// Why this exists: the NSIS uninstaller is the one Orca binary SignPath never
+// saw. app-builder-lib builds it in a separate makensis pass, hands it to the
+// packager's sign hook, embeds it in the installer, then deletes it
+// (NsisTarget.computeScriptAndSignUninstaller → packager.signIf(uninstallerPath),
+// then `unlink(defines.UNINSTALLER_OUT_FILE)`). That hook is the only moment the
+// file exists on disk, so it is the only place a post-hoc signer can reach it.
+//
+// Orca does not sign during electron-builder — SignPath signs afterwards, behind
+// a human approval — so instead of signing, this hook relays: build 1 exports the
+// unsigned uninstaller so CI can put it in the existing inner-binaries SignPath
+// request, and the rebuild-from-signed-tree pass swaps the signed bytes back in
+// before makensis embeds them.
+//
+// Trap for whoever adds a real certificate to the Windows build: a custom sign
+// hook *replaces* signtool rather than running alongside it — windowsSignToolManager
+// does `const executor = customSign || (config => this.doSign(config))`. Inert
+// today (no CSC_LINK/WIN_CSC_LINK anywhere in the Windows workflows), but setting
+// one would silently sign nothing until this hook learns to delegate.
+//
+// Trap for whoever adds a second NSIS target or arch: app-builder-lib names the
+// intermediate uninstaller per target *and* arch, while the relay is a single
+// pair of env vars. Two targets would race — last write wins on export, every
+// installer would embed the same uninstaller, and the receipt could not tell.
+// Release is x64-only `--win` with `win.target` unset (so `["nsis"]`) today.
+const { createHash } = require('node:crypto')
+const { copyFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } = require('node:fs')
+const { basename, dirname } = require('node:path')
+
+// app-builder-lib names the intermediate uninstaller `<installer basename>__uninstaller.exe`.
+const UNINSTALLER_BASENAME_SUFFIX = '__uninstaller.exe'
+
+// Why a receipt: NSIS embeds the uninstaller in its own compressed data section,
+// not in the app 7z payload the evidence gate extracts, so the shipped installer
+// cannot be inspected for it with the bundled 7za. The receipt records the digest
+// of the exact bytes handed to makensis, which the gate compares against the
+// SignPath-returned file — proving what was embedded without extracting it.
+const EMBEDDED_RECEIPT_SUFFIX = '.embedded-sha256'
+
+const isNsisUninstallerArtifact = (filePath) =>
+  typeof filePath === 'string' && basename(filePath).endsWith(UNINSTALLER_BASENAME_SUFFIX)
+
+/**
+ * Pure relay. Returns a short verdict string for logging and tests.
+ * Never throws: a relay failure must ship today's installer, not break the build.
+ */
+function relayNsisUninstaller({
+  filePath,
+  exportPath,
+  signedPath,
+  fs = { copyFileSync, existsSync, mkdirSync, readFileSync, writeFileSync }
+}) {
+  if (!isNsisUninstallerArtifact(filePath)) {
+    return 'not-uninstaller'
+  }
+  try {
+    // Import wins over export: the rebuild pass must embed the signed bytes even
+    // though it also regenerates an unsigned uninstaller of its own.
+    if (signedPath) {
+      if (!fs.existsSync(signedPath)) {
+        return 'signed-missing'
+      }
+      fs.copyFileSync(signedPath, filePath)
+      const digest = createHash('sha256').update(fs.readFileSync(filePath)).digest('hex')
+      fs.writeFileSync(`${signedPath}${EMBEDDED_RECEIPT_SUFFIX}`, digest)
+      return 'imported'
+    }
+    if (exportPath) {
+      fs.mkdirSync(dirname(exportPath), { recursive: true })
+      fs.copyFileSync(filePath, exportPath)
+      return 'exported'
+    }
+    return 'idle'
+  } catch (error) {
+    return `failed: ${error.message}`
+  }
+}
+
+const VERDICT_MESSAGES = {
+  imported: (paths) => `embedded the SignPath-signed uninstaller from ${paths.signedPath}`,
+  exported: (paths) => `exported the unsigned uninstaller to ${paths.exportPath}`,
+  'signed-missing': (paths) =>
+    `no signed uninstaller at ${paths.signedPath}; embedding the unsigned one (fail-open)`
+}
+
+/**
+ * electron-builder `win.signtoolOptions.sign` hook. Called for every Windows
+ * executable, twice per file (once per signing hash), so it must be cheap for
+ * non-uninstaller paths and idempotent for the uninstaller.
+ */
+function signWindowsUninstallerViaSignPath(configuration) {
+  const paths = {
+    filePath: configuration?.path,
+    exportPath: process.env.ORCA_WIN_UNINSTALLER_EXPORT_PATH || undefined,
+    signedPath: process.env.ORCA_WIN_UNINSTALLER_SIGNED_PATH || undefined
+  }
+  const verdict = relayNsisUninstaller(paths)
+  const message = VERDICT_MESSAGES[verdict]
+  if (message) {
+    console.log(`[win-uninstaller-signing] ${message(paths)}`)
+  } else if (verdict.startsWith('failed')) {
+    console.warn(`[win-uninstaller-signing] ${verdict}; embedding the unsigned uninstaller.`)
+  }
+}
+
+module.exports = {
+  EMBEDDED_RECEIPT_SUFFIX,
+  UNINSTALLER_BASENAME_SUFFIX,
+  isNsisUninstallerArtifact,
+  relayNsisUninstaller,
+  signWindowsUninstallerViaSignPath
+}
diff --git a/config/scripts/windows-uninstaller-signing.test.mjs b/config/scripts/windows-uninstaller-signing.test.mjs
new file mode 100644
index 00000000000..57ebfbdf786
--- /dev/null
+++ b/config/scripts/windows-uninstaller-signing.test.mjs
@@ -0,0 +1,235 @@
+import { createHash } from 'node:crypto'
+import { existsSync, mkdtempSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { createRequire } from 'node:module'
+import { join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+
+const require = createRequire(import.meta.url)
+const {
+  EMBEDDED_RECEIPT_SUFFIX,
+  isNsisUninstallerArtifact,
+  relayNsisUninstaller,
+  signWindowsUninstallerViaSignPath
+} = require('./windows-uninstaller-signing.cjs')
+
+const makeDir = () => mkdtempSync(join(tmpdir(), 'orca-uninstaller-signing-'))
+
+describe('isNsisUninstallerArtifact', () => {
+  // The name app-builder-lib's NsisTarget.computeScriptAndSignUninstaller gives
+  // the intermediate uninstaller; the hook keys off nothing else.
+  it('matches only electron-builder intermediate uninstallers', () => {
+    expect(isNsisUninstallerArtifact('C:\\dist\\orca-windows-setup.__uninstaller.exe')).toBe(true)
+    expect(isNsisUninstallerArtifact('/dist/orca-windows-setup.__uninstaller.exe')).toBe(true)
+    expect(isNsisUninstallerArtifact('C:\\dist\\win-unpacked\\Orca.exe')).toBe(false)
+    expect(isNsisUninstallerArtifact('C:\\dist\\orca-windows-setup.exe')).toBe(false)
+    expect(isNsisUninstallerArtifact(undefined)).toBe(false)
+  })
+})
+
+describe('relayNsisUninstaller', () => {
+  const writeUninstaller = (dir, contents) => {
+    const filePath = join(dir, 'orca-windows-setup.__uninstaller.exe')
+    writeFileSync(filePath, contents)
+    return filePath
+  }
+
+  it('ignores every file that is not the uninstaller', () => {
+    const dir = makeDir()
+    const filePath = join(dir, 'Orca.exe')
+    writeFileSync(filePath, 'app')
+    expect(relayNsisUninstaller({ filePath, exportPath: join(dir, 'out', 'x.exe') })).toBe(
+      'not-uninstaller'
+    )
+  })
+
+  it('exports the unsigned uninstaller, creating the destination directory', () => {
+    const dir = makeDir()
+    const filePath = writeUninstaller(dir, 'unsigned-uninstaller')
+    const exportPath = join(dir, 'uninstaller-signing', 'unsigned', 'orca-uninstaller.exe')
+
+    expect(relayNsisUninstaller({ filePath, exportPath })).toBe('exported')
+    expect(readFileSync(exportPath, 'utf8')).toBe('unsigned-uninstaller')
+  })
+
+  it('overwrites the freshly built uninstaller with the signed bytes', () => {
+    const dir = makeDir()
+    const filePath = writeUninstaller(dir, 'rebuild-unsigned')
+    const signedPath = join(dir, 'signed', 'orca-uninstaller.exe')
+    mkdirSync(join(dir, 'signed'))
+    writeFileSync(signedPath, 'signpath-signed')
+
+    expect(relayNsisUninstaller({ filePath, signedPath })).toBe('imported')
+    expect(readFileSync(filePath, 'utf8')).toBe('signpath-signed')
+  })
+
+  // The receipt is the evidence gate's only handle on the embedded uninstaller:
+  // NSIS hides it in a compressed section the bundled 7za cannot read.
+  it('records the digest of the bytes it handed makensis', () => {
+    const dir = makeDir()
+    const filePath = writeUninstaller(dir, 'rebuild-unsigned')
+    const signedPath = join(dir, 'signed', 'orca-uninstaller.exe')
+    mkdirSync(join(dir, 'signed'))
+    writeFileSync(signedPath, 'signpath-signed')
+
+    relayNsisUninstaller({ filePath, signedPath })
+
+    const expected = createHash('sha256').update('signpath-signed').digest('hex')
+    expect(readFileSync(`${signedPath}${EMBEDDED_RECEIPT_SUFFIX}`, 'utf8')).toBe(expected)
+  })
+
+  it('leaves no receipt when the signed uninstaller never came back', () => {
+    const dir = makeDir()
+    const filePath = writeUninstaller(dir, 'unsigned-uninstaller')
+    const signedPath = join(dir, 'absent', 'orca-uninstaller.exe')
+
+    relayNsisUninstaller({ filePath, signedPath })
+
+    expect(existsSync(`${signedPath}${EMBEDDED_RECEIPT_SUFFIX}`)).toBe(false)
+  })
+
+  // Import wins so the rebuild pass embeds the signed bytes even though it also
+  // regenerates an unsigned uninstaller of its own.
+  it('prefers importing over exporting when both are configured', () => {
+    const dir = makeDir()
+    const filePath = writeUninstaller(dir, 'rebuild-unsigned')
+    const signedPath = join(dir, 'signed', 'orca-uninstaller.exe')
+    mkdirSync(join(dir, 'signed'))
+    writeFileSync(signedPath, 'signpath-signed')
+
+    expect(
+      relayNsisUninstaller({ filePath, signedPath, exportPath: join(dir, 'out', 'x.exe') })
+    ).toBe('imported')
+    expect(readFileSync(filePath, 'utf8')).toBe('signpath-signed')
+  })
+
+  // Fail-open: a missing or unwritable relay must leave the build with today's
+  // unsigned uninstaller, never throw.
+  it('leaves the unsigned uninstaller in place when no signed copy came back', () => {
+    const dir = makeDir()
+    const filePath = writeUninstaller(dir, 'unsigned-uninstaller')
+
+    expect(
+      relayNsisUninstaller({ filePath, signedPath: join(dir, 'absent', 'orca-uninstaller.exe') })
+    ).toBe('signed-missing')
+    expect(readFileSync(filePath, 'utf8')).toBe('unsigned-uninstaller')
+  })
+
+  it('swallows filesystem errors instead of failing the build', () => {
+    const dir = makeDir()
+    const filePath = writeUninstaller(dir, 'unsigned-uninstaller')
+    const fs = {
+      existsSync: () => true,
+      mkdirSync: () => {},
+      copyFileSync: () => {
+        throw new Error('EACCES')
+      }
+    }
+
+    expect(relayNsisUninstaller({ filePath, exportPath: join(dir, 'x.exe'), fs })).toBe(
+      'failed: EACCES'
+    )
+  })
+
+  it('does nothing when neither relay path is configured (local builds)', () => {
+    const dir = makeDir()
+    const filePath = writeUninstaller(dir, 'unsigned-uninstaller')
+
+    expect(relayNsisUninstaller({ filePath })).toBe('idle')
+    expect(readFileSync(filePath, 'utf8')).toBe('unsigned-uninstaller')
+  })
+})
+
+// Why a suite of its own: this is the function electron-builder actually calls,
+// and it runs inside `Build Windows release artifacts`, which has no
+// continue-on-error. If it throws, the release job dies before a single
+// SignPath request is made. Nothing else in the chain guards that.
+describe('signWindowsUninstallerViaSignPath', () => {
+  const RELAY_VARS = ['ORCA_WIN_UNINSTALLER_EXPORT_PATH', 'ORCA_WIN_UNINSTALLER_SIGNED_PATH']
+
+  const withEnv = (env, run) => {
+    const saved = Object.fromEntries(RELAY_VARS.map((key) => [key, process.env[key]]))
+    const apply = (values) => {
+      for (const key of RELAY_VARS) {
+        if (values[key] === undefined) {
+          delete process.env[key]
+        } else {
+          process.env[key] = values[key]
+        }
+      }
+    }
+    apply({ ...Object.fromEntries(RELAY_VARS.map((key) => [key, undefined])), ...env })
+    try {
+      return run()
+    } finally {
+      apply(saved)
+    }
+  }
+
+  const writeBuiltUninstaller = (dir) => {
+    const filePath = join(dir, 'orca-windows-setup.__uninstaller.exe')
+    writeFileSync(filePath, 'built-by-makensis')
+    return filePath
+  }
+
+  it.each([
+    ['a missing configuration', undefined],
+    ['a configuration with no path', {}],
+    ['a non-uninstaller path', { path: 'C:\\dist\\win-unpacked\\Orca.exe' }]
+  ])('never throws on %s', (_label, configuration) => {
+    withEnv({ ORCA_WIN_UNINSTALLER_EXPORT_PATH: join(makeDir(), 'out', 'x.exe') }, () => {
+      expect(() => signWindowsUninstallerViaSignPath(configuration)).not.toThrow()
+    })
+  })
+
+  // electron-builder calls the hook once per signing hash (sha1 then sha256),
+  // so both legs have to survive running twice over the same file.
+  it('is idempotent across the sha1 and sha256 invocations on both legs', () => {
+    const dir = makeDir()
+    const filePath = writeBuiltUninstaller(dir)
+    const exportPath = join(dir, 'relay', 'unsigned', 'orca-uninstaller.exe')
+
+    withEnv({ ORCA_WIN_UNINSTALLER_EXPORT_PATH: exportPath }, () => {
+      signWindowsUninstallerViaSignPath({ path: filePath })
+      signWindowsUninstallerViaSignPath({ path: filePath })
+    })
+    expect(readFileSync(exportPath, 'utf8')).toBe('built-by-makensis')
+
+    const signedPath = join(dir, 'relay', 'signed', 'orca-uninstaller.exe')
+    mkdirSync(join(dir, 'relay', 'signed'), { recursive: true })
+    writeFileSync(signedPath, 'signpath-signed')
+
+    withEnv({ ORCA_WIN_UNINSTALLER_SIGNED_PATH: signedPath }, () => {
+      signWindowsUninstallerViaSignPath({ path: filePath })
+      signWindowsUninstallerViaSignPath({ path: filePath })
+    })
+    expect(readFileSync(filePath, 'utf8')).toBe('signpath-signed')
+    expect(readFileSync(`${signedPath}${EMBEDDED_RECEIPT_SUFFIX}`, 'utf8')).toBe(
+      createHash('sha256').update('signpath-signed').digest('hex')
+    )
+  })
+
+  // An unwritable destination is the realistic filesystem failure, and it must
+  // cost the uninstaller signature rather than the release job.
+  it('never throws when the export destination cannot be created', () => {
+    const dir = makeDir()
+    const filePath = writeBuiltUninstaller(dir)
+    const blocker = join(dir, 'blocker')
+    writeFileSync(blocker, 'not a directory')
+
+    withEnv({ ORCA_WIN_UNINSTALLER_EXPORT_PATH: join(blocker, 'sub', 'x.exe') }, () => {
+      expect(() => signWindowsUninstallerViaSignPath({ path: filePath })).not.toThrow()
+    })
+    expect(readFileSync(filePath, 'utf8')).toBe('built-by-makensis')
+  })
+
+  it('does nothing when neither relay variable is set (local Windows builds)', () => {
+    const dir = makeDir()
+    const filePath = writeBuiltUninstaller(dir)
+
+    withEnv({}, () => {
+      expect(() => signWindowsUninstallerViaSignPath({ path: filePath })).not.toThrow()
+    })
+    expect(readFileSync(filePath, 'utf8')).toBe('built-by-makensis')
+  })
+})
diff --git a/config/scripts/workflow-ref-mirror-case-safety.test.mjs b/config/scripts/workflow-ref-mirror-case-safety.test.mjs
new file mode 100644
index 00000000000..31366f5e489
--- /dev/null
+++ b/config/scripts/workflow-ref-mirror-case-safety.test.mjs
@@ -0,0 +1,44 @@
+import { readFileSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { parse } from 'yaml'
+
+const projectDir = resolve(import.meta.dirname, '../..')
+
+const readWorkflow = (relativePath) => parse(readFileSync(join(projectDir, relativePath), 'utf8'))
+
+// Every step that mirrors this repo's whole ref namespace onto a runner disk to
+// prove a commit is reachable from a branch or tag before signing it.
+const REF_MIRRORS = [
+  ['.github/workflows/adhoc-mac-build.yml', 'build-adhoc-mac', 'Vet the requested ref'],
+  ['.github/workflows/dev-channel-win-build.yml', 'build-win', 'Vet the requested inputs']
+]
+
+describe('ref-mirroring vet steps', () => {
+  it('keeps the full-history adhoc checkout on the same case-safe backend', () => {
+    const steps = readWorkflow('.github/workflows/adhoc-mac-build.yml').jobs['build-adhoc-mac']
+      .steps
+    const checkout = steps.find((step) => step.name === 'Checkout the requested ref')
+    expect(checkout.env.GIT_DEFAULT_REF_FORMAT).toBe('reftable')
+    expect(checkout.with.ref).toBe('${{ steps.vetted.outputs.sha }}')
+    expect(checkout.with['fetch-depth']).toBe(0)
+    expect(checkout.with['persist-credentials']).toBe(false)
+  })
+
+  // Why: macOS and Windows runner disks are case-insensitive, and this repo has
+  // branches that differ only in casing. The files backend cannot store both, and
+  // it fails the whole fetch rather than the one ref — so the vet step dies before
+  // any build runs. reftable keys refs in a table instead of file paths.
+  it.each(REF_MIRRORS)(
+    '%s creates its scratch repo with the reftable backend',
+    (path, job, step) => {
+      const run = readWorkflow(path).jobs[job].steps.find(
+        (candidate) => candidate.name === step
+      ).run
+
+      expect(run).toContain('+refs/heads/*:refs/heads/*')
+      expect(run).toMatch(/git init\b[^\n]*--ref-format=reftable/)
+      expect(run).not.toMatch(/git init -q --bare "\$scratch"/)
+    }
+  )
+})
diff --git a/config/scripts/workflow-ref-reachability.test.mjs b/config/scripts/workflow-ref-reachability.test.mjs
new file mode 100644
index 00000000000..d71c3094c56
--- /dev/null
+++ b/config/scripts/workflow-ref-reachability.test.mjs
@@ -0,0 +1,125 @@
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { pathToFileURL } from 'node:url'
+import { afterAll, beforeAll, describe, expect, it } from 'vitest'
+import { parse } from 'yaml'
+import { runProcess } from '../../src/shared/child-process/run-process'
+
+const readWorkflow = (name) => parse(readFileSync(`.github/workflows/${name}.yml`, 'utf8'))
+const windowsVet = readWorkflow('dev-channel-win-build').jobs['build-win'].steps.find(
+  (step) => step.id === 'vetted'
+)
+const macSteps = readWorkflow('adhoc-mac-build').jobs['build-adhoc-mac'].steps
+const macVet = macSteps.find((step) => step.id === 'vetted')
+const macCheckout = macSteps.find((step) => step.name === 'Checkout the requested ref')
+const directory = mkdtempSync(join(tmpdir(), 'workflow-ref-reachability-'))
+const repository = join(directory, 'remote.git')
+const identity = {
+  ...process.env,
+  GIT_AUTHOR_NAME: 'Ref test',
+  GIT_AUTHOR_EMAIL: 'ref-test@example.com',
+  GIT_COMMITTER_NAME: 'Ref test',
+  GIT_COMMITTER_EMAIL: 'ref-test@example.com'
+}
+let ancestor, upper, lower, untrusted
+
+async function git(args, env = identity) {
+  const result = await runProcess({ program: 'git', args, env })
+  expect(result.code, result.stderr).toBe(0)
+  return result.stdout.trim()
+}
+
+beforeAll(async () => {
+  await git(['init', '--bare', '--ref-format=reftable', repository])
+  const tree = await git(['-C', repository, 'mktree'])
+  ancestor = await git(['-C', repository, 'commit-tree', tree, '-m', 'ancestor'])
+  upper = await git(['-C', repository, 'commit-tree', tree, '-p', ancestor, '-m', 'upper'])
+  lower = await git(['-C', repository, 'commit-tree', tree, '-p', ancestor, '-m', 'lower'])
+  untrusted = await git(['-C', repository, 'commit-tree', tree, '-m', 'PR only'])
+  for (const [ref, sha] of [
+    ['refs/heads/Fix', upper],
+    ['refs/heads/fix', lower],
+    ['refs/pull/1/head', untrusted]
+  ]) {
+    await git(['-C', repository, 'update-ref', ref, sha])
+  }
+  await git(['-C', repository, 'tag', '-a', 'Release', upper, '-m', 'upper tag'])
+  await git(['-C', repository, 'tag', '-a', 'release', lower, '-m', 'lower tag'])
+  await git(['-C', repository, 'config', 'uploadpack.allowFilter', 'true'])
+})
+
+afterAll(() => rmSync(directory, { recursive: true, force: true }))
+
+async function vet(step, ref) {
+  const scratch = mkdtempSync(join(directory, 'attempt-'))
+  const script = join(scratch, 'vet.sh')
+  writeFileSync(script, step.run)
+  return runProcess({
+    program: 'bash',
+    args: [script],
+    env: {
+      ...identity,
+      REPO_URL: pathToFileURL(repository).href,
+      RUNNER_TEMP: scratch,
+      GITHUB_OUTPUT: join(scratch, 'output'),
+      REQUESTED_REF: ref,
+      REQUESTED_SHA: ref,
+      CHANNEL: 'hourly',
+      TAG: 'v1.0.0-hourly.test',
+      VERSION: '1.0.0-hourly.test'
+    }
+  })
+}
+
+describe('release ref trust with case-twin names', () => {
+  it('accepts both branch tips, annotated tags, and their common ancestor', async () => {
+    for (const sha of [upper, lower, ancestor]) {
+      const result = await vet(windowsVet, sha)
+      expect(result.code, result.stderr).toBe(0)
+    }
+    for (const ref of ['Fix', 'fix', 'Release', 'release', ancestor]) {
+      const result = await vet(macVet, ref)
+      expect(result.code, result.stderr).toBe(0)
+    }
+  })
+
+  it('rejects PR-only commits even when the server has their objects', async () => {
+    for (const step of [windowsVet, macVet]) {
+      const result = await vet(step, untrusted)
+      expect(result.code).not.toBe(0)
+      expect(result.stdout).toContain('not reachable from any branch or tag')
+    }
+    const result = await vet(macVet, 'refs/pull/1/head')
+    expect(result.code).not.toBe(0)
+    expect(result.stdout).toContain('Refusing to build PR ref')
+  })
+
+  it('preserves both case variants in the subsequent full-history checkout', async () => {
+    const checkout = join(directory, 'checkout')
+    const env = { ...identity, ...macCheckout.env }
+    await git(['init', checkout], env)
+    await git(
+      [
+        '-C',
+        checkout,
+        'fetch',
+        '--no-tags',
+        repository,
+        '+refs/heads/*:refs/remotes/origin/*',
+        '+refs/tags/*:refs/tags/*'
+      ],
+      env
+    )
+    await git(['-C', checkout, 'checkout', '--detach', upper], env)
+    for (const [ref, sha] of [
+      ['refs/remotes/origin/Fix', upper],
+      ['refs/remotes/origin/fix', lower],
+      ['refs/tags/Release', upper],
+      ['refs/tags/release', lower]
+    ]) {
+      expect(await git(['-C', checkout, 'rev-parse', `${ref}^{commit}`], env)).toBe(sha)
+    }
+    expect(await git(['-C', checkout, 'rev-parse', 'HEAD'], env)).toBe(upper)
+  })
+})
diff --git a/config/tsconfig.cli.json b/config/tsconfig.cli.json
index b8c40c7c8aa..80cf4a511f2 100644
--- a/config/tsconfig.cli.json
+++ b/config/tsconfig.cli.json
@@ -16,6 +16,7 @@
     "../src/main/agent-hooks/managed-hook-script-refresh.ts",
     "../src/main/agent-hooks/posix-hook-command.ts",
     "../src/main/agent-hooks/runtime-home-hook-command.ts",
+    "../src/main/agent-hooks/windows-direct-cmd-hook-command.ts",
     "../src/main/agent-hooks/windows-powershell-hook-launcher.ts",
     "../src/main/amp/agent-status-plugin-source.ts",
     "../src/main/amp/hook-service.ts",
@@ -118,6 +119,7 @@
     "../src/main/hermes/hermes-home-filesystem.ts",
     "../src/main/hermes/hermes-managed-plugin-source.ts",
     "../src/main/hermes/hook-service.ts",
+    "../src/main/git-bash.ts",
     "../src/main/in-flight-run-dedupe.ts",
     "../src/main/kimi/hook-service.ts",
     "../src/main/kimi/kimi-hook-config-toml.ts",
diff --git a/config/vitest.performance.config.ts b/config/vitest.performance.config.ts
new file mode 100644
index 00000000000..7682b7b9698
--- /dev/null
+++ b/config/vitest.performance.config.ts
@@ -0,0 +1,33 @@
+import { existsSync } from 'node:fs'
+import { resolve } from 'node:path'
+import { defineConfig } from 'vitest/config'
+import baseConfig from './vitest.config'
+
+const contracts = [
+  'src/main/sqlite/sync-database.test.ts',
+  'src/main/runtime/orchestration/db/row-column-lists.test.ts',
+  'src/relay/fs-path-metadata-symlink-concurrency.test.ts',
+  'src/renderer/src/components/editor/rich-markdown-list-tokenizers.test.ts',
+  'src/renderer/src/components/editor/rich-markdown-lowlight-cache.test.ts',
+  'src/renderer/src/components/terminal-pane/agent-completion-coordinator-queued-inspection-disposal.test.ts',
+  'src/renderer/src/lib/pane-manager/pane-terminal-output-scheduler-queue-retention.test.ts',
+  'config/scripts/app-store-performance-plugin.test.mjs',
+  'config/scripts/quadratic-buffer-concat-plugin.test.mjs',
+  'config/scripts/sort-comparator-performance-plugin.test.mjs'
+]
+
+for (const contract of contracts) {
+  if (!existsSync(resolve(contract))) {
+    throw new Error(`Missing performance contract: ${contract}`)
+  }
+}
+
+export default defineConfig({
+  ...baseConfig,
+  test: {
+    ...baseConfig.test,
+    include: contracts,
+    fileParallelism: false,
+    retry: 0
+  }
+})
diff --git a/docs/assets/readme-downloads.svg b/docs/assets/readme-downloads.svg
index ef8ebb61bb4..33ad276aa2d 100644
--- a/docs/assets/readme-downloads.svg
+++ b/docs/assets/readme-downloads.svg
@@ -1,5 +1,5 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="106" height="20" role="img" aria-label="downloads: 38m">
-  <title>downloads: 38m</title>
+<svg xmlns="http://www.w3.org/2000/svg" width="106" height="20" role="img" aria-label="downloads: 41m">
+  <title>downloads: 41m</title>
   <linearGradient id="s" x2="0" y2="100%">
     <stop offset="0" stop-color="#bbb" stop-opacity=".1"/>
     <stop offset="1" stop-opacity=".1"/>
@@ -15,7 +15,7 @@
   <g fill="#fff" text-anchor="middle" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" text-rendering="geometricPrecision" font-size="11">
     <text x="37" y="15" fill="#010101" fill-opacity=".3">downloads</text>
     <text x="37" y="14">downloads</text>
-    <text x="90" y="15" fill="#010101" fill-opacity=".3">38m</text>
-    <text x="90" y="14">38m</text>
+    <text x="90" y="15" fill="#010101" fill-opacity=".3">41m</text>
+    <text x="90" y="14">41m</text>
   </g>
 </svg>
diff --git a/docs/assets/wechat-qr-group9.jpg b/docs/assets/wechat-qr-group9.jpg
new file mode 100644
index 00000000000..2bf46a28c3d
Binary files /dev/null and b/docs/assets/wechat-qr-group9.jpg differ
diff --git a/docs/readme/README.fr.md b/docs/readme/README.fr.md
index 97c78d4e713..e601abc2344 100644
--- a/docs/readme/README.fr.md
+++ b/docs/readme/README.fr.md
@@ -243,9 +243,9 @@ Associez-la à l'app de bureau pour surveiller et piloter vos agents depuis votr
 
 - **Discord :** Rejoignez la communauté sur **[Discord](https://discord.gg/fzjDKHxv8Q)**.
 - **Twitter / X :** Suivez **[@orca_build](https://x.com/orca_build)** pour les news et annonces.
-- **WeChat :** Scannez pour rejoindre le groupe WeChat 8 de la communauté Orca.
+- **WeChat :** Scannez pour rejoindre le groupe WeChat 8 de la communauté Orca. Le groupe 8 est peut-être complet ; dans ce cas, scannez plutôt le QR code du groupe 9.
 
-  <img src="../assets/wechat-qr-group8.jpg" alt="QR code WeChat groupe 8 de la communauté Orca" width="160" />
+  <img src="../assets/wechat-qr-group8.jpg" alt="QR code WeChat groupe 8 de la communauté Orca" width="160" />&nbsp;&nbsp;<img src="../assets/wechat-qr-group9.jpg" alt="QR code WeChat groupe 9 de la communauté Orca" width="160" />
 
 - **Feedback &amp; idées :** On ship vite. Il manque quelque chose ? [Demandez une feature](https://github.com/stablyai/orca/issues).
 - **Confidentialité :** Voir la [doc confidentialité &amp; télémétrie](https://www.onorca.dev/docs/telemetry) pour ce qu'Orca collecte en anonyme et comment désactiver la télémétrie.
diff --git a/docs/readme/README.ko.md b/docs/readme/README.ko.md
index 4a75722ff8c..837ecf2133f 100644
--- a/docs/readme/README.ko.md
+++ b/docs/readme/README.ko.md
@@ -238,9 +238,9 @@ yay -S stably-orca-bin
 
 - **Discord:** **[Discord](https://discord.gg/fzjDKHxv8Q)** 커뮤니티에 참여하세요.
 - **Twitter / X:** 업데이트와 공지는 **[@orca_build](https://x.com/orca_build)** 를 팔로우하세요.
-- **WeChat:** QR 코드를 스캔해 Orca 커뮤니티 WeChat 그룹 8에 참여하세요.
+- **WeChat:** QR 코드를 스캔해 Orca 커뮤니티 WeChat 그룹 8에 참여하세요. 그룹 8이 가득 찼을 수 있으니, 그런 경우 그룹 9 QR 코드를 스캔하세요.
 
-  <img src="../assets/wechat-qr-group8.jpg" alt="Orca 커뮤니티 WeChat 그룹 8 QR 코드" width="160" />
+  <img src="../assets/wechat-qr-group8.jpg" alt="Orca 커뮤니티 WeChat 그룹 8 QR 코드" width="160" />&nbsp;&nbsp;<img src="../assets/wechat-qr-group9.jpg" alt="Orca 커뮤니티 WeChat 그룹 9 QR 코드" width="160" />
 
 - **피드백과 아이디어:** 우리는 빠르게 출시합니다. 필요한 기능이 있나요? [새 기능을 요청](https://github.com/stablyai/orca/issues)하세요.
 - **개인정보 보호:** Orca가 수집하는 익명 사용 데이터와 수집 거부 방법은 [개인정보 및 텔레메트리 문서](https://www.onorca.dev/docs/telemetry)를 참고하세요.
diff --git a/docs/readme/README.zh-CN.md b/docs/readme/README.zh-CN.md
index d7bae3fba9e..10f47e20fe6 100644
--- a/docs/readme/README.zh-CN.md
+++ b/docs/readme/README.zh-CN.md
@@ -235,9 +235,9 @@ yay -S stably-orca-bin
 
 - **Discord:** 加入 **[Discord](https://discord.gg/fzjDKHxv8Q)** 社区。
 - **Twitter / X:** 关注 **[@orca_build](https://x.com/orca_build)** 获取更新和公告。
-- **微信:** 扫码加入 Orca 社区微信第 8 群。
+- **微信:** 扫码加入 Orca 社区微信第 8 群。第 8 群可能已满，如遇这种情况请扫描第 9 群二维码。
 
-  <img src="../assets/wechat-qr-group8.jpg" alt="Orca 社区微信第 8 群二维码" width="160" />
+  <img src="../assets/wechat-qr-group8.jpg" alt="Orca 社区微信第 8 群二维码" width="160" />&nbsp;&nbsp;<img src="../assets/wechat-qr-group9.jpg" alt="Orca 社区微信第 9 群二维码" width="160" />
 
 - **反馈与想法:** 我们发布很快。缺少什么功能？[提交功能请求](https://github.com/stablyai/orca/issues)。
 - **隐私:** 查看[隐私与遥测文档](https://www.onorca.dev/docs/telemetry)，了解 Orca 收集哪些匿名使用数据以及如何退出。
diff --git a/docs/reference/ci-runner-efficiency.md b/docs/reference/ci-runner-efficiency.md
new file mode 100644
index 00000000000..6d688598097
--- /dev/null
+++ b/docs/reference/ci-runner-efficiency.md
@@ -0,0 +1,199 @@
+# CI efficiency and runner capacity
+
+Audit date: September 5, 2026. No paid capacity or provider configuration changed.
+
+## Measurements and changes
+
+Three recent successful PR runs used 54.6–64.9 aggregate runner minutes:
+[33998366568](https://github.com/stablyai/orca/actions/runs/33998366568),
+[33998220287](https://github.com/stablyai/orca/actions/runs/33998220287), and
+[33998181502](https://github.com/stablyai/orca/actions/runs/33998181502).
+These are sums of active job durations, excluding skipped jobs; they are not
+billing minutes or queue time. This small sample is not a historical average.
+
+- Consolidate E2E routing into the existing code-path detector. The removed
+  detector occupied 20–22 seconds and required another runner allocation and
+  full-history checkout per nondraft code PR. The same routing commands remain,
+  including SSH and native IME selection; actual E2E results remain advisory.
+  A routing-script error now fails the required code-path detector.
+- Use gzip for PR-only Debian/RPM artifacts. The two sampled Linux packaging
+  jobs took 8m10s and 8m19s overall; one spent 3m47s in electron-builder. Its
+  default Debian/RPM compression is xz. PR artifacts are inspected on the same
+  runner, so their download size offers no benefit. Keep all AppImage, Debian,
+  RPM, payload, launcher, and shutdown checks. Release compression is unchanged.
+  Hosted validation in [33999422341](https://github.com/stablyai/orca/actions/runs/33999422341)
+  reduced the package-build step to 2m13s and the full Linux job to 6m17s, with
+  all existing checks passing. This is a small observational sample.
+- Cancel superseded Mobile Checks and Skill update round-trip PR runs. The
+  skill matrix has 13 jobs. Preserve non-cancelling main/merge-group skill runs,
+  with separate concurrency groups per event.
+- Reuse the existing script-free root dependency action in Mobile Checks,
+  including the pnpm cache keyed by both root and mobile lockfiles. The root
+  install remains necessary because mobile types import root dependencies.
+
+The repository already has eight unit shards, path-scoped platform checks,
+native caches, one shared E2E build, PR cancellation, incremental TypeScript
+caching, and changed-spec E2E routing. Increasing shards would increase setup
+work and simultaneous runner demand. Do not adjust the count without comparing
+critical-path time and aggregate job time on the same commit.
+
+## Follow-up savings
+
+- Move the hourly main/release freshness lookup to a five-minute Ubuntu
+  preflight without a checkout. In unchanged run
+  [33986205749](https://github.com/stablyai/orca/actions/runs/33986205749),
+  Blacksmith macOS was occupied for 40 seconds, including a 30-second checkout,
+  before skipping. The new job-level gate avoids that Mac allocation. Actual
+  builds gain an Ubuntu scheduling hop; pin the Mac checkout and downstream
+  Windows identity to the SHA that the preflight checked.
+- Avoid global `npm install -g node-gyp` for validated Linux Node-runtime cache
+  hits. Use the existing native-module load/provenance check before skipping;
+  misses, broken addons, and Electron jobs still install the rebuild toolchain.
+  The action file participates in cache keys, so this rollout creates fresh
+  native caches once. No measured warm-cache seconds are claimed yet.
+
+## Runner recommendations
+
+The repository is **public**, verified using the GitHub API. Standard
+GitHub-hosted Linux, Windows, and macOS runners have free compute minutes for
+public repositories. Queue pressure and third-party provider allowances still
+matter; artifact storage and larger runners have separate billing rules.
+See [GitHub Actions billing](https://docs.github.com/en/billing/concepts/product-billing/github-actions).
+
+1. Keep standard GitHub-hosted runners as the default. Ask GitHub Support for a
+   higher concurrent-job limit before paying for more capacity. The documented
+   standard limits depend on the account plan (Free: 20 total/5 macOS; Team:
+   60/5; Enterprise: 500/50), and increases are subject to approval. The actual
+   account entitlement was not verified. See [limits](https://docs.github.com/en/actions/reference/limits).
+2. Reserve existing Blacksmith allowance for macOS if that is the priority.
+   Blacksmith documents 3,000 free x64 2-vCPU-equivalent minutes per organization;
+   a 6-vCPU Mac minute consumes 20 equivalents, or 150 actual Mac minutes if
+   it uses the entire free pool. Cloud workflows also use Blacksmith Linux.
+   Moving Linux to hosted GitHub saves shared allowance, but does not necessarily
+   free Mac hardware capacity. Account-specific contracts and usage were not
+   inspected. See [Blacksmith runners](https://docs.blacksmith.sh/blacksmith-runners/overview).
+3. Treat Ubicloud as an optional small Linux overflow trial. Its documented
+   $2.50 monthly credit buys 1,250 premium 2-vCPU minutes at $0.002/minute, or
+   2,000 standard 2-vCPU minutes at $0.00125/minute. New accounts default to
+   premium and require a credit card. No enforceable hard spending cap was
+   verified, so changing runner labels cannot guarantee the no-spend constraint.
+   One PR's roughly 55–65 runner minutes also makes clear how small this pool
+   is relative to repository activity (hardware speeds differ).
+   See [pricing](https://ubicloud.com/docs/about/pricing) and
+   [setup](https://ubicloud.com/docs/github-actions-integration/quickstart).
+
+### A bounded Ubicloud candidate
+
+The Linux leg of `performance-contracts.yml` took 48 seconds in
+[33994756657](https://github.com/stablyai/orca/actions/runs/33994756657).
+Its daily schedule and 20-minute timeout make it a small candidate: 31 ordinary
+scheduled attempts permit at most 620 job-runtime minutes, before runner
+startup/cleanup billing. Actual timings on Ubicloud's 2-vCPU hardware still need
+measurement; the GitHub timing is only a sizing reference.
+
+If enabled later, route only the first attempt of the scheduled Linux job to
+Ubicloud; keep PRs, manual dispatches, reruns, and macOS/Windows on GitHub. This
+avoids spending the allowance on unpredictable PR volume. Check other account
+usage and available credit before enabling; a workflow timeout is not an
+account-wide billing cap. On September 5, the organization's GitHub App
+installation list contained Blacksmith but no Ubicloud installation, so this
+follow-up leaves runner selection on GitHub rather than queueing work against
+an unprovisioned label.
+
+## Machines that also run coding agents
+
+Do not register the credentialed host directly as a public-PR runner. A PR can
+execute arbitrary build/test code, and a persistent host lets it access local
+credentials or affect subsequent jobs. Docker alone is not adequate isolation
+when it exposes the host home, Docker socket, SSH agent, or office network.
+
+A possible no-new-hardware experiment is a disposable VM per job, preferably on
+a dedicated spare machine, with a just-in-time single-job runner, no shared
+home/keychain/SSH agent or host mounts, restricted network access, and CPU/RAM
+limits that leave room for coding agents. Destroy the VM after every job;
+ephemeral runner registration by itself does not clean the machine. Start with
+trusted branch/manual workloads and keep public fork PRs on hosted runners.
+Provisioning and ongoing patching are real operational costs even when the
+machine is already owned. See GitHub's
+[self-hosted runner security guidance](https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions).
+
+## Release waits
+
+The latest successful sampled Windows release used 13m59s of a 21m56s job in
+signing wait/download steps. The same release held an Ubuntu job for 11m38s
+polling the isolated Mac build. These are stronger occupancy opportunities than
+small checkout savings, especially when approval takes hours.
+
+[Windows signing without occupying a runner](windows-signing-runner-time.md)
+describes a staged, same-run design, required protected environments, and
+rehearsal criteria. No callback integration or protected Windows signing
+environments currently exist. An environment-gated design adds a GitHub
+approval after each SignPath approval and changes the current automatic inner
+signing timeout fallback; those are explicit release-policy decisions, so this
+PR leaves production signing behavior unchanged.
+
+## Second audit and hosted trials
+
+- Cloud Verify ran 100 times in a sampled 39-hour window (84 PR and 16 push
+  runs). Move its four Ubuntu 22.04 jobs from Blacksmith to standard hosted
+  Ubuntu 22.04, preserving Postgres, secret scanning, build, tests, and Terraform
+  validation. Baseline [34001538145](https://github.com/stablyai/orca/actions/runs/34001538145)
+  used 64/72/26/19 seconds for security/test/build/Terraform respectively.
+  This conserves the shared provider allowance; hosted latency must be checked.
+- Keep full tag history for the 13-job skill round-trip matrix, but fetch blobs
+  lazily. Only two historical SKILL.md files are materialized. Baseline
+  [33999994876](https://github.com/stablyai/orca/actions/runs/33999994876)
+  spent 42–84 seconds per checkout, about 14 aggregate runner minutes. A hosted
+  trial must verify historical blob fetches on all three operating systems.
+- Use the existing Electron/native dependency cache for native IME CI. Keep
+  both deterministic boundary and real IBus tests. Add pnpm store caching to
+  terminal perf and release golden/evidence lanes; retain their raw installs
+  because manually selected older refs may not contain the shared action.
+- Disable ZIP recompression only for already-compressed NSIS installers sent
+  to SignPath. Installer contents, release compression, and signing stay intact.
+- Advance existing placement and startup deadlines with scoped fake timers in
+  three renderer test files. All 34 tests pass in 62 ms of local test execution,
+  versus 65.182 seconds in the sampled hosted baseline. Imports and transforms
+  still dominate invocation time; this is not a claim of equal PR wall savings.
+
+Eight unit shards already have balanced 260–296-second sample durations.
+Reducing shards or removing test isolation lacks evidence of a net gain. Real
+subprocess tests intentionally cover lifecycle behavior and retain real clocks.
+The 14-way E2E split retains headroom after earlier 12-way timeouts. Lowering
+coverage or schedule frequency is outside this efficiency pass. Cache complexity
+for a seven-second docs install is unlikely to pay back. Release build reuse
+across modes risks differing telemetry identities and native platform artifacts.
+
+Terminal Perf's baseline [33955846492](https://github.com/stablyai/orca/actions/runs/33955846492)
+failed waiting 30 seconds for workspaceSessionReady in its shared-page fixture,
+before measuring terminal performance. Compare hosted trials against that known
+failure rather than attributing it to dependency cache changes.
+
+Hosted trials for the second audit:
+
+- [Cloud Verify 34002295216](https://github.com/stablyai/orca/actions/runs/34002295216)
+  passed all four jobs on standard hosted Ubuntu: security 57s, test 102s, build
+  35s, Terraform 19s. The test lane is 30s slower than the Blacksmith sample;
+  retain this modest latency tradeoff to conserve shared allowance.
+- [Skill matrix 34002295221](https://github.com/stablyai/orca/actions/runs/34002295221)
+  passed all 13 legs, including historical blob materialization. Checkout took
+  18–20s on Linux, 39–45s on macOS, and 49–58s on Windows, versus the earlier
+  42–84s range across platforms. These are observational samples.
+- [Native IME 34002299594](https://github.com/stablyai/orca/actions/runs/34002299594)
+  passed both deterministic and real IBus checks. Shared dependency setup took
+  29s, versus 35s for the old install/toolchain steps in the sampled baseline.
+- Native-IME-only source/spec changes no longer allocate the reusable E2E
+  build, cache, and consumer jobs just to filter out the native spec. The
+  separate native workflow still runs; SSH-only and mixed spec lists still
+  allocate the reusable workflow. Routing contracts exercise these cases.
+- [Hourly 34001816449](https://github.com/stablyai/orca/actions/runs/34001816449)
+  exercised the new five-second preflight and successfully published macOS.
+  The Windows follow-up failed in its unchanged input-vetting fetch because
+  remote refs differ only by case on its case-insensitive filesystem. The
+  requested SHA was correct; this does not validate an unchanged-main skip yet.
+
+Moving the daily Mac freshness check has lower expected value than hourly:
+only one potential idle allocation per day, and active development usually
+requires that build. Defer another release-graph change until skip frequency
+justifies it. The substantive remaining release occupancy opportunity is the
+separately documented asynchronous signing policy decision.
diff --git a/docs/reference/windows-cmd-shim-resolution.md b/docs/reference/windows-cmd-shim-resolution.md
new file mode 100644
index 00000000000..c17380e800d
--- /dev/null
+++ b/docs/reference/windows-cmd-shim-resolution.md
@@ -0,0 +1,77 @@
+# Resolving Windows `.cmd` shims past cmd.exe
+
+Node refuses to spawn a `.cmd`/`.bat` target without a shell (the
+CVE-2024-27980 mitigation), so `resolveSpawn` has to make `cmd.exe` the program
+and hand it `/d /v:off /s /c "<caret-escaped argv>"`. For an agent CLI that
+means a long `cmd.exe /c` line whose caret-escaped payload is natural-language
+prompt text — which Microsoft Defender for Endpoint's command-line model scores
+as obfuscation. `codex.cmd` appeared in the spawn cluster of an MDE incident
+against Orca for exactly this reason.
+
+`src/shared/child-process/windows-cmd-shim-resolution.ts` sidesteps it. npm's
+`cmd-shim` and pnpm's `@zkochan/cmd-shim` generate files whose entire body is
+"find a Node interpreter and run this script". Reading one lets `resolveSpawn`
+spawn `node.exe <script> <args…>` directly: no cmd.exe in the tree, and no
+caret escaping at all.
+
+## What resolution changes
+
+Only `runProcess` / `spawnProcess` callers. Two things people expect it to
+cover, and it does not:
+
+- **The interactive terminal.** `src/main/daemon/pty-subprocess/native-pty-spawn.ts`
+  calls `pty.spawn` directly, so typing `codex` in an Orca terminal is
+  completely unaffected.
+- **Orca's own hook wrappers** (`codex-hook.cmd` and friends). These are batch
+  files Orca writes, matching none of the generator shapes, so they keep the
+  cmd.exe path. They are addressable — we generate them — but not by this
+  module.
+
+## Adding a shape
+
+Four shapes are recognised, each transcribed verbatim from a real install into
+`src/shared/child-process/__fixtures__/windows-cmd-shim-bodies.ts`. If you add a
+fifth, add its real body there too. A shape guessed from documentation is not
+evidence.
+
+The rule for the parser is all-or-nothing: the whole canonicalised body must
+match end to end, and anything unrecognised returns null and keeps the cmd.exe
+path. **A mis-resolution silently runs the wrong program or drops arguments,
+which is far worse than an EDR alert** — when in doubt, refuse.
+
+Resolution also refuses a captured path that is absolute, drive-relative
+(`D:evil.js` — `win32.isAbsolute` says false, but `win32.resolve` leaves the
+shim directory), or contains `% ^ & | < > " :` or a line break; a script or
+target that is not on disk; an interpreter-less target that is not `.exe`/`.com`;
+and a program path that is not absolute.
+
+Refusing every `:` cannot cause a false refusal. Windows reserves the character
+within a path segment, so a relative path cannot contain one — the only
+spellings that can are drive-qualified, an alternate data stream (`a.js:zone`),
+or a `\\?\` device path, and the last is already refused as absolute.
+
+## Kill switch
+
+Set **`ORCA_DISABLE_CMD_SHIM_RESOLUTION`** to any non-empty value in the
+environment a child is spawned with, and every `.cmd` goes back through
+`cmd.exe /c` unchanged. It is read from the spawn's own environment, so
+exporting it before launching Orca disables resolution process-wide.
+
+Use it to confirm a suspected mis-resolution: run the failing operation with and
+without it. Identical behaviour means resolution is not the cause. If it is,
+report the shim's body — the parser is only allowed to recognise shapes we have
+seen for real.
+
+## Behaviour that changes, deliberately
+
+A resolved shim is not merely a quieter spelling of the cmd.exe path. Two limits
+of `cmd.exe` disappear with it:
+
+- An argument containing `\r`/`\n` was rejected outright, because cmd ends its
+  command at a raw line break whatever the quote state. Multi-line agent prompts
+  now work.
+- A command line over 8191 characters returned `The command line is too long.`
+  Long prompts now work.
+
+Both are improvements, but they are behaviour changes: an unresolved shim still
+hits both limits, so a caller must not assume every `.cmd` accepts them.
diff --git a/docs/reference/windows-daemon-host-relocation.md b/docs/reference/windows-daemon-host-relocation.md
new file mode 100644
index 00000000000..f560597e25e
--- /dev/null
+++ b/docs/reference/windows-daemon-host-relocation.md
@@ -0,0 +1,118 @@
+# Windows daemon-host relocation
+
+On Windows the terminal daemon does not run from the install directory. Before it forks the
+daemon, Orca materializes a trimmed copy of its own runtime under
+`%LOCALAPPDATA%\Orca\daemon-host\<app version>\` and forks the daemon from there
+(`src/main/daemon/daemon-host-relocation.ts`). This is what keeps live terminals alive across an
+auto-update and across a crash of the main process.
+
+Read this before changing the copy plan, the host exe name, the LOCALAPPDATA layout, or
+`config/nsis/orca-installer-hooks.nsh`.
+
+## What the relocation actually escapes
+
+The killer is **electron-builder's process sweep, matched on image path** — not file deletion.
+Windows will not delete a running image, so `RMDir /r "$INSTDIR"` cannot end the daemon on its own.
+
+In app-builder-lib's `allowOnlyOneInstallerInstance.nsh`, `FIND_PROCESS` / `KILL_PROCESS` have two
+branches:
+
+| Branch   | Condition                                                                                                       | Selector                                                                                                                                                              |
+| -------- | --------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Primary  | `powershell.exe` runs, `Get-CimInstance` resolves, and `Get-ExecutionPolicy -Scope Process` is not `Restricted` | `Win32_Process` where `$_.Path.StartsWith('$INSTDIR', 'CurrentCultureIgnoreCase')` — **path-scoped**                                                                  |
+| Fallback | otherwise                                                                                                       | per-user: `taskkill /F /IM "<AppName>.exe" /FI "PID ne $pid" /FI "USERNAME eq %USERNAME%"`; per-machine: the same without the username filter — **image-name-scoped** |
+
+The probe reads the **process** scope, not the effective policy, and Group Policy writes
+`MachinePolicy`/`UserPolicy` — so a GPO-managed host whose effective policy is `Restricted` still
+exits 0 and takes the primary branch. The fallback is reached only when `powershell.exe` is absent,
+`Get-CimInstance` does not resolve, PowerShell is blocked outright (WDAC/AppLocker, Server Core), or
+an inherited `PSExecutionPolicyPreference=Restricted` is in the environment.
+
+So on essentially every machine the sweep is path-scoped, and a daemon whose image lives under
+`%LOCALAPPDATA%` is out of range regardless of what the file is called. **Survival is a property of
+the path.** The name only matters on the fallback branch.
+
+## Why the exe is copied verbatim (and not renamed)
+
+The host exe keeps the app exe's own file name (`daemonHostExeName()` returns
+`basename(process.execPath)`), so the relocated image is a byte-for-byte copy of the app binary
+under its original name.
+
+An earlier revision copied it as `orca-terminal-daemon.exe` specifically so the fallback
+`taskkill /IM Orca.exe` could not match. That bought survival on the rare no-PowerShell host and
+cost a textbook defence-evasion signature: _a process copies its own image into a user-writable
+directory under a different name so a kill-by-image-name cannot match it, then runs detached and
+survives the installer._ Microsoft Defender for Endpoint flagged it as MITRE **T1036
+(Masquerading)**, and — because it is the process every other flagged action is attributed to — it
+acted as a reputation multiplier on unrelated findings. No VS Code fork does this.
+
+Trading the fallback branch for the name is the right trade:
+
+- On the primary branch nothing changes: the daemon still survives the update.
+- On the fallback branch the daemon is killed with the app and terminals **cold-restore** on
+  relaunch. That is the documented pre-relocation behaviour, a first-class outcome the update
+  harness already asserts (`--expect cold-restore`), not a failure.
+- Relocation is fail-open end to end anyway: any materialization failure returns `null` and the
+  caller forks the install-dir host.
+
+One new failure mode comes with it, on the fallback branch only. The daemon now matches
+`FIND_PROCESS` under the app's image name, so it enters electron-builder's retry loop
+(`allowOnlyOneInstallerInstance.nsh:136-141`). If the `taskkill` there fails to end it — an elevated
+or otherwise unkillable host — the loop reaches `MessageBox ... /SD IDCANCEL` and `Quit`s, aborting a
+silent update rather than completing it. Under the old distinct name the daemon was invisible to
+that loop. Low probability (fallback branch _and_ an unkillable daemon), but it is a real new path.
+
+What this does **not** buy. Two things bound the win honestly:
+
+- The strongest T1036 indicator is a PE-resource-vs-disk-name mismatch, and it was **never firing**:
+  the shipped binary's `OriginalFilename` is empty (only `InternalName = Orca` is set), so there was
+  no embedded name for the old disk name to contradict.
+- The remaining behaviour — a signed app copying its own ~225 MB image into user-writable
+  `%LOCALAPPDATA%` and running it detached under `ELECTRON_RUN_AS_NODE=1` — is still execution from
+  a non-standard user-writable location, which maps to **T1036.005** and is a standard heuristic on
+  its own.
+
+So this removes a real but partial signal. Expect the score to drop; do not expect the process to
+stop being scored.
+
+## Options that were rejected
+
+| Option                                                                        | Why not                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| ----------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Materialize the tree from the NSIS installer                                  | The daemon host is ~246 MB. Writing it at install time doubles install footprint and lengthens the window in which the app is down during a silent update. Worse, on a per-machine install (`INSTALL_MODE_PER_ALL_USERS`) the installer runs as the installing admin, so `$LOCALAPPDATA` is the wrong user's — every other user still needs the runtime path, which means the runtime self-copy stays in the product and the signal is only made rarer.                                                                                                  |
+| Ship a second signed `orca-terminal-daemon.exe` in the installer              | `Orca.exe` is 235,555,328 bytes (224.6 MiB). electron-builder's NSIS uses solid LZMA with a 64 MB dictionary, so a second copy 224 MB downstream does not dedupe; the compressed installer grows by roughly a whole compressed Electron binary, paid by every user on every update download. It also does not remove the runtime copy — the helper still has to reach `%LOCALAPPDATA%` to escape the sweep — so it buys the same signal reduction as the verbatim copy at a large download cost.                                                         |
+| Override `customCheckAppRunning` to force a path-scoped kill on both branches | Cheap to write (~6 lines: `!include "getProcessInfo.nsh"`, `Var pid`, and a macro that pins `IsPowerShellAvailable`, reusing upstream's dialog, retry loop and elevated handling) — but wrong at any size. Forcing the PowerShell branch on a host where PowerShell is genuinely absent makes `FIND_PROCESS` and `KILL_PROCESS` silently no-op, so the installer proceeds with the **real app** still running and its files in use. That is a worse outcome than the cold restore it would prevent, so this is not worth doing ever, not merely not now. |
+| Hardlink instead of copy                                                      | Avoids the 246 MB entirely and is not a "copy" at all, but is NTFS-and-same-volume-only and introduces fresh failure modes (link counts, AV interception, cross-volume installs). Worth revisiting deliberately, not as part of a signal fix.                                                                                                                                                                                                                                                                                                            |
+
+## Invariants to preserve
+
+- The host exe name is **derived from `process.execPath`**, never a literal. A future
+  `executableName` or dev-channel rename must follow automatically; pinning a name of our own is
+  how the mismatch creeps back.
+- The daemon is identified by **PID and command line**, never by image name — in the product
+  (`daemon-pid-file-parse`, `daemon-process-inspection`) and in the harness
+  (`tests/tools/win-update-e2e/daemon-processes.mjs`). Nothing may start matching on the exe name.
+- `config/nsis/orca-installer-hooks.nsh` kills the daemon by image name. That now also matches the
+  app's own exe, which is correct on a genuine uninstall — the product is being removed — but its
+  `${isUpdated}` guard must stay: electron-builder runs the uninstaller during every update's
+  `uninstallOldVersion`, and killing the daemon there defeats the whole feature. The legacy
+  `orca-terminal-daemon.exe` name stays in the macro to reap hosts left by older builds.
+- `LOCAL_HOST_ROOT_NAME` in `daemon-host-relocation.ts` and the path in the uninstall macro are the
+  same directory. Change both together.
+
+## Verifying a change
+
+Unit coverage lives in `src/main/daemon/daemon-host-relocation.test.ts` (copy plan, verbatim
+naming, marker/atomic publish, fail-open, prune veto). Nothing in unit tests can prove survival, so
+any change to this file or to the NSIS macro needs the packaged harnesses:
+
+- `.github/workflows/win-update-survival-e2e.yml` — builds an installer from the branch and updates
+  it over itself with `--expect survival`. The primary proof.
+- `.github/workflows/win-crash-survival-e2e.yml` — proves the daemon survives a main-process crash.
+- `.github/workflows/windows-terminal-restart-e2e.yml` — terminal restart behaviour.
+- `.github/workflows/win-update-e2e.yml` — release-tag-to-release-tag update, both `survival` and
+  `cold-restore` profiles.
+
+All four are `workflow_dispatch`-only (the two update workflows also carry a push trigger pinned to
+one historical feature branch), so they must be dispatched by hand against this branch before
+merging a change here — which requires the workflow files to already exist on `main`.
diff --git a/docs/reference/windows-edr-posture.md b/docs/reference/windows-edr-posture.md
index 06eb2d5ff9b..24854890fc7 100644
--- a/docs/reference/windows-edr-posture.md
+++ b/docs/reference/windows-edr-posture.md
@@ -13,7 +13,7 @@ two escalated to multi-stage incidents carrying ATT&CK tactic mappings
 The framing this document keeps throughout, because both halves matter:
 
 > **Defender is not malfunctioning. It is describing the code accurately.** Orca
-> really does copy its own signed image under a different name, really does read
+> really does copy its own signed image under a different name, really did read
 > every process's memory on a timer, really does run base64-encoded PowerShell
 > with the execution policy bypassed, and really does take screenshots and
 > synthesise input from a runtime-compiled assembly. Each of those is a
@@ -50,33 +50,49 @@ and `orca-terminal-daemon.exe` report `Valid CN=SignPath Foundation`.
 
 ## The behaviours, and why each one exists
 
-### The daemon runs from a renamed copy of our own image
+### The daemon runs from a copy of our own image
 
 `src/main/daemon/daemon-host-relocation.ts` copies the Electron runtime into
-`%LOCALAPPDATA%\Orca\daemon-host\<version>\` and renames `Orca.exe` to
-`orca-terminal-daemon.exe`. The comment on `DAEMON_HOST_EXE_NAME` states the
-reason without varnish: _"so the NSIS updater's `taskkill /IM Orca.exe` can't
-match it."_
+`%LOCALAPPDATA%\Orca\daemon-host\<version>\` and forks the terminal daemon from
+there.
 
 It exists because the NSIS installer deletes the old install directory and force-
 kills every process imaged under it. Without relocation, an auto-update kills the
 terminal daemon and every live terminal with it. The copy is a run-as-node
 `Orca.exe` rather than `node.exe` so there is no console flash and asar still
-resolves; `config/nsis/daemon-host-uninstall.nsh` reaps it on a real uninstall
+resolves; `config/nsis/orca-installer-hooks.nsh` reaps it on a real uninstall
 (guarded by `${isUpdated}` so an update's `uninstallOldVersion` never fires it).
 
-**How an EDR reads it: MITRE T1036, masquerading.** A signed executable copied
-out of the install directory into `%LOCALAPPDATA%` under a different name, which
-then spawns shells, matches the textbook description closely enough that no
-behavioural engine can be expected to score it low.
+**At the time of these incidents the copy was also renamed** to
+`orca-terminal-daemon.exe`, the image name every incident here reports, and
+`DAEMON_HOST_EXE_NAME`'s comment stated the reason without varnish: _"so the NSIS
+updater's `taskkill /IM Orca.exe` can't match it."_ The rename has since been
+removed; the copy now keeps the app exe's own file name, because the updater's
+kill sweep is path-scoped on every host that has PowerShell and the rename only
+ever bought the no-PowerShell fallback. See
+[`windows-daemon-host-relocation.md`](./windows-daemon-host-relocation.md).
+
+**How an EDR reads it: MITRE T1036, masquerading** — and, for what remains,
+**T1036.005**. A signed executable copied out of the install directory into
+`%LOCALAPPDATA%` under a different name, which then spawns shells, matches the
+textbook description closely enough that no behavioural engine can be expected to
+score it low. Dropping the rename removes that literal indicator but not the
+underlying shape: execution from a non-standard user-writable location is scored
+on its own. Note also that the strongest form of the T1036 signal was never
+present here — the shipped binary's `OriginalFilename` is empty, so there was no
+embedded name for the old disk name to contradict.
 
 ### Every process gets a handle, on a timer
 
-`src/main/windows/windows-process-table.ts` takes a Toolhelp32 snapshot under
-**one** flag set, `CommandLine | CreationTime`, shared by every caller. pid, ppid
-and name come out of the snapshot itself and open nothing. `CommandLine` is what
-opens a handle: the addon calls `GetProcessCommandLine` per process, which opens
-`PROCESS_QUERY_INFORMATION | PROCESS_VM_READ` and walks the PEB with three
+`src/main/windows/windows-process-table.ts` takes a Toolhelp32 snapshot under one
+of **two** flag sets: identity (`None | CreationTime`) for callers that read only
+pid, ppid and name, and detailed (`+ CommandLine`) for callers that match on a
+command line. pid, ppid and name come out of the snapshot itself and open
+nothing, so an identity scan opens nothing at all. `CommandLine` is what opens a
+handle: the addon calls `GetProcessCommandLine` per process, which opens
+`PROCESS_QUERY_LIMITED_INFORMATION` — the same right Task Manager takes — and
+asks the kernel for the string. Upstream it opened
+`PROCESS_QUERY_INFORMATION | PROCESS_VM_READ` and walked the PEB with three
 `ReadProcessMemory` calls (`src/process_commandline.cc:32,41-47` in the vendored
 `@vscode/windows-process-tree` 0.8.0 source that `config/patches/` patches).
 
@@ -84,8 +100,9 @@ opens a handle: the addon calls `GetProcessCommandLine` per process, which opens
 `GetProcessMemoryUsage` open a **second** `PROCESS_QUERY_INFORMATION |
 PROCESS_VM_READ` handle per process for a `GetProcessMemoryInfo` call whose
 result no caller read (`src/process.cc:47-63`). Dropping it halves the handles
-opened per snapshot. It does not remove the remote memory read, because the
-command line still performs one.
+opened per snapshot. On its own it removed no memory read — both handles carried
+`PROCESS_VM_READ` at the time — so it composes with the patch below rather than
+substituting for it.
 
 It exists because seven independent readers used to fork `powershell.exe` for a
 `Get-CimInstance Win32_Process` scan. That cost, measured: a PowerShell
@@ -98,41 +115,49 @@ panes multiplied it (#15036). The native snapshot answers the same question in
 See
 [`windows-process-enumeration.md`](./windows-process-enumeration.md).
 
-Asking for fewer fields is cheaper, and the module now asks for the smallest set
-that still answers every caller. There is **no** per-flag-set cache split: one
-TTL-cached snapshot serves everyone, deliberately, because a split would restore
-the per-pane fan-out the cache exists to remove — a 32-wide teardown has to
-collapse into one scan. So the cheap identity-only read is not something any
-caller can select; every read pays for `CommandLine`. An earlier revision of this
-file described a two-cache design with 6.3 ms / 12.3 ms p50 figures at 492
-processes. That design is not in the tree and those numbers describe no code
-path here; the figures that do apply are the module's own, in
+Asking for fewer fields is cheaper, and each caller now asks for the smallest set
+that answers it. There are exactly **two** TTL-cached snapshots, one per flag
+set, never one per caller: the fan-out the cache exists to remove is one scan per
+_caller_, and each reader still serves every caller wanting its flag set, so a
+32-wide teardown still collapses into one scan of each. Teardown identity and the
+owner probe select the identity set and therefore open no handles; the per-pane
+foreground tracker genuinely needs a command line and still pays for one. A third
+cache would need a third flag set, not a third caller. Measured at 492 processes,
+p50: identity 6.3 ms, detailed 12.3 ms — see
 [`windows-process-enumeration.md`](./windows-process-enumeration.md).
 
-**How an EDR reads it:** a cross-process handle plus a remote memory read against
+**How an EDR read it:** a cross-process handle plus a remote memory read against
 every process on the box, repeating on a cadence, is the read half of the
 telemetry that credential dumping and process injection produce. MDE surfaced it
 as "suspicious memory activity".
 
-**That signal is still present.** An earlier revision of this file claimed the
-command line "now comes from the kernel" through `NtQueryInformationProcess`'s
-`ProcessCommandLineInformation` class, needing only
-`PROCESS_QUERY_LIMITED_INFORMATION`, and that `ReadProcessMemory` was absent from
-the compiled addon. None of that is true of the code we ship.
-`process_commandline.cc` calls `NtQueryInformationProcess` with
-`ProcessBasicInformation` only — to locate the PEB — and then issues three
-`ReadProcessMemory` calls against a `PROCESS_VM_READ` handle to read the PEB, the
-`RTL_USER_PROCESS_PARAMETERS`, and the command-line buffer. Nothing asserts an
-import table, and no such assertion would pass.
+**The memory read is gone.** A fourth hunk in
+`config/patches/@vscode__windows-process-tree@0.8.0.patch` has
+`GetProcessCommandLine` call `NtQueryInformationProcess` with
+`ProcessCommandLineInformation` (class 60, Windows 8.1+; Electron's floor is
+Windows 10), which returns a `UNICODE_STRING` the kernel builds and needs only
+`PROCESS_QUERY_LIMITED_INFORMATION`. Measured on ~540 processes, per detailed
+scan: `ReadProcessMemory` 1128 → **0**, desired access `0x0410` → `0x1000`, with
+byte-identical command lines on every process both readers recovered. There is no
+PEB fallback to reinstate it — a hooked `ntdll` answering
+`STATUS_INVALID_INFO_CLASS` for one target would have flipped a process-wide,
+one-way switch back to `PROCESS_VM_READ` on exactly the machines this exists for.
 
-What this change did remove is the `Memory` flag's second handle and its
-`GetProcessMemoryInfo` call, so the per-process handle count per snapshot halves.
-What remains to declare to administrators is unchanged in kind: one
-`PROCESS_QUERY_INFORMATION | PROCESS_VM_READ` handle and a PEB read against every
-process on the box, at the shared snapshot's cadence. Moving to
-`ProcessCommandLineInformation` (Windows 8.1+, `PROCESS_QUERY_LIMITED_INFORMATION`
-only) would genuinely retire the remote read, but it is an addon patch nobody has
-written; treat it as unclaimed work, not as shipped.
+Because the property is the *absence* of an import, it is checkable on the
+artifact rather than the source: `inspectWindowsProcessTreeAddon()` answers
+`clean` / `unpatched` / `missing`, and the rebuild, `ensure-native-runtime.mjs`,
+the relay build and `loadWindowsProcessTree()` all key on it. That check is load-
+bearing because the published tarball ships a *loadable* prebuilt built from
+unpatched source, so "it required cleanly" is not evidence.
+
+What to declare to administrators is now one
+`PROCESS_QUERY_LIMITED_INFORMATION` handle per process on a detailed snapshot and
+no remote memory access at all; an identity snapshot opens nothing. What this
+does not narrow is _which_ processes are asked — a detailed scan still queries
+every pid, including `lsass.exe`. Restricting the command-line pass to Orca's own
+subtree needs job-object membership as its source of truth (a ppid-derived
+allowlist would miss the detached, reparented descendants of #9045 and #10475),
+and remains unclaimed work.
 
 ### Encoded, policy-bypassing PowerShell
 
@@ -166,7 +191,8 @@ What remains is `-EncodedCommand` without the bypass: the PTY bootstraps
 `src/main/providers/windows-shell-args.ts`), the hook wrappers
 (`src/main/agent-hooks/windows-powershell-hook-launcher.ts` and its callers
 `src/main/agent-hooks/runtime-home-hook-command.ts`,
-`src/main/agent-hooks/installer-utils.ts`, `src/main/claude/hook-settings.ts`),
+`src/main/agent-hooks/installer-utils.ts`, and `src/main/claude/hook-settings.ts`
+— that last one only as a *fallback* since #18875, see below),
 `src/main/runtime/windows-default-route-interfaces.ts`,
 `src/main/runtime/orchestration/setup-completion-signal.ts`,
 `src/shared/hermes-startup-query.ts`, and the four ex-bypass sites above.
@@ -231,7 +257,8 @@ obfuscated-command-line detector is tuned on.
 
 ### The spawn tree itself
 
-`Orca.exe` → `orca-terminal-daemon.exe` → a shell → an agent CLI is what a
+`Orca.exe` → the relocated daemon host (`orca-terminal-daemon.exe` in the builds
+these incidents cover, `Orca.exe` since) → a shell → an agent CLI is what a
 terminal multiplexer for coding agents *is*. `reg.exe` appears from
 `src/main/win32-utils.ts`,
 `src/main/agent-hooks/managed-hook-owner-identity.ts` and
@@ -242,6 +269,41 @@ breadth: every interpreter hop between Orca and the thing the user asked for add
 a scored edge, which is why the shipped doctrine of #15520 and #15595 is to
 *shorten the interpreter chain* rather than to hide a window.
 
+#18875 is a worked example of that doctrine. The Claude Code lifecycle hook was
+registered as `powershell.exe -NoProfile -EncodedCommand <...>` whose entire
+decoded payload was a `Test-Path` and a call to `~/.orca/agent-hooks/claude-hook.cmd`.
+It now registers the script path itself (`<path> || echo {}`), so `bash ->
+powershell -> cmd -> curl` became `bash -> cmd -> curl` and one
+`powershell.exe -EncodedCommand` per hook event — a first-class Defender alert
+title — leaves the tree. The reporting box fired ~6 900 of them in five days,
+70% from Claude sessions that were not running under Orca at all and whose hook
+exits at its first `ORCA_PANE_KEY` guard.
+
+What is measured is latency and the hop count, nothing else: median 471 ms ->
+213 ms per event idle, and 656 ms -> 296 ms (p95 696 ms -> 337 ms) under 10-way
+concurrency, invoked as Claude Code invokes it. **No EDR verdict on either tree
+was measured**, so claim the removed `-EncodedCommand` spelling and the shorter
+chain, not a score. `cmd.exe` remains in the tree, spelled by MSYS's own `.cmd`
+spawn rather than by us — the doc's one "unavoidable for `.cmd`/`.bat`" case,
+carrying an absolute path and two literal tokens, with no caret escaping, no
+encoding and no free text. The encoded launcher is still the shape for profile
+paths the shells cannot carry bare (a space, `%`, `^`, `&`, non-ASCII, a UNC
+profile) and for hosts where Git Bash is not resolvable, because PowerShell 5.1
+rejects `||` (measured: parse error, exit 1).
+
+That last clause is the standing assumption of this change, and it is worth
+stating plainly because it is **not** measured. `||` parses in Git Bash, cmd.exe
+and pwsh, but not in Windows PowerShell 5.1, so the direct shape is correct for
+any host that is one of the first three. Claude Code itself is a Git Bash host on
+native Windows. What no one here has verified is which host a *compat consumer*
+uses: cursor-agent and Devin import `~/.claude/settings.json` and run `command`
+through their own launcher (the managed `.cmd` carries a `DEVIN_PROJECT_DIR` skip
+for exactly that). If one of them spawns hook strings through Windows PowerShell
+5.1, its imported Claude events become a parse error with empty stdout, which is
+the fail-closed case #14818 exists to prevent. The encoded launcher had no such
+assumption — it was a `powershell.exe` invocation and therefore parsed anywhere.
+Before widening the direct shape to another agent, measure that consumer's host.
+
 ### Computer use: screen capture, synthetic input, runtime-compiled MSIL
 
 `native/computer-use-windows/runtime.ps1` is a large PowerShell script.
@@ -327,7 +389,7 @@ The checklist. On Windows, do not reach for:
 | Forking `powershell.exe` to read system state               | The native reader — [`windows-process-enumeration.md`](./windows-process-enumeration.md) is the standing rule for the process table |
 | A process per operation in a loop                           | One long-lived helper with a request channel. A burst of short-lived interpreters under one parent is itself the signal     |
 | `Add-Type -TypeDefinition` at runtime                       | A precompiled, signed assembly, or a native helper                                                                          |
-| Copying our own image under a different name                | An installer or updater that does not need the rename. Where the rename is load-bearing, document it as such                |
+| Copying our own image under a different name                | Copy it verbatim — [`windows-daemon-host-relocation.md`](./windows-daemon-host-relocation.md) (done for the daemon host)    |
 | Deriving a script runner from a UI preference               | [`windows-setup-shell.md`](./windows-setup-shell.md) — the script declares its own interpreter                              |
 
 Two framing rules that outlast the table:
diff --git a/docs/reference/windows-process-enumeration.md b/docs/reference/windows-process-enumeration.md
index 87ac2a97fb1..34afb56c8e6 100644
--- a/docs/reference/windows-process-enumeration.md
+++ b/docs/reference/windows-process-enumeration.md
@@ -16,38 +16,193 @@ table. It wraps a Toolhelp32 snapshot from `@vscode/windows-process-tree`.
 
 ```ts
 import {
+  readWindowsProcessIdentityTable,
+  readWindowsProcessIdentityTableFresh,
   readWindowsProcessTable,
   readWindowsProcessTableFresh
 } from '../windows/windows-process-table'
 ```
 
-- `readWindowsProcessTable()` — shared TTL cache. Use for anything periodic.
-- `readWindowsProcessTableFresh()` — a snapshot that starts after the call. Use
-  for teardown identity, where a cached row can predate the exit it is being
-  asked about.
+Each pair is a shared TTL cache plus a `Fresh` variant that starts its scan
+after the call. Use `Fresh` for teardown identity, where a cached row can
+predate the exit it is being asked about, and the cached one for anything
+periodic.
 
-Both **reject** when the table cannot be read. Do not convert that into an empty
-array. An empty table is a claim that nothing is running, and callers act on
-that claim by declaring a tree dead or a shell childless. "Unavailable" has to
-stay distinguishable from "empty" — collapsing the two is how a PTY tree
+All four **reject** when the table cannot be read. Do not convert that into an
+empty array. An empty table is a claim that nothing is running, and callers act
+on that claim by declaring a tree dead or a shell childless. "Unavailable" has
+to stay distinguishable from "empty" — collapsing the two is how a PTY tree
 survived its own teardown (#9045).
 
-Measured on Windows 11 with 1050 processes (p50 / p95):
+## Two flag sets: ask for a command line only if you read one
+
+Neither flag is a wider column on the same query. Each is a separate
+per-process syscall sequence, and they are not equally expensive to the EDR
+watching:
+
+- `CommandLine` (`process_commandline.cc`) —
+  `OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION)`, then
+  `NtQueryInformationProcess(ProcessCommandLineInformation)` twice: once to size
+  the buffer, once to fill it. The kernel builds the string, so no address space
+  is opened or read. It used to walk the target's PEB with three chained
+  `ReadProcessMemory` calls; the patched addon no longer contains that primitive.
+- `Memory` (`process.cc`) — retired. It took a **second** `OpenProcess`, and that
+  one carried `PROCESS_VM_READ`, which it acquired and never used.
+
+Measured here (541 processes, 405 openable), per detailed scan, before → after
+dropping `Memory`: `OpenProcess` 1082 → 541. That halving is all the `Memory`
+drop bought on its own — both handles carried `PROCESS_VM_READ` at the time, so
+it moved the PEB traffic not at all. Replacing the PEB walk with the kernel
+query is what took `PROCESS_VM_READ` and `ReadProcessMemory` out of the addon
+altogether; the two changes compose, and neither substitutes for the other.
+
+So be precise about what these two flag sets buy now. A detailed scan is one
+`OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION)` per process and no memory
+access at all. What the split buys on top of that is the handle itself: an
+identity scan opens nothing.
+
+So the module exposes two snapshots, and the row types differ so a cheap caller
+cannot read what its flag set did not pay for:
+
+| reader                                     | row type                     | flags                       | per-process handles |
+| ------------------------------------------ | ---------------------------- | --------------------------- | ------------------- |
+| `readWindowsProcessIdentityTable[Fresh]()` | `WindowsProcessIdentityRow`  | `None \| CreationTime`      | none                |
+| `readWindowsProcessTable[Fresh]()`         | `WindowsProcessRow`          | `+ CommandLine`             | one `OpenProcess`   |
+
+`Memory` is requested by neither. Nothing reads a working set off this table —
+`windows-process-resource-collector.ts` runs its own sweep because it needs
+commit and CPU counters in the same pass, and the addon stores `WorkingSetSize`
+into a `DWORD` so anything above 4 GB wraps anyway.
+
+Measured on Windows 11 with 492 processes (p50 / p95):
 
 |                                  | p50     | p95     |
 | -------------------------------- | ------- | ------- |
-| pid + ppid + name                | 15.9 ms | 17.5 ms |
-| + memory + command line          | 30.6 ms | 33.7 ms |
+| identity (pid + ppid + name)     | 6.3 ms  | 7.0 ms  |
+| detailed (+ command line)        | 12.3 ms | 13.4 ms |
+| _retired_ (+ memory)             | 13.1 ms | 14.1 ms |
 | `Get-CimInstance` via PowerShell | 706 ms  | 723 ms  |
 
-Those are the module's published figures. The flag set this module actually
-requests is `CommandLine | CreationTime` — **not** `Memory`, which cost a second
-`OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ)` plus
-`GetProcessMemoryInfo` per process (`src/process.cc:47-63`) for a value nothing
-read. Dropping it halves the handles a snapshot opens. The remaining set sits
-between the two rows above and has not been measured separately; on a real
-Windows host, `Get-Counter '\Process(Orca)\Handle Count'` sampled across a
-snapshot cadence is the check.
+There are exactly **two** caches, never one per caller. The fan-out this module
+exists to prevent is one scan per _caller_, and each reader still serves every
+caller wanting its flag set, so a 32-wide teardown still collapses into one scan
+of each. A third cache would need a third flag set, not a third caller.
+
+### Only one native read may be in flight, ever
+
+This is the price of having two flag sets, and it is not optional.
+
+The npm wrapper **coalesces rather than queues**. `getRawProcessList` pushes the
+callback onto one list and calls the addon only when no request is in progress,
+so a second concurrent caller's `flags` are **discarded** and it is handed the
+first caller's rows. Measured against the real addon: issue identity first, both
+callers get the same array, 0 of 541 rows carry a command line. A detailed read
+that overlaps an identity read therefore returns a table with **every command
+line empty**, and agent recognition reads that as "no agent" — silently, and
+only under concurrency.
+
+Nothing else in this module prevents that. Each snapshot cache single-flights
+only within itself (`inFlight` is a closure per reader), and the wedge set
+latches only *after* a read misses its 3 s deadline, so through the healthy
+~12 ms of a scan neither excludes the other. Overlap is the normal state rather
+than an edge case: other panes keep polling detailed at 750 ms while a teardown
+takes identity snapshots, and `codex-structured-turn-processes.ts` issues fresh
+detailed scans on turn stop.
+
+`nativeReadGate` serializes every native read across both flag sets. It is also
+what makes the relay's bare addon safe: `adaptAddon` has no queue at all, and
+two simultaneous `CreateToolhelp32Snapshot` calls are the crash the vendor's
+queue exists to prevent. Every link settles — a wedged read still rejects on its
+deadline — so a waiter is never stranded; it re-checks the wedge and rejects.
+
+Because only one native call is ever outstanding, the wedge gate and the 3 s
+deadline stay **shared** and retention stays bounded at exactly one callback,
+not one per reader. Read ids are module-global and monotonic, so a late callback
+can only clear its own wedge.
+
+`resetNativeReaderState` **chains** onto the gate rather than replacing it. A
+replacement would let a waiter still holding the old chain run beside a read
+queued on the new one; every link settles within the deadline, so chaining costs
+a bounded wait and keeps the exclusion whole. That path is test-only, which is
+exactly why it matters — it would otherwise hand a suite two concurrent calls
+into its own mock, the condition these tests exist to detect.
+
+### Testing this module: assert a positive property, on the right mock
+
+Three defects have now shipped in this file's tests, all the same shape — a case
+that passed for a reason other than the one it claimed to check:
+
+1. A loader that built a **fresh mock per call**, so the coalescing it was meant
+   to reproduce could never happen.
+2. An identity-side assertion of only `!('command' in row)`, which a correctly
+   flagged read and a coalesced one satisfy equally, so the test would go green
+   on the very regression it guards.
+3. A concurrency assertion placed on the **coalescing** mock, whose own
+   `requestInProgress` latch means it can never report more than one call in
+   flight — so it held whether or not this module excluded anything, and passed
+   against a read gate that had genuinely lost exclusion.
+
+The third arrived in the fix for the first two, which is the point: this is not a
+mistake you make once.
+
+So: assert what each flag set **did** get, not only what it lacks, and put those
+assertions in the helper both orderings run through, or the reverse order keeps
+the blind spot. The identity set is checked on `creationTimeMs` because that is
+the field it exists to carry. Keep both that check and the flags-array check —
+they catch **different** failures and neither is redundant. The flags array
+catches a read served another flag set's rows (the coalescing bug); the
+positional `creationTimeMs` check catches field shaping — identity dropping
+`CreationTime` from its flags, or `toIdentityRow` failing to forward it — which
+no flags assertion would notice.
+
+And pick the mock to match the claim. The coalescing mock models the npm
+wrapper's queue semantics and is the only place to assert those. Concurrency has
+to be measured against the bare-addon mock, which has no queue and so makes
+re-entry observable.
+
+With no native binding there is only one scan to run and it is the 1.4 s
+PowerShell one, so the identity view rides the detailed snapshot — projected
+through `toIdentityRow`, so an identity row carries no command line on any host.
+
+### Which callers need which
+
+| caller                                        | reads              | flag set |
+| --------------------------------------------- | ------------------ | -------- |
+| `windows-agent-foreground-process.ts`         | `command` (agent recognition) | detailed |
+| `local-workspace-platform-port-scanner.ts`    | `command` (port attribution)  | detailed |
+| `codex-structured-turn-processes.ts`          | `command` (turn-process identity) | detailed |
+| `structured-tui-process-identity.ts`          | `command` (child match)       | detailed |
+| `windows-pty-root-identity.ts`                | `pid` / `ppid` only           | identity |
+| `agent-session-process-identity-probe.ts`     | `creationTimeMs` only         | identity |
+| `relay/windows-port-scan.ts`                  | `name` (port owner label)     | detailed |
+
+`windows-port-scan.ts` is the one mismatch in the table: it reads only `pid` and
+`name`, which the identity set answers, but it calls the detailed reader. On a
+host with a live pane that costs nothing extra — the detailed snapshot is
+already cached — and on a headless relay it pays for a command line no caller
+reads. Left as-is deliberately, because moving it to identity would trade that
+for a second scan whenever a pane is polling; revisit if the relay ever scans
+ports without one.
+
+The per-pane foreground tracker is the hot one (750 ms / 2 s cadence) and it
+genuinely needs the command line, so the repeating per-process `OpenProcess` is
+not something the split removes. What the split removes is that handle from
+teardown identity and from the owner probe, which now open nothing.
+
+### `creationTimeMs` does not exist on any shipped build
+
+Nothing in the repo supplies a `CreationTime` flag. The package enum is
+`None`/`Memory`/`CommandLine`, `process_worker.cc` emits no `creationTimeMs`,
+the vendored patch adds none, and `adaptAddon`'s `PROCESS_DATA_FLAG` lacks the
+bit. So `creationTimeMs` is always `undefined` in production and
+`isWindowsProcessStartTimeAvailable()` is always `false` — a latent product gap
+that predates the split and needs its own owner.
+
+Two consequences. `IDENTITY_PROJECTION.flags` evaluates to `0` today, so the
+identity reader really does open zero handles. And
+`agent-session-process-identity-probe.ts` early-returns on
+`isWindowsProcessStartTimeAvailable()` rather than scanning the whole table to
+produce `null`. Do not build anything on Windows start time working.
 
 Those CIM numbers are from a 1050-process host. The scan scales with process
 count: on a 1486-process Windows SSH host it measured **1.36 s** and produced
@@ -189,7 +344,7 @@ on any other OS keeps using the scan.
 
 ## Why the package is patched
 
-`config/patches/@vscode__windows-process-tree@0.8.0.patch` carries three hunks.
+`config/patches/@vscode__windows-process-tree@0.8.0.patch` carries four hunks.
 
 1. **Spectre mitigation.** The upstream `binding.gyp` requires Spectre-mitigated
    libraries, which Orca's Windows build agents do not install. `node-pty` is
@@ -204,10 +359,122 @@ on any other OS keeps using the scan.
    realpath, then loads the relative path from the `node_modules` symlink, so
    `node_addon_api.gyp` resolves outside the repo and hourly Windows builds
    die at configure. `node-pty` is patched the same way for the same reason.
+4. **No PEB reads, no `PROCESS_VM_READ`.** See below.
 
 The typings claim `commandLine` is truncated at 512 characters. Measured, it is
 not: the longest observed on a real host was 26,059.
 
+### The command line comes from the kernel, not the target's memory
+
+Upstream, `GetProcessCommandLine` opens every process with
+`PROCESS_QUERY_INFORMATION | PROCESS_VM_READ` and issues three chained
+`ReadProcessMemory` calls — PEB, `RTL_USER_PROCESS_PARAMETERS`, then the string
+— to recover the command line. Walking another process's address space for
+credentials-adjacent data on a repeating timer is what a credential dumper does,
+so Defender for Endpoint scores it as such regardless of intent. Nothing about
+the flag sets above changes that; only removing the read does.
+
+Windows 8.1 added `NtQueryInformationProcess`'s `ProcessCommandLineInformation`
+class (60), which returns the same string as a `UNICODE_STRING` the kernel
+builds, needing only `PROCESS_QUERY_LIMITED_INFORMATION`. Electron's floor is
+Windows 10, so every OS Orca supports has it. The entry point is resolved with
+`GetProcAddress` on `ntdll.dll` — it has no import library — and the size is
+probed with a null-buffer call that answers `STATUS_INFO_LENGTH_MISMATCH`.
+
+The same hunk drops `PROCESS_VM_READ` from `GetProcessMemoryUsage` and
+`GetCpuUsage`, which acquired it and never read an address space:
+`GetProcessMemoryInfo` and `GetProcessTimes` are satisfied by
+`PROCESS_QUERY_LIMITED_INFORMATION`. Measured, both return identical values
+under the weaker right on every process that opens at all.
+
+Measured on Windows 11, ~540 processes, counted in-process by replacing the
+addon's import table entries with counting stubs:
+
+| per `CommandLine` scan | before                                    | after                                  |
+| ---------------------- | ----------------------------------------- | -------------------------------------- |
+| `OpenProcess` calls    | 543                                       | 543                                    |
+| desired access         | `0x0410` (`VM_READ \| QUERY_INFORMATION`) | `0x1000` (`QUERY_LIMITED_INFORMATION`) |
+| `ReadProcessMemory`    | 1128                                      | **0**                                  |
+| p50 / p95              | 13.5 / 14.5 ms                            | 12.3 / 13.5 ms                         |
+
+Command lines were byte-identical on every process both readers recovered
+(405/405, and 399/399 and 376/376 on other runs), including a 24,087-character
+argv with embedded quotes, non-ASCII characters and trailing whitespace, and a
+WOW64 target. The weaker right is also a strict superset in reach: three
+processes that refused `PROCESS_QUERY_INFORMATION | PROCESS_VM_READ` granted
+`PROCESS_QUERY_LIMITED_INFORMATION`, and none went the other way.
+
+### There is no PEB fallback, deliberately
+
+An earlier revision kept the PEB reader for a kernel without class 60, behind a
+latch. That was wrong, and the reason is worth recording: `ClassifyQueryFailure`
+mapped `STATUS_INVALID_INFO_CLASS` / `NOT_SUPPORTED` / `NOT_IMPLEMENTED` from
+**any single target** onto a process-wide, one-way switch back to
+`PROCESS_VM_READ` plus three `ReadProcessMemory` per pid per scan, for the life
+of the process, with nothing observable from JS.
+
+The environment this reader exists for is one where an EDR hooks `ntdll`. A hook
+that returns `STATUS_INVALID_INFO_CLASS` for a class it does not recognise would
+have silently reinstated the exact primitive the patch removes, on precisely the
+machines it was written for — and one stray status from one process was enough.
+The same applies under Wine or any instrumented `ntdll`.
+
+So the fallback is gone rather than guarded. `GetProcessCommandLine` returns
+false and leaves the command line empty, which is already a normal outcome
+(`WindowsProcessRow.command` is documented as empty when a process denies a
+query handle, and callers fall back to the image name). Degrading to no command
+line is recoverable; silently resuming address-space reads is not.
+
+This also makes the property checkable on the artifact rather than the source:
+the patched reader never calls `ReadProcessMemory`, so the symbol is absent from
+the compiled addon's import table. `inspectWindowsProcessTreeAddon()` in
+`config/scripts/windows-process-tree-gyp-rebuild.mjs` is that check, and it is
+the only way to tell the two binaries apart — see below. It answers
+`clean` / `unpatched` / `missing` rather than a boolean, because a binary that is
+not there has not been cleared, and a caller reading `false` as “verified” would
+pass exactly the thing the check exists to catch.
+
+Because the returned `UNICODE_STRING` comes from that same hookable boundary,
+its `Buffer` and `Length` are bounds-checked against the allocation before the
+characters are encoded, and the probed size is capped at the header plus 64 KiB
+(`Length` is a `USHORT`) so a bogus size cannot turn into a `bad_alloc` that
+fails an entire scan instead of one process.
+
+### The published tarball ships a loadable unpatched prebuilt
+
+`@vscode/windows-process-tree@0.8.0` publishes
+`build/Release/windows_process_tree.node` in the tarball. It is node-addon-api,
+so it is ABI-stable and loads cleanly under both Node and Electron — and it was
+built from unpatched source, so it performs 1179 `ReadProcessMemory` calls and
+opens every process at `0x0410` per scan.
+
+That matters because `allowBuilds` is `false` for this package and CI installs
+with `--ignore-scripts`, so nothing compiles it at install time. A `require()`
+health check cannot tell the two binaries apart, and a rebuild that is skipped —
+`rebuild-native-deps.mjs` soft-exits 0 on a Windows file lock during postinstall
+— leaves the upstream prebuilt in place and cached.
+
+Four checks close that, all keyed on the absent `ReadProcessMemory` import:
+
+- `ensureWindowsProcessTreeCommandLinePatch()` deletes a binary that still has
+  it, so a skipped rebuild fails loudly instead of using the prebuilt;
+- `ensure-native-runtime.mjs` treats such a binary as a load failure, which is
+  what triggers the rebuild;
+- the relay build asserts it on the artifact it just produced;
+- `loadWindowsProcessTree()` asserts it again on the addon staged beside a relay
+  bundle and refuses to bind one that still imports the symbol, falling back to
+  the CIM scan. The build-time assertion is not enough on its own: a bundle and
+  the addon beside it redeploy independently, so a host that has not taken a new
+  bundle keeps whatever `.node` is already there.
+
+What none of this does is narrow _which_ processes are asked. A detailed scan
+still queries every pid, including `lsass.exe`; it now asks with the same right
+Task Manager uses instead of `PROCESS_VM_READ`. Restricting the command-line
+pass to Orca's own subtree is the complementary change, and it belongs with the
+identity/detailed reader split rather than here — a ppid-derived allowlist would
+miss exactly the detached, reparented descendants the trackers exist to find
+(#9045, #10475), so it needs the job-object membership as its source of truth.
+
 ## Packaging
 
 The addon is Windows-only, so it follows the same contract as
@@ -221,6 +488,10 @@ The addon is Windows-only, so it follows the same contract as
   `ensure-native-runtime.mjs`;
 - copied into the packaged `node_modules` for win32 only.
 
+The relay's copy is a separate artifact staged beside the bundle, so a relay host
+only picks up a rebuilt addon on redeploy. Until then it keeps whatever binary it
+already has, which is why the addon is checked again at load.
+
 ## What the snapshot does not provide
 
 `CreationDate` (process start time) has no equivalent. Anything using a start
@@ -229,9 +500,10 @@ ownership, and CPU accounting in the memory collector — still reads it through
 its own query. Those callers are not migrated.
 
 Committed private bytes have no equivalent either, and the one memory value the
-snapshot _can_ carry is unusable for the sizes Orca now sees: `process.cc` stores
-`pmc.WorkingSetSize` into a `DWORD`, so anything above 4 GB wraps. That is the
-second reason `windows-process-resource-collector.ts` still runs its own
+addon can produce is unusable for the sizes Orca now sees: `process.cc` stores
+`pmc.WorkingSetSize` into a `DWORD`, so anything above 4 GB wraps — which is why
+neither flag set asks for it. That is the second reason
+`windows-process-resource-collector.ts` still runs its own
 `Get-CimInstance` sweep — it needs `PageFileUsage` (commit) and the CPU-time
 counters in the same pass. Migrating it to the native table would cost both, and
 it is why this module no longer sets the `Memory` flag at all: the field had no
diff --git a/docs/reference/windows-signing-runner-time.md b/docs/reference/windows-signing-runner-time.md
new file mode 100644
index 00000000000..fb02ba6bdca
--- /dev/null
+++ b/docs/reference/windows-signing-runner-time.md
@@ -0,0 +1,137 @@
+# Windows signing without occupying a runner during approval
+
+Status: implementation proposal; production signing behavior is unchanged.
+
+## Measured cost
+
+In [release run 33821033674](https://github.com/stablyai/orca/actions/runs/33821033674)
+(September 4, 2026), the Windows job took 21m56s. The inner-binary download step
+took 13m19s and the installer download step took 40s: 13m59s, or 64% of the job,
+was spent in the signing download/wait steps. These durations include the
+download itself, so they are an upper bound on removable idle time, not a
+prediction of net savings after transferring state between jobs.
+
+`release-cut.yml` submits both requests with `wait-for-completion: false`, but
+then invokes `Get-SignedArtifact` on the same Windows runner with one-hour and
+four-hour completion timeouts. The six-hour job timeout accommodates both
+waits. Changing the submission flag again, polling less often, or running the
+wait inside a container does not release the runner slot.
+
+This is runner occupancy, not a billing estimate. Standard GitHub-hosted
+runners in a public repository may be free; removing the waits still releases
+concurrency for other work. Check actual billing before assigning dollar savings.
+
+The same release also occupied an Ubuntu runner for 11m38s while
+`run-release-mac-build-workflow.mjs` waited on the isolated macOS workflow.
+That is a separate orchestration optimization. Windows development-channel
+builds deliberately ship unsigned and have no SignPath wait to remove.
+
+## Proposed execution graph
+
+Keep all Windows stages in the original `release-cut.yml` run to preserve the
+current SignPath GitHub artifact provenance boundary:
+
+1. `build-windows` builds and uploads the unpacked app, original installer,
+   updater metadata, and inner-signing manifest. It submits the inner request,
+   sends the existing notification, exposes the request ID, and finishes.
+2. `package-windows` depends on that job and uses a protected environment named
+   `windows-inner-signing`. Its runner is allocated only after GitHub approval.
+   It restores the exact build, downloads the signed binaries with a short,
+   bounded completion wait, applies the existing signature restoration and
+   signed `elevate.exe` cache replacement, builds the NSIS installer, uploads it,
+   submits the second signing request, notifies approvers, and finishes.
+3. `finalize-windows` depends on packaging and uses a second protected environment
+   named `windows-installer-signing`. After approval it downloads the signed
+   installer, regenerates its blockmap and `latest.yml`, runs existing outer and
+   inner signature checks, uploads evidence, and uploads the assets to the draft.
+4. `publish-release` depends on finalization as well as the existing Linux, macOS,
+   and blocking release gates. It remains the only job that publishes the draft.
+
+The approver signs in SignPath, waits for that request to finish, and then
+approves the corresponding pending GitHub job. Each notification should link
+to both places and explain the order. GitHub approval is an extra action;
+approving in SignPath alone does not release an environment gate.
+
+## Required configuration
+
+The repository environments were inspected through the GitHub API on
+September 5, 2026. Neither Windows environment exists. `adhoc-mac-build` has no
+protection rules; it cannot be reused as an approval gate. No SignPath callback
+handler was found in the repository's workflows, scripts, application, or cloud
+code.
+
+Before enabling the graph:
+
+1. Create both environments in repository Settings → Environments.
+2. Add the release approvers as required reviewers for each environment. Decide
+   whether a release initiator may approve their own job, and configure that
+   consistently with the existing SignPath policy.
+3. Restrict deployment branches to the trusted refs used to dispatch release
+   workflows, and check that the release workflow's ref passes the restriction.
+   The workflow ref and the checked-out release tag are different concepts.
+4. Read back both environments through the API and verify that
+   `required_reviewers` rules exist before changing the release graph. Merely
+   referring to a new environment name in YAML can create an unprotected
+   environment and silently leave the wait on the runner.
+5. Add a preflight assertion for those rules so accidental removal fails before
+   any signing request is submitted. Verify the API access required for this
+   assertion using the release workflow's token; do not assume an administrator's
+   local `gh` access proves workflow-token access.
+
+An automatic alternative requires a SignPath completion callback and an
+authenticated integration that releases the corresponding deployment gate.
+Confirm the Foundation plan supports the necessary callback before choosing
+that architecture. Do not introduce a long-running GitHub polling job as the
+callback substitute: it would continue occupying a slot.
+
+## State and failure contracts
+
+- Use artifacts from this exact run and attempt, with a manifest containing the
+  tag, tag commit SHA, workflow SHA, request IDs, artifact IDs, and SHA-256 hashes.
+  Artifact names alone are insufficient. Preserve the original unsigned
+  installer for the existing inner-signing fallback.
+- Restore `dist/win-unpacked`, the staging list, the installer, and updater
+  metadata as one checkpoint. Use an archive to preserve the tree. Do not ship
+  a fresh rebuild of the app after approving a different binary tree.
+- Each new Windows runner needs the pinned Node/pnpm toolchain, build
+  dependencies, SignPath module, and electron-builder tool cache. The second
+  runner must populate the NSIS cache before replacing `elevate.exe`; the old
+  code assumes the first installer build already populated that cache.
+- Retain checkout-from-tag behavior and the existing support for release tags
+  that predate the composite action. Explicitly restore new orchestration code
+  from the workflow SHA when necessary.
+- Preserve the rule that rerunning a workflow never submits a new signing
+  request. A resume must consume the recorded request and artifacts. Test failed
+  stage reruns, whole-workflow reruns, and missing/expired checkpoints separately.
+- Keep installer signature checks blocking. Keep inner verification evidence
+  and its current warning-only policy unless changed in a separate decision.
+- Resolve the current one-hour inner-signing fallback deliberately: an
+  environment approval can remain pending longer than one hour and rejection
+  skips dependent jobs. It cannot reproduce the existing automatic timeout
+  fallback by itself. A first migration should explicitly document the new
+  manual release/cancellation behavior; silently treating rejected approval as
+  permission to ship is not acceptable.
+- Keep the release-wide concurrency lock while the graph waits, preventing
+  another release from overtaking this draft. This saves worker occupancy, but
+  does not shorten the serialized release queue's human approval time.
+
+## Validation before production
+
+First adapt `windows-signing-rehearsal.yml` to exercise the same staged code
+using the auto-approved test-signing policy. Then run a manual rehearsal with
+the protected environments and confirm that pending approval has no allocated
+Windows runner. Verify signed bytes through the existing extraction-based
+installer checks, not only the outer installer signature.
+
+Cover approval before SignPath completion, rejected approval, missing signed
+files, changed checkpoint hashes, lost checkpoints, expired artifacts, failed
+packaging, and stage reruns without duplicate submissions. Confirm no release
+becomes public until all platform and signature gates pass. Compare transferred
+artifact/setup time with the original 13m59s wait sample to measure net savings.
+
+A separate `workflow_dispatch` continuation can avoid environment provisioning,
+but changes this design substantially: the original release run finishes,
+workflow-level concurrency no longer protects the pending draft, and SignPath
+must accept artifacts assembled from a prior run. That option needs a durable
+release state machine and provenance validation before production use; it is
+not a drop-in replacement for the two download steps.
diff --git a/docs/site/content/docs/browser/profiles.mdx b/docs/site/content/docs/browser/profiles.mdx
index 97286a6cb0c..102dd1e443d 100644
--- a/docs/site/content/docs/browser/profiles.mdx
+++ b/docs/site/content/docs/browser/profiles.mdx
@@ -9,9 +9,7 @@ Browser-use profiles let you run the Orca browser with a specific identity — a
 1. Open [Settings → Browser → Profiles](/docs/settings).
 1. Click **Add profile**, give it a name.
 1. Optionally seed it with cookies, a user-agent, and a viewport size.
-1. For sites that reject Orca's default Chrome-shaped UA (some Google sign-in flows), create a profile that keeps the **native Electron user agent** instead of spoofing. Default profiles still use the cleaned Chrome UA for broader Cloudflare compatibility.
-
-You can also create a no-spoof profile from the CLI with `orca tab profile create --no-ua-spoof` when you script browser setup.
+1. Every profile presents Electron's own user agent. Orca no longer rewrites it to look like Chrome, because Cloudflare Turnstile rejects a Chrome-shaped UA that sends no client hints and accepts a declared Electron client. The only exception is Google's sign-in hosts, where Orca presents a Firefox identity so Google issues cookies bound to the embedded browser. A **native user agent** profile (`orca tab profile create --no-ua-spoof`) also skips that Google exception.
 
 ## Cookie import and Google sign-in
 
diff --git a/docs/site/content/docs/cli/reference.mdx b/docs/site/content/docs/cli/reference.mdx
index 0f24ca34192..5cbf19b82f9 100644
--- a/docs/site/content/docs/cli/reference.mdx
+++ b/docs/site/content/docs/cli/reference.mdx
@@ -63,7 +63,7 @@ List every machine the current Orca host can target and the selector for each on
 orca host list --json
 ```
 
-The result includes this machine, its registered [SSH targets](/docs/ssh), and paired [Remote Orca Servers](/docs/remote-servers). Use `--host local` for this machine, `--host ssh:<target-id>` for an SSH target, and `--environment <server-name>` for a paired server. SSH labels and paired-server names also resolve when they are unique; use the IDs from `host list` when names collide. If you put a machine name on the wrong selector, Orca reports the matching machine and the flag to use instead of returning an empty result.
+The result includes this machine, its registered [SSH targets](/docs/ssh), and paired [Remote Orca Servers](/docs/remote-servers). Use `--host local` for this machine, `--host ssh:<target-id>` for an SSH target, and `--environment <server-name>` for a paired server. SSH rows include the detected remote platform (`linux`, `darwin`, or `win32`) after the target connects; older or disconnected targets report `platform unknown`. They also include `connected` and, when known, the SSH lifecycle `connectionStatus`. SSH labels and paired-server names also resolve when they are unique; use the IDs from `host list` when names collide. If you put a machine name on the wrong selector, Orca reports the matching machine and the flag to use instead of returning an empty result.
 
 ## Runtime commands
 
diff --git a/electron.vite.config.ts b/electron.vite.config.ts
index 4ed4641cde1..90dc637c204 100644
--- a/electron.vite.config.ts
+++ b/electron.vite.config.ts
@@ -253,6 +253,9 @@ export const electronViteConfig: UserConfig = {
           'agent-hooks/managed-agent-hook-controls': resolve(
             'src/main/agent-hooks/managed-agent-hook-controls.ts'
           ),
+          'codex/managed-home-shell-preflight': resolve(
+            'src/main/codex/managed-home-shell-preflight.ts'
+          ),
           // Why: account import mutates the user's macOS Keychain from the CLI.
           'claude-accounts/keychain': resolve('src/main/claude-accounts/keychain.ts')
         },
diff --git a/mobile/app.json b/mobile/app.json
index d5a420cc74b..131e3899396 100644
--- a/mobile/app.json
+++ b/mobile/app.json
@@ -2,7 +2,7 @@
   "expo": {
     "name": "Orca",
     "slug": "orca-mobile",
-    "version": "0.0.47",
+    "version": "0.0.48",
     "orientation": "default",
     "icon": "./assets/icon.png",
     "userInterfaceStyle": "automatic",
diff --git a/mobile/src/components/MobileMarkdown.tsx b/mobile/src/components/MobileMarkdown.tsx
index cc88c01e564..2f5b52cfe18 100644
--- a/mobile/src/components/MobileMarkdown.tsx
+++ b/mobile/src/components/MobileMarkdown.tsx
@@ -192,6 +192,7 @@ function MobileMarkdownInner({ content, fallback = '', textScale = 1, onOpenFile
           return (
             <Text
               key={index}
+              selectable
               style={[styles.heading, block.level <= 2 ? styles.headingLarge : null]}
             >
               {renderInline(block.text, onOpenFile)}
@@ -201,7 +202,9 @@ function MobileMarkdownInner({ content, fallback = '', textScale = 1, onOpenFile
         if (block.type === 'quote') {
           return (
             <View key={index} style={styles.quote}>
-              <Text style={styles.quoteText}>{renderInline(block.text, onOpenFile)}</Text>
+              <Text selectable style={styles.quoteText}>
+                {renderInline(block.text, onOpenFile)}
+              </Text>
             </View>
           )
         }
@@ -223,7 +226,9 @@ function MobileMarkdownInner({ content, fallback = '', textScale = 1, onOpenFile
           return (
             <View key={index} style={styles.codeBlock}>
               {block.language ? <Text style={styles.codeLanguage}>{block.language}</Text> : null}
-              <Text style={styles.codeText}>{block.text}</Text>
+              <Text selectable style={styles.codeText}>
+                {block.text}
+              </Text>
             </View>
           )
         }
@@ -251,7 +256,7 @@ function MobileMarkdownInner({ content, fallback = '', textScale = 1, onOpenFile
               <View style={styles.table}>
                 <View style={styles.tableRow}>
                   {visibleHeaders.map((header, cellIndex) => (
-                    <Text key={cellIndex} style={[styles.tableCell, styles.tableHeader]}>
+                    <Text key={cellIndex} selectable style={[styles.tableCell, styles.tableHeader]}>
                       {renderInline(header, onOpenFile)}
                     </Text>
                   ))}
@@ -259,7 +264,7 @@ function MobileMarkdownInner({ content, fallback = '', textScale = 1, onOpenFile
                 {visibleRows.map((row, rowIndex) => (
                   <View key={rowIndex} style={styles.tableRow}>
                     {visibleHeaders.map((_, cellIndex) => (
-                      <Text key={cellIndex} style={styles.tableCell}>
+                      <Text key={cellIndex} selectable style={styles.tableCell}>
                         {renderInline(row[cellIndex] ?? '', onOpenFile)}
                       </Text>
                     ))}
@@ -290,7 +295,7 @@ function MobileMarkdownInner({ content, fallback = '', textScale = 1, onOpenFile
                         ? '[x]'
                         : '[ ]'}
                   </Text>
-                  <Text style={[styles.listText, listScale]}>
+                  <Text selectable style={[styles.listText, listScale]}>
                     {renderInline(item.text, onOpenFile)}
                   </Text>
                 </View>
diff --git a/mobile/src/components/mobile-markdown-preview-html.ts b/mobile/src/components/mobile-markdown-preview-html.ts
index 8bb5fca0934..a5866b171e6 100644
--- a/mobile/src/components/mobile-markdown-preview-html.ts
+++ b/mobile/src/components/mobile-markdown-preview-html.ts
@@ -204,11 +204,18 @@ function escapeRegExp(value: string): string {
 }
 
 function codePlaceholderPrefix(content: string): string {
-  let prefix = CODE_PLACEHOLDER_PREFIX_BASE
-  while (content.includes(prefix)) {
-    prefix = `${prefix}_`
+  let suffixLength = 0
+  let cursor = 0
+  while ((cursor = content.indexOf(CODE_PLACEHOLDER_PREFIX_BASE, cursor)) !== -1) {
+    cursor += CODE_PLACEHOLDER_PREFIX_BASE.length
+    const suffixStart = cursor
+    while (content[cursor] === '_') {
+      cursor += 1
+    }
+    // One extra underscore keeps the prefix longer than every authored run.
+    suffixLength = Math.max(suffixLength, cursor - suffixStart + 1)
   }
-  return prefix
+  return CODE_PLACEHOLDER_PREFIX_BASE + '_'.repeat(suffixLength)
 }
 
 function protectMarkdownCode(content: string): {
diff --git a/mobile/src/components/mobile-markdown-preview-placeholder.test.ts b/mobile/src/components/mobile-markdown-preview-placeholder.test.ts
new file mode 100644
index 00000000000..f751608af78
--- /dev/null
+++ b/mobile/src/components/mobile-markdown-preview-placeholder.test.ts
@@ -0,0 +1,33 @@
+import { describe, expect, it } from 'vitest'
+import { normalizeMobileMarkdownPreviewHtml } from './mobile-markdown-preview-html'
+
+const marker = '\uE000ORCA_MD_CODE_'
+const suffix = '\uE000'
+
+describe('mobile Markdown code placeholder collisions', () => {
+  it.each([0, 1, 2, 15, 128, 16384])('preserves a literal marker with %i underscores', (length) => {
+    const literal = `${marker}${'_'.repeat(length)}0${suffix}`
+    const input = `${literal} and \`Array<string>\`\n\n\`\`\`html\n<p>literal</p>\n\`\`\``
+    expect(normalizeMobileMarkdownPreviewHtml(input)).toBe(input)
+  })
+
+  it('handles adjacent markers and repeated maximum suffixes', () => {
+    const literal = `${marker}${marker}__0${suffix}${marker}__1${suffix}${marker}_2${suffix}`
+    expect(normalizeMobileMarkdownPreviewHtml(`<p>${literal} and \`<div>\`</p>`)).toBe(
+      `${literal} and \`<div>\``
+    )
+  })
+
+  it('preserves authored markers across generated suffix orders and HTML islands', () => {
+    let seed = 173
+    for (let sample = 0; sample < 500; sample++) {
+      const literals: string[] = []
+      for (let index = 0; index < 8; index++) {
+        seed = (Math.imul(seed, 1664525) + 1013904223) >>> 0
+        literals.push(`${marker}${'_'.repeat(seed % 32)}${index}${suffix}`)
+      }
+      const text = literals.join(' ') + ' and `Array<string>`'
+      expect(normalizeMobileMarkdownPreviewHtml(`<p>${text}</p>`)).toBe(text)
+    }
+  })
+})
diff --git a/mobile/src/home/MobileHomeHostList.tsx b/mobile/src/home/MobileHomeHostList.tsx
index 3907df16f03..41d1f07156d 100644
--- a/mobile/src/home/MobileHomeHostList.tsx
+++ b/mobile/src/home/MobileHomeHostList.tsx
@@ -19,6 +19,7 @@ type MobileHomeHostListProps = {
   hostAttempts: Record<string, number>
   hostLastConnected: Record<string, number | null>
   hostPairingRejected: Record<string, boolean>
+  hostSignedOut: Record<string, boolean>
   hostPaths: Record<string, MobileConnectionPath>
   hostPendingPaths: Record<string, MobileConnectionPath | null>
   hosts: HostCatalogEntry[]
@@ -40,6 +41,7 @@ export function MobileHomeHostList(props: MobileHomeHostListProps) {
         hostAttempts={props.hostAttempts}
         hostLastConnected={props.hostLastConnected}
         hostPairingRejected={props.hostPairingRejected}
+        hostSignedOut={props.hostSignedOut}
         hostPaths={props.hostPaths}
         hostPendingPaths={props.hostPendingPaths}
         hostStates={props.hostStates}
@@ -54,6 +56,7 @@ export function MobileHomeHostList(props: MobileHomeHostListProps) {
       props.hostAttempts,
       props.hostLastConnected,
       props.hostPairingRejected,
+      props.hostSignedOut,
       props.hostPaths,
       props.hostPendingPaths,
       props.hostStates,
@@ -91,6 +94,7 @@ type MobileHomeHostRowProps = Pick<
   | 'hostAttempts'
   | 'hostLastConnected'
   | 'hostPairingRejected'
+  | 'hostSignedOut'
   | 'hostPaths'
   | 'hostPendingPaths'
   | 'hostStates'
@@ -113,7 +117,8 @@ const MobileHomeHostRow = memo(function MobileHomeHostRow(props: MobileHomeHostR
     lastConnectedAt: props.hostLastConnected[item.id] ?? null,
     endpoint: item.endpoint,
     pendingPath: props.hostPendingPaths[item.id] ?? null,
-    pairingRejected: props.hostPairingRejected[item.id] ?? false
+    pairingRejected: props.hostPairingRejected[item.id] ?? false,
+    hostSignedOut: props.hostSignedOut[item.id] ?? false
   })
   const open = useCallback(() => onOpen(item), [item, onOpen])
   const longPress = useCallback(() => onLongPress(item), [item, onLongPress])
diff --git a/mobile/src/home/MobileHomeScreen.tsx b/mobile/src/home/MobileHomeScreen.tsx
index 83cf3de4b8a..7772f5152c6 100644
--- a/mobile/src/home/MobileHomeScreen.tsx
+++ b/mobile/src/home/MobileHomeScreen.tsx
@@ -143,6 +143,7 @@ export function MobileHomeScreen() {
           hostAttempts={data.hostAttempts}
           hostLastConnected={data.hostLastConnected}
           hostPairingRejected={data.hostPairingRejected}
+          hostSignedOut={data.hostSignedOut}
           hostPaths={data.hostPaths}
           hostPendingPaths={data.hostPendingPaths}
           hosts={data.sortedHostCatalog}
diff --git a/mobile/src/home/home-host-connection-projection.ts b/mobile/src/home/home-host-connection-projection.ts
index f8fdfd4bcdf..9a49f6186c4 100644
--- a/mobile/src/home/home-host-connection-projection.ts
+++ b/mobile/src/home/home-host-connection-projection.ts
@@ -5,12 +5,14 @@ export type HomeHostConnectionProjectionEntry = {
   path: MobileConnectionPath
   pendingPath: MobileConnectionPath | null
   pairingRejected: boolean
+  hostSignedOut: boolean
 }
 
 export type HomeHostConnectionProjection = {
   hostPaths: Record<string, MobileConnectionPath>
   hostPendingPaths: Record<string, MobileConnectionPath | null>
   hostPairingRejected: Record<string, boolean>
+  hostSignedOut: Record<string, boolean>
 }
 
 /** Build all host lookup maps while reading each connection entry once. */
@@ -22,16 +24,19 @@ export function projectHomeHostConnections(
   const hostPaths = Object.create(null) as Record<string, MobileConnectionPath>
   const hostPendingPaths = Object.create(null) as Record<string, MobileConnectionPath | null>
   const hostPairingRejected = Object.create(null) as Record<string, boolean>
+  const hostSignedOut = Object.create(null) as Record<string, boolean>
 
-  for (const { hostId, path, pendingPath, pairingRejected } of entries) {
+  for (const { hostId, path, pendingPath, pairingRejected, hostSignedOut: signedOut } of entries) {
     hostPaths[hostId] = path
     hostPendingPaths[hostId] = pendingPath
     hostPairingRejected[hostId] = pairingRejected
+    hostSignedOut[hostId] = signedOut
   }
 
   Object.setPrototypeOf(hostPaths, Object.prototype)
   Object.setPrototypeOf(hostPendingPaths, Object.prototype)
   Object.setPrototypeOf(hostPairingRejected, Object.prototype)
+  Object.setPrototypeOf(hostSignedOut, Object.prototype)
 
-  return { hostPaths, hostPendingPaths, hostPairingRejected }
+  return { hostPaths, hostPendingPaths, hostPairingRejected, hostSignedOut }
 }
diff --git a/mobile/src/home/use-mobile-home-data.ts b/mobile/src/home/use-mobile-home-data.ts
index c77d024158e..6b28354a86d 100644
--- a/mobile/src/home/use-mobile-home-data.ts
+++ b/mobile/src/home/use-mobile-home-data.ts
@@ -179,6 +179,7 @@ export function useMobileHomeData() {
     connectedHosts,
     hostCatalog,
     hostPairingRejected: hostConnectionProjection.hostPairingRejected,
+    hostSignedOut: hostConnectionProjection.hostSignedOut,
     hostPaths: hostConnectionProjection.hostPaths,
     hostPendingPaths: hostConnectionProjection.hostPendingPaths,
     primaryHost,
diff --git a/mobile/src/session/MobileNativeChatMessage.test.ts b/mobile/src/session/MobileNativeChatMessage.test.ts
index 10b96cc3d20..677b76d240c 100644
--- a/mobile/src/session/MobileNativeChatMessage.test.ts
+++ b/mobile/src/session/MobileNativeChatMessage.test.ts
@@ -6,11 +6,21 @@ import type { NativeChatMessage } from '../../../src/shared/native-chat-types'
 
 vi.mock('react-native', async () => {
   const React = await import('react')
+  const Text = ({ children, ...props }: { children?: unknown }): unknown =>
+    React.createElement('Text', props, children)
   return {
+    Animated: {
+      Text,
+      Value: class {
+        setValue(): void {}
+      },
+      loop: (animation: unknown) => animation,
+      sequence: () => ({ start: vi.fn(), stop: vi.fn() }),
+      timing: () => ({ start: vi.fn(), stop: vi.fn() })
+    },
     Image: 'Image',
     Pressable: 'Pressable',
-    Text: ({ children, ...props }: { children?: unknown }) =>
-      React.createElement('Text', props, children),
+    Text,
     View: ({ children, ...props }: { children?: unknown }) =>
       React.createElement('View', props, children),
     StyleSheet: { create: (styles: unknown) => styles, hairlineWidth: 1 }
@@ -21,7 +31,10 @@ vi.mock('lucide-react-native', () => ({
   ArrowUp: 'ArrowUp',
   ChevronDown: 'ChevronDown',
   Copy: 'Copy',
-  SquareChevronRight: 'SquareChevronRight'
+  SquareChevronRight: 'SquareChevronRight',
+  SquareTerminal: 'SquareTerminal',
+  Wrench: 'Wrench',
+  ChevronRight: 'ChevronRight'
 }))
 vi.mock('../components/MobileMarkdown', () => ({ MobileMarkdown: 'MobileMarkdown' }))
 
@@ -45,7 +58,18 @@ describe('MobileNativeChatMessage', () => {
 
   function render(
     message: NativeChatMessage,
-    props: { toolsExpanded?: boolean } = {}
+    props: {
+      toolsExpanded?: boolean
+      structuredActivityUi?: boolean
+      activeTurnIsWorking?: boolean
+      turnExpanded?: boolean
+      turnStatus?: {
+        startedAt: number | null
+        thinking: boolean
+        workedSeconds: number | null
+      } | null
+      onToggleTurn?: () => void
+    } = {}
   ): ReactTestRenderer {
     act(() => {
       renderer = create(createElement(MobileNativeChatMessage, { message, ...props }))
@@ -152,4 +176,96 @@ describe('MobileNativeChatMessage', () => {
     expect(tree.root.findAllByType('ChevronDown' as never)).toHaveLength(1)
     expect(tree.root.findAllByType('SquareChevronRight' as never)).toHaveLength(1)
   })
+
+  describe('structured activity UI', () => {
+    const runningCall = {
+      type: 'tool-call' as const,
+      name: 'Bash',
+      input: { command: 'npm test' },
+      state: 'running' as const
+    }
+    const settledCall = {
+      type: 'tool-call' as const,
+      name: 'Read',
+      input: { file_path: 'a/b.ts' },
+      state: 'completed' as const
+    }
+
+    it('shows the live tool label with a terminal glyph while a command runs', () => {
+      const tree = render(toolMessage([runningCall]), {
+        structuredActivityUi: true,
+        activeTurnIsWorking: true
+      })
+      expect(textIn(tree.root)).toContain('Running npm test')
+      expect(tree.root.findAllByType('SquareTerminal' as never)).toHaveLength(1)
+      expect(tree.root.findAllByType('Wrench' as never)).toHaveLength(0)
+    })
+
+    it('uses the wrench glyph for a non-command tool', () => {
+      const tree = render(
+        toolMessage([
+          { type: 'tool-call', name: 'Read', input: { file_path: 'a/b.ts' }, state: 'running' }
+        ]),
+        { structuredActivityUi: true, activeTurnIsWorking: true }
+      )
+      expect(textIn(tree.root)).toContain('Running Read a/b.ts')
+      expect(tree.root.findAllByType('Wrench' as never)).toHaveLength(1)
+    })
+
+    it('falls back to the collapsed count row once the run settles', () => {
+      const tree = render(toolMessage([settledCall]), {
+        structuredActivityUi: true,
+        activeTurnIsWorking: true
+      })
+      expect(textIn(tree.root)).not.toContain('Running Read a/b.ts')
+      expect(textIn(tree.root)).toContain('1×')
+    })
+
+    it("hides a completed turn's activity until the turn caret discloses it", () => {
+      const collapsed = render(toolMessage([settledCall]), {
+        structuredActivityUi: true,
+        activeTurnIsWorking: false
+      })
+      expect(textIn(collapsed.root)).not.toContain('1×')
+      act(() => collapsed.unmount())
+
+      const disclosed = render(toolMessage([settledCall]), {
+        structuredActivityUi: true,
+        activeTurnIsWorking: false,
+        turnExpanded: true
+      })
+      expect(textIn(disclosed.root)).toContain('1×')
+    })
+
+    it('lets the global Tools toggle reveal a hidden settled run', () => {
+      // Otherwise the composer's Tools control is a no-op on every settled turn.
+      const tree = render(toolMessage([settledCall]), {
+        structuredActivityUi: true,
+        activeTurnIsWorking: false,
+        toolsExpanded: true
+      })
+      expect(textIn(tree.root)).toContain('1\u00d7')
+    })
+
+    it('keeps the bridge lane on its always-visible tool run', () => {
+      const tree = render(toolMessage([settledCall]), { activeTurnIsWorking: false })
+      expect(textIn(tree.root)).toContain('1×')
+      expect(tree.root.findAllByType('Wrench' as never)).toHaveLength(0)
+    })
+
+    it('renders the turn status row under a user message', () => {
+      const tree = render(userMessage([{ type: 'text', text: 'go' }]), {
+        structuredActivityUi: true,
+        turnStatus: { startedAt: Date.now(), thinking: true, workedSeconds: null }
+      })
+      expect(textIn(tree.root)).toContain('Thinking')
+    })
+
+    it('does not render a turn status row without one', () => {
+      const tree = render(userMessage([{ type: 'text', text: 'go' }]), {
+        structuredActivityUi: true
+      })
+      expect(textIn(tree.root)).toEqual(['go'])
+    })
+  })
 })
diff --git a/mobile/src/session/MobileNativeChatMessage.tsx b/mobile/src/session/MobileNativeChatMessage.tsx
index 0a676061e5b..cc6c086b1f3 100644
--- a/mobile/src/session/MobileNativeChatMessage.tsx
+++ b/mobile/src/session/MobileNativeChatMessage.tsx
@@ -1,139 +1,20 @@
 import { memo, useEffect, useRef, useState } from 'react'
 import { Image, Pressable, Text, View } from 'react-native'
 import * as Clipboard from 'expo-clipboard'
-import { ArrowUp, ChevronDown, Copy, SquareChevronRight } from 'lucide-react-native'
-import { diffFromText, diffFromToolCall } from '../../../src/shared/native-chat-diff'
-import type { NativeChatDiffLine as DiffLine } from '../../../src/shared/native-chat-diff'
-import { pairToolBlocks, splitNativeChatBlocks } from '../../../src/shared/native-chat-tool-fold'
-import type { NativeChatToolPair as ToolPair } from '../../../src/shared/native-chat-tool-fold'
-import {
-  createToolInputDisplay,
-  summarizeToolRun,
-  truncateToolDetail
-} from '../../../src/shared/native-chat-tool-summary'
+import { ArrowUp, Copy } from 'lucide-react-native'
+import { splitNativeChatBlocks } from '../../../src/shared/native-chat-tool-fold'
+import { selectActiveToolCall } from '../../../src/shared/native-chat-tool-activity'
 import { isImageRefBlock, isTextBlock } from '../../../src/shared/native-chat-types'
 import type { NativeChatBlock, NativeChatMessage } from '../../../src/shared/native-chat-types'
 import { MobileMarkdown } from '../components/MobileMarkdown'
+import { MobileNativeChatTurnStatus } from './MobileNativeChatTurnStatus'
+import { ToolRun } from './MobileNativeChatToolRun'
+import type { NativeChatTurnStatus } from './use-mobile-native-chat-turn-status'
 import { colors } from '../theme/mobile-theme'
 import { isRenderableImageUri } from './mobile-native-chat-image-preview'
 import { styles, TEXT_SIZE } from './mobile-native-chat-message-styles'
 import { nativeChatMessageText } from './mobile-native-chat-message-text'
 
-const MAX_VISIBLE_TOOL_PAIRS = 6
-const MAX_TOOL_RUN_DIFF_ROWS = 240
-
-function DiffView({ lines }: { lines: DiffLine[] }): React.JSX.Element {
-  return (
-    <View style={styles.diff}>
-      {lines.map((line, i) => (
-        <Text
-          key={i}
-          style={[
-            styles.diffLine,
-            line.kind === 'add' && styles.diffAdd,
-            line.kind === 'del' && styles.diffDel,
-            line.kind === 'meta' && styles.diffMeta
-          ]}
-        >
-          {line.kind === 'add' ? '+' : line.kind === 'del' ? '-' : ' '}
-          {line.text}
-        </Text>
-      ))}
-    </View>
-  )
-}
-
-/** A single inline tool line — `▸ ToolName  preview` — that expands in place to
- *  show the call's diff/input or the result's body. Mirrors the reference design
- *  where tool calls read as flat lines in the conversation, not boxed blocks. */
-function ResultBody({
-  output,
-  isError,
-  diff
-}: {
-  output: string
-  isError?: boolean
-  diff: DiffLine[] | null
-}): React.JSX.Element {
-  if (diff) {
-    return <DiffView lines={diff} />
-  }
-  return (
-    <View style={[styles.toolResult, isError && styles.toolResultError]}>
-      <Text style={styles.mono}>{truncateToolDetail(output)}</Text>
-    </View>
-  )
-}
-
-/** One request: a tool call and its result rendered together as a single
- *  expandable line. `defaultExpanded` lets the group toggle open every line. */
-function ToolLine({
-  pair,
-  defaultExpanded,
-  diffLineLimit,
-  onOpenFile
-}: {
-  pair: ToolPair
-  defaultExpanded: boolean
-  diffLineLimit: number
-  onOpenFile?: (relativePath: string) => void
-}): React.JSX.Element {
-  const [expanded, setExpanded] = useState(defaultExpanded)
-  const { call, result } = pair
-  const name = call ? call.name : 'Result'
-  const inputDisplay = call ? createToolInputDisplay(call.input) : null
-  const preview = inputDisplay?.label ?? result?.output.split('\n')[0]?.slice(0, 80) ?? ''
-  // Why: collapsed tool rows are the common path; defer bounded diff parsing
-  // and detail formatting until the user asks to reveal the detail.
-  const callDiff = expanded && call ? diffFromToolCall(call.name, call.input, diffLineLimit) : null
-  const resultDiff = expanded && result ? diffFromText(result.output, diffLineLimit) : null
-  const callDetail = expanded && inputDisplay && !callDiff ? inputDisplay.formatDetail() : undefined
-  const hasDetail = callDiff !== null || result !== undefined || inputDisplay?.hasDetail === true
-  // The group toggle opens every line at once, bypassing the tap guard, so the
-  // panel has to consult it too — else a detail-less row echoes its own label
-  // under itself and no tap can dismiss it.
-  const showDetail = hasDetail && expanded
-  // A tool that targets a file (Read/Edit/Write…) renders its preview as a
-  // tappable link that opens the file, independent of the line's expand tap.
-  const filePath = inputDisplay?.filePath ?? null
-  const openable = filePath !== null && onOpenFile !== undefined
-  return (
-    <View>
-      <Pressable
-        style={styles.toolLine}
-        onPress={() => hasDetail && setExpanded((v) => !v)}
-        hitSlop={6}
-      >
-        {showDetail ? (
-          <ChevronDown size={15} color={colors.textMuted} strokeWidth={2} />
-        ) : (
-          <SquareChevronRight size={15} color={colors.textMuted} strokeWidth={2} />
-        )}
-        <Text style={styles.toolName}>{name}</Text>
-        {preview ? (
-          <Text
-            style={[styles.toolPreview, openable && styles.toolPreviewLink]}
-            numberOfLines={1}
-            onPress={openable ? () => onOpenFile!(filePath!) : undefined}
-            suppressHighlighting={!openable}
-          >
-            {preview}
-          </Text>
-        ) : null}
-      </Pressable>
-      {showDetail ? (
-        <View style={styles.toolDetail}>
-          {callDiff ? <DiffView lines={callDiff} /> : null}
-          {callDetail ? <Text style={styles.mono}>{callDetail}</Text> : null}
-          {result ? (
-            <ResultBody output={result.output} isError={result.isError} diff={resultDiff} />
-          ) : null}
-        </View>
-      ) : null}
-    </View>
-  )
-}
-
 function Prose({
   block,
   invert,
@@ -150,7 +31,9 @@ function Prose({
     // markdown renderer's light-on-dark palette.
     if (invert) {
       return (
-        <Text style={[styles.userText, { fontSize: TEXT_SIZE * fontScale }]}>{block.text}</Text>
+        <Text selectable style={[styles.userText, { fontSize: TEXT_SIZE * fontScale }]}>
+          {block.text}
+        </Text>
       )
     }
     return (
@@ -180,67 +63,6 @@ function Prose({
   return null
 }
 
-/** A run of a message's tool calls/results, collapsed to a one-line summary that
- *  expands to the individual inline tool lines. `defaultExpanded` lets the global
- *  toolbar toggle drive every run at once while still allowing per-run override. */
-function ToolRun({
-  blocks,
-  defaultExpanded,
-  trailing,
-  onOpenFile
-}: {
-  blocks: NativeChatBlock[]
-  defaultExpanded: boolean
-  trailing?: React.ReactNode
-  onOpenFile?: (relativePath: string) => void
-}): React.JSX.Element {
-  const [open, setOpen] = useState(defaultExpanded)
-  const pairs = pairToolBlocks(blocks, MAX_VISIBLE_TOOL_PAIRS)
-  const diffLineLimit = Math.max(1, Math.floor(MAX_TOOL_RUN_DIFF_ROWS / (pairs.length * 2 || 1)))
-  let callCount = 0
-  for (const block of blocks) {
-    if (block.type === 'tool-call') {
-      callCount++
-    }
-  }
-  callCount ||= pairs.length
-  const summary = summarizeToolRun(blocks)
-  return (
-    <View style={styles.toolRun}>
-      <View style={styles.toolRunHeader}>
-        <Pressable style={styles.toolRunToggle} onPress={() => setOpen((v) => !v)} hitSlop={6}>
-          {open ? (
-            <ChevronDown size={15} color={colors.textMuted} strokeWidth={2} />
-          ) : (
-            <SquareChevronRight size={15} color={colors.textMuted} strokeWidth={2} />
-          )}
-          <Text style={styles.toolRunCount}>{callCount}×</Text>
-          <Text style={styles.toolRunLabel} numberOfLines={1}>
-            {summary || `${callCount} tool ${callCount === 1 ? 'call' : 'calls'}`}
-          </Text>
-        </Pressable>
-        {trailing}
-      </View>
-      {open ? (
-        <View style={styles.toolRunBody}>
-          {pairs.map((pair, i) => (
-            <ToolLine
-              key={i}
-              pair={pair}
-              defaultExpanded={defaultExpanded}
-              diffLineLimit={diffLineLimit}
-              onOpenFile={onOpenFile}
-            />
-          ))}
-          {callCount > pairs.length ? (
-            <Text style={styles.toolPreview}>… {callCount - pairs.length} more tool calls</Text>
-          ) : null}
-        </View>
-      ) : null}
-    </View>
-  )
-}
-
 /** Subtle top-right controls for an agent message: copy its prose, or scroll so
  *  this message's top aligns to the top of the viewport. */
 function AgentControls({
@@ -280,7 +102,13 @@ function MobileNativeChatMessageImpl({
   fontScale = 1,
   messageIndex,
   onScrollToMessage,
-  onOpenFile
+  onOpenFile,
+  turnStatus,
+  turnExpanded,
+  turnKey,
+  onToggleTurn,
+  activeTurnIsWorking,
+  structuredActivityUi = false
 }: {
   message: NativeChatMessage
   toolsExpanded?: boolean
@@ -291,6 +119,18 @@ function MobileNativeChatMessageImpl({
   /** Ask the list to align this message's top to the top of the viewport. */
   onScrollToMessage?: (index: number) => void
   onOpenFile?: (relativePath: string) => void
+  /** This turn's status row, rendered under a user message (desktop parity). */
+  turnStatus?: NativeChatTurnStatus | null
+  /** Whether the turn caret has disclosed this turn's activity. */
+  turnExpanded?: boolean
+  /** Set only when this row's turn has settled and can disclose its activity. */
+  turnKey?: string
+  /** Stable across renders; the row supplies its own key when tapped. */
+  onToggleTurn?: (turnKey: string) => void
+  /** Session-level working state for this message's turn; gates the live tool row. */
+  activeTurnIsWorking?: boolean
+  /** Structured lane only: live tool progress plus the turn-status disclosure. */
+  structuredActivityUi?: boolean
 }): React.JSX.Element {
   const isUser = message.role === 'user'
   const isReasoning = message.role === 'reasoning'
@@ -310,6 +150,20 @@ function MobileNativeChatMessageImpl({
   // tool calls fold into a collapsible run beneath. The user's own messages get
   // an inverted (filled accent) bubble so they stand apart from agent prose.
   const { prose, tools } = splitNativeChatBlocks(message.blocks)
+  const activeCall = structuredActivityUi
+    ? selectActiveToolCall(tools, { activeTurnIsWorking })
+    : null
+  // A completed turn's activity belongs behind the turn-status caret. Leaving the
+  // grouped row visible made a failed child command read as a failed response.
+  // The composer's global Tools toggle still overrides this, or it would silently
+  // do nothing on every settled turn.
+  const settledToolsHidden =
+    structuredActivityUi &&
+    activeCall == null &&
+    activeTurnIsWorking === false &&
+    !turnExpanded &&
+    !toolsExpanded
+  const showToolRun = tools.length > 0 && !settledToolsHidden
 
   const handleCopy = (): void => {
     const text = nativeChatMessageText(message.blocks)
@@ -338,39 +192,52 @@ function MobileNativeChatMessageImpl({
   ) : null
 
   return (
-    <View style={[styles.row, isUser && styles.rowUser]}>
-      <View
-        style={[
-          styles.content,
-          isUser && styles.userBubble,
-          isReasoning && styles.reasoning,
-          copied && styles.copied
-        ]}
-      >
-        {prose.map((block, index) => (
-          <Prose
-            key={index}
-            block={block}
-            invert={isUser}
-            fontScale={fontScale}
-            onOpenFile={onOpenFile}
-          />
-        ))}
-        {tools.length > 0 ? (
-          <ToolRun
-            // Why: a global toggle intentionally resets all per-run/per-line
-            // overrides in one remount, avoiding an effect-driven second render.
-            key={toolsExpanded ? 'expanded' : 'collapsed'}
-            blocks={tools}
-            defaultExpanded={toolsExpanded}
-            trailing={controls}
-            onOpenFile={onOpenFile}
-          />
-        ) : controls ? (
-          <View style={styles.controlsRow}>{controls}</View>
-        ) : null}
+    <>
+      <View style={[styles.row, isUser && styles.rowUser]}>
+        <View
+          style={[
+            styles.content,
+            isUser && styles.userBubble,
+            isReasoning && styles.reasoning,
+            copied && styles.copied
+          ]}
+        >
+          {prose.map((block, index) => (
+            <Prose
+              key={index}
+              block={block}
+              invert={isUser}
+              fontScale={fontScale}
+              onOpenFile={onOpenFile}
+            />
+          ))}
+          {showToolRun ? (
+            <ToolRun
+              // Why: a global toggle intentionally resets all per-run/per-line
+              // overrides in one remount, avoiding an effect-driven second render.
+              key={`${toolsExpanded ? 'expanded' : 'collapsed'}:${turnExpanded ? 'turn' : 'flat'}`}
+              blocks={tools}
+              defaultExpanded={turnExpanded || toolsExpanded}
+              expandChildren={turnExpanded ? false : toolsExpanded}
+              activeCall={activeCall}
+              trailing={controls}
+              onOpenFile={onOpenFile}
+            />
+          ) : controls ? (
+            <View style={styles.controlsRow}>{controls}</View>
+          ) : null}
+        </View>
       </View>
-    </View>
+      {turnStatus ? (
+        <MobileNativeChatTurnStatus
+          startedAt={turnStatus.startedAt}
+          thinking={turnStatus.thinking}
+          workedSeconds={turnStatus.workedSeconds}
+          expanded={turnExpanded ?? false}
+          onToggleExpanded={turnKey && onToggleTurn ? () => onToggleTurn(turnKey) : undefined}
+        />
+      ) : null}
+    </>
   )
 }
 
diff --git a/mobile/src/session/MobileNativeChatOverlay.tsx b/mobile/src/session/MobileNativeChatOverlay.tsx
index 23724300ddf..357a089466e 100644
--- a/mobile/src/session/MobileNativeChatOverlay.tsx
+++ b/mobile/src/session/MobileNativeChatOverlay.tsx
@@ -71,6 +71,7 @@ export function MobileNativeChatOverlay({
         error={session.error}
         agent={controller.nativeChatAgent}
         agentWorking={controller.nativeChatAgentWorking}
+        structuredActivityUi={controller.nativeChatStructured}
         streaming={streaming}
         onStop={controller.handleNativeChatStop}
         ask={controller.nativeChatAsk}
diff --git a/mobile/src/session/MobileNativeChatPromptCard.tsx b/mobile/src/session/MobileNativeChatPromptCard.tsx
new file mode 100644
index 00000000000..470ba2ee8b6
--- /dev/null
+++ b/mobile/src/session/MobileNativeChatPromptCard.tsx
@@ -0,0 +1,74 @@
+import type { AskAnswerSelection, AskPrompt } from '../../../src/shared/native-chat-ask'
+import { MobileNativeChatAsk } from './MobileNativeChatAsk'
+import { MobileNativeChatPermission } from './MobileNativeChatPermission'
+import type { MobileChatPermission } from './mobile-native-chat-permission'
+import { MobileNativeChatQuestion } from './MobileNativeChatQuestion'
+import { mobileChatQuestionKey, type MobileChatQuestion } from './mobile-native-chat-question'
+
+/** The one pending agent prompt shown above the composer: a structured
+ *  AskUserQuestion wins, then a heuristic permission, then a heuristic question.
+ *  The controller owns dismissal (it must survive this subtree unmounting on a
+ *  view toggle); `ask` arrives already nulled while dismissed. */
+export function MobileNativeChatPromptCard({
+  ask,
+  askKey,
+  onDismissAsk,
+  onAnswerAsk,
+  onCancelAsk,
+  permission,
+  onRespondPermission,
+  question,
+  onAnswerQuestion
+}: {
+  ask?: AskPrompt | null
+  askKey?: string | null
+  onDismissAsk?: () => void
+  onAnswerAsk?: (prompt: AskPrompt, selections: AskAnswerSelection[]) => Promise<boolean>
+  onCancelAsk?: () => Promise<boolean>
+  permission?: MobileChatPermission | null
+  onRespondPermission?: (send: string) => Promise<boolean>
+  question?: MobileChatQuestion | null
+  onAnswerQuestion?: (text: string) => Promise<boolean>
+}): React.JSX.Element | null {
+  if (ask) {
+    return (
+      <MobileNativeChatAsk
+        key={askKey ?? 'ask'}
+        prompt={ask}
+        onAnswer={async (selections) => {
+          const accepted = (await onAnswerAsk?.(ask, selections)) ?? false
+          if (accepted) {
+            onDismissAsk?.()
+          }
+          return accepted
+        }}
+        onCancel={async () => {
+          const accepted = (await onCancelAsk?.()) ?? false
+          if (accepted) {
+            onDismissAsk?.()
+          }
+          return accepted
+        }}
+      />
+    )
+  }
+  if (permission) {
+    return (
+      <MobileNativeChatPermission
+        key={JSON.stringify(permission)}
+        permission={permission}
+        onRespond={async (send) => (await onRespondPermission?.(send)) ?? false}
+      />
+    )
+  }
+  if (question) {
+    return (
+      <MobileNativeChatQuestion
+        key={mobileChatQuestionKey(question)}
+        question={question}
+        onAnswer={async (text) => (await onAnswerQuestion?.(text)) ?? false}
+      />
+    )
+  }
+  return null
+}
diff --git a/mobile/src/session/MobileNativeChatSessionOptionPickers.test.ts b/mobile/src/session/MobileNativeChatSessionOptionPickers.test.ts
index 4430c60115a..5a959b870bf 100644
--- a/mobile/src/session/MobileNativeChatSessionOptionPickers.test.ts
+++ b/mobile/src/session/MobileNativeChatSessionOptionPickers.test.ts
@@ -41,6 +41,7 @@ const MODEL_DESCRIPTOR: SessionOptionDescriptor = {
     ]
   },
   valueSource: 'reported',
+  transport: 'catalog',
   settable: true
 }
 
@@ -57,6 +58,7 @@ const EFFORT_DESCRIPTOR: SessionOptionDescriptor = {
     ]
   },
   valueSource: 'dispatched',
+  transport: 'catalog',
   settable: true
 }
 
@@ -66,6 +68,7 @@ const FAST_MODE_DESCRIPTOR: SessionOptionDescriptor = {
   category: 'mode',
   kind: { type: 'boolean', currentValue: false },
   valueSource: 'reported',
+  transport: 'catalog',
   settable: true
 }
 
@@ -227,6 +230,7 @@ describe('MobileNativeChatSessionOptionPickers', () => {
         ...MODEL_DESCRIPTOR,
         kind: { type: 'select', choices: [] },
         valueSource: 'unknown',
+        transport: 'catalog',
         action: { type: 'agent-picker' }
       }
     ])
@@ -236,6 +240,46 @@ describe('MobileNativeChatSessionOptionPickers', () => {
     expect(invokeAction).toHaveBeenCalledWith('model')
   })
 
+  // The terminal transport can only learn the outcome by parsing the screen back,
+  // so the sheet admits the value is unconfirmed; the structured transport reports
+  // it every turn, which makes the same caption noise there.
+  it.each([
+    { transport: 'catalog' as const, caption: true },
+    { transport: 'agent-session' as const, caption: false }
+  ])('captions a dispatched value only on the terminal transport', async (scenario) => {
+    mount([
+      MODEL_DESCRIPTOR,
+      { ...EFFORT_DESCRIPTOR, valueSource: 'dispatched', transport: scenario.transport }
+    ])
+    await act(async () => pill('Model').props.onPress())
+    await act(async () => rowByText('Effort').props.onPress())
+    const captions = renderer!.root
+      .findAll((node) => node.type === 'Text')
+      .filter(
+        (node) =>
+          (node.props as { children?: unknown }).children === 'Sent to the agent — not confirmed'
+      )
+    expect(captions.length > 0).toBe(scenario.caption)
+  })
+
+  it.each(['catalog', 'agent-session'] as const)(
+    'does not caption a reported value on the %s transport',
+    async (transport) => {
+      mount([MODEL_DESCRIPTOR, { ...EFFORT_DESCRIPTOR, valueSource: 'reported', transport }])
+      await act(async () => pill('Model').props.onPress())
+      await act(async () => rowByText('Effort').props.onPress())
+      expect(
+        renderer!.root
+          .findAll((node) => node.type === 'Text')
+          .some(
+            (node) =>
+              (node.props as { children?: unknown }).children ===
+              'Sent to the agent — not confirmed'
+          )
+      ).toBe(false)
+    }
+  )
+
   it('locks the pills while the agent is working', () => {
     mount([MODEL_DESCRIPTOR, EFFORT_DESCRIPTOR], true)
     expect(pill('Model').props).toMatchObject({ disabled: true })
diff --git a/mobile/src/session/MobileNativeChatSessionOptionPickers.tsx b/mobile/src/session/MobileNativeChatSessionOptionPickers.tsx
index bfa5244a398..c9d641f74ec 100644
--- a/mobile/src/session/MobileNativeChatSessionOptionPickers.tsx
+++ b/mobile/src/session/MobileNativeChatSessionOptionPickers.tsx
@@ -3,9 +3,10 @@ import { ActivityIndicator, Keyboard, Pressable, StyleSheet, Text, View } from '
 import { ChevronLeft, X } from 'lucide-react-native'
 import { BottomDrawer } from '../components/BottomDrawer'
 import { colors, radii, spacing, typography } from '../theme/mobile-theme'
-import type {
-  SessionOptionDescriptor,
-  SessionOptionValue
+import {
+  sessionOptionDispatchUnconfirmed,
+  type SessionOptionDescriptor,
+  type SessionOptionValue
 } from '../../../src/shared/native-chat-session-options'
 import {
   mobileModelPillLabel,
@@ -119,7 +120,7 @@ export function MobileNativeChatSessionOptionPickers({
                 ) : null}
               </View>
             </View>
-            {activeDescriptor.valueSource === 'dispatched' ? (
+            {sessionOptionDispatchUnconfirmed(activeDescriptor) ? (
               <SessionOptionCaption>Sent to the agent — not confirmed</SessionOptionCaption>
             ) : null}
             {reason ? <SessionOptionCaption>{reason}</SessionOptionCaption> : null}
diff --git a/mobile/src/session/MobileNativeChatToolRun.tsx b/mobile/src/session/MobileNativeChatToolRun.tsx
new file mode 100644
index 00000000000..ccc732dab88
--- /dev/null
+++ b/mobile/src/session/MobileNativeChatToolRun.tsx
@@ -0,0 +1,253 @@
+import { useEffect, useRef, useState } from 'react'
+import { Animated, Pressable, Text, View } from 'react-native'
+import { ChevronDown, SquareChevronRight, SquareTerminal, Wrench } from 'lucide-react-native'
+import { diffFromText, diffFromToolCall } from '../../../src/shared/native-chat-diff'
+import type { NativeChatDiffLine as DiffLine } from '../../../src/shared/native-chat-diff'
+import { pairToolBlocks } from '../../../src/shared/native-chat-tool-fold'
+import type { NativeChatToolPair as ToolPair } from '../../../src/shared/native-chat-tool-fold'
+import {
+  createToolInputDisplay,
+  summarizeToolRun,
+  truncateToolDetail
+} from '../../../src/shared/native-chat-tool-summary'
+import {
+  describeActiveToolCall,
+  formatActiveToolLabel,
+  formatToolCallCount,
+  selectActiveToolCall
+} from '../../../src/shared/native-chat-tool-activity'
+import { isShellActivityToolCall } from '../../../src/shared/native-chat-tool-icon'
+import type { NativeChatBlock } from '../../../src/shared/native-chat-types'
+import { colors } from '../theme/mobile-theme'
+import { styles } from './mobile-native-chat-message-styles'
+
+const MAX_VISIBLE_TOOL_PAIRS = 6
+const MAX_TOOL_RUN_DIFF_ROWS = 240
+
+function DiffView({ lines }: { lines: DiffLine[] }): React.JSX.Element {
+  return (
+    <View style={styles.diff}>
+      {lines.map((line, i) => (
+        <Text
+          key={i}
+          style={[
+            styles.diffLine,
+            line.kind === 'add' && styles.diffAdd,
+            line.kind === 'del' && styles.diffDel,
+            line.kind === 'meta' && styles.diffMeta
+          ]}
+        >
+          {line.kind === 'add' ? '+' : line.kind === 'del' ? '-' : ' '}
+          {line.text}
+        </Text>
+      ))}
+    </View>
+  )
+}
+
+/** A single inline tool line — `▸ ToolName  preview` — that expands in place to
+ *  show the call's diff/input or the result's body. Mirrors the reference design
+ *  where tool calls read as flat lines in the conversation, not boxed blocks. */
+function ResultBody({
+  output,
+  isError,
+  diff
+}: {
+  output: string
+  isError?: boolean
+  diff: DiffLine[] | null
+}): React.JSX.Element {
+  if (diff) {
+    return <DiffView lines={diff} />
+  }
+  return (
+    <View style={[styles.toolResult, isError && styles.toolResultError]}>
+      <Text style={styles.mono}>{truncateToolDetail(output)}</Text>
+    </View>
+  )
+}
+
+/** One request: a tool call and its result rendered together as a single
+ *  expandable line. `defaultExpanded` lets the group toggle open every line. */
+function ToolLine({
+  pair,
+  defaultExpanded,
+  diffLineLimit,
+  onOpenFile
+}: {
+  pair: ToolPair
+  defaultExpanded: boolean
+  diffLineLimit: number
+  onOpenFile?: (relativePath: string) => void
+}): React.JSX.Element {
+  const [expanded, setExpanded] = useState(defaultExpanded)
+  const { call, result } = pair
+  const name = call ? call.name : 'Result'
+  const inputDisplay = call ? createToolInputDisplay(call.input) : null
+  const preview = inputDisplay?.label ?? result?.output.split('\n')[0]?.slice(0, 80) ?? ''
+  // Why: collapsed tool rows are the common path; defer bounded diff parsing
+  // and detail formatting until the user asks to reveal the detail.
+  const callDiff = expanded && call ? diffFromToolCall(call.name, call.input, diffLineLimit) : null
+  const resultDiff = expanded && result ? diffFromText(result.output, diffLineLimit) : null
+  const callDetail = expanded && inputDisplay && !callDiff ? inputDisplay.formatDetail() : undefined
+  const hasDetail = callDiff !== null || result !== undefined || inputDisplay?.hasDetail === true
+  // The group toggle opens every line at once, bypassing the tap guard, so the
+  // panel has to consult it too — else a detail-less row echoes its own label
+  // under itself and no tap can dismiss it.
+  const showDetail = hasDetail && expanded
+  // A tool that targets a file (Read/Edit/Write…) renders its preview as a
+  // tappable link that opens the file, independent of the line's expand tap.
+  const filePath = inputDisplay?.filePath ?? null
+  const openable = filePath !== null && onOpenFile !== undefined
+  return (
+    <View>
+      <Pressable
+        style={styles.toolLine}
+        onPress={() => hasDetail && setExpanded((v) => !v)}
+        hitSlop={6}
+      >
+        {showDetail ? (
+          <ChevronDown size={15} color={colors.textMuted} strokeWidth={2} />
+        ) : (
+          <SquareChevronRight size={15} color={colors.textMuted} strokeWidth={2} />
+        )}
+        <Text style={styles.toolName}>{name}</Text>
+        {preview ? (
+          <Text
+            style={[styles.toolPreview, openable && styles.toolPreviewLink]}
+            numberOfLines={1}
+            onPress={openable ? () => onOpenFile!(filePath!) : undefined}
+            suppressHighlighting={!openable}
+          >
+            {preview}
+          </Text>
+        ) : null}
+      </Pressable>
+      {showDetail ? (
+        <View style={styles.toolDetail}>
+          {callDiff ? <DiffView lines={callDiff} /> : null}
+          {callDetail ? <Text style={styles.mono}>{callDetail}</Text> : null}
+          {result ? (
+            <ResultBody output={result.output} isError={result.isError} diff={resultDiff} />
+          ) : null}
+        </View>
+      ) : null}
+    </View>
+  )
+}
+
+/** Breathing label for a still-running tool, matching desktop's `animate-pulse`. */
+function PulsingText({
+  style,
+  numberOfLines,
+  children
+}: {
+  style?: React.ComponentProps<typeof Animated.Text>['style']
+  numberOfLines?: number
+  children: React.ReactNode
+}): React.JSX.Element {
+  const pulse = useRef(new Animated.Value(1)).current
+  useEffect(() => {
+    const animation = Animated.loop(
+      Animated.sequence([
+        Animated.timing(pulse, { toValue: 0.45, duration: 700, useNativeDriver: true }),
+        Animated.timing(pulse, { toValue: 1, duration: 700, useNativeDriver: true })
+      ])
+    )
+    animation.start()
+    return () => animation.stop()
+  }, [pulse])
+  return (
+    <Animated.Text style={[style, { opacity: pulse }]} numberOfLines={numberOfLines}>
+      {children}
+    </Animated.Text>
+  )
+}
+
+/** A run of a message's tool calls/results, collapsed to a one-line summary that
+ *  expands to the individual inline tool lines. `defaultExpanded` lets the global
+ *  toolbar toggle drive every run at once while still allowing per-run override. */
+export function ToolRun({
+  blocks,
+  defaultExpanded,
+  expandChildren,
+  activeCall,
+  trailing,
+  onOpenFile
+}: {
+  blocks: NativeChatBlock[]
+  defaultExpanded: boolean
+  /** Child tool lines stay collapsed when the turn caret drove the run open. */
+  expandChildren: boolean
+  /** The still-running call, when the turn is live (desktop parity). */
+  activeCall: ReturnType<typeof selectActiveToolCall>
+  trailing?: React.ReactNode
+  onOpenFile?: (relativePath: string) => void
+}): React.JSX.Element {
+  const [open, setOpen] = useState(defaultExpanded)
+  const pairs = pairToolBlocks(blocks, MAX_VISIBLE_TOOL_PAIRS)
+  const diffLineLimit = Math.max(1, Math.floor(MAX_TOOL_RUN_DIFF_ROWS / (pairs.length * 2 || 1)))
+  let callCount = 0
+  for (const block of blocks) {
+    if (block.type === 'tool-call') {
+      callCount++
+    }
+  }
+  callCount ||= pairs.length
+  const summary = summarizeToolRun(blocks)
+  // The call's input, not its word: Codex names a classified shell row
+  // `read`/`search`/`list` and keeps the command it ran, while Claude's `Read`
+  // shares that word and ran none.
+  const ActiveToolIcon = activeCall && isShellActivityToolCall(activeCall) ? SquareTerminal : Wrench
+  return (
+    <View style={styles.toolRun}>
+      <View style={styles.toolRunHeader}>
+        {activeCall ? (
+          <Pressable
+            style={styles.toolRunActive}
+            onPress={() => setOpen((v) => !v)}
+            hitSlop={6}
+            accessibilityRole="button"
+            accessibilityState={{ expanded: open }}
+            accessibilityLiveRegion="polite"
+          >
+            <ActiveToolIcon size={15} color={colors.textMuted} strokeWidth={2} />
+            <PulsingText style={styles.toolRunActiveLabel} numberOfLines={1}>
+              {formatActiveToolLabel(describeActiveToolCall(activeCall))}
+            </PulsingText>
+            {open ? <ChevronDown size={15} color={colors.textMuted} strokeWidth={2} /> : null}
+          </Pressable>
+        ) : (
+          <Pressable style={styles.toolRunToggle} onPress={() => setOpen((v) => !v)} hitSlop={6}>
+            {open ? (
+              <ChevronDown size={15} color={colors.textMuted} strokeWidth={2} />
+            ) : (
+              <SquareChevronRight size={15} color={colors.textMuted} strokeWidth={2} />
+            )}
+            <Text style={styles.toolRunCount}>{callCount}×</Text>
+            <Text style={styles.toolRunLabel} numberOfLines={1}>
+              {summary || formatToolCallCount(callCount)}
+            </Text>
+          </Pressable>
+        )}
+        {trailing}
+      </View>
+      {open ? (
+        <View style={styles.toolRunBody}>
+          {pairs.map((pair, i) => (
+            <ToolLine
+              key={i}
+              pair={pair}
+              defaultExpanded={expandChildren}
+              diffLineLimit={diffLineLimit}
+              onOpenFile={onOpenFile}
+            />
+          ))}
+          {callCount > pairs.length ? (
+            <Text style={styles.toolPreview}>… {callCount - pairs.length} more tool calls</Text>
+          ) : null}
+        </View>
+      ) : null}
+    </View>
+  )
+}
diff --git a/mobile/src/session/MobileNativeChatTurnStatus.test.ts b/mobile/src/session/MobileNativeChatTurnStatus.test.ts
new file mode 100644
index 00000000000..78ac01e0d37
--- /dev/null
+++ b/mobile/src/session/MobileNativeChatTurnStatus.test.ts
@@ -0,0 +1,112 @@
+import { createElement } from 'react'
+import { act, create, type ReactTestInstance, type ReactTestRenderer } from 'react-test-renderer'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+vi.mock('react-native', async () => {
+  const React = await import('react')
+  const Text = ({ children, ...props }: { children?: unknown }): unknown =>
+    React.createElement('Text', props, children)
+  return {
+    Animated: {
+      Text,
+      Value: class {
+        constructor(private value: number) {}
+        setValue(next: number): void {
+          this.value = next
+        }
+      },
+      loop: (animation: unknown) => animation,
+      sequence: () => ({ start: vi.fn(), stop: vi.fn() }),
+      timing: () => ({ start: vi.fn(), stop: vi.fn() })
+    },
+    Pressable: ({ children, ...props }: { children?: unknown }) =>
+      React.createElement('Pressable', props, children),
+    Text,
+    View: ({ children, ...props }: { children?: unknown }) =>
+      React.createElement('View', props, children),
+    StyleSheet: { create: (styles: unknown) => styles, hairlineWidth: 1 }
+  }
+})
+vi.mock('lucide-react-native', () => ({ ChevronRight: 'ChevronRight' }))
+
+import { MobileNativeChatTurnStatus } from './MobileNativeChatTurnStatus'
+
+describe('MobileNativeChatTurnStatus', () => {
+  let renderer: ReactTestRenderer | null = null
+
+  beforeEach(() => {
+    vi.useFakeTimers()
+    vi.setSystemTime(new Date('2026-09-04T00:00:00Z'))
+  })
+
+  afterEach(() => {
+    act(() => renderer?.unmount())
+    renderer = null
+    vi.useRealTimers()
+  })
+
+  function render(props: {
+    startedAt: number | null
+    thinking: boolean
+    workedSeconds?: number | null
+    expanded?: boolean
+    onToggleExpanded?: () => void
+  }): ReactTestRenderer {
+    act(() => {
+      renderer = create(createElement(MobileNativeChatTurnStatus, props))
+    })
+    return renderer!
+  }
+
+  const labels = (node: ReactTestInstance): string[] =>
+    node.findAllByType('Text' as never).map((text) => String(text.children.join('')))
+
+  it('reads "Thinking" before the turn produces output', () => {
+    const tree = render({ startedAt: Date.now(), thinking: true })
+    expect(labels(tree.root)).toEqual(['Thinking'])
+  })
+
+  it('counts up once the turn is producing output', () => {
+    const startedAt = Date.now()
+    const tree = render({ startedAt, thinking: false })
+    expect(labels(tree.root)).toEqual(['Working for 0s'])
+    act(() => {
+      vi.advanceTimersByTime(12_000)
+    })
+    expect(labels(tree.root)).toEqual(['Working for 12s'])
+  })
+
+  it('settles to a tappable "Worked for" row that toggles the turn', () => {
+    const onToggleExpanded = vi.fn()
+    const tree = render({
+      startedAt: Date.now(),
+      thinking: false,
+      workedSeconds: 184,
+      onToggleExpanded
+    })
+    expect(labels(tree.root)).toEqual(['Worked for 3m 4s'])
+    const button = tree.root.findByType('Pressable' as never)
+    expect(button.props.accessibilityLabel).toBe('Toggle turn details')
+    expect(button.props.accessibilityState).toEqual({ expanded: false })
+    act(() => button.props.onPress())
+    expect(onToggleExpanded).toHaveBeenCalledOnce()
+  })
+
+  it('stays a plain row when the settled turn has nothing to disclose', () => {
+    const tree = render({ startedAt: Date.now(), thinking: false, workedSeconds: 5 })
+    expect(tree.root.findAllByType('Pressable' as never)).toHaveLength(0)
+    expect(labels(tree.root)).toEqual(['Worked for 5s'])
+  })
+
+  it('holds no interval once the turn has settled', () => {
+    render({ startedAt: Date.now(), thinking: false, workedSeconds: 5 })
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('announces the live row to assistive tech', () => {
+    const tree = render({ startedAt: Date.now(), thinking: true })
+    const row = tree.root.findByType('View' as never)
+    expect(row.props.accessibilityLiveRegion).toBe('polite')
+    expect(row.props.accessibilityLabel).toBe('Agent is responding')
+  })
+})
diff --git a/mobile/src/session/MobileNativeChatTurnStatus.tsx b/mobile/src/session/MobileNativeChatTurnStatus.tsx
new file mode 100644
index 00000000000..4ce73cdcd38
--- /dev/null
+++ b/mobile/src/session/MobileNativeChatTurnStatus.tsx
@@ -0,0 +1,117 @@
+import { useEffect, useRef, useState } from 'react'
+import { Animated, Pressable, StyleSheet, Text, View } from 'react-native'
+import { ChevronRight } from 'lucide-react-native'
+import {
+  formatNativeChatTurnStatusLabel,
+  NATIVE_CHAT_TURN_STATUS_COPY,
+  nativeChatElapsedSeconds
+} from '../../../src/shared/native-chat-turn-status'
+import { colors, spacing, typography } from '../theme/mobile-theme'
+
+/** Seconds tick only while a turn is actually counting, so a settled transcript
+ *  holds no timers. */
+function useElapsedSeconds(startedAt: number | null, counting: boolean): number {
+  // Preserves the pre-stamp epoch for the frame before the turn's startedAt lands.
+  const [mountedAt] = useState(() => Date.now())
+  const [now, setNow] = useState(() => Date.now())
+  useEffect(() => {
+    if (!counting) {
+      return
+    }
+    setNow(Date.now())
+    const timer = setInterval(() => setNow(Date.now()), 1_000)
+    return () => clearInterval(timer)
+  }, [counting])
+  return counting ? nativeChatElapsedSeconds(startedAt, mountedAt, now) : 0
+}
+
+/** The per-turn status row — "Thinking", then "Working for 12s" while the turn
+ *  runs, settling to a tappable "Worked for 3m 4s" that discloses the turn's
+ *  tool activity. Desktop parity: `NativeChatWorkingStatus`. */
+export function MobileNativeChatTurnStatus({
+  startedAt,
+  thinking,
+  workedSeconds,
+  expanded = false,
+  onToggleExpanded
+}: {
+  startedAt: number | null
+  thinking: boolean
+  workedSeconds?: number | null
+  expanded?: boolean
+  onToggleExpanded?: () => void
+}): React.JSX.Element {
+  const counting = !thinking && workedSeconds == null
+  const elapsedSeconds = useElapsedSeconds(startedAt, counting)
+  const label = formatNativeChatTurnStatusLabel({ thinking, workedSeconds, elapsedSeconds })
+
+  const pulse = useRef(new Animated.Value(1)).current
+  useEffect(() => {
+    if (!thinking) {
+      pulse.setValue(1)
+      return
+    }
+    const animation = Animated.loop(
+      Animated.sequence([
+        Animated.timing(pulse, { toValue: 0.45, duration: 700, useNativeDriver: true }),
+        Animated.timing(pulse, { toValue: 1, duration: 700, useNativeDriver: true })
+      ])
+    )
+    animation.start()
+    return () => animation.stop()
+  }, [pulse, thinking])
+
+  const rowStyle = [styles.row, thinking ? null : styles.rowSettled]
+
+  if (workedSeconds != null && onToggleExpanded) {
+    return (
+      <Pressable
+        style={({ pressed }) => [...rowStyle, pressed && styles.pressed]}
+        onPress={onToggleExpanded}
+        hitSlop={6}
+        accessibilityRole="button"
+        accessibilityState={{ expanded }}
+        accessibilityLabel={NATIVE_CHAT_TURN_STATUS_COPY.toggleDetails}
+      >
+        <Text style={styles.label}>{label}</Text>
+        <View style={expanded ? styles.caretOpen : undefined}>
+          <ChevronRight size={14} color={colors.textMuted} strokeWidth={2} />
+        </View>
+      </Pressable>
+    )
+  }
+
+  return (
+    <View
+      style={rowStyle}
+      accessibilityLiveRegion="polite"
+      accessibilityLabel={NATIVE_CHAT_TURN_STATUS_COPY.responding}
+    >
+      <Animated.Text style={[styles.label, thinking && { opacity: pulse }]}>{label}</Animated.Text>
+    </View>
+  )
+}
+
+const styles = StyleSheet.create({
+  row: {
+    flexDirection: 'row',
+    alignItems: 'center',
+    gap: spacing.xs,
+    minHeight: 28,
+    paddingHorizontal: spacing.md
+  },
+  rowSettled: {
+    borderBottomWidth: StyleSheet.hairlineWidth,
+    borderBottomColor: colors.borderSubtle
+  },
+  pressed: {
+    opacity: 0.6
+  },
+  label: {
+    color: colors.textMuted,
+    fontSize: typography.bodySize
+  },
+  caretOpen: {
+    transform: [{ rotate: '90deg' }]
+  }
+})
diff --git a/mobile/src/session/MobileNativeChatView.test.ts b/mobile/src/session/MobileNativeChatView.test.ts
index 9d171e3ac8a..d101c3f0ef6 100644
--- a/mobile/src/session/MobileNativeChatView.test.ts
+++ b/mobile/src/session/MobileNativeChatView.test.ts
@@ -72,6 +72,9 @@ type Overrides = {
   inputLockReason?: 'disconnected' | 'waiting' | null
   onSend?: (text: string) => Promise<boolean>
   pending?: Parameters<typeof MobileNativeChatView>[0]['pending']
+  structuredActivityUi?: boolean
+  agentWorking?: boolean
+  sendSurfaceId?: string
 }
 
 function assistantTurn(id: string, text: string): NativeChatMessage {
@@ -243,4 +246,111 @@ describe('MobileNativeChatView', () => {
       vi.useRealTimers()
     }
   })
+
+  describe('structured turn status wiring', () => {
+    const userTurn = (id: string, text: string): NativeChatMessage => ({
+      id,
+      role: 'user',
+      blocks: [{ type: 'text', text }],
+      timestamp: 0,
+      source: 'transcript'
+    })
+
+    function rowProps(id: string): Record<string, unknown> {
+      return (renderedRow(id) as { props: Record<string, unknown> }).props
+    }
+
+    function workingIndicators(): ReactTestInstance[] {
+      return renderer!.root.findAll((node) => node.type === 'WorkingIndicator')
+    }
+
+    it('gives the live user turn a status row and drops the three-dot indicator', async () => {
+      const folded = [userTurn('u1', 'go')]
+      await render({ messages: folded, folded, structuredActivityUi: true, agentWorking: true })
+      const props = rowProps('u1')
+      expect(props.structuredActivityUi).toBe(true)
+      expect(props.turnStatus).toMatchObject({ thinking: true, workedSeconds: null })
+      expect(props.activeTurnIsWorking).toBe(true)
+      expect(workingIndicators()).toHaveLength(0)
+    })
+
+    it('keeps the bridge lane on the three-dot indicator with no turn status', async () => {
+      const folded = [userTurn('u1', 'go')]
+      await render({ messages: folded, folded, agentWorking: true })
+      const props = rowProps('u1')
+      expect(props.structuredActivityUi).toBe(false)
+      expect(props.turnStatus).toBeNull()
+      expect(props.activeTurnIsWorking).toBe(false)
+      expect(workingIndicators()).toHaveLength(1)
+    })
+
+    it('settles the finished turn to a tappable duration', async () => {
+      const folded = [userTurn('u1', 'go'), assistantTurn('a1', 'done')]
+      await render({ messages: folded, folded, structuredActivityUi: true, agentWorking: true })
+      expect(rowProps('u1').turnStatus).toMatchObject({ thinking: false, workedSeconds: null })
+      await update({ messages: folded, folded, structuredActivityUi: true, agentWorking: false })
+      const settled = rowProps('u1')
+      expect(settled.turnStatus).toMatchObject({ thinking: false })
+      expect((settled.turnStatus as { workedSeconds: number | null }).workedSeconds).toBeTypeOf(
+        'number'
+      )
+      expect(settled.onToggleTurn).toBeTypeOf('function')
+      expect(settled.activeTurnIsWorking).toBe(false)
+    })
+
+    it('hangs no status row on an assistant row', async () => {
+      const folded = [userTurn('u1', 'go'), assistantTurn('a1', 'done')]
+      await render({ messages: folded, folded, structuredActivityUi: true, agentWorking: true })
+      expect(rowProps('a1').turnStatus).toBeNull()
+      // The assistant row still belongs to the live turn, so its tool row stays visible.
+      expect(rowProps('a1').activeTurnIsWorking).toBe(true)
+    })
+
+    it('does not carry a running turn clock across chat surfaces', async () => {
+      vi.useFakeTimers()
+      try {
+        vi.setSystemTime(1_000)
+        const firstTab = [userTurn('u1', 'first')]
+        await render({
+          messages: firstTab,
+          folded: firstTab,
+          structuredActivityUi: true,
+          agentWorking: true,
+          sendSurfaceId: 'host\0worktree\0tab-a'
+        })
+        expect(rowProps('u1').turnStatus).toMatchObject({ startedAt: 1_000 })
+
+        vi.setSystemTime(12_000)
+        const secondTab = [userTurn('u2', 'second')]
+        await update({
+          messages: secondTab,
+          folded: secondTab,
+          structuredActivityUi: true,
+          agentWorking: true,
+          sendSurfaceId: 'host\0worktree\0tab-b'
+        })
+
+        expect(rowProps('u2').turnStatus).toMatchObject({ startedAt: 12_000 })
+      } finally {
+        vi.useRealTimers()
+      }
+    })
+
+    it('does not treat pre-user history as part of the live turn', async () => {
+      const history = [
+        assistantTurn('a0', 'before the first prompt'),
+        userTurn('u1', 'go'),
+        assistantTurn('a1', 'working')
+      ]
+      await render({
+        messages: history,
+        folded: history,
+        structuredActivityUi: true,
+        agentWorking: true
+      })
+
+      expect(rowProps('a0').activeTurnIsWorking).toBe(false)
+      expect(rowProps('a1').activeTurnIsWorking).toBe(true)
+    })
+  })
 })
diff --git a/mobile/src/session/MobileNativeChatView.tsx b/mobile/src/session/MobileNativeChatView.tsx
index 4db4e437b43..59c024435b6 100644
--- a/mobile/src/session/MobileNativeChatView.tsx
+++ b/mobile/src/session/MobileNativeChatView.tsx
@@ -21,16 +21,16 @@ import {
   type MobileNativeChatPendingItem
 } from './mobile-native-chat-render-data'
 import { useMobileNativeChatPinchGesture } from './use-mobile-native-chat-pinch-gesture'
+import { useMobileNativeChatTurnDisclosure } from './use-mobile-native-chat-turn-disclosure'
+import { MobileNativeChatTurnStatus } from './MobileNativeChatTurnStatus'
 import { MobileAgentWorkingIndicator } from './MobileAgentWorkingIndicator'
 import type { PendingNativeChatImage } from './mobile-native-chat-image-attachment'
 import { MobileNativeChatComposer } from './MobileNativeChatComposer'
+import { MobileNativeChatPromptCard } from './MobileNativeChatPromptCard'
+import type { MobileChatPermission } from './mobile-native-chat-permission'
+import type { MobileChatQuestion } from './mobile-native-chat-question'
 import type { MobileNativeChatSessionOptionPickersProps } from './MobileNativeChatSessionOptionPickers'
 import { MobileNativeChatMessage } from './MobileNativeChatMessage'
-import { MobileNativeChatAsk } from './MobileNativeChatAsk'
-import { MobileNativeChatPermission } from './MobileNativeChatPermission'
-import type { MobileChatPermission } from './mobile-native-chat-permission'
-import { MobileNativeChatQuestion } from './MobileNativeChatQuestion'
-import { mobileChatQuestionKey, type MobileChatQuestion } from './mobile-native-chat-question'
 import type { MobileNativeChatStatus } from './use-mobile-native-chat-session'
 
 const INPUT_LOCK_SETTLE_MS = 600
@@ -49,6 +49,9 @@ type Props = {
   /** Resolved agent for this chat; names the empty-state copy (desktop parity). */
   agent?: string | null
   agentWorking?: boolean
+  /** Structured lane: per-turn "Working for N" status plus live tool progress,
+   *  replacing the bridge lane's static three-dot working row (desktop parity). */
+  structuredActivityUi?: boolean
   /** Interrupt the agent mid-turn (shown as a Stop button on the working bar). */
   onStop?: () => void
   /** Live partial assistant text to show as an in-progress bubble, already gated
@@ -126,6 +129,7 @@ export function MobileNativeChatView({
   error,
   agent,
   agentWorking,
+  structuredActivityUi = false,
   onStop,
   streaming,
   hasMore,
@@ -252,6 +256,15 @@ export function MobileNativeChatView({
     listRef.current?.scrollToIndex({ index, viewPosition: 0, animated: true })
   }, [])
 
+  // Per-turn "Thinking / Working for N / Worked for N" rows. The structured lane
+  // owns them; the bridge lane keeps its three-dot indicator.
+  const turns = useMobileNativeChatTurnDisclosure({
+    messages: data,
+    enabled: structuredActivityUi,
+    isWorking: agentWorking === true,
+    scopeKey: sendSurfaceId
+  })
+
   const renderItem = useCallback(
     ({ item, index }: { item: NativeChatMessage; index: number }) => (
       <MobileNativeChatMessage
@@ -261,9 +274,12 @@ export function MobileNativeChatView({
         messageIndex={index}
         onScrollToMessage={onScrollToMessage}
         onOpenFile={onOpenFile}
+        structuredActivityUi={structuredActivityUi}
+        onToggleTurn={turns.onToggleTurn}
+        {...turns.resolveRow(index, item)}
       />
     ),
-    [toolsExpanded, fontScale, onScrollToMessage, onOpenFile]
+    [toolsExpanded, fontScale, onScrollToMessage, onOpenFile, structuredActivityUi, turns]
   )
 
   const emptyState = mobileNativeChatEmptyState(status, agent ?? null, error)
@@ -337,6 +353,15 @@ export function MobileNativeChatView({
                   </Pressable>
                 ) : null
               }
+              ListFooterComponent={
+                turns.activeTurnIsUnanchored && turns.active ? (
+                  <MobileNativeChatTurnStatus
+                    startedAt={turns.active.startedAt}
+                    thinking={turns.active.thinking}
+                    workedSeconds={turns.active.workedSeconds}
+                  />
+                ) : null
+              }
               ListEmptyComponent={
                 emptyState ? (
                   <View style={styles.center}>
@@ -360,47 +385,22 @@ export function MobileNativeChatView({
           ) : null}
         </GestureHandlerRootView>
       )}
-      {/* Pending agent prompt: a structured AskUserQuestion wins, then a
-          heuristic permission, then a heuristic question. The controller owns
-          dismissal (it must survive this subtree unmounting on a view toggle);
-          `ask` arrives already nulled while dismissed. */}
-      {ask ? (
-        <MobileNativeChatAsk
-          key={askKey ?? 'ask'}
-          prompt={ask}
-          onAnswer={async (selections) => {
-            const accepted = (await onAnswerAsk?.(ask, selections)) ?? false
-            if (accepted) {
-              onDismissAsk?.()
-            }
-            return accepted
-          }}
-          onCancel={async () => {
-            const accepted = (await onCancelAsk?.()) ?? false
-            if (accepted) {
-              onDismissAsk?.()
-            }
-            return accepted
-          }}
-        />
-      ) : permission ? (
-        <MobileNativeChatPermission
-          key={JSON.stringify(permission)}
-          permission={permission}
-          onRespond={async (send) => (await onRespondPermission?.(send)) ?? false}
-        />
-      ) : question ? (
-        <MobileNativeChatQuestion
-          key={mobileChatQuestionKey(question)}
-          question={question}
-          onAnswer={async (text) => (await onAnswerQuestion?.(text)) ?? false}
-        />
-      ) : null}
+      <MobileNativeChatPromptCard
+        ask={ask}
+        askKey={askKey}
+        onDismissAsk={onDismissAsk}
+        onAnswerAsk={onAnswerAsk}
+        onCancelAsk={onCancelAsk}
+        permission={permission}
+        onRespondPermission={onRespondPermission}
+        question={question}
+        onAnswerQuestion={onAnswerQuestion}
+      />
       {/* Chrome row above the composer: the working indicator and the global
           tool-calls expand/collapse toggle on the left, Stop in the far corner. */}
       <View style={styles.chromeRow}>
         <View style={styles.chromeLeft}>
-          {agentWorking ? <MobileAgentWorkingIndicator /> : null}
+          {agentWorking && !structuredActivityUi ? <MobileAgentWorkingIndicator /> : null}
           <Pressable
             style={({ pressed }) => [styles.chromeToggle, pressed && styles.pressed]}
             onPress={() => setToolsExpanded((v) => !v)}
diff --git a/mobile/src/session/mobile-image-attachment.test.ts b/mobile/src/session/mobile-image-attachment.test.ts
index 9d725d5fe60..eead9691303 100644
--- a/mobile/src/session/mobile-image-attachment.test.ts
+++ b/mobile/src/session/mobile-image-attachment.test.ts
@@ -50,7 +50,9 @@ describe('attachMobileImageToTerminal', () => {
     const sendCall = client.calls.find((c) => c.method === 'terminal.send')
     expect(sendCall?.params).toEqual({
       terminal: 'term-1',
-      text: '\x1b[200~/tmp/orca-attach.png\x1b[201~',
+      // Trailing space: the user types on this same line next, so a bare
+      // `…\x1b[201~` would arrive as `…pngadd` (STA-4847).
+      text: '\x1b[200~/tmp/orca-attach.png\x1b[201~ ',
       enter: false,
       client: { id: 'device-9', type: 'mobile' }
     })
diff --git a/mobile/src/session/mobile-image-attachment.ts b/mobile/src/session/mobile-image-attachment.ts
index 567be99a9a1..9cb7d60aa8e 100644
--- a/mobile/src/session/mobile-image-attachment.ts
+++ b/mobile/src/session/mobile-image-attachment.ts
@@ -1,4 +1,5 @@
 import type { RpcClient } from '../transport/rpc-client'
+import { separateImagePasteFromFollowingText } from '../../../src/shared/image-paste-following-text'
 import {
   buildMobileImagePastePayload,
   saveMobileClipboardImageAsTempFile
@@ -47,7 +48,10 @@ export async function attachMobileImageToTerminal(
   })
   // Why: a generated image path is terminal image injection, so it's always
   // bracketed (matching desktop paste) regardless of terminal mode.
-  const payload = buildMobileImagePastePayload(imagePath)
+  // Always separated: attach-then-type is the whole interaction here, so the user's
+  // next keystroke would otherwise glue onto the path (`…pngadd`). Unlike native
+  // chat there is no batch to look ahead in, and a trailing space is inert.
+  const payload = separateImagePasteFromFollowingText(buildMobileImagePastePayload(imagePath), true)
   if (beforeTerminalSend && !(await beforeTerminalSend(terminal))) {
     return false
   }
diff --git a/mobile/src/session/mobile-native-chat-autocomplete.ts b/mobile/src/session/mobile-native-chat-autocomplete.ts
index 548d0614837..8de107c9fb0 100644
--- a/mobile/src/session/mobile-native-chat-autocomplete.ts
+++ b/mobile/src/session/mobile-native-chat-autocomplete.ts
@@ -81,7 +81,7 @@ export function rankSuggestions(candidates: readonly string[], query: string, li
   const substring: string[] = []
   for (const candidate of candidates) {
     const lower = candidate.toLowerCase()
-    const base = lower.split('/').pop() ?? lower
+    const base = lower.slice(lower.lastIndexOf('/') + 1)
     if (lower.startsWith(q) || base.startsWith(q)) {
       prefix.push(candidate)
     } else if (lower.includes(q)) {
diff --git a/mobile/src/session/mobile-native-chat-controller-contract.ts b/mobile/src/session/mobile-native-chat-controller-contract.ts
index 890a3a1562e..53187e0d6db 100644
--- a/mobile/src/session/mobile-native-chat-controller-contract.ts
+++ b/mobile/src/session/mobile-native-chat-controller-contract.ts
@@ -25,6 +25,8 @@ export type MobileNativeChatController = {
   chatPending: MobileNativeChatPendingMessage[]
   chatImagePreviewsByMessageId: Record<string, string[]>
   nativeChatSession: ReturnType<typeof useMobileNativeChatSession>
+  /** Structured lane: drives the per-turn status row and live tool progress. */
+  nativeChatStructured: boolean
   nativeChatAgentWorking: boolean
   nativeChatStreamingText?: string
   /** Agent mid-turn, regardless of whether chat is the visible view. */
diff --git a/mobile/src/session/mobile-native-chat-image-send.test.ts b/mobile/src/session/mobile-native-chat-image-send.test.ts
index cf1c59adf0f..a41b3fca3f1 100644
--- a/mobile/src/session/mobile-native-chat-image-send.test.ts
+++ b/mobile/src/session/mobile-native-chat-image-send.test.ts
@@ -38,7 +38,8 @@ describe('pasteMobileNativeChatImagePaths', () => {
       client,
       terminal: 'term-1',
       deviceToken: 'device-9',
-      imagePaths: ['/tmp/a.png', '/tmp/b.png', '/tmp/c.png']
+      imagePaths: ['/tmp/a.png', '/tmp/b.png', '/tmp/c.png'],
+      followedByText: true
     })
 
     expect(ok).toBe(true)
@@ -55,7 +56,7 @@ describe('pasteMobileNativeChatImagePaths', () => {
     })
     expect(client.calls[1]?.params.text).toBe('\x1b[200~/tmp/a.png\x1b[201~')
     expect(client.calls[2]?.params.text).toBe('\x1b[200~/tmp/b.png\x1b[201~')
-    expect(client.calls[3]?.params.text).toBe('\x1b[200~/tmp/c.png\x1b[201~')
+    expect(client.calls[3]?.params.text).toBe('\x1b[200~/tmp/c.png\x1b[201~ ')
   })
 
   it('stops and reports failure as soon as a paste is rejected', async () => {
@@ -66,7 +67,8 @@ describe('pasteMobileNativeChatImagePaths', () => {
       client,
       terminal: 'term-1',
       deviceToken: null,
-      imagePaths: ['/tmp/a.png', '/tmp/b.png']
+      imagePaths: ['/tmp/a.png', '/tmp/b.png'],
+      followedByText: true
     })
 
     expect(ok).toBe(false)
@@ -94,7 +96,8 @@ describe('pasteMobileNativeChatImagePaths', () => {
         client,
         terminal: 'term-1',
         deviceToken: null,
-        imagePaths: ['/tmp/a.png', '/tmp/b.png']
+        imagePaths: ['/tmp/a.png', '/tmp/b.png'],
+        followedByText: true
       })
 
       expect(ok).toBe(false)
@@ -121,6 +124,7 @@ describe('clearing a parked multi-line launch draft before the image paste', ()
       terminal: 'term-1',
       deviceToken: null,
       imagePaths: ['/tmp/a.png'],
+      followedByText: true,
       clearInput
     })
 
@@ -137,6 +141,7 @@ describe('clearing a parked multi-line launch draft before the image paste', ()
       terminal: 'term-1',
       deviceToken: null,
       imagePaths: ['/tmp/a.png', '/tmp/b.png'],
+      followedByText: true,
       clearInput
     })
 
@@ -151,9 +156,27 @@ describe('clearing a parked multi-line launch draft before the image paste', ()
       client,
       terminal: 'term-1',
       deviceToken: null,
-      imagePaths: ['/tmp/a.png']
+      imagePaths: ['/tmp/a.png'],
+      followedByText: true
     })
 
     expect(client.calls[0]?.params.text).toBe('\x15')
   })
+
+  it('keeps image writes byte-clean when no text or submit follows', async () => {
+    const client = clientWithResponses([sendResult(true), sendResult(true), sendResult(true)])
+
+    await pasteMobileNativeChatImagePaths({
+      client,
+      terminal: 'term-1',
+      deviceToken: null,
+      imagePaths: ['/tmp/a.png', '/tmp/b.png'],
+      followedByText: false
+    })
+
+    expect(client.calls.slice(1).map((call) => call.params.text)).toEqual([
+      '\x1b[200~/tmp/a.png\x1b[201~',
+      '\x1b[200~/tmp/b.png\x1b[201~'
+    ])
+  })
 })
diff --git a/mobile/src/session/mobile-native-chat-image-send.ts b/mobile/src/session/mobile-native-chat-image-send.ts
index adb996b7612..9f3c555062f 100644
--- a/mobile/src/session/mobile-native-chat-image-send.ts
+++ b/mobile/src/session/mobile-native-chat-image-send.ts
@@ -1,4 +1,5 @@
 import type { RpcClient } from '../transport/rpc-client'
+import { imagePasteWritesFollowedByText } from '../../../src/shared/image-paste-following-text'
 import { buildMobileImagePastePayload } from './mobile-clipboard-image'
 import {
   MOBILE_NATIVE_CHAT_MIN_WRITE_TIMEOUT_MS,
@@ -23,6 +24,7 @@ type PasteImagesArgs = {
   readonly terminal: string
   readonly deviceToken: string | null
   readonly imagePaths: readonly string[]
+  readonly followedByText: boolean
   /** Budget shared with the rest of the user action (the text body that follows, or
    *  the send this is healing for). Omit to open a fresh one for this paste alone. */
   readonly deadline?: number
@@ -42,6 +44,7 @@ export async function pasteMobileNativeChatImagePaths({
   terminal,
   deviceToken,
   imagePaths,
+  followedByText,
   deadline: sharedDeadline,
   clearInput
 }: PasteImagesArgs): Promise<boolean> {
@@ -55,7 +58,7 @@ export async function pasteMobileNativeChatImagePaths({
   const deadline = sharedDeadline ?? openMobileNativeChatSendBudget()
   for (const text of [
     clearInput ?? MOBILE_NATIVE_CHAT_CLEAR_UNSUBMITTED_INPUT,
-    ...imagePaths.map(buildMobileImagePastePayload)
+    ...imagePasteWritesFollowedByText(imagePaths.map(buildMobileImagePastePayload), followedByText)
   ]) {
     const remainingMs = deadline - Date.now()
     // Why: the budget is the whole sequence's — starting a write it can't fund would
diff --git a/mobile/src/session/mobile-native-chat-message-styles.ts b/mobile/src/session/mobile-native-chat-message-styles.ts
index ad7cf4b4009..7ae1128445a 100644
--- a/mobile/src/session/mobile-native-chat-message-styles.ts
+++ b/mobile/src/session/mobile-native-chat-message-styles.ts
@@ -80,6 +80,18 @@ export const styles = StyleSheet.create({
     fontFamily: typography.monoFamily,
     fontSize: MONO_SIZE
   },
+  toolRunActive: {
+    flex: 1,
+    flexDirection: 'row',
+    alignItems: 'center',
+    gap: spacing.sm,
+    paddingVertical: 3
+  },
+  toolRunActiveLabel: {
+    flex: 1,
+    color: colors.textSecondary,
+    fontSize: typography.bodySize
+  },
   toolRunBody: {
     paddingLeft: spacing.sm,
     borderLeftWidth: 2,
diff --git a/mobile/src/session/mobile-native-chat-stale-input.ts b/mobile/src/session/mobile-native-chat-stale-input.ts
index 18d84d2e503..cdc21067683 100644
--- a/mobile/src/session/mobile-native-chat-stale-input.ts
+++ b/mobile/src/session/mobile-native-chat-stale-input.ts
@@ -55,6 +55,7 @@ export async function healMobileNativeChatStaleInput(args: {
       terminal: args.terminal,
       deviceToken: args.deviceToken,
       imagePaths: [],
+      followedByText: false,
       ...(args.deadline === undefined ? {} : { deadline: args.deadline })
     })
   } catch {
diff --git a/mobile/src/session/mobile-session-route-parity.test.ts b/mobile/src/session/mobile-session-route-parity.test.ts
index c6e5f434326..e1ea2f8ec15 100644
--- a/mobile/src/session/mobile-session-route-parity.test.ts
+++ b/mobile/src/session/mobile-session-route-parity.test.ts
@@ -79,7 +79,7 @@ const HEAD_TIMER_CREATION_SHA256 =
   '1a31b625e2174c3db77272249843196d2b6b06ab1e654a96d8f7858e3082e66b'
 const HEAD_TIMER_CLEANUP_SHA256 = 'c73f1d1c2cc89642f3d727d6f3b6b81860a9d6f34234541a2065ec3d1a8cd116'
 const HEAD_RUNTIME_STRING_SHA256 =
-  'ba52a3ede721bd29acbe8593161e90b216b7f361ff896e085927d4d73fa83b2f'
+  '0c08a53c2cd1e182e1d7edfb7b98bd9e4a313e47c7b93f5a509a89ec3292bc1f'
 const HEAD_HOST_JSX_SHA256 = '390405926b1695fa3a33686f0bc192b432f5468d8576499d7cafbb4922defbb5'
 const HEAD_LEAF_JSX_SHA256 = '21dba981875e173f692590bf910d60964660c5f4cbb79f3a377c7e54f6a1f016'
 const HEAD_STYLE_REFERENCE_SHA256 =
@@ -517,7 +517,7 @@ describe('mobile session route extraction parity', () => {
 
   it('preserves runtime strings, styles, and the expanded JSX tree', () => {
     const strings = readRuntimeStrings()
-    expect(strings).toHaveLength(546)
+    expect(strings).toHaveLength(547)
     expect(hash(strings)).toBe(HEAD_RUNTIME_STRING_SHA256)
     const jsx = readJsxFacts(readDefinitions())
     expect(jsx.host).toHaveLength(124)
diff --git a/mobile/src/session/mobile-structured-agent-session-launch.test.ts b/mobile/src/session/mobile-structured-agent-session-launch.test.ts
index 54f9b5cbe88..f575d5ac6d4 100644
--- a/mobile/src/session/mobile-structured-agent-session-launch.test.ts
+++ b/mobile/src/session/mobile-structured-agent-session-launch.test.ts
@@ -139,4 +139,76 @@ describe('mobile structured Codex launch', () => {
       kind: 'unknown'
     })
   })
+
+  it.each(['structured_agent_session_unsupported', 'method_not_found'])(
+    'treats a top-level %s as a definitive refusal',
+    async (code) => {
+      const client = clientReturning(
+        { ok: true, result: { supported: true } },
+        { ok: false, error: { code, message: 'structured create unavailable' } }
+      )
+
+      await expect(createMobileStructuredCodexSession(client, 'workspace-1')).resolves.toEqual({
+        kind: 'failed',
+        message: 'structured create unavailable'
+      })
+    }
+  )
+
+  it.each(['agent_session_operation_unknown', 'runtime_error', 'future_unknown_code'])(
+    'keeps a top-level %s outcome unknown',
+    async (code) => {
+      const client = clientReturning(
+        { ok: true, result: { supported: true } },
+        { ok: false, error: { code, message: 'create outcome ambiguous' } }
+      )
+
+      await expect(createMobileStructuredCodexSession(client, 'workspace-1')).resolves.toEqual({
+        kind: 'unknown',
+        message: 'create outcome ambiguous'
+      })
+    }
+  )
+
+  it('treats an envelope unsupported refusal as definitive', async () => {
+    const client = clientReturning(
+      { ok: true, result: { supported: true } },
+      {
+        ok: true,
+        result: {
+          ok: false,
+          refusal: {
+            code: 'structured_agent_session_unsupported',
+            message: 'structured create unavailable'
+          }
+        }
+      }
+    )
+
+    await expect(createMobileStructuredCodexSession(client, 'workspace-1')).resolves.toEqual({
+      kind: 'failed',
+      message: 'structured create unavailable'
+    })
+  })
+
+  it.each(['agent_session_operation_unknown', 'agent_session_ownership_unknown', 'future_code'])(
+    'keeps an envelope %s refusal unknown',
+    async (code) => {
+      const client = clientReturning(
+        { ok: true, result: { supported: true } },
+        {
+          ok: true,
+          result: {
+            ok: false,
+            refusal: { code, message: 'create outcome ambiguous' }
+          }
+        }
+      )
+
+      await expect(createMobileStructuredCodexSession(client, 'workspace-1')).resolves.toEqual({
+        kind: 'unknown',
+        message: 'create outcome ambiguous'
+      })
+    }
+  )
 })
diff --git a/mobile/src/session/mobile-structured-agent-session-launch.ts b/mobile/src/session/mobile-structured-agent-session-launch.ts
index ecad0410dfd..b7eb8289e84 100644
--- a/mobile/src/session/mobile-structured-agent-session-launch.ts
+++ b/mobile/src/session/mobile-structured-agent-session-launch.ts
@@ -2,6 +2,7 @@ import type {
   AgentSessionAttachResult,
   AgentSessionMutationResult
 } from '../../../src/shared/agent-session-wire'
+import { isDefinitiveAgentSessionCreateRefusal } from '../../../src/shared/agent-session-definitive-refusal'
 import { structuredAgentSessionPayloadFingerprint } from '../../../src/shared/structured-agent-session-mutation'
 import type { RpcClient } from '../transport/rpc-client'
 import { structuredSessionOperationId } from './mobile-structured-agent-session-rpc'
@@ -66,6 +67,13 @@ function unknownCreateResult(error: unknown): MobileStructuredCodexLaunchResult
   }
 }
 
+function classifyCreateRefusal(code: string, message: string): MobileStructuredCodexLaunchResult {
+  if (!isDefinitiveAgentSessionCreateRefusal(code)) {
+    return unknownCreateResult(new Error(message))
+  }
+  return { kind: 'failed', message: message || 'Could not open Codex chat.' }
+}
+
 export async function createMobileStructuredCodexSession(
   client: RpcClient,
   worktreeId: string
@@ -125,10 +133,7 @@ export async function createMobileStructuredCodexSession(
     ) {
       return unknownCreateResult(new Error('The Codex chat result could not be confirmed.'))
     }
-    if (response.error.code === 'agent_session_operation_unknown') {
-      return unknownCreateResult(new Error(response.error.message))
-    }
-    return { kind: 'failed', message: response.error.message || 'Could not open Codex chat.' }
+    return classifyCreateRefusal(response.error.code, response.error.message)
   }
   const result = response.result as AgentSessionMutationResult<AgentSessionAttachResult>
   if (!result || typeof result !== 'object' || typeof result.ok !== 'boolean') {
@@ -142,10 +147,7 @@ export async function createMobileStructuredCodexSession(
     ) {
       return unknownCreateResult(new Error('The Codex chat result could not be confirmed.'))
     }
-    if (result.refusal.code === 'agent_session_operation_unknown') {
-      return unknownCreateResult(new Error(result.refusal.message))
-    }
-    return { kind: 'failed', message: result.refusal.message || 'Could not open Codex chat.' }
+    return classifyCreateRefusal(result.refusal.code, result.refusal.message)
   }
   if (
     !result.value ||
diff --git a/mobile/src/session/use-mobile-native-chat-controller.ts b/mobile/src/session/use-mobile-native-chat-controller.ts
index bf944398e87..a946956f8d6 100644
--- a/mobile/src/session/use-mobile-native-chat-controller.ts
+++ b/mobile/src/session/use-mobile-native-chat-controller.ts
@@ -10,9 +10,8 @@ import { useMobileNativeChatDrafts } from './use-mobile-native-chat-drafts'
 import { useMobileNativeChatFileSearch } from './use-mobile-native-chat-file-search'
 import { useMobileNativeChatMessageSend } from './use-mobile-native-chat-message-send'
 import { mobileNativeChatStreamPreview } from './mobile-native-chat-streaming-gate'
-import { useMobileNativeChatSession } from './use-mobile-native-chat-session'
 import { useMobileNativeChatSessionOptionController } from './use-mobile-native-chat-session-option-controller'
-import { useMobileStructuredAgentSession } from './use-mobile-structured-agent-session'
+import { useMobileNativeChatSessionLane } from './use-mobile-native-chat-session-lane'
 import { useMobileStructuredNativeChatSendBridge } from './use-mobile-structured-native-chat-send-bridge'
 import { useMobileNativeChatPrompts } from './use-mobile-native-chat-prompts'
 import { useMobileNativeChatStop } from './use-mobile-native-chat-stop'
@@ -82,27 +81,19 @@ export function useMobileNativeChatController(args: {
     nativeChatTranscriptIsLocalReadable
   })
 
-  const legacyNativeChatSession = useMobileNativeChatSession({
-    client,
-    sourceIdentity,
-    agent: activeChatStructured ? null : (activeChatResolution?.agent ?? null),
-    sessionId: activeChatStructured ? null : activeChatSessionId,
-    transcriptPath: activeChatStructured ? null : (activeChatResolution?.transcriptPath ?? null)
-  })
-  const structuredNativeChat = useMobileStructuredAgentSession({
-    client,
-    sessionId: activeChatStructured ? activeChatSessionId : null,
-    sourceIdentity,
-    enabled: showNativeChat,
-    // Holds are connection-scoped; dropping this on transport loss lets the hook
-    // reacquire the provider without clearing the cached transcript.
-    connected: connState === 'connected',
-    agent: activeChatStructured ? activeChatAgent : null,
-    onSendError
-  })
-  const nativeChatSession = activeChatStructured
-    ? structuredNativeChat.session
-    : legacyNativeChatSession
+  const { structuredSession: structuredNativeChat, session: nativeChatSession } =
+    useMobileNativeChatSessionLane({
+      client,
+      structured: activeChatStructured,
+      agent: activeChatAgent,
+      resolvedAgent: activeChatResolution?.agent ?? null,
+      transcriptPath: activeChatResolution?.transcriptPath ?? null,
+      sessionId: activeChatSessionId,
+      sourceIdentity,
+      enabled: showNativeChat,
+      connState,
+      onSendError
+    })
   const {
     composerText: chatComposerText,
     setComposerText: setChatComposerText,
@@ -303,6 +294,8 @@ export function useMobileNativeChatController(args: {
     chatPending,
     chatImagePreviewsByMessageId,
     nativeChatSession,
+    /** Structured lane: drives the per-turn status row and live tool progress. */
+    nativeChatStructured: activeChatStructured,
     nativeChatAgentWorking,
     nativeChatStreamingText,
     nativeChatStreamLive,
diff --git a/mobile/src/session/use-mobile-native-chat-image-attachments.test.ts b/mobile/src/session/use-mobile-native-chat-image-attachments.test.ts
index cb8522bae7a..022bb8c3953 100644
--- a/mobile/src/session/use-mobile-native-chat-image-attachments.test.ts
+++ b/mobile/src/session/use-mobile-native-chat-image-attachments.test.ts
@@ -182,9 +182,12 @@ describe('useMobileNativeChatImageAttachments', () => {
     expect(sendCalls).toHaveLength(2)
     expect(sendCalls[0]?.params).toMatchObject({ text: '\x15', enter: false })
     expect(sendCalls[1]?.params).toMatchObject({
-      text: '\x1b[200~/tmp/a.png\x1b[201~',
+      text: '\x1b[200~/tmp/a.png\x1b[201~ ',
       enter: false
     })
+    const combined = String(sendCalls[1]?.params.text ?? '') + 'look at this'
+    expect(combined).toContain('.png\x1b[201~ look')
+    expect(combined).not.toContain('.png\x1b[201~look')
     // Clear, then paste, then settle, then the text send — in that order.
     expect(order).toEqual(['clear', 'paste', 'settle', 'text:look at this'])
     // The local preview URI rides along so the sent bubble shows the photo.
@@ -267,7 +270,10 @@ describe('useMobileNativeChatImageAttachments', () => {
     }
   })
 
-  it('routes an attachments-only send through baseSend with empty text so the echo still shows the photo', async () => {
+  it.each([
+    ['empty', ''],
+    ['whitespace-only', '   ']
+  ])('routes an attachments-only send through baseSend with %s text', async (_label, text) => {
     pick.mockResolvedValue([{ base64: 'AAAA', uri: 'file:///a.jpg' }])
     const client = makeClient([
       methodNotFound('start'),
@@ -283,16 +289,17 @@ describe('useMobileNativeChatImageAttachments', () => {
     })
     let accepted = false
     await act(async () => {
-      accepted = await hook!.sendNativeChat('')
+      accepted = await hook!.sendNativeChat(text)
     })
 
     expect(accepted).toBe(true)
-    // Empty text still goes through baseSend (which submits the bare Enter) so the
+    // Attachment-only text still goes through baseSend (which submits Enter) so the
     // optimistic echo carries the preview URI.
-    expect(baseSend).toHaveBeenCalledWith('', ['file:///a.jpg'], expect.any(Number))
+    expect(baseSend).toHaveBeenCalledWith(text, ['file:///a.jpg'], expect.any(Number))
     const sendCalls = client.calls.filter((c) => c.method === 'terminal.send')
     // Only the clear + image paste hit the wire here; baseSend owns the submit.
     expect(sendCalls).toHaveLength(2)
+    expect(sendCalls[1]?.params.text).toBe('\x1b[200~/tmp/a.png\x1b[201~')
     expect(hook!.attachments).toEqual([])
   })
 
diff --git a/mobile/src/session/use-mobile-native-chat-image-attachments.ts b/mobile/src/session/use-mobile-native-chat-image-attachments.ts
index 77d839adf34..c36e30f44d7 100644
--- a/mobile/src/session/use-mobile-native-chat-image-attachments.ts
+++ b/mobile/src/session/use-mobile-native-chat-image-attachments.ts
@@ -240,6 +240,7 @@ export function useMobileNativeChatImageAttachments({
             terminal: handle,
             deviceToken: deviceTokenRef.current,
             imagePaths: pendingImages.map((attachment) => attachment.path),
+            followedByText: text.trim().length > 0,
             deadline,
             ...(seededLaunchDraft
               ? { clearInput: buildAgentTuiClearInputForText(seededLaunchDraft) }
diff --git a/mobile/src/session/use-mobile-native-chat-session-lane.ts b/mobile/src/session/use-mobile-native-chat-session-lane.ts
new file mode 100644
index 00000000000..fc465de902b
--- /dev/null
+++ b/mobile/src/session/use-mobile-native-chat-session-lane.ts
@@ -0,0 +1,59 @@
+import type { RpcClient } from '../transport/rpc-client'
+import type { ConnectionState } from '../transport/types'
+import { useMobileNativeChatSession } from './use-mobile-native-chat-session'
+import { useMobileStructuredAgentSession } from './use-mobile-structured-agent-session'
+
+/** Mounts both transcript sources and hands back the one this tab's lane owns.
+ *  Both hooks always run (hook order is fixed); the inactive lane is starved of
+ *  its identity inputs rather than unmounted, so a lane flip keeps its cache. */
+export function useMobileNativeChatSessionLane({
+  client,
+  structured,
+  agent,
+  resolvedAgent,
+  transcriptPath,
+  sessionId,
+  sourceIdentity,
+  enabled,
+  connState,
+  onSendError
+}: {
+  client: RpcClient | null
+  structured: boolean
+  /** Agent id for the structured provider session. */
+  agent: string | null
+  /** Agent resolved from the terminal, for the bridge transcript reader. */
+  resolvedAgent: string | null
+  transcriptPath: string | null
+  sessionId: string | null
+  sourceIdentity: Parameters<typeof useMobileNativeChatSession>[0]['sourceIdentity']
+  enabled: boolean
+  connState: ConnectionState
+  onSendError: (message: string) => void
+}): {
+  structuredSession: ReturnType<typeof useMobileStructuredAgentSession>
+  session: ReturnType<typeof useMobileNativeChatSession>
+} {
+  const bridgeSession = useMobileNativeChatSession({
+    client,
+    sourceIdentity,
+    agent: structured ? null : resolvedAgent,
+    sessionId: structured ? null : sessionId,
+    transcriptPath: structured ? null : transcriptPath
+  })
+  const structuredSession = useMobileStructuredAgentSession({
+    client,
+    sessionId: structured ? sessionId : null,
+    sourceIdentity,
+    enabled,
+    // Holds are connection-scoped; dropping this on transport loss lets the hook
+    // reacquire the provider without clearing the cached transcript.
+    connected: connState === 'connected',
+    agent: structured ? agent : null,
+    onSendError
+  })
+  return {
+    structuredSession,
+    session: structured ? structuredSession.session : bridgeSession
+  }
+}
diff --git a/mobile/src/session/use-mobile-native-chat-session-options.ts b/mobile/src/session/use-mobile-native-chat-session-options.ts
index 66a929aeb56..6acdf8b3750 100644
--- a/mobile/src/session/use-mobile-native-chat-session-options.ts
+++ b/mobile/src/session/use-mobile-native-chat-session-options.ts
@@ -168,7 +168,8 @@ export function useMobileNativeChatSessionOptions(args: {
       models: activeModels(catalog, record),
       record,
       mode: 'live',
-      modelLabel: 'Model'
+      modelLabel: 'Model',
+      liveTransport: 'catalog'
     })
   }, [agent, catalog, scopeKey, version])
 
diff --git a/mobile/src/session/use-mobile-native-chat-turn-disclosure.test.tsx b/mobile/src/session/use-mobile-native-chat-turn-disclosure.test.tsx
new file mode 100644
index 00000000000..8467684ce16
--- /dev/null
+++ b/mobile/src/session/use-mobile-native-chat-turn-disclosure.test.tsx
@@ -0,0 +1,153 @@
+import { createElement } from 'react'
+import { act, create, type ReactTestRenderer } from 'react-test-renderer'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { NativeChatMessage } from '../../../src/shared/native-chat-types'
+import { useMobileNativeChatTurnDisclosure } from './use-mobile-native-chat-turn-disclosure'
+
+function userMessage(id: string): NativeChatMessage {
+  return {
+    id,
+    role: 'user',
+    blocks: [{ type: 'text', text: id }],
+    timestamp: null,
+    source: 'transcript'
+  }
+}
+
+function Harness({
+  messages,
+  enabled,
+  isWorking = true,
+  scopeKey = 'host\0worktree\0tab-a'
+}: {
+  messages: readonly NativeChatMessage[]
+  enabled: boolean
+  isWorking?: boolean
+  scopeKey?: string
+}): React.JSX.Element {
+  const disclosure = useMobileNativeChatTurnDisclosure({
+    messages,
+    enabled,
+    isWorking,
+    scopeKey
+  })
+  return createElement('result', { disclosure })
+}
+
+describe('useMobileNativeChatTurnDisclosure', () => {
+  let renderer: ReactTestRenderer | null = null
+
+  afterEach(() => {
+    act(() => renderer?.unmount())
+    renderer = null
+  })
+
+  it('does not scan bridge-lane transcripts', () => {
+    const messages: NativeChatMessage[] = [
+      {
+        id: 'u1',
+        role: 'user',
+        blocks: [{ type: 'text', text: 'go' }],
+        timestamp: null,
+        source: 'transcript'
+      }
+    ]
+    const findLastIndex = vi.spyOn(messages, 'findLastIndex')
+    const slice = vi.spyOn(messages, 'slice')
+    const filter = vi.spyOn(messages, 'filter')
+    const map = vi.spyOn(messages, 'map')
+
+    act(() => {
+      renderer = create(createElement(Harness, { messages, enabled: false }))
+    })
+
+    expect(findLastIndex).not.toHaveBeenCalled()
+    expect(slice).not.toHaveBeenCalled()
+    expect(filter).not.toHaveBeenCalled()
+    expect(map).not.toHaveBeenCalled()
+  })
+
+  it('keeps a settled turn handler stable for NUL-delimited scope keys', () => {
+    vi.useFakeTimers()
+    try {
+      vi.setSystemTime(1_000)
+      const messages: NativeChatMessage[] = [
+        {
+          id: 'u1',
+          role: 'user',
+          blocks: [{ type: 'text', text: 'go' }],
+          timestamp: null,
+          source: 'transcript'
+        }
+      ]
+      act(() => {
+        renderer = create(createElement(Harness, { messages, enabled: true }))
+      })
+      vi.setSystemTime(6_000)
+      act(() => {
+        renderer?.update(createElement(Harness, { messages, enabled: true, isWorking: false }))
+      })
+      const first = renderer!.root.findByType('result').props.disclosure.resolveRow(0, messages[0])
+
+      const refreshed = [...messages]
+      act(() => {
+        renderer?.update(
+          createElement(Harness, { messages: refreshed, enabled: true, isWorking: false })
+        )
+      })
+      const second = renderer!.root
+        .findByType('result')
+        .props.disclosure.resolveRow(0, refreshed[0])
+
+      // The row carries the key; the handler itself lives on the hook and stays
+      // stable for the scope, so a re-render never disturbs a row's memo.
+      expect(first.turnKey).toBe('u1')
+      expect(second.turnKey).toBe('u1')
+      const firstHandler = renderer!.root.findByType('result').props.disclosure.onToggleTurn
+      expect(firstHandler).toBeTypeOf('function')
+      act(() => {
+        renderer?.update(
+          createElement(Harness, { messages: [...refreshed], enabled: true, isWorking: false })
+        )
+      })
+      expect(renderer!.root.findByType('result').props.disclosure.onToggleTurn).toBe(firstHandler)
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('keeps at most the latest 128 turns expanded', () => {
+    vi.useFakeTimers()
+    try {
+      let messages: NativeChatMessage[] = []
+      for (let index = 0; index < 129; index++) {
+        messages = messages.concat(userMessage(`u${index}`))
+        vi.setSystemTime(index * 2_000)
+        act(() => {
+          if (renderer) {
+            renderer.update(createElement(Harness, { messages, enabled: true }))
+          } else {
+            renderer = create(createElement(Harness, { messages, enabled: true }))
+          }
+        })
+        vi.setSystemTime(index * 2_000 + 1_000)
+        act(() => {
+          renderer?.update(createElement(Harness, { messages, enabled: true, isWorking: false }))
+        })
+        const disclosureNow = renderer!.root.findByType('result').props.disclosure
+        const row = disclosureNow.resolveRow(index, messages[index])
+        act(() => disclosureNow.onToggleTurn(row.turnKey))
+      }
+
+      const disclosure = renderer!.root.findByType('result').props.disclosure
+      const expanded = messages.filter(
+        (message, index) => disclosure.resolveRow(index, message).turnExpanded
+      )
+      expect(expanded).toHaveLength(128)
+      expect(disclosure.resolveRow(0, messages[0]).turnExpanded).toBe(false)
+      expect(disclosure.resolveRow(128, messages[128]).turnExpanded).toBe(true)
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+})
diff --git a/mobile/src/session/use-mobile-native-chat-turn-disclosure.ts b/mobile/src/session/use-mobile-native-chat-turn-disclosure.ts
new file mode 100644
index 00000000000..46b58f29cba
--- /dev/null
+++ b/mobile/src/session/use-mobile-native-chat-turn-disclosure.ts
@@ -0,0 +1,126 @@
+import { useCallback, useMemo, useState } from 'react'
+import type { NativeChatMessage } from '../../../src/shared/native-chat-types'
+import {
+  MOBILE_UNANCHORED_TURN_KEY,
+  useMobileNativeChatTurnStatus,
+  type NativeChatTurnStatus
+} from './use-mobile-native-chat-turn-status'
+
+const EMPTY_TURN_IDS: ReadonlySet<string> = new Set()
+const EMPTY_TURN_KEYS: readonly undefined[] = []
+const MAX_EXPANDED_TURNS = 128
+
+export type MobileNativeChatTurnRow = {
+  turnStatus: NativeChatTurnStatus | null
+  turnExpanded: boolean
+  /** Set only on a settled turn — the one row that has activity to disclose. */
+  turnKey?: string
+  activeTurnIsWorking: boolean
+}
+
+/** Owns the transcript's per-turn status rows and their disclosure state, and
+ *  resolves what one list row needs. Bridge-lane chats pass `enabled: false` and
+ *  keep their single three-dot working indicator instead. */
+export function useMobileNativeChatTurnDisclosure({
+  messages,
+  enabled,
+  isWorking,
+  scopeKey
+}: {
+  messages: readonly NativeChatMessage[]
+  enabled: boolean
+  isWorking: boolean
+  /** Host/worktree/tab identity for timing and disclosure isolation. */
+  scopeKey: string
+}): {
+  active: NativeChatTurnStatus | null
+  /** True when the live turn has no user message to hang its status row under. */
+  activeTurnIsUnanchored: boolean
+  onToggleTurn: (turnKey: string) => void
+  resolveRow: (index: number, message: NativeChatMessage) => MobileNativeChatTurnRow
+} {
+  const turnStatuses = useMobileNativeChatTurnStatus({
+    messages,
+    enabled,
+    isWorking,
+    scopeKey
+  })
+  const [expandedTurns, setExpandedTurns] = useState<{
+    scopeKey: string
+    turnIds: ReadonlySet<string>
+  }>(() => ({ scopeKey, turnIds: new Set() }))
+  const expandedTurnIds =
+    expandedTurns.scopeKey === scopeKey ? expandedTurns.turnIds : EMPTY_TURN_IDS
+  const toggleExpandedTurn = useCallback(
+    (turnKey: string) => {
+      setExpandedTurns((current) => {
+        const next = new Set(current.scopeKey === scopeKey ? current.turnIds : [])
+        if (!next.delete(turnKey)) {
+          if (next.size >= MAX_EXPANDED_TURNS) {
+            const oldest = next.values().next().value
+            if (oldest) {
+              next.delete(oldest)
+            }
+          }
+          next.add(turnKey)
+        }
+        return { scopeKey, turnIds: next }
+      })
+    },
+    [scopeKey]
+  )
+  // Resolve each row's turn boundary once — a findLast per row is quadratic on a
+  // long transcript.
+  const turnKeys = useMemo(() => {
+    if (!enabled) {
+      return EMPTY_TURN_KEYS
+    }
+    let turnKey: string | undefined
+    return messages.map((message) => {
+      if (message.role === 'user') {
+        turnKey = message.id
+      }
+      return turnKey
+    })
+  }, [enabled, messages])
+
+  const { active, activeTurnKey, completedByTurn } = turnStatuses
+  const resolveRow = useCallback(
+    (index: number, message: NativeChatMessage): MobileNativeChatTurnRow => {
+      const turnKey = turnKeys[index]
+      const turnStatus =
+        !enabled || message.role !== 'user'
+          ? null
+          : turnKey === activeTurnKey
+            ? active
+            : turnKey
+              ? (completedByTurn[turnKey] ?? null)
+              : null
+      return {
+        turnStatus,
+        turnExpanded: turnKey ? expandedTurnIds.has(turnKey) : false,
+        // Why: the key travels and the row calls one stable handler with it. A
+        // closure per row would be a new identity every render of a streaming
+        // transcript, defeating the row's memo; caching one per turn would mean
+        // writing a ref during render, which react-freeze can discard.
+        turnKey: turnKey && turnStatus?.workedSeconds != null ? turnKey : undefined,
+        // With no user boundary at all, the session's working state stays authoritative.
+        activeTurnIsWorking:
+          enabled &&
+          isWorking &&
+          (turnKey === activeTurnKey ||
+            (turnKey === undefined && activeTurnKey === MOBILE_UNANCHORED_TURN_KEY))
+      }
+    },
+    [turnKeys, enabled, activeTurnKey, active, completedByTurn, expandedTurnIds, isWorking]
+  )
+
+  return {
+    active,
+    /** Stable for a given chat scope, so it never disturbs a row's memo. */
+    onToggleTurn: toggleExpandedTurn,
+    activeTurnIsUnanchored:
+      enabled && active != null && activeTurnKey === MOBILE_UNANCHORED_TURN_KEY,
+    resolveRow
+  }
+}
diff --git a/mobile/src/session/use-mobile-native-chat-turn-status.ts b/mobile/src/session/use-mobile-native-chat-turn-status.ts
new file mode 100644
index 00000000000..13afbe70c09
--- /dev/null
+++ b/mobile/src/session/use-mobile-native-chat-turn-status.ts
@@ -0,0 +1,105 @@
+import { useEffect, useMemo, useRef, useState } from 'react'
+import type { NativeChatMessage } from '../../../src/shared/native-chat-types'
+import {
+  nativeChatTurnHasResponse,
+  reduceNativeChatTurnTiming,
+  selectNativeChatTurnStatuses,
+  type NativeChatTurnStatus,
+  type NativeChatTurnTimingByTurn
+} from '../../../src/shared/native-chat-turn-status'
+
+export type { NativeChatTurnStatus }
+
+export const MOBILE_UNANCHORED_TURN_KEY = '__unanchored__'
+const EMPTY_TURN_TIMING_BY_TURN: NativeChatTurnTimingByTurn = Object.freeze({})
+
+type ScopedTurnTiming = {
+  scopeKey: string
+  timingByTurn: NativeChatTurnTimingByTurn
+}
+
+/** Per-turn "Thinking / Working for N / Worked for N" timing, on the same shared
+ *  state machine the desktop renderer uses so the two surfaces stamp turns alike. */
+export function useMobileNativeChatTurnStatus({
+  messages,
+  enabled,
+  isWorking,
+  workingStartedAt,
+  scopeKey
+}: {
+  messages: readonly NativeChatMessage[]
+  enabled: boolean
+  isWorking: boolean
+  workingStartedAt?: number | null
+  /** Host/worktree/tab identity. Timings never carry across chat surfaces. */
+  scopeKey: string
+}): {
+  active: NativeChatTurnStatus | null
+  completedByTurn: Readonly<Record<string, NativeChatTurnStatus>>
+  activeTurnKey: string
+} {
+  const latestUserIndex = enabled
+    ? messages.findLastIndex((message) => message.role === 'user')
+    : -1
+  const hasCurrentTurnResponse = enabled && nativeChatTurnHasResponse(messages, latestUserIndex)
+  const latestUserId = latestUserIndex !== -1 ? (messages[latestUserIndex]?.id ?? null) : null
+  const activeTurnKey = latestUserId ?? MOBILE_UNANCHORED_TURN_KEY
+  const [scopedTiming, setScopedTiming] = useState<ScopedTurnTiming>(() => ({
+    scopeKey,
+    timingByTurn: {}
+  }))
+  // Do not expose the previous surface's state during the render before the
+  // timing effect adopts the new scope, or scan it while this UI is disabled.
+  const timingByTurn =
+    enabled && scopedTiming.scopeKey === scopeKey
+      ? scopedTiming.timingByTurn
+      : EMPTY_TURN_TIMING_BY_TURN
+  // An accepted send renders as `pending-N` until the transcript echo lands under
+  // its real id. That is one turn under two keys, so the clock must survive the swap.
+  const previousActiveTurn = useRef<{ scopeKey: string; turnKey: string } | null>(null)
+
+  useEffect(() => {
+    if (!enabled) {
+      return
+    }
+    const validTurnKeys = new Set(
+      messages.filter((message) => message.role === 'user').map((message) => message.id)
+    )
+    const previousActiveTurnKey =
+      previousActiveTurn.current?.scopeKey === scopeKey
+        ? previousActiveTurn.current.turnKey
+        : undefined
+    previousActiveTurn.current = { scopeKey, turnKey: activeTurnKey }
+    setScopedTiming((current) => {
+      const currentTiming =
+        current.scopeKey === scopeKey ? current.timingByTurn : EMPTY_TURN_TIMING_BY_TURN
+      const nextTiming = reduceNativeChatTurnTiming(currentTiming, {
+        activeTurnKey,
+        previousActiveTurnKey,
+        validTurnKeys,
+        isWorking,
+        workingStartedAt,
+        now: Date.now()
+      })
+      return current.scopeKey === scopeKey && nextTiming === currentTiming
+        ? current
+        : { scopeKey, timingByTurn: nextTiming }
+    })
+  }, [activeTurnKey, enabled, isWorking, messages, scopeKey, workingStartedAt])
+
+  // Why: the selection rebuilds its status objects on every call, and a streaming
+  // turn re-renders ~20x/s. Without this, every settled turn's row gets fresh
+  // props each tick and the memoized message rows all re-render.
+  const turnIsWorking = enabled && isWorking
+  const statuses = useMemo(
+    () =>
+      selectNativeChatTurnStatuses(timingByTurn, {
+        activeTurnKey,
+        isWorking: turnIsWorking,
+        workingStartedAt,
+        hasCurrentTurnResponse
+      }),
+    [timingByTurn, activeTurnKey, turnIsWorking, workingStartedAt, hasCurrentTurnResponse]
+  )
+  return { ...statuses, activeTurnKey }
+}
diff --git a/mobile/src/session/use-mobile-session-terminal-create-actions.test.ts b/mobile/src/session/use-mobile-session-terminal-create-actions.test.ts
index c0a4e8368c5..e46bf087f38 100644
--- a/mobile/src/session/use-mobile-session-terminal-create-actions.test.ts
+++ b/mobile/src/session/use-mobile-session-terminal-create-actions.test.ts
@@ -137,14 +137,17 @@ describe('mobile + Codex tab creation routing', () => {
     expect(scope.setActiveSessionTabId).toHaveBeenCalledWith('terminal-tab-1')
   })
 
-  it('falls back to a terminal when structured creation is refused', async () => {
+  it('falls back to a terminal when structured creation is definitively refused', async () => {
     const client = clientReturning(
       { ok: true, result: { supported: true } },
       {
         ok: true,
         result: {
           ok: false,
-          refusal: { code: 'agent_session_ownership_unknown', message: 'provider unavailable' }
+          refusal: {
+            code: 'structured_agent_session_unsupported',
+            message: 'provider unavailable'
+          }
         }
       },
       terminalCreateResponse()
@@ -228,4 +231,34 @@ describe('mobile + Codex tab creation routing', () => {
     expect(scope.setCreateError).toHaveBeenCalledWith('still unknown')
     expect(scope.showToast).toHaveBeenCalledWith('still unknown', 1800)
   })
+
+  it.each(['agent_session_operation_unknown', 'runtime_error', 'future_unknown_code'])(
+    'does not create a legacy sibling after a top-level %s response',
+    async (code) => {
+      const client = clientReturning(
+        { ok: true, result: { supported: true } },
+        { ok: false, error: { code, message: 'create outcome ambiguous' } }
+      )
+      const scope = createScope(client)
+      let actions: ReturnType<typeof useMobileSessionTerminalCreateActions> | undefined
+      function Harness() {
+        actions = useMobileSessionTerminalCreateActions(scope as never)
+        return null
+      }
+      await act(async () => {
+        renderer = create(createElement(Harness))
+      })
+      await act(async () => {
+        await actions?.handleCreateTerminal('codex')
+      })
+
+      const sendRequest = client.sendRequest as unknown as ReturnType<typeof vi.fn>
+      expect(sendRequest.mock.calls.map(([method]) => method)).toEqual([
+        'agentSession.createSupport',
+        'agentSession.create'
+      ])
+      expect(scope.setCreateError).toHaveBeenCalledWith('create outcome ambiguous')
+      expect(scope.showToast).toHaveBeenCalledWith('create outcome ambiguous', 1800)
+    }
+  )
 })
diff --git a/mobile/src/session/use-mobile-session-terminal-runtime.ts b/mobile/src/session/use-mobile-session-terminal-runtime.ts
index 5086efe1ba1..374a9eefd94 100644
--- a/mobile/src/session/use-mobile-session-terminal-runtime.ts
+++ b/mobile/src/session/use-mobile-session-terminal-runtime.ts
@@ -1,5 +1,5 @@
 import { useState, useRef, useCallback } from 'react'
-import type { Keyboard, TextInput } from 'react-native'
+import { Platform, type Keyboard, type TextInput } from 'react-native'
 import { useFocusEffect } from 'expo-router'
 import type { RpcClient } from '../transport/rpc-client'
 import type { ConnectionState } from '../transport/types'
@@ -142,6 +142,7 @@ export function useMobileSessionTerminalRuntime(scope: MobileSessionScreenStateM
     lifecycleIdentity: client,
     lifecycleKey: JSON.stringify([hostId, worktreeId, connState]),
     liveInputEnabled,
+    reopenFocusedInputWhenKeyboardHidden: Platform.OS === 'android',
     timerRef: liveInputFocusTimerRef
   })
   useFocusEffect(
diff --git a/mobile/src/terminal/terminal-live-input.test.ts b/mobile/src/terminal/terminal-live-input.test.ts
index daca212d4a8..a9ec903f637 100644
--- a/mobile/src/terminal/terminal-live-input.test.ts
+++ b/mobile/src/terminal/terminal-live-input.test.ts
@@ -196,18 +196,40 @@ describe('terminal live input', () => {
     const input = createFocusTarget(() => true)
     const refocus = vi.fn()
 
-    focusTerminalLiveInputTarget(input, { keyboardHeight: 0, refocus })
+    focusTerminalLiveInputTarget(input, {
+      keyboardHeight: 0,
+      refocus,
+      reopenFocusedInputWhenKeyboardHidden: true
+    })
 
     expect(input.blur).toHaveBeenCalledTimes(1)
     expect(input.focus).not.toHaveBeenCalled()
     expect(refocus).toHaveBeenCalledTimes(1)
   })
+  it('keeps an iPad hardware-keyboard responder focused when the software keyboard is absent', () => {
+    const input = createFocusTarget(() => true)
+    const refocus = vi.fn()
+
+    focusTerminalLiveInputTarget(input, {
+      keyboardHeight: 0,
+      refocus,
+      reopenFocusedInputWhenKeyboardHidden: false
+    })
+
+    expect(input.blur).not.toHaveBeenCalled()
+    expect(input.focus).toHaveBeenCalledTimes(1)
+    expect(refocus).not.toHaveBeenCalled()
+  })
 
   it('focuses the capture input directly when the keyboard is open', () => {
     const input = createFocusTarget(() => true)
     const refocus = vi.fn()
 
-    focusTerminalLiveInputTarget(input, { keyboardHeight: 240, refocus })
+    focusTerminalLiveInputTarget(input, {
+      keyboardHeight: 240,
+      refocus,
+      reopenFocusedInputWhenKeyboardHidden: true
+    })
 
     expect(input.blur).not.toHaveBeenCalled()
     expect(input.focus).toHaveBeenCalledTimes(1)
@@ -218,7 +240,11 @@ describe('terminal live input', () => {
     const input = createFocusTarget(() => false)
     const refocus = vi.fn()
 
-    focusTerminalLiveInputTarget(input, { keyboardHeight: 0, refocus })
+    focusTerminalLiveInputTarget(input, {
+      keyboardHeight: 0,
+      refocus,
+      reopenFocusedInputWhenKeyboardHidden: true
+    })
 
     expect(input.blur).not.toHaveBeenCalled()
     expect(input.focus).toHaveBeenCalledTimes(1)
diff --git a/mobile/src/terminal/terminal-live-input.ts b/mobile/src/terminal/terminal-live-input.ts
index 321226c0c7d..42b4d5cb2cf 100644
--- a/mobile/src/terminal/terminal-live-input.ts
+++ b/mobile/src/terminal/terminal-live-input.ts
@@ -75,6 +75,7 @@ export type TerminalLiveInputFocusTarget = {
 type FocusTerminalLiveInputTargetOptions = {
   readonly keyboardHeight: number
   readonly refocus: () => void
+  readonly reopenFocusedInputWhenKeyboardHidden: boolean
 }
 
 export type TerminalLiveInputDefaultResult = {
@@ -230,13 +231,17 @@ export function scheduleTerminalLiveInputFocus(
 
 export function focusTerminalLiveInputTarget(
   input: TerminalLiveInputFocusTarget | null,
-  { keyboardHeight, refocus }: FocusTerminalLiveInputTargetOptions
+  {
+    keyboardHeight,
+    refocus,
+    reopenFocusedInputWhenKeyboardHidden
+  }: FocusTerminalLiveInputTargetOptions
 ): void {
   if (!input) {
     return
   }
 
-  if (keyboardHeight <= 0 && input.isFocused?.()) {
+  if (reopenFocusedInputWhenKeyboardHidden && keyboardHeight <= 0 && input.isFocused?.()) {
     // Why: Android can keep a hidden TextInput focused after the IME is dismissed;
     // focus() is then a no-op, so force a new focus session to reopen the keyboard.
     input.blur()
diff --git a/mobile/src/terminal/use-terminal-live-input-focus.test.ts b/mobile/src/terminal/use-terminal-live-input-focus.test.ts
index 92ce4e2c455..cb906b164c7 100644
--- a/mobile/src/terminal/use-terminal-live-input-focus.test.ts
+++ b/mobile/src/terminal/use-terminal-live-input-focus.test.ts
@@ -15,6 +15,7 @@ type HarnessProps = {
   readonly lifecycleIdentity: object | null
   readonly lifecycleKey: string
   readonly liveInputEnabled: boolean
+  readonly reopenFocusedInputWhenKeyboardHidden: boolean
   readonly timerRef: TerminalLiveInputFocusTimerRef
 }
 
@@ -92,6 +93,7 @@ function connectedProps(
     lifecycleIdentity: null,
     lifecycleKey: 'host-a:worktree-a:connected',
     liveInputEnabled: true,
+    reopenFocusedInputWhenKeyboardHidden: true,
     timerRef
   }
 }
@@ -128,6 +130,22 @@ describe('terminal live input focus hook', () => {
     expect(input.focus).toHaveBeenCalledTimes(2)
     harness.unmount()
   })
+  it('preserves the focused iPad responder when a hardware keyboard keeps keyboard height at zero', () => {
+    vi.useFakeTimers()
+    const input = createFocusTarget(true)
+    const inputRef = { current: input }
+    const harness = createHarness({
+      ...connectedProps(inputRef),
+      reopenFocusedInputWhenKeyboardHidden: false
+    })
+
+    harness.handlers().handleTerminalTap('terminal-a')
+    vi.runAllTimers()
+
+    expect(input.blur).not.toHaveBeenCalled()
+    expect(input.focus).toHaveBeenCalledTimes(1)
+    harness.unmount()
+  })
 
   it('cancels focus when navigation reuses the mounted route', () => {
     vi.useFakeTimers()
diff --git a/mobile/src/terminal/use-terminal-live-input-focus.ts b/mobile/src/terminal/use-terminal-live-input-focus.ts
index b0ab456b721..36fa0f5272e 100644
--- a/mobile/src/terminal/use-terminal-live-input-focus.ts
+++ b/mobile/src/terminal/use-terminal-live-input-focus.ts
@@ -11,6 +11,7 @@ type TerminalLiveInputFocusContext = {
   readonly canSend: boolean
   readonly keyboardHeight: number
   readonly liveInputEnabled: boolean
+  readonly reopenFocusedInputWhenKeyboardHidden: boolean
 }
 
 type UseTerminalLiveInputFocusOptions<T extends TerminalLiveInputFocusTarget> =
@@ -35,17 +36,24 @@ export function useTerminalLiveInputFocus<T extends TerminalLiveInputFocusTarget
   keyboardHeight,
   lifecycleIdentity,
   lifecycleKey,
+  reopenFocusedInputWhenKeyboardHidden,
   liveInputEnabled,
   timerRef
 }: UseTerminalLiveInputFocusOptions<T>): TerminalLiveInputFocusHandlers {
   const contextRef = useRef<TerminalLiveInputFocusContext>({
     canSend,
     keyboardHeight,
-    liveInputEnabled
+    liveInputEnabled,
+    reopenFocusedInputWhenKeyboardHidden
   })
   useLayoutEffect(() => {
-    contextRef.current = { canSend, keyboardHeight, liveInputEnabled }
-  }, [canSend, keyboardHeight, liveInputEnabled])
+    contextRef.current = {
+      canSend,
+      keyboardHeight,
+      liveInputEnabled,
+      reopenFocusedInputWhenKeyboardHidden
+    }
+  }, [canSend, keyboardHeight, liveInputEnabled, reopenFocusedInputWhenKeyboardHidden])
 
   const resetLiveInputFocus = useCallback(() => {
     clearTerminalLiveInputFocusTimer(timerRef)
@@ -62,6 +70,7 @@ export function useTerminalLiveInputFocus<T extends TerminalLiveInputFocusTarget
     }
     focusTerminalLiveInputTarget(inputRef.current, {
       keyboardHeight: context.keyboardHeight,
+      reopenFocusedInputWhenKeyboardHidden: context.reopenFocusedInputWhenKeyboardHidden,
       refocus: () => scheduleTerminalLiveInputFocus(timerRef, focusLiveInput)
     })
   }, [inputRef, timerRef])
diff --git a/mobile/src/transport/client-context-connection-metrics.ts b/mobile/src/transport/client-context-connection-metrics.ts
index 1e2ff6f7919..1fe72687bd2 100644
--- a/mobile/src/transport/client-context-connection-metrics.ts
+++ b/mobile/src/transport/client-context-connection-metrics.ts
@@ -30,14 +30,16 @@ export function useConnectionPathStatus(hostId: string | undefined): {
 export function useRelayRecoveryStatus(hostId: string | undefined): {
   pendingPath: MobileConnectionPath | null
   pairingRejected: boolean
+  hostSignedOut: boolean
 } {
   return useHostMetric(
     hostId,
     (context, id) => ({
       pendingPath: context.getPendingPath(id),
-      pairingRejected: context.isPairingRejected(id)
+      pairingRejected: context.isPairingRejected(id),
+      hostSignedOut: context.isHostSignedOut(id)
     }),
-    { pendingPath: null, pairingRejected: false }
+    { pendingPath: null, pairingRejected: false, hostSignedOut: false }
   )
 }
 
diff --git a/mobile/src/transport/client-context.test.ts b/mobile/src/transport/client-context.test.ts
index 4a7d5d7b0e8..56b227bdff7 100644
--- a/mobile/src/transport/client-context.test.ts
+++ b/mobile/src/transport/client-context.test.ts
@@ -533,12 +533,12 @@ describe('useAllHostClients', () => {
       await Promise.resolve()
     })
     act(() => client.emitPendingPath('relay'))
-    expect(status).toEqual({ pendingPath: 'relay', pairingRejected: false })
+    expect(status).toEqual({ pendingPath: 'relay', pairingRejected: false, hostSignedOut: false })
 
     // Why: the desktop refusing the credential is a status-only change — no
     // transport state moves, so only the connection-path signal can carry it.
     act(() => client.emitPairingRejected(true))
-    expect(status).toEqual({ pendingPath: 'relay', pairingRejected: true })
+    expect(status).toEqual({ pendingPath: 'relay', pairingRejected: true, hostSignedOut: false })
 
     act(() => renderer.unmount())
   })
diff --git a/mobile/src/transport/connection-health.ts b/mobile/src/transport/connection-health.ts
index 858b13a8b24..1a9e282047f 100644
--- a/mobile/src/transport/connection-health.ts
+++ b/mobile/src/transport/connection-health.ts
@@ -29,6 +29,10 @@ const STALE_SINCE_LAST_CONNECT_MS = 60_000
 // instead of leaving the user staring at a generic "Can't connect".
 const TAILSCALE_HINT = 'check Tailscale'
 
+// No hint field: the remedy is the label, and appending "— check Tailscale" to
+// it would be wrong advice for a desktop that is reachable but signed out.
+const SIGNED_OUT_LABEL = 'Desktop signed out — sign in to Orca on your desktop to reconnect'
+
 export type ConnectionVerdict =
   | { kind: 'normal'; label: string }
   | { kind: 'warning'; label: string; hint?: string } // "Can't connect"
@@ -54,6 +58,10 @@ export function classifyConnection(args: {
   // The desktop has repeatedly refused this device's relay credential — retrying
   // cannot fix it, so it outranks any "still connecting" reading (STA-4681).
   pairingRejected?: boolean
+  // The relay says the desktop's last control close named its own Orca Cloud
+  // sign-out. Retrying is still correct and still happens on the same cadence,
+  // but only the desktop's owner can end it, so the label has to say so.
+  hostSignedOut?: boolean
   nowMs?: number
 }): ConnectionVerdict {
   const { state, reconnectAttempts, lastConnectedAt } = args
@@ -70,6 +78,17 @@ export function classifyConnection(args: {
     return { kind: 'normal', label: 'Connected' }
   }
 
+  // Ahead of the attempt thresholds: this is evidence, not an inference from a
+  // failure streak, and waiting twelve dials to show it wastes the whole point.
+  // Below auth-failed because a revoked pairing cannot be fixed by signing in.
+  if (args.hostSignedOut) {
+    return {
+      kind: 'unreachable',
+      label: SIGNED_OUT_LABEL,
+      reason: lastConnectedAt == null ? 'never-connected' : 'stale'
+    }
+  }
+
   // A disconnected pending path can survive a cleared retry timer during a
   // lifecycle race. Only narrate Relay while dialing or after a retry has
   // recorded progress; otherwise the idle transport must read Disconnected.
diff --git a/mobile/src/transport/host-client-context-state.ts b/mobile/src/transport/host-client-context-state.ts
index 859e5d847f9..db4c7908b41 100644
--- a/mobile/src/transport/host-client-context-state.ts
+++ b/mobile/src/transport/host-client-context-state.ts
@@ -89,10 +89,16 @@ export function createHostClientSelectors(
     getPendingPath: (hostId: string): MobileConnectionPath | null =>
       clientPendingPath(entries.get(hostId)?.client),
     isPairingRejected: (hostId: string): boolean =>
-      clientPairingRejected(entries.get(hostId)?.client)
+      clientPairingRejected(entries.get(hostId)?.client),
+    isHostSignedOut: (hostId: string): boolean => clientHostSignedOut(entries.get(hostId)?.client)
   }
 }
 
+export function clientHostSignedOut(client: RpcClient | undefined): boolean {
+  const logical = client as Partial<StableLogicalRpcClient> | undefined
+  return logical?.isHostSignedOut?.() ?? false
+}
+
 export function clientPairingRejected(client: RpcClient | undefined): boolean {
   const logical = client as Partial<StableLogicalRpcClient> | undefined
   return logical?.isPairingRejected?.() ?? false
diff --git a/mobile/src/transport/logical-client-connection-path.ts b/mobile/src/transport/logical-client-connection-path.ts
index 55c6d1d28f3..b7f02b40b88 100644
--- a/mobile/src/transport/logical-client-connection-path.ts
+++ b/mobile/src/transport/logical-client-connection-path.ts
@@ -5,6 +5,7 @@ export class LogicalClientConnectionPath {
   private recovery: MobileConnectionPath | null = null
   private recoveryAttempt = 0
   private pairingRejected = false
+  private hostSignedOut = false
   private readonly listeners = new Set<() => void>()
 
   constructor(private readonly isConnected: () => boolean) {}
@@ -35,12 +36,23 @@ export class LogicalClientConnectionPath {
     })
   }
 
+  isHostSignedOut(): boolean {
+    return this.hostSignedOut
+  }
+
+  setHostSignedOut(signedOut: boolean): void {
+    this.update(() => {
+      this.hostSignedOut = signedOut
+    })
+  }
+
   clearAfterConnected(): void {
     this.migration = null
     this.recovery = null
     this.recoveryAttempt = 0
     // Why: an authenticated session is the desktop accepting this device.
     this.pairingRejected = false
+    this.hostSignedOut = false
   }
 
   setRecovery(path: MobileConnectionPath | null, attempt?: number): void {
@@ -69,11 +81,13 @@ export class LogicalClientConnectionPath {
     const previousPath = this.pending()
     const previousAttempt = this.reconnectAttempt(0)
     const previousRejected = this.pairingRejected
+    const previousSignedOut = this.hostSignedOut
     apply()
     if (
       previousPath === this.pending() &&
       previousAttempt === this.reconnectAttempt(0) &&
-      previousRejected === this.pairingRejected
+      previousRejected === this.pairingRejected &&
+      previousSignedOut === this.hostSignedOut
     ) {
       return
     }
diff --git a/mobile/src/transport/mobile-direct-endpoint-probe.test.ts b/mobile/src/transport/mobile-direct-endpoint-probe.test.ts
index 69fe8a2ab8a..4049b4b073b 100644
--- a/mobile/src/transport/mobile-direct-endpoint-probe.test.ts
+++ b/mobile/src/transport/mobile-direct-endpoint-probe.test.ts
@@ -71,4 +71,114 @@ describe('mobile direct endpoint probe', () => {
     expect(clients.get(host.endpoint)?.close).toHaveBeenCalledOnce()
     expect(result?.client.close).not.toHaveBeenCalled()
   })
+
+  it('fails a whole dead LAN in seconds instead of holding the 12s bound', async () => {
+    // Incident 2026-09-04: foregrounding on a dead LAN produced an instant 1006 and
+    // the direct client's 500/1000/2000ms redials, while the probe sat on the
+    // 'connecting' phase and held the supervisor mutex for the whole 12s bound.
+    const clients: FakeClient[] = []
+    const openDirect = vi.fn(() => {
+      const client = new FakeClient('connecting')
+      clients.push(client)
+      setTimeout(() => client.publishState('reconnecting'), 20)
+      return client
+    })
+
+    const probing = openAuthenticatedDirectEndpoint(host, openDirect, 12_000)
+    await vi.advanceTimersByTimeAsync(20)
+    await vi.advanceTimersByTimeAsync(2_000)
+    await expect(probing).resolves.toBeNull()
+
+    expect(clients).toHaveLength(2)
+    for (const client of clients) {
+      expect(client.close).toHaveBeenCalledOnce()
+    }
+    // No 12s timer is left behind to fire into a settled probe.
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('rides out one access-point flap that the first redial recovers', async () => {
+    // 'reconnecting' is published on any socket close, so a single RST on the first
+    // dial must not book a direct failure and its 60s cooldown.
+    const openDirect = vi.fn((endpoint: string) => {
+      const client = new FakeClient('connecting')
+      if (endpoint.includes('100.64.0.2')) {
+        setTimeout(() => client.publishState('reconnecting'), 20)
+        setTimeout(() => client.publishState('connected'), 600)
+      }
+      return client
+    })
+
+    const probing = openAuthenticatedDirectEndpoint(host, openDirect, 12_000)
+    await vi.advanceTimersByTimeAsync(600)
+    const result = await probing
+
+    expect(result?.path).toBe('tailscale')
+    expect(result?.client.close).not.toHaveBeenCalled()
+  })
+
+  it('extends the grace once when the redial reaches a handshake', async () => {
+    // The redial fires at 500ms, but 'connected' waits on the Noise handshake and a
+    // capability RPC, so real work needs more than one grace window.
+    const openDirect = vi.fn((endpoint: string) => {
+      const client = new FakeClient('connecting')
+      if (endpoint.includes('100.64.0.2')) {
+        setTimeout(() => client.publishState('reconnecting'), 20)
+        setTimeout(() => client.publishState('handshaking'), 1_500)
+        // Past the first grace window: only the re-arm keeps this probe alive.
+        setTimeout(() => client.publishState('connected'), 3_000)
+      }
+      return client
+    })
+
+    const probing = openAuthenticatedDirectEndpoint(host, openDirect, 12_000)
+    await vi.advanceTimersByTimeAsync(3_000)
+
+    expect((await probing)?.path).toBe('tailscale')
+  })
+
+  it('fails a handshake that stalls, one grace after it started', async () => {
+    const openDirect = vi.fn(() => {
+      const client = new FakeClient('connecting')
+      setTimeout(() => client.publishState('reconnecting'), 20)
+      setTimeout(() => client.publishState('handshaking'), 1_500)
+      // A restarted handshake must not buy a second extension.
+      setTimeout(() => client.publishState('handshaking'), 2_500)
+      return client
+    })
+
+    const probing = openAuthenticatedDirectEndpoint(host, openDirect, 12_000)
+    await vi.advanceTimersByTimeAsync(3_499)
+    let settled = false
+    void probing.then(() => {
+      settled = true
+    })
+    await vi.advanceTimersByTimeAsync(0)
+    expect(settled).toBe(false)
+
+    await vi.advanceTimersByTimeAsync(1)
+    await expect(probing).resolves.toBeNull()
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('gives up at the grace window when the redial never lands', async () => {
+    const openDirect = vi.fn(() => {
+      const client = new FakeClient('connecting')
+      setTimeout(() => client.publishState('reconnecting'), 20)
+      return client
+    })
+
+    const probing = openAuthenticatedDirectEndpoint(host, openDirect, 12_000)
+    await vi.advanceTimersByTimeAsync(2_019)
+    let settled = false
+    void probing.then(() => {
+      settled = true
+    })
+    await vi.advanceTimersByTimeAsync(0)
+    expect(settled).toBe(false)
+
+    await vi.advanceTimersByTimeAsync(1)
+    await expect(probing).resolves.toBeNull()
+    expect(vi.getTimerCount()).toBe(0)
+  })
 })
diff --git a/mobile/src/transport/mobile-direct-endpoint-probe.ts b/mobile/src/transport/mobile-direct-endpoint-probe.ts
index 114a4f29130..038f73b93b8 100644
--- a/mobile/src/transport/mobile-direct-endpoint-probe.ts
+++ b/mobile/src/transport/mobile-direct-endpoint-probe.ts
@@ -25,17 +25,52 @@ export function directPathForEndpoint(
   return 'lan'
 }
 
-function waitForAuthenticatedSession(session: RpcClient, timeoutMs: number): Promise<void> {
+// Why: 'reconnecting' is published on any socket close, so it cannot tell a dead
+// LAN (instant 1006, then doomed redials) from one access-point flap that the
+// first redial recovers. One redial fits here; a dead LAN still fails in ~2s
+// instead of holding the supervisor's operation mutex for the full outer bound.
+const RECONNECT_GRACE_MS = 2_000
+
+function waitForAuthenticatedSession(
+  session: RpcClient,
+  timeoutMs: number,
+  signal?: AbortSignal
+): Promise<void> {
+  if (signal?.aborted) {
+    return Promise.reject(new Error('probe cancelled'))
+  }
   if (session.getState() === 'connected') {
     return Promise.resolve()
   }
   return new Promise((resolve, reject) => {
     let timer: ReturnType<typeof setTimeout> | null = null
+    let graceTimer: ReturnType<typeof setTimeout> | null = null
+    let graceExtended = false
+    const armGrace = (): ReturnType<typeof setTimeout> =>
+      setTimeout(() => {
+        finish()
+        reject(new Error('probe session reconnecting'))
+      }, RECONNECT_GRACE_MS)
     const unsubscribe = session.onStateChange((state) => {
       if (state === 'connected') {
         finish()
         resolve()
-      } else if (state === 'disconnected' || state === 'auth-failed') {
+        return
+      }
+      if (state === 'reconnecting' && !graceTimer) {
+        graceTimer = armGrace()
+        return
+      }
+      // Why: the redial fires at 500ms but 'connected' waits on the Noise handshake
+      // and a capability RPC. 'handshaking' is proof the peer answered, so extend
+      // once; a dead handshake still fails at ~4s, far inside the outer bound.
+      if (state === 'handshaking' && graceTimer && !graceExtended) {
+        graceExtended = true
+        clearTimeout(graceTimer)
+        graceTimer = armGrace()
+        return
+      }
+      if (state === 'disconnected' || state === 'auth-failed' || state === 'reconnecting') {
         finish()
         reject(new Error(`probe session ${state}`))
       }
@@ -44,10 +79,19 @@ function waitForAuthenticatedSession(session: RpcClient, timeoutMs: number): Pro
       finish()
       reject(new Error('probe session authentication timed out'))
     }, timeoutMs)
+    const onAbort = (): void => {
+      finish()
+      reject(new Error('probe cancelled'))
+    }
+    signal?.addEventListener('abort', onAbort, { once: true })
     function finish(): void {
+      signal?.removeEventListener('abort', onAbort)
       if (timer) {
         clearTimeout(timer)
       }
+      if (graceTimer) {
+        clearTimeout(graceTimer)
+      }
       unsubscribe()
     }
   })
@@ -56,8 +100,12 @@ function waitForAuthenticatedSession(session: RpcClient, timeoutMs: number): Pro
 export async function openAuthenticatedDirectEndpoint(
   host: HostProfile,
   openDirect: (endpoint: string) => RpcClient,
-  timeoutMs: number
+  timeoutMs: number,
+  signal?: AbortSignal
 ): Promise<{ client: RpcClient; path: Exclude<MobileConnectionPath, 'relay'> } | null> {
+  if (signal?.aborted) {
+    return null
+  }
   const endpoints = directEndpointUrls(host)
   return await new Promise((resolve) => {
     const clients = new Set<RpcClient>()
@@ -79,8 +127,13 @@ export async function openAuthenticatedDirectEndpoint(
         continue
       }
       clients.add(client)
-      void waitForAuthenticatedSession(client, timeoutMs).then(
+      void waitForAuthenticatedSession(client, timeoutMs, signal).then(
         () => {
+          if (signal?.aborted) {
+            client.close()
+            rejectCandidate()
+            return
+          }
           if (settled) {
             client.close()
             return
diff --git a/mobile/src/transport/mobile-direct-probe-stop-budget.test.ts b/mobile/src/transport/mobile-direct-probe-stop-budget.test.ts
new file mode 100644
index 00000000000..535790ed480
--- /dev/null
+++ b/mobile/src/transport/mobile-direct-probe-stop-budget.test.ts
@@ -0,0 +1,175 @@
+import { expect, it, vi } from 'vitest'
+import {
+  dependencies,
+  FakeLogicalClient,
+  FakeSession,
+  host
+} from './mobile-endpoint-supervisor-test-fakes'
+import { MobileEndpointHysteresis } from './mobile-endpoint-hysteresis'
+import { createStableLogicalRpcClient } from './stable-logical-rpc-client'
+import { MobileEndpointSupervisor } from './mobile-endpoint-supervisor'
+vi.mock('react-native', () => ({ Platform: { OS: 'ios' } }))
+vi.mock('expo-secure-store', () => ({ WHEN_UNLOCKED_THIS_DEVICE_ONLY: 'when-unlocked' }))
+vi.mock('expo-crypto', () => ({ getRandomBytes: (length: number) => new Uint8Array(length) }))
+it('closes in-flight candidates and clears their timeout when the owner stops', async () => {
+  vi.useFakeTimers()
+  try {
+    const candidate = new FakeSession('connecting')
+    const logical = new FakeLogicalClient('connected', 'relay')
+    const deps = dependencies({ openDirect: vi.fn(() => candidate) })
+    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    await supervisor.start()
+    await vi.advanceTimersByTimeAsync(15_000)
+    expect(deps.openDirect).toHaveBeenCalledOnce()
+    supervisor.stop()
+    await vi.advanceTimersByTimeAsync(0)
+    expect(candidate.close).toHaveBeenCalledOnce()
+    expect(vi.getTimerCount()).toBe(0)
+    await vi.advanceTimersByTimeAsync(12_000)
+    expect(vi.getTimerCount()).toBe(0)
+    expect(candidate.close).toHaveBeenCalledOnce()
+    expect(logical.migrateTo).not.toHaveBeenCalled()
+    expect(deps.openDirect).toHaveBeenCalledOnce()
+  } finally {
+    vi.restoreAllMocks()
+    vi.useRealTimers()
+  }
+})
+
+it('closes an authenticated candidate when stop races its completion', async () => {
+  vi.useFakeTimers()
+  try {
+    const candidate = new FakeSession('connecting')
+    const logical = new FakeLogicalClient('connected', 'relay')
+    const deps = dependencies({ openDirect: vi.fn(() => candidate) })
+    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    await supervisor.start()
+    await vi.advanceTimersByTimeAsync(15_000)
+    candidate.publishState('connected')
+    supervisor.stop()
+    await vi.advanceTimersByTimeAsync(0)
+    expect(candidate.close).toHaveBeenCalledOnce()
+    expect(logical.migrateTo).not.toHaveBeenCalled()
+    expect(vi.getTimerCount()).toBe(0)
+  } finally {
+    vi.restoreAllMocks()
+    vi.useRealTimers()
+  }
+})
+
+it('preserves an in-flight probe across a transient background pause', async () => {
+  vi.useFakeTimers()
+  try {
+    const candidate = new FakeSession('connecting')
+    const logical = new FakeLogicalClient('connected', 'relay')
+    const deps = dependencies({ openDirect: vi.fn(() => candidate) })
+    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    await supervisor.start()
+    await vi.advanceTimersByTimeAsync(15_000)
+    supervisor.setForeground(false)
+    await vi.advanceTimersByTimeAsync(0)
+    expect(candidate.close).not.toHaveBeenCalled()
+    supervisor.stop()
+    await vi.advanceTimersByTimeAsync(0)
+    expect(candidate.close).toHaveBeenCalledOnce()
+    expect(vi.getTimerCount()).toBe(0)
+  } finally {
+    vi.restoreAllMocks()
+    vi.useRealTimers()
+  }
+})
+
+it('releases every candidate when multiple endpoint probes are pending', async () => {
+  vi.useFakeTimers()
+  try {
+    const candidates: FakeSession[] = []
+    const logical = new FakeLogicalClient('connected', 'relay')
+    const deps = dependencies({
+      openDirect: vi.fn(() => {
+        const candidate = new FakeSession('connecting')
+        candidates.push(candidate)
+        return candidate
+      })
+    })
+    const supervisor = new MobileEndpointSupervisor(
+      logical,
+      {
+        ...host,
+        endpoints: [{ id: 'alternate', kind: 'tailscale', url: 'ws://100.64.0.2:6768' }]
+      },
+      deps
+    )
+    await supervisor.start()
+    await vi.advanceTimersByTimeAsync(15_000)
+    expect(candidates).toHaveLength(2)
+    supervisor.stop()
+    await vi.advanceTimersByTimeAsync(0)
+    expect(vi.getTimerCount()).toBe(0)
+    for (const candidate of candidates) {
+      expect(candidate.close).toHaveBeenCalledOnce()
+      candidate.publishState('connected')
+    }
+    await vi.advanceTimersByTimeAsync(60_000)
+    expect(logical.migrateTo).not.toHaveBeenCalled()
+    expect(deps.openDirect).toHaveBeenCalledTimes(2)
+    expect(vi.getTimerCount()).toBe(0)
+  } finally {
+    vi.restoreAllMocks()
+    vi.useRealTimers()
+  }
+})
+
+it.each([false, true])(
+  'fences migration finishing after stop (already swapped: %s)',
+  async (alreadySwapped) => {
+    vi.useFakeTimers()
+    try {
+      const recordedMigration = vi.spyOn(MobileEndpointHysteresis.prototype, 'recordMigration')
+      const relay = new FakeSession('connected')
+      const logical = createStableLogicalRpcClient(relay, 'relay')
+      const candidates: FakeSession[] = []
+      const deps = dependencies({
+        openDirect: vi.fn(() => {
+          const candidate = new FakeSession('connected')
+          candidates.push(candidate)
+          return candidate
+        })
+      })
+      const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+      const migrate = logical.migrateTo.bind(logical)
+      let release!: () => void
+      const pending = new Promise<void>((resolve) => {
+        release = resolve
+      })
+      const migration = vi.spyOn(logical, 'migrateTo').mockImplementation(async (...args) => {
+        if (alreadySwapped) {
+          await migrate(...args)
+        }
+        await pending
+        if (!alreadySwapped) {
+          await migrate(...args)
+        }
+      })
+      await supervisor.start()
+      await vi.advanceTimersByTimeAsync(60_000)
+      expect(migration).toHaveBeenCalledOnce()
+      const requestsBeforeStop = relay.sendRequest.mock.calls.length
+      const candidateRequestsBeforeStop = candidates[3].sendRequest.mock.calls.length
+      const migrationsBeforeStop = recordedMigration.mock.calls.length
+      supervisor.stop()
+      release()
+      await vi.advanceTimersByTimeAsync(0)
+      expect(logical.getActivePath()).toBe(alreadySwapped ? 'lan' : 'relay')
+      expect(logical.getGeneration()).toBe(alreadySwapped ? 2 : 1)
+      expect(relay.sendRequest).toHaveBeenCalledTimes(requestsBeforeStop)
+      expect(candidates[3].sendRequest).toHaveBeenCalledTimes(candidateRequestsBeforeStop)
+      expect(recordedMigration).toHaveBeenCalledTimes(migrationsBeforeStop)
+      expect(candidates[3].close).toHaveBeenCalledTimes(alreadySwapped ? 0 : 1)
+      expect(vi.getTimerCount()).toBe(0)
+      logical.close()
+    } finally {
+      vi.restoreAllMocks()
+      vi.useRealTimers()
+    }
+  }
+)
diff --git a/mobile/src/transport/mobile-direct-return-probe.ts b/mobile/src/transport/mobile-direct-return-probe.ts
index dfb0572aa38..3ae31edd07f 100644
--- a/mobile/src/transport/mobile-direct-return-probe.ts
+++ b/mobile/src/transport/mobile-direct-return-probe.ts
@@ -11,6 +11,9 @@ const DIRECT_PROBE_INTERVAL_MS = 15_000
 export class DirectReturnProbe {
   private timer: ReturnType<typeof setTimeout> | null = null
 
+  private stopped = false
+  private activeProbe: AbortController | null = null
+
   constructor(
     private readonly deps: {
       now: () => number
@@ -24,14 +27,18 @@ export class DirectReturnProbe {
       canSchedule: () => boolean
       canAttempt: () => boolean
       beginOperation: () => void
-      migrate: (client: RpcClient, path: MobileConnectionPath) => Promise<void>
+      migrate: (
+        client: RpcClient,
+        path: MobileConnectionPath,
+        shouldAbort: () => boolean
+      ) => Promise<void>
       onDirectMigrated: () => Promise<void>
       afterProbe: () => void
     }
   ) {}
 
   schedule(delayMs = DIRECT_PROBE_INTERVAL_MS): void {
-    if (!this.hooks.canSchedule() || this.timer) {
+    if (this.stopped || !this.hooks.canSchedule() || this.timer) {
       return
     }
     this.timer = this.deps.setTimer(() => {
@@ -47,19 +54,34 @@ export class DirectReturnProbe {
     }
   }
 
+  stop(): void {
+    this.stopped = true
+    this.clear()
+    this.activeProbe?.abort()
+  }
+
   private async probe(): Promise<void> {
+    if (this.stopped) {
+      return
+    }
     if (!this.hooks.canAttempt() || !this.hooks.hysteresis.canProbe(this.deps.now())) {
       this.schedule()
       return
     }
+    const controller = new AbortController()
+    this.activeProbe = controller
     this.hooks.beginOperation()
     let successful: Awaited<ReturnType<typeof openAuthenticatedDirectEndpoint>> = null
     try {
       successful = await openAuthenticatedDirectEndpoint(
         this.hooks.host(),
         this.deps.openDirect,
-        12_000
+        12_000,
+        controller.signal
       )
+      if (this.stopped) {
+        return
+      }
       if (!successful) {
         this.hooks.hysteresis.recordDirectFailure(this.deps.now())
         return
@@ -68,11 +90,24 @@ export class DirectReturnProbe {
         successful.client.close()
         return
       }
-      await this.hooks.migrate(successful.client, successful.path)
+      const candidate = successful
+      // Migration owns the candidate, including closing it if cutover is canceled.
       successful = null
+      try {
+        await this.hooks.migrate(candidate.client, candidate.path, () => this.stopped)
+      } catch (error) {
+        if (this.stopped) {
+          return
+        }
+        throw error
+      }
+      if (this.stopped) {
+        return
+      }
       this.hooks.hysteresis.recordMigration(this.deps.now())
       await this.hooks.onDirectMigrated()
     } finally {
+      this.activeProbe = null
       successful?.client.close()
       // Why: a relay drop or backoff timer can arrive while the probe owns the
       // operation mutex; afterProbe releases it and replays deferred recovery.
diff --git a/mobile/src/transport/mobile-endpoint-lifecycle.ts b/mobile/src/transport/mobile-endpoint-lifecycle.ts
index 8ee8df6948e..7ec5f28b945 100644
--- a/mobile/src/transport/mobile-endpoint-lifecycle.ts
+++ b/mobile/src/transport/mobile-endpoint-lifecycle.ts
@@ -86,7 +86,7 @@ function createSupervisor(
 ): MobileEndpointSupervisor {
   return new MobileEndpointSupervisor(logical, host, {
     openDirect: (endpoint) => connect(endpoint, host.deviceToken, host.publicKeyB64, { onLog }),
-    openRelay: (relay, credential, confirmReqId) =>
+    openRelay: (relay, credential, confirmReqId, onHostCloseReason) =>
       connectMobileRelayRpcSession({
         relay,
         resumeToken: credential.token,
@@ -94,6 +94,7 @@ function createSupervisor(
         resumeConfirmReqId: confirmReqId,
         deviceToken: host.deviceToken,
         desktopPublicKeyB64: host.publicKeyB64,
+        onHostCloseReason,
         onLog
       }),
     resolveRelay: resolveMobileRelayEndpoint,
diff --git a/mobile/src/transport/mobile-endpoint-supervisor-contract.ts b/mobile/src/transport/mobile-endpoint-supervisor-contract.ts
index 0098de6e079..2a784fd8895 100644
--- a/mobile/src/transport/mobile-endpoint-supervisor-contract.ts
+++ b/mobile/src/transport/mobile-endpoint-supervisor-contract.ts
@@ -1,4 +1,5 @@
 import type { MobileRelayEndpoint } from '../../../src/shared/mobile-relay-credential-contract'
+import type { RelayHostCloseReason } from '../../../src/shared/relay-host-close-reason'
 import type { MobileRelayCredentialBundle } from './mobile-relay-credential-bundle'
 import type { MobileRelayRpcSession } from './mobile-relay-rpc-session'
 import type { resolveMobileRelayEndpoint } from './mobile-relay-resume-director'
@@ -10,7 +11,8 @@ export type MobileEndpointSupervisorDependencies = {
   openRelay: (
     relay: MobileRelayEndpoint,
     credential: { token: string; version: number },
-    confirmReqId: string
+    confirmReqId: string,
+    onHostCloseReason?: (reason: RelayHostCloseReason) => void
   ) => MobileRelayRpcSession
   resolveRelay: typeof resolveMobileRelayEndpoint
   readBundle: (hostId: string) => Promise<MobileRelayCredentialBundle | null>
diff --git a/mobile/src/transport/mobile-endpoint-supervisor-direct-probe.test.ts b/mobile/src/transport/mobile-endpoint-supervisor-direct-probe.test.ts
new file mode 100644
index 00000000000..3ee52fc7ddf
--- /dev/null
+++ b/mobile/src/transport/mobile-endpoint-supervisor-direct-probe.test.ts
@@ -0,0 +1,51 @@
+import { beforeEach, afterEach, describe, expect, it, vi } from 'vitest'
+import { MobileEndpointSupervisor } from './mobile-endpoint-supervisor'
+import {
+  dependencies,
+  FakeLogicalClient,
+  FakeRelaySession,
+  FakeSession,
+  host
+} from './mobile-endpoint-supervisor-test-fakes'
+
+vi.mock('react-native', () => ({ Platform: { OS: 'ios' } }))
+vi.mock('expo-secure-store', () => ({ WHEN_UNLOCKED_THIS_DEVICE_ONLY: 'when-unlocked' }))
+vi.mock('expo-crypto', () => ({ getRandomBytes: (length: number) => new Uint8Array(length) }))
+
+describe('mobile endpoint supervisor direct probe', () => {
+  beforeEach(() => {
+    vi.useFakeTimers()
+    vi.setSystemTime(new Date('2026-07-13T12:00:00Z'))
+  })
+
+  afterEach(() => {
+    vi.useRealTimers()
+  })
+
+  it('does not block relay recovery behind a direct probe stuck in its redial loop', async () => {
+    const logical = new FakeLogicalClient('connected', 'relay')
+    const direct = new FakeSession('connecting')
+    const openRelay = vi.fn(() => new FakeRelaySession('connected'))
+    const deps = dependencies({ openDirect: vi.fn(() => direct), openRelay })
+    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    await supervisor.start()
+
+    // Foreground return: the probe dials direct at once, the dead LAN answers with
+    // an instant 1006, and the direct client enters its 500/1000/2000ms backoff.
+    supervisor.setForeground(false)
+    supervisor.setForeground(true)
+    await vi.advanceTimersByTimeAsync(0)
+    expect(deps.openDirect).toHaveBeenCalledOnce()
+    direct.publishState('reconnecting')
+    logical.publishState('disconnected')
+
+    // Relay recovery must not wait out the probe's 12s bound; the probe gives up
+    // one grace window after the redial fails to land.
+    await vi.advanceTimersByTimeAsync(2_000)
+    expect(openRelay).toHaveBeenCalledOnce()
+    expect(direct.close).toHaveBeenCalled()
+    expect(logical.getState()).toBe('connected')
+    expect(logical.getActivePath()).toBe('relay')
+    supervisor.stop()
+  })
+})
diff --git a/mobile/src/transport/mobile-endpoint-supervisor-test-fakes.ts b/mobile/src/transport/mobile-endpoint-supervisor-test-fakes.ts
index 1dc1473d9db..80f4438c160 100644
--- a/mobile/src/transport/mobile-endpoint-supervisor-test-fakes.ts
+++ b/mobile/src/transport/mobile-endpoint-supervisor-test-fakes.ts
@@ -134,10 +134,22 @@ export class FakeLogicalClient extends FakeSession implements StableLogicalRpcCl
     }
   })
   isPairingRejected = () => this.pairingRejected
+  private hostSignedOut = false
+  setHostSignedOut = vi.fn((signedOut: boolean) => {
+    if (this.hostSignedOut === signedOut) {
+      return
+    }
+    this.hostSignedOut = signedOut
+    for (const listener of this.pathListeners) {
+      listener()
+    }
+  })
+  isHostSignedOut = () => this.hostSignedOut
   // Mirrors LogicalClientConnectionPath.clearAfterConnected.
   publishState(state: ConnectionState): void {
     if (state === 'connected') {
       this.pairingRejected = false
+      this.hostSignedOut = false
     }
     super.publishState(state)
   }
diff --git a/mobile/src/transport/mobile-endpoint-supervisor.test.ts b/mobile/src/transport/mobile-endpoint-supervisor.test.ts
index aeb9cddef63..10ef892a479 100644
--- a/mobile/src/transport/mobile-endpoint-supervisor.test.ts
+++ b/mobile/src/transport/mobile-endpoint-supervisor.test.ts
@@ -185,7 +185,12 @@ describe('mobile endpoint supervisor', () => {
     await supervisor.start()
 
     expect(deps.resolveRelay).toHaveBeenCalledOnce()
-    expect(openRelay).toHaveBeenLastCalledWith(resolved, expect.any(Object), expect.any(String))
+    expect(openRelay).toHaveBeenLastCalledWith(
+      resolved,
+      expect.any(Object),
+      expect.any(String),
+      expect.any(Function)
+    )
     expect(deps.saveHost).toHaveBeenCalledWith(
       expect.objectContaining({ relay: resolved, endpoint: host.endpoint })
     )
@@ -556,7 +561,8 @@ describe('mobile endpoint supervisor', () => {
     expect(openRelay).toHaveBeenLastCalledWith(
       relay,
       expect.objectContaining({ version: 3 }),
-      expect.any(String)
+      expect.any(String),
+      expect.any(Function)
     )
     supervisor.stop()
   })
@@ -603,7 +609,8 @@ describe('mobile endpoint supervisor', () => {
     expect(openRelay).toHaveBeenLastCalledWith(
       relay,
       expect.objectContaining({ version: 3 }),
-      expect.any(String)
+      expect.any(String),
+      expect.any(Function)
     )
     supervisor.stop()
   })
diff --git a/mobile/src/transport/mobile-endpoint-supervisor.ts b/mobile/src/transport/mobile-endpoint-supervisor.ts
index 6fca6c0cc17..9ba12f35112 100644
--- a/mobile/src/transport/mobile-endpoint-supervisor.ts
+++ b/mobile/src/transport/mobile-endpoint-supervisor.ts
@@ -120,7 +120,7 @@ export class MobileEndpointSupervisor {
       canSchedule: () => this.isActive() && this.logical.getActivePath() === 'relay',
       canAttempt: () => this.isActive() && !this.operationInFlight,
       beginOperation: () => (this.operationInFlight = true),
-      migrate: (client, path) => this.logical.migrateTo(client, path),
+      migrate: (client, path, abort) => this.logical.migrateTo(client, path, undefined, abort),
       onDirectMigrated: async () => {
         this.leaseRotation.clear()
         this.relayRotationPending = false
@@ -195,6 +195,7 @@ export class MobileEndpointSupervisor {
 
   stop(): void {
     this.stopped = true
+    this.directProbe.stop()
     this.unsubscribeState?.()
     this.unsubscribeState = null
     this.backgroundGrace.stop()
diff --git a/mobile/src/transport/mobile-relay-browser-cancel-budget.test.ts b/mobile/src/transport/mobile-relay-browser-cancel-budget.test.ts
new file mode 100644
index 00000000000..59426fc42da
--- /dev/null
+++ b/mobile/src/transport/mobile-relay-browser-cancel-budget.test.ts
@@ -0,0 +1,109 @@
+import { describe, expect, it } from 'vitest'
+import { RuntimeBrowserScreencastController } from '../../../src/main/runtime/runtime-browser-screencast-controller'
+import type { RuntimeBrowserCommands } from '../../../src/main/runtime/orca-runtime-browser'
+import type { BrowserScreencastResult } from '../../../src/shared/runtime-types'
+import { MobileRelayRpcStreams } from './mobile-relay-rpc-streams'
+import type { RpcResponse } from './types'
+
+describe('relay browser cancellation resource budget', () => {
+  it.each([false, true])('stops host frames when cancellation precedes ready=%s', async (early) => {
+    const subscriptions = new Map<string, () => void | Promise<void>>()
+    const done = Promise.withResolvers<void>()
+    const ready = Promise.withResolvers<RpcResponse>()
+    let sequence = 0
+    let stopped = false
+    let frameSends = 0
+    let frameBytes = 0
+    let sendBinary: (bytes: Uint8Array) => boolean | void = () => false
+    let hostRun: Promise<void> | undefined
+    const methods: string[] = []
+    const cleanup = (id: string): void => {
+      const release = subscriptions.get(id)
+      subscriptions.delete(id)
+      void release?.()
+    }
+    const host = new RuntimeBrowserScreencastController({
+      getCommands: () =>
+        ({
+          browserScreencast: async (_params, stream) => {
+            sendBinary = stream.sendBinary
+            return {
+              subscriptionId: 'server-stream',
+              ready: { type: 'ready', subscriptionId: 'server-stream', browserPageId: 'page' },
+              session: {
+                done: done.promise,
+                stop: () => {
+                  stopped = true
+                  done.resolve()
+                }
+              },
+              flushPendingFrame: () => {}
+            }
+          }
+        }) as RuntimeBrowserCommands,
+      registerSubscriptionCleanup: (id, release) => subscriptions.set(id, release),
+      cleanupSubscription: cleanup,
+      getDriver: () => ({ kind: 'idle' }),
+      setDriver: () => {},
+      notifyRemoteViewersChanged: () => {}
+    })
+    const streams = new MobileRelayRpcStreams({
+      nextId: () => `request-${++sequence}`,
+      waitForConnected: async () => {},
+      sendFrame: (request) => {
+        methods.push(request.method)
+        if (request.method === 'browser.screencast' && (request.params as { page?: string }).page) {
+          hostRun = host.start(request.params as Parameters<typeof host.start>[0], {
+            connectionId: 'relay-connection',
+            sendBinary: (bytes) => {
+              frameSends++
+              frameBytes += bytes.byteLength
+              return true
+            },
+            emit: (result: BrowserScreencastResult) => {
+              if (result.type === 'ready') {
+                ready.resolve({
+                  id: request.id,
+                  ok: true,
+                  streaming: true,
+                  result,
+                  _meta: { runtimeId: 'host' }
+                })
+              }
+            }
+          })
+        } else if (request.method === 'browser.screencast.unsubscribe') {
+          cleanup((request.params as { subscriptionId: string }).subscriptionId)
+        }
+        return true
+      }
+    })
+    const cancel = streams.subscribe('browser.screencast', { page: 'page' }, () => {})
+    try {
+      const response = await ready.promise
+      if (early) {
+        cancel()
+      }
+      streams.handleResponse(response)
+      if (!early) {
+        cancel()
+      }
+      for (let frame = 0; frame < 100; frame++) {
+        if (!stopped) {
+          sendBinary(new Uint8Array(65_536))
+        }
+      }
+      expect({ stopped, subscriptions: subscriptions.size, frameSends, frameBytes }).toEqual({
+        stopped: true,
+        subscriptions: 0,
+        frameSends: 0,
+        frameBytes: 0
+      })
+      expect(methods).toEqual(['browser.screencast', 'browser.screencast.unsubscribe'])
+    } finally {
+      cleanup('server-stream')
+      await hostRun
+      streams.clear()
+    }
+  })
+})
diff --git a/mobile/src/transport/mobile-relay-e2ee-link.ts b/mobile/src/transport/mobile-relay-e2ee-link.ts
index 7743deb23dd..9b1f7a9a355 100644
--- a/mobile/src/transport/mobile-relay-e2ee-link.ts
+++ b/mobile/src/transport/mobile-relay-e2ee-link.ts
@@ -2,6 +2,10 @@ import {
   RelayPhoneHelloSchema,
   type RelayPhoneHello
 } from '../../../src/shared/mobile-relay-phone-protocol'
+import {
+  relayHostCloseReasonFrom,
+  type RelayHostCloseReason
+} from '../../../src/shared/relay-host-close-reason'
 import { MobileE2EEV2ClientSession } from './mobile-e2ee-v2-client-session'
 import { MobileE2EEV2PhysicalChannel } from './mobile-e2ee-v2-physical-channel'
 import { websocketPayloadToUint8 } from './websocket-payload-bytes'
@@ -26,6 +30,12 @@ type MobileRelayE2eeLinkOptions = {
   onText: (plaintext: string) => void
   onBinary: (plaintext: Uint8Array) => void
   onHello?: (hello: Extract<RelayPhoneHello, { ok: true }>) => void
+  // The cell's account of why the desktop is absent, read off the close frame.
+  // Reported separately from onError because a rejection is delivered as both a
+  // relay-hello and a close, and which one the runtime dispatches first is not
+  // ordered — only the close carries the reason, and it must not be lost to
+  // that race.
+  onHostCloseReason?: (reason: RelayHostCloseReason) => void
   // Fired once relay-auth is on the wire: from here the cell owns the wait.
   onOpen?: () => void
   onError: (error: Error) => void
@@ -129,6 +139,11 @@ export class MobileRelayE2eeLink {
         clearTimeout(this.transportErrorTimer)
         this.transportErrorTimer = null
       }
+      // Ahead of fail(), which no-ops once the hello already reported this close.
+      const hostCloseReason = relayHostCloseReasonFrom(event.reason)
+      if (hostCloseReason) {
+        this.options.onHostCloseReason?.(hostCloseReason)
+      }
       this.fail(new RelayOuterError(event.code || 1006))
     }
   }
diff --git a/mobile/src/transport/mobile-relay-rpc-session.test.ts b/mobile/src/transport/mobile-relay-rpc-session.test.ts
index 5887dffc73d..4bf617faf50 100644
--- a/mobile/src/transport/mobile-relay-rpc-session.test.ts
+++ b/mobile/src/transport/mobile-relay-rpc-session.test.ts
@@ -136,6 +136,36 @@ describe('mobile relay RPC session', () => {
   })
   afterEach(() => vi.useRealTimers())
 
+  it('releases stream listeners on failure even when close follows it', async () => {
+    const { session } = await authenticateSession()
+    const listener = vi.fn()
+    session.subscribe('runtime.clientEvents.subscribe', {}, listener)
+    await Promise.resolve()
+    const request = JSON.parse(fakes.sendText.mock.calls[0]![0] as string) as { id: string }
+    fakes.linkOptions!.onText(
+      JSON.stringify({
+        id: request.id,
+        ok: true,
+        streaming: true,
+        result: { type: 'ready', subscriptionId: 'server-events' },
+        _meta: { runtimeId: 'runtime-1' }
+      })
+    )
+    expect(listener).toHaveBeenCalledTimes(1)
+    fakes.linkOptions!.onError(new Error('relay lost'))
+    session.close()
+    fakes.linkOptions!.onText(
+      JSON.stringify({
+        id: request.id,
+        ok: true,
+        streaming: true,
+        result: { type: 'event' },
+        _meta: { runtimeId: 'runtime-1' }
+      })
+    )
+    expect(listener).toHaveBeenCalledTimes(1)
+  })
+
   it('requires exact resume observations and confirms by request ID before becoming connected', async () => {
     const { session, confirmationRequest, capabilityRequest } = await authenticateSession()
 
diff --git a/mobile/src/transport/mobile-relay-rpc-session.ts b/mobile/src/transport/mobile-relay-rpc-session.ts
index 947a1d23ce8..67b50ea591e 100644
--- a/mobile/src/transport/mobile-relay-rpc-session.ts
+++ b/mobile/src/transport/mobile-relay-rpc-session.ts
@@ -13,6 +13,7 @@ import { RelayDialStageTracker, type RelayDialStageSource } from './relay-dial-s
 import { RelayPendingRequests } from './relay-pending-requests'
 import { RpcSessionLivenessWatchdog } from './rpc-session-liveness-watchdog'
 import { settleMobileRuntimeCapabilities } from './mobile-runtime-capability-negotiation'
+import type { RelayHostCloseReason } from '../../../src/shared/relay-host-close-reason'
 import type { RpcClient } from './rpc-client'
 import type { ConnectionLogSink, ConnectionState, RpcResponse } from './types'
 
@@ -40,6 +41,7 @@ export function connectMobileRelayRpcSession(args: {
   desktopPublicKeyB64: string
   requestTimeoutMs?: number
   createSocket?: (url: string) => WebSocket
+  onHostCloseReason?: (reason: RelayHostCloseReason) => void
   onLog?: ConnectionLogSink
 }): MobileRelayRpcSession {
   const requestTimeoutMs = args.requestTimeoutMs ?? 30_000
@@ -69,6 +71,7 @@ export function connectMobileRelayRpcSession(args: {
     deviceToken: args.deviceToken,
     desktopPublicKeyB64: args.desktopPublicKeyB64,
     createSocket: args.createSocket,
+    onHostCloseReason: args.onHostCloseReason,
     onOpen: () => dialStage.advance('awaiting-hello'),
     onHello: (hello) => {
       if (
@@ -291,6 +294,7 @@ export function connectMobileRelayRpcSession(args: {
     closed = true
     failure = error
     livenessWatchdog.stop(livenessIdentity)
+    streams.clear()
     link.close()
     pending.rejectAll(error)
     publishState(error instanceof MobileE2EEAuthenticationError ? 'auth-failed' : 'disconnected')
diff --git a/mobile/src/transport/mobile-relay-rpc-stream-cancellation.test.ts b/mobile/src/transport/mobile-relay-rpc-stream-cancellation.test.ts
new file mode 100644
index 00000000000..0a7a25dfbd7
--- /dev/null
+++ b/mobile/src/transport/mobile-relay-rpc-stream-cancellation.test.ts
@@ -0,0 +1,259 @@
+import { describe, expect, it, vi } from 'vitest'
+import { MobileRelayRpcStreams } from './mobile-relay-rpc-streams'
+import type { RpcResponse } from './types'
+
+function createStreams(waitForConnected = async () => {}) {
+  let sequence = 0
+  const sendFrame = vi.fn((_request: { id: string; method: string; params?: unknown }) => true)
+  const streams = new MobileRelayRpcStreams({
+    nextId: () => `request-${++sequence}`,
+    sendFrame,
+    waitForConnected
+  })
+  return { streams, sendFrame }
+}
+
+function response(id: string, result: unknown): RpcResponse {
+  return { id, ok: true, streaming: true, result, _meta: { runtimeId: 'test' } }
+}
+
+const serverSubscriptions = [
+  ['browser.screencast', 'browser.screencast.unsubscribe'],
+  ['runtime.clientEvents.subscribe', 'runtime.clientEvents.unsubscribe']
+] as const
+
+describe('mobile relay subscription cancellation', () => {
+  it.each(serverSubscriptions)('cleans up ready %s exactly once', async (method, unsubscribe) => {
+    const { streams, sendFrame } = createStreams()
+    const listener = vi.fn()
+    const cancel = streams.subscribe(method, {}, listener)
+    await Promise.resolve()
+    streams.handleResponse(response('request-1', { type: 'ready', subscriptionId: 'server-1' }))
+    cancel()
+    cancel()
+    expect(sendFrame.mock.calls).toEqual([
+      [{ id: 'request-1', method, params: {} }],
+      [{ id: 'request-2', method: unsubscribe, params: { subscriptionId: 'server-1' } }]
+    ])
+    expect(streams.handleResponse(response('request-1', { type: 'end' }))).toBe(false)
+    expect(listener).toHaveBeenCalledTimes(1)
+  })
+
+  it.each(serverSubscriptions)(
+    'cleans up late-ready %s without calling disposed listeners',
+    async (method, unsubscribe) => {
+      const { streams, sendFrame } = createStreams()
+      const listener = vi.fn()
+      const cancel = streams.subscribe(method, {}, listener)
+      await Promise.resolve()
+      cancel()
+      cancel()
+      expect(sendFrame).toHaveBeenCalledTimes(1)
+      expect(streams.handleResponse(response('request-1', { type: 'starting' }))).toBe(true)
+      streams.handleResponse(response('request-1', { type: 'ready', subscriptionId: 'server-1' }))
+      expect(sendFrame).toHaveBeenLastCalledWith({
+        id: 'request-2',
+        method: unsubscribe,
+        params: { subscriptionId: 'server-1' }
+      })
+      expect(
+        streams.handleResponse(response('request-1', { type: 'ready', subscriptionId: 'server-1' }))
+      ).toBe(false)
+      expect(listener).not.toHaveBeenCalled()
+    }
+  )
+
+  it.each(['error', 'end', 'disconnect', 'completed'])(
+    'forgets cancelled cleanup routes on %s',
+    async (ending) => {
+      const { streams, sendFrame } = createStreams()
+      const cancel = streams.subscribe('browser.screencast', {}, vi.fn())
+      await Promise.resolve()
+      cancel()
+      if (ending === 'disconnect') {
+        streams.clear()
+      } else if (ending === 'completed') {
+        streams.handleResponse({
+          id: 'request-1',
+          ok: true,
+          result: null,
+          _meta: { runtimeId: 'test' }
+        })
+      } else if (ending === 'error') {
+        streams.handleResponse({
+          id: 'request-1',
+          ok: false,
+          error: { code: 'unsupported', message: 'failed' },
+          _meta: { runtimeId: 'test' }
+        })
+      } else {
+        streams.handleResponse(response('request-1', { type: 'end', subscriptionId: 'server-1' }))
+      }
+      expect(
+        streams.handleResponse(response('request-1', { type: 'ready', subscriptionId: 'server-1' }))
+      ).toBe(false)
+      expect(sendFrame).toHaveBeenCalledTimes(1)
+    }
+  )
+
+  it.each([
+    [
+      'terminal.subscribe',
+      { terminal: 'term', client: { id: 'phone' } },
+      'terminal.unsubscribe',
+      { subscriptionId: 'term:phone', client: { id: 'phone' } }
+    ],
+    [
+      'session.tabs.subscribe',
+      { worktree: 'id:workspace' },
+      'session.tabs.unsubscribe',
+      { worktree: 'id:workspace', subscriptionId: 'request-1' }
+    ],
+    [
+      'nativeChat.subscribe',
+      { subscriptionId: 'chat' },
+      'nativeChat.unsubscribe',
+      { subscriptionId: 'chat' }
+    ]
+  ])(
+    'cancels %s using its request cleanup identity',
+    async (method, params, unsubscribe, unsubscribeParams) => {
+      const { streams, sendFrame } = createStreams()
+      const cancel = streams.subscribe(method as string, params, vi.fn())
+      await Promise.resolve()
+      if (method === 'session.tabs.subscribe') {
+        streams.handleResponse(response('request-1', { type: 'snapshot' }))
+      }
+      cancel()
+      expect(sendFrame).toHaveBeenLastCalledWith({
+        id: 'request-2',
+        method: unsubscribe,
+        params: unsubscribeParams
+      })
+    }
+  )
+
+  it.each([
+    'terminal.subscribe',
+    'browser.screencast',
+    'runtime.clientEvents.subscribe',
+    'session.tabs.subscribe',
+    'nativeChat.subscribe'
+  ])('does not unsubscribe an unsent %s', async (method) => {
+    const wait = Promise.withResolvers<void>()
+    const { streams, sendFrame } = createStreams(() => wait.promise)
+    const cancel = streams.subscribe(
+      method,
+      { terminal: 'term', worktree: 'id:workspace', subscriptionId: 'chat' },
+      vi.fn()
+    )
+    cancel()
+    wait.resolve()
+    await Promise.resolve()
+    expect(sendFrame).not.toHaveBeenCalled()
+    expect(
+      streams.handleResponse(response('request-1', { type: 'ready', subscriptionId: 'server-1' }))
+    ).toBe(false)
+  })
+
+  it.each([false, true])(
+    'preserves a same-worktree sibling when cancellation precedes snapshot=%s',
+    async (early) => {
+      const { streams, sendFrame } = createStreams()
+      const first = vi.fn()
+      const second = vi.fn()
+      const cancel = streams.subscribe(
+        'session.tabs.subscribe',
+        { worktree: 'id:workspace' },
+        first
+      )
+      streams.subscribe('session.tabs.subscribe', { worktree: 'id:workspace' }, second)
+      await Promise.resolve()
+      if (early) {
+        cancel()
+      }
+      expect(sendFrame).toHaveBeenCalledTimes(2)
+      streams.handleResponse(response('request-1', { type: 'snapshot' }))
+      if (!early) {
+        cancel()
+      }
+      expect(sendFrame).toHaveBeenLastCalledWith({
+        id: 'request-3',
+        method: 'session.tabs.unsubscribe',
+        params: { worktree: 'id:workspace', subscriptionId: 'request-1' }
+      })
+      streams.handleResponse(response('request-2', { type: 'snapshot' }))
+      streams.handleResponse(response('request-2', { type: 'updated' }))
+      expect(second).toHaveBeenCalledTimes(2)
+      expect(first).toHaveBeenCalledTimes(early ? 0 : 1)
+      expect(streams.handleResponse(response('request-1', { type: 'updated' }))).toBe(false)
+    }
+  )
+
+  it.each([
+    ['nativeChat.subscribe', { agent: 'claude', sessionId: 's1', subscriptionId: 'claude:s1' }],
+    ['terminal.subscribe', { terminal: 'term', client: { id: 'phone' } }]
+  ])(
+    'keeps the newer %s live when an older same-token subscription unmounts',
+    async (method, params) => {
+      const { streams, sendFrame } = createStreams()
+      const older = vi.fn()
+      const newer = vi.fn()
+      const cancelOlder = streams.subscribe(method, params, older)
+      const cancelNewer = streams.subscribe(method, { ...params }, newer)
+      await Promise.resolve()
+      expect(sendFrame).toHaveBeenCalledTimes(2)
+      cancelOlder()
+      // The host keys cleanup by the deterministic token, so unsubscribing would evict the newer.
+      expect(sendFrame).toHaveBeenCalledTimes(2)
+      streams.handleResponse(response('request-2', { type: 'snapshot' }))
+      expect(newer).toHaveBeenCalledTimes(1)
+      expect(streams.handleResponse(response('request-1', { type: 'snapshot' }))).toBe(false)
+      expect(older).not.toHaveBeenCalled()
+      cancelNewer()
+      expect(sendFrame).toHaveBeenCalledTimes(3)
+      expect(sendFrame).toHaveBeenLastCalledWith(
+        expect.objectContaining({ method: method.replace(/\.subscribe$/, '.unsubscribe') })
+      )
+    }
+  )
+
+  it('still unsubscribes a shared-token nativeChat stream when the sibling is unsent', async () => {
+    const wait = Promise.withResolvers<void>()
+    let connected = false
+    const { streams, sendFrame } = createStreams(() =>
+      connected ? Promise.resolve() : wait.promise
+    )
+    const params = { agent: 'claude', sessionId: 's1', subscriptionId: 'claude:s1' }
+    connected = true
+    const cancelOlder = streams.subscribe('nativeChat.subscribe', params, vi.fn())
+    await Promise.resolve()
+    connected = false
+    streams.subscribe('nativeChat.subscribe', params, vi.fn())
+    cancelOlder()
+    expect(sendFrame).toHaveBeenCalledTimes(2)
+    expect(sendFrame).toHaveBeenLastCalledWith({
+      id: 'request-3',
+      method: 'nativeChat.unsubscribe',
+      params: { subscriptionId: 'claude:s1' }
+    })
+  })
+
+  it('cleans up every cancelled server subscription across repeated late-ready cycles', async () => {
+    const { streams, sendFrame } = createStreams()
+    const listener = vi.fn()
+    for (let i = 0; i < 100; i++) {
+      const cancel = streams.subscribe('runtime.clientEvents.subscribe', {}, listener)
+      await Promise.resolve()
+      const requestId = `request-${2 * i + 1}`
+      cancel()
+      streams.handleResponse(response(requestId, { type: 'ready', subscriptionId: `server-${i}` }))
+    }
+    expect(
+      sendFrame.mock.calls.filter(
+        ([request]) => (request as { method: string }).method === 'runtime.clientEvents.unsubscribe'
+      )
+    ).toHaveLength(100)
+    expect(listener).not.toHaveBeenCalled()
+  })
+})
diff --git a/mobile/src/transport/mobile-relay-rpc-streams.ts b/mobile/src/transport/mobile-relay-rpc-streams.ts
index 2eacbd2168f..abb2c12564b 100644
--- a/mobile/src/transport/mobile-relay-rpc-streams.ts
+++ b/mobile/src/transport/mobile-relay-rpc-streams.ts
@@ -4,9 +4,11 @@ import {
   type TerminalSnapshotState
 } from './rpc-client-terminal-binary-frame'
 import {
+  buildStreamUnsubscribe,
   buildTerminalUnsubscribeParams,
   updateTerminalSubscriptionViewport
 } from './rpc-client-terminal-subscription'
+import { buildReadyStreamUnsubscribe } from './rpc-client-server-subscription'
 import type { RpcClient } from './rpc-client'
 import type { RpcResponse, RpcSuccess } from './types'
 
@@ -22,6 +24,23 @@ type StreamRecord = {
   streamIds: Set<number>
   subscriptionId?: string
   cancelled: boolean
+  sent: boolean
+  receivedSnapshot?: boolean
+}
+
+type StreamUnsubscribe = { method: string; params: unknown }
+
+/** Unsubscribe derived from the subscribe params alone (no server-assigned id). */
+function buildParamsUnsubscribe(
+  method: string,
+  params: unknown,
+  requestId: string
+): StreamUnsubscribe | null {
+  if (method === 'terminal.subscribe') {
+    const unsubscribeParams = buildTerminalUnsubscribeParams(params)
+    return unsubscribeParams ? { method: 'terminal.unsubscribe', params: unsubscribeParams } : null
+  }
+  return buildStreamUnsubscribe(method, params, requestId)
 }
 
 type StreamManagerOptions = {
@@ -32,6 +51,10 @@ type StreamManagerOptions = {
 
 export class MobileRelayRpcStreams {
   private readonly streams = new Map<string, StreamRecord>()
+  private readonly cancelledSubscriptions = new Map<
+    string,
+    { method: string; unsubscribe?: StreamUnsubscribe }
+  >()
   private readonly terminalListeners = new Map<number, (result: unknown) => void>()
   private readonly terminalSnapshots = new Map<number, TerminalSnapshotState>()
   private activeBrowserStream: StreamRecord | null = null
@@ -51,13 +74,15 @@ export class MobileRelayRpcStreams {
       listener,
       onBinaryFrame: subscribeOptions?.onBinaryFrame,
       streamIds: new Set(),
-      cancelled: false
+      cancelled: false,
+      sent: false
     }
     this.streams.set(id, stream)
     void this.options
       .waitForConnected()
       .then(() => {
         if (!stream.cancelled) {
+          stream.sent = true
           if (!this.options.sendFrame({ id, method, params: stream.params })) {
             this.fail(id, stream, 'Connection interrupted')
           }
@@ -75,6 +100,30 @@ export class MobileRelayRpcStreams {
   }
 
   handleResponse(response: RpcResponse): boolean {
+    const cancelled = this.cancelledSubscriptions.get(response.id)
+    if (cancelled) {
+      if (!response.ok) {
+        this.cancelledSubscriptions.delete(response.id)
+      } else if (response.result && typeof response.result === 'object') {
+        const result = response.result as { subscriptionId?: unknown; type?: unknown }
+        if (result.type === 'end') {
+          this.cancelledSubscriptions.delete(response.id)
+        } else if (result.type === 'snapshot' && cancelled.unsubscribe) {
+          this.cancelledSubscriptions.delete(response.id)
+          this.options.sendFrame({ id: this.options.nextId(), ...cancelled.unsubscribe })
+        } else if (typeof result.subscriptionId === 'string') {
+          this.cancelledSubscriptions.delete(response.id)
+          const unsubscribe = buildReadyStreamUnsubscribe(cancelled.method, result.subscriptionId)
+          if (unsubscribe) {
+            this.options.sendFrame({ id: this.options.nextId(), ...unsubscribe })
+          }
+        }
+      }
+      if (response.ok && response.streaming !== true) {
+        this.cancelledSubscriptions.delete(response.id)
+      }
+      return true
+    }
     const stream = this.streams.get(response.id)
     if (!stream) {
       return false
@@ -86,6 +135,9 @@ export class MobileRelayRpcStreams {
     const result = (response as RpcSuccess).result
     if (result && typeof result === 'object') {
       const metadata = result as { subscriptionId?: unknown; streamId?: unknown; type?: unknown }
+      if (stream.method === 'session.tabs.subscribe' && metadata.type === 'snapshot') {
+        stream.receivedSnapshot = true
+      }
       if (typeof metadata.subscriptionId === 'string') {
         stream.subscriptionId = metadata.subscriptionId
       }
@@ -125,6 +177,7 @@ export class MobileRelayRpcStreams {
       stream.cancelled = true
     }
     this.streams.clear()
+    this.cancelledSubscriptions.clear()
     this.terminalListeners.clear()
     this.terminalSnapshots.clear()
     this.activeBrowserStream = null
@@ -136,25 +189,61 @@ export class MobileRelayRpcStreams {
       return
     }
     stream.cancelled = true
-    if (stream.method === 'terminal.subscribe') {
-      const params = buildTerminalUnsubscribeParams(stream.params)
-      if (params) {
-        this.options.sendFrame({
-          id: this.options.nextId(),
-          method: 'terminal.unsubscribe',
-          params
-        })
+    if (stream.sent) {
+      const byParams = buildParamsUnsubscribe(stream.method, stream.params, id)
+      if (stream.method === 'terminal.subscribe') {
+        if (byParams) {
+          this.sendUnsubscribe(byParams)
+        }
+      } else {
+        const unsubscribe = stream.subscriptionId
+          ? buildReadyStreamUnsubscribe(stream.method, stream.subscriptionId)
+          : null
+        if (byParams && stream.method === 'session.tabs.subscribe' && !stream.receivedSnapshot) {
+          // The host registers cleanup only after resolving the initial snapshot.
+          this.cancelledSubscriptions.set(id, { method: stream.method, unsubscribe: byParams })
+        } else if (unsubscribe || byParams) {
+          this.sendUnsubscribe((unsubscribe ?? byParams)!)
+        } else if (
+          stream.method === 'browser.screencast' ||
+          stream.method === 'runtime.clientEvents.subscribe'
+        ) {
+          // Keep only the cleanup route while the server assigns its subscription ID.
+          this.cancelledSubscriptions.set(id, { method: stream.method })
+        } else if (stream.subscriptionId) {
+          this.sendUnsubscribe({
+            method: stream.method.replace(/\.subscribe$/, '.unsubscribe'),
+            params: { subscriptionId: stream.subscriptionId }
+          })
+        }
       }
-    } else if (stream.subscriptionId) {
-      this.options.sendFrame({
-        id: this.options.nextId(),
-        method: stream.method.replace(/\.subscribe$/, '.unsubscribe'),
-        params: { subscriptionId: stream.subscriptionId }
-      })
     }
     this.remove(id)
   }
 
+  /** Skip the unsubscribe when a live sibling shares the host cleanup token (e.g. nativeChat's
+   *  deterministic `agent:sessionId`), since the host would evict the sibling's registration. */
+  private sendUnsubscribe(unsubscribe: StreamUnsubscribe): void {
+    if (this.hasLiveOwner(unsubscribe)) {
+      return
+    }
+    this.options.sendFrame({ id: this.options.nextId(), ...unsubscribe })
+  }
+
+  private hasLiveOwner(unsubscribe: StreamUnsubscribe): boolean {
+    const token = JSON.stringify(unsubscribe)
+    for (const [siblingId, sibling] of this.streams) {
+      if (sibling.cancelled || !sibling.sent) {
+        continue
+      }
+      const siblingUnsubscribe = buildParamsUnsubscribe(sibling.method, sibling.params, siblingId)
+      if (siblingUnsubscribe && JSON.stringify(siblingUnsubscribe) === token) {
+        return true
+      }
+    }
+    return false
+  }
+
   private remove(id: string): void {
     const stream = this.streams.get(id)
     if (!stream) {
diff --git a/mobile/src/transport/mobile-relay-runtime-failover.test.ts b/mobile/src/transport/mobile-relay-runtime-failover.test.ts
index 01f4d45feb0..ce7cca3fd9f 100644
--- a/mobile/src/transport/mobile-relay-runtime-failover.test.ts
+++ b/mobile/src/transport/mobile-relay-runtime-failover.test.ts
@@ -145,10 +145,22 @@ class FakeLogicalClient extends FakeSession implements StableLogicalRpcClient {
     }
   })
   isPairingRejected = () => this.pairingRejected
+  private hostSignedOut = false
+  setHostSignedOut = vi.fn((signedOut: boolean) => {
+    if (this.hostSignedOut === signedOut) {
+      return
+    }
+    this.hostSignedOut = signedOut
+    for (const listener of this.pathListeners) {
+      listener()
+    }
+  })
+  isHostSignedOut = () => this.hostSignedOut
   // Mirrors LogicalClientConnectionPath.clearAfterConnected.
   publishState(state: ConnectionState): void {
     if (state === 'connected') {
       this.pairingRejected = false
+      this.hostSignedOut = false
     }
     super.publishState(state)
   }
@@ -264,7 +276,8 @@ describe('relay runtime recovery without direct connectivity', () => {
     expect(openRelay).toHaveBeenLastCalledWith(
       relay,
       expect.objectContaining({ version: 3 }),
-      expect.any(String)
+      expect.any(String),
+      expect.any(Function)
     )
     expect(logical.getActivePath()).toBe('relay')
     supervisor.stop()
@@ -353,7 +366,8 @@ describe('relay runtime recovery without direct connectivity', () => {
     expect(deps.openRelay).toHaveBeenLastCalledWith(
       relay,
       expect.objectContaining({ version: 2 }),
-      expect.any(String)
+      expect.any(String),
+      expect.any(Function)
     )
     expect(logical.getActivePath()).toBe('relay')
     supervisor.stop()
@@ -382,7 +396,8 @@ describe('relay runtime recovery without direct connectivity', () => {
     expect(openRelay).toHaveBeenLastCalledWith(
       relay,
       expect.objectContaining({ version: 1 }),
-      expect.any(String)
+      expect.any(String),
+      expect.any(Function)
     )
     expect(logical.getActivePath()).toBe('relay')
     supervisor.stop()
diff --git a/mobile/src/transport/mobile-relay-session-establisher.ts b/mobile/src/transport/mobile-relay-session-establisher.ts
index 7a8ce372155..9a04ae44137 100644
--- a/mobile/src/transport/mobile-relay-session-establisher.ts
+++ b/mobile/src/transport/mobile-relay-session-establisher.ts
@@ -10,6 +10,7 @@ import type { MobileRelayCredentialBundle } from './mobile-relay-credential-bund
 import type { RelayReconnectController } from './mobile-relay-reconnect-controller'
 import type { StableLogicalRpcClient } from './stable-logical-rpc-client'
 import type { MobileRelayEndpoint } from '../../../src/shared/mobile-relay-credential-contract'
+import { RELAY_HOST_CLOSE_REASON } from '../../../src/shared/relay-host-close-reason'
 import type { HostProfile } from './types'
 
 type EstablishResult = { ok: true } | { ok: false; error: Error }
@@ -100,7 +101,16 @@ export class MobileRelaySessionEstablisher {
     const session = args.openRelay(
       relay,
       credential,
-      `confirm-${encodeBase64Url(args.randomBytes(16))}`
+      `confirm-${encodeBase64Url(args.randomBytes(16))}`,
+      // Latched on the logical client, not on the dial result: the close that
+      // carries the reason can land after this dial has already reported its
+      // failure. Clearing is clearAfterConnected's job, so any path that
+      // reaches connected retires it.
+      (reason) => {
+        if (reason === RELAY_HOST_CLOSE_REASON.SIGNED_OUT) {
+          args.logical.setHostSignedOut(true)
+        }
+      }
     )
     try {
       // Why: backgrounding or a direct winner withdraws this dial before cutover.
diff --git a/mobile/src/transport/relay-host-signed-out-supervisor.test.ts b/mobile/src/transport/relay-host-signed-out-supervisor.test.ts
new file mode 100644
index 00000000000..cc7a9ac6c35
--- /dev/null
+++ b/mobile/src/transport/relay-host-signed-out-supervisor.test.ts
@@ -0,0 +1,60 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { MOBILE_RELAY_CLOSE_CODE } from '../../../src/shared/mobile-relay-close-codes'
+import { RELAY_HOST_CLOSE_REASON } from '../../../src/shared/relay-host-close-reason'
+import { RelayOuterError } from './mobile-relay-e2ee-link'
+import {
+  dependencies,
+  FakeLogicalClient,
+  FakeRelaySession,
+  host
+} from './mobile-endpoint-supervisor-test-fakes'
+import { MobileEndpointSupervisor } from './mobile-endpoint-supervisor'
+
+vi.mock('react-native', () => ({ Platform: { OS: 'ios' } }))
+vi.mock('expo-secure-store', () => ({ WHEN_UNLOCKED_THIS_DEVICE_ONLY: 'when-unlocked' }))
+vi.mock('expo-crypto', () => ({ getRandomBytes: (length: number) => new Uint8Array(length) }))
+
+// The reason travels from the cell's close frame to the screens. This covers
+// the production wiring between them: the supervisor's own openRelay callback.
+describe('a signed-out desktop reaches the phone verdict', () => {
+  beforeEach(() => {
+    vi.useFakeTimers()
+    vi.setSystemTime(new Date('2026-07-13T12:00:00Z'))
+  })
+  afterEach(() => vi.useRealTimers())
+
+  function supervisorOver(closeReason: string | null) {
+    const logical = new FakeLogicalClient('disconnected', 'lan')
+    const deps = dependencies({
+      openDirect: vi.fn(() => new FakeRelaySession('disconnected')),
+      openRelay: vi.fn((_relay, _credential, _confirmReqId, onHostCloseReason) => {
+        if (closeReason) {
+          onHostCloseReason?.(closeReason as never)
+        }
+        return new FakeRelaySession(
+          'disconnected',
+          new RelayOuterError(MOBILE_RELAY_CLOSE_CODE.HOST_OFFLINE)
+        )
+      })
+    })
+    return { logical, supervisor: new MobileEndpointSupervisor(logical, host, deps) }
+  }
+
+  it('latches the sign-out the cell reported', async () => {
+    const { logical, supervisor } = supervisorOver(RELAY_HOST_CLOSE_REASON.SIGNED_OUT)
+
+    await supervisor.start()
+    await vi.waitFor(() => expect(logical.isHostSignedOut()).toBe(true))
+
+    supervisor.stop()
+  })
+
+  it('stays quiet for an ordinary host-offline rejection', async () => {
+    const { logical, supervisor } = supervisorOver(null)
+
+    await supervisor.start()
+
+    expect(logical.isHostSignedOut()).toBe(false)
+    supervisor.stop()
+  })
+})
diff --git a/mobile/src/transport/relay-host-signed-out-verdict.test.ts b/mobile/src/transport/relay-host-signed-out-verdict.test.ts
new file mode 100644
index 00000000000..2607b922b58
--- /dev/null
+++ b/mobile/src/transport/relay-host-signed-out-verdict.test.ts
@@ -0,0 +1,216 @@
+import { describe, expect, it, vi } from 'vitest'
+
+vi.mock('./mobile-e2ee-v2-client-session', () => ({
+  MobileE2EEV2ClientSession: { create: () => ({}) }
+}))
+
+vi.mock('./mobile-e2ee-v2-physical-channel', () => ({
+  MobileE2EEAuthenticationError: class extends Error {},
+  MobileE2EEV2PhysicalChannel: class {
+    start = vi.fn()
+    handleMessage = vi.fn(async () => {})
+    sendText = vi.fn(() => true)
+    sendBinary = vi.fn(() => true)
+    dispose = vi.fn()
+  }
+}))
+
+import { RELAY_HOST_CLOSE_REASON } from '../../../src/shared/relay-host-close-reason'
+import { MOBILE_RELAY_CLOSE_CODE } from '../../../src/shared/mobile-relay-close-codes'
+import { classifyConnection, verdictDisplayLabel } from './connection-health'
+import { MobileRelayE2eeLink, RelayOuterError } from './mobile-relay-e2ee-link'
+import { LogicalClientConnectionPath } from './logical-client-connection-path'
+import { RelayReconnectController } from './mobile-relay-reconnect-controller'
+
+const SIGNED_OUT_LABEL = 'Desktop signed out — sign in to Orca on your desktop to reconnect'
+
+class FakeSocket {
+  static readonly OPEN = 1
+  readonly OPEN = FakeSocket.OPEN
+  readyState = FakeSocket.OPEN
+  bufferedAmount = 0
+  onopen: (() => void) | null = null
+  onmessage: ((event: { data: unknown }) => void) | null = null
+  onerror: (() => void) | null = null
+  onclose: ((event: { code: number; reason: string }) => void) | null = null
+  send = vi.fn()
+  close = vi.fn()
+}
+
+function linkOver(
+  socket: FakeSocket,
+  onHostCloseReason: (reason: string) => void,
+  onError: (error: Error) => void
+): MobileRelayE2eeLink {
+  return new MobileRelayE2eeLink({
+    endpoint: { cellUrl: 'https://relay-c1.onorca.dev', relayHostId: 'AbCdEf0123_-xyZ9' },
+    credential: 'credential',
+    expectedCredentialKind: 'resume',
+    deviceToken: 'device-token',
+    desktopPublicKeyB64: 'desktop-key',
+    onAuthenticated: vi.fn(),
+    onText: vi.fn(),
+    onBinary: vi.fn(),
+    onHostCloseReason,
+    onError,
+    createSocket: () => socket as unknown as WebSocket
+  })
+}
+
+describe('relay close reason on the phone', () => {
+  it('reports the cell close reason and still fails with 4404', () => {
+    const socket = new FakeSocket()
+    const onHostCloseReason = vi.fn()
+    const onError = vi.fn()
+    linkOver(socket, onHostCloseReason, onError)
+
+    socket.onclose?.({
+      code: MOBILE_RELAY_CLOSE_CODE.HOST_OFFLINE,
+      reason: RELAY_HOST_CLOSE_REASON.SIGNED_OUT
+    })
+
+    expect(onHostCloseReason).toHaveBeenCalledWith(RELAY_HOST_CLOSE_REASON.SIGNED_OUT)
+    expect(onError).toHaveBeenCalledWith(new RelayOuterError(MOBILE_RELAY_CLOSE_CODE.HOST_OFFLINE))
+  })
+
+  // An old cell sends its constant, and every other close sends nothing.
+  it('reports nothing for a reason it does not know', () => {
+    const socket = new FakeSocket()
+    const onHostCloseReason = vi.fn()
+    linkOver(socket, onHostCloseReason, vi.fn())
+
+    socket.onclose?.({
+      code: MOBILE_RELAY_CLOSE_CODE.HOST_OFFLINE,
+      reason: 'relay connection rejected'
+    })
+
+    expect(onHostCloseReason).not.toHaveBeenCalled()
+  })
+
+  // The rejection arrives as a relay-hello AND a close, in an unordered pair.
+  // Whichever lands first, the reason must survive.
+  it('still reports the reason when the hello already failed the link', async () => {
+    const socket = new FakeSocket()
+    const onHostCloseReason = vi.fn()
+    linkOver(socket, onHostCloseReason, vi.fn())
+
+    socket.onmessage?.({
+      data: JSON.stringify({
+        type: 'relay-hello',
+        ok: false,
+        code: MOBILE_RELAY_CLOSE_CODE.HOST_OFFLINE
+      })
+    })
+    await Promise.resolve()
+    await Promise.resolve()
+    socket.onclose?.({
+      code: MOBILE_RELAY_CLOSE_CODE.HOST_OFFLINE,
+      reason: RELAY_HOST_CLOSE_REASON.SIGNED_OUT
+    })
+
+    expect(onHostCloseReason).toHaveBeenCalledWith(RELAY_HOST_CLOSE_REASON.SIGNED_OUT)
+  })
+})
+
+describe('the signed-out signal on the logical client', () => {
+  it('publishes on change and retires when any path reaches connected', () => {
+    const path = new LogicalClientConnectionPath(() => false)
+    const changes = vi.fn()
+    path.subscribe(changes)
+
+    path.setHostSignedOut(true)
+    path.setHostSignedOut(true)
+    expect(path.isHostSignedOut()).toBe(true)
+    expect(changes).toHaveBeenCalledTimes(1)
+
+    path.clearAfterConnected()
+    expect(path.isHostSignedOut()).toBe(false)
+  })
+})
+
+describe('RelayReconnectController cadence', () => {
+  // The reason changes no recovery decision; 4404 keeps the host-offline
+  // backoff it has always had, so a phone on this build retries exactly as
+  // often as one that never hears the reason.
+  it('keeps the host-offline retry delay for a 4404', () => {
+    const delays: number[] = []
+    const controller = new RelayReconnectController(
+      {
+        now: () => 0,
+        randomBytes: () => new Uint8Array([0, 0]),
+        setTimer: ((callback: () => void, delay: number) => {
+          delays.push(delay)
+          return 1 as unknown as ReturnType<typeof setTimeout>
+        }) as unknown as typeof setTimeout,
+        clearTimer: (() => {}) as unknown as typeof clearTimeout
+      },
+      vi.fn()
+    )
+
+    controller.registerFailure(new RelayOuterError(MOBILE_RELAY_CLOSE_CODE.HOST_OFFLINE))
+
+    // hostOfflineDelayMs' 5s floor, not the 250ms transport-backoff floor.
+    expect(delays.at(-1)).toBe(5_000)
+  })
+})
+
+describe('classifyConnection with a signed-out desktop', () => {
+  const base = { reconnectAttempts: 0, lastConnectedAt: null, hostSignedOut: true }
+
+  it('says so from the first failed dial instead of "Connecting via Relay…"', () => {
+    const verdict = classifyConnection({
+      ...base,
+      state: 'connecting',
+      pendingPath: 'relay'
+    })
+
+    expect(verdict).toEqual({
+      kind: 'unreachable',
+      label: SIGNED_OUT_LABEL,
+      reason: 'never-connected'
+    })
+    expect(verdictDisplayLabel(verdict)).toBe(SIGNED_OUT_LABEL)
+  })
+
+  it('replaces "Can\'t reach desktop" on the direct path too', () => {
+    expect(
+      classifyConnection({ ...base, state: 'reconnecting', reconnectAttempts: 20 }).label
+    ).toBe(SIGNED_OUT_LABEL)
+  })
+
+  it('reads as stale once this session had been connected', () => {
+    expect(
+      classifyConnection({ ...base, state: 'reconnecting', lastConnectedAt: 1, nowMs: 2 }).reason
+    ).toBe('stale')
+  })
+
+  // A Tailscale endpoint cannot make "sign in on your desktop" better advice.
+  it('never appends the Tailscale hint', () => {
+    expect(
+      classifyConnection({ ...base, state: 'reconnecting', endpoint: '100.64.0.1' })
+    ).not.toHaveProperty('hint')
+  })
+
+  it('never outranks a connected session', () => {
+    expect(classifyConnection({ ...base, state: 'connected' }).label).toBe('Connected')
+  })
+
+  // Re-pairing, not signing in, is the remedy when the pairing itself is dead.
+  it('never outranks a revoked pairing', () => {
+    expect(classifyConnection({ ...base, state: 'reconnecting', pairingRejected: true }).kind).toBe(
+      'auth-failed'
+    )
+  })
+
+  it('leaves every other verdict alone when the desktop is not signed out', () => {
+    expect(
+      classifyConnection({
+        state: 'connecting',
+        reconnectAttempts: 0,
+        lastConnectedAt: null,
+        pendingPath: 'relay',
+        hostSignedOut: false
+      }).label
+    ).toBe('Connecting via Relay…')
+  })
+})
diff --git a/mobile/src/transport/rpc-client-context-contract.ts b/mobile/src/transport/rpc-client-context-contract.ts
index 54e25973c7f..65262a6fc15 100644
--- a/mobile/src/transport/rpc-client-context-contract.ts
+++ b/mobile/src/transport/rpc-client-context-contract.ts
@@ -24,6 +24,7 @@ export type RpcClientContextValue = {
   getActivePath: (hostId: string) => MobileConnectionPath
   getPendingPath: (hostId: string) => MobileConnectionPath | null
   isPairingRejected: (hostId: string) => boolean
+  isHostSignedOut: (hostId: string) => boolean
   subscribeHostState: (hostId: string, listener: (state: ConnectionState) => void) => () => void
   getAllClients: () => { hostId: string; client: RpcClient }[]
   subscribeAllHosts: (listener: () => void) => () => void
diff --git a/mobile/src/transport/rpc-client-terminal-subscription.ts b/mobile/src/transport/rpc-client-terminal-subscription.ts
index 471bc3c4a4e..405f7f1d9e0 100644
--- a/mobile/src/transport/rpc-client-terminal-subscription.ts
+++ b/mobile/src/transport/rpc-client-terminal-subscription.ts
@@ -38,7 +38,8 @@ export function updateTerminalSubscriptionViewport(
  *  the per-method echo logic out of the rpc-client teardown closure. */
 export function buildStreamUnsubscribe(
   method: string | undefined,
-  params: unknown
+  params: unknown,
+  requestId?: string
 ): { method: string; params: Record<string, unknown> } | null {
   if (!params || typeof params !== 'object') {
     return null
@@ -46,7 +47,10 @@ export function buildStreamUnsubscribe(
   if (method === 'session.tabs.subscribe') {
     const worktree = (params as { worktree?: unknown }).worktree
     return typeof worktree === 'string'
-      ? { method: 'session.tabs.unsubscribe', params: { worktree } }
+      ? {
+          method: 'session.tabs.unsubscribe',
+          params: { worktree, ...(requestId ? { subscriptionId: requestId } : {}) }
+        }
       : null
   }
   if (method === 'nativeChat.subscribe') {
diff --git a/mobile/src/transport/stable-logical-rpc-client.ts b/mobile/src/transport/stable-logical-rpc-client.ts
index d1f1701aed9..fb514128382 100644
--- a/mobile/src/transport/stable-logical-rpc-client.ts
+++ b/mobile/src/transport/stable-logical-rpc-client.ts
@@ -55,6 +55,9 @@ export type StableLogicalRpcClient = RpcClient & {
   // Latched when the desktop has repeatedly refused this device's relay credential.
   setPairingRejected(rejected: boolean): void
   isPairingRejected(): boolean
+  // Latched when the relay named the desktop's own sign-out as the reason it is absent.
+  setHostSignedOut(signedOut: boolean): void
+  isHostSignedOut(): boolean
   // Recovery attempts share this signal so status-only changes rerender.
   onConnectionPathChange(listener: () => void): () => void
   getGeneration(): number
@@ -282,6 +285,8 @@ export function createStableLogicalRpcClient(
     setRecoveryAttempt: (attempt) => connectionPath.setRecoveryAttempt(attempt),
     setPairingRejected: (rejected) => connectionPath.setPairingRejected(rejected),
     isPairingRejected: () => connectionPath.isPairingRejected(),
+    setHostSignedOut: (signedOut) => connectionPath.setHostSignedOut(signedOut),
+    isHostSignedOut: () => connectionPath.isHostSignedOut(),
     onConnectionPathChange: (listener) => connectionPath.subscribe(listener),
     getGeneration: () => generation
   }
diff --git a/mobile/src/transport/use-all-host-clients.ts b/mobile/src/transport/use-all-host-clients.ts
index 03ac5890015..70c709d965f 100644
--- a/mobile/src/transport/use-all-host-clients.ts
+++ b/mobile/src/transport/use-all-host-clients.ts
@@ -138,6 +138,7 @@ export function useAllHostClients(hostIds: string[], options?: UseAllHostClients
       path: MobileConnectionPath
       pendingPath: MobileConnectionPath | null
       pairingRejected: boolean
+      hostSignedOut: boolean
     }>((hostId) => {
       const client = clientsByHostId.get(hostId)
       return client
@@ -148,7 +149,8 @@ export function useAllHostClients(hostIds: string[], options?: UseAllHostClients
               state: ctx.getState(hostId),
               path: ctx.getActivePath(hostId),
               pendingPath: ctx.getPendingPath(hostId),
-              pairingRejected: ctx.isPairingRejected(hostId)
+              pairingRejected: ctx.isPairingRejected(hostId),
+              hostSignedOut: ctx.isHostSignedOut(hostId)
             }
           ]
         : []
diff --git a/native/computer-use-windows/runtime.ps1 b/native/computer-use-windows/runtime.ps1
index 4b68525c7c6..efd44e6cde7 100644
--- a/native/computer-use-windows/runtime.ps1
+++ b/native/computer-use-windows/runtime.ps1
@@ -1,9 +1,15 @@
 param(
-    [Parameter(Mandatory = $true)]
-    [string]$OperationPath
+    [Parameter(Position = 0)]
+    [string]$OperationPath,
+    # Serve mode keeps one process alive so the Add-Type P/Invoke assembly below
+    # is emitted once per session instead of once per operation.
+    [switch]$Serve
 )
 
 $ErrorActionPreference = "Stop"
+# Progress records render to the host, which in serve mode is a pipe carrying
+# one JSON response per line; a stray record would desynchronise the stream.
+$ProgressPreference = "SilentlyContinue"
 $utf8NoBom = New-Object System.Text.UTF8Encoding $false
 [Console]::InputEncoding = $utf8NoBom
 [Console]::OutputEncoding = $utf8NoBom
@@ -1313,9 +1319,56 @@ function Invoke-OrcaOperation($Operation) {
     [pscustomobject]@{ ok = $true; action = $action; snapshot = $snapshot }
 }
 
-try {
-    $operation = Read-OrcaOperation $OperationPath
-    Write-OrcaJson (Invoke-OrcaOperation $operation)
-} catch {
-    Write-OrcaJson ([pscustomobject]@{ ok = $false; error = [string]$_.Exception.Message })
+function Invoke-OrcaServeLoop {
+    # Announced before the first read, and after every Add-Type above: a caller
+    # that never sees this line knows the helper cannot have read a request, let
+    # alone synthesized a click, so replaying it is provably safe. Inferring that
+    # from a missing response instead would replay operations that did run.
+    [Console]::Out.WriteLine('{"ready":true}')
+    [Console]::Out.Flush()
+    # One NDJSON request per line in, one response per line out, until stdin closes.
+    # Responses carry base64 screenshots and routinely exceed a megabyte; ReadLine
+    # and the console writer are both length-bounded only by memory.
+    while ($true) {
+        $line = [Console]::In.ReadLine()
+        if ($null -eq $line) { break }
+        if ([string]::IsNullOrWhiteSpace($line)) { continue }
+        $requestId = $null
+        try {
+            $operation = $line | ConvertFrom-Json
+            $requestId = $operation.requestId
+            $response = Invoke-OrcaOperation $operation
+        } catch {
+            $response = [pscustomobject]@{ ok = $false; error = [string]$_.Exception.Message }
+            # ConvertFrom-Json throws before the id is read, so recover it from the
+            # raw line. An error the caller can match is delivered to the request
+            # that caused it; an unmatched one only trips the caller's desync
+            # guard, which kills this helper, charges a failure toward its cooldown
+            # and discards the message below - so a malformed request would be
+            # reported as a broken stream and its real cause never surface.
+            if ($null -eq $requestId -and $line -match '"requestId"\s*:\s*(\d+)') {
+                $requestId = [long]$Matches[1]
+            }
+        }
+        # Echoed so the caller can prove which request a line answers; a reply it
+        # cannot match is a desynchronised stream, not a usable response.
+        if ($null -ne $requestId) {
+            $response | Add-Member -NotePropertyName requestId -NotePropertyValue $requestId -Force
+        }
+        [Console]::Out.WriteLine((ConvertTo-Json $response -Depth 100 -Compress))
+        [Console]::Out.Flush()
+    }
+}
+
+if ($Serve) {
+    Invoke-OrcaServeLoop
+} elseif ([string]::IsNullOrWhiteSpace($OperationPath)) {
+    Write-OrcaJson ([pscustomobject]@{ ok = $false; error = "runtime.ps1 requires an operation path or -Serve" })
+} else {
+    try {
+        $operation = Read-OrcaOperation $OperationPath
+        Write-OrcaJson (Invoke-OrcaOperation $operation)
+    } catch {
+        Write-OrcaJson ([pscustomobject]@{ ok = $false; error = [string]$_.Exception.Message })
+    }
 }
diff --git a/package.json b/package.json
index 58f4805d937..7b27dffc8c7 100644
--- a/package.json
+++ b/package.json
@@ -10,6 +10,8 @@
   },
   "main": "./out/main/index.js",
   "scripts": {
+    "audit:perf": "oxlint --config config/oxlint-performance-audit.json --format json src",
+    "test:perf:contracts": "vitest run --config config/vitest.performance.config.ts",
     "format": "oxfmt --write .",
     "lint": "oxlint && pnpm run audit:code-quality:native && pnpm run audit:code-quality:type-aware && pnpm run check:reliability-gates && pnpm run check:max-lines-ratchet && pnpm run check:ts-nocheck-ratchet && pnpm run check:runtime-electron-ratchet && pnpm run verify:bundled-skill-guides && pnpm run verify:skill-bundle-manifest && pnpm run verify:localization-catalog && pnpm run verify:localization-runtime-catalog && pnpm run verify:localization-extraction && pnpm run verify:localization-coverage",
     "audit:code-quality": "pnpm run audit:code-quality:native && pnpm run audit:code-quality:type-aware && pnpm run audit:react-doctor",
@@ -141,6 +143,10 @@
     "bench:main-thread-jank": "pnpm run ensure:electron-runtime && node tests/tools/benchmarks/main-thread-jank-bench.mjs",
     "bench:worktree-deletion": "node tests/tools/benchmarks/worktree-deletion-dev-bench.mjs",
     "bench:zustand-selector-fanout": "node config/scripts/zustand-selector-fanout-benchmark.mjs",
+    "bench:agent-inspection-cadence": "node config/scripts/agent-inspection-cadence-batching-benchmark.mjs",
+    "bench:renderer-quadratic-scans": "node config/scripts/renderer-quadratic-scan-benchmark.mjs",
+    "bench:session-write-hot-path": "node config/scripts/session-write-hot-path-benchmark.mjs",
+    "bench:terminal-partial-escape-tail": "node config/scripts/terminal-partial-escape-tail-benchmark.mjs",
     "bench:worktree-refresh-churn": "node --disable-warning=MODULE_TYPELESS_PACKAGE_JSON config/scripts/worktree-refresh-churn-benchmark.mjs",
     "bench:multi-workspace-typing": "pnpm run ensure:electron-runtime && node config/scripts/run-multi-workspace-typing-bench.mjs",
     "bench:ai-vault-typing": "pnpm run ensure:electron-runtime && node config/scripts/run-ai-vault-typing-bench.mjs",
@@ -153,6 +159,7 @@
     "repro:live-remote-realistic-freeze": "node config/scripts/live-remote-realistic-freeze-repro.mjs"
   },
   "dependencies": {
+    "@anthropic-ai/claude-agent-sdk": "0.3.251",
     "@electron-toolkit/preload": "^3.0.2",
     "@electron-toolkit/utils": "^4.0.0",
     "@floating-ui/dom": "1.7.6",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index a045833577f..a69e47f89b3 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -109,19 +109,22 @@ overrides:
   monaco-editor>dompurify: 3.4.13
 
 patchedDependencies:
-  '@vscode/windows-process-tree@0.8.0': 9217ef36c01ed74127fef5512b0c92089cdbf820fd6c109dd671137eebdc7585
+  '@vscode/windows-process-tree@0.8.0': f8ea245391c94da5770045aeea01fa6de466c2199c6ef46b5b769b398aa9823e
   '@xterm/addon-ligatures@0.11.0-beta.300': 47405b9994b5acf1b4e90b49250358c1ca03649854d59560e7732b72fe336920
   '@xterm/addon-search@0.17.0-beta.300': eee5338dd2621ece46e79c61ec06766cd7fadaf79ffdb24e2a8ab68e97ef31f0
   '@xterm/addon-serialize@0.15.0-beta.300': 851eac3d75e6d8c013b9f4c053e61d824b23965cb19ecc28e335e05059f3a294
   '@xterm/addon-webgl@0.20.0-beta.299': 94687e89a0115e6e6aa102837f986debdc029c091527ee5eb4a4e17ceaf9473e
   '@xterm/xterm@6.1.0-beta.303': 98756bcedc402bcdb7c6ab7b015d2e59cd18e97b03a2c06a27e95bb3ba429d9d
   lint-staged@16.4.0: 7333b3837f80a7fbd045964db6d76ba4fc118e49134bdbabb00585b6b7b60673
-  node-pty@1.1.0: e262847f57a1d4d3f2287a843822f7dcf3c9d8655892b07a69eba464e1317eaa
+  node-pty@1.1.0: 7cc9d45f3d2c38f142490d0805e75db55f0eef5174ad41c4b52abc5fbe079ad1
 
 importers:
 
   .:
     dependencies:
+      '@anthropic-ai/claude-agent-sdk':
+        specifier: 0.3.251
+        version: 0.3.251(@anthropic-ai/sdk@0.122.0(zod@4.5.4))(@modelcontextprotocol/sdk@1.30.0(supports-color@7.2.0)(zod@4.5.4))(zod@4.5.4)
       '@electron-toolkit/preload':
         specifier: ^3.0.2
         version: 3.0.2(electron@43.4.1(supports-color@7.2.0))
@@ -157,7 +160,7 @@ importers:
         version: 3.3.1
       node-pty:
         specifier: ^1.1.0
-        version: 1.1.0(patch_hash=e262847f57a1d4d3f2287a843822f7dcf3c9d8655892b07a69eba464e1317eaa)
+        version: 1.1.0(patch_hash=7cc9d45f3d2c38f142490d0805e75db55f0eef5174ad41c4b52abc5fbe079ad1)
       posthog-node:
         specifier: ^5.33.3
         version: 5.33.3
@@ -507,7 +510,7 @@ importers:
     optionalDependencies:
       '@vscode/windows-process-tree':
         specifier: 0.8.0
-        version: 0.8.0(patch_hash=9217ef36c01ed74127fef5512b0c92089cdbf820fd6c109dd671137eebdc7585)
+        version: 0.8.0(patch_hash=f8ea245391c94da5770045aeea01fa6de466c2199c6ef46b5b769b398aa9823e)
       sherpa-onnx-darwin-arm64:
         specifier: 1.12.37
         version: 1.12.37
@@ -535,6 +538,23 @@ packages:
   '@antfu/install-pkg@1.1.0':
     resolution: {integrity: sha512-MGQsmw10ZyI+EJo45CdSER4zEb+p31LpDAFp2Z3gkSd1yqVZGi0Ebx++YTEMonJy4oChEMLsxZ64j8FH6sSqtQ==}
 
+  '@anthropic-ai/claude-agent-sdk@0.3.251':
+    resolution: {integrity: sha512-DqSi8mH2tQYRlVV0G+lJnQ/WbjJZ/a+8cJ3vPuYoqh8esIIvXHm1ZOXV1UPGsFYRnbBytEoiSGitguEXd+sQ+Q==}
+    engines: {node: '>=18.0.0'}
+    peerDependencies:
+      '@anthropic-ai/sdk': '>=0.93.0'
+      '@modelcontextprotocol/sdk': ^1.29.0
+      zod: ^4.0.0
+
+  '@anthropic-ai/sdk@0.122.0':
+    resolution: {integrity: sha512-GGPNftt0caaz9MDlmNQGHX8855Ojaduyy5pm9Sm1h7HalCn0cWNb5/bweadJF+4yzbal+QL6ztBa09WAAOzLmQ==}
+    hasBin: true
+    peerDependencies:
+      zod: ^3.25.0 || ^4.0.0
+    peerDependenciesMeta:
+      zod:
+        optional: true
+
   '@babel/code-frame@7.29.7':
     resolution: {integrity: sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw==}
     engines: {node: '>=6.9.0'}
@@ -2628,6 +2648,9 @@ packages:
     resolution: {integrity: sha512-tlqY9xq5ukxTUZBmoOp+m61cqwQD5pHJtFY3Mn8CA8ps6yghLH/Hw8UPdqg4OLmFW3IFlcXnQNmo/dh8HzXYIQ==}
     engines: {node: '>=18'}
 
+  '@stablelib/base64@1.0.1':
+    resolution: {integrity: sha512-1bnPQqSxSuc3Ii6MhBysoWCg58j97aUjuCSZrGSmDxNqtytIi0k8utUenAwTZN4V5mXXYGsVUI9zeBqy+jBOSQ==}
+
   '@stablyai/playwright-base@2.1.14':
     resolution: {integrity: sha512-/iAgMW5tC0ETDo3mFyTzszRrD7rGFIT4fgDgtZxqa9vPhiTLix/1+GeOOBNY0uS+XRLFY0Uc/irsC3XProL47g==}
     engines: {node: '>=18'}
@@ -4493,6 +4516,9 @@ packages:
     resolution: {integrity: sha512-7MptL8U0cqcFdzIzwOTHoilX9x5BrNqye7Z/LuC7kCMRio1EMSyqRK3BEAUD7sXRq4iT4AzTVuZdhgQ2TCvYLg==}
     engines: {node: '>=8.6.0'}
 
+  fast-sha256@1.3.0:
+    resolution: {integrity: sha512-n11RGP/lrWEFI/bWdygLxhI+pVeo1ZYIVwvvPkW7azl/rOy+F3HYRZ2K5zeE9mmkhQppyv9sQFx0JM9UabnpPQ==}
+
   fast-string-truncated-width@3.0.3:
     resolution: {integrity: sha512-0jjjIEL6+0jag3l2XWWizO64/aZVtpiGE3t0Zgqxv0DPuxiMjvB3M24fCyhZUO4KomJQPj3LTSUnDP3GpdwC0g==}
 
@@ -5039,6 +5065,10 @@ packages:
   json-parse-even-better-errors@2.3.1:
     resolution: {integrity: sha512-xyFwyhro/JEof6Ghe2iz2NcXoj2sloNsWr/XsERDK/oiPCfaNhl5ONfp+jQdAZRQQ0IJWNzH9zIZF7li91kh2w==}
 
+  json-schema-to-ts@3.1.1:
+    resolution: {integrity: sha512-+DWg8jCJG2TEnpy7kOm/7/AxaYoaRbjVB4LFZLySZlWn8exGs3A4OLJR966cVvU26N7X9TWxl+Jsw7dzAqKT6g==}
+    engines: {node: '>=16'}
+
   json-schema-traverse@1.0.0:
     resolution: {integrity: sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==}
 
@@ -6425,6 +6455,9 @@ packages:
   stackback@0.0.2:
     resolution: {integrity: sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw==}
 
+  standardwebhooks@1.1.1:
+    resolution: {integrity: sha512-bCbX9ZEyFkWPsRz7Bl3NuQUJohmwGSev/yhr7vhaGPlc4AfIrspIRa6cPTBuI1ItmrTDJ4d/S2hCsfe4+vQGnQ==}
+
   stat-mode@1.0.0:
     resolution: {integrity: sha512-jH9EhtKIjuXZ2cWxmXS8ZP80XyC3iasQxMDV8jzhNJpfDb7VbQLVW4Wvsxz9QZvzV+G4YoSfBUVKDOyxLzi/sg==}
     engines: {node: '>= 6'}
@@ -6608,6 +6641,9 @@ packages:
   truncate-utf8-bytes@1.0.2:
     resolution: {integrity: sha512-95Pu1QXQvruGEhv62XCMO3Mm90GscOCClvrIUwCM0PYOXK3kaF3l3sIHxx71ThJfcbM2O5Au6SO3AWCSEfW4mQ==}
 
+  ts-algebra@2.0.0:
+    resolution: {integrity: sha512-FPAhNPFMrkwz76P7cdjdmiShwMynZYN6SgOujD1urY4oNm80Ou9oMdmbR45LotcKOXoy7wSmHkRFE6Mxbrhefw==}
+
   ts-dedent@2.2.0:
     resolution: {integrity: sha512-q5W7tVM71e2xjHZTlgfTDoPF/SmqKG5hddq9SzR49CH2hayqRKJtQ4mtRlSxKaJlR/+9rEM+mnBHf7I2/BQcpQ==}
     engines: {node: '>=6.10'}
@@ -7007,6 +7043,16 @@ packages:
   zwitch@2.0.4:
     resolution: {integrity: sha512-bXE4cR/kVZhKZX/RjPEflHaKVhUVl85noU3v6b8apfQEc1x4A+zBxjZ4lN8LqGd6WZ3dl98pY4o717VFmoPp+A==}
 
+ignoredOptionalDependencies:
+  - '@anthropic-ai/claude-agent-sdk-darwin-arm64'
+  - '@anthropic-ai/claude-agent-sdk-darwin-x64'
+  - '@anthropic-ai/claude-agent-sdk-linux-arm64'
+  - '@anthropic-ai/claude-agent-sdk-linux-arm64-musl'
+  - '@anthropic-ai/claude-agent-sdk-linux-x64'
+  - '@anthropic-ai/claude-agent-sdk-linux-x64-musl'
+  - '@anthropic-ai/claude-agent-sdk-win32-arm64'
+  - '@anthropic-ai/claude-agent-sdk-win32-x64'
+
 snapshots:
 
   '@adobe/css-tools@4.5.0': {}
@@ -7016,6 +7062,19 @@ snapshots:
       package-manager-detector: 1.6.0
       tinyexec: 1.1.2
 
+  '@anthropic-ai/claude-agent-sdk@0.3.251(@anthropic-ai/sdk@0.122.0(zod@4.5.4))(@modelcontextprotocol/sdk@1.30.0(supports-color@7.2.0)(zod@4.5.4))(zod@4.5.4)':
+    dependencies:
+      '@anthropic-ai/sdk': 0.122.0(zod@4.5.4)
+      '@modelcontextprotocol/sdk': 1.30.0(supports-color@7.2.0)(zod@4.5.4)
+      zod: 4.5.4
+
+  '@anthropic-ai/sdk@0.122.0(zod@4.5.4)':
+    dependencies:
+      json-schema-to-ts: 3.1.1
+      standardwebhooks: 1.1.1
+    optionalDependencies:
+      zod: 4.5.4
+
   '@babel/code-frame@7.29.7':
     dependencies:
       '@babel/helper-validator-identifier': 7.29.7
@@ -7669,6 +7728,28 @@ snapshots:
     dependencies:
       '@chevrotain/types': 11.1.2
 
+  '@modelcontextprotocol/sdk@1.30.0(supports-color@7.2.0)(zod@4.5.4)':
+    dependencies:
+      '@hono/node-server': 2.1.0(hono@4.13.0)
+      ajv: 8.20.0
+      ajv-formats: 3.0.1(ajv@8.20.0)
+      content-type: 1.0.5
+      cors: 2.8.6
+      cross-spawn: 7.0.6
+      eventsource: 3.0.7
+      eventsource-parser: 3.0.8
+      express: 5.2.1(supports-color@7.2.0)
+      express-rate-limit: 8.5.2(express@5.2.1(supports-color@7.2.0))
+      hono: 4.13.0
+      jose: 6.2.3
+      json-schema-typed: 8.0.2
+      pkce-challenge: 5.0.1
+      raw-body: 3.0.2
+      zod: 4.5.4
+      zod-to-json-schema: 3.25.2(zod@4.5.4)
+    transitivePeerDependencies:
+      - supports-color
+
   '@modelcontextprotocol/sdk@1.30.0(zod@3.25.76)':
     dependencies:
       '@hono/node-server': 2.1.0(hono@4.13.0)
@@ -7679,8 +7760,8 @@ snapshots:
       cross-spawn: 7.0.6
       eventsource: 3.0.7
       eventsource-parser: 3.0.8
-      express: 5.2.1
-      express-rate-limit: 8.5.2(express@5.2.1)
+      express: 5.2.1(supports-color@7.2.0)
+      express-rate-limit: 8.5.2(express@5.2.1(supports-color@7.2.0))
       hono: 4.13.0
       jose: 6.2.3
       json-schema-typed: 8.0.2
@@ -8917,6 +8998,8 @@ snapshots:
 
   '@sindresorhus/merge-streams@4.0.0': {}
 
+  '@stablelib/base64@1.0.1': {}
+
   '@stablyai/playwright-base@2.1.14(@playwright/test@1.59.1)(zod@4.5.4)':
     dependencies:
       '@playwright/test': 1.59.1
@@ -9738,7 +9821,7 @@ snapshots:
       convert-source-map: 2.0.0
       tinyrainbow: 3.1.0
 
-  '@vscode/windows-process-tree@0.8.0(patch_hash=9217ef36c01ed74127fef5512b0c92089cdbf820fd6c109dd671137eebdc7585)':
+  '@vscode/windows-process-tree@0.8.0(patch_hash=f8ea245391c94da5770045aeea01fa6de466c2199c6ef46b5b769b398aa9823e)':
     dependencies:
       node-addon-api: 7.1.0
     optional: true
@@ -9923,7 +10006,7 @@ snapshots:
 
   bluebird@3.7.2: {}
 
-  body-parser@2.3.0:
+  body-parser@2.3.0(supports-color@7.2.0):
     dependencies:
       bytes: 3.1.2
       content-type: 2.0.0
@@ -10779,15 +10862,15 @@ snapshots:
 
   exponential-backoff@3.1.3: {}
 
-  express-rate-limit@8.5.2(express@5.2.1):
+  express-rate-limit@8.5.2(express@5.2.1(supports-color@7.2.0)):
     dependencies:
-      express: 5.2.1
+      express: 5.2.1(supports-color@7.2.0)
       ip-address: 10.4.0
 
-  express@5.2.1:
+  express@5.2.1(supports-color@7.2.0):
     dependencies:
       accepts: 2.0.0
-      body-parser: 2.3.0
+      body-parser: 2.3.0(supports-color@7.2.0)
       content-disposition: 1.1.0
       content-type: 1.0.5
       cookie: 0.7.2
@@ -10797,7 +10880,7 @@ snapshots:
       encodeurl: 2.0.0
       escape-html: 1.0.3
       etag: 1.8.1
-      finalhandler: 2.1.1
+      finalhandler: 2.1.1(supports-color@7.2.0)
       fresh: 2.0.0
       http-errors: 2.0.1
       merge-descriptors: 2.0.0
@@ -10808,9 +10891,9 @@ snapshots:
       proxy-addr: 2.0.7
       qs: 6.15.2
       range-parser: 1.2.1
-      router: 2.2.0
-      send: 1.2.1
-      serve-static: 2.2.1
+      router: 2.2.0(supports-color@7.2.0)
+      send: 1.2.1(supports-color@7.2.0)
+      serve-static: 2.2.1(supports-color@7.2.0)
       statuses: 2.0.2
       type-is: 2.1.0
       vary: 1.1.2
@@ -10831,6 +10914,8 @@ snapshots:
       merge2: 1.4.1
       micromatch: 4.0.8
 
+  fast-sha256@1.3.0: {}
+
   fast-string-truncated-width@3.0.3: {}
 
   fast-string-width@3.0.2:
@@ -10871,7 +10956,7 @@ snapshots:
     dependencies:
       to-regex-range: 5.0.1
 
-  finalhandler@2.1.1:
+  finalhandler@2.1.1(supports-color@7.2.0):
     dependencies:
       debug: 4.4.3(supports-color@7.2.0)
       encodeurl: 2.0.0
@@ -11445,6 +11530,11 @@ snapshots:
 
   json-parse-even-better-errors@2.3.1: {}
 
+  json-schema-to-ts@3.1.1:
+    dependencies:
+      '@babel/runtime': 7.29.7
+      ts-algebra: 2.0.0
+
   json-schema-traverse@1.0.0: {}
 
   json-schema-typed@8.0.2: {}
@@ -12195,7 +12285,7 @@ snapshots:
 
   node-int64@0.4.0: {}
 
-  node-pty@1.1.0(patch_hash=e262847f57a1d4d3f2287a843822f7dcf3c9d8655892b07a69eba464e1317eaa):
+  node-pty@1.1.0(patch_hash=7cc9d45f3d2c38f142490d0805e75db55f0eef5174ad41c4b52abc5fbe079ad1):
     dependencies:
       node-addon-api: 7.1.1
 
@@ -13037,7 +13127,7 @@ snapshots:
       points-on-curve: 0.2.0
       points-on-path: 0.2.1
 
-  router@2.2.0:
+  router@2.2.0(supports-color@7.2.0):
     dependencies:
       debug: 4.4.3(supports-color@7.2.0)
       depd: 2.0.0
@@ -13080,7 +13170,7 @@ snapshots:
 
   semver@7.8.1: {}
 
-  send@1.2.1:
+  send@1.2.1(supports-color@7.2.0):
     dependencies:
       debug: 4.4.3(supports-color@7.2.0)
       encodeurl: 2.0.0
@@ -13107,12 +13197,12 @@ snapshots:
     transitivePeerDependencies:
       - typescript
 
-  serve-static@2.2.1:
+  serve-static@2.2.1(supports-color@7.2.0):
     dependencies:
       encodeurl: 2.0.0
       escape-html: 1.0.3
       parseurl: 1.3.3
-      send: 1.2.1
+      send: 1.2.1(supports-color@7.2.0)
     transitivePeerDependencies:
       - supports-color
 
@@ -13267,6 +13357,11 @@ snapshots:
 
   stackback@0.0.2: {}
 
+  standardwebhooks@1.1.1:
+    dependencies:
+      '@stablelib/base64': 1.0.1
+      fast-sha256: 1.3.0
+
   stat-mode@1.0.0: {}
 
   state-local@1.0.7: {}
@@ -13437,6 +13532,8 @@ snapshots:
     dependencies:
       utf8-byte-length: 1.0.5
 
+  ts-algebra@2.0.0: {}
+
   ts-dedent@2.2.0: {}
 
   ts-morph@26.0.0:
@@ -13786,6 +13883,10 @@ snapshots:
     dependencies:
       zod: 3.25.76
 
+  zod-to-json-schema@3.25.2(zod@4.5.4):
+    dependencies:
+      zod: 4.5.4
+
   zod@3.25.76: {}
 
   zod@4.5.4: {}
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index d241459f884..97920f087c5 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -12,6 +12,20 @@ minimumReleaseAgeExclude:
   - zod@4.5.4
 shamefullyHoist: true
 
+# Orca always launches the user's own resolved Claude CLI via
+# pathToClaudeCodeExecutable, so the SDK's bundled ~95 MB-per-platform CLI
+# binaries must never be installed. Excluding them is what makes the path
+# override mandatory rather than merely preferred.
+ignoredOptionalDependencies:
+  - '@anthropic-ai/claude-agent-sdk-darwin-arm64'
+  - '@anthropic-ai/claude-agent-sdk-darwin-x64'
+  - '@anthropic-ai/claude-agent-sdk-linux-arm64'
+  - '@anthropic-ai/claude-agent-sdk-linux-arm64-musl'
+  - '@anthropic-ai/claude-agent-sdk-linux-x64'
+  - '@anthropic-ai/claude-agent-sdk-linux-x64-musl'
+  - '@anthropic-ai/claude-agent-sdk-win32-arm64'
+  - '@anthropic-ai/claude-agent-sdk-win32-x64'
+
 supportedArchitectures:
   os:
     - current
diff --git a/resources/skills/current-manifest.json b/resources/skills/current-manifest.json
index c8b204f00c5..fdb54016a8f 100644
--- a/resources/skills/current-manifest.json
+++ b/resources/skills/current-manifest.json
@@ -131,17 +131,17 @@
       "name": "orchestration",
       "sourcePath": "skills/orchestration",
       "releaseRevision": 29,
-      "packageDigest": "7a386ce558ba54abe02b4a0de5d71fe3d63c944ef0888ddde130c729b37f7cc8",
-      "gitTreeSha": "4199ec6988801dd491631706cba62631b4bed8fb",
+      "packageDigest": "689e31d84256aded123c801eaa87413474943a9a30d96bff9a19d0a321aefb54",
+      "gitTreeSha": "902cc33dd65730b32ac234dd0ae7166d75498b46",
       "files": [
         {
           "path": "SKILL.md",
-          "size": 4451,
+          "size": 4398,
           "executable": false,
           "classification": "text",
-          "exactSha256": "a7e3350f037698ebbce36b2818d8383ec6e96c2a4825537caab39a83b4fb4b7f",
-          "textNormalizedSha256": "a7e3350f037698ebbce36b2818d8383ec6e96c2a4825537caab39a83b4fb4b7f",
-          "identitySha256": "a7e3350f037698ebbce36b2818d8383ec6e96c2a4825537caab39a83b4fb4b7f"
+          "exactSha256": "19ffdc1fe0d2c97dae845e8d636edb16781453ce2ec26f65a323c492ef90da18",
+          "textNormalizedSha256": "19ffdc1fe0d2c97dae845e8d636edb16781453ce2ec26f65a323c492ef90da18",
+          "identitySha256": "19ffdc1fe0d2c97dae845e8d636edb16781453ce2ec26f65a323c492ef90da18"
         }
       ]
     }
diff --git a/resources/skills/snapshot-registry.json b/resources/skills/snapshot-registry.json
index 5842b48858a..5b3412a497b 100644
--- a/resources/skills/snapshot-registry.json
+++ b/resources/skills/snapshot-registry.json
@@ -1046,17 +1046,17 @@
       },
       {
         "releaseRevision": 29,
-        "packageDigest": "7a386ce558ba54abe02b4a0de5d71fe3d63c944ef0888ddde130c729b37f7cc8",
-        "gitTreeSha": "4199ec6988801dd491631706cba62631b4bed8fb",
+        "packageDigest": "689e31d84256aded123c801eaa87413474943a9a30d96bff9a19d0a321aefb54",
+        "gitTreeSha": "902cc33dd65730b32ac234dd0ae7166d75498b46",
         "files": [
           {
             "path": "SKILL.md",
-            "size": 4451,
+            "size": 4398,
             "executable": false,
             "classification": "text",
-            "exactSha256": "a7e3350f037698ebbce36b2818d8383ec6e96c2a4825537caab39a83b4fb4b7f",
-            "textNormalizedSha256": "a7e3350f037698ebbce36b2818d8383ec6e96c2a4825537caab39a83b4fb4b7f",
-            "identitySha256": "a7e3350f037698ebbce36b2818d8383ec6e96c2a4825537caab39a83b4fb4b7f"
+            "exactSha256": "19ffdc1fe0d2c97dae845e8d636edb16781453ce2ec26f65a323c492ef90da18",
+            "textNormalizedSha256": "19ffdc1fe0d2c97dae845e8d636edb16781453ce2ec26f65a323c492ef90da18",
+            "identitySha256": "19ffdc1fe0d2c97dae845e8d636edb16781453ce2ec26f65a323c492ef90da18"
           }
         ]
       }
diff --git a/skill-guides/orchestration.md b/skill-guides/orchestration.md
index b9b7ca79442..eab866f13d0 100644
--- a/skill-guides/orchestration.md
+++ b/skill-guides/orchestration.md
@@ -3,18 +3,18 @@ name: orchestration
 description: >-
   Use Orca orchestration for structured multi-agent coordination: threaded
   messages, blocking ask/reply flows, task dispatch, worker_done/escalation
-  waits, task DAGs, decision gates, coordinator loops, or decomposing work
-  across agents. Use `orca-cli` instead for full ownership handoffs, including
-  requests phrased as "hand off", "handoff", "handover", "give this to another
-  agent", or "another worktree" when the user did not explicitly ask to
-  supervise, monitor, wait for results, or coordinate a DAG. Use `orca-cli` for
-  terminal control, lightweight terminal prompts, shell commands, Orca
-  worktree management, reading or waiting on terminals, and automation of the
-  browser embedded inside Orca. Use Computer Use for external browser windows,
-  webviews, Orca app UI, or desktop UI outside Orca's embedded browser only when
-  the task requires OS/window-level control such as focus, menus, dialogs,
-  coordinates, or screenshots. Use `orca-cli` for Orca's embedded pages and a
-  page-automation tool such as Playwright or CDP for external pages.
+  waits, task DAGs, decision gates, or coordinator loops. Use `orca-cli`
+  instead for full ownership handoffs, including requests phrased as "hand
+  off", "handoff", "handover", "give this to another agent", or "another
+  worktree" when the user did not explicitly ask to supervise, monitor, wait
+  for results, or coordinate a DAG. Use `orca-cli` for terminal control,
+  lightweight terminal prompts, shell commands, Orca worktree management,
+  reading or waiting on terminals, and the Orca embedded browser. Use Computer
+  Use for external browser windows, webviews, Orca app UI, or desktop UI
+  outside Orca's embedded browser only when the task requires OS/window-level
+  control such as focus, menus, dialogs, coordinates, or screenshots. Use
+  `orca-cli` for Orca's embedded pages and a page-automation tool such as
+  Playwright or CDP for external pages.
 ---
 
 # Orca Inter-Agent Orchestration
@@ -180,6 +180,15 @@ Dispatch rules:
 - After 3 consecutive failures on one task, the dispatch context circuit-breaks and the task is marked failed.
 - Use `task-list --brief --json` for coordinator sweeps; it collapses whitespace and caps each echoed spec at 160 characters (`spec_truncated` marks shortened rows). Omit `--brief` when the full spec is required, or when an older CLI rejects it as an unknown flag.
 
+`dispatch` and `worker-start` refuse the following preflight cases with a stable `error.code`; read it before choosing a recovery, and treat `error.data.nextSteps` as the exact recovery text. Older hosts may omit `data`, so treat every field as optional.
+
+| Code                 | Meaning                                                                                                               | Recovery                                                                                                                       |
+| -------------------- | --------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------ |
+| `task_not_found`     | No Task with that id, or not in the bound Run (`data.taskId`, `data.runId`)                                           | Check `task-list --json`; create the Task with `task-create` if it does not exist                                              |
+| `task_not_startable` | Task cannot start now: not `ready`, or invalid `--retry-of` (`data.status`, `data.unmetDependencies`, `data.retryOf`) | Wait for running dependencies with `check --wait`; retry or unblock failed ones; inspect `dispatch-show` if already dispatched |
+| `inject_rejected`    | `--inject` refused because no recognized agent runs in the target (`data.terminal`, `data.reason`)                    | Start a recognized agent there or pick another terminal; or dispatch without `--inject` and use `terminal send`                |
+| `runtime_error`      | Any other failure, including a target terminal that already owns an active Dispatch                                   | Read the message, inspect state, and do not retry unchanged                                                                    |
+
 ## How deep workers can nest
 
 A dispatched worker normally cannot dispatch sub-workers. Attempting it fails with
diff --git a/skills/orchestration/SKILL.md b/skills/orchestration/SKILL.md
index 85a0ff8c4b0..5725a8f5512 100644
--- a/skills/orchestration/SKILL.md
+++ b/skills/orchestration/SKILL.md
@@ -3,18 +3,18 @@ name: orchestration
 description: >-
   Use Orca orchestration for structured multi-agent coordination: threaded
   messages, blocking ask/reply flows, task dispatch, worker_done/escalation
-  waits, task DAGs, decision gates, coordinator loops, or decomposing work
-  across agents. Use `orca-cli` instead for full ownership handoffs, including
-  requests phrased as "hand off", "handoff", "handover", "give this to another
-  agent", or "another worktree" when the user did not explicitly ask to
-  supervise, monitor, wait for results, or coordinate a DAG. Use `orca-cli` for
-  terminal control, lightweight terminal prompts, shell commands, Orca
-  worktree management, reading or waiting on terminals, and automation of the
-  browser embedded inside Orca. Use Computer Use for external browser windows,
-  webviews, Orca app UI, or desktop UI outside Orca's embedded browser only when
-  the task requires OS/window-level control such as focus, menus, dialogs,
-  coordinates, or screenshots. Use `orca-cli` for Orca's embedded pages and a
-  page-automation tool such as Playwright or CDP for external pages.
+  waits, task DAGs, decision gates, or coordinator loops. Use `orca-cli`
+  instead for full ownership handoffs, including requests phrased as "hand
+  off", "handoff", "handover", "give this to another agent", or "another
+  worktree" when the user did not explicitly ask to supervise, monitor, wait
+  for results, or coordinate a DAG. Use `orca-cli` for terminal control,
+  lightweight terminal prompts, shell commands, Orca worktree management,
+  reading or waiting on terminals, and the Orca embedded browser. Use Computer
+  Use for external browser windows, webviews, Orca app UI, or desktop UI
+  outside Orca's embedded browser only when the task requires OS/window-level
+  control such as focus, menus, dialogs, coordinates, or screenshots. Use
+  `orca-cli` for Orca's embedded pages and a page-automation tool such as
+  Playwright or CDP for external pages.
 ---
 
 # Orca Orchestration
diff --git a/src/cli/bundled-skill-guides.ts b/src/cli/bundled-skill-guides.ts
index 66625fc9a1f..5e68efbe8da 100644
--- a/src/cli/bundled-skill-guides.ts
+++ b/src/cli/bundled-skill-guides.ts
@@ -30,7 +30,7 @@ const ORCA_LINEAR_MARKDOWN = "---\nname: orca-linear\ndescription: >-\n  Use Orc
 const ORCA_PER_WORKSPACE_ENV_MARKDOWN = "---\nname: orca-per-workspace-env\ndescription: >-\n  Set up, review, debug, or validate Orca per-workspace environment recipes —\n  on-demand, disposable runtimes (cloud sandboxes, VMs, or local) created fresh\n  for each workspace. Covers first-time setup (provider prerequisites, the\n  reusable base snapshot, the coding-agent auth snapshot, credentials, and\n  state), not just the per-workspace lifecycle scripts. Use to stand up\n  per-workspace environments, fix an `environmentRecipes` entry in `orca.yaml`, scaffold\n  provider lifecycle scripts, or resolve an `orca vm recipe doctor` failure.\n---\n\n# Per-Workspace Environments\n\nHelp a user stand up and maintain a repo-owned per-workspace environment recipe end to end. Each\nworkspace gets its own on-demand, disposable runtime (a cloud sandbox, a VM, or a local one),\ncreated fresh and torn down after.\n\nOrca is a **thin wrapper**: you guide, detect, and scaffold; you never own the user's cloud account,\nbilling, images, or credentials.\n\n- **You DO:** sequence the setup, detect what's detectable (provider CLI present/logged-in? recipe\n  present? `doctor` passing?), scaffold provider-templated scripts the user fills in, drive the slow\n  snapshot/auth phases with the user, and always show the next action.\n- **You DO NOT:** create accounts, choose plans/regions, invent org/project/scope ids, store or print\n  secrets, or run anything that spends money without an explicit user OK.\n\nFirst-time setup has **four phases before the per-workspace recipe runs** — easy to miss, so walk\nthem in order:\n\n1. **Prerequisites** — cloud account, provider CLI, scope/project, plan limits, git token (§2).\n2. **Base snapshot** — reusable image: tools + repo + headless build, snapshotted once (§3).\n3. **Agent-auth snapshot** — boot the base, run interactive device-auth, re-snapshot (§4).\n4. **State** — thread snapshot id / scope / project / port between phases via a state file (§6).\n\nThen the **per-workspace contract** (create/suspend/resume/destroy) runs fast (§8).\n\n**The one branch that shapes everything — connection mode:** **Orca-server** (`create` runs `orca serve`\nin the env and emits a `pairingCode`; §7c/§7f) vs **SSH** (`create` runs no server and emits a\n`connection.type:\"ssh\"` block Orca dials into; §7g/§7h). Settle this first — it changes the `create`\noutput shape and half the templates.\n\nKeep Orca's checkout behavior unchanged by default: omit `checkoutMode`, emit schema version 1, and\nlet Orca create a linked worktree. Only use `checkoutMode: provisioned-root` when the user explicitly\nwants one ephemeral machine to clone the finished workspace itself. This niche mode currently requires\ndirect SSH, an ordinary non-bare/non-sparse primary checkout at `projectRoot`, and schema version 2.\n\n**Quick-start (happy path):** interview the user (connection mode Orca-server vs SSH, provider, agent CLI,\ngit auth — §1.2) + read the provider's CLI docs → scaffold `scripts/orca-vm/` from §7 → run the\nbase-snapshot script, then the auth script (you invoke these by hand; not via `orca.yaml`) → wire\n`environmentRecipes` in `orca.yaml` → `orca vm recipe doctor <id> --json` (free) → then the `--provision`\nself-test loop (§9) until it passes.\n\n---\n\n## 1. Setup workflow\n\nDrive these with the user. **[CHECKPOINT]** steps need explicit confirmation — they spend money, take\na long time, or need the user at the keyboard. Never create an Orca workspace or commit unless asked.\n\n1. **Inspect the repo** for an existing `environmentRecipes` entry, `scripts/orca-vm/`, a state file, or setup\n   notes. If a working recipe exists, jump to Doctor (§9) instead of rebuilding.\n2. **Interview the user up front** — gather these choices and confirm them back before scaffolding\n   anything. Don't pick for them (§11); don't guess.\n   - **Connection mode:** how Orca attaches to the environment — an **Orca server** (the VM runs\n     `orca serve` and Orca pairs over its pairing URL; worked example §7f) or **SSH** (Orca connects to\n     the host over SSH; §7g). This decides the recipe's connection shape, so settle it first.\n   - **Checkout ownership:** do not ask by default. Only when the user requires the environment to\n     create the exact final checkout, confirm `provisioned-root` and direct SSH; otherwise omit it.\n   - **Provider:** Vercel Sandbox, Fly, Modal, an existing SSH host, … For non-obvious providers, also\n     ask scope/project/region and plan limits (§2). Then **read that provider's CLI/SDK docs** (or\n     `<cli> --help`) before scaffolding — you need its exact create/exec/snapshot/remove verbs.\n     If a provider advertises `ssh`, verify whether it exposes a real dialable SSH target\n     (host/port/user/key or proxy command) or only a provider-mediated interactive shell; Orca SSH mode\n     needs the former.\n   - **Coding-agent CLI + account:** which agent runs in the VM (`codex`, `claude`, …) and that the user\n     has an account for it — it gets logged in during the Phase-3 auth snapshot (§4).\n   - **Git auth:** the token source for cloning a private repo (`GH_TOKEN`/`GITHUB_TOKEN` or `gh auth\ntoken`; §5).\n3. **Check prerequisites (§2)** — detect the provider CLI + auth and confirm the items above are in\n   place before any paid step.\n4. **Scaffold scripts + state file** from §7 (worked Vercel example: §7f; SSH host: §7g; Docker SSH:\n   §7h; Windows: §7i), filling in the provider's real commands. Make them executable.\n5. **[CHECKPOINT] Build the base snapshot (§3)** — paid, slow.\n6. **[CHECKPOINT] Authenticate the agent (§4)** — interactive; the user follows a URL/code. **You cannot\n   drive this step** — you run commands non-interactively, so there's no TTY for `docker exec -it` /\n   `ssh -t` to prompt against. The **user** runs the Phase-3 login in their own terminal (or via the\n   Claude Code harness bang-prefix — `! <cmd>`, with the required space after `!`); you scaffold and drive\n   the non-interactive phases around it. After kicking it off, **ask the user to report back once the login\n   finishes** — you can't observe it completing, and you need that confirmation before resuming the\n   non-interactive steps (base/auth commit, doctor, provision).\n7. **Wire the recipe** so `orca.yaml` points create/suspend/resume/destroy at the scripts (§8). The\n   workspace composer reads `environmentRecipes` from the project's primary checkout of `orca.yaml`, **not** from\n   a feature branch or worktree. So a recipe added only on a branch won't appear as a \"Run on\" option\n   until that `orca.yaml` change is committed and merged to the project's primary branch. Tell the user\n   this up front: `doctor`/`--provision` validate the scripts from the working copy on any branch, but\n   creating a workspace from the recipe in the picker needs it on primary.\n8. **Dry-run doctor** — `orca vm recipe doctor <recipe-id> --repo-path <repo> --json` (free, static; §9).\n   Fix every failure before going live.\n9. **[CHECKPOINT] Live self-test** — get the user's OK once, then run\n   `orca vm recipe doctor <recipe-id> --provision --json` as a loop: it runs create → validates →\n   destroys, and on failure returns a full transcript. Read it, fix the scripts, and re-run yourself until\n   it passes (§9). Spends cloud money; the one approval covers the loop.\n10. **[CHECKPOINT] Optional workspace test** — only if asked: create a workspace via the picker, then\n    verify sleep/wake/delete.\n\n---\n\n## 2. Phase 1 — Prerequisites\n\nThe user's responsibility; verify what's verifiable, ask for the rest, invent nothing. State which\nitems you verified vs. which the user asserted.\n\n- **Connection mode** (Orca server vs SSH) confirmed with the user — see §1 step 2; it shapes the recipe.\n- **Cloud account + plan** that allows sandboxes/VMs. Ask.\n- **Provider CLI installed + authenticated** — detect (`command -v <cli>`), check auth (e.g.\n  `vercel whoami`). If missing, point at the provider's docs; don't log them in.\n- **Scope / project / region** the sandboxes live under. Ask; flows into every script via state.\n- **Plan / timeout / RAM caps.** Record them — e.g. Vercel Hobby caps sandbox timeout at **45m**,\n  which limits both the base build and per-workspace runtime (see §10).\n- **Git token for private repos** (`GH_TOKEN`/`GITHUB_TOKEN`, or the provider's git auth; can fall back\n  to `gh auth token`). See §5.\n- **Coding-agent CLI choice** (`codex`, `claude`…) and that the user has an account — it gets\n  authenticated into the VM in Phase 3.\n\n---\n\n## 3. Phase 2 — Base snapshot (the reusable image)\n\nBuild **once**, snapshot, and every workspace boots from it in seconds instead of rebuilding.\nProvisioning + building takes a while (often ~20–30 min), so it runs behind a checkpoint. The script\nshape is §7a; key points:\n\n- Build the **headless Electron main only** (not the renderer) so it fits in plan RAM.\n- Use the VM image's package manager (`apt`/`dnf`/`apk`, per the base distro — not the provider brand).\n- Clone with the git token via `GIT_ASKPASS` (§5).\n- **Trap errors and remove the half-built sandbox** so a crash doesn't leave a paid resource running.\n- **Never snapshot a machine on which the Orca runtime has already run.** The first `orca serve` creates\n  the runtime's user-data dir, and everything in it gets baked into the image and shared by every VM\n  booted from it: the pairing keypair and device-token registry (`orca-devices.json`,\n  `orca-e2ee-keypair.json`), `agent-session-authority.key`, and the build box's logs, terminal history\n  and orchestration db. Confirmed: two VMs from one such snapshot emitted **identical `deviceToken` and\n  `pairedDeviceId`**. Snapshot **before** the runtime has ever run, or delete the resolved user-data\n  directory first: `orca_user_data_path=\"${ORCA_USER_DATA_PATH:-${XDG_CONFIG_HOME:-$HOME/.config}/orca}\"; rm -rf -- \"$orca_user_data_path\"`.\n  This matches Orca's Linux precedence for custom and default paths; deleting a named file list will\n  drift as Orca adds state.\n- Snapshot the stopped sandbox, parse the snapshot id, and write it + scope/project/port/repo to state.\n\n---\n\n## 4. Phase 3 — Agent-auth snapshot (interactive)\n\nThe base snapshot has the agent CLI installed but **not logged in**, and per-workspace VMs are\nephemeral — so authenticate once and bake it into a second snapshot layer. Script shape is §7b:\n\n1. Boot a sandbox from the base `snapshotId` (from state).\n2. Run the agent's login **interactively** (`--interactive --tty`); the user completes the URL/code in\n   their browser. On a **headless VM this must be the device-auth flow** (e.g. `codex login --device-auth`),\n   **not** plain `codex login`: the default OAuth login starts a loopback callback server on a container\n   port the host browser can't reach, so it hangs. Device-auth instead prints a URL + code the user opens\n   on the **host**.\n3. Verify login; **refuse to snapshot an unauthenticated VM.** Prefer the status command's **exit code**\n   (most agent CLIs exit non-zero when unauthenticated). If you grep instead, agent status often goes to\n   **stderr** (e.g. `codex login status` prints \"Logged in using ChatGPT\" there), so **fold stderr first**\n   (`... 2>&1 | grep …`) and match the agent's **exact success line** — never `grep -qi 'logged in'`, which\n   also matches \"**not** logged in\" and would commit an unauthenticated image.\n4. Re-snapshot, parse the new id, and overwrite `snapshotId` in state to the authenticated image\n   (recording `authSourceSnapshotId`). Remove the auth sandbox.\n\n**You can't drive step 2 yourself** (you run commands non-interactively — no TTY). The **user** runs it in\ntheir own terminal, or via the Claude Code harness bang-prefix (`! <cmd>`, with the required space after\n`!`). You scaffold/boot the sandbox and run steps 3–4, but **you cannot observe the interactive login\nfinishing** — so **ask the user to tell you when it's done** before you verify and re-snapshot.\n\nThis layer inherits §3's rule: if you started `orca serve` on the base or auth sandbox to smoke-test it,\ndelete the runtime's user-data dir (`~/.config/orca` on Linux) before re-snapshotting, or every workspace\nbooted from this image shares one pairing identity and one `agent-session-authority.key`.\n\nIf the agent's credentials are short-lived, warn that the snapshot may need periodic re-auth (§10).\n\nFor disposable runtimes, do **not** treat a host agent config directory (for example `~/.codex`) as the\nauth snapshot by bind-mounting or copying it wholesale. Agent homes often contain sqlite state, hook\napproval state, caches, logs, and host-specific env/config. Instead, authenticate/configure the agent\ninside the disposable runtime and snapshot/commit that runtime layer.\n\n---\n\n## 5. Credentials\n\n- **Never** commit secrets or put them in `userData`, recipe JSON, comments, docs, or the state file.\n- **Git token:** read from env (`GH_TOKEN`/`GITHUB_TOKEN`), falling back to `gh auth token`. Pass to the\n  VM only via the provider's ephemeral `--env`. Inside the VM, use a `GIT_ASKPASS` helper with\n  `x-access-token` (not the token in the clone URL) and `GIT_TERMINAL_PROMPT=0` so a missing token fails\n  fast instead of hanging. When you write the helper from inside `bash -lc` under `set -u`, escape the\n  positional arg and the token (`\\$1`, `\\$GH_TOKEN`) so they land **literally** and resolve at git-runtime\n  — an unescaped `$1` aborts with \"unbound variable\", and a literal `$GH_TOKEN` keeps the real token out of\n  the written file. `rm -f` the helper after the clone/fetch.\n- **Provider auth:** rely on the provider CLI's logged-in session, not checked-in keys.\n- **Agent auth:** lives in the authenticated snapshot (Phase 3) — never a file you write or commit.\n- State holds only **non-secret** wiring (snapshot ids, scope, project, port, repo url/ref).\n\n---\n\n## 6. State file\n\nA repo-local JSON file (e.g. `scripts/orca-vm/<provider>-state.json`) threads non-secret values between\nphases. Each script resolves values as **env var → state → built-in fallback**, and merges its outputs\nback. Phase 2 writes the base `snapshotId`; Phase 3 overwrites it with the authenticated snapshot;\nper-workspace `create` boots from `snapshotId`.\n\n```json\n{\n  \"baseName\": \"orca-base\",\n  \"snapshotId\": \"snap_authenticated_image_id\",\n  \"authSourceSnapshotId\": \"snap_base_image_id\",\n  \"scope\": \"<provider-scope>\",\n  \"project\": \"<provider-project>\",\n  \"port\": 7331,\n  \"repoUrl\": \"https://host/org/repo.git\",\n  \"repoRef\": \"main\",\n  \"projectRoot\": \"/abs/path/on/remote/repo\"\n}\n```\n\n---\n\n## 7. Script templates (provider-agnostic shapes)\n\nScaffold under `scripts/orca-vm/`. These are **shapes** — fill in the provider's real commands. All\nreserve stdout for the final JSON and log progress to stderr. Include a shared `json_value <key>` /\n`env_value <NAME>` reader (env → state → fallback) in each.\n\n**Where each script runs:**\n\n- **Local-side** (`create`/`suspend`/`resume`/`destroy` + the base-snapshot/auth scripts the user\n  invokes) runs **on the user's desktop**, so it must run on their OS. macOS/Linux: `#!/usr/bin/env\nbash`, `set -euo pipefail`, quoted paths. **Windows:** a bare `.sh` won't run — scaffold `.ps1`/`.cmd`\n  or require WSL/Git-Bash and point `orca.yaml` at the right launcher.\n- **Remote-side** (commands you `exec` _inside_ the Linux VM) always runs in the VM's Linux shell, so\n  bash is fine there regardless of the user's OS.\n\n### 7a. Base-snapshot (`<provider>-base-snapshot.sh`) — Phase 2\n\n```bash\n#!/usr/bin/env bash\nset -euo pipefail\n# resolve base_name/repo_url/repo_ref/project_root/port/scope/project/timeout (env→state→fallback)\n# resolve gh token: GH_TOKEN | GITHUB_TOKEN | `gh auth token`\n# 1. provision a sandbox (timeout/vcpus/published port/snapshot retention); trap: remove on error\n# 2. remote exec (long timeout): install pkgs + gh + corepack/pnpm + agent CLI;\n#    clone with GIT_ASKPASS(token); write headless main-only build config;\n#    dev setup; pnpm install; build CLI; build headless electron main; smoke-check tools\n# 3. snapshot stopped sandbox; parse snapshot id (fail if unparseable)\n# 4. merge { baseName, snapshotId, projectRoot, repoUrl, repoRef, port, scope, project } into state\n# print only the state JSON to stdout\n```\n\nWorked Vercel commands for this phase are in §7f. You run this script by hand (not via `orca.yaml`),\nafter exporting the first-run inputs the state file doesn't have yet — e.g. provider scope/project, the\nrepo URL/ref, and a git token (`GH_TOKEN`); later runs read them back from state.\n\n### 7b. Auth (`<provider>-base-auth.sh`) — Phase 3\n\n```bash\n#!/usr/bin/env bash\nset -euo pipefail\n# read source snapshot from state.snapshotId (fail if absent); auth_name=\"${base_name}-auth\"\n# 1. boot sandbox from source snapshot; trap: remove on error\n# 2. INTERACTIVE/TTY remote exec: agent login — user completes URL/code. Headless VM: MUST use the\n#    device-auth flow (e.g. `codex login --device-auth`) — plain OAuth login binds a loopback callback\n#    port the host can't reach and hangs. User runs this themselves (you have no interactive TTY); ask\n#    them to report back when it's done before continuing.\n# 3. verify login, then refuse to snapshot if not logged in. Prefer the status command's EXIT CODE (most\n#    agent CLIs exit non-zero when unauthenticated) over string-matching. If you must grep, fold stderr\n#    first (`status 2>&1 | grep …` — many agents print the success line there) and match the agent's exact\n#    success line; never `grep -qi 'logged in'`, which also matches \"not logged in\". Codex example: §7f.\n# 4. snapshot; parse new id\n# 5. merge { snapshotId:<new>, authSourceSnapshotId:<source> } into state; remove auth sandbox\n# print only the state JSON to stdout\n```\n\n### 7c. Create (`<provider>-create.sh`) — per workspace\n\n```bash\n#!/usr/bin/env bash\nset -euo pipefail\n# read authenticated snapshotId/scope/project/port/repo*/project_root (env→state→fallback)\n# fail clearly if snapshotId is missing (point back to Phases 2–3)\n# name = orca-${ORCA_RECIPE_ID}-${ORCA_VM_INSTANCE_ID} (sanitized, length-capped)\n# 1. boot sandbox from snapshotId with a published port; capture the public URL → pairing address\n#    (an externally reachable wss:// URL); trap: remove sandbox on error\n# 2. remote exec: ensure repo at desired commit; rebuild only if commit changed (cache marker)\n# 3. remote exec: start orca serve in the background and read the recipe JSON it writes (see below)\n# 4. print serve's JSON to stdout, optionally enriched with userData:\n#    { schemaVersion:1, pairingCode, projectRoot, userData:{ provider, resourceId:name, snapshotId } }\n```\n\n**The exact `orca serve` invocation and its output (verified — do not improvise the flags).** Inside the\nVM, run:\n\n```bash\norca serve \\\n  --port \"$PORT\" \\\n  --project-root \"$ABS_REPO_PATH_ON_REMOTE\" \\\n  --pairing-address \"$EXTERNAL_WSS_URL\" \\\n  --recipe-json\n```\n\n**Binary name:** in a VM built from source (the Phase-2 flow), run it as `pnpm exec orca-dev serve …`\nfrom the repo root — `orca-dev` is the in-repo entrypoint and is what the §7f example uses. Plain\n`orca serve …` is the same command when the built CLI is installed on the VM's PATH. The flags/output\nare identical either way.\n\nThere is **no `--host` flag**. `--project-root` must be an absolute directory on the remote. With\n`--recipe-json` the server **stays running** and prints exactly this single object to **stdout**, then\nkeeps serving:\n\n```json\n{\n  \"schemaVersion\": 1,\n  \"pairingCode\": \"<orca pairing URL>\",\n  \"projectRoot\": \"<the --project-root you passed>\"\n}\n```\n\n`pairingCode` is the pairing URL, already pointing at whatever you passed as `--pairing-address` — so set\n`--pairing-address` to the externally reachable address and **pass `pairingCode` through unchanged; never\nhand-rewrite it**. Because serve runs in the foreground and doesn't exit, redirect its stdout to a file\nand poll until that file parses as JSON (and bail if the process dies — dump its stderr log). Your\n`create` script then prints that JSON (optionally merging `userData`). Concrete pattern: §7f.\n\n### 7d. Suspend / resume / destroy — per workspace\n\n```bash\n#!/usr/bin/env bash\nset -euo pipefail\npayload=\"$(cat)\"                       # Orca passes lifecycle JSON on stdin\nresource_id=\"$(node -e 'const d=JSON.parse(process.argv[1]); process.stdout.write(d.recipeResult?.userData?.resourceId ?? \"\")' \"$payload\")\"\n[ -n \"$resource_id\" ] || { echo \"No resource id in lifecycle payload\" >&2; exit 1; }\n# suspend: provider suspend \"$resource_id\"\n# resume:  provider resume \"$resource_id\"; then RE-EMIT fresh recipe JSON (pairing may change)\n# destroy: provider remove \"$resource_id\"   (or set destroy: none in orca.yaml)\n```\n\n### 7e. State file — scaffold with scope/project/repo filled in and snapshot ids empty (§6).\n\n### 7f. Worked example — Vercel Sandbox (all three phases)\n\nA real, working shape (the Vercel surface is a CLI: `vercel sandbox create|exec|snapshot|remove`). Adapt\nnames; verify flags against `vercel sandbox --help` for the user's CLI version before relying on them.\nThese ground §7a (base snapshot) and §7b (auth), which are otherwise generic skeletons.\n\n**Phase 2 — base snapshot (§7a):** provision → install tools + clone + headless build → snapshot.\n\n```bash\n# provision a fresh build sandbox (retain a couple of snapshots); trap-remove on error\nvercel sandbox create --name \"$base\" --runtime node24 --timeout 30m --vcpus 4 --publish-port \"$port\" \\\n  --snapshot-expiration 30d --keep-last-snapshots 2 \"${vercel_args[@]}\" >&2\n# remote build (long timeout): install pkgs+gh+pnpm+agent CLI, clone with GIT_ASKPASS (write the helper\n# with LITERAL \\$1/\\$GH_TOKEN so they resolve at git-runtime, not write-time — see §5/§7f create — then\n# `rm -f /tmp/askpass.sh`), write the headless main-only build config (drop the renderer), dev setup,\n# build CLI + headless main, smoke-check\nvercel sandbox exec \"$base\" \"${vercel_args[@]}\" --timeout 25m --env \"GH_TOKEN=$gh_token\" … -- bash -lc '…build…' >&2\n# snapshot the STOPPED sandbox and parse the id from CLI output (fail if unparseable)\nout=\"$(vercel sandbox snapshot \"$base\" --stop --expiration 30d \"${vercel_args[@]}\" 2>&1)\"; printf '%s\\n' \"$out\" >&2\nsnapshot_id=\"$(printf '%s\\n' \"$out\" | sed -nE 's/.*(snap_[A-Za-z0-9]+).*/\\1/p' | tail -1)\"\n# merge { baseName, snapshotId, scope, project, port, repoUrl, repoRef, projectRoot } into state; print state JSON\n```\n\n**Phase 3 — agent-auth snapshot (§7b):** boot the base, log the agent in interactively, re-snapshot.\n(`codex` below is an example — substitute the user's chosen agent's login/status verbs, e.g. `claude`.)\n\n```bash\nvercel sandbox create --name \"$auth\" --snapshot \"$snapshot_id\" --timeout 30m --publish-port \"$port\" \"${vercel_args[@]}\" >&2\n# INTERACTIVE — the USER runs this in their own terminal (you have no interactive TTY) and completes the\n# URL/code on the HOST. --device-auth is MANDATORY on a headless VM: plain `codex login` binds a loopback\n# callback port the host browser can't reach and hangs. Ask the user to report back when login finishes.\nvercel sandbox exec --interactive --tty \"$auth\" \"${vercel_args[@]}\" -- bash -lc 'codex login --device-auth'\n# refuse to snapshot an unauthenticated VM — fold stderr, match codex's exact success line (§4)\nvercel sandbox exec \"$auth\" \"${vercel_args[@]}\" --timeout 30s -- bash -lc 'codex login status 2>&1' | grep -Eqi 'Logged in using ChatGPT|Logged in via device' \\\n  || { echo \"agent not logged in; not snapshotting\" >&2; exit 1; }\nout=\"$(vercel sandbox snapshot \"$auth\" --stop --expiration 30d \"${vercel_args[@]}\" 2>&1)\"; printf '%s\\n' \"$out\" >&2\nnew_id=\"$(printf '%s\\n' \"$out\" | sed -nE 's/.*(snap_[A-Za-z0-9]+).*/\\1/p' | tail -1)\"\n# overwrite state.snapshotId = new_id, record authSourceSnapshotId = snapshot_id; remove the auth sandbox\n```\n\n**Per-workspace `create`** (the fast path):\n\n```bash\n#!/usr/bin/env bash\nset -euo pipefail\n# resolve from env→state→fallback: snapshot_id, scope, project, port, repo_url, repo_ref, project_root\nvercel_args=(); [ -n \"$scope\" ] && vercel_args+=(--scope \"$scope\"); [ -n \"$project\" ] && vercel_args+=(--project \"$project\")\n[ -n \"$snapshot_id\" ] || { echo \"snapshotId missing — run Phases 2–3 first\" >&2; exit 1; }\ngh_token=\"${GH_TOKEN:-${GITHUB_TOKEN:-$(command -v gh >/dev/null 2>&1 && gh auth token 2>/dev/null || true)}}\"\nrecipe_id=\"${ORCA_RECIPE_ID:-vercel-sandbox}\"\nrecipe_id=\"${recipe_id//./-}\"  # Vercel names forbid dots.\ninstance_id=\"${ORCA_VM_INSTANCE_ID:-$(date +%s)}\"\nmax_recipe_id_length=$((128 - ${#instance_id} - 6))  # Preserve the unique instance suffix.\n[ \"$max_recipe_id_length\" -gt 0 ] || { echo \"ORCA_VM_INSTANCE_ID is too long for a Vercel sandbox name\" >&2; exit 1; }\nname=\"orca-${recipe_id:0:max_recipe_id_length}-${instance_id}\"\n\n# Arm cleanup BEFORE create so a failing create can't leak a half-built paid sandbox.\ncleanup_on_error() { [ \"$?\" -ne 0 ] && vercel sandbox remove \"$name\" \"${vercel_args[@]}\" >/dev/null 2>&1 || true; }\ntrap cleanup_on_error EXIT\n\n# 1. boot from the authenticated snapshot, publish the serve port\ncreate_output=\"$(vercel sandbox create --name \"$name\" --snapshot \"$snapshot_id\" \\\n  --timeout 30m --publish-port \"$port\" \"${vercel_args[@]}\" 2>&1)\"; printf '%s\\n' \"$create_output\" >&2\n# Vercel prints the published https URL; derive the external wss:// pairing address from it\npublic_url=\"$(printf '%s\\n' \"$create_output\" | sed -nE 's#.*(https://[^[:space:]]+\\.vercel\\.run).*#\\1#p' | head -1)\"\n[ -n \"$public_url\" ] || { echo \"no published URL in create output\" >&2; exit 1; }\npairing_ws=\"${public_url/https:\\/\\//wss://}\"\n\n# 2. (remote) ensure the repo is at the right commit; rebuild only if the commit changed (cache marker)\nvercel sandbox exec \"$name\" \"${vercel_args[@]}\" --timeout 20m \\\n  --env \"GH_TOKEN=$gh_token\" --env \"ORCA_PROJECT_ROOT=$project_root\" \\\n  --env \"ORCA_REPO_URL=$repo_url\" --env \"ORCA_REPO_REF=$repo_ref\" \\\n  -- bash -lc 'set -euo pipefail; cd \"$ORCA_PROJECT_ROOT\"; \\\n    # Re-establish git auth for the private-repo fetch (why + full rationale: §5); else it hangs on a prompt.\n    # Load-bearing escaping: \\$1 and \\$GH_TOKEN must land LITERALLY and resolve at git-runtime. Test after\n    # any edit here — reformatting the nested printf/node quoting silently breaks the fetch or leaks the token.\n    if [ -n \"${GH_TOKEN:-}\" ]; then \\\n      printf \"%s\\n\" \"#!/usr/bin/env bash\" \"case \\\"\\$1\\\" in *Username*) echo x-access-token;; *Password*) echo \\\"\\$GH_TOKEN\\\";; esac\" > /tmp/askpass.sh; \\\n      chmod 700 /tmp/askpass.sh; export GIT_ASKPASS=/tmp/askpass.sh GIT_TERMINAL_PROMPT=0; fi; \\\n    git fetch origin \"$ORCA_REPO_REF\"; \\\n    git checkout -B \"$ORCA_REPO_REF\" FETCH_HEAD; \\\n    rm -f /tmp/askpass.sh; \\\n    c=\"$(git rev-parse HEAD)\"; [ -f .orca-built ] && [ \"$(cat .orca-built)\" = \"$c\" ] || { \\\n      pnpm install --prefer-offline && pnpm run build:cli && \\\n      node config/scripts/run-electron-vite-build.mjs --config config/electron-vite.vm-serve.config.ts && \\\n      printf \"%s\" \"$c\" > .orca-built; }' >&2\n\n# 3. (remote) start orca serve in the background, writing recipe JSON to a file; poll until it parses\nrecipe_json=\"$(vercel sandbox exec \"$name\" \"${vercel_args[@]}\" --timeout 60s \\\n  --env \"ORCA_PORT=$port\" --env \"ORCA_PROJECT_ROOT=$project_root\" --env \"ORCA_PAIRING_ADDRESS=$pairing_ws\" \\\n  -- bash -lc 'set -euo pipefail; cd \"$ORCA_PROJECT_ROOT\"; rm -f /tmp/orca-recipe.json /tmp/orca-serve.log; \\\n    nohup pnpm exec orca-dev serve --port \"$ORCA_PORT\" --project-root \"$ORCA_PROJECT_ROOT\" \\\n      --pairing-address \"$ORCA_PAIRING_ADDRESS\" --recipe-json >/tmp/orca-recipe.json 2>/tmp/orca-serve.log </dev/null & \\\n    pid=$!; for _ in $(seq 1 80); do \\\n      node -e \"JSON.parse(require(\\\"node:fs\\\").readFileSync(\\\"/tmp/orca-recipe.json\\\",\\\"utf8\\\"))\" >/dev/null 2>&1 && { cat /tmp/orca-recipe.json; exit 0; }; \\\n      kill -0 \"$pid\" 2>/dev/null || { cat /tmp/orca-serve.log >&2; exit 1; }; sleep 0.25; \\\n    done; cat /tmp/orca-serve.log >&2; echo \"serve recipe JSON timed out\" >&2; exit 1')\"\n\n# 4. print serve's JSON enriched with userData (single object on stdout)\nnode -e 'const p=JSON.parse(process.argv[1]); console.log(JSON.stringify({...p, schemaVersion:1,\n  userData:{...p.userData, provider:\"vercel-sandbox\", resourceId:process.argv[2], snapshotId:process.argv[3]}}))' \\\n  \"$recipe_json\" \"$name\" \"$snapshot_id\"\ntrap - EXIT\n```\n\n`suspend`/`resume`/`destroy` use `vercel sandbox stop|...|remove \"$resource_id\"` reading\n`userData.resourceId` from stdin (§7d). This is the **Orca-server** connection mode (the recipe emits a\npairing URL). If the user chose **SSH** in the §1 interview, use §7g instead.\n\n### 7g. Worked example — existing SSH host (SSH connection mode)\n\nSSH mode is **fundamentally different from §7c/§7f**, not a relabeling of them:\n\n- **`create` does NOT run `orca serve` and does NOT emit a `pairingCode`.** Orca itself connects to the\n  host over its SSH relay, brings up the git + filesystem providers, and imports the repo. The script's\n  only job is to make the host ready and **print SSH connection details** Orca will dial.\n- The result uses a `connection` block with `type: \"ssh\"` and a `target`, **not** the flat\n  `pairingCode`/`projectRoot` shape. Exact shape (Orca rejects anything else):\n\n```json\n{\n  \"schemaVersion\": 1,\n  \"connection\": {\n    \"type\": \"ssh\",\n    \"projectRoot\": \"/abs/path/to/repo/on/host\",\n    \"target\": {\n      \"label\": \"my-box\",\n      \"host\": \"192.0.2.10\",\n      \"port\": 22,\n      \"username\": \"ubuntu\",\n      \"identityFile\": \"~/.ssh/id_ed25519\",\n      \"jumpHost\": \"bastion.example.com\",\n      \"proxyCommand\": \"cloudflared access ssh --hostname %h\",\n      \"relayGracePeriodSeconds\": 0,\n      \"portForwards\": []\n    }\n  }\n}\n```\n\n`label`, `host`, `port`, `username` are required; the rest are optional — omit any you don't need.\n\nFor an explicitly requested one-VM-per-workspace checkout, the create script must read\n`ORCA_RECIPE_RESULT_SCHEMA_VERSION`, `ORCA_REPO_URL`, `ORCA_REPO_REF`, `ORCA_REPO_REF_HEAD`, and\n`ORCA_REPO_BRANCH`. Use `ORCA_REPO_REF` to fetch the selected source, but create\n`ORCA_REPO_BRANCH` at the exact `ORCA_REPO_REF_HEAD` commit; resolving the symbolic ref again can race\nwith an upstream update. `ORCA_REPO_URL` and `ORCA_REPO_REF` are a matched fetch pair, including when\nthe desktop source uses multiple remotes. Return that primary checkout at `projectRoot` and emit the\nsame SSH result with:\n\n```bash\n[ -n \"${ORCA_REPO_REF_HEAD:-}\" ] || { echo \"missing pinned source commit\" >&2; exit 1; }\ngit fetch origin \"$ORCA_REPO_REF\"\ngit cat-file -e \"${ORCA_REPO_REF_HEAD}^{commit}\"\ngit checkout -B \"$ORCA_REPO_BRANCH\" \"$ORCA_REPO_REF_HEAD\"\n```\n\n```json\n{\n  \"schemaVersion\": 2,\n  \"checkoutMode\": \"provisioned-root\",\n  \"connection\": {\n    \"type\": \"ssh\",\n    \"projectRoot\": \"/abs/repo\",\n    \"target\": { \"label\": \"my-box\", \"host\": \"192.0.2.10\", \"port\": 22, \"username\": \"ubuntu\" }\n  }\n}\n```\n\nFail if the requested schema is not `2`; do not silently fall back to the ordinary recipe shape.\n\n**Networking → which `target` fields to set** (how _your desktop_ reaches the box — there is no\n`orca serve` URL in SSH mode):\n\n- Public IP / DNS, or a Tailscale/VPN address → `host`; SSH port → `port` (usually 22).\n- Key auth → `identityFile` (add `identitiesOnly: true` if the agent has many keys).\n- Through a bastion → `jumpHost` (a `user@host` ProxyJump) **or** a full `proxyCommand` (e.g. an access\n  proxy). Use one, not both.\n- A service port the workspace needs → add entries to `portForwards`.\n- `relayGracePeriodSeconds` (optional): how long Orca keeps the SSH relay alive after the workspace\n  detaches before tearing it down; `0` = tear down immediately. Leave it off unless the user wants a\n  reconnect grace window.\n\n**Toolchain & agent auth on a persistent (no-snapshot) host — do this ONCE, by hand, before wiring the\nrecipe** (there's no base image to bake; the host _is_ the base). Run the §7f Phase-2 install steps and\nthe §7f Phase-3 `<agent> login --device-auth` **directly over SSH on the host** (interactive, e.g.\n`ssh -t user@host '<agent> login --device-auth'`). After that the host stays ready across workspaces.\n\n```bash\n#!/usr/bin/env bash\nset -euo pipefail\n# resolve from env→state→fallback (default unset optionals to \"\"): ssh_username, host,\n#   ssh_port (default 22), identity_file, jump_host, proxy_command, project_root, repo_url, repo_ref\n: \"${identity_file:=}\"; : \"${jump_host:=}\"; : \"${proxy_command:=}\"   # avoid set -u aborts on optionals\ngh_token=\"${GH_TOKEN:-${GITHUB_TOKEN:-$(command -v gh >/dev/null 2>&1 && gh auth token 2>/dev/null || true)}}\"\nssh_target=\"${ssh_username}@${host}\"\nssh_opts=(-p \"$ssh_port\"); [ -n \"$identity_file\" ] && ssh_opts+=(-i \"$identity_file\")\n# Why: a fresh host's key isn't in known_hosts; a StrictHostKeyChecking prompt would HANG a\n# non-interactive create. Pre-add the key (or set the option) so it can't block.\nssh-keyscan -p \"$ssh_port\" \"$host\" >> \"$HOME/.ssh/known_hosts\" 2>/dev/null || true\n\n# 1. ensure the repo is present and at the right commit on the host (NO orca serve here)\nssh \"${ssh_opts[@]}\" \"$ssh_target\" \\\n  \"GH_TOKEN='$gh_token' GIT_TERMINAL_PROMPT=0 bash -lc '\n     set -euo pipefail\n     [ -d \\\"$project_root/.git\\\" ] || git clone \\\"$repo_url\\\" \\\"$project_root\\\"\n     cd \\\"$project_root\\\" && git fetch origin \\\"$repo_ref\\\" && git checkout -B \\\"$repo_ref\\\" FETCH_HEAD\n   '\" >&2\n\n# 2. print the SSH connection block (NO pairingCode, NO orca serve). host/port/username tell Orca's\n#    relay how to dial in; identityFile/jumpHost/proxyCommand/portForwards are emitted when set.\nnode -e 'const [host,port,user,idf,jh,pc,root]=process.argv.slice(1);\n  const target={ label:\"per-workspace-host\", host, port:Number(port), username:user };\n  if(idf) target.identityFile=idf; if(jh) target.jumpHost=jh; if(pc) target.proxyCommand=pc;\n  // add target.portForwards=[...] here if the workspace needs forwarded service ports\n  console.log(JSON.stringify({ schemaVersion:1, connection:{ type:\"ssh\", projectRoot:root, target } }))' \\\n  \"$host\" \"$ssh_port\" \"$ssh_username\" \"$identity_file\" \"$jump_host\" \"$proxy_command\" \"$project_root\"\n```\n\n`suspend`/`resume`/`destroy`: on a persistent host there's usually nothing to tear down — set\n`destroy: none` and omit suspend/resume. (Orca still disconnects/reconnects its own SSH relay on\nsleep/wake/delete — that's separate from these scripts.)\n\nIf the SSH host is instead an **ephemeral/snapshot-capable VM** (your hypervisor, or a cloud VM with\nimage support), keep the §7f Phase-2/3 base-image model for provisioning, but still emit the\n`connection.type:\"ssh\"` block above instead of starting `orca serve`.\n\n### 7h. Worked example — local Docker SSH (SSH connection mode)\n\nLocal Docker can model an ephemeral SSH VM without cloud cost: build a base image with `sshd`, tools,\nrepo prerequisites, and the agent CLI; run an **interactive auth container** once; then `docker commit`\nthat container as the authenticated image used by per-workspace `create`.\n\nKey points:\n\n- Publish container SSH to a random localhost port (`-p 127.0.0.1::22`) and emit\n  `connection.type:\"ssh\"` with `host:\"127.0.0.1\"`, that port, `username`, `identityFile`, and\n  `identitiesOnly:true`.\n- Generate a repo-local SSH key if needed, but gitignore the private/public key files.\n- **Bake SSH host keys into the base image** (`ssh-keygen -A` at **build** time; at runtime only generate\n  if absent). Ephemeral containers all present the **same** host key, so `known_hosts` on `127.0.0.1`\n  doesn't churn as the published port rotates across workspaces (otherwise every container's freshly\n  generated key collides on `localhost` and trips host-key-changed warnings).\n- The auth image is the Docker equivalent of Phase 3: the **user** runs the agent login **inside** the\n  container (you can't drive it — you have no interactive TTY), configures proxy env/config, approves\n  hooks, and you commit once they report it's done. On a headless container use the **device-auth** flow\n  (§4). Verify login before committing — exit code, or fold stderr and match the exact success line (§4).\n- Do not bind-mount or copy the host's full agent home into the image. Let each container have writable\n  agent state; only the committed auth image should carry reusable authenticated state.\n- If committing from an interactive shell, force the runtime entrypoint back to `sshd`:\n  `docker commit --change='ENTRYPOINT [\"/usr/local/bin/orca-docker-ssh-entrypoint\"]' …`.\n- `destroy` should read `recipeResult.userData.resourceId` and run `docker rm -f \"$resource_id\"`.\n\nValidation before wiring/live use:\n\n```bash\ndocker image inspect \"$auth_image\" --format '{{json .Config.Entrypoint}}'\ndocker run -d --name \"$name\" -p 127.0.0.1::22 -e \"ORCA_SSH_PUBLIC_KEY=$pubkey\" \"$auth_image\"\ndocker ps -a --filter \"name=$name\"\ndocker logs \"$name\"\nssh -i \"$key\" -p \"$port\" -o IdentitiesOnly=yes user@127.0.0.1 'codex --version'\n```\n\nIf the container exits immediately, inspect logs before the cleanup trap removes it; a committed\ninteractive image with `ENTRYPOINT [\"bash\"]` is a common cause.\n\nAlso confirm the **host key is stable** across containers: the SSH `ssh -i … 127.0.0.1` dial should not\ntrigger a host-key-changed warning when a second container reuses the port. If it does, the host keys\nweren't baked into the base image (see the `ssh-keygen -A` point above).\n\n### 7i. Windows local-side scripts\n\nThe local-side scripts run on the user's desktop. On **Windows**, a bare `.sh` won't execute. Either\nrequire WSL/Git-Bash (and point `orca.yaml` at e.g. `bash ./scripts/orca-vm/<name>.sh` via a `.cmd`\nlauncher), or scaffold PowerShell equivalents. Minimal PowerShell shape:\n\n```powershell\n#requires -Version 5\n$ErrorActionPreference = 'Stop'\n# resolve env→state→fallback; run the provider CLI / ssh the same way;\n# capture provider output; build the result object for the chosen mode and write ONE line of JSON to stdout.\n# Orca-server mode: @{ schemaVersion=1; pairingCode=$pairingCode; projectRoot=$projectRoot; userData=@{...} }\n# SSH mode:        @{ schemaVersion=1; connection=@{ type=\"ssh\"; projectRoot=$projectRoot;\n#                     target=@{ label=$label; host=$host; port=$port; username=$user } } }  (see §7g/§7h)\n($result | ConvertTo-Json -Compress -Depth 6)\n# progress/errors → Write-Error / the error stream, never stdout.\n```\n\nThe remote-side commands you run _inside_ the Linux VM stay bash regardless of the desktop OS.\n\n---\n\n## 8. Per-workspace recipe contract (the fast path)\n\nOnce the authenticated snapshot exists, this runs on every workspace create. Define recipes in\n`orca.yaml`:\n\n```yaml\nenvironmentRecipes:\n  - id: cloud-sandbox\n    name: Cloud Sandbox\n    create: ./scripts/orca-vm/cloud-sandbox-create.sh\n    suspend: ./scripts/orca-vm/cloud-sandbox-suspend.sh\n    resume: ./scripts/orca-vm/cloud-sandbox-resume.sh\n    destroy: ./scripts/orca-vm/cloud-sandbox-destroy.sh\n```\n\n`create` runs **locally from the repo root** and prints **one** JSON object to stdout. Its shape depends\non the connection mode chosen in §1:\n\n**Orca-server mode** — boot the env, start `orca serve` in it, and print serve's result:\n\n```json\n{\n  \"schemaVersion\": 1,\n  \"pairingCode\": \"orca-pairing-code-or-url\",\n  \"projectRoot\": \"/absolute/path/to/repo/on/remote\",\n  \"userData\": { \"provider\": \"example\", \"resourceId\": \"provider-resource-id\" }\n}\n```\n\nHere `pairingCode` (from `orca serve --recipe-json`) and `projectRoot` are required; `schemaVersion` (`1`)\nand `userData` are optional.\n\n**SSH mode** — do **not** run `orca serve`; print the `connection.type:\"ssh\"` block instead (full shape +\nworked script in §7g). `pairingCode` is **not** used in SSH mode.\n\n**Optional provisioned root** — only for direct SSH and only when explicitly requested. Add\n`checkoutMode: provisioned-root` to the recipe, require `ORCA_RECIPE_RESULT_SCHEMA_VERSION=2`, create\nthe requested `ORCA_REPO_BRANCH` at the pinned `ORCA_REPO_REF_HEAD` commit (use `ORCA_REPO_REF` only\nto fetch that commit) at the returned `projectRoot`, and emit schema version 2 with\n`checkoutMode: \"provisioned-root\"`. All recipes without this field retain the schema-v1 behavior above.\n\nLifecycle hooks (all run locally):\n\n- `create`: required. Prints recipe result JSON.\n- `suspend`: optional. Sleep; reads lifecycle payload on stdin.\n- `resume`: optional. Wake; reads payload on stdin and **prints fresh recipe JSON** (pairing may change).\n- `destroy`: optional unless `destroy: none`. Delete/cleanup; reads payload on stdin.\n\nStart Orca remotely with `orca serve --port \"$PORT\" --project-root \"$ABS_ROOT\" --pairing-address\n\"$EXTERNAL_WSS_URL\" --recipe-json` (exact flags + output in §7c). Set `--pairing-address` to the\nexternally reachable address so the emitted `pairingCode` is reachable; tunneling/port mapping is the\nscript's job.\n\nBackward compatibility: `command`→`create`, `cleanup`→`destroy`, `cleanup: none`→`destroy: none`.\nPrefer the lifecycle names.\n\n---\n\n## 9. Doctor and validation\n\nValidate in two stages — the cheap dry run first, then the live self-test.\n\n### Dry run (free, non-destructive) — always do this first\n\n`orca vm recipe doctor <recipe-id> --repo-path <repo> --json` validates **static wiring only** — it does\n**not** boot anything. It checks: local-host execution (v1), repo path, recipe id exists,\ncreate/destroy/suspend/resume command paths resolve, suspend/resume are paired, and each script is\nexecutable (POSIX exec bit; skipped on Windows). Fix every failure here before spending any cloud money.\n\n### Live self-test (`--provision`) — diagnose and iterate yourself\n\n`orca vm recipe doctor <recipe-id> --repo-path <repo> --provision --json` actually runs the recipe end\nto end: it executes `create`, validates the returned recipe JSON, then runs `destroy` to **tear the\nenvironment back down** (so the test leaves nothing running, as long as `destroy` works). It spends real\ncloud money, so get the user's OK **once** before starting — that one approval covers the whole loop\nbelow; do not re-ask before each run.\n\nOn failure, the JSON result includes a `provisionTranscript` with the **complete** captured output of\neach stage so you can self-diagnose without asking the user to relay logs:\n\n```json\n{\n  \"ok\": false,\n  \"checks\": [{ \"id\": \"recipe.provision\", \"status\": \"fail\", \"message\": \"…\" }],\n  \"provisionTranscript\": {\n    \"provision\": { \"exitCode\": 0, \"signal\": null, \"stdout\": \"…\", \"stderr\": \"…\", \"parseError\": \"…\" },\n    \"destroy\": { \"exitCode\": 0, \"signal\": null, \"stdout\": \"…\", \"stderr\": \"…\" }\n  }\n}\n```\n\n**Run it as a loop:** read `provisionTranscript.provision.stderr` / `.stdout` / `.parseError` (and\n`destroy.*`), fix the script, and re-run `--provision` until `ok` is `true` — iterating on your own\nrather than waiting for the user to paste errors. Common reads: a non-empty `stderr` with `exitCode 0`\nplus a `parseError` means `create` ran but printed something other than the single recipe-result JSON on\nstdout (often a stray `echo` — route it to stderr, see §10); a non-zero `exitCode` is a provider/script\nfailure described in `stderr`. Each stream is redacted and capped (head+tail) — large logs keep both the\nsetup context and the failure.\n\nThe self-test cannot see provider-side truth beyond what the scripts print, so still confirm: state has a\npopulated **authenticated** `snapshotId` (Phases 2–3 done), and `destroy` is implemented/tested (or\nexplicitly `none` — in which case the self-test won't tear down, so clean up manually).\n\nFor SSH recipes, also smoke-test the exact emitted target before declaring success: dial the host/port\nwith the identity/proxy settings, run `pwd`, verify the repo path, check the agent binary, and confirm\n`destroy` removes the provider resource/container. For Docker, inspect the auth image entrypoint and do a\nstartup-only `docker run` before the full clone/install path.\n\n---\n\n## 10. Failure modes\n\n- **Build exceeds plan timeout (e.g. Hobby 45m).** Use enough vCPUs and a timeout covering the build;\n  else split work or use a higher plan. The cap also limits per-workspace runtime — surface it.\n- **Build exceeds plan RAM.** Build the **headless main only** (drop the renderer) — the biggest fitter.\n- **Private-repo clone hangs/fails.** Wrong/missing token. Use `GIT_ASKPASS` + `GIT_TERMINAL_PROMPT=0`\n  so it fails fast instead of prompting.\n- **`GIT_ASKPASS` helper aborts the clone with \"`$1: unbound variable`\".** The `printf`/heredoc that writes\n  the helper inside `bash -lc` under `set -u` expanded `$1`/`$GH_TOKEN` at **write** time. Escape them\n  (`\\$1`, `\\$GH_TOKEN`) so they land literally and resolve at git-runtime; this also keeps the real token\n  out of the file. `rm -f` the helper afterward (§5, §7f).\n- **Agent verified as \"not logged in\" despite a good login.** `codex login status` (and similar) print\n  \"Logged in …\" to **stderr**; an stdout-only `grep` misses it. Prefer the status **exit code**; if you\n  grep, fold stderr first (`status 2>&1 | grep …`) and match the exact success line — not `grep -qi\n'logged in'`, which also matches \"not logged in\".\n- **Headless agent login hangs.** Plain OAuth `login` starts a loopback callback server on a VM/container\n  port the host browser can't reach. Use the **device-auth** flow (`login --device-auth`) — it prints a\n  URL + code the user opens on the host.\n- **`known_hosts` host-key churn on local Docker.** Each ephemeral container regenerating its SSH host key\n  collides on `127.0.0.1` as the published port rotates. Bake host keys into the base image at build time\n  (`ssh-keygen -A`; runtime generates only if absent) so all containers share one stable key (§7h).\n- **Snapshot expired/evicted.** If `create` hits an unknown snapshot id, rerun Phases 2–3 and update\n  `snapshotId`.\n- **Agent auth didn't persist.** Confirm `snapshotId` points at the **authenticated** snapshot; re-run\n  Phase 3. Warn that short-lived tokens may need periodic re-auth.\n- **Agent auth copied from the host breaks.** Do not bind-mount/copy a full host agent home; sqlite\n  files can be unwritable or host-specific, hooks may need approval again, and config may reference\n  local-only env vars. Authenticate inside the runtime and snapshot/commit that layer.\n- **Docker auth image exits immediately.** Inspect `docker image inspect … .Config.Entrypoint` and\n  `docker logs`. If the image was committed from an interactive shell, reset the entrypoint to the SSH\n  entrypoint during `docker commit`.\n- **Leaked paid resource.** Every long script must trap errors and remove the sandbox it created.\n- **`create` emits non-JSON on stdout.** A stray `echo` corrupts the result — stdout is for the final\n  JSON only; everything else to stderr. The `--provision` self-test surfaces this as `exitCode 0` + a\n  `parseError` with the offending stdout in `provisionTranscript` (§9).\n\n---\n\n## 11. Boundaries\n\n- Don't create accounts, choose plans/regions, or invent scope/project/org/image/billing ids.\n- Don't invent or store credentials; no secrets in `userData`, state, comments, docs, or commits.\n- Don't run paid/long phases (base snapshot, auth, live test) without an explicit OK.\n- Don't hide provider errors behind generic messages — preserve actionable stderr.\n- Don't make Orca own provider lifecycle beyond invoking the configured scripts.\n- Don't commit or create an Orca workspace unless asked.\n"
 
 // oxfmt-ignore
-const ORCHESTRATION_MARKDOWN = "---\nname: orchestration\ndescription: >-\n  Use Orca orchestration for structured multi-agent coordination: threaded\n  messages, blocking ask/reply flows, task dispatch, worker_done/escalation\n  waits, task DAGs, decision gates, coordinator loops, or decomposing work\n  across agents. Use `orca-cli` instead for full ownership handoffs, including\n  requests phrased as \"hand off\", \"handoff\", \"handover\", \"give this to another\n  agent\", or \"another worktree\" when the user did not explicitly ask to\n  supervise, monitor, wait for results, or coordinate a DAG. Use `orca-cli` for\n  terminal control, lightweight terminal prompts, shell commands, Orca\n  worktree management, reading or waiting on terminals, and automation of the\n  browser embedded inside Orca. Use Computer Use for external browser windows,\n  webviews, Orca app UI, or desktop UI outside Orca's embedded browser only when\n  the task requires OS/window-level control such as focus, menus, dialogs,\n  coordinates, or screenshots. Use `orca-cli` for Orca's embedded pages and a\n  page-automation tool such as Playwright or CDP for external pages.\n---\n\n# Orca Inter-Agent Orchestration\n\nOrchestration is Orca's structured coordination layer for agent messages, task ownership, dispatch state, and worker completion tracking.\n\nUse this skill when coordination state matters. For lightweight terminal prompts or basic worktree/terminal/built-in-browser control, use `orca-cli`.\n\n## Tool Boundary\n\nIf a task says to use Orca orchestration, the coordinator must create or bind a Run, create the Task with `orca orchestration task-create`, then attach the worker with either the preferred `orca orchestration worker-start` composition or the low-level `orca orchestration dispatch --inject` path.\n\nDo not substitute non-Orca subagent tools, generic agent-spawn APIs, or chat-only parallel worker features. Those may create useful workers, but they do not create Orca task/dispatch provenance, injected lifecycle preambles, `worker_done` authority, or decision gates.\n\nBefore claiming a worker was orchestrated, verify the task/dispatch exists:\n\n```bash\norca orchestration task-list --json\norca orchestration dispatch-show --task <task_id> --json\n```\n\nIf the work was accidentally run outside Orca orchestration, say so plainly. To repair provenance, rerun or revalidate the needed work through a fresh Orca terminal plus injected dispatch; do not retroactively describe the external worker as orchestrated.\n\n## When To Use\n\n- Send/reply/ask between agent terminals with persistent messages.\n- Dispatch structured tasks to workers and wait for `worker_done` or `escalation`.\n- Track task DAGs with dependencies.\n- Run coordinator loops or decision gates.\n\nDo not use orchestration merely because the user says \"hand off\", \"handoff\", \"handover\", \"give this to another agent\", or asks for another worktree/agent/model/effort. Those are full ownership transfers unless the user explicitly asks to supervise, monitor, wait for worker completion/results, coordinate a DAG, use decision gates, or keep a blocking ask/reply loop.\n\n## Preconditions\n\n- `orca status --json` should show a running runtime.\n- `orca` must be on PATH (`orca-ide` on Linux).\n- The orchestration experimental feature must be enabled in Settings > Experimental.\n- `orca orchestration` commands are RPC calls to the running Orca runtime.\n\n## Contract Migration\n\nOrca adopts a live pre-update orchestration assignment into an ordinary Run. Adoption preserves the existing agent process, PTY/session, terminal handle, tab/leaf/pane, worktree or folder workspace, Task, and Dispatch; it never restarts or replaces the worker. The retired scheduler is not revived, and a newly created attempt uses the current grammar.\n\nTreat the authority label on injected or formatted messages as definitive:\n\n- `[LEGACY COMPATIBILITY]` is live and attested. Run only the exact supported command printed with the message, using the same CLI executable and arguments that the original prompt supplied.\n- `[LEGACY RECOVERY REPLAY — MAY HAVE BEEN SEEN]` is one bounded, at-least-once cutover replay. Process it idempotently and acknowledge it only through the exact displayed guidance.\n- `[LEGACY READ-ONLY]` is inspection-only. It has no reply, acknowledgment, or lifecycle action.\n- An unlabeled current message uses the current guide and current grammar.\n\nAn explicitly selected current Run, attested current Run binding, current Dispatch, or federated attachment takes precedence over legacy fallback. A retained adoption record alone never turns a current command into a legacy call.\n\nDatabase provenance, an old-looking terminal, or a legacy Run ID does not prove mutation authority. If the runtime cannot prove liveness, principal ownership, capability, or the exact legacy contract, it degrades to read-only inspection and must not fall back to local execution. Exact recovery may restore the already-live PTY once in its original inactive background tab. It must not spawn, write, signal, stop, switch, focus, split, or inject a terminal. Loss of lifecycle authority does not invalidate the existing assignment, process, or filesystem work.\n\nCompatibility retries have narrow guarantees. A pending ask, a reply, a final Dispatch settlement, and a consuming check have durable recovery identities. A-era heartbeat and escalation calls remain at-least-once across a manual A-to-B retry because identical later signals may be intentional. If an A-era ask may already have been answered, run the exact non-consuming recovery check printed by the runtime first; after its answer is printed and acknowledged, a new invocation with the same question creates a new question. Never guess among multiple identical question threads.\n\nWhen a compatibility or recovery command returns structured next-step arguments, run those exact arguments with the same CLI executable. The arguments intentionally omit the executable name so the guidance works with `orca`, `orca-ide`, `orca-dev`, or another configured Orca CLI command. Do not translate the command from memory, broaden its recipient, or retry it as a current mutation unless the returned guidance explicitly says to.\n\nOn packaged Windows, a legacy ask uses a two-step commit/resume protocol. The initial command durably commits the question, prints its exact `ask --resume <message_id>` command, and exits with launcher status `75`; it does not wait for the answer. Run that exact resume command after the launcher or update boundary. Resume is idempotent and read-oriented: it waits for the already-committed question and does not create another one. For a WSL process that received compatibility proof at launch, use the printed executable `orca-ide` WSL resume command so the same distro and packaged launcher authority are preserved; do not substitute a PATH-resolved local CLI. Older WSL processes that never received the hidden launch token remain lifecycle read-only after the update, even while their terminal and filesystem work continue.\n\nLegacy inspection remains available without consuming mail:\n\n```bash\norca orchestration run-list --json\n# run_legacy_local is an empty audit tombstone after adoption.\norca orchestration run-show --id run_legacy_local --json\n# In run-list, find the ordinary Run whose objective is:\n# \"Recovered orchestration work from a contract update\"\norca orchestration run-show --id <adopted_run_id> --json\norca orchestration task-list --run <adopted_run_id> --json\norca orchestration inbox --full --json\norca orchestration check --terminal <legacy_handle> --peek --format --json\norca terminal read --terminal <legacy_handle> --json\norca terminal wait --terminal <legacy_handle> --for tui-idle --timeout-ms 60000 --json\n```\n\nIf the original coordinator is unavailable or cannot prove its retained authority, a current coordinator may explicitly take over the adopted Run from its own live agent terminal:\n\n```bash\norca orchestration run-use --id <adopted_run_id> --takeover-legacy --json\norca orchestration check --run <adopted_run_id> --json\n```\n\nTakeover fences only the old coordinator, binds the current one, and moves pending worker mail into current Run Delivery. It is bound to the authenticated invoking terminal; `--from` cannot name another coordinator. Live legacy workers keep their original Tasks, Dispatches, processes, filesystems, and old prompt commands; their later questions, escalations, and completion reports route to the current coordinator. Do not use takeover while the original coordinator is still actively coordinating, because its later lifecycle mutations are rejected.\n\nDo not launch a replacement editor merely because the desktop app or runtime was updated. If adoption cannot prove continuing authority, keep the original worker as the only editor until it reaches a stable handoff point, then use a new current Dispatch in a conflict-free placement for any remaining work.\n\n## Ownership\n\nNew orchestration messages and tasks belong to one explicitly bound Run. A Run is only a durable namespace and coordinator inbox; it never schedules or places workers. Lifecycle authority comes from the active Dispatch, and terminal handles remain routing metadata rather than durable identity. Send `worker_done` and `heartbeat` from the worker's own terminal; Orca routes them to that Dispatch's Run.\n\nClassify inherited context before sending lifecycle messages:\n\n- Coordinated subtask: a live coordinator owns the DAG and waits on this dispatch. Follow the preamble exactly, including `worker_done`, heartbeat/status, `ask`, and `escalation`.\n- Full handoff means ownership transfer, not supervised dispatch. The original actor is not monitoring a DAG, so do not create lifecycle obligations unless the user explicitly asks you to supervise.\n- Classify requests containing \"hand off\", \"handoff\", \"handover\", \"give this to another agent\", \"give this to another worktree\", \"another agent\", or \"another worktree\" as full handoffs by default, even when the user names a custom model or reasoning effort.\n- Use supervised orchestration only when the user explicitly asks you to \"supervise\", \"monitor\", \"wait\", \"track completion\", \"wait for worker_done\", return results, coordinate a DAG, use a decision gate, or manage ask/reply flow.\n- Do not use `orca orchestration dispatch --inject` for full handoffs. It injects a coordinator preamble that tells the worker to send `worker_done`, heartbeat, and `ask` messages, then end its turn under the original terminal's dispatch lifecycle.\n- Do not run `orca orchestration task-create`, `orca orchestration dispatch --inject`, or `orca orchestration check --wait` for full handoffs. Do not peek at terminal output after prompt delivery to monitor progress.\n- A review-only `worker_done` reports findings; it does not authorize coordinator file edits. After a review-only completion, synthesize findings, ask a decision gate if ownership is unclear, and dispatch or hand off fixes unless the user explicitly asked the coordinator to own fixes.\n- If the user's plan names a next owner agent (for example, \"then use opencode to create a PR\"), post-review corrections and PR prep belong to that named owner. The coordinator routes, synthesizes, asks decision gates when needed, and supervises; the named owner edits files and creates the PR.\n\nIf unclear, inspect orchestration state before sending lifecycle messages:\n\n```bash\norca orchestration task-list --json\norca terminal list --json\n# If inherited context includes a task id:\norca orchestration dispatch-show --task <task_id> --json\n```\n\n## Messaging\n\n```bash\norca orchestration send --subject <text> [--to <run:id|dispatch:id|legacy_handle>] [--from <handle>] [--body <text>] [--type <type>] [--priority <level>] [--thread-id <id>] [--payload <json>] [--json]\norca orchestration check [--terminal <handle>] [--ack <delivery_id>] [--peek|--all] [--types <type,...>] [--format] [--wait] [--timeout-ms <n>] [--json]\norca orchestration reply --id <msg_id> --body <text> [--from <handle>] [--json]\norca orchestration ask (--question <text>|--resume <msg_id>) [--options <csv>] [--timeout-ms <n>] [--from <handle>] [--json]\norca orchestration inbox [--limit <n>] [--json]\n```\n\nRules:\n\n- Omit `--from` unless impersonating another terminal; Orca auto-resolves it from the current terminal.\n- A coordinator `check` returns the bound Run's oldest FIFO Delivery (up to 50 messages) and replays that exact batch until `--ack <delivery_id>`. Process every message before acknowledging; `check --ack <id> --wait` acknowledges, checks, and waits in one operation.\n- Use `--peek` and `--all` only for read-only history/debugging. Type filters decide when a waiter wakes; the returned actionable Delivery is still the oldest full batch.\n- Use `dispatch:<id>` for coordinator guidance to one supervised worker. Orca routes that stable address locally or through the connected-server relay; do not substitute a remote terminal handle.\n- Terminal handles remain appropriate for low-level pre-Dispatch messaging. Prefer `agentTerminalHandle` from the create response, fall back to `startupTerminal.handle` for older runtimes, then re-resolve with `orca terminal list --worktree ... --json` if missing or stale. Continue with the replacement handle only; never dual-send to old and new handles.\n- `terminal list --json` omits `visualLayouts` because handle recovery does not need topology. Add `--include-visual-layouts` only for explicit tab and pane inspection.\n- `orca orchestration check --peek --format --json` returns locally formatted unread mail without consuming it; it never writes to terminal input or remotely wakes another terminal. Use `orchestration dispatch --inject` to deliver a tracked task, or `terminal send` when an existing agent needs a free-form prompt.\n- While supervising workers manually, use `check --wait --types worker_done,escalation,question --timeout-ms <n>` instead of sleep/poll loops. Process the whole Delivery, reply to `question` messages with `orca orchestration reply --id <msg_id> --body <answer> --json`, then acknowledge and keep waiting.\n- `check --json` prints exactly one JSON document on stdout. While `--wait` blocks it also prints keepalive lines (`{\"_keepalive\":true,...}`) to stderr so you can tell the process is alive; those are never on stdout. Do not merge the streams before a parser — `check --wait --json 2>&1 | <parser>` fails with \"Extra data: line 2\". Pipe stdout only.\n- Treat a `check --wait` timeout or `{count:0}` as a checkpoint, not a worker failure. Long coding tasks routinely run 15-60 minutes; keep using rolling waits unless you receive `worker_done`/`escalation`, the terminal exits or disappears, or the user explicitly asks you to stop.\n- Heartbeats and visible terminal activity mean the worker is alive, not done. Do not stop, close, kill, or restart a worker just because it has not produced a completion message yet.\n- Use `ask` when a worker needs a blocking answer from the coordinator; it defaults to the active Dispatch's Run. Timeout or disconnect leaves the question pending, so resume by its original message ID instead of asking again.\n- `check --wait` returns one bounded Delivery, not every future completion. Process every message, acknowledge it, then keep waiting until every expected Dispatch settles.\n- Group addresses include `@all`, `@idle`, `@claude`, `@codex`, `@opencode`, `@gemini`, `@droid`, `@grok`, `@cursor`, and `@worktree:<id>`.\n- Message types include `status`, `dispatch`, `worker_done`, `merge_ready`, `escalation`, `handoff`, `question`, `decision_gate` (legacy/gates), and `heartbeat`.\n- Use group addresses only for messages that are genuinely useful to many terminals, such as `status` broadcasts or intentional fan-out questions. Do not send dispatch lifecycle messages to groups.\n- `worker_done` belongs to the active Dispatch and defaults to its Run mailbox; never target a group.\n- A valid `worker_done` for the active `taskId` + `dispatchId` marks the task and dispatch completed automatically. Do not follow it with `task-update --status completed`; reserve manual updates for explicit recovery or overrides.\n- `heartbeat` is also Dispatch-scoped. Include both IDs and omit `--to` so Orca uses the owning Run; use `status` for broad progress updates.\n\n## Tasks And Dispatch\n\nA Run is the namespace/inbox, a Task is the work item, and a Dispatch assigns one Task attempt to a terminal. Create or bind a Run once before the common loop.\n\n```bash\norca orchestration run-create --objective <text> --json\norca orchestration task-create --spec <text> [--deps <json_array>] [--parent <task_id>] [--json]\norca orchestration task-list [--status <status>] [--ready] [--brief] [--json]\norca orchestration task-update --id <task_id> --status <status> [--result <json>] [--json]\norca orchestration dispatch --task <task_id> --to <handle> [--from <handle>] [--inject] [--json]\norca orchestration dispatch-show --task <task_id> [--json]\n```\n\nTask statuses: `pending`, `ready`, `dispatched`, `completed`, `failed`, `blocked`.\n\nDispatch rules:\n\n- `--inject` sends the task spec plus preamble into a recognized agent CLI so it can report `worker_done`.\n- If the target is a bare shell, omit `--inject`, dispatch for tracking if needed, then send the prompt manually with `orca terminal send --terminal <handle> --text <prompt> --enter --json`.\n- After 3 consecutive failures on one task, the dispatch context circuit-breaks and the task is marked failed.\n- Use `task-list --brief --json` for coordinator sweeps; it collapses whitespace and caps each echoed spec at 160 characters (`spec_truncated` marks shortened rows). Omit `--brief` when the full spec is required, or when an older CLI rejects it as an unknown flag.\n\n## How deep workers can nest\n\nA dispatched worker normally cannot dispatch sub-workers. Attempting it fails with\n`nested_worker_depth_exceeded` and a message telling the worker to complete the task\nitself. Do that — do not try to route around it.\n\nThe limit is a number, not an on/off switch. `Settings -> Orchestration -> Nested worker depth`\nsets how many generations are allowed:\n\n- `1` (default): a coordinator dispatches workers; those workers do not dispatch.\n- `2`: workers may dispatch one further generation.\n\nDepth is counted from the terminal that issues the command, not from the Run. Creating a\nnew Run does not reset it — a worker that runs `run-create` then `worker-start` is still a\nworker, and still counted. This is the part that changed: the old behaviour rejected\nsub-dispatch only because a worker's terminal was not bound to a Run, so creating a Run was\nenough to slip past it.\n\nTwo limits worth knowing:\n\n- **It is a guardrail, not a security boundary.** A caller that declares another terminal's\n  handle while its own launch evidence is unverifiable (an ordinary restored terminal, for\n  example) can be counted as that terminal instead. Orca does not treat workers as hostile.\n- **It applies while a Dispatch is active.** After `worker_done`, or after a coordinator\n  settles the task, the terminal is no longer a worker and is counted as a root again. The\n  process may still be alive; that is the documented boundary, not an accident.\n\n## Preferred Supervised Worker Loop\n\nUse `worker-start` for the normal supervised path. It composes the existing worktree, terminal, readiness, and dispatch primitives while returning exact created/reused effects. Agents still choose placement and concurrency; Orca does not schedule workers or infer conflicts.\n\nCreate the Run and every independent Task first, then start all independent workers before waiting:\n\n```bash\norca orchestration run-create --objective \"<objective>\" --json\norca orchestration task-create --spec \"<worker A task>\" --json\norca orchestration task-create --spec \"<worker B task>\" --json\norca orchestration worker-start --task <task_a> --worktree current --agent codex --json\norca orchestration worker-start --task <task_b> --worktree current --agent claude --json\n```\n\n`current` and exact existing worktrees create a fresh agent terminal and do not rerun setup. Reuse an existing agent only with `--terminal <handle>`.\n\nFor a per-invocation Claude, Codex, or Cursor launch, pass an opaque provider model id with `--model`; add `--effort` only when that agent/model supports the level. These options apply only to fresh agent terminals, override general agent default arguments, and are reported under `launch.requested` and `launch.effective` in the receipt:\n\n```bash\norca orchestration worker-start --task <task_id> --worktree current --agent claude --model opus --effort high --json\n```\n\n`--effort` requires `--model`, and neither option can combine with `--terminal`. A connected worker server must advertise launch-preference support before Orca forwards either option.\n\nFor a new worktree, setup runs by default and agent-first creation reuses the returned startup agent terminal:\n\n```bash\norca orchestration worker-start --task <task_id> --worktree new-child --name <name> --agent codex --setup run --json\n# Independent/top-level:\norca orchestration worker-start --task <task_id> --worktree new-top-level --name <name> --agent codex --setup run --json\n```\n\nSetup normally starts alongside the agent. Only a repository explicitly configured with `wait-for-setup` delays agent launch until setup succeeds. Use `--setup skip` or `--setup inherit` only for a concrete reason.\n\nRead the returned receipt before continuing: `ready` plus setup `running` is normal for start-immediately, while wait-for-setup returns setup `succeeded` before accepting task input. A failed or unknown start exits nonzero; inspect its `stage`, `effects`, and `residualResources` instead of guessing or automatically retrying. A wait-for-setup timeout can honestly leave setup `running`, which is not proof of failure.\n\nTo run the worker on another connected Orca server, add `--on <saved-environment>`. The Run and Tasks remain authoritative on the current server; later commands route by Dispatch ID, so never repeat `--on`:\n\n```bash\n# Mac Run home -> Windows worker (the reverse is identical from a Windows Run home)\norca orchestration worker-start --task <task_id> --on windows --worktree new-top-level --repo <exact_remote_repo_selector> --name <name> --agent codex --setup run --json\norca orchestration worker-show --dispatch <dispatch_id> --json\norca orchestration worker-read --dispatch <dispatch_id> --limit 50 --json\norca orchestration send --to dispatch:<dispatch_id> --subject \"Follow-up\" --body \"<attempt-specific guidance>\" --json\n```\n\nRemote `current` and `new-child` are intentionally invalid because those words are ambiguous across servers. Use an exact discovered remote worktree selector or `new-top-level` with an explicit remote repo selector.\n\nThe follow-up is structured inbox mail, not prompt injection. The worker's next\n`orchestration check` receives it even when the Dispatch is on another connected Orca server.\n\n`worker-read` defaults to `--source auto`: Orca returns the exact hook-reported Codex, Claude, OpenClaude, or Grok transcript when it can prove the worker session, otherwise it returns bounded terminal output with `source: \"terminal\"` and a typed `fallbackReason`. Continue with the returned top-level `cursor`; it stays pinned to that exact source. If Orca reports `source_changed`, start a fresh read without the old cursor. Never supply or guess a provider session ID or transcript path.\n\nWait until every expected Dispatch settles, not for a fixed number of batches:\n\n```bash\norca orchestration check --wait --types worker_done,escalation,question --timeout-ms 900000 --json\n# Process every message. For each accepted worker_done that is not immediately reused:\norca orchestration worker-release --dispatch <dispatch_id> --json\n# Acknowledge only after every message and required release decision is handled:\norca orchestration check --ack <delivery_id> --wait --types worker_done,escalation,question --timeout-ms 900000 --json\n```\n\nAfter processing each accepted `worker_done`, choose the terminal's next owner before you acknowledge the Delivery or wait again. If the same exact agent has an immediate follow-up Task, read the `worker.agent_terminal_handle` field of `worker-show --dispatch <dispatch_id> --json`, then run `orca orchestration worker-start --task <next_task_id> --terminal <handle> --json` so Orca transfers cleanup ownership to the new Dispatch. Otherwise run `orca orchestration worker-release --dispatch <dispatch_id> --json`.\n\nRun `worker-release` after both succeeded and failed `worker_done` reports unless the user explicitly asked to keep that worker live. Release is post-completion cleanup, not cancellation: Orca first preserves inspectable output, then closes only the exact agent terminal owned by that settled Dispatch. Reused or pre-existing terminals, setup terminals, coordinators, active workers, user-taken-over terminals, and identities Orca cannot prove are retained. If the user explicitly asks to keep the live terminal for debugging, record that exception with `orca orchestration worker-retain --dispatch <dispatch_id> --json` instead of silently skipping cleanup. When the user is finished, the same Dispatch can be passed to `worker-release`, which clears the requested retention and releases the terminal.\n\nDo not release a worker because of a timeout, TUI idle state, heartbeat, status, question, escalation, or rejected/stale `worker_done`. If release returns `release_pending` or `release_unknown`, do not substitute `terminal close`; follow the exact recovery action in the receipt. A replayed Delivery may repeat `worker-release` safely.\n\nWorkers report exactly once using the IDs and capability injected by Orca; they do not supply Run/server/terminal identity:\n\n```bash\norca orchestration send --type worker_done --subject \"<status>\" --body \"<what changed, findings, and what remains>\" --task-id <task_id> --dispatch-id <dispatch_id> --outcome succeeded --files-modified \"path/a,path/b\" --json\n# On failure, use --outcome failed; never encode failure only in prose.\n```\n\nA worker question defaults to its owning Run. Timeout leaves it pending:\n\n```bash\norca orchestration ask --question \"<question>\" --options \"yes,no\" --timeout-ms 600000 --json\norca orchestration ask --resume <message_id> --timeout-ms 600000 --json\n# Coordinator:\norca orchestration reply --id <message_id> --body \"<answer>\" --json\n```\n\nRecovery is conditional, never a fixed destructive sequence:\n\n- The response was lost and named no Dispatch: run `orca orchestration request-show --request <request_id> --json` first. It is read-only. `completed` means the mutation already took effect. `pending` means the original mutation is still running or Orca restarted before recording its outcome. For either state, replaying the original command with `--retry-request <request_id>` reuses the same operation identity so Orca can replay, join, or safely recover it without starting a separate duplicate. `absent` means this runtime holds no receipt under your caller identity and is not proof that nothing happened; inspect the affected state before deciding whether to retry.\n- `worker-show --dispatch <id>` says `ready`: keep waiting or read bounded output.\n- It proves `failed` or `stopped`: start a replacement with `worker-start --task <task> --retry-of <id>` plus an explicit `--on`/`--worktree` and `--agent`/`--terminal` choice. Retry does not silently inherit placement.\n- It remains `outcome_unknown`: either `worker-stop --dispatch <id>` and inspect again, or explicitly `worker-abandon --dispatch <id>` while accepting that resources may still be live. Abandon performs no remote, process, or filesystem action.\n- `worker-stop` closes only the exact supervised agent terminal. It never deletes the worktree, setup terminal, configured tabs, or unrelated processes.\n\nLow-level `worktree create`, `terminal create`, and `dispatch --inject` remain valid recipes for custom argv or topology that `worker-start` does not express.\n\n`dispatch --inject` deliberately keeps an operator-started terminal unsupervised: it never creates a `worker_dispatches` row and `worker-stop`/`worker-abandon` never close that process. The dispatch context is still authoritative, so `worker-show`, `worker-read`, and `worker-list` report it as `unsupervised`; settled `worker-retain` and `worker-release` report `retained` with `no_owned_resource` and take no process action. Use `worker-start --terminal <handle>` when supervision and worker lifecycle state are required.\n\n## Gates And Legacy Inspection\n\n```bash\norca orchestration gate-create --task <task_id> --question <text> [--options <json_array>] [--json]\norca orchestration gate-resolve --id <gate_id> --resolution <text> [--json]\norca orchestration gate-list [--task <task_id>] [--status <status>] [--json]\n```\n\nUse `ask` for worker-to-coordinator questions; it creates a `question` message that the coordinator answers with `reply`. Use `gate-create` only for coordinator-managed task DAG decisions, not for answering a worker's `ask`.\n\n`coordinator-start`, `coordinator-stop`, `run`, and `run-stop` are retired scheduler commands. They perform no effects and return the current-skill recovery action. They are not aliases for lightweight Run creation or binding.\n\nRecovery only: `orca orchestration reset --tasks|--messages|--all --json` clears the selected local orchestration database state. Do not run it during active coordination unless explicitly abandoning that state.\n\n## Full Handoffs\n\nFor full ownership transfer, use non-lifecycle terminal/worktree commands and then stop monitoring unless the user asks for supervision.\n\nTreat these as full handoff requests by default: \"hand off\", \"handoff\", \"handover\", \"give this to another agent\", \"give this to another worktree\", \"send this to another agent\", \"another agent\", \"another worktree\", or \"launch another agent to own this.\" Custom model or reasoning effort words such as `gpt-5.5`, `high`, or `xhigh` do not make the handoff supervised.\n\nSupervised orchestration remains available only when the user explicitly asks for supervision or coordination: \"supervise\", \"monitor\", \"wait for worker_done\", \"wait for results\", \"track completion\", \"DAG\", \"decision gate\", \"ask/reply\", or \"coordinate workers.\"\n\nDo not run `orca orchestration task-create`, `orca orchestration dispatch --inject`, or `orca orchestration check --wait` for full handoffs. `task-create` is also forbidden because it records coordinator-owned tracking state; if a task row is needed, the user asked for supervised orchestration. Do not create a `taskId`/`dispatchId`, inject a lifecycle preamble, wait for completion, or read the worker terminal after prompt delivery except to avoid losing the initial prompt.\n\nNew top-level worktree handoff:\n\n```bash\norca worktree create --name <task-name> --no-parent --agent codex --prompt \"<task brief>\" --setup run --json\n```\n\nBefore creating a new worktree from an active feature branch, decide and state whether the desired Orca lineage is child or top-level. Use child worktree lineage only when the new work is conceptually stacked under or dependent on the active worktree. For independent repo-wide fixes, standalone feature work, or unrelated follow-up tasks, create a top-level worktree with `--no-parent`.\n\nExisting terminal handoff:\n\n```bash\norca terminal send --terminal <handle> --text \"<task brief>\" --enter --json\n```\n\nCustom Codex model/effort handoff:\n\n`orca worktree create --agent codex --prompt ...` launches the known Codex agent but does not accept Codex-specific `--model` or `-c model_reasoning_effort=...` arguments. When the user asks for a specific Codex model or effort, create the independent worktree first, launch Codex with the requested command in that worktree, wait only for TUI readiness if prompt delivery would otherwise race startup, send the prompt, and stop.\n\nThe two-step custom-argv path cannot enforce a repository's explicit `wait-for-setup` startup policy because the later `terminal create` is not the startup owned by `worktree create`. Use it only when the repository starts agents immediately. If the repository requires `wait-for-setup`, use an agent-first configured launcher that can preserve sequencing, or stop and ask rather than silently bypassing the policy.\n\nNote: when no repo default-terminal configuration supplies a primary terminal, bare create opens a fallback shell before `terminal create` adds the agent. Configured default tabs are materialized instead and may run real commands. Prefer `--agent` whenever custom argv is not required. With the two-step path, target only the agent handle; close a prior terminal only after `terminal list` or `terminal show` confirms it is an unused shell.\n\nUse the exact full `<repo-id>::<path>` worktree id returned by `orca worktree create --json`; a bare repo id cannot target the new worktree.\n\n```bash\norca worktree create --name <task-name> --no-parent --setup run --json\norca terminal create --worktree id:<newFullWorktreeId> --title <task-name> --command 'codex --model gpt-5.5 -c model_reasoning_effort=\"xhigh\"' --json\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms 60000 --json\norca terminal send --terminal <handle> --text \"<task brief>\" --enter --json\n```\n\nWait only for `tui-idle` when needed to avoid losing the prompt. Do not monitor task completion.\n\n`--no-parent` only controls Orca lineage; it does not choose the Git base. If the work should start from the repo default base, omit `--base-branch` so Orca uses that default, or explicitly pass the repo default base (`origin/main`, `origin/master`, or the `orca repo show --repo <selector> --json` value); never base it on the current feature branch unless the user explicitly asks for stacked work or \"branch from current\". Put current-branch context in the prompt instead.\n\n## Worker Terminals\n\nChoose the worker location before creating a terminal. `Fresh worker` means a fresh agent session, not a new git worktree. For parallel work, create one fresh agent terminal per worker in the same required worktree, falling back to the active worktree when none is named. If the task says current worktree only, depends on uncommitted files/artifacts, or must validate/PR the current branch, keep every worker in the active worktree:\n\n```bash\norca terminal create --worktree active --title <task-name> --command \"codex\" --json\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms 60000 --json\norca orchestration dispatch --task <task_id> --to <handle> --inject --json\n```\n\nReuse an idle agent in the required worktree only if the prompt allows reuse; otherwise create a fresh terminal there. Create a new worktree only when the user explicitly requests one or a concrete checkout or filesystem conflict makes sharing unsafe or impossible; if the user did not request it, state that conflict before running `worktree create`. Independent tasks, parallel execution, convenience, or a preference for separate checkouts are not isolation requirements.\n\nWhen a new worktree is allowed, use child lineage for isolated work that is stacked under or dependent on the active worktree, and use `--no-parent` when it is not stacked. Decide the Git base separately: `--no-parent` makes the worktree top-level in Orca, while omitted `--base-branch` uses the repo default base.\n\nFor every new worktree, pass `--setup run` so any configured repository setup hook runs. This does not mean waiting for setup before agent launch: preserve the repository's startup policy, whose default starts setup and the agent side by side. Use `--setup skip` or `--setup inherit` only when there is a concrete task-specific reason, and state that reason before creating the worktree. This rule does not rerun setup for current or existing worktrees.\n\n```bash\norca worktree create --name <task-name> --agent codex --setup run --json\n# or: --agent claude | omp | pi | grok | ...\n# Read <handle> from agentTerminalHandle, falling back to startupTerminal.handle.\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms 60000 --json\norca orchestration dispatch --task <task_id> --to <handle> --inject --json\n```\n\nFor new-worktree workers, read the id and `agentTerminalHandle` from `worktree create`, falling back to `startupTerminal.handle` for older runtimes. Use that as the sole worker handle when present; otherwise use `terminal list` to resolve the agent handle. Omit `--repo` only inside an Orca-managed worktree; otherwise pass `--repo <selector>`.\n\n**For an allowed new worktree, use agent-first:** `--agent` reveals the new worktree and launches the selected agent **in its first terminal**, without adding a separate fallback shell for that worker. Pass `--setup run`; repo setup and default-terminal settings may add intentional tabs or splits. Do **not** run bare `worktree create` and then `terminal create --command <agent>` for the same worker when agent-first create is available: without configured default tabs, that two-step path leaves a fallback shell + agent pair. Only use it when custom agent argv is required (for example Codex model/effort flags) or when an older CLI rejects `--agent`; if you must, message only the agent handle. Configured default tabs are intentional surfaces, so close a prior terminal only after `terminal list` or `terminal show` confirms it is an unused shell. Do not run `worktree create` when the task must stay in the current worktree.\n\nUse `orca worktree create --prompt ...` or `orca terminal send ...` for full handoffs or untracked/lightweight prompts. Those paths do not attach `taskId`/`dispatchId`; the worker should not send lifecycle messages unless the prompt supplies a live orchestration preamble.\n\nSidebar lineage and orchestration lifecycle are related but not identical. A same-worktree worker may appear as a peer under that worktree in the sidebar while remaining a child dispatch in orchestration state; only an actual child worktree creates visible parent/child worktree lineage.\n\nOther terminal commands coordinators often need:\n\n```bash\norca terminal list [--worktree <selector>] [--include-visual-layouts] [--json]\norca terminal create [--worktree <selector>] [--title <text>] [--command <cmd>] [--json]\norca terminal split --terminal <handle> [--direction horizontal|vertical] [--command <cmd>] [--json]\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms <n> --json\norca terminal read --terminal <handle> --json\norca terminal send --terminal <handle> --text <text> --enter --json\n```\n\nIf an older CLI rejects `worktree create --agent`, create the worktree normally, then run `orca terminal create --worktree <selector> --command \"codex\" --json` or `--command \"claude\"`.\n\nWait for `tui-idle` before dispatching. Always pass `--timeout-ms`; real coding tasks can take 15-60 minutes. During supervision, use rolling `check --wait` windows. If a window returns no matching message, inspect `task-list`, `terminal read`, or `terminal wait --for tui-idle` as a liveness checkpoint; if the terminal is still working or producing activity, keep waiting instead of retrying the task.\n\n## Agent Guidance\n\n- Workers with a valid live preamble must send `worker_done` exactly once from their own terminal with an explicit `--outcome succeeded` or `--outcome failed`:\n  `orca orchestration send --type worker_done --subject \"<short status>\" --body \"<3-sentence summary: what you did, what you found, what's left>\" --task-id <task_id> --dispatch-id <dispatch_id> --outcome succeeded --files-modified \"path/a\" --report-path \"<optional>\" --json`\n- A failed outcome is still a terminal report, but Orca records both the Dispatch and Task as failed. Never encode failure only in the subject/body.\n- After sending `worker_done`, end that dispatched turn and idle at the agent prompt. Do not autonomously start more work, poll, or attempt to close the terminal yourself. A direct user instruction takes precedence and starts ordinary user-owned work: follow it without coordinator approval or a fresh Dispatch, never refuse it because of worker/coordinator roles, and do not reuse the settled Dispatch's lifecycle IDs. A coordinator-supervised follow-up still arrives with a fresh preamble + TASK block.\n- For long tasks, send heartbeat/status only when the preamble asks for it, including both IDs:\n  `orca orchestration send --type heartbeat --subject \"alive\" --payload '{\"taskId\":\"<task_id>\",\"dispatchId\":\"<dispatch_id>\",\"phase\":\"implementing\"}' --json`\n- If blocked before completion, use `ask`; use `escalation` only when ownership is valid and the coordinator must intervene.\n- Treat preambles inherited through terminal history or full handoffs as stale unless the current prompt explicitly keeps that coordinator in the loop.\n- Coordinators must account for every settled worker terminal before waiting again or ending the turn: immediately reuse the exact worker for a new Dispatch, explicitly retain it at the user's request with `worker-retain`, or run `worker-release`. Do not leave a completed worker live merely to inspect output; released workers remain readable through `worker-read`.\n- Coordinators should use `task-list --ready` as external memory, dispatch parallel waves, and avoid dependency chains deeper than 3-4 steps.\n\n## Example\n\n```bash\norca terminal create --worktree active --title login-css-worker --command \"claude\" --json\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms 60000 --json\norca orchestration task-create --spec \"Fix the login button CSS\" --json\norca orchestration dispatch --task <task_id> --to <handle> --inject --json\norca orchestration check --wait --types worker_done,escalation,question --timeout-ms 900000 --json\n```\n\n## Next Action\n\nCoordinator: confirm `orca status --json`, create or bind a Run, inspect `task-list`/`dispatch-show` if inheriting state, then use the explicit supervised loop (`task-create` -> `worker-start` -> `check --wait`). Use low-level terminal creation plus `dispatch --inject` only when the composed start does not express the needed topology. After every accepted `worker_done`, either transfer the exact terminal to an immediate follow-up Dispatch or run `worker-release` before the next wait.\n\nWorker: if the current prompt contains a live dispatch preamble, do the task, use `ask` for blocking questions, and send `worker_done` once with the required payload. If the preamble is stale or absent, do not send lifecycle messages; inspect state or treat the prompt as an ordinary handoff.\n"
+const ORCHESTRATION_MARKDOWN = "---\nname: orchestration\ndescription: >-\n  Use Orca orchestration for structured multi-agent coordination: threaded\n  messages, blocking ask/reply flows, task dispatch, worker_done/escalation\n  waits, task DAGs, decision gates, or coordinator loops. Use `orca-cli`\n  instead for full ownership handoffs, including requests phrased as \"hand\n  off\", \"handoff\", \"handover\", \"give this to another agent\", or \"another\n  worktree\" when the user did not explicitly ask to supervise, monitor, wait\n  for results, or coordinate a DAG. Use `orca-cli` for terminal control,\n  lightweight terminal prompts, shell commands, Orca worktree management,\n  reading or waiting on terminals, and the Orca embedded browser. Use Computer\n  Use for external browser windows, webviews, Orca app UI, or desktop UI\n  outside Orca's embedded browser only when the task requires OS/window-level\n  control such as focus, menus, dialogs, coordinates, or screenshots. Use\n  `orca-cli` for Orca's embedded pages and a page-automation tool such as\n  Playwright or CDP for external pages.\n---\n\n# Orca Inter-Agent Orchestration\n\nOrchestration is Orca's structured coordination layer for agent messages, task ownership, dispatch state, and worker completion tracking.\n\nUse this skill when coordination state matters. For lightweight terminal prompts or basic worktree/terminal/built-in-browser control, use `orca-cli`.\n\n## Tool Boundary\n\nIf a task says to use Orca orchestration, the coordinator must create or bind a Run, create the Task with `orca orchestration task-create`, then attach the worker with either the preferred `orca orchestration worker-start` composition or the low-level `orca orchestration dispatch --inject` path.\n\nDo not substitute non-Orca subagent tools, generic agent-spawn APIs, or chat-only parallel worker features. Those may create useful workers, but they do not create Orca task/dispatch provenance, injected lifecycle preambles, `worker_done` authority, or decision gates.\n\nBefore claiming a worker was orchestrated, verify the task/dispatch exists:\n\n```bash\norca orchestration task-list --json\norca orchestration dispatch-show --task <task_id> --json\n```\n\nIf the work was accidentally run outside Orca orchestration, say so plainly. To repair provenance, rerun or revalidate the needed work through a fresh Orca terminal plus injected dispatch; do not retroactively describe the external worker as orchestrated.\n\n## When To Use\n\n- Send/reply/ask between agent terminals with persistent messages.\n- Dispatch structured tasks to workers and wait for `worker_done` or `escalation`.\n- Track task DAGs with dependencies.\n- Run coordinator loops or decision gates.\n\nDo not use orchestration merely because the user says \"hand off\", \"handoff\", \"handover\", \"give this to another agent\", or asks for another worktree/agent/model/effort. Those are full ownership transfers unless the user explicitly asks to supervise, monitor, wait for worker completion/results, coordinate a DAG, use decision gates, or keep a blocking ask/reply loop.\n\n## Preconditions\n\n- `orca status --json` should show a running runtime.\n- `orca` must be on PATH (`orca-ide` on Linux).\n- The orchestration experimental feature must be enabled in Settings > Experimental.\n- `orca orchestration` commands are RPC calls to the running Orca runtime.\n\n## Contract Migration\n\nOrca adopts a live pre-update orchestration assignment into an ordinary Run. Adoption preserves the existing agent process, PTY/session, terminal handle, tab/leaf/pane, worktree or folder workspace, Task, and Dispatch; it never restarts or replaces the worker. The retired scheduler is not revived, and a newly created attempt uses the current grammar.\n\nTreat the authority label on injected or formatted messages as definitive:\n\n- `[LEGACY COMPATIBILITY]` is live and attested. Run only the exact supported command printed with the message, using the same CLI executable and arguments that the original prompt supplied.\n- `[LEGACY RECOVERY REPLAY — MAY HAVE BEEN SEEN]` is one bounded, at-least-once cutover replay. Process it idempotently and acknowledge it only through the exact displayed guidance.\n- `[LEGACY READ-ONLY]` is inspection-only. It has no reply, acknowledgment, or lifecycle action.\n- An unlabeled current message uses the current guide and current grammar.\n\nAn explicitly selected current Run, attested current Run binding, current Dispatch, or federated attachment takes precedence over legacy fallback. A retained adoption record alone never turns a current command into a legacy call.\n\nDatabase provenance, an old-looking terminal, or a legacy Run ID does not prove mutation authority. If the runtime cannot prove liveness, principal ownership, capability, or the exact legacy contract, it degrades to read-only inspection and must not fall back to local execution. Exact recovery may restore the already-live PTY once in its original inactive background tab. It must not spawn, write, signal, stop, switch, focus, split, or inject a terminal. Loss of lifecycle authority does not invalidate the existing assignment, process, or filesystem work.\n\nCompatibility retries have narrow guarantees. A pending ask, a reply, a final Dispatch settlement, and a consuming check have durable recovery identities. A-era heartbeat and escalation calls remain at-least-once across a manual A-to-B retry because identical later signals may be intentional. If an A-era ask may already have been answered, run the exact non-consuming recovery check printed by the runtime first; after its answer is printed and acknowledged, a new invocation with the same question creates a new question. Never guess among multiple identical question threads.\n\nWhen a compatibility or recovery command returns structured next-step arguments, run those exact arguments with the same CLI executable. The arguments intentionally omit the executable name so the guidance works with `orca`, `orca-ide`, `orca-dev`, or another configured Orca CLI command. Do not translate the command from memory, broaden its recipient, or retry it as a current mutation unless the returned guidance explicitly says to.\n\nOn packaged Windows, a legacy ask uses a two-step commit/resume protocol. The initial command durably commits the question, prints its exact `ask --resume <message_id>` command, and exits with launcher status `75`; it does not wait for the answer. Run that exact resume command after the launcher or update boundary. Resume is idempotent and read-oriented: it waits for the already-committed question and does not create another one. For a WSL process that received compatibility proof at launch, use the printed executable `orca-ide` WSL resume command so the same distro and packaged launcher authority are preserved; do not substitute a PATH-resolved local CLI. Older WSL processes that never received the hidden launch token remain lifecycle read-only after the update, even while their terminal and filesystem work continue.\n\nLegacy inspection remains available without consuming mail:\n\n```bash\norca orchestration run-list --json\n# run_legacy_local is an empty audit tombstone after adoption.\norca orchestration run-show --id run_legacy_local --json\n# In run-list, find the ordinary Run whose objective is:\n# \"Recovered orchestration work from a contract update\"\norca orchestration run-show --id <adopted_run_id> --json\norca orchestration task-list --run <adopted_run_id> --json\norca orchestration inbox --full --json\norca orchestration check --terminal <legacy_handle> --peek --format --json\norca terminal read --terminal <legacy_handle> --json\norca terminal wait --terminal <legacy_handle> --for tui-idle --timeout-ms 60000 --json\n```\n\nIf the original coordinator is unavailable or cannot prove its retained authority, a current coordinator may explicitly take over the adopted Run from its own live agent terminal:\n\n```bash\norca orchestration run-use --id <adopted_run_id> --takeover-legacy --json\norca orchestration check --run <adopted_run_id> --json\n```\n\nTakeover fences only the old coordinator, binds the current one, and moves pending worker mail into current Run Delivery. It is bound to the authenticated invoking terminal; `--from` cannot name another coordinator. Live legacy workers keep their original Tasks, Dispatches, processes, filesystems, and old prompt commands; their later questions, escalations, and completion reports route to the current coordinator. Do not use takeover while the original coordinator is still actively coordinating, because its later lifecycle mutations are rejected.\n\nDo not launch a replacement editor merely because the desktop app or runtime was updated. If adoption cannot prove continuing authority, keep the original worker as the only editor until it reaches a stable handoff point, then use a new current Dispatch in a conflict-free placement for any remaining work.\n\n## Ownership\n\nNew orchestration messages and tasks belong to one explicitly bound Run. A Run is only a durable namespace and coordinator inbox; it never schedules or places workers. Lifecycle authority comes from the active Dispatch, and terminal handles remain routing metadata rather than durable identity. Send `worker_done` and `heartbeat` from the worker's own terminal; Orca routes them to that Dispatch's Run.\n\nClassify inherited context before sending lifecycle messages:\n\n- Coordinated subtask: a live coordinator owns the DAG and waits on this dispatch. Follow the preamble exactly, including `worker_done`, heartbeat/status, `ask`, and `escalation`.\n- Full handoff means ownership transfer, not supervised dispatch. The original actor is not monitoring a DAG, so do not create lifecycle obligations unless the user explicitly asks you to supervise.\n- Classify requests containing \"hand off\", \"handoff\", \"handover\", \"give this to another agent\", \"give this to another worktree\", \"another agent\", or \"another worktree\" as full handoffs by default, even when the user names a custom model or reasoning effort.\n- Use supervised orchestration only when the user explicitly asks you to \"supervise\", \"monitor\", \"wait\", \"track completion\", \"wait for worker_done\", return results, coordinate a DAG, use a decision gate, or manage ask/reply flow.\n- Do not use `orca orchestration dispatch --inject` for full handoffs. It injects a coordinator preamble that tells the worker to send `worker_done`, heartbeat, and `ask` messages, then end its turn under the original terminal's dispatch lifecycle.\n- Do not run `orca orchestration task-create`, `orca orchestration dispatch --inject`, or `orca orchestration check --wait` for full handoffs. Do not peek at terminal output after prompt delivery to monitor progress.\n- A review-only `worker_done` reports findings; it does not authorize coordinator file edits. After a review-only completion, synthesize findings, ask a decision gate if ownership is unclear, and dispatch or hand off fixes unless the user explicitly asked the coordinator to own fixes.\n- If the user's plan names a next owner agent (for example, \"then use opencode to create a PR\"), post-review corrections and PR prep belong to that named owner. The coordinator routes, synthesizes, asks decision gates when needed, and supervises; the named owner edits files and creates the PR.\n\nIf unclear, inspect orchestration state before sending lifecycle messages:\n\n```bash\norca orchestration task-list --json\norca terminal list --json\n# If inherited context includes a task id:\norca orchestration dispatch-show --task <task_id> --json\n```\n\n## Messaging\n\n```bash\norca orchestration send --subject <text> [--to <run:id|dispatch:id|legacy_handle>] [--from <handle>] [--body <text>] [--type <type>] [--priority <level>] [--thread-id <id>] [--payload <json>] [--json]\norca orchestration check [--terminal <handle>] [--ack <delivery_id>] [--peek|--all] [--types <type,...>] [--format] [--wait] [--timeout-ms <n>] [--json]\norca orchestration reply --id <msg_id> --body <text> [--from <handle>] [--json]\norca orchestration ask (--question <text>|--resume <msg_id>) [--options <csv>] [--timeout-ms <n>] [--from <handle>] [--json]\norca orchestration inbox [--limit <n>] [--json]\n```\n\nRules:\n\n- Omit `--from` unless impersonating another terminal; Orca auto-resolves it from the current terminal.\n- A coordinator `check` returns the bound Run's oldest FIFO Delivery (up to 50 messages) and replays that exact batch until `--ack <delivery_id>`. Process every message before acknowledging; `check --ack <id> --wait` acknowledges, checks, and waits in one operation.\n- Use `--peek` and `--all` only for read-only history/debugging. Type filters decide when a waiter wakes; the returned actionable Delivery is still the oldest full batch.\n- Use `dispatch:<id>` for coordinator guidance to one supervised worker. Orca routes that stable address locally or through the connected-server relay; do not substitute a remote terminal handle.\n- Terminal handles remain appropriate for low-level pre-Dispatch messaging. Prefer `agentTerminalHandle` from the create response, fall back to `startupTerminal.handle` for older runtimes, then re-resolve with `orca terminal list --worktree ... --json` if missing or stale. Continue with the replacement handle only; never dual-send to old and new handles.\n- `terminal list --json` omits `visualLayouts` because handle recovery does not need topology. Add `--include-visual-layouts` only for explicit tab and pane inspection.\n- `orca orchestration check --peek --format --json` returns locally formatted unread mail without consuming it; it never writes to terminal input or remotely wakes another terminal. Use `orchestration dispatch --inject` to deliver a tracked task, or `terminal send` when an existing agent needs a free-form prompt.\n- While supervising workers manually, use `check --wait --types worker_done,escalation,question --timeout-ms <n>` instead of sleep/poll loops. Process the whole Delivery, reply to `question` messages with `orca orchestration reply --id <msg_id> --body <answer> --json`, then acknowledge and keep waiting.\n- `check --json` prints exactly one JSON document on stdout. While `--wait` blocks it also prints keepalive lines (`{\"_keepalive\":true,...}`) to stderr so you can tell the process is alive; those are never on stdout. Do not merge the streams before a parser — `check --wait --json 2>&1 | <parser>` fails with \"Extra data: line 2\". Pipe stdout only.\n- Treat a `check --wait` timeout or `{count:0}` as a checkpoint, not a worker failure. Long coding tasks routinely run 15-60 minutes; keep using rolling waits unless you receive `worker_done`/`escalation`, the terminal exits or disappears, or the user explicitly asks you to stop.\n- Heartbeats and visible terminal activity mean the worker is alive, not done. Do not stop, close, kill, or restart a worker just because it has not produced a completion message yet.\n- Use `ask` when a worker needs a blocking answer from the coordinator; it defaults to the active Dispatch's Run. Timeout or disconnect leaves the question pending, so resume by its original message ID instead of asking again.\n- `check --wait` returns one bounded Delivery, not every future completion. Process every message, acknowledge it, then keep waiting until every expected Dispatch settles.\n- Group addresses include `@all`, `@idle`, `@claude`, `@codex`, `@opencode`, `@gemini`, `@droid`, `@grok`, `@cursor`, and `@worktree:<id>`.\n- Message types include `status`, `dispatch`, `worker_done`, `merge_ready`, `escalation`, `handoff`, `question`, `decision_gate` (legacy/gates), and `heartbeat`.\n- Use group addresses only for messages that are genuinely useful to many terminals, such as `status` broadcasts or intentional fan-out questions. Do not send dispatch lifecycle messages to groups.\n- `worker_done` belongs to the active Dispatch and defaults to its Run mailbox; never target a group.\n- A valid `worker_done` for the active `taskId` + `dispatchId` marks the task and dispatch completed automatically. Do not follow it with `task-update --status completed`; reserve manual updates for explicit recovery or overrides.\n- `heartbeat` is also Dispatch-scoped. Include both IDs and omit `--to` so Orca uses the owning Run; use `status` for broad progress updates.\n\n## Tasks And Dispatch\n\nA Run is the namespace/inbox, a Task is the work item, and a Dispatch assigns one Task attempt to a terminal. Create or bind a Run once before the common loop.\n\n```bash\norca orchestration run-create --objective <text> --json\norca orchestration task-create --spec <text> [--deps <json_array>] [--parent <task_id>] [--json]\norca orchestration task-list [--status <status>] [--ready] [--brief] [--json]\norca orchestration task-update --id <task_id> --status <status> [--result <json>] [--json]\norca orchestration dispatch --task <task_id> --to <handle> [--from <handle>] [--inject] [--json]\norca orchestration dispatch-show --task <task_id> [--json]\n```\n\nTask statuses: `pending`, `ready`, `dispatched`, `completed`, `failed`, `blocked`.\n\nDispatch rules:\n\n- `--inject` sends the task spec plus preamble into a recognized agent CLI so it can report `worker_done`.\n- If the target is a bare shell, omit `--inject`, dispatch for tracking if needed, then send the prompt manually with `orca terminal send --terminal <handle> --text <prompt> --enter --json`.\n- After 3 consecutive failures on one task, the dispatch context circuit-breaks and the task is marked failed.\n- Use `task-list --brief --json` for coordinator sweeps; it collapses whitespace and caps each echoed spec at 160 characters (`spec_truncated` marks shortened rows). Omit `--brief` when the full spec is required, or when an older CLI rejects it as an unknown flag.\n\n`dispatch` and `worker-start` refuse the following preflight cases with a stable `error.code`; read it before choosing a recovery, and treat `error.data.nextSteps` as the exact recovery text. Older hosts may omit `data`, so treat every field as optional.\n\n| Code                 | Meaning                                                                                                               | Recovery                                                                                                                       |\n| -------------------- | --------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------ |\n| `task_not_found`     | No Task with that id, or not in the bound Run (`data.taskId`, `data.runId`)                                           | Check `task-list --json`; create the Task with `task-create` if it does not exist                                              |\n| `task_not_startable` | Task cannot start now: not `ready`, or invalid `--retry-of` (`data.status`, `data.unmetDependencies`, `data.retryOf`) | Wait for running dependencies with `check --wait`; retry or unblock failed ones; inspect `dispatch-show` if already dispatched |\n| `inject_rejected`    | `--inject` refused because no recognized agent runs in the target (`data.terminal`, `data.reason`)                    | Start a recognized agent there or pick another terminal; or dispatch without `--inject` and use `terminal send`                |\n| `runtime_error`      | Any other failure, including a target terminal that already owns an active Dispatch                                   | Read the message, inspect state, and do not retry unchanged                                                                    |\n\n## How deep workers can nest\n\nA dispatched worker normally cannot dispatch sub-workers. Attempting it fails with\n`nested_worker_depth_exceeded` and a message telling the worker to complete the task\nitself. Do that — do not try to route around it.\n\nThe limit is a number, not an on/off switch. `Settings -> Orchestration -> Nested worker depth`\nsets how many generations are allowed:\n\n- `1` (default): a coordinator dispatches workers; those workers do not dispatch.\n- `2`: workers may dispatch one further generation.\n\nDepth is counted from the terminal that issues the command, not from the Run. Creating a\nnew Run does not reset it — a worker that runs `run-create` then `worker-start` is still a\nworker, and still counted. This is the part that changed: the old behaviour rejected\nsub-dispatch only because a worker's terminal was not bound to a Run, so creating a Run was\nenough to slip past it.\n\nTwo limits worth knowing:\n\n- **It is a guardrail, not a security boundary.** A caller that declares another terminal's\n  handle while its own launch evidence is unverifiable (an ordinary restored terminal, for\n  example) can be counted as that terminal instead. Orca does not treat workers as hostile.\n- **It applies while a Dispatch is active.** After `worker_done`, or after a coordinator\n  settles the task, the terminal is no longer a worker and is counted as a root again. The\n  process may still be alive; that is the documented boundary, not an accident.\n\n## Preferred Supervised Worker Loop\n\nUse `worker-start` for the normal supervised path. It composes the existing worktree, terminal, readiness, and dispatch primitives while returning exact created/reused effects. Agents still choose placement and concurrency; Orca does not schedule workers or infer conflicts.\n\nCreate the Run and every independent Task first, then start all independent workers before waiting:\n\n```bash\norca orchestration run-create --objective \"<objective>\" --json\norca orchestration task-create --spec \"<worker A task>\" --json\norca orchestration task-create --spec \"<worker B task>\" --json\norca orchestration worker-start --task <task_a> --worktree current --agent codex --json\norca orchestration worker-start --task <task_b> --worktree current --agent claude --json\n```\n\n`current` and exact existing worktrees create a fresh agent terminal and do not rerun setup. Reuse an existing agent only with `--terminal <handle>`.\n\nFor a per-invocation Claude, Codex, or Cursor launch, pass an opaque provider model id with `--model`; add `--effort` only when that agent/model supports the level. These options apply only to fresh agent terminals, override general agent default arguments, and are reported under `launch.requested` and `launch.effective` in the receipt:\n\n```bash\norca orchestration worker-start --task <task_id> --worktree current --agent claude --model opus --effort high --json\n```\n\n`--effort` requires `--model`, and neither option can combine with `--terminal`. A connected worker server must advertise launch-preference support before Orca forwards either option.\n\nFor a new worktree, setup runs by default and agent-first creation reuses the returned startup agent terminal:\n\n```bash\norca orchestration worker-start --task <task_id> --worktree new-child --name <name> --agent codex --setup run --json\n# Independent/top-level:\norca orchestration worker-start --task <task_id> --worktree new-top-level --name <name> --agent codex --setup run --json\n```\n\nSetup normally starts alongside the agent. Only a repository explicitly configured with `wait-for-setup` delays agent launch until setup succeeds. Use `--setup skip` or `--setup inherit` only for a concrete reason.\n\nRead the returned receipt before continuing: `ready` plus setup `running` is normal for start-immediately, while wait-for-setup returns setup `succeeded` before accepting task input. A failed or unknown start exits nonzero; inspect its `stage`, `effects`, and `residualResources` instead of guessing or automatically retrying. A wait-for-setup timeout can honestly leave setup `running`, which is not proof of failure.\n\nTo run the worker on another connected Orca server, add `--on <saved-environment>`. The Run and Tasks remain authoritative on the current server; later commands route by Dispatch ID, so never repeat `--on`:\n\n```bash\n# Mac Run home -> Windows worker (the reverse is identical from a Windows Run home)\norca orchestration worker-start --task <task_id> --on windows --worktree new-top-level --repo <exact_remote_repo_selector> --name <name> --agent codex --setup run --json\norca orchestration worker-show --dispatch <dispatch_id> --json\norca orchestration worker-read --dispatch <dispatch_id> --limit 50 --json\norca orchestration send --to dispatch:<dispatch_id> --subject \"Follow-up\" --body \"<attempt-specific guidance>\" --json\n```\n\nRemote `current` and `new-child` are intentionally invalid because those words are ambiguous across servers. Use an exact discovered remote worktree selector or `new-top-level` with an explicit remote repo selector.\n\nThe follow-up is structured inbox mail, not prompt injection. The worker's next\n`orchestration check` receives it even when the Dispatch is on another connected Orca server.\n\n`worker-read` defaults to `--source auto`: Orca returns the exact hook-reported Codex, Claude, OpenClaude, or Grok transcript when it can prove the worker session, otherwise it returns bounded terminal output with `source: \"terminal\"` and a typed `fallbackReason`. Continue with the returned top-level `cursor`; it stays pinned to that exact source. If Orca reports `source_changed`, start a fresh read without the old cursor. Never supply or guess a provider session ID or transcript path.\n\nWait until every expected Dispatch settles, not for a fixed number of batches:\n\n```bash\norca orchestration check --wait --types worker_done,escalation,question --timeout-ms 900000 --json\n# Process every message. For each accepted worker_done that is not immediately reused:\norca orchestration worker-release --dispatch <dispatch_id> --json\n# Acknowledge only after every message and required release decision is handled:\norca orchestration check --ack <delivery_id> --wait --types worker_done,escalation,question --timeout-ms 900000 --json\n```\n\nAfter processing each accepted `worker_done`, choose the terminal's next owner before you acknowledge the Delivery or wait again. If the same exact agent has an immediate follow-up Task, read the `worker.agent_terminal_handle` field of `worker-show --dispatch <dispatch_id> --json`, then run `orca orchestration worker-start --task <next_task_id> --terminal <handle> --json` so Orca transfers cleanup ownership to the new Dispatch. Otherwise run `orca orchestration worker-release --dispatch <dispatch_id> --json`.\n\nRun `worker-release` after both succeeded and failed `worker_done` reports unless the user explicitly asked to keep that worker live. Release is post-completion cleanup, not cancellation: Orca first preserves inspectable output, then closes only the exact agent terminal owned by that settled Dispatch. Reused or pre-existing terminals, setup terminals, coordinators, active workers, user-taken-over terminals, and identities Orca cannot prove are retained. If the user explicitly asks to keep the live terminal for debugging, record that exception with `orca orchestration worker-retain --dispatch <dispatch_id> --json` instead of silently skipping cleanup. When the user is finished, the same Dispatch can be passed to `worker-release`, which clears the requested retention and releases the terminal.\n\nDo not release a worker because of a timeout, TUI idle state, heartbeat, status, question, escalation, or rejected/stale `worker_done`. If release returns `release_pending` or `release_unknown`, do not substitute `terminal close`; follow the exact recovery action in the receipt. A replayed Delivery may repeat `worker-release` safely.\n\nWorkers report exactly once using the IDs and capability injected by Orca; they do not supply Run/server/terminal identity:\n\n```bash\norca orchestration send --type worker_done --subject \"<status>\" --body \"<what changed, findings, and what remains>\" --task-id <task_id> --dispatch-id <dispatch_id> --outcome succeeded --files-modified \"path/a,path/b\" --json\n# On failure, use --outcome failed; never encode failure only in prose.\n```\n\nA worker question defaults to its owning Run. Timeout leaves it pending:\n\n```bash\norca orchestration ask --question \"<question>\" --options \"yes,no\" --timeout-ms 600000 --json\norca orchestration ask --resume <message_id> --timeout-ms 600000 --json\n# Coordinator:\norca orchestration reply --id <message_id> --body \"<answer>\" --json\n```\n\nRecovery is conditional, never a fixed destructive sequence:\n\n- The response was lost and named no Dispatch: run `orca orchestration request-show --request <request_id> --json` first. It is read-only. `completed` means the mutation already took effect. `pending` means the original mutation is still running or Orca restarted before recording its outcome. For either state, replaying the original command with `--retry-request <request_id>` reuses the same operation identity so Orca can replay, join, or safely recover it without starting a separate duplicate. `absent` means this runtime holds no receipt under your caller identity and is not proof that nothing happened; inspect the affected state before deciding whether to retry.\n- `worker-show --dispatch <id>` says `ready`: keep waiting or read bounded output.\n- It proves `failed` or `stopped`: start a replacement with `worker-start --task <task> --retry-of <id>` plus an explicit `--on`/`--worktree` and `--agent`/`--terminal` choice. Retry does not silently inherit placement.\n- It remains `outcome_unknown`: either `worker-stop --dispatch <id>` and inspect again, or explicitly `worker-abandon --dispatch <id>` while accepting that resources may still be live. Abandon performs no remote, process, or filesystem action.\n- `worker-stop` closes only the exact supervised agent terminal. It never deletes the worktree, setup terminal, configured tabs, or unrelated processes.\n\nLow-level `worktree create`, `terminal create`, and `dispatch --inject` remain valid recipes for custom argv or topology that `worker-start` does not express.\n\n`dispatch --inject` deliberately keeps an operator-started terminal unsupervised: it never creates a `worker_dispatches` row and `worker-stop`/`worker-abandon` never close that process. The dispatch context is still authoritative, so `worker-show`, `worker-read`, and `worker-list` report it as `unsupervised`; settled `worker-retain` and `worker-release` report `retained` with `no_owned_resource` and take no process action. Use `worker-start --terminal <handle>` when supervision and worker lifecycle state are required.\n\n## Gates And Legacy Inspection\n\n```bash\norca orchestration gate-create --task <task_id> --question <text> [--options <json_array>] [--json]\norca orchestration gate-resolve --id <gate_id> --resolution <text> [--json]\norca orchestration gate-list [--task <task_id>] [--status <status>] [--json]\n```\n\nUse `ask` for worker-to-coordinator questions; it creates a `question` message that the coordinator answers with `reply`. Use `gate-create` only for coordinator-managed task DAG decisions, not for answering a worker's `ask`.\n\n`coordinator-start`, `coordinator-stop`, `run`, and `run-stop` are retired scheduler commands. They perform no effects and return the current-skill recovery action. They are not aliases for lightweight Run creation or binding.\n\nRecovery only: `orca orchestration reset --tasks|--messages|--all --json` clears the selected local orchestration database state. Do not run it during active coordination unless explicitly abandoning that state.\n\n## Full Handoffs\n\nFor full ownership transfer, use non-lifecycle terminal/worktree commands and then stop monitoring unless the user asks for supervision.\n\nTreat these as full handoff requests by default: \"hand off\", \"handoff\", \"handover\", \"give this to another agent\", \"give this to another worktree\", \"send this to another agent\", \"another agent\", \"another worktree\", or \"launch another agent to own this.\" Custom model or reasoning effort words such as `gpt-5.5`, `high`, or `xhigh` do not make the handoff supervised.\n\nSupervised orchestration remains available only when the user explicitly asks for supervision or coordination: \"supervise\", \"monitor\", \"wait for worker_done\", \"wait for results\", \"track completion\", \"DAG\", \"decision gate\", \"ask/reply\", or \"coordinate workers.\"\n\nDo not run `orca orchestration task-create`, `orca orchestration dispatch --inject`, or `orca orchestration check --wait` for full handoffs. `task-create` is also forbidden because it records coordinator-owned tracking state; if a task row is needed, the user asked for supervised orchestration. Do not create a `taskId`/`dispatchId`, inject a lifecycle preamble, wait for completion, or read the worker terminal after prompt delivery except to avoid losing the initial prompt.\n\nNew top-level worktree handoff:\n\n```bash\norca worktree create --name <task-name> --no-parent --agent codex --prompt \"<task brief>\" --setup run --json\n```\n\nBefore creating a new worktree from an active feature branch, decide and state whether the desired Orca lineage is child or top-level. Use child worktree lineage only when the new work is conceptually stacked under or dependent on the active worktree. For independent repo-wide fixes, standalone feature work, or unrelated follow-up tasks, create a top-level worktree with `--no-parent`.\n\nExisting terminal handoff:\n\n```bash\norca terminal send --terminal <handle> --text \"<task brief>\" --enter --json\n```\n\nCustom Codex model/effort handoff:\n\n`orca worktree create --agent codex --prompt ...` launches the known Codex agent but does not accept Codex-specific `--model` or `-c model_reasoning_effort=...` arguments. When the user asks for a specific Codex model or effort, create the independent worktree first, launch Codex with the requested command in that worktree, wait only for TUI readiness if prompt delivery would otherwise race startup, send the prompt, and stop.\n\nThe two-step custom-argv path cannot enforce a repository's explicit `wait-for-setup` startup policy because the later `terminal create` is not the startup owned by `worktree create`. Use it only when the repository starts agents immediately. If the repository requires `wait-for-setup`, use an agent-first configured launcher that can preserve sequencing, or stop and ask rather than silently bypassing the policy.\n\nNote: when no repo default-terminal configuration supplies a primary terminal, bare create opens a fallback shell before `terminal create` adds the agent. Configured default tabs are materialized instead and may run real commands. Prefer `--agent` whenever custom argv is not required. With the two-step path, target only the agent handle; close a prior terminal only after `terminal list` or `terminal show` confirms it is an unused shell.\n\nUse the exact full `<repo-id>::<path>` worktree id returned by `orca worktree create --json`; a bare repo id cannot target the new worktree.\n\n```bash\norca worktree create --name <task-name> --no-parent --setup run --json\norca terminal create --worktree id:<newFullWorktreeId> --title <task-name> --command 'codex --model gpt-5.5 -c model_reasoning_effort=\"xhigh\"' --json\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms 60000 --json\norca terminal send --terminal <handle> --text \"<task brief>\" --enter --json\n```\n\nWait only for `tui-idle` when needed to avoid losing the prompt. Do not monitor task completion.\n\n`--no-parent` only controls Orca lineage; it does not choose the Git base. If the work should start from the repo default base, omit `--base-branch` so Orca uses that default, or explicitly pass the repo default base (`origin/main`, `origin/master`, or the `orca repo show --repo <selector> --json` value); never base it on the current feature branch unless the user explicitly asks for stacked work or \"branch from current\". Put current-branch context in the prompt instead.\n\n## Worker Terminals\n\nChoose the worker location before creating a terminal. `Fresh worker` means a fresh agent session, not a new git worktree. For parallel work, create one fresh agent terminal per worker in the same required worktree, falling back to the active worktree when none is named. If the task says current worktree only, depends on uncommitted files/artifacts, or must validate/PR the current branch, keep every worker in the active worktree:\n\n```bash\norca terminal create --worktree active --title <task-name> --command \"codex\" --json\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms 60000 --json\norca orchestration dispatch --task <task_id> --to <handle> --inject --json\n```\n\nReuse an idle agent in the required worktree only if the prompt allows reuse; otherwise create a fresh terminal there. Create a new worktree only when the user explicitly requests one or a concrete checkout or filesystem conflict makes sharing unsafe or impossible; if the user did not request it, state that conflict before running `worktree create`. Independent tasks, parallel execution, convenience, or a preference for separate checkouts are not isolation requirements.\n\nWhen a new worktree is allowed, use child lineage for isolated work that is stacked under or dependent on the active worktree, and use `--no-parent` when it is not stacked. Decide the Git base separately: `--no-parent` makes the worktree top-level in Orca, while omitted `--base-branch` uses the repo default base.\n\nFor every new worktree, pass `--setup run` so any configured repository setup hook runs. This does not mean waiting for setup before agent launch: preserve the repository's startup policy, whose default starts setup and the agent side by side. Use `--setup skip` or `--setup inherit` only when there is a concrete task-specific reason, and state that reason before creating the worktree. This rule does not rerun setup for current or existing worktrees.\n\n```bash\norca worktree create --name <task-name> --agent codex --setup run --json\n# or: --agent claude | omp | pi | grok | ...\n# Read <handle> from agentTerminalHandle, falling back to startupTerminal.handle.\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms 60000 --json\norca orchestration dispatch --task <task_id> --to <handle> --inject --json\n```\n\nFor new-worktree workers, read the id and `agentTerminalHandle` from `worktree create`, falling back to `startupTerminal.handle` for older runtimes. Use that as the sole worker handle when present; otherwise use `terminal list` to resolve the agent handle. Omit `--repo` only inside an Orca-managed worktree; otherwise pass `--repo <selector>`.\n\n**For an allowed new worktree, use agent-first:** `--agent` reveals the new worktree and launches the selected agent **in its first terminal**, without adding a separate fallback shell for that worker. Pass `--setup run`; repo setup and default-terminal settings may add intentional tabs or splits. Do **not** run bare `worktree create` and then `terminal create --command <agent>` for the same worker when agent-first create is available: without configured default tabs, that two-step path leaves a fallback shell + agent pair. Only use it when custom agent argv is required (for example Codex model/effort flags) or when an older CLI rejects `--agent`; if you must, message only the agent handle. Configured default tabs are intentional surfaces, so close a prior terminal only after `terminal list` or `terminal show` confirms it is an unused shell. Do not run `worktree create` when the task must stay in the current worktree.\n\nUse `orca worktree create --prompt ...` or `orca terminal send ...` for full handoffs or untracked/lightweight prompts. Those paths do not attach `taskId`/`dispatchId`; the worker should not send lifecycle messages unless the prompt supplies a live orchestration preamble.\n\nSidebar lineage and orchestration lifecycle are related but not identical. A same-worktree worker may appear as a peer under that worktree in the sidebar while remaining a child dispatch in orchestration state; only an actual child worktree creates visible parent/child worktree lineage.\n\nOther terminal commands coordinators often need:\n\n```bash\norca terminal list [--worktree <selector>] [--include-visual-layouts] [--json]\norca terminal create [--worktree <selector>] [--title <text>] [--command <cmd>] [--json]\norca terminal split --terminal <handle> [--direction horizontal|vertical] [--command <cmd>] [--json]\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms <n> --json\norca terminal read --terminal <handle> --json\norca terminal send --terminal <handle> --text <text> --enter --json\n```\n\nIf an older CLI rejects `worktree create --agent`, create the worktree normally, then run `orca terminal create --worktree <selector> --command \"codex\" --json` or `--command \"claude\"`.\n\nWait for `tui-idle` before dispatching. Always pass `--timeout-ms`; real coding tasks can take 15-60 minutes. During supervision, use rolling `check --wait` windows. If a window returns no matching message, inspect `task-list`, `terminal read`, or `terminal wait --for tui-idle` as a liveness checkpoint; if the terminal is still working or producing activity, keep waiting instead of retrying the task.\n\n## Agent Guidance\n\n- Workers with a valid live preamble must send `worker_done` exactly once from their own terminal with an explicit `--outcome succeeded` or `--outcome failed`:\n  `orca orchestration send --type worker_done --subject \"<short status>\" --body \"<3-sentence summary: what you did, what you found, what's left>\" --task-id <task_id> --dispatch-id <dispatch_id> --outcome succeeded --files-modified \"path/a\" --report-path \"<optional>\" --json`\n- A failed outcome is still a terminal report, but Orca records both the Dispatch and Task as failed. Never encode failure only in the subject/body.\n- After sending `worker_done`, end that dispatched turn and idle at the agent prompt. Do not autonomously start more work, poll, or attempt to close the terminal yourself. A direct user instruction takes precedence and starts ordinary user-owned work: follow it without coordinator approval or a fresh Dispatch, never refuse it because of worker/coordinator roles, and do not reuse the settled Dispatch's lifecycle IDs. A coordinator-supervised follow-up still arrives with a fresh preamble + TASK block.\n- For long tasks, send heartbeat/status only when the preamble asks for it, including both IDs:\n  `orca orchestration send --type heartbeat --subject \"alive\" --payload '{\"taskId\":\"<task_id>\",\"dispatchId\":\"<dispatch_id>\",\"phase\":\"implementing\"}' --json`\n- If blocked before completion, use `ask`; use `escalation` only when ownership is valid and the coordinator must intervene.\n- Treat preambles inherited through terminal history or full handoffs as stale unless the current prompt explicitly keeps that coordinator in the loop.\n- Coordinators must account for every settled worker terminal before waiting again or ending the turn: immediately reuse the exact worker for a new Dispatch, explicitly retain it at the user's request with `worker-retain`, or run `worker-release`. Do not leave a completed worker live merely to inspect output; released workers remain readable through `worker-read`.\n- Coordinators should use `task-list --ready` as external memory, dispatch parallel waves, and avoid dependency chains deeper than 3-4 steps.\n\n## Example\n\n```bash\norca terminal create --worktree active --title login-css-worker --command \"claude\" --json\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms 60000 --json\norca orchestration task-create --spec \"Fix the login button CSS\" --json\norca orchestration dispatch --task <task_id> --to <handle> --inject --json\norca orchestration check --wait --types worker_done,escalation,question --timeout-ms 900000 --json\n```\n\n## Next Action\n\nCoordinator: confirm `orca status --json`, create or bind a Run, inspect `task-list`/`dispatch-show` if inheriting state, then use the explicit supervised loop (`task-create` -> `worker-start` -> `check --wait`). Use low-level terminal creation plus `dispatch --inject` only when the composed start does not express the needed topology. After every accepted `worker_done`, either transfer the exact terminal to an immediate follow-up Dispatch or run `worker-release` before the next wait.\n\nWorker: if the current prompt contains a live dispatch preamble, do the task, use `ask` for blocking questions, and send `worker_done` once with the required payload. If the preamble is stale or absent, do not send lifecycle messages; inspect state or treat the prompt as an ordinary handoff.\n"
 
 // Why: no current guide has bundled reference documents, so --full is byte-identical for now.
 // oxfmt-ignore
@@ -86,7 +86,7 @@ export const BUNDLED_SKILL_GUIDES = [
   },
   {
     name: "orchestration",
-    description: "Use Orca orchestration for structured multi-agent coordination: threaded messages, blocking ask/reply flows, task dispatch, worker_done/escalation waits, task DAGs, decision gates, coordinator loops, or decomposing work across agents. Use `orca-cli` instead for full ownership handoffs, including requests phrased as \"hand off\", \"handoff\", \"handover\", \"give this to another agent\", or \"another worktree\" when the user did not explicitly ask to supervise, monitor, wait for results, or coordinate a DAG. Use `orca-cli` for terminal control, lightweight terminal prompts, shell commands, Orca worktree management, reading or waiting on terminals, and automation of the browser embedded inside Orca. Use Computer Use for external browser windows, webviews, Orca app UI, or desktop UI outside Orca's embedded browser only when the task requires OS/window-level control such as focus, menus, dialogs, coordinates, or screenshots. Use `orca-cli` for Orca's embedded pages and a page-automation tool such as Playwright or CDP for external pages.",
+    description: "Use Orca orchestration for structured multi-agent coordination: threaded messages, blocking ask/reply flows, task dispatch, worker_done/escalation waits, task DAGs, decision gates, or coordinator loops. Use `orca-cli` instead for full ownership handoffs, including requests phrased as \"hand off\", \"handoff\", \"handover\", \"give this to another agent\", or \"another worktree\" when the user did not explicitly ask to supervise, monitor, wait for results, or coordinate a DAG. Use `orca-cli` for terminal control, lightweight terminal prompts, shell commands, Orca worktree management, reading or waiting on terminals, and the Orca embedded browser. Use Computer Use for external browser windows, webviews, Orca app UI, or desktop UI outside Orca's embedded browser only when the task requires OS/window-level control such as focus, menus, dialogs, coordinates, or screenshots. Use `orca-cli` for Orca's embedded pages and a page-automation tool such as Playwright or CDP for external pages.",
     markdown: ORCHESTRATION_MARKDOWN,
     fullMarkdown: ORCHESTRATION_MARKDOWN,
     aliases: []
diff --git a/src/cli/cli-error.ts b/src/cli/cli-error.ts
new file mode 100644
index 00000000000..6a87f149079
--- /dev/null
+++ b/src/cli/cli-error.ts
@@ -0,0 +1,144 @@
+import { computerUseErrorRecoveryData } from '../shared/computer-use-error-recovery'
+import {
+  matchAutomationOwnerConflict,
+  stripAutomationOwnerConflictCode
+} from '../shared/automation-owner-conflict'
+import { automationOwnerConflictRecovery } from './automation-owner-conflict-recovery'
+import type { RuntimeRpcFailure } from './runtime-client'
+import { RuntimeClientError, RuntimeRpcFailureError } from './runtime/types'
+
+type CliErrorContext = {
+  commandPath?: readonly string[]
+}
+
+export function formatCliError(error: unknown, context: CliErrorContext = {}): string {
+  const message = error instanceof Error ? error.message : String(error)
+  if (error instanceof RuntimeClientError && error.code === 'runtime_unavailable') {
+    if (hasOrchestrationRequestId(error.data)) {
+      return message
+    }
+    return `${message}\nOrca is not running. Run 'orca open' first.`
+  }
+  // Why: error-specific recovery must win over the generic computer fallback.
+  // Classified from the whole error, not just `.code`: a hop that flattens the class leaves only the token.
+  const conflict = automationOwnerConflictRecovery(matchAutomationOwnerConflict(error))
+  if (conflict) {
+    return formatMessageWithNextSteps(stripAutomationOwnerConflictCode(message), conflict.nextSteps)
+  }
+  if (error instanceof RuntimeClientError) {
+    const nextSteps = nextStepsFromData(error.data)
+    if (nextSteps.length > 0) {
+      return formatMessageWithNextSteps(message, nextSteps)
+    }
+    if (error.code === 'invalid_argument' && context.commandPath?.[0] === 'computer') {
+      return formatMessageWithNextSteps(
+        message,
+        computerUseErrorRecoveryData('invalid_argument')?.nextSteps ?? []
+      )
+    }
+  }
+  if (
+    error instanceof RuntimeRpcFailureError &&
+    error.response.error.code === 'runtime_unavailable'
+  ) {
+    return `${message}\nOrca is not running. Run 'orca open' first.`
+  }
+  if (error instanceof RuntimeRpcFailureError) {
+    return formatMessageWithNextSteps(message, nextStepsFromData(error.response.error.data))
+  }
+  return message
+}
+
+function hasOrchestrationRequestId(data: unknown): boolean {
+  return (
+    data !== null &&
+    typeof data === 'object' &&
+    typeof (data as { orchestrationRequestId?: unknown }).orchestrationRequestId === 'string'
+  )
+}
+
+export function reportCliError(error: unknown, json: boolean, context: CliErrorContext = {}): void {
+  if (json) {
+    if (error instanceof RuntimeRpcFailureError) {
+      console.log(JSON.stringify(withAutomationOwnerConflictRecovery(error.response), null, 2))
+    } else {
+      const response: RuntimeRpcFailure = {
+        id: 'local',
+        ok: false,
+        error: {
+          code:
+            matchAutomationOwnerConflict(error) ??
+            (error instanceof RuntimeClientError ? error.code : 'runtime_error'),
+          message: stripAutomationOwnerConflictCode(
+            error instanceof Error ? error.message : String(error)
+          ),
+          data: localCliErrorData(error, context)
+        },
+        _meta: {
+          runtimeId: null
+        }
+      }
+      console.log(JSON.stringify(response, null, 2))
+    }
+  } else {
+    console.error(formatCliError(error, context))
+  }
+}
+
+/** Machine-readable half of the same recovery the human message carries. */
+function withAutomationOwnerConflictRecovery(response: RuntimeRpcFailure): RuntimeRpcFailure {
+  const code = matchAutomationOwnerConflict(response)
+  const conflict = automationOwnerConflictRecovery(code)
+  if (!conflict || !code) {
+    return response
+  }
+  return {
+    ...response,
+    error: {
+      ...response.error,
+      // Restores the classification a flattening hop dropped, so --json consumers read the conflict, not the transport.
+      code,
+      message: stripAutomationOwnerConflictCode(response.error.message),
+      data: response.error.data ?? conflict
+    }
+  }
+}
+
+function formatMessageWithNextSteps(message: string, nextSteps: readonly string[]): string {
+  if (nextSteps.length === 0) {
+    return message
+  }
+  return `${message}\n${nextSteps.map((step) => `Next step: ${step}`).join('\n')}`
+}
+
+function nextStepsFromData(data: unknown): string[] {
+  if (
+    data &&
+    typeof data === 'object' &&
+    Array.isArray((data as { nextSteps?: unknown }).nextSteps)
+  ) {
+    return (data as { nextSteps: unknown[] }).nextSteps.filter(
+      (step): step is string => typeof step === 'string'
+    )
+  }
+  return []
+}
+
+function localCliErrorData(error: unknown, context: CliErrorContext): unknown {
+  // Why: error-specific recovery must win over the generic computer fallback.
+  if (error instanceof RuntimeClientError && error.data !== undefined) {
+    return error.data
+  }
+  const conflict = automationOwnerConflictRecovery(matchAutomationOwnerConflict(error))
+  if (conflict) {
+    return conflict
+  }
+  if (
+    error instanceof RuntimeClientError &&
+    error.code === 'invalid_argument' &&
+    context.commandPath?.[0] === 'computer'
+  ) {
+    return computerUseErrorRecoveryData('invalid_argument')
+  }
+  return undefined
+}
diff --git a/src/cli/command-suggestion-budget.test.ts b/src/cli/command-suggestion-budget.test.ts
new file mode 100644
index 00000000000..7902ad7fdba
--- /dev/null
+++ b/src/cli/command-suggestion-budget.test.ts
@@ -0,0 +1,44 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import * as distance from '../shared/edit-distance'
+import { suggestCommands, unknownFlagData } from './command-suggestion'
+import type { CommandSpec } from './command-spec'
+
+const specs: CommandSpec[] = [
+  { path: ['list'], summary: '', usage: '', allowedFlags: [] },
+  { path: ['remove'], summary: '', usage: '', allowedFlags: [], destructive: true }
+]
+
+afterEach(() => vi.restoreAllMocks())
+
+describe('suggestion distance work', () => {
+  it('does no distance calculations for a long command, including destructive intent', () => {
+    const spy = vi.spyOn(distance, 'levenshtein')
+    expect(suggestCommands(specs, ['x'.repeat(32_768)])).toEqual([])
+    expect(spy).not.toHaveBeenCalled()
+  })
+
+  it('does no distance calculations for a long flag but still lists valid flags', () => {
+    const spy = vi.spyOn(distance, 'levenshtein')
+    expect(unknownFlagData('x'.repeat(32_768), ['worktree', 'json'])).toEqual({
+      validFlags: ['json', 'worktree'],
+      suggestions: [],
+      nextSteps: ['Valid flags: --json, --worktree']
+    })
+    expect(spy).not.toHaveBeenCalled()
+  })
+
+  it('keeps the inclusive three-edit suggestion boundary', () => {
+    expect(suggestCommands(specs, ['listxxx'])).toEqual(['list'])
+    expect(unknownFlagData('jsonxxx', ['json']).suggestions).toEqual(['json'])
+  })
+
+  it('keeps the inclusive one-edit destructive intent boundary', () => {
+    expect(suggestCommands(specs, ['remov'])).toEqual(['remove'])
+    expect(suggestCommands(specs, ['remo'])).toEqual([])
+  })
+
+  it('retains UTF-16 distance semantics at the length boundary', () => {
+    expect(unknownFlagData('json😀x', ['json']).suggestions).toEqual(['json'])
+    expect(unknownFlagData('json😀😀', ['json']).suggestions).toEqual([])
+  })
+})
diff --git a/src/cli/command-suggestion.ts b/src/cli/command-suggestion.ts
index 7b80138e2f3..9c935f694fa 100644
--- a/src/cli/command-suggestion.ts
+++ b/src/cli/command-suggestion.ts
@@ -37,7 +37,10 @@ function destructiveVerbs(specs: CommandSpec[]): Set<string> {
 // input token is itself a near-miss of a destructive verb. #6303
 function intendsDestruction(inputToken: string, verbs: Set<string>): boolean {
   for (const verb of verbs) {
-    if (levenshtein(inputToken, verb) <= DESTRUCTIVE_INTENT_THRESHOLD) {
+    if (
+      Math.abs(inputToken.length - verb.length) <= DESTRUCTIVE_INTENT_THRESHOLD &&
+      levenshtein(inputToken, verb) <= DESTRUCTIVE_INTENT_THRESHOLD
+    ) {
       return true
     }
   }
@@ -85,7 +88,9 @@ export function suggestCommands(specs: CommandSpec[], commandPath: string[]): st
         continue
       }
       seen.add(joined)
-      scored.push({ label: joined, distance: levenshtein(input, joined) })
+      if (Math.abs(input.length - joined.length) <= SUGGESTION_THRESHOLD) {
+        scored.push({ label: joined, distance: levenshtein(input, joined) })
+      }
     }
   }
   return rankByDistance(scored)
@@ -106,9 +111,13 @@ export type FlagErrorData = {
 }
 
 function suggestFlags(flag: string, validFlags: string[]): string[] {
-  return rankByDistance(
-    validFlags.map((candidate) => ({ label: candidate, distance: levenshtein(flag, candidate) }))
-  )
+  const scored: { label: string; distance: number }[] = []
+  for (const candidate of validFlags) {
+    if (Math.abs(flag.length - candidate.length) <= SUGGESTION_THRESHOLD) {
+      scored.push({ label: candidate, distance: levenshtein(flag, candidate) })
+    }
+  }
+  return rankByDistance(scored)
 }
 
 // Why: include the accepted set so agents can recover without another help call.
diff --git a/src/cli/format.ts b/src/cli/format.ts
index 0a297138364..dd6b7b739c7 100644
--- a/src/cli/format.ts
+++ b/src/cli/format.ts
@@ -1,13 +1,8 @@
 import type { CliStatusResult } from '../shared/runtime-types'
-import { computerUseErrorRecoveryData } from '../shared/computer-use-error-recovery'
-import {
-  matchAutomationOwnerConflict,
-  stripAutomationOwnerConflictCode
-} from '../shared/automation-owner-conflict'
-import { automationOwnerConflictRecovery } from './automation-owner-conflict-recovery'
 import { prepareComputerCliJsonResult } from './computer-format'
-import type { RuntimeRpcFailure, RuntimeRpcSuccess } from './runtime-client'
-import { RuntimeClientError, RuntimeRpcFailureError } from './runtime/types'
+import type { RuntimeRpcSuccess } from './runtime-client'
+
+export { formatCliError, reportCliError } from './cli-error'
 
 export {
   formatBrowserProfileList,
@@ -67,10 +62,6 @@ export {
   formatWorktreeShow
 } from './workspace-format'
 
-type CliErrorContext = {
-  commandPath?: readonly string[]
-}
-
 export function printResult<TResult>(
   response: RuntimeRpcSuccess<TResult>,
   json: boolean,
@@ -83,143 +74,14 @@ export function printResult<TResult>(
   console.log(formatter(response.result))
 }
 
-export function formatCliError(error: unknown, context: CliErrorContext = {}): string {
-  const message = error instanceof Error ? error.message : String(error)
-  if (error instanceof RuntimeClientError && error.code === 'runtime_unavailable') {
-    if (hasOrchestrationRequestId(error.data)) {
-      return message
-    }
-    return `${message}\nOrca is not running. Run 'orca open' first.`
-  }
-  // Why: error-specific recovery must win over the generic computer fallback.
-  // Classified from the whole error, not just `.code`: a hop that flattens the class leaves only the token.
-  const conflict = automationOwnerConflictRecovery(matchAutomationOwnerConflict(error))
-  if (conflict) {
-    return formatMessageWithNextSteps(stripAutomationOwnerConflictCode(message), conflict.nextSteps)
-  }
-  if (error instanceof RuntimeClientError) {
-    const nextSteps = nextStepsFromData(error.data)
-    if (nextSteps.length > 0) {
-      return formatMessageWithNextSteps(message, nextSteps)
-    }
-    if (error.code === 'invalid_argument' && context.commandPath?.[0] === 'computer') {
-      return formatMessageWithNextSteps(
-        message,
-        computerUseErrorRecoveryData('invalid_argument')?.nextSteps ?? []
-      )
-    }
-  }
-  if (
-    error instanceof RuntimeRpcFailureError &&
-    error.response.error.code === 'runtime_unavailable'
-  ) {
-    return `${message}\nOrca is not running. Run 'orca open' first.`
-  }
-  if (error instanceof RuntimeRpcFailureError) {
-    return formatMessageWithNextSteps(message, nextStepsFromData(error.response.error.data))
-  }
-  return message
-}
-
-function hasOrchestrationRequestId(data: unknown): boolean {
-  return (
-    data !== null &&
-    typeof data === 'object' &&
-    typeof (data as { orchestrationRequestId?: unknown }).orchestrationRequestId === 'string'
-  )
-}
-
-export function reportCliError(error: unknown, json: boolean, context: CliErrorContext = {}): void {
-  if (json) {
-    if (error instanceof RuntimeRpcFailureError) {
-      console.log(JSON.stringify(withAutomationOwnerConflictRecovery(error.response), null, 2))
-    } else {
-      const response: RuntimeRpcFailure = {
-        id: 'local',
-        ok: false,
-        error: {
-          code:
-            matchAutomationOwnerConflict(error) ??
-            (error instanceof RuntimeClientError ? error.code : 'runtime_error'),
-          message: stripAutomationOwnerConflictCode(
-            error instanceof Error ? error.message : String(error)
-          ),
-          data: localCliErrorData(error, context)
-        },
-        _meta: {
-          runtimeId: null
-        }
-      }
-      console.log(JSON.stringify(response, null, 2))
-    }
-  } else {
-    console.error(formatCliError(error, context))
-  }
-}
-
-/** Machine-readable half of the same recovery the human message carries. */
-function withAutomationOwnerConflictRecovery(response: RuntimeRpcFailure): RuntimeRpcFailure {
-  const code = matchAutomationOwnerConflict(response)
-  const conflict = automationOwnerConflictRecovery(code)
-  if (!conflict || !code) {
-    return response
-  }
-  return {
-    ...response,
-    error: {
-      ...response.error,
-      // Restores the classification a flattening hop dropped, so --json consumers read the conflict, not the transport.
-      code,
-      message: stripAutomationOwnerConflictCode(response.error.message),
-      data: response.error.data ?? conflict
-    }
-  }
-}
-
-function formatMessageWithNextSteps(message: string, nextSteps: readonly string[]): string {
-  if (nextSteps.length === 0) {
-    return message
-  }
-  return `${message}\n${nextSteps.map((step) => `Next step: ${step}`).join('\n')}`
-}
-
-function nextStepsFromData(data: unknown): string[] {
-  if (
-    data &&
-    typeof data === 'object' &&
-    Array.isArray((data as { nextSteps?: unknown }).nextSteps)
-  ) {
-    return (data as { nextSteps: unknown[] }).nextSteps.filter(
-      (step): step is string => typeof step === 'string'
-    )
-  }
-  return []
-}
-
-function localCliErrorData(error: unknown, context: CliErrorContext): unknown {
-  // Why: error-specific recovery must win over the generic computer fallback.
-  if (error instanceof RuntimeClientError && error.data !== undefined) {
-    return error.data
-  }
-  const conflict = automationOwnerConflictRecovery(matchAutomationOwnerConflict(error))
-  if (conflict) {
-    return conflict
-  }
-  if (
-    error instanceof RuntimeClientError &&
-    error.code === 'invalid_argument' &&
-    context.commandPath?.[0] === 'computer'
-  ) {
-    return computerUseErrorRecoveryData('invalid_argument')
-  }
-  return undefined
-}
-
 export type HostListEntry = {
   kind: 'local' | 'ssh' | 'environment'
   name: string
   id: string
   selector: string
+  platform?: string
+  connected?: boolean
+  connectionStatus?: string
 }
 
 // Why: the selector column is the point of this command — the name alone is what callers already
@@ -231,10 +93,25 @@ export function formatHostList(result: { hosts: HostListEntry[] }): string {
     environment: 'orca server'
   }
   return result.hosts
-    .map((host) => `${kindLabel[host.kind].padEnd(11)} ${host.name}  ->  ${host.selector}`)
+    .map(
+      (host) =>
+        `${kindLabel[host.kind].padEnd(11)} ${host.name}  ${host.platform ?? 'platform unknown'}  ${formatHostConnection(host)}  ->  ${host.selector}`
+    )
     .join('\n')
 }
 
+function formatHostConnection(host: HostListEntry): string {
+  if (host.kind !== 'ssh') {
+    return ''
+  }
+  if (host.connected === undefined) {
+    return `connection unknown${host.connectionStatus ? ` (${host.connectionStatus})` : ''}`
+  }
+  return host.connected
+    ? `connected${host.connectionStatus ? ` (${host.connectionStatus})` : ''}`
+    : `not connected${host.connectionStatus ? ` (${host.connectionStatus})` : ''}`
+}
+
 export function formatCliStatus(status: CliStatusResult): string {
   return [
     ...(status.target && status.target.kind === 'environment'
diff --git a/src/cli/handlers/agent-hooks.test.ts b/src/cli/handlers/agent-hooks.test.ts
index 4fcc186b0d8..279a8900bec 100644
--- a/src/cli/handlers/agent-hooks.test.ts
+++ b/src/cli/handlers/agent-hooks.test.ts
@@ -56,7 +56,10 @@ vi.mock('../runtime-client', () => {
 
 vi.mock('../../main/agent-hooks/managed-agent-hook-controls', () => ({
   applyAgentStatusHooksEnabled: applyAgentStatusHooksEnabledMock,
-  getManagedAgentHookStatuses: getManagedAgentHookStatusesMock,
+  getManagedAgentHookStatuses: getManagedAgentHookStatusesMock
+}))
+
+vi.mock('../../main/codex/managed-home-shell-preflight', () => ({
   prepareManagedCodexHomeBeforeShellLaunch: prepareManagedCodexHomeBeforeShellLaunchMock
 }))
 
diff --git a/src/cli/handlers/agent-hooks.ts b/src/cli/handlers/agent-hooks.ts
index bf44211b4a7..4fcfe64f9b7 100644
--- a/src/cli/handlers/agent-hooks.ts
+++ b/src/cli/handlers/agent-hooks.ts
@@ -15,11 +15,7 @@ import { getDefaultPersistedState } from '../../shared/constants'
 import { normalizeDisabledTuiAgents } from '../../shared/tui-agent-selection'
 import type { GlobalSettings } from '../../shared/global-settings-types'
 import type { PersistedState } from '../../shared/persisted-state-types'
-import {
-  applyAgentStatusHooksEnabled,
-  getManagedAgentHookStatuses,
-  prepareManagedCodexHomeBeforeShellLaunch
-} from '../../main/agent-hooks/managed-agent-hook-controls'
+import { prepareManagedCodexHomeBeforeShellLaunch } from '../../main/codex/managed-home-shell-preflight'
 
 type AgentHookCommandResult = {
   enabled: boolean
@@ -194,6 +190,8 @@ async function setAgentHooksEnabled(
   client: RuntimeClient,
   enabled: boolean
 ): Promise<AgentHookCommandResult> {
+  const { applyAgentStatusHooksEnabled, getManagedAgentHookStatuses } =
+    await import('../../main/agent-hooks/managed-agent-hook-controls.js')
   const updatedRuntime = await updateRunningRuntime(client, enabled)
   const offlineUpdate = updatedRuntime ? null : updateEnabledOnDisk(enabled)
   const settingsPath = offlineUpdate?.settingsPath ?? getDataPath()
@@ -234,6 +232,8 @@ export const AGENT_HOOK_HANDLERS: Record<string, CommandHandler> = {
     })
   },
   'agent hooks status': async ({ json }) => {
+    const { getManagedAgentHookStatuses } =
+      await import('../../main/agent-hooks/managed-agent-hook-controls.js')
     const result: AgentHookCommandResult = {
       enabled: readHookSettingsFromDisk().agentStatusHooksEnabled,
       settingsPath: getDataPath(),
diff --git a/src/cli/handlers/environment.ts b/src/cli/handlers/environment.ts
index 37b437af2c3..181b2947f98 100644
--- a/src/cli/handlers/environment.ts
+++ b/src/cli/handlers/environment.ts
@@ -50,10 +50,19 @@ export const ENVIRONMENT_HANDLERS: Record<string, CommandHandler> = {
       kind: 'ssh' as const,
       name: target.label,
       id: target.id,
-      selector: `--host ssh:${target.id}`
+      selector: `--host ssh:${target.id}`,
+      ...(target.connected === undefined ? {} : { connected: target.connected }),
+      ...(target.connectionStatus ? { connectionStatus: target.connectionStatus } : {}),
+      ...(target.remotePlatform ? { platform: target.remotePlatform } : {})
     }))
     const hosts = [
-      { kind: 'local' as const, name: 'this machine', id: 'local', selector: '--host local' },
+      {
+        kind: 'local' as const,
+        name: 'this machine',
+        id: 'local',
+        selector: '--host local',
+        platform: process.platform
+      },
       ...sshTargets,
       ...environments
     ]
diff --git a/src/cli/host-selector-alternatives.test.ts b/src/cli/host-selector-alternatives.test.ts
index bc4fadd05c1..9460931a083 100644
--- a/src/cli/host-selector-alternatives.test.ts
+++ b/src/cli/host-selector-alternatives.test.ts
@@ -118,6 +118,24 @@ describe('listSshTargets', () => {
     expect(call).toHaveBeenCalledWith('ssh.listTargets')
   })
 
+  it('enriches legacy target rows from host-owned connection state', async () => {
+    const { RuntimeClientError } = await import('./runtime/types.js')
+    const call = vi.fn(async (method: string) => {
+      if (method === 'ssh.listTargetSummaries') {
+        throw new RuntimeClientError('method_not_found', 'Unknown method')
+      }
+      if (method === 'ssh.getState') {
+        return { result: { state: { status: 'connected', remotePlatform: 'win32' } } }
+      }
+      return { result: { targets: SSH_TARGETS } }
+    })
+
+    await expect(listSshTargets({ call } as unknown as RuntimeClient)).resolves.toEqual([
+      { ...SSH_TARGETS[0], connected: true, connectionStatus: 'connected', remotePlatform: 'win32' }
+    ])
+    expect(call).toHaveBeenCalledWith('ssh.getState', { targetId: SSH_TARGETS[0].id })
+  })
+
   // Why: this only ever runs to enrich an error we are already reporting; a failure here must
   // not replace that error with a confusing one about SSH enumeration.
   it('returns nothing rather than masking the error it was enriching', async () => {
diff --git a/src/cli/host-selector-alternatives.ts b/src/cli/host-selector-alternatives.ts
index fd5abecbc18..f42fec88aee 100644
--- a/src/cli/host-selector-alternatives.ts
+++ b/src/cli/host-selector-alternatives.ts
@@ -1,6 +1,12 @@
 import type { RuntimeClient } from './runtime-client'
 
-export type SshTargetSummary = { id: string; label: string }
+export type SshTargetSummary = {
+  id: string
+  label: string
+  remotePlatform?: 'linux' | 'darwin' | 'win32'
+  connected?: boolean
+  connectionStatus?: string
+}
 export type EnvironmentSummary = { id: string; name: string }
 
 export type HostAlternatives = {
@@ -106,7 +112,7 @@ export async function listSshTargets(client: RuntimeClient): Promise<SshTargetSu
     if (error instanceof Error && 'code' in error && error.code === 'method_not_found') {
       try {
         const legacy = await client.call<{ targets: SshTargetSummary[] }>('ssh.listTargets')
-        return legacy.result.targets
+        return await enrichLegacySshTargetStates(client, legacy.result.targets)
       } catch {
         return []
       }
@@ -115,6 +121,34 @@ export async function listSshTargets(client: RuntimeClient): Promise<SshTargetSu
   }
 }
 
+async function enrichLegacySshTargetStates(
+  client: RuntimeClient,
+  targets: SshTargetSummary[]
+): Promise<SshTargetSummary[]> {
+  return Promise.all(
+    targets.map(async (target) => {
+      try {
+        const response = await client.call<{
+          state: {
+            status?: string
+            remotePlatform?: 'linux' | 'darwin' | 'win32'
+          } | null
+        }>('ssh.getState', { targetId: target.id })
+        const state = response.result.state
+        return {
+          ...target,
+          ...(state?.status === undefined
+            ? {}
+            : { connected: state.status === 'connected', connectionStatus: state.status }),
+          ...(state?.remotePlatform === undefined ? {} : { remotePlatform: state.remotePlatform })
+        }
+      } catch {
+        return target
+      }
+    })
+  )
+}
+
 // Why: `--host ssh:<id>` was never validated, so an unknown target answered ok:true with an
 // empty list — the same silent wrong-machine answer that `runtime:` ids used to give. And since
 // target ids are machine-generated (`ssh-<timestamp>-<random>`), the label a caller actually
diff --git a/src/cli/index-local-command-routing-flags.test.ts b/src/cli/index-local-command-routing-flags.test.ts
index b8db44915d2..1a195cc52ff 100644
--- a/src/cli/index-local-command-routing-flags.test.ts
+++ b/src/cli/index-local-command-routing-flags.test.ts
@@ -48,7 +48,7 @@ import { main } from './index'
 import { okFixture, queueFixtures } from './test-fixtures'
 import { pairRuntimeEnvironment, useWorktreeAwarenessEnvironment } from './index-test-harness'
 
-const SSH_TARGET = { id: 'ssh-1777360569033-yvz2mp', label: 'openclaw' }
+const SSH_TARGET = { id: 'ssh-1777360569033-yvz2mp', label: 'openclaw', remotePlatform: 'win32' }
 
 /** Every SSH-target lookup answers with the one target only this machine's runtime knows about. */
 function queueSshTargetLookups(count: number): void {
@@ -82,6 +82,9 @@ describe('runtime-selector flags on locally pinned CLI commands', () => {
       SSH_TARGET.id,
       'env-m4air'
     ])
+    expect(
+      printed.result.hosts.find((host: { id: string }) => host.id === SSH_TARGET.id).platform
+    ).toBe('win32')
     // The tell: `runtimeId: local` is only honest if no routed client was ever built.
     expect(runtimeClientConstructorMock).toHaveBeenCalledWith(null, null)
   })
diff --git a/src/cli/index.ts b/src/cli/index.ts
index 9389113b195..a0e1354307f 100644
--- a/src/cli/index.ts
+++ b/src/cli/index.ts
@@ -15,7 +15,7 @@ import {
   resolveHostFlagEnvironmentId
 } from './execution-host-flag'
 import { listSshTargets } from './host-selector-alternatives'
-import { reportCliError } from './format'
+import { reportCliError } from './cli-error'
 import { printHelp } from './help'
 import type { RuntimeClient } from './runtime-client'
 import { COMMAND_SPECS } from './specs'
diff --git a/src/cli/orchestration-dispatch-refusal-format.test.ts b/src/cli/orchestration-dispatch-refusal-format.test.ts
new file mode 100644
index 00000000000..0a4461f25f1
--- /dev/null
+++ b/src/cli/orchestration-dispatch-refusal-format.test.ts
@@ -0,0 +1,77 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import {
+  injectRejectedRefusal,
+  taskNotFoundRefusal,
+  taskNotStartableRefusal,
+  type DispatchRefusalReceipt
+} from '../shared/orchestration-dispatch-refusal-contract'
+import { formatCliError, reportCliError } from './format'
+import { RuntimeRpcFailureError, type RuntimeRpcFailure } from './runtime/types'
+
+afterEach(() => {
+  vi.restoreAllMocks()
+})
+
+// Why: these are the exact envelopes the RPC dispatcher test proved the runtime emits. This
+// checkout's formatter never enumerates codes (verified below with a code no build has defined),
+// which is what lets a client that predates a new code still print its message and nextSteps.
+describe('orchestration dispatch refusals through the CLI error boundary', () => {
+  it.each([
+    {
+      receipt: taskNotFoundRefusal('Task not found: task_missing', { taskId: 'task_missing' }),
+      recovery: /task-create|task-list/
+    },
+    {
+      receipt: taskNotStartableRefusal(
+        'Task task_child is pending; only ready tasks can be dispatched',
+        { taskId: 'task_child', status: 'pending', unmetDependencies: ['task_parent'] }
+      ),
+      recovery: /task_parent/
+    },
+    {
+      receipt: injectRejectedRefusal('term_worker', 'no_agent_detected'),
+      recovery: /without --inject/
+    }
+  ])('prints $receipt.code with its recovery in human and JSON output', ({ receipt, recovery }) => {
+    const failure = envelope(receipt)
+    const error = new RuntimeRpcFailureError(failure)
+    expect(error.code).toBe(receipt.code)
+
+    const human = formatCliError(error, { commandPath: ['orchestration', 'dispatch'] })
+    expect(human).toContain(receipt.message)
+    expect(human).toMatch(recovery)
+
+    const log = vi.spyOn(console, 'log').mockImplementation(() => {})
+    reportCliError(error, true, { commandPath: ['orchestration', 'dispatch'] })
+    const printed = JSON.parse(log.mock.calls[0]?.[0] as string) as RuntimeRpcFailure
+    expect(printed.ok).toBe(false)
+    expect(printed.error).toEqual(receipt)
+  })
+})
+
+// Why: a code this build has never defined stands in for a future host's new code; if the
+// formatter ever starts gating on known codes, this is the assertion that catches it.
+it('prints an unknown code with its message and nextSteps unchanged', () => {
+  const failure: RuntimeRpcFailure = {
+    id: 'rpc_1',
+    ok: false,
+    error: {
+      code: 'code_from_a_newer_host',
+      message: 'Refused for a reason this CLI has never heard of.',
+      data: { nextSteps: ['Do the thing the newer host suggested.'] }
+    },
+    _meta: { runtimeId: 'runtime_1' }
+  }
+  const error = new RuntimeRpcFailureError(failure)
+
+  expect(formatCliError(error, { commandPath: ['orchestration', 'dispatch'] })).toBe(
+    'Refused for a reason this CLI has never heard of.\nNext step: Do the thing the newer host suggested.'
+  )
+  const log = vi.spyOn(console, 'log').mockImplementation(() => {})
+  reportCliError(error, true, { commandPath: ['orchestration', 'dispatch'] })
+  expect(JSON.parse(log.mock.calls[0]?.[0] as string)).toEqual(failure)
+})
+
+function envelope(receipt: DispatchRefusalReceipt): RuntimeRpcFailure {
+  return { id: 'rpc_1', ok: false, error: receipt, _meta: { runtimeId: 'runtime_1' } }
+}
diff --git a/src/cli/runtime-client-deferral.test.ts b/src/cli/runtime-client-deferral.test.ts
index 658cc60f0a4..5fcdf8b9686 100644
--- a/src/cli/runtime-client-deferral.test.ts
+++ b/src/cli/runtime-client-deferral.test.ts
@@ -84,14 +84,12 @@ describe('RuntimeClient module-graph deferral', () => {
     process.exitCode = 0
   })
 
-  // Why: the whole point of the change. These six modules load on EVERY
-  // invocation, so a value-import of the barrel from any of them drags the
-  // RuntimeClient graph (zod, ws, tweetnacl) back onto the --help path.
+  // These eager modules must not pull the RuntimeClient dependency graph into help.
   it.each([
     'args.ts',
     'flags.ts',
     'dispatch.ts',
-    'format.ts',
+    'cli-error.ts',
     'selectors.ts',
     'execution-host-flag.ts'
   ])('%s imports error classes from ./runtime/types, not the barrel', (file) => {
@@ -110,6 +108,7 @@ describe('RuntimeClient module-graph deferral', () => {
     expect(source).toContain("import type { RuntimeClient } from './runtime-client'")
     expect(source).not.toMatch(/^import \{[^}]*RuntimeClient[^}]*\} from '\.\/runtime-client'/m)
     expect(source).toContain("await import('./runtime-client.js')")
+    expect(source).toContain("import { reportCliError } from './cli-error'")
   })
 
   it('constructs no client for --help', async () => {
diff --git a/src/cli/runtime/transport-framing.test.ts b/src/cli/runtime/transport-framing.test.ts
new file mode 100644
index 00000000000..cf3150f60c9
--- /dev/null
+++ b/src/cli/runtime/transport-framing.test.ts
@@ -0,0 +1,150 @@
+import { EventEmitter } from 'node:events'
+import { StringDecoder } from 'node:string_decoder'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { RuntimeMetadata } from '../../shared/runtime-bootstrap'
+import { sendRequest } from './transport'
+
+const { createConnection } = vi.hoisted(() => ({ createConnection: vi.fn() }))
+vi.mock('node:net', () => ({ createConnection }))
+vi.mock('node:crypto', () => ({ randomUUID: () => 'request-1' }))
+
+const metadata: RuntimeMetadata = {
+  runtimeId: 'runtime-1',
+  pid: 123,
+  transports: [{ kind: 'unix', endpoint: 'test-only' }],
+  authToken: 'token',
+  startedAt: 1
+}
+const reply = (result: unknown) =>
+  `${JSON.stringify({ id: 'request-1', ok: true, result, _meta: { runtimeId: 'runtime-1' } })}\n`
+
+class TestSocket extends EventEmitter {
+  setEncoding = vi.fn()
+  write = vi.fn()
+  end = vi.fn()
+  destroy = vi.fn()
+}
+let socket: TestSocket
+
+beforeEach(() => {
+  socket = new TestSocket()
+  createConnection.mockReturnValue(socket)
+})
+afterEach(() => {
+  vi.restoreAllMocks()
+  vi.useRealTimers()
+})
+
+describe('CLI runtime response framing', () => {
+  it.each([1, 7, 256, 4096])(
+    'reads a fragmented response with %i-character chunks',
+    async (size) => {
+      const result = { data: '界😀'.repeat(10000) }
+      const encoded = reply(result)
+      const pending = sendRequest(metadata, 'terminal.read', {}, 30000)
+      for (let offset = 0; offset < encoded.length; offset += size) {
+        socket.emit('data', encoded.slice(offset, offset + size))
+      }
+      await expect(pending).resolves.toMatchObject({ result })
+      expect(socket.setEncoding).toHaveBeenCalledExactlyOnceWith('utf8')
+      expect(socket.end).toHaveBeenCalledOnce()
+    }
+  )
+
+  it('accepts Unicode split across socket bytes using the existing UTF-8 decoder', async () => {
+    const pending = sendRequest(metadata, 'terminal.read', {}, 30000)
+    const decoder = new StringDecoder('utf8')
+    for (const byte of Buffer.from(reply({ data: '界😀é' }))) {
+      socket.emit('data', decoder.write(Buffer.from([byte])))
+    }
+    socket.emit('data', decoder.end())
+    await expect(pending).resolves.toMatchObject({ result: { data: '界😀é' } })
+  })
+
+  it('searches each fragment once without rescanning the accumulated reply', async () => {
+    const encoded = reply({ data: 'x'.repeat(1024 * 1024) })
+    const pending = sendRequest(metadata, 'terminal.read', {}, 30000)
+    const originalIndexOf = String.prototype.indexOf
+    let searchedCharacters = 0
+    const search = vi
+      .spyOn(String.prototype, 'indexOf')
+      .mockImplementation(function (this: string, value, position) {
+        if (value === '\n') {
+          searchedCharacters += this.length - (position ?? 0)
+        }
+        return originalIndexOf.call(this, value, position)
+      })
+    try {
+      for (let offset = 0; offset < encoded.length; offset += 256) {
+        socket.emit('data', encoded.slice(offset, offset + 256))
+      }
+    } finally {
+      search.mockRestore()
+    }
+    await expect(pending).resolves.toMatchObject({ ok: true })
+    expect(searchedCharacters).toBe(encoded.length)
+  })
+
+  it('refreshes keepalives across chunks and ignores blanks and data after the final frame', async () => {
+    vi.useFakeTimers()
+    const pending = sendRequest(metadata, 'terminal.read', {}, 100)
+    await vi.advanceTimersByTimeAsync(90)
+    socket.emit('data', ' \r\n{"_keep')
+    socket.emit('data', 'alive":true}\n\t\n')
+    await vi.advanceTimersByTimeAsync(90)
+    socket.emit('data', `${reply({ data: 'done' })}invalid JSON\n`)
+    socket.emit('data', 'more ignored data')
+    await expect(pending).resolves.toMatchObject({ result: { data: 'done' } })
+    expect(socket.end).toHaveBeenCalledOnce()
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it.each([
+    ['broken JSON\n', 'invalid_runtime_response'],
+    ['{}\n', 'invalid_runtime_response'],
+    ['{"id":"other","ok":true,"result":{}}\n', 'invalid_runtime_response'],
+    [
+      '{"id":"request-1","ok":true,"result":{},"_meta":{"runtimeId":"other"}}\n',
+      'runtime_unavailable'
+    ]
+  ])(
+    'rejects a fragmented invalid first frame before subsequent valid frames',
+    async (line, code) => {
+      const pending = sendRequest(metadata, 'terminal.read', {}, 30000)
+      socket.emit('data', line.slice(0, 2))
+      socket.emit('data', line.slice(2) + reply({ data: 'ignored' }))
+      await expect(pending).rejects.toMatchObject({ code })
+      expect(socket.end).toHaveBeenCalledOnce()
+    }
+  )
+
+  it('preserves terminal failure envelopes', async () => {
+    const pending = sendRequest(metadata, 'terminal.read', {}, 30000)
+    socket.emit('data', '{"id":"request-1","ok":false,"error":{"code":"bad","message":"no"}}\n')
+    await expect(pending).resolves.toMatchObject({
+      ok: false,
+      error: { code: 'bad', message: 'no' }
+    })
+  })
+
+  it('rejects close with an incomplete frame and does not parse later data', async () => {
+    const pending = sendRequest(metadata, 'terminal.read', {}, 30000)
+    socket.emit('data', '{"id":')
+    socket.emit('close')
+    socket.emit('data', reply({ data: 'ignored' }))
+    await expect(pending).rejects.toMatchObject({ code: 'runtime_unavailable' })
+    expect(socket.end).toHaveBeenCalledOnce()
+  })
+
+  it('destroys a timed out socket holding an incomplete frame', async () => {
+    vi.useFakeTimers()
+    const pending = sendRequest(metadata, 'terminal.read', {}, 100)
+    const rejected = expect(pending).rejects.toMatchObject({ code: 'runtime_timeout' })
+    socket.emit('data', '{"id":')
+    await vi.advanceTimersByTimeAsync(100)
+    socket.emit('data', reply({ data: 'ignored' }))
+    await rejected
+    expect(socket.destroy).toHaveBeenCalledOnce()
+    expect(vi.getTimerCount()).toBe(0)
+  })
+})
diff --git a/src/cli/runtime/transport.ts b/src/cli/runtime/transport.ts
index 091ca9da0e0..4e0d0a15ec7 100644
--- a/src/cli/runtime/transport.ts
+++ b/src/cli/runtime/transport.ts
@@ -31,7 +31,7 @@ export async function sendRequest<TResult>(
       return
     }
     const socket = createConnection(transport.endpoint)
-    let buffer = ''
+    let lineSegments: string[] = []
     let settled = false
     const requestId = randomUUID()
 
@@ -40,6 +40,7 @@ export async function sendRequest<TResult>(
         return
       }
       settled = true
+      lineSegments = []
       socket.destroy()
       reject(
         new RuntimeClientError(
@@ -56,6 +57,7 @@ export async function sendRequest<TResult>(
         return
       }
       settled = true
+      lineSegments = []
       clearTimeout(timeout)
       socket.end()
       if (result.ok === false) {
@@ -89,18 +91,27 @@ export async function sendRequest<TResult>(
       })
     })
     socket.on('data', (chunk: string) => {
-      buffer += chunk
       // Why: the server may interleave `{"_keepalive":true}\n` frames with the
       // final success/failure frame to keep both idle timers alive during a
       // long-poll (see design doc §3.1). Read frames in a loop until we see a
       // terminal frame. Each keepalive refreshes the client-side timer so a
       // 10 min wait doesn't trip the 60 s default ceiling.
-      let newlineIndex = buffer.indexOf('\n')
-      while (newlineIndex !== -1 && !settled) {
-        const line = buffer.slice(0, newlineIndex)
-        buffer = buffer.slice(newlineIndex + 1)
+      let cursor = 0
+      while (cursor < chunk.length && !settled) {
+        const newlineIndex = chunk.indexOf('\n', cursor)
+        if (newlineIndex === -1) {
+          lineSegments.push(chunk.slice(cursor))
+          return
+        }
+        const segment = chunk.slice(cursor, newlineIndex)
+        let line = segment
+        if (lineSegments.length > 0) {
+          lineSegments.push(segment)
+          line = lineSegments.join('')
+          lineSegments = []
+        }
+        cursor = newlineIndex + 1
         if (line.trim().length === 0) {
-          newlineIndex = buffer.indexOf('\n')
           continue
         }
 
@@ -124,7 +135,6 @@ export async function sendRequest<TResult>(
         // major). See §7 risk #9.
         if (isKeepaliveFrame(raw)) {
           timeout.refresh()
-          newlineIndex = buffer.indexOf('\n')
           continue
         }
 
@@ -150,7 +160,6 @@ export async function sendRequest<TResult>(
         const frame = parsed.data
         if ('_keepalive' in frame) {
           timeout.refresh()
-          newlineIndex = buffer.indexOf('\n')
           continue
         }
 
diff --git a/src/cli/specs/environment.ts b/src/cli/specs/environment.ts
index 7bf90615270..64efbe802b9 100644
--- a/src/cli/specs/environment.ts
+++ b/src/cli/specs/environment.ts
@@ -10,6 +10,8 @@ export const ENVIRONMENT_COMMAND_SPECS: CommandSpec[] = [
     notes: [
       'Answers "what can I target and what do I pass" in one place: this machine, the SSH targets registered on it, and the Orca servers paired with it.',
       'The three kinds are reached differently. A paired Orca server is a connection, selected with --environment <name>. An SSH target is a machine the connected Orca host reaches, selected with --host ssh:<id>. Passing one where the other belongs is the most common way to get an empty or missing-host answer.',
+      'SSH rows include the detected remote platform after that target has connected (linux, darwin, or win32); disconnected or older targets report platform unknown.',
+      'SSH rows also include whether the target is currently connected and its lifecycle status when known.',
       "SSH targets are read from this machine's own Orca runtime, so this lists that machine's targets and not another server's. Run `orca host list` on the other machine to see the targets registered there.",
       '--environment and --pairing-code are rejected rather than ignored: paired servers come from this machine\u2019s pairing store, so a routed answer would describe two machines at once.'
     ],
diff --git a/src/main/__fixtures__/shell-wrapper-snapshots/daemon-bash-rcfile.txt b/src/main/__fixtures__/shell-wrapper-snapshots/daemon-bash-rcfile.txt
index 54837bf4d65..b79ed543494 100644
--- a/src/main/__fixtures__/shell-wrapper-snapshots/daemon-bash-rcfile.txt
+++ b/src/main/__fixtures__/shell-wrapper-snapshots/daemon-bash-rcfile.txt
@@ -127,10 +127,6 @@ __orca_osc133_precmd() {
     unset __orca_in_command
   fi
   printf "\033]133;A\007"
-  # Why: emit the shell-ready marker here (not a trailing PROMPT_COMMAND entry)
-  # so a framework that must be last in PROMPT_COMMAND — bash-preexec — is not
-  # displaced by one of Orca's own hooks.
-  [[ -n "$__orca_ready_marker" ]] && printf "\033]777;orca-shell-ready\007"
   return "$exit_code"
 }
 __orca_osc133_preexec() {
@@ -188,6 +184,11 @@ __orca_osc133_epilogue() {
   unset __orca_in_prompt_command
   __orca_adopt_outer_debug_trap
   trap '__orca_osc133_preexec' DEBUG
+  # Readline renders PS1 after entering raw mode; prompt hooks still run in cooked mode.
+  if [[ -n "$__orca_ready_marker" ]]; then
+    PS1="${PS1-}"'\[\e]777;orca-shell-ready\a\]'
+    __orca_ready_marker=""
+  fi
 }
 __orca_normalize_prompt_command_part() {
   local __orca_value="$1" __orca_output_name="$2" __orca_character __orca_chunk
diff --git a/src/main/agent-awake-service-platform-assertions.test.ts b/src/main/agent-awake-service-platform-assertions.test.ts
index cd1d7fb1adc..7b3566b322f 100644
--- a/src/main/agent-awake-service-platform-assertions.test.ts
+++ b/src/main/agent-awake-service-platform-assertions.test.ts
@@ -22,6 +22,20 @@ function workingStatus(): AgentAwakeStatus {
   }
 }
 
+describe('AgentAwakeService status array ownership', () => {
+  it('does not observe rows appended to the caller array after setStatuses', () => {
+    const service = new AgentAwakeService()
+    service.setMode('auto')
+    const statuses: AgentAwakeStatus[] = [workingStatus()]
+
+    service.setStatuses(statuses)
+    const before = service.getWorkingAgentCount()
+    statuses.push(workingStatus(), workingStatus())
+
+    expect(service.getWorkingAgentCount()).toBe(before)
+  })
+})
+
 function createBlocker() {
   const startedIds = new Set<number>()
   let nextId = 1
diff --git a/src/main/agent-awake-service.ts b/src/main/agent-awake-service.ts
index b79612e2b9c..6be27e9d0e6 100644
--- a/src/main/agent-awake-service.ts
+++ b/src/main/agent-awake-service.ts
@@ -105,7 +105,8 @@ export class AgentAwakeService {
   }
 
   setStatuses(statuses: AgentAwakeStatus[]): void {
-    this.statuses = statuses.map((status) => ({ ...status }))
+    // Copy the array, not every row: the hook server allocates each row fresh per event.
+    this.statuses = [...statuses]
     this.refresh('status-change')
   }
 
@@ -171,7 +172,8 @@ export class AgentAwakeService {
 
   private getEligibleRunningStatusCount(): number {
     const now = this.now()
-    return this.statuses.filter((status) => this.isWakeEligible(status, now)).length
+    // Counted in place: the filtered array was only ever measured, and this runs per hook event.
+    return this.statuses.reduce((count, s) => count + (this.isWakeEligible(s, now) ? 1 : 0), 0)
   }
 
   private isWakeEligible(status: AgentAwakeStatus, now: number): boolean {
diff --git a/src/main/agent-hooks/managed-hook-stdin-lifecycle.test.ts b/src/main/agent-hooks/managed-hook-stdin-lifecycle.test.ts
index 40237141d24..af70f6f54f0 100644
--- a/src/main/agent-hooks/managed-hook-stdin-lifecycle.test.ts
+++ b/src/main/agent-hooks/managed-hook-stdin-lifecycle.test.ts
@@ -4,7 +4,7 @@
 // missing-Orca-env path, so their writer may break there.
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { spawn } from 'node:child_process'
-import { mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs'
+import { mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import type { SFTPWrapper } from 'ssh2'
@@ -60,6 +60,7 @@ import { DroidHookService } from '../droid/hook-service'
 import { GeminiHookService } from '../gemini/hook-service'
 import { GrokHookService } from '../grok/hook-service'
 import { KimiHookService } from '../kimi/hook-service'
+
 import { openClaudeHookService } from '../openclaude/hook-service'
 import { wrapPosixHookCommand, wrapWindowsHookCommand } from './installer-utils'
 import { POSIX_HOOK_STDIN_READER } from './hook-stdin-contract'
@@ -69,6 +70,16 @@ import { findGitBash } from './windows-git-bash-path.test-fixture'
 
 const REMOTE_HOME = '/home/dev'
 const LARGE_PAYLOAD = Buffer.alloc(1_000_000, 'x')
+
+// Why: a developer box may set HKCU\...\Command Processor\AutoRun, which cmd.exe runs before any
+// .cmd — and MSYS spawns a .cmd without `/d`, so it fires on the Git Bash legs. Redirecting the
+// profile makes the usual `%USERPROFILE%\.cmd_aliases.cmd` target vanish, putting cmd's "not
+// recognized" on the hook's stderr. Seed an empty target so these suites measure the launcher
+// rather than the host's shell configuration.
+function seedCmdAutoRunTarget(profileDir: string): void {
+  mkdirSync(profileDir, { recursive: true })
+  writeFileSync(join(profileDir, '.cmd_aliases.cmd'), '@echo off\r\n', 'utf8')
+}
 const REMOTE_INSTALLERS = [
   {
     agent: 'antigravity',
@@ -228,6 +239,7 @@ describe('Windows managed hook stdin structure', () => {
   it('exits immediately when Orca env is missing and keeps drain for other failures', async () => {
     const home = mkdtempSync(join(tmpdir(), 'orca-hook-stdin-windows-'))
     homedirMock.mockReturnValue(home)
+    seedCmdAutoRunTarget(home)
     const previousGrokHome = process.env.GROK_HOME
     const previousKimiHome = process.env.KIMI_CODE_HOME
     delete process.env.GROK_HOME
@@ -317,6 +329,7 @@ describe('Windows managed hook stdin structure', () => {
     async () => {
       const home = mkdtempSync(join(tmpdir(), 'orca-hook-stdin-windows-live-'))
       homedirMock.mockReturnValue(home)
+      seedCmdAutoRunTarget(home)
       try {
         const gitBash = findGitBash()
         for (const entry of LOCAL_INSTALLERS) {
@@ -399,6 +412,9 @@ describe('Windows managed hook stdin structure', () => {
     async () => {
       const home = mkdtempSync(join(tmpdir(), 'orca-hook-stdout-json-'))
       homedirMock.mockReturnValue(home)
+      const absentProfile = join(home, 'absent')
+      seedCmdAutoRunTarget(home)
+      seedCmdAutoRunTarget(absentProfile)
       try {
         expect(new ClaudeHookService().install().state).toBe('installed')
         const settings = JSON.parse(
@@ -426,8 +442,12 @@ describe('Windows managed hook stdin structure', () => {
             })
           },
           {
+            // Why: the encoded launcher resolves %USERPROFILE% at run time, so redirecting it is
+            // what makes the script vanish for that shape. The direct launcher (#18875) carries
+            // an absolute path, so here it asserts only that a bogus profile changes nothing; its
+            // missing-script fallback is covered live in windows-direct-cmd-hook-command.test.ts.
             name: 'missing managed script',
-            env: hookEnvironment({ USERPROFILE: join(home, 'absent') })
+            env: hookEnvironment({ USERPROFILE: absentProfile })
           }
         ]
         for (const shell of shells) {
diff --git a/src/main/agent-hooks/windows-direct-cmd-hook-command.test.ts b/src/main/agent-hooks/windows-direct-cmd-hook-command.test.ts
new file mode 100644
index 00000000000..acb4bf2d46d
--- /dev/null
+++ b/src/main/agent-hooks/windows-direct-cmd-hook-command.test.ts
@@ -0,0 +1,143 @@
+// Why (#18875): the registered Windows Claude hook is now the script path itself, so this file
+// pins the two things that make that safe — the shape carries nothing MSYS or cmd.exe rewrites,
+// and it still answers with neutral JSON when the script is gone. The live legs run the string
+// through BOTH hosts Claude Code can pick, because the shape has to parse in either.
+import { describe, expect, it } from 'vitest'
+import { execFileSync } from 'node:child_process'
+import { existsSync, mkdtempSync, readdirSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { removeTreeSync } from '../../shared/windows-transient-lock-removal'
+import { WINDOWS_CMD_SAFE_PATH } from './installer-utils'
+import { wrapWindowsDirectCmdHookCommand } from './windows-direct-cmd-hook-command'
+import { findGitBash } from './windows-git-bash-path.test-fixture'
+
+const SAFE_PATH = 'C:\\Users\\alice\\.orca\\agent-hooks\\claude-hook.cmd'
+
+describe('wrapWindowsDirectCmdHookCommand', () => {
+  it('emits the script path with forward slashes and a neutral-JSON fallback', () => {
+    expect(wrapWindowsDirectCmdHookCommand(SAFE_PATH)).toBe(
+      'C:/Users/alice/.orca/agent-hooks/claude-hook.cmd || echo {}'
+    )
+  })
+
+  it('spells nothing either shell would rewrite or reinterpret', () => {
+    const command = wrapWindowsDirectCmdHookCommand(SAFE_PATH)!
+
+    // Why: MSYS rewrites `/c`-shaped tokens into drive paths — a literal `cmd.exe /d /c <path>`
+    // does not survive Git Bash (measured), which is why no interpreter is spelled at all.
+    expect(command).not.toMatch(/ \/[a-zA-Z]+( |$)/)
+    expect(command).not.toMatch(/\\/)
+    expect(command).not.toMatch(/["']/)
+    expect(command).not.toMatch(/powershell|cmd\.exe|conhost/i)
+    // Why: `2>nul` writes a literal file named `nul` into the cwd under MSYS (measured), and no
+    // stderr sink parses in both hosts. The missing-script line is left on stderr deliberately.
+    expect(command).not.toContain('2>')
+  })
+
+  it('declines any path the shells cannot carry bare', () => {
+    for (const path of [
+      'C:\\Users\\Bob Smith\\.orca\\agent-hooks\\claude-hook.cmd',
+      'C:\\Users\\%name%\\.orca\\agent-hooks\\claude-hook.cmd',
+      'C:\\Users\\a^b\\.orca\\agent-hooks\\claude-hook.cmd',
+      'C:\\Users\\a&b\\.orca\\agent-hooks\\claude-hook.cmd',
+      'C:\\Users\\a(b)\\.orca\\agent-hooks\\claude-hook.cmd',
+      'C:\\Users\\rené\\.orca\\agent-hooks\\claude-hook.cmd',
+      '/home/alice/.orca/agent-hooks/claude-hook.sh',
+      // Why: WINDOWS_CMD_SAFE_PATH admits a UNC profile, but `//server/share/...` is not a
+      // command cmd.exe reliably starts — keep those on the encoded launcher.
+      '\\\\server\\share\\alice\\.orca\\agent-hooks\\claude-hook.cmd'
+    ]) {
+      expect(wrapWindowsDirectCmdHookCommand(path), path).toBeNull()
+    }
+  })
+})
+
+describe.skipIf(process.platform !== 'win32')('direct hook command, run by both hook hosts', () => {
+  // Why: the fixture throws when Git Bash is absent, and that is a skip here, not a failure —
+  // a box without it never gets this command shape in the first place.
+  const gitBash = ((): string | null => {
+    try {
+      return findGitBash()
+    } catch {
+      return null
+    }
+  })()
+
+  function runInCmd(command: string, cwd: string): { stdout: string; status: number } {
+    return runCapture('cmd.exe', ['/d', '/c', command], cwd)
+  }
+
+  function runInBash(command: string, cwd: string): { stdout: string; status: number } {
+    return runCapture(gitBash!, ['-c', command], cwd)
+  }
+
+  function runCapture(file: string, args: string[], cwd: string) {
+    try {
+      const stdout = execFileSync(file, args, {
+        cwd,
+        input: '{"hook_event_name":"PreToolUse"}',
+        encoding: 'utf8',
+        stdio: ['pipe', 'pipe', 'pipe']
+      })
+      return { stdout, status: 0 }
+    } catch (error) {
+      const failure = error as { stdout?: string; status?: number }
+      return { stdout: failure.stdout ?? '', status: failure.status ?? 1 }
+    }
+  }
+
+  // Why: a runner whose TEMP sits under a profile with a space is the encoded-launcher case,
+  // so these legs skip rather than assert a contract that shape never claimed.
+  const tempIsCmdSafe = WINDOWS_CMD_SAFE_PATH.test(join(tmpdir(), 'orca-direct-hook-x', 'x.cmd'))
+  const canRunLive = Boolean(gitBash) && tempIsCmdSafe
+
+  function withTempDir(run: (dir: string, scriptPath: string, command: string) => void): void {
+    const dir = mkdtempSync(join(tmpdir(), 'orca-direct-hook-'))
+    try {
+      const scriptPath = join(dir, 'claude-hook.cmd')
+      const command = wrapWindowsDirectCmdHookCommand(scriptPath)
+      expect(command, 'precondition: temp path must be cmd-safe').not.toBeNull()
+      run(dir, scriptPath, command!)
+    } finally {
+      // Why: cmd.exe/bash have just exited in this tree; a raw recursive rm throws EPERM on
+      // Windows while their handles drain.
+      removeTreeSync(dir)
+    }
+  }
+
+  it.skipIf(!canRunLive)('answers {} and exit 0 in both hosts when the script exists', () => {
+    withTempDir((dir, scriptPath, command) => {
+      writeFileSync(scriptPath, '@echo off\r\necho {}\r\nexit /b 0\r\n', 'utf8')
+      for (const result of [runInCmd(command, dir), runInBash(command, dir)]) {
+        expect(result.stdout.trim()).toBe('{}')
+        expect(result.status).toBe(0)
+      }
+    })
+  })
+
+  it.skipIf(!canRunLive)(
+    'still answers {} and exit 0 in both hosts when the script is gone',
+    () => {
+      // Why: compat consumers require neutral JSON even with no managed script (#14818). The
+      // encoded launcher did this with a Test-Path; `|| echo {}` does it with no interpreter.
+      withTempDir((dir, scriptPath, command) => {
+        expect(existsSync(scriptPath)).toBe(false)
+        for (const result of [runInCmd(command, dir), runInBash(command, dir)]) {
+          expect(result.stdout.trim()).toBe('{}')
+          expect(result.status).toBe(0)
+        }
+      })
+    }
+  )
+
+  it.skipIf(!canRunLive)('leaves no stray `nul` file behind in the working directory', () => {
+    // Why this is worth a test: adding `2>nul` to silence the missing-script line looks like
+    // tidy-up, but under MSYS it creates a real file named `nul` in the cwd — which is the
+    // user's repo. Measured on Windows 11. Keep stderr unredirected.
+    withTempDir((dir, _scriptPath, command) => {
+      runInBash(command, dir)
+      expect(readdirSync(dir)).not.toContain('nul')
+    })
+  })
+})
diff --git a/src/main/agent-hooks/windows-direct-cmd-hook-command.ts b/src/main/agent-hooks/windows-direct-cmd-hook-command.ts
new file mode 100644
index 00000000000..f7646f19578
--- /dev/null
+++ b/src/main/agent-hooks/windows-direct-cmd-hook-command.ts
@@ -0,0 +1,30 @@
+import { WINDOWS_CMD_SAFE_PATH } from './installer-utils'
+
+// Why: a drive-letter path only. WINDOWS_CMD_SAFE_PATH also admits a UNC profile, and
+// `//server/share/...` is not a command cmd.exe reliably starts.
+const WINDOWS_DRIVE_LETTER_PATH = /^[A-Za-z]:\\/
+
+/**
+ * Shortest launcher for a managed Windows `.cmd` hook: the script path itself (#18875).
+ *
+ * The encoded PowerShell launcher spent a full interpreter start-up per hook event to reach a
+ * script that exits at its first `ORCA_PANE_KEY` guard, and left a stdout-holding orphan behind
+ * when the hook's timeout kill landed. Measurements and the EDR trade are in
+ * `docs/reference/windows-edr-posture.md`.
+ *
+ * Returns null when the caller must keep the encoded launcher: a path either shell would mangle.
+ */
+export function wrapWindowsDirectCmdHookCommand(scriptPath: string): string | null {
+  if (!WINDOWS_CMD_SAFE_PATH.test(scriptPath) || !WINDOWS_DRIVE_LETTER_PATH.test(scriptPath)) {
+    return null
+  }
+  // Why: forward slashes are the one separator both hosts read, and no token here is a switch
+  // MSYS can rewrite — a literal `cmd.exe /d /c <path>` does not survive Git Bash (measured).
+  const invocation = scriptPath.replaceAll('\\', '/')
+  // Why: neutral JSON when the script is missing (#14818), with no interpreter to Test-Path with.
+  // Valid in bash and cmd.exe; PowerShell 5.1 rejects `||`, which is what gates this on Git Bash.
+  // It also fires when cmd.exe itself exits non-zero (a failing AutoRun), printing `{}` twice —
+  // on that same box the encoded launcher exited 1 instead, so neither shape is clean there.
+  // Stderr stays unredirected: `2>nul` writes a literal `nul` file into the cwd under MSYS.
+  return `${invocation} || echo {}`
+}
diff --git a/src/main/agent-hooks/windows-hook-payload-delivery.test.ts b/src/main/agent-hooks/windows-hook-payload-delivery.test.ts
index 22103b178ff..79d9f4f60ae 100644
--- a/src/main/agent-hooks/windows-hook-payload-delivery.test.ts
+++ b/src/main/agent-hooks/windows-hook-payload-delivery.test.ts
@@ -7,7 +7,7 @@
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import { spawn } from 'node:child_process'
 import { createServer, type Server } from 'node:http'
-import { mkdtempSync, readFileSync } from 'node:fs'
+import { mkdtempSync, readFileSync, writeFileSync } from 'node:fs'
 import { removeTreeSync } from '../../shared/windows-transient-lock-removal'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -32,6 +32,7 @@ vi.mock('os', async (importOriginal) => {
 })
 
 import { ClaudeHookService } from '../claude/hook-service'
+import { WINDOWS_CMD_SAFE_PATH } from './installer-utils'
 import { getConfigPath, getWindowsManagedLifecycleHook } from '../claude/hook-settings'
 import { findGitBash } from './windows-git-bash-path.test-fixture'
 
@@ -122,6 +123,15 @@ function runHookCommand(
   })
 }
 
+// Why: a developer box may set HKCU\...\Command Processor\AutoRun, which cmd.exe runs before
+// any .cmd — and MSYS spawns a .cmd without `/d`, so it fires on the Git Bash leg. Redirecting
+// USERPROFILE to a temp home makes the usual `%USERPROFILE%\.cmd_aliases.cmd` target vanish, and
+// cmd's "not recognized" lands on the hook's stderr. Seed an empty target so this suite measures
+// the launcher rather than the host's shell configuration.
+function seedCmdAutoRunTarget(home: string): void {
+  writeFileSync(join(home, '.cmd_aliases.cmd'), '@echo off\r\n', 'utf8')
+}
+
 function hookEnvironment(extra: NodeJS.ProcessEnv): NodeJS.ProcessEnv {
   const base = Object.fromEntries(
     Object.entries(process.env).filter(([key]) => !key.startsWith('ORCA_'))
@@ -158,6 +168,7 @@ describe.skipIf(process.platform !== 'win32')('Windows managed hook payload deli
   it('delivers the piped payload to the hook listener through cmd.exe and Git Bash', async () => {
     home = mkdtempSync(join(tmpdir(), 'orca-hook-payload-'))
     homedirMock.mockReturnValue(home)
+    seedCmdAutoRunTarget(home)
     expect(new ClaudeHookService().install().state).toBe('installed')
 
     const settings = JSON.parse(readFileSync(getConfigPath(), 'utf8')) as {
@@ -166,6 +177,11 @@ describe.skipIf(process.platform !== 'win32')('Windows managed hook payload deli
     // Why: assert nothing about the launcher's shape here — this test's whole value is
     // that it fails for any launcher that loses the payload, named conhost or not.
     const registeredCommand = settings.hooks.PreToolUse[0].hooks[0].command
+    // ...with one exception: a cmd-safe profile must reach the script with no interpreter in
+    // front of it, or #18875's per-event PowerShell start-up has quietly come back.
+    if (WINDOWS_CMD_SAFE_PATH.test(join(home, '.orca', 'agent-hooks', 'claude-hook.cmd'))) {
+      expect(registeredCommand).not.toMatch(/powershell|-EncodedCommand/i)
+    }
 
     const listener = await startHookListener()
     server = listener.server
diff --git a/src/main/agent-hooks/windows-powershell-hook-launcher.ts b/src/main/agent-hooks/windows-powershell-hook-launcher.ts
index b9a9f6dd208..2cdb8c0f3fa 100644
--- a/src/main/agent-hooks/windows-powershell-hook-launcher.ts
+++ b/src/main/agent-hooks/windows-powershell-hook-launcher.ts
@@ -39,6 +39,11 @@ export function getWindowsPowerShellExecutablePath(): string {
  * Do not restore the flag to fix a console report. That trades every hook on an
  * AV host for a flicker. The answer is to shorten the interpreter chain — the
  * shipped doctrine of #15520 and #15595 — or a launcher that owns no console.
+ *
+ * #18875 took that answer for the Claude lifecycle hook, which now registers the
+ * managed `.cmd` path directly (`windows-direct-cmd-hook-command.ts`) and reaches
+ * this launcher only when the profile path is not cmd-safe or Git Bash is not
+ * resolvable. Every other caller still comes through here on every event.
  */
 export const WINDOWS_POWERSHELL_HOOK_SWITCHES = '-NoProfile'
 
diff --git a/src/main/artifacts/artifact-cloud-recovery.test.ts b/src/main/artifacts/artifact-cloud-recovery.test.ts
index f57b53c2b02..fea3b73bda0 100644
--- a/src/main/artifacts/artifact-cloud-recovery.test.ts
+++ b/src/main/artifacts/artifact-cloud-recovery.test.ts
@@ -1,7 +1,7 @@
 import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
-import { afterEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
 vi.mock('electron', () => ({
   app: { isPackaged: false },
@@ -21,7 +21,14 @@ const writeRequest = {
   authToken: 'token-a'
 }
 
+beforeEach(() => {
+  // Keep fixed response expirations independent of the runner's wall clock.
+  vi.useFakeTimers({ toFake: ['Date'] })
+  vi.setSystemTime('2026-08-07T00:00:00.000Z')
+})
+
 afterEach(async () => {
+  vi.useRealTimers()
   vi.unstubAllGlobals()
   await Promise.all(
     createdPaths.splice(0).map((path) => rm(path, { recursive: true, force: true }))
@@ -336,7 +343,7 @@ function createResponseBody(slug: string): object {
       renderedContentType: 'text/html',
       createdAt: '2026-08-06T00:00:00.000Z',
       updatedAt: '2026-08-06T00:00:00.000Z',
-      expiresAt: '2026-09-06T00:00:00.000Z',
+      expiresAt: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000).toISOString(),
       byteSize: 17,
       deletedAt: null
     },
diff --git a/src/main/artifacts/artifact-cloud-service-races.test.ts b/src/main/artifacts/artifact-cloud-service-races.test.ts
index c31c2a23e3e..28195bf6965 100644
--- a/src/main/artifacts/artifact-cloud-service-races.test.ts
+++ b/src/main/artifacts/artifact-cloud-service-races.test.ts
@@ -1,7 +1,7 @@
 import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
-import { afterEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
 vi.mock('electron', () => ({
   app: { isPackaged: false },
@@ -33,7 +33,7 @@ function createResponse(slug: string): Response {
         renderedContentType: 'text/html',
         createdAt: '2026-08-06T00:00:00.000Z',
         updatedAt: '2026-08-06T00:00:00.000Z',
-        expiresAt: '2026-09-06T00:00:00.000Z',
+        expiresAt: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000).toISOString(),
         byteSize: 12,
         deletedAt: null
       },
@@ -50,7 +50,14 @@ async function setup(): Promise<ArtifactCloudService> {
   return new ArtifactCloudService(path, () => true)
 }
 
+beforeEach(() => {
+  // Keep fixed response expirations independent of the runner's wall clock.
+  vi.useFakeTimers({ toFake: ['Date'] })
+  vi.setSystemTime('2026-08-07T00:00:00.000Z')
+})
+
 afterEach(async () => {
+  vi.useRealTimers()
   vi.unstubAllGlobals()
   await Promise.all(
     createdPaths.splice(0).map((path) => rm(path, { recursive: true, force: true }))
diff --git a/src/main/artifacts/artifact-cloud-service.test.ts b/src/main/artifacts/artifact-cloud-service.test.ts
index 75da3922fc8..c747e6517aa 100644
--- a/src/main/artifacts/artifact-cloud-service.test.ts
+++ b/src/main/artifacts/artifact-cloud-service.test.ts
@@ -1,7 +1,7 @@
 import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
-import { afterEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
 vi.mock('electron', () => ({
   app: { isPackaged: false },
@@ -43,7 +43,10 @@ const cloudB: OrcaProfileCloudSummary = {
   linkedAt: 2
 }
 
-function createResponse(slug = 'artifact-a', expiresAt = '2026-09-06T00:00:00.000Z'): Response {
+function createResponse(
+  slug = 'artifact-a',
+  expiresAt = new Date(Date.now() + 30 * 24 * 60 * 60 * 1000).toISOString()
+): Response {
   return new Response(
     JSON.stringify({
       artifact: {
@@ -92,6 +95,12 @@ const writeRequest = {
   authToken: 'token-a'
 }
 
+beforeEach(() => {
+  // Keep fixed response expirations independent of the runner's wall clock.
+  vi.useFakeTimers({ toFake: ['Date'] })
+  vi.setSystemTime('2026-08-07T00:00:00.000Z')
+})
+
 afterEach(async () => {
   vi.useRealTimers()
   vi.unstubAllGlobals()
diff --git a/src/main/artifacts/artifact-create-intent-store.test.ts b/src/main/artifacts/artifact-create-intent-store.test.ts
index f512f5ab439..7c07520576e 100644
--- a/src/main/artifacts/artifact-create-intent-store.test.ts
+++ b/src/main/artifacts/artifact-create-intent-store.test.ts
@@ -1,4 +1,3 @@
-import { execFileSync } from 'node:child_process'
 import { mkdtemp, readFile, readdir, rm, stat, truncate, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -16,9 +15,14 @@ import {
   getOrCreateArtifactCreateIntent,
   removeArtifactCreateIntent
 } from './artifact-create-intent-store'
+import { runProcessSync } from '../../shared/child-process/run-process'
+import { __resetSecureFileWindowsUserSidForTests } from '../../shared/secure-file'
 import type { ArtifactShareScope } from './artifact-share-record-store'
 
-vi.mock('node:child_process', () => ({ execFile: vi.fn(), execFileSync: vi.fn() }))
+vi.mock('../../shared/child-process/run-process', () => ({
+  runProcess: vi.fn(),
+  runProcessSync: vi.fn()
+}))
 
 const createdPaths: string[] = []
 const scope: ArtifactShareScope = {
@@ -168,12 +172,26 @@ describe('artifact create intent store', () => {
     expect((await readdir(directory)).some((name) => name.endsWith('.tmp'))).toBe(false)
   })
 
-  it('hardens one Windows journal directory without per-file PowerShell launches', async () => {
+  it('hardens one Windows journal directory without per-file ACL launches', async () => {
     const originalPlatform = Object.getOwnPropertyDescriptor(process, 'platform')
     Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
-    vi.mocked(execFileSync).mockImplementation((file) =>
-      String(file).endsWith('whoami.exe') ? '"USER","S-1-5-21-1000"' : ''
-    )
+    const ok = { code: 0, signal: null, stdout: '', stderr: '', timedOut: false }
+    // Earlier cases in this file already resolved (and cached) the SID against an unstubbed mock.
+    __resetSecureFileWindowsUserSidForTests()
+    vi.mocked(runProcessSync).mockImplementation((spec) => {
+      if (spec.program.endsWith('whoami.exe')) {
+        return { ...ok, stdout: '"USER","S-1-5-21-1000"' }
+      }
+      const args = spec.args ?? []
+      if (args.length > 1) {
+        return ok // /reset and the /grant:r pass
+      }
+      // The verify pass re-reads the DACL; answer with the three protected inheritable rules.
+      const rules = ['host\\me', 'NT AUTHORITY\\SYSTEM', 'BUILTIN\\Administrators'].map(
+        (name, index) => (index === 0 ? `${args[0]} ${name}:(OI)(CI)(F)` : `   ${name}:(OI)(CI)(F)`)
+      )
+      return { ...ok, stdout: `${rules.join('\r\n')}\r\n\r\nSuccessfully processed 1 files\r\n` }
+    })
     try {
       const userDataPath = await createUserDataPath()
       getOrCreateArtifactCreateIntent(
@@ -193,16 +211,20 @@ describe('artifact create intent store', () => {
         body
       )
 
-      const powershellCalls = vi
-        .mocked(execFileSync)
-        .mock.calls.filter(([file]) => String(file).endsWith('powershell.exe'))
-      expect(powershellCalls).toHaveLength(1)
-      expect((powershellCalls[0]![1] as string[]).at(-1)).toBe('1')
+      // One harden across both intents: counted by its /reset pass, which opens each harden.
+      const aclCalls = vi
+        .mocked(runProcessSync)
+        .mock.calls.map(([spec]) => spec)
+        .filter((spec) => spec.program.endsWith('icacls.exe'))
+      expect(aclCalls.filter((spec) => spec.args?.includes('/reset'))).toHaveLength(1)
+      // The child intent files rely on inheritance, so the directory rules must carry (OI)(CI).
+      const grant = aclCalls.find((spec) => spec.args?.includes('/grant:r'))
+      expect(grant?.args?.filter((arg) => arg.endsWith(':(OI)(CI)(F)'))).toHaveLength(3)
     } finally {
       if (originalPlatform) {
         Object.defineProperty(process, 'platform', originalPlatform)
       }
-      vi.mocked(execFileSync).mockReset()
+      vi.mocked(runProcessSync).mockReset()
     }
   })
 
diff --git a/src/main/automations/precheck-runner.ts b/src/main/automations/precheck-runner.ts
index 753bd784b06..ab38fd42355 100644
--- a/src/main/automations/precheck-runner.ts
+++ b/src/main/automations/precheck-runner.ts
@@ -4,6 +4,7 @@ import type { AutomationPrecheck, AutomationPrecheckResult } from '../../shared/
 import { MAX_AUTOMATION_PRECHECK_OUTPUT_CHARS } from '../../shared/automation-precheck'
 import { getSshConnectionManager } from '../ipc/ssh'
 import { shellEscape } from '../ssh/ssh-connection-utils'
+import { admitSelfInitiatedTreeKill } from '../own-chromium-tree-kill-guard'
 
 type AutomationPrecheckExecutionTarget =
   | {
@@ -73,7 +74,10 @@ function failedPrecheckResult(
   })
 }
 
-function killLocalPrecheckProcessTree(child: ChildProcess): ReturnType<typeof setTimeout> | null {
+/** Exported for the refusal-fallback test; the timeout path is otherwise unreachable. */
+export function killLocalPrecheckProcessTree(
+  child: ChildProcess
+): ReturnType<typeof setTimeout> | null {
   const pid = child.pid
   if (!pid) {
     child.kill()
@@ -81,6 +85,18 @@ function killLocalPrecheckProcessTree(child: ChildProcess): ReturnType<typeof se
   }
 
   if (process.platform === 'win32') {
+    if (
+      !admitSelfInitiatedTreeKill({
+        pid,
+        site: 'automation-precheck-timeout',
+        scope: 'win-taskkill-tree'
+      })
+    ) {
+      // Refusal blocks the tree walk, not the termination: killing the root by
+      // handle cannot reach a recycled pid, and a timed-out precheck must stop.
+      child.kill()
+      return null
+    }
     try {
       // Why: shell prechecks can launch child processes; taskkill walks the
       // Windows process tree so timeout means the command is actually stopped.
diff --git a/src/main/browser/anti-detection-permission-status.test.ts b/src/main/browser/anti-detection-permission-status.test.ts
deleted file mode 100644
index d686e32c975..00000000000
--- a/src/main/browser/anti-detection-permission-status.test.ts
+++ /dev/null
@@ -1,210 +0,0 @@
-import { runInNewContext } from 'node:vm'
-import { describe, expect, it } from 'vitest'
-
-import { ANTI_DETECTION_SCRIPT } from './anti-detection'
-
-type PermissionQueryResult = EventTarget & {
-  state: string
-  onchange: EventListener | null
-  marker: string
-}
-
-type PermissionStatusConstructor = {
-  new (): PermissionQueryResult
-  prototype: PermissionQueryResult
-}
-
-type AntiDetectionContext = {
-  Notification: {
-    permission: string
-    requestPermission: (callback?: (permission: string) => void) => Promise<string>
-  }
-  PermissionStatus: PermissionStatusConstructor
-  dispatchPermissionChange: (name: string) => void
-  navigator: {
-    permissions: {
-      query: (descriptor: { name: string }) => Promise<PermissionQueryResult>
-    }
-  }
-}
-
-function createContext(args: {
-  nativeNotificationPermission: string
-  requestedNotificationPermission: string
-  rejectedPermissions?: string[]
-}): AntiDetectionContext & Record<string, unknown> {
-  class PermissionStatus extends EventTarget {
-    #state = 'denied'
-    #onchange: EventListener | null = null
-    marker = 'real-status'
-
-    get state(): string {
-      return this.#state
-    }
-
-    get onchange(): EventListener | null {
-      return this.#onchange
-    }
-
-    set onchange(listener: EventListener | null) {
-      if (this.#onchange) {
-        super.removeEventListener('change', this.#onchange)
-      }
-      this.#onchange = typeof listener === 'function' ? listener : null
-      if (this.#onchange) {
-        super.addEventListener('change', this.#onchange)
-      }
-    }
-  }
-
-  const statuses = new Map<string, PermissionStatus[]>()
-  const rejectedPermissions = new Set(args.rejectedPermissions)
-
-  class Permissions {
-    query(descriptor: { name: string }): Promise<PermissionStatus> {
-      if (rejectedPermissions.has(descriptor.name)) {
-        return Promise.reject(new Error('Unsupported permission'))
-      }
-      const status = new PermissionStatus()
-      const permissionStatuses = statuses.get(descriptor.name) ?? []
-      permissionStatuses.push(status)
-      statuses.set(descriptor.name, permissionStatuses)
-      return Promise.resolve(status)
-    }
-  }
-
-  const Notification = {
-    permission: args.nativeNotificationPermission,
-    requestPermission(callback?: (permission: string) => void): Promise<string> {
-      callback?.(args.requestedNotificationPermission)
-      return Promise.resolve(args.requestedNotificationPermission)
-    }
-  }
-  Object.defineProperty(Notification, 'permission', {
-    configurable: true,
-    get: () => args.nativeNotificationPermission
-  })
-
-  return {
-    Date,
-    Event,
-    EventTarget,
-    Object,
-    Promise,
-    Set,
-    performance: { now: () => 0 },
-    // Why: the script's Firefox gate reads navigator.userAgent, so a non-Firefox UA keeps these
-    // tests on the ordinary-page path where the PermissionStatus override applies.
-    window: { chrome: {} },
-    navigator: {
-      userAgent:
-        'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36',
-      plugins: [],
-      languages: [],
-      permissions: new Permissions()
-    },
-    Permissions,
-    PermissionStatus,
-    Notification,
-    dispatchPermissionChange(name: string): void {
-      for (const status of statuses.get(name) ?? []) {
-        status.dispatchEvent(new Event('change'))
-      }
-    }
-  } as AntiDetectionContext & Record<string, unknown>
-}
-
-describe('ANTI_DETECTION_SCRIPT — PermissionStatus', () => {
-  it('keeps an existing notification status current after permission changes', async () => {
-    const context = createContext({
-      nativeNotificationPermission: 'denied',
-      requestedNotificationPermission: 'granted'
-    })
-
-    runInNewContext(ANTI_DETECTION_SCRIPT, context)
-    const status = await context.navigator.permissions.query({ name: 'notifications' })
-
-    expect(context.Notification.permission).toBe('default')
-    expect(status.state).toBe('prompt')
-
-    await expect(context.Notification.requestPermission()).resolves.toBe('granted')
-
-    expect(context.Notification.permission).toBe('granted')
-    expect(status.state).toBe('granted')
-  })
-
-  it('preserves native PermissionStatus identity and methods', async () => {
-    const context = createContext({
-      nativeNotificationPermission: 'denied',
-      requestedNotificationPermission: 'granted'
-    })
-
-    runInNewContext(ANTI_DETECTION_SCRIPT, context)
-    const status = await context.navigator.permissions.query({ name: 'camera' })
-    const expectedSource = Function.prototype.toString.call(
-      context.PermissionStatus.prototype.addEventListener
-    )
-
-    expect(status).toBeInstanceOf(context.PermissionStatus)
-    expect(status.state).toBe('prompt')
-    expect(status.constructor.name).toBe('PermissionStatus')
-    expect(status.marker).toBe('real-status')
-    expect(status.addEventListener.name).toBe('addEventListener')
-    expect(status.addEventListener).toBe(status.addEventListener)
-    expect(Function.prototype.toString.call(status.addEventListener)).toBe(expectedSource)
-    expect(expectedSource).toContain('addEventListener')
-  })
-
-  it('delivers change events through the returned status with the overridden state', async () => {
-    const context = createContext({
-      nativeNotificationPermission: 'denied',
-      requestedNotificationPermission: 'granted'
-    })
-
-    runInNewContext(ANTI_DETECTION_SCRIPT, context)
-    const status = await context.navigator.permissions.query({ name: 'notifications' })
-    const events: { receiver: EventTarget; target: EventTarget | null; state: string }[] = []
-    const recordEvent = function (this: EventTarget, event: Event): void {
-      events.push({
-        receiver: this,
-        target: event.target,
-        state: (event.target as PermissionQueryResult).state
-      })
-    }
-
-    status.addEventListener('change', recordEvent)
-    expect(() => {
-      status.onchange = function (this: EventTarget, event): void {
-        recordEvent.call(this, event)
-      }
-    }).not.toThrow()
-
-    await context.Notification.requestPermission()
-    context.dispatchPermissionChange('notifications')
-
-    expect(events).toHaveLength(2)
-    expect(events).toEqual([
-      { receiver: status, target: status, state: 'granted' },
-      { receiver: status, target: status, state: 'granted' }
-    ])
-  })
-
-  // Why: 'camera' rather than 'storage-access' — #14685 narrowed the intercepted set to
-  // camera/microphone, so a name outside it falls through to the real query and never reaches
-  // the fallback at all.
-  it('uses a non-enumerable EventTarget fallback when the native query rejects', async () => {
-    const context = createContext({
-      nativeNotificationPermission: 'denied',
-      requestedNotificationPermission: 'granted',
-      rejectedPermissions: ['camera']
-    })
-
-    runInNewContext(ANTI_DETECTION_SCRIPT, context)
-    const status = await context.navigator.permissions.query({ name: 'camera' })
-
-    expect(status).toBeInstanceOf(EventTarget)
-    expect(status).not.toBeInstanceOf(context.PermissionStatus)
-    expect(status.state).toBe('prompt')
-    expect(Object.keys(status)).toEqual([])
-  })
-})
diff --git a/src/main/browser/anti-detection.test.ts b/src/main/browser/anti-detection.test.ts
deleted file mode 100644
index ddb904cb436..00000000000
--- a/src/main/browser/anti-detection.test.ts
+++ /dev/null
@@ -1,157 +0,0 @@
-import { runInNewContext } from 'node:vm'
-import { describe, expect, it } from 'vitest'
-
-import { ANTI_DETECTION_SCRIPT } from './anti-detection'
-import { googleAuthUserAgent } from './browser-google-auth-ua'
-
-type PermissionQueryResult = {
-  state: string
-  onchange: null
-}
-
-type AntiDetectionContext = {
-  Notification: {
-    permission: string
-    requestPermission: (callback?: (permission: string) => void) => Promise<string>
-  }
-  navigator: {
-    userAgent: string
-    permissions: {
-      query: (descriptor: { name: string }) => Promise<PermissionQueryResult>
-    }
-  }
-  window: {
-    chrome?: {
-      runtime?: unknown
-      csi?: () => unknown
-      loadTimes?: () => unknown
-    }
-  }
-}
-
-function createContext(args: {
-  nativeNotificationPermission: string
-  requestedNotificationPermission: string
-  userAgent?: string
-}): AntiDetectionContext & Record<string, unknown> {
-  class Permissions {
-    query(): Promise<PermissionQueryResult> {
-      return Promise.resolve({ state: 'denied', onchange: null })
-    }
-  }
-
-  const Notification = {
-    permission: args.nativeNotificationPermission,
-    requestPermission(callback?: (permission: string) => void): Promise<string> {
-      callback?.(args.requestedNotificationPermission)
-      return Promise.resolve(args.requestedNotificationPermission)
-    }
-  }
-  Object.defineProperty(Notification, 'permission', {
-    configurable: true,
-    get: () => args.nativeNotificationPermission
-  })
-
-  return {
-    Date,
-    Object,
-    Promise,
-    Set,
-    performance: { now: () => 0 },
-    // Electron 43 exposes this native object before the anti-detection script runs.
-    window: { chrome: {} },
-    navigator: {
-      userAgent:
-        args.userAgent ??
-        'Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36',
-      plugins: [],
-      languages: [],
-      permissions: new Permissions()
-    },
-    Permissions,
-    Notification
-  } as AntiDetectionContext & Record<string, unknown>
-}
-
-describe('ANTI_DETECTION_SCRIPT', () => {
-  it('does not expose Chrome globals under a Firefox identity', () => {
-    const context = createContext({
-      nativeNotificationPermission: 'denied',
-      requestedNotificationPermission: 'denied',
-      userAgent: googleAuthUserAgent()
-    })
-
-    runInNewContext(ANTI_DETECTION_SCRIPT, context)
-
-    expect(context.window.chrome).toBeUndefined()
-    expect('chrome' in context.window).toBe(false)
-  })
-
-  it('keeps Chrome API stubs aligned with an ordinary Chrome page', () => {
-    const context = createContext({
-      nativeNotificationPermission: 'denied',
-      requestedNotificationPermission: 'denied'
-    })
-
-    runInNewContext(ANTI_DETECTION_SCRIPT, context)
-
-    expect(context.window.chrome?.runtime).toBeUndefined()
-    expect(context.window.chrome?.csi).toBeTypeOf('function')
-    expect(context.window.chrome?.loadTimes).toBeTypeOf('function')
-  })
-
-  it.each(['geolocation', 'idle-detection', 'midi', 'storage-access'])(
-    'passes non-intercepted permission queries through to the native state for %s',
-    async (name) => {
-      const context = createContext({
-        nativeNotificationPermission: 'denied',
-        requestedNotificationPermission: 'denied'
-      })
-
-      runInNewContext(ANTI_DETECTION_SCRIPT, context)
-
-      await expect(context.navigator.permissions.query({ name })).resolves.toEqual({
-        state: 'denied',
-        onchange: null
-      })
-    }
-  )
-
-  it('reports notification permission as granted after a site permission request succeeds', async () => {
-    const context = createContext({
-      nativeNotificationPermission: 'denied',
-      requestedNotificationPermission: 'granted'
-    })
-
-    runInNewContext(ANTI_DETECTION_SCRIPT, context)
-
-    expect(context.Notification.permission).toBe('default')
-    await expect(context.navigator.permissions.query({ name: 'notifications' })).resolves.toEqual({
-      state: 'prompt',
-      onchange: null
-    })
-
-    await expect(context.Notification.requestPermission()).resolves.toBe('granted')
-
-    expect(context.Notification.permission).toBe('granted')
-    await expect(context.navigator.permissions.query({ name: 'notifications' })).resolves.toEqual({
-      state: 'granted',
-      onchange: null
-    })
-  })
-
-  it('preserves notification permission when Electron already reports a grant', async () => {
-    const context = createContext({
-      nativeNotificationPermission: 'granted',
-      requestedNotificationPermission: 'granted'
-    })
-
-    runInNewContext(ANTI_DETECTION_SCRIPT, context)
-
-    expect(context.Notification.permission).toBe('granted')
-    await expect(context.navigator.permissions.query({ name: 'notifications' })).resolves.toEqual({
-      state: 'granted',
-      onchange: null
-    })
-  })
-})
diff --git a/src/main/browser/anti-detection.ts b/src/main/browser/anti-detection.ts
deleted file mode 100644
index d725fbf965f..00000000000
--- a/src/main/browser/anti-detection.ts
+++ /dev/null
@@ -1,161 +0,0 @@
-// Why: Cloudflare Turnstile and similar bot detectors probe multiple browser
-// APIs beyond navigator.webdriver. This script runs via
-// Page.addScriptToEvaluateOnNewDocument before any page JS to mask automation
-// signals that CDP debugger attachment and Electron's webview expose.
-export const ANTI_DETECTION_SCRIPT = `(function() {
-  Object.defineProperty(navigator, 'webdriver', { get: () => false });
-  // Why: Electron webviews expose an empty plugins array. Real Chrome always
-  // has at least a few default plugins (PDF Viewer, etc.). An empty array is
-  // a strong automation signal.
-  if (navigator.plugins.length === 0) {
-    Object.defineProperty(navigator, 'plugins', {
-      get: () => [
-        { name: 'Chrome PDF Plugin', filename: 'internal-pdf-viewer' },
-        { name: 'Chrome PDF Viewer', filename: 'mhjfbmdgcfjbbpaeojofohoefgiehjai' },
-        { name: 'Native Client', filename: 'internal-nacl-plugin' }
-      ]
-    });
-  }
-  // Why: auth hosts present Firefox, where Electron's native window.chrome is an identity mismatch.
-  if (navigator.userAgent.includes('Firefox/')) {
-    try {
-      delete window.chrome;
-      if ('chrome' in window) {
-        window.chrome = undefined;
-      }
-    } catch {}
-  } else {
-    // Why: Electron webviews may not have the window.chrome object that real
-    // Chrome exposes. Turnstile checks for its presence. The csi() and
-    // loadTimes() stubs satisfy deeper probes of Chrome-specific APIs.
-    if (!window.chrome) {
-      window.chrome = {};
-    }
-    if (!window.chrome.csi) {
-      window.chrome.csi = function() {
-        return {
-          startE: Date.now(),
-          onloadT: Date.now(),
-          pageT: performance.now(),
-          tran: 15
-        };
-      };
-    }
-    if (!window.chrome.loadTimes) {
-      window.chrome.loadTimes = function() {
-        return {
-          commitLoadTime: Date.now() / 1000,
-          connectionInfo: 'h2',
-          finishDocumentLoadTime: Date.now() / 1000,
-          finishLoadTime: Date.now() / 1000,
-          firstPaintAfterLoadTime: 0,
-          firstPaintTime: Date.now() / 1000,
-          navigationType: 'Other',
-          npnNegotiatedProtocol: 'h2',
-          requestTime: Date.now() / 1000 - 0.16,
-          startLoadTime: Date.now() / 1000 - 0.3,
-          wasAlternateProtocolAvailable: false,
-          wasFetchedViaSpdy: true,
-          wasNpnNegotiated: true
-        };
-      };
-    }
-  }
-  // Why: Electron's Permission API defaults to 'denied' for most permissions,
-  // but real Chrome returns 'prompt' for ungranted permissions. Returning
-  // 'denied' is a strong bot signal. Override the query result for common
-  // permissions that Turnstile and similar detectors probe.
-  var notificationPermission = 'default';
-  var setNotificationPermission = function(permission) {
-    if (permission === 'granted' || permission === 'denied') {
-      notificationPermission = permission;
-      return permission;
-    }
-    notificationPermission = 'default';
-    return 'default';
-  };
-  var notificationPermissionState = function() {
-    return notificationPermission === 'default' ? 'prompt' : notificationPermission;
-  };
-  try {
-    if (Notification.permission === 'granted') {
-      notificationPermission = 'granted';
-    }
-  } catch {}
-  const promptPerms = new Set([
-    'camera', 'microphone'
-  ]);
-  const origQuery = Permissions.prototype.query;
-  // Why: sites must receive the genuine PermissionStatus so native events, brand checks and method
-  // identity survive. Shadow only state, and resolve it lazily so existing statuses stay current.
-  function withOverriddenState(realStatus, stateProvider) {
-    Object.defineProperty(realStatus, 'state', {
-      configurable: true,
-      get: stateProvider
-    });
-    return realStatus;
-  }
-  // Why: some names the real implementation rejects outright; fall back to an EventTarget so
-  // listener registration still works instead of throwing.
-  function fallbackStatus(stateProvider) {
-    const status = new EventTarget();
-    Object.defineProperties(status, {
-      state: { configurable: true, get: stateProvider },
-      onchange: { configurable: true, value: null, writable: true }
-    });
-    return status;
-  }
-  function queryWithState(permissions, desc, stateProvider) {
-    let real;
-    try {
-      real = origQuery.call(permissions, desc);
-    } catch {
-      return Promise.resolve(fallbackStatus(stateProvider));
-    }
-    return Promise.resolve(real).then(
-      (status) => withOverriddenState(status, stateProvider),
-      () => fallbackStatus(stateProvider)
-    );
-  }
-  Permissions.prototype.query = function(desc) {
-    if (desc.name === 'notifications') {
-      return queryWithState(this, desc, notificationPermissionState);
-    }
-    if (promptPerms.has(desc.name)) {
-      return queryWithState(this, desc, () => 'prompt');
-    }
-    return origQuery.call(this, desc);
-  };
-  // Why: Electron may report Notification.permission as 'denied' by default
-  // whereas real Chrome reports 'default' for sites that haven't been granted
-  // or blocked. Turnstile cross-references this with the Permissions API.
-  try {
-    Object.defineProperty(Notification, 'permission', {
-      get: () => notificationPermission
-    });
-    const origRequestPermission = Notification.requestPermission;
-    if (typeof origRequestPermission === 'function') {
-      Notification.requestPermission = function(callback) {
-        var wrappedCallback = typeof callback === 'function'
-          ? function(permission) {
-              callback(setNotificationPermission(permission));
-            }
-          : undefined;
-        var result = origRequestPermission.call(Notification, wrappedCallback);
-        if (result && typeof result.then === 'function') {
-          return result.then(function(permission) {
-            return setNotificationPermission(permission);
-          });
-        }
-        return result;
-      };
-    }
-  } catch {}
-  // Why: Electron webviews may have an empty languages array. Real Chrome
-  // always has at least one entry. An empty array is an automation signal.
-  if (!navigator.languages || navigator.languages.length === 0) {
-    Object.defineProperty(navigator, 'languages', {
-      get: () => ['en-US', 'en']
-    });
-  }
-})()`
diff --git a/src/main/browser/browser-clicked-link-routing.test.ts b/src/main/browser/browser-clicked-link-routing.test.ts
index 24c26471c3a..315d6ae1779 100644
--- a/src/main/browser/browser-clicked-link-routing.test.ts
+++ b/src/main/browser/browser-clicked-link-routing.test.ts
@@ -10,6 +10,7 @@ import {
 } from './browser-clicked-link-routing'
 
 const FOREGROUND_FRAME_NAME = '__orca_clicked_link_foreground_test'
+const BACKGROUND_FRAME_NAME = '__orca_clicked_link_background_test'
 
 type RoutingGlobal = typeof globalThis & {
   __orcaBrowserClickedLinkRouting?: {
@@ -32,7 +33,7 @@ function resetRouting(): void {
 }
 
 function installRouting(isMac = true): void {
-  installBrowserClickedLinkRouting(FOREGROUND_FRAME_NAME, isMac, true)
+  installBrowserClickedLinkRouting(FOREGROUND_FRAME_NAME, BACKGROUND_FRAME_NAME, isMac, true)
 }
 
 function clickLink(
@@ -90,7 +91,7 @@ describe('browser clicked-link routing', () => {
     expect(clickLink(link, { metaKey: true }).open).not.toHaveBeenCalled()
     expect(clickLink(link, { ctrlKey: true }).open).toHaveBeenCalledWith(
       'https://example.com/reference',
-      FOREGROUND_FRAME_NAME
+      BACKGROUND_FRAME_NAME
     )
   })
 
@@ -102,7 +103,7 @@ describe('browser clicked-link routing', () => {
 
     expect(clickLink(link, { type: 'auxclick' }).open).toHaveBeenCalledWith(
       'https://example.com/reference',
-      FOREGROUND_FRAME_NAME
+      BACKGROUND_FRAME_NAME
     )
     expect(clickLink(link, { metaKey: true, shiftKey: true }).open).toHaveBeenCalledWith(
       'https://example.com/reference',
@@ -110,6 +111,28 @@ describe('browser clicked-link routing', () => {
     )
   })
 
+  it.each([true, false])('routes Shift+middle-click to the foreground (isMac=%s)', (isMac) => {
+    const link = document.createElement('a')
+    link.href = 'https://example.com/reference'
+    document.body.append(link)
+    installRouting(isMac)
+
+    const { event, open } = clickLink(link, { type: 'auxclick', shiftKey: true })
+    expect(event.defaultPrevented).toBe(true)
+    expect(open).toHaveBeenCalledWith(link.href, FOREGROUND_FRAME_NAME)
+
+    resetRouting()
+    cleanupIframeRouting = installBrowserIframeClickedLinkRouting(
+      FOREGROUND_FRAME_NAME,
+      BACKGROUND_FRAME_NAME,
+      isMac,
+      true
+    )
+    const iframeClick = clickLink(link, { type: 'auxclick', shiftKey: true })
+    expect(iframeClick.event.defaultPrevented).toBe(true)
+    expect(iframeClick.open).toHaveBeenCalledWith(link.href, FOREGROUND_FRAME_NAME)
+  })
+
   it('honors page cancellation and observes link rewrites before routing', () => {
     const cancelled = document.createElement('a')
     cancelled.href = 'https://example.com/original'
@@ -180,21 +203,35 @@ describe('browser clicked-link routing', () => {
     const link = document.createElement('a')
     link.href = 'https://example.com/reference'
     document.body.append(link)
-    installBrowserClickedLinkRouting('__orca_clicked_link_old_fg', true, true)
-    installBrowserClickedLinkRouting('__orca_clicked_link_new_fg', false, true)
+    installBrowserClickedLinkRouting(
+      '__orca_clicked_link_old_fg',
+      '__orca_clicked_link_old_bg',
+      true,
+      true
+    )
+    installBrowserClickedLinkRouting(
+      '__orca_clicked_link_new_fg',
+      '__orca_clicked_link_new_bg',
+      false,
+      true
+    )
 
     expect(addEventListener.mock.calls.filter(([event]) => event === 'click')).toHaveLength(1)
     expect(clickLink(link, { ctrlKey: true }).open).toHaveBeenCalledWith(
       'https://example.com/reference',
-      '__orca_clicked_link_new_fg'
+      '__orca_clicked_link_new_bg'
     )
   })
 
   it('builds a self-contained isolated-world script', () => {
-    const script = buildBrowserClickedLinkRoutingScript(FOREGROUND_FRAME_NAME, false)
+    const script = buildBrowserClickedLinkRoutingScript(
+      FOREGROUND_FRAME_NAME,
+      BACKGROUND_FRAME_NAME,
+      false
+    )
 
     expect(script).toContain('installBrowserClickedLinkRouting')
-    expect(script).toContain(`"${FOREGROUND_FRAME_NAME}",false`)
+    expect(script).toContain(`"${FOREGROUND_FRAME_NAME}","${BACKGROUND_FRAME_NAME}",false`)
     expect(script).not.toContain('BrowserClickedLinkRoutingState')
   })
 
@@ -203,7 +240,12 @@ describe('browser clicked-link routing', () => {
     link.href = 'https://example.com/from-frame'
     link.target = '_blank'
     document.body.append(link)
-    cleanupIframeRouting = installBrowserIframeClickedLinkRouting(FOREGROUND_FRAME_NAME, true, true)
+    cleanupIframeRouting = installBrowserIframeClickedLinkRouting(
+      FOREGROUND_FRAME_NAME,
+      BACKGROUND_FRAME_NAME,
+      true,
+      true
+    )
 
     const { event, open } = clickLink(link)
 
@@ -216,20 +258,35 @@ describe('browser clicked-link routing', () => {
     blank.href = 'https://example.com/new-context'
     blank.target = '_blank'
     document.body.append(blank)
-    cleanupIframeRouting = installBrowserIframeClickedLinkRouting(FOREGROUND_FRAME_NAME, true, true)
+    cleanupIframeRouting = installBrowserIframeClickedLinkRouting(
+      FOREGROUND_FRAME_NAME,
+      BACKGROUND_FRAME_NAME,
+      true,
+      true
+    )
 
     expect(clickLink(blank, { metaKey: true }).open).toHaveBeenCalledWith(
       'https://example.com/new-context',
-      FOREGROUND_FRAME_NAME
+      BACKGROUND_FRAME_NAME
     )
 
-    cleanupIframeRouting = installBrowserIframeClickedLinkRouting(FOREGROUND_FRAME_NAME, true, true)
+    cleanupIframeRouting = installBrowserIframeClickedLinkRouting(
+      FOREGROUND_FRAME_NAME,
+      BACKGROUND_FRAME_NAME,
+      true,
+      true
+    )
     expect(clickLink(blank, { type: 'auxclick' }).open).toHaveBeenCalledWith(
       'https://example.com/new-context',
-      FOREGROUND_FRAME_NAME
+      BACKGROUND_FRAME_NAME
     )
 
-    cleanupIframeRouting = installBrowserIframeClickedLinkRouting(FOREGROUND_FRAME_NAME, true, true)
+    cleanupIframeRouting = installBrowserIframeClickedLinkRouting(
+      FOREGROUND_FRAME_NAME,
+      BACKGROUND_FRAME_NAME,
+      true,
+      true
+    )
     expect(clickLink(blank, { metaKey: true, shiftKey: true }).open).toHaveBeenCalledWith(
       'https://example.com/new-context',
       FOREGROUND_FRAME_NAME
@@ -243,7 +300,12 @@ describe('browser clicked-link routing', () => {
     const ordinary = document.createElement('a')
     ordinary.href = 'https://example.com/current'
     document.body.append(blank, ordinary)
-    cleanupIframeRouting = installBrowserIframeClickedLinkRouting(FOREGROUND_FRAME_NAME, true, true)
+    cleanupIframeRouting = installBrowserIframeClickedLinkRouting(
+      FOREGROUND_FRAME_NAME,
+      BACKGROUND_FRAME_NAME,
+      true,
+      true
+    )
 
     expect(clickLink(blank, { ctrlKey: true }).open).not.toHaveBeenCalled()
     expect(clickLink(blank, { shiftKey: true }).open).not.toHaveBeenCalled()
@@ -257,8 +319,12 @@ describe('browser clicked-link routing', () => {
     frameLink.href = 'https://example.com/frame-synthetic'
     frameLink.target = '_blank'
     document.body.append(mainLink, frameLink)
-    installBrowserClickedLinkRouting(FOREGROUND_FRAME_NAME, true)
-    cleanupIframeRouting = installBrowserIframeClickedLinkRouting(FOREGROUND_FRAME_NAME, true)
+    installBrowserClickedLinkRouting(FOREGROUND_FRAME_NAME, BACKGROUND_FRAME_NAME, true)
+    cleanupIframeRouting = installBrowserIframeClickedLinkRouting(
+      FOREGROUND_FRAME_NAME,
+      BACKGROUND_FRAME_NAME,
+      true
+    )
 
     expect(clickLink(mainLink, { metaKey: true }).open).not.toHaveBeenCalled()
     expect(clickLink(frameLink).open).not.toHaveBeenCalled()
@@ -266,9 +332,13 @@ describe('browser clicked-link routing', () => {
   })
 
   it('builds a self-contained iframe script with per-frame routing tokens', () => {
-    const script = buildBrowserIframeClickedLinkRoutingScript(FOREGROUND_FRAME_NAME, false)
+    const script = buildBrowserIframeClickedLinkRoutingScript(
+      FOREGROUND_FRAME_NAME,
+      BACKGROUND_FRAME_NAME,
+      false
+    )
 
     expect(script).toContain('installBrowserIframeClickedLinkRouting')
-    expect(script).toContain(`"${FOREGROUND_FRAME_NAME}",false`)
+    expect(script).toContain(`"${FOREGROUND_FRAME_NAME}","${BACKGROUND_FRAME_NAME}",false`)
   })
 })
diff --git a/src/main/browser/browser-clicked-link-routing.ts b/src/main/browser/browser-clicked-link-routing.ts
index ee6f2fc43d5..4189f222ef8 100644
--- a/src/main/browser/browser-clicked-link-routing.ts
+++ b/src/main/browser/browser-clicked-link-routing.ts
@@ -1,7 +1,13 @@
 export const BROWSER_CLICKED_LINK_ROUTING_WORLD_ID = 1208
 
+export type BrowserClickedLinkFrameNames = {
+  foreground: string
+  background: string
+}
+
 type BrowserClickedLinkRoutingState = {
-  frameName: string
+  foregroundFrameName: string
+  backgroundFrameName: string
   isMac: boolean
   allowUntrustedEvents: boolean
   listener: (event: MouseEvent) => void
@@ -16,21 +22,24 @@ type BrowserClickedLinkRoutingGlobal = typeof globalThis & {
  * can distinguish them from opener-dependent window.open calls.
  */
 export function installBrowserClickedLinkRouting(
-  frameName: string,
+  foregroundFrameName: string,
+  backgroundFrameName: string,
   isMac: boolean,
   allowUntrustedEvents = false
 ): void {
   const routingGlobal = globalThis as BrowserClickedLinkRoutingGlobal
   const existing = routingGlobal.__orcaBrowserClickedLinkRouting
   if (existing) {
-    existing.frameName = frameName
+    existing.foregroundFrameName = foregroundFrameName
+    existing.backgroundFrameName = backgroundFrameName
     existing.isMac = isMac
     existing.allowUntrustedEvents = allowUntrustedEvents
     return
   }
 
   const state: BrowserClickedLinkRoutingState = {
-    frameName,
+    foregroundFrameName,
+    backgroundFrameName,
     isMac,
     allowUntrustedEvents,
     listener: () => {}
@@ -68,7 +77,7 @@ export function installBrowserClickedLinkRouting(
     }
     // Shift alone is browser-native new-window intent; keep OAuth and other
     // opener-dependent window flows in Orca's guarded popup window.
-    if (event.shiftKey && !modifierClick) {
+    if (event.shiftKey && !modifierClick && !middleClick) {
       return
     }
 
@@ -101,7 +110,11 @@ export function installBrowserClickedLinkRouting(
     // with the same disposition. The private frame name preserves that one
     // distinction without weakening OAuth popups that need window.opener.
     event.preventDefault()
-    window.open(targetUrl.toString(), state.frameName)
+    const openInBackground = (middleClick || modifierClick) && !event.shiftKey
+    window.open(
+      targetUrl.toString(),
+      openInBackground ? state.backgroundFrameName : state.foregroundFrameName
+    )
   }
   routingGlobal.__orcaBrowserClickedLinkRouting = state
 
@@ -116,7 +129,8 @@ export function installBrowserClickedLinkRouting(
  * API cannot reach, so this runs in the page world against a one-use token.
  */
 export function installBrowserIframeClickedLinkRouting(
-  frameName: string,
+  foregroundFrameName: string,
+  backgroundFrameName: string,
   isMac: boolean,
   allowUntrustedEvents = false
 ): () => void {
@@ -148,7 +162,7 @@ export function installBrowserIframeClickedLinkRouting(
 
     const modifierClick = isMac ? event.metaKey : event.ctrlKey
     const otherPlatformModifier = isMac ? event.ctrlKey : event.metaKey
-    if (otherPlatformModifier || (event.shiftKey && !modifierClick)) {
+    if (otherPlatformModifier || (event.shiftKey && !modifierClick && !middleClick)) {
       return
     }
 
@@ -179,7 +193,8 @@ export function installBrowserIframeClickedLinkRouting(
     // A page that observes a real click cannot replay it to create more tabs.
     event.preventDefault()
     cleanup()
-    window.open(targetUrl.toString(), frameName)
+    const openInBackground = (middleClick || modifierClick) && !event.shiftKey
+    window.open(targetUrl.toString(), openInBackground ? backgroundFrameName : foregroundFrameName)
   }
 
   const cleanup = (): void => {
@@ -191,13 +206,18 @@ export function installBrowserIframeClickedLinkRouting(
   return cleanup
 }
 
-export function buildBrowserClickedLinkRoutingScript(frameName: string, isMac: boolean): string {
-  return `(${installBrowserClickedLinkRouting.toString()})(${JSON.stringify(frameName)},${JSON.stringify(isMac)});`
+export function buildBrowserClickedLinkRoutingScript(
+  foregroundFrameName: string,
+  backgroundFrameName: string,
+  isMac: boolean
+): string {
+  return `(${installBrowserClickedLinkRouting.toString()})(${JSON.stringify(foregroundFrameName)},${JSON.stringify(backgroundFrameName)},${JSON.stringify(isMac)});`
 }
 
 export function buildBrowserIframeClickedLinkRoutingScript(
-  frameName: string,
+  foregroundFrameName: string,
+  backgroundFrameName: string,
   isMac: boolean
 ): string {
-  return `void (${installBrowserIframeClickedLinkRouting.toString()})(${JSON.stringify(frameName)},${JSON.stringify(isMac)});`
+  return `void (${installBrowserIframeClickedLinkRouting.toString()})(${JSON.stringify(foregroundFrameName)},${JSON.stringify(backgroundFrameName)},${JSON.stringify(isMac)});`
 }
diff --git a/src/main/browser/browser-client-upload-transfer.test.ts b/src/main/browser/browser-client-upload-transfer.test.ts
index fdc129618e8..84bb649abd3 100644
--- a/src/main/browser/browser-client-upload-transfer.test.ts
+++ b/src/main/browser/browser-client-upload-transfer.test.ts
@@ -1,4 +1,4 @@
-import { describe, expect, it } from 'vitest'
+import { describe, expect, it, vi } from 'vitest'
 
 import type { BrowserClientHostCommandEvent } from '../../shared/browser-client-host-protocol'
 import {
@@ -102,3 +102,38 @@ describe('readBrowserClientUploadPaths', () => {
     )
   })
 })
+
+it.each([0, 1, 128 * 1024])(
+  'avoids recopying 16 single-chunk uploads of %i bytes',
+  async (size) => {
+    const source = Buffer.alloc(size, 171)
+    const response = {
+      contentBase64: source.toString('base64'),
+      bytesRead: size,
+      totalBytes: size,
+      eof: true
+    }
+    const remotePaths = Array.from({ length: 16 }, (_, i) => `file-${i}.bin`)
+    const request = vi.fn(async () => response)
+    const concat = vi.spyOn(Buffer, 'concat')
+    let copies = 0
+    let files: Awaited<ReturnType<typeof fetchBrowserClientUploadFiles>>
+    try {
+      files = await fetchBrowserClientUploadFiles({ request, event, remotePaths })
+      copies = concat.mock.calls.length
+    } finally {
+      concat.mockRestore()
+    }
+    expect(copies).toBe(0)
+    expect(request).toHaveBeenCalledTimes(16)
+    expect(files.map((file) => file.remotePath)).toEqual(remotePaths)
+    for (const file of files) {
+      expect(file.contents).toEqual(source)
+    }
+    if (size > 0) {
+      files[0].contents[0] = 0
+      expect(files[1].contents[0]).toBe(171)
+      expect(source[0]).toBe(171)
+    }
+  }
+)
diff --git a/src/main/browser/browser-client-upload-transfer.ts b/src/main/browser/browser-client-upload-transfer.ts
index 1863f7b9f75..f85af071633 100644
--- a/src/main/browser/browser-client-upload-transfer.ts
+++ b/src/main/browser/browser-client-upload-transfer.ts
@@ -74,7 +74,7 @@ export async function fetchBrowserClientUploadFiles(options: {
         throw new Error('browser_client_upload_transfer_stalled')
       }
     }
-    files.push({ remotePath, contents: Buffer.concat(chunks) })
+    files.push({ remotePath, contents: chunks.length === 1 ? chunks[0] : Buffer.concat(chunks) })
   }
   return files
 }
diff --git a/src/main/browser/browser-google-auth-ua.ts b/src/main/browser/browser-google-auth-ua.ts
index 16ed14eb80f..e9b802f6d70 100644
--- a/src/main/browser/browser-google-auth-ua.ts
+++ b/src/main/browser/browser-google-auth-ua.ts
@@ -1,12 +1,12 @@
 // Why: Google binds a signed-in session to the browser identity that created it.
-// Cookies copied in from another browser (or sent under an Electron/Chrome-shaped
-// UA that doesn't match a real first-party browser) get flagged by anti-fraud on
-// accounts.google.com and expire within ~1h. Presenting a Firefox identity scoped
+// Cookies copied in from another browser (or sent under a UA that doesn't match a
+// real first-party browser) get flagged by anti-fraud on accounts.google.com and
+// expire within ~1h. Presenting a Firefox identity scoped
 // to Google's auth hosts lets the user sign in *inside* the embedded browser, so
 // Google issues cookies bound to THIS browser that self-refresh — instead of us
 // transplanting cookies that go stale. Scope is deliberately the auth hosts only:
 // post-auth app surfaces (mail.google.com, myaccount.google.com, drive, etc.) keep
-// the profile's real Chrome-shaped identity so nothing else about the session shifts.
+// the profile's real identity so nothing else about the session shifts.
 
 // Why: exact hostname match — subdomains such as myaccount.google.com are post-auth
 // app surfaces, not the sign-in flow, and must retain the profile's real identity.
diff --git a/src/main/browser/browser-manager-auth-user-agent.test.ts b/src/main/browser/browser-manager-auth-user-agent.test.ts
index 405b689e850..eb0bd75b354 100644
--- a/src/main/browser/browser-manager-auth-user-agent.test.ts
+++ b/src/main/browser/browser-manager-auth-user-agent.test.ts
@@ -51,7 +51,7 @@ import {
 import {
   createViewportGuestFactory,
   flushViewportOps,
-  GUEST_CLEAN_UA
+  GUEST_ELECTRON_UA
 } from './browser-manager-viewport-test-fixtures'
 
 const {
@@ -197,8 +197,9 @@ describe('browserManager', () => {
 
   // Why: popup child windows get attachGuestPolicies but are never entered into tabIdByWebContentsId,
   // so a direct lookup of the UA mode misses the native opt-out. That is worse than doing nothing —
-  // native sessions skip setupClientHintsOverride, so the popup would send the raw Electron UA on the
-  // wire while navigator.userAgent claimed Firefox. Google sign-in popups are a first-class surface.
+  // native sessions never install the header-level Firefox switch, so the popup would send the
+  // Electron UA on the wire while navigator.userAgent claimed Firefox. Google sign-in popups are a
+  // first-class surface.
   it('leaves the UA untouched on auth hosts for a popup owned by a native-UA profile', () => {
     const ownerGuest = {
       id: 415,
@@ -543,7 +544,7 @@ describe('browserManager', () => {
     )
     expect(uaWrites.length).toBeGreaterThan(0)
     for (const [, params] of uaWrites) {
-      expect((params as { userAgent: string }).userAgent).toBe(GUEST_CLEAN_UA)
+      expect((params as { userAgent: string }).userAgent).toBe(GUEST_ELECTRON_UA)
     }
   })
 })
diff --git a/src/main/browser/browser-manager-final.ts b/src/main/browser/browser-manager-final.ts
index b19369fc91d..49a5110ce54 100644
--- a/src/main/browser/browser-manager-final.ts
+++ b/src/main/browser/browser-manager-final.ts
@@ -3,7 +3,7 @@ import { normalizeBrowserNavigationUrl } from '../../shared/browser-url'
 import { BrowserManagerEventForwarding } from './browser-manager-event-forwarding'
 
 export abstract class BrowserManagerFinal extends BrowserManagerEventForwarding {
-  protected openLinkInOrcaTab(browserTabId: string, rawUrl: string): boolean {
+  protected openLinkInOrcaTab(browserTabId: string, rawUrl: string, activate?: boolean): boolean {
     const renderer = this.resolveRendererForBrowserTab(browserTabId)
     if (!renderer) {
       return false
@@ -15,7 +15,8 @@ export abstract class BrowserManagerFinal extends BrowserManagerEventForwarding
     // Why: only the renderer owns Orca's worktree/tab model; main forwards a validated URL, never letting guest content mutate it.
     renderer.send('browser:open-link-in-orca-tab', {
       browserPageId: browserTabId,
-      url: normalizedUrl
+      url: normalizedUrl,
+      ...(activate === false ? { activate: false } : {})
     })
     return true
   }
diff --git a/src/main/browser/browser-manager-guest-cleanup.ts b/src/main/browser/browser-manager-guest-cleanup.ts
index 9dac4f3f665..a815e95e431 100644
--- a/src/main/browser/browser-manager-guest-cleanup.ts
+++ b/src/main/browser/browser-manager-guest-cleanup.ts
@@ -20,7 +20,6 @@ export abstract class BrowserManagerGuestCleanup extends BrowserManagerGuestNavi
       this.policyCleanupByGuestId.delete(guestWebContentsId)
     }
     this.policyAttachedGuestIds.delete(guestWebContentsId)
-    this.clickedLinkFrameNameByGuestId.delete(guestWebContentsId)
     this.offscreenGuestIds.delete(guestWebContentsId)
     this.popupOwnerContextByGuestId.delete(guestWebContentsId)
     this.pageInitiatedTabBudgetByRootGuestId.delete(guestWebContentsId)
diff --git a/src/main/browser/browser-manager-guest-lifecycle.test.ts b/src/main/browser/browser-manager-guest-lifecycle.test.ts
index c8550083dfc..425d1fe59f6 100644
--- a/src/main/browser/browser-manager-guest-lifecycle.test.ts
+++ b/src/main/browser/browser-manager-guest-lifecycle.test.ts
@@ -288,19 +288,17 @@ describe('browserManager', () => {
       webContentsId: 102,
       rendererWebContentsId
     })
-    // Why: attach-before-registration teardown skips unregisterGuest, so global
-    // cleanup must independently release the private click-routing token.
-    browserManager.attachGuestPolicies({ ...guest, id: 103 } as never)
+    // Guests attached before registration still need their policy listeners released.
+    const unregisteredGuestOff = vi.fn()
+    browserManager.attachGuestPolicies({ ...guest, id: 103, off: unregisteredGuestOff } as never)
 
     browserManager.unregisterAll()
 
     expect(browserManager.getGuestWebContentsId('browser-1')).toBeNull()
     expect(browserManager.getGuestWebContentsId('browser-2')).toBeNull()
     expect(guestOffMock).toHaveBeenCalled()
-    const managerState = browserManager as unknown as {
-      clickedLinkFrameNameByGuestId: Map<number, unknown>
-    }
-    expect(managerState.clickedLinkFrameNameByGuestId.size).toBe(0)
+    expect(unregisteredGuestOff).toHaveBeenCalledWith('dom-ready', expect.any(Function))
+    expect(unregisteredGuestOff).toHaveBeenCalledWith('frame-created', expect.any(Function))
   })
 
   it('rejects non-webview guest types to prevent privilege escalation', () => {
@@ -637,9 +635,9 @@ describe('browserManager', () => {
     ).toHaveLength(2)
   })
 
-  it('cancels pending anti-detection reattach timers when unregistering a guest', () => {
-    vi.useFakeTimers()
-
+  // Why: a plain browsing tab must never attach a debugger (Cloudflare treats CDP as a bot signal);
+  // the only debugger wiring it keeps is the detach listener that invalidates the auth-host UA override.
+  it('never attaches a debugger to a browsing guest and drops its detach listener on unregister', () => {
     const debuggerHandlers = new Map<string, () => void>()
     const debuggerAttachMock = vi.fn()
     const guest = {
@@ -670,18 +668,17 @@ describe('browserManager', () => {
 
     browserManager.attachGuestPolicies(guest as never)
     browserManager.registerGuest({
-      browserPageId: 'browser-reattach',
+      browserPageId: 'browser-no-debugger',
       webContentsId: 809,
       rendererWebContentsId
     })
 
-    debuggerHandlers.get('detach')?.()
-    expect(vi.getTimerCount()).toBe(1)
+    expect(debuggerAttachMock).not.toHaveBeenCalled()
+    expect(guest.debugger.sendCommand).not.toHaveBeenCalled()
+    expect(debuggerHandlers.has('detach')).toBe(true)
 
-    browserManager.unregisterGuest('browser-reattach')
-    expect(vi.getTimerCount()).toBe(0)
-
-    vi.advanceTimersByTime(500)
-    expect(debuggerAttachMock).toHaveBeenCalledTimes(1)
+    browserManager.unregisterGuest('browser-no-debugger')
+    expect(debuggerHandlers.has('detach')).toBe(false)
+    expect(debuggerAttachMock).not.toHaveBeenCalled()
   })
 })
diff --git a/src/main/browser/browser-manager-guest-policy-profile.test.ts b/src/main/browser/browser-manager-guest-policy-profile.test.ts
index 47871f64ea9..c5c4c2521fe 100644
--- a/src/main/browser/browser-manager-guest-policy-profile.test.ts
+++ b/src/main/browser/browser-manager-guest-policy-profile.test.ts
@@ -52,6 +52,8 @@ type GuestFake = {
     isAttached: () => boolean
     attach: ReturnType<typeof vi.fn>
     sendCommand: ReturnType<typeof vi.fn>
+    on: ReturnType<typeof vi.fn>
+    off: ReturnType<typeof vi.fn>
   }
   on: (event: string, listener: (...args: never[]) => void) => void
   once: (event: string, listener: (...args: never[]) => void) => void
@@ -81,7 +83,9 @@ function createGuest(id: number, url: string): GuestFake {
     debugger: {
       isAttached: () => true,
       attach: vi.fn(),
-      sendCommand: vi.fn(async () => undefined)
+      sendCommand: vi.fn(async () => undefined),
+      on: vi.fn(),
+      off: vi.fn()
     },
     on: (event, listener) => {
       listeners.set(event, [...(listeners.get(event) ?? []), listener])
@@ -143,7 +147,7 @@ describe('guest policy profiles', () => {
   // The presence half of every absence below: a browsing guest observably takes all of it through
   // the same method, so a profile that fenced nothing — or an attach path that stopped installing
   // anything at all — cannot pass these by being uniformly empty.
-  it('gives a browsing guest link routing, popups and anti-detection', () => {
+  it('gives a browsing guest link routing, popups and auth-identity detach tracking', () => {
     const guest = createGuest(300, 'https://example.com/')
 
     browserManager.attachGuestPolicies(guest as never)
@@ -151,7 +155,10 @@ describe('guest policy profiles', () => {
     expect(listenerCount(guest, 'dom-ready')).toBe(1)
     expect(listenerCount(guest, 'frame-created')).toBe(1)
     expect(listenerCount(guest, 'did-create-window')).toBe(1)
-    expect(guest.debugger.sendCommand).toHaveBeenCalled()
+    expect(guest.debugger.on).toHaveBeenCalledWith('detach', expect.any(Function))
+    // Why: a plain browsing tab must never attach a debugger; Cloudflare treats CDP as a bot signal.
+    expect(guest.debugger.attach).not.toHaveBeenCalled()
+    expect(guest.debugger.sendCommand).not.toHaveBeenCalled()
     expect(navigateTo(guest, 'https://elsewhere.example/')).toBe(false)
   })
 
@@ -161,6 +168,7 @@ describe('guest policy profiles', () => {
     expect(listenerCount(guest, 'dom-ready')).toBe(0)
     expect(listenerCount(guest, 'frame-created')).toBe(0)
     expect(listenerCount(guest, 'did-create-window')).toBe(0)
+    expect(guest.debugger.on).not.toHaveBeenCalled()
     expect(guest.debugger.sendCommand).not.toHaveBeenCalled()
     expect(guest.executeJavaScriptInIsolatedWorld).not.toHaveBeenCalled()
   })
diff --git a/src/main/browser/browser-manager-guest-policy.ts b/src/main/browser/browser-manager-guest-policy.ts
index c0d522235c8..dd418d71af7 100644
--- a/src/main/browser/browser-manager-guest-policy.ts
+++ b/src/main/browser/browser-manager-guest-policy.ts
@@ -1,4 +1,3 @@
-import { randomUUID } from 'node:crypto'
 import {
   BROWSING_GUEST_POLICY,
   type BrowserGuestPolicy,
@@ -27,31 +26,22 @@ export abstract class BrowserManagerGuestPolicy extends BrowserManagerGuestClean
     if (inheritedOwnerContext) {
       this.popupOwnerContextByGuestId.set(guest.id, inheritedOwnerContext)
     }
-    // Why: only the primary embedded browser converts new-tab clicks to Orca tabs; OAuth child windows keep native link behavior.
-    const clickedLinkFrameName = inheritedOwnerContext
-      ? null
-      : `__orca_clicked_link_foreground_${randomUUID()}`
-    if (clickedLinkFrameName) {
-      this.clickedLinkFrameNameByGuestId.set(guest.id, clickedLinkFrameName)
-    }
-
-    // Why: bot detectors probe APIs that differ in Electron webviews; inject overrides each load so manual browsing passes.
-    const disposeAntiDetection = this.injectAntiDetection(guest)
+    const disposeAuthDetachTracking = this.trackDebuggerDetachForAuthUserAgent(guest)
     // Why: disable throttling so background screenshots still get frames; else the compositor stalls and capture returns empty.
     guest.setBackgroundThrottling(false)
-    const disposePopupPolicy = this.installGuestPopupPolicy(guest, clickedLinkFrameName)
+    const disposePopupPolicy = this.installGuestPopupPolicy(guest, !inheritedOwnerContext)
     const disposeNavigationPolicy = this.installGuestNavigationPolicy(guest)
 
     // Why: store cleanup so unregisterGuest can drop these listeners on teardown and let the WebContents wrapper GC.
     this.policyCleanupByGuestId.set(guest.id, () => {
-      disposeAntiDetection()
+      disposeAuthDetachTracking()
       disposePopupPolicy()
       disposeNavigationPolicy()
     })
   }
 
   /**
-   * A workspace document is not the web: no popups, no link routing, no anti-detection, and no
+   * A workspace document is not the web: no popups, no link routing, no auth-identity tracking, and no
    * navigation bookkeeping for chrome it does not have. What it does share with a browsing guest is
    * this method's teardown, so a retired preview drops its listeners on the same path.
    */
diff --git a/src/main/browser/browser-manager-guest-popup-policy.ts b/src/main/browser/browser-manager-guest-popup-policy.ts
index 43133fd8e29..70c3ef5abb6 100644
--- a/src/main/browser/browser-manager-guest-popup-policy.ts
+++ b/src/main/browser/browser-manager-guest-popup-policy.ts
@@ -9,7 +9,8 @@ import {
 import {
   BROWSER_CLICKED_LINK_ROUTING_WORLD_ID,
   buildBrowserClickedLinkRoutingScript,
-  buildBrowserIframeClickedLinkRoutingScript
+  buildBrowserIframeClickedLinkRoutingScript,
+  type BrowserClickedLinkFrameNames
 } from './browser-clicked-link-routing'
 import { isNewBrowserTabPopupIntent } from './browser-popup-new-tab-intent'
 import { SAFE_POPUP_WINDOW_OPTIONS, safeOrigin } from './browser-manager-types'
@@ -19,11 +20,18 @@ import { BrowserManagerNavigation } from './browser-manager-navigation'
 export abstract class BrowserManagerGuestPopupPolicy extends BrowserManagerNavigation {
   protected installGuestPopupPolicy(
     guest: Electron.WebContents,
-    clickedLinkFrameName: string | null
+    routeClickedLinks: boolean
   ): () => void {
-    let clickedLinkRoutingActive = Boolean(clickedLinkFrameName)
+    // OAuth child windows keep native link behavior.
+    const clickedLinkFrameNames: BrowserClickedLinkFrameNames | null = routeClickedLinks
+      ? {
+          foreground: `__orca_clicked_link_foreground_${randomUUID()}`,
+          background: `__orca_clicked_link_background_${randomUUID()}`
+        }
+      : null
+    let clickedLinkRoutingActive = routeClickedLinks
     const installClickedLinkRouting = (): void => {
-      if (!clickedLinkRoutingActive || !clickedLinkFrameName || guest.isDestroyed()) {
+      if (!clickedLinkRoutingActive || !clickedLinkFrameNames || guest.isDestroyed()) {
         return
       }
       // Why: an isolated-world listener labels real anchor clicks without exposing the frame name to page scripts.
@@ -34,7 +42,8 @@ export abstract class BrowserManagerGuestPopupPolicy extends BrowserManagerNavig
             {
               // Why: mobile emulation spoofs the UA as iOS, so use the real host platform from main for modifier routing.
               code: buildBrowserClickedLinkRoutingScript(
-                clickedLinkFrameName,
+                clickedLinkFrameNames.foreground,
+                clickedLinkFrameNames.background,
                 process.platform === 'darwin'
               )
             }
@@ -43,36 +52,50 @@ export abstract class BrowserManagerGuestPopupPolicy extends BrowserManagerNavig
         )
         .catch(() => {})
     }
-    if (clickedLinkFrameName) {
+    if (clickedLinkFrameNames) {
       guest.on('dom-ready', installClickedLinkRouting)
     }
     const pendingIframeRoutingInstalls = new Map<Electron.WebFrameMain, () => void>()
-    const iframeFrameNameByFrame = new Map<Electron.WebFrameMain, string>()
-    const iframeFrameByFrameName = new Map<string, Electron.WebFrameMain>()
+    const iframeFrameNamesByFrame = new Map<Electron.WebFrameMain, BrowserClickedLinkFrameNames>()
+    const iframeRoutingByFrameName = new Map<
+      string,
+      { frame: Electron.WebFrameMain; activate: boolean }
+    >()
     const clearIframeFrameName = (frame: Electron.WebFrameMain): void => {
-      const name = iframeFrameNameByFrame.get(frame)
-      if (!name) {
+      const names = iframeFrameNamesByFrame.get(frame)
+      if (!names) {
         return
       }
-      iframeFrameNameByFrame.delete(frame)
-      iframeFrameByFrameName.delete(name)
+      iframeFrameNamesByFrame.delete(frame)
+      for (const name of [names.foreground, names.background]) {
+        iframeRoutingByFrameName.delete(name)
+      }
     }
     const installIframeClickedLinkRouting = (frame: Electron.WebFrameMain): void => {
       clearIframeFrameName(frame)
       if (!clickedLinkRoutingActive || frame.isDestroyed()) {
         return
       }
-      const name = `__orca_clicked_link_iframe_foreground_${randomUUID()}`
-      iframeFrameNameByFrame.set(frame, name)
-      iframeFrameByFrameName.set(name, frame)
+      const foregroundName = `__orca_clicked_link_iframe_foreground_${randomUUID()}`
+      const backgroundName = `__orca_clicked_link_iframe_background_${randomUUID()}`
+      iframeFrameNamesByFrame.set(frame, {
+        foreground: foregroundName,
+        background: backgroundName
+      })
+      iframeRoutingByFrameName.set(foregroundName, { frame, activate: true })
+      iframeRoutingByFrameName.set(backgroundName, { frame, activate: false })
       // Why: child-frame tokens live in the page world, so consume after one trusted click and replace before the next.
       void frame
         .executeJavaScript(
-          buildBrowserIframeClickedLinkRoutingScript(name, process.platform === 'darwin'),
+          buildBrowserIframeClickedLinkRoutingScript(
+            foregroundName,
+            backgroundName,
+            process.platform === 'darwin'
+          ),
           false
         )
         .catch(() => {
-          if (iframeFrameNameByFrame.get(frame) === name) {
+          if (iframeFrameNamesByFrame.get(frame)?.foreground === foregroundName) {
             clearIframeFrameName(frame)
           }
         })
@@ -81,10 +104,10 @@ export abstract class BrowserManagerGuestPopupPolicy extends BrowserManagerNavig
       _event: Electron.Event,
       { frame }: Electron.FrameCreatedDetails
     ): void => {
-      if (!clickedLinkFrameName || !frame || frame.parent === null) {
+      if (!clickedLinkFrameNames || !frame || frame.parent === null) {
         return
       }
-      for (const knownFrame of iframeFrameNameByFrame.keys()) {
+      for (const knownFrame of iframeFrameNamesByFrame.keys()) {
         if (knownFrame.isDestroyed()) {
           clearIframeFrameName(knownFrame)
         }
@@ -96,7 +119,7 @@ export abstract class BrowserManagerGuestPopupPolicy extends BrowserManagerNavig
       pendingIframeRoutingInstalls.set(frame, installAfterDomReady)
       frame.once('dom-ready', installAfterDomReady)
     }
-    if (clickedLinkFrameName) {
+    if (clickedLinkFrameNames) {
       guest.on('frame-created', handleFrameCreated)
     }
     const handleDidCreateWindow = (window: Electron.BrowserWindow): void => {
@@ -109,19 +132,28 @@ export abstract class BrowserManagerGuestPopupPolicy extends BrowserManagerNavig
       const browserTabId = ownerContext?.browserTabId ?? null
       const browserUrl = normalizeBrowserNavigationUrl(url)
       const externalUrl = normalizeExternalBrowserUrl(url)
-      const expectedClickedLinkFrameName = this.clickedLinkFrameNameByGuestId.get(guest.id)
-      const iframeFrame = frameName ? iframeFrameByFrameName.get(frameName) : undefined
-      let isClickedLink = Boolean(
-        expectedClickedLinkFrameName && frameName === expectedClickedLinkFrameName
-      )
-      if (!isClickedLink && iframeFrame) {
-        isClickedLink = true
-        clearIframeFrameName(iframeFrame)
-        queueMicrotask(() => installIframeClickedLinkRouting(iframeFrame))
+      const expectedClickedLinkFrameNames = clickedLinkRoutingActive ? clickedLinkFrameNames : null
+      const iframeRouting = frameName ? iframeRoutingByFrameName.get(frameName) : undefined
+      let clickedLinkActivate: boolean | null = null
+      if (expectedClickedLinkFrameNames && frameName === expectedClickedLinkFrameNames.foreground) {
+        clickedLinkActivate = true
+      } else if (
+        expectedClickedLinkFrameNames &&
+        frameName === expectedClickedLinkFrameNames.background
+      ) {
+        clickedLinkActivate = false
+      } else if (iframeRouting) {
+        clickedLinkActivate = iframeRouting.activate
+        clearIframeFrameName(iframeRouting.frame)
+        queueMicrotask(() => installIframeClickedLinkRouting(iframeRouting.frame))
       }
 
-      if (isClickedLink) {
-        if (browserTabId && browserUrl && this.openLinkInOrcaTab(browserTabId, browserUrl)) {
+      if (clickedLinkActivate !== null) {
+        if (
+          browserTabId &&
+          browserUrl &&
+          this.openLinkInOrcaTab(browserTabId, browserUrl, clickedLinkActivate)
+        ) {
           this.forwardOrQueuePopupEvent(guest.id, {
             origin: safeOrigin(browserUrl),
             action: 'opened-in-orca'
@@ -148,7 +180,13 @@ export abstract class BrowserManagerGuestPopupPolicy extends BrowserManagerNavig
           })
           return { action: 'deny' }
         }
-        if (this.openLinkInOrcaTab(ownerContext.browserTabId, externalUrl)) {
+        if (
+          this.openLinkInOrcaTab(
+            ownerContext.browserTabId,
+            externalUrl,
+            disposition !== 'background-tab'
+          )
+        ) {
           this.forwardOrQueuePopupEvent(guest.id, {
             origin: safeOrigin(externalUrl),
             action: 'opened-in-orca'
@@ -190,7 +228,7 @@ export abstract class BrowserManagerGuestPopupPolicy extends BrowserManagerNavig
       clickedLinkRoutingActive = false
       try {
         guest.off('did-create-window', handleDidCreateWindow)
-        if (clickedLinkFrameName) {
+        if (clickedLinkFrameNames) {
           guest.off('dom-ready', installClickedLinkRouting)
           guest.off('frame-created', handleFrameCreated)
           for (const [frame, install] of pendingIframeRoutingInstalls) {
@@ -199,8 +237,8 @@ export abstract class BrowserManagerGuestPopupPolicy extends BrowserManagerNavig
             }
           }
           pendingIframeRoutingInstalls.clear()
-          iframeFrameNameByFrame.clear()
-          iframeFrameByFrameName.clear()
+          iframeFrameNamesByFrame.clear()
+          iframeRoutingByFrameName.clear()
         }
       } catch {
         // guest may already be destroyed
diff --git a/src/main/browser/browser-manager-navigation.ts b/src/main/browser/browser-manager-navigation.ts
index 4e061d288aa..5cb46ccb682 100644
--- a/src/main/browser/browser-manager-navigation.ts
+++ b/src/main/browser/browser-manager-navigation.ts
@@ -1,5 +1,4 @@
 import { openPopupWithOriginBar, type PopupChildWindowOptions } from './popup-origin-bar-window'
-import { cleanElectronUserAgent } from './browser-session-ua'
 import { getBrowserSessionUserAgentMode } from './browser-session-user-agent-mode'
 import { googleAuthUserAgent, isGoogleAuthUrl } from './browser-google-auth-ua'
 import { buildViewportUserAgentOverride } from './browser-viewport-user-agent'
@@ -12,10 +11,10 @@ import { BrowserManagerVisibility } from './browser-manager-visibility'
 
 export abstract class BrowserManagerNavigation extends BrowserManagerVisibility {
   // Why: navigator.userAgent (read by Google's auth JS) reflects the WebContents UA,
-  // not the request header, so the header-level Firefox switch in setupClientHintsOverride
+  // not the request header, so the header-level Firefox switch in setupGoogleAuthUserAgentOverride
   // must be matched here per navigation or the two layers disagree — itself a bot tell.
   // Restores the session's base identity off the auth hosts. Native-UA profiles opt out
-  // of the whole clean-UA path, so they keep their untouched identity everywhere.
+  // of the Firefox switch, so they keep their untouched identity everywhere.
   protected applyGoogleAuthUserAgent(
     guest: Electron.WebContents,
     url: string,
@@ -24,8 +23,8 @@ export abstract class BrowserManagerNavigation extends BrowserManagerVisibility
     const browserPageId = this.tabIdByWebContentsId.get(guest.id)
     // Why: popup child windows get these policies but are never in tabIdByWebContentsId, so a direct
     // lookup misses the native-UA opt-out and would hand a native profile's popup the Firefox UA.
-    // That is worse than doing nothing: native sessions skip setupClientHintsOverride entirely, so
-    // the popup would send the raw Electron UA on the wire while navigator.userAgent claims Firefox.
+    // That is worse than doing nothing: native sessions never install the header-level Firefox
+    // switch, so the popup would send the Electron UA on the wire while navigator.userAgent claims Firefox.
     const ownerTabId = this.resolveBrowserTabIdForGuestWebContentsId(guest.id)
     // Session state is authoritative before renderer registration and after a native profile imports a source UA.
     const mode =
@@ -56,15 +55,14 @@ export abstract class BrowserManagerNavigation extends BrowserManagerVisibility
       // navigation (ERR_ABORTED) and replay the original request, which a POST-started OAuth chain
       // cannot survive — the sign-in lands on a blank tab. CDP retargets navigator.userAgent without
       // touching the navigation, and it outranks the WebContents UA from then on, so a guest that
-      // switches to it stays on it. The wire UA never depended on this write: setupClientHintsOverride
-      // rewrites User-Agent per request for auth-host URLs on its own.
+      // switches to it stays on it. The wire UA never depended on this write:
+      // setupGoogleAuthUserAgentOverride rewrites User-Agent per request for auth-host URLs on its own.
       if (options.duringRedirect === true || overrideState !== undefined) {
         if (this.canOverrideUserAgentOverCdp(guest)) {
           authOverrideIssuedOverCdp = true
           // Why: go through the viewport builder rather than writing nextUa raw, so both CDP writers
-          // resolve one identity for this URL — Firefox on auth hosts, the profile's clean base off
-          // them, any mobile preset preserved. Writing the session UA directly would put the
-          // unlaundered Electron token back on the wire.
+          // resolve one identity for this URL — Firefox on auth hosts, the session's base identity
+          // off them, any mobile preset preserved.
           void this.applyAuthUserAgentOverrideOverCdp(
             guest,
             (browserPageId ? this.viewportUaOverrideMobileByTabId.get(browserPageId) : undefined) ??
@@ -188,7 +186,7 @@ export abstract class BrowserManagerNavigation extends BrowserManagerVisibility
 
   // Why: Emulation.setUserAgentOverride is set once and stands across every later navigation,
   // outranking setUserAgent for navigator.userAgent. A viewport preset applied before reaching an
-  // auth host would otherwise pin navigator.userAgent to the Chrome-shaped preset UA while the
+  // auth host would otherwise pin navigator.userAgent to the session's preset UA while the
   // request header says Firefox — the two-layer disagreement this scope exists to remove.
   protected reapplyViewportUserAgentOverride(
     guest: Electron.WebContents,
@@ -222,7 +220,7 @@ export abstract class BrowserManagerNavigation extends BrowserManagerVisibility
         // Why: the session UA is the profile's stable base identity. guest.getUserAgent() is not:
         // applyGoogleAuthUserAgent leaves it pinned to the Firefox auth UA once a guest switches to
         // the CDP override, so reading it back here would republish that identity on ordinary hosts.
-        baseUserAgent: cleanElectronUserAgent(baseUserAgent ?? guest.session.getUserAgent())
+        baseUserAgent: baseUserAgent ?? guest.session.getUserAgent()
       })
     )
   }
diff --git a/src/main/browser/browser-manager-popup-routing.test.ts b/src/main/browser/browser-manager-popup-routing.test.ts
index a3083005016..c0247796d09 100644
--- a/src/main/browser/browser-manager-popup-routing.test.ts
+++ b/src/main/browser/browser-manager-popup-routing.test.ts
@@ -263,6 +263,11 @@ describe('browserManager', () => {
       browserPageId: 'browser-1',
       url: 'https://docs.example.com/guide'
     })
+    expect(rendererSendMock).toHaveBeenCalledWith('browser:open-link-in-orca-tab', {
+      browserPageId: 'browser-1',
+      url: 'https://docs.example.com/guide',
+      activate: false
+    })
     expect(rendererSendMock).toHaveBeenCalledWith('browser:popup', {
       browserPageId: 'browser-1',
       origin: 'https://docs.example.com',
@@ -416,20 +421,21 @@ describe('browserManager', () => {
     domReadyHandler?.()
     await vi.waitFor(() => expect(executeJavaScriptInIsolatedWorldMock).toHaveBeenCalledTimes(1))
 
-    const managerState = browserManager as unknown as {
-      clickedLinkFrameNameByGuestId: Map<number, string>
+    const script = executeJavaScriptInIsolatedWorldMock.mock.calls[0][1][0].code as string
+    const clickedLinkFrameNames = {
+      foreground: script.match(/__orca_clicked_link_foreground_[0-9a-f-]+/)?.[0],
+      background: script.match(/__orca_clicked_link_background_[0-9a-f-]+/)?.[0]
     }
-    const clickedLinkFrameName = managerState.clickedLinkFrameNameByGuestId.get(guest.id)
-    if (!clickedLinkFrameName) {
-      throw new Error('Expected a private clicked-link frame name')
+    if (!clickedLinkFrameNames.foreground || !clickedLinkFrameNames.background) {
+      throw new Error('Expected private clicked-link frame names')
     }
-    expect(clickedLinkFrameName).toMatch(/^__orca_clicked_link_foreground_/)
+    expect(clickedLinkFrameNames.foreground).toMatch(/^__orca_clicked_link_foreground_/)
     expect(executeJavaScriptInIsolatedWorldMock).toHaveBeenCalledWith(
       expect.any(Number),
       [
         expect.objectContaining({
           code: expect.stringContaining(
-            `${JSON.stringify(clickedLinkFrameName)},${process.platform === 'darwin'})`
+            `${JSON.stringify(clickedLinkFrameNames.foreground)},${JSON.stringify(clickedLinkFrameNames.background)},${process.platform === 'darwin'})`
           )
         })
       ],
@@ -443,13 +449,14 @@ describe('browserManager', () => {
     expect(
       handler({
         url: 'https://docs.example.com/guide',
-        frameName: clickedLinkFrameName
+        frameName: clickedLinkFrameNames.background
       })
     ).toEqual({ action: 'deny' })
 
     expect(rendererSendMock).toHaveBeenCalledWith('browser:open-link-in-orca-tab', {
       browserPageId: 'browser-1',
-      url: 'https://docs.example.com/guide'
+      url: 'https://docs.example.com/guide',
+      activate: false
     })
     expect(rendererSendMock).toHaveBeenCalledWith('browser:popup', {
       browserPageId: 'browser-1',
@@ -512,9 +519,15 @@ describe('browserManager', () => {
     const foregroundFrameName = firstScript.match(
       /__orca_clicked_link_iframe_foreground_[0-9a-f-]+/
     )?.[0]
+    const backgroundFrameName = firstScript.match(
+      /__orca_clicked_link_iframe_background_[0-9a-f-]+/
+    )?.[0]
     if (!foregroundFrameName) {
       throw new Error('Expected a private child-frame routing token')
     }
+    if (!backgroundFrameName) {
+      throw new Error('Expected a private background child-frame routing token')
+    }
     expect(firstScript).toContain('installBrowserIframeClickedLinkRouting')
     expect(executeJavaScriptMock).toHaveBeenCalledWith(firstScript, false)
 
@@ -525,17 +538,26 @@ describe('browserManager', () => {
     expect(
       popupHandler({
         url: 'https://docs.example.com/from-frame',
-        frameName: foregroundFrameName
+        frameName: backgroundFrameName
       })
     ).toEqual({ action: 'deny' })
     expect(rendererSendMock).toHaveBeenCalledWith('browser:open-link-in-orca-tab', {
       browserPageId: 'browser-frame',
-      url: 'https://docs.example.com/from-frame'
+      url: 'https://docs.example.com/from-frame',
+      activate: false
     })
+    expect(
+      popupHandler({
+        url: 'https://docs.example.com/from-frame-sibling',
+        frameName: foregroundFrameName
+      })
+    ).toMatchObject({ action: 'allow' })
+    expect(rendererSendMock).toHaveBeenCalledTimes(2)
 
     await vi.waitFor(() => expect(executeJavaScriptMock).toHaveBeenCalledTimes(2))
     const secondScript = executeJavaScriptMock.mock.calls[1][0] as string
     expect(secondScript).not.toContain(foregroundFrameName)
+    expect(secondScript).not.toContain(backgroundFrameName)
   })
 
   it('hosts allowed popups in an origin-bar window with inherited guest policies', () => {
diff --git a/src/main/browser/browser-manager-registration.ts b/src/main/browser/browser-manager-registration.ts
index 6850c240950..ba2ac8647eb 100644
--- a/src/main/browser/browser-manager-registration.ts
+++ b/src/main/browser/browser-manager-registration.ts
@@ -206,7 +206,6 @@ export abstract class BrowserManagerRegistration extends BrowserManagerGuestPoli
       cleanup()
     }
     this.policyCleanupByGuestId.clear()
-    this.clickedLinkFrameNameByGuestId.clear()
     this.tabIdByWebContentsId.clear()
     this.popupOwnerContextByGuestId.clear()
     this.pageInitiatedTabBudgetByRootGuestId.clear()
diff --git a/src/main/browser/browser-manager-state.ts b/src/main/browser/browser-manager-state.ts
index bc65cc3d2dc..fef6eee3f9a 100644
--- a/src/main/browser/browser-manager-state.ts
+++ b/src/main/browser/browser-manager-state.ts
@@ -1,4 +1,3 @@
-import { ANTI_DETECTION_SCRIPT } from './anti-detection'
 import { BrowserGrabSessionController } from './browser-grab-session-controller'
 import type { BrowserCertificateTrustController } from './browser-certificate-trust-controller'
 import {
@@ -103,7 +102,11 @@ export abstract class BrowserManagerState extends BrowserManagerViewportScrollSt
     error: string | null
   ): void
   protected abstract getDownloadReceivedBytes(item: Electron.DownloadItem): number
-  protected abstract openLinkInOrcaTab(browserTabId: string, rawUrl: string): boolean
+  protected abstract openLinkInOrcaTab(
+    browserTabId: string,
+    rawUrl: string,
+    activate?: boolean
+  ): boolean
 
   protected settingsResolver:
     | (() => {
@@ -144,7 +147,6 @@ export abstract class BrowserManagerState extends BrowserManagerViewportScrollSt
   protected readonly policyAttachedGuestIds = new Set<number>()
   protected readonly offscreenGuestIds = new Set<number>()
   protected readonly policyCleanupByGuestId = new Map<number, () => void>()
-  protected readonly clickedLinkFrameNameByGuestId = new Map<number, string>()
   protected readonly loadErrorsByGuestId = new Map<number, BrowserLoadError>()
   // Why: did-start-navigation hides the overlay optimistically; stash the cleared error so did-fail-load(-3) can restore an aborted nav.
   protected readonly clearedLoadErrorsByGuestId = new Map<number, BrowserLoadError>()
@@ -190,56 +192,19 @@ export abstract class BrowserManagerState extends BrowserManagerViewportScrollSt
     this.settingsResolver = resolver
   }
 
-  // Why: addScriptToEvaluateOnNewDocument (CDP) is the only reliable pre-page-script hook per nav; executeJavaScript ran on the old page context.
-  protected injectAntiDetection(guest: Electron.WebContents): () => void {
-    let disposed = false
-    let reattachTimer: ReturnType<typeof setTimeout> | null = null
-
-    const attach = (): void => {
-      if (disposed || guest.isDestroyed()) {
-        return
-      }
-      try {
-        if (!guest.debugger.isAttached()) {
-          guest.debugger.attach('1.3')
-        }
-        void guest.debugger
-          .sendCommand('Page.enable', {})
-          .then(() =>
-            guest.debugger.sendCommand('Page.addScriptToEvaluateOnNewDocument', {
-              source: ANTI_DETECTION_SCRIPT
-            })
-          )
-          .catch(() => {})
-      } catch {
-        /* best-effort — debugger may be unavailable */
-      }
-    }
-
-    // Why: proxy/bridge stop detaches the debugger and drops injections; re-attach (500ms delay to avoid racing a mid-restart) to keep overrides.
+  // Why: a debugger detach clears every CDP override Chromium holds, including the Google auth-host
+  // UA override, so the confirmed-override record must be dropped or the next auth navigation
+  // believes the identity is still installed and skips the write.
+  protected trackDebuggerDetachForAuthUserAgent(guest: Electron.WebContents): () => void {
     const onDetach = (): void => {
       this.authUserAgentOverrideStateByGuestId.delete(guest.id)
-      if (!disposed && !guest.isDestroyed() && reattachTimer === null) {
-        reattachTimer = setTimeout(() => {
-          reattachTimer = null
-          attach()
-        }, 500)
-      }
     }
-
     try {
-      attach()
       guest.debugger.on('detach', onDetach)
     } catch {
-      /* best-effort */
+      /* debugger may be unavailable */
     }
-
     return () => {
-      disposed = true
-      if (reattachTimer !== null) {
-        clearTimeout(reattachTimer)
-        reattachTimer = null
-      }
       try {
         guest.debugger.off('detach', onDetach)
       } catch {
diff --git a/src/main/browser/browser-manager-types.ts b/src/main/browser/browser-manager-types.ts
index a1b832a65bc..b91e2b741fe 100644
--- a/src/main/browser/browser-manager-types.ts
+++ b/src/main/browser/browser-manager-types.ts
@@ -117,7 +117,7 @@ export type PopupOwnerContext = {
 
 /**
  * What a guest is allowed to be. A browsing guest is the web — popups, clicked-link routing and
- * anti-detection all apply. A workspace-document guest renders one granted document and gets none
+ * auth-identity tracking all apply. A workspace-document guest renders one granted document and gets none
  * of that; `host` is the renderer that minted its grant, and the only sink for what it reports.
  */
 export type BrowserGuestPolicy =
diff --git a/src/main/browser/browser-manager-viewport-override.test.ts b/src/main/browser/browser-manager-viewport-override.test.ts
index b7d3bbabe0a..0ffc3c2a6e1 100644
--- a/src/main/browser/browser-manager-viewport-override.test.ts
+++ b/src/main/browser/browser-manager-viewport-override.test.ts
@@ -49,7 +49,6 @@ import {
 import {
   createViewportGuestFactory,
   flushViewportOps,
-  GUEST_CLEAN_UA,
   GUEST_ELECTRON_UA
 } from './browser-manager-viewport-test-fixtures'
 
@@ -207,7 +206,7 @@ describe('browserManager', () => {
         mobile: false
       })
       expect(debuggerSendCommand).toHaveBeenLastCalledWith('Emulation.setUserAgentOverride', {
-        userAgent: GUEST_CLEAN_UA
+        userAgent: GUEST_ELECTRON_UA
       })
 
       // Navigating to the auth host must move the standing override to the Firefox identity.
@@ -218,11 +217,11 @@ describe('browserManager', () => {
         userAgent: googleAuthUserAgent()
       })
 
-      // Leaving the auth host restores the clean Chrome-shaped preset UA.
+      // Leaving the auth host restores the session's own preset UA.
       debuggerSendCommand.mockClear()
       willRedirect({ preventDefault: vi.fn() }, 'https://example.com/', false, true)
       await flushViewportOps()
-      expect(lastUserAgentOverride(debuggerSendCommand)).toEqual({ userAgent: GUEST_CLEAN_UA })
+      expect(lastUserAgentOverride(debuggerSendCommand)).toEqual({ userAgent: GUEST_ELECTRON_UA })
     })
 
     // Why: not an ordering race — debugger.sendCommand dispatches in call order over one channel, so
@@ -241,9 +240,9 @@ describe('browserManager', () => {
     }
 
     // Why mobile: on the desktop branch the break is masked by coincidence — applyGoogleAuthUserAgent
-    // has already switched the WebContents UA to Firefox, and cleanElectronUserAgent passes a Firefox
-    // UA through untouched, so the stale-URL desktop path happens to emit Firefox anyway. The mobile
-    // branch derives a Chrome-shaped iPhone UA from that same base and exposes the real defect.
+    // has already switched the WebContents UA to Firefox, so the stale-URL desktop path happens to
+    // emit Firefox anyway. The mobile branch derives a Chrome-shaped iPhone UA from the session base
+    // and exposes the real defect.
     it('does not leave the Chrome preset UA standing when a mobile preset lands mid-navigation onto an auth host', async () => {
       const { guest, debuggerSendCommand } = makeGuest(4251, 'https://example.com/')
       // Hold the preset's first CDP command open so the navigation lands inside its await window.
@@ -332,7 +331,7 @@ describe('browserManager', () => {
 
       // Without the fix the resuming preset re-reads getURL() as the auth host and clobbers the
       // navigation's correct write, stranding the Firefox UA on a non-auth page.
-      expect(lastUserAgentOverride(debuggerSendCommand)).toEqual({ userAgent: GUEST_CLEAN_UA })
+      expect(lastUserAgentOverride(debuggerSendCommand)).toEqual({ userAgent: GUEST_ELECTRON_UA })
     })
 
     it('falls back to the committed URL once a navigation commits or fails', async () => {
@@ -378,7 +377,7 @@ describe('browserManager', () => {
       await flushViewportOps()
 
       expect(guest.setUserAgent).toHaveBeenLastCalledWith(GUEST_ELECTRON_UA)
-      expect(lastUserAgentOverride(debuggerSendCommand)).toEqual({ userAgent: GUEST_CLEAN_UA })
+      expect(lastUserAgentOverride(debuggerSendCommand)).toEqual({ userAgent: GUEST_ELECTRON_UA })
 
       // A later preset must also resolve the committed, non-auth URL.
       debuggerSendCommand.mockClear()
@@ -457,7 +456,7 @@ describe('browserManager', () => {
       expect(guest.setUserAgent).not.toHaveBeenCalled()
       expect(debuggerSendCommand).not.toHaveBeenCalledWith(
         'Emulation.setUserAgentOverride',
-        expect.objectContaining({ userAgent: GUEST_CLEAN_UA })
+        expect.objectContaining({ userAgent: GUEST_ELECTRON_UA })
       )
     })
 
@@ -517,7 +516,7 @@ describe('browserManager', () => {
       didFailLoad(null, -3, 'Aborted', 'https://accounts.google.com/redirected', true)
       await flushViewportOps()
       expect(guest.setUserAgent).not.toHaveBeenCalled()
-      expect(lastUserAgentOverride(debuggerSendCommand)).toEqual({ userAgent: GUEST_CLEAN_UA })
+      expect(lastUserAgentOverride(debuggerSendCommand)).toEqual({ userAgent: GUEST_ELECTRON_UA })
     })
 
     it('preserves the auth identity when a viewport preset is cleared after a redirect', async () => {
@@ -592,7 +591,7 @@ describe('browserManager', () => {
       didStartNavigation(null, 'https://example.com/', false, true)
       await flushViewportOps()
 
-      expect(lastUserAgentOverride(debuggerSendCommand)).toEqual({ userAgent: GUEST_CLEAN_UA })
+      expect(lastUserAgentOverride(debuggerSendCommand)).toEqual({ userAgent: GUEST_ELECTRON_UA })
     })
 
     it('reapplies a preset when navigation starts during its final UA write', async () => {
@@ -849,8 +848,7 @@ describe('browserManager', () => {
 
       expect(debuggerAttach).toHaveBeenCalledWith('1.3')
       expect(debuggerSendCommand).toHaveBeenCalled()
-      // Why: detaching would clear Page.addScriptToEvaluateOnNewDocument
-      // (anti-detection). Guard regression.
+      // Why: detaching would clear every standing CDP override (viewport, auth UA). Guard regression.
       expect((guest.debugger as { detach?: unknown }).detach ?? undefined).toBeUndefined()
     })
 
diff --git a/src/main/browser/browser-manager-viewport-test-fixtures.ts b/src/main/browser/browser-manager-viewport-test-fixtures.ts
index 8d68977f62e..076524ce5d0 100644
--- a/src/main/browser/browser-manager-viewport-test-fixtures.ts
+++ b/src/main/browser/browser-manager-viewport-test-fixtures.ts
@@ -3,8 +3,6 @@ import type { BrowserManagerMocks } from './browser-manager-test-harness'
 
 export const GUEST_ELECTRON_UA =
   'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) orca/1.0.0 Chrome/134.0.0.0 Electron/30.0.0 Safari/537.36'
-export const GUEST_CLEAN_UA =
-  'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36'
 
 // Why: viewport UA writes are queued on the per-tab chain, so draining it takes more than one
 // microtask hop; loop until the chain is empty rather than guessing a tick count.
@@ -53,7 +51,9 @@ export function createViewportGuestFactory(
       debugger: {
         isAttached: debuggerIsAttached,
         attach: debuggerAttach,
-        sendCommand: debuggerSendCommand
+        sendCommand: debuggerSendCommand,
+        on: vi.fn(),
+        off: vi.fn()
       }
     }
     return {
diff --git a/src/main/browser/browser-manager-viewport.ts b/src/main/browser/browser-manager-viewport.ts
index 1e79e760942..ce31dbe37e1 100644
--- a/src/main/browser/browser-manager-viewport.ts
+++ b/src/main/browser/browser-manager-viewport.ts
@@ -30,7 +30,7 @@ export abstract class BrowserManagerViewport extends BrowserManagerDownloadLifec
     return true
   }
 
-  // Why: emulate viewport via CDP; never detach the debugger here or per-guest overrides (addScriptToEvaluateOnNewDocument) are cleared.
+  // Why: emulate viewport via CDP; never detach the debugger here or the agent bridge's per-guest state is cleared.
   async setViewportOverride(
     browserTabId: string,
     override: BrowserViewportOverride | null
diff --git a/src/main/browser/browser-session-partition-policies.test.ts b/src/main/browser/browser-session-partition-policies.test.ts
index 78ce34d95fd..952c199536c 100644
--- a/src/main/browser/browser-session-partition-policies.test.ts
+++ b/src/main/browser/browser-session-partition-policies.test.ts
@@ -82,8 +82,7 @@ vi.mock('./browser-media-access', () => ({
   requestSystemMediaAccess: async () => false
 }))
 vi.mock('./browser-session-ua', () => ({
-  cleanElectronUserAgent: (userAgent: string) => userAgent,
-  setupClientHintsOverride: vi.fn()
+  setupGoogleAuthUserAgentOverride: vi.fn()
 }))
 vi.mock('./browser-session-user-agent-mode', () => ({
   setBrowserSessionUserAgentMode: vi.fn()
diff --git a/src/main/browser/browser-session-partition-policies.ts b/src/main/browser/browser-session-partition-policies.ts
index 9f25d8840a2..ec3c68fb45e 100644
--- a/src/main/browser/browser-session-partition-policies.ts
+++ b/src/main/browser/browser-session-partition-policies.ts
@@ -9,7 +9,7 @@ import {
 } from './browser-session-proxy'
 import { hasSystemMediaAccess, requestSystemMediaAccess } from './browser-media-access'
 import { isAutoGrantedBrowserSessionPermission } from './browser-session-permission-policy'
-import { cleanElectronUserAgent, setupClientHintsOverride } from './browser-session-ua'
+import { setupGoogleAuthUserAgentOverride } from './browser-session-ua'
 import { setBrowserSessionUserAgentMode } from './browser-session-user-agent-mode'
 import {
   allowsBrowserWebAuthnPermission,
@@ -92,10 +92,8 @@ export function installBrowserSessionPartitionPolicies(
   }
 
   browserManager.installCertificateRequestGuard(sess)
-  if (profile.userAgentMode !== 'native' && typeof sess.getUserAgent === 'function') {
-    const cleanUA = cleanElectronUserAgent(sess.getUserAgent())
-    sess.setUserAgent(cleanUA)
-    setupClientHintsOverride(sess, cleanUA)
+  if (profile.userAgentMode !== 'native') {
+    setupGoogleAuthUserAgentOverride(sess)
   }
   if (options?.permissions === 'deny') {
     sess.setPermissionRequestHandler((_webContents, _permission, callback) => callback(false))
@@ -191,11 +189,7 @@ export function applyBrowserSessionUserAgentModes(profiles: BrowserSessionProfil
       if (profile.userAgentMode === 'native') {
         continue
       }
-
-      // Why: the default Electron UA leaks "Electron/X.X.X" + app name, which trips Cloudflare Turnstile.
-      const cleanUA = cleanElectronUserAgent(sess.getUserAgent())
-      sess.setUserAgent(cleanUA)
-      setupClientHintsOverride(sess, cleanUA)
+      setupGoogleAuthUserAgentOverride(sess)
     } catch {
       /* session not available yet (e.g. unit tests or pre-ready) */
     }
diff --git a/src/main/browser/browser-session-partition-proxy-install.test.ts b/src/main/browser/browser-session-partition-proxy-install.test.ts
index 0841ed94785..4beeaab04c9 100644
--- a/src/main/browser/browser-session-partition-proxy-install.test.ts
+++ b/src/main/browser/browser-session-partition-proxy-install.test.ts
@@ -44,8 +44,7 @@ vi.mock('./browser-media-access', () => ({
   requestSystemMediaAccess: vi.fn(async () => false)
 }))
 vi.mock('./browser-session-ua', () => ({
-  cleanElectronUserAgent: vi.fn((ua: string) => ua),
-  setupClientHintsOverride: vi.fn()
+  setupGoogleAuthUserAgentOverride: vi.fn()
 }))
 vi.mock('./browser-session-user-agent-mode', () => ({
   setBrowserSessionUserAgentMode: vi.fn(),
diff --git a/src/main/browser/browser-session-registry.persistence.test.ts b/src/main/browser/browser-session-registry.persistence.test.ts
index fdba71e16d6..67653c0c76c 100644
--- a/src/main/browser/browser-session-registry.persistence.test.ts
+++ b/src/main/browser/browser-session-registry.persistence.test.ts
@@ -27,7 +27,7 @@ function installModuleMocks(
   copyFailures = new Set<string>()
 ): {
   sessionFromPartitionMock: ReturnType<typeof vi.fn>
-  setupClientHintsOverrideMock: ReturnType<typeof vi.fn>
+  setupGoogleAuthUserAgentOverrideMock: ReturnType<typeof vi.fn>
   browserManagerHandleGuestWillDownloadMock: ReturnType<typeof vi.fn>
   browserManagerNotifyPermissionDeniedMock: ReturnType<typeof vi.fn>
   requestSystemMediaAccessMock: ReturnType<typeof vi.fn>
@@ -36,6 +36,7 @@ function installModuleMocks(
     partition,
     setUserAgent: vi.fn(),
     getUserAgent: vi.fn(() => 'Mozilla/5.0 Electron/31 Orca'),
+    webRequest: { onBeforeSendHeaders: vi.fn() },
     setPermissionRequestHandler: vi.fn(),
     setPermissionCheckHandler: vi.fn(),
     setDevicePermissionHandler: vi.fn(),
@@ -45,7 +46,7 @@ function installModuleMocks(
     clearStorageData: vi.fn().mockResolvedValue(undefined),
     clearCache: vi.fn().mockResolvedValue(undefined)
   }))
-  const setupClientHintsOverrideMock = vi.fn()
+  const setupGoogleAuthUserAgentOverrideMock = vi.fn()
   const browserManagerHandleGuestWillDownloadMock = vi.fn()
   const browserManagerNotifyPermissionDeniedMock = vi.fn()
   const requestSystemMediaAccessMock = vi.fn().mockResolvedValue(true)
@@ -119,8 +120,7 @@ function installModuleMocks(
     requestSystemMediaAccess: requestSystemMediaAccessMock
   }))
   vi.doMock('./browser-session-ua', () => ({
-    cleanElectronUserAgent: vi.fn((ua: string) => ua.replace(/\s*Electron\/\S+/, '')),
-    setupClientHintsOverride: setupClientHintsOverrideMock
+    setupGoogleAuthUserAgentOverride: setupGoogleAuthUserAgentOverrideMock
   }))
   // This suite models replay with an in-memory filesystem. The real file-backed SQLite merge has
   // dedicated coverage; these fixtures are legacy unmarked images and keep the copy path.
@@ -149,7 +149,7 @@ function installModuleMocks(
 
   return {
     sessionFromPartitionMock,
-    setupClientHintsOverrideMock,
+    setupGoogleAuthUserAgentOverrideMock,
     browserManagerHandleGuestWillDownloadMock,
     browserManagerNotifyPermissionDeniedMock,
     requestSystemMediaAccessMock
@@ -234,21 +234,24 @@ describe('BrowserSessionRegistry persistence', () => {
     })
   })
 
-  it('keeps UA cleaning as the fallback for profiles without an override', async () => {
+  // Why: the stock Electron UA is what clears Cloudflare; only the Google auth switch installs.
+  it('keeps the stock UA and installs the Google auth switch for profiles without an override', async () => {
     const fsState = createFsState()
-    const { sessionFromPartitionMock, setupClientHintsOverrideMock } = installModuleMocks(fsState)
+    const { sessionFromPartitionMock, setupGoogleAuthUserAgentOverrideMock } =
+      installModuleMocks(fsState)
     const { browserSessionRegistry } = await import('./browser-session-registry')
 
     await browserSessionRegistry.createProfile('isolated', 'Default identity')
 
     const profileSession = sessionFromPartitionMock.mock.results.at(-1)?.value
-    expect(profileSession.setUserAgent).toHaveBeenCalledWith('Mozilla/5.0 Orca')
-    expect(setupClientHintsOverrideMock).toHaveBeenCalledWith(profileSession, 'Mozilla/5.0 Orca')
+    expect(profileSession.setUserAgent).not.toHaveBeenCalled()
+    expect(setupGoogleAuthUserAgentOverrideMock).toHaveBeenCalledWith(profileSession)
   })
 
   it('leaves UA and client hints untouched for native-mode profiles', async () => {
     const fsState = createFsState()
-    const { sessionFromPartitionMock, setupClientHintsOverrideMock } = installModuleMocks(fsState)
+    const { sessionFromPartitionMock, setupGoogleAuthUserAgentOverrideMock } =
+      installModuleMocks(fsState)
     const { browserSessionRegistry } = await import('./browser-session-registry')
 
     await browserSessionRegistry.createProfile('isolated', 'Google', { userAgentMode: 'native' })
@@ -256,7 +259,7 @@ describe('BrowserSessionRegistry persistence', () => {
     const profileSession = sessionFromPartitionMock.mock.results.at(-1)?.value
     const { getBrowserSessionUserAgentMode } = await import('./browser-session-user-agent-mode')
     expect(profileSession.setUserAgent).not.toHaveBeenCalled()
-    expect(setupClientHintsOverrideMock).not.toHaveBeenCalled()
+    expect(setupGoogleAuthUserAgentOverrideMock).not.toHaveBeenCalled()
     expect(getBrowserSessionUserAgentMode(profileSession as never)).toBe('native')
   })
 
@@ -379,7 +382,7 @@ describe('BrowserSessionRegistry persistence', () => {
   // Why: imports before Aug 2026 persisted a synthesized source-browser UA
   // (fork imports as a broken Chrome/1.x, Chrome imports as a valid version).
   // Neither may ever be applied again — the engine-derived UA is the only one.
-  it('ignores legacy persisted UAs, valid or broken, and applies the engine UA', async () => {
+  it('ignores legacy persisted UAs, valid or broken, and keeps the engine UA', async () => {
     const importedPartition = 'persist:orca-browser-session-11111111-1111-4111-8111-111111111111'
     const brokenUa =
       'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/1.158.1 Safari/537.36'
@@ -405,7 +408,8 @@ describe('BrowserSessionRegistry persistence', () => {
       ]
     })
 
-    const { sessionFromPartitionMock, setupClientHintsOverrideMock } = installModuleMocks(fsState)
+    const { sessionFromPartitionMock, setupGoogleAuthUserAgentOverrideMock } =
+      installModuleMocks(fsState)
     const { browserSessionRegistry } = await import('./browser-session-registry')
 
     browserSessionRegistry.initializeBrowserSessionsFromPersistedState()
@@ -413,16 +417,9 @@ describe('BrowserSessionRegistry persistence', () => {
     const appliedUas = sessionFromPartitionMock.mock.results.flatMap((r) =>
       r.value.setUserAgent.mock.calls.map((c: unknown[]) => c[0])
     )
-    expect(appliedUas).not.toContain(brokenUa)
-    expect(appliedUas).not.toContain(validUa)
-    // Why: every non-native profile falls to Orca's own cleaned engine UA.
-    expect(appliedUas.length).toBeGreaterThan(0)
-    expect(appliedUas.every((ua) => ua === 'Mozilla/5.0 Orca')).toBe(true)
-    expect(
-      setupClientHintsOverrideMock.mock.calls.every(
-        (c: unknown[]) => c[1] !== brokenUa && c[1] !== validUa
-      )
-    ).toBe(true)
+    // Why: no persisted UA is ever written back; every profile keeps the engine's stock UA.
+    expect(appliedUas).toEqual([])
+    expect(setupGoogleAuthUserAgentOverrideMock).toHaveBeenCalled()
   })
 
   it('never applies a legacy persisted UA to a native-mode profile', async () => {
@@ -487,7 +484,8 @@ describe('BrowserSessionRegistry persistence', () => {
       ]
     })
 
-    const { sessionFromPartitionMock, setupClientHintsOverrideMock } = installModuleMocks(fsState)
+    const { sessionFromPartitionMock, setupGoogleAuthUserAgentOverrideMock } =
+      installModuleMocks(fsState)
     const { browserSessionRegistry } = await import('./browser-session-registry')
 
     browserSessionRegistry.initializeBrowserSessionsFromPersistedState()
@@ -498,7 +496,7 @@ describe('BrowserSessionRegistry persistence', () => {
     expect(importedSessions.length).toBeGreaterThan(0)
     expect(importedSessions.every((sess) => sess.setUserAgent.mock.calls.length === 0)).toBe(true)
     expect(
-      setupClientHintsOverrideMock.mock.calls.some(
+      setupGoogleAuthUserAgentOverrideMock.mock.calls.some(
         ([sess]) => (sess as { partition?: string }).partition === importedPartition
       )
     ).toBe(false)
diff --git a/src/main/browser/browser-session-registry.test.ts b/src/main/browser/browser-session-registry.test.ts
index d5111483fcf..ae81ffda4e2 100644
--- a/src/main/browser/browser-session-registry.test.ts
+++ b/src/main/browser/browser-session-registry.test.ts
@@ -33,7 +33,7 @@ vi.mock('./browser-manager', () => ({
 
 import { browserSessionRegistry } from './browser-session-registry'
 import { googleAuthUserAgent } from './browser-google-auth-ua'
-import { setupClientHintsOverride } from './browser-session-ua'
+import { setupGoogleAuthUserAgentOverride } from './browser-session-ua'
 import { setBrowserNetworkProxySettingsResolver } from './browser-session-proxy'
 import { handleElectronProxyLogin } from '../network/electron-proxy-credentials'
 import { applyProxySettingsToSession } from '../network/proxy-settings'
@@ -54,6 +54,7 @@ describe('BrowserSessionRegistry', () => {
     askForMediaAccessMock.mockResolvedValue(true)
     getMediaAccessStatusMock.mockReturnValue('granted')
     sessionFromPartitionMock.mockReturnValue({
+      webRequest: { onBeforeSendHeaders: vi.fn() },
       setPermissionRequestHandler: vi.fn(),
       setPermissionCheckHandler: vi.fn(),
       setDevicePermissionHandler: vi.fn(),
@@ -528,80 +529,46 @@ describe('BrowserSessionRegistry', () => {
     })
   })
 
-  describe('setupClientHintsOverride', () => {
-    it('overrides sec-ch-ua headers for Edge UA', () => {
+  describe('setupGoogleAuthUserAgentOverride', () => {
+    const STOCK_UA =
+      'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) orca/1.0.0 Chrome/147.0.6890.3 Electron/43.0.0 Safari/537.36'
+
+    function install(): (details: unknown, callback: ReturnType<typeof vi.fn>) => void {
       const onBeforeSendHeaders = vi.fn()
-      const mockSess = { webRequest: { onBeforeSendHeaders } } as never
-      const edgeUa =
-        'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.6890.3 Safari/537.36 Edg/147.0.3210.5'
-
-      setupClientHintsOverride(mockSess, edgeUa)
-
+      setupGoogleAuthUserAgentOverride({ webRequest: { onBeforeSendHeaders } } as never)
       expect(onBeforeSendHeaders).toHaveBeenCalledWith(
         { urls: ['https://*/*'] },
         expect.any(Function)
       )
+      return onBeforeSendHeaders.mock.calls[0][1]
+    }
 
+    // Why: the Electron token is what clears Cloudflare Turnstile; a Chrome-shaped UA with no
+    // client hints is what it rejects, so ordinary hosts must see the session's UA untouched.
+    it('leaves the stock Electron UA and its client hints alone off the auth hosts', () => {
+      const listener = install()
       const callback = vi.fn()
-      const listener = onBeforeSendHeaders.mock.calls[0][1]
       listener(
-        { requestHeaders: { 'sec-ch-ua': 'old', 'sec-ch-ua-full-version-list': 'old' } },
+        {
+          url: 'https://example.com/api',
+          requestHeaders: { 'User-Agent': STOCK_UA, 'sec-ch-ua': 'old', Cookie: 'abc=123' }
+        },
         callback
       )
       const modified = callback.mock.calls[0][0].requestHeaders
-      expect(modified['sec-ch-ua']).toContain('Microsoft Edge')
-      expect(modified['sec-ch-ua']).toContain('"147"')
-      expect(modified['sec-ch-ua-full-version-list']).toContain('147.0.3210.5')
-    })
-
-    it('overrides sec-ch-ua headers for Chrome UA', () => {
-      const onBeforeSendHeaders = vi.fn()
-      const mockSess = { webRequest: { onBeforeSendHeaders } } as never
-      const chromeUa =
-        'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.6890.3 Safari/537.36'
-
-      setupClientHintsOverride(mockSess, chromeUa)
-
-      const callback = vi.fn()
-      const listener = onBeforeSendHeaders.mock.calls[0][1]
-      listener({ requestHeaders: { 'sec-ch-ua': 'old' } }, callback)
-      const modified = callback.mock.calls[0][0].requestHeaders
-      expect(modified['sec-ch-ua']).toContain('Google Chrome')
-      expect(modified['sec-ch-ua']).not.toContain('Microsoft Edge')
-    })
-
-    it('registers handler even for non-Chrome UA but leaves sec-ch-ua untouched off auth hosts', () => {
-      const onBeforeSendHeaders = vi.fn()
-      const mockSess = { webRequest: { onBeforeSendHeaders } } as never
-
-      // Why: the Google-auth Firefox switch must install regardless of the base UA.
-      setupClientHintsOverride(mockSess, 'Mozilla/5.0 (compatible; MSIE 10.0)')
-
-      expect(onBeforeSendHeaders).toHaveBeenCalledWith(
-        { urls: ['https://*/*'] },
-        expect.any(Function)
-      )
-      const callback = vi.fn()
-      const listener = onBeforeSendHeaders.mock.calls[0][1]
-      listener({ url: 'https://example.com/', requestHeaders: { 'sec-ch-ua': 'old' } }, callback)
-      expect(callback.mock.calls[0][0].requestHeaders['sec-ch-ua']).toBe('old')
+      expect(modified['User-Agent']).toBe(STOCK_UA)
+      expect(modified['sec-ch-ua']).toBe('old')
+      expect(modified.Cookie).toBe('abc=123')
     })
 
     it('presents a Firefox UA and strips client hints on Google auth hosts', () => {
-      const onBeforeSendHeaders = vi.fn()
-      const mockSess = { webRequest: { onBeforeSendHeaders } } as never
-      setupClientHintsOverride(
-        mockSess,
-        'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.6890.3 Safari/537.36'
-      )
-
+      const listener = install()
       const callback = vi.fn()
-      const listener = onBeforeSendHeaders.mock.calls[0][1]
       listener(
         {
           url: 'https://accounts.google.com/v3/signin/identifier',
           requestHeaders: {
-            'User-Agent': 'Chrome/147',
+            'User-Agent': STOCK_UA,
             'sec-ch-ua': 'old',
             'sec-ch-ua-full-version-list': 'old',
             'sec-ch-ua-platform': '"macOS"'
@@ -610,7 +577,7 @@ describe('BrowserSessionRegistry', () => {
         callback
       )
       const modified = callback.mock.calls[0][0].requestHeaders
-      expect(modified['User-Agent']).toMatch(/Firefox\/\d/)
+      expect(modified['User-Agent']).toBe(googleAuthUserAgent())
       expect(modified['User-Agent']).not.toContain('Chrome')
       expect(modified['sec-ch-ua']).toBeUndefined()
       expect(modified['sec-ch-ua-full-version-list']).toBeUndefined()
@@ -618,15 +585,8 @@ describe('BrowserSessionRegistry', () => {
     })
 
     it('strips client hints on a cross-host request that carries the Firefox auth UA', () => {
-      const onBeforeSendHeaders = vi.fn()
-      const mockSess = { webRequest: { onBeforeSendHeaders } } as never
-      setupClientHintsOverride(
-        mockSess,
-        'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.6890.3 Safari/537.36'
-      )
-
+      const listener = install()
       const callback = vi.fn()
-      const listener = onBeforeSendHeaders.mock.calls[0][1]
       // Subresource/XHR to a non-auth Google host while the auth document is on
       // screen: the WebContents Firefox UA leaks onto the request header.
       listener(
@@ -651,99 +611,19 @@ describe('BrowserSessionRegistry', () => {
       expect(modified['sec-ch-ua-mobile']).toBeUndefined()
     })
 
-    it('keeps the clean Chrome identity on cross-host requests that carry the Chrome UA', () => {
-      const onBeforeSendHeaders = vi.fn()
-      const mockSess = { webRequest: { onBeforeSendHeaders } } as never
-      const chromeUa =
-        'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.6890.3 Safari/537.36'
-      setupClientHintsOverride(mockSess, chromeUa)
-
+    it('keeps the session identity on Google app subdomains (not auth hosts)', () => {
+      const listener = install()
       const callback = vi.fn()
-      const listener = onBeforeSendHeaders.mock.calls[0][1]
-      // Regression guard: non-Google sites (Cloudflare) must keep Chrome hints.
       listener(
         {
-          url: 'https://example.com/api',
-          requestHeaders: { 'User-Agent': chromeUa, 'sec-ch-ua': 'old' }
-        },
-        callback
-      )
-      expect(callback.mock.calls[0][0].requestHeaders['sec-ch-ua']).toContain('Google Chrome')
-    })
-
-    it('does not strip hints for the Firefox UA when googleAuthOverride is disabled', () => {
-      const onBeforeSendHeaders = vi.fn()
-      const mockSess = { webRequest: { onBeforeSendHeaders } } as never
-      const chromeUa =
-        'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.6890.3 Safari/537.36'
-      setupClientHintsOverride(mockSess, chromeUa, { googleAuthOverride: false })
-
-      const callback = vi.fn()
-      const listener = onBeforeSendHeaders.mock.calls[0][1]
-      listener(
-        {
-          url: 'https://play.google.com/log',
-          requestHeaders: { 'User-Agent': googleAuthUserAgent(), 'sec-ch-ua': 'old' }
-        },
-        callback
-      )
-      // Imported-native profiles never install the Firefox switch, so the strip
-      // branch stays inert and hints are aligned to Chrome instead.
-      expect(callback.mock.calls[0][0].requestHeaders['sec-ch-ua']).toContain('Google Chrome')
-    })
-
-    it('keeps Chrome client hints on Google app subdomains (not auth hosts)', () => {
-      const onBeforeSendHeaders = vi.fn()
-      const mockSess = { webRequest: { onBeforeSendHeaders } } as never
-      setupClientHintsOverride(
-        mockSess,
-        'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.6890.3 Safari/537.36'
-      )
-
-      const callback = vi.fn()
-      const listener = onBeforeSendHeaders.mock.calls[0][1]
-      listener(
-        { url: 'https://myaccount.google.com/', requestHeaders: { 'sec-ch-ua': 'old' } },
-        callback
-      )
-      expect(callback.mock.calls[0][0].requestHeaders['sec-ch-ua']).toContain('Google Chrome')
-    })
-
-    it('keeps an imported native UA on auth hosts while aligning its Chrome hints', () => {
-      const onBeforeSendHeaders = vi.fn()
-      const mockSess = { webRequest: { onBeforeSendHeaders } } as never
-      const importedUa =
-        'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.6890.3 Safari/537.36'
-      setupClientHintsOverride(mockSess, importedUa, { googleAuthOverride: false })
-
-      const callback = vi.fn()
-      const listener = onBeforeSendHeaders.mock.calls[0][1]
-      listener(
-        {
-          url: 'https://accounts.google.com/v3/signin/identifier',
-          requestHeaders: { 'User-Agent': importedUa, 'sec-ch-ua': 'old' }
+          url: 'https://myaccount.google.com/',
+          requestHeaders: { 'User-Agent': STOCK_UA, 'sec-ch-ua': 'old' }
         },
         callback
       )
       const modified = callback.mock.calls[0][0].requestHeaders
-      expect(modified['User-Agent']).toBe(importedUa)
-      expect(modified['sec-ch-ua']).toContain('Google Chrome')
-    })
-
-    it('leaves non-Client-Hints headers unchanged', () => {
-      const onBeforeSendHeaders = vi.fn()
-      const mockSess = { webRequest: { onBeforeSendHeaders } } as never
-      setupClientHintsOverride(mockSess, 'Mozilla/5.0 Chrome/147.0.0.0 Safari/537.36')
-
-      const callback = vi.fn()
-      const listener = onBeforeSendHeaders.mock.calls[0][1]
-      listener(
-        { requestHeaders: { Cookie: 'abc=123', 'sec-ch-ua': 'old', Accept: 'text/html' } },
-        callback
-      )
-      const modified = callback.mock.calls[0][0].requestHeaders
-      expect(modified.Cookie).toBe('abc=123')
-      expect(modified.Accept).toBe('text/html')
+      expect(modified['User-Agent']).toBe(STOCK_UA)
+      expect(modified['sec-ch-ua']).toBe('old')
     })
   })
 })
diff --git a/src/main/browser/browser-session-ua-wire-identity.electron.test.ts b/src/main/browser/browser-session-ua-wire-identity.electron.test.ts
new file mode 100644
index 00000000000..4e0719b2745
--- /dev/null
+++ b/src/main/browser/browser-session-ua-wire-identity.electron.test.ts
@@ -0,0 +1,180 @@
+import { spawnSync } from 'node:child_process'
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { createRequire } from 'node:module'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterAll, describe, expect, it } from 'vitest'
+import { build as buildVite } from 'vite'
+
+// Why this runs a real Electron: Cloudflare Turnstile rejects a Chrome-shaped UA that ships no
+// client hints (error 600010) and clears a declared Electron client. The header layer is the
+// only place that identity can be proven, and the vm-based unit tests cannot see Chromium's
+// header emission at all. Every partition must therefore keep the stock Electron UA on the wire
+// for ordinary hosts and present the Firefox identity on Google's sign-in hosts only.
+
+const electronBinary = createRequire(import.meta.url)('electron') as string
+const fixtureRoots: string[] = []
+
+afterAll(() => {
+  for (const root of fixtureRoots) {
+    rmSync(root, { recursive: true, force: true, maxRetries: 5, retryDelay: 100 })
+  }
+})
+
+// Retry once when Electron startup times out before `ready`; keep later failures fatal.
+const FIXTURE_LAUNCH_ATTEMPTS = 2
+
+type CapturedRequest = {
+  url: string
+  userAgent: string | null
+  clientHints: string[]
+}
+
+type FixtureResult = {
+  sessionUserAgent: string
+  navigatorUserAgent: string
+  requests: CapturedRequest[]
+}
+
+function neverReachedElectronReady(fixtureResult: string): boolean {
+  try {
+    return (JSON.parse(fixtureResult) as { step?: string }).step === 'timed out after starting'
+  } catch {
+    return false
+  }
+}
+
+function buildFixtureMain(modulePath: string, resultPath: string): string {
+  return `
+const { app, BrowserWindow, session } = require('electron')
+const { writeFileSync } = require('node:fs')
+const { setupGoogleAuthUserAgentOverride } = require(${JSON.stringify(modulePath)})
+const resultPath = ${JSON.stringify(resultPath)}
+let currentStep = 'starting'
+const mark = (step) => {
+  currentStep = step
+  writeFileSync(resultPath, JSON.stringify({ step }))
+}
+
+async function run() {
+  const timeout = setTimeout(() => {
+    writeFileSync(resultPath, JSON.stringify({ step: 'timed out after ' + currentStep }))
+    app.exit(1)
+  }, 15000)
+  await app.whenReady()
+  mark('ready')
+  const partition = 'persist:wire-identity-test'
+  const sess = session.fromPartition(partition)
+  setupGoogleAuthUserAgentOverride(sess)
+  mark('auth switch installed')
+
+  // Why: onSendHeaders reports the headers exactly as they leave the network stack, after the
+  // product's onBeforeSendHeaders listener has rewritten them. The requests must actually be
+  // dispatched for it to fire, so the session is pointed at a proxy that refuses every
+  // connection: nothing reaches the real hosts and every load fails fast.
+  await sess.setProxy({ proxyRules: 'http://127.0.0.1:9', proxyBypassRules: '<-loopback>' })
+  const requests = []
+  sess.webRequest.onSendHeaders({ urls: ['https://*/*'] }, (details) => {
+    const headers = details.requestHeaders || {}
+    const uaKey = Object.keys(headers).find((key) => key.toLowerCase() === 'user-agent')
+    requests.push({
+      url: details.url,
+      userAgent: uaKey ? headers[uaKey] : null,
+      clientHints: Object.keys(headers)
+        .filter((key) => key.toLowerCase().startsWith('sec-ch-ua'))
+        .sort()
+    })
+  })
+
+  const window = new BrowserWindow({ show: false, webPreferences: { partition } })
+  mark('window created')
+  for (const url of ['https://example.com/', 'https://accounts.google.com/v3/signin/identifier']) {
+    await window.loadURL(url).catch(() => {})
+  }
+  mark('navigations attempted')
+  const navigatorUserAgent = await window.webContents.executeJavaScript('navigator.userAgent')
+  clearTimeout(timeout)
+  writeFileSync(resultPath, JSON.stringify({
+    sessionUserAgent: sess.getUserAgent(),
+    navigatorUserAgent,
+    requests
+  }))
+  window.destroy()
+  app.exit(0)
+}
+
+run().catch((error) => {
+  writeFileSync(resultPath, JSON.stringify({ step: currentStep, error: String(error?.stack || error) }))
+  app.exit(1)
+})
+`
+}
+
+async function runFixture(): Promise<FixtureResult> {
+  const root = mkdtempSync(join(tmpdir(), 'orca-wire-identity-'))
+  fixtureRoots.push(root)
+  const modulePath = join(root, 'browser-session-ua.cjs')
+  const resultPath = join(root, 'result.json')
+  const fixturePath = join(root, 'main.cjs')
+  await buildVite({
+    configFile: false,
+    logLevel: 'silent',
+    build: {
+      emptyOutDir: false,
+      lib: {
+        entry: join(process.cwd(), 'src/main/browser/browser-session-ua.ts'),
+        formats: ['cjs'],
+        fileName: () => 'browser-session-ua.cjs'
+      },
+      outDir: root,
+      target: 'node20',
+      rollupOptions: { external: ['electron', /^node:/] }
+    }
+  })
+  writeFileSync(fixturePath, buildFixtureMain(modulePath, resultPath))
+  const { ELECTRON_RUN_AS_NODE: _electronRunAsNode, ...env } = process.env
+  const executable = process.platform === 'linux' ? 'xvfb-run' : electronBinary
+  for (let attempt = 1; ; attempt += 1) {
+    rmSync(resultPath, { force: true })
+    // Why a fresh profile per attempt: a launch that never reached `ready` may have left the
+    // Chromium profile mid-initialization, and reusing it would bias the retry.
+    const electronArgs = [fixturePath, `--user-data-dir=${join(root, `profile-${attempt}`)}`]
+    const run = spawnSync(
+      executable,
+      process.platform === 'linux'
+        ? ['--auto-servernum', electronBinary, ...electronArgs, '--no-sandbox']
+        : electronArgs,
+      { encoding: 'utf8', env, timeout: 60_000 }
+    )
+    const fixtureResult = existsSync(resultPath) ? readFileSync(resultPath, 'utf8') : 'no result'
+    if (attempt < FIXTURE_LAUNCH_ATTEMPTS && neverReachedElectronReady(fixtureResult)) {
+      continue
+    }
+    expect(run.error).toBeUndefined()
+    expect(run.status, `${fixtureResult}\n${run.stdout}\n${run.stderr}`).toBe(0)
+    return JSON.parse(fixtureResult) as FixtureResult
+  }
+}
+
+describe('browser session wire identity under Electron', () => {
+  it('sends the stock Electron UA to ordinary hosts and Firefox to Google auth hosts', async () => {
+    const result = await runFixture()
+
+    // Presence precondition: the stock identity still carries the Electron token that the old
+    // Chrome-shaped rewrite stripped, so an identity check below cannot pass on an empty UA.
+    expect(result.sessionUserAgent).toMatch(/ Electron\/\d/)
+
+    const ordinary = result.requests.find((request) => request.url === 'https://example.com/')
+    expect(ordinary, JSON.stringify(result.requests)).toBeDefined()
+    expect(ordinary?.userAgent).toBe(result.sessionUserAgent)
+    expect(result.navigatorUserAgent).toBe(result.sessionUserAgent)
+
+    const auth = result.requests.find((request) =>
+      request.url.startsWith('https://accounts.google.com/')
+    )
+    expect(auth, JSON.stringify(result.requests)).toBeDefined()
+    expect(auth?.userAgent).toMatch(/Firefox\/\d/)
+    expect(auth?.userAgent).not.toContain('Chrome')
+    expect(auth?.clientHints).toEqual([])
+  })
+})
diff --git a/src/main/browser/browser-session-ua.ts b/src/main/browser/browser-session-ua.ts
index 96c55cf5ac9..1375ebc66f5 100644
--- a/src/main/browser/browser-session-ua.ts
+++ b/src/main/browser/browser-session-ua.ts
@@ -8,93 +8,28 @@ import {
   stripClientHints
 } from './browser-google-auth-ua'
 
-// Why: Electron's default UA includes "Electron/X.X.X" and the app name
-// (e.g. "orca/1.2.3"), which Cloudflare Turnstile and other bot detectors
-// flag as non-human traffic. Strip those tokens so the webview's UA and
-// sec-ch-ua Client Hints look like standard Chrome.
-export function cleanElectronUserAgent(ua: string): string {
-  return (
-    ua
-      .replace(/\s+Electron\/\S+/, '')
-      // Why: \S+ matches any non-whitespace token (e.g. "orca/1.3.8-rc.0")
-      // including pre-release semver strings that [\d.]+ would miss.
-      .replace(/(\)\s+)\S+\s+(Chrome\/)/, '$1$2')
-  )
-}
-
-// Why: Electron emits sec-ch-ua brands like "Not A(Brand" without a
-// "Google Chrome" entry, which disagrees with the Chrome-shaped UA the session
-// presents. Rewrite the hint headers to the brand set Chrome ships for the same
-// engine version so the two surfaces tell one story. Also owns the Google
-// auth-host Firefox switch, which must install even for a non-Chrome-shaped UA.
-export function setupClientHintsOverride(
-  sess: Session,
-  ua: string,
-  options: { googleAuthOverride?: boolean } = {}
-): void {
-  // Why: only Chrome-shaped base UAs carry sec-ch-ua hints to rewrite, but the
-  // Google-auth Firefox switch below must install regardless, so keep the hints
-  // optional rather than bailing out of the whole handler.
-  const chromeHints = buildChromeClientHints(ua)
+// Why: the session keeps Electron's stock UA. Stripping the Electron/app tokens to look like
+// plain Chrome is what Cloudflare Turnstile rejects (error 600010): a Chrome UA that ships no
+// client hints reads as a spoof, while a declared Electron client clears the same challenge.
+// This handler only owns the Google auth-host Firefox switch, which is a proven, host-scoped
+// exception that must stay consistent across the header and every cross-host subresource.
+export function setupGoogleAuthUserAgentOverride(sess: Session): void {
   const firefoxUa = googleAuthUserAgent()
 
   sess.webRequest.onBeforeSendHeaders({ urls: ['https://*/*'] }, (details, callback) => {
     const headers = details.requestHeaders
-    if (options.googleAuthOverride !== false && isGoogleAuthUrl(details.url)) {
+    if (isGoogleAuthUrl(details.url)) {
       // Why: present a Firefox identity on Google's sign-in hosts so the user logs
       // in inside the app and Google issues self-refreshing bound cookies. Strip
       // sec-ch-ua* because real Firefox sends none.
       setUserAgentHeader(headers, firefoxUa)
       stripClientHints(headers)
-      callback({ requestHeaders: headers })
-      return
-    }
-    if (options.googleAuthOverride !== false && currentUserAgent(headers) === firefoxUa) {
-      // Why: while the auth document is on screen the WebContents UA is Firefox,
-      // so its cross-host subresource/XHR requests (gstatic, play.google.com, the
-      // sign-in challenge endpoints) reach here carrying the Firefox UA yet still
-      // bearing Chromium client hints. Rewriting those to Chrome pairs a Firefox
-      // UA with Chrome hints — a sharper cross-host identity tell than either
-      // alone, which can stall Google's password-submit challenge. Real Firefox
-      // sends no client hints, so strip them to keep one identity for the flow.
+    } else if (currentUserAgent(headers) === firefoxUa) {
+      // Why: while the auth document is on screen the WebContents UA is Firefox, so its
+      // cross-host subresource/XHR requests carry the Firefox UA yet still bear Chromium
+      // client hints — a sharper cross-host identity tell than either alone.
       stripClientHints(headers)
-      callback({ requestHeaders: headers })
-      return
-    }
-    if (chromeHints) {
-      for (const key of Object.keys(headers)) {
-        const lower = key.toLowerCase()
-        if (lower === 'sec-ch-ua') {
-          headers[key] = chromeHints.secChUa
-        } else if (lower === 'sec-ch-ua-full-version-list') {
-          headers[key] = chromeHints.secChUaFull
-        }
-      }
     }
     callback({ requestHeaders: headers })
   })
 }
-
-function buildChromeClientHints(ua: string): { secChUa: string; secChUaFull: string } | null {
-  const chromeMatch = ua.match(/Chrome\/([\d.]+)/)
-  if (!chromeMatch) {
-    return null
-  }
-  const fullChromeVersion = chromeMatch[1]
-  const majorVersion = fullChromeVersion.split('.')[0]
-
-  let brand = 'Google Chrome'
-  let brandFullVersion = fullChromeVersion
-
-  const edgeMatch = ua.match(/Edg\/([\d.]+)/)
-  if (edgeMatch) {
-    brand = 'Microsoft Edge'
-    brandFullVersion = edgeMatch[1]
-  }
-  const brandMajor = brandFullVersion.split('.')[0]
-
-  return {
-    secChUa: `"${brand}";v="${brandMajor}", "Chromium";v="${majorVersion}", "Not/A)Brand";v="24"`,
-    secChUaFull: `"${brand}";v="${brandFullVersion}", "Chromium";v="${fullChromeVersion}", "Not/A)Brand";v="24.0.0.0"`
-  }
-}
diff --git a/src/main/browser/browser-viewport-user-agent.ts b/src/main/browser/browser-viewport-user-agent.ts
index 7dedf8d8a6e..b8159a44c2a 100644
--- a/src/main/browser/browser-viewport-user-agent.ts
+++ b/src/main/browser/browser-viewport-user-agent.ts
@@ -23,7 +23,7 @@ export type ViewportUserAgentOverride = {
 }
 
 // Why: responsive sites UA-sniff; this is Chrome DevTools' default iPhone UA template with the real
-// Chrome major spliced in to keep sec-ch-ua consistent (see setupClientHintsOverride).
+// Chrome major spliced in so the userAgentMetadata brands below agree with it.
 function buildMobileUserAgent(chromeMajor: string): string {
   return `Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/${chromeMajor}.0.0.0 Mobile/15E148 Safari/604.1`
 }
@@ -44,7 +44,7 @@ export function buildViewportUserAgentOverride(args: {
     return { userAgent: googleAuthUserAgent() }
   }
   if (!args.mobile) {
-    // Why: desktop presets still need the clean (non-Electron) UA so Cloudflare/Turnstile don't flag the session.
+    // Why: desktop presets republish the session's own identity unchanged.
     return { userAgent: args.baseUserAgent }
   }
   const chromeMajor = extractChromeMajor(args.baseUserAgent)
diff --git a/src/main/browser/browser-webauthn-profile-delete.test.ts b/src/main/browser/browser-webauthn-profile-delete.test.ts
index 9a5e129885f..3c471fe2dc2 100644
--- a/src/main/browser/browser-webauthn-profile-delete.test.ts
+++ b/src/main/browser/browser-webauthn-profile-delete.test.ts
@@ -48,7 +48,8 @@ function mockSession(): MockSession {
     setDevicePermissionHandler: vi.fn(),
     setDisplayMediaRequestHandler: vi.fn(),
     setPermissionCheckHandler: vi.fn(),
-    setPermissionRequestHandler: vi.fn()
+    setPermissionRequestHandler: vi.fn(),
+    webRequest: { onBeforeSendHeaders: vi.fn() }
   }) as unknown as MockSession
 }
 
diff --git a/src/main/browser/cdp-debugger-channel.ts b/src/main/browser/cdp-debugger-channel.ts
index 352bc741ef0..18b819a1ce9 100644
--- a/src/main/browser/cdp-debugger-channel.ts
+++ b/src/main/browser/cdp-debugger-channel.ts
@@ -1,6 +1,5 @@
 import { WebSocket } from 'ws'
 import type { WebContents } from 'electron'
-import { ANTI_DETECTION_SCRIPT } from './anti-detection'
 import { acquireElectronDebugger, type ElectronDebuggerLease } from './electron-debugger-lease'
 import type { CdpClientResponseWriter } from './cdp-client-response-writer'
 import type { CdpSyntheticSessionRegistry } from './cdp-synthetic-session-registry'
@@ -34,14 +33,8 @@ export class CdpDebuggerChannel {
     }
     this.attached = true
 
-    // Why: attaching the CDP debugger sets navigator.webdriver = true and
-    // exposes other automation signals that Cloudflare Turnstile checks.
-    // Inject before any page loads so challenges succeed.
     try {
       await this.webContents.debugger.sendCommand('Page.enable', {})
-      await this.webContents.debugger.sendCommand('Page.addScriptToEvaluateOnNewDocument', {
-        source: ANTI_DETECTION_SCRIPT
-      })
     } catch {
       /* best-effort — page domain may not be ready yet */
     }
diff --git a/src/main/browser/cdp-debugger-events.ts b/src/main/browser/cdp-debugger-events.ts
index 023d648a8ca..59d30105910 100644
--- a/src/main/browser/cdp-debugger-events.ts
+++ b/src/main/browser/cdp-debugger-events.ts
@@ -32,9 +32,11 @@ export function createCdpDebuggerMessageListener(
         | undefined
       if (p?.sessionId && p.targetInfo?.type === 'iframe' && p.targetInfo.targetId) {
         state.iframeSessions.set(p.targetInfo.targetId, p.sessionId)
+        // Why: no Runtime.enable here. Cross-origin iframes include challenge widgets
+        // (Cloudflare Turnstile), and the Runtime domain's console/Error.stack serialization
+        // is the CDP tell they detect; nothing reads iframe Runtime events anyway.
         guest.debugger.sendCommand('DOM.enable', {}, p.sessionId).catch(() => {})
         guest.debugger.sendCommand('Accessibility.enable', {}, p.sessionId).catch(() => {})
-        guest.debugger.sendCommand('Runtime.enable', {}, p.sessionId).catch(() => {})
       }
     }
     if (method === 'Target.detachedFromTarget') {
diff --git a/src/main/browser/cdp-debugger-lifecycle.ts b/src/main/browser/cdp-debugger-lifecycle.ts
index f969f113d59..225eb689dba 100644
--- a/src/main/browser/cdp-debugger-lifecycle.ts
+++ b/src/main/browser/cdp-debugger-lifecycle.ts
@@ -1,5 +1,4 @@
 import type { WebContents } from 'electron'
-import { ANTI_DETECTION_SCRIPT } from './anti-detection'
 import { BrowserError } from './browser-error'
 import type { CdpTabState } from './cdp-auxiliary-commands'
 import type { CdpCommandSender } from './snapshot-engine'
@@ -62,11 +61,6 @@ export class CdpDebuggerLifecycle {
       flatten: true
     })
 
-    // Why: CDP attach exposes automation signals (navigator.webdriver) that Cloudflare checks; override per new document.
-    await sender('Page.addScriptToEvaluateOnNewDocument', {
-      source: ANTI_DETECTION_SCRIPT
-    })
-
     // Why: only remove this bridge's listeners; screencast/proxy sessions share the debugger and own their teardown.
     this.removeDebuggerListeners(guest, state)
 
diff --git a/src/main/browser/cdp-ws-proxy-focus-replay.test.ts b/src/main/browser/cdp-ws-proxy-focus-replay.test.ts
index 71b00cd9ff6..8404614ef8d 100644
--- a/src/main/browser/cdp-ws-proxy-focus-replay.test.ts
+++ b/src/main/browser/cdp-ws-proxy-focus-replay.test.ts
@@ -52,7 +52,6 @@ describe('CdpWsProxy DOM.focus replay', () => {
     expect(mock.webContents.focus).toHaveBeenCalledTimes(1)
     expect(getSendCommandCalls(mock)).toEqual([
       ['Page.enable', {}],
-      ['Page.addScriptToEvaluateOnNewDocument', expect.any(Object)],
       ['DOM.focus', { backendNodeId: 99 }],
       ['DOM.focus', { backendNodeId: 99 }],
       ['Input.insertText', { text: 'hello' }]
@@ -80,7 +79,6 @@ describe('CdpWsProxy DOM.focus replay', () => {
     expect(insertResponse.result).toEqual({})
     expect(getSendCommandCalls(mock)).toEqual([
       ['Page.enable', {}],
-      ['Page.addScriptToEvaluateOnNewDocument', expect.any(Object)],
       ['DOM.focus', { backendNodeId: 123 }, 'oopif-session-123'],
       ['DOM.focus', { backendNodeId: 123 }, 'oopif-session-123'],
       ['Input.insertText', { text: 'frame text' }, 'oopif-session-123']
@@ -112,7 +110,6 @@ describe('CdpWsProxy DOM.focus replay', () => {
     expect(mock.webContents.focus).toHaveBeenCalledTimes(1)
     expect(getSendCommandCalls(mock)).toEqual([
       ['Page.enable', {}],
-      ['Page.addScriptToEvaluateOnNewDocument', expect.any(Object)],
       ['DOM.focus', { backendNodeId: 44 }],
       ['Runtime.callFunctionOn', { functionDeclaration: '() => document.activeElement?.id' }],
       ['Input.insertText', { text: 'after eval' }]
@@ -155,7 +152,6 @@ describe('CdpWsProxy DOM.focus replay', () => {
     expect(mock.webContents.focus).toHaveBeenCalledTimes(1)
     expect(getSendCommandCalls(mock)).toEqual([
       ['Page.enable', {}],
-      ['Page.addScriptToEvaluateOnNewDocument', expect.any(Object)],
       ['DOM.focus', { backendNodeId: 55 }],
       ['Input.insertText', { text: 'fallback' }]
     ])
@@ -197,7 +193,6 @@ describe('CdpWsProxy DOM.focus replay', () => {
     expect(mock.webContents.focus).toHaveBeenCalledTimes(1)
     expect(getSendCommandCalls(mock)).toEqual([
       ['Page.enable', {}],
-      ['Page.addScriptToEvaluateOnNewDocument', expect.any(Object)],
       ['DOM.focus', { backendNodeId: 77 }],
       ['DOM.focus', { backendNodeId: 77 }]
     ])
@@ -242,7 +237,6 @@ describe('CdpWsProxy DOM.focus replay', () => {
     expect(insertResponse?.result).toEqual({})
     expect(getSendCommandMethods(mock)).toEqual([
       'Page.enable',
-      'Page.addScriptToEvaluateOnNewDocument',
       'DOM.focus',
       'DOM.focus',
       'Input.insertText'
@@ -270,12 +264,7 @@ describe('CdpWsProxy DOM.focus replay', () => {
     // Why: both Page.bringToFront and Input.insertText natively call focus(),
     // independent of the (now-cleared) DOM.focus replay.
     expect(mock.webContents.focus).toHaveBeenCalledTimes(2)
-    expect(getSendCommandMethods(mock)).toEqual([
-      'Page.enable',
-      'Page.addScriptToEvaluateOnNewDocument',
-      'DOM.focus',
-      'Input.insertText'
-    ])
+    expect(getSendCommandMethods(mock)).toEqual(['Page.enable', 'DOM.focus', 'Input.insertText'])
     client.close()
   })
 
@@ -298,7 +287,6 @@ describe('CdpWsProxy DOM.focus replay', () => {
     expect(insertResponse.result).toEqual({})
     expect(getSendCommandMethods(mock)).toEqual([
       'Page.enable',
-      'Page.addScriptToEvaluateOnNewDocument',
       'DOM.focus',
       'Page.captureScreenshot',
       'Input.insertText'
@@ -322,12 +310,7 @@ describe('CdpWsProxy DOM.focus replay', () => {
 
     expect(insertResponse.id).toBe(34)
     expect(insertResponse.result).toEqual({})
-    expect(getSendCommandMethods(mock)).toEqual([
-      'Page.enable',
-      'Page.addScriptToEvaluateOnNewDocument',
-      'DOM.focus',
-      'Input.insertText'
-    ])
+    expect(getSendCommandMethods(mock)).toEqual(['Page.enable', 'DOM.focus', 'Input.insertText'])
     second.close()
   })
 
diff --git a/src/main/browser/cdp-ws-proxy.test.ts b/src/main/browser/cdp-ws-proxy.test.ts
index c5f098ffa91..d5a2d14a05b 100644
--- a/src/main/browser/cdp-ws-proxy.test.ts
+++ b/src/main/browser/cdp-ws-proxy.test.ts
@@ -400,11 +400,7 @@ describe('CdpWsProxy', () => {
     })
 
     expect(mock.webContents.focus).toHaveBeenCalledTimes(1)
-    expect(getSendCommandMethods(mock)).toEqual([
-      'Page.enable',
-      'Page.addScriptToEvaluateOnNewDocument',
-      'Input.insertText'
-    ])
+    expect(getSendCommandMethods(mock)).toEqual(['Page.enable', 'Input.insertText'])
     client.close()
   })
 
@@ -421,7 +417,6 @@ describe('CdpWsProxy', () => {
     expect(response.result).toEqual({})
     expect(getSendCommandMethods(mock)).toEqual([
       'Page.enable',
-      'Page.addScriptToEvaluateOnNewDocument',
       'Network.enable',
       'Page.enable',
       'Page.setLifecycleEventsEnabled',
@@ -442,7 +437,6 @@ describe('CdpWsProxy', () => {
     expect(response.result).toEqual({})
     expect(getSendCommandMethods(mock)).toEqual([
       'Page.enable',
-      'Page.addScriptToEvaluateOnNewDocument',
       'Network.enable',
       'Page.enable',
       'Page.setLifecycleEventsEnabled'
@@ -462,7 +456,7 @@ describe('CdpWsProxy', () => {
       sessionId: 'iframe-session-123'
     })
 
-    expect(getSendCommandCalls(mock).slice(2)).toEqual([
+    expect(getSendCommandCalls(mock).slice(1)).toEqual([
       ['Network.enable', {}, 'iframe-session-123'],
       ['Page.enable', {}, 'iframe-session-123'],
       ['Page.setLifecycleEventsEnabled', { enabled: true }, 'iframe-session-123'],
@@ -481,7 +475,7 @@ describe('CdpWsProxy', () => {
       sessionId: 'iframe-session-123'
     })
 
-    expect(getSendCommandCalls(mock).slice(2)).toEqual([
+    expect(getSendCommandCalls(mock).slice(1)).toEqual([
       ['Network.enable', {}, 'iframe-session-123'],
       ['Page.enable', {}, 'iframe-session-123'],
       ['Page.setLifecycleEventsEnabled', { enabled: true }, 'iframe-session-123'],
@@ -562,11 +556,7 @@ describe('CdpWsProxy', () => {
 
     expect(response.id).toBe(13)
     expect(response.result).toEqual({})
-    expect(getSendCommandMethods(mock)).toEqual([
-      'Page.enable',
-      'Page.addScriptToEvaluateOnNewDocument',
-      'Runtime.evaluate'
-    ])
+    expect(getSendCommandMethods(mock)).toEqual(['Page.enable', 'Runtime.evaluate'])
     client.close()
   })
 
diff --git a/src/main/claude-accounts/claude-structured-auth-policy.test.ts b/src/main/claude-accounts/claude-structured-auth-policy.test.ts
new file mode 100644
index 00000000000..a2d7c7d5da8
--- /dev/null
+++ b/src/main/claude-accounts/claude-structured-auth-policy.test.ts
@@ -0,0 +1,168 @@
+import { describe, expect, it } from 'vitest'
+import type { GlobalSettings } from '../../shared/global-settings-types'
+import type { ClaudeManagedAccount } from '../../shared/managed-account-types'
+import {
+  CLAUDE_AUTH_ENV_VARS,
+  hasClaudeAuthEnvConflict,
+  shouldStripClaudeAuthEnvForAccount
+} from './environment'
+import {
+  normalizeTuiAgentEnvRecord,
+  resolveTuiAgentLaunchEnv
+} from '../../shared/tui-agent-launch-defaults'
+import { claudeStructuredAuthPolicyForSettings } from './claude-structured-auth-policy'
+
+const HOST_ACCOUNT = { id: 'host-a', managedAuthRuntime: 'host' } as ClaudeManagedAccount
+const WSL_ACCOUNT = { id: 'wsl-b', managedAuthRuntime: 'wsl' } as ClaudeManagedAccount
+const LEGACY_ACCOUNT = { id: 'legacy-c' } as ClaudeManagedAccount
+
+function settings(
+  overrides: Partial<
+    Pick<
+      GlobalSettings,
+      | 'claudeManagedAccounts'
+      | 'activeClaudeManagedAccountId'
+      | 'activeClaudeManagedAccountIdsByRuntime'
+    >
+  >
+): Parameters<typeof claudeStructuredAuthPolicyForSettings>[0] {
+  return {
+    claudeManagedAccounts: [HOST_ACCOUNT, WSL_ACCOUNT, LEGACY_ACCOUNT],
+    activeClaudeManagedAccountId: null,
+    ...overrides
+  } as Parameters<typeof claudeStructuredAuthPolicyForSettings>[0]
+}
+
+// The predicate now backs BOTH transports (runtime-auth-preparation.ts and the
+// structured wiring), so it needs a test of its own: forcing it to a constant used
+// to leave ~1000 tests green.
+describe('shouldStripClaudeAuthEnvForAccount', () => {
+  it('does not strip when no managed account is selected', () => {
+    expect(shouldStripClaudeAuthEnvForAccount([HOST_ACCOUNT], null)).toBe(false)
+    expect(shouldStripClaudeAuthEnvForAccount([HOST_ACCOUNT], undefined)).toBe(false)
+    expect(shouldStripClaudeAuthEnvForAccount([HOST_ACCOUNT], '')).toBe(false)
+  })
+
+  it('strips for a host-managed account', () => {
+    expect(shouldStripClaudeAuthEnvForAccount([HOST_ACCOUNT, WSL_ACCOUNT], 'host-a')).toBe(true)
+  })
+
+  it('strips for an account with no explicit runtime (the legacy host shape)', () => {
+    expect(shouldStripClaudeAuthEnvForAccount([LEGACY_ACCOUNT], 'legacy-c')).toBe(true)
+  })
+
+  it('does not strip for a WSL-managed account, matching runtime-auth-preparation', () => {
+    expect(shouldStripClaudeAuthEnvForAccount([HOST_ACCOUNT, WSL_ACCOUNT], 'wsl-b')).toBe(false)
+  })
+
+  it('strips for a selected id no account list explains', () => {
+    // Fail-safe: an id we cannot resolve is treated as a pinned account, never as
+    // "no account", so an unreadable settings blob cannot open the strip.
+    expect(shouldStripClaudeAuthEnvForAccount([HOST_ACCOUNT], 'deleted-d')).toBe(true)
+    expect(shouldStripClaudeAuthEnvForAccount(undefined, 'deleted-d')).toBe(true)
+    expect(shouldStripClaudeAuthEnvForAccount([], 'deleted-d')).toBe(true)
+  })
+})
+
+describe('claudeStructuredAuthPolicyForSettings', () => {
+  it('reads the host runtime selection, not the legacy flat field alone', () => {
+    expect(
+      claudeStructuredAuthPolicyForSettings(
+        settings({
+          activeClaudeManagedAccountId: 'host-a',
+          activeClaudeManagedAccountIdsByRuntime: { host: null, wsl: {} }
+        })
+      )
+    ).toEqual({ stripAuthEnv: true })
+  })
+
+  it('strips when a host account is pinned by runtime selection', () => {
+    expect(
+      claudeStructuredAuthPolicyForSettings(
+        settings({ activeClaudeManagedAccountIdsByRuntime: { host: 'host-a', wsl: {} } })
+      )
+    ).toEqual({ stripAuthEnv: true })
+  })
+
+  it('does not strip for system auth, so an API-key-only user keeps their sign-in', () => {
+    expect(claudeStructuredAuthPolicyForSettings(settings({}))).toEqual({ stripAuthEnv: false })
+  })
+
+  it('ignores a WSL-only selection: the structured child is always a native host process', () => {
+    expect(
+      claudeStructuredAuthPolicyForSettings(
+        settings({
+          activeClaudeManagedAccountIdsByRuntime: { host: null, wsl: { Ubuntu: 'wsl-b' } }
+        })
+      )
+    ).toEqual({ stripAuthEnv: false })
+  })
+})
+
+describe('the strip vocabulary the policy governs', () => {
+  it('covers every Anthropic auth variable the terminal path knows about', () => {
+    // A new auth var added to the list without a matching refusal/strip path is the
+    // shape of the leak this lane already shipped once.
+    expect([...CLAUDE_AUTH_ENV_VARS]).toEqual([
+      'ANTHROPIC_API_KEY',
+      'ANTHROPIC_AUTH_TOKEN',
+      'CLAUDE_CODE_OAUTH_TOKEN',
+      'AWS_BEARER_TOKEN_BEDROCK'
+    ])
+  })
+})
+
+// The refusal has to cover exactly what the strip removes. Anything narrower lets an
+// override reach the child that applyClaudeEnvPatch would have deleted.
+describe('hasClaudeAuthEnvConflict matches the strip it guards', () => {
+  it('refuses each Anthropic auth variable', () => {
+    for (const key of CLAUDE_AUTH_ENV_VARS) {
+      expect(hasClaudeAuthEnvConflict({ [key]: 'v' }, 'linux')).toBe(true)
+    }
+  })
+
+  // `ANTHROPIC_API_KEY=` in the agent env box is how a user blanks a variable, and the
+  // settings pipeline preserves the empty value (agent-default-env-draft.ts assigns
+  // everything after the `=`; normalizeTuiAgentEnvRecord drops empty KEYS only). An
+  // empty value cannot beat the pinned account and the strip removes the name anyway,
+  // so refusing it would break a terminal launch that works today for no security gain.
+  it('admits an override whose value is empty, the documented way to blank a variable', () => {
+    expect(hasClaudeAuthEnvConflict({ ANTHROPIC_API_KEY: '' }, 'linux')).toBe(false)
+    expect(hasClaudeAuthEnvConflict({ anthropic_api_key: '' }, 'win32')).toBe(false)
+    expect(hasClaudeAuthEnvConflict({ ANTHROPIC_CUSTOM_HEADERS: '' }, 'linux')).toBe(false)
+  })
+
+  it('still refuses the same names once they carry a value', () => {
+    expect(hasClaudeAuthEnvConflict({ ANTHROPIC_API_KEY: 'sk-ant' }, 'linux')).toBe(true)
+  })
+
+  // The end-to-end shape the regression actually took: settings text -> normalized
+  // record -> launch env -> the predicate the terminal preflight gates on.
+  it('admits a blanked variable all the way from the settings record', () => {
+    const configured = normalizeTuiAgentEnvRecord({ claude: { ANTHROPIC_API_KEY: '' } })
+    const launchEnv = resolveTuiAgentLaunchEnv('claude', configured)
+
+    expect(launchEnv).toEqual({ ANTHROPIC_API_KEY: '' })
+    expect(hasClaudeAuthEnvConflict(launchEnv, 'linux')).toBe(false)
+  })
+
+  it('folds case on win32, where the OS does', () => {
+    expect(hasClaudeAuthEnvConflict({ anthropic_api_key: 'sk-lower' }, 'win32')).toBe(true)
+    expect(hasClaudeAuthEnvConflict({ Anthropic_Custom_Headers: 'x-api-key: v' }, 'win32')).toBe(
+      true
+    )
+  })
+
+  it('keeps env names case-sensitive off win32', () => {
+    expect(hasClaudeAuthEnvConflict({ anthropic_api_key: 'sk-lower' }, 'linux')).toBe(false)
+  })
+
+  it('admits non-auth Anthropic settings on both platforms', () => {
+    expect(hasClaudeAuthEnvConflict({ ANTHROPIC_BASE_URL: 'https://gw.test' }, 'linux')).toBe(false)
+    expect(hasClaudeAuthEnvConflict({ ANTHROPIC_BASE_URL: 'https://gw.test' }, 'win32')).toBe(false)
+    expect(hasClaudeAuthEnvConflict({ ANTHROPIC_CUSTOM_HEADERS: 'X-Trace: 1' }, 'linux')).toBe(
+      false
+    )
+    expect(hasClaudeAuthEnvConflict(undefined, 'linux')).toBe(false)
+  })
+})
diff --git a/src/main/claude-accounts/claude-structured-auth-policy.ts b/src/main/claude-accounts/claude-structured-auth-policy.ts
new file mode 100644
index 00000000000..c30cd69b827
--- /dev/null
+++ b/src/main/claude-accounts/claude-structured-auth-policy.ts
@@ -0,0 +1,37 @@
+import type { GlobalSettings } from '../../shared/global-settings-types'
+import { shouldStripClaudeAuthEnvForAccount } from './environment'
+import { getSelectedClaudeAccountIdForTarget } from './runtime-selection'
+
+/** The structured mirror of the terminal preflight's `prepareClaudeAuth` result:
+ *  the one field a launch resolution needs from the managed-account state. */
+export type ClaudeStructuredAuthPolicy = {
+  stripAuthEnv: boolean
+}
+
+/**
+ * The only supported way to build a structured launch's auth policy.
+ *
+ * It exists as a named function rather than an inline object at the wiring site so
+ * that the settings-to-policy mapping is testable on its own: the one production
+ * wiring lives in a `@ts-nocheck` file, where neither the compiler nor a type test
+ * can see a dropped field.
+ *
+ * Structured Claude always spawns a native local-host child — the launch resolver
+ * refuses any record with a remote execution host or a WSL distro — so the host
+ * selection, not the platform default target, owns its auth.
+ */
+export function claudeStructuredAuthPolicyForSettings(
+  settings: Pick<
+    GlobalSettings,
+    | 'claudeManagedAccounts'
+    | 'activeClaudeManagedAccountId'
+    | 'activeClaudeManagedAccountIdsByRuntime'
+  >
+): ClaudeStructuredAuthPolicy {
+  return {
+    stripAuthEnv: shouldStripClaudeAuthEnvForAccount(
+      settings.claudeManagedAccounts,
+      getSelectedClaudeAccountIdForTarget(settings, { runtime: 'host' })
+    )
+  }
+}
diff --git a/src/main/claude-accounts/environment.ts b/src/main/claude-accounts/environment.ts
index 83fe3b40209..b85dd60a854 100644
--- a/src/main/claude-accounts/environment.ts
+++ b/src/main/claude-accounts/environment.ts
@@ -1,3 +1,5 @@
+import type { ClaudeManagedAccount } from '../../shared/managed-account-types'
+
 export const CLAUDE_AUTH_ENV_VARS = [
   'ANTHROPIC_API_KEY',
   'ANTHROPIC_AUTH_TOKEN',
@@ -13,14 +15,21 @@ export type ClaudeEnvPatch = {
 export function applyClaudeEnvPatch(
   baseEnv: Record<string, string>,
   patch: ClaudeEnvPatch,
-  options?: { stripAuthEnv?: boolean }
+  options?: { stripAuthEnv?: boolean; platform?: NodeJS.Platform }
 ): Record<string, string> {
   if (options?.stripAuthEnv) {
     for (const key of CLAUDE_AUTH_ENV_VARS) {
       delete baseEnv[key]
     }
-    if (isAuthLikeCustomHeaders(baseEnv.ANTHROPIC_CUSTOM_HEADERS)) {
-      delete baseEnv.ANTHROPIC_CUSTOM_HEADERS
+    const platform = options.platform ?? process.platform
+    for (const key of Object.keys(baseEnv)) {
+      const normalized = platform === 'win32' ? key.toUpperCase() : key
+      if (
+        (platform === 'win32' && CLAUDE_AUTH_ENV_VARS.some((authKey) => authKey === normalized)) ||
+        (normalized === 'ANTHROPIC_CUSTOM_HEADERS' && isAuthLikeCustomHeaders(baseEnv[key]))
+      ) {
+        delete baseEnv[key]
+      }
     }
   }
 
@@ -34,16 +43,94 @@ export function applyClaudeEnvPatch(
   return baseEnv
 }
 
-export function hasClaudeAuthEnvConflict(env: Record<string, string> | undefined): boolean {
-  if (!env) {
+/** One string for every transport, so a terminal launch and a structured launch
+ *  cannot drift into telling the user two different things about one refusal. */
+export const CLAUDE_AUTH_ENV_CONFLICT_MESSAGE =
+  'This Claude launch defines explicit Anthropic auth environment variables. Remove those overrides before using a managed Claude account.'
+
+export const CLAUDE_AUTH_SWITCH_IN_PROGRESS_MESSAGE =
+  'A Claude account switch is in progress. Try again after it finishes.'
+
+/**
+ * Whether a launch on the host runtime must drop inherited Anthropic auth.
+ *
+ * Only a pinned host-managed account owns the credential, so only it may strip:
+ * with no managed account the user's own `ANTHROPIC_*` is their sign-in, and
+ * removing it signs them out of a CLI that would otherwise have worked.
+ */
+export function shouldStripClaudeAuthEnvForAccount(
+  accounts: readonly ClaudeManagedAccount[] | undefined,
+  activeAccountId: string | null | undefined
+): boolean {
+  if (!activeAccountId) {
     return false
   }
   return (
-    CLAUDE_AUTH_ENV_VARS.some((key) => Boolean(env[key])) ||
-    isAuthLikeCustomHeaders(env.ANTHROPIC_CUSTOM_HEADERS)
+    (accounts ?? []).find((account) => account.id === activeAccountId)?.managedAuthRuntime !== 'wsl'
   )
 }
 
+/**
+ * Whether a launch's explicit env carries Anthropic auth a managed account must own.
+ *
+ * The key comparison mirrors applyClaudeEnvPatch's strip exactly: case-insensitive on
+ * win32, where the OS folds env names so `anthropic_api_key` is an effective
+ * `ANTHROPIC_API_KEY`, and case-sensitive elsewhere. A refusal narrower than the strip
+ * lets an override through that the strip would have removed.
+ *
+ * A non-empty value is what makes it a conflict. `ANTHROPIC_API_KEY=` in the agent env
+ * box is how a user blanks a variable — the settings pipeline preserves that empty value
+ * (normalizeTuiAgentEnvRecord drops empty KEYS only) — and an empty override can neither
+ * authenticate nor beat the pinned account, while the strip removes the name regardless.
+ * Refusing it would break a terminal launch that works today for no security gain.
+ */
+/**
+ * The inherited Anthropic auth a non-stripping launch has to carry forward explicitly.
+ *
+ * applyClaudeEnvPatch always strips the inherited half of a child env, and the
+ * configured half is what overrides it — so a system-auth user's own key only survives
+ * if the caller puts it back deliberately. Returns the exact keys present, so a
+ * win32 `anthropic_api_key` is carried under the name the OS actually has.
+ */
+export function claudeAuthEnvCarriedForward(
+  inherited: NodeJS.ProcessEnv,
+  platform: NodeJS.Platform = process.platform
+): Record<string, string> {
+  const carried: Record<string, string> = {}
+  for (const [key, value] of Object.entries(inherited)) {
+    if (value === undefined) {
+      continue
+    }
+    const normalized = platform === 'win32' ? key.toUpperCase() : key
+    if (
+      CLAUDE_AUTH_ENV_VARS.some((authKey) => authKey === normalized) ||
+      (normalized === 'ANTHROPIC_CUSTOM_HEADERS' && isAuthLikeCustomHeaders(value))
+    ) {
+      carried[key] = value
+    }
+  }
+  return carried
+}
+
+export function hasClaudeAuthEnvConflict(
+  env: Record<string, string> | undefined,
+  platform: NodeJS.Platform = process.platform
+): boolean {
+  if (!env) {
+    return false
+  }
+  for (const [key, value] of Object.entries(env)) {
+    const normalized = platform === 'win32' ? key.toUpperCase() : key
+    if (value && CLAUDE_AUTH_ENV_VARS.some((authKey) => authKey === normalized)) {
+      return true
+    }
+    if (normalized === 'ANTHROPIC_CUSTOM_HEADERS' && isAuthLikeCustomHeaders(value)) {
+      return true
+    }
+  }
+  return false
+}
+
 function isAuthLikeCustomHeaders(value: string | undefined): boolean {
   if (!value) {
     return false
diff --git a/src/main/claude-accounts/live-pty-gate.ts b/src/main/claude-accounts/live-pty-gate.ts
index 9e30b621924..caab66c3430 100644
--- a/src/main/claude-accounts/live-pty-gate.ts
+++ b/src/main/claude-accounts/live-pty-gate.ts
@@ -5,6 +5,13 @@ const liveClaudePtyIds = new Set<string>()
 // survived the app restart inside the daemon.
 const seededUnconfirmedPtyIds = new Set<string>()
 let switchInProgress = false
+// Woken by endClaudeAuthSwitch so a caller past the point of no return can wait the
+// swap out instead of refusing. See whenClaudeAuthSwitchSettles.
+const switchSettledListeners = new Set<() => void>()
+
+/** A managed account swap is a credential-file rewrite, not a network round trip;
+ *  anything past this is a wedged switch, and refusing beats waiting forever. */
+export const CLAUDE_AUTH_SWITCH_SETTLE_TIMEOUT_MS = 15_000
 
 export type ClaudeLivePtyPersistence = {
   addClaudeLivePtySessionId(sessionId: string): void
@@ -81,6 +88,35 @@ export function markClaudePtyExited(ptyId: string): void {
   notifyDrainedOnTransition(hadLivePtys)
 }
 
+/**
+ * Register a structured Claude child with the same gate the terminal path uses.
+ *
+ * The gate is what makes the managed OAuth refresh defer instead of rotating a
+ * single-use refresh token out from under a running Claude (runtime-auth-sync.ts).
+ * A structured session's child is as much a live Claude as a PTY's is, so it has to
+ * hold the gate too — otherwise a refresh mid-turn breaks its next API call while an
+ * identical terminal session is protected.
+ *
+ * Deliberately not persisted, unlike markClaudePtySpawned: these children are direct
+ * children of this process and cannot survive a restart, so seeding them back on the
+ * next launch would hold the gate closed for a process that is provably gone.
+ */
+export function markClaudeStructuredChildSpawned(childKey: string): void {
+  liveClaudePtyIds.add(structuredChildGateId(childKey))
+}
+
+export function markClaudeStructuredChildExited(childKey: string): void {
+  const hadLivePtys = liveClaudePtyIds.size > 0
+  liveClaudePtyIds.delete(structuredChildGateId(childKey))
+  notifyDrainedOnTransition(hadLivePtys)
+}
+
+// Namespaced so a structured child can never collide with a daemon PTY session id,
+// which confirmSeededClaudeLivePtys reconciles against the daemon's own list.
+function structuredChildGateId(childKey: string): string {
+  return `claude-structured:${childKey}`
+}
+
 export function hasLiveClaudePtys(): boolean {
   return liveClaudePtyIds.size > 0
 }
@@ -93,7 +129,44 @@ export function beginClaudeAuthSwitch(): void {
 }
 
 export function endClaudeAuthSwitch(): void {
+  const wasInProgress = switchInProgress
   switchInProgress = false
+  if (!wasInProgress) {
+    return
+  }
+  // Each listener removes itself as it settles; Set iteration is defined over that.
+  for (const listener of switchSettledListeners) {
+    listener()
+  }
+}
+
+/**
+ * Resolves `true` once no account switch is running, `false` if one is still running
+ * at the deadline.
+ *
+ * Exists for callers that have already done irreversible work — a structured acquire
+ * has closed the old child by the time it resolves its launch, so turning a switch
+ * into a refusal there strands the user with a dead session and no replacement.
+ * Waiting for the swap and then launching against it is the recoverable answer;
+ * refusing is only correct when nothing has been torn down yet.
+ */
+export function whenClaudeAuthSwitchSettles(
+  timeoutMs = CLAUDE_AUTH_SWITCH_SETTLE_TIMEOUT_MS
+): Promise<boolean> {
+  if (!switchInProgress) {
+    return Promise.resolve(true)
+  }
+  return new Promise<boolean>((resolve) => {
+    const settle = (settled: boolean): void => {
+      switchSettledListeners.delete(listener)
+      clearTimeout(timer)
+      resolve(settled)
+    }
+    const listener = (): void => settle(true)
+    switchSettledListeners.add(listener)
+    const timer = setTimeout(() => settle(false), timeoutMs)
+    timer.unref?.()
+  })
 }
 
 export function isClaudeAuthSwitchInProgress(): boolean {
diff --git a/src/main/claude-accounts/runtime-auth/runtime-auth-preparation.ts b/src/main/claude-accounts/runtime-auth/runtime-auth-preparation.ts
index ae79c4c7bbb..dabcd9d472f 100644
--- a/src/main/claude-accounts/runtime-auth/runtime-auth-preparation.ts
+++ b/src/main/claude-accounts/runtime-auth/runtime-auth-preparation.ts
@@ -2,6 +2,7 @@ import { join } from 'node:path'
 import type { ClaudeManagedAccount } from '../../../shared/managed-account-types'
 import { resolveLocalAccountRuntimeTarget } from '../../../shared/local-account-runtime'
 import { parseWslUncPath } from '../../../shared/wsl-paths'
+import { shouldStripClaudeAuthEnvForAccount } from '../environment'
 import { getDefaultWslDistro, getWslHome } from '../../wsl'
 import {
   getSelectedClaudeAccountIdForTarget,
@@ -69,7 +70,10 @@ export class ClaudeRuntimeAuthPreparationService extends ClaudeRuntimeAuthSnapsh
       wslDistro: null,
       wslLinuxConfigDir: null,
       envPatch: paths.envPatch,
-      stripAuthEnv: Boolean(activeAccountId && activeAccount?.managedAuthRuntime !== 'wsl'),
+      stripAuthEnv: shouldStripClaudeAuthEnvForAccount(
+        settings.claudeManagedAccounts,
+        activeAccountId
+      ),
       managedRefreshDeferredByLivePty: Boolean(
         activeAccountId &&
         activeAccount?.managedAuthRuntime !== 'wsl' &&
diff --git a/src/main/claude-usage/transcript-record-parser-prefilter.test.ts b/src/main/claude-usage/transcript-record-parser-prefilter.test.ts
new file mode 100644
index 00000000000..992b4ba8fd3
--- /dev/null
+++ b/src/main/claude-usage/transcript-record-parser-prefilter.test.ts
@@ -0,0 +1,40 @@
+import { describe, expect, it } from 'vitest'
+import { parseClaudeUsageRecord } from './transcript-record-parser'
+
+function assistantLine(overrides: Record<string, unknown> = {}): string {
+  return JSON.stringify({
+    type: 'assistant',
+    sessionId: 'session-1',
+    timestamp: '2026-01-01T00:00:00.000Z',
+    message: { usage: { input_tokens: 3, output_tokens: 5 } },
+    ...overrides
+  })
+}
+
+describe('assistant-record prefilter', () => {
+  it('still parses an ordinary assistant record', () => {
+    expect(parseClaudeUsageRecord(assistantLine())?.inputTokens).toBe(3)
+  })
+
+  it('rejects a user record that never mentions assistant', () => {
+    const userLine = JSON.stringify({
+      type: 'user',
+      sessionId: 'session-1',
+      timestamp: '2026-01-01T00:00:00.000Z',
+      message: { content: 'x'.repeat(200) }
+    })
+
+    expect(parseClaudeUsageRecord(userLine)).toBeNull()
+  })
+
+  it('rejects a non-assistant record that happens to contain the word assistant', () => {
+    const userLine = JSON.stringify({
+      type: 'user',
+      sessionId: 'session-1',
+      timestamp: '2026-01-01T00:00:00.000Z',
+      message: { content: 'ask the assistant about this' }
+    })
+
+    expect(parseClaudeUsageRecord(userLine)).toBeNull()
+  })
+})
diff --git a/src/main/claude-usage/transcript-record-parser.ts b/src/main/claude-usage/transcript-record-parser.ts
index 59b0e75be39..2ad51f3ee90 100644
--- a/src/main/claude-usage/transcript-record-parser.ts
+++ b/src/main/claude-usage/transcript-record-parser.ts
@@ -84,10 +84,30 @@ function dedupeClaudeUsageTurns(
   return deduped
 }
 
+/**
+ * Necessary condition for `JSON.parse(line).type === 'assistant'`, checked before the parse.
+ *
+ * Sound for any transcript written by a standard JSON serializer: `JSON.stringify` (which writes
+ * these files) escapes only quotes, backslashes and control characters, never ASCII letters, so
+ * the decoded value can only be `assistant` if the line spells it literally. The gate over-admits
+ * freely — the `parsed.type` check below stays authoritative.
+ *
+ * A `\u`-escape fallback was measured and rejected: it costs a second full-line scan and made
+ * transcripts whose tool results contain control characters 1.43x slower overall.
+ */
+function mayEncodeAssistantType(line: string): boolean {
+  return line.includes('assistant')
+}
+
 function parseClaudeUsageSourceRecord(
   line: string,
   fallbackSessionId: string | null = null
 ): ClaudeUsageParsedSourceTurn | null {
+  // Only assistant records carry usage, but transcripts interleave user/tool-result lines that
+  // routinely embed whole files. Reject those before paying for a full parse.
+  if (!mayEncodeAssistantType(line)) {
+    return null
+  }
   let parsed: ClaudeUsageSourceRecord
   try {
     parsed = JSON.parse(line) as ClaudeUsageSourceRecord
diff --git a/src/main/claude/__fixtures__/claude-agent-sdk-scripted-cli.mjs b/src/main/claude/__fixtures__/claude-agent-sdk-scripted-cli.mjs
new file mode 100644
index 00000000000..4f2a09425fd
--- /dev/null
+++ b/src/main/claude/__fixtures__/claude-agent-sdk-scripted-cli.mjs
@@ -0,0 +1,144 @@
+// Scripted stand-in for the Claude Code CLI, driven by the SDK contract-pin
+// tests. It speaks just enough stream-json to satisfy the SDK: it answers every
+// inbound control_request with a success control_response, records everything it
+// observes to a report file, and plays back the steps listed in a scenario file.
+//
+// Env contract (set by the test):
+//   ORCA_SDK_CONTRACT_SCENARIO_PATH — JSON file
+//     { steps: Step[], controlResponses?: { [subtype]: <response> } } where a Step is
+//     { emit: <frame> } | { awaitUserMessage: true } | { stderr: <text> } |
+//     { awaitControlResponse: <request_id> } | { delayMs: <n> } | { exit: <code> }
+//   ORCA_SDK_CONTRACT_REPORT_PATH — where argv/env observations are written
+//   ORCA_SDK_CONTRACT_IGNORE_SIGTERM — trap SIGTERM/SIGINT and outlive stdin close
+//   ORCA_SDK_CONTRACT_IGNORE_CONTROL_REQUESTS — record control requests but never answer
+//   ORCA_SDK_CONTRACT_DESCENDANT — fork an idle grandchild and report its pid
+import { spawn } from 'node:child_process'
+import { readFileSync, writeFileSync } from 'node:fs'
+import { createInterface } from 'node:readline'
+
+const scenarioPath = process.env.ORCA_SDK_CONTRACT_SCENARIO_PATH
+const reportPath = process.env.ORCA_SDK_CONTRACT_REPORT_PATH
+
+const report = {
+  argv: process.argv.slice(1),
+  execPath: process.execPath,
+  controlRequests: [],
+  controlResponses: [],
+  userMessages: [],
+  descendantPid: null
+}
+const writeReport = () => {
+  if (reportPath) {
+    writeFileSync(reportPath, JSON.stringify(report))
+  }
+}
+// Written immediately so a test can prove which script the SDK executed even if
+// the session dies before the scenario completes.
+writeReport()
+
+const scenario = scenarioPath ? JSON.parse(readFileSync(scenarioPath, 'utf8')) : { steps: [] }
+
+if (process.env.ORCA_SDK_CONTRACT_IGNORE_SIGTERM) {
+  process.on('SIGTERM', () => {})
+  process.on('SIGINT', () => {})
+  setInterval(() => {}, 1_000_000)
+}
+if (process.env.ORCA_SDK_CONTRACT_DESCENDANT) {
+  const descendant = spawn(process.execPath, ['-e', 'setInterval(() => {}, 1000000)'], {
+    stdio: 'ignore'
+  })
+  descendant.unref()
+  report.descendantPid = descendant.pid ?? null
+  writeReport()
+}
+
+const emit = (frame) => process.stdout.write(`${JSON.stringify(frame)}\n`)
+
+const waiters = []
+const settle = (kind, requestId) => {
+  for (let i = waiters.length - 1; i >= 0; i--) {
+    const waiter = waiters[i]
+    if (
+      waiter.kind === kind &&
+      (waiter.requestId === undefined || waiter.requestId === requestId)
+    ) {
+      waiters.splice(i, 1)
+      waiter.resolve()
+    }
+  }
+}
+const waitFor = (kind, requestId) => {
+  if (kind === 'user' && report.userMessages.length > 0) {
+    return Promise.resolve()
+  }
+  if (
+    kind === 'control_response' &&
+    report.controlResponses.some((frame) => frame.response?.request_id === requestId)
+  ) {
+    return Promise.resolve()
+  }
+  return new Promise((resolve) => waiters.push({ kind, requestId, resolve }))
+}
+
+createInterface({ input: process.stdin }).on('line', (line) => {
+  let frame
+  try {
+    frame = JSON.parse(line)
+  } catch {
+    return
+  }
+  if (frame.type === 'control_request') {
+    report.controlRequests.push(frame)
+    writeReport()
+    if (process.env.ORCA_SDK_CONTRACT_IGNORE_CONTROL_REQUESTS) {
+      return
+    }
+    emit({
+      type: 'control_response',
+      response: {
+        subtype: 'success',
+        request_id: frame.request_id,
+        response: scenario.controlResponses?.[frame.request?.subtype] ?? {
+          commands: [],
+          models: []
+        }
+      }
+    })
+    return
+  }
+  if (frame.type === 'control_response') {
+    report.controlResponses.push(frame)
+    writeReport()
+    settle('control_response', frame.response?.request_id)
+    return
+  }
+  if (frame.type === 'user') {
+    report.userMessages.push(frame)
+    writeReport()
+    settle('user')
+  }
+})
+
+// Never outlive a wedged test: the readline subscription would otherwise hold
+// this process open forever if the SDK side stops driving the scenario.
+setTimeout(() => process.exit(3), 20_000).unref()
+
+for (const step of scenario.steps) {
+  if (step.emit) {
+    emit(step.emit)
+  } else if (step.stderr !== undefined) {
+    process.stderr.write(step.stderr)
+  } else if (step.awaitUserMessage) {
+    await waitFor('user')
+  } else if (step.awaitControlResponse !== undefined) {
+    await waitFor('control_response', step.awaitControlResponse)
+  } else if (step.delayMs) {
+    await new Promise((resolve) => setTimeout(resolve, step.delayMs))
+  } else if (step.exit !== undefined) {
+    // A CLI that refuses to start: leave with its own status, stderr already written.
+    writeReport()
+    process.exit(step.exit)
+  }
+}
+writeReport()
+process.exit(0)
diff --git a/src/main/claude/claude-agent-sdk-contract-pins.test.ts b/src/main/claude/claude-agent-sdk-contract-pins.test.ts
new file mode 100644
index 00000000000..46bcb7219d3
--- /dev/null
+++ b/src/main/claude/claude-agent-sdk-contract-pins.test.ts
@@ -0,0 +1,519 @@
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { createRequire } from 'node:module'
+import { tmpdir } from 'node:os'
+import { dirname, join } from 'node:path'
+import {
+  query,
+  type CanUseTool,
+  type Options,
+  type SDKUserMessage,
+  type SpawnedProcess as SdkSpawnedProcess,
+  type SpawnOptions as SdkSpawnOptions
+} from '@anthropic-ai/claude-agent-sdk'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { spawnProcess } from '../../shared/child-process/run-process'
+import type { AgentSessionRecord } from '../../shared/agent-session-record'
+import { LOCAL_EXECUTION_HOST_ID } from '../../shared/execution-host'
+import type { AgentSessionRecordStore } from '../runtime/agent-session-record-store'
+import { claudeQuerySettingsReader } from './claude-agent-sdk-control-requests'
+import { createClaudeStructuredLaunchResolver } from './claude-structured-launch-resolution'
+
+// Contract pins for @anthropic-ai/claude-agent-sdk, run against the real SDK
+// driving a scripted fake CLI (never the real Claude binary). These tests exist
+// to catch a future SDK version drifting under Orca: unknown-frame pass-through,
+// spawner env fidelity, argument parity with the pre-SDK argv,
+// permission-callback semantics, and executable-path override.
+
+const FAKE_CLI = join(__dirname, '__fixtures__', 'claude-agent-sdk-scripted-cli.mjs')
+const SESSION_ID = '5348c19f-6a54-4c2e-9c68-9c2b1a3d4e5f'
+const LEAF_UUID = 'ad0f7c9e-1b2c-4d3e-8f90-abc123def456'
+const PINNED_SDK_VERSION = '0.3.251'
+const SDK_PLATFORM_PACKAGE_BASENAMES = [
+  'claude-agent-sdk-darwin-arm64',
+  'claude-agent-sdk-darwin-x64',
+  'claude-agent-sdk-linux-arm64',
+  'claude-agent-sdk-linux-arm64-musl',
+  'claude-agent-sdk-linux-x64',
+  'claude-agent-sdk-linux-x64-musl',
+  'claude-agent-sdk-win32-arm64',
+  'claude-agent-sdk-win32-x64'
+]
+
+/**
+ * The exact argv the hand-rolled transport built before the SDK swap. Frozen here
+ * as the parity oracle: CLAUDE_STRUCTURED_BASE_OPTIONS has to keep producing it.
+ */
+const PRE_SDK_ARGV = [
+  '-p',
+  '--input-format',
+  'stream-json',
+  '--output-format',
+  'stream-json',
+  '--include-partial-messages',
+  '--verbose',
+  '--replay-user-messages',
+  '--permission-prompt-tool',
+  'stdio',
+  '--setting-sources',
+  'user,project,local'
+]
+
+const RESULT_FRAME = {
+  type: 'result',
+  subtype: 'success',
+  is_error: false,
+  duration_ms: 1,
+  duration_api_ms: 1,
+  num_turns: 1,
+  result: 'ok',
+  session_id: SESSION_ID,
+  total_cost_usd: 0,
+  usage: { input_tokens: 1, output_tokens: 1 },
+  uuid: 'uuid-result-1'
+}
+
+type ScenarioStep = Record<string, unknown>
+type SpawnSeen = {
+  command: string
+  args: string[]
+  cwd: string | undefined
+  env: Record<string, string | undefined>
+}
+type ScriptedCliReport = {
+  argv: string[]
+  execPath: string
+  controlRequests: { request_id: string; request: { subtype: string } }[]
+  controlResponses: { response: { request_id: string; response?: Record<string, unknown> } }[]
+  userMessages: Record<string, unknown>[]
+}
+
+const scratchDirs: string[] = []
+afterEach(() => {
+  vi.unstubAllEnvs()
+  for (const dir of scratchDirs.splice(0)) {
+    rmSync(dir, { recursive: true, force: true })
+  }
+})
+
+function scriptScenario(
+  steps: ScenarioStep[],
+  controlResponses: Record<string, unknown> = {}
+): {
+  scenarioPath: string
+  reportPath: string
+  cwd: string
+  readReport: () => ScriptedCliReport
+} {
+  const dir = mkdtempSync(join(tmpdir(), 'claude-sdk-contract-'))
+  scratchDirs.push(dir)
+  const scenarioPath = join(dir, 'scenario.json')
+  const reportPath = join(dir, 'report.json')
+  writeFileSync(scenarioPath, JSON.stringify({ steps, controlResponses }))
+  return {
+    scenarioPath,
+    reportPath,
+    cwd: dir,
+    readReport: () => JSON.parse(readFileSync(reportPath, 'utf8')) as ScriptedCliReport
+  }
+}
+
+function scenarioEnv(scenario: { scenarioPath: string; reportPath: string }) {
+  return {
+    PATH: process.env.PATH,
+    ORCA_SDK_CONTRACT_SCENARIO_PATH: scenario.scenarioPath,
+    ORCA_SDK_CONTRACT_REPORT_PATH: scenario.reportPath
+  }
+}
+
+function recordingSpawner(spawns: SpawnSeen[]) {
+  return (opts: SdkSpawnOptions): SdkSpawnedProcess => {
+    spawns.push({
+      command: opts.command,
+      args: [...opts.args],
+      cwd: opts.cwd,
+      env: { ...opts.env }
+    })
+    return spawnProcess({
+      program: opts.command,
+      args: opts.args,
+      cwd: opts.cwd,
+      env: opts.env as NodeJS.ProcessEnv,
+      signal: opts.signal
+    }) as unknown as SdkSpawnedProcess
+  }
+}
+
+function resolvedLaunch(launchArgs: string[]) {
+  const record = {
+    sessionId: 'contract-pin-session',
+    provider: 'claude',
+    location: {
+      executionHostId: LOCAL_EXECUTION_HOST_ID,
+      wslDistro: null,
+      workspaceId: 'workspace-1',
+      workspaceKind: 'folder'
+    },
+    accountHome: { variable: 'CLAUDE_CONFIG_DIR', path: '/home/work/.claude' },
+    providerHandleChain: [],
+    launchArgs
+  } as unknown as AgentSessionRecord
+  return createClaudeStructuredLaunchResolver({
+    store: { getRecord: () => record } as unknown as AgentSessionRecordStore,
+    resolveWorkspacePath: async () => '/repos/workspace-1',
+    resolveCommand: () => FAKE_CLI,
+    resolveAuthPolicy: () => ({ stripAuthEnv: true })
+  })({ identity: { sessionId: record.sessionId } as never })
+}
+
+function singleUserTurn(): AsyncIterable<SDKUserMessage> {
+  return (async function* () {
+    yield {
+      type: 'user',
+      message: { role: 'user', content: [{ type: 'text', text: 'hello' }] },
+      parent_tool_use_id: null,
+      session_id: SESSION_ID
+    } as SDKUserMessage
+    // Hold input open; the stream ends when the scripted CLI exits, and an
+    // unresolved bare promise does not keep the event loop alive.
+    await new Promise<void>(() => {})
+  })()
+}
+
+async function drainQuery(options: Options): Promise<Record<string, unknown>[]> {
+  const messages: Record<string, unknown>[] = []
+  for await (const message of query({ prompt: singleUserTurn(), options })) {
+    messages.push(message as unknown as Record<string, unknown>)
+  }
+  return messages
+}
+
+/** Expand `--flag=value` argv entries so both SDK spellings compare equal. */
+function normalizeArgv(args: string[]): string[] {
+  return args.flatMap((arg) => {
+    if (!arg.startsWith('--')) {
+      return [arg]
+    }
+    const eq = arg.indexOf('=')
+    return eq === -1 ? [arg] : [arg.slice(0, eq), arg.slice(eq + 1)]
+  })
+}
+
+/** Group the pre-SDK argv into flag/value pairs. */
+function flagTable(args: readonly string[]): { flag: string; value: string | null }[] {
+  const table: { flag: string; value: string | null }[] = []
+  for (let i = 0; i < args.length; i++) {
+    const flag = args[i]!
+    const next = args[i + 1]
+    if (next !== undefined && !next.startsWith('-')) {
+      table.push({ flag, value: next })
+      i++
+    } else {
+      table.push({ flag, value: null })
+    }
+  }
+  return table
+}
+
+describe('Claude Agent SDK contract pins', () => {
+  it('yields unknown types, unknown fields and unknown content blocks verbatim, and consumes keep_alive', async () => {
+    const unknownTopLevel = {
+      type: 'message_kind_from_the_future',
+      session_id: SESSION_ID,
+      uuid: 'uuid-unknown-1',
+      payload: { alpha: 1, nested: { flags: ['a', 'b'] } }
+    }
+    const assistantWithUnknowns = {
+      type: 'assistant',
+      message: {
+        id: 'msg-1',
+        type: 'message',
+        role: 'assistant',
+        model: 'claude-x',
+        content: [
+          { type: 'text', text: 'hello back' },
+          { type: 'content_block_from_the_future', payload: { depth: 3 } }
+        ],
+        stop_reason: null,
+        stop_sequence: null,
+        usage: { input_tokens: 1, output_tokens: 2 }
+      },
+      parent_tool_use_id: null,
+      uuid: 'uuid-assistant-1',
+      session_id: SESSION_ID,
+      field_from_the_future: 'preserved'
+    }
+    const scenario = scriptScenario([
+      { awaitUserMessage: true },
+      { emit: { type: 'keep_alive' } },
+      { emit: unknownTopLevel },
+      { emit: assistantWithUnknowns },
+      { emit: RESULT_FRAME }
+    ])
+    const spawns: SpawnSeen[] = []
+    const messages = await drainQuery({
+      pathToClaudeCodeExecutable: FAKE_CLI,
+      cwd: scenario.cwd,
+      env: scenarioEnv(scenario),
+      spawnClaudeCodeProcess: recordingSpawner(spawns)
+    })
+
+    expect(messages.find((m) => m.uuid === 'uuid-unknown-1')).toEqual(unknownTopLevel)
+    expect(messages.find((m) => m.uuid === 'uuid-assistant-1')).toEqual(assistantWithUnknowns)
+    // The SDK intercepts keep_alive internally — a liveness signal must never
+    // be derived from it reaching the consumer, because it does not.
+    expect(messages.some((m) => m.type === 'keep_alive')).toBe(false)
+    expect(messages.some((m) => m.type === 'result')).toBe(true)
+  })
+
+  it('hands the custom spawner exactly the caller-supplied env, plus the two pinned SDK mutations', async () => {
+    vi.stubEnv('ANTHROPIC_API_KEY', 'ambient-key-must-not-leak')
+    const scenario = scriptScenario([{ awaitUserMessage: true }, { emit: RESULT_FRAME }])
+    const spawns: SpawnSeen[] = []
+    await drainQuery({
+      pathToClaudeCodeExecutable: FAKE_CLI,
+      cwd: scenario.cwd,
+      env: {
+        ...scenarioEnv(scenario),
+        CLAUDE_CONFIG_DIR: '/pinned/claude-config',
+        ORCA_AGENT_SESSION_SPAWN_TOKEN: 'spawn-token-1',
+        NODE_OPTIONS: '--max-old-space-size=64'
+      },
+      spawnClaudeCodeProcess: recordingSpawner(spawns)
+    })
+
+    const env = spawns[0]!.env
+    // Supplied values arrive verbatim: the config-dir pin and spawn token are
+    // observable at this boundary, so Orca's auth scrubbing stays assertable.
+    expect(env.CLAUDE_CONFIG_DIR).toBe('/pinned/claude-config')
+    expect(env.ORCA_AGENT_SESSION_SPAWN_TOKEN).toBe('spawn-token-1')
+    // Ambient process.env is NOT merged in when env is supplied.
+    expect(env.ANTHROPIC_API_KEY).toBeUndefined()
+    // The SDK's two documented mutations, pinned so a change is noticed.
+    expect(env.CLAUDE_CODE_ENTRYPOINT).toBe('sdk-ts')
+    expect('NODE_OPTIONS' in env).toBe(false)
+  })
+
+  it('inherits process.env into the child when env is omitted — the ambient-auth sharp edge', async () => {
+    const scenario = scriptScenario([{ awaitUserMessage: true }, { emit: RESULT_FRAME }])
+    vi.stubEnv('ORCA_SDK_CONTRACT_SCENARIO_PATH', scenario.scenarioPath)
+    vi.stubEnv('ORCA_SDK_CONTRACT_REPORT_PATH', scenario.reportPath)
+    vi.stubEnv('ORCA_SDK_CONTRACT_AMBIENT_CANARY', 'inherited-from-process-env')
+    const spawns: SpawnSeen[] = []
+    await drainQuery({
+      pathToClaudeCodeExecutable: FAKE_CLI,
+      cwd: scenario.cwd,
+      spawnClaudeCodeProcess: recordingSpawner(spawns)
+    })
+
+    // Omitting env reproduces the ambient-auth-leak failure mode: the child
+    // sees everything in process.env. Orca must therefore always pass an
+    // explicit, fully-constructed env.
+    expect(spawns[0]!.env.ORCA_SDK_CONTRACT_AMBIENT_CANARY).toBe('inherited-from-process-env')
+  })
+
+  it('emits --replay-user-messages only through extraArgs, never on its own', async () => {
+    const scenario = scriptScenario([{ awaitUserMessage: true }, { emit: RESULT_FRAME }])
+    const bareSpawns: SpawnSeen[] = []
+    await drainQuery({
+      pathToClaudeCodeExecutable: FAKE_CLI,
+      cwd: scenario.cwd,
+      env: scenarioEnv(scenario),
+      spawnClaudeCodeProcess: recordingSpawner(bareSpawns)
+    })
+    expect(bareSpawns[0]!.args).not.toContain('--replay-user-messages')
+
+    const replayScenario = scriptScenario([{ awaitUserMessage: true }, { emit: RESULT_FRAME }])
+    const replaySpawns: SpawnSeen[] = []
+    await drainQuery({
+      pathToClaudeCodeExecutable: FAKE_CLI,
+      cwd: replayScenario.cwd,
+      env: scenarioEnv(replayScenario),
+      extraArgs: { 'replay-user-messages': null },
+      spawnClaudeCodeProcess: recordingSpawner(replaySpawns)
+    })
+    const replayArgs = replaySpawns[0]!.args
+    expect(replayArgs.filter((arg) => arg === '--replay-user-messages')).toHaveLength(1)
+  })
+
+  it('produces a matching CLI flag for every pre-SDK argv entry', async () => {
+    const scenario = scriptScenario([{ awaitUserMessage: true }, { emit: RESULT_FRAME }])
+    const spawns: SpawnSeen[] = []
+    // Driven by the real resolver, so the argv walk covers the durable-launchArgs
+    // translation and its merge order, not a hand-written options literal.
+    const launch = await resolvedLaunch(['--model', 'claude-sonnet-4-5', '--effort', 'high'])
+    await drainQuery({
+      ...launch.options,
+      pathToClaudeCodeExecutable: FAKE_CLI,
+      cwd: scenario.cwd,
+      env: scenarioEnv(scenario),
+      canUseTool: (async () => ({ behavior: 'deny', message: 'unused' })) as CanUseTool,
+      spawnClaudeCodeProcess: recordingSpawner(spawns)
+    })
+
+    expect(spawns).toHaveLength(1)
+    const argv = normalizeArgv(spawns[0]!.args)
+    // Typed-first translation must not also spell the flag through extraArgs.
+    for (const flag of ['--model', '--effort']) {
+      expect(
+        argv.filter((arg) => arg === flag),
+        `${flag} occurrences`
+      ).toHaveLength(1)
+    }
+    expect(argv[argv.indexOf('--model') + 1]).toBe('claude-sonnet-4-5')
+    expect(argv[argv.indexOf('--effort') + 1]).toBe('high')
+    // Headless print mode is the SDK's only mode; `query()` never passes `-p`,
+    // and if the SDK ever started passing it this pin would notice.
+    const impliedByHeadlessQuery = new Set(['-p'])
+    for (const entry of flagTable(PRE_SDK_ARGV)) {
+      if (impliedByHeadlessQuery.has(entry.flag)) {
+        expect(argv, `${entry.flag} is implied, never spelled`).not.toContain(entry.flag)
+        continue
+      }
+      const at = argv.indexOf(entry.flag)
+      expect(at, `SDK argv is missing ${entry.flag}`).toBeGreaterThanOrEqual(0)
+      if (entry.value !== null) {
+        expect(argv[at + 1], `value of ${entry.flag}`).toBe(entry.value)
+      }
+    }
+    // The launch resolver always carries one of --session-id / --resume.
+    const sessionAt = argv.indexOf('--session-id')
+    expect(sessionAt).toBeGreaterThanOrEqual(0)
+    expect(argv[sessionAt + 1]).toBe(launch.providerSessionId)
+  })
+
+  it('still exposes the runtime get_settings reader the auth diagnostic depends on', async () => {
+    // 0.3.251 ships getSettings() but redacts it from the Query declaration. This pin
+    // is the drift alarm: if a bump drops or reshapes it, the diagnostic degrades and
+    // this test says so instead of the degradation shipping silently.
+    const settings = { env: { ANTHROPIC_BASE_URL: 'https://settings.example.test' } }
+    const scenario = scriptScenario([{ delayMs: 3_000 }], { get_settings: settings })
+    const session = query({
+      prompt: singleUserTurn(),
+      options: {
+        pathToClaudeCodeExecutable: FAKE_CLI,
+        cwd: scenario.cwd,
+        env: scenarioEnv(scenario)
+      }
+    })
+    try {
+      const read = claudeQuerySettingsReader(session)
+      expect(read, 'the SDK no longer exposes get_settings at runtime').not.toBeNull()
+      await expect(read?.()).resolves.toEqual(settings)
+    } finally {
+      await session.return(undefined)
+    }
+  })
+
+  it('maps resume identity to --resume and --resume-session-at', async () => {
+    const scenario = scriptScenario([{ awaitUserMessage: true }, { emit: RESULT_FRAME }])
+    const spawns: SpawnSeen[] = []
+    await drainQuery({
+      pathToClaudeCodeExecutable: FAKE_CLI,
+      cwd: scenario.cwd,
+      env: scenarioEnv(scenario),
+      resume: SESSION_ID,
+      resumeSessionAt: LEAF_UUID,
+      spawnClaudeCodeProcess: recordingSpawner(spawns)
+    })
+
+    const argv = normalizeArgv(spawns[0]!.args)
+    const resumeAt = argv.indexOf('--resume')
+    expect(resumeAt).toBeGreaterThanOrEqual(0)
+    expect(argv[resumeAt + 1]).toBe(SESSION_ID)
+    const leafAt = argv.indexOf('--resume-session-at')
+    expect(leafAt).toBeGreaterThanOrEqual(0)
+    expect(argv[leafAt + 1]).toBe(LEAF_UUID)
+  })
+
+  it('gives canUseTool the wire request_id and fires its abort signal on control_cancel_request', async () => {
+    const scenario = scriptScenario([
+      { awaitUserMessage: true },
+      {
+        emit: {
+          type: 'control_request',
+          request_id: 'perm-421',
+          request: {
+            subtype: 'can_use_tool',
+            tool_name: 'Bash',
+            input: { command: 'echo hi' },
+            tool_use_id: 'tool-use-9'
+          }
+        }
+      },
+      { delayMs: 120 },
+      { emit: { type: 'control_cancel_request', request_id: 'perm-421' } },
+      { awaitControlResponse: 'perm-421' },
+      { emit: RESULT_FRAME }
+    ])
+    const seen: { toolName: string; requestId: string; toolUseID: string }[] = []
+    let abortFired = false
+    const canUseTool: CanUseTool = (toolName, _input, { signal, requestId, toolUseID }) => {
+      seen.push({ toolName, requestId, toolUseID })
+      return new Promise((resolve) => {
+        signal.addEventListener('abort', () => {
+          abortFired = true
+          resolve({ behavior: 'deny', message: 'cancelled by test' })
+        })
+      })
+    }
+    const spawns: SpawnSeen[] = []
+    await drainQuery({
+      pathToClaudeCodeExecutable: FAKE_CLI,
+      cwd: scenario.cwd,
+      env: scenarioEnv(scenario),
+      canUseTool,
+      spawnClaudeCodeProcess: recordingSpawner(spawns)
+    })
+
+    expect(seen).toEqual([{ toolName: 'Bash', requestId: 'perm-421', toolUseID: 'tool-use-9' }])
+    expect(abortFired).toBe(true)
+    // The callback's settlement is written back onto the wire against the same id.
+    const settled = scenario
+      .readReport()
+      .controlResponses.find((frame) => frame.response.request_id === 'perm-421')
+    expect(settled?.response.response?.behavior).toBe('deny')
+    // Exactly one process spawn per query, control traffic included.
+    expect(spawns).toHaveLength(1)
+  })
+
+  it('runs the executable given via pathToClaudeCodeExecutable under the default spawner', async () => {
+    const scenario = scriptScenario([{ awaitUserMessage: true }, { emit: RESULT_FRAME }])
+    const messages = await drainQuery({
+      pathToClaudeCodeExecutable: FAKE_CLI,
+      cwd: scenario.cwd,
+      env: scenarioEnv(scenario)
+    })
+
+    expect(messages.some((m) => m.type === 'result')).toBe(true)
+    const report = scenario.readReport()
+    // The SDK executed exactly the script we pointed it at — no bundled binary.
+    expect(report.argv[0]).toBe(FAKE_CLI)
+    expect(report.execPath).toContain('node')
+    // And the streaming handshake went to it: the SDK sent its initialize
+    // control request to our script.
+    expect(report.controlRequests.some((frame) => frame.request.subtype === 'initialize')).toBe(
+      true
+    )
+  })
+
+  it('pins the SDK version the contract was verified against', () => {
+    const sdkEntry = createRequire(__filename).resolve('@anthropic-ai/claude-agent-sdk')
+    const manifest = JSON.parse(readFileSync(join(dirname(sdkEntry), 'package.json'), 'utf8')) as {
+      version: string
+    }
+    expect(manifest.version).toBe(PINNED_SDK_VERSION)
+  })
+
+  it('keeps the eight bundled CLI platform binaries out of the install', () => {
+    const sdkEntry = createRequire(__filename).resolve('@anthropic-ai/claude-agent-sdk')
+    // The SDK's own scoped directory is where pnpm would link its optional
+    // platform packages; ignoredOptionalDependencies must keep them all absent.
+    const scopeDir = dirname(dirname(sdkEntry))
+    for (const basename of SDK_PLATFORM_PACKAGE_BASENAMES) {
+      expect(
+        existsSync(join(scopeDir, basename, 'package.json')),
+        `${basename} must not be installed`
+      ).toBe(false)
+    }
+  })
+})
diff --git a/src/main/claude/claude-agent-sdk-control-requests.test.ts b/src/main/claude/claude-agent-sdk-control-requests.test.ts
new file mode 100644
index 00000000000..f76650d8151
--- /dev/null
+++ b/src/main/claude/claude-agent-sdk-control-requests.test.ts
@@ -0,0 +1,26 @@
+import type { Query } from '@anthropic-ai/claude-agent-sdk'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { createClaudeControlSurface } from './claude-agent-sdk-control-requests'
+
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+describe('createClaudeControlSurface stopTask', () => {
+  it('bounds a lost reply and permits a later stop request', async () => {
+    vi.useFakeTimers()
+    const stopTask = vi
+      .fn<() => Promise<void>>()
+      .mockImplementationOnce(() => new Promise(() => {}))
+      .mockResolvedValueOnce()
+    const controls = createClaudeControlSurface({ stopTask } as unknown as Query)
+    const timedOut = expect(controls.stopTask('task-1', { timeoutMs: 25 })).rejects.toThrow(
+      'claude stop_task request timed out'
+    )
+
+    await vi.advanceTimersByTimeAsync(25)
+    await timedOut
+    await expect(controls.stopTask('task-2', { timeoutMs: 25 })).resolves.toBeUndefined()
+    expect(stopTask).toHaveBeenCalledTimes(2)
+  })
+})
diff --git a/src/main/claude/claude-agent-sdk-control-requests.ts b/src/main/claude/claude-agent-sdk-control-requests.ts
new file mode 100644
index 00000000000..71498f28421
--- /dev/null
+++ b/src/main/claude/claude-agent-sdk-control-requests.ts
@@ -0,0 +1,159 @@
+import type {
+  PermissionMode,
+  Query,
+  SDKControlInterruptResponse
+} from '@anthropic-ai/claude-agent-sdk'
+
+export class ClaudeControlRequestError extends Error {
+  constructor(
+    readonly subtype: string,
+    message: string
+  ) {
+    super(message)
+    this.name = 'ClaudeControlRequestError'
+  }
+}
+
+export const CLAUDE_DEFAULT_REQUEST_TIMEOUT_MS = 30_000
+
+/** The SDK closes a query out from under an in-flight control request with this exact message. */
+const QUERY_CLOSED_MESSAGE = 'Query closed before response received'
+
+/** 0.3.251 ships getSettings() but redacts it from the Query declaration; the typeof guard below is its degradation path. */
+type ClaudeQuerySettingsReader = { getSettings?: () => Promise<unknown> }
+
+export function claudeQuerySettingsReader(query: Query): (() => Promise<unknown>) | null {
+  const reader = (query as unknown as ClaudeQuerySettingsReader).getSettings
+  return typeof reader === 'function' ? reader.bind(query) : null
+}
+
+/**
+ * cancel_async_message is a runtime Query method the shipped 0.3.251 declaration omits;
+ * it withdraws a single still-queued async user message by uuid so an interrupted turn
+ * cannot spawn a later unexpected turn. The typeof guard is its degradation path.
+ */
+type ClaudeQueryAsyncCanceller = { cancelAsyncMessage?: (uuid: string) => Promise<unknown> }
+
+export function claudeQueryAsyncCanceller(
+  query: Query
+): ((uuid: string) => Promise<unknown>) | null {
+  const cancel = (query as unknown as ClaudeQueryAsyncCanceller).cancelAsyncMessage
+  return typeof cancel === 'function' ? cancel.bind(query) : null
+}
+
+export type ClaudeControlOptions = { timeoutMs?: number }
+
+/**
+ * Run one native Query control method under Orca's deadline and error classification.
+ *
+ * The SDK owns correlation but applies no deadline, so the timeout stays here — and its
+ * message is load-bearing: the init proof matches on `claude initialize request timed out`.
+ * A closed query is a transport failure, not the CLI rejecting the request, so only the
+ * latter is re-thrown as a `ClaudeControlRequestError` a caller may surface as a rejection.
+ */
+export function runClaudeControl<T>(
+  subtype: string,
+  run: () => Promise<T>,
+  timeoutMs: number = CLAUDE_DEFAULT_REQUEST_TIMEOUT_MS
+): Promise<T> {
+  let timer: ReturnType<typeof setTimeout> | null = null
+  const deadline = new Promise<never>((_resolve, reject) => {
+    timer = setTimeout(() => reject(new Error(`claude ${subtype} request timed out`)), timeoutMs)
+    timer.unref?.()
+  })
+  return Promise.race([
+    Promise.resolve()
+      .then(run)
+      .catch((error: unknown) => {
+        const message = error instanceof Error ? error.message : String(error)
+        if (error instanceof ClaudeControlRequestError || message === QUERY_CLOSED_MESSAGE) {
+          throw error
+        }
+        throw new ClaudeControlRequestError(subtype, message)
+      }),
+    deadline
+  ]).finally(() => {
+    if (timer) {
+      clearTimeout(timer)
+    }
+  })
+}
+
+/** The native control surface Orca drives, one method per Query control request. */
+export type ClaudeControlSurface = {
+  interrupt: (
+    options?: ClaudeControlOptions & { cancelQueued?: boolean }
+  ) => Promise<SDKControlInterruptResponse | undefined>
+  cancelAsyncMessage: (uuid: string, options?: ClaudeControlOptions) => Promise<void>
+  setModel: (model: string | undefined, options?: ClaudeControlOptions) => Promise<void>
+  setPermissionMode: (mode: PermissionMode, options?: ClaudeControlOptions) => Promise<void>
+  applyFlagSettings: (
+    settings: Parameters<Query['applyFlagSettings']>[0],
+    options?: ClaudeControlOptions
+  ) => Promise<void>
+  stopTask: (taskId: string, options?: ClaudeControlOptions) => Promise<void>
+  supportedModels: (options?: ClaudeControlOptions) => Promise<unknown[]>
+  initializationResult: (options?: ClaudeControlOptions) => Promise<unknown>
+  getSettings: (options?: ClaudeControlOptions) => Promise<unknown>
+}
+
+type InterruptingQuery = {
+  interrupt: (options?: {
+    cancelQueued?: boolean
+  }) => Promise<SDKControlInterruptResponse | undefined>
+}
+
+export function createClaudeControlSurface(query: Query): ClaudeControlSurface {
+  return {
+    interrupt: (options) =>
+      runClaudeControl(
+        'interrupt',
+        () =>
+          (query as unknown as InterruptingQuery).interrupt(
+            options?.cancelQueued ? { cancelQueued: true } : undefined
+          ),
+        options?.timeoutMs
+      ),
+    cancelAsyncMessage: (uuid, options) => {
+      const cancel = claudeQueryAsyncCanceller(query)
+      return cancel
+        ? runClaudeControl('cancel_async_message', () => cancel(uuid), options?.timeoutMs).then(
+            () => {}
+          )
+        : Promise.resolve()
+    },
+    setModel: (model, options) =>
+      runClaudeControl('set_model', () => query.setModel(model), options?.timeoutMs).then(() => {}),
+    setPermissionMode: (mode, options) =>
+      runClaudeControl(
+        'set_permission_mode',
+        () => query.setPermissionMode(mode),
+        options?.timeoutMs
+      ).then(() => {}),
+    applyFlagSettings: (settings, options) =>
+      runClaudeControl(
+        'apply_flag_settings',
+        () => query.applyFlagSettings(settings),
+        options?.timeoutMs
+      ).then(() => {}),
+    stopTask: (taskId, options) =>
+      runClaudeControl('stop_task', () => query.stopTask(taskId), options?.timeoutMs).then(
+        () => {}
+      ),
+    supportedModels: (options) =>
+      runClaudeControl('list_models', () => query.supportedModels(), options?.timeoutMs),
+    initializationResult: (options) =>
+      runClaudeControl('initialize', () => query.initializationResult(), options?.timeoutMs),
+    getSettings: (options) => {
+      const read = claudeQuerySettingsReader(query)
+      return read
+        ? runClaudeControl('get_settings', read, options?.timeoutMs)
+        : Promise.reject(
+            new ClaudeControlRequestError(
+              'get_settings',
+              'this SDK exposes no get_settings request'
+            )
+          )
+    }
+  }
+}
diff --git a/src/main/claude/claude-agent-sdk-exit-proof-identity.test.ts b/src/main/claude/claude-agent-sdk-exit-proof-identity.test.ts
new file mode 100644
index 00000000000..04d58067353
--- /dev/null
+++ b/src/main/claude/claude-agent-sdk-exit-proof-identity.test.ts
@@ -0,0 +1,104 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { DescendantSnapshot } from '../pty-descendant-termination'
+import type { WindowsDescendantSnapshot } from '../windows-descendant-exit-verification'
+import { collectDescendantRows } from '../pty-descendant-termination'
+import { createClaudeChildTreeReaper } from './claude-agent-sdk-exit-proof'
+import { mergeClaudeCapturedTrees } from './claude-child-tree-snapshot'
+
+function posixSnapshot(capturedAtMs: number): DescendantSnapshot {
+  return {
+    root: { pid: 100, startedAt: 'Mon Jan 1 00:00:00 2026' },
+    rootPgid: 100,
+    descendants: [{ pid: 200, ppid: 100, pgid: 100, startedAt: 'Mon Jan 1 00:00:01 2026' }],
+    capturedAtMs
+  }
+}
+
+function windowsSnapshot(): WindowsDescendantSnapshot {
+  return {
+    root: { pid: 100, creationTimeMs: 5 },
+    descendants: [{ pid: 200, creationTimeMs: 7 }],
+    unidentifiedCount: 0,
+    capturedAtMs: 1
+  }
+}
+
+describe('Claude child root identity', () => {
+  it('keeps a retained row boundary when a refresh observes no new descendants', () => {
+    const previous = posixSnapshot(1_700_000_000_900)
+    const next = posixSnapshot(1_700_000_002_100)
+
+    expect(
+      mergeClaudeCapturedTrees(
+        { platform: 'posix', tree: previous },
+        { platform: 'posix', tree: next }
+      )
+    ).toEqual({
+      platform: 'posix',
+      tree: { ...next, capturedAtMsByPid: { '200': previous.capturedAtMs } }
+    })
+  })
+
+  it('keeps the descendant verdict when a POSIX root probe is unavailable', async () => {
+    const child = { pid: 100, kill: vi.fn(() => true) }
+    const terminateDescendants = vi.fn(async () => 'exited' as const)
+    const tree = createClaudeChildTreeReaper(child, {
+      platform: 'linux',
+      captureDescendants: vi.fn(async () => posixSnapshot(1)),
+      terminateDescendants,
+      verifyRootIdentity: vi.fn(async () => false)
+    })
+
+    // POSIX runs no bare-pid root operation, so a declined probe withholds
+    // nothing: the handle kill still lands and the verification still speaks.
+    await expect(tree.reap()).resolves.toBe('exited')
+    expect(terminateDescendants).toHaveBeenCalled()
+    expect(child.kill).toHaveBeenCalledWith('SIGKILL')
+  })
+
+  it('rejects mixed old and recycled root rows instead of making the tree killable', async () => {
+    const child = { pid: 100, kill: vi.fn(() => true) }
+    const terminateDescendants = vi.fn(async () => 'exited' as const)
+    const tree = createClaudeChildTreeReaper(child, {
+      platform: 'linux',
+      captureDescendants: vi.fn(async () =>
+        collectDescendantRows(
+          100,
+          [
+            { pid: 100, ppid: 1, pgid: 100, startedAt: 'Mon Jan 1 00:00:00 2026' },
+            { pid: 100, ppid: 1, pgid: 101, startedAt: 'Mon Jan 1 00:00:01 2026' },
+            { pid: 200, ppid: 100, pgid: 200, startedAt: 'Mon Jan 1 00:00:00 2026' }
+          ],
+          1
+        )
+      ),
+      terminateDescendants,
+      verifyRootIdentity: vi.fn(async () => true)
+    })
+
+    await expect(tree.reap()).resolves.toBe('unverifiable')
+    // No admissible snapshot means no row may be signalled from its number, but
+    // the root still leaves through the handle Node owns.
+    expect(terminateDescendants).not.toHaveBeenCalled()
+    expect(child.kill).toHaveBeenCalledWith('SIGKILL')
+  })
+
+  it('fails closed when Windows root identity revalidation is unavailable', async () => {
+    const child = { pid: 100, kill: vi.fn(() => true) }
+    const terminateWindowsTree = vi.fn(async () => {})
+    const terminateWindowsDescendants = vi.fn(async () => 'exited' as const)
+    const tree = createClaudeChildTreeReaper(child, {
+      platform: 'win32',
+      captureWindowsDescendants: vi.fn(async () => windowsSnapshot()),
+      terminateWindowsTree,
+      terminateWindowsDescendants,
+      verifyRootIdentity: vi.fn(async () => false)
+    })
+
+    await expect(tree.reap()).resolves.toBe('unverifiable')
+    // taskkill /T /F addresses a bare pid and stays gated; the handle does not.
+    expect(terminateWindowsTree).not.toHaveBeenCalled()
+    expect(terminateWindowsDescendants).not.toHaveBeenCalled()
+    expect(child.kill).toHaveBeenCalledWith('SIGKILL')
+  })
+})
diff --git a/src/main/claude/claude-agent-sdk-exit-proof.test.ts b/src/main/claude/claude-agent-sdk-exit-proof.test.ts
new file mode 100644
index 00000000000..3f15f8e8fca
--- /dev/null
+++ b/src/main/claude/claude-agent-sdk-exit-proof.test.ts
@@ -0,0 +1,934 @@
+import { execFileSync } from 'node:child_process'
+import { EventEmitter } from 'node:events'
+import { PassThrough } from 'node:stream'
+import { describe, expect, it, vi } from 'vitest'
+import { spawnProcess, type SpawnedProcess } from '../../shared/child-process/run-process'
+import type { DescendantTreeVerdict } from '../pty-descendant-exit-verification'
+import type { DescendantSnapshot } from '../pty-descendant-termination'
+import type { WindowsDescendantSnapshot } from '../windows-descendant-exit-verification'
+import {
+  createClaudeChildTreeReaper as createClaudeChildTreeReaperImpl,
+  proveClaudeChildExit,
+  type ClaudeChildTreeReaper
+} from './claude-agent-sdk-exit-proof'
+
+// The descendant models an MCP server: it either cooperates or, when it traps
+// SIGTERM, only a forced, verified sweep can reach it. The root either traps
+// SIGTERM too, or leaves promptly on stdin end the way a healthy CLI does —
+// which is the path that used to skip descendant proof entirely.
+function childWithDescendantScript(input: {
+  rootTrapsSigterm: boolean
+  descendantTrapsSigterm: boolean
+}): string {
+  const descendantScript = `${input.descendantTrapsSigterm ? 'process.on("SIGTERM", () => {}); ' : ''}setInterval(() => {}, 1000000)`
+  const rootBehaviour = input.rootTrapsSigterm
+    ? `process.on('SIGTERM', () => {})
+process.on('SIGINT', () => {})
+setInterval(() => {}, 1000000)`
+    : `process.stdin.on('end', () => process.exit(0))
+process.stdin.resume()`
+  return `
+const descendant = require('node:child_process').spawn(
+  process.execPath,
+  ['-e', ${JSON.stringify(descendantScript)}],
+  { stdio: 'ignore' }
+)
+descendant.unref()
+process.stdout.write(JSON.stringify({ descendantPid: descendant.pid }) + '\\n')
+${rootBehaviour}
+`
+}
+
+const COOPERATIVE_CHILD = `
+process.stdin.on('end', () => process.exit(0))
+process.stdin.resume()
+process.stdout.write('ready\\n')
+`
+
+/**
+ * Sampled synchronously so it reads the exact moment the close boundary is
+ * crossed. A zombie has exited (its parent just has not reaped it yet), so a
+ * kill(pid, 0) probe would misreport it as running.
+ */
+function descendantState(pid: number): 'running' | 'exited' {
+  let state: string
+  try {
+    state = execFileSync('ps', ['-o', 'state=', '-p', String(pid)], {
+      encoding: 'utf8',
+      env: { ...process.env, LANG: 'C', LC_ALL: 'C' }
+    }).trim()
+  } catch (error) {
+    // ps exits 1 when no process matches; anything else is a failed probe, not an answer.
+    if ((error as { status?: number }).status !== 1) {
+      throw error
+    }
+    return 'exited'
+  }
+  return state.startsWith('Z') ? 'exited' : 'running'
+}
+
+/**
+ * ps lstart is second-resolution, so the identity-safe sweep only SIGKILLs a row
+ * born strictly before the second the snapshot was captured in. The snapshot is
+ * armed the moment close begins, so a descendant born in that same second can
+ * only be asked, never forced — the same bound an MCP server spawned within a
+ * second of the user closing the chat would hit.
+ */
+function ageDescendantPastTheCaptureSecond(): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, 1_000 - (Date.now() % 1_000) + 20))
+}
+
+/**
+ * The close ladder as production drives it: `closeProcessRegistry` retries an
+ * unproven close, and each retry re-verifies the retained snapshot. A loaded
+ * host can spend one attempt's whole window inside `ps`, and reporting false
+ * there is the honest verdict — the requirement is that TRUE never outruns the
+ * observation, which the caller asserts at whichever boundary returns it.
+ */
+async function proveExitWithRetries(
+  input: Parameters<typeof proveClaudeChildExit>[0],
+  attempts = 3
+): Promise<boolean> {
+  for (let attempt = 1; attempt < attempts; attempt += 1) {
+    if (await proveClaudeChildExit(input)) {
+      return true
+    }
+  }
+  return proveClaudeChildExit(input)
+}
+
+function spawnScript(script: string): ReturnType<typeof spawnProcess> {
+  return spawnProcess({
+    program: process.execPath,
+    args: ['-e', script],
+    stdio: ['pipe', 'pipe', 'pipe']
+  })
+}
+
+function firstStdoutLine(child: ReturnType<typeof spawnProcess>): Promise<string> {
+  return new Promise((resolve) => {
+    child.stdout.setEncoding('utf8').once('data', (chunk: string) => resolve(chunk.trim()))
+  })
+}
+
+function observeExit(child: EventEmitter): { exitPromise: Promise<void>; exited: () => boolean } {
+  let exited = false
+  const exitPromise = new Promise<void>((resolve) => {
+    child.once('exit', () => {
+      exited = true
+      resolve()
+    })
+  })
+  return { exitPromise, exited: () => exited }
+}
+
+/** `null` models a spawn that failed before a pid existed. */
+function mockChild(
+  pid: number | null = 424242
+): EventEmitter &
+  Pick<SpawnedProcess, 'pid' | 'kill' | 'stdin'> & { kill: ReturnType<typeof vi.fn> } {
+  const child = new EventEmitter()
+  return Object.assign(child, {
+    pid: pid ?? undefined,
+    stdin: new PassThrough(),
+    kill: vi.fn(() => true)
+  }) as never
+}
+
+/** A tree whose verdict is scripted per reap, recording when it was armed. */
+function mockTree(verdicts: DescendantTreeVerdict[]): ClaudeChildTreeReaper & {
+  capture: ReturnType<typeof vi.fn>
+  reap: ReturnType<typeof vi.fn>
+} {
+  let treeVerdict: DescendantTreeVerdict = 'unverifiable'
+  return {
+    capture: vi.fn(async () => {}),
+    reap: vi.fn(async () => {
+      treeVerdict = verdicts.shift() ?? treeVerdict
+      return treeVerdict
+    }),
+    get treeVerdict() {
+      return treeVerdict
+    }
+  }
+}
+
+function windowsSnapshotOf(descendantPid: number): WindowsDescendantSnapshot {
+  return {
+    root: { pid: 424242, creationTimeMs: 1_700_000_000_001 },
+    descendants: [{ pid: descendantPid, creationTimeMs: 1_700_000_000_000 }],
+    unidentifiedCount: 0,
+    capturedAtMs: 1
+  }
+}
+
+function snapshotOf(descendantPid: number): DescendantSnapshot {
+  return {
+    root: { pid: 424242, startedAt: 'Mon Jan 1 00:00:00 2026' },
+    rootPgid: 1,
+    descendants: [
+      { pid: descendantPid, ppid: 424242, pgid: 1, startedAt: 'Mon Jan 1 00:00:00 2026' }
+    ],
+    capturedAtMs: 1
+  }
+}
+
+// Unit tests use synthetic process ids; production always supplies the fresh
+// identity probe, so the harness explicitly models a matching probe.
+function createClaudeChildTreeReaper(
+  child: Parameters<typeof createClaudeChildTreeReaperImpl>[0],
+  deps: Parameters<typeof createClaudeChildTreeReaperImpl>[1] = {}
+): ReturnType<typeof createClaudeChildTreeReaperImpl> {
+  return createClaudeChildTreeReaperImpl(child, {
+    verifyRootIdentity: async () => true,
+    ...deps
+  })
+}
+
+describe('claude child exit proof', () => {
+  it.runIf(process.platform !== 'win32')(
+    'reports a proven exit only once a SIGTERM-resistant descendant is gone at the close boundary',
+    async () => {
+      const child = spawnScript(
+        childWithDescendantScript({ rootTrapsSigterm: true, descendantTrapsSigterm: true })
+      )
+      const { descendantPid } = JSON.parse(await firstStdoutLine(child)) as {
+        descendantPid: number
+      }
+      expect(descendantState(descendantPid)).toBe('running')
+      await ageDescendantPastTheCaptureSecond()
+
+      try {
+        const proven = await proveExitWithRetries({ child, ...observeExit(child) })
+        // Evaluated AT the boundary, not by polling until a deferred sweep timer
+        // wins: true releases the lease, so a descendant still running here is
+        // exactly the orphan the proof exists to prevent. False would be the
+        // honest verdict for a tree that outlived the bounded ladder.
+        expect({ proven, descendant: descendantState(descendantPid) }).toEqual({
+          proven: true,
+          descendant: 'exited'
+        })
+      } finally {
+        // Failure-safe only: the assertion above owns the requirement, this just
+        // stops a failing run from leaking a process.
+        try {
+          process.kill(descendantPid, 'SIGKILL')
+        } catch {
+          // Already gone.
+        }
+      }
+    },
+    20_000
+  )
+
+  it.runIf(process.platform !== 'win32')(
+    'proves a promptly exiting root only once its stubborn descendant is gone too',
+    async () => {
+      // The ordinary healthy close: the root leaves on stdin end within the graceful
+      // window. Its descendant must still be proven gone, not assumed gone with it.
+      const child = spawnScript(
+        childWithDescendantScript({ rootTrapsSigterm: false, descendantTrapsSigterm: true })
+      )
+      const { descendantPid } = JSON.parse(await firstStdoutLine(child)) as {
+        descendantPid: number
+      }
+      expect(descendantState(descendantPid)).toBe('running')
+      await ageDescendantPastTheCaptureSecond()
+
+      try {
+        const proven = await proveExitWithRetries({ child, ...observeExit(child) })
+        expect({ proven, descendant: descendantState(descendantPid) }).toEqual({
+          proven: true,
+          descendant: 'exited'
+        })
+      } finally {
+        try {
+          process.kill(descendantPid, 'SIGKILL')
+        } catch {
+          // Already gone.
+        }
+      }
+    },
+    20_000
+  )
+
+  it.runIf(process.platform !== 'win32')(
+    'still proves a stubborn child whose descendant honours SIGTERM',
+    async () => {
+      const child = spawnScript(
+        childWithDescendantScript({ rootTrapsSigterm: true, descendantTrapsSigterm: false })
+      )
+      const { descendantPid } = JSON.parse(await firstStdoutLine(child)) as {
+        descendantPid: number
+      }
+      try {
+        const proven = await proveExitWithRetries({ child, ...observeExit(child) })
+        expect({ proven, descendant: descendantState(descendantPid) }).toEqual({
+          proven: true,
+          descendant: 'exited'
+        })
+      } finally {
+        try {
+          process.kill(descendantPid, 'SIGKILL')
+        } catch {
+          // Already gone.
+        }
+      }
+    },
+    20_000
+  )
+
+  it('arms the snapshot before stdin closes and verifies it after a clean exit', async () => {
+    const child = spawnScript(COOPERATIVE_CHILD)
+    expect(await firstStdoutLine(child)).toBe('ready')
+    const exit = observeExit(child)
+    const tree = mockTree(['exited'])
+    let exitedWhenArmed: boolean | null = null
+    tree.capture.mockImplementation(async () => {
+      exitedWhenArmed = exit.exited()
+    })
+
+    await expect(proveClaudeChildExit({ child, ...exit, tree })).resolves.toBe(true)
+    // The snapshot is the only proof that survives the root: taken while it lived,
+    // verified once it left. A reap before the exit would have been the forced ladder.
+    expect(exitedWhenArmed).toBe(false)
+    expect(tree.reap).toHaveBeenCalledTimes(1)
+    expect(exit.exited()).toBe(true)
+  }, 20_000)
+
+  it('proves a clean close of a childless root with one snapshot and no signal', async () => {
+    const child = spawnScript(COOPERATIVE_CHILD)
+    expect(await firstStdoutLine(child)).toBe('ready')
+
+    await expect(proveClaudeChildExit({ child, ...observeExit(child) })).resolves.toBe(true)
+  }, 20_000)
+
+  it('reports an unprovable exit as false rather than assuming the child died', async () => {
+    const child = mockChild()
+    const tree = mockTree(['exited'])
+
+    await expect(
+      proveClaudeChildExit({
+        child,
+        exitPromise: new Promise<void>(() => {}),
+        exited: () => false,
+        tree
+      })
+    ).resolves.toBe(false)
+    expect(tree.reap).toHaveBeenCalledTimes(1)
+  }, 20_000)
+
+  it('reports false when the root exit was observed but a descendant was seen alive', async () => {
+    const child = mockChild()
+    const exit = observeExit(child)
+    const tree = mockTree(['live'])
+    tree.reap.mockImplementation(async () => {
+      child.emit('exit', null, 'SIGKILL')
+      return 'live'
+    })
+
+    await expect(proveClaudeChildExit({ child, ...exit, tree })).resolves.toBe(false)
+    expect(exit.exited()).toBe(true)
+    // One verification per attempt: the retried close re-verifies, this one does not.
+    expect(tree.reap).toHaveBeenCalledTimes(1)
+  }, 20_000)
+
+  it('re-verifies an unproven tree on a retried close instead of trusting the dead root', async () => {
+    const child = mockChild()
+    const tree = mockTree(['exited'])
+
+    await expect(
+      proveClaudeChildExit({ child, exitPromise: Promise.resolve(), exited: () => true, tree })
+    ).resolves.toBe(true)
+    expect(tree.reap).toHaveBeenCalledTimes(1)
+  })
+
+  it('stays unproven for a root that left before any snapshot could be armed', async () => {
+    const child = mockChild()
+    const captureDescendants = vi.fn(async () => snapshotOf(4243))
+    const terminateDescendants = vi.fn()
+    const tree = createClaudeChildTreeReaper(child, {
+      platform: 'darwin',
+      exited: () => true,
+      captureDescendants,
+      terminateDescendants
+    })
+
+    await expect(
+      proveClaudeChildExit({ child, exitPromise: Promise.resolve(), exited: () => true, tree })
+    ).resolves.toBe(false)
+    // A dead root's descendants have reparented: walking its pid now could only
+    // sweep a stranger, so no walk is attempted and nothing is proven.
+    expect(captureDescendants).not.toHaveBeenCalled()
+    expect(terminateDescendants).not.toHaveBeenCalled()
+    expect(tree.treeVerdict).toBe('unverifiable')
+  })
+})
+
+describe('claude child tree reaper', () => {
+  it('kills the root while verification runs and never stops it first', async () => {
+    const child = mockChild()
+    const release = Promise.withResolvers<DescendantTreeVerdict>()
+    const terminateDescendants = vi.fn(() => release.promise)
+    const captureDescendants = vi.fn(async () => snapshotOf(4243))
+    const tree = createClaudeChildTreeReaper(child, {
+      platform: 'darwin',
+      captureDescendants,
+      terminateDescendants
+    })
+
+    const first = tree.reap()
+    const second = tree.reap()
+    await vi.waitFor(() => expect(terminateDescendants).toHaveBeenCalledTimes(1))
+    // A stopped root cannot verify: its killed children stay zombie rows in ps.
+    expect(child.kill.mock.calls).toEqual([['SIGKILL']])
+    expect(tree.treeVerdict).toBe('unverifiable')
+
+    release.resolve('exited')
+    await expect(Promise.all([first, second])).resolves.toEqual(['exited', 'exited'])
+    expect(captureDescendants).toHaveBeenCalledTimes(1)
+    expect(tree.treeVerdict).toBe('exited')
+  })
+
+  it('re-verifies the retained snapshot on a later reap rather than re-walking a dead root', async () => {
+    const child = mockChild()
+    const captureDescendants = vi.fn(async () => snapshotOf(4243))
+    const terminateDescendants = vi
+      .fn()
+      .mockResolvedValueOnce('live')
+      .mockResolvedValueOnce('exited')
+    const tree = createClaudeChildTreeReaper(child, {
+      platform: 'linux',
+      captureDescendants,
+      terminateDescendants
+    })
+
+    await expect(tree.reap()).resolves.toBe('live')
+    expect(tree.treeVerdict).toBe('live')
+    await expect(tree.reap()).resolves.toBe('exited')
+    expect(captureDescendants).toHaveBeenCalledTimes(1)
+    expect(terminateDescendants).toHaveBeenNthCalledWith(2, snapshotOf(4243))
+    expect(tree.treeVerdict).toBe('exited')
+  })
+
+  it('keeps an observed exit when a later re-read cannot see the table', async () => {
+    const child = mockChild()
+    const terminateDescendants = vi
+      .fn()
+      .mockResolvedValueOnce('exited')
+      .mockResolvedValueOnce('unverifiable')
+    const tree = createClaudeChildTreeReaper(child, {
+      platform: 'linux',
+      captureDescendants: vi.fn(async () => snapshotOf(4243)),
+      terminateDescendants
+    })
+
+    await expect(tree.reap()).resolves.toBe('exited')
+    await expect(tree.reap()).resolves.toBe('unverifiable')
+    expect(tree.treeVerdict).toBe('exited')
+  })
+
+  it('keeps an observed live descendant when a later re-read cannot see the table', async () => {
+    const child = mockChild()
+    // Reap #1 completed and saw a descendant alive at its deadline; the root then
+    // left on its own and the re-verification on a loaded host could not read the
+    // table. "Could not look" must not erase "was seen alive": the lease release
+    // gate is exactly the pair this distinguishes.
+    const terminateDescendants = vi
+      .fn()
+      .mockResolvedValueOnce('live')
+      .mockResolvedValueOnce('unverifiable')
+    const tree = createClaudeChildTreeReaper(child, {
+      platform: 'linux',
+      captureDescendants: vi.fn(async () => snapshotOf(4243)),
+      terminateDescendants
+    })
+
+    await expect(tree.reap()).resolves.toBe('live')
+    await expect(tree.reap()).resolves.toBe('unverifiable')
+    expect(tree.treeVerdict).toBe('live')
+  })
+
+  it('treats an unreadable process table as unproven and re-walks the live root', async () => {
+    const child = mockChild()
+    // A loaded host can miss the table's deadline; while the root still lives
+    // that is a retryable read, not evidence that it has no descendants.
+    const captureDescendants = vi
+      .fn()
+      .mockResolvedValueOnce(null)
+      .mockResolvedValueOnce(snapshotOf(4243))
+    const terminateDescendants = vi.fn(async () => 'exited' as const)
+    const tree = createClaudeChildTreeReaper(child, {
+      platform: 'linux',
+      captureDescendants,
+      terminateDescendants
+    })
+
+    await expect(tree.reap()).resolves.toBe('unverifiable')
+    expect(terminateDescendants).not.toHaveBeenCalled()
+    await expect(tree.reap()).resolves.toBe('exited')
+    expect(captureDescendants).toHaveBeenCalledTimes(2)
+  })
+
+  it('does not latch a missing root while it is still live', async () => {
+    const child = mockChild()
+    const captureDescendants = vi
+      .fn()
+      .mockResolvedValueOnce({ rootPgid: null, descendants: [], capturedAtMs: 1 })
+      .mockResolvedValueOnce(snapshotOf(4243))
+    const terminateDescendants = vi.fn(async () => 'exited' as const)
+    const tree = createClaudeChildTreeReaper(child, {
+      platform: 'linux',
+      captureDescendants,
+      terminateDescendants
+    })
+
+    await tree.capture()
+    await expect(tree.reap()).resolves.toBe('exited')
+    expect(captureDescendants).toHaveBeenCalledTimes(2)
+    expect(terminateDescendants).toHaveBeenCalledWith(snapshotOf(4243))
+  })
+
+  it('refreshes the live snapshot at close time so late descendants are included', async () => {
+    const child = mockChild()
+    const first = snapshotOf(4243)
+    const second = {
+      ...first,
+      descendants: [...first.descendants, { ...first.descendants[0], pid: 4244 }]
+    }
+    const captureDescendants = vi.fn().mockResolvedValueOnce(first).mockResolvedValueOnce(second)
+    const terminateDescendants = vi.fn(async () => 'exited' as const)
+    const tree = createClaudeChildTreeReaper(child, {
+      platform: 'linux',
+      captureDescendants,
+      terminateDescendants
+    })
+
+    await tree.capture()
+    await tree.refresh?.()
+    await tree.reap()
+
+    expect(captureDescendants).toHaveBeenCalledTimes(2)
+    expect(terminateDescendants).toHaveBeenCalledWith(second)
+    expect(child.kill).toHaveBeenCalledWith('SIGKILL')
+  })
+
+  it('keeps the original capture boundary for retained POSIX rows', async () => {
+    const child = mockChild()
+    const first = {
+      ...snapshotOf(4243),
+      capturedAtMs: 1_700_000_000_900
+    }
+    const refreshed = {
+      ...first,
+      capturedAtMs: 1_700_000_002_100,
+      descendants: [
+        ...first.descendants,
+        {
+          pid: 4244,
+          ppid: 424242,
+          pgid: 1,
+          startedAt: 'Tue Jan 2 00:00:00 2026'
+        }
+      ]
+    }
+    const captureDescendants = vi.fn().mockResolvedValueOnce(first).mockResolvedValueOnce(refreshed)
+    const terminateDescendants = vi.fn(async () => 'exited' as const)
+    const tree = createClaudeChildTreeReaper(child, {
+      platform: 'linux',
+      captureDescendants,
+      terminateDescendants
+    })
+
+    await tree.capture()
+    await tree.refresh?.()
+    await tree.reap()
+
+    expect(terminateDescendants).toHaveBeenCalledWith({
+      ...refreshed,
+      // The retained 4243 row was first observed in the earlier displayed
+      // second. Its per-row boundary must not advance with the refresh.
+      capturedAtMsByPid: {
+        '4243': first.capturedAtMs,
+        '4244': refreshed.capturedAtMs
+      }
+    })
+  })
+
+  it('fails closed when a POSIX refresh reuses a PID with a new identity', async () => {
+    const child = mockChild()
+    const first = snapshotOf(4243)
+    const replacement = {
+      ...first,
+      descendants: [
+        {
+          ...first.descendants[0],
+          pgid: 9,
+          startedAt: 'Tue Jan 2 00:00:00 2026'
+        }
+      ]
+    }
+    const captureDescendants = vi
+      .fn()
+      .mockResolvedValueOnce(first)
+      .mockResolvedValueOnce(replacement)
+    const terminateDescendants = vi.fn(async () => 'exited' as const)
+    const tree = createClaudeChildTreeReaper(child, {
+      platform: 'linux',
+      captureDescendants,
+      terminateDescendants
+    })
+
+    await tree.capture()
+    await tree.refresh?.()
+
+    await expect(tree.reap()).resolves.toBe('unverifiable')
+    // The descendant evidence is discarded; the root's identity never was in doubt.
+    expect(terminateDescendants).not.toHaveBeenCalled()
+    expect(child.kill).toHaveBeenCalledWith('SIGKILL')
+  })
+
+  it('fails closed when a Windows refresh reuses a PID with a new creation time', async () => {
+    const child = mockChild()
+    const first = windowsSnapshotOf(4243)
+    const replacement = {
+      ...first,
+      descendants: [{ pid: 4243, creationTimeMs: first.descendants[0].creationTimeMs + 1 }]
+    }
+    const captureWindowsDescendants = vi
+      .fn()
+      .mockResolvedValueOnce(first)
+      .mockResolvedValueOnce(replacement)
+    const terminateWindowsTree = vi.fn(async () => {})
+    const terminateWindowsDescendants = vi.fn(async () => 'exited' as const)
+    const tree = createClaudeChildTreeReaper(child, {
+      platform: 'win32',
+      captureWindowsDescendants,
+      terminateWindowsTree,
+      terminateWindowsDescendants
+    })
+
+    await tree.capture()
+    await tree.refresh?.()
+
+    await expect(tree.reap()).resolves.toBe('unverifiable')
+    expect(terminateWindowsTree).not.toHaveBeenCalled()
+    expect(terminateWindowsDescendants).not.toHaveBeenCalled()
+    expect(child.kill).toHaveBeenCalledWith('SIGKILL')
+  })
+
+  it('queues a fresh boundary behind an output-triggered capture already in flight', async () => {
+    const child = mockChild()
+    const firstDone = Promise.withResolvers<void>()
+    const first = snapshotOf(4243)
+    const second = {
+      ...first,
+      descendants: [...first.descendants, { ...first.descendants[0], pid: 4244 }]
+    }
+    const captureDescendants = vi
+      .fn()
+      .mockImplementationOnce(async () => {
+        await firstDone.promise
+        return first
+      })
+      .mockResolvedValueOnce(second)
+    const terminateDescendants = vi.fn(async () => 'exited' as const)
+    const tree = createClaudeChildTreeReaper(child, {
+      platform: 'linux',
+      captureDescendants,
+      terminateDescendants
+    })
+
+    const outputCapture = tree.refresh!()
+    await vi.waitFor(() => expect(captureDescendants).toHaveBeenCalledTimes(1))
+    const closeCapture = tree.refresh!()
+    await Promise.resolve()
+    expect(captureDescendants).toHaveBeenCalledTimes(1)
+
+    firstDone.resolve()
+    await closeCapture
+    await tree.reap()
+
+    expect(captureDescendants).toHaveBeenCalledTimes(2)
+    expect(terminateDescendants).toHaveBeenCalledWith(second)
+    await outputCapture
+  })
+
+  it('retains a replacement descendant when the prior identity exited', async () => {
+    const child = mockChild()
+    const first = snapshotOf(4243)
+    const replacement = snapshotOf(4244)
+    const captureDescendants = vi
+      .fn()
+      .mockResolvedValueOnce(first)
+      .mockResolvedValueOnce(replacement)
+    const terminateDescendants = vi.fn(async (snapshot: DescendantSnapshot) =>
+      snapshot.descendants.some((row) => row.pid === 4244) ? ('live' as const) : ('exited' as const)
+    )
+    const tree = createClaudeChildTreeReaper(child, {
+      platform: 'linux',
+      captureDescendants,
+      terminateDescendants
+    })
+
+    await tree.capture()
+    await tree.refresh?.()
+    await expect(tree.reap()).resolves.toBe('live')
+
+    expect(terminateDescendants).toHaveBeenCalledWith({
+      ...replacement,
+      descendants: [...first.descendants, ...replacement.descendants]
+    })
+  })
+
+  it('retains a Windows replacement descendant while preserving unidentified rows', async () => {
+    const child = mockChild()
+    const first = windowsSnapshotOf(4243)
+    const replacement = {
+      ...windowsSnapshotOf(4244),
+      unidentifiedCount: 0
+    }
+    const captureWindowsDescendants = vi
+      .fn()
+      .mockResolvedValueOnce({ ...first, unidentifiedCount: 1 })
+      .mockResolvedValueOnce(replacement)
+    const terminateWindowsTree = vi.fn(async () => {})
+    const terminateWindowsDescendants = vi.fn(async (snapshot: WindowsDescendantSnapshot) =>
+      snapshot.descendants.some((row) => row.pid === 4244) ? ('live' as const) : ('exited' as const)
+    )
+    const tree = createClaudeChildTreeReaper(child, {
+      platform: 'win32',
+      captureWindowsDescendants,
+      terminateWindowsTree,
+      terminateWindowsDescendants
+    })
+
+    await tree.capture()
+    await tree.refresh?.()
+    await expect(tree.reap()).resolves.toBe('live')
+
+    expect(terminateWindowsDescendants).toHaveBeenCalledWith({
+      ...replacement,
+      descendants: [...first.descendants, ...replacement.descendants],
+      unidentifiedCount: 1
+    })
+  })
+
+  it('retains the prior identity-safe snapshot when a refresh is partial', async () => {
+    const child = mockChild()
+    const first = {
+      ...snapshotOf(4243),
+      descendants: [
+        ...snapshotOf(4243).descendants,
+        { ...snapshotOf(4243).descendants[0], pid: 4244 }
+      ]
+    }
+    const captureDescendants = vi
+      .fn()
+      .mockResolvedValueOnce(first)
+      .mockResolvedValueOnce({
+        ...first,
+        descendants: first.descendants.slice(0, 1)
+      })
+    const terminateDescendants = vi.fn(async () => 'exited' as const)
+    const tree = createClaudeChildTreeReaper(child, {
+      platform: 'linux',
+      captureDescendants,
+      terminateDescendants
+    })
+
+    await tree.capture()
+    await tree.refresh?.()
+    await tree.reap()
+
+    expect(terminateDescendants).toHaveBeenCalledWith(first)
+  })
+
+  it('stops re-walking once the root is gone, however the table behaved', async () => {
+    const child = mockChild()
+    let exited = false
+    const captureDescendants = vi.fn(async () => null)
+    const tree = createClaudeChildTreeReaper(child, {
+      platform: 'linux',
+      exited: () => exited,
+      captureDescendants,
+      terminateDescendants: vi.fn()
+    })
+
+    await expect(tree.reap()).resolves.toBe('unverifiable')
+    // An unreadable table costs the snapshot, never the kill on the live root.
+    expect(child.kill).toHaveBeenCalledTimes(1)
+    exited = true
+    await expect(tree.reap()).resolves.toBe('unverifiable')
+    expect(captureDescendants).toHaveBeenCalledTimes(1)
+    // The second attempt observes a dead root: Node has dropped the handle, so
+    // there is nothing left to signal and no recycled pid to reach.
+    expect(child.kill).toHaveBeenCalledTimes(1)
+  })
+
+  it('discards a walk that found no root instead of proving an empty tree', async () => {
+    const child = mockChild()
+    const captureDescendants = vi.fn(async () => ({
+      rootPgid: null,
+      descendants: [],
+      capturedAtMs: 1
+    }))
+    const tree = createClaudeChildTreeReaper(child, {
+      platform: 'linux',
+      captureDescendants,
+      terminateDescendants: vi.fn()
+    })
+
+    await tree.capture()
+    await expect(tree.reap()).resolves.toBe('unverifiable')
+    // A vacuous walk remains retryable while the root is live; no empty-tree
+    // verdict is latched from a missing root row.
+    expect(captureDescendants).toHaveBeenCalledTimes(2)
+  })
+
+  it('discards a walk that raced the root exit instead of proving an empty tree', async () => {
+    const child = mockChild()
+    let exited = false
+    const captureDescendants = vi.fn(async () => {
+      exited = true
+      return { rootPgid: 1, descendants: [], capturedAtMs: 1 }
+    })
+    const tree = createClaudeChildTreeReaper(child, {
+      platform: 'linux',
+      exited: () => exited,
+      captureDescendants,
+      terminateDescendants: vi.fn()
+    })
+
+    await tree.capture()
+    await expect(tree.reap()).resolves.toBe('unverifiable')
+  })
+
+  it('proves a childless snapshot without signalling anything', async () => {
+    const child = mockChild()
+    const terminateDescendants = vi.fn()
+    const tree = createClaudeChildTreeReaper(child, {
+      platform: 'linux',
+      captureDescendants: vi.fn(async () => ({
+        root: { pid: 424242, startedAt: 'Mon Jan 1 00:00:00 2026' },
+        rootPgid: 1,
+        descendants: [],
+        capturedAtMs: 1
+      })),
+      terminateDescendants
+    })
+
+    await expect(tree.reap()).resolves.toBe('exited')
+    expect(terminateDescendants).not.toHaveBeenCalled()
+    expect(child.kill).toHaveBeenCalledWith('SIGKILL')
+  })
+
+  it('waits for the Windows tree kill before releasing the root', async () => {
+    const child = mockChild()
+    const release = Promise.withResolvers<void>()
+    const terminateWindowsTree = vi.fn(() => release.promise)
+    const captureDescendants = vi.fn()
+    const terminateWindowsDescendants = vi.fn(async () => 'exited' as const)
+    const tree = createClaudeChildTreeReaper(child, {
+      platform: 'win32',
+      captureDescendants,
+      captureWindowsDescendants: vi.fn(async () => windowsSnapshotOf(4243)),
+      terminateWindowsTree,
+      terminateWindowsDescendants
+    })
+
+    const reap = tree.reap()
+    await vi.waitFor(() =>
+      expect(terminateWindowsTree).toHaveBeenCalledWith({
+        pid: 424242,
+        creationTimeMs: 1_700_000_000_001
+      })
+    )
+    expect(child.kill).not.toHaveBeenCalled()
+    expect(terminateWindowsDescendants).not.toHaveBeenCalled()
+    release.resolve()
+    await expect(reap).resolves.toBe('exited')
+    expect(child.kill).toHaveBeenCalledWith('SIGKILL')
+    expect(terminateWindowsDescendants).toHaveBeenCalledWith(windowsSnapshotOf(4243))
+    expect(captureDescendants).not.toHaveBeenCalled()
+  })
+
+  it('stays unproven on Windows when taskkill fails and a descendant is still observed', async () => {
+    const child = mockChild()
+    const tree = createClaudeChildTreeReaper(child, {
+      platform: 'win32',
+      captureWindowsDescendants: vi.fn(async () => windowsSnapshotOf(4243)),
+      terminateWindowsTree: vi.fn(async () => {
+        throw new Error('taskkill: access denied')
+      }),
+      terminateWindowsDescendants: vi.fn(async () => 'live' as const)
+    })
+
+    // taskkill's own outcome is not the proof; the table read after it is.
+    await expect(tree.reap()).resolves.toBe('live')
+    expect(tree.treeVerdict).toBe('live')
+    expect(child.kill).toHaveBeenCalledWith('SIGKILL')
+  })
+
+  it('stays unproven on Windows when taskkill resolves but a descendant survives it', async () => {
+    const child = mockChild()
+    const terminateWindowsTree = vi.fn(async () => {})
+    const tree = createClaudeChildTreeReaper(child, {
+      platform: 'win32',
+      captureWindowsDescendants: vi.fn(async () => windowsSnapshotOf(4243)),
+      terminateWindowsTree,
+      terminateWindowsDescendants: vi.fn(async () => 'live' as const)
+    })
+
+    await expect(tree.reap()).resolves.toBe('live')
+    expect(terminateWindowsTree).toHaveBeenCalledTimes(1)
+    expect(tree.treeVerdict).toBe('live')
+  })
+
+  it('never taskkills a Windows root that already exited, but still verifies its snapshot', async () => {
+    const child = mockChild()
+    let exited = false
+    const terminateWindowsTree = vi.fn(async () => {})
+    const terminateWindowsDescendants = vi.fn(async () => 'exited' as const)
+    const tree = createClaudeChildTreeReaper(child, {
+      platform: 'win32',
+      exited: () => exited,
+      captureWindowsDescendants: vi.fn(async () => windowsSnapshotOf(4243)),
+      terminateWindowsTree,
+      terminateWindowsDescendants
+    })
+
+    await tree.capture()
+    exited = true
+    await expect(tree.reap()).resolves.toBe('exited')
+    // A dead root's pid may already belong to a stranger: taskkill /T /F on it
+    // would take down an unrelated tree.
+    expect(terminateWindowsTree).not.toHaveBeenCalled()
+    expect(terminateWindowsDescendants).toHaveBeenCalledWith(windowsSnapshotOf(4243))
+  })
+
+  it('treats an unreadable Windows table as unproven', async () => {
+    const child = mockChild()
+    const terminateWindowsDescendants = vi.fn()
+    const tree = createClaudeChildTreeReaper(child, {
+      platform: 'win32',
+      captureWindowsDescendants: vi.fn(async () => null),
+      terminateWindowsTree: vi.fn(async () => {}),
+      terminateWindowsDescendants
+    })
+
+    await expect(tree.reap()).resolves.toBe('unverifiable')
+    expect(terminateWindowsDescendants).not.toHaveBeenCalled()
+    // A host that cannot supply creation times blocks taskkill, not the root kill.
+    expect(child.kill).toHaveBeenCalledWith('SIGKILL')
+  })
+
+  it('has nothing to reap for a child that never spawned', async () => {
+    const child = mockChild(null)
+    const captureDescendants = vi.fn()
+    const tree = createClaudeChildTreeReaper(child, { platform: 'linux', captureDescendants })
+
+    await expect(tree.reap()).resolves.toBe('exited')
+    expect(captureDescendants).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/claude/claude-agent-sdk-exit-proof.ts b/src/main/claude/claude-agent-sdk-exit-proof.ts
new file mode 100644
index 00000000000..17533f87a70
--- /dev/null
+++ b/src/main/claude/claude-agent-sdk-exit-proof.ts
@@ -0,0 +1,366 @@
+import type { SpawnedProcess } from '../../shared/child-process/run-process'
+import {
+  terminateDescendantSnapshotWithVerdict,
+  type DescendantTreeVerdict
+} from '../pty-descendant-exit-verification'
+import {
+  captureDescendantSnapshot,
+  type DescendantSnapshot,
+  type PosixProcessIdentity
+} from '../pty-descendant-termination'
+import {
+  captureWindowsDescendantSnapshot,
+  terminateIdentifiedWindowsProcessTree,
+  verifyWindowsDescendantSnapshotExit,
+  verifyWindowsProcessIdentity,
+  type WindowsDescendantSnapshot,
+  type WindowsProcessIdentity
+} from '../windows-descendant-exit-verification'
+import { mergeClaudeCapturedTrees, type ClaudeCapturedTree } from './claude-child-tree-snapshot'
+import { terminateClaudeRoot, terminateClaudeWindowsRoot } from './claude-child-root-termination'
+import {
+  proveClaudeChildExitWithReaper,
+  type ClaudeChildExitProofInput
+} from './claude-child-exit-proof-ladder'
+
+/**
+ * A later reap may only raise the latched verdict. An observed exit is final, and
+ * a descendant seen alive at a deadline is never forgotten by a later look that
+ * could not read the table: the lease gate discriminates on exactly that pair.
+ */
+const TREE_VERDICT_TRUST: Record<DescendantTreeVerdict, number> = {
+  unverifiable: 0,
+  live: 1,
+  exited: 2
+}
+
+type ReapableChild = Pick<SpawnedProcess, 'pid' | 'kill'>
+
+/**
+ * A walk is only admissible while the root it walked was alive. A POSIX walk
+ * that found no root says so with a null pgid; either platform's walk can also
+ * have raced the root's death. Both can only have missed descendants that
+ * already reparented away, so neither is evidence about the tree.
+ */
+function admissibleTree(
+  captured: DescendantSnapshot | WindowsDescendantSnapshot | null,
+  platform: NodeJS.Platform,
+  exited: boolean
+): ClaudeCapturedTree | null {
+  if (!captured || exited) {
+    return null
+  }
+  if (platform === 'win32') {
+    return { platform: 'win32', tree: captured as WindowsDescendantSnapshot }
+  }
+  const tree = captured as DescendantSnapshot
+  return tree.rootPgid === null ? null : { platform: 'posix', tree }
+}
+
+export type ClaudeChildTreeReaperDeps = {
+  platform?: NodeJS.Platform
+  /** Whether the root's exit has been observed; only a live root can be walked. */
+  exited?: () => boolean
+  captureDescendants?: (rootPid: number) => Promise<DescendantSnapshot | null>
+  terminateDescendants?: (snapshot: DescendantSnapshot) => Promise<DescendantTreeVerdict>
+  terminateWindowsTree?: (root: WindowsProcessIdentity) => Promise<void>
+  captureWindowsDescendants?: (rootPid: number) => Promise<WindowsDescendantSnapshot | null>
+  terminateWindowsDescendants?: (
+    snapshot: WindowsDescendantSnapshot
+  ) => Promise<DescendantTreeVerdict>
+  /** Identity probe for the bare-pid tree kill; only Windows has one to gate. */
+  verifyRootIdentity?: (root: PosixProcessIdentity | WindowsProcessIdentity) => Promise<boolean>
+}
+
+export type ClaudeChildTreeReaper = {
+  /**
+   * Snapshot the root's live descendants. The moment the root dies they reparent
+   * and no table walk can find them again, so this has to run before anything
+   * gives the root a reason to leave. Held once; later calls are no-ops.
+   */
+  capture(): Promise<void>
+  /** Refresh a live root's snapshot at the close boundary; a failed refresh keeps the prior proof. */
+  refresh?: () => Promise<void>
+  /**
+   * Kill the child's whole tree and report what the bounded verification
+   * observed. Concurrent calls share one reap, and a later call re-verifies the
+   * same snapshot rather than trusting a root that has since died on its own.
+   */
+  reap(): Promise<DescendantTreeVerdict>
+  /**
+   * `unverifiable` until a reap observes otherwise. `exited` is the only verdict
+   * that lets a close release the lease; `live` names a descendant that was seen
+   * still running, which no later caller may collapse into "unknown".
+   */
+  readonly treeVerdict: DescendantTreeVerdict
+}
+
+/**
+ * The same shared primitives the Codex structured provider composes: a raw
+ * pipe child owns no PTY job, so there is nothing for the PTY job sweep to
+ * terminate on Windows and no unref'd timer is allowed to outlive the proof.
+ *
+ * The proof is unproven by default. `treeVerdict` is assigned in exactly one
+ * place, from the verdict of `judgeTree`, so a code path that never reaches a
+ * verification cannot report the tree gone by omission.
+ */
+export function createClaudeChildTreeReaper(
+  child: ReapableChild,
+  deps: ClaudeChildTreeReaperDeps = {}
+): ClaudeChildTreeReaper {
+  const platform = deps.platform ?? process.platform
+  const exited = deps.exited ?? (() => false)
+  // Undefined until captured; null when no admissible snapshot exists — the root
+  // was already gone, or the table could not be read while it was alive — which
+  // no later read can make up for.
+  let snapshot: ClaudeCapturedTree | null | undefined
+  let capturing: Promise<void> | null = null
+  let refreshing: Promise<void> | null = null
+  let queuedRefresh: Promise<void> | null = null
+  let inFlight: Promise<DescendantTreeVerdict> | null = null
+  let treeVerdict: DescendantTreeVerdict = 'unverifiable'
+
+  // Consulted only on win32: POSIX signals descendants by revalidated identity
+  // and reaches the root solely through Node's handle, so neither needs a probe.
+  const verifyRoot =
+    deps.verifyRootIdentity ??
+    ((root: PosixProcessIdentity | WindowsProcessIdentity) =>
+      verifyWindowsProcessIdentity(root as WindowsProcessIdentity))
+
+  function captureOnce(): Promise<void> {
+    if (refreshing) {
+      const pending = refreshing
+      return pending.then(() => queuedRefresh ?? undefined)
+    }
+    if (snapshot !== undefined) {
+      return Promise.resolve()
+    }
+    if (capturing) {
+      const pending = capturing
+      return pending.then(() => queuedRefresh ?? undefined)
+    }
+    const rootPid = child.pid
+    if (!rootPid || exited()) {
+      // Only the root's death makes a missing snapshot final: its descendants
+      // have reparented, and no later walk can reach them.
+      snapshot = exited() ? null : snapshot
+      return Promise.resolve()
+    }
+    const capture =
+      platform === 'win32'
+        ? (deps.captureWindowsDescendants ?? captureWindowsDescendantSnapshot)
+        : (deps.captureDescendants ?? captureDescendantSnapshot)
+    capturing = capture(rootPid)
+      .catch(() => null)
+      .then((captured) => {
+        // A walk that found no root, or that raced the root's death, can only
+        // have missed descendants that already reparented away. A table that
+        // could not be read in time is not an answer at all: while the root
+        // still lives the walk is simply retried, rather than latching a failed
+        // read as proof that there was nothing to find.
+        const rootExited = exited()
+        const tree = admissibleTree(captured, platform, rootExited)
+        if (tree) {
+          snapshot = tree
+        } else if (rootExited) {
+          // Once the root has exited its descendants may have reparented; no
+          // later table read can make an absent snapshot safe to signal.
+          snapshot = null
+        } else {
+          // A failed read or a walk that did not observe the live root is
+          // retryable while the root remains alive. Never latch a vacuous null.
+          snapshot = undefined
+        }
+      })
+      .finally(() => {
+        capturing = null
+      })
+    return capturing
+  }
+
+  function startRefresh(): Promise<void> {
+    if (exited()) {
+      return Promise.resolve()
+    }
+    const rootPid = child.pid
+    if (!rootPid) {
+      return Promise.resolve()
+    }
+    const capture =
+      platform === 'win32'
+        ? (deps.captureWindowsDescendants ?? captureWindowsDescendantSnapshot)
+        : (deps.captureDescendants ?? captureDescendantSnapshot)
+    const operation = (async () => {
+      const captured = await capture(rootPid).catch(() => null)
+      if (exited()) {
+        return
+      }
+      const tree = admissibleTree(captured, platform, false)
+      if (!tree) {
+        return
+      }
+      if (snapshot === undefined) {
+        snapshot = tree
+        return
+      }
+      if (snapshot !== null) {
+        // A merge that returns null saw a same-PID identity change: a
+        // recycle/replace decision, not an absent descendant, so no row here may
+        // be signalled from its number. Only the descendant evidence is lost —
+        // the root still leaves through the handle no recycled pid can reach.
+        snapshot = mergeClaudeCapturedTrees(snapshot, tree)
+      }
+      // Keep an earlier admissible snapshot when this close-boundary read fails;
+      // it remains the only identity-safe evidence after root exit.
+    })()
+    refreshing = operation
+    const clearRefreshing = (): void => {
+      if (refreshing === operation) {
+        refreshing = null
+      }
+    }
+    void operation.then(clearRefreshing, clearRefreshing)
+    return operation
+  }
+
+  function queueRefreshAfter(pending: Promise<void>): Promise<void> {
+    if (queuedRefresh) {
+      return queuedRefresh
+    }
+    const operation = pending.then(() => {
+      if (exited()) {
+        return
+      }
+      return startRefresh()
+    })
+    queuedRefresh = operation
+    const clearQueuedRefresh = (): void => {
+      if (queuedRefresh === operation) {
+        queuedRefresh = null
+      }
+    }
+    void operation.then(clearQueuedRefresh, clearQueuedRefresh)
+    return operation
+  }
+
+  async function refresh(): Promise<void> {
+    const pending = capturing ?? refreshing
+    if (pending) {
+      await queueRefreshAfter(pending)
+      return
+    }
+    if (queuedRefresh) {
+      await queuedRefresh
+      return
+    }
+    try {
+      await startRefresh()
+    } catch {
+      // A refresh is advisory; capture failures leave the prior proof intact.
+    }
+  }
+
+  /** The only source of a tree verdict: every `exited` here is an observation. */
+  async function judgeTree(): Promise<DescendantTreeVerdict> {
+    const killRoot = (): boolean => terminateClaudeRoot({ child, exited })
+    const rootPid = child.pid
+    if (!rootPid) {
+      // Never spawned, so the OS never created a tree to orphan.
+      return 'exited'
+    }
+    await captureOnce()
+    if (platform === 'win32') {
+      // Why taskkill's own outcome is never the verdict: it resolves identically
+      // on a timeout, an access denial, a recycled root and a real kill.
+      const { rootVerified } = await terminateClaudeWindowsRoot({
+        snapshot: snapshot?.platform === 'win32' ? snapshot.tree : null,
+        exited,
+        verifyRoot: (root) => verifyRoot(root),
+        terminateTree: (root) =>
+          deps.terminateWindowsTree
+            ? deps.terminateWindowsTree(root)
+            : terminateIdentifiedWindowsProcessTree(root, {
+                ownsRoot: () => !exited()
+              }).then(() => undefined),
+        killRoot
+      })
+      if (!rootVerified && !exited()) {
+        return 'unverifiable'
+      }
+      return snapshot?.platform === 'win32'
+        ? await (deps.terminateWindowsDescendants ?? verifyWindowsDescendantSnapshotExit)(
+            snapshot.tree
+          )
+        : 'unverifiable'
+    }
+    if (snapshot?.platform !== 'posix') {
+      killRoot()
+      return 'unverifiable'
+    }
+    if (snapshot.tree.descendants.length === 0) {
+      // Read while the root was alive and childless: a later table read has no
+      // row it could match, so it would add nothing to this observation.
+      killRoot()
+      return 'exited'
+    }
+    // Why the root is killed while verification is already running, and never
+    // SIGSTOPped first the way the Codex non-group path does: measured on macOS, a
+    // killed child of a stopped parent stays a zombie row in ps with its lstart
+    // and pgid intact, so verification cannot pass until the root is dead. The
+    // descendants are signalled by the verifier as soon as it revalidates their
+    // identities; the root's death then reparents any zombies to init, which
+    // reaps them. After a root exit the kill is a no-op: Node drops the handle
+    // on exit and never signals a possibly recycled pid.
+    const verdictPromise = deps.terminateDescendants
+      ? deps.terminateDescendants(snapshot.tree)
+      : terminateDescendantSnapshotWithVerdict(snapshot.tree, {
+          requireIdentityBeforeSignal: true
+        })
+    killRoot()
+    // What the verification observed is the verdict: a kill that reports no
+    // signal means the handle was already gone, never that the tree survived.
+    return verdictPromise
+  }
+
+  return {
+    capture: captureOnce,
+    refresh,
+    reap() {
+      if (inFlight) {
+        return inFlight
+      }
+      const attempt = judgeTree()
+        .catch((): DescendantTreeVerdict => 'unverifiable')
+        .then((verdict) => {
+          treeVerdict =
+            TREE_VERDICT_TRUST[verdict] > TREE_VERDICT_TRUST[treeVerdict] ? verdict : treeVerdict
+          return verdict
+        })
+      inFlight = attempt
+      void attempt.finally(() => {
+        if (inFlight === attempt) {
+          inFlight = null
+        }
+      })
+      return attempt
+    },
+    get treeVerdict() {
+      return treeVerdict
+    }
+  }
+}
+
+/**
+ * Orca's own shutdown ladder on the child it spawned, kept because the SDK's
+ * close path returns no proof and Orca never releases a lease on an assumed exit.
+ *
+ * Resolves true only after the child actually emitted exit and its snapshotted
+ * descendants were observed gone; false is unproven. A root that left on its
+ * own before a snapshot could be armed stays unproven: its descendants had
+ * already reparented out of reach when the ladder first looked.
+ */
+export function proveClaudeChildExit(input: ClaudeChildExitProofInput): Promise<boolean> {
+  return proveClaudeChildExitWithReaper(input, () =>
+    createClaudeChildTreeReaper(input.child, { exited: input.exited })
+  )
+}
diff --git a/src/main/claude/claude-agent-sdk-import-boundary.test.ts b/src/main/claude/claude-agent-sdk-import-boundary.test.ts
new file mode 100644
index 00000000000..f1a38466d41
--- /dev/null
+++ b/src/main/claude/claude-agent-sdk-import-boundary.test.ts
@@ -0,0 +1,154 @@
+import { existsSync, readFileSync, statSync } from 'node:fs'
+import { dirname, join, relative, resolve } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { spawnProcess } from '../../shared/child-process/run-process'
+
+/**
+ * Keep the agent SDK on the structured-Claude side of the toggle.
+ *
+ * A user who never leaves the terminal/TUI Claude path must not pay for the SDK:
+ * importing it evaluates a package that rewrites
+ * `process.env.NoDefaultCurrentDirectoryInExePath`, changing how Windows resolves
+ * executables for every later subprocess, and a missing or incompatible install
+ * would take normal runtime startup down with it. The ordinary
+ * `OrcaRuntimeService` graph reaches the Claude transport module, so only a
+ * deferred import keeps that boundary — and only a walk of the real import graph
+ * keeps the next static import from quietly restoring it.
+ */
+const SDK_PACKAGE = '@anthropic-ai/claude-agent-sdk'
+const REPO_ROOT = resolve(__dirname, '..', '..', '..')
+
+/** The Electron main entry: everything the app loads before any session exists. */
+const ROOT = 'src/main/index.ts'
+/** Proof the walk goes all the way into the Claude transport rather than stopping short. */
+const TRANSPORT_MODULE = 'src/main/claude/claude-stream-json-connection.ts'
+
+/**
+ * Static, value-carrying specifiers only, read statement by statement so a
+ * multi-line `import { ... } from '...'` counts. `import type` is erased before
+ * the module ever loads and a bare `import(...)` is the deferral this guards, so
+ * neither is an edge the runtime traverses at load time.
+ */
+const STATEMENT_START = /^\s*(?:import|export)\b/
+const TYPE_ONLY = /^\s*(?:import|export)\s+type\b/
+const FROM_SPECIFIER = /(?:^|\s)from\s*['"]([^'"]+)['"]/
+const SIDE_EFFECT_IMPORT = /^\s*import\s*['"]([^'"]+)['"]/
+/** An import statement never spans more lines than its longest specifier list. */
+const MAX_STATEMENT_LINES = 60
+
+function readSpecifiers(source: string): string[] {
+  const lines = source.split('\n')
+  const found: string[] = []
+  for (let index = 0; index < lines.length; index += 1) {
+    const first = lines[index] as string
+    if (!STATEMENT_START.test(first) || TYPE_ONLY.test(first)) {
+      continue
+    }
+    const sideEffect = SIDE_EFFECT_IMPORT.exec(first)
+    if (sideEffect) {
+      found.push(sideEffect[1] as string)
+      continue
+    }
+    for (let scan = index; scan < Math.min(lines.length, index + MAX_STATEMENT_LINES); scan += 1) {
+      if (scan > index && STATEMENT_START.test(lines[scan] as string)) {
+        break
+      }
+      const specifier = FROM_SPECIFIER.exec(lines[scan] as string)
+      if (specifier) {
+        found.push(specifier[1] as string)
+        break
+      }
+    }
+  }
+  return found
+}
+
+/** Resolve a relative specifier the way the bundler does; unresolvable means not a module. */
+function resolveRelative(fromFile: string, specifier: string): string | null {
+  const base = join(dirname(fromFile), specifier)
+  for (const candidate of [base, `${base}.ts`, `${base}.tsx`, join(base, 'index.ts')]) {
+    if (existsSync(candidate) && statSync(candidate).isFile()) {
+      return candidate
+    }
+  }
+  return null
+}
+
+function walkStaticImports(rootFile: string): { visited: Set<string>; sdkImporters: string[] } {
+  const visited = new Set<string>()
+  const sdkImporters: string[] = []
+  const queue = [resolve(REPO_ROOT, rootFile)]
+  while (queue.length > 0) {
+    const file = queue.pop() as string
+    const key = relative(REPO_ROOT, file).split('\\').join('/')
+    if (visited.has(key)) {
+      continue
+    }
+    visited.add(key)
+    for (const specifier of readSpecifiers(readFileSync(file, 'utf8'))) {
+      if (specifier === SDK_PACKAGE || specifier.startsWith(`${SDK_PACKAGE}/`)) {
+        sdkImporters.push(key)
+        continue
+      }
+      if (!specifier.startsWith('.')) {
+        continue
+      }
+      const target = resolveRelative(file, specifier)
+      if (target) {
+        queue.push(target)
+      }
+    }
+  }
+  return { visited, sdkImporters }
+}
+
+describe('claude agent SDK import boundary', () => {
+  const walk = walkStaticImports(ROOT)
+
+  it('walks a graph deep enough to reach the Claude transport', () => {
+    // Without this the guard passes for the wrong reason the moment the walk breaks.
+    expect(walk.visited.size).toBeGreaterThan(500)
+    expect([...walk.visited]).toContain(TRANSPORT_MODULE)
+  })
+
+  it('never reaches the SDK through a static import from the main entry', () => {
+    expect(
+      walk.sdkImporters,
+      `${SDK_PACKAGE} must stay behind the structured-Claude boundary. Load it with a deferred import inside the session path instead.`
+    ).toEqual([])
+  })
+
+  it('leaves the Windows executable-search environment alone when the runtime loads', async () => {
+    // A vitest file runs in its own fork, so this is a clean process; the ambient
+    // value is cleared first because the developer's own shell may carry one.
+    delete process.env.NoDefaultCurrentDirectoryInExePath
+    await import('../runtime/structured-agent-session-runtime')
+
+    expect(process.env.NoDefaultCurrentDirectoryInExePath).toBeUndefined()
+  })
+
+  it('still lets the SDK set it, so the guard above is not measuring nothing', async () => {
+    // A separate process, not this fork: the assertion has to be about a first
+    // evaluation of the package, which a cached module registry cannot give.
+    const { NoDefaultCurrentDirectoryInExePath: _cleared, ...env } = process.env
+    const probe = spawnProcess({
+      program: process.execPath,
+      args: [
+        '-e',
+        `import(${JSON.stringify(SDK_PACKAGE)}).then(() => console.log(String(process.env.NoDefaultCurrentDirectoryInExePath)))`
+      ],
+      cwd: REPO_ROOT,
+      env: env as Record<string, string>,
+      stdio: ['ignore', 'pipe', 'ignore']
+    })
+    const observed = await new Promise<string>((settle) => {
+      let output = ''
+      probe.stdout?.setEncoding('utf8').on('data', (chunk: string) => {
+        output += chunk
+      })
+      probe.once('close', () => settle(output.trim()))
+    })
+
+    expect(observed).toBe('1')
+  })
+})
diff --git a/src/main/claude/claude-agent-sdk-process-spawn.test.ts b/src/main/claude/claude-agent-sdk-process-spawn.test.ts
new file mode 100644
index 00000000000..cd3520cf6d5
--- /dev/null
+++ b/src/main/claude/claude-agent-sdk-process-spawn.test.ts
@@ -0,0 +1,107 @@
+import { EventEmitter } from 'node:events'
+import { PassThrough } from 'node:stream'
+import { describe, expect, it, vi } from 'vitest'
+import type { SpawnOptions as SdkSpawnOptions } from '@anthropic-ai/claude-agent-sdk'
+import { resolveSpawn, type spawnProcess } from '../../shared/child-process/run-process'
+import type { ProcessSpec } from '../../shared/child-process/process-spec'
+import { createClaudeCodeProcessSpawn } from './claude-agent-sdk-process-spawn'
+
+type FakeChild = EventEmitter & {
+  pid: number
+  stdin: PassThrough
+  stdout: PassThrough
+  stderr: PassThrough
+  kill: ReturnType<typeof vi.fn>
+}
+
+function fakeSpawn() {
+  const child = new EventEmitter() as FakeChild
+  child.pid = 4321
+  child.stdin = new PassThrough()
+  child.stdout = new PassThrough()
+  child.stderr = new PassThrough()
+  child.kill = vi.fn(() => true)
+  const specs: ProcessSpec[] = []
+  const spawnImpl = ((spec: ProcessSpec) => {
+    specs.push(spec)
+    return child
+  }) as unknown as typeof spawnProcess
+  return { child, spawnImpl, specs }
+}
+
+function sdkOptions(overrides: Partial<SdkSpawnOptions> = {}): SdkSpawnOptions {
+  return {
+    command: '/usr/local/bin/claude',
+    args: ['--output-format', 'stream-json'],
+    cwd: '/work/repo',
+    env: { PATH: '/usr/bin', CLAUDE_CONFIG_DIR: '/accounts/one', UNSET: undefined },
+    signal: new AbortController().signal,
+    ...overrides
+  }
+}
+
+describe('claude agent SDK process spawn', () => {
+  it('routes the SDK spawn through Orca and retains the pid the lease adjudicates on', () => {
+    const process = fakeSpawn()
+    const spawn = createClaudeCodeProcessSpawn(process.spawnImpl)
+
+    expect(spawn.pid).toBeUndefined()
+    expect(spawn.child).toBeNull()
+    const child = spawn.spawn(sdkOptions())
+
+    expect(child).toBe(process.child)
+    expect(spawn.child).toBe(process.child)
+    expect(spawn.pid).toBe(4321)
+    expect(process.specs[0]).toEqual({
+      program: '/usr/local/bin/claude',
+      args: ['--output-format', 'stream-json'],
+      cwd: '/work/repo',
+      env: { PATH: '/usr/bin', CLAUDE_CONFIG_DIR: '/accounts/one' },
+      stdio: ['pipe', 'pipe', 'pipe']
+    })
+  })
+
+  it('keeps the child out of the SDK abort path so exit proof stays Orca-owned', () => {
+    const process = fakeSpawn()
+    const controller = new AbortController()
+    createClaudeCodeProcessSpawn(process.spawnImpl).spawn(sdkOptions({ signal: controller.signal }))
+
+    // Node's spawn({signal}) kills the child on abort; Orca's ladder must be the
+    // only thing that can end this process, or close() would report an assumed exit.
+    expect(process.specs[0]).not.toHaveProperty('signal')
+  })
+
+  it('drains stderr into a bounded tail so an exit error still carries it', async () => {
+    const process = fakeSpawn()
+    const spawn = createClaudeCodeProcessSpawn(process.spawnImpl)
+    spawn.spawn(sdkOptions())
+
+    process.child.stderr.write('x'.repeat(9000))
+    process.child.stderr.write('claude: not signed in')
+    await new Promise((resolve) => setImmediate(resolve))
+
+    expect(spawn.stderrTail).toMatch(/claude: not signed in$/)
+    expect(spawn.stderrTail.length).toBe(8192)
+  })
+
+  it('hands a Windows .cmd shim to Orca\u2019s argument encoder', () => {
+    const process = fakeSpawn()
+    createClaudeCodeProcessSpawn(process.spawnImpl).spawn(
+      sdkOptions({
+        command: 'C:\\Users\\dev\\AppData\\npm\\claude.cmd',
+        args: ['--setting-sources=user,project,local', '--session-id', 'a b&c']
+      })
+    )
+
+    // The spec the spawner builds is what Orca's Windows branch encodes; the SDK's
+    // own spawn would hand `.cmd` straight to Node and mangle the argument.
+    const resolved = resolveSpawn(process.specs[0] as ProcessSpec, 'win32')
+    expect(resolved.file.toLowerCase()).toContain('cmd.exe')
+    expect(resolved.options.windowsVerbatimArguments).toBe(true)
+    expect(resolved.args).toHaveLength(1)
+    // `/v:off` plus the quoted argument is what keeps `&` from splitting the line.
+    expect(resolved.args[0]).toContain('/v:off')
+    expect(resolved.args[0]).toContain('"a b&c"')
+    expect(resolved.args[0]).toContain('"--setting-sources=user,project,local"')
+  })
+})
diff --git a/src/main/claude/claude-agent-sdk-process-spawn.ts b/src/main/claude/claude-agent-sdk-process-spawn.ts
new file mode 100644
index 00000000000..a2b1ad7f158
--- /dev/null
+++ b/src/main/claude/claude-agent-sdk-process-spawn.ts
@@ -0,0 +1,69 @@
+import type { SpawnOptions as ClaudeAgentSdkSpawnOptions } from '@anthropic-ai/claude-agent-sdk'
+import { spawnProcess } from '../../shared/child-process/run-process'
+
+/** Derived rather than imported: only src/shared/child-process may name node:child_process. */
+type ClaudeCodeChild = ReturnType<typeof spawnProcess>
+
+const STDERR_TAIL_MAX_BYTES = 8192
+
+export type ClaudeCodeProcessSpawn = {
+  /** Pass as the SDK's `spawnClaudeCodeProcess`; the SDK never learns the pid because it never owns it. */
+  spawn: (options: ClaudeAgentSdkSpawnOptions) => ClaudeCodeChild
+  /** The retained child, so Orca keeps its own tree-kill and exit-proof ladder. Null until the SDK spawns. */
+  readonly child: ClaudeCodeChild | null
+  /** Ownership proof: the durable lease adjudicates on this pid plus start time plus the spawn token. */
+  readonly pid: number | undefined
+  readonly stderrTail: string
+}
+
+function definedEnv(env: Record<string, string | undefined>): Record<string, string> {
+  const next: Record<string, string> = {}
+  for (const [key, value] of Object.entries(env)) {
+    if (value !== undefined) {
+      next[key] = value
+    }
+  }
+  return next
+}
+
+/**
+ * Orca supplies the Claude Code child rather than letting the SDK spawn it.
+ *
+ * Two independent reasons: the SDK's `SpawnedProcess` has no pid, and Orca's
+ * spawner is the only path that encodes `.cmd` arguments safely on Windows.
+ */
+export function createClaudeCodeProcessSpawn(
+  spawnImpl: typeof spawnProcess = spawnProcess
+): ClaudeCodeProcessSpawn {
+  let child: ClaudeCodeChild | null = null
+  let stderrTail = ''
+  return {
+    spawn: (options) => {
+      // Why `options.signal` is dropped: it would let the SDK kill the child outside
+      // Orca's ladder, and close() may never report an exit it did not observe.
+      const spawned = spawnImpl({
+        program: options.command,
+        args: [...options.args],
+        ...(options.cwd === undefined ? {} : { cwd: options.cwd }),
+        env: definedEnv(options.env),
+        stdio: ['pipe', 'pipe', 'pipe']
+      })
+      child = spawned
+      // The SDK drains stderr only for its own local spawn, so a custom spawner must:
+      // otherwise the child blocks on a full pipe and exit errors lose their tail.
+      spawned.stderr.setEncoding('utf8').on('data', (chunk: string) => {
+        stderrTail = (stderrTail + chunk).slice(-STDERR_TAIL_MAX_BYTES)
+      })
+      return spawned
+    },
+    get child() {
+      return child
+    },
+    get pid() {
+      return child?.pid
+    },
+    get stderrTail() {
+      return stderrTail
+    }
+  }
+}
diff --git a/src/main/claude/claude-agent-sdk-root-kill-fallback.test.ts b/src/main/claude/claude-agent-sdk-root-kill-fallback.test.ts
new file mode 100644
index 00000000000..9f843527e30
--- /dev/null
+++ b/src/main/claude/claude-agent-sdk-root-kill-fallback.test.ts
@@ -0,0 +1,190 @@
+import { EventEmitter } from 'node:events'
+import { PassThrough } from 'node:stream'
+import { describe, expect, it, vi } from 'vitest'
+import type { SpawnedProcess } from '../../shared/child-process/run-process'
+import type { DescendantSnapshot } from '../pty-descendant-termination'
+import type { WindowsDescendantSnapshot } from '../windows-descendant-exit-verification'
+import { createClaudeChildTreeReaper } from './claude-agent-sdk-exit-proof'
+import { mergeClaudeCapturedTrees } from './claude-child-tree-snapshot'
+
+const ROOT_PID = 424242
+const ROOT_STARTED_AT = 'Mon Jan 1 00:00:00 2026'
+const ROOT_FORK_MS = Date.parse(ROOT_STARTED_AT)
+
+function mockChild(): EventEmitter &
+  Pick<SpawnedProcess, 'pid' | 'kill' | 'stdin'> & { kill: ReturnType<typeof vi.fn> } {
+  return Object.assign(new EventEmitter(), {
+    pid: ROOT_PID,
+    stdin: new PassThrough(),
+    kill: vi.fn(() => true)
+  }) as never
+}
+
+function posixSnapshot(input: {
+  capturedAtMs: number
+  descendants?: DescendantSnapshot['descendants']
+}): DescendantSnapshot {
+  return {
+    root: { pid: ROOT_PID, startedAt: ROOT_STARTED_AT },
+    rootPgid: ROOT_PID,
+    descendants: input.descendants ?? [],
+    capturedAtMs: input.capturedAtMs
+  }
+}
+
+function windowsSnapshot(capturedAtMs = 1): WindowsDescendantSnapshot {
+  return {
+    root: { pid: ROOT_PID, creationTimeMs: 1_700_000_000_001 },
+    descendants: [{ pid: 4243, creationTimeMs: 1_700_000_000_000 }],
+    unidentifiedCount: 0,
+    capturedAtMs
+  }
+}
+
+describe('Claude root kill fallback', () => {
+  it('kills the root when the first capture landed in the fork second', async () => {
+    // The production POSIX verifier declines a root born in its capture second,
+    // and that verdict must not cost the tree the kill on Node's own handle.
+    const child = mockChild()
+    const tree = createClaudeChildTreeReaper(child, {
+      platform: 'linux',
+      exited: () => false,
+      captureDescendants: vi.fn(async () => posixSnapshot({ capturedAtMs: ROOT_FORK_MS + 300 }))
+    })
+
+    await expect(tree.reap()).resolves.toBe('exited')
+    expect(child.kill).toHaveBeenCalledWith('SIGKILL')
+  })
+
+  it('kills the root after a recycled descendant pid voided the snapshot', async () => {
+    const child = mockChild()
+    const captureDescendants = vi
+      .fn()
+      .mockResolvedValueOnce(
+        posixSnapshot({
+          capturedAtMs: ROOT_FORK_MS + 5_000,
+          descendants: [{ pid: 100, ppid: ROOT_PID, pgid: ROOT_PID, startedAt: ROOT_STARTED_AT }]
+        })
+      )
+      .mockResolvedValueOnce(
+        posixSnapshot({
+          capturedAtMs: ROOT_FORK_MS + 6_000,
+          descendants: [
+            { pid: 100, ppid: ROOT_PID, pgid: ROOT_PID, startedAt: 'Mon Jan 1 00:00:30 2026' }
+          ]
+        })
+      )
+    const tree = createClaudeChildTreeReaper(child, {
+      platform: 'linux',
+      exited: () => false,
+      captureDescendants,
+      terminateDescendants: vi.fn(async () => 'exited' as const),
+      verifyRootIdentity: vi.fn(async () => true)
+    })
+
+    await tree.capture()
+    await tree.refresh?.()
+    // The descendant evidence is rightly discarded; the root's never was in doubt.
+    await expect(tree.reap()).resolves.toBe('unverifiable')
+    expect(child.kill).toHaveBeenCalledWith('SIGKILL')
+  })
+
+  it('keeps an observed live descendant when the root identity probe declined', async () => {
+    const child = mockChild()
+    const tree = createClaudeChildTreeReaper(child, {
+      platform: 'linux',
+      exited: () => false,
+      captureDescendants: vi.fn(async () =>
+        posixSnapshot({
+          capturedAtMs: ROOT_FORK_MS + 5_000,
+          descendants: [{ pid: 100, ppid: ROOT_PID, pgid: ROOT_PID, startedAt: ROOT_STARTED_AT }]
+        })
+      ),
+      terminateDescendants: vi.fn(async () => 'live' as const),
+      verifyRootIdentity: vi.fn(async () => false)
+    })
+
+    await expect(tree.reap()).resolves.toBe('live')
+    expect(tree.treeVerdict).toBe('live')
+    expect(child.kill).toHaveBeenCalledWith('SIGKILL')
+  })
+
+  it('reports a Windows taskkill that worked as exited, not unverifiable', async () => {
+    const child = mockChild()
+    // Probe 1 gates taskkill; a later probe correctly finds the root already dead.
+    const verifyRootIdentity = vi.fn().mockResolvedValueOnce(true).mockResolvedValue(false)
+    const tree = createClaudeChildTreeReaper(child, {
+      platform: 'win32',
+      exited: () => false,
+      captureWindowsDescendants: vi.fn(async () => windowsSnapshot()),
+      terminateWindowsTree: vi.fn(async () => {}),
+      terminateWindowsDescendants: vi.fn(async () => 'exited' as const),
+      verifyRootIdentity
+    })
+
+    await expect(tree.reap()).resolves.toBe('exited')
+  })
+
+  it('kills the root when no POSIX snapshot could be read', async () => {
+    const child = mockChild()
+    const tree = createClaudeChildTreeReaper(child, {
+      platform: 'linux',
+      exited: () => false,
+      captureDescendants: vi.fn(async () => null),
+      terminateDescendants: vi.fn()
+    })
+
+    await expect(tree.reap()).resolves.toBe('unverifiable')
+    expect(child.kill).toHaveBeenCalledWith('SIGKILL')
+  })
+
+  it('kills the root when the Windows process table is unreadable', async () => {
+    const child = mockChild()
+    const terminateWindowsTree = vi.fn(async () => {})
+    const tree = createClaudeChildTreeReaper(child, {
+      platform: 'win32',
+      exited: () => false,
+      captureWindowsDescendants: vi.fn(async () => null),
+      terminateWindowsTree,
+      terminateWindowsDescendants: vi.fn()
+    })
+
+    await expect(tree.reap()).resolves.toBe('unverifiable')
+    // No identity means no bare-pid tree kill, but the owned handle is still ours.
+    expect(terminateWindowsTree).not.toHaveBeenCalled()
+    expect(child.kill).toHaveBeenCalledWith('SIGKILL')
+  })
+
+  it('never signals a root the reaper already saw exit', async () => {
+    const child = mockChild()
+    const tree = createClaudeChildTreeReaper(child, {
+      platform: 'linux',
+      exited: () => true,
+      captureDescendants: vi.fn(async () => null)
+    })
+
+    await expect(tree.reap()).resolves.toBe('unverifiable')
+    expect(child.kill).not.toHaveBeenCalled()
+  })
+
+  it('chains per-pid Windows boundaries across a second merge', async () => {
+    const first = windowsSnapshot(1_000)
+    const second: WindowsDescendantSnapshot = {
+      ...windowsSnapshot(2_000),
+      descendants: [
+        { pid: 4243, creationTimeMs: 1_700_000_000_000 },
+        { pid: 4244, creationTimeMs: 1_700_000_000_002 }
+      ]
+    }
+    const third: WindowsDescendantSnapshot = { ...second, capturedAtMs: 3_000 }
+
+    const merged = mergeClaudeCapturedTrees(
+      { platform: 'win32', tree: first },
+      { platform: 'win32', tree: second }
+    )
+    expect(merged?.tree.capturedAtMsByPid).toEqual({ '4243': 1_000, '4244': 2_000 })
+    const rechained = mergeClaudeCapturedTrees(merged!, { platform: 'win32', tree: third })
+
+    expect(rechained?.tree.capturedAtMsByPid).toEqual({ '4243': 1_000, '4244': 2_000 })
+  })
+})
diff --git a/src/main/claude/claude-agent-sdk-user-message-queue.test.ts b/src/main/claude/claude-agent-sdk-user-message-queue.test.ts
new file mode 100644
index 00000000000..62fbd8cf203
--- /dev/null
+++ b/src/main/claude/claude-agent-sdk-user-message-queue.test.ts
@@ -0,0 +1,65 @@
+import type { SDKUserMessage } from '@anthropic-ai/claude-agent-sdk'
+import { describe, expect, it } from 'vitest'
+import { createClaudeUserMessageQueue } from './claude-agent-sdk-user-message-queue'
+
+/**
+ * The SDK's input pump is `for await (const frame of prompt) { await transport.write(frame) }`.
+ * A rejected write — or an abort — ends that loop abruptly, which calls the
+ * generator's `return()`. Everything below drives that exact shape, because the
+ * frame the pump already pulled is the one nothing else can reach.
+ */
+const frame = (text: string): SDKUserMessage =>
+  ({
+    type: 'user',
+    message: { role: 'user', content: [{ type: 'text', text }] }
+  }) as unknown as SDKUserMessage
+
+const settled = (promise: Promise<void>): Promise<'settled' | 'pending'> =>
+  Promise.race([
+    promise.then(
+      () => 'settled' as const,
+      () => 'settled' as const
+    ),
+    new Promise<'pending'>((resolve) => setTimeout(() => resolve('pending'), 100))
+  ])
+
+describe('claude user message queue', () => {
+  it('rejects the frame the SDK pulled but abandoned without writing', async () => {
+    const queue = createClaudeUserMessageQueue()
+    const pump = queue.messages[Symbol.asyncIterator]()
+    const sent = queue.push(frame('hello'))
+
+    await pump.next()
+    await pump.return?.(undefined)
+
+    await expect(settled(sent)).resolves.toBe('settled')
+    await expect(sent).rejects.toThrow(
+      'claude stream-json input ended before the frame was written'
+    )
+  })
+
+  it('rejects an in-flight frame from fail() when the SDK never resumes the pump', async () => {
+    const queue = createClaudeUserMessageQueue()
+    const pump = queue.messages[Symbol.asyncIterator]()
+    const sent = queue.push(frame('hello'))
+
+    await pump.next()
+    queue.fail(new Error('claude stream-json exited: child died'))
+
+    await expect(settled(sent)).resolves.toBe('settled')
+    await expect(sent).rejects.toThrow('claude stream-json exited: child died')
+  })
+
+  it('still settles a written frame only once the pump asks for the next one', async () => {
+    const queue = createClaudeUserMessageQueue()
+    const pump = queue.messages[Symbol.asyncIterator]()
+    const sent = queue.push(frame('hello'))
+
+    const pulled = await pump.next()
+    expect(pulled.value).toMatchObject({ type: 'user' })
+    // The write proof is the pump coming back for more, exactly as before.
+    await expect(settled(sent)).resolves.toBe('pending')
+    void pump.next()
+    await expect(sent).resolves.toBeUndefined()
+  })
+})
diff --git a/src/main/claude/claude-agent-sdk-user-message-queue.ts b/src/main/claude/claude-agent-sdk-user-message-queue.ts
new file mode 100644
index 00000000000..87fa6660159
--- /dev/null
+++ b/src/main/claude/claude-agent-sdk-user-message-queue.ts
@@ -0,0 +1,100 @@
+import type { SDKUserMessage } from '@anthropic-ai/claude-agent-sdk'
+
+type QueuedMessage = {
+  message: SDKUserMessage
+  resolve: () => void
+  reject: (error: Error) => void
+}
+
+export type ClaudeUserMessageQueue = {
+  /** The SDK's streaming-input prompt; it stays open until `end`. */
+  messages: AsyncIterable<SDKUserMessage>
+  /** Resolves once the SDK has finished writing the frame to the child. */
+  push: (message: SDKUserMessage) => Promise<void>
+  /** Reject every unwritten frame, in-flight included; a caller waiting on a send must not hang past the exit. */
+  fail: (error: Error) => void
+  end: () => void
+}
+
+/** The rejection an abandoned frame carries when nothing else has named a cause yet. */
+const UNWRITTEN_FRAME_MESSAGE = 'claude stream-json input ended before the frame was written'
+
+export function createClaudeUserMessageQueue(): ClaudeUserMessageQueue {
+  const queued: QueuedMessage[] = []
+  // The frame the SDK has taken but not yet acknowledged. It is out of `queued`,
+  // so it is unreachable from anywhere else and would otherwise never settle.
+  let inFlight: QueuedMessage | null = null
+  let wake: (() => void) | null = null
+  let ended = false
+  let failure: Error | null = null
+  const notify = (): void => {
+    wake?.()
+    wake = null
+  }
+  const rejectInFlight = (error: Error): void => {
+    const abandoned = inFlight
+    inFlight = null
+    abandoned?.reject(error)
+  }
+
+  async function* drain(): AsyncGenerator<SDKUserMessage> {
+    for (;;) {
+      const next = queued.shift()
+      if (next) {
+        inFlight = next
+        let written = false
+        try {
+          yield next.message
+          written = true
+        } finally {
+          // The SDK's input pump abandons this iterator when its
+          // `await transport.write(...)` rejects or the query aborts, and the code
+          // after a `yield` never runs on that path. Settling here is the only
+          // place a frame it already took can be reached.
+          if (written) {
+            inFlight = null
+            // Resumed only after the SDK's `await transport.write(...)` settled, so this
+            // is the same "the frame reached the child" proof the hand-rolled write gave.
+            next.resolve()
+          } else {
+            rejectInFlight(failure ?? new Error(UNWRITTEN_FRAME_MESSAGE))
+          }
+        }
+        continue
+      }
+      if (ended || failure) {
+        return
+      }
+      await new Promise<void>((resolve) => {
+        wake = resolve
+      })
+    }
+  }
+
+  return {
+    messages: drain(),
+    push: (message) =>
+      new Promise<void>((resolve, reject) => {
+        if (failure) {
+          reject(failure)
+          return
+        }
+        queued.push({ message, resolve, reject })
+        notify()
+      }),
+    fail: (error) => {
+      failure ??= error
+      for (const entry of queued.splice(0)) {
+        entry.reject(error)
+      }
+      // A pump that never resumes cannot run the generator's cleanup, so the
+      // exit path has to reach the in-flight frame itself.
+      rejectInFlight(error)
+      notify()
+    },
+    end: () => {
+      ended = true
+      notify()
+    }
+  }
+}
diff --git a/src/main/claude/claude-background-task-tracker.test.ts b/src/main/claude/claude-background-task-tracker.test.ts
new file mode 100644
index 00000000000..d8f316d7dcd
--- /dev/null
+++ b/src/main/claude/claude-background-task-tracker.test.ts
@@ -0,0 +1,340 @@
+import { describe, expect, it } from 'vitest'
+import {
+  ClaudeBackgroundTaskTracker,
+  classifyClaudeBackgroundTaskKind
+} from './claude-background-task-tracker'
+
+function system(subtype: string, fields: Record<string, unknown>): Record<string, unknown> {
+  return { type: 'system', subtype, session_id: 'provider-1', uuid: crypto.randomUUID(), ...fields }
+}
+
+function result(): Record<string, unknown> {
+  return { type: 'result', subtype: 'success', session_id: 'provider-1', uuid: crypto.randomUUID() }
+}
+
+function aggregate(tasks: unknown[]): Record<string, unknown> {
+  return system('background_tasks_changed', { tasks })
+}
+
+describe('ClaudeBackgroundTaskTracker', () => {
+  it('classifies SDK task types without inferring them from descriptions', () => {
+    expect(classifyClaudeBackgroundTaskKind('local_agent')).toBe('agent')
+    expect(classifyClaudeBackgroundTaskKind('local_workflow')).toBe('workflow')
+    expect(classifyClaudeBackgroundTaskKind('local_bash')).toBe('command')
+    expect(classifyClaudeBackgroundTaskKind('monitor')).toBe('monitor')
+    expect(classifyClaudeBackgroundTaskKind('future_task')).toBe('unknown')
+  })
+
+  it('waits for the foreground turn to settle before monitoring a background task', () => {
+    const tracker = new ClaudeBackgroundTaskTracker()
+    tracker.observe({ type: 'user' }, true)
+    tracker.observe(
+      system('task_started', {
+        task_id: 'task-1',
+        task_type: 'local_agent',
+        is_backgrounded: true
+      })
+    )
+    expect(tracker.state).toBeNull()
+
+    expect(tracker.observe(result())).toBe(true)
+    expect(tracker.state).toEqual({
+      state: 'monitoring',
+      tasks: [{ id: 'task-1', kind: 'agent' }]
+    })
+  })
+
+  it('uses an explicit background update for a foreground task and ignores progress alone', () => {
+    const tracker = new ClaudeBackgroundTaskTracker()
+    tracker.observe({ type: 'user' }, true)
+    tracker.observe(
+      system('task_started', {
+        task_id: 'task-1',
+        task_type: 'local_bash',
+        is_backgrounded: false
+      })
+    )
+    expect(
+      tracker.observe(system('task_progress', { task_id: 'task-1', description: 'still working' }))
+    ).toBe(false)
+    tracker.observe(result())
+    expect(tracker.state).toBeNull()
+
+    tracker.observe(system('task_updated', { task_id: 'task-1', patch: { is_backgrounded: true } }))
+    expect(tracker.state).toEqual({
+      state: 'monitoring',
+      tasks: [{ id: 'task-1', kind: 'command' }]
+    })
+  })
+
+  it('publishes bounded display details when a running task description changes', () => {
+    const tracker = new ClaudeBackgroundTaskTracker()
+    expect(
+      tracker.observe(
+        system('task_started', {
+          task_id: 'task-1',
+          task_type: 'local_bash',
+          is_backgrounded: true,
+          description: '  run\n  the build  '
+        })
+      )
+    ).toBe(true)
+    expect(tracker.state).toEqual({
+      state: 'monitoring',
+      tasks: [{ id: 'task-1', kind: 'command', description: 'run the build' }]
+    })
+
+    expect(
+      tracker.observe(
+        system('task_updated', {
+          task_id: 'task-1',
+          patch: { description: 'x'.repeat(600) }
+        })
+      )
+    ).toBe(true)
+    expect(tracker.state?.tasks?.[0]?.description).toHaveLength(512)
+    expect(
+      tracker.observe(
+        system('task_updated', {
+          task_id: 'task-1',
+          patch: { description: 'x'.repeat(600) }
+        })
+      )
+    ).toBe(false)
+  })
+
+  it('replaces its roster from aggregate lifecycle frames and preserves stoppable provider ids', () => {
+    const tracker = new ClaudeBackgroundTaskTracker()
+    expect(
+      tracker.observe(
+        aggregate([
+          { task_id: 'task-agent', task_type: 'local_agent', description: 'agent' },
+          { task_id: 'task-bash', task_type: 'local_bash', description: 'bash' }
+        ])
+      )
+    ).toBe(true)
+    expect(tracker.stoppableTaskIds).toEqual(['task-agent', 'task-bash'])
+    expect(tracker.state).toEqual({
+      state: 'monitoring',
+      tasks: [
+        { id: 'task-agent', kind: 'agent', description: 'agent' },
+        { id: 'task-bash', kind: 'command', description: 'bash' }
+      ]
+    })
+
+    expect(
+      tracker.observe(
+        aggregate([{ task_id: 'task-next', task_type: 'local_workflow', description: 'workflow' }])
+      )
+    ).toBe(true)
+    expect(tracker.stoppableTaskIds).toEqual(['task-next'])
+    expect(tracker.state).toEqual({
+      state: 'monitoring',
+      tasks: [{ id: 'task-next', kind: 'workflow', description: 'workflow' }]
+    })
+
+    expect(tracker.observe(aggregate([]))).toBe(true)
+    expect(tracker.stoppableTaskIds).toEqual([])
+    expect(tracker.state).toBeNull()
+  })
+
+  it('excludes ambient aggregate tasks', () => {
+    const tracker = new ClaudeBackgroundTaskTracker()
+    tracker.observe(
+      aggregate([
+        { task_id: 'ambient', task_type: 'monitor', description: 'watcher', ambient: true },
+        { task_id: 'visible', task_type: 'local_bash', description: 'command' }
+      ])
+    )
+
+    expect(tracker.stoppableTaskIds).toEqual(['visible'])
+  })
+
+  it('does not let late edge frames revive tasks cleared by an aggregate roster', () => {
+    const tracker = new ClaudeBackgroundTaskTracker()
+    tracker.observe(
+      aggregate([{ task_id: 'task-late', task_type: 'local_agent', description: 'agent' }])
+    )
+    tracker.observe(aggregate([]))
+
+    tracker.observe(
+      system('task_started', {
+        task_id: 'task-late',
+        task_type: 'local_agent',
+        is_backgrounded: true
+      })
+    )
+    tracker.observe(
+      system('task_updated', { task_id: 'task-late', patch: { is_backgrounded: true } })
+    )
+
+    expect(tracker.stoppableTaskIds).toEqual([])
+    expect(tracker.state).toBeNull()
+  })
+
+  it('lets an authoritative aggregate roster replace earlier terminal-edge evidence', () => {
+    const tracker = new ClaudeBackgroundTaskTracker()
+    tracker.observe(system('task_notification', { task_id: 'task-live', status: 'completed' }))
+
+    tracker.observe(
+      aggregate([{ task_id: 'task-live', task_type: 'local_agent', description: 'agent' }])
+    )
+
+    expect(tracker.stoppableTaskIds).toEqual(['task-live'])
+    expect(tracker.state).toEqual({
+      state: 'monitoring',
+      tasks: [{ id: 'task-live', kind: 'agent', description: 'agent' }]
+    })
+  })
+
+  it('keeps terminal edges authoritative on either side of aggregate replacement', () => {
+    const terminalFirst = new ClaudeBackgroundTaskTracker()
+    terminalFirst.observe(
+      system('task_notification', { task_id: 'task-first', status: 'completed' })
+    )
+    terminalFirst.observe(aggregate([]))
+    terminalFirst.observe(
+      system('task_started', {
+        task_id: 'task-first',
+        task_type: 'local_agent',
+        is_backgrounded: true
+      })
+    )
+    expect(terminalFirst.state).toBeNull()
+
+    const terminalLast = new ClaudeBackgroundTaskTracker()
+    terminalLast.observe(
+      aggregate([{ task_id: 'task-last', task_type: 'local_agent', description: 'agent' }])
+    )
+    terminalLast.observe(system('task_notification', { task_id: 'task-last', status: 'completed' }))
+    terminalLast.observe(
+      system('task_started', {
+        task_id: 'task-last',
+        task_type: 'local_agent',
+        is_backgrounded: true
+      })
+    )
+    expect(terminalLast.state).toBeNull()
+  })
+
+  it('keeps terminal evidence authoritative across duplicates and out-of-order starts', () => {
+    const tracker = new ClaudeBackgroundTaskTracker()
+    const terminal = system('task_notification', { task_id: 'task-late', status: 'completed' })
+    tracker.observe(terminal)
+    tracker.observe(terminal)
+    tracker.observe(
+      system('task_started', {
+        task_id: 'task-late',
+        task_type: 'local_workflow',
+        is_backgrounded: true
+      })
+    )
+    expect(tracker.state).toBeNull()
+
+    tracker.observe(
+      system('task_started', {
+        task_id: 'task-live',
+        task_type: 'monitor'
+      })
+    )
+    expect(tracker.state).toEqual({
+      state: 'monitoring',
+      tasks: [{ id: 'task-live', kind: 'monitor' }]
+    })
+    expect(
+      tracker.observe(system('task_updated', { task_id: 'task-live', patch: { status: 'killed' } }))
+    ).toBe(true)
+    expect(tracker.state).toBeNull()
+  })
+
+  it('recognizes task types that are registered only as background work', () => {
+    for (const taskType of ['local_workflow', 'monitor']) {
+      const tracker = new ClaudeBackgroundTaskTracker()
+      tracker.observe(system('task_started', { task_id: taskType, task_type: taskType }))
+      expect(tracker.state).toEqual({
+        state: 'monitoring',
+        tasks: [{ id: taskType, kind: taskType === 'local_workflow' ? 'workflow' : 'monitor' }]
+      })
+    }
+  })
+
+  it('admits unknown background updates conservatively and bounds edge-only fallback ids', () => {
+    const tracker = new ClaudeBackgroundTaskTracker()
+    tracker.observe(
+      system('task_updated', { task_id: 'unknown', patch: { is_backgrounded: true } })
+    )
+    expect(tracker.stoppableTaskIds).toEqual(['unknown'])
+
+    for (let index = 0; index < 400; index += 1) {
+      tracker.observe(
+        system('task_started', {
+          task_id: `task-${index}`,
+          task_type: 'local_agent',
+          is_backgrounded: true
+        })
+      )
+    }
+    expect(tracker.stoppableTaskIds.length).toBeLessThanOrEqual(256)
+  })
+
+  it('bounds aggregate rosters and resets to the edge-only fallback on clear', () => {
+    const tracker = new ClaudeBackgroundTaskTracker()
+    tracker.observe(
+      aggregate(
+        Array.from({ length: 400 }, (_, index) => ({
+          task_id: `aggregate-${index}`,
+          task_type: 'local_bash',
+          description: 'command'
+        }))
+      )
+    )
+    expect(tracker.stoppableTaskIds).toHaveLength(256)
+
+    tracker.clear()
+    tracker.observe(
+      system('task_started', {
+        task_id: 'edge-after-reset',
+        task_type: 'local_agent',
+        is_backgrounded: true
+      })
+    )
+    expect(tracker.stoppableTaskIds).toEqual(['edge-after-reset'])
+  })
+
+  it('gates aggregate monitoring behind foreground turn completion', () => {
+    const tracker = new ClaudeBackgroundTaskTracker()
+    tracker.observe({ type: 'user' }, true)
+    tracker.observe(
+      aggregate([{ task_id: 'task-live', task_type: 'local_bash', description: 'command' }])
+    )
+    expect(tracker.state).toBeNull()
+
+    expect(tracker.observe(result())).toBe(true)
+    expect(tracker.state).toEqual({
+      state: 'monitoring',
+      tasks: [{ id: 'task-live', kind: 'command', description: 'command' }]
+    })
+  })
+
+  it('ignores ambient SDK tasks and clears all liveness when the session ends', () => {
+    const tracker = new ClaudeBackgroundTaskTracker()
+    tracker.observe(
+      system('task_started', {
+        task_id: 'ambient',
+        task_type: 'monitor',
+        is_backgrounded: true,
+        ambient: true
+      })
+    )
+    expect(tracker.state).toBeNull()
+    tracker.observe(
+      system('task_started', {
+        task_id: 'task-live',
+        task_type: 'local_agent',
+        is_backgrounded: true
+      })
+    )
+    expect(tracker.clear()).toBe(true)
+    expect(tracker.state).toBeNull()
+  })
+})
diff --git a/src/main/claude/claude-background-task-tracker.ts b/src/main/claude/claude-background-task-tracker.ts
new file mode 100644
index 00000000000..a1504a65dec
--- /dev/null
+++ b/src/main/claude/claude-background-task-tracker.ts
@@ -0,0 +1,251 @@
+import type {
+  AgentSessionBackgroundTask,
+  AgentSessionBackgroundTaskState
+} from '../../shared/agent-session-wire'
+
+const MAX_TRACKED_TASKS = 256
+const MAX_TASK_ID_LENGTH = 512
+const MAX_TASK_DESCRIPTION_LENGTH = 512
+const TERMINAL_TASK_STATES = new Set(['completed', 'failed', 'killed', 'stopped'])
+
+export type ClaudeBackgroundTaskKind = AgentSessionBackgroundTask['kind']
+
+type TrackedTask = {
+  backgrounded: boolean
+  kind: ClaudeBackgroundTaskKind
+  description?: string
+}
+
+function record(value: unknown): Record<string, unknown> | null {
+  return typeof value === 'object' && value !== null ? (value as Record<string, unknown>) : null
+}
+
+function taskId(message: Record<string, unknown>): string | null {
+  const value = message.task_id
+  return typeof value === 'string' && value.length > 0 && value.length <= MAX_TASK_ID_LENGTH
+    ? value
+    : null
+}
+
+function taskDescription(value: unknown): string | undefined {
+  if (typeof value !== 'string') {
+    return undefined
+  }
+  const trimmed = value.trim().replace(/\s+/g, ' ')
+  return trimmed.length > 0 ? trimmed.slice(0, MAX_TASK_DESCRIPTION_LENGTH) : undefined
+}
+
+export function classifyClaudeBackgroundTaskKind(taskType: unknown): ClaudeBackgroundTaskKind {
+  switch (taskType) {
+    case 'local_agent':
+      return 'agent'
+    case 'local_workflow':
+      return 'workflow'
+    case 'local_bash':
+      return 'command'
+    case 'monitor':
+      return 'monitor'
+    default:
+      return 'unknown'
+  }
+}
+
+export class ClaudeBackgroundTaskTracker {
+  private readonly tasks = new Map<string, TrackedTask>()
+  private readonly terminalTaskIds = new Set<string>()
+  private aggregateRosterObserved = false
+  private foregroundTurnActive = false
+  private monitoring = false
+  private publishedTasksFingerprint = ''
+
+  get state(): AgentSessionBackgroundTaskState | null {
+    if (!this.monitoring) {
+      return null
+    }
+    return {
+      state: 'monitoring',
+      tasks: this.backgroundTaskDetails()
+    }
+  }
+
+  get stoppableTaskIds(): string[] {
+    const ids: string[] = []
+    for (const [id, task] of this.tasks) {
+      if (task.backgrounded) {
+        ids.push(id)
+      }
+    }
+    return ids
+  }
+
+  observe(message: Record<string, unknown>, startsTurn = false): boolean {
+    if (startsTurn) {
+      this.foregroundTurnActive = true
+    }
+    if (message.type === 'result') {
+      this.foregroundTurnActive = false
+    } else if (message.type === 'system') {
+      if (!this.observeSystemFrame(message) && !startsTurn) {
+        return false
+      }
+    } else if (!startsTurn) {
+      return false
+    }
+    return this.refreshMonitoring()
+  }
+
+  clear(): boolean {
+    this.tasks.clear()
+    this.terminalTaskIds.clear()
+    this.aggregateRosterObserved = false
+    this.foregroundTurnActive = false
+    return this.refreshMonitoring()
+  }
+
+  private observeSystemFrame(message: Record<string, unknown>): boolean {
+    if (message.subtype === 'background_tasks_changed') {
+      this.replaceAggregateRoster(message.tasks)
+      return true
+    }
+    const id = taskId(message)
+    if (!id) {
+      return false
+    }
+    if (message.subtype === 'task_notification') {
+      this.finish(id)
+      return true
+    }
+    if (message.subtype === 'task_updated') {
+      const patch = record(message.patch)
+      if (!patch) {
+        return false
+      }
+      if (TERMINAL_TASK_STATES.has(String(patch.status))) {
+        this.finish(id)
+        return true
+      }
+      const existing = this.tasks.get(id)
+      if (
+        (patch.is_backgrounded === true || taskDescription(patch.description)) &&
+        (!this.aggregateRosterObserved || existing)
+      ) {
+        this.upsert(id, {
+          backgrounded: patch.is_backgrounded === true || existing?.backgrounded === true,
+          kind: existing?.kind ?? 'unknown',
+          description: taskDescription(patch.description) ?? existing?.description
+        })
+        return true
+      }
+      return false
+    }
+    if (message.subtype !== 'task_started' || this.terminalTaskIds.has(id)) {
+      return false
+    }
+    if (message.ambient === true || message.skip_transcript === true) {
+      this.finish(id)
+      return true
+    }
+    if (this.aggregateRosterObserved && !this.tasks.has(id)) {
+      return false
+    }
+    const kind = classifyClaudeBackgroundTaskKind(message.task_type)
+    this.upsert(id, {
+      backgrounded: message.is_backgrounded === true || kind === 'workflow' || kind === 'monitor',
+      kind,
+      description: taskDescription(message.description)
+    })
+    return true
+  }
+
+  private replaceAggregateRoster(value: unknown): void {
+    if (!Array.isArray(value)) {
+      return
+    }
+    this.aggregateRosterObserved = true
+    this.tasks.clear()
+    this.terminalTaskIds.clear()
+    for (const valueTask of value) {
+      if (this.tasks.size >= MAX_TRACKED_TASKS) {
+        break
+      }
+      const task = record(valueTask)
+      if (!task || task.ambient === true) {
+        continue
+      }
+      const id = taskId(task)
+      if (!id) {
+        continue
+      }
+      this.tasks.set(id, {
+        backgrounded: true,
+        kind: classifyClaudeBackgroundTaskKind(task.task_type),
+        description: taskDescription(task.description)
+      })
+    }
+  }
+
+  private upsert(id: string, task: TrackedTask): void {
+    const existing = this.tasks.get(id)
+    if (existing) {
+      this.tasks.set(id, {
+        backgrounded: existing.backgrounded || task.backgrounded,
+        kind: existing.kind === 'unknown' ? task.kind : existing.kind,
+        description: task.description ?? existing.description
+      })
+      return
+    }
+    if (this.tasks.size >= MAX_TRACKED_TASKS) {
+      let foregroundId: string | undefined
+      for (const [candidateId, candidate] of this.tasks) {
+        if (!candidate.backgrounded) {
+          foregroundId = candidateId
+          break
+        }
+      }
+      if (!foregroundId) {
+        return
+      }
+      this.tasks.delete(foregroundId)
+    }
+    this.tasks.set(id, task)
+  }
+
+  private finish(id: string): void {
+    this.tasks.delete(id)
+    this.terminalTaskIds.delete(id)
+    this.terminalTaskIds.add(id)
+    if (this.terminalTaskIds.size > MAX_TRACKED_TASKS) {
+      const oldest = this.terminalTaskIds.values().next()
+      if (!oldest.done) {
+        this.terminalTaskIds.delete(oldest.value)
+      }
+    }
+  }
+
+  private refreshMonitoring(): boolean {
+    const details = this.foregroundTurnActive ? [] : this.backgroundTaskDetails()
+    const next = details.length > 0
+    const fingerprint = next ? JSON.stringify(details) : ''
+    if (next === this.monitoring && fingerprint === this.publishedTasksFingerprint) {
+      return false
+    }
+    this.monitoring = next
+    this.publishedTasksFingerprint = fingerprint
+    return true
+  }
+
+  private backgroundTaskDetails(): AgentSessionBackgroundTask[] {
+    const details: AgentSessionBackgroundTask[] = []
+    for (const [id, task] of this.tasks) {
+      if (!task.backgrounded) {
+        continue
+      }
+      details.push({
+        id,
+        kind: task.kind,
+        ...(task.description ? { description: task.description } : {})
+      })
+    }
+    return details
+  }
+}
diff --git a/src/main/claude/claude-child-exit-proof-ladder.ts b/src/main/claude/claude-child-exit-proof-ladder.ts
new file mode 100644
index 00000000000..85ed629f1b9
--- /dev/null
+++ b/src/main/claude/claude-child-exit-proof-ladder.ts
@@ -0,0 +1,41 @@
+import type { SpawnedProcess } from '../../shared/child-process/run-process'
+import { waitForProcessExitUntil } from '../codex/codex-process-exit-deadline'
+import type { ClaudeChildTreeReaper } from './claude-agent-sdk-exit-proof'
+
+const GRACEFUL_EXIT_MS = 1_500
+const FORCED_EXIT_MS = 1_000
+
+export type ClaudeChildExitProofInput = {
+  child: Pick<SpawnedProcess, 'pid' | 'kill' | 'stdin'>
+  exitPromise: Promise<void>
+  exited: () => boolean
+  tree?: ClaudeChildTreeReaper
+}
+
+export async function proveClaudeChildExitWithReaper(
+  input: ClaudeChildExitProofInput,
+  createTree: () => ClaudeChildTreeReaper
+): Promise<boolean> {
+  const tree = input.tree ?? createTree()
+  // Arm before stdin closes: only a live root can identify its descendants.
+  await tree.capture()
+  try {
+    input.child.stdin?.end()
+  } catch {
+    // The reap below still owns the process.
+  }
+  let reaped = false
+  if (!input.exited()) {
+    await waitForProcessExitUntil(input.exitPromise, GRACEFUL_EXIT_MS)
+    if (!input.exited()) {
+      reaped = true
+      await tree.refresh?.()
+      await tree.reap()
+      await waitForProcessExitUntil(input.exitPromise, FORCED_EXIT_MS)
+    }
+  }
+  if (!reaped && input.exited() && tree.treeVerdict !== 'exited') {
+    await tree.reap()
+  }
+  return input.exited() && tree.treeVerdict === 'exited'
+}
diff --git a/src/main/claude/claude-child-process-environment.test.ts b/src/main/claude/claude-child-process-environment.test.ts
new file mode 100644
index 00000000000..8299fdcdd61
--- /dev/null
+++ b/src/main/claude/claude-child-process-environment.test.ts
@@ -0,0 +1,63 @@
+import { describe, expect, it } from 'vitest'
+import { applyClaudeEnvPatch } from '../claude-accounts/environment'
+import { buildClaudeChildProcessEnv } from './claude-child-process-environment'
+
+describe('Claude child process environment', () => {
+  it('strips case-insensitive auth headers through the shared env patch on Windows', () => {
+    expect(
+      applyClaudeEnvPatch(
+        {
+          anthropic_api_key: 'inherited-key',
+          Anthropic_Custom_Headers: 'Authorization: inherited',
+          SAFE_VALUE: 'preserved'
+        },
+        {},
+        { stripAuthEnv: true, platform: 'win32' }
+      )
+    ).toEqual({ SAFE_VALUE: 'preserved' })
+  })
+
+  it('strips case-insensitive inherited auth and session stamps on Windows', () => {
+    const env = buildClaudeChildProcessEnv(
+      {
+        ANTHROPIC_AUTH_TOKEN: 'configured-token',
+        Claude_Code_Session_Id: 'configured-session'
+      },
+      {
+        platform: 'win32',
+        inheritedEnv: {
+          anthropic_api_key: 'inherited-key',
+          Anthropic_Custom_Headers: 'Authorization: inherited',
+          claude_code_child_session: '1',
+          CLAUDE_CODE_SESSION_ID: 'inherited-session',
+          SAFE_VALUE: 'preserved'
+        }
+      }
+    )
+
+    expect(env).toEqual({
+      ANTHROPIC_AUTH_TOKEN: 'configured-token',
+      Claude_Code_Session_Id: 'configured-session',
+      SAFE_VALUE: 'preserved'
+    })
+  })
+
+  it('can strip child-session stamps reintroduced by a full SDK launch overlay', () => {
+    expect(
+      buildClaudeChildProcessEnv(
+        {
+          CLAUDE_CODE_CHILD_SESSION: 'configured-child-session',
+          CLAUDE_CODE_SESSION_ID: 'configured-session',
+          CLAUDE_CODE_BRIDGE_SESSION_ID: 'configured-bridge-session'
+        },
+        {
+          scrubConfiguredChildSessionStamps: true,
+          inheritedEnv: {
+            CLAUDE_CODE_CHILD_SESSION: 'inherited-child-session',
+            SAFE_VALUE: 'preserved'
+          }
+        }
+      )
+    ).toEqual({ SAFE_VALUE: 'preserved' })
+  })
+})
diff --git a/src/main/claude/claude-child-process-environment.ts b/src/main/claude/claude-child-process-environment.ts
new file mode 100644
index 00000000000..58f00c5c1b8
--- /dev/null
+++ b/src/main/claude/claude-child-process-environment.ts
@@ -0,0 +1,69 @@
+import { CLAUDE_AUTH_ENV_VARS, applyClaudeEnvPatch } from '../claude-accounts/environment'
+
+const CLAUDE_CHILD_SESSION_STAMP_ENV_KEYS = [
+  'CLAUDE_CODE_CHILD_SESSION',
+  'CLAUDE_CODE_SESSION_ID',
+  'CLAUDE_CODE_BRIDGE_SESSION_ID'
+] as const
+
+function cloneProcessEnv(source: NodeJS.ProcessEnv): Record<string, string> {
+  const env: Record<string, string> = {}
+  for (const [key, value] of Object.entries(source)) {
+    if (value !== undefined) {
+      env[key] = value
+    }
+  }
+  return env
+}
+
+function stripClaudeChildSessionStamps(
+  env: Record<string, string>,
+  platform: NodeJS.Platform
+): Record<string, string> {
+  for (const key of CLAUDE_CHILD_SESSION_STAMP_ENV_KEYS) {
+    for (const envKey of Object.keys(env)) {
+      if (envKey === key || (platform === 'win32' && envKey.toUpperCase() === key)) {
+        delete env[envKey]
+      }
+    }
+  }
+  return env
+}
+
+export function buildClaudeChildProcessEnv(
+  configuredEnv: Record<string, string> = {},
+  options: {
+    inheritedEnv?: NodeJS.ProcessEnv
+    platform?: NodeJS.Platform
+    scrubConfiguredChildSessionStamps?: boolean
+  } = {}
+): Record<string, string> {
+  const inheritedEnv = options.inheritedEnv ?? process.env
+  const platform = options.platform ?? process.platform
+  const env = applyClaudeEnvPatch(
+    cloneProcessEnv(inheritedEnv),
+    {},
+    {
+      stripAuthEnv: true,
+      platform
+    }
+  )
+  if (platform === 'win32') {
+    const authKeys = new Set(CLAUDE_AUTH_ENV_VARS.map((key) => key.toUpperCase()))
+    for (const [key, value] of Object.entries(env)) {
+      const normalized = key.toUpperCase()
+      if (
+        authKeys.has(normalized) ||
+        (normalized === 'ANTHROPIC_CUSTOM_HEADERS' &&
+          /authorization|x-api-key|api-key|bearer/i.test(value))
+      ) {
+        delete env[key]
+      }
+    }
+  }
+  if (options.scrubConfiguredChildSessionStamps) {
+    return stripClaudeChildSessionStamps({ ...env, ...configuredEnv }, platform)
+  }
+  stripClaudeChildSessionStamps(env, platform)
+  return { ...env, ...configuredEnv }
+}
diff --git a/src/main/claude/claude-child-root-termination.ts b/src/main/claude/claude-child-root-termination.ts
new file mode 100644
index 00000000000..bed422532e1
--- /dev/null
+++ b/src/main/claude/claude-child-root-termination.ts
@@ -0,0 +1,54 @@
+import type { SpawnedProcess } from '../../shared/child-process/run-process'
+import type { PosixProcessIdentity } from '../pty-descendant-termination'
+import type {
+  WindowsDescendantSnapshot,
+  WindowsProcessIdentity
+} from '../windows-descendant-exit-verification'
+
+export type ClaudeRootIdentity = PosixProcessIdentity | WindowsProcessIdentity
+
+type RootTerminationInput = {
+  child: Pick<SpawnedProcess, 'kill'>
+  exited: () => boolean
+}
+
+/**
+ * Kills the root through the handle Node owns rather than through its pid, which
+ * is why no identity probe gates it: libuv drops that handle in the same turn it
+ * reaps, so the signal either reaches the process Orca spawned or reaches
+ * nothing. A probe here could only let an unreadable process table cost the tree
+ * the one fallback that still works once every table read has failed.
+ *
+ * False means no signal was sent, because the root had already left.
+ */
+export function terminateClaudeRoot(input: RootTerminationInput): boolean {
+  return input.exited() ? false : input.child.kill('SIGKILL')
+}
+
+type WindowsRootTerminationInput = {
+  snapshot: WindowsDescendantSnapshot | null
+  exited: () => boolean
+  verifyRoot: (root: WindowsProcessIdentity) => Promise<boolean>
+  terminateTree: (root: WindowsProcessIdentity) => Promise<void>
+  killRoot: () => boolean
+}
+
+/**
+ * `taskkill /T /F` addresses a bare pid, so a dead root's pid may already belong
+ * to a stranger whose whole tree it would take down: that one is identity-gated.
+ * The direct root kill after it runs however the probe decided.
+ */
+export async function terminateClaudeWindowsRoot(
+  input: WindowsRootTerminationInput
+): Promise<{ rootVerified: boolean }> {
+  const { snapshot, exited, verifyRoot, terminateTree, killRoot } = input
+  let rootVerified = false
+  if (!exited() && snapshot) {
+    rootVerified = await verifyRoot(snapshot.root).catch(() => false)
+    if (rootVerified && !exited()) {
+      await terminateTree(snapshot.root).catch(() => {})
+    }
+  }
+  killRoot()
+  return { rootVerified }
+}
diff --git a/src/main/claude/claude-child-tree-snapshot.ts b/src/main/claude/claude-child-tree-snapshot.ts
new file mode 100644
index 00000000000..e0955648b02
--- /dev/null
+++ b/src/main/claude/claude-child-tree-snapshot.ts
@@ -0,0 +1,128 @@
+import type { DescendantSnapshot } from '../pty-descendant-termination'
+import type { WindowsDescendantSnapshot } from '../windows-descendant-exit-verification'
+
+/** One platform's descendant tree, tagged so neither verifier can be handed the other's rows. */
+export type ClaudeCapturedTree =
+  | { platform: 'posix'; tree: DescendantSnapshot }
+  | { platform: 'win32'; tree: WindowsDescendantSnapshot }
+
+/**
+ * Process-table reads are not atomic: a refresh can omit a still-live row, but
+ * it can also observe a new process after the old row exited. Retain rows absent
+ * from the refresh, but reject a PID whose identity changed between reads.
+ */
+function mergeRowsByPid<Row extends { pid: number }>(
+  previous: readonly Row[],
+  next: readonly Row[],
+  sameIdentity: (previous: Row, next: Row) => boolean,
+  previousBoundary: (row: Row) => number,
+  nextBoundary: (row: Row) => number,
+  refreshBoundary: number
+): { rows: Row[]; capturedAtMsByPid?: Readonly<Record<string, number>> } | null {
+  const merged = new Map<number, Row>()
+  const capturedAtMsByPid: Record<string, number> = {}
+  for (const row of previous) {
+    const prior = merged.get(row.pid)
+    if (prior && !sameIdentity(prior, row)) {
+      return null
+    }
+    merged.set(row.pid, row)
+    capturedAtMsByPid[String(row.pid)] = previousBoundary(row)
+  }
+  for (const row of next) {
+    const prior = merged.get(row.pid)
+    if (prior && !sameIdentity(prior, row)) {
+      return null
+    }
+    if (!prior) {
+      capturedAtMsByPid[String(row.pid)] = nextBoundary(row)
+    }
+    merged.set(row.pid, row)
+  }
+  const boundaries = Object.values(capturedAtMsByPid)
+  const needsBoundaryMap =
+    new Set(boundaries).size > 1 || boundaries.some((boundary) => boundary !== refreshBoundary)
+  return {
+    rows: [...merged.values()],
+    ...(needsBoundaryMap ? { capturedAtMsByPid } : {})
+  }
+}
+
+export function mergeClaudeCapturedTrees(
+  previous: ClaudeCapturedTree,
+  next: ClaudeCapturedTree
+): ClaudeCapturedTree | null {
+  if (previous.platform !== next.platform) {
+    return null
+  }
+  if (previous.platform === 'posix' && next.platform === 'posix') {
+    if (previous.tree.rootPgid !== next.tree.rootPgid) {
+      return null
+    }
+    // A refresh cannot repair an earlier capture that lacked root identity;
+    // retaining those rows would permit a later numeric-pid kill without proof.
+    if (!previous.tree.root || !next.tree.root) {
+      return null
+    }
+    if (
+      previous.tree.root.pid !== next.tree.root.pid ||
+      previous.tree.root.startedAt !== next.tree.root.startedAt
+    ) {
+      return null
+    }
+    const descendants = mergeRowsByPid(
+      previous.tree.descendants,
+      next.tree.descendants,
+      (left, right) => left.pgid === right.pgid && left.startedAt === right.startedAt,
+      (row) => previous.tree.capturedAtMsByPid?.[String(row.pid)] ?? previous.tree.capturedAtMs,
+      (row) => next.tree.capturedAtMsByPid?.[String(row.pid)] ?? next.tree.capturedAtMs,
+      next.tree.capturedAtMs
+    )
+    if (!descendants) {
+      return null
+    }
+    return {
+      platform: 'posix',
+      tree: {
+        ...next.tree,
+        // Retained rows keep their earlier boundary; new rows use the refresh
+        // boundary. The scalar remains the latest scan for legacy consumers.
+        descendants: descendants.rows,
+        ...(descendants.capturedAtMsByPid
+          ? { capturedAtMsByPid: descendants.capturedAtMsByPid }
+          : {})
+      }
+    }
+  }
+  if (previous.platform === 'win32' && next.platform === 'win32') {
+    if (
+      previous.tree.root.pid !== next.tree.root.pid ||
+      previous.tree.root.creationTimeMs !== next.tree.root.creationTimeMs
+    ) {
+      return null
+    }
+    const descendants = mergeRowsByPid(
+      previous.tree.descendants,
+      next.tree.descendants,
+      (left, right) => left.creationTimeMs === right.creationTimeMs,
+      (row) => previous.tree.capturedAtMsByPid?.[String(row.pid)] ?? previous.tree.capturedAtMs,
+      (row) => next.tree.capturedAtMsByPid?.[String(row.pid)] ?? next.tree.capturedAtMs,
+      next.tree.capturedAtMs
+    )
+    if (!descendants) {
+      return null
+    }
+    return {
+      platform: 'win32',
+      tree: {
+        ...next.tree,
+        descendants: descendants.rows,
+        ...(descendants.capturedAtMsByPid
+          ? { capturedAtMsByPid: descendants.capturedAtMsByPid }
+          : {}),
+        unidentifiedCount: Math.max(previous.tree.unidentifiedCount, next.tree.unidentifiedCount)
+      }
+    }
+  }
+  return null
+}
diff --git a/src/main/claude/claude-command-lifecycle-frames.test.ts b/src/main/claude/claude-command-lifecycle-frames.test.ts
new file mode 100644
index 00000000000..8126a546ed8
--- /dev/null
+++ b/src/main/claude/claude-command-lifecycle-frames.test.ts
@@ -0,0 +1,115 @@
+import { describe, expect, it, vi } from 'vitest'
+import type {
+  AgentJournalItemBody,
+  AgentJournalItemIdentity
+} from '../../shared/agent-session-journal-types'
+import type { StructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
+import { createClaudeJournalTranslator } from './claude-structured-journal-translation'
+
+function sinkState() {
+  const items: { identity: AgentJournalItemIdentity; body: AgentJournalItemBody }[] = []
+  const sink: StructuredAgentSessionEventSink = {
+    appendItem: (identity, body) => items.push({ identity, body }),
+    appendTombstone: () => {},
+    publish: vi.fn()
+  }
+  return { sink, items }
+}
+
+function providerFrameKinds(items: { body: AgentJournalItemBody }[]): string[] {
+  return items.flatMap((item) =>
+    item.body.kind === 'status' && item.body.providerFrame ? [item.body.providerFrame.kind] : []
+  )
+}
+
+/**
+ * The queue-bookkeeping frame Claude Code 2.1.258 emits for every uuid-stamped
+ * command: `command_uuid` plus a state, and no content of its own. Shape and
+ * states taken from the CLI's own emission sites.
+ */
+function commandLifecycle(state: 'started' | 'completed' | 'cancelled', uuid: string) {
+  return {
+    type: 'message' as const,
+    sessionId: 'orca-session',
+    message: {
+      type: 'command_lifecycle',
+      command_uuid: 'command-1',
+      state,
+      uuid,
+      session_id: 'claude-session'
+    }
+  }
+}
+
+function userTurn(uuid: string, text: string) {
+  return {
+    type: 'message' as const,
+    sessionId: 'orca-session',
+    startsTurn: true as const,
+    message: {
+      type: 'user',
+      uuid,
+      session_id: 'claude-session',
+      parent_tool_use_id: null,
+      isReplay: true,
+      message: { role: 'user', content: text }
+    }
+  }
+}
+
+function assistantReply(uuid: string, text: string) {
+  return {
+    type: 'message' as const,
+    sessionId: 'orca-session',
+    message: {
+      type: 'assistant',
+      uuid,
+      session_id: 'claude-session',
+      parent_tool_use_id: null,
+      message: { role: 'assistant', content: [{ type: 'text', text }] }
+    }
+  }
+}
+
+describe('Claude command_lifecycle frames', () => {
+  it('keeps queue bookkeeping off the transcript for a whole turn', () => {
+    const state = sinkState()
+    const translator = createClaudeJournalTranslator({ sink: state.sink })
+
+    translator.handle(userTurn('user-1', 'Reply with exactly PROBE_OK and nothing else.'))
+    translator.handle(commandLifecycle('started', 'lifecycle-1'))
+    translator.handle(assistantReply('assistant-1', 'PROBE_OK'))
+    translator.handle(commandLifecycle('completed', 'lifecycle-2'))
+    translator.handle(commandLifecycle('completed', 'lifecycle-3'))
+    translator.handle({
+      type: 'message',
+      sessionId: 'orca-session',
+      message: {
+        type: 'result',
+        subtype: 'success',
+        uuid: 'result-1',
+        session_id: 'claude-session',
+        is_error: false,
+        result: 'PROBE_OK',
+        terminal_reason: 'completed'
+      }
+    })
+
+    expect(providerFrameKinds(state.items)).toEqual([])
+    // The turn's real content is untouched.
+    expect(
+      state.items.flatMap((item) =>
+        item.body.kind === 'message' && item.body.role === 'assistant' ? [item.body.blocks] : []
+      )
+    ).toEqual([[{ type: 'text', text: 'PROBE_OK' }]])
+  })
+
+  it('keeps a cancelled command off the transcript too', () => {
+    const state = sinkState()
+    const translator = createClaudeJournalTranslator({ sink: state.sink })
+
+    translator.handle(commandLifecycle('cancelled', 'lifecycle-4'))
+
+    expect(providerFrameKinds(state.items)).toEqual([])
+  })
+})
diff --git a/src/main/claude/claude-config-dir-pin.test.ts b/src/main/claude/claude-config-dir-pin.test.ts
new file mode 100644
index 00000000000..c7be40a6f38
--- /dev/null
+++ b/src/main/claude/claude-config-dir-pin.test.ts
@@ -0,0 +1,34 @@
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { claudeConfigDirEnvPatch, defaultClaudeConfigDir } from './claude-config-dir-pin'
+
+describe('claude config dir pin', () => {
+  it('does not pin the CLI default home, so the macOS Keychain stays reachable', () => {
+    expect(claudeConfigDirEnvPatch(join(homedir(), '.claude'), { env: {} })).toEqual({})
+    expect(claudeConfigDirEnvPatch(`${join(homedir(), '.claude')}/`, { env: {} })).toEqual({})
+    expect(claudeConfigDirEnvPatch('  ', { env: {} })).toEqual({})
+  })
+
+  it('pins a managed account home the CLI would not find on its own', () => {
+    expect(claudeConfigDirEnvPatch('/accounts/claude/managed', { env: {} })).toEqual({
+      CLAUDE_CONFIG_DIR: '/accounts/claude/managed'
+    })
+  })
+
+  it('treats an inherited CLAUDE_CONFIG_DIR as the default the CLI already resolves', () => {
+    const env = { CLAUDE_CONFIG_DIR: '/inherited/home' }
+    expect(defaultClaudeConfigDir(env)).toBe('/inherited/home')
+    expect(claudeConfigDirEnvPatch('/inherited/home', { env })).toEqual({})
+    expect(claudeConfigDirEnvPatch('/other/home', { env })).toEqual({
+      CLAUDE_CONFIG_DIR: '/other/home'
+    })
+  })
+
+  it('compares Windows homes case-insensitively', () => {
+    const env = { CLAUDE_CONFIG_DIR: 'C:\\Users\\Work\\.claude' }
+    expect(claudeConfigDirEnvPatch('c:\\users\\work\\.claude', { env, platform: 'win32' })).toEqual(
+      {}
+    )
+  })
+})
diff --git a/src/main/claude/claude-config-dir-pin.ts b/src/main/claude/claude-config-dir-pin.ts
new file mode 100644
index 00000000000..d5cc0b8b186
--- /dev/null
+++ b/src/main/claude/claude-config-dir-pin.ts
@@ -0,0 +1,37 @@
+import { homedir } from 'node:os'
+import { join, resolve } from 'node:path'
+
+/** The config dir the Claude CLI resolves for itself when nothing pins one. */
+export function defaultClaudeConfigDir(env: NodeJS.ProcessEnv = process.env): string {
+  return env.CLAUDE_CONFIG_DIR?.trim() || join(homedir(), '.claude')
+}
+
+function samePath(a: string, b: string, platform: NodeJS.Platform): boolean {
+  const left = resolve(a)
+  const right = resolve(b)
+  return platform === 'win32' ? left.toLowerCase() === right.toLowerCase() : left === right
+}
+
+/**
+ * An explicit CLAUDE_CONFIG_DIR moves the Claude CLI off the default Keychain item onto
+ * one derived from the pinned path, so a claude.ai OAuth login stops working even when
+ * the pin names the CLI's own default. Pin only a home the CLI would not find on its
+ * own — the same rule the legacy PTY path applies via `ClaudeRuntimePathResolver`.
+ *
+ * The pinned value is the account home verbatim: the CLI keys its credential lookup on
+ * the literal string, so re-spelling an equivalent path (absolute vs `~`, trailing
+ * separator) selects a different identity. Normalization here is for the equality test
+ * only and must never reach the env.
+ */
+export function claudeConfigDirEnvPatch(
+  accountHome: string,
+  options: { env?: NodeJS.ProcessEnv; platform?: NodeJS.Platform } = {}
+): { CLAUDE_CONFIG_DIR?: string } {
+  const env = options.env ?? process.env
+  const platform = options.platform ?? process.platform
+  const resolved = accountHome.trim()
+  if (!resolved || samePath(resolved, defaultClaudeConfigDir(env), platform)) {
+    return {}
+  }
+  return { CLAUDE_CONFIG_DIR: resolved }
+}
diff --git a/src/main/claude/claude-descendant-escalation-boundary.test.ts b/src/main/claude/claude-descendant-escalation-boundary.test.ts
new file mode 100644
index 00000000000..55459df0c7f
--- /dev/null
+++ b/src/main/claude/claude-descendant-escalation-boundary.test.ts
@@ -0,0 +1,124 @@
+import { describe, expect, it, vi } from 'vitest'
+import { terminateDescendantSnapshotWithVerdict } from '../pty-descendant-exit-verification'
+import {
+  collectDescendantRows,
+  type DescendantSnapshot,
+  type ProcessTableRow
+} from '../pty-descendant-termination'
+import { createClaudeChildTreeReaper } from './claude-agent-sdk-exit-proof'
+
+const ROOT_PID = 500
+const ORCA_PGID = 400
+const ROOT_STARTED_AT = 'Thu Sep 3 18:04:50 2026'
+/** The second both close-time walks land in. */
+const WALK_SECOND = 'Thu Sep 3 18:05:04 2026'
+const WALK_MS = Date.parse(WALK_SECOND)
+const EARLIER_SECOND = 'Thu Sep 3 18:05:03 2026'
+
+/** The measured split: `s20` at :03.946 died, `s21` at :04.042 leaked. */
+const EARLIER_BORN = [700, 701, 702]
+const WALK_SECOND_BORN = [721, 722, 723, 724]
+
+type Cohort = { pids: number[]; startedAt: string }
+
+const LIVE_TREE: Cohort[] = [
+  { pids: EARLIER_BORN, startedAt: EARLIER_SECOND },
+  { pids: WALK_SECOND_BORN, startedAt: WALK_SECOND }
+]
+
+function rowsFor(cohorts: Cohort[]): ProcessTableRow[] {
+  return [
+    { pid: ROOT_PID, ppid: 1, pgid: ORCA_PGID, startedAt: ROOT_STARTED_AT },
+    ...cohorts.flatMap((cohort) =>
+      cohort.pids.map((pid) => ({
+        pid,
+        ppid: ROOT_PID,
+        pgid: ORCA_PGID,
+        startedAt: cohort.startedAt
+      }))
+    )
+  ]
+}
+
+/** A real ppid walk from the root, exactly as production captures one. */
+function walk(capturedAtMs: number, cohorts: Cohort[] = LIVE_TREE): DescendantSnapshot {
+  return collectDescendantRows(ROOT_PID, rowsFor(cohorts), capturedAtMs)
+}
+
+function killedPids(calls: [number, NodeJS.Signals][]): number[] {
+  return calls.flatMap(([pid, signal]) => (signal === 'SIGKILL' ? [pid] : [])).sort((a, b) => a - b)
+}
+
+function signalledPids(calls: [number, NodeJS.Signals][]): number[] {
+  return calls.flatMap(([pid, signal]) => (signal === 'SIGTERM' ? [pid] : [])).sort((a, b) => a - b)
+}
+
+/**
+ * Drives the real reaper and the real verifier against a process table where
+ * every descendant traps SIGTERM, so only a forced sweep can end them. The root
+ * is alive for both walks and gone by the sweep, which is the measured teardown.
+ */
+async function sweep(
+  captures: DescendantSnapshot[],
+  liveTree: Cohort[] = LIVE_TREE
+): Promise<[number, NodeJS.Signals][]> {
+  const calls: [number, NodeJS.Signals][] = []
+  const captureDescendants = vi.fn()
+  for (const capture of captures) {
+    captureDescendants.mockResolvedValueOnce(capture)
+  }
+  const tree = createClaudeChildTreeReaper(
+    { pid: ROOT_PID, kill: vi.fn(() => true) },
+    {
+      platform: 'linux',
+      exited: () => false,
+      captureDescendants,
+      terminateDescendants: (snapshot) =>
+        terminateDescendantSnapshotWithVerdict(snapshot, {
+          requireIdentityBeforeSignal: true,
+          graceMs: 0,
+          verifyMs: 120,
+          sendSignal: (pid, signal) => calls.push([pid, signal]),
+          readTable: async () => ({ rows: rowsFor(liveTree), capturedAtMs: Date.now() })
+        })
+    }
+  )
+  // The close ladder's shape: arm, then re-walk the live root at the boundary.
+  await tree.capture()
+  await tree.refresh?.()
+  await tree.reap()
+  return calls
+}
+
+describe('Claude descendant forced-sweep fence', () => {
+  it('escalates a descendant forked in the same second as both close walks', async () => {
+    // Both walks land inside second :04, one ps duration apart, and the root is
+    // gone before a third could run. A descendant born at :04.042 is no less
+    // ours than its sibling born 96ms earlier at :03.946.
+    const calls = await sweep([walk(WALK_MS + 42), walk(WALK_MS + 140)])
+
+    expect(signalledPids(calls)).toEqual([...EARLIER_BORN, ...WALK_SECOND_BORN])
+    expect(killedPids(calls)).toEqual([...EARLIER_BORN, ...WALK_SECOND_BORN])
+  })
+
+  it('still escalates descendants born before the walk that first saw them', async () => {
+    const onlyEarlier = [{ pids: EARLIER_BORN, startedAt: EARLIER_SECOND }]
+    const calls = await sweep([walk(WALK_MS + 42, onlyEarlier)], onlyEarlier)
+
+    expect(killedPids(calls)).toEqual(EARLIER_BORN)
+  })
+
+  it('withholds the sweep from a row no walk re-derived, on its start second alone', async () => {
+    // 900 was seen once, in its own birth second, and the refresh did not find
+    // it. The merge retains the row, but nothing re-proved it belongs to us, so
+    // the second-resolution fence is all there is and it still says no.
+    const retained = { pids: [900], startedAt: WALK_SECOND }
+    const firstWalk = walk(WALK_MS + 42, [...LIVE_TREE, retained])
+    const refresh = walk(WALK_MS + 140)
+
+    const calls = await sweep([firstWalk, refresh], [...LIVE_TREE, retained])
+
+    expect(signalledPids(calls)).toEqual([...EARLIER_BORN, ...WALK_SECOND_BORN, 900])
+    expect(killedPids(calls)).toEqual([...EARLIER_BORN, ...WALK_SECOND_BORN])
+  })
+})
diff --git a/src/main/claude/claude-stream-json-connection-close.test.ts b/src/main/claude/claude-stream-json-connection-close.test.ts
new file mode 100644
index 00000000000..e824139a776
--- /dev/null
+++ b/src/main/claude/claude-stream-json-connection-close.test.ts
@@ -0,0 +1,126 @@
+import { EventEmitter } from 'node:events'
+import { PassThrough } from 'node:stream'
+import type { ChildProcessWithoutNullStreams } from 'node:child_process'
+import { describe, expect, it, vi } from 'vitest'
+import type { query } from '@anthropic-ai/claude-agent-sdk'
+import {
+  openClaudeStreamJsonConnection,
+  type ClaudeStreamJsonLaunch
+} from './claude-stream-json-connection'
+
+const mocks = vi.hoisted(() => {
+  const refresh = vi.fn()
+  const proveClaudeChildExit = vi.fn()
+  const tree = {
+    capture: vi.fn(async () => {}),
+    refresh: (...args: unknown[]) => refresh(...args),
+    reap: vi.fn(async () => 'exited' as const),
+    treeVerdict: 'unverifiable' as const
+  }
+  return { proveClaudeChildExit, refresh, tree }
+})
+
+vi.mock('./claude-agent-sdk-exit-proof', () => ({
+  createClaudeChildTreeReaper: vi.fn(() => mocks.tree),
+  proveClaudeChildExit: (...args: unknown[]) => mocks.proveClaudeChildExit(...args)
+}))
+
+function fakeChild(): ChildProcessWithoutNullStreams {
+  const child = new EventEmitter()
+  return Object.assign(child, {
+    pid: 424242,
+    stdin: new PassThrough(),
+    stdout: new PassThrough(),
+    stderr: new PassThrough(),
+    kill: vi.fn()
+  }) as unknown as ChildProcessWithoutNullStreams
+}
+
+describe('Claude stream-json close ordering', () => {
+  it('waits for the live tree refresh before ending stdin', async () => {
+    const refreshDone = Promise.withResolvers<void>()
+    mocks.refresh.mockReturnValueOnce(refreshDone.promise)
+    mocks.proveClaudeChildExit.mockResolvedValueOnce(true)
+    const child = fakeChild()
+    const launch: ClaudeStreamJsonLaunch = {
+      pathToClaudeCodeExecutable: 'claude',
+      options: {},
+      cwd: '/work/repo'
+    }
+    const queryImpl = ((params: Parameters<typeof query>[0]) => {
+      if (!params.options) {
+        throw new Error('missing SDK options')
+      }
+      params.options.spawnClaudeCodeProcess?.({
+        command: 'claude',
+        args: [],
+        env: {},
+        signal: new AbortController().signal
+      })
+      void (async () => {
+        for await (const _message of params.prompt) {
+          // The SDK owns the transport write; the close test only needs its EOF boundary.
+        }
+        child.stdin.end()
+      })()
+      return (async function* () {})()
+    }) as typeof query
+    const connection = await openClaudeStreamJsonConnection(launch, {}, () => child, queryImpl)
+
+    const closing = connection.close()
+    await new Promise((resolve) => setImmediate(resolve))
+    expect(child.stdin.writableEnded).toBe(false)
+
+    refreshDone.resolve()
+    await expect(closing).resolves.toBe(true)
+    expect(child.stdin.writableEnded).toBe(true)
+  })
+
+  it('requests a fresh close boundary after an output capture starts', async () => {
+    mocks.refresh.mockReset()
+    mocks.proveClaudeChildExit.mockReset()
+    const outputCapture = Promise.withResolvers<void>()
+    const closeCapture = Promise.withResolvers<void>()
+    mocks.refresh
+      .mockReturnValueOnce(outputCapture.promise)
+      .mockReturnValueOnce(closeCapture.promise)
+    mocks.proveClaudeChildExit.mockResolvedValueOnce(true)
+    const child = fakeChild()
+    const launch: ClaudeStreamJsonLaunch = {
+      pathToClaudeCodeExecutable: 'claude',
+      options: {},
+      cwd: '/work/repo'
+    }
+    const queryImpl = ((params: Parameters<typeof query>[0]) => {
+      params.options?.spawnClaudeCodeProcess?.({
+        command: 'claude',
+        args: [],
+        env: {},
+        signal: new AbortController().signal
+      })
+      void (async () => {
+        for await (const _message of params.prompt) {
+          // The SDK owns the transport write; the close test only needs its EOF boundary.
+        }
+        child.stdin.end()
+      })()
+      return (async function* () {})()
+    }) as typeof query
+    const connection = await openClaudeStreamJsonConnection(launch, {}, () => child, queryImpl)
+
+    child.stderr.emit('data', 'output')
+    await vi.waitFor(() => expect(mocks.refresh).toHaveBeenCalledTimes(1))
+    const closing = connection.close()
+    await Promise.resolve()
+
+    expect(mocks.refresh).toHaveBeenCalledTimes(2)
+    expect(child.stdin.writableEnded).toBe(false)
+
+    outputCapture.resolve()
+    await Promise.resolve()
+    expect(child.stdin.writableEnded).toBe(false)
+    closeCapture.resolve()
+    await expect(closing).resolves.toBe(true)
+    expect(child.stdin.writableEnded).toBe(true)
+  })
+})
diff --git a/src/main/claude/claude-stream-json-connection.test.ts b/src/main/claude/claude-stream-json-connection.test.ts
new file mode 100644
index 00000000000..eb69a66a897
--- /dev/null
+++ b/src/main/claude/claude-stream-json-connection.test.ts
@@ -0,0 +1,769 @@
+import { execFileSync } from 'node:child_process'
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { spawnProcess, type SpawnedProcess } from '../../shared/child-process/run-process'
+import { hasLiveClaudePtys } from '../claude-accounts/live-pty-gate'
+import type { ProcessSpec } from '../../shared/child-process/process-spec'
+import { query, type CanUseTool, type Options } from '@anthropic-ai/claude-agent-sdk'
+import {
+  openClaudeStreamJsonConnection,
+  type ClaudeStreamJsonConnection,
+  type ClaudeStreamJsonLaunch
+} from './claude-stream-json-connection'
+import { openAgentSessionJournal } from '../native-chat/agent-session-journal/journal-store-factory'
+import { createDeferredStructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
+import { claudeAuthDiagnostic } from './claude-structured-init-proof'
+import { createClaudeJournalTranslator } from './claude-structured-journal-translation'
+import { readClaudeStructuredSessionOptions } from './claude-structured-session-options'
+import type { ClaudeSession } from './claude-structured-session-state'
+import { CLAUDE_STRUCTURED_BASE_OPTIONS } from './claude-structured-launch-resolution'
+
+// These drive the real SDK against the scripted fake CLI, so every assertion is
+// about the environment, argv and frames a real child actually saw.
+const FAKE_CLI = join(__dirname, '__fixtures__', 'claude-agent-sdk-scripted-cli.mjs')
+const SESSION_ID = '5348c19f-6a54-4c2e-9c68-9c2b1a3d4e5f'
+const HOLD_OPEN = { delayMs: 10_000 }
+
+type ScriptedCliReport = {
+  argv: string[]
+  controlRequests: { request_id: string; request: { subtype: string } }[]
+  controlResponses: { response: { request_id: string; response?: unknown } }[]
+  userMessages: Record<string, unknown>[]
+  descendantPid: number | null
+}
+
+const scratchDirs: string[] = []
+const openConnections: ClaudeStreamJsonConnection[] = []
+
+afterEach(async () => {
+  for (const connection of openConnections.splice(0)) {
+    await connection.close()
+  }
+  for (const dir of scratchDirs.splice(0)) {
+    rmSync(dir, { recursive: true, force: true })
+  }
+  spawned.splice(0)
+  spawnedChildren.splice(0)
+  vi.unstubAllEnvs()
+})
+
+function scriptScenario(
+  steps: Record<string, unknown>[],
+  controlResponses: Record<string, unknown> = {}
+) {
+  const dir = mkdtempSync(join(tmpdir(), 'claude-sdk-connection-'))
+  scratchDirs.push(dir)
+  const scenarioPath = join(dir, 'scenario.json')
+  const reportPath = join(dir, 'report.json')
+  writeFileSync(scenarioPath, JSON.stringify({ steps, controlResponses }))
+  return {
+    cwd: dir,
+    env: {
+      PATH: process.env.PATH ?? '',
+      ORCA_SDK_CONTRACT_SCENARIO_PATH: scenarioPath,
+      ORCA_SDK_CONTRACT_REPORT_PATH: reportPath
+    },
+    readReport: () => JSON.parse(readFileSync(reportPath, 'utf8')) as ScriptedCliReport
+  }
+}
+
+function launchFor(
+  scenario: { cwd: string; env: Record<string, string> },
+  env: Record<string, string> = {}
+): ClaudeStreamJsonLaunch {
+  return {
+    pathToClaudeCodeExecutable: FAKE_CLI,
+    options: { ...CLAUDE_STRUCTURED_BASE_OPTIONS, sessionId: SESSION_ID },
+    cwd: scenario.cwd,
+    env: { ...scenario.env, ...env }
+  }
+}
+
+/** The derived child environment, captured where Orca actually hands it to the OS. */
+const spawned: ProcessSpec[] = []
+/** The retained child, so a test can end it the way a crashing CLI would. */
+const spawnedChildren: SpawnedProcess[] = []
+
+async function open(
+  launch: ClaudeStreamJsonLaunch,
+  handlers: Parameters<typeof openClaudeStreamJsonConnection>[1] = {},
+  queryImpl?: typeof query
+): Promise<ClaudeStreamJsonConnection> {
+  const connection = await openClaudeStreamJsonConnection(
+    launch,
+    handlers,
+    (spec) => {
+      spawned.push(spec)
+      const child = spawnProcess(spec)
+      spawnedChildren.push(child)
+      return child
+    },
+    queryImpl
+  )
+  openConnections.push(connection)
+  return connection
+}
+
+function childEnv(): Record<string, string | undefined> {
+  return (spawned.at(-1)?.env ?? {}) as Record<string, string | undefined>
+}
+
+async function until<T>(read: () => T | null | undefined, label: string): Promise<T> {
+  for (let attempt = 0; attempt < 400; attempt++) {
+    const value = read()
+    if (value !== null && value !== undefined) {
+      return value
+    }
+    await new Promise((resolve) => setTimeout(resolve, 25))
+  }
+  throw new Error(`timed out waiting for ${label}`)
+}
+
+function readReportSafely(scenario: { readReport: () => ScriptedCliReport }) {
+  try {
+    return scenario.readReport()
+  } catch {
+    return null
+  }
+}
+
+function processState(pid: number): 'running' | 'exited' {
+  try {
+    const state = execFileSync('ps', ['-o', 'state=', '-p', String(pid)], {
+      encoding: 'utf8',
+      env: { ...process.env, LANG: 'C', LC_ALL: 'C' }
+    }).trim()
+    return state.startsWith('Z') ? 'exited' : 'running'
+  } catch (error) {
+    if ((error as { status?: number }).status === 1) {
+      return 'exited'
+    }
+    throw error
+  }
+}
+
+describe('Claude stream-json connection', () => {
+  it('passes the Claude Code system-prompt preset through to SDK query', async () => {
+    const scenario = scriptScenario([HOLD_OPEN])
+    let captured: Options | undefined
+    await open(launchFor(scenario), {}, (params) => {
+      captured = params.options
+      return query(params)
+    })
+
+    expect(captured?.systemPrompt).toEqual({ type: 'preset', preset: 'claude_code' })
+  })
+
+  it('hands the child a derived environment, the resolved CLI path, and keeps the pid', async () => {
+    vi.stubEnv('ANTHROPIC_API_KEY', 'sk-ant-SHELL-LEAK')
+    vi.stubEnv('CLAUDE_CODE_CHILD_SESSION', '1')
+    vi.stubEnv('NODE_OPTIONS', '--require=/tmp/inject.js')
+    // An inherited value wins over the SDK's default, so clear it to pin the default.
+    vi.stubEnv('CLAUDE_CODE_ENTRYPOINT', undefined)
+    vi.stubEnv('ORCA_CONNECTION_MARKER', 'inherited')
+    const scenario = scriptScenario([HOLD_OPEN])
+    const connection = await open(
+      launchFor(scenario, {
+        CLAUDE_CONFIG_DIR: '/accounts/managed/home',
+        ANTHROPIC_AUTH_TOKEN: 'configured-token',
+        ORCA_AGENT_SESSION_SPAWN_TOKEN: 'spawn-9',
+        CLAUDE_CODE_CHILD_SESSION: 'configured-child-session',
+        CLAUDE_CODE_SESSION_ID: 'configured-session',
+        CLAUDE_CODE_BRIDGE_SESSION_ID: 'configured-bridge-session'
+      })
+    )
+
+    // Ownership proof: the pid is a real live process, not a value the SDK reported.
+    expect(connection.pid).toEqual(expect.any(Number))
+    expect(() => process.kill(connection.pid as number, 0)).not.toThrow()
+    const env = childEnv()
+    // The managed home is pinned verbatim: the CLI keys credential lookup on the literal string.
+    expect(env.CLAUDE_CONFIG_DIR).toBe('/accounts/managed/home')
+    expect(env.ANTHROPIC_AUTH_TOKEN).toBe('configured-token')
+    expect(env.ORCA_AGENT_SESSION_SPAWN_TOKEN).toBe('spawn-9')
+    expect(env.ORCA_CONNECTION_MARKER).toBe('inherited')
+    expect(env.ANTHROPIC_API_KEY).toBeUndefined()
+    expect(env.CLAUDE_CODE_CHILD_SESSION).toBeUndefined()
+    expect(env.CLAUDE_CODE_SESSION_ID).toBeUndefined()
+    expect(env.CLAUDE_CODE_BRIDGE_SESSION_ID).toBeUndefined()
+    // Two SDK mutations of the child env, pinned so a bump cannot change them unseen.
+    expect(env.CLAUDE_CODE_ENTRYPOINT).toBe('sdk-ts')
+    expect(env.NODE_OPTIONS).toBeUndefined()
+    // The bundled binary is excluded from the install, so the resolved path is mandatory.
+    const report = await until(() => readReportSafely(scenario), 'the scripted CLI report')
+    expect(report.argv[0]).toBe(FAKE_CLI)
+    // The .mjs fixture makes the SDK run it under node; a real CLI path is the program
+    // itself. Either way the resolved path is what Orca's spawner is asked to execute.
+    expect([spawned.at(-1)?.program, ...(spawned.at(-1)?.args ?? [])]).toContain(FAKE_CLI)
+    expect(report.argv).toContain('--replay-user-messages')
+    expect(report.argv).toContain(`--session-id=${SESSION_ID}`)
+  })
+
+  it('leaves the default CLI home unpinned so macOS Keychain OAuth keeps working', async () => {
+    const scenario = scriptScenario([HOLD_OPEN])
+    await open(launchFor(scenario))
+
+    await until(() => readReportSafely(scenario), 'the scripted CLI report')
+    expect(childEnv().CLAUDE_CONFIG_DIR).toBeUndefined()
+  })
+
+  it('settles a send only once the frame reached the child, and replays reach onMessage', async () => {
+    const replay = {
+      type: 'user',
+      message: { role: 'user', content: [{ type: 'text', text: 'hello' }] },
+      parent_tool_use_id: null,
+      isReplay: true,
+      session_id: SESSION_ID,
+      uuid: 'uuid-replay-1'
+    }
+    const scenario = scriptScenario([{ awaitUserMessage: true }, { emit: replay }, HOLD_OPEN])
+    const messages: Record<string, unknown>[] = []
+    const connection = await open(launchFor(scenario), {
+      onMessage: (message) => messages.push(message)
+    })
+
+    await connection.send({
+      type: 'user',
+      message: { role: 'user', content: [{ type: 'text', text: 'hello' }] },
+      parent_tool_use_id: null,
+      session_id: SESSION_ID
+    })
+    // The report exists from the child's first line of work, so poll for the frame
+    // itself: `send` settles on the SDK's completed write, and the child still has
+    // to read that line before it can record it.
+    const report = await until(
+      () => (readReportSafely(scenario)?.userMessages.length ? readReportSafely(scenario) : null),
+      'the user frame recorded by the child'
+    )
+    expect(report.userMessages).toHaveLength(1)
+
+    await until(() => messages.find((message) => message.uuid === 'uuid-replay-1'), 'the replay')
+    // The replay is delivered verbatim, so the dispatch acknowledgement still binds on it.
+    expect(messages.find((message) => message.uuid === 'uuid-replay-1')).toEqual(replay)
+  })
+
+  it('rejects a send the SDK pulled but could not write to a terminated child', async () => {
+    const scenario = scriptScenario([{ awaitUserMessage: true }, HOLD_OPEN])
+    const connection = await open(launchFor(scenario))
+    const child = spawnedChildren.at(-1)
+
+    // Same tick as the send, so the liveness guard still passes and the frame
+    // reaches the SDK's input pump: its `transport.write` is what fails, which is
+    // the window a child crashing mid-send actually opens.
+    child?.kill('SIGKILL')
+    const sent = connection.send({
+      type: 'user',
+      message: { role: 'user', content: [{ type: 'text', text: 'hello' }] },
+      parent_tool_use_id: null,
+      session_id: SESSION_ID
+    })
+
+    await expect(sent).rejects.toThrow()
+    expect(readReportSafely(scenario)?.userMessages ?? []).toHaveLength(0)
+  })
+
+  it('delivers an unmodeled frame verbatim so the provider-fallback row survives', async () => {
+    const unknown = {
+      type: 'frame_kind_from_the_future',
+      session_id: SESSION_ID,
+      uuid: 'uuid-unknown-1',
+      payload: { nested: { flags: ['a', 'b'] } }
+    }
+    const scenario = scriptScenario([{ emit: unknown }, HOLD_OPEN])
+    const messages: Record<string, unknown>[] = []
+    await open(launchFor(scenario), { onMessage: (message) => messages.push(message) })
+
+    await until(() => messages.find((message) => message.uuid === 'uuid-unknown-1'), 'the frame')
+    expect(messages.find((message) => message.uuid === 'uuid-unknown-1')).toEqual(unknown)
+  })
+
+  it('commits the real partial-message cadence as one assistant item through the translator', async () => {
+    // The frame order and per-frame uuids are the ones Claude Code 2.1.258 emits
+    // under --include-partial-messages: every stream_event and the block's final
+    // assistant frame each carry their own uuid; only message.id ties them.
+    const stream = (uuid: string, event: Record<string, unknown>) => ({
+      type: 'stream_event',
+      uuid,
+      session_id: SESSION_ID,
+      parent_tool_use_id: null,
+      event
+    })
+    const frames = [
+      stream('uuid-message-start', {
+        type: 'message_start',
+        message: { id: 'msg_01', role: 'assistant', content: [] }
+      }),
+      stream('uuid-block-start', {
+        type: 'content_block_start',
+        index: 0,
+        content_block: { type: 'text', text: '' }
+      }),
+      stream('uuid-delta-1', {
+        type: 'content_block_delta',
+        index: 0,
+        delta: { type: 'text_delta', text: 'ST' }
+      }),
+      stream('uuid-delta-2', {
+        type: 'content_block_delta',
+        index: 0,
+        delta: { type: 'text_delta', text: 'REAMOK_ELEC_64E632' }
+      }),
+      {
+        type: 'assistant',
+        uuid: 'uuid-assistant-final',
+        session_id: SESSION_ID,
+        parent_tool_use_id: null,
+        message: {
+          id: 'msg_01',
+          role: 'assistant',
+          content: [{ type: 'text', text: 'STREAMOK_ELEC_64E632' }],
+          stop_reason: null
+        }
+      },
+      stream('uuid-block-stop', { type: 'content_block_stop', index: 0 }),
+      stream('uuid-message-delta', { type: 'message_delta', delta: { stop_reason: 'end_turn' } }),
+      stream('uuid-message-stop', { type: 'message_stop' }),
+      {
+        type: 'result',
+        subtype: 'success',
+        is_error: false,
+        duration_ms: 1,
+        duration_api_ms: 1,
+        num_turns: 1,
+        result: 'STREAMOK_ELEC_64E632',
+        stop_reason: 'end_turn',
+        session_id: SESSION_ID,
+        uuid: 'uuid-result'
+      }
+    ]
+    const scenario = scriptScenario([...frames.map((frame) => ({ emit: frame })), HOLD_OPEN])
+    const journal = await openAgentSessionJournal({
+      identity: {
+        sessionId: 'session-1',
+        workspaceId: 'workspace-1',
+        hostId: 'host-1',
+        agent: 'claude',
+        providerHandle: { kind: 'claude', sessionId: SESSION_ID, leafUuid: 'leaf-1' }
+      },
+      journalDir: join(scenario.cwd, 'journal'),
+      now: () => 1_700_000_000_000,
+      mintEpoch: () => 'epoch-1'
+    })
+    const deferred = createDeferredStructuredAgentSessionEventSink()
+    deferred.bind({ journal, fence: 1, publish: vi.fn() })
+    const translator = createClaudeJournalTranslator({ sink: deferred.sink })
+    let settled = false
+    await open(launchFor(scenario), {
+      onMessage: (message) => {
+        translator.handle({ type: 'message', sessionId: 'session-1', message })
+        settled ||= message.type === 'result'
+      }
+    })
+
+    await until(() => (settled ? true : null), 'the result frame')
+    await deferred.drained()
+    const items = journal.snapshot().items
+    const assistant = items.filter(
+      (item) => item.body.kind === 'message' && item.body.role === 'assistant'
+    )
+    expect(assistant.map((item) => item.body)).toEqual([
+      {
+        kind: 'message',
+        role: 'assistant',
+        blocks: [{ type: 'text', text: 'STREAMOK_ELEC_64E632' }]
+      }
+    ])
+    expect(assistant.map((item) => item.itemId)).toEqual([`claude:${SESSION_ID}:uuid-block-start`])
+    expect(
+      items.flatMap((item) =>
+        item.body.kind === 'status' && item.body.providerFrame ? [item.body.providerFrame.kind] : []
+      )
+    ).toEqual([])
+    // The journal owns a SQLite connection now; afterEach removes this temp root and an open
+    // handle blocks that on Windows.
+    await journal.close()
+  })
+
+  it('feeds an inbound permission request to canUseTool and writes its answer back on the same id', async () => {
+    const scenario = scriptScenario([
+      {
+        emit: {
+          type: 'control_request',
+          request_id: 'perm-421',
+          request: {
+            subtype: 'can_use_tool',
+            tool_name: 'Bash',
+            input: { command: 'ls' },
+            tool_use_id: 'toolu_1',
+            permission_suggestions: [{ type: 'addRules' }]
+          }
+        }
+      },
+      { awaitControlResponse: 'perm-421' },
+      HOLD_OPEN
+    ])
+    const seen: { toolName: string; requestId: string; toolUseID: string; suggestions: unknown }[] =
+      []
+    const canUseTool: CanUseTool = (toolName, _input, options) => {
+      seen.push({
+        toolName,
+        requestId: options.requestId,
+        toolUseID: options.toolUseID,
+        suggestions: options.suggestions
+      })
+      return Promise.resolve({ behavior: 'deny', message: 'No', toolUseID: options.toolUseID })
+    }
+    await open(launchFor(scenario), { canUseTool })
+
+    await until(() => (seen.length > 0 ? seen : null), 'the inbound permission request')
+    expect(seen).toEqual([
+      {
+        toolName: 'Bash',
+        requestId: 'perm-421',
+        toolUseID: 'toolu_1',
+        suggestions: [{ type: 'addRules' }]
+      }
+    ])
+    const written = await until(
+      () =>
+        readReportSafely(scenario)?.controlResponses.find(
+          (frame) => frame.response.request_id === 'perm-421'
+        ),
+      'the permission answer'
+    )
+    expect(written.response.response).toMatchObject({ behavior: 'deny', message: 'No' })
+  })
+
+  it('drives Orca control methods onto the SDK and times out with the init proof message', async () => {
+    const scenario = scriptScenario([HOLD_OPEN], {
+      initialize: { models: [{ value: 'sonnet' }], account: { tokenSource: 'oauth' } },
+      get_settings: { env: { ANTHROPIC_BASE_URL: 'https://settings.example.test' } }
+    })
+    const connection = await open(launchFor(scenario))
+
+    await expect(connection.initializationResult()).resolves.toMatchObject({
+      models: [{ value: 'sonnet' }]
+    })
+    await expect(connection.getSettings()).resolves.toEqual({
+      env: { ANTHROPIC_BASE_URL: 'https://settings.example.test' }
+    })
+    await expect(connection.setModel('opus')).resolves.toBeUndefined()
+    const requests = await until(
+      () =>
+        readReportSafely(scenario)?.controlRequests.find(
+          (frame) => frame.request.subtype === 'set_model'
+        ),
+      'the set_model control request'
+    )
+    expect(requests.request.subtype).toBe('set_model')
+  })
+
+  it('reads supportedModels from the catalog the running CLI reported', async () => {
+    const scenario = scriptScenario([HOLD_OPEN], {
+      initialize: {
+        models: [
+          { value: 'default', resolvedModel: 'claude-opus-5' },
+          {
+            value: 'opus',
+            displayName: 'Opus 5',
+            description: 'The live row, not the seed',
+            resolvedModel: 'claude-opus-5',
+            supportsEffort: true,
+            supportedEffortLevels: ['low', 'high']
+          }
+        ]
+      }
+    })
+    const connection = await open(launchFor(scenario))
+
+    await expect(connection.supportedModels()).resolves.toMatchObject([
+      { value: 'default', resolvedModel: 'claude-opus-5' },
+      { value: 'opus', displayName: 'Opus 5', supportedEffortLevels: ['low', 'high'] }
+    ])
+  })
+
+  it('serves the picker the live catalog rather than falling back to the static seed', async () => {
+    const scenario = scriptScenario([HOLD_OPEN], {
+      initialize: {
+        models: [
+          { value: 'default', resolvedModel: 'claude-opus-5' },
+          {
+            value: 'opus',
+            displayName: 'Opus 5',
+            description: 'The live row, not the seed',
+            resolvedModel: 'claude-opus-5',
+            supportsEffort: true,
+            supportedEffortLevels: ['low', 'high']
+          }
+        ]
+      }
+    })
+    const connection = await open(launchFor(scenario))
+    const session = {
+      connection,
+      options: new Map<string, string>(),
+      reportedOptions: {}
+    } as unknown as ClaudeSession
+
+    const options = await readClaudeStructuredSessionOptions(session, 5_000)
+
+    // The seed carries neither this description nor a two-level effort list, so
+    // both can only have come from the child.
+    expect(options.models).toContainEqual({
+      id: 'opus',
+      label: 'Opus 5',
+      description: 'The live row, not the seed',
+      isDefault: true,
+      efforts: [
+        { value: 'low', label: 'Low' },
+        { value: 'high', label: 'High' }
+      ]
+    })
+    expect(options.current.model).toBe('opus')
+  })
+
+  it('feeds the auth diagnostic from the settings the running child reports', async () => {
+    for (const key of ['ANTHROPIC_BASE_URL', 'ANTHROPIC_AUTH_TOKEN', 'ANTHROPIC_API_KEY']) {
+      vi.stubEnv(key, undefined)
+    }
+    const scenario = scriptScenario([HOLD_OPEN], {
+      get_settings: {
+        env: {
+          ANTHROPIC_BASE_URL: 'https://settings.example.test',
+          ANTHROPIC_AUTH_TOKEN: 'secret'
+        }
+      }
+    })
+    const connection = await open(launchFor(scenario))
+    const init = { providerSessionId: SESSION_ID, uuid: null, model: null, message: {} }
+
+    // With no ambient auth, every true below can only have come from the CLI's settings.
+    expect(claudeAuthDiagnostic(init, null)).toMatchObject({
+      baseUrlConfigured: false,
+      authTokenConfigured: false
+    })
+    const diagnostic = claudeAuthDiagnostic(init, await connection.getSettings())
+    expect(diagnostic).toMatchObject({
+      baseUrlConfigured: true,
+      authTokenConfigured: true,
+      apiKeyConfigured: false
+    })
+    expect(JSON.stringify(diagnostic)).not.toContain('secret')
+  })
+
+  it('reports an unauthenticated start through the init deadline instead of hanging', async () => {
+    // The scripted CLI never answers, which is the shape of a silently unauthenticated CLI.
+    const scenario = scriptScenario([HOLD_OPEN])
+    const connection = await open({
+      ...launchFor(scenario),
+      env: { ...launchFor(scenario).env, ORCA_SDK_CONTRACT_IGNORE_CONTROL_REQUESTS: '1' }
+    })
+
+    await expect(connection.initializationResult({ timeoutMs: 200 })).rejects.toThrow(
+      'claude initialize request timed out'
+    )
+  })
+
+  it('reports a self-exit with its status, stderr, and observed tree verdict', async () => {
+    const scenario = scriptScenario([{ stderr: 'claude: not signed in\n' }, { exit: 1 }])
+    let exit: Error | null = null
+    const connection = await open(launchFor(scenario), {
+      onExit: (error) => {
+        exit = error
+      }
+    })
+
+    await until(() => exit, 'the exit error')
+    // The status and stderr are the only diagnostic a refused start leaves behind.
+    expect((exit as unknown as Error).message).toMatch(/exited \(code 1\): claude: not signed in/)
+    expect(connection.closed).toBe(true)
+    // Stderr-triggered capture can win or lose the race with this real child's exit.
+    const closed = await connection.close()
+    expect(connection.exitVerdict.root).toBe('exited')
+    expect(['exited', 'unverifiable']).toContain(connection.exitVerdict.tree)
+    expect(closed).toBe(connection.exitVerdict.tree === 'exited')
+  })
+
+  it.runIf(process.platform !== 'win32')(
+    'proves a natural SDK exit and cleans up its descendant before recovery',
+    async () => {
+      const scenario = scriptScenario([
+        { stderr: 'claude: natural exit\n' },
+        { delayMs: 500 },
+        { exit: 1 }
+      ])
+      let exit: Error | null = null
+      const connection = await open(
+        {
+          ...launchFor(scenario),
+          env: { ...launchFor(scenario).env, ORCA_SDK_CONTRACT_DESCENDANT: '1' }
+        },
+        { onExit: (error) => (exit = error) }
+      )
+      const report = await until(() => {
+        const current = readReportSafely(scenario)
+        return current?.descendantPid ? current : null
+      }, 'the descendant report')
+      await until(() => exit, 'the natural exit error')
+      try {
+        await expect(connection.close()).resolves.toBe(true)
+        expect(connection.exitVerdict).toEqual({ root: 'exited', tree: 'exited' })
+        expect(processState(report.descendantPid as number)).toBe('exited')
+      } finally {
+        try {
+          process.kill(report.descendantPid as number, 'SIGKILL')
+        } catch {
+          // Already gone.
+        }
+      }
+    },
+    20_000
+  )
+
+  it('settles a spawn error followed by close as processless and closes idempotently', async () => {
+    const scenario = scriptScenario([HOLD_OPEN])
+    const missingCli = join(scenario.cwd, 'claude-that-does-not-exist')
+    let fault: Error | null = null
+    let exit: Error | null = null
+    const connection = await open(
+      { ...launchFor(scenario), pathToClaudeCodeExecutable: missingCli },
+      {
+        onFault: (error) => {
+          fault = error
+        },
+        onExit: (error) => {
+          exit = error
+        }
+      }
+    )
+
+    await until(
+      () => (connection.exitVerdict.root === 'processless' ? connection.exitVerdict : null),
+      'the processless spawn settlement'
+    )
+    expect(connection.pid).toBeUndefined()
+    expect(fault).toBeInstanceOf(Error)
+    expect(exit).toBeNull()
+    await expect(Promise.all([connection.close(), connection.close()])).resolves.toEqual([
+      true,
+      true
+    ])
+    await expect(connection.close()).resolves.toBe(true)
+    expect(connection.exitVerdict).toEqual({ root: 'processless', tree: 'exited' })
+  })
+
+  it('does not treat a child error event as first-hand root exit proof', async () => {
+    const scenario = scriptScenario([HOLD_OPEN])
+    let exit: Error | null = null
+    const connection = await open(launchFor(scenario), {
+      onExit: (error) => {
+        exit = error
+      }
+    })
+    const child = spawnedChildren.at(-1)
+    expect(child).toBeDefined()
+
+    child?.emit('error', new Error('child transport fault'))
+
+    expect(exit).toBeNull()
+    expect(connection.exitVerdict.root).toBe('live')
+    await until(() => exit, 'the distinct child exit')
+    expect(connection.exitVerdict.root).toBe('exited')
+  })
+
+  it('proves the exit of a child that ignores a graceful shutdown', async () => {
+    const scenario = scriptScenario([HOLD_OPEN])
+    const connection = await open({
+      ...launchFor(scenario),
+      env: { ...launchFor(scenario).env, ORCA_SDK_CONTRACT_IGNORE_SIGTERM: '1' }
+    })
+
+    // Keep the lstart capture boundary outside the child's displayed start second.
+    await new Promise((resolve) => setTimeout(resolve, 1_100))
+    await expect(connection.close()).resolves.toBe(true)
+  }, 20_000)
+})
+
+// A structured Claude child owns the account's credentials while it runs, exactly as
+// a Claude PTY does. The gate is what makes runtime-auth-sync defer the managed OAuth
+// refresh instead of rotating the single-use token out from under a live session, and
+// structured sessions used to be invisible to it.
+describe('the managed-auth live gate', () => {
+  it('holds while a structured child runs and releases when it ends', async () => {
+    // The gate is a process-wide singleton and a sibling test's release lands on its
+    // child's 'close' event, which can settle after that test's close() resolved.
+    await until(() => (hasLiveClaudePtys() ? null : true), 'a drained auth gate')
+    const scenario = scriptScenario([
+      { emit: { type: 'system', subtype: 'init', session_id: SESSION_ID, uuid: 'init-1' } },
+      { wait: HOLD_OPEN }
+    ])
+    const connection = await open(launchFor(scenario))
+
+    expect(hasLiveClaudePtys()).toBe(true)
+
+    await connection.close()
+
+    await until(() => (hasLiveClaudePtys() ? null : true), 'the auth gate to drain')
+    expect(hasLiveClaudePtys()).toBe(false)
+  }, 30_000)
+
+  it('releases when the child dies on its own rather than through close()', async () => {
+    await until(() => (hasLiveClaudePtys() ? null : true), 'a drained auth gate')
+    const scenario = scriptScenario([
+      { emit: { type: 'system', subtype: 'init', session_id: SESSION_ID, uuid: 'init-1' } },
+      { wait: HOLD_OPEN }
+    ])
+    await open(launchFor(scenario))
+    expect(hasLiveClaudePtys()).toBe(true)
+
+    spawnedChildren.at(-1)?.kill('SIGKILL')
+
+    await until(() => (hasLiveClaudePtys() ? null : true), 'the auth gate to drain')
+    expect(hasLiveClaudePtys()).toBe(false)
+  }, 30_000)
+
+  // The gate entry is deliberately unpersisted, so confirmSeededClaudeLivePtys can never
+  // reconcile a stray one: a leak here defers the managed OAuth refresh for the life of
+  // the process. Entering the gate only after the release handlers are attached makes
+  // that unreachable regardless of what the setup in between does.
+  it('leaks no gate entry when setup throws between spawn and handler attachment', async () => {
+    await until(() => (hasLiveClaudePtys() ? null : true), 'a drained auth gate')
+    const scenario = scriptScenario([
+      { emit: { type: 'system', subtype: 'init', session_id: SESSION_ID, uuid: 'init-1' } },
+      { wait: HOLD_OPEN }
+    ])
+    let started: SpawnedProcess | null = null
+
+    try {
+      await expect(
+        openClaudeStreamJsonConnection(launchFor(scenario), {}, (spec) => {
+          const child = spawnProcess(spec)
+          started = child
+          const attach = child.stderr.on.bind(child.stderr)
+          // Measured attach order: the SDK binds stderr 'data' from inside query(),
+          // before the child is even assigned. The SECOND bind is this connection's own
+          // armTreeOnOutput — the first statement that runs after the child exists and
+          // before its 'exit'/'close' release handlers. Throwing on the first is
+          // vacuous: it escapes before any gate entry could have happened.
+          let dataAttaches = 0
+          child.stderr.on = ((event: string, listener: (...args: unknown[]) => void) => {
+            if (event === 'data') {
+              dataAttaches += 1
+              if (dataAttaches === 2) {
+                throw new Error('stderr listener attach failed')
+              }
+            }
+            return attach(event, listener)
+          }) as typeof child.stderr.on
+          return child
+        })
+      ).rejects.toThrow('stderr listener attach failed')
+
+      expect(hasLiveClaudePtys()).toBe(false)
+    } finally {
+      ;(started as SpawnedProcess | null)?.kill('SIGKILL')
+    }
+  }, 30_000)
+})
diff --git a/src/main/claude/claude-stream-json-connection.ts b/src/main/claude/claude-stream-json-connection.ts
new file mode 100644
index 00000000000..dd6bbc8a5eb
--- /dev/null
+++ b/src/main/claude/claude-stream-json-connection.ts
@@ -0,0 +1,283 @@
+import { randomUUID } from 'node:crypto'
+import type * as ClaudeAgentSdk from '@anthropic-ai/claude-agent-sdk'
+import type { CanUseTool, OnUserDialog, SDKUserMessage } from '@anthropic-ai/claude-agent-sdk'
+import { spawnProcess } from '../../shared/child-process/run-process'
+import {
+  markClaudeStructuredChildExited,
+  markClaudeStructuredChildSpawned
+} from '../claude-accounts/live-pty-gate'
+import { buildClaudeChildProcessEnv } from './claude-child-process-environment'
+import {
+  ClaudeControlRequestError,
+  createClaudeControlSurface,
+  type ClaudeControlSurface
+} from './claude-agent-sdk-control-requests'
+import { createClaudeChildTreeReaper, proveClaudeChildExit } from './claude-agent-sdk-exit-proof'
+import type { DescendantTreeVerdict } from '../pty-descendant-exit-verification'
+import { createClaudeCodeProcessSpawn } from './claude-agent-sdk-process-spawn'
+import { createClaudeUserMessageQueue } from './claude-agent-sdk-user-message-queue'
+import type { ClaudeStructuredSdkOptions } from './claude-structured-launch-resolution'
+
+export { ClaudeControlRequestError }
+
+/**
+ * The SDK is loaded at the structured-Claude boundary rather than by this module's
+ * import. The ordinary runtime's class graph statically reaches this file, and the
+ * SDK sets `process.env.NoDefaultCurrentDirectoryInExePath` at import time — a
+ * Windows executable-search change that a user who never leaves the terminal/TUI
+ * path never opted into, and a missing SDK would fail runtime startup. Memoized,
+ * so a session pays the import once per process rather than once per connection.
+ */
+let claudeAgentSdk: Promise<typeof ClaudeAgentSdk> | null = null
+
+function loadClaudeAgentSdk(): Promise<typeof ClaudeAgentSdk> {
+  claudeAgentSdk ??= import('@anthropic-ai/claude-agent-sdk')
+  return claudeAgentSdk
+}
+
+export type ClaudeStreamJsonLaunch = {
+  /** Orca's resolved user CLI; the SDK falls back to a bundled binary that is not installed. */
+  pathToClaudeCodeExecutable: string
+  options: ClaudeStructuredSdkOptions
+  cwd: string
+  env?: Record<string, string>
+}
+
+export type ClaudeStreamJsonConnectionHandlers = {
+  onMessage?: (message: Record<string, unknown>) => void
+  /**
+   * The SDK owns inbound permission control: it hands `can_use_tool` to this callback with
+   * a stable requestId and an abort signal, dedups duplicate delivery, and matches the
+   * response by request_id itself. Setting it makes the SDK pass `--permission-prompt-tool
+   * stdio` automatically; it must not be paired with `permissionPromptToolName`.
+   */
+  canUseTool?: CanUseTool
+  /** `request_user_dialog` control; the CLI only emits kinds declared in `supportedDialogKinds`. */
+  onUserDialog?: OnUserDialog
+  /** A transport/process fault that is not itself first-hand root exit proof. */
+  onFault?: (error: Error) => void
+  onExit?: (error: Error) => void
+}
+
+/**
+ * Two questions with their own evidence. The root's verdict is first-hand: Orca's
+ * own child handle reported exit, or reported error then close before it ever had
+ * a pid. The tree's comes from bounded descendant verification, and `unverifiable`
+ * is never collapsed into either neighbour.
+ */
+export type ClaudeChildExitVerdict = {
+  root: 'exited' | 'live' | 'processless'
+  tree: DescendantTreeVerdict
+}
+
+export type ClaudeStreamJsonConnection = ClaudeControlSurface & {
+  readonly pid: number | undefined
+  readonly closed: boolean
+  /** What the ladder has observed so far; read after a `close()` that returned false. */
+  readonly exitVerdict: ClaudeChildExitVerdict
+  send: (message: Record<string, unknown>) => Promise<void>
+  /** Resolves true after processless settlement, or root exit plus observed tree exit. */
+  close: () => Promise<boolean>
+}
+
+type ExitStatus = { code: number | null; signal: NodeJS.Signals | null }
+
+function exitError(stderrTail: string, status: ExitStatus | null, cause?: Error): Error {
+  const detail = stderrTail.trim()
+  // The status is the diagnostic a signed-out or refused start leaves behind;
+  // it has to survive every wrapper between here and the user.
+  const how =
+    status?.signal !== null && status?.signal !== undefined
+      ? ` (signal ${status.signal})`
+      : status?.code !== null && status?.code !== undefined
+        ? ` (code ${status.code})`
+        : ''
+  const message = `claude stream-json exited${how}${detail ? `: ${detail}` : ''}`
+  return cause ? new Error(message, { cause }) : new Error(message)
+}
+
+export async function openClaudeStreamJsonConnection(
+  launch: ClaudeStreamJsonLaunch,
+  handlers: ClaudeStreamJsonConnectionHandlers = {},
+  spawnImpl: typeof spawnProcess = spawnProcess,
+  queryImpl?: typeof ClaudeAgentSdk.query
+): Promise<ClaudeStreamJsonConnection> {
+  const { query } = await loadClaudeAgentSdk()
+  const spawner = createClaudeCodeProcessSpawn(spawnImpl)
+  const inbox = createClaudeUserMessageQueue()
+  const session = (queryImpl ?? query)({
+    prompt: inbox.messages,
+    options: {
+      ...launch.options,
+      cwd: launch.cwd,
+      // Why env is never omitted: the SDK inherits process.env when it is, which is
+      // exactly the ambient ANTHROPIC_* auth leak this lane already shipped once.
+      env: buildClaudeChildProcessEnv(launch.env, { scrubConfiguredChildSessionStamps: true }),
+      pathToClaudeCodeExecutable: launch.pathToClaudeCodeExecutable,
+      spawnClaudeCodeProcess: spawner.spawn,
+      ...(handlers.canUseTool ? { canUseTool: handlers.canUseTool } : {}),
+      ...(handlers.onUserDialog ? { onUserDialog: handlers.onUserDialog } : {})
+    }
+  })
+  const child = spawner.child
+  if (!child) {
+    throw new Error('the claude agent SDK returned without spawning a child')
+  }
+  // This child owns the account's credentials for as long as it runs, exactly as a
+  // Claude PTY does — hold the OAuth-refresh gate so a managed refresh cannot rotate
+  // the single-use token out from under it mid-turn. Entered below, once a release
+  // path exists.
+  const authGateKey = randomUUID()
+  const releaseAuthGate = (): void => markClaudeStructuredChildExited(authGateKey)
+  let exited = false
+  let exitStatus: ExitStatus | null = null
+  let closing = false
+  let processless = false
+  let prePidSpawnError = false
+  let terminalError: Error | null = null
+  let faultReported = false
+  let exitReported = false
+  let closePromise: Promise<boolean> | null = null
+  // One reaper per child: every close attempt and error-path reap shares its proof.
+  const rootSettled = (): boolean => exited || processless
+  const tree = createClaudeChildTreeReaper(child, { exited: rootSettled })
+
+  // Arm lazily on actual child output instead of issuing a process-table scan for
+  // every session at startup. A natural SDK exit can race a later close, while
+  // output-triggered observation still catches the usual live-child window.
+  let outputObservationArmed = false
+  const armTreeOnOutput = (): void => {
+    if (outputObservationArmed) {
+      return
+    }
+    outputObservationArmed = true
+    void (tree.refresh?.() ?? tree.capture())
+  }
+  child.stderr.on('data', armTreeOnOutput)
+  // The SDK may synchronously spawn the CLI and consume an early stderr chunk
+  // before this connection can attach its listener; the bounded tail preserves
+  // that observation for the same lazy arm.
+  if (spawner.stderrTail.length > 0) {
+    armTreeOnOutput()
+  }
+
+  let settleExit = (): void => {}
+  const exitPromise = new Promise<void>((resolve) => {
+    settleExit = resolve
+  })
+  const markExited = (): void => {
+    exited = true
+    releaseAuthGate()
+    settleExit()
+  }
+  child.on('exit', (code, signal) => {
+    exitStatus = { code, signal }
+    markExited()
+    handleUnexpectedEnd()
+  })
+
+  const handleUnexpectedEnd = (cause?: Error): void => {
+    terminalError ??= exitError(spawner.stderrTail, exitStatus, cause)
+    inbox.fail(terminalError)
+    if (!closing && !faultReported) {
+      faultReported = true
+      handlers.onFault?.(terminalError)
+    }
+    if (!closing && exited && !exitReported) {
+      exitReported = true
+      handlers.onExit?.(terminalError)
+    }
+  }
+
+  void (async () => {
+    for await (const message of session) {
+      handlers.onMessage?.(message as unknown as Record<string, unknown>)
+    }
+  })().catch((error: unknown) => {
+    // The SDK ends its generator in error when the child dies or the transport
+    // fails; a transport failure with a live child still has to reap the tree.
+    if (!closing && !exited) {
+      void tree.reap()
+    }
+    handleUnexpectedEnd(error instanceof Error ? error : new Error(String(error)))
+  })
+
+  child.on('error', (error) => {
+    if (spawner.pid === undefined) {
+      prePidSpawnError = true
+    }
+    if (!closing && !exited) {
+      void tree.reap()
+    }
+    handleUnexpectedEnd(error)
+  })
+  child.on('close', () => {
+    // Covers the spawn-failure path too, where no 'exit' ever arrives.
+    releaseAuthGate()
+    if (prePidSpawnError && spawner.pid === undefined) {
+      processless = true
+      settleExit()
+    }
+    handleUnexpectedEnd()
+  })
+  child.stdin.on('error', (error) => {
+    if (!closing) {
+      void tree.reap()
+      handleUnexpectedEnd(error)
+    }
+  })
+  // Why here and not at spawn: a structured gate entry is deliberately unpersisted, so
+  // confirmSeededClaudeLivePtys can never reconcile a stray one and a leak defers the
+  // managed OAuth refresh for the life of the process. Entering only after 'exit' and
+  // 'close' are attached makes that unreachable — any later throw still leaves a
+  // listener that releases. Nothing between spawn and here can yield, so the child
+  // cannot end before the gate is entered.
+  markClaudeStructuredChildSpawned(authGateKey)
+
+  const send = (message: Record<string, unknown>): Promise<void> => {
+    if (closing || exited || terminalError || child.stdin.destroyed || !child.stdin.writable) {
+      return Promise.reject(terminalError ?? new Error('claude stream-json connection is closed'))
+    }
+    return inbox.push(message as unknown as SDKUserMessage)
+  }
+
+  const close = (): Promise<boolean> => {
+    closePromise ??= (async () => {
+      closing = true
+      // Arm the descendant proof before ending stdin. The SDK may exit the root
+      // immediately; a post-exit walk cannot recover descendants that reparented.
+      await (tree.refresh?.() ?? tree.capture())
+      inbox.end()
+      const proven = await proveClaudeChildExit({
+        child,
+        exitPromise,
+        exited: rootSettled,
+        tree
+      })
+      inbox.fail(new Error('claude stream-json connection closed'))
+      if (!proven) {
+        closePromise = null
+      }
+      return proven
+    })()
+    return closePromise
+  }
+
+  return {
+    ...createClaudeControlSurface(session),
+    get pid() {
+      return spawner.pid
+    },
+    get closed() {
+      return closing || exited || terminalError !== null
+    },
+    get exitVerdict() {
+      return {
+        root: processless ? 'processless' : exited ? 'exited' : 'live',
+        tree: tree.treeVerdict
+      } as const
+    },
+    send,
+    close
+  }
+}
diff --git a/src/main/claude/claude-streamed-block-identity.ts b/src/main/claude/claude-streamed-block-identity.ts
new file mode 100644
index 00000000000..5cbf6674159
--- /dev/null
+++ b/src/main/claude/claude-streamed-block-identity.ts
@@ -0,0 +1,110 @@
+import type { AgentJournalItemIdentity } from '../../shared/agent-session-journal-types'
+import { claudeRecord, claudeText } from './claude-structured-item-translation'
+
+// Under --include-partial-messages every stream_event frame carries its own
+// uuid, and the block's final `assistant` frame carries yet another; only
+// `message.id` ties them together. The block's first stream frame mints the
+// journal identity, and the final frame lands on it in block order instead of
+// appending a duplicate under its own uuid.
+
+export type ClaudeStreamedTextDelta = { identity: AgentJournalItemIdentity; text: string }
+
+type StreamedMessage = {
+  messageId: string | null
+  blocks: Map<number, AgentJournalItemIdentity>
+  /** Streamed text blocks whose final assistant frame has not arrived, in block order. */
+  awaitingFinal: AgentJournalItemIdentity[]
+}
+
+export type ClaudeStreamedBlockRegistry = {
+  /** Text a stream_event frame appends to its block, or null when it carries none. */
+  observe: (frame: Record<string, unknown>) => ClaudeStreamedTextDelta | null
+  /** The streamed identity a final assistant frame reconciles onto, if its block streamed. */
+  reconcile: (frame: {
+    sessionId: string
+    parentToolUseId: string | null
+    messageId: string | null
+  }) => AgentJournalItemIdentity | null
+  clear: () => void
+}
+
+function scopeKey(sessionId: string, parentToolUseId: string | null): string {
+  return `${sessionId}/${parentToolUseId ?? ''}`
+}
+
+export function createClaudeStreamedBlockRegistry(): ClaudeStreamedBlockRegistry {
+  const messages = new Map<string, StreamedMessage>()
+
+  const messageFor = (scope: string): StreamedMessage => {
+    let streamed = messages.get(scope)
+    if (!streamed) {
+      streamed = { messageId: null, blocks: new Map(), awaitingFinal: [] }
+      messages.set(scope, streamed)
+    }
+    return streamed
+  }
+
+  const mint = (
+    streamed: StreamedMessage,
+    sessionId: string,
+    index: number,
+    uuid: string
+  ): AgentJournalItemIdentity => {
+    const identity: AgentJournalItemIdentity = { provider: 'claude', sessionId, uuid }
+    streamed.blocks.set(index, identity)
+    streamed.awaitingFinal.push(identity)
+    return identity
+  }
+
+  return {
+    observe: (frame) => {
+      const event = claudeRecord(frame.event)
+      const sessionId = claudeText(frame.session_id)
+      const uuid = claudeText(frame.uuid)
+      if (frame.type !== 'stream_event' || !event || !sessionId || !uuid) {
+        return null
+      }
+      const scope = scopeKey(sessionId, claudeText(frame.parent_tool_use_id))
+      if (event.type === 'message_start') {
+        messages.set(scope, {
+          messageId: claudeText(claudeRecord(event.message)?.id),
+          blocks: new Map(),
+          awaitingFinal: []
+        })
+        return null
+      }
+      const index = typeof event.index === 'number' ? event.index : 0
+      if (event.type === 'content_block_start') {
+        const block = claudeRecord(event.content_block)
+        if (block?.type !== 'text') {
+          return null
+        }
+        const identity = mint(messageFor(scope), sessionId, index, uuid)
+        const text = claudeText(block.text)
+        return text ? { identity, text } : null
+      }
+      if (event.type !== 'content_block_delta') {
+        return null
+      }
+      const delta = claudeRecord(event.delta)
+      const text = delta?.type === 'text_delta' ? claudeText(delta.text) : null
+      if (!text) {
+        return null
+      }
+      const streamed = messageFor(scope)
+      const identity = streamed.blocks.get(index) ?? mint(streamed, sessionId, index, uuid)
+      return { identity, text }
+    },
+    reconcile: (frame) => {
+      const streamed = messages.get(scopeKey(frame.sessionId, frame.parentToolUseId))
+      if (
+        !streamed ||
+        (frame.messageId && streamed.messageId && frame.messageId !== streamed.messageId)
+      ) {
+        return null
+      }
+      return streamed.awaitingFinal.shift() ?? null
+    },
+    clear: () => messages.clear()
+  }
+}
diff --git a/src/main/claude/claude-streamed-text-checkpoints.test.ts b/src/main/claude/claude-streamed-text-checkpoints.test.ts
new file mode 100644
index 00000000000..00a0bc0edd6
--- /dev/null
+++ b/src/main/claude/claude-streamed-text-checkpoints.test.ts
@@ -0,0 +1,93 @@
+import { describe, expect, it } from 'vitest'
+import type { AgentJournalItemIdentity } from '../../shared/agent-session-journal-types'
+import { createClaudeStreamedTextCheckpoints } from './claude-streamed-text-checkpoints'
+
+function identityOf(uuid: string): AgentJournalItemIdentity {
+  return { provider: 'claude', sessionId: 'claude-session', uuid }
+}
+
+function checkpoints() {
+  const rows: { uuid: string; text: string }[] = []
+  let scheduled: (() => void) | null = null
+  const store = createClaudeStreamedTextCheckpoints({
+    persist: (identity, text) => {
+      rows.push({ uuid: 'uuid' in identity ? identity.uuid : '', text })
+    },
+    schedule: (run) => {
+      scheduled = run
+      return () => {
+        scheduled = null
+      }
+    }
+  })
+  return {
+    store,
+    rows,
+    runWindow: () => {
+      const run = scheduled as (() => void) | null
+      run?.()
+    }
+  }
+}
+
+describe('claude streamed text checkpoints', () => {
+  it('rewrites a block row with the full text accumulated so far', () => {
+    const { store, rows, runWindow } = checkpoints()
+
+    store.append(identityOf('block-1'), 'hel')
+    store.append(identityOf('block-1'), 'lo')
+    runWindow()
+
+    expect(rows).toEqual([{ uuid: 'block-1', text: 'hello' }])
+    expect(store.pending).toBe(1)
+  })
+
+  it('drops every block still awaiting its final frame at settlement', () => {
+    const { store, rows, runWindow } = checkpoints()
+
+    store.append(identityOf('block-1'), 'partial answer')
+    runWindow()
+    store.settle()
+
+    expect(store.pending).toBe(0)
+    // The row written before settlement stays; nothing is rewritten afterwards.
+    store.flush()
+    expect(rows).toEqual([{ uuid: 'block-1', text: 'partial answer' }])
+  })
+
+  it('keeps a block whose final frame arrived out of the settlement sweep', () => {
+    const { store } = checkpoints()
+
+    store.append(identityOf('block-1'), 'one')
+    store.append(identityOf('block-2'), 'two')
+    store.forget('claude:claude-session:block-1')
+
+    expect(store.pending).toBe(1)
+    store.settle()
+    expect(store.pending).toBe(0)
+  })
+
+  it('flushes text the widening checkpoint interval has not written yet', () => {
+    const { store, rows } = checkpoints()
+
+    store.append(identityOf('block-1'), 'x')
+    store.flush()
+
+    expect(rows).toEqual([{ uuid: 'block-1', text: 'x' }])
+    // Already at the row's length: a second flush has nothing to write.
+    store.flush()
+    expect(rows).toHaveLength(1)
+  })
+
+  it('stops persisting once disposed', () => {
+    const { store, rows, runWindow } = checkpoints()
+
+    store.append(identityOf('block-1'), 'text')
+    store.dispose()
+    runWindow()
+    store.flush()
+
+    expect(rows).toEqual([])
+    expect(store.pending).toBe(0)
+  })
+})
diff --git a/src/main/claude/claude-streamed-text-checkpoints.ts b/src/main/claude/claude-streamed-text-checkpoints.ts
new file mode 100644
index 00000000000..348ecd99558
--- /dev/null
+++ b/src/main/claude/claude-streamed-text-checkpoints.ts
@@ -0,0 +1,105 @@
+import type { AgentJournalItemIdentity } from '../../shared/agent-session-journal-types'
+import { agentJournalItemKey } from '../../shared/agent-session-journal-item-key'
+import {
+  createAgentSessionDeltaCoalescer,
+  type AgentSessionDeltaCoalescerDeps
+} from '../native-chat/agent-session-wire/agent-session-delta-coalescer'
+
+export type ClaudeStreamedTextCheckpointDeps = {
+  /** Rewrites the block's journal row with the text accumulated so far. */
+  persist: (identity: AgentJournalItemIdentity, text: string) => void
+  coalesceMs?: number
+  schedule?: AgentSessionDeltaCoalescerDeps['schedule']
+}
+
+export type ClaudeStreamedTextCheckpoints = {
+  /** Accumulate a delta; the row is rewritten on the coalescer's own cadence. */
+  append: (identity: AgentJournalItemIdentity, text: string) => void
+  /** Write every block whose row is behind the text received for it. */
+  flush: () => void
+  /** Drop one block's state, for a block whose final frame has now landed. */
+  forget: (key: string) => void
+  /**
+   * Drop every block still awaiting its final frame, at turn settlement. Their
+   * text is already journaled by the flush that precedes settlement; keeping it
+   * live would grow with every interrupted turn for the life of the session.
+   */
+  settle: () => void
+  /** Blocks still awaiting a final frame. A settled turn must leave none. */
+  readonly pending: number
+  dispose: () => void
+}
+
+/**
+ * Growth of a streamed block's row between its deltas and its final frame.
+ *
+ * The row is rewritten on a widening interval rather than per delta: a 200-line
+ * reply would otherwise rewrite the same journal row once per token.
+ */
+export function createClaudeStreamedTextCheckpoints(
+  deps: ClaudeStreamedTextCheckpointDeps
+): ClaudeStreamedTextCheckpoints {
+  const identities = new Map<string, AgentJournalItemIdentity>()
+  const latestText = new Map<string, string>()
+  const checkpointLengths = new Map<string, number>()
+
+  const persist = (key: string, text: string, force: boolean): void => {
+    latestText.set(key, text)
+    const checkpointLength = checkpointLengths.get(key) ?? 0
+    const nextLength = Math.max(checkpointLength + 32, Math.ceil(checkpointLength * 1.125))
+    if (!force && checkpointLength > 0 && text.length < nextLength) {
+      return
+    }
+    const identity = identities.get(key)
+    if (!identity) {
+      return
+    }
+    checkpointLengths.set(key, text.length)
+    deps.persist(identity, text)
+  }
+
+  const coalescer = createAgentSessionDeltaCoalescer({
+    ...(deps.coalesceMs === undefined ? {} : { windowMs: deps.coalesceMs }),
+    ...(deps.schedule ? { schedule: deps.schedule } : {}),
+    emit: (key, text) => persist(key, text, false)
+  })
+
+  const drop = (key: string): void => {
+    coalescer.forget(key)
+    identities.delete(key)
+    latestText.delete(key)
+    checkpointLengths.delete(key)
+  }
+
+  return {
+    append: (identity, text) => {
+      const key = agentJournalItemKey(identity)
+      identities.set(key, identity)
+      coalescer.append(key, text)
+    },
+    flush: () => {
+      coalescer.flushAll()
+      for (const [key, text] of latestText) {
+        if (checkpointLengths.get(key) !== text.length) {
+          persist(key, text, true)
+        }
+      }
+    },
+    forget: drop,
+    settle: () => {
+      // Map iteration tolerates deletion of the entry just visited.
+      for (const key of identities.keys()) {
+        drop(key)
+      }
+    },
+    get pending() {
+      return identities.size
+    },
+    dispose: () => {
+      coalescer.dispose()
+      identities.clear()
+      latestText.clear()
+      checkpointLengths.clear()
+    }
+  }
+}
diff --git a/src/main/claude/claude-structured-acquisition-release.ts b/src/main/claude/claude-structured-acquisition-release.ts
new file mode 100644
index 00000000000..6be06c86e93
--- /dev/null
+++ b/src/main/claude/claude-structured-acquisition-release.ts
@@ -0,0 +1,44 @@
+import {
+  closeClaudeSession,
+  claudeAcquisitionCleanupError
+} from './claude-structured-session-close'
+import type {
+  ClaudeAcquisitionRegistry,
+  ClaudeSession,
+  ClaudeSessionExit,
+  ClaudeStructuredSessionAdapterDeps
+} from './claude-structured-session-state'
+
+/**
+ * Cleanup for an acquisition the host could not commit or prove. A session that
+ * a first-hand exit already removed is not an absence to report as proven: the
+ * ladder on its connection still answers, and that answer is classified exactly
+ * as a start-time failure would be.
+ */
+export async function releaseClaudeAcquisition(input: {
+  sessionId: string
+  sessions: Map<string, ClaudeSession>
+  acquisitions: ClaudeAcquisitionRegistry
+  exits: Map<string, ClaudeSessionExit>
+  onExitProven?: (sessionId: string, exit: ClaudeSessionExit) => Promise<void>
+  persistHandle?: ClaudeStructuredSessionAdapterDeps['persistHandle']
+  onEvent?: ClaudeStructuredSessionAdapterDeps['onEvent']
+  onBackgroundTasksChanged?: ClaudeStructuredSessionAdapterDeps['onBackgroundTasksChanged']
+}): Promise<boolean> {
+  const exit = input.exits.get(input.sessionId)
+  if (!exit || input.sessions.has(input.sessionId) || input.acquisitions.get(input.sessionId)) {
+    return closeClaudeSession(input)
+  }
+  const firstProof = exit.closePromise ? await exit.closePromise : false
+  // A failed exit-path proof is retained as evidence, not as a terminal result;
+  // a release retry must drive a fresh tree verification on the same connection.
+  const retriedProof = firstProof || (await exit.connection.close())
+  if (retriedProof) {
+    await input.onExitProven?.(input.sessionId, exit)
+    // Keep the first-hand exit evidence indexed until the tree proof succeeds;
+    // a failed close must be retryable and cannot look like an absent session.
+    input.exits.delete(input.sessionId)
+    return true
+  }
+  throw claudeAcquisitionCleanupError(exit.connection, exit.error)
+}
diff --git a/src/main/claude/claude-structured-auth-parity.test.ts b/src/main/claude/claude-structured-auth-parity.test.ts
new file mode 100644
index 00000000000..ddc69366aad
--- /dev/null
+++ b/src/main/claude/claude-structured-auth-parity.test.ts
@@ -0,0 +1,235 @@
+import { afterEach, describe, expect, it } from 'vitest'
+import type { AgentSessionRecord } from '../../shared/agent-session-record'
+import { LOCAL_EXECUTION_HOST_ID } from '../../shared/execution-host'
+import { beginClaudeAuthSwitch, endClaudeAuthSwitch } from '../claude-accounts/live-pty-gate'
+import {
+  CLAUDE_AUTH_ENV_CONFLICT_MESSAGE,
+  CLAUDE_AUTH_SWITCH_IN_PROGRESS_MESSAGE
+} from '../claude-accounts/environment'
+import type { AgentSessionRecordStore } from '../runtime/agent-session-record-store'
+import { createClaudeStructuredLaunchResolver } from './claude-structured-launch-resolution'
+import { ClaudeStructuredSessionAdapter } from './claude-structured-session-adapter'
+import {
+  PROVIDER_SESSION_ID,
+  adapterFor,
+  fakeClaude,
+  identityFor
+} from './claude-structured-session-test-support'
+
+const SESSION_ID = 'orca-session-auth'
+const IDENTITY = { sessionId: SESSION_ID } as Parameters<
+  ReturnType<typeof createClaudeStructuredLaunchResolver>
+>[0]['identity']
+
+function record(): AgentSessionRecord {
+  return {
+    sessionId: SESSION_ID,
+    provider: 'claude',
+    location: {
+      executionHostId: LOCAL_EXECUTION_HOST_ID,
+      wslDistro: null,
+      workspaceId: 'workspace-1',
+      workspaceKind: 'folder'
+    },
+    accountHome: { variable: 'CLAUDE_CONFIG_DIR', path: '/home/work/.claude' },
+    providerHandleChain: []
+  } as unknown as AgentSessionRecord
+}
+
+function resolverFor(options: {
+  stripAuthEnv: boolean
+  overlay?: Record<string, string>
+  authSwitchSettleTimeoutMs?: number
+}): ReturnType<typeof createClaudeStructuredLaunchResolver> {
+  return createClaudeStructuredLaunchResolver({
+    store: { getRecord: () => record() } as unknown as AgentSessionRecordStore,
+    resolveWorkspacePath: async (id) => `/repos/${id}`,
+    resolveCommand: () => '/usr/local/bin/claude',
+    resolveAuthPolicy: () => ({ stripAuthEnv: options.stripAuthEnv }),
+    authSwitchSettleTimeoutMs: options.authSwitchSettleTimeoutMs ?? 20,
+    ...(options.overlay ? { resolveEnv: () => options.overlay as Record<string, string> } : {})
+  })
+}
+
+/**
+ * An adapter driven by the REAL launch resolver, not the stub in the shared test
+ * support — the stub has no auth guard at all, so a teardown-window test built on it
+ * would pass whatever the guard did.
+ */
+function realResolverAdapter(
+  claude: ReturnType<typeof fakeClaude>,
+  authSwitchSettleTimeoutMs: number
+): ClaudeStructuredSessionAdapter {
+  const resumable = {
+    ...record(),
+    providerHandleChain: [
+      { handle: { provider: 'claude', sessionId: PROVIDER_SESSION_ID, leafUuid: null } }
+    ]
+  } as unknown as AgentSessionRecord
+  return new ClaudeStructuredSessionAdapter({
+    resolveLaunch: createClaudeStructuredLaunchResolver({
+      store: { getRecord: () => resumable } as unknown as AgentSessionRecordStore,
+      resolveWorkspacePath: async (id) => `/repos/${id}`,
+      resolveCommand: () => '/usr/local/bin/claude',
+      resolveAuthPolicy: () => ({ stripAuthEnv: false }),
+      authSwitchSettleTimeoutMs
+    }),
+    openConnection: claude.openConnection,
+    readProcessStartTime: async () => 1_700_000_000_000,
+    now: () => 1_700_000_000_500,
+    persistHandle: async () => {}
+  })
+}
+
+function withAmbientAuth<T>(value: string, run: () => Promise<T>): Promise<T> {
+  const restore = process.env.ANTHROPIC_API_KEY
+  process.env.ANTHROPIC_API_KEY = value
+  return run().finally(() => {
+    if (restore === undefined) {
+      delete process.env.ANTHROPIC_API_KEY
+    } else {
+      process.env.ANTHROPIC_API_KEY = restore
+    }
+  })
+}
+
+describe('claude structured auth parity with the terminal preflight', () => {
+  afterEach(() => {
+    endClaudeAuthSwitch()
+  })
+
+  // Task 1 — the terminal preflight refuses this at spawn-env.ts:25 and
+  // runtime/spawn-preflight.ts:139; the structured path used to let the override win.
+  it('refuses an explicit Anthropic auth override while a managed account is pinned', async () => {
+    await expect(
+      resolverFor({ stripAuthEnv: true, overlay: { ANTHROPIC_API_KEY: 'sk-ant-CONFIGURED' } })({
+        identity: IDENTITY
+      })
+    ).rejects.toThrow(CLAUDE_AUTH_ENV_CONFLICT_MESSAGE)
+  })
+
+  it('refuses an auth-like ANTHROPIC_CUSTOM_HEADERS override while a managed account is pinned', async () => {
+    await expect(
+      resolverFor({
+        stripAuthEnv: true,
+        overlay: { ANTHROPIC_CUSTOM_HEADERS: 'Authorization: Bearer sk-ant-CONFIGURED' }
+      })({ identity: IDENTITY })
+    ).rejects.toThrow(CLAUDE_AUTH_ENV_CONFLICT_MESSAGE)
+  })
+
+  it('still admits a non-auth env overlay under a managed account', async () => {
+    const launch = await resolverFor({
+      stripAuthEnv: true,
+      overlay: { ANTHROPIC_BASE_URL: 'https://gateway.example.test' }
+    })({ identity: IDENTITY })
+
+    expect(launch.env?.ANTHROPIC_BASE_URL).toBe('https://gateway.example.test')
+  })
+
+  // Task 2 — legacy computes stripAuthEnv at runtime-auth-preparation.ts:72, so a
+  // system-auth user's own shell key is their sign-in and must survive.
+  it('passes an ambient Anthropic key through when no managed account is active', async () => {
+    await withAmbientAuth('sk-ant-SHELL', async () => {
+      const launch = await resolverFor({ stripAuthEnv: false })({ identity: IDENTITY })
+
+      expect(launch.env?.ANTHROPIC_API_KEY).toBe('sk-ant-SHELL')
+    })
+  })
+
+  it('lets an explicit overlay override the ambient key when no managed account is active', async () => {
+    await withAmbientAuth('sk-ant-SHELL', async () => {
+      const launch = await resolverFor({
+        stripAuthEnv: false,
+        overlay: { ANTHROPIC_API_KEY: 'sk-ant-CONFIGURED' }
+      })({ identity: IDENTITY })
+
+      expect(launch.env?.ANTHROPIC_API_KEY).toBe('sk-ant-CONFIGURED')
+    })
+  })
+
+  it('still strips the ambient Anthropic key when a managed account is pinned', async () => {
+    await withAmbientAuth('sk-ant-SHELL', async () => {
+      const launch = await resolverFor({ stripAuthEnv: true })({ identity: IDENTITY })
+
+      expect(launch.env?.ANTHROPIC_API_KEY).toBeUndefined()
+    })
+  })
+
+  // Task 3 — the terminal preflight guards this at four sites; the structured path had none.
+  it('refuses launch resolution when an account switch never settles', async () => {
+    beginClaudeAuthSwitch()
+
+    await expect(
+      resolverFor({ stripAuthEnv: true, authSwitchSettleTimeoutMs: 20 })({ identity: IDENTITY })
+    ).rejects.toThrow(CLAUDE_AUTH_SWITCH_IN_PROGRESS_MESSAGE)
+  })
+
+  it('waits a settling account switch out rather than refusing a resolved launch', async () => {
+    beginClaudeAuthSwitch()
+    setTimeout(() => endClaudeAuthSwitch(), 20)
+
+    const launch = await resolverFor({
+      stripAuthEnv: true,
+      authSwitchSettleTimeoutMs: 5_000
+    })({ identity: IDENTITY })
+
+    expect(launch.claudeConfigDir).toBe('/home/work/.claude')
+  })
+
+  it('refuses an acquire before it tears the previous session down', async () => {
+    const claude = fakeClaude()
+    const adapter = adapterFor(claude)
+    beginClaudeAuthSwitch()
+
+    await expect(
+      adapter.acquire({ identity: identityFor(), fence: 7, spawnToken: 'spawn-9' })
+    ).rejects.toThrow(CLAUDE_AUTH_SWITCH_IN_PROGRESS_MESSAGE)
+    // Nothing was spawned, so the refusal must not have opened a connection.
+    expect(claude.connections).toHaveLength(0)
+  })
+
+  // The teardown between the entry guard and launch resolution closes the live child
+  // and proves its tree — seconds, not milliseconds. A switch that begins inside it
+  // has already cost the user their session, so refusing there produces exactly the
+  // outcome the entry guard advertises against: a dead chat and no replacement.
+  it('replaces the session when a switch begins inside the acquire teardown', async () => {
+    const claude = fakeClaude()
+    const adapter = realResolverAdapter(claude, 5_000)
+    await adapter.acquire({ identity: identityFor(), fence: 7, spawnToken: 'spawn-9' })
+    const live = claude.connections[0]!
+    const closeWithSwitch = live.close
+    live.close = async () => {
+      beginClaudeAuthSwitch()
+      setTimeout(() => endClaudeAuthSwitch(), 20)
+      return closeWithSwitch()
+    }
+
+    await expect(
+      adapter.acquire({ identity: identityFor(), fence: 8, spawnToken: 'spawn-10' })
+    ).resolves.toMatchObject({ process: { spawnToken: 'spawn-10' } })
+    expect(live.closed).toBe(true)
+    // The replacement child exists: the user's chat came back.
+    expect(claude.connections).toHaveLength(2)
+    expect(claude.connections[1]!.closed).toBe(false)
+    await adapter.closeAll()
+  })
+
+  it('still refuses a mid-teardown switch that never settles, leaving nothing half-open', async () => {
+    const claude = fakeClaude()
+    const adapter = realResolverAdapter(claude, 20)
+    await adapter.acquire({ identity: identityFor(), fence: 7, spawnToken: 'spawn-9' })
+    const live = claude.connections[0]!
+    const closeWithSwitch = live.close
+    live.close = async () => {
+      beginClaudeAuthSwitch()
+      return closeWithSwitch()
+    }
+
+    await expect(
+      adapter.acquire({ identity: identityFor(), fence: 8, spawnToken: 'spawn-10' })
+    ).rejects.toThrow(CLAUDE_AUTH_SWITCH_IN_PROGRESS_MESSAGE)
+    // No replacement child was opened, so nothing is left running unowned.
+    expect(claude.connections).toHaveLength(1)
+    await adapter.closeAll()
+  })
+})
diff --git a/src/main/claude/claude-structured-content-parts.test.ts b/src/main/claude/claude-structured-content-parts.test.ts
new file mode 100644
index 00000000000..d2142150937
--- /dev/null
+++ b/src/main/claude/claude-structured-content-parts.test.ts
@@ -0,0 +1,98 @@
+import { describe, expect, it, vi } from 'vitest'
+import type {
+  AgentJournalItemBody,
+  AgentJournalItemIdentity
+} from '../../shared/agent-session-journal-types'
+import type { StructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
+import { createClaudeJournalTranslator } from './claude-structured-journal-translation'
+
+function sinkState() {
+  const items: { identity: AgentJournalItemIdentity; body: AgentJournalItemBody }[] = []
+  const sink: StructuredAgentSessionEventSink = {
+    appendItem: (identity, body) => items.push({ identity, body }),
+    appendTombstone: () => {},
+    publish: vi.fn()
+  }
+  return { sink, items }
+}
+
+function providerRows(items: { body: AgentJournalItemBody }[]) {
+  return items.flatMap((item) =>
+    item.body.kind === 'status' && item.body.providerFrame
+      ? [{ kind: item.body.providerFrame.kind, text: item.body.text }]
+      : []
+  )
+}
+
+function userMessageWith(part: unknown) {
+  return {
+    type: 'message' as const,
+    sessionId: 'orca-session',
+    startsTurn: true as const,
+    message: {
+      type: 'user',
+      uuid: 'user-1',
+      session_id: 'claude-session',
+      parent_tool_use_id: null,
+      isReplay: true,
+      message: { role: 'user', content: [{ type: 'text', text: 'look at this' }, part] }
+    }
+  }
+}
+
+/** Exactly what claudeDispatchMessageContent sends for a local attachment. */
+const BASE64_IMAGE = {
+  type: 'image',
+  source: { type: 'base64', media_type: 'image/png', data: 'iVBORw0KGgoAAAANSUhEUg==' }
+}
+
+describe('Claude message content parts', () => {
+  it('does not leak a wire kind for a locally attached image', () => {
+    const state = sinkState()
+    const translator = createClaudeJournalTranslator({ sink: state.sink })
+
+    translator.handle(userMessageWith(BASE64_IMAGE))
+
+    expect(providerRows(state.items)).toEqual([])
+  })
+
+  it('still renders an image the CLI sends by url', () => {
+    const state = sinkState()
+    const translator = createClaudeJournalTranslator({ sink: state.sink })
+
+    translator.handle(
+      userMessageWith({ type: 'image', source: { type: 'url', url: 'https://x.test/a.png' } })
+    )
+
+    expect(providerRows(state.items)).toEqual([])
+    expect(
+      state.items.flatMap((item) => (item.body.kind === 'message' ? item.body.blocks : []))
+    ).toContainEqual({ type: 'image-ref', url: 'https://x.test/a.png' })
+  })
+
+  it('says what is true for a content part it cannot render, not the wire kind', () => {
+    const state = sinkState()
+    const translator = createClaudeJournalTranslator({ sink: state.sink })
+
+    translator.handle(userMessageWith({ type: 'some_future_part', payload: { a: 1 } }))
+
+    const rows = providerRows(state.items)
+    expect(rows).toHaveLength(1)
+    // The kind stays on the row for debugging, behind the disclosure.
+    expect(rows[0].kind).toBe('message:user:content:some_future_part')
+    // ...but the visible text is a sentence, not the opcode.
+    expect(rows[0].text).not.toContain('message:user:content')
+    expect(rows[0].text.toLowerCase()).toContain('claude')
+  })
+
+  it('prefers a readable sentence the part carries over the placeholder', () => {
+    const state = sinkState()
+    const translator = createClaudeJournalTranslator({ sink: state.sink })
+
+    translator.handle(
+      userMessageWith({ type: 'some_future_part', message: 'the server refused the upload' })
+    )
+
+    expect(providerRows(state.items)[0].text).toBe('the server refused the upload')
+  })
+})
diff --git a/src/main/claude/claude-structured-control-actions.test.ts b/src/main/claude/claude-structured-control-actions.test.ts
new file mode 100644
index 00000000000..168ce558f53
--- /dev/null
+++ b/src/main/claude/claude-structured-control-actions.test.ts
@@ -0,0 +1,199 @@
+import { describe, expect, it, vi } from 'vitest'
+import {
+  cancelClaudeTurn,
+  answerClaudePrompt,
+  stopClaudeBackgroundTasks
+} from './claude-structured-control-actions'
+import { ClaudeControlRequestError } from './claude-stream-json-connection'
+import { ClaudePromptRegistry } from './claude-structured-prompt-replies'
+import type { ClaudeSession } from './claude-structured-session-state'
+import { ClaudeBackgroundTaskTracker } from './claude-background-task-tracker'
+
+type InterruptResult = Awaited<ReturnType<ClaudeSession['connection']['interrupt']>>
+
+function sessionWith(input: {
+  capabilities?: string[]
+  interrupt: (options?: { cancelQueued?: boolean; timeoutMs?: number }) => Promise<InterruptResult>
+  cancelAsyncMessage?: (uuid: string) => Promise<void>
+  prompts?: ClaudePromptRegistry
+}): {
+  session: ClaudeSession
+  interrupt: ReturnType<typeof vi.fn>
+  cancelAsyncMessage: ReturnType<typeof vi.fn>
+} {
+  const interrupt = vi.fn(input.interrupt)
+  const cancelAsyncMessage = vi.fn(input.cancelAsyncMessage ?? (async () => {}))
+  const session = {
+    capabilities: input.capabilities ?? [],
+    prompts: input.prompts ?? new ClaudePromptRegistry(),
+    connection: { interrupt, cancelAsyncMessage }
+  } as unknown as ClaudeSession
+  return { session, interrupt, cancelAsyncMessage }
+}
+
+describe('cancelClaudeTurn', () => {
+  it('interrupts without a receipt on an older CLI and reports the turn cancelled', async () => {
+    const { session, interrupt, cancelAsyncMessage } = sessionWith({
+      interrupt: async () => undefined
+    })
+
+    await expect(cancelClaudeTurn(session, 5_000)).resolves.toEqual({ cancelled: true })
+    expect(interrupt).toHaveBeenCalledWith({ timeoutMs: 5_000 })
+    expect(cancelAsyncMessage).not.toHaveBeenCalled()
+  })
+
+  it('withdraws every still-queued message a plain interrupt receipt reports', async () => {
+    const { session, interrupt, cancelAsyncMessage } = sessionWith({
+      capabilities: ['interrupt_receipt_v1'],
+      interrupt: async () => ({ still_queued: ['queued-1', 'queued-2'] })
+    })
+
+    await expect(cancelClaudeTurn(session, 5_000)).resolves.toEqual({ cancelled: true })
+    // No cancel_queued capability, so the queue is swept one uuid at a time.
+    expect(interrupt).toHaveBeenCalledWith({ timeoutMs: 5_000 })
+    expect(cancelAsyncMessage.mock.calls.map((call) => call[0])).toEqual(['queued-1', 'queued-2'])
+  })
+
+  it('sends cancel_queued and never sweeps when the CLI advertises the capability', async () => {
+    const { session, interrupt, cancelAsyncMessage } = sessionWith({
+      capabilities: ['interrupt_receipt_v1', 'interrupt_cancel_queued_v1'],
+      interrupt: async () => ({ still_queued: [], cancelled: ['queued-1'] })
+    })
+
+    await expect(cancelClaudeTurn(session, 5_000)).resolves.toEqual({ cancelled: true })
+    expect(interrupt).toHaveBeenCalledWith({ cancelQueued: true, timeoutMs: 5_000 })
+    expect(cancelAsyncMessage).not.toHaveBeenCalled()
+  })
+
+  it('reports a not-running interrupt as not cancelled without throwing', async () => {
+    const { session } = sessionWith({
+      interrupt: async () => {
+        throw new ClaudeControlRequestError('interrupt', 'not running')
+      }
+    })
+
+    await expect(cancelClaudeTurn(session, 5_000)).resolves.toEqual({ cancelled: false })
+  })
+
+  it('propagates a transport failure such as an interrupt timeout', async () => {
+    const { session } = sessionWith({
+      interrupt: async () => {
+        throw new Error('claude interrupt request timed out')
+      }
+    })
+
+    await expect(cancelClaudeTurn(session, 5_000)).rejects.toThrow('timed out')
+  })
+})
+
+describe('answerClaudePrompt', () => {
+  it('settles the pending prompt callback and forgets it', async () => {
+    const prompts = new ClaudePromptRegistry()
+    const settle = vi.fn()
+    const prompt = prompts.register({
+      requestId: 'perm-1',
+      toolName: 'Bash',
+      toolUseId: 'tool-1',
+      input: { command: 'ls' },
+      suggestions: [],
+      settle
+    })!
+    prompts.bindJournalItemId('journal-1', prompt.promptKey)
+    const { session } = sessionWith({ interrupt: async () => undefined, prompts })
+
+    await answerClaudePrompt(session, { itemId: 'journal-1', kind: 'approval', optionId: 'allow' })
+
+    expect(settle).toHaveBeenCalledWith(
+      expect.objectContaining({ behavior: 'allow', toolUseID: 'tool-1' })
+    )
+    expect(prompts.find('journal-1')).toBeNull()
+  })
+
+  it('refuses an answer for a prompt Claude is no longer waiting on', async () => {
+    const { session } = sessionWith({ interrupt: async () => undefined })
+    await expect(
+      answerClaudePrompt(session, { itemId: 'missing', kind: 'approval', optionId: 'allow' })
+    ).rejects.toThrow(/no longer waiting/)
+  })
+})
+
+describe('stopClaudeBackgroundTasks', () => {
+  it('stops each live SDK task id and never depends on an active turn id', async () => {
+    const backgroundTasks = new ClaudeBackgroundTaskTracker()
+    backgroundTasks.observe({
+      type: 'system',
+      subtype: 'background_tasks_changed',
+      tasks: [
+        { task_id: 'task-agent', task_type: 'local_agent', description: 'agent' },
+        { task_id: 'task-bash', task_type: 'local_bash', description: 'bash' }
+      ]
+    })
+    const stopTask = vi.fn(async (_taskId: string, _options?: { timeoutMs?: number }) => {})
+    const session = { backgroundTasks, connection: { stopTask } } as unknown as ClaudeSession
+
+    await expect(stopClaudeBackgroundTasks(session, 5_000)).resolves.toEqual({ cancelled: true })
+    expect(stopTask.mock.calls).toEqual([
+      ['task-agent', { timeoutMs: 5_000 }],
+      ['task-bash', { timeoutMs: 5_000 }]
+    ])
+  })
+
+  it('stops issuing requests when ownership changes between tasks', async () => {
+    const backgroundTasks = new ClaudeBackgroundTaskTracker()
+    for (const taskId of ['task-1', 'task-2']) {
+      backgroundTasks.observe({
+        type: 'system',
+        subtype: 'task_started',
+        task_id: taskId,
+        task_type: 'local_agent',
+        is_backgrounded: true
+      })
+    }
+    let current = true
+    const stopTask = vi.fn(async (_taskId: string) => {
+      current = false
+    })
+    const session = { backgroundTasks, connection: { stopTask } } as unknown as ClaudeSession
+
+    await stopClaudeBackgroundTasks(session, undefined, () => current)
+    expect(stopTask).toHaveBeenCalledTimes(1)
+  })
+
+  it('stops only the requested live task id', async () => {
+    const backgroundTasks = new ClaudeBackgroundTaskTracker()
+    backgroundTasks.observe({
+      type: 'system',
+      subtype: 'background_tasks_changed',
+      tasks: [
+        { task_id: 'task-one', task_type: 'local_agent' },
+        { task_id: 'task-two', task_type: 'local_bash' }
+      ]
+    })
+    const stopTask = vi.fn(async (_taskId: string) => {})
+    const session = { backgroundTasks, connection: { stopTask } } as unknown as ClaudeSession
+
+    await expect(
+      stopClaudeBackgroundTasks(session, 5_000, () => true, 'task-two')
+    ).resolves.toEqual({ cancelled: true })
+    expect(stopTask).toHaveBeenCalledWith('task-two', { timeoutMs: 5_000 })
+    expect(stopTask).toHaveBeenCalledTimes(1)
+  })
+
+  it('refuses a stale or unknown task id without a provider call', async () => {
+    const backgroundTasks = new ClaudeBackgroundTaskTracker()
+    backgroundTasks.observe({
+      type: 'system',
+      subtype: 'task_started',
+      task_id: 'task-live',
+      task_type: 'local_agent',
+      is_backgrounded: true
+    })
+    const stopTask = vi.fn(async (_taskId: string) => {})
+    const session = { backgroundTasks, connection: { stopTask } } as unknown as ClaudeSession
+
+    await expect(
+      stopClaudeBackgroundTasks(session, undefined, () => true, 'task-stale')
+    ).resolves.toEqual({ cancelled: false })
+    expect(stopTask).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/claude/claude-structured-control-actions.ts b/src/main/claude/claude-structured-control-actions.ts
new file mode 100644
index 00000000000..8b3bb94c7b5
--- /dev/null
+++ b/src/main/claude/claude-structured-control-actions.ts
@@ -0,0 +1,86 @@
+import { applyClaudePromptAnswer } from './claude-structured-prompt-replies'
+import { ClaudeControlRequestError } from './claude-stream-json-connection'
+import type { ClaudeSession } from './claude-structured-session-state'
+
+const INTERRUPT_CANCEL_QUEUED_CAPABILITY = 'interrupt_cancel_queued_v1'
+
+export type ClaudeTurnCancellationGuard = () => boolean
+
+/**
+ * Interrupt the running turn, then make sure no queued async user message survives to spawn a
+ * later unexpected turn. On a CLI advertising `interrupt_cancel_queued_v1` one round trip
+ * cancels the queue alongside the abort; otherwise the interrupt receipt lists `still_queued`
+ * uuids, and each is withdrawn best-effort with `cancel_async_message`. Older CLIs resolve no
+ * receipt, so there is nothing to sweep.
+ */
+export async function cancelClaudeTurn(
+  session: ClaudeSession,
+  timeoutMs: number | undefined,
+  isCurrent: ClaudeTurnCancellationGuard = () => true
+): Promise<{ cancelled: boolean }> {
+  // The SDK interrupt is session-scoped. Re-check the caller's turn/fence
+  // immediately before issuing it so a delayed request cannot stop a later turn.
+  if (!isCurrent()) {
+    return { cancelled: false }
+  }
+  const cancelQueued = session.capabilities.includes(INTERRUPT_CANCEL_QUEUED_CAPABILITY)
+  try {
+    const receipt = await session.connection.interrupt({
+      ...(cancelQueued ? { cancelQueued: true } : {}),
+      timeoutMs
+    })
+    if (!cancelQueued) {
+      for (const uuid of receipt?.still_queued ?? []) {
+        await session.connection.cancelAsyncMessage(uuid, { timeoutMs }).catch(() => {})
+      }
+    }
+    return { cancelled: true }
+  } catch (error) {
+    if (error instanceof ClaudeControlRequestError) {
+      return { cancelled: false }
+    }
+    throw error
+  }
+}
+
+export async function stopClaudeBackgroundTasks(
+  session: ClaudeSession,
+  timeoutMs: number | undefined,
+  isCurrent: ClaudeTurnCancellationGuard = () => true,
+  taskId?: string
+): Promise<{ cancelled: boolean }> {
+  const stoppableTaskIds = session.backgroundTasks.stoppableTaskIds
+  const taskIds =
+    taskId === undefined ? stoppableTaskIds : stoppableTaskIds.includes(taskId) ? [taskId] : []
+  let cancelled = false
+  for (const taskId of taskIds) {
+    if (!isCurrent()) {
+      break
+    }
+    try {
+      await session.connection.stopTask(taskId, { timeoutMs })
+      cancelled = true
+    } catch (error) {
+      if (!(error instanceof ClaudeControlRequestError)) {
+        throw error
+      }
+    }
+  }
+  return { cancelled }
+}
+
+export async function answerClaudePrompt(
+  session: ClaudeSession,
+  input: { itemId: string; kind: 'approval' | 'question'; optionId: string }
+): Promise<void> {
+  const found = session.prompts.find(input.itemId)
+  if (!found || found.prompt.kind !== input.kind) {
+    throw new Error(`claude is no longer waiting on ${input.itemId}`)
+  }
+  const response = applyClaudePromptAnswer(found, input.optionId)
+  if (response === null) {
+    return
+  }
+  session.prompts.forget(found.prompt)
+  found.prompt.settle(response)
+}
diff --git a/src/main/claude/claude-structured-dispatch-content.ts b/src/main/claude/claude-structured-dispatch-content.ts
new file mode 100644
index 00000000000..71f180bc3ac
--- /dev/null
+++ b/src/main/claude/claude-structured-dispatch-content.ts
@@ -0,0 +1,165 @@
+import { createHash } from 'node:crypto'
+import { open } from 'node:fs/promises'
+import { extname } from 'node:path'
+import type { AgentJournalMessageItem } from '../../shared/agent-session-journal-types'
+import type { NativeChatBlock } from '../../shared/native-chat-types'
+
+const MAX_IMAGE_BYTES = 5 * 1024 * 1024
+const MAX_IMAGE_COUNT = 20
+const MAX_TOTAL_IMAGE_BYTES = 20 * 1024 * 1024
+const MAX_REPLAY_CONTENT_KEY_BYTES = 256
+
+type ImageBudget = {
+  count: number
+  localBytes: number
+}
+
+export async function readClaudeImage(path: string, openImpl: typeof open = open): Promise<Buffer> {
+  const file = await openImpl(path, 'r')
+  try {
+    const invalidImage = (): Error =>
+      new Error(`Claude image must be a non-empty file no larger than ${MAX_IMAGE_BYTES} bytes`)
+    const info = await file.stat()
+    if (!info.isFile()) {
+      throw new Error('Claude image must be a file')
+    }
+    if (info.size > MAX_IMAGE_BYTES) {
+      throw invalidImage()
+    }
+    const buffer = Buffer.allocUnsafe(info.size + 1)
+    let bytesRead = 0
+    while (bytesRead < buffer.length) {
+      const result = await file.read(buffer, bytesRead, buffer.length - bytesRead, bytesRead)
+      if (result.bytesRead === 0) {
+        break
+      }
+      bytesRead += result.bytesRead
+    }
+    // A file can grow after the initial stat and after the final read returns
+    // zero. Prove the descriptor's size matches what was copied before sending.
+    const finalInfo = await file.stat()
+    if (bytesRead === 0 || bytesRead > MAX_IMAGE_BYTES || finalInfo.size !== bytesRead) {
+      throw invalidImage()
+    }
+    return buffer.subarray(0, bytesRead)
+  } finally {
+    await file.close()
+  }
+}
+
+const IMAGE_MIME_BY_EXTENSION: Record<string, string> = {
+  '.gif': 'image/gif',
+  '.jpeg': 'image/jpeg',
+  '.jpg': 'image/jpeg',
+  '.png': 'image/png',
+  '.webp': 'image/webp'
+}
+
+async function imageContent(
+  block: Extract<NativeChatBlock, { type: 'image-ref' }>,
+  budget: ImageBudget
+): Promise<unknown> {
+  budget.count += 1
+  if (budget.count > MAX_IMAGE_COUNT) {
+    throw new Error(`Claude messages support at most ${MAX_IMAGE_COUNT} images`)
+  }
+  if (block.url) {
+    return { type: 'image', source: { type: 'url', url: block.url } }
+  }
+  if (!block.path) {
+    throw new Error('image reference has neither a path nor a URL')
+  }
+  const data = await readClaudeImage(block.path)
+  budget.localBytes += data.byteLength
+  if (budget.localBytes > MAX_TOTAL_IMAGE_BYTES) {
+    throw new Error(`Claude images must total no more than ${MAX_TOTAL_IMAGE_BYTES} bytes`)
+  }
+  const mediaType = IMAGE_MIME_BY_EXTENSION[extname(block.path).toLowerCase()]
+  if (!mediaType) {
+    throw new Error(`Claude does not support the image type ${extname(block.path)}`)
+  }
+  return {
+    type: 'image',
+    source: {
+      type: 'base64',
+      media_type: mediaType,
+      data: data.toString('base64')
+    }
+  }
+}
+
+export async function claudeDispatchMessageContent(
+  body: AgentJournalMessageItem
+): Promise<unknown[]> {
+  if (body.role !== 'user') {
+    throw new Error('Claude dispatch accepts only user messages')
+  }
+  const content: unknown[] = []
+  const imageBudget: ImageBudget = { count: 0, localBytes: 0 }
+  for (const block of body.blocks as NativeChatBlock[]) {
+    if (block.type === 'text' && block.text.length > 0) {
+      content.push({ type: 'text', text: block.text })
+    } else if (block.type === 'image-ref') {
+      content.push(await imageContent(block, imageBudget))
+    }
+  }
+  if (content.length === 0) {
+    throw new Error('Claude dispatch requires text or an image')
+  }
+  return content
+}
+
+/**
+ * Keep waiter metadata bounded even when a dispatch contains large base64 images.
+ * The digest is only diagnostic: replay acknowledgement must use provider identity.
+ */
+export function claudeDispatchContentKey(content: readonly unknown[]): string {
+  const digest = createHash('sha256')
+  const summary = content
+    .map((part) => {
+      const record =
+        typeof part === 'object' && part !== null && !Array.isArray(part)
+          ? (part as Record<string, unknown>)
+          : null
+      const type = typeof record?.type === 'string' ? record.type : 'unknown'
+      if (type === 'text') {
+        return `text:${typeof record?.text === 'string' ? record.text.length : 0}`
+      }
+      const source =
+        typeof record?.source === 'object' && record.source !== null
+          ? (record.source as Record<string, unknown>)
+          : null
+      if (type === 'image' && source?.type === 'base64') {
+        return `image:${typeof source.media_type === 'string' ? source.media_type : ''}:${typeof source.data === 'string' ? source.data.length : 0}`
+      }
+      return type
+    })
+    .join(',')
+  for (const [index, part] of content.entries()) {
+    const record =
+      typeof part === 'object' && part !== null && !Array.isArray(part)
+        ? (part as Record<string, unknown>)
+        : null
+    const type = typeof record?.type === 'string' ? record.type : 'unknown'
+    digest.update(`${index}:${type}:`)
+    if (type === 'text' && typeof record?.text === 'string') {
+      digest.update(record.text)
+      continue
+    }
+    const source =
+      typeof record?.source === 'object' && record.source !== null
+        ? (record.source as Record<string, unknown>)
+        : null
+    if (type === 'image' && source?.type === 'base64') {
+      digest.update(typeof source.media_type === 'string' ? source.media_type : '')
+      digest.update(':')
+      if (typeof source.data === 'string') {
+        digest.update(source.data)
+      }
+      continue
+    }
+    digest.update(JSON.stringify(part))
+  }
+  const key = `v1:${summary.slice(0, 128)}:${digest.digest('hex')}`
+  return key.slice(0, MAX_REPLAY_CONTENT_KEY_BYTES)
+}
diff --git a/src/main/claude/claude-structured-dispatch.test.ts b/src/main/claude/claude-structured-dispatch.test.ts
new file mode 100644
index 00000000000..d66a64f82eb
--- /dev/null
+++ b/src/main/claude/claude-structured-dispatch.test.ts
@@ -0,0 +1,600 @@
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { describe, expect, it, vi } from 'vitest'
+import type { AgentJournalMessageItem } from '../../shared/agent-session-journal-types'
+import { dispatchClaudeTurn, resolveClaudeReplayWaiter } from './claude-structured-dispatch'
+import { readClaudeImage } from './claude-structured-dispatch-content'
+import type { ClaudeSession } from './claude-structured-session-state'
+import { ClaudeBackgroundTaskTracker } from './claude-background-task-tracker'
+
+function sessionFor(send = vi.fn().mockResolvedValue(undefined)): ClaudeSession {
+  return {
+    connection: { send } as unknown as ClaudeSession['connection'],
+    providerSessionId: 'provider-session',
+    claudeConfigDir: '/accounts/claude',
+    leafUuid: null,
+    fence: 1,
+    acquisitionGeneration: 'generation-1',
+    prompts: {} as ClaudeSession['prompts'],
+    dispatchWaiters: [],
+    retiredDispatchWaiters: [],
+    replayContentFallbackBlocked: false,
+    backgroundTasks: new ClaudeBackgroundTaskTracker(),
+    dispatchSequence: 0,
+    optionMutationSequence: 0,
+    options: new Map(),
+    reportedOptions: {},
+    reportedModelMutation: 0,
+    confirmedOptions: new Set(),
+    restoreSkippedOptions: new Set(),
+    capabilities: [],
+    events: undefined,
+    translator: null
+  }
+}
+
+function userMessage(blocks: AgentJournalMessageItem['blocks']): AgentJournalMessageItem {
+  return { kind: 'message', role: 'user', blocks }
+}
+
+function userReplayFrame(uuid: string, text: string): Record<string, unknown> {
+  return {
+    type: 'user',
+    parent_tool_use_id: null,
+    session_id: 'provider-session',
+    uuid,
+    message: { role: 'user', content: [{ type: 'text', text }] }
+  }
+}
+
+describe('Claude structured dispatch image limits', () => {
+  it('recovers the active identity when a timed-out replay arrives late', async () => {
+    const session = sessionFor()
+    const dispatched = dispatchClaudeTurn(
+      session,
+      { clientMessageId: 'client-1', body: userMessage([{ type: 'text', text: 'one' }]) },
+      500
+    )
+    await vi.waitFor(() => expect(session.dispatchWaiters).toHaveLength(1))
+    const sentUuid = (session.dispatchWaiters[0] as { sentUuid?: string }).sentUuid
+    await expect(dispatched).resolves.toMatchObject({ state: 'unknown' })
+
+    expect(resolveClaudeReplayWaiter(session, userReplayFrame(sentUuid!, 'one'))).toBe(true)
+    expect(session.activeTurnId).toBe(sentUuid)
+    expect(session.activeTurnSequence).toBe(session.dispatchSequence)
+  })
+
+  it('never lets a late replay for dispatch A resolve dispatch B', async () => {
+    const session = sessionFor()
+    const first = dispatchClaudeTurn(
+      session,
+      { clientMessageId: 'client-1', body: userMessage([{ type: 'text', text: 'one' }]) },
+      500
+    )
+    await vi.waitFor(() => expect(session.dispatchWaiters).toHaveLength(1))
+    const firstUuid = (session.dispatchWaiters[0] as { sentUuid?: string }).sentUuid
+    await expect(first).resolves.toMatchObject({ state: 'unknown' })
+
+    const second = dispatchClaudeTurn(
+      session,
+      { clientMessageId: 'client-2', body: userMessage([{ type: 'text', text: 'two' }]) },
+      100
+    )
+    await vi.waitFor(() => expect(session.dispatchWaiters).toHaveLength(1))
+    const secondUuid = (session.dispatchWaiters[0] as { sentUuid?: string }).sentUuid
+
+    expect(resolveClaudeReplayWaiter(session, userReplayFrame(firstUuid!, 'one'))).toBe(false)
+    expect(session.dispatchWaiters[0]).toMatchObject({ sentUuid: secondUuid })
+    expect(resolveClaudeReplayWaiter(session, userReplayFrame(secondUuid!, 'two'))).toBe(true)
+    await expect(second).resolves.toMatchObject({ providerIdentity: { uuid: secondUuid } })
+  })
+
+  it('does not let an identical late replay for dispatch A resolve active dispatch B', async () => {
+    const session = sessionFor()
+    const first = dispatchClaudeTurn(
+      session,
+      { clientMessageId: 'client-1', body: userMessage([{ type: 'text', text: 'same prompt' }]) },
+      500
+    )
+    await vi.waitFor(() => expect(session.dispatchWaiters).toHaveLength(1))
+    await expect(first).resolves.toMatchObject({ state: 'unknown' })
+
+    const second = dispatchClaudeTurn(
+      session,
+      { clientMessageId: 'client-2', body: userMessage([{ type: 'text', text: 'same prompt' }]) },
+      100
+    )
+    await vi.waitFor(() => expect(session.dispatchWaiters).toHaveLength(1))
+    const secondUuid = session.dispatchWaiters[0]!.sentUuid
+
+    expect(resolveClaudeReplayWaiter(session, userReplayFrame('provider-a', 'same prompt'))).toBe(
+      false
+    )
+    expect(session.dispatchWaiters[0]).toMatchObject({ sentUuid: secondUuid })
+
+    resolveClaudeReplayWaiter(session, userReplayFrame(secondUuid, 'same prompt'))
+    await expect(second).resolves.toMatchObject({ providerIdentity: { uuid: secondUuid } })
+  })
+
+  it('does not let a fresh-UUID replay for an evicted dispatch resolve active dispatch B', async () => {
+    const session = sessionFor()
+    const first = dispatchClaudeTurn(
+      session,
+      { clientMessageId: 'client-1', body: userMessage([{ type: 'text', text: 'same prompt' }]) },
+      100
+    )
+    await vi.waitFor(() => expect(session.dispatchWaiters).toHaveLength(1))
+    await expect(first).resolves.toMatchObject({ state: 'unknown' })
+    const firstUuid = session.retiredDispatchWaiters[0]!.sentUuid
+
+    const fillerDispatches = await Promise.all(
+      Array.from({ length: 64 }, (_, index) =>
+        dispatchClaudeTurn(
+          session,
+          {
+            clientMessageId: `filler-${index}`,
+            body: userMessage([{ type: 'text', text: 'same prompt' }])
+          },
+          5
+        )
+      )
+    )
+    expect(fillerDispatches.every((outcome) => outcome.state === 'unknown')).toBe(true)
+    expect(session.retiredDispatchWaiters).toHaveLength(64)
+    expect(session.replayContentFallbackBlocked).toBe(true)
+    expect(session.retiredDispatchWaiters.some((waiter) => waiter.sentUuid === firstUuid)).toBe(
+      false
+    )
+
+    while (session.retiredDispatchWaiters.length > 0) {
+      const sentUuid = session.retiredDispatchWaiters[0]!.sentUuid
+      resolveClaudeReplayWaiter(session, userReplayFrame(sentUuid, 'same prompt'))
+    }
+    expect(session.retiredDispatchWaiters).toHaveLength(0)
+
+    const second = dispatchClaudeTurn(
+      session,
+      { clientMessageId: 'client-2', body: userMessage([{ type: 'text', text: 'same prompt' }]) },
+      100
+    )
+    await vi.waitFor(() => expect(session.dispatchWaiters).toHaveLength(1))
+    const secondUuid = session.dispatchWaiters[0]!.sentUuid
+
+    expect(
+      resolveClaudeReplayWaiter(session, userReplayFrame('provider-a-late', 'same prompt'))
+    ).toBe(false)
+    expect(session.dispatchWaiters[0]).toMatchObject({ sentUuid: secondUuid })
+
+    resolveClaudeReplayWaiter(session, userReplayFrame(secondUuid, 'same prompt'))
+    await expect(second).resolves.toMatchObject({ providerIdentity: { uuid: secondUuid } })
+  })
+
+  it('does not let a fresh-UUID result for an evicted slash dispatch resolve active dispatch B', async () => {
+    const session = sessionFor()
+    const first = dispatchClaudeTurn(
+      session,
+      { clientMessageId: 'client-1', body: userMessage([{ type: 'text', text: '/permissions' }]) },
+      100
+    )
+    await vi.waitFor(() => expect(session.dispatchWaiters).toHaveLength(1))
+    await expect(first).resolves.toMatchObject({ state: 'unknown' })
+    const firstUuid = session.retiredDispatchWaiters[0]!.sentUuid
+
+    const fillerDispatches = await Promise.all(
+      Array.from({ length: 64 }, (_, index) =>
+        dispatchClaudeTurn(
+          session,
+          {
+            clientMessageId: `filler-${index}`,
+            body: userMessage([{ type: 'text', text: '/permissions' }])
+          },
+          5
+        )
+      )
+    )
+    expect(fillerDispatches.every((outcome) => outcome.state === 'unknown')).toBe(true)
+    expect(session.retiredDispatchWaiters).toHaveLength(64)
+    expect(session.replayContentFallbackBlocked).toBe(true)
+    expect(session.retiredDispatchWaiters.some((waiter) => waiter.sentUuid === firstUuid)).toBe(
+      false
+    )
+
+    while (session.retiredDispatchWaiters.length > 0) {
+      const sentUuid = session.retiredDispatchWaiters[0]!.sentUuid
+      expect(
+        resolveClaudeReplayWaiter(session, {
+          type: 'result',
+          subtype: 'success',
+          session_id: 'provider-session',
+          uuid: `result-${sentUuid}`,
+          user_message_uuid: sentUuid
+        })
+      ).toBe(false)
+    }
+    expect(session.retiredDispatchWaiters).toHaveLength(0)
+
+    const second = dispatchClaudeTurn(
+      session,
+      { clientMessageId: 'client-2', body: userMessage([{ type: 'text', text: '/permissions' }]) },
+      100
+    )
+    await vi.waitFor(() => expect(session.dispatchWaiters).toHaveLength(1))
+    const secondUuid = session.dispatchWaiters[0]!.sentUuid
+
+    expect(
+      resolveClaudeReplayWaiter(session, {
+        type: 'result',
+        subtype: 'success',
+        session_id: 'provider-session',
+        uuid: 'result-a-late'
+      })
+    ).toBe(false)
+    expect(session.dispatchWaiters[0]).toMatchObject({ sentUuid: secondUuid })
+
+    expect(
+      resolveClaudeReplayWaiter(session, {
+        type: 'result',
+        subtype: 'success',
+        session_id: 'provider-session',
+        uuid: 'result-b',
+        user_message_uuid: secondUuid
+      })
+    ).toBe(false)
+    await expect(second).resolves.toMatchObject({
+      providerIdentity: { uuid: 'result-b' }
+    })
+  })
+
+  it('does not let a legacy result for timed-out ordinary dispatch A resolve slash dispatch B', async () => {
+    const session = sessionFor()
+    const first = dispatchClaudeTurn(
+      session,
+      { clientMessageId: 'client-1', body: userMessage([{ type: 'text', text: 'ordinary' }]) },
+      100
+    )
+    await vi.waitFor(() => expect(session.dispatchWaiters).toHaveLength(1))
+    await expect(first).resolves.toMatchObject({ state: 'unknown' })
+
+    const second = dispatchClaudeTurn(
+      session,
+      { clientMessageId: 'client-2', body: userMessage([{ type: 'text', text: '/permissions' }]) },
+      100
+    )
+    await vi.waitFor(() => expect(session.dispatchWaiters).toHaveLength(1))
+
+    expect(
+      resolveClaudeReplayWaiter(session, {
+        type: 'result',
+        subtype: 'success',
+        session_id: 'provider-session',
+        uuid: 'legacy-result-a'
+      })
+    ).toBe(false)
+    await expect(second).resolves.toMatchObject({ state: 'unknown' })
+  })
+
+  it('removes only its own waiter when a later send fails', async () => {
+    const session = sessionFor()
+    const first = dispatchClaudeTurn(
+      session,
+      { clientMessageId: 'client-1', body: userMessage([{ type: 'text', text: 'one' }]) },
+      100
+    )
+    await vi.waitFor(() => expect(session.dispatchWaiters).toHaveLength(1))
+    const firstWaiter = session.dispatchWaiters[0]
+    session.connection.send = vi.fn().mockRejectedValue(new Error('broken pipe'))
+
+    await expect(
+      dispatchClaudeTurn(
+        session,
+        { clientMessageId: 'client-2', body: userMessage([{ type: 'text', text: 'two' }]) },
+        100
+      )
+    ).resolves.toMatchObject({ state: 'unknown', reason: 'broken pipe' })
+    expect(session.dispatchWaiters).toEqual([firstWaiter])
+
+    const firstUuid = (firstWaiter as { sentUuid?: string }).sentUuid
+    resolveClaudeReplayWaiter(session, userReplayFrame(firstUuid!, 'one'))
+    await expect(first).resolves.toMatchObject({ providerIdentity: { uuid: firstUuid } })
+  })
+
+  it('keeps a replay accepted before its send reports failure', async () => {
+    let session!: ClaudeSession
+    const send = vi.fn(async (message: Record<string, unknown>) => {
+      resolveClaudeReplayWaiter(session, { ...message, uuid: 'turn-race' })
+      throw new Error('write raced provider acknowledgement')
+    })
+    session = sessionFor(send)
+
+    await expect(
+      dispatchClaudeTurn(
+        session,
+        { clientMessageId: 'client-1', body: userMessage([{ type: 'text', text: 'one' }]) },
+        100
+      )
+    ).resolves.toMatchObject({ state: 'accepted', providerIdentity: { uuid: 'turn-race' } })
+    expect(session.dispatchWaiters).toHaveLength(0)
+  })
+
+  it('accepts a slash command from its result receipt when Claude omits the user replay', async () => {
+    const session = sessionFor()
+    const dispatched = dispatchClaudeTurn(
+      session,
+      { clientMessageId: 'client-1', body: userMessage([{ type: 'text', text: '/permissions' }]) },
+      100
+    )
+    await vi.waitFor(() => expect(session.dispatchWaiters).toHaveLength(1))
+
+    expect(
+      resolveClaudeReplayWaiter(session, {
+        type: 'result',
+        subtype: 'success',
+        session_id: 'provider-session',
+        uuid: 'command-result-uuid'
+      })
+    ).toBe(false)
+
+    await expect(dispatched).resolves.toEqual({
+      state: 'accepted',
+      providerIdentity: {
+        provider: 'claude',
+        sessionId: 'provider-session',
+        uuid: 'command-result-uuid'
+      }
+    })
+  })
+
+  it('correlates a later slash-command result by user_message_uuid despite a timed-out slash waiter', async () => {
+    const session = sessionFor()
+    const first = dispatchClaudeTurn(
+      session,
+      { clientMessageId: 'client-1', body: userMessage([{ type: 'text', text: '/permissions' }]) },
+      500
+    )
+    await vi.waitFor(() => expect(session.dispatchWaiters).toHaveLength(1))
+    await expect(first).resolves.toMatchObject({ state: 'unknown' })
+
+    const second = dispatchClaudeTurn(
+      session,
+      { clientMessageId: 'client-2', body: userMessage([{ type: 'text', text: '/permissions' }]) },
+      500
+    )
+    await vi.waitFor(() => expect(session.dispatchWaiters).toHaveLength(1))
+    const secondUuid = session.dispatchWaiters[0]!.sentUuid
+
+    expect(
+      resolveClaudeReplayWaiter(session, {
+        type: 'result',
+        subtype: 'success',
+        session_id: 'provider-session',
+        uuid: 'result-b',
+        user_message_uuid: secondUuid
+      })
+    ).toBe(false)
+    await expect(second).resolves.toMatchObject({
+      state: 'accepted',
+      providerIdentity: { uuid: 'result-b' }
+    })
+  })
+
+  it('does not mistake a normal turn result for its missing user replay', async () => {
+    const session = sessionFor()
+    const dispatched = dispatchClaudeTurn(
+      session,
+      { clientMessageId: 'client-1', body: userMessage([{ type: 'text', text: 'hello' }]) },
+      100
+    )
+    await vi.waitFor(() => expect(session.dispatchWaiters).toHaveLength(1))
+
+    expect(
+      resolveClaudeReplayWaiter(session, {
+        type: 'result',
+        session_id: 'provider-session',
+        uuid: 'unrelated-result-uuid'
+      })
+    ).toBe(false)
+    expect(session.dispatchWaiters).toHaveLength(1)
+    expect(
+      resolveClaudeReplayWaiter(session, {
+        type: 'user',
+        parent_tool_use_id: null,
+        session_id: 'provider-session',
+        uuid: 'user-replay-uuid',
+        message: {
+          role: 'user',
+          content: [{ type: 'text', text: 'hello' }]
+        }
+      })
+    ).toBe(true)
+
+    await expect(dispatched).resolves.toMatchObject({
+      state: 'accepted',
+      providerIdentity: { uuid: 'user-replay-uuid' }
+    })
+  })
+
+  it('ignores a top-level tool-result user frame while waiting for a slash command replay', async () => {
+    const session = sessionFor()
+    const dispatched = dispatchClaudeTurn(
+      session,
+      { clientMessageId: 'client-1', body: userMessage([{ type: 'text', text: '/permissions' }]) },
+      100
+    )
+    await vi.waitFor(() => expect(session.dispatchWaiters).toHaveLength(1))
+
+    resolveClaudeReplayWaiter(session, {
+      type: 'user',
+      parent_tool_use_id: null,
+      session_id: 'provider-session',
+      uuid: 'tool-result-uuid',
+      message: {
+        role: 'user',
+        content: [{ type: 'tool_result', tool_use_id: 'tool-1', content: 'done' }]
+      }
+    })
+    expect(session.dispatchWaiters).toHaveLength(1)
+
+    resolveClaudeReplayWaiter(session, {
+      type: 'user',
+      parent_tool_use_id: null,
+      session_id: 'provider-session',
+      uuid: 'user-replay-uuid',
+      message: {
+        role: 'user',
+        content: [{ type: 'text', text: '/permissions' }]
+      }
+    })
+
+    await expect(dispatched).resolves.toEqual({
+      state: 'accepted',
+      providerIdentity: {
+        provider: 'claude',
+        sessionId: 'provider-session',
+        uuid: 'user-replay-uuid'
+      }
+    })
+  })
+
+  it('rejects more than twenty URL images before sending', async () => {
+    const session = sessionFor()
+    const body = userMessage(
+      Array.from({ length: 21 }, (_, index) => ({
+        type: 'image-ref' as const,
+        url: `https://example.test/${index}.png`
+      }))
+    )
+
+    await expect(
+      dispatchClaudeTurn(session, { clientMessageId: 'client-1', body }, 1)
+    ).resolves.toEqual({ state: 'rejected', reason: 'Claude messages support at most 20 images' })
+    expect(session.connection.send).not.toHaveBeenCalled()
+  })
+
+  it('rejects local images whose aggregate size exceeds twenty MiB', async () => {
+    const directory = await mkdtemp(join(tmpdir(), 'orca-claude-images-'))
+    try {
+      const paths = await Promise.all(
+        Array.from({ length: 5 }, async (_, index) => {
+          const path = join(directory, `${index}.png`)
+          await writeFile(path, Buffer.alloc(5 * 1024 * 1024))
+          return path
+        })
+      )
+      const session = sessionFor()
+      const body = userMessage(paths.map((path) => ({ type: 'image-ref' as const, path })))
+
+      await expect(
+        dispatchClaudeTurn(session, { clientMessageId: 'client-1', body }, 1)
+      ).resolves.toEqual({
+        state: 'rejected',
+        reason: `Claude images must total no more than ${20 * 1024 * 1024} bytes`
+      })
+      expect(session.connection.send).not.toHaveBeenCalled()
+    } finally {
+      await rm(directory, { recursive: true, force: true })
+    }
+  })
+
+  it('rejects a local image by actual bytes read beyond the per-image cap', async () => {
+    const directory = await mkdtemp(join(tmpdir(), 'orca-claude-image-'))
+    try {
+      const path = join(directory, 'oversized.png')
+      await writeFile(path, Buffer.alloc(5 * 1024 * 1024 + 1))
+      const session = sessionFor()
+      const body = userMessage([{ type: 'image-ref', path }])
+
+      await expect(
+        dispatchClaudeTurn(session, { clientMessageId: 'client-1', body }, 1)
+      ).resolves.toEqual({
+        state: 'rejected',
+        reason: `Claude image must be a non-empty file no larger than ${5 * 1024 * 1024} bytes`
+      })
+      expect(session.connection.send).not.toHaveBeenCalled()
+    } finally {
+      await rm(directory, { recursive: true, force: true })
+    }
+  })
+
+  it('allocates local image reads from the file size, not the maximum cap', async () => {
+    const directory = await mkdtemp(join(tmpdir(), 'orca-claude-image-'))
+    const allocUnsafe = vi.spyOn(Buffer, 'allocUnsafe')
+    try {
+      const path = join(directory, 'small.png')
+      await writeFile(path, Buffer.alloc(64))
+      const session = sessionFor()
+      const dispatched = dispatchClaudeTurn(
+        session,
+        { clientMessageId: 'client-1', body: userMessage([{ type: 'image-ref', path }]) },
+        100
+      )
+      await vi.waitFor(() => expect(session.dispatchWaiters).toHaveLength(1))
+      const sentUuid = (session.dispatchWaiters[0] as { sentUuid?: string }).sentUuid
+      resolveClaudeReplayWaiter(session, {
+        ...userReplayFrame(sentUuid!, ''),
+        message: {
+          role: 'user',
+          content: [
+            { type: 'image', source: { type: 'base64', media_type: 'image/png', data: '' } }
+          ]
+        }
+      })
+      await expect(dispatched).resolves.toMatchObject({ state: 'accepted' })
+      expect(allocUnsafe).toHaveBeenCalled()
+      expect(allocUnsafe.mock.calls.some(([size]) => size === 64 + 1)).toBe(true)
+      expect(allocUnsafe.mock.calls.some(([size]) => size >= 5 * 1024 * 1024)).toBe(false)
+    } finally {
+      allocUnsafe.mockRestore()
+      await rm(directory, { recursive: true, force: true })
+    }
+  })
+
+  it('bounds retained waiter identity bytes when image dispatches time out', async () => {
+    const directory = await mkdtemp(join(tmpdir(), 'orca-claude-image-'))
+    try {
+      const path = join(directory, 'large.png')
+      await writeFile(path, Buffer.alloc(64 * 1024))
+      const session = sessionFor()
+      const body = userMessage([{ type: 'image-ref', path }])
+      await Promise.all(
+        Array.from({ length: 64 }, (_, index) =>
+          dispatchClaudeTurn(session, { clientMessageId: `client-${index}`, body }, 1)
+        )
+      )
+
+      expect(session.retiredDispatchWaiters).toHaveLength(64)
+      const retainedKeyBytes = session.retiredDispatchWaiters.reduce(
+        (total, waiter) => total + waiter.replayContentKey.length,
+        0
+      )
+      expect(retainedKeyBytes).toBeLessThan(64 * 512)
+      expect(
+        session.retiredDispatchWaiters.every((waiter) => waiter.replayContentKey.length < 512)
+      ).toBe(true)
+    } finally {
+      await rm(directory, { recursive: true, force: true })
+    }
+  })
+
+  it('rejects a local image when it grows after the initial stat', async () => {
+    const stat = vi
+      .fn()
+      .mockResolvedValueOnce({ isFile: () => true, size: 64 })
+      .mockResolvedValueOnce({ isFile: () => true, size: 128 })
+    const read = vi.fn(async (buffer: Buffer, offset: number) => {
+      if (read.mock.calls.length === 1) {
+        buffer.fill(1, offset, offset + 64)
+        return { bytesRead: 64, buffer }
+      }
+      return { bytesRead: 0, buffer }
+    })
+    const open = vi.fn().mockResolvedValue({
+      stat,
+      read,
+      close: vi.fn().mockResolvedValue(undefined)
+    } as never)
+    await expect(readClaudeImage('/controlled/growing.png', open)).rejects.toThrow(
+      `Claude image must be a non-empty file no larger than ${5 * 1024 * 1024} bytes`
+    )
+  })
+})
diff --git a/src/main/claude/claude-structured-dispatch.ts b/src/main/claude/claude-structured-dispatch.ts
new file mode 100644
index 00000000000..96271e41d71
--- /dev/null
+++ b/src/main/claude/claude-structured-dispatch.ts
@@ -0,0 +1,264 @@
+import { randomUUID } from 'node:crypto'
+import type { AgentJournalMessageItem } from '../../shared/agent-session-journal-types'
+import type { AgentSessionDispatchOutcome } from '../native-chat/agent-session-wire/structured-agent-session-adapter'
+import {
+  claudeHasReplayContent,
+  readClaudeMessageEnvelope
+} from './claude-structured-item-translation'
+import type { ClaudeDispatchWaiter, ClaudeSession } from './claude-structured-session-state'
+import { readClaudeFrameString } from './claude-structured-init-proof'
+import {
+  claudeDispatchContentKey,
+  claudeDispatchMessageContent
+} from './claude-structured-dispatch-content'
+
+const MAX_RETIRED_DISPATCH_WAITERS = 64
+
+export function resolveClaudeReplayWaiter(
+  session: ClaudeSession,
+  message: Record<string, unknown>
+): boolean {
+  const envelope = readClaudeMessageEnvelope(message)
+  const isUserReplay =
+    envelope?.role === 'user' &&
+    message.parent_tool_use_id === null &&
+    claudeHasReplayContent(envelope)
+  const isCompletedCommand = message.type === 'result'
+  if (
+    (!isUserReplay && !isCompletedCommand) ||
+    readClaudeFrameString(message, 'session_id') !== session.providerSessionId
+  ) {
+    return false
+  }
+  const uuid = readClaudeFrameString(message, 'uuid')
+  if (!uuid) {
+    return false
+  }
+
+  // Newer SDK frames carry the client uuid that caused a turn. A correlation
+  // value is authoritative: never fall back to queue order or content, since
+  // identical prompts may be in flight across a timeout boundary.
+  const userMessageUuid = readClaudeFrameString(message, 'user_message_uuid')
+  if (userMessageUuid) {
+    const exact = session.dispatchWaiters.find(
+      (candidate) => candidate.sentUuid === userMessageUuid
+    )
+    if (exact) {
+      settleWaiter(session, exact, uuid)
+      return isUserReplay && exact.dispatchSequence === session.dispatchSequence
+    }
+    const retired = session.retiredDispatchWaiters.find(
+      (candidate) => candidate.sentUuid === userMessageUuid
+    )
+    if (retired) {
+      forgetRetiredWaiter(session, retired)
+      return recoverLateIdentity(session, retired, uuid, isUserReplay)
+    }
+    return false
+  }
+
+  const exact = session.dispatchWaiters.find((candidate) => candidate.sentUuid === uuid)
+  if (exact) {
+    settleWaiter(session, exact, uuid)
+    return isUserReplay && exact.dispatchSequence === session.dispatchSequence
+  }
+  const retired = session.retiredDispatchWaiters.find((candidate) => candidate.sentUuid === uuid)
+  if (retired) {
+    forgetRetiredWaiter(session, retired)
+    return recoverLateIdentity(session, retired, uuid, isUserReplay)
+  }
+
+  if (isUserReplay) {
+    // Compatibility CLIs may mint a new replay uuid instead of echoing the
+    // client uuid. Content is an acceptable join only when it is the sole
+    // candidate on one side of the timeout boundary; with active and retired
+    // candidates present, identical prompts are intentionally left unknown.
+    const replayContentKey = claudeDispatchContentKey(envelope.content)
+    if (!session.replayContentFallbackBlocked && session.retiredDispatchWaiters.length === 0) {
+      const compatible = session.dispatchWaiters.filter(
+        (candidate) => candidate.replayContentKey === replayContentKey
+      )
+      if (compatible.length === 1) {
+        settleWaiter(session, compatible[0]!, uuid)
+        return compatible[0]!.dispatchSequence === session.dispatchSequence
+      }
+    } else if (!session.replayContentFallbackBlocked && session.dispatchWaiters.length === 0) {
+      const lateCompatible = session.retiredDispatchWaiters.filter(
+        (candidate) => candidate.replayContentKey === replayContentKey
+      )
+      if (lateCompatible.length === 1) {
+        const [candidate] = lateCompatible
+        forgetRetiredWaiter(session, candidate!)
+        return recoverLateIdentity(session, candidate!, uuid, true)
+      }
+    }
+    return false
+  }
+  const current = session.dispatchWaiters[0]
+  if (isCompletedCommand && !current?.acceptsResult) {
+    return false
+  }
+  // A legacy result has no dispatch correlation. Any retired waiter makes queue order ambiguous,
+  // even when the retired dispatch was an ordinary turn rather than a slash command.
+  if (isCompletedCommand && session.retiredDispatchWaiters.length > 0) {
+    return false
+  }
+  // Once an eviction occurred, a fresh result uuid cannot be joined to a waiter by queue order.
+  if (isCompletedCommand && session.replayContentFallbackBlocked) {
+    return false
+  }
+  const waiter = uuid ? session.dispatchWaiters.shift() : undefined
+  if (waiter && uuid) {
+    clearTimeout(waiter.timer)
+    waiter.settledUuid = uuid
+    waiter.resolve(uuid)
+    return isUserReplay
+  }
+  return false
+}
+
+function settleWaiter(session: ClaudeSession, waiter: ClaudeDispatchWaiter, uuid: string): void {
+  const index = session.dispatchWaiters.indexOf(waiter)
+  if (index !== -1) {
+    session.dispatchWaiters.splice(index, 1)
+  }
+  clearTimeout(waiter.timer)
+  waiter.settledUuid = uuid
+  waiter.resolve(uuid)
+}
+
+function forgetRetiredWaiter(session: ClaudeSession, waiter: ClaudeDispatchWaiter): void {
+  const index = session.retiredDispatchWaiters.indexOf(waiter)
+  if (index !== -1) {
+    session.retiredDispatchWaiters.splice(index, 1)
+  }
+}
+
+function recoverLateIdentity(
+  session: ClaudeSession,
+  waiter: ClaudeDispatchWaiter,
+  uuid: string,
+  isUserReplay: boolean
+): boolean {
+  if (!isUserReplay && !waiter.acceptsResult) {
+    return false
+  }
+  if (waiter.dispatchSequence === session.dispatchSequence) {
+    session.activeTurnId = uuid
+    session.activeTurnSequence = waiter.dispatchSequence
+  }
+  return isUserReplay && waiter.dispatchSequence === session.dispatchSequence
+}
+
+function waitForReplay(
+  session: ClaudeSession,
+  timeoutMs: number,
+  acceptsResult: boolean,
+  sentUuid: string,
+  replayContentKey: string
+): { waiter: ClaudeDispatchWaiter; promise: Promise<string | null> } {
+  let waiter!: ClaudeDispatchWaiter
+  const promise = new Promise<string | null>((resolve) => {
+    waiter = {
+      acceptsResult,
+      sentUuid,
+      dispatchSequence: session.dispatchSequence,
+      replayContentKey,
+      resolve,
+      timer: setTimeout(() => {
+        const index = session.dispatchWaiters.indexOf(waiter)
+        if (index !== -1) {
+          session.dispatchWaiters.splice(index, 1)
+        }
+        retireWaiter(session, waiter)
+        resolve(null)
+      }, timeoutMs)
+    }
+    waiter.timer.unref?.()
+    session.dispatchWaiters.push(waiter)
+  })
+  return { waiter, promise }
+}
+
+function retireWaiter(session: ClaudeSession, waiter: ClaudeDispatchWaiter): void {
+  const index = session.dispatchWaiters.indexOf(waiter)
+  if (index !== -1) {
+    session.dispatchWaiters.splice(index, 1)
+  }
+  clearTimeout(waiter.timer)
+  if (!waiter.retired) {
+    waiter.retired = true
+    session.retiredDispatchWaiters.push(waiter)
+    if (session.retiredDispatchWaiters.length > MAX_RETIRED_DISPATCH_WAITERS) {
+      session.replayContentFallbackBlocked = true
+      session.retiredDispatchWaiters.splice(
+        0,
+        session.retiredDispatchWaiters.length - MAX_RETIRED_DISPATCH_WAITERS
+      )
+    }
+  }
+}
+
+export async function dispatchClaudeTurn(
+  session: ClaudeSession,
+  input: { clientMessageId: string; body: AgentJournalMessageItem },
+  timeoutMs: number
+): Promise<AgentSessionDispatchOutcome> {
+  let content: unknown[]
+  try {
+    content = await claudeDispatchMessageContent(input.body)
+  } catch (error) {
+    return { state: 'rejected', reason: (error as Error).message }
+  }
+  const dispatchSequence = ++session.dispatchSequence
+  const acceptsResult = input.body.blocks.some(
+    (block) => block.type === 'text' && block.text.trimStart().startsWith('/')
+  )
+  const sentUuid = randomUUID()
+  const replay = waitForReplay(
+    session,
+    timeoutMs,
+    acceptsResult,
+    sentUuid,
+    claudeDispatchContentKey(content)
+  )
+  const replayed = replay.promise
+  try {
+    await session.connection.send({
+      type: 'user',
+      uuid: sentUuid,
+      message: { role: 'user', content },
+      parent_tool_use_id: null,
+      session_id: session.providerSessionId
+    })
+  } catch (error) {
+    const waiter = replay.waiter
+    if (waiter.settledUuid) {
+      const uuid = await replayed
+      if (uuid) {
+        session.activeTurnId = uuid
+        session.activeTurnSequence = dispatchSequence
+        return {
+          state: 'accepted',
+          providerIdentity: { provider: 'claude', sessionId: session.providerSessionId, uuid }
+        }
+      }
+    }
+    if (!waiter.retired) {
+      retireWaiter(session, waiter)
+      waiter.resolve(null)
+    }
+    return { state: 'unknown', reason: (error as Error).message }
+  }
+  const uuid = await replayed
+  if (uuid) {
+    session.activeTurnId = uuid
+    session.activeTurnSequence = dispatchSequence
+  }
+  return uuid
+    ? {
+        state: 'accepted',
+        providerIdentity: { provider: 'claude', sessionId: session.providerSessionId, uuid }
+      }
+    : { state: 'unknown', reason: 'claude accepted a message but did not replay its uuid in time' }
+}
diff --git a/src/main/claude/claude-structured-effort-reporting.test.ts b/src/main/claude/claude-structured-effort-reporting.test.ts
new file mode 100644
index 00000000000..be022d86956
--- /dev/null
+++ b/src/main/claude/claude-structured-effort-reporting.test.ts
@@ -0,0 +1,257 @@
+import { describe, expect, it } from 'vitest'
+import { AgentSessionOptionRejectedError } from '../native-chat/agent-session-wire/structured-agent-session-option-error'
+import {
+  restoreClaudeStructuredSessionOptions,
+  setClaudeStructuredOption
+} from './claude-structured-options'
+import { readClaudeSettingsEffort } from './claude-structured-session-options'
+import type { ClaudeSession } from './claude-structured-session-state'
+import type { ClaudeStructuredSessionEvent } from './claude-structured-session-adapter'
+import { acquired, fakeClaude } from './claude-structured-session-test-support'
+
+/** Verbatim from Claude Code 2.1.258's get_settings response. */
+const REAL_SETTINGS = {
+  applied: { model: 'claude-opus-5[1m]', effort: 'high', advisor: null, ultracode: false },
+  effective: { model: 'claude-opus-5[1m]', effortLevel: 'high', env: {} },
+  sources: {}
+}
+
+function sessionWith(
+  reported: string | null,
+  calls: string[] = [],
+  listed?: { model: string; catalog: readonly Record<string, unknown>[] }
+) {
+  return {
+    session: {
+      options: new Map<string, string>(listed ? [['model', listed.model]] : []),
+      reportedOptions: {} as { model?: string; effort?: string },
+      optionMutationSequence: 0,
+      reportedModelMutation: 0,
+      confirmedOptions: new Set<string>(),
+      restoreSkippedOptions: new Set<string>(),
+      connection: {
+        supportedModels: async () => {
+          calls.push('list_models')
+          return [...(listed?.catalog ?? [])]
+        },
+        setModel: async (model: string) => {
+          calls.push(`set_model:${model}`)
+        },
+        applyFlagSettings: async (settings: { effortLevel?: string }) => {
+          // The measured behaviour: an unknown effort is accepted and ignored.
+          calls.push(`apply:${settings.effortLevel}`)
+        },
+        getSettings: async () => {
+          calls.push('get_settings')
+          return reported === null
+            ? { applied: {}, effective: {}, sources: {} }
+            : { applied: { effort: reported }, effective: { effortLevel: reported }, sources: {} }
+        }
+      }
+    } as unknown as ClaudeSession,
+    calls
+  }
+}
+
+describe('Claude effort reporting', () => {
+  it('reads the effort get_settings reports', () => {
+    expect(readClaudeSettingsEffort(REAL_SETTINGS)).toBe('high')
+  })
+
+  it.each([
+    [
+      'the provider stops reporting it',
+      { applied: { effort: 'high' }, effective: {}, sources: {} }
+    ],
+    ['the payload carries no effective block', { applied: { effort: 'high' } }],
+    ['the request failed outright', null]
+  ])('reports no effort when %s', (_case, settings) => {
+    // Never defaulted: an effort nothing measured would be worse than a blank
+    // pill, and this is the assertion that goes red if the key is renamed.
+    expect(readClaudeSettingsEffort(settings)).toBeNull()
+  })
+
+  it('publishes the effort from get_settings, which system/init never carries', async () => {
+    const claude = fakeClaude({ settings: REAL_SETTINGS })
+    const adapter = await acquired(claude)
+
+    await expect(adapter.readOptions({ sessionId: 'session-1', fence: 7 })).resolves.toMatchObject({
+      current: { effort: 'high' }
+    })
+  })
+
+  it('leaves the effort unreported when the session never learns one', async () => {
+    const claude = fakeClaude({ settings: { applied: {}, effective: {}, sources: {} } })
+    const adapter = await acquired(claude)
+
+    const options = await adapter.readOptions({ sessionId: 'session-1', fence: 7 })
+    expect(options.current.effort).toBeUndefined()
+    expect(options.current.model).toBeTruthy()
+  })
+
+  it('keeps the init fixture free of an effort the real frame never sends', async () => {
+    const events: ClaudeStructuredSessionEvent[] = []
+    await acquired(fakeClaude(), {}, events)
+    const init = events.flatMap((event) =>
+      event.type === 'message' && event.message.subtype === 'init' ? [event.message] : []
+    )
+
+    expect(init).toHaveLength(1)
+    expect(init[0]).toHaveProperty('model')
+    // The regression that hid this defect: a fixture inventing `effortLevel`
+    // kept every gate green over a value that is always empty in production.
+    expect(Object.keys(init[0])).not.toContain('effortLevel')
+  })
+})
+
+describe('Claude effort readback', () => {
+  it('records an effort the child did not adopt without vouching for it', async () => {
+    const { session, calls } = sessionWith('high')
+
+    // The disagreement stops the confirmation, not the write: no other client
+    // vetoes here, and the pre-flight catalog guard already refuses the levels
+    // the model cannot run.
+    await expect(
+      setClaudeStructuredOption(session, { key: 'effort', value: 'bogus-effort-xyz' }, undefined)
+    ).resolves.toEqual({ effort: 'bogus-effort-xyz' })
+    expect(session.confirmedOptions.has('effort')).toBe(false)
+    // The child's own answer is kept rather than discarded with the refusal.
+    expect(session.reportedOptions.effort).toBe('high')
+    expect(calls).toEqual(['apply:bogus-effort-xyz', 'get_settings'])
+  })
+
+  it('records an effort the child confirms', async () => {
+    const { session } = sessionWith('low')
+
+    await expect(
+      setClaudeStructuredOption(session, { key: 'effort', value: 'low' }, undefined)
+    ).resolves.toEqual({ effort: 'low' })
+  })
+
+  it('records the request when the readback is unavailable', async () => {
+    // No evidence of a refusal is not evidence of one; the apply itself succeeded.
+    const { session } = sessionWith(null)
+
+    await expect(
+      setClaudeStructuredOption(session, { key: 'effort', value: 'low' }, undefined)
+    ).resolves.toEqual({ effort: 'low' })
+  })
+})
+
+describe('Claude effort against the model that must run it', () => {
+  const HAIKU = { value: 'haiku', resolvedModel: 'claude-haiku-4-5-20251001', displayName: 'Haiku' }
+  const SONNET = {
+    value: 'sonnet',
+    resolvedModel: 'claude-sonnet-5',
+    displayName: 'Sonnet',
+    supportsEffort: true,
+    supportedEffortLevels: ['low', 'medium', 'high', 'xhigh', 'max']
+  }
+
+  it('refuses an effort the current model advertises no control for', async () => {
+    const { session, calls } = sessionWith('high', [], { model: 'haiku', catalog: [HAIKU, SONNET] })
+
+    await expect(
+      setClaudeStructuredOption(session, { key: 'effort', value: 'high' }, undefined)
+    ).rejects.toBeInstanceOf(AgentSessionOptionRejectedError)
+    // Measured on Claude Code 2.1.260: apply_flag_settings stores `high` on a
+    // haiku session and get_settings reads it straight back, so a send here is
+    // never undone. The refusal has to land before the write.
+    expect(calls).toEqual(['list_models'])
+    expect(session.options.has('effort')).toBe(false)
+  })
+
+  it('refuses a level outside the ones the current model advertises', async () => {
+    const { session } = sessionWith('high', [], {
+      model: 'sonnet',
+      catalog: [{ ...SONNET, supportedEffortLevels: ['low', 'medium'] }]
+    })
+
+    await expect(
+      setClaudeStructuredOption(session, { key: 'effort', value: 'high' }, undefined)
+    ).rejects.toBeInstanceOf(AgentSessionOptionRejectedError)
+  })
+
+  it('sends an effort the current model advertises', async () => {
+    const { session, calls } = sessionWith('high', [], {
+      model: 'sonnet',
+      catalog: [HAIKU, SONNET]
+    })
+
+    await expect(
+      setClaudeStructuredOption(session, { key: 'effort', value: 'high' }, undefined)
+    ).resolves.toEqual({ model: 'sonnet', effort: 'high' })
+    expect(calls).toEqual(['list_models', 'apply:high', 'get_settings'])
+    expect(session.confirmedOptions.has('effort')).toBe(true)
+  })
+
+  it('sends `max`, which the readback cannot report, when the model advertises it', async () => {
+    // UNREPORTED_EFFORTS still governs: no get_settings, so no false disagreement.
+    const { session, calls } = sessionWith('high', [], { model: 'sonnet', catalog: [SONNET] })
+
+    await expect(
+      setClaudeStructuredOption(session, { key: 'effort', value: 'max' }, undefined)
+    ).resolves.toEqual({ model: 'sonnet', effort: 'max' })
+    expect(calls).toEqual(['list_models', 'apply:max'])
+    expect(session.confirmedOptions.has('effort')).toBe(false)
+  })
+
+  it('sends the effort when the model is not in the catalog the CLI listed', async () => {
+    // An unlisted model is an unknown one, not one that refuses effort.
+    const { session, calls } = sessionWith('high', [], { model: 'sonnet', catalog: [HAIKU] })
+
+    await expect(
+      setClaudeStructuredOption(session, { key: 'effort', value: 'high' }, undefined)
+    ).resolves.toEqual({ model: 'sonnet', effort: 'high' })
+    expect(calls).toEqual(['list_models', 'apply:high', 'get_settings'])
+  })
+
+  it('sends the effort when list_models is unavailable', async () => {
+    const calls: string[] = []
+    const { session } = sessionWith('high', calls, { model: 'sonnet', catalog: [] })
+    session.connection.supportedModels = async () => {
+      calls.push('list_models')
+      throw new Error('this CLI predates list_models')
+    }
+
+    await expect(
+      setClaudeStructuredOption(session, { key: 'effort', value: 'high' }, undefined)
+    ).resolves.toEqual({ model: 'sonnet', effort: 'high' })
+    expect(calls).toEqual(['list_models', 'apply:high', 'get_settings'])
+  })
+
+  it('matches the model the init frame reported, not just the id the user picked', async () => {
+    const { session } = sessionWith('high', [], { model: 'sonnet', catalog: [HAIKU, SONNET] })
+    session.options.delete('model')
+    session.reportedOptions.model = 'claude-haiku-4-5-20251001'
+
+    await expect(
+      setClaudeStructuredOption(session, { key: 'effort', value: 'high' }, undefined)
+    ).rejects.toBeInstanceOf(AgentSessionOptionRejectedError)
+  })
+
+  it('keeps a disagreeing effort through restore instead of skipping it', async () => {
+    const calls: string[] = []
+    const { session } = sessionWith('high', calls, { model: 'sonnet', catalog: [SONNET] })
+    session.options.set('effort', 'low')
+
+    await restoreClaudeStructuredSessionOptions(session, undefined)
+
+    expect(session.options.get('effort')).toBe('low')
+    expect(session.restoreSkippedOptions.has('effort')).toBe(false)
+    expect(session.confirmedOptions.has('effort')).toBe(false)
+  })
+
+  it('drops a stale effort on restore instead of replaying it onto the new model', async () => {
+    const calls: string[] = []
+    const { session } = sessionWith('high', calls, { model: 'sonnet', catalog: [HAIKU, SONNET] })
+    session.options.set('model', 'haiku')
+    session.options.set('effort', 'high')
+
+    await restoreClaudeStructuredSessionOptions(session, undefined)
+
+    expect(session.options.has('effort')).toBe(false)
+    expect(session.restoreSkippedOptions.has('effort')).toBe(true)
+    expect(calls.filter((call) => call.startsWith('apply:'))).toEqual([])
+  })
+})
diff --git a/src/main/claude/claude-structured-inbound-control.test.ts b/src/main/claude/claude-structured-inbound-control.test.ts
new file mode 100644
index 00000000000..07be4bbb516
--- /dev/null
+++ b/src/main/claude/claude-structured-inbound-control.test.ts
@@ -0,0 +1,164 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { CanUseTool } from '@anthropic-ai/claude-agent-sdk'
+import { ClaudePromptRegistry } from './claude-structured-prompt-replies'
+import {
+  buildClaudePermissionCallbacks,
+  CLAUDE_BLOCKING_CONTROL_CALLBACKS,
+  CLAUDE_CAN_USE_TOOL_SUBTYPE,
+  CLAUDE_REQUEST_USER_DIALOG_SUBTYPE
+} from './claude-structured-inbound-control'
+
+type CanUseToolOptions = Parameters<CanUseTool>[2]
+
+function permissionOptions(
+  requestId: string,
+  toolUseID: string,
+  signal: AbortSignal,
+  suggestions?: unknown[]
+): CanUseToolOptions {
+  return {
+    requestId,
+    toolUseID,
+    signal,
+    ...(suggestions ? { suggestions } : {})
+  } as unknown as CanUseToolOptions
+}
+
+function callbacksFor() {
+  const prompts = new ClaudePromptRegistry()
+  const emit = vi.fn()
+  const { canUseTool, onUserDialog } = buildClaudePermissionCallbacks({
+    sessionId: 'session-1',
+    prompts,
+    emit
+  })
+  return { prompts, emit, canUseTool, onUserDialog }
+}
+
+describe('Claude permission callbacks', () => {
+  it('registers a decodable can_use_tool as a durable prompt and settles it from the registry', async () => {
+    const control = callbacksFor()
+    const answered = control.canUseTool(
+      'Bash',
+      { command: 'git status' },
+      permissionOptions('perm-1', 'tool-1', new AbortController().signal, [{ type: 'addRules' }])
+    )
+
+    expect(control.emit).toHaveBeenCalledWith(
+      expect.objectContaining({
+        type: 'prompt',
+        sessionId: 'session-1',
+        prompt: expect.objectContaining({ promptKey: 'perm-1', toolName: 'Bash', kind: 'approval' })
+      })
+    )
+    const found = control.prompts.find('perm-1')
+    expect(found?.prompt.suggestions).toEqual([{ type: 'addRules' }])
+    // The prompt's settle is the SDK callback's own resolve — answering resolves this promise.
+    found?.prompt.settle({ behavior: 'allow', toolUseID: 'tool-1' })
+    await expect(answered).resolves.toEqual({ behavior: 'allow', toolUseID: 'tool-1' })
+  })
+
+  it('denies a malformed permission request without registering a prompt', async () => {
+    const control = callbacksFor()
+    const answered = control.canUseTool(
+      '',
+      {},
+      permissionOptions('perm-2', 'tool-2', new AbortController().signal)
+    )
+
+    await expect(answered).resolves.toEqual({
+      behavior: 'deny',
+      message: 'Orca could not decode this permission request.',
+      toolUseID: 'tool-2'
+    })
+    expect(control.prompts.find('perm-2')).toBeNull()
+    expect(control.emit).not.toHaveBeenCalled()
+  })
+
+  it('settles a pending prompt with null and forgets it when the abort signal fires', async () => {
+    const control = callbacksFor()
+    const controller = new AbortController()
+    const answered = control.canUseTool(
+      'Bash',
+      { command: 'ls' },
+      permissionOptions('perm-3', 'tool-3', controller.signal)
+    )
+    expect(control.prompts.find('perm-3')).not.toBeNull()
+
+    controller.abort()
+
+    await expect(answered).resolves.toBeNull()
+    expect(control.emit).toHaveBeenLastCalledWith(
+      expect.objectContaining({ type: 'prompt-cancelled', promptKey: 'perm-3' })
+    )
+    // Forgotten: a late answer can no longer find the prompt to authorize the wrong tool.
+    expect(control.prompts.find('perm-3')).toBeNull()
+  })
+
+  it('cancels a request whose abort raced ahead of delivery without emitting a prompt', async () => {
+    const control = callbacksFor()
+    const controller = new AbortController()
+    controller.abort()
+
+    const answered = control.canUseTool(
+      'Bash',
+      { command: 'ls' },
+      permissionOptions('perm-4', 'tool-4', controller.signal)
+    )
+
+    await expect(answered).resolves.toBeNull()
+    expect(control.prompts.find('perm-4')).toBeNull()
+    expect(control.emit).toHaveBeenCalledTimes(1)
+    expect(control.emit).toHaveBeenCalledWith(
+      expect.objectContaining({ type: 'prompt-cancelled', promptKey: 'perm-4' })
+    )
+  })
+
+  it('settles every in-flight prompt with null when the registry is cleared', async () => {
+    const control = callbacksFor()
+    const first = control.canUseTool(
+      'Bash',
+      { command: 'a' },
+      permissionOptions('perm-5', 'tool-5', new AbortController().signal)
+    )
+    const second = control.canUseTool(
+      'Bash',
+      { command: 'b' },
+      permissionOptions('perm-6', 'tool-6', new AbortController().signal)
+    )
+
+    // What session close does: settle each pending callback so no promise dangles.
+    for (const prompt of control.prompts.clear()) {
+      prompt.settle(null)
+    }
+
+    await expect(first).resolves.toBeNull()
+    await expect(second).resolves.toBeNull()
+  })
+
+  it('answers a user dialog deny-safe', async () => {
+    const control = callbacksFor()
+    await expect(
+      control.onUserDialog(
+        { dialogKind: 'refusal_fallback_prompt', payload: {} },
+        { signal: new AbortController().signal, requestId: 'dialog-1' }
+      )
+    ).resolves.toEqual({ behavior: 'cancelled' })
+  })
+
+  it('enumerates every blocking control request and wires a callback for each', () => {
+    // The stable surface of controls a turn can block on. Adding one here without wiring its
+    // callback below fails this test rather than silently leaving a control unhandled.
+    expect(new Set(Object.keys(CLAUDE_BLOCKING_CONTROL_CALLBACKS))).toEqual(
+      new Set([CLAUDE_CAN_USE_TOOL_SUBTYPE, CLAUDE_REQUEST_USER_DIALOG_SUBTYPE])
+    )
+    const callbacks = buildClaudePermissionCallbacks({
+      sessionId: 'session-1',
+      prompts: new ClaudePromptRegistry(),
+      emit: vi.fn()
+    }) as unknown as Record<string, unknown>
+    for (const callbackName of Object.values(CLAUDE_BLOCKING_CONTROL_CALLBACKS)) {
+      expect(typeof callbacks[callbackName], `${callbackName} must be wired`).toBe('function')
+    }
+  })
+})
diff --git a/src/main/claude/claude-structured-inbound-control.ts b/src/main/claude/claude-structured-inbound-control.ts
new file mode 100644
index 00000000000..343e76d4ea5
--- /dev/null
+++ b/src/main/claude/claude-structured-inbound-control.ts
@@ -0,0 +1,91 @@
+import type { CanUseTool, OnUserDialog, PermissionResult } from '@anthropic-ai/claude-agent-sdk'
+import type { ClaudePromptRegistry } from './claude-structured-prompt-replies'
+import type { ClaudeStructuredSessionEvent } from './claude-structured-session-state'
+
+export const CLAUDE_CAN_USE_TOOL_SUBTYPE = 'can_use_tool'
+export const CLAUDE_REQUEST_USER_DIALOG_SUBTYPE = 'request_user_dialog'
+
+/**
+ * The blocking control requests Orca answers, each mapped to the SDK consumer callback that
+ * answers it. This is the stable surface a real turn can block on: `can_use_tool` through
+ * `canUseTool` and `request_user_dialog` through `onUserDialog`. Every other control-request
+ * subtype the SDK routes (elicitation, oauth/host token refresh, mcp_message, hook_callback)
+ * is either not surfaced to this consumer or fails closed inside the SDK; adding a new
+ * blocking control Orca must answer means adding its callback here, and the catalog test
+ * fails if a named callback is missing.
+ */
+export const CLAUDE_BLOCKING_CONTROL_CALLBACKS = {
+  [CLAUDE_CAN_USE_TOOL_SUBTYPE]: 'canUseTool',
+  [CLAUDE_REQUEST_USER_DIALOG_SUBTYPE]: 'onUserDialog'
+} as const
+
+export type ClaudeBlockingControlSubtype = keyof typeof CLAUDE_BLOCKING_CONTROL_CALLBACKS
+
+export type ClaudePermissionCallbackDeps = {
+  sessionId: string
+  prompts: ClaudePromptRegistry
+  emit: (event: ClaudeStructuredSessionEvent) => void
+}
+
+function denySafeResult(toolUseId: string | undefined): PermissionResult {
+  return {
+    behavior: 'deny',
+    message: 'Orca could not decode this permission request.',
+    ...(toolUseId ? { toolUseID: toolUseId } : {})
+  }
+}
+
+/**
+ * Build the SDK permission callbacks from the durable prompt registry.
+ *
+ * A decodable `can_use_tool` becomes a durable prompt whose `settle` resolves this callback;
+ * a malformed one is denied without registering. The SDK's abort signal fires on
+ * `control_cancel_request` (a cancelled turn), which forgets the prompt and settles it with
+ * `null` — never authorizing a tool. A late answer after abort finds no prompt and is refused
+ * by `answerClaudePrompt`. `onUserDialog` is deny-safe; the CLI only emits dialog kinds Orca
+ * declares in `supportedDialogKinds`, which is empty.
+ */
+export function buildClaudePermissionCallbacks(deps: ClaudePermissionCallbackDeps): {
+  canUseTool: CanUseTool
+  onUserDialog: OnUserDialog
+} {
+  const canUseTool: CanUseTool = (toolName, input, options) =>
+    new Promise<PermissionResult | null>((resolve) => {
+      const prompt = deps.prompts.register({
+        requestId: options.requestId,
+        toolName,
+        toolUseId: options.toolUseID,
+        input,
+        suggestions: options.suggestions ?? [],
+        settle: resolve as (response: Record<string, unknown> | null) => void
+      })
+      if (!prompt) {
+        resolve(denySafeResult(options.toolUseID))
+        return
+      }
+      const cancel = (): void => {
+        if (deps.prompts.forgetIfPending(prompt)) {
+          deps.emit({
+            type: 'prompt-cancelled',
+            sessionId: deps.sessionId,
+            promptKey: prompt.promptKey
+          })
+          // Null is the SDK's "no response written" sentinel: a cancelled request must not
+          // be answered, only forgotten.
+          resolve(null)
+        }
+      }
+      if (options.signal.aborted) {
+        // No abort event can still fire, so registering a listener would park the callback
+        // forever behind a prompt nothing will answer.
+        cancel()
+        return
+      }
+      options.signal.addEventListener('abort', cancel, { once: true })
+      deps.emit({ type: 'prompt', sessionId: deps.sessionId, prompt })
+    })
+
+  const onUserDialog: OnUserDialog = () => Promise.resolve({ behavior: 'cancelled' })
+
+  return { canUseTool, onUserDialog }
+}
diff --git a/src/main/claude/claude-structured-init-deadline.ts b/src/main/claude/claude-structured-init-deadline.ts
new file mode 100644
index 00000000000..f3acd6c3af9
--- /dev/null
+++ b/src/main/claude/claude-structured-init-deadline.ts
@@ -0,0 +1,68 @@
+import type { ClaudeInitObservation } from './claude-structured-init-proof'
+import { claudeInitializationAuthError } from './claude-structured-init-proof'
+import type { ClaudeStreamJsonConnection } from './claude-stream-json-connection'
+import { AgentSessionAcquisitionRefusal } from '../native-chat/agent-session-wire/structured-agent-session-adapter'
+
+export type ClaudeInitDeadline = {
+  promise: Promise<ClaudeInitObservation>
+  resolve: (init: ClaudeInitObservation) => void
+  reject: (error: Error) => void
+  start: () => void
+  clear: () => void
+}
+
+export function claudeInitTimeoutError(
+  sessionId: string,
+  timeoutMs: number
+): AgentSessionAcquisitionRefusal {
+  return new AgentSessionAcquisitionRefusal(
+    `Claude did not finish starting session ${sessionId} within ${Math.ceil(timeoutMs / 1000)} seconds. Verify the selected Claude account is signed in and CLAUDE_CONFIG_DIR contains valid credentials, then retry; no SessionStart or system/init proof arrived.`
+  )
+}
+
+export async function requestClaudeInitialization(
+  connection: ClaudeStreamJsonConnection,
+  sessionId: string,
+  timeoutMs: number
+): Promise<unknown> {
+  try {
+    const result = await connection.initializationResult({ timeoutMs })
+    const authError = claudeInitializationAuthError(result)
+    if (authError) {
+      throw authError
+    }
+    return result
+  } catch (error) {
+    if (error instanceof Error && error.message === 'claude initialize request timed out') {
+      throw claudeInitTimeoutError(sessionId, timeoutMs)
+    }
+    throw error
+  }
+}
+
+export function createClaudeInitDeadline(sessionId: string, timeoutMs: number): ClaudeInitDeadline {
+  let resolve = (_init: ClaudeInitObservation): void => {}
+  let reject = (_error: Error): void => {}
+  const promise = new Promise<ClaudeInitObservation>((resolvePromise, rejectPromise) => {
+    resolve = resolvePromise
+    reject = rejectPromise
+  })
+  void promise.catch(() => {})
+  let timer: ReturnType<typeof setTimeout> | null = null
+
+  return {
+    promise,
+    resolve,
+    reject,
+    start: () => {
+      timer = setTimeout(() => reject(claudeInitTimeoutError(sessionId, timeoutMs)), timeoutMs)
+      timer.unref?.()
+    },
+    clear: () => {
+      if (timer) {
+        clearTimeout(timer)
+        timer = null
+      }
+    }
+  }
+}
diff --git a/src/main/claude/claude-structured-init-proof.ts b/src/main/claude/claude-structured-init-proof.ts
new file mode 100644
index 00000000000..c29cb2d4715
--- /dev/null
+++ b/src/main/claude/claude-structured-init-proof.ts
@@ -0,0 +1,88 @@
+import { CLAUDE_DEFAULT_SETTING_SOURCES } from './claude-structured-launch-resolution'
+import type { ClaudeAuthDiagnostic } from './claude-structured-session-state'
+import { AgentSessionAcquisitionRefusal } from '../native-chat/agent-session-wire/structured-agent-session-adapter'
+
+export type ClaudeInitObservation = {
+  providerSessionId: string
+  uuid: string | null
+  /** The resolved model id the CLI reports it is running; only `system/init` carries it. */
+  model: string | null
+  message: Record<string, unknown>
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+export function readClaudeFrameString(source: Record<string, unknown>, key: string): string | null {
+  const value = source[key]
+  return typeof value === 'string' && value.length > 0 ? value : null
+}
+
+export function readClaudeInit(message: Record<string, unknown>): ClaudeInitObservation | null {
+  const hookName = readClaudeFrameString(message, 'hook_name')
+  const isInit = message.type === 'system' && message.subtype === 'init'
+  const isSessionStart =
+    message.type === 'system' &&
+    (message.subtype === 'hook_started' || message.subtype === 'hook_response') &&
+    hookName?.startsWith('SessionStart:') === true
+  if (!isInit && !isSessionStart) {
+    return null
+  }
+  const providerSessionId = readClaudeFrameString(message, 'session_id')
+  return providerSessionId
+    ? {
+        providerSessionId,
+        uuid: isInit ? readClaudeFrameString(message, 'uuid') : null,
+        model: isInit ? readClaudeFrameString(message, 'model') : null,
+        message
+      }
+    : null
+}
+
+export function readClaudeModels(initialization: unknown): unknown[] {
+  return isRecord(initialization) && Array.isArray(initialization.models)
+    ? initialization.models
+    : []
+}
+
+/** CLI capabilities advertised on the initialize result or the yielded system/init frame. */
+export function readClaudeCapabilities(
+  init: ClaudeInitObservation,
+  initialization: unknown
+): string[] {
+  const fromResult = isRecord(initialization) ? initialization.capabilities : undefined
+  const fromFrame = init.message.capabilities
+  const source = Array.isArray(fromResult) ? fromResult : Array.isArray(fromFrame) ? fromFrame : []
+  return source.filter((value): value is string => typeof value === 'string')
+}
+
+export function claudeInitializationAuthError(
+  initialization: unknown
+): AgentSessionAcquisitionRefusal | null {
+  const account =
+    isRecord(initialization) && isRecord(initialization.account) ? initialization.account : null
+  return readClaudeFrameString(account ?? {}, 'tokenSource') === 'none'
+    ? new AgentSessionAcquisitionRefusal(
+        'Claude is not signed in for the selected account. Sign in with the Claude CLI for this CLAUDE_CONFIG_DIR, then retry.'
+      )
+    : null
+}
+
+export function claudeAuthDiagnostic(
+  init: ClaudeInitObservation,
+  settings: unknown
+): ClaudeAuthDiagnostic {
+  const env = isRecord(settings) && isRecord(settings.env) ? settings.env : {}
+  const apiKeySource = readClaudeFrameString(init.message, 'apiKeySource')
+  const configured = (key: string): boolean =>
+    (typeof env[key] === 'string' && (env[key] as string).trim().length > 0) ||
+    Boolean(process.env[key]?.trim())
+  return {
+    apiKeySourceConfigured: apiKeySource !== null && apiKeySource !== 'none',
+    baseUrlConfigured: configured('ANTHROPIC_BASE_URL'),
+    authTokenConfigured: configured('ANTHROPIC_AUTH_TOKEN'),
+    apiKeyConfigured: configured('ANTHROPIC_API_KEY'),
+    settingSources: CLAUDE_DEFAULT_SETTING_SOURCES
+  }
+}
diff --git a/src/main/claude/claude-structured-item-translation.ts b/src/main/claude/claude-structured-item-translation.ts
new file mode 100644
index 00000000000..d86093ee0a5
--- /dev/null
+++ b/src/main/claude/claude-structured-item-translation.ts
@@ -0,0 +1,179 @@
+import type {
+  AgentJournalItemBody,
+  AgentJournalItemIdentity,
+  AgentJournalMessageItem
+} from '../../shared/agent-session-journal-types'
+import type { NativeChatBlock } from '../../shared/native-chat-types'
+import {
+  boundInlineText,
+  DEFAULT_JOURNAL_PAYLOAD_LIMITS
+} from '../native-chat/agent-session-journal/journal-payload-bounds'
+
+export type ClaudeMessageEnvelope = {
+  sessionId: string
+  uuid: string
+  role: 'assistant' | 'user'
+  content: unknown[]
+  /** Messages API id shared by every frame of one streamed assistant message. */
+  messageId: string | null
+  parentToolUseId: string | null
+}
+
+export type ClaudeToolUse = { id: string; name: string; input: unknown }
+export type ClaudeToolResult = { toolUseId: string; output: string; failed: boolean }
+
+export function claudeRecord(value: unknown): Record<string, unknown> | null {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : null
+}
+
+export function claudeText(value: unknown): string | null {
+  return typeof value === 'string' && value.length > 0 ? value : null
+}
+
+export function readClaudeMessageEnvelope(
+  frame: Record<string, unknown>
+): ClaudeMessageEnvelope | null {
+  if (frame.type !== 'assistant' && frame.type !== 'user') {
+    return null
+  }
+  const message = claudeRecord(frame.message)
+  const sessionId = claudeText(frame.session_id)
+  const uuid = claudeText(frame.uuid)
+  const role = message?.role
+  return sessionId && uuid && (role === 'assistant' || role === 'user')
+    ? {
+        sessionId,
+        uuid,
+        role,
+        content: messageContent(message?.content),
+        messageId: claudeText(message?.id),
+        parentToolUseId: claudeText(frame.parent_tool_use_id)
+      }
+    : null
+}
+
+// A user replay may carry its text as a bare string (MessageParam), not blocks.
+function messageContent(content: unknown): unknown[] {
+  if (Array.isArray(content)) {
+    return content
+  }
+  const text = claudeText(content)
+  return text ? [{ type: 'text', text }] : []
+}
+
+export function claudeMessageIdentity(
+  envelope: Pick<ClaudeMessageEnvelope, 'sessionId' | 'uuid'>
+): AgentJournalItemIdentity {
+  return { provider: 'claude', sessionId: envelope.sessionId, uuid: envelope.uuid }
+}
+
+function messageBlocks(envelope: ClaudeMessageEnvelope): NativeChatBlock[] {
+  const blocks: NativeChatBlock[] = []
+  for (const value of envelope.content) {
+    const part = claudeRecord(value)
+    const text = claudeText(part?.text)
+    if (part?.type === 'text' && text) {
+      blocks.push({ type: 'text', text })
+      continue
+    }
+    const source = claudeRecord(part?.source)
+    const url = claudeText(source?.url)
+    if (part?.type === 'image' && source?.type === 'url' && url) {
+      blocks.push({ type: 'image-ref', url })
+    }
+  }
+  return blocks
+}
+
+export function claudeMessageBody(envelope: ClaudeMessageEnvelope): AgentJournalMessageItem | null {
+  const blocks = messageBlocks(envelope)
+  return blocks.length > 0 ? { kind: 'message', role: envelope.role, blocks } : null
+}
+
+export function claudeHasReplayContent(envelope: ClaudeMessageEnvelope): boolean {
+  return envelope.content.some((value) => {
+    const part = claudeRecord(value)
+    return part !== null && part.type !== 'tool_result'
+  })
+}
+
+export function claudeToolUses(envelope: ClaudeMessageEnvelope): ClaudeToolUse[] {
+  return envelope.content.flatMap((value) => {
+    const part = claudeRecord(value)
+    const id = claudeText(part?.id)
+    const name = claudeText(part?.name)
+    return part?.type === 'tool_use' && id && name ? [{ id, name, input: part.input ?? null }] : []
+  })
+}
+
+function resultText(value: unknown): string {
+  if (typeof value === 'string') {
+    return value
+  }
+  if (!Array.isArray(value)) {
+    return value === undefined ? '' : JSON.stringify(value)
+  }
+  return value
+    .flatMap((entry) => {
+      if (typeof entry === 'string') {
+        return [entry]
+      }
+      const part = claudeRecord(entry)
+      return part?.type === 'text' && typeof part.text === 'string' ? [part.text] : []
+    })
+    .join('\n')
+}
+
+export function claudeToolResults(envelope: ClaudeMessageEnvelope): ClaudeToolResult[] {
+  return envelope.content.flatMap((value) => {
+    const part = claudeRecord(value)
+    const toolUseId = claudeText(part?.tool_use_id)
+    return part?.type === 'tool_result' && toolUseId
+      ? [
+          {
+            toolUseId,
+            output: resultText(part.content),
+            failed: part.is_error === true
+          }
+        ]
+      : []
+  })
+}
+
+export function claudeThinkingText(envelope: ClaudeMessageEnvelope): string | null {
+  const parts = envelope.content.flatMap((value) => {
+    const part = claudeRecord(value)
+    const thinking = claudeText(part?.thinking)
+    return part?.type === 'thinking' && thinking ? [thinking] : []
+  })
+  return parts.length > 0 ? parts.join('\n') : null
+}
+
+export function claudeToolBody(input: {
+  tool: ClaudeToolUse
+  result?: ClaudeToolResult
+}): AgentJournalItemBody {
+  return {
+    kind: 'tool-call',
+    name: input.tool.name,
+    input: input.tool.input,
+    state: input.result ? (input.result.failed ? 'failed' : 'completed') : 'running',
+    ...(input.result
+      ? { output: boundInlineText(input.result.output, DEFAULT_JOURNAL_PAYLOAD_LIMITS).bounded }
+      : {})
+  }
+}
+
+export function claudeStreamingMessageBody(text: string): AgentJournalMessageItem {
+  return { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text }] }
+}
+
+export function claudeToolIdentity(sessionId: string, toolUseId: string): AgentJournalItemIdentity {
+  return { provider: 'orca', clientMessageId: `claude-tool:${sessionId}:${toolUseId}` }
+}
+
+export function claudeThinkingIdentity(sessionId: string, uuid: string): AgentJournalItemIdentity {
+  return { provider: 'orca', clientMessageId: `claude-thinking:${sessionId}:${uuid}` }
+}
diff --git a/src/main/claude/claude-structured-journal-translation.test.ts b/src/main/claude/claude-structured-journal-translation.test.ts
new file mode 100644
index 00000000000..f403313dae8
--- /dev/null
+++ b/src/main/claude/claude-structured-journal-translation.test.ts
@@ -0,0 +1,811 @@
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type {
+  AgentJournalItemBody,
+  AgentJournalItemIdentity,
+  AgentJournalRenderItem,
+  AgentSessionJournalIdentity
+} from '../../shared/agent-session-journal-types'
+import { agentJournalItemKey } from '../../shared/agent-session-journal-item-key'
+import { activeStructuredAgentSessionTurnId } from '../../shared/structured-agent-session-projection'
+import { openAgentSessionJournal } from '../native-chat/agent-session-journal/journal-store-factory'
+import {
+  createDeferredStructuredAgentSessionEventSink,
+  type StructuredAgentSessionEventSink
+} from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
+import {
+  boundInlineText,
+  DEFAULT_JOURNAL_PAYLOAD_LIMITS
+} from '../native-chat/agent-session-journal/journal-payload-bounds'
+import type { ClaudePendingPrompt } from './claude-structured-prompt-replies'
+import { createClaudeJournalTranslator } from './claude-structured-journal-translation'
+
+function sinkState() {
+  const items: { identity: AgentJournalItemIdentity; body: AgentJournalItemBody }[] = []
+  const tombstones: AgentJournalItemIdentity[] = []
+  const sink: StructuredAgentSessionEventSink = {
+    appendItem: (identity, body) => items.push({ identity, body }),
+    appendTombstone: (identity) => tombstones.push(identity),
+    publish: vi.fn()
+  }
+  return { sink, items, tombstones }
+}
+
+function message(
+  type: 'assistant' | 'user',
+  uuid: string,
+  content: unknown[],
+  parentToolUseId: string | null = null
+) {
+  return {
+    type: 'message' as const,
+    sessionId: 'orca-session',
+    ...(type === 'user' && parentToolUseId === null ? { startsTurn: true as const } : {}),
+    message: {
+      type,
+      uuid,
+      session_id: 'claude-session',
+      parent_tool_use_id: parentToolUseId,
+      message: { role: type, content }
+    }
+  }
+}
+
+// Frames below follow the Claude Code 2.1.258 / SDK 0.3.251 partial-message
+// cadence captured from the real CLI: every stream_event carries its own uuid,
+// the final assistant frame for a block carries yet another, and only
+// message.id ties them together.
+function streamEvent(uuid: string, event: Record<string, unknown>) {
+  return {
+    type: 'message' as const,
+    sessionId: 'orca-session',
+    message: {
+      type: 'stream_event',
+      uuid,
+      session_id: 'claude-session',
+      parent_tool_use_id: null,
+      event
+    }
+  }
+}
+
+function resultFrame(subtype: string, fields: Record<string, unknown>) {
+  return {
+    type: 'message' as const,
+    sessionId: 'orca-session',
+    message: {
+      type: 'result',
+      subtype,
+      duration_ms: 1200,
+      duration_api_ms: 1100,
+      num_turns: 1,
+      session_id: 'claude-session',
+      uuid: `result-${subtype}`,
+      ...fields
+    }
+  }
+}
+
+/** One streamed text turn in wire order: message_start, the block's start frame,
+ *  one delta per chunk, the block's final assistant frame, the stop frames and
+ *  the success result. */
+function streamedTextTurn(input: {
+  messageId: string
+  startUuid: string
+  finalUuid: string
+  chunks: string[]
+}) {
+  const text = input.chunks.join('')
+  return {
+    start: [
+      streamEvent(`${input.messageId}-message-start`, {
+        type: 'message_start',
+        message: { id: input.messageId, role: 'assistant', content: [] }
+      }),
+      streamEvent(input.startUuid, {
+        type: 'content_block_start',
+        index: 0,
+        content_block: { type: 'text', text: '' }
+      })
+    ],
+    deltas: input.chunks.map((chunk, index) =>
+      streamEvent(`${input.messageId}-delta-${index}`, {
+        type: 'content_block_delta',
+        index: 0,
+        delta: { type: 'text_delta', text: chunk }
+      })
+    ),
+    final: {
+      type: 'message' as const,
+      sessionId: 'orca-session',
+      message: {
+        type: 'assistant',
+        uuid: input.finalUuid,
+        session_id: 'claude-session',
+        parent_tool_use_id: null,
+        message: {
+          id: input.messageId,
+          role: 'assistant',
+          content: [{ type: 'text', text }],
+          stop_reason: null
+        }
+      }
+    },
+    stop: [
+      streamEvent(`${input.messageId}-block-stop`, { type: 'content_block_stop', index: 0 }),
+      streamEvent(`${input.messageId}-message-delta`, {
+        type: 'message_delta',
+        delta: { stop_reason: 'end_turn' }
+      }),
+      streamEvent(`${input.messageId}-message-stop`, { type: 'message_stop' }),
+      resultFrame('success', {
+        is_error: false,
+        result: text,
+        stop_reason: 'end_turn',
+        terminal_reason: 'completed'
+      })
+    ],
+    text
+  }
+}
+
+function assistantMessages<T extends { body: AgentJournalItemBody }>(items: T[]): T[] {
+  return items.filter((item) => item.body.kind === 'message' && item.body.role === 'assistant')
+}
+
+function providerFrameKinds(items: { body: AgentJournalItemBody }[]): string[] {
+  return items.flatMap((item) =>
+    item.body.kind === 'status' && item.body.providerFrame ? [item.body.providerFrame.kind] : []
+  )
+}
+
+const JOURNAL_IDENTITY: AgentSessionJournalIdentity = {
+  sessionId: 'session-1',
+  workspaceId: 'workspace-1',
+  hostId: 'host-1',
+  agent: 'claude',
+  providerHandle: { kind: 'claude', sessionId: 'claude-session', leafUuid: 'leaf-1' }
+}
+
+let journalRoot = ''
+
+beforeEach(async () => {
+  journalRoot = await mkdtemp(join(tmpdir(), 'orca-claude-journal-translation-'))
+})
+
+afterEach(async () => {
+  await rm(journalRoot, { recursive: true, force: true })
+})
+
+describe('Claude structured journal translation', () => {
+  it('coalesces partial deltas onto the block identity and reconciles the final frame onto it', () => {
+    const state = sinkState()
+    let scheduled: (() => void) | null = null
+    const translator = createClaudeJournalTranslator({
+      sink: state.sink,
+      schedule: (run, delay) => {
+        expect(delay).toBe(60)
+        scheduled = run
+        return () => {
+          scheduled = null
+        }
+      }
+    })
+    const turn = streamedTextTurn({
+      messageId: 'msg_01',
+      startUuid: 'block-start-1',
+      finalUuid: 'assistant-final-1',
+      chunks: ['ST', 'REAMOK_ELEC_64E632']
+    })
+    const streamedIdentity = {
+      provider: 'claude',
+      sessionId: 'claude-session',
+      uuid: 'block-start-1'
+    }
+
+    for (const event of turn.start) {
+      translator.handle(event)
+    }
+    for (const delta of turn.deltas) {
+      translator.handle(delta)
+    }
+    expect(state.items).toEqual([])
+
+    const run = scheduled as (() => void) | null
+    run?.()
+    expect(state.items.at(-1)).toEqual({
+      identity: streamedIdentity,
+      body: { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text: turn.text }] }
+    })
+
+    translator.handle(turn.final)
+    for (const event of turn.stop) {
+      translator.handle(event)
+    }
+    const assistant = assistantMessages(state.items)
+    expect(assistant.at(-1)).toEqual({
+      identity: streamedIdentity,
+      body: { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text: turn.text }] }
+    })
+    expect(new Set(assistant.map((item) => agentJournalItemKey(item.identity))).size).toBe(1)
+    expect(providerFrameKinds(state.items)).toEqual([])
+  })
+
+  it('journals a count-to-200 stream as one assistant item carrying the complete reply', async () => {
+    const journal = await openAgentSessionJournal({
+      identity: JOURNAL_IDENTITY,
+      journalDir: journalRoot,
+      now: () => 1_700_000_000_000,
+      mintEpoch: () => 'epoch-1'
+    })
+    const deferred = createDeferredStructuredAgentSessionEventSink()
+    deferred.bind({ journal, fence: 1, publish: vi.fn() })
+    let scheduled: (() => void) | null = null
+    const translator = createClaudeJournalTranslator({
+      sink: deferred.sink,
+      schedule: (run) => {
+        scheduled = run
+        return () => {
+          scheduled = null
+        }
+      }
+    })
+    const numbers = Array.from({ length: 200 }, (_, index) => String(index + 1))
+    // The chunk boundaries the real CLI produced for this prompt.
+    const boundaries = [0, 1, 45, 93, 141, 189, 200]
+    const chunks = boundaries.slice(1).map((end, index) => {
+      const slice = numbers.slice(boundaries[index], end).join('\n')
+      return index === 0 ? slice : `\n${slice}`
+    })
+    const turn = streamedTextTurn({
+      messageId: 'msg_count',
+      startUuid: 'count-start',
+      finalUuid: 'count-final',
+      chunks
+    })
+
+    for (const event of turn.start) {
+      translator.handle(event)
+    }
+    for (const delta of turn.deltas) {
+      translator.handle(delta)
+      // Each chunk lands in its own coalescing window, as it did on the wire.
+      const run = scheduled as (() => void) | null
+      run?.()
+    }
+    translator.handle(turn.final)
+    for (const event of turn.stop) {
+      translator.handle(event)
+    }
+    await deferred.drained()
+
+    const items: AgentJournalRenderItem[] = journal.snapshot().items
+    const assistant = assistantMessages(items)
+    expect(assistant.map((item) => item.itemId)).toEqual(['claude:claude-session:count-start'])
+    expect(assistant[0]?.body).toEqual({
+      kind: 'message',
+      role: 'assistant',
+      blocks: [{ type: 'text', text: numbers.join('\n') }]
+    })
+    expect(providerFrameKinds(items)).toEqual([])
+  })
+
+  it('settles result frames, empty thinking and string user replays without painting a row', () => {
+    const state = sinkState()
+    const translator = createClaudeJournalTranslator({ sink: state.sink })
+
+    translator.handle({
+      type: 'message',
+      sessionId: 'orca-session',
+      startsTurn: true,
+      message: {
+        type: 'user',
+        uuid: 'user-replay-1',
+        session_id: 'claude-session',
+        parent_tool_use_id: null,
+        isReplay: true,
+        timestamp: '2026-09-01T00:00:00.000Z',
+        message: { role: 'user', content: 'Reply with exactly PROBE_OK_1 and nothing else.' }
+      }
+    })
+    translator.handle(
+      message('assistant', 'assistant-thinking-empty', [
+        { type: 'thinking', thinking: '', signature: 'CAQS6QcKEAgRGAI4AUIIdGhpbmtpbmc' }
+      ])
+    )
+    translator.handle(
+      resultFrame('success', {
+        is_error: false,
+        result: 'PROBE_OK_1',
+        stop_reason: 'end_turn',
+        terminal_reason: 'completed'
+      })
+    )
+    translator.handle(
+      message('user', 'user-interrupt', [{ type: 'text', text: '[Request interrupted by user]' }])
+    )
+    translator.handle(
+      resultFrame('error_during_execution', {
+        is_error: true,
+        errors: ['[ede_diagnostic] result_type=user last_content_type=n/a stop_reason=null'],
+        stop_reason: null,
+        terminal_reason: 'aborted_streaming',
+        permission_denials: []
+      })
+    )
+    translator.handle(message('user', 'control-only', []))
+
+    expect(providerFrameKinds(state.items)).toEqual([])
+    expect(
+      state.items.flatMap((item) =>
+        item.body.kind === 'message' && item.body.role === 'user' ? [item.body.blocks] : []
+      )
+    ).toEqual([
+      [{ type: 'text', text: 'Reply with exactly PROBE_OK_1 and nothing else.' }],
+      [{ type: 'text', text: '[Request interrupted by user]' }]
+    ])
+    expect(
+      state.items.some((item) => item.body.kind === 'status' && !item.body.turnLifecycle)
+    ).toBe(false)
+    expect(
+      state.tombstones.flatMap((identity) =>
+        identity.provider === 'legacy' ? [identity.recordId] : []
+      )
+    ).toEqual(['turn-lifecycle:user-replay-1', 'turn-lifecycle:user-interrupt'])
+  })
+
+  it('does not reopen a completed turn when the SDK replays its user row after restart', () => {
+    const live = sinkState()
+    const liveTranslator = createClaudeJournalTranslator({ sink: live.sink })
+    const replay = {
+      type: 'message' as const,
+      sessionId: 'orca-session',
+      message: {
+        type: 'user',
+        uuid: 'picker-command-1',
+        session_id: 'claude-session',
+        parent_tool_use_id: null,
+        isReplay: true,
+        message: { role: 'user', content: '/model' }
+      }
+    }
+
+    liveTranslator.handle({ ...replay, startsTurn: true })
+    liveTranslator.handle(resultFrame('success', { is_error: false, result: '' }))
+    expect(live.tombstones).toContainEqual({
+      provider: 'legacy',
+      agent: 'claude',
+      sessionId: 'claude-session',
+      recordId: 'turn-lifecycle:picker-command-1'
+    })
+    liveTranslator.dispose()
+
+    const restarted = sinkState()
+    const restartedTranslator = createClaudeJournalTranslator({ sink: restarted.sink })
+    restartedTranslator.handle(replay)
+
+    expect(
+      activeStructuredAgentSessionTurnId(
+        restarted.items.map((item, sequence) => ({
+          itemId: agentJournalItemKey(item.identity),
+          revision: 1,
+          body: item.body,
+          sequence,
+          observedAt: sequence
+        }))
+      )
+    ).toBeNull()
+  })
+
+  it('surfaces an API error carried by a success-subtype result with no assistant frame', () => {
+    const state = sinkState()
+    const translator = createClaudeJournalTranslator({ sink: state.sink })
+
+    translator.handle(message('user', 'user-1', [{ type: 'text', text: 'summarize this' }]))
+    // The SDK models this as a SUCCESS-subtype result whose `result` string is the
+    // user-facing API error. Suppressing it as ordinary turn bookkeeping ends the
+    // turn with nothing shown at all.
+    translator.handle(
+      resultFrame('success', {
+        is_error: true,
+        result: 'API Error: 529 upstream overloaded',
+        stop_reason: null,
+        terminal_reason: 'api_error'
+      })
+    )
+
+    expect(providerFrameKinds(state.items)).toEqual(['message:result:success'])
+    expect(state.items.at(-1)?.body).toMatchObject({
+      kind: 'status',
+      text: 'API Error: 529 upstream overloaded'
+    })
+    // The turn still settles: the error is an extra row, not a stuck lifecycle.
+    expect(
+      state.tombstones.flatMap((identity) =>
+        identity.provider === 'legacy' ? [identity.recordId] : []
+      )
+    ).toEqual(['turn-lifecycle:user-1'])
+  })
+
+  it('drops the stream state of turns that ended without their final frame', () => {
+    const state = sinkState()
+    let scheduled: (() => void) | null = null
+    const translator = createClaudeJournalTranslator({
+      sink: state.sink,
+      schedule: (run) => {
+        scheduled = run
+        return () => {
+          scheduled = null
+        }
+      }
+    })
+    for (let turn = 0; turn < 3; turn += 1) {
+      const aborted = streamedTextTurn({
+        messageId: `msg_abort_${turn}`,
+        startUuid: `abort-start-${turn}`,
+        finalUuid: `abort-final-${turn}`,
+        chunks: ['x'.repeat(4_000)]
+      })
+      for (const event of [...aborted.start, ...aborted.deltas]) {
+        translator.handle(event)
+      }
+      const run = scheduled as (() => void) | null
+      run?.()
+      // The user interrupts: the result arrives with no final assistant frame,
+      // so nothing ever reconciles these blocks.
+      translator.handle(
+        resultFrame('error_during_execution', {
+          is_error: true,
+          terminal_reason: 'aborted_streaming'
+        })
+      )
+      // The partial text is already journaled; only the live state is dropped.
+      expect(translator.pendingStreamedBlocks).toBe(0)
+    }
+
+    expect(assistantMessages(state.items)).toHaveLength(3)
+  })
+
+  it('keeps an ordinary successful result off the timeline', () => {
+    const state = sinkState()
+    const translator = createClaudeJournalTranslator({ sink: state.sink })
+
+    translator.handle(resultFrame('success', { is_error: false, result: 'done', errors: [] }))
+
+    expect(providerFrameKinds(state.items)).toEqual([])
+  })
+
+  it('surfaces the reason an error-subtype result stopped the turn', () => {
+    const state = sinkState()
+    const translator = createClaudeJournalTranslator({ sink: state.sink })
+
+    translator.handle(
+      resultFrame('error_max_turns', { is_error: true, errors: ['turn limit reached'] })
+    )
+
+    expect(providerFrameKinds(state.items)).toEqual(['message:result:error_max_turns'])
+  })
+
+  it('keeps an unmodeled result subtype on the bounded provider fallback', () => {
+    const state = sinkState()
+    const translator = createClaudeJournalTranslator({ sink: state.sink })
+
+    translator.handle(
+      resultFrame('error_from_the_future', { is_error: true, errors: ['budget exhausted'] })
+    )
+
+    expect(providerFrameKinds(state.items)).toEqual(['message:result:error_from_the_future'])
+  })
+
+  it('journals turn lifecycle and updates one tool row through its result', () => {
+    const state = sinkState()
+    const translator = createClaudeJournalTranslator({ sink: state.sink })
+
+    translator.handle(message('user', 'user-1', [{ type: 'text', text: 'List files' }]))
+    translator.handle(
+      message('assistant', 'assistant-tool', [
+        { type: 'tool_use', id: 'tool-1', name: 'Bash', input: { command: 'ls' } }
+      ])
+    )
+    translator.handle(
+      message(
+        'user',
+        'tool-result-1',
+        [{ type: 'tool_result', tool_use_id: 'tool-1', content: 'a.ts\nb.ts' }],
+        'tool-1'
+      )
+    )
+
+    const keyed = new Map(
+      state.items.map((item) => [agentJournalItemKey(item.identity), item.body])
+    )
+    expect(keyed.get('claude:claude-session:user-1')).toMatchObject({
+      kind: 'message',
+      role: 'user'
+    })
+    expect(keyed.get('orca:claude-tool%3Aclaude-session%3Atool-1')).toMatchObject({
+      kind: 'tool-call',
+      name: 'Bash',
+      state: 'completed',
+      output: { head: 'a.ts\nb.ts', truncated: false }
+    })
+    expect(
+      state.items.some(
+        (item) => item.body.kind === 'status' && item.body.turnLifecycle?.turnId === 'user-1'
+      )
+    ).toBe(true)
+
+    translator.handle(
+      message(
+        'user',
+        'tool-result-2',
+        [{ type: 'tool_result', tool_use_id: 'tool-1', content: 'done again' }],
+        'tool-1'
+      )
+    )
+    expect(state.items.at(-1)?.body).toMatchObject({
+      kind: 'tool-call',
+      name: 'tool',
+      input: null,
+      output: { head: 'done again' }
+    })
+
+    translator.handle({
+      type: 'message',
+      sessionId: 'orca-session',
+      message: { type: 'result', session_id: 'claude-session', uuid: 'result-1' }
+    })
+    expect(state.tombstones.at(-1)).toMatchObject({
+      provider: 'legacy',
+      agent: 'claude',
+      recordId: 'turn-lifecycle:user-1'
+    })
+  })
+
+  it('bounds persisted thinking text to the shared journal payload limit', () => {
+    const state = sinkState()
+    const translator = createClaudeJournalTranslator({ sink: state.sink })
+    const thinking = 'considering '.repeat(20_000)
+
+    translator.handle(message('assistant', 'assistant-thinking', [{ type: 'thinking', thinking }]))
+
+    expect(state.items.at(-1)?.body).toEqual({
+      kind: 'status',
+      text: boundInlineText(thinking, DEFAULT_JOURNAL_PAYLOAD_LIMITS).text
+    })
+  })
+
+  it('starts a cancellable lifecycle for image-only root user replays', () => {
+    const state = sinkState()
+    const translator = createClaudeJournalTranslator({ sink: state.sink })
+
+    translator.handle(
+      message('user', 'user-image', [
+        { type: 'image', source: { type: 'base64', media_type: 'image/png', data: 'AA==' } }
+      ])
+    )
+
+    expect(state.items.at(-1)?.body).toEqual({
+      kind: 'status',
+      text: 'Claude is working…',
+      turnLifecycle: { turnId: 'user-image', state: 'running' }
+    })
+  })
+
+  it('does not start a lifecycle for a top-level user tool result', () => {
+    const state = sinkState()
+    const translator = createClaudeJournalTranslator({ sink: state.sink })
+
+    translator.handle(
+      message('user', 'tool-result-only', [
+        { type: 'tool_result', tool_use_id: 'tool-1', content: 'done' }
+      ])
+    )
+
+    expect(state.items.map((item) => agentJournalItemKey(item.identity))).toEqual([
+      'orca:claude-tool%3Aclaude-session%3Atool-1'
+    ])
+    expect(state.items[0]?.body).toMatchObject({
+      kind: 'tool-call',
+      state: 'completed',
+      output: { head: 'done' }
+    })
+    expect(
+      state.items.some(
+        (item) => item.body.kind === 'status' && item.body.turnLifecycle !== undefined
+      )
+    ).toBe(false)
+  })
+
+  it('paints nothing for a user frame that carries no content', () => {
+    const state = sinkState()
+    const translator = createClaudeJournalTranslator({ sink: state.sink })
+
+    translator.handle(message('user', 'control-only', []))
+
+    expect(state.items).toEqual([])
+    expect(state.tombstones).toEqual([])
+  })
+
+  it('renders unmodeled substantive Claude frames as bounded provider rows', () => {
+    const state = sinkState()
+    const translator = createClaudeJournalTranslator({ sink: state.sink })
+
+    translator.handle({
+      type: 'message',
+      sessionId: 'orca-session',
+      message: { type: 'system', subtype: 'local_command_output', summary: 'x'.repeat(100_000) }
+    })
+    translator.handle({
+      type: 'message',
+      sessionId: 'orca-session',
+      message: { type: 'system', subtype: 'hook_response', hook_name: 'PostToolUse' }
+    })
+    translator.handle({
+      type: 'message',
+      sessionId: 'orca-session',
+      message: { type: 'system', subtype: 'command_started', command: '/compact' }
+    })
+    translator.handle({
+      type: 'message',
+      sessionId: 'orca-session',
+      message: { type: 'result', usage: { input_tokens: 12 }, total_cost_usd: 0.01 }
+    })
+    translator.handle({
+      type: 'message',
+      sessionId: 'orca-session',
+      message: { type: 'tool_progress', tool_use_id: 'tool-1', elapsed_time_seconds: 2 }
+    })
+    translator.handle({
+      type: 'message',
+      sessionId: 'orca-session',
+      message: { type: 'prompt_suggestion', suggestion: '/compact' }
+    })
+    translator.handle(
+      message('user', 'attachment-1', [
+        { type: 'document', source: { type: 'base64', media_type: 'application/pdf' } }
+      ])
+    )
+    translator.handle({
+      type: 'provider-frame',
+      sessionId: 'orca-session',
+      kind: 'control_request:future_control',
+      payload: { subtype: 'future_control' }
+    })
+
+    const frames = state.items.flatMap((item) =>
+      item.body.kind === 'status' && item.body.providerFrame ? [item.body.providerFrame] : []
+    )
+    expect(frames.map((frame) => frame.kind)).toEqual(
+      expect.arrayContaining([
+        'message:system:local_command_output',
+        'message:system:command_started',
+        'message:result',
+        'message:user:content:document',
+        'control_request:future_control'
+      ])
+    )
+    expect(frames.map((frame) => frame.kind)).not.toEqual(
+      expect.arrayContaining([
+        'message:system:hook_response',
+        'message:tool_progress',
+        'message:prompt_suggestion'
+      ])
+    )
+    expect(
+      frames.find((frame) => frame.kind === 'message:system:local_command_output')?.payload
+    ).toEqual(expect.objectContaining({ truncated: true, byteLength: expect.any(Number) }))
+  })
+
+  it('preserves a question group as one addressable prompt and cancels it durably', () => {
+    const state = sinkState()
+    const bindings: unknown[][] = []
+    const translator = createClaudeJournalTranslator({
+      sink: state.sink,
+      bindPromptItemId: (...args) => bindings.push(args)
+    })
+    const approval = prompt({
+      requestId: 'permission-1',
+      promptKey: 'permission-1',
+      toolUseId: 'tool-1',
+      toolName: 'Bash',
+      kind: 'approval',
+      input: { command: 'git status' },
+      questionIds: []
+    })
+    translator.handle({ type: 'prompt', sessionId: 'orca-session', prompt: approval })
+    expect(state.items.at(-1)?.body).toMatchObject({
+      kind: 'approval',
+      title: 'Allow Bash?',
+      options: expect.arrayContaining([{ id: 'allow', label: 'Allow' }])
+    })
+    expect(bindings[0]).toEqual([
+      'orca:claude-prompt%3Aorca-session%3Apermission-1',
+      'permission-1'
+    ])
+
+    const questions = prompt({
+      requestId: 'questions-1',
+      promptKey: 'questions-1',
+      toolUseId: 'tool-q',
+      toolName: 'AskUserQuestion',
+      kind: 'question',
+      input: {
+        questions: [
+          { question: 'Library?', options: [{ label: 'Luxon' }] },
+          { question: 'Ship?', options: [{ label: 'Yes' }] }
+        ]
+      },
+      questionIds: ['Library?', 'Ship?']
+    })
+    translator.handle({ type: 'prompt', sessionId: 'orca-session', prompt: questions })
+    expect(state.items.filter((item) => item.body.kind === 'question')).toHaveLength(1)
+    expect(state.items.at(-1)?.body).toMatchObject({
+      kind: 'question',
+      questions: [
+        { id: 'q1', question: 'Library?', multiSelect: false },
+        { id: 'q2', question: 'Ship?', multiSelect: false }
+      ]
+    })
+    expect(bindings.at(-1)).toEqual([
+      'orca:claude-prompt%3Aorca-session%3Aquestions-1',
+      'questions-1'
+    ])
+
+    const multiSelect = prompt({
+      requestId: 'questions-multi',
+      promptKey: 'questions-multi',
+      toolUseId: 'tool-multi',
+      toolName: 'AskUserQuestion',
+      kind: 'question',
+      input: {
+        questions: [
+          {
+            question: 'Libraries?',
+            multiSelect: true,
+            options: [{ label: 'Luxon' }, { label: 'Temporal' }]
+          }
+        ]
+      },
+      questionIds: ['Libraries?']
+    })
+    translator.handle({ type: 'prompt', sessionId: 'orca-session', prompt: multiSelect })
+    expect(state.items.at(-1)?.body).toMatchObject({
+      kind: 'question',
+      question: '1 grouped question from Claude',
+      options: [],
+      questions: [
+        {
+          id: 'q1',
+          question: 'Libraries?',
+          multiSelect: true,
+          options: [{ label: 'Luxon' }, { label: 'Temporal' }],
+          freeTextQuestionId: 'q1'
+        }
+      ]
+    })
+
+    translator.handle({
+      type: 'prompt-cancelled',
+      sessionId: 'orca-session',
+      promptKey: 'questions-1'
+    })
+    expect(state.tombstones).toHaveLength(1)
+  })
+})
+
+function prompt(
+  input: Pick<
+    ClaudePendingPrompt,
+    'requestId' | 'promptKey' | 'toolUseId' | 'toolName' | 'kind' | 'input' | 'questionIds'
+  >
+): ClaudePendingPrompt {
+  return {
+    ...input,
+    suggestions: [],
+    answers: new Map(),
+    settle: () => {}
+  }
+}
diff --git a/src/main/claude/claude-structured-journal-translation.ts b/src/main/claude/claude-structured-journal-translation.ts
new file mode 100644
index 00000000000..ffaad4da570
--- /dev/null
+++ b/src/main/claude/claude-structured-journal-translation.ts
@@ -0,0 +1,287 @@
+import type { AgentJournalItemIdentity } from '../../shared/agent-session-journal-types'
+import { agentJournalItemKey } from '../../shared/agent-session-journal-item-key'
+import type { AgentSessionDeltaCoalescerDeps } from '../native-chat/agent-session-wire/agent-session-delta-coalescer'
+import type { StructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
+import {
+  boundInlineText,
+  DEFAULT_JOURNAL_PAYLOAD_LIMITS
+} from '../native-chat/agent-session-journal/journal-payload-bounds'
+import type { ClaudeStructuredSessionEvent } from './claude-structured-session-state'
+import {
+  claudeMessageBody,
+  claudeMessageIdentity,
+  claudeHasReplayContent,
+  claudeRecord,
+  claudeStreamingMessageBody,
+  claudeText,
+  claudeThinkingIdentity,
+  claudeThinkingText,
+  claudeToolBody,
+  claudeToolIdentity,
+  claudeToolResults,
+  claudeToolUses,
+  readClaudeMessageEnvelope,
+  type ClaudeToolUse
+} from './claude-structured-item-translation'
+import {
+  claudeApprovalItem,
+  claudePromptIdentity,
+  claudeQuestionItems
+} from './claude-structured-prompt-items'
+import type { ClaudePromptRegistry } from './claude-structured-prompt-replies'
+import { readableProviderFrameText } from '../native-chat/agent-session-wire/unhandled-provider-frame'
+import {
+  CLAUDE_UNRENDERABLE_CONTENT_TEXT,
+  claudeProviderFrameKind,
+  claudeResultFailure,
+  createClaudeProviderFrameFallback,
+  isModeledClaudeContent,
+  isSettledClaudeResultKind
+} from './claude-structured-provider-fallback'
+import { createClaudeStreamedBlockRegistry } from './claude-streamed-block-identity'
+import { createClaudeStreamedTextCheckpoints } from './claude-streamed-text-checkpoints'
+
+export type ClaudeJournalTranslatorDeps = {
+  sink: StructuredAgentSessionEventSink
+  bindPromptItemId?: (journalItemId: string, promptKey: string, questionId?: string) => void
+  coalesceMs?: number
+  schedule?: AgentSessionDeltaCoalescerDeps['schedule']
+  fallbackIdPrefix?: string
+}
+
+export type ClaudeJournalTranslator = {
+  handle: (event: ClaudeStructuredSessionEvent) => void
+  flush: () => void
+  /** Streamed blocks still awaiting a final frame. A settled turn leaves none. */
+  readonly pendingStreamedBlocks: number
+  dispose: () => void
+}
+
+export function createClaudeSessionJournalTranslator(
+  sink: StructuredAgentSessionEventSink | undefined,
+  prompts: ClaudePromptRegistry,
+  fallbackIdPrefix: string
+): ClaudeJournalTranslator | null {
+  return sink
+    ? createClaudeJournalTranslator({
+        sink,
+        fallbackIdPrefix,
+        bindPromptItemId: (itemId, promptKey, questionId) =>
+          prompts.bindJournalItemId(itemId, promptKey, questionId)
+      })
+    : null
+}
+
+function lifecycleIdentity(sessionId: string, turnId: string): AgentJournalItemIdentity {
+  return {
+    provider: 'legacy',
+    agent: 'claude',
+    sessionId,
+    recordId: `turn-lifecycle:${turnId}`
+  }
+}
+
+export function createClaudeJournalTranslator(
+  deps: ClaudeJournalTranslatorDeps
+): ClaudeJournalTranslator {
+  const tools = new Map<string, ClaudeToolUse>()
+  const promptItems = new Map<string, AgentJournalItemIdentity[]>()
+  const streamedBlocks = createClaudeStreamedBlockRegistry()
+  let currentTurn: { sessionId: string; turnId: string } | null = null
+  const providerFallback = createClaudeProviderFrameFallback(
+    deps.sink,
+    deps.fallbackIdPrefix ?? 'acquisition'
+  )
+  const streamedText = createClaudeStreamedTextCheckpoints({
+    ...(deps.coalesceMs === undefined ? {} : { coalesceMs: deps.coalesceMs }),
+    ...(deps.schedule ? { schedule: deps.schedule } : {}),
+    persist: (identity, text) => {
+      deps.sink.appendItem(identity, claudeStreamingMessageBody(text))
+      deps.sink.publish()
+    }
+  })
+
+  const publishLifecycle = (sessionId: string, turnId: string, running: boolean): void => {
+    const identity = lifecycleIdentity(sessionId, turnId)
+    if (running) {
+      deps.sink.appendItem(identity, {
+        kind: 'status',
+        text: 'Claude is working…',
+        turnLifecycle: { turnId, state: 'running' }
+      })
+    } else {
+      deps.sink.appendTombstone(identity)
+    }
+    deps.sink.publish()
+  }
+
+  const handleStream = (message: Record<string, unknown>): boolean => {
+    const delta = streamedBlocks.observe(message)
+    if (!delta) {
+      return false
+    }
+    streamedText.append(delta.identity, delta.text)
+    return true
+  }
+
+  const handleMessage = (message: Record<string, unknown>, startsTurn: boolean): boolean => {
+    const envelope = readClaudeMessageEnvelope(message)
+    if (!envelope) {
+      return false
+    }
+    let changed = false
+    const body = claudeMessageBody(envelope)
+    // The final frame of a streamed block lands on the block's identity, not its own uuid.
+    const identity =
+      (body && envelope.role === 'assistant' ? streamedBlocks.reconcile(envelope) : null) ??
+      claudeMessageIdentity(envelope)
+    streamedText.forget(agentJournalItemKey(identity))
+    if (body) {
+      deps.sink.appendItem(identity, body)
+      changed = true
+    }
+    for (const tool of claudeToolUses(envelope)) {
+      tools.set(tool.id, tool)
+      deps.sink.appendItem(
+        claudeToolIdentity(envelope.sessionId, tool.id),
+        claudeToolBody({ tool })
+      )
+      changed = true
+    }
+    for (const result of claudeToolResults(envelope)) {
+      const tool = tools.get(result.toolUseId) ?? {
+        id: result.toolUseId,
+        name: 'tool',
+        input: null
+      }
+      deps.sink.appendItem(
+        claudeToolIdentity(envelope.sessionId, result.toolUseId),
+        claudeToolBody({ tool, result })
+      )
+      // Tool inputs are only needed until their matching result arrives.
+      tools.delete(result.toolUseId)
+      changed = true
+    }
+    const thinking = claudeThinkingText(envelope)
+    if (thinking) {
+      deps.sink.appendItem(claudeThinkingIdentity(envelope.sessionId, envelope.uuid), {
+        kind: 'status',
+        text: boundInlineText(thinking, DEFAULT_JOURNAL_PAYLOAD_LIMITS).text
+      })
+      changed = true
+    }
+    const unhandledContent = envelope.content.filter((part) => !isModeledClaudeContent(part))
+    for (const part of unhandledContent) {
+      const partType = claudeText(claudeRecord(part)?.type) ?? 'unknown'
+      providerFallback.append(
+        `message:${envelope.role}:content:${partType}`,
+        part,
+        readableProviderFrameText(part) ?? CLAUDE_UNRENDERABLE_CONTENT_TEXT
+      )
+      changed = true
+    }
+    // An empty user frame is a replay with nothing to show, not an unknown kind.
+    if (envelope.content.length === 0 && envelope.role === 'assistant') {
+      providerFallback.append(`message:${envelope.role}:empty`, message)
+      changed = true
+    }
+    if (
+      envelope.role === 'user' &&
+      startsTurn &&
+      claudeHasReplayContent(envelope) &&
+      message.parent_tool_use_id === null
+    ) {
+      if (currentTurn) {
+        publishLifecycle(currentTurn.sessionId, currentTurn.turnId, false)
+      }
+      currentTurn = { sessionId: envelope.sessionId, turnId: envelope.uuid }
+      publishLifecycle(envelope.sessionId, envelope.uuid, true)
+    }
+    if (changed) {
+      deps.sink.publish()
+    }
+    return true
+  }
+
+  const handlePrompt = (event: Extract<ClaudeStructuredSessionEvent, { type: 'prompt' }>): void => {
+    const identities: AgentJournalItemIdentity[] = []
+    if (event.prompt.kind === 'question') {
+      for (const question of claudeQuestionItems({
+        sessionId: event.sessionId,
+        prompt: event.prompt
+      })) {
+        identities.push(question.identity)
+        deps.sink.appendItem(question.identity, question.body)
+        deps.bindPromptItemId?.(agentJournalItemKey(question.identity), event.prompt.promptKey)
+      }
+    } else {
+      const identity = claudePromptIdentity({
+        sessionId: event.sessionId,
+        promptKey: event.prompt.promptKey
+      })
+      identities.push(identity)
+      deps.sink.appendItem(identity, claudeApprovalItem(event.prompt))
+      deps.bindPromptItemId?.(agentJournalItemKey(identity), event.prompt.promptKey)
+    }
+    promptItems.set(event.prompt.promptKey, identities)
+    deps.sink.publish()
+  }
+
+  return {
+    handle: (event) => {
+      if (event.type === 'ended') {
+        streamedText.flush()
+        if (currentTurn) {
+          publishLifecycle(currentTurn.sessionId, currentTurn.turnId, false)
+          currentTurn = null
+        }
+        return
+      }
+      if (event.type === 'message' && handleStream(event.message)) {
+        return
+      }
+      streamedText.flush()
+      if (event.type === 'prompt') {
+        handlePrompt(event)
+      } else if (event.type === 'prompt-cancelled') {
+        for (const identity of promptItems.get(event.promptKey) ?? []) {
+          deps.sink.appendTombstone(identity)
+        }
+        promptItems.delete(event.promptKey)
+        deps.sink.publish()
+      } else if (event.type === 'message' && event.message.type === 'result') {
+        if (currentTurn) {
+          publishLifecycle(currentTurn.sessionId, currentTurn.turnId, false)
+          currentTurn = null
+        }
+        // The turn is over. A block still awaiting its final keeps the text the
+        // flush above journaled, but its live state goes: an interrupted turn
+        // would otherwise retain that text for the life of the session.
+        streamedBlocks.clear()
+        streamedText.settle()
+        const kind = claudeProviderFrameKind(event.message)
+        // Ordinary turn bookkeeping stays suppressed; a reported failure never does.
+        const failure = claudeResultFailure(event.message)
+        if (failure || !isSettledClaudeResultKind(kind)) {
+          providerFallback.append(kind, event.message, failure?.text)
+        }
+      } else if (event.type === 'message') {
+        if (!handleMessage(event.message, event.startsTurn === true)) {
+          providerFallback.append(claudeProviderFrameKind(event.message), event.message)
+        }
+      } else if (event.type === 'provider-frame') {
+        providerFallback.append(event.kind, event.payload)
+      }
+    },
+    flush: streamedText.flush,
+    get pendingStreamedBlocks() {
+      return streamedText.pending
+    },
+    dispose: () => {
+      streamedText.dispose()
+      tools.clear()
+      promptItems.clear()
+      streamedBlocks.clear()
+    }
+  }
+}
diff --git a/src/main/claude/claude-structured-launch-resolution.test.ts b/src/main/claude/claude-structured-launch-resolution.test.ts
new file mode 100644
index 00000000000..650947cffa1
--- /dev/null
+++ b/src/main/claude/claude-structured-launch-resolution.test.ts
@@ -0,0 +1,392 @@
+import { chmodSync, mkdtempSync, mkdirSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { delimiter, join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import type { AgentSessionRecord } from '../../shared/agent-session-record'
+import { LOCAL_EXECUTION_HOST_ID } from '../../shared/execution-host'
+import type { AgentSessionRecordStore } from '../runtime/agent-session-record-store'
+import { AgentSessionPreSpawnError } from '../native-chat/agent-session-wire/structured-agent-session-adapter'
+import { claudeStructuredAuthPolicyForSettings } from '../claude-accounts/claude-structured-auth-policy'
+import type { ClaudeManagedAccountGateSettings } from '../native-chat/claude-structured-managed-account-support'
+import {
+  CLAUDE_DEFAULT_SETTING_SOURCES,
+  CLAUDE_STRUCTURED_BASE_OPTIONS,
+  claudeSdkOptionsForLaunchArgs,
+  claudeSessionIdForOrcaSession,
+  createClaudeStructuredLaunchResolver
+} from './claude-structured-launch-resolution'
+
+const SESSION_ID = 'orca-session-1'
+const IDENTITY = { sessionId: SESSION_ID } as Parameters<
+  ReturnType<typeof createClaudeStructuredLaunchResolver>
+>[0]['identity']
+
+function record(overrides: Partial<AgentSessionRecord> = {}): AgentSessionRecord {
+  return {
+    sessionId: SESSION_ID,
+    provider: 'claude',
+    location: {
+      executionHostId: LOCAL_EXECUTION_HOST_ID,
+      wslDistro: null,
+      workspaceId: 'workspace-1',
+      workspaceKind: 'folder'
+    },
+    accountHome: { variable: 'CLAUDE_CONFIG_DIR', path: '/home/work/.claude' },
+    providerHandleChain: [],
+    ...overrides
+  } as AgentSessionRecord
+}
+
+function identityAt(leafUuid: string | null): typeof IDENTITY {
+  return {
+    ...IDENTITY,
+    providerHandle: { kind: 'claude', sessionId: 'provider-current', leafUuid }
+  }
+}
+
+function makeExecutable(path: string): void {
+  mkdirSync(join(path, '..'), { recursive: true })
+  writeFileSync(path, '')
+  if (process.platform !== 'win32') {
+    chmodSync(path, 0o755)
+  }
+}
+
+function resolverFor(
+  value: AgentSessionRecord | null,
+  resolveEnv?: () => Record<string, string>,
+  stripAuthEnv = false
+) {
+  return createClaudeStructuredLaunchResolver({
+    store: { getRecord: () => value } as unknown as AgentSessionRecordStore,
+    resolveWorkspacePath: async (id) => `/repos/${id}`,
+    resolveCommand: () => '/usr/local/bin/claude',
+    resolveAuthPolicy: () => ({ stripAuthEnv }),
+    ...(resolveEnv ? { resolveEnv } : {})
+  })
+}
+
+function managedAccount(id: string, managedAuthRuntime: 'host' | 'wsl') {
+  return {
+    id,
+    email: `${id}@example.com`,
+    managedAuthPath: `/managed/${id}`,
+    managedAuthRuntime,
+    authMethod: 'subscription-oauth' as const,
+    createdAt: 0,
+    updatedAt: 0,
+    lastAuthenticatedAt: 0
+  }
+}
+
+const HOST_SELECTED: ClaudeManagedAccountGateSettings = {
+  claudeManagedAccounts: [managedAccount('host-1', 'host')],
+  activeClaudeManagedAccountId: 'host-1',
+  activeClaudeManagedAccountIdsByRuntime: { host: 'host-1', wsl: {} }
+}
+
+/** The normalized steady state of a Windows user whose only Claude account is WSL-managed: the
+ *  prune drops the WSL account out of the host slot and persists that. */
+const WSL_ONLY_NORMALIZED: ClaudeManagedAccountGateSettings = {
+  claudeManagedAccounts: [managedAccount('wsl-1', 'wsl')],
+  activeClaudeManagedAccountId: null,
+  activeClaudeManagedAccountIdsByRuntime: { host: null, wsl: { Ubuntu: 'wsl-1' } }
+}
+
+const RESUMABLE = record({
+  providerHandleChain: [
+    { handle: { provider: 'claude', sessionId: 'provider-current', leafUuid: 'leaf-current' } }
+  ] as AgentSessionRecord['providerHandleChain']
+})
+
+describe('claude structured launch resolution', () => {
+  it('pre-mints a stable provider id and pins interactive setting sources', async () => {
+    const first = await resolverFor(record())({ identity: IDENTITY })
+    const second = await resolverFor(record())({ identity: IDENTITY })
+
+    expect(first.providerSessionId).toBe(claudeSessionIdForOrcaSession(SESSION_ID))
+    expect(second.providerSessionId).toBe(first.providerSessionId)
+    expect(first).toMatchObject({
+      pathToClaudeCodeExecutable: '/usr/local/bin/claude',
+      cwd: '/repos/workspace-1',
+      claudeConfigDir: '/home/work/.claude',
+      resumeLeafUuid: null,
+      resumed: false
+    })
+    expect(first.options).toEqual({
+      includePartialMessages: true,
+      settingSources: [...CLAUDE_DEFAULT_SETTING_SOURCES],
+      supportedDialogKinds: [],
+      extraArgs: { 'replay-user-messages': null },
+      systemPrompt: { type: 'preset', preset: 'claude_code' },
+      sessionId: first.providerSessionId
+    })
+    expect(first.options.resume).toBeUndefined()
+    expect(CLAUDE_STRUCTURED_BASE_OPTIONS.includePartialMessages).toBe(true)
+  })
+
+  it('resumes the session and leaf at the durable chain head', async () => {
+    const launch = await resolverFor(
+      record({
+        providerHandleChain: [
+          { handle: { provider: 'claude', sessionId: 'provider-old', leafUuid: 'leaf-old' } },
+          {
+            handle: {
+              provider: 'claude',
+              sessionId: 'provider-current',
+              leafUuid: 'leaf-current'
+            }
+          }
+        ] as AgentSessionRecord['providerHandleChain']
+      })
+    )({ identity: identityAt('leaf-current') })
+
+    expect(launch).toMatchObject({
+      providerSessionId: 'provider-current',
+      resumeLeafUuid: 'leaf-current',
+      resumed: true
+    })
+    expect(launch.options.resume).toBe('provider-current')
+    expect(launch.options.resumeSessionAt).toBe('leaf-current')
+    expect(launch.options.sessionId).toBeUndefined()
+  })
+
+  it('refuses a durable journal leaf that diverged before resume resolution', async () => {
+    const resolve = resolverFor(
+      record({
+        providerHandleChain: [
+          {
+            handle: {
+              provider: 'claude',
+              sessionId: 'provider-current',
+              leafUuid: 'leaf-current'
+            }
+          }
+        ] as AgentSessionRecord['providerHandleChain']
+      })
+    )
+
+    await expect(resolve({ identity: identityAt('leaf-stale') })).rejects.toThrow(
+      'durable resume identity changed before spawn'
+    )
+  })
+
+  it('keeps session-only resume when the durable handle has no leaf', async () => {
+    const launch = await resolverFor(
+      record({
+        providerHandleChain: [
+          {
+            handle: {
+              provider: 'claude',
+              sessionId: 'provider-current',
+              leafUuid: null
+            }
+          }
+        ] as AgentSessionRecord['providerHandleChain']
+      })
+    )({ identity: identityAt(null) })
+
+    expect(launch.options.resume).toBe('provider-current')
+    expect(launch.options.resumeSessionAt).toBeUndefined()
+  })
+
+  it('preserves durable Claude launch arguments as typed options and extraArgs', async () => {
+    const launch = await resolverFor(
+      record({
+        launchArgs: [
+          '--model',
+          'claude-sonnet-4-5',
+          '--effort',
+          'high',
+          '--dangerously-skip-permissions'
+        ]
+      })
+    )({ identity: IDENTITY })
+
+    expect(launch.options.model).toBe('claude-sonnet-4-5')
+    expect(launch.options.effort).toBe('high')
+    expect(launch.options.extraArgs).toEqual({
+      'dangerously-skip-permissions': null,
+      'replay-user-messages': null
+    })
+  })
+
+  it('routes durable launch arguments to a typed option first and refuses what neither can carry', () => {
+    // The catalog's own output: each flag lands in exactly one place, so the SDK
+    // cannot emit it twice with two different values.
+    expect(claudeSdkOptionsForLaunchArgs(['--model', 'opus', '--effort', 'xhigh'])).toEqual({
+      model: 'opus',
+      effort: 'xhigh'
+    })
+    // An effort the SDK's union does not name still reaches the CLI, unchanged.
+    expect(claudeSdkOptionsForLaunchArgs(['--effort', 'ultra'])).toEqual({
+      extraArgs: { effort: 'ultra' }
+    })
+    expect(claudeSdkOptionsForLaunchArgs(['--settings=/tmp/s.json'])).toEqual({
+      extraArgs: { settings: '/tmp/s.json' }
+    })
+    expect(() => claudeSdkOptionsForLaunchArgs(['-m', 'opus'])).toThrow(/no SDK option/)
+  })
+
+  it('keeps the session launch environment pinned after account settings change', async () => {
+    const resolver = resolverFor(record(), () => ({
+      ANTHROPIC_AUTH_TOKEN: 'rotated-token',
+      ANTHROPIC_BASE_URL: 'https://gateway.example.test'
+    }))
+
+    expect((await resolver({ identity: IDENTITY })).env).toMatchObject({
+      ANTHROPIC_AUTH_TOKEN: 'rotated-token',
+      ANTHROPIC_BASE_URL: 'https://gateway.example.test'
+    })
+    expect((await resolver({ identity: IDENTITY })).env?.ANTHROPIC_AUTH_TOKEN).toBe('rotated-token')
+  })
+
+  // Stripping is the managed-account rule the terminal preflight computes at
+  // runtime-auth-preparation.ts:72; claude-structured-auth-parity.test.ts covers
+  // the system-auth half, where the user's own key has to survive.
+  it('strips ambient Anthropic auth under a managed account but keeps the rest of the env', async () => {
+    const restore = {
+      ANTHROPIC_API_KEY: process.env.ANTHROPIC_API_KEY,
+      ANTHROPIC_AUTH_TOKEN: process.env.ANTHROPIC_AUTH_TOKEN,
+      CLAUDE_CODE_OAUTH_TOKEN: process.env.CLAUDE_CODE_OAUTH_TOKEN,
+      ORCA_LAUNCH_RESOLUTION_MARKER: process.env.ORCA_LAUNCH_RESOLUTION_MARKER
+    }
+    process.env.ANTHROPIC_API_KEY = 'sk-ant-SHELL-LEAK'
+    process.env.ANTHROPIC_AUTH_TOKEN = 'tok-SHELL-LEAK'
+    process.env.CLAUDE_CODE_OAUTH_TOKEN = 'oauth-SHELL-LEAK'
+    process.env.ORCA_LAUNCH_RESOLUTION_MARKER = 'inherited'
+    try {
+      const launch = await resolverFor(record(), undefined, true)({ identity: IDENTITY })
+
+      expect(launch.env?.ANTHROPIC_API_KEY).toBeUndefined()
+      expect(launch.env?.ANTHROPIC_AUTH_TOKEN).toBeUndefined()
+      expect(launch.env?.CLAUDE_CODE_OAUTH_TOKEN).toBeUndefined()
+      // The inherited env is still the base — only auth is removed from it.
+      expect(launch.env?.ORCA_LAUNCH_RESOLUTION_MARKER).toBe('inherited')
+      expect(launch.env?.PATH ?? launch.env?.Path).toBeTruthy()
+    } finally {
+      for (const [key, value] of Object.entries(restore)) {
+        if (value === undefined) {
+          delete process.env[key]
+        } else {
+          process.env[key] = value
+        }
+      }
+    }
+  })
+
+  it('lets an explicit Claude env overlay override ambient auth under system auth', async () => {
+    const restore = process.env.ANTHROPIC_API_KEY
+    process.env.ANTHROPIC_API_KEY = 'sk-ant-SHELL-LEAK'
+    try {
+      const launch = await resolverFor(record(), () => ({
+        ANTHROPIC_API_KEY: 'sk-ant-CONFIGURED'
+      }))({ identity: IDENTITY })
+
+      expect(launch.env?.ANTHROPIC_API_KEY).toBe('sk-ant-CONFIGURED')
+    } finally {
+      if (restore === undefined) {
+        delete process.env.ANTHROPIC_API_KEY
+      } else {
+        process.env.ANTHROPIC_API_KEY = restore
+      }
+    }
+  })
+
+  it('pairs a resolved Claude CLI with its sibling Node runtime', async () => {
+    const root = mkdtempSync(join(tmpdir(), 'orca-claude-launch-'))
+    const binDir = join(root, 'bin')
+    const claudeCommand = join(binDir, process.platform === 'win32' ? 'claude.cmd' : 'claude')
+    const nodeCommand = join(binDir, process.platform === 'win32' ? 'node.cmd' : 'node')
+    makeExecutable(claudeCommand)
+    makeExecutable(nodeCommand)
+
+    const launch = await createClaudeStructuredLaunchResolver({
+      store: { getRecord: () => record() } as unknown as AgentSessionRecordStore,
+      resolveWorkspacePath: async (id) => `/repos/${id}`,
+      resolveCommand: () => claudeCommand,
+      resolveAuthPolicy: () => ({ stripAuthEnv: false }),
+      resolveEnv: () => ({
+        PATH: '/usr/bin',
+        CLAUDE_CONFIG_DIR: '/accounts/selected/home'
+      })
+    })({ identity: IDENTITY })
+
+    expect((launch.env?.PATH ?? launch.env?.Path)?.split(delimiter)[0]).toBe(binDir)
+  })
+
+  it('refuses other hosts, WSL, providers, and account-home variables', async () => {
+    await expect(
+      resolverFor(record({ location: { ...record().location, executionHostId: 'ssh:build' } }))({
+        identity: IDENTITY
+      })
+    ).rejects.toThrow(/local host/)
+    await expect(
+      resolverFor(record({ location: { ...record().location, wslDistro: 'Ubuntu' } }))({
+        identity: IDENTITY
+      })
+    ).rejects.toThrow(/local host/)
+    await expect(
+      resolverFor(record({ provider: 'codex' } as Partial<AgentSessionRecord>))({
+        identity: IDENTITY
+      })
+    ).rejects.toThrow(/codex session/)
+    await expect(
+      resolverFor(record({ accountHome: { variable: 'CODEX_HOME', path: '/tmp/codex' } }))({
+        identity: IDENTITY
+      })
+    ).rejects.toThrow(/CLAUDE_CONFIG_DIR/)
+  })
+
+  /** The account state can change while a session lives, and a reacquire after an unexpected child
+   *  exit re-resolves the launch. Without the gate here, that reacquire spawns under whatever the
+   *  account state has become. */
+  describe('managed-account gate on every acquisition', () => {
+    function resolverWithGate(read: () => ClaudeManagedAccountGateSettings | null) {
+      return createClaudeStructuredLaunchResolver({
+        store: { getRecord: () => RESUMABLE } as unknown as AgentSessionRecordStore,
+        resolveWorkspacePath: async (id) => `/repos/${id}`,
+        resolveCommand: () => '/usr/local/bin/claude',
+        // Derived, not a literal: the gate and the policy must read the SAME account state, so a
+        // hardcoded value could assert a pairing production cannot produce.
+        resolveAuthPolicy: () => {
+          const settings = read()
+          if (!settings) {
+            throw new Error('the gate refuses before the auth policy is computed')
+          }
+          return claudeStructuredAuthPolicyForSettings(settings)
+        },
+        readManagedAccountGate: read
+      })
+    }
+
+    it('refuses a reacquire once the account state becomes the refused shape', async () => {
+      let gate: ClaudeManagedAccountGateSettings | null = HOST_SELECTED
+      const resolve = resolverWithGate(() => gate)
+
+      // Created while supported: the launch resolves and would spawn.
+      await expect(resolve({ identity: identityAt('leaf-current') })).resolves.toMatchObject({
+        providerSessionId: 'provider-current'
+      })
+
+      gate = WSL_ONLY_NORMALIZED
+
+      // Reacquire after the account state changed: refused before anything spawns.
+      await expect(resolve({ identity: identityAt('leaf-current') })).rejects.toBeInstanceOf(
+        AgentSessionPreSpawnError
+      )
+    })
+
+    it('fails closed when the account state cannot be read', async () => {
+      await expect(
+        resolverWithGate(() => null)({ identity: identityAt('leaf-current') })
+      ).rejects.toBeInstanceOf(AgentSessionPreSpawnError)
+    })
+
+    it('keeps resolving when no gate is wired, so other embedders are unaffected', async () => {
+      await expect(
+        resolverFor(RESUMABLE)({ identity: identityAt('leaf-current') })
+      ).resolves.toMatchObject({ providerSessionId: 'provider-current' })
+    })
+  })
+})
diff --git a/src/main/claude/claude-structured-launch-resolution.ts b/src/main/claude/claude-structured-launch-resolution.ts
new file mode 100644
index 00000000000..4f28f14ad65
--- /dev/null
+++ b/src/main/claude/claude-structured-launch-resolution.ts
@@ -0,0 +1,273 @@
+import { createHash } from 'node:crypto'
+import type { EffortLevel, Options as ClaudeAgentSdkOptions } from '@anthropic-ai/claude-agent-sdk'
+import type { AgentSessionJournalIdentity } from '../../shared/agent-session-journal-types'
+import { agentSessionProviderHandleChainHead } from '../../shared/agent-session-provider-handle'
+import { LOCAL_EXECUTION_HOST_ID } from '../../shared/execution-host'
+import { withCliRuntimeOnPath } from '../../shared/node-cli-command-resolution'
+import {
+  CLAUDE_AUTH_ENV_CONFLICT_MESSAGE,
+  CLAUDE_AUTH_SWITCH_IN_PROGRESS_MESSAGE,
+  applyClaudeEnvPatch,
+  hasClaudeAuthEnvConflict
+} from '../claude-accounts/environment'
+import type { ClaudeStructuredAuthPolicy } from '../claude-accounts/claude-structured-auth-policy'
+import {
+  CLAUDE_AUTH_SWITCH_SETTLE_TIMEOUT_MS,
+  whenClaudeAuthSwitchSettles
+} from '../claude-accounts/live-pty-gate'
+import { AgentSessionPreSpawnError } from '../native-chat/agent-session-wire/structured-agent-session-adapter'
+import {
+  structuredClaudeMatchesActiveManagedAccount,
+  type ClaudeManagedAccountGateSettings
+} from '../native-chat/claude-structured-managed-account-support'
+import { resolveClaudeCommand } from '../codex-cli/command'
+import type { AgentSessionRecordStore } from '../runtime/agent-session-record-store'
+
+export const CLAUDE_DEFAULT_SETTING_SOURCES = ['user', 'project', 'local'] as const
+
+export type ClaudeStructuredSdkOptions = Pick<
+  ClaudeAgentSdkOptions,
+  | 'includePartialMessages'
+  | 'systemPrompt'
+  | 'settingSources'
+  | 'supportedDialogKinds'
+  | 'extraArgs'
+  | 'model'
+  | 'effort'
+  | 'sessionId'
+  | 'resume'
+  | 'resumeSessionAt'
+>
+
+/**
+ * The options translation of the flags this transport used to build by hand.
+ *
+ * `-p`, `--input-format`, `--output-format` and `--verbose` are implied by
+ * `query()`; `--permission-prompt-tool stdio` is emitted because a `canUseTool`
+ * callback is supplied. `--replay-user-messages` has no option — the SDK never
+ * emits it — and Orca's send acknowledgement depends on the replay.
+ */
+export const CLAUDE_STRUCTURED_BASE_OPTIONS: ClaudeStructuredSdkOptions = {
+  includePartialMessages: true,
+  // Keep the SDK on Claude Code's own system-prompt contract.
+  systemPrompt: { type: 'preset', preset: 'claude_code' },
+  settingSources: [...CLAUDE_DEFAULT_SETTING_SOURCES],
+  supportedDialogKinds: [],
+  extraArgs: { 'replay-user-messages': null }
+}
+
+const EFFORT_LEVELS: readonly string[] = ['low', 'medium', 'high', 'xhigh', 'max']
+
+function cloneDefinedEnv(env: NodeJS.ProcessEnv | Record<string, string>): Record<string, string> {
+  const next: Record<string, string> = {}
+  for (const [key, value] of Object.entries(env)) {
+    if (value !== undefined) {
+      next[key] = value
+    }
+  }
+  return next
+}
+
+/**
+ * Translate the record's durable launch arguments into SDK options.
+ *
+ * Typed option first so a flag is never emitted twice; `extraArgs` carries
+ * anything without one. A token expressible neither way is refused rather than
+ * dropped — a silent drop is how this lane loses launch flags.
+ */
+export function claudeSdkOptionsForLaunchArgs(
+  args: readonly string[]
+): Pick<ClaudeStructuredSdkOptions, 'model' | 'effort' | 'extraArgs'> {
+  let model: string | undefined
+  let effort: EffortLevel | undefined
+  const extraArgs: Record<string, string | null> = {}
+  for (let index = 0; index < args.length; index += 1) {
+    const token = args[index] ?? ''
+    if (!token.startsWith('--') || token.length <= 2) {
+      throw new Error(
+        `claude launch argument ${token} has no SDK option; refusing rather than dropping it`
+      )
+    }
+    const equals = token.indexOf('=')
+    const flag = equals === -1 ? token : token.slice(0, equals)
+    let value = equals === -1 ? null : token.slice(equals + 1)
+    if (value === null) {
+      const next = args[index + 1]
+      if (next !== undefined && !next.startsWith('-')) {
+        value = next
+        index += 1
+      }
+    }
+    if (flag === '--model' && value !== null) {
+      model = value
+    } else if (flag === '--effort' && value !== null && EFFORT_LEVELS.includes(value)) {
+      effort = value as EffortLevel
+    } else {
+      extraArgs[flag.slice(2)] = value
+    }
+  }
+  return {
+    ...(model === undefined ? {} : { model }),
+    ...(effort === undefined ? {} : { effort }),
+    ...(Object.keys(extraArgs).length > 0 ? { extraArgs } : {})
+  }
+}
+
+export type ClaudeStructuredLaunch = {
+  /** Always Orca's resolved user CLI: the SDK's bundled binaries are excluded from the install. */
+  pathToClaudeCodeExecutable: string
+  options: ClaudeStructuredSdkOptions
+  cwd: string
+  env?: Record<string, string>
+  claudeConfigDir: string
+  providerSessionId: string
+  resumeLeafUuid: string | null
+  resumed: boolean
+}
+
+export type ClaudeStructuredLaunchResolverDeps = {
+  store: AgentSessionRecordStore
+  resolveWorkspacePath: (workspaceId: string) => Promise<string>
+  resolveCommand?: () => string
+  resolveEnv?: () =>
+    | Promise<Record<string, string> | undefined>
+    | Record<string, string>
+    | undefined
+  /**
+   * Required, and deliberately not defaulted. `stripAuthEnv` used to be a literal
+   * `true` here, so a missing dependency could not under-strip. Now it can, and the
+   * failure is silent — so every caller states the account's policy rather than
+   * inherit a guess. Build it with claudeStructuredAuthPolicyForSettings.
+   */
+  resolveAuthPolicy: () => Promise<ClaudeStructuredAuthPolicy> | ClaudeStructuredAuthPolicy
+  /** How long an in-flight account switch may hold a launch before it is refused. */
+  authSwitchSettleTimeoutMs?: number
+  /** Account state for the managed-account gate; null when it cannot be read, which refuses. */
+  readManagedAccountGate?: () => ClaudeManagedAccountGateSettings | null
+}
+
+/**
+ * Wait a running account switch out, and refuse only if it never settles.
+ *
+ * Launch resolution is reached from `acquireClaudeSession` *after* the old child has
+ * been closed and proved, so a plain refusal here would leave the user with a dead
+ * chat and no replacement — the very harm the acquire-entry guard exists to prevent.
+ * The entry guard still refuses outright, because nothing has been torn down yet.
+ */
+export async function assertClaudeAuthSwitchSettled(
+  timeoutMs = CLAUDE_AUTH_SWITCH_SETTLE_TIMEOUT_MS
+): Promise<void> {
+  if (!(await whenClaudeAuthSwitchSettles(timeoutMs))) {
+    throw new Error(CLAUDE_AUTH_SWITCH_IN_PROGRESS_MESSAGE)
+  }
+}
+
+export function claudeSessionIdForOrcaSession(sessionId: string): string {
+  const bytes = createHash('sha256').update(`orca-claude:${sessionId}`).digest().subarray(0, 16)
+  bytes[6] = ((bytes[6] ?? 0) & 0x0f) | 0x40
+  bytes[8] = ((bytes[8] ?? 0) & 0x3f) | 0x80
+  const hex = bytes.toString('hex')
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`
+}
+
+export function createClaudeStructuredLaunchResolver(
+  deps: ClaudeStructuredLaunchResolverDeps
+): (input: { identity: AgentSessionJournalIdentity }) => Promise<ClaudeStructuredLaunch> {
+  return async ({ identity }) => {
+    await assertClaudeAuthSwitchSettled(deps.authSwitchSettleTimeoutMs)
+    const record = deps.store.getRecord(identity.sessionId)
+    if (!record) {
+      throw new Error(`no durable agent-session record for ${identity.sessionId}`)
+    }
+    if (record.provider !== 'claude') {
+      throw new Error(`session ${identity.sessionId} is a ${record.provider} session`)
+    }
+    if (
+      record.location.executionHostId !== LOCAL_EXECUTION_HOST_ID ||
+      record.location.wslDistro !== null
+    ) {
+      throw new Error(
+        `claude structured sessions run on the local host, not ${record.location.executionHostId}`
+      )
+    }
+    if (record.accountHome.variable !== 'CLAUDE_CONFIG_DIR') {
+      throw new Error(`claude sessions pin CLAUDE_CONFIG_DIR, not ${record.accountHome.variable}`)
+    }
+    // Every acquisition, not just the first: the account state can change under a live session, and
+    // a reacquire after an unexpected exit would otherwise spawn under whatever it has become.
+    // Codex has no gate here — it resolves its account on a different path.
+    if (
+      deps.readManagedAccountGate &&
+      !structuredClaudeMatchesActiveManagedAccount(deps.readManagedAccountGate())
+    ) {
+      throw new AgentSessionPreSpawnError(
+        'structured Claude is not offered under the active managed Claude account'
+      )
+    }
+    const head = agentSessionProviderHandleChainHead(record.providerHandleChain)
+    if (
+      head?.handle.provider === 'claude' &&
+      (identity.providerHandle.kind !== 'claude' ||
+        identity.providerHandle.sessionId !== head.handle.sessionId ||
+        identity.providerHandle.leafUuid !== head.handle.leafUuid)
+    ) {
+      throw new Error('claude durable resume identity changed before spawn')
+    }
+    const providerSessionId =
+      head?.handle.provider === 'claude'
+        ? head.handle.sessionId
+        : claudeSessionIdForOrcaSession(identity.sessionId)
+    const durable = claudeSdkOptionsForLaunchArgs(record.launchArgs ?? [])
+    const command = (deps.resolveCommand ?? resolveClaudeCommand)()
+    const auth = await deps.resolveAuthPolicy()
+    const overlay = await deps.resolveEnv?.()
+    // A switch can begin while the policy and overlay resolve, exactly as it can
+    // during the terminal preflight's prepareClaudeAuth — recheck after the awaits.
+    await assertClaudeAuthSwitchSettled(deps.authSwitchSettleTimeoutMs)
+    // Under a managed account the pinned credential is the only auth this launch may
+    // use, so an explicit override is refused rather than silently beating the pin.
+    if (auth.stripAuthEnv && hasClaudeAuthEnvConflict(overlay)) {
+      throw new Error(CLAUDE_AUTH_ENV_CONFLICT_MESSAGE)
+    }
+    // Why the overlay merges onto the inherited env rather than replacing it: the child
+    // still needs PATH and the rest of the shell environment, and withCliRuntimeOnPath
+    // derives PATH from what it is handed. Ambient Anthropic auth is stripped from the
+    // inherited half only when a managed account owns the credential; a system-auth
+    // user's own key is their sign-in and must reach the child.
+    const env = withCliRuntimeOnPath(
+      command,
+      {
+        ...applyClaudeEnvPatch(
+          cloneDefinedEnv(process.env),
+          {},
+          {
+            stripAuthEnv: auth.stripAuthEnv,
+            platform: process.platform
+          }
+        ),
+        ...(overlay ? cloneDefinedEnv(overlay) : {})
+      },
+      { platform: process.platform }
+    )
+    return {
+      pathToClaudeCodeExecutable: command,
+      options: {
+        ...durable,
+        ...CLAUDE_STRUCTURED_BASE_OPTIONS,
+        extraArgs: { ...durable.extraArgs, ...CLAUDE_STRUCTURED_BASE_OPTIONS.extraArgs },
+        ...(head?.handle.provider === 'claude'
+          ? {
+              resume: providerSessionId,
+              ...(head.handle.leafUuid === null ? {} : { resumeSessionAt: head.handle.leafUuid })
+            }
+          : { sessionId: providerSessionId })
+      },
+      cwd: await deps.resolveWorkspacePath(record.location.workspaceId),
+      env,
+      claudeConfigDir: record.accountHome.path,
+      providerSessionId,
+      resumeLeafUuid: head?.handle.provider === 'claude' ? head.handle.leafUuid : null,
+      resumed: head?.handle.provider === 'claude'
+    }
+  }
+}
diff --git a/src/main/claude/claude-structured-location-support.test.ts b/src/main/claude/claude-structured-location-support.test.ts
new file mode 100644
index 00000000000..1106667d544
--- /dev/null
+++ b/src/main/claude/claude-structured-location-support.test.ts
@@ -0,0 +1,91 @@
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import {
+  __setWindowsProcessTreeLoaderForTests,
+  resetWindowsProcessTableForTests
+} from '../windows/windows-process-table'
+import { supportsClaudeStructuredLocation } from './claude-structured-location-support'
+
+function setPlatform(platform: NodeJS.Platform): PropertyDescriptor | undefined {
+  const previous = Object.getOwnPropertyDescriptor(process, 'platform')
+  Object.defineProperty(process, 'platform', { configurable: true, value: platform })
+  return previous
+}
+
+describe('supportsClaudeStructuredLocation', () => {
+  let previousPlatform: PropertyDescriptor | undefined
+
+  beforeEach(() => {
+    previousPlatform = setPlatform('darwin')
+    __setWindowsProcessTreeLoaderForTests()
+  })
+
+  afterEach(() => {
+    __setWindowsProcessTreeLoaderForTests()
+    resetWindowsProcessTableForTests()
+    if (previousPlatform) {
+      Object.defineProperty(process, 'platform', previousPlatform)
+    }
+  })
+
+  it('allows local non-WSL locations on macOS and Linux', () => {
+    expect(
+      supportsClaudeStructuredLocation({
+        executionHostId: 'local',
+        wslDistro: null,
+        workspaceId: 'workspace-1',
+        workspaceKind: 'git-worktree'
+      })
+    ).toBe(true)
+  })
+
+  it('rejects Windows local locations until creation-time proof is available', () => {
+    previousPlatform = setPlatform('win32')
+    __setWindowsProcessTreeLoaderForTests(() => ({
+      ProcessDataFlag: { None: 0, Memory: 1, CommandLine: 2 },
+      getAllProcesses: () => undefined
+    }))
+    expect(
+      supportsClaudeStructuredLocation({
+        executionHostId: 'local',
+        wslDistro: null,
+        workspaceId: 'workspace-1',
+        workspaceKind: 'git-worktree'
+      })
+    ).toBe(false)
+  })
+
+  it('accepts Windows local locations once creation-time proof is available', () => {
+    previousPlatform = setPlatform('win32')
+    __setWindowsProcessTreeLoaderForTests(() => ({
+      ProcessDataFlag: { None: 0, Memory: 1, CommandLine: 2, CreationTime: 4 },
+      getAllProcesses: () => undefined
+    }))
+    expect(
+      supportsClaudeStructuredLocation({
+        executionHostId: 'local',
+        wslDistro: null,
+        workspaceId: 'workspace-1',
+        workspaceKind: 'git-worktree'
+      })
+    ).toBe(true)
+  })
+
+  it('rejects WSL and remote locations', () => {
+    expect(
+      supportsClaudeStructuredLocation({
+        executionHostId: 'local',
+        wslDistro: 'Ubuntu',
+        workspaceId: 'workspace-1',
+        workspaceKind: 'git-worktree'
+      })
+    ).toBe(false)
+    expect(
+      supportsClaudeStructuredLocation({
+        executionHostId: 'runtime:env-1',
+        wslDistro: null,
+        workspaceId: 'workspace-1',
+        workspaceKind: 'git-worktree'
+      })
+    ).toBe(false)
+  })
+})
diff --git a/src/main/claude/claude-structured-location-support.ts b/src/main/claude/claude-structured-location-support.ts
new file mode 100644
index 00000000000..9c784a91325
--- /dev/null
+++ b/src/main/claude/claude-structured-location-support.ts
@@ -0,0 +1,11 @@
+import type { AgentSessionExecutionLocation } from '../../shared/agent-session-record'
+import { LOCAL_EXECUTION_HOST_ID } from '../../shared/execution-host'
+import { isWindowsProcessStartTimeAvailable } from '../windows/windows-process-table'
+
+export function supportsClaudeStructuredLocation(location: AgentSessionExecutionLocation): boolean {
+  return (
+    location.executionHostId === LOCAL_EXECUTION_HOST_ID &&
+    location.wslDistro === null &&
+    (process.platform !== 'win32' || isWindowsProcessStartTimeAvailable())
+  )
+}
diff --git a/src/main/claude/claude-structured-model-confirmation.test.ts b/src/main/claude/claude-structured-model-confirmation.test.ts
new file mode 100644
index 00000000000..7bd8f629119
--- /dev/null
+++ b/src/main/claude/claude-structured-model-confirmation.test.ts
@@ -0,0 +1,209 @@
+import { describe, expect, it } from 'vitest'
+import { setClaudeStructuredOption } from './claude-structured-options'
+import type { ClaudeSession } from './claude-structured-session-state'
+import { PROVIDER_SESSION_ID, acquired, fakeClaude } from './claude-structured-session-test-support'
+
+/** Verbatim rows from Claude Code 2.1.258's list_models response. */
+const CATALOG = [
+  {
+    value: 'default',
+    resolvedModel: 'claude-opus-5[1m]',
+    displayName: 'Default (recommended)',
+    supportsEffort: true,
+    supportedEffortLevels: ['low', 'medium', 'high', 'xhigh', 'max']
+  },
+  {
+    value: 'sonnet',
+    resolvedModel: 'claude-sonnet-5',
+    displayName: 'Sonnet',
+    supportsEffort: true,
+    supportedEffortLevels: ['low', 'medium', 'high', 'xhigh', 'max']
+  },
+  { value: 'haiku', resolvedModel: 'claude-haiku-4-5-20251001', displayName: 'Haiku' }
+]
+
+function initFrame(model: string): Record<string, unknown> {
+  // Keys mirror the real per-turn system/init frame: it carries `model` as the
+  // resolved id, and no effort of any kind.
+  return {
+    type: 'system',
+    subtype: 'init',
+    session_id: PROVIDER_SESSION_ID,
+    uuid: 'turn-init-uuid',
+    model,
+    apiKeySource: 'none'
+  }
+}
+
+describe('Claude model confirmation', () => {
+  it('adopts the model a later turn reports when nothing was set since', async () => {
+    const claude = fakeClaude({
+      initModel: 'claude-sonnet-5',
+      routes: { list_models: () => CATALOG }
+    })
+    const adapter = await acquired(claude)
+
+    await expect(adapter.readOptions({ sessionId: 'session-1', fence: 7 })).resolves.toMatchObject({
+      current: { model: 'sonnet' }
+    })
+
+    // The CLI's own report of what it is running — the only channel that carries
+    // it, since set_model answers success for a model it never resolves.
+    claude.connections[0]!.handlers.onMessage?.(initFrame('claude-haiku-4-5-20251001'))
+
+    await expect(adapter.readOptions({ sessionId: 'session-1', fence: 7 })).resolves.toMatchObject({
+      current: { model: 'haiku' }
+    })
+  })
+
+  it('keeps a just-set model until the next turn reports one', async () => {
+    const claude = fakeClaude({
+      initModel: 'claude-sonnet-5',
+      routes: { list_models: () => CATALOG }
+    })
+    const adapter = await acquired(claude)
+
+    await adapter.setOption({ sessionId: 'session-1', key: 'model', value: 'haiku', fence: 7 })
+
+    // No turn has run, so the acquisition-time report is older than the write and
+    // must not flip the pill back to the model the session started on.
+    await expect(adapter.readOptions({ sessionId: 'session-1', fence: 7 })).resolves.toMatchObject({
+      current: { model: 'haiku' }
+    })
+  })
+
+  it('corrects the record when the turn runs a different model than was set', async () => {
+    const claude = fakeClaude({
+      initModel: 'claude-sonnet-5',
+      routes: { list_models: () => CATALOG }
+    })
+    const adapter = await acquired(claude)
+
+    await adapter.setOption({ sessionId: 'session-1', key: 'model', value: 'haiku', fence: 7 })
+    claude.connections[0]!.handlers.onMessage?.(initFrame('claude-sonnet-5'))
+
+    await expect(adapter.readOptions({ sessionId: 'session-1', fence: 7 })).resolves.toMatchObject({
+      current: { model: 'sonnet' }
+    })
+  })
+
+  it('guards an effort against the model the turn reported, not the one that was set', async () => {
+    const claude = fakeClaude({
+      initModel: 'claude-sonnet-5',
+      routes: { list_models: () => CATALOG }
+    })
+    const adapter = await acquired(claude)
+
+    await adapter.setOption({ sessionId: 'session-1', key: 'model', value: 'haiku', fence: 7 })
+    // set_model answered success for a model it never resolved; the turn runs sonnet.
+    claude.connections[0]!.handlers.onMessage?.(initFrame('claude-sonnet-5'))
+
+    // The picker offers sonnet's levels, so refusing one under haiku — a model the
+    // pill does not show and the child is not running — is the false positive.
+    await expect(
+      adapter.setOption({ sessionId: 'session-1', key: 'effort', value: 'high', fence: 7 })
+    ).resolves.toMatchObject({ effort: 'high' })
+  })
+
+  it('keeps guarding against the reported model across a second effort write', async () => {
+    const claude = fakeClaude({
+      initModel: 'claude-sonnet-5',
+      routes: { list_models: () => CATALOG }
+    })
+    const adapter = await acquired(claude)
+
+    await adapter.setOption({ sessionId: 'session-1', key: 'model', value: 'haiku', fence: 7 })
+    claude.connections[0]!.handlers.onMessage?.(initFrame('claude-sonnet-5'))
+    await adapter.setOption({ sessionId: 'session-1', key: 'effort', value: 'high', fence: 7 })
+
+    // The effort write bumps the option fence but does not change what the child
+    // runs, so the sonnet report is still current and still governs the guard.
+    // `max` skips the settings readback by contract, so only the catalog gates it:
+    // sonnet advertises it, haiku advertises no effort control at all.
+    await expect(
+      adapter.setOption({ sessionId: 'session-1', key: 'effort', value: 'max', fence: 7 })
+    ).resolves.toMatchObject({ effort: 'max' })
+  })
+
+  it('guards an effort against a just-set model no turn has reported yet', async () => {
+    const claude = fakeClaude({
+      initModel: 'claude-sonnet-5',
+      routes: { list_models: () => CATALOG }
+    })
+    const adapter = await acquired(claude)
+
+    await adapter.setOption({ sessionId: 'session-1', key: 'model', value: 'haiku', fence: 7 })
+
+    // The acquisition-time report predates the write, so haiku — which advertises
+    // no effort control — is still the model the guard must answer for.
+    await expect(
+      adapter.setOption({ sessionId: 'session-1', key: 'effort', value: 'high', fence: 7 })
+    ).rejects.toThrow('claude model haiku does not accept effort high')
+  })
+
+  it('stops vouching for a confirmed effort once the model changes', async () => {
+    const claude = fakeClaude({
+      initModel: 'claude-sonnet-5',
+      routes: { list_models: () => CATALOG }
+    })
+    const adapter = await acquired(claude)
+
+    await adapter.setOption({ sessionId: 'session-1', key: 'effort', value: 'high', fence: 7 })
+    await expect(adapter.readOptions({ sessionId: 'session-1', fence: 7 })).resolves.toMatchObject({
+      current: { model: 'sonnet', effort: 'high', confirmed: ['model', 'effort'] }
+    })
+
+    await adapter.setOption({ sessionId: 'session-1', key: 'model', value: 'haiku', fence: 7 })
+
+    // The readback was taken under sonnet; nothing has reported haiku holding it.
+    const options = await adapter.readOptions({ sessionId: 'session-1', fence: 7 })
+    expect(options.current.effort).toBe('high')
+    expect(options.current.confirmed).toBeUndefined()
+  })
+})
+
+describe('Claude effort the settings readback cannot report', () => {
+  function sessionWith(
+    reported: string,
+    calls: string[] = []
+  ): { session: ClaudeSession; calls: string[] } {
+    return {
+      session: {
+        options: new Map<string, string>([['model', 'sonnet']]),
+        reportedOptions: {},
+        optionMutationSequence: 0,
+        confirmedOptions: new Set<string>(),
+        connection: {
+          supportedModels: async () => {
+            calls.push('list_models')
+            return CATALOG
+          },
+          applyFlagSettings: async (settings: { effortLevel?: string }) => {
+            calls.push(`apply:${settings.effortLevel}`)
+          },
+          getSettings: async () => {
+            calls.push('get_settings')
+            return {
+              applied: { effort: reported },
+              effective: { effortLevel: reported },
+              sources: {}
+            }
+          }
+        }
+      } as unknown as ClaudeSession,
+      calls
+    }
+  }
+
+  it('records a session-scoped effort the persisted settings never carry', async () => {
+    // `max` applies for the session and is deliberately excluded from the
+    // persisted effortLevel, so the readback reporting `high` is an absence of
+    // evidence, not a refusal — and the CLI offers `max` in its own catalog.
+    const { session, calls } = sessionWith('high')
+
+    await expect(
+      setClaudeStructuredOption(session, { key: 'effort', value: 'max' }, undefined)
+    ).resolves.toEqual({ model: 'sonnet', effort: 'max' })
+    expect(calls).toEqual(['list_models', 'apply:max'])
+  })
+})
diff --git a/src/main/claude/claude-structured-option-confirmation.test.ts b/src/main/claude/claude-structured-option-confirmation.test.ts
new file mode 100644
index 00000000000..ca7b8b70f1c
--- /dev/null
+++ b/src/main/claude/claude-structured-option-confirmation.test.ts
@@ -0,0 +1,193 @@
+import { describe, expect, it } from 'vitest'
+import {
+  applyStructuredAgentSessionOptions,
+  createStructuredAgentSessionOptionState,
+  structuredAgentSessionOptionSnapshot
+} from '../../shared/structured-agent-session-options'
+import { CLAUDE_SESSION_OPTION_CATALOG } from '../../shared/agent-session-option-catalog-claude-codex'
+import type { AgentSessionOptionsResult } from '../../shared/agent-session-wire'
+import type { SessionOptionDescriptor } from '../../shared/native-chat-session-options'
+import { setClaudeStructuredOption } from './claude-structured-options'
+import type { ClaudeSession } from './claude-structured-session-state'
+import { PROVIDER_SESSION_ID, acquired, fakeClaude } from './claude-structured-session-test-support'
+
+/** Verbatim rows from Claude Code 2.1.260's list_models response: `haiku` really
+ *  does omit both effort keys, which is what makes an effort under it refusable. */
+const CATALOG = [
+  {
+    value: 'sonnet',
+    resolvedModel: 'claude-sonnet-5',
+    displayName: 'Sonnet',
+    supportsEffort: true,
+    supportedEffortLevels: ['low', 'medium', 'high', 'xhigh', 'max']
+  },
+  { value: 'haiku', resolvedModel: 'claude-haiku-4-5-20251001', displayName: 'Haiku' }
+]
+
+function initFrame(model: string): Record<string, unknown> {
+  return {
+    type: 'system',
+    subtype: 'init',
+    session_id: PROVIDER_SESSION_ID,
+    uuid: 'turn-init-uuid',
+    model,
+    apiKeySource: 'none'
+  }
+}
+
+function modelPill(result: AgentSessionOptionsResult): SessionOptionDescriptor | undefined {
+  const state = applyStructuredAgentSessionOptions(
+    createStructuredAgentSessionOptionState('claude'),
+    CLAUDE_SESSION_OPTION_CATALOG,
+    result
+  )
+  return structuredAgentSessionOptionSnapshot(state).find((d) => d.category === 'model')
+}
+
+/** Provenance the record keeps. Nothing renders it — the pill shows the value
+ *  either way, and a report that disagrees is what corrects it. */
+function modelSource(result: AgentSessionOptionsResult): string | undefined {
+  return modelPill(result)?.valueSource
+}
+
+function modelValue(result: AgentSessionOptionsResult): string | undefined {
+  const kind = modelPill(result)?.kind
+  return kind?.type === 'select' ? kind.currentValue : undefined
+}
+
+describe('structured option confirmation reaches the pill', () => {
+  it('shows a just-set model before any turn reports it', async () => {
+    const claude = fakeClaude({
+      initModel: 'claude-sonnet-5',
+      routes: { list_models: () => CATALOG }
+    })
+    const adapter = await acquired(claude)
+    await adapter.setOption({ sessionId: 'session-1', key: 'model', value: 'haiku', fence: 7 })
+
+    const result = await adapter.readOptions({ sessionId: 'session-1', fence: 7 })
+    expect(result.current.confirmed ?? []).not.toContain('model')
+    expect(modelSource(result)).toBe('dispatched')
+  })
+
+  it('marks the model reported once the provider names it back', async () => {
+    const claude = fakeClaude({
+      initModel: 'claude-sonnet-5',
+      routes: { list_models: () => CATALOG }
+    })
+    const adapter = await acquired(claude)
+    await adapter.setOption({ sessionId: 'session-1', key: 'model', value: 'haiku', fence: 7 })
+    claude.connections[0]!.handlers.onMessage?.(initFrame('claude-haiku-4-5-20251001'))
+
+    const result = await adapter.readOptions({ sessionId: 'session-1', fence: 7 })
+    expect(result.current.confirmed).toContain('model')
+    expect(modelSource(result)).toBe('reported')
+  })
+
+  it('records an effort the readback could not take without confirming it', async () => {
+    const claude = fakeClaude({
+      initModel: 'claude-sonnet-5',
+      settings: { applied: {}, effective: {}, sources: {} },
+      routes: { list_models: () => CATALOG }
+    })
+    const adapter = await acquired(claude)
+    // `max` is session-scoped and absent from the persisted settings, so it records
+    // without a readback — recorded, never vouched for.
+    await adapter.setOption({ sessionId: 'session-1', key: 'effort', value: 'max', fence: 7 })
+
+    const result = await adapter.readOptions({ sessionId: 'session-1', fence: 7 })
+    expect(result.current.effort).toBe('max')
+    expect(result.current.confirmed ?? []).not.toContain('effort')
+  })
+
+  it('confirms an effort the readback agreed with', async () => {
+    const claude = fakeClaude({
+      initModel: 'claude-sonnet-5',
+      settings: { applied: { effort: 'low' }, effective: { effortLevel: 'low' }, sources: {} },
+      routes: { list_models: () => CATALOG }
+    })
+    const adapter = await acquired(claude)
+    await adapter.setOption({ sessionId: 'session-1', key: 'effort', value: 'low', fence: 7 })
+
+    const result = await adapter.readOptions({ sessionId: 'session-1', fence: 7 })
+    expect(result.current.confirmed).toContain('effort')
+  })
+
+  it('treats a host that reports no confirmation as unconfirmed', () => {
+    // Wire compatibility: an older host omits `confirmed` entirely. Absence must
+    // read as unconfirmed provenance, and the pill still shows the host's value.
+    const result = {
+      models: [{ id: 'haiku', label: 'Haiku', isDefault: false, efforts: [] }],
+      current: { model: 'haiku' }
+    }
+    expect(modelSource(result)).toBe('dispatched')
+    expect(modelValue(result)).toBe('haiku')
+  })
+})
+
+describe('the provider report corrects the pill', () => {
+  it('moves the pill to the model the turn actually ran', async () => {
+    const claude = fakeClaude({
+      initModel: 'claude-sonnet-5',
+      routes: { list_models: () => CATALOG }
+    })
+    const adapter = await acquired(claude)
+    await adapter.setOption({ sessionId: 'session-1', key: 'model', value: 'haiku', fence: 7 })
+    expect(modelValue(await adapter.readOptions({ sessionId: 'session-1', fence: 7 }))).toBe(
+      'haiku'
+    )
+
+    claude.connections[0]!.handlers.onMessage?.(initFrame('claude-sonnet-5'))
+
+    const corrected = await adapter.readOptions({ sessionId: 'session-1', fence: 7 })
+    expect(modelValue(corrected)).toBe('sonnet')
+    expect(corrected.current.confirmed).toContain('model')
+  })
+
+  it('lets a newer write outrank the report it precedes', async () => {
+    const claude = fakeClaude({
+      initModel: 'claude-sonnet-5',
+      routes: { list_models: () => CATALOG }
+    })
+    const adapter = await acquired(claude)
+    claude.connections[0]!.handlers.onMessage?.(initFrame('claude-sonnet-5'))
+    await adapter.setOption({ sessionId: 'session-1', key: 'model', value: 'haiku', fence: 7 })
+
+    const result = await adapter.readOptions({ sessionId: 'session-1', fence: 7 })
+    expect(modelValue(result)).toBe('haiku')
+    expect(result.current.confirmed ?? []).not.toContain('model')
+  })
+})
+
+describe('confirmation never outlives the write it belongs to', () => {
+  it('drops an earlier effort confirmation when the value changes', async () => {
+    const calls: string[] = []
+    let reported = 'low'
+    const session = {
+      options: new Map<string, string>([['model', 'sonnet']]),
+      reportedOptions: {},
+      optionMutationSequence: 0,
+      confirmedOptions: new Set<string>(),
+      connection: {
+        supportedModels: async () => CATALOG,
+        applyFlagSettings: async (s: { effortLevel?: string }) => {
+          calls.push(`apply:${s.effortLevel}`)
+        },
+        getSettings: async () => ({
+          applied: { effort: reported },
+          effective: { effortLevel: reported },
+          sources: {}
+        })
+      }
+    } as unknown as ClaudeSession
+
+    await setClaudeStructuredOption(session, { key: 'effort', value: 'low' }, undefined)
+    expect(session.confirmedOptions.has('effort')).toBe(true)
+
+    // The provider now reports a level it cannot represent; the stale confirmation
+    // must not survive into the new value.
+    await setClaudeStructuredOption(session, { key: 'effort', value: 'max' }, undefined)
+    expect(session.options.get('effort')).toBe('max')
+    expect(session.confirmedOptions.has('effort')).toBe(false)
+    expect(calls).toEqual(['apply:low', 'apply:max'])
+  })
+})
diff --git a/src/main/claude/claude-structured-options.test.ts b/src/main/claude/claude-structured-options.test.ts
new file mode 100644
index 00000000000..0738095f45d
--- /dev/null
+++ b/src/main/claude/claude-structured-options.test.ts
@@ -0,0 +1,53 @@
+import { describe, expect, it, vi } from 'vitest'
+import { setClaudeStructuredOption } from './claude-structured-options'
+import type { ClaudeSession } from './claude-structured-session-state'
+import { ClaudeBackgroundTaskTracker } from './claude-background-task-tracker'
+
+function sessionFor(setModel: ClaudeSession['connection']['setModel']): ClaudeSession {
+  return {
+    connection: { setModel } as ClaudeSession['connection'],
+    providerSessionId: 'provider-session',
+    claudeConfigDir: '/accounts/claude',
+    leafUuid: null,
+    fence: 1,
+    acquisitionGeneration: 'generation-1',
+    prompts: {} as ClaudeSession['prompts'],
+    dispatchWaiters: [],
+    retiredDispatchWaiters: [],
+    replayContentFallbackBlocked: false,
+    backgroundTasks: new ClaudeBackgroundTaskTracker(),
+    dispatchSequence: 0,
+    optionMutationSequence: 0,
+    options: new Map(),
+    reportedOptions: {},
+    reportedModelMutation: 0,
+    confirmedOptions: new Set(),
+    restoreSkippedOptions: new Set(),
+    capabilities: [],
+    events: undefined,
+    translator: null
+  }
+}
+
+describe('Claude structured option mutation fencing', () => {
+  it('does not let a delayed earlier apply overwrite a later option', async () => {
+    let releaseFirst!: () => void
+    const firstApply = new Promise<void>((resolve) => {
+      releaseFirst = resolve
+    })
+    const setModel = vi
+      .fn<ClaudeSession['connection']['setModel']>()
+      .mockReturnValueOnce(firstApply)
+      .mockResolvedValue(undefined)
+    const session = sessionFor(setModel)
+
+    const first = setClaudeStructuredOption(session, { key: 'model', value: 'old' }, undefined)
+    await vi.waitFor(() => expect(setModel).toHaveBeenCalledTimes(1))
+    const second = setClaudeStructuredOption(session, { key: 'model', value: 'new' }, undefined)
+    await expect(second).resolves.toEqual({ model: 'new' })
+
+    releaseFirst()
+    await expect(first).resolves.toEqual({ model: 'new' })
+    expect(session.options).toEqual(new Map([['model', 'new']]))
+  })
+})
diff --git a/src/main/claude/claude-structured-options.ts b/src/main/claude/claude-structured-options.ts
new file mode 100644
index 00000000000..3d1377b12c6
--- /dev/null
+++ b/src/main/claude/claude-structured-options.ts
@@ -0,0 +1,147 @@
+import type { EffortLevel, PermissionMode } from '@anthropic-ai/claude-agent-sdk'
+import { ClaudeControlRequestError } from './claude-stream-json-connection'
+import {
+  AgentSessionOptionRejectedError,
+  isAgentSessionOptionRejectedError
+} from '../native-chat/agent-session-wire/structured-agent-session-option-error'
+import {
+  readClaudeCurrentModel,
+  readClaudeModelEffortLevels,
+  readClaudeSettingsEffort
+} from './claude-structured-session-options'
+import type { ClaudeSession } from './claude-structured-session-state'
+
+const OPTION_ORDER = ['model', 'effort', 'permissionMode'] as const
+
+/**
+ * Efforts the settings readback cannot report. `max` applies for the rest of the
+ * session and is excluded from the persisted `effortLevel` by contract, so
+ * `get_settings` answers with the level underneath it — an absence of evidence
+ * that must not be read as the child refusing a level its own catalog offers.
+ */
+const UNREPORTED_EFFORTS: ReadonlySet<string> = new Set(['max'])
+
+export function restoredClaudeStructuredSessionOptions(
+  options: Readonly<Record<string, string>> | undefined
+): Map<string, string> {
+  return new Map(
+    OPTION_ORDER.flatMap((key) => {
+      const value = options?.[key]
+      return value ? [[key, value] as const] : []
+    })
+  )
+}
+
+export async function setClaudeStructuredOption(
+  session: ClaudeSession,
+  input: { key: string; value: string },
+  timeoutMs: number | undefined
+): Promise<Readonly<Record<string, string>>> {
+  const apply =
+    input.key === 'model'
+      ? () => session.connection.setModel(input.value, { timeoutMs })
+      : input.key === 'permissionMode'
+        ? () => session.connection.setPermissionMode(input.value as PermissionMode, { timeoutMs })
+        : input.key === 'effort'
+          ? () =>
+              session.connection.applyFlagSettings(
+                { effortLevel: input.value as EffortLevel },
+                { timeoutMs }
+              )
+          : null
+  if (!apply) {
+    throw new AgentSessionOptionRejectedError(
+      `claude stream-json has no session option named ${input.key}`
+    )
+  }
+  // The child stores an effort its model has no control for and keeps it across
+  // every later model switch and restore, so refuse before the write rather than
+  // read the acceptance back as adoption. Refused here, restore drops the stale
+  // value instead of replaying it onto a model that cannot use it.
+  if (input.key === 'effort') {
+    const { modelId, levels } = await readClaudeModelEffortLevels(session, timeoutMs)
+    if (levels && !levels.has(input.value)) {
+      throw new AgentSessionOptionRejectedError(
+        `claude model ${modelId} does not accept effort ${input.value}`
+      )
+    }
+  }
+  const modelWasConfirmed = readClaudeCurrentModel(session).confirmed
+  const mutationSequence = ++session.optionMutationSequence
+  // Only a model write can stale the model report — an effort or permission-mode
+  // write does not change what the child is running. Leaving the stamp behind
+  // would drop the session back to the written model and refuse, on the next
+  // effort write, a level the model actually running advertises.
+  if (modelWasConfirmed && input.key !== 'model') {
+    session.reportedModelMutation = mutationSequence
+  }
+  try {
+    await apply()
+  } catch (error) {
+    if (error instanceof ClaudeControlRequestError) {
+      throw new AgentSessionOptionRejectedError(error)
+    }
+    throw error
+  }
+  // apply_flag_settings answers `success` for an effort it then ignores, so the
+  // absence of a throw proves nothing. Ask what the child actually holds.
+  const adopted =
+    input.key === 'effort' && !UNREPORTED_EFFORTS.has(input.value)
+      ? await session.connection
+          .getSettings({ timeoutMs })
+          .then(readClaudeSettingsEffort)
+          .catch(() => null)
+      : null
+  if (mutationSequence !== session.optionMutationSequence) {
+    return Object.fromEntries(session.options)
+  }
+  // A disagreement stops main vouching for the value, it does not veto the write:
+  // the pre-flight guard already refuses levels the model advertises no control
+  // for, and no other client refuses on a readback. Keep the child's own answer so
+  // the disagreement survives as the level a later read falls back to.
+  if (adopted !== null && adopted !== input.value) {
+    session.reportedOptions.effort = adopted
+  }
+  session.options.set(input.key, input.value)
+  // Only a readback that agreed is adoption evidence; one that disagreed or could
+  // not be taken records the value but must not also claim the provider vouched for it.
+  if (adopted !== null && adopted === input.value) {
+    session.confirmedOptions.add(input.key)
+  } else {
+    session.confirmedOptions.delete(input.key)
+  }
+  // The effort readback was taken under the old model, so a model switch retires
+  // it: the child keeps the value but nothing has reported the new model holding
+  // it, and vouching for it would show a confirmed effort no readback covers.
+  if (input.key === 'model') {
+    session.confirmedOptions.delete('effort')
+  }
+  return Object.fromEntries(session.options)
+}
+
+export async function restoreClaudeStructuredSessionOptions(
+  session: ClaudeSession,
+  timeoutMs: number | undefined
+): Promise<void> {
+  // Any write that was already in flight belongs to the previous acquisition
+  // state and must not repopulate this map after restore starts.
+  session.optionMutationSequence += 1
+  // The fence bump is not a write, so the report the session already holds is still
+  // current as of this instant; leaving the stamp behind would make every restored
+  // session read as unconfirmed until its next turn.
+  session.reportedModelMutation = session.optionMutationSequence
+  const options = [...session.options.entries()]
+  session.options.clear()
+  for (const [key, value] of options) {
+    try {
+      await setClaudeStructuredOption(session, { key, value }, timeoutMs)
+    } catch (error) {
+      if (!isAgentSessionOptionRejectedError(error)) {
+        throw error
+      }
+      // A stale or unavailable preference must not poison every future acquire;
+      // the provider's current value remains authoritative and is re-persisted.
+      session.restoreSkippedOptions.add(key)
+    }
+  }
+}
diff --git a/src/main/claude/claude-structured-owner-identity.test.ts b/src/main/claude/claude-structured-owner-identity.test.ts
new file mode 100644
index 00000000000..592b61df338
--- /dev/null
+++ b/src/main/claude/claude-structured-owner-identity.test.ts
@@ -0,0 +1,39 @@
+import { describe, expect, it, vi } from 'vitest'
+import { CLAUDE_SPAWN_TOKEN_ENV, claudeProcessIdentity } from './claude-structured-owner-identity'
+
+const IDENTITY = {
+  sessionId: 'session-identity',
+  workspaceId: 'workspace-1',
+  hostId: 'local',
+  agent: 'claude' as const,
+  providerHandle: { kind: 'claude' as const, sessionId: 'session-1', leafUuid: 'leaf-1' }
+}
+
+describe('claude structured owner identity', () => {
+  it('exports the spawn token env and records the observed process identity', async () => {
+    expect(CLAUDE_SPAWN_TOKEN_ENV).toBe('ORCA_AGENT_SESSION_SPAWN_TOKEN')
+    await expect(
+      claudeProcessIdentity(
+        { identity: IDENTITY, spawnToken: 'spawn-a', pid: 4242 },
+        async () => 123
+      )
+    ).resolves.toEqual({
+      hostId: 'local',
+      pid: 4242,
+      processStartTimeMs: 123,
+      spawnToken: 'spawn-a'
+    })
+  })
+
+  it('retries a failed start-time read before giving up', async () => {
+    const readStartTime = vi
+      .fn<(pid: number) => Promise<number | null>>()
+      .mockResolvedValueOnce(null)
+      .mockResolvedValueOnce(null)
+      .mockResolvedValueOnce(456)
+    await expect(
+      claudeProcessIdentity({ identity: IDENTITY, spawnToken: 'spawn-a', pid: 4242 }, readStartTime)
+    ).resolves.toMatchObject({ processStartTimeMs: 456 })
+    expect(readStartTime).toHaveBeenCalledTimes(3)
+  })
+})
diff --git a/src/main/claude/claude-structured-owner-identity.ts b/src/main/claude/claude-structured-owner-identity.ts
index 1d13e6ec7c2..e8f251d41f9 100644
--- a/src/main/claude/claude-structured-owner-identity.ts
+++ b/src/main/claude/claude-structured-owner-identity.ts
@@ -1,4 +1,7 @@
+import type { AgentSessionJournalIdentity } from '../../shared/agent-session-journal-types'
 import type { AgentSessionProviderHandleLink } from '../../shared/agent-session-provider-handle'
+import type { AgentSessionProcessIdentity } from '../../shared/agent-session-record'
+import { readProcessStartTimeMs } from '../runtime/agent-session-process-identity-probe'
 
 export function claudeProviderHandleLink(input: {
   sessionId: string
@@ -19,3 +22,41 @@ export function claudeProviderHandleLink(input: {
     observedAt: input.observedAt
   }
 }
+
+/** The child echoes its spawn token here so the owner probe can tell a live
+ *  child of this reservation from a same-pid stranger. */
+export const CLAUDE_SPAWN_TOKEN_ENV = 'ORCA_AGENT_SESSION_SPAWN_TOKEN'
+
+const START_TIME_READ_ATTEMPTS = 3
+
+export async function claudeProcessIdentity(
+  input: {
+    identity: AgentSessionJournalIdentity
+    spawnToken: string
+    pid: number | undefined
+  },
+  readStartTime: (pid: number) => Promise<number | null> = readProcessStartTimeMs
+): Promise<AgentSessionProcessIdentity> {
+  if (input.pid === undefined) {
+    throw new Error('claude app-server started without a pid')
+  }
+  let processStartTimeMs: number | null = null
+  for (
+    let attempt = 0;
+    attempt < START_TIME_READ_ATTEMPTS && processStartTimeMs === null;
+    attempt += 1
+  ) {
+    processStartTimeMs = await readStartTime(input.pid)
+  }
+  if (processStartTimeMs === null) {
+    // Why: recording null makes every later owner probe indeterminate — a durable latch.
+    // Failing here reaps the child and leaves a retryable refusal instead.
+    throw new Error(`claude app-server start time for pid ${input.pid} could not be read`)
+  }
+  return {
+    hostId: input.identity.hostId,
+    pid: input.pid,
+    processStartTimeMs,
+    spawnToken: input.spawnToken
+  }
+}
diff --git a/src/main/claude/claude-structured-prompt-items.test.ts b/src/main/claude/claude-structured-prompt-items.test.ts
new file mode 100644
index 00000000000..79916d6a507
--- /dev/null
+++ b/src/main/claude/claude-structured-prompt-items.test.ts
@@ -0,0 +1,110 @@
+import { describe, expect, it } from 'vitest'
+import { agentJournalItemKey } from '../../shared/agent-session-journal-item-key'
+import { encodeAgentSessionQuestionAnswers } from '../../shared/agent-session-question-answer'
+import { claudeQuestionItems } from './claude-structured-prompt-items'
+import {
+  applyClaudePromptAnswer,
+  encodeClaudeQuestionOptionId,
+  type ClaudePendingPrompt
+} from './claude-structured-prompt-replies'
+
+describe('Claude structured question addressing', () => {
+  it('keeps wire IDs bounded while returning the original question and choice', () => {
+    const questionId = 'Which option? '.repeat(100)
+    const label = 'A detailed choice '.repeat(100)
+    const prompt: ClaudePendingPrompt = {
+      requestId: 'question-1',
+      promptKey: 'question-1',
+      toolUseId: 'tool-1',
+      toolName: 'AskUserQuestion',
+      kind: 'question',
+      input: { questions: [{ question: questionId, options: [{ label }] }] },
+      suggestions: [],
+      questionIds: [questionId],
+      answers: new Map(),
+      settle: () => {}
+    }
+
+    const item = claudeQuestionItems({ sessionId: 'session-1', prompt })[0]!
+    expect(agentJournalItemKey(item.identity).length).toBeLessThan(512)
+    expect(item.body.options[0]!.id.length).toBeLessThan(512)
+    expect(item.body.freeTextQuestionId).toBe('q1')
+    expect(applyClaudePromptAnswer({ prompt }, item.body.options[0]!.id)).toMatchObject({
+      updatedInput: { answers: { [questionId]: label } }
+    })
+  })
+
+  it('preserves colon-containing free-text answers', () => {
+    const questionId = 'Where should this run?'
+    const prompt: ClaudePendingPrompt = {
+      requestId: 'question-1',
+      promptKey: 'question-1',
+      toolUseId: 'tool-1',
+      toolName: 'AskUserQuestion',
+      kind: 'question',
+      input: { questions: [{ question: questionId }] },
+      suggestions: [],
+      questionIds: [questionId],
+      answers: new Map(),
+      settle: () => {}
+    }
+    const answer = 'https://example.test:8443/path'
+
+    expect(
+      applyClaudePromptAnswer({ prompt }, encodeClaudeQuestionOptionId('q1', answer))
+    ).toMatchObject({
+      updatedInput: { answers: { [questionId]: answer } }
+    })
+  })
+
+  it('returns arrays for multi-select and preserves mixed single and Other answers', () => {
+    const multiQuestion = 'Which targets?'
+    const singleQuestion = 'Which mode?'
+    const otherQuestion = 'Where should it run?'
+    const prompt: ClaudePendingPrompt = {
+      requestId: 'question-1',
+      promptKey: 'question-1',
+      toolUseId: 'tool-1',
+      toolName: 'AskUserQuestion',
+      kind: 'question',
+      input: {
+        questions: [
+          {
+            question: multiQuestion,
+            multiSelect: true,
+            options: [{ label: 'frontend' }, { label: 'backend' }]
+          },
+          {
+            question: singleQuestion,
+            options: [{ label: 'fast' }, { label: 'safe' }]
+          },
+          { question: otherQuestion, options: [] }
+        ]
+      },
+      suggestions: [],
+      questionIds: [multiQuestion, singleQuestion, otherQuestion],
+      answers: new Map(),
+      settle: () => {}
+    }
+    const item = claudeQuestionItems({ sessionId: 'session-1', prompt })[0]!
+    const questions = item.body.questions!
+    const encoded = encodeAgentSessionQuestionAnswers([
+      {
+        questionId: 'q1',
+        optionIds: [questions[0]!.options[0]!.id, questions[0]!.options[1]!.id]
+      },
+      { questionId: 'q2', optionIds: [questions[1]!.options[1]!.id] },
+      { questionId: 'q3', optionIds: [], other: 'remote host' }
+    ])
+
+    expect(applyClaudePromptAnswer({ prompt }, encoded)).toMatchObject({
+      updatedInput: {
+        answers: {
+          [multiQuestion]: ['frontend', 'backend'],
+          [singleQuestion]: 'safe',
+          [otherQuestion]: 'remote host'
+        }
+      }
+    })
+  })
+})
diff --git a/src/main/claude/claude-structured-prompt-items.ts b/src/main/claude/claude-structured-prompt-items.ts
new file mode 100644
index 00000000000..3bdf8ab6091
--- /dev/null
+++ b/src/main/claude/claude-structured-prompt-items.ts
@@ -0,0 +1,134 @@
+import type {
+  AgentJournalApprovalItem,
+  AgentJournalItemIdentity,
+  AgentJournalPromptOption,
+  AgentJournalQuestion,
+  AgentJournalQuestionItem
+} from '../../shared/agent-session-journal-types'
+import {
+  boundInlineText,
+  DEFAULT_JOURNAL_PAYLOAD_LIMITS
+} from '../native-chat/agent-session-journal/journal-payload-bounds'
+import { claudeRecord, claudeText } from './claude-structured-item-translation'
+import {
+  CLAUDE_APPROVAL_DECISIONS,
+  encodeClaudeQuestionOptionId,
+  type ClaudeApprovalDecision,
+  type ClaudePendingPrompt
+} from './claude-structured-prompt-replies'
+
+const APPROVAL_LABELS: Record<ClaudeApprovalDecision, string> = {
+  allow: 'Allow',
+  allowForSession: 'Allow for this session',
+  deny: 'Deny',
+  cancel: 'Stop'
+}
+
+const PENDING = {
+  state: 'pending',
+  selectedOptionId: null,
+  resolvedBy: null,
+  resolvedAt: null
+} as const
+
+export function claudePromptIdentity(input: {
+  sessionId: string
+  promptKey: string
+  questionId?: string
+}): AgentJournalItemIdentity {
+  const suffix = input.questionId ? `:${input.questionId}` : ''
+  return {
+    provider: 'orca',
+    clientMessageId: `claude-prompt:${input.sessionId}:${input.promptKey}${suffix}`
+  }
+}
+
+export function claudeApprovalItem(prompt: ClaudePendingPrompt): AgentJournalApprovalItem {
+  const serialized = JSON.stringify(prompt.input)
+  return {
+    kind: 'approval',
+    title: `Allow ${prompt.toolName}?`,
+    detail: serialized ? boundInlineText(serialized, DEFAULT_JOURNAL_PAYLOAD_LIMITS).text : null,
+    options: CLAUDE_APPROVAL_DECISIONS.map((decision) => ({
+      id: decision,
+      label: APPROVAL_LABELS[decision]
+    })),
+    resolution: { ...PENDING }
+  }
+}
+
+export type ClaudeQuestionItem = {
+  identity: AgentJournalItemIdentity
+  body: AgentJournalQuestionItem
+}
+
+function questionOptions(
+  question: Record<string, unknown>,
+  questionAddress: string
+): AgentJournalPromptOption[] {
+  if (!Array.isArray(question.options)) {
+    return []
+  }
+  return question.options.flatMap((value, index) => {
+    const option = claudeRecord(value)
+    const label = claudeText(option?.label)
+    const description = claudeText(option?.description)
+    return label
+      ? [
+          {
+            id: encodeClaudeQuestionOptionId(questionAddress, `choice-${index + 1}`),
+            label,
+            ...(description ? { description } : {})
+          }
+        ]
+      : []
+  })
+}
+
+export function claudeQuestionItems(input: {
+  sessionId: string
+  prompt: ClaudePendingPrompt
+}): ClaudeQuestionItem[] {
+  const values = Array.isArray(input.prompt.input.questions) ? input.prompt.input.questions : []
+  const questions = values.flatMap((value, index): AgentJournalQuestion[] => {
+    const question = claudeRecord(value)
+    const questionAddress = `q${index + 1}`
+    const text = claudeText(question?.question) ?? claudeText(question?.header)
+    const header = claudeText(question?.header)
+    return question && input.prompt.questionIds[index] && text
+      ? [
+          {
+            id: questionAddress,
+            question: text,
+            ...(header ? { header } : {}),
+            options: questionOptions(question, questionAddress),
+            multiSelect: question.multiSelect === true,
+            freeTextQuestionId: questionAddress
+          }
+        ]
+      : []
+  })
+  if (questions.length === 0) {
+    return []
+  }
+  const legacyCompatible = questions.length === 1 && questions[0]?.multiSelect === false
+  const first = questions[0]!
+  return [
+    {
+      identity: claudePromptIdentity({
+        sessionId: input.sessionId,
+        promptKey: input.prompt.promptKey
+      }),
+      body: {
+        kind: 'question',
+        question: legacyCompatible
+          ? first.question
+          : `${questions.length} grouped question${questions.length === 1 ? '' : 's'} from Claude`,
+        options: legacyCompatible ? first.options : [],
+        ...(legacyCompatible ? { freeTextQuestionId: first.freeTextQuestionId } : {}),
+        questions,
+        resolution: { ...PENDING }
+      }
+    }
+  ]
+}
diff --git a/src/main/claude/claude-structured-prompt-replies.ts b/src/main/claude/claude-structured-prompt-replies.ts
new file mode 100644
index 00000000000..deec74b7308
--- /dev/null
+++ b/src/main/claude/claude-structured-prompt-replies.ts
@@ -0,0 +1,297 @@
+import { decodeAgentSessionQuestionAnswers } from '../../shared/agent-session-question-answer'
+
+export const CLAUDE_APPROVAL_DECISIONS = ['allow', 'allowForSession', 'deny', 'cancel'] as const
+export type ClaudeApprovalDecision = (typeof CLAUDE_APPROVAL_DECISIONS)[number]
+
+/** Settles the SDK's `canUseTool` promise; `null` is the SDK's "no response written" sentinel. */
+export type ClaudePromptSettle = (response: Record<string, unknown> | null) => void
+
+export type ClaudePendingPrompt = {
+  requestId: string
+  promptKey: string
+  toolUseId: string
+  toolName: string
+  kind: 'approval' | 'question'
+  input: Record<string, unknown>
+  suggestions: unknown[]
+  questionIds: readonly string[]
+  answers: Map<string, string | readonly string[]>
+  settle: ClaudePromptSettle
+}
+
+export type ClaudePromptRegistration = {
+  requestId: string
+  toolName: string
+  toolUseId: string
+  input: Record<string, unknown>
+  suggestions: unknown[]
+  settle: ClaudePromptSettle
+}
+
+type PromptBinding = {
+  address: string
+  questionId?: string
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+function readString(value: unknown): string | null {
+  return typeof value === 'string' && value.trim().length > 0 ? value : null
+}
+
+function questionsFrom(input: Record<string, unknown>): Record<string, unknown>[] {
+  return Array.isArray(input.questions) ? input.questions.filter(isRecord) : []
+}
+
+function questionIdFromAddress(prompt: ClaudePendingPrompt, address: string): string | null {
+  const match = /^q([1-9]\d*)$/.exec(address)
+  const index = match ? Number(match[1]) - 1 : -1
+  return index >= 0 ? (prompt.questionIds[index] ?? null) : null
+}
+
+function questionAnswer(prompt: ClaudePendingPrompt, questionId: string, optionId: string): string {
+  const decoded = decodeClaudeQuestionOptionId(optionId)
+  if (!decoded) {
+    return optionId
+  }
+  const questionIndex = prompt.questionIds.indexOf(questionId)
+  if (questionIndex === -1) {
+    return optionId
+  }
+  const choice = /^choice-([1-9]\d*)$/.exec(decoded.answer)
+  const optionIndex = choice ? Number(choice[1]) - 1 : -1
+  const question = questionsFrom(prompt.input)[questionIndex]
+  const options = Array.isArray(question?.options) ? question.options : []
+  const option = options[optionIndex]
+  const label = isRecord(option) ? readString(option.label) : null
+  if (decoded.questionId === `q${questionIndex + 1}` && label) {
+    return label
+  }
+  if (decoded.questionId === `q${questionIndex + 1}`) {
+    return decoded.answer
+  }
+  const legacyChoice = options.some(
+    (candidate) => isRecord(candidate) && readString(candidate.label) === decoded.answer
+  )
+  return decoded.questionId === questionId && (legacyChoice || decoded.answer.trim().length > 0)
+    ? decoded.answer
+    : optionId
+}
+
+function questionId(question: Record<string, unknown>, index: number): string {
+  return readString(question.question) ?? readString(question.header) ?? `question-${index + 1}`
+}
+
+export function encodeClaudeQuestionOptionId(questionId: string, answer: string): string {
+  return `${encodeURIComponent(questionId)}:${encodeURIComponent(answer)}`
+}
+
+export function decodeClaudeQuestionOptionId(
+  optionId: string
+): { questionId: string; answer: string } | null {
+  const separator = optionId.indexOf(':')
+  if (separator <= 0) {
+    return null
+  }
+  try {
+    return {
+      questionId: decodeURIComponent(optionId.slice(0, separator)),
+      answer: decodeURIComponent(optionId.slice(separator + 1))
+    }
+  } catch {
+    return null
+  }
+}
+
+export class ClaudePromptRegistry {
+  private readonly prompts = new Map<string, ClaudePendingPrompt>()
+  private readonly journalBindings = new Map<string, PromptBinding>()
+
+  register(registration: ClaudePromptRegistration): ClaudePendingPrompt | null {
+    const toolUseId = readString(registration.toolUseId)
+    const toolName = readString(registration.toolName)
+    const input = isRecord(registration.input) ? registration.input : null
+    if (!toolUseId || !toolName || !input) {
+      return null
+    }
+    const questions = toolName === 'AskUserQuestion' ? questionsFrom(input) : []
+    const prompt: ClaudePendingPrompt = {
+      requestId: registration.requestId,
+      promptKey: registration.requestId,
+      toolUseId,
+      toolName,
+      kind: questions.length > 0 ? 'question' : 'approval',
+      input,
+      suggestions: Array.isArray(registration.suggestions) ? registration.suggestions : [],
+      questionIds: questions.map(questionId),
+      answers: new Map(),
+      settle: registration.settle
+    }
+    this.prompts.set(prompt.promptKey, prompt)
+    return prompt
+  }
+
+  /** True only if the prompt was still pending; lets an abort and an answer race settle once. */
+  forgetIfPending(prompt: ClaudePendingPrompt): boolean {
+    if (!this.prompts.has(prompt.promptKey)) {
+      return false
+    }
+    this.forget(prompt)
+    return true
+  }
+
+  bindJournalItemId(journalItemId: string, promptKey: string, questionIdForItem?: string): void {
+    this.journalBindings.set(journalItemId, {
+      address: promptKey,
+      ...(questionIdForItem ? { questionId: questionIdForItem } : {})
+    })
+  }
+
+  find(itemId: string): { prompt: ClaudePendingPrompt; questionId?: string } | null {
+    const binding = this.journalBindings.get(itemId)
+    const prompt = this.prompts.get(binding?.address ?? itemId)
+    return prompt
+      ? { prompt, ...(binding?.questionId ? { questionId: binding.questionId } : {}) }
+      : null
+  }
+
+  cancel(requestId: string): ClaudePendingPrompt | null {
+    const prompt = this.prompts.get(requestId) ?? null
+    if (prompt) {
+      this.forget(prompt)
+    }
+    return prompt
+  }
+
+  forget(prompt: ClaudePendingPrompt): void {
+    this.prompts.delete(prompt.promptKey)
+    for (const [itemId, binding] of this.journalBindings) {
+      if (binding.address === prompt.promptKey) {
+        this.journalBindings.delete(itemId)
+      }
+    }
+  }
+
+  clear(): ClaudePendingPrompt[] {
+    const pending = [...this.prompts.values()]
+    this.prompts.clear()
+    this.journalBindings.clear()
+    return pending
+  }
+}
+
+function approvalResponse(prompt: ClaudePendingPrompt, optionId: string): Record<string, unknown> {
+  if (!(CLAUDE_APPROVAL_DECISIONS as readonly string[]).includes(optionId)) {
+    throw new Error(`${optionId} is not a Claude approval decision`)
+  }
+  const decision = optionId as ClaudeApprovalDecision
+  if (decision === 'allow' || decision === 'allowForSession') {
+    return {
+      behavior: 'allow',
+      updatedInput: prompt.input,
+      ...(decision === 'allowForSession' && prompt.suggestions.length > 0
+        ? { updatedPermissions: prompt.suggestions }
+        : {}),
+      toolUseID: prompt.toolUseId
+    }
+  }
+  return {
+    behavior: 'deny',
+    message: decision === 'cancel' ? 'User stopped this turn.' : 'User denied this action.',
+    ...(decision === 'cancel' ? { interrupt: true } : {}),
+    toolUseID: prompt.toolUseId
+  }
+}
+
+function questionResponse(
+  prompt: ClaudePendingPrompt,
+  optionId: string,
+  boundQuestionId?: string
+): Record<string, unknown> | null {
+  const decoded = decodeClaudeQuestionOptionId(optionId)
+  const decodedQuestionId = decoded
+    ? (questionIdFromAddress(prompt, decoded.questionId) ??
+      (prompt.questionIds.includes(decoded.questionId) ? decoded.questionId : null))
+    : null
+  const selectedQuestionId =
+    boundQuestionId ??
+    decodedQuestionId ??
+    (prompt.questionIds.length === 1 ? prompt.questionIds[0] : null)
+  if (!selectedQuestionId || !prompt.questionIds.includes(selectedQuestionId)) {
+    throw new Error(`${optionId} does not name a question on Claude prompt ${prompt.promptKey}`)
+  }
+  const answer = questionAnswer(prompt, selectedQuestionId, optionId)
+  prompt.answers.set(selectedQuestionId, answer)
+  if (prompt.questionIds.some((id) => !prompt.answers.has(id))) {
+    return null
+  }
+  const answers: Record<string, string | readonly string[]> = {}
+  for (const id of prompt.questionIds) {
+    answers[id] = prompt.answers.get(id) as string
+  }
+  return {
+    behavior: 'allow',
+    updatedInput: { ...prompt.input, answers },
+    toolUseID: prompt.toolUseId
+  }
+}
+
+function groupedQuestionResponse(
+  prompt: ClaudePendingPrompt,
+  optionId: string
+): Record<string, unknown> | null {
+  const grouped = decodeAgentSessionQuestionAnswers(optionId)
+  if (!grouped) {
+    return null
+  }
+  const questions = questionsFrom(prompt.input)
+  if (grouped.length !== prompt.questionIds.length) {
+    throw new Error(`Grouped answer does not match Claude prompt ${prompt.promptKey}`)
+  }
+  const answers: Record<string, string | readonly string[]> = {}
+  for (let index = 0; index < questions.length; index += 1) {
+    const question = questions[index]!
+    const providerQuestionId = prompt.questionIds[index]
+    const answer = grouped.find((entry) => entry.questionId === `q${index + 1}`)
+    if (!providerQuestionId || !answer) {
+      throw new Error(`Grouped answer does not name question ${index + 1}`)
+    }
+    const selected = answer.optionIds.map((selectedId) =>
+      questionAnswer(prompt, providerQuestionId, selectedId)
+    )
+    const other = answer.other?.trim()
+    if (question.multiSelect === true) {
+      const values = [...selected, ...(other ? [other] : [])]
+      if (values.length === 0) {
+        throw new Error(`Grouped answer leaves question ${index + 1} empty`)
+      }
+      answers[providerQuestionId] = values
+    } else {
+      const value = other || selected[0]
+      if (!value || selected.length > 1) {
+        throw new Error(`Grouped answer is invalid for question ${index + 1}`)
+      }
+      answers[providerQuestionId] = value
+    }
+  }
+  return {
+    behavior: 'allow',
+    updatedInput: { ...prompt.input, answers },
+    toolUseID: prompt.toolUseId
+  }
+}
+
+export function applyClaudePromptAnswer(
+  found: { prompt: ClaudePendingPrompt; questionId?: string },
+  optionId: string
+): Record<string, unknown> | null {
+  if (found.prompt.kind === 'approval') {
+    return approvalResponse(found.prompt, optionId)
+  }
+  return (
+    groupedQuestionResponse(found.prompt, optionId) ??
+    questionResponse(found.prompt, optionId, found.questionId)
+  )
+}
diff --git a/src/main/claude/claude-structured-provider-fallback.test.ts b/src/main/claude/claude-structured-provider-fallback.test.ts
new file mode 100644
index 00000000000..e8b27114da4
--- /dev/null
+++ b/src/main/claude/claude-structured-provider-fallback.test.ts
@@ -0,0 +1,117 @@
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type {
+  AgentJournalItemBody,
+  AgentSessionJournalIdentity
+} from '../../shared/agent-session-journal-types'
+import { openAgentSessionJournal } from '../native-chat/agent-session-journal/journal-store-factory'
+import { createDeferredStructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
+import { createClaudeJournalTranslator } from './claude-structured-journal-translation'
+import type { ClaudeStructuredSessionEvent } from './claude-structured-session-state'
+
+const IDENTITY: AgentSessionJournalIdentity = {
+  sessionId: 'session-1',
+  workspaceId: 'workspace-1',
+  hostId: 'host-1',
+  agent: 'claude',
+  providerHandle: { kind: 'claude', sessionId: 'provider-1', leafUuid: 'leaf-1' }
+}
+
+let root = ''
+
+function message(
+  role: 'assistant' | 'user',
+  uuid: string,
+  content: unknown[]
+): ClaudeStructuredSessionEvent {
+  return {
+    type: 'message',
+    sessionId: 'orca-session',
+    message: {
+      type: role,
+      uuid,
+      session_id: 'provider-1',
+      message: { role, content }
+    }
+  }
+}
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-claude-provider-fallback-'))
+})
+
+afterEach(async () => {
+  await rm(root, { recursive: true, force: true })
+})
+
+describe('Claude provider fallback', () => {
+  it('drops suppressed init frames instead of dereferencing a null translation', () => {
+    const items: { identity: unknown; body: AgentJournalItemBody }[] = []
+    const sink = {
+      appendItem: (identity: unknown, body: AgentJournalItemBody) => {
+        items.push({ identity, body })
+      },
+      appendTombstone: vi.fn(),
+      publish: vi.fn()
+    }
+    const translator = createClaudeJournalTranslator({ sink })
+    const initEvent: ClaudeStructuredSessionEvent = {
+      type: 'message',
+      sessionId: 'orca-session',
+      message: {
+        type: 'system',
+        subtype: 'init',
+        session_id: 'provider-1',
+        uuid: 'init-1'
+      }
+    }
+
+    expect(() => translator.handle(initEvent)).not.toThrow()
+    expect(items).toEqual([])
+  })
+
+  it('keeps provider-fallback rows distinct across acquisitions', async () => {
+    const journal = await openAgentSessionJournal({
+      identity: IDENTITY,
+      journalDir: root,
+      now: () => 1_700_000_000_000,
+      mintEpoch: () => 'epoch-1'
+    })
+    const deferred = createDeferredStructuredAgentSessionEventSink()
+    deferred.bind({
+      journal,
+      fence: 1,
+      publish: vi.fn()
+    })
+
+    const first = createClaudeJournalTranslator({ sink: deferred.sink, fallbackIdPrefix: '1' })
+    const second = createClaudeJournalTranslator({ sink: deferred.sink, fallbackIdPrefix: '2' })
+
+    first.handle(message('assistant', 'assistant-1', [{ type: 'future_event', message: 'first' }]))
+    await deferred.drained()
+    second.handle(
+      message('assistant', 'assistant-2', [{ type: 'future_event', message: 'second' }])
+    )
+    await deferred.drained()
+
+    const fallbackRows = journal
+      .snapshot()
+      .items.filter(
+        (item) =>
+          item.body.kind === 'status' &&
+          item.body.providerFrame?.kind === 'message:assistant:content:future_event'
+      )
+
+    expect(fallbackRows).toHaveLength(2)
+    expect(fallbackRows.map(statusText)).toEqual(['first', 'second'])
+  })
+})
+
+function statusText(row: { body: AgentJournalItemBody }): string {
+  if (row.body.kind !== 'status') {
+    throw new Error('expected status row')
+  }
+  return row.body.text
+}
diff --git a/src/main/claude/claude-structured-provider-fallback.ts b/src/main/claude/claude-structured-provider-fallback.ts
new file mode 100644
index 00000000000..2528ac027df
--- /dev/null
+++ b/src/main/claude/claude-structured-provider-fallback.ts
@@ -0,0 +1,125 @@
+import type { StructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
+import {
+  boundInlineText,
+  DEFAULT_JOURNAL_PAYLOAD_LIMITS
+} from '../native-chat/agent-session-journal/journal-payload-bounds'
+import { CLAUDE_STREAM_JSON_FRAME_KINDS } from '../native-chat/agent-session-wire/claude-stream-json-frame-schema'
+import { unhandledProviderFrameJournalItem } from '../native-chat/agent-session-wire/unhandled-provider-frame'
+import { claudeRecord, claudeText } from './claude-structured-item-translation'
+
+export function claudeProviderFrameKind(message: Record<string, unknown>): string {
+  const type = claudeText(message.type) ?? 'unknown'
+  const subtype = claudeText(message.subtype)
+  const eventType = claudeText(claudeRecord(message.event)?.type)
+  return ['message', type, subtype ?? eventType].filter(Boolean).join(':')
+}
+
+const SETTLED_RESULT_KINDS: ReadonlySet<string> = new Set(
+  CLAUDE_STREAM_JSON_FRAME_KINDS.filter((kind) => kind.startsWith('message:result:'))
+)
+
+/** A catalogued result subtype is the turn-complete signal the translator settles
+ *  itself; only an unmodeled subtype still needs the provider-fallback row. */
+export function isSettledClaudeResultKind(kind: string): boolean {
+  return SETTLED_RESULT_KINDS.has(kind)
+}
+
+/**
+ * The failure a result frame carries that the turn's own frames never showed.
+ *
+ * Suppression is by meaning, not by kind. The SDK models an API failure as a
+ * SUCCESS-subtype result whose `result` string IS the error text and which has
+ * no assistant frame behind it, so keying on the subtype tombstones the turn and
+ * shows the user a completed, empty reply. A turn the user aborted is the
+ * opposite: its interrupt frame already says so, and the diagnostic in `errors`
+ * would only be noise.
+ */
+export function claudeResultFailure(
+  message: Record<string, unknown>
+): { text: string | null } | null {
+  if (message.is_error !== true) {
+    return null
+  }
+  const terminalReason = claudeText(message.terminal_reason)
+  if (terminalReason === 'aborted_streaming' || terminalReason === 'aborted_tools') {
+    return null
+  }
+  const result = claudeText(message.result)?.trim()
+  if (result) {
+    return { text: result }
+  }
+  const errors = Array.isArray(message.errors)
+    ? message.errors.flatMap((entry) => {
+        const text = claudeText(entry)?.trim()
+        return text ? [text] : []
+      })
+    : []
+  // Nothing readable to lead with, but a reported failure still gets its row.
+  return { text: errors.length > 0 ? errors.join('\n') : null }
+}
+
+/**
+ * What a message part that Orca cannot render says for itself. The kinds under
+ * `message:<role>:content:*` are synthesised from whatever `part.type` the CLI
+ * sends, so they can never be catalogued ahead of time; printing one is leaking
+ * wire vocabulary at a user who cannot act on it. The frame stays on the row's
+ * disclosure, so nothing is dropped and the next reader can still name it.
+ */
+export const CLAUDE_UNRENDERABLE_CONTENT_TEXT = 'Claude sent content Orca cannot display yet'
+
+export function isModeledClaudeContent(value: unknown): boolean {
+  const part = claudeRecord(value)
+  if (!part) {
+    return false
+  }
+  if (part.type === 'text') {
+    return claudeText(part.text) !== null
+  }
+  if (part.type === 'image') {
+    const source = claudeRecord(part.source)
+    if (source?.type === 'url') {
+      return claudeText(source.url) !== null
+    }
+    // A local attachment is replayed as the base64 (or file) source Orca itself
+    // sent, so it is content we recognise -- not an unknown part to surface.
+    return source?.type === 'base64' || source?.type === 'file'
+  }
+  if (part.type === 'tool_use') {
+    return claudeText(part.id) !== null && claudeText(part.name) !== null
+  }
+  if (part.type === 'tool_result') {
+    return claudeText(part.tool_use_id) !== null
+  }
+  // Redacted thinking arrives as an empty string plus a signature.
+  return part.type === 'thinking' || part.type === 'redacted_thinking'
+}
+
+export function createClaudeProviderFrameFallback(
+  sink: StructuredAgentSessionEventSink,
+  acquisitionId: string
+): {
+  /** `displayText` leads the row when Claude knows the sentence the frame itself does not name. */
+  append: (kind: string, payload: unknown, displayText?: string | null) => void
+} {
+  let sequence = 0
+  return {
+    append: (kind, payload, displayText) => {
+      sequence += 1
+      const translated = unhandledProviderFrameJournalItem('claude', kind, payload)
+      if (!translated) {
+        return
+      }
+      const bounded = displayText
+        ? boundInlineText(displayText, DEFAULT_JOURNAL_PAYLOAD_LIMITS).text
+        : null
+      sink.appendItem(
+        {
+          provider: 'orca',
+          clientMessageId: `provider-frame:claude:${acquisitionId}:${sequence}`
+        },
+        bounded ? { ...translated.body, text: bounded } : translated.body
+      )
+      sink.publish()
+    }
+  }
+}
diff --git a/src/main/claude/claude-structured-real-cli.test.ts b/src/main/claude/claude-structured-real-cli.test.ts
new file mode 100644
index 00000000000..0f22c175cc6
--- /dev/null
+++ b/src/main/claude/claude-structured-real-cli.test.ts
@@ -0,0 +1,299 @@
+import { spawnSync } from 'node:child_process'
+import { randomUUID } from 'node:crypto'
+import { mkdtemp, rm } from 'node:fs/promises'
+import { homedir, tmpdir } from 'node:os'
+import { basename, join, relative } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import type { AgentSessionJournalIdentity } from '../../shared/agent-session-journal-types'
+import { resolveClaudeCommand } from '../codex-cli/command'
+import { resolveSessionFilePath } from '../native-chat/session-file-resolver'
+import { getSpawnArgsForWindows } from '../win32-utils'
+import { CLAUDE_STRUCTURED_BASE_OPTIONS } from './claude-structured-launch-resolution'
+import {
+  ClaudeStructuredSessionAdapter,
+  type ClaudeStructuredSessionEvent
+} from './claude-structured-session-adapter'
+
+const command = resolveClaudeCommand()
+const versionLaunch = getSpawnArgsForWindows(command, ['--version'])
+const realClaudeAvailable =
+  spawnSync(versionLaunch.spawnCmd, versionLaunch.spawnArgs, {
+    stdio: 'ignore',
+    windowsHide: true,
+    timeout: 5_000
+  }).status === 0
+const authStatusLaunch = getSpawnArgsForWindows(command, ['auth', 'status', '--json'])
+/** The CLI's own account report — the only source of truth for where it writes that
+ *  is not derived from Orca's own path expressions. */
+const realClaudeAuthStatus = (() => {
+  if (!realClaudeAvailable) {
+    return null
+  }
+  const result = spawnSync(authStatusLaunch.spawnCmd, authStatusLaunch.spawnArgs, {
+    encoding: 'utf8',
+    windowsHide: true,
+    timeout: 5_000
+  })
+  if (result.status !== 0) {
+    return null
+  }
+  try {
+    return JSON.parse(result.stdout) as { loggedIn?: boolean; projectsDirectory?: string }
+  } catch {
+    return null
+  }
+})()
+const realClaudeAuthenticated = realClaudeAuthStatus?.loggedIn === true
+
+function realAdapter(
+  providerSessionId: string,
+  claudeConfigDir: string,
+  events: ClaudeStructuredSessionEvent[] = []
+): ClaudeStructuredSessionAdapter {
+  return new ClaudeStructuredSessionAdapter({
+    resolveLaunch: async () => ({
+      pathToClaudeCodeExecutable: command,
+      options: { ...CLAUDE_STRUCTURED_BASE_OPTIONS, sessionId: providerSessionId },
+      cwd: process.cwd(),
+      claudeConfigDir,
+      providerSessionId,
+      resumeLeafUuid: null,
+      resumed: false
+    }),
+    onEvent: (event) => events.push(event),
+    readProcessStartTime: async () => 1,
+    now: () => 2,
+    initTimeoutMs: 5_000
+  })
+}
+
+function identity(providerSessionId: string): AgentSessionJournalIdentity {
+  return {
+    sessionId: 'real-cli-handshake',
+    workspaceId: 'real-cli-workspace',
+    hostId: 'local',
+    agent: 'claude',
+    providerHandle: { kind: 'claude', sessionId: providerSessionId, leafUuid: null }
+  }
+}
+
+/** The CLI flushes its transcript on its own schedule; poll rather than race it. */
+async function waitForResolvedTranscript(
+  providerSessionId: string,
+  timeoutMs = 15_000
+): Promise<string | null> {
+  const deadline = Date.now() + timeoutMs
+  for (;;) {
+    // No options: the exact call transcript-read-cache.ts makes for mobile.
+    const resolved = await resolveSessionFilePath('claude', providerSessionId)
+    if (resolved || Date.now() >= deadline) {
+      return resolved
+    }
+    await new Promise((resolve) => setTimeout(resolve, 250))
+  }
+}
+
+describe.skipIf(!realClaudeAvailable)('Claude structured real CLI handshake', () => {
+  it.skipIf(!realClaudeAuthenticated)(
+    'proves a pre-minted session before the first user message',
+    async () => {
+      const providerSessionId = randomUUID()
+      const claudeConfigDir = process.env.CLAUDE_CONFIG_DIR?.trim() || join(homedir(), '.claude')
+      const events: ClaudeStructuredSessionEvent[] = []
+      const adapter = realAdapter(providerSessionId, claudeConfigDir, events)
+
+      try {
+        const acquisition = await adapter.acquire({
+          identity: identity(providerSessionId),
+          fence: 1,
+          spawnToken: 'real-cli'
+        })
+        const observedSubtypes = events.flatMap((event) =>
+          event.type === 'message' ? [event.message.subtype] : []
+        )
+
+        expect(acquisition.link.handle).toMatchObject({
+          provider: 'claude',
+          sessionId: providerSessionId,
+          // Init/SessionStart UUIDs are protocol frames, not resumable
+          // main-transcript leaves; no cursor exists before the first user turn.
+          leafUuid: null
+        })
+        expect(observedSubtypes).toContain('hook_started')
+      } finally {
+        await adapter.closeAll()
+      }
+    },
+    10_000
+  )
+
+  // Unit tests can only pin the shape we read, which is exactly how the blank
+  // Effort pill survived every gate: the fixture invented an `effortLevel` on a
+  // frame the CLI does not send. This asserts both halves against the live
+  // binary — that get_settings reports the effort, and that init does not.
+  it.skipIf(!realClaudeAuthenticated)(
+    'reports the current effort through get_settings and never on the init frame',
+    async () => {
+      const providerSessionId = randomUUID()
+      const claudeConfigDir = process.env.CLAUDE_CONFIG_DIR?.trim() || join(homedir(), '.claude')
+      const events: ClaudeStructuredSessionEvent[] = []
+      const adapter = realAdapter(providerSessionId, claudeConfigDir, events)
+
+      try {
+        await adapter.acquire({
+          identity: identity(providerSessionId),
+          fence: 1,
+          spawnToken: 'real-cli-effort'
+        })
+        const published = events.flatMap((event) =>
+          event.type === 'message' ? [event.message] : []
+        )
+        const options = await adapter.readOptions({ sessionId: 'real-cli-handshake', fence: 1 })
+
+        expect(published.length).toBeGreaterThan(0)
+        // Not just the init frame: no frame the CLI publishes carries an effort
+        // at all. Goes red the day one does, which is when the simpler fix
+        // becomes available. Which frame proves the session varies by host, so
+        // this asserts over all of them rather than picking one.
+        expect(published.filter((frame) => 'effortLevel' in frame)).toEqual([])
+        // Goes red if `effective.effortLevel` is renamed or dropped, which no
+        // fixture-backed test can see.
+        expect(options.current.effort).toEqual(expect.any(String))
+      } finally {
+        await adapter.closeAll()
+      }
+    },
+    15_000
+  )
+
+  // Mobile native chat never reads the structured journal — it reads the CLI's own
+  // transcript through native-chat/session-file-resolver.ts. So this resolves the way
+  // transcript-read-cache.ts:104 does, with NO root override, and checks the answer
+  // against the root the CLI itself reports. Deriving the expected root from Orca's own
+  // `CLAUDE_CONFIG_DIR || ~/.claude` expression — the same one the code under test uses —
+  // would move both sides together and stay green in exactly the environment that
+  // blacks mobile out.
+  // The turn is what creates the file: an init-only handshake writes nothing.
+  it.skipIf(!realClaudeAuthenticated || !realClaudeAuthStatus?.projectsDirectory)(
+    'writes its transcript where the mobile session-file resolver looks for it',
+    async () => {
+      const providerSessionId = randomUUID()
+      const claudeConfigDir = process.env.CLAUDE_CONFIG_DIR?.trim() || join(homedir(), '.claude')
+      const adapter = realAdapter(providerSessionId, claudeConfigDir)
+      const cliProjectsDir = realClaudeAuthStatus?.projectsDirectory as string
+
+      let transcriptPath: string | null = null
+      try {
+        await adapter.acquire({
+          identity: identity(providerSessionId),
+          fence: 1,
+          spawnToken: 'real-cli-transcript'
+        })
+        await adapter.dispatch({
+          sessionId: 'real-cli-handshake',
+          clientMessageId: 'real-cli-transcript-1',
+          body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'hi' }] },
+          fence: 1
+        })
+        transcriptPath = await waitForResolvedTranscript(providerSessionId)
+      } finally {
+        await adapter.closeAll()
+      }
+
+      expect(transcriptPath).not.toBeNull()
+      expect(basename(transcriptPath ?? '')).toBe(`${providerSessionId}.jsonl`)
+      // `<the root the CLI reports>/<project slug>/<provider session id>.jsonl`
+      expect(relative(cliProjectsDir, transcriptPath ?? '').split(/[\\/]/)).toHaveLength(2)
+      // And the pinned account home is that same root, so the host-side leaf recovery
+      // (structured-claude-runtime-adapter.ts:64) and mobile agree.
+      expect(join(claudeConfigDir, 'projects')).toBe(cliProjectsDir)
+    },
+    45_000
+  )
+
+  // The model half of the same lesson: a fixture can only pin the shape we read.
+  // set_model answers success for a model it never resolves — a nonexistent id is
+  // accepted and only fails once a turn runs — so the CLI's own report is the only
+  // adoption evidence, and it arrives on the init frame that opens each turn. This
+  // asserts that frame carries the resolved model against the live binary; it goes
+  // red the day the CLI stops reporting it, which is the day the confirmation
+  // silently degrades to echoing back whatever Orca sent.
+  it.skipIf(!realClaudeAuthenticated)(
+    'reports the model it adopted on the init frame that opens each turn',
+    async () => {
+      const providerSessionId = randomUUID()
+      const claudeConfigDir = process.env.CLAUDE_CONFIG_DIR?.trim() || join(homedir(), '.claude')
+      const events: ClaudeStructuredSessionEvent[] = []
+      const adapter = realAdapter(providerSessionId, claudeConfigDir, events)
+
+      try {
+        await adapter.acquire({
+          identity: identity(providerSessionId),
+          fence: 1,
+          spawnToken: 'real-cli-model'
+        })
+        await adapter.setOption({
+          sessionId: 'real-cli-handshake',
+          key: 'model',
+          value: 'haiku',
+          fence: 1
+        })
+        const before = events.length
+        await adapter.dispatch({
+          sessionId: 'real-cli-handshake',
+          clientMessageId: 'real-cli-model-1',
+          body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'Say ok' }] },
+          fence: 1
+        })
+        const deadline = Date.now() + 60_000
+        let frames: Record<string, unknown>[] = []
+        for (;;) {
+          frames = events
+            .slice(before)
+            .flatMap((event) =>
+              event.type === 'message' &&
+              event.message.type === 'system' &&
+              event.message.subtype === 'init'
+                ? [event.message]
+                : []
+            )
+          if (frames.length > 0 || Date.now() >= deadline) {
+            break
+          }
+          await new Promise((resolve) => setTimeout(resolve, 250))
+        }
+
+        expect(frames).not.toHaveLength(0)
+        // Both halves: the field exists, and it names the model the picker asked
+        // for in the catalog's resolved shape rather than the id Orca sent.
+        expect(frames[0]?.model).toEqual(expect.any(String))
+        expect(frames[0]?.model).toBe('claude-haiku-4-5-20251001')
+        await expect(
+          adapter.readOptions({ sessionId: 'real-cli-handshake', fence: 1 })
+        ).resolves.toMatchObject({ current: { model: 'haiku' } })
+      } finally {
+        await adapter.closeAll()
+      }
+    },
+    90_000
+  )
+
+  it('turns a real silent unauthenticated startup into sign-in guidance', async () => {
+    const claudeConfigDir = await mkdtemp(join(tmpdir(), 'orca-claude-no-auth-'))
+    const providerSessionId = randomUUID()
+    const adapter = realAdapter(providerSessionId, claudeConfigDir)
+
+    try {
+      await expect(
+        adapter.acquire({
+          identity: identity(providerSessionId),
+          fence: 1,
+          spawnToken: 'real-cli-no-auth'
+        })
+      ).rejects.toThrow(/not signed in.*Claude CLI.*CLAUDE_CONFIG_DIR/s)
+    } finally {
+      await adapter.closeAll()
+      await rm(claudeConfigDir, { recursive: true, force: true })
+    }
+  }, 10_000)
+})
diff --git a/src/main/claude/claude-structured-session-acquisition-processless.test.ts b/src/main/claude/claude-structured-session-acquisition-processless.test.ts
new file mode 100644
index 00000000000..2c83dce1875
--- /dev/null
+++ b/src/main/claude/claude-structured-session-acquisition-processless.test.ts
@@ -0,0 +1,71 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { AgentSessionJournalIdentity } from '../../shared/agent-session-journal-types'
+import { AgentSessionPreSpawnError } from '../native-chat/agent-session-wire/structured-agent-session-adapter'
+import type {
+  ClaudeStreamJsonConnection,
+  openClaudeStreamJsonConnection
+} from './claude-stream-json-connection'
+import { ClaudeStructuredSessionAdapter } from './claude-structured-session-adapter'
+
+const PROVIDER_SESSION_ID = '819cf9f8-e43c-4ad7-b50f-54aa158a726a'
+const IDENTITY: AgentSessionJournalIdentity = {
+  sessionId: 'session-processless',
+  workspaceId: 'workspace-1',
+  hostId: 'local',
+  agent: 'claude',
+  providerHandle: { kind: 'opaque', agent: 'claude', value: 'pending' }
+}
+
+describe('Claude structured processless acquisition', () => {
+  it('classifies pre-pid error and close as processless with idempotent cleanup', async () => {
+    const fault = new Error('spawn claude ENOENT')
+    const close = vi.fn(async () => true)
+    const openConnection: typeof openClaudeStreamJsonConnection = async (
+      _launch,
+      handlers = {}
+    ) => {
+      const connection: ClaudeStreamJsonConnection = {
+        pid: undefined,
+        closed: true,
+        exitVerdict: { root: 'processless', tree: 'exited' },
+        initializationResult: async () => {
+          handlers.onFault?.(fault)
+          throw fault
+        },
+        getSettings: async () => ({}),
+        supportedModels: async () => [],
+        interrupt: async () => undefined,
+        cancelAsyncMessage: async () => {},
+        setModel: async () => {},
+        setPermissionMode: async () => {},
+        applyFlagSettings: async () => {},
+        send: async () => {},
+        stopTask: async () => {},
+        close
+      }
+      return connection
+    }
+    const adapter = new ClaudeStructuredSessionAdapter({
+      resolveLaunch: async () => ({
+        pathToClaudeCodeExecutable: 'claude',
+        options: {},
+        cwd: '/work/repo',
+        claudeConfigDir: '/accounts/claude',
+        providerSessionId: PROVIDER_SESSION_ID,
+        resumeLeafUuid: null,
+        resumed: false
+      }),
+      openConnection
+    })
+
+    const error = await adapter
+      .acquire({ identity: IDENTITY, fence: 7, spawnToken: 'spawn-9' })
+      .catch((cause: unknown) => cause)
+
+    expect(error).toBeInstanceOf(AgentSessionPreSpawnError)
+    expect(error).toMatchObject({ message: fault.message })
+    expect(close).toHaveBeenCalledOnce()
+    await expect(adapter.releaseAcquisition({ sessionId: IDENTITY.sessionId })).resolves.toBe(true)
+    expect(close).toHaveBeenCalledOnce()
+  })
+})
diff --git a/src/main/claude/claude-structured-session-acquisition.ts b/src/main/claude/claude-structured-session-acquisition.ts
new file mode 100644
index 00000000000..e8d09bd78d9
--- /dev/null
+++ b/src/main/claude/claude-structured-session-acquisition.ts
@@ -0,0 +1,298 @@
+import {
+  AgentSessionAcquisitionExitUnprovenError,
+  AgentSessionPreSpawnError
+} from '../native-chat/agent-session-wire/structured-agent-session-adapter'
+import type {
+  AgentSessionAcquisition,
+  StructuredAgentSessionAcquireInput
+} from '../native-chat/agent-session-wire/structured-agent-session-adapter'
+import { CLAUDE_AUTH_SWITCH_IN_PROGRESS_MESSAGE } from '../claude-accounts/environment'
+import { isClaudeAuthSwitchInProgress } from '../claude-accounts/live-pty-gate'
+import { openClaudeStreamJsonConnection } from './claude-stream-json-connection'
+import { buildClaudePermissionCallbacks } from './claude-structured-inbound-control'
+import { resolveClaudeReplayWaiter } from './claude-structured-dispatch'
+import {
+  claudeAuthDiagnostic,
+  readClaudeCapabilities,
+  readClaudeFrameString,
+  readClaudeInit,
+  readClaudeModels
+} from './claude-structured-init-proof'
+import {
+  createClaudeInitDeadline,
+  requestClaudeInitialization
+} from './claude-structured-init-deadline'
+import { claudeConfigDirEnvPatch } from './claude-config-dir-pin'
+import { CLAUDE_SPAWN_TOKEN_ENV, claudeProcessIdentity } from './claude-structured-owner-identity'
+import {
+  restoreClaudeStructuredSessionOptions,
+  restoredClaudeStructuredSessionOptions
+} from './claude-structured-options'
+import { ClaudePromptRegistry } from './claude-structured-prompt-replies'
+import { createClaudeSessionJournalTranslator } from './claude-structured-journal-translation'
+import { readClaudeSettingsEffort } from './claude-structured-session-options'
+import { createClaudeSessionPublication } from './claude-structured-session-publication'
+import {
+  cancelClaudeAcquisitionAttempt,
+  mintClaudeAcquisitionGeneration,
+  type ClaudeAcquisitionRegistry,
+  type ClaudeSession,
+  type ClaudeSessionExit,
+  type ClaudeStructuredSessionAdapterDeps,
+  type ClaudeAcquireCallbacks
+} from './claude-structured-session-state'
+import {
+  closeClaudePublishedSessionForDeps,
+  claudeAcquisitionCleanupError
+} from './claude-structured-session-close'
+import { readClaudeTranscriptEntryUuid } from './claude-tui-exit'
+
+export const CLAUDE_STRUCTURED_INIT_TIMEOUT_MS = 10_000
+
+export async function acquireClaudeSession({
+  input,
+  deps,
+  sessions,
+  acquisitions,
+  exits,
+  callbacks
+}: {
+  input: StructuredAgentSessionAcquireInput
+  deps: ClaudeStructuredSessionAdapterDeps
+  sessions: Map<string, ClaudeSession>
+  acquisitions: ClaudeAcquisitionRegistry
+  exits: Map<string, ClaudeSessionExit>
+  callbacks: ClaudeAcquireCallbacks
+}): Promise<AgentSessionAcquisition> {
+  // A managed-account switch is mid-swap of the pinned credential home; refuse here,
+  // before this acquisition cancels the previous attempt and closes the live session.
+  if (isClaudeAuthSwitchInProgress()) {
+    throw new AgentSessionPreSpawnError(new Error(CLAUDE_AUTH_SWITCH_IN_PROGRESS_MESSAGE))
+  }
+  const sessionId = input.identity.sessionId
+  const prompts = new ClaudePromptRegistry()
+  const translator = createClaudeSessionJournalTranslator(
+    input.events,
+    prompts,
+    String(input.fence)
+  )
+  const { previous, attempt } = acquisitions.start(sessionId, prompts)
+  let liveSession: ClaudeSession | null = null
+  let observedLeafUuid: string | null = null,
+    expectedProviderSessionId: string | null = null
+  // Frames are admitted only after launch resolution proves the provider session
+  // this acquisition owns. Keep the check ahead of every stateful consumer.
+  const initTimeoutMs = deps.initTimeoutMs ?? CLAUDE_STRUCTURED_INIT_TIMEOUT_MS
+  const initDeadline = createClaudeInitDeadline(sessionId, initTimeoutMs)
+
+  const onMessage = (message: Record<string, unknown>): void => {
+    const init = readClaudeInit(message)
+    if (readClaudeFrameString(message, 'session_id') !== expectedProviderSessionId) {
+      // An init proof for another (or unnamed) provider must fail acquisition
+      // promptly, while ordinary foreign frames stay quarantined silently.
+      if (init || (message.type === 'system' && message.subtype === 'init')) {
+        initDeadline.reject(new Error('claude provider session expected'))
+      }
+      return
+    }
+    if (init) {
+      initDeadline.resolve(init)
+      // Every turn opens with an init frame naming the model the CLI is actually
+      // running; set_model answers success for a model it never resolves, so this
+      // report is the session's only adoption evidence.
+      if (liveSession && init.model) {
+        liveSession.reportedOptions.model = init.model
+        liveSession.reportedModelMutation = liveSession.optionMutationSequence
+      }
+    }
+    observedLeafUuid = readClaudeTranscriptEntryUuid(message) ?? observedLeafUuid
+    if (liveSession) {
+      liveSession.leafUuid = observedLeafUuid
+    }
+    const startsTurn = liveSession ? resolveClaudeReplayWaiter(liveSession, message) : false
+    callbacks.deliver(attempt, sessionId, () =>
+      callbacks.emit(liveSession, input.events, {
+        type: 'message',
+        sessionId,
+        message,
+        ...(startsTurn ? { startsTurn: true } : {})
+      })
+    )
+  }
+  const { canUseTool, onUserDialog } = buildClaudePermissionCallbacks({
+    sessionId,
+    prompts,
+    emit: (event) =>
+      callbacks.deliver(attempt, sessionId, () => callbacks.emit(liveSession, input.events, event))
+  })
+
+  try {
+    if (previous && !(await cancelClaudeAcquisitionAttempt(previous))) {
+      acquisitions.restoreIfCurrent(sessionId, attempt, previous)
+      throw new AgentSessionAcquisitionExitUnprovenError(
+        new Error(`claude acquisition for session ${sessionId} could not be stopped`)
+      )
+    }
+    acquisitions.assertCurrent(sessionId, attempt)
+    let resumeSession = sessions.get(sessionId)
+    if (!(await closeClaudePublishedSessionForDeps(sessions, sessionId, deps))) {
+      throw new AgentSessionAcquisitionExitUnprovenError(
+        new Error(`claude session ${sessionId} could not be stopped`)
+      )
+    }
+    // A first-hand exit that has not yet proved its full tree still owns a cleanup
+    // obligation; never let a new acquisition hide that evidence by omission.
+    const retainedExit = exits.get(sessionId)
+    if (retainedExit) {
+      const firstProof = retainedExit.closePromise ? await retainedExit.closePromise : false
+      const proven = firstProof || (await retainedExit.connection.close().catch(() => false))
+      if (!proven) {
+        throw claudeAcquisitionCleanupError(retainedExit.connection, retainedExit.error)
+      }
+      // The old child is superseded by this acquisition. Settle its lifecycle
+      // before discarding the retained proof so its cursor and callbacks are
+      // cleaned up exactly once.
+      await callbacks.settleExit(sessionId, retainedExit)
+      resumeSession ??= retainedExit.session
+    }
+    acquisitions.assertCurrent(sessionId, attempt)
+    // Both close paths persist their final leaf, so launch validates that durable head.
+    const launchIdentity = resumeSession
+      ? {
+          ...input.identity,
+          providerHandle: {
+            kind: 'claude' as const,
+            sessionId: resumeSession.providerSessionId,
+            leafUuid: resumeSession.leafUuid
+          }
+        }
+      : input.identity
+    const launch = await deps
+      .resolveLaunch({ identity: launchIdentity })
+      .catch((error: unknown) => {
+        throw error instanceof AgentSessionPreSpawnError
+          ? error
+          : new AgentSessionPreSpawnError(error)
+      })
+    expectedProviderSessionId = launch.providerSessionId
+    observedLeafUuid = launch.resumeLeafUuid
+    acquisitions.assertCurrent(sessionId, attempt)
+    const open = deps.openConnection ?? openClaudeStreamJsonConnection
+    const connection = await open(
+      {
+        pathToClaudeCodeExecutable: launch.pathToClaudeCodeExecutable,
+        options: launch.options,
+        cwd: launch.cwd,
+        env: {
+          ...launch.env,
+          [CLAUDE_SPAWN_TOKEN_ENV]: input.spawnToken,
+          // Compared against what the child would otherwise inherit, so the record's
+          // account home still wins over a diverging overlay without a needless pin.
+          // (`process` is shadowed by a local later in this function, so it is not named here.)
+          ...claudeConfigDirEnvPatch(launch.claudeConfigDir, launch.env ? { env: launch.env } : {})
+        }
+      },
+      {
+        onMessage,
+        canUseTool,
+        onUserDialog,
+        onFault: (error) => {
+          if (!attempt.published) {
+            initDeadline.reject(error)
+          }
+        },
+        onExit: (error) => {
+          if (!attempt.published) {
+            initDeadline.reject(error)
+          }
+          callbacks.handleExit(sessionId, attempt, error)
+        }
+      }
+    )
+    attempt.connection = connection
+    acquisitions.assertCurrent(sessionId, attempt)
+    initDeadline.start()
+    const [initialization, init] = await Promise.all([
+      requestClaudeInitialization(connection, sessionId, initTimeoutMs),
+      initDeadline.promise
+    ])
+    const models = readClaudeModels(initialization)
+    callbacks.deliver(attempt, sessionId, () =>
+      callbacks.emit(liveSession, input.events, { type: 'options', sessionId, models })
+    )
+    initDeadline.clear()
+    acquisitions.assertCurrent(sessionId, attempt)
+    if (init.providerSessionId !== launch.providerSessionId) {
+      throw new Error(
+        `claude proved session ${init.providerSessionId}, expected ${launch.providerSessionId}`
+      )
+    }
+    const settings = await connection
+      .getSettings({ timeoutMs: deps.requestTimeoutMs })
+      .catch(() => null)
+    callbacks.deliver(attempt, sessionId, () =>
+      callbacks.emit(liveSession, input.events, {
+        type: 'auth-diagnostic',
+        sessionId,
+        diagnostic: claudeAuthDiagnostic(init, settings)
+      })
+    )
+    const process = await claudeProcessIdentity(
+      { ...input, pid: connection.pid },
+      deps.readProcessStartTime
+    )
+    acquisitions.assertCurrent(sessionId, attempt)
+    if (connection.closed) {
+      throw new Error(`claude stream-json for session ${sessionId} exited while being acquired`)
+    }
+    const publication = createClaudeSessionPublication({
+      connection,
+      init,
+      claudeConfigDir: launch.claudeConfigDir,
+      leafUuid: observedLeafUuid,
+      fence: input.fence,
+      effort: readClaudeSettingsEffort(settings),
+      resumed: launch.resumed,
+      prompts,
+      translator,
+      events: input.events,
+      process,
+      acquisitionGeneration: mintClaudeAcquisitionGeneration(deps),
+      options: restoredClaudeStructuredSessionOptions(input.options),
+      capabilities: readClaudeCapabilities(init, initialization),
+      ...(deps.mintLinkId ? { linkId: deps.mintLinkId() } : {}),
+      observedAt: deps.now?.() ?? Date.now()
+    })
+    const acquired: AgentSessionAcquisition = publication.acquisition
+    liveSession = publication.session
+    await restoreClaudeStructuredSessionOptions(liveSession, deps.requestTimeoutMs)
+    acquisitions.assertCurrent(sessionId, attempt)
+    acquisitions.deleteIfCurrent(sessionId, attempt)
+    sessions.set(sessionId, liveSession)
+    attempt.published = true
+    for (const event of attempt.buffered.splice(0)) {
+      event()
+    }
+    return acquired
+  } catch (error) {
+    initDeadline.clear()
+    let acquisitionError = error
+    if (sessions.get(sessionId)?.connection !== attempt.connection) {
+      translator?.dispose()
+      // Settle any callback that fired before the failure so no SDK promise dangles.
+      for (const prompt of prompts.clear()) {
+        prompt.settle(null)
+      }
+      const closed = (await attempt.connection?.close()) ?? true
+      if (attempt.connection?.exitVerdict.root === 'processless') {
+        acquisitionError = new AgentSessionPreSpawnError(error)
+      } else if (!closed) {
+        acquisitionError = claudeAcquisitionCleanupError(attempt.connection, error)
+      }
+    }
+    acquisitions.deleteIfCurrent(sessionId, attempt)
+    throw acquisitionError
+  } finally {
+    attempt.finish()
+  }
+}
diff --git a/src/main/claude/claude-structured-session-adapter.test.ts b/src/main/claude/claude-structured-session-adapter.test.ts
new file mode 100644
index 00000000000..859ba9a8ed8
--- /dev/null
+++ b/src/main/claude/claude-structured-session-adapter.test.ts
@@ -0,0 +1,891 @@
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+import { describe, expect, it, vi } from 'vitest'
+import {
+  AgentSessionAcquisitionExitUnprovenError,
+  AgentSessionAcquisitionRefusal,
+  AgentSessionAcquisitionRootExitObservedError
+} from '../native-chat/agent-session-wire/structured-agent-session-adapter'
+import type { ClaudeStreamJsonConnection } from './claude-stream-json-connection'
+import { ClaudeControlRequestError } from './claude-stream-json-connection'
+import { CLAUDE_SPAWN_TOKEN_ENV } from './claude-structured-owner-identity'
+import { encodeClaudeQuestionOptionId } from './claude-structured-prompt-replies'
+import {
+  CLAUDE_STRUCTURED_INIT_TIMEOUT_MS,
+  type ClaudeStructuredSessionAdapter,
+  type ClaudeStructuredSessionEvent
+} from './claude-structured-session-adapter'
+import {
+  acquired,
+  adapterFor,
+  fakeClaude,
+  identityFor,
+  invokeCanUseTool,
+  PROVIDER_SESSION_ID,
+  tick,
+  USER_MESSAGE,
+  type FakeConnection
+} from './claude-structured-session-test-support'
+
+describe('ClaudeStructuredSessionAdapter.acquire', () => {
+  it('finishes its startup deadline before the paired mobile request deadline', () => {
+    expect(CLAUDE_STRUCTURED_INIT_TIMEOUT_MS).toBeLessThan(30_000)
+  })
+
+  it('pins the account and proves init without treating the system-frame uuid as a chain leaf', async () => {
+    const claude = fakeClaude()
+    const events: ClaudeStructuredSessionEvent[] = []
+    const adapter = adapterFor(claude, {}, events)
+
+    const acquisition = await adapter.acquire({
+      identity: identityFor(),
+      fence: 7,
+      spawnToken: 'spawn-9'
+    })
+
+    expect(claude.connections[0].launch).toMatchObject({
+      cwd: '/work/repo',
+      env: {
+        [CLAUDE_SPAWN_TOKEN_ENV]: 'spawn-9',
+        CLAUDE_CONFIG_DIR: '/accounts/claude'
+      }
+    })
+    // supportedDialogKinds is now a query() launch option, not an initialize request param.
+    expect(claude.connections[0].calls.slice(0, 2)).toEqual([
+      { subtype: 'initialize' },
+      { subtype: 'get_settings' }
+    ])
+    expect(acquisition.process).toEqual({
+      hostId: 'host-1',
+      pid: 4321,
+      processStartTimeMs: 1_700_000_000_000,
+      spawnToken: 'spawn-9'
+    })
+    expect(acquisition.link).toEqual({
+      linkId: `claude-7-${PROVIDER_SESSION_ID}-empty`,
+      handle: { provider: 'claude', sessionId: PROVIDER_SESSION_ID, leafUuid: null },
+      origin: 'created',
+      mintedAtFence: 7,
+      observedAt: 1_700_000_000_500
+    })
+    expect(events[0]).toMatchObject({ type: 'message', message: { subtype: 'init' } })
+  })
+
+  it('restores persisted model and effort before publishing a reacquired session', async () => {
+    const claude = fakeClaude()
+    const adapter = adapterFor(claude, { resumed: true })
+
+    await adapter.acquire({
+      identity: identityFor(),
+      fence: 7,
+      spawnToken: 'spawn-9',
+      options: { model: 'opus', effort: 'high' }
+    })
+
+    expect(claude.connections[0].calls.slice(-4)).toEqual([
+      { subtype: 'set_model', params: { model: 'opus' } },
+      // The restored model's advertised levels gate the replay, so a stale effort
+      // is dropped rather than re-applied to a model with no effort control.
+      { subtype: 'list_models' },
+      { subtype: 'apply_flag_settings', params: { settings: { effortLevel: 'high' } } },
+      // The effort is only recorded once the child reports having adopted it.
+      { subtype: 'get_settings' }
+    ])
+    await expect(adapter.readOptions({ sessionId: 'session-1', fence: 7 })).resolves.toMatchObject({
+      current: { model: 'opus', effort: 'high' }
+    })
+  })
+
+  it.each([
+    ['model', 'set_model', { model: 'retired-model' }],
+    ['effort', 'apply_flag_settings', { effort: 'retired-effort' }],
+    ['permissionMode', 'set_permission_mode', { permissionMode: 'retired-mode' }]
+  ] as const)(
+    'self-heals a persisted %s rejected during restore',
+    async (key, subtype, options) => {
+      const claude = fakeClaude({
+        routes: {
+          [subtype]: () => {
+            throw new ClaudeControlRequestError(subtype, 'value is no longer available')
+          }
+        }
+      })
+      const adapter = adapterFor(claude)
+
+      await expect(
+        adapter.acquire({
+          identity: identityFor(),
+          fence: 7,
+          spawnToken: 'spawn-9',
+          options
+        })
+      ).resolves.toBeDefined()
+      expect(adapter.readOptionRestoreFailures('session-1')).toEqual([key])
+    }
+  )
+
+  it('does not treat a transport timeout while restoring an option as recoverable', async () => {
+    const claude = fakeClaude({
+      routes: {
+        set_model: () => {
+          throw new Error('claude set_model request timed out')
+        }
+      }
+    })
+    const adapter = adapterFor(claude)
+    const input = {
+      identity: identityFor(),
+      fence: 7,
+      spawnToken: 'spawn-9',
+      options: { model: 'temporarily-unavailable' }
+    }
+
+    await expect(adapter.acquire(input)).rejects.toThrow('claude set_model request timed out')
+    expect(claude.connections[0]?.closeCount).toBe(1)
+  })
+
+  it('recovers a cancellable lifecycle when a timed-out replay arrives late', async () => {
+    const claude = fakeClaude({ replayUuid: null })
+    const events: ClaudeStructuredSessionEvent[] = []
+    const adapter = await acquired(claude, {}, events)
+
+    await expect(
+      adapter.dispatch({
+        sessionId: 'session-1',
+        clientMessageId: 'client-1',
+        body: USER_MESSAGE,
+        fence: 7
+      })
+    ).resolves.toMatchObject({ state: 'unknown' })
+    const sent = claude.connections[0]!.sent[0]!
+    claude.connections[0]!.handlers.onMessage?.({
+      ...sent,
+      uuid: 'late-turn-1'
+    })
+
+    expect(events).toContainEqual(
+      expect.objectContaining({
+        type: 'message',
+        startsTurn: true,
+        message: expect.objectContaining({ uuid: 'late-turn-1' })
+      })
+    )
+    await expect(
+      adapter.cancelTurn({ sessionId: 'session-1', turnId: 'late-turn-1', fence: 7 })
+    ).resolves.toEqual({ cancelled: true })
+  })
+
+  it('quarantines SDK frames without the acquired session identity', async () => {
+    const claude = fakeClaude({ replayUuid: null })
+    const events: ClaudeStructuredSessionEvent[] = []
+    const adapter = await acquired(claude, {}, events)
+    const connection = claude.connections[0]!
+
+    connection.handlers.onMessage?.({
+      type: 'assistant',
+      uuid: 'foreign-leaf',
+      session_id: 'foreign-provider-session',
+      message: { role: 'assistant', content: [{ type: 'text', text: 'do not admit' }] }
+    })
+    connection.handlers.onMessage?.({
+      type: 'assistant',
+      uuid: 'missing-session-leaf',
+      message: { role: 'assistant', content: [{ type: 'text', text: 'do not admit' }] }
+    })
+
+    const dispatch = adapter.dispatch({
+      sessionId: 'session-1',
+      clientMessageId: 'client-1',
+      body: USER_MESSAGE,
+      fence: 7
+    })
+    await Promise.resolve()
+    expect(connection.sent).toHaveLength(1)
+    connection.handlers.onMessage?.({
+      ...connection.sent[0],
+      uuid: 'foreign-replay',
+      session_id: 'foreign-provider-session'
+    })
+    await Promise.resolve()
+    expect(events.filter((event) => event.type === 'message')).toHaveLength(1)
+
+    connection.handlers.onMessage?.({
+      ...connection.sent[0],
+      session_id: PROVIDER_SESSION_ID
+    })
+    await expect(dispatch).resolves.toMatchObject({
+      state: 'accepted',
+      providerIdentity: { uuid: connection.sent[0]!.uuid }
+    })
+  })
+
+  it('forwards configured launch environment while keeping ownership pins authoritative', async () => {
+    const claude = fakeClaude()
+    const adapter = adapterFor(claude, {
+      env: {
+        ANTHROPIC_AUTH_TOKEN: 'configured-token',
+        ANTHROPIC_BASE_URL: 'https://gateway.example.test',
+        CLAUDE_CONFIG_DIR: '/wrong/account',
+        [CLAUDE_SPAWN_TOKEN_ENV]: 'wrong-token'
+      }
+    })
+
+    await adapter.acquire({ identity: identityFor(), fence: 7, spawnToken: 'spawn-9' })
+
+    expect(claude.connections[0].launch.env).toEqual({
+      ANTHROPIC_AUTH_TOKEN: 'configured-token',
+      ANTHROPIC_BASE_URL: 'https://gateway.example.test',
+      CLAUDE_CONFIG_DIR: '/accounts/claude',
+      [CLAUDE_SPAWN_TOKEN_ENV]: 'spawn-9'
+    })
+  })
+
+  it('leaves CLAUDE_CONFIG_DIR unset when the account home is the CLI default', async () => {
+    const claude = fakeClaude()
+    const adapter = adapterFor(claude, { claudeConfigDir: join(homedir(), '.claude'), env: {} })
+
+    await adapter.acquire({ identity: identityFor(), fence: 7, spawnToken: 'spawn-9' })
+
+    // Pinning the CLI's own default suppresses the macOS Keychain and breaks claude.ai login.
+    expect(claude.connections[0].launch.env).toEqual({ [CLAUDE_SPAWN_TOKEN_ENV]: 'spawn-9' })
+  })
+
+  it('re-pins the account home when the launch env would send the child elsewhere', async () => {
+    const claude = fakeClaude()
+    const accountHome = join(homedir(), '.claude')
+    const adapter = adapterFor(claude, {
+      claudeConfigDir: accountHome,
+      env: { CLAUDE_CONFIG_DIR: '/other/account' }
+    })
+
+    await adapter.acquire({ identity: identityFor(), fence: 7, spawnToken: 'spawn-9' })
+
+    expect(claude.connections[0].launch.env).toEqual({
+      CLAUDE_CONFIG_DIR: accountHome,
+      [CLAUDE_SPAWN_TOKEN_ENV]: 'spawn-9'
+    })
+  })
+
+  it('accepts SessionStart as pre-turn proof without treating its system uuid as a leaf', async () => {
+    const claude = fakeClaude({ initProof: 'session-start', initUuid: 'session-start-uuid' })
+    const events: ClaudeStructuredSessionEvent[] = []
+    const adapter = adapterFor(claude, {}, events)
+
+    const acquisition = await adapter.acquire({
+      identity: identityFor(),
+      fence: 7,
+      spawnToken: 'spawn-9'
+    })
+
+    expect(acquisition.link.handle).toEqual({
+      provider: 'claude',
+      sessionId: PROVIDER_SESSION_ID,
+      leafUuid: null
+    })
+    expect(events[0]).toMatchObject({
+      type: 'message',
+      message: { subtype: 'hook_started', hook_name: 'SessionStart:startup' }
+    })
+  })
+
+  it('records only non-secret effective auth-lane diagnostics', async () => {
+    const claude = fakeClaude({
+      settings: {
+        env: {
+          ANTHROPIC_BASE_URL: 'https://gateway.example.test',
+          ANTHROPIC_AUTH_TOKEN: 'secret'
+        }
+      }
+    })
+    const events: ClaudeStructuredSessionEvent[] = []
+    await acquired(claude, {}, events)
+
+    const diagnostic = events.find((event) => event.type === 'auth-diagnostic')
+    expect(diagnostic).toEqual({
+      type: 'auth-diagnostic',
+      sessionId: 'session-1',
+      diagnostic: {
+        apiKeySourceConfigured: false,
+        baseUrlConfigured: true,
+        authTokenConfigured: true,
+        apiKeyConfigured: false,
+        settingSources: ['user', 'project', 'local']
+      }
+    })
+    expect(JSON.stringify(diagnostic)).not.toContain('secret')
+    expect(JSON.stringify(diagnostic)).not.toContain('gateway.example.test')
+  })
+
+  it('resumes the same provider id and refuses an init proof for another session', async () => {
+    const resumedClaude = fakeClaude()
+    const resumed = adapterFor(resumedClaude, {
+      resumed: true,
+      resumeLeafUuid: 'leaf-before'
+    })
+    const acquisition = await resumed.acquire({
+      identity: identityFor(),
+      fence: 9,
+      spawnToken: 'spawn-9'
+    })
+    expect(acquisition.link.origin).toBe('resumed')
+    expect(acquisition.link.handle).toEqual({
+      provider: 'claude',
+      sessionId: PROVIDER_SESSION_ID,
+      leafUuid: 'leaf-before'
+    })
+
+    const wrongClaude = fakeClaude({ initSessionId: 'different-session' })
+    const wrong = adapterFor(wrongClaude)
+    await expect(
+      wrong.acquire({ identity: identityFor(), fence: 7, spawnToken: 'spawn-9' })
+    ).rejects.toThrow(/expected/)
+    expect(wrongClaude.connections[0].closeCount).toBe(1)
+  })
+
+  it('surfaces a CLI startup failure instead of waiting for the init deadline', async () => {
+    const claude = fakeClaude({ exitBeforeInit: 'Claude login required' })
+    const adapter = adapterFor(claude)
+
+    await expect(
+      adapter.acquire({ identity: identityFor(), fence: 7, spawnToken: 'spawn-9' })
+    ).rejects.toThrow('Claude login required')
+    expect(claude.connections[0].closeCount).toBe(1)
+  })
+
+  it('closes a silent unauthenticated startup with actionable account guidance', async () => {
+    const claude = fakeClaude({ initProof: 'none' })
+    const adapter = adapterFor(claude, {}, [], [], 20)
+
+    const error = await adapter
+      .acquire({ identity: identityFor(), fence: 7, spawnToken: 'spawn-9' })
+      .catch((cause: unknown) => cause)
+
+    expect(error).toBeInstanceOf(AgentSessionAcquisitionRefusal)
+    expect(error).toMatchObject({
+      message: expect.stringMatching(/selected Claude account is signed in.*CLAUDE_CONFIG_DIR/s)
+    })
+    expect(claude.connections[0].calls[0]).toEqual({ subtype: 'initialize' })
+    expect(claude.connections[0].closeCount).toBe(1)
+  })
+
+  it('refuses an unauthenticated initialize response even when SessionStart runs', async () => {
+    const claude = fakeClaude({
+      initProof: 'session-start',
+      initAccount: { apiProvider: 'firstParty', tokenSource: 'none' }
+    })
+    const adapter = adapterFor(claude)
+
+    await expect(
+      adapter.acquire({ identity: identityFor(), fence: 7, spawnToken: 'spawn-9' })
+    ).rejects.toThrow(/not signed in.*Claude CLI.*CLAUDE_CONFIG_DIR/s)
+    expect(claude.connections[0].closeCount).toBe(1)
+  })
+})
+
+describe('ClaudeStructuredSessionAdapter turns and controls', () => {
+  it('accepts a dispatch only after Claude replays its provider uuid', async () => {
+    const claude = fakeClaude({ replayUuid: 'user-provider-uuid' })
+    const adapter = await acquired(claude)
+
+    const result = await adapter.dispatch({
+      sessionId: 'session-1',
+      clientMessageId: 'client-1',
+      body: USER_MESSAGE,
+      fence: 7
+    })
+
+    expect(result).toEqual({
+      state: 'accepted',
+      providerIdentity: {
+        provider: 'claude',
+        sessionId: PROVIDER_SESSION_ID,
+        uuid: 'user-provider-uuid'
+      }
+    })
+    expect(claude.connections[0].sent[0]).toMatchObject({
+      type: 'user',
+      message: { role: 'user', content: [{ type: 'text', text: 'ship it' }] },
+      session_id: PROVIDER_SESSION_ID
+    })
+  })
+
+  it('leaves delivery unconfirmed when no replay uuid arrives', async () => {
+    const adapter = await acquired(fakeClaude({ replayUuid: null }))
+    await expect(
+      adapter.dispatch({
+        sessionId: 'session-1',
+        clientMessageId: 'client-1',
+        body: USER_MESSAGE,
+        fence: 7
+      })
+    ).resolves.toMatchObject({ state: 'unknown' })
+  })
+
+  it('requires an acknowledged interrupt and supports controlled options', async () => {
+    const claude = fakeClaude()
+    const adapter = await acquired(claude)
+    await expect(
+      adapter.cancelTurn({ sessionId: 'session-1', turnId: 'turn-1', fence: 7 })
+    ).resolves.toEqual({ cancelled: true })
+    await expect(
+      adapter.setOption({ sessionId: 'session-1', key: 'model', value: 'sonnet', fence: 7 })
+    ).resolves.toEqual({ model: 'sonnet' })
+    expect(claude.connections[0].calls.slice(-2)).toEqual([
+      { subtype: 'interrupt', params: {} },
+      { subtype: 'set_model', params: { model: 'sonnet' } }
+    ])
+
+    claude.routes.interrupt = () => {
+      throw new ClaudeControlRequestError('interrupt', 'not running')
+    }
+    await expect(
+      adapter.cancelTurn({ sessionId: 'session-1', turnId: 'turn-2', fence: 7 })
+    ).resolves.toEqual({ cancelled: false })
+
+    claude.routes.interrupt = () => {
+      throw new Error('claude interrupt request timed out')
+    }
+    await expect(
+      adapter.cancelTurn({ sessionId: 'session-1', turnId: 'turn-3', fence: 7 })
+    ).rejects.toThrow('timed out')
+  })
+
+  it('does not let a delayed cancellation for an earlier turn interrupt the later turn', async () => {
+    const claude = fakeClaude({ replayUuids: ['turn-T', 'turn-U'] })
+    const adapter = await acquired(claude)
+
+    await adapter.dispatch({
+      sessionId: 'session-1',
+      clientMessageId: 'client-T',
+      body: USER_MESSAGE,
+      fence: 7
+    })
+    await adapter.dispatch({
+      sessionId: 'session-1',
+      clientMessageId: 'client-U',
+      body: USER_MESSAGE,
+      fence: 7
+    })
+
+    await expect(
+      adapter.cancelTurn({ sessionId: 'session-1', turnId: 'turn-T', fence: 7 })
+    ).resolves.toEqual({ cancelled: false })
+    expect(claude.connections[0].calls.filter((call) => call.subtype === 'interrupt')).toHaveLength(
+      0
+    )
+
+    await expect(
+      adapter.cancelTurn({ sessionId: 'session-1', turnId: 'turn-U', fence: 6 })
+    ).resolves.toEqual({ cancelled: false })
+
+    await expect(
+      adapter.cancelTurn({ sessionId: 'session-1', turnId: 'turn-U', fence: 7 })
+    ).resolves.toEqual({ cancelled: true })
+    expect(claude.connections[0].calls.filter((call) => call.subtype === 'interrupt')).toHaveLength(
+      1
+    )
+  })
+
+  it('does not cancel an acknowledged turn after a later dispatch returns unknown', async () => {
+    const claude = fakeClaude({ replayUuids: ['turn-T', null] })
+    const adapter = await acquired(claude)
+
+    await expect(
+      adapter.dispatch({
+        sessionId: 'session-1',
+        clientMessageId: 'client-T',
+        body: USER_MESSAGE,
+        fence: 7
+      })
+    ).resolves.toMatchObject({
+      state: 'accepted',
+      providerIdentity: { uuid: 'turn-T' }
+    })
+    await expect(
+      adapter.dispatch({
+        sessionId: 'session-1',
+        clientMessageId: 'client-U',
+        body: USER_MESSAGE,
+        fence: 7
+      })
+    ).resolves.toMatchObject({ state: 'unknown' })
+    expect(claude.connections[0].sent).toHaveLength(2)
+
+    await expect(
+      adapter.cancelTurn({ sessionId: 'session-1', turnId: 'turn-T', fence: 7 })
+    ).resolves.toEqual({ cancelled: false })
+    expect(claude.connections[0].calls.filter((call) => call.subtype === 'interrupt')).toHaveLength(
+      0
+    )
+  })
+
+  it('classifies provider-declined options without treating timeouts as settled', async () => {
+    const claude = fakeClaude({
+      routes: {
+        set_model: () => {
+          throw new ClaudeControlRequestError('set_model', 'model unavailable')
+        }
+      }
+    })
+    const adapter = await acquired(claude)
+
+    await expect(
+      adapter.setOption({ sessionId: 'session-1', key: 'model', value: 'fable', fence: 7 })
+    ).rejects.toMatchObject({ name: 'AgentSessionOptionRejectedError' })
+    claude.routes.set_model = () => {
+      throw new Error('claude set_model request timed out')
+    }
+    await expect(
+      adapter.setOption({ sessionId: 'session-1', key: 'model', value: 'opus', fence: 7 })
+    ).rejects.toThrow('timed out')
+  })
+
+  it('hydrates live model choices and maps the resolved current model to its CLI id', async () => {
+    const claude = fakeClaude({
+      initModel: 'claude-sonnet-5',
+      routes: {
+        list_models: () => [
+          { value: 'default', resolvedModel: 'claude-opus-5', displayName: 'Default' },
+          {
+            value: 'opus',
+            resolvedModel: 'claude-opus-5',
+            displayName: 'Opus',
+            supportsEffort: true,
+            supportedEffortLevels: ['low', 'high']
+          },
+          {
+            value: 'sonnet',
+            resolvedModel: 'claude-sonnet-5',
+            displayName: 'Sonnet'
+          }
+        ]
+      }
+    })
+    const adapter = await acquired(claude)
+
+    await expect(adapter.readOptions({ sessionId: 'session-1', fence: 7 })).resolves.toEqual({
+      models: [
+        {
+          id: 'opus',
+          label: 'Opus',
+          isDefault: true,
+          efforts: [
+            { value: 'low', label: 'Low' },
+            { value: 'high', label: 'High' }
+          ]
+        },
+        { id: 'sonnet', label: 'Sonnet', isDefault: false, efforts: [] }
+      ],
+      current: { model: 'sonnet', effort: 'high', confirmed: ['model', 'effort'] }
+    })
+  })
+
+  it('keeps the shared Claude seed when live model discovery is unavailable', async () => {
+    const claude = fakeClaude({
+      initModel: 'custom-model',
+      routes: {
+        list_models: () => {
+          throw new Error('unsupported')
+        }
+      }
+    })
+    const adapter = await acquired(claude)
+    const result = await adapter.readOptions({ sessionId: 'session-1', fence: 7 })
+
+    expect(result.models.map((model) => model.id)).toEqual([
+      'fable',
+      'opus',
+      'sonnet',
+      'haiku',
+      'custom-model'
+    ])
+    expect(result.current).toEqual({
+      model: 'custom-model',
+      effort: 'high',
+      confirmed: ['model', 'effort']
+    })
+  })
+})
+
+describe('ClaudeStructuredSessionAdapter acquisition cleanup', () => {
+  /** A start that fails after the child self-exited, with its close verdict scripted. */
+  function failedStart(
+    unprovenCloseVerdict: ClaudeStreamJsonConnection['exitVerdict']
+  ): Promise<unknown> {
+    const claude = fakeClaude({
+      exitBeforeInit: 'claude stream-json exited (code 1): not logged in',
+      unprovenCloseVerdict
+    })
+    return adapterFor(claude)
+      .acquire({ identity: identityFor(), fence: 7, spawnToken: 'spawn-9' })
+      .catch((error: unknown) => error)
+  }
+
+  it('releases on a first-hand root exit while still carrying the CLI diagnostic', async () => {
+    // The root's pid and start time are the lease's identity, and they are
+    // provably dead: latching the session would strand a signed-out user.
+    const error = await failedStart({ root: 'exited', tree: 'unverifiable' })
+
+    expect(error).toBeInstanceOf(AgentSessionAcquisitionRootExitObservedError)
+    expect((error as Error).message).toBe('claude stream-json exited (code 1): not logged in')
+  })
+
+  it('never releases while a descendant was observed alive', async () => {
+    const error = await failedStart({ root: 'exited', tree: 'live' })
+
+    expect(error).toBeInstanceOf(AgentSessionAcquisitionExitUnprovenError)
+    expect(error).not.toBeInstanceOf(AgentSessionAcquisitionRootExitObservedError)
+  })
+
+  it('never releases for a root Orca never saw leave', async () => {
+    const error = await failedStart({ root: 'live', tree: 'unverifiable' })
+
+    expect(error).toBeInstanceOf(AgentSessionAcquisitionExitUnprovenError)
+    expect(error).not.toBeInstanceOf(AgentSessionAcquisitionRootExitObservedError)
+  })
+
+  /** A published session whose CLI then exits first-hand, with the verdict its ladder holds. */
+  async function exitedAfterPublish(
+    exitVerdict: ClaudeStreamJsonConnection['exitVerdict']
+  ): Promise<{ adapter: ClaudeStructuredSessionAdapter; connection: FakeConnection }> {
+    const claude = fakeClaude({ unprovenCloseVerdict: exitVerdict })
+    const adapter = await acquired(claude)
+    const connection = claude.connections[0]
+    connection.handlers.onExit?.(new Error('claude stream-json exited (code 1): crashed'))
+    return { adapter, connection }
+  }
+
+  it('classifies cleanup after a first-hand exit removed the session as a root exit, never as proven', async () => {
+    // The host may still be committing or proving the lease when the child dies;
+    // its cleanup must find the exit the ladder observed, not an absence.
+    const { adapter, connection } = await exitedAfterPublish({
+      root: 'exited',
+      tree: 'unverifiable'
+    })
+    const error = await adapter.releaseAcquisition({ sessionId: 'session-1' }).catch((e) => e)
+
+    expect(error).toBeInstanceOf(AgentSessionAcquisitionRootExitObservedError)
+    expect((error as Error).message).toBe('claude stream-json exited (code 1): crashed')
+    expect(connection.closeCount).toBe(2)
+  })
+
+  it('never releases after an exit that left a descendant observed alive', async () => {
+    const { adapter } = await exitedAfterPublish({ root: 'exited', tree: 'live' })
+    const error = await adapter.releaseAcquisition({ sessionId: 'session-1' }).catch((e) => e)
+
+    expect(error).toBeInstanceOf(AgentSessionAcquisitionExitUnprovenError)
+    expect(error).not.toBeInstanceOf(AgentSessionAcquisitionRootExitObservedError)
+  })
+
+  it('forgets a retained exit once the session is acquired again', async () => {
+    const options: Parameters<typeof fakeClaude>[0] = {}
+    const claude = fakeClaude(options)
+    const adapter = await acquired(claude)
+    const first = claude.connections[0]
+    first.handlers.onExit?.(new Error('claude stream-json exited (code 1): crashed'))
+    first.exitVerdict = { root: 'exited', tree: 'unverifiable' }
+    first.close = async () => false
+    options.exitBeforeInit = 'claude stream-json exited (code 1): not logged in'
+
+    await expect(
+      adapter.acquire({ identity: identityFor(), fence: 8, spawnToken: 'spawn-10' })
+    ).rejects.toThrow('not logged in')
+    // The second start's own proven close is the answer; the first exit is stale.
+    await expect(adapter.releaseAcquisition({ sessionId: 'session-1' })).resolves.toBe(true)
+    expect(first.closeCount).toBe(1)
+  })
+
+  it('reports unproven published-session cleanup so callers can retry safely', async () => {
+    const claude = fakeClaude()
+    const adapter = await acquired(claude)
+    const connection = claude.connections[0]
+    connection.close = vi
+      .fn<() => Promise<boolean>>()
+      .mockResolvedValueOnce(false)
+      .mockResolvedValueOnce(true) as unknown as FakeConnection['close']
+
+    await expect(adapter.releaseAcquisition({ sessionId: 'session-1' })).resolves.toBe(false)
+    expect(await adapter.readOptions({ sessionId: 'session-1', fence: 7 })).toMatchObject({
+      current: { model: 'claude-sonnet-5' }
+    })
+    await expect(adapter.releaseAcquisition({ sessionId: 'session-1' })).resolves.toBe(true)
+    expect(() => adapter.readOptions({ sessionId: 'session-1', fence: 7 })).toThrow(
+      'no live claude stream-json session'
+    )
+  })
+
+  it('does not report a second release as successful while retained exit evidence is unproven', async () => {
+    const claude = fakeClaude({ unprovenCloseVerdict: { root: 'exited', tree: 'unverifiable' } })
+    const adapter = await acquired(claude)
+    const connection = claude.connections[0]
+    connection.handlers.onExit?.(new Error('claude stream-json exited (code 1): crashed'))
+    connection.close = vi.fn().mockResolvedValue(false) as unknown as FakeConnection['close']
+
+    await expect(adapter.releaseAcquisition({ sessionId: 'session-1' })).rejects.toBeInstanceOf(
+      AgentSessionAcquisitionRootExitObservedError
+    )
+    await expect(adapter.releaseAcquisition({ sessionId: 'session-1' })).rejects.toBeInstanceOf(
+      AgentSessionAcquisitionRootExitObservedError
+    )
+    expect(connection.close).toHaveBeenCalledTimes(2)
+  })
+
+  it('keeps shutdown pending until a retained unexpected-exit proof settles', async () => {
+    const claude = fakeClaude()
+    const adapter = await acquired(claude)
+    const connection = claude.connections[0]
+    const proof = Promise.withResolvers<boolean>()
+    connection.close = vi
+      .fn<() => Promise<boolean>>()
+      .mockImplementationOnce(() => proof.promise)
+      .mockResolvedValueOnce(true) as unknown as FakeConnection['close']
+
+    connection.handlers.onExit?.(new Error('crashed'))
+    await tick()
+    let settled = false
+    const closing = adapter.closeAll().then(() => {
+      settled = true
+    })
+    await tick()
+    expect(settled).toBe(false)
+
+    proof.resolve(false)
+    await expect(closing).resolves.toBeUndefined()
+    expect(connection.close).toHaveBeenCalledTimes(2)
+  })
+
+  it('does not claim shutdown success for a retained false exit proof', async () => {
+    const claude = fakeClaude()
+    const events: ClaudeStructuredSessionEvent[] = []
+    const adapter = await acquired(claude, {}, events)
+    const connection = claude.connections[0]
+    connection.close = vi
+      .fn<() => Promise<boolean>>()
+      .mockResolvedValue(false) as unknown as FakeConnection['close']
+
+    connection.handlers.onExit?.(new Error('crashed'))
+    await tick()
+
+    await expect(adapter.closeAll()).rejects.toThrow(
+      'claude structured session shutdown could not prove every child stopped'
+    )
+    expect(events.filter((event) => event.type === 'ended')).toEqual([])
+    expect(connection.close).toHaveBeenCalledTimes(4)
+  })
+})
+
+describe('ClaudeStructuredSessionAdapter prompts', () => {
+  it('turns can_use_tool into an addressable durable approval that settles the SDK callback', async () => {
+    const claude = fakeClaude()
+    const events: ClaudeStructuredSessionEvent[] = []
+    const adapter = await acquired(claude, {}, events)
+    const answered = invokeCanUseTool(claude.connections[0], 'Bash', 'permission-1', 'tool-1', {
+      input: { command: 'git status' },
+      suggestions: [{ type: 'addRules' }]
+    })
+    expect(events.at(-1)).toMatchObject({
+      type: 'prompt',
+      prompt: { kind: 'approval', toolName: 'Bash', promptKey: 'permission-1' }
+    })
+
+    adapter.bindPromptItemId('session-1', 'journal-approval', 'permission-1')
+    await adapter.answerPrompt({
+      sessionId: 'session-1',
+      itemId: 'journal-approval',
+      kind: 'approval',
+      optionId: 'allowForSession',
+      fence: 7
+    })
+    // The answer resolves the SDK's own callback promise; the SDK writes the wire response.
+    await expect(answered.promise).resolves.toEqual({
+      behavior: 'allow',
+      updatedInput: { command: 'git status' },
+      updatedPermissions: [{ type: 'addRules' }],
+      toolUseID: 'tool-1'
+    })
+  })
+
+  it('collects every AskUserQuestion card before settling the one callback', async () => {
+    const claude = fakeClaude()
+    const adapter = await acquired(claude)
+    const answered = invokeCanUseTool(
+      claude.connections[0],
+      'AskUserQuestion',
+      'question-1',
+      'tool-question',
+      {
+        input: {
+          questions: [
+            { question: 'Library?', options: [{ label: 'Luxon' }] },
+            { question: 'Ship now?', options: [{ label: 'Yes' }] }
+          ]
+        }
+      }
+    )
+    adapter.bindPromptItemId('session-1', 'journal-q1', 'question-1', 'Library?')
+    adapter.bindPromptItemId('session-1', 'journal-q2', 'question-1', 'Ship now?')
+
+    await adapter.answerPrompt({
+      sessionId: 'session-1',
+      itemId: 'journal-q1',
+      kind: 'question',
+      optionId: encodeClaudeQuestionOptionId('Library?', 'Luxon'),
+      fence: 7
+    })
+    await tick()
+    expect(answered.settled()).toBe(false)
+    await adapter.answerPrompt({
+      sessionId: 'session-1',
+      itemId: 'journal-q2',
+      kind: 'question',
+      optionId: encodeClaudeQuestionOptionId('Ship now?', 'Yes'),
+      fence: 7
+    })
+    await expect(answered.promise).resolves.toMatchObject({
+      behavior: 'allow',
+      updatedInput: { answers: { 'Library?': 'Luxon', 'Ship now?': 'Yes' } },
+      toolUseID: 'tool-question'
+    })
+  })
+
+  it('leaves a prompt cancelled and unanswerable once the SDK abort signal fires', async () => {
+    const claude = fakeClaude()
+    const events: ClaudeStructuredSessionEvent[] = []
+    const adapter = await acquired(claude, {}, events)
+    const controller = new AbortController()
+    const answered = invokeCanUseTool(claude.connections[0], 'Bash', 'permission-9', 'tool-9', {
+      input: { command: 'rm -rf /' },
+      signal: controller.signal
+    })
+    adapter.bindPromptItemId('session-1', 'journal-9', 'permission-9')
+
+    controller.abort()
+    // A cancelled request is forgotten and settled with null — never an authorization.
+    await expect(answered.promise).resolves.toBeNull()
+    expect(events.at(-1)).toMatchObject({ type: 'prompt-cancelled', promptKey: 'permission-9' })
+    // A late answer after the abort must not authorize the wrong tool.
+    await expect(
+      adapter.answerPrompt({
+        sessionId: 'session-1',
+        itemId: 'journal-9',
+        kind: 'approval',
+        optionId: 'allow',
+        fence: 7
+      })
+    ).rejects.toThrow(/no longer waiting/)
+  })
+
+  it('settles an in-flight permission callback when the session closes, leaving no dangling promise', async () => {
+    const claude = fakeClaude()
+    const adapter = await acquired(claude)
+    const answered = invokeCanUseTool(claude.connections[0], 'Bash', 'permission-close', 'tool-c', {
+      input: { command: 'ls' }
+    })
+    await tick()
+    expect(answered.settled()).toBe(false)
+
+    await adapter.closeSession('session-1')
+
+    await expect(answered.promise).resolves.toBeNull()
+  })
+})
diff --git a/src/main/claude/claude-structured-session-adapter.ts b/src/main/claude/claude-structured-session-adapter.ts
new file mode 100644
index 00000000000..c00a588e891
--- /dev/null
+++ b/src/main/claude/claude-structured-session-adapter.ts
@@ -0,0 +1,322 @@
+import type {
+  AgentSessionAcquisition,
+  StructuredAgentSessionAcquireInput,
+  StructuredAgentSessionAdapter
+} from '../native-chat/agent-session-wire/structured-agent-session-adapter'
+import type { StructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
+import {
+  answerClaudePrompt,
+  cancelClaudeTurn,
+  stopClaudeBackgroundTasks
+} from './claude-structured-control-actions'
+import { dispatchClaudeTurn } from './claude-structured-dispatch'
+import { releaseClaudeAcquisition } from './claude-structured-acquisition-release'
+import { acquireClaudeSession } from './claude-structured-session-acquisition'
+export { CLAUDE_STRUCTURED_INIT_TIMEOUT_MS } from './claude-structured-session-acquisition'
+import { supportsClaudeStructuredLocation } from './claude-structured-location-support'
+import { setClaudeStructuredOption } from './claude-structured-options'
+import { readClaudeStructuredSessionOptions } from './claude-structured-session-options'
+import {
+  ClaudeAcquisitionRegistry,
+  type ClaudeAcquisitionAttempt,
+  type ClaudeSession,
+  type ClaudeSessionExit,
+  type ClaudeStructuredSessionAdapterDeps,
+  type ClaudeStructuredSessionEvent
+} from './claude-structured-session-state'
+import {
+  closeAllClaudeSessions,
+  closeClaudeSession,
+  settleClaudeExitedSession
+} from './claude-structured-session-close'
+import { readClaudeTranscriptLeafWithReproof } from './claude-transcript-branch-proof'
+import type { AgentSessionBackgroundTaskState } from '../../shared/agent-session-wire'
+
+export type { ClaudeStructuredLaunch } from './claude-structured-launch-resolution'
+export type {
+  ClaudeAuthDiagnostic,
+  ClaudeStructuredSessionAdapterDeps,
+  ClaudeStructuredSessionEvent
+} from './claude-structured-session-state'
+
+const DISPATCH_ACK_TIMEOUT_MS = 10_000
+
+function backgroundTaskState(session: ClaudeSession): AgentSessionBackgroundTaskState | null {
+  const state = session.backgroundTasks.state
+  return state ? { ...state, supportsTaskStop: true } : null
+}
+
+export class ClaudeStructuredSessionAdapter implements StructuredAgentSessionAdapter {
+  private readonly sessions = new Map<string, ClaudeSession>()
+  private readonly acquisitions = new ClaudeAcquisitionRegistry()
+  private readonly exits = new Map<string, ClaudeSessionExit>()
+
+  constructor(private readonly deps: ClaudeStructuredSessionAdapterDeps) {}
+
+  supportsLocation = supportsClaudeStructuredLocation
+
+  acquire = (input: StructuredAgentSessionAcquireInput): Promise<AgentSessionAcquisition> =>
+    acquireClaudeSession({
+      input,
+      deps: this.deps,
+      sessions: this.sessions,
+      acquisitions: this.acquisitions,
+      exits: this.exits,
+      callbacks: {
+        deliver: (attempt, sessionId, event) => this.deliver(attempt, sessionId, event),
+        emit: (session, events, event) => this.emit(session, events, event),
+        handleExit: (sessionId, attempt, error) => this.handleExit(sessionId, attempt, error),
+        settleExit: (sessionId, exit) => this.settleUnexpectedExit(sessionId, exit)
+      }
+    })
+
+  private deliver(attempt: ClaudeAcquisitionAttempt, sessionId: string, event: () => void): void {
+    if (!attempt.published) {
+      attempt.buffered.push(event)
+      return
+    }
+    if (this.sessions.get(sessionId)?.connection === attempt.connection) {
+      event()
+    }
+  }
+
+  private handleExit(sessionId: string, attempt: ClaudeAcquisitionAttempt, error: Error): void {
+    const session = this.sessions.get(sessionId)
+    if (!session || session.connection !== attempt.connection) {
+      return
+    }
+    this.sessions.delete(sessionId)
+    // Re-enter the provider's close ladder before publishing lifecycle recovery.
+    // An exit callback is root evidence only; the retained tree proof must run
+    // before the host releases and reacquires this exact child.
+    const closePromise = session.connection.close().catch(() => false)
+    const exit: ClaudeSessionExit = {
+      connection: session.connection,
+      session,
+      error,
+      closePromise
+    }
+    this.exits.set(sessionId, exit)
+    exit.publication = closePromise
+      .then((proven) => (proven ? this.settleUnexpectedExit(sessionId, exit) : undefined))
+      .catch(() => undefined)
+  }
+
+  /** Resolves once every first-hand exit observed so far has published its
+   *  lifecycle event — or has failed its tree proof and stayed indexed for a
+   *  retry. Publication trails observation by the close ladder and the
+   *  transcript cursor write, so nothing outside can otherwise tell the two
+   *  apart without guessing at wall-clock. */
+  drainObservedExits = async (): Promise<void> => {
+    const awaited = new Set<Promise<void>>()
+    for (;;) {
+      const pending = [...this.exits.values()]
+        .map((exit) => exit.publication)
+        .filter(
+          (publication): publication is Promise<void> =>
+            publication !== undefined && !awaited.has(publication)
+        )
+      if (pending.length === 0) {
+        return
+      }
+      for (const publication of pending) {
+        awaited.add(publication)
+      }
+      // A publication can settle an exit that itself observes another; only the
+      // ones this pass has not already awaited keep the loop going.
+      await Promise.all(pending)
+    }
+  }
+
+  /** Lifecycle recovery is published only after the child tree proof is true. */
+  private settleUnexpectedExit(sessionId: string, exit: ClaudeSessionExit): Promise<void> {
+    exit.settlementPromise ??= (async () => {
+      if (this.exits.get(sessionId) !== exit) {
+        settleClaudeExitedSession(exit.session)
+        return
+      }
+      // Persist the transcript-derived cursor before publishing the lifecycle
+      // event that lets the host release and reacquire this exact child.
+      await this.persistSessionHandle(sessionId, exit.session).catch(() => undefined)
+      if (this.exits.get(sessionId) !== exit) {
+        settleClaudeExitedSession(exit.session)
+        return
+      }
+      this.exits.delete(sessionId)
+      const ended: ClaudeStructuredSessionEvent = {
+        type: 'ended',
+        sessionId,
+        reason: exit.error.message,
+        cause: 'unexpected-exit',
+        fence: exit.session.fence,
+        acquisitionGeneration: exit.session.acquisitionGeneration
+      }
+      try {
+        this.emit(exit.session, exit.session.events, ended)
+      } finally {
+        settleClaudeExitedSession(exit.session)
+      }
+    })()
+    return exit.settlementPromise
+  }
+
+  private async persistSessionHandle(sessionId: string, session: ClaudeSession): Promise<void> {
+    try {
+      const transcriptLeaf = this.deps.readTranscriptLeaf
+        ? await readClaudeTranscriptLeafWithReproof({
+            readTranscriptLeaf: this.deps.readTranscriptLeaf,
+            providerSessionId: session.providerSessionId,
+            previousLeafUuid: session.leafUuid,
+            claudeConfigDir: session.claudeConfigDir
+          })
+        : null
+      if (transcriptLeaf) {
+        session.leafUuid = transcriptLeaf
+      }
+    } catch {
+      // A stale or unavailable tail must not overwrite the last observed leaf.
+    }
+    await this.deps.persistHandle?.({
+      sessionId,
+      providerSessionId: session.providerSessionId,
+      leafUuid: session.leafUuid,
+      fence: session.fence
+    })
+  }
+
+  private emit(
+    session: ClaudeSession | null,
+    _events: StructuredAgentSessionEventSink | undefined,
+    event: ClaudeStructuredSessionEvent
+  ): void {
+    const backgroundTasksChanged =
+      event.type === 'ended'
+        ? (session?.backgroundTasks.clear() ?? false)
+        : event.type === 'message'
+          ? (session?.backgroundTasks.observe(event.message, event.startsTurn === true) ?? false)
+          : false
+    session?.translator?.handle(event)
+    this.deps.onEvent?.(event)
+    if (backgroundTasksChanged) {
+      this.deps.onBackgroundTasksChanged?.(
+        event.sessionId,
+        session ? backgroundTaskState(session) : null
+      )
+    }
+  }
+
+  bindPromptItemId(
+    sessionId: string,
+    journalItemId: string,
+    promptKey: string,
+    questionId?: string
+  ): void {
+    this.sessions.get(sessionId)?.prompts.bindJournalItemId(journalItemId, promptKey, questionId)
+  }
+
+  dispatch: StructuredAgentSessionAdapter['dispatch'] = (input) =>
+    dispatchClaudeTurn(
+      this.session(input.sessionId),
+      input,
+      this.deps.dispatchAckTimeoutMs ?? DISPATCH_ACK_TIMEOUT_MS
+    )
+
+  cancelTurn: StructuredAgentSessionAdapter['cancelTurn'] = (input) => {
+    const session = this.session(input.sessionId)
+    const acquisitionGeneration = session.acquisitionGeneration
+    return cancelClaudeTurn(session, this.deps.requestTimeoutMs, () => {
+      // Keep every ownership check adjacent to the provider interrupt. The
+      // session map check fences a replaced child; the turn check fences a
+      // delayed cancel after a newer turn was admitted on the same child.
+      return (
+        this.sessions.get(input.sessionId) === session &&
+        session.fence === input.fence &&
+        session.acquisitionGeneration === acquisitionGeneration &&
+        (session.activeTurnId === undefined
+          ? session.dispatchSequence === 0
+          : session.activeTurnId === input.turnId &&
+            session.activeTurnSequence === session.dispatchSequence)
+      )
+    })
+  }
+  stopBackgroundTasks: StructuredAgentSessionAdapter['stopBackgroundTasks'] = (input) => {
+    const session = this.session(input.sessionId)
+    const acquisitionGeneration = session.acquisitionGeneration
+    return stopClaudeBackgroundTasks(
+      session,
+      this.deps.requestTimeoutMs,
+      () =>
+        Boolean(
+          this.sessions.get(input.sessionId) === session &&
+          session.fence === input.fence &&
+          session.acquisitionGeneration === acquisitionGeneration &&
+          session.backgroundTasks.state
+        ),
+      input.taskId
+    )
+  }
+  backgroundTaskState: NonNullable<StructuredAgentSessionAdapter['backgroundTaskState']> = (
+    sessionId
+  ) => {
+    const session = this.sessions.get(sessionId)
+    return session ? backgroundTaskState(session) : undefined
+  }
+  answerPrompt: StructuredAgentSessionAdapter['answerPrompt'] = (input) =>
+    answerClaudePrompt(this.session(input.sessionId), input)
+  setOption: StructuredAgentSessionAdapter['setOption'] = (input) =>
+    setClaudeStructuredOption(this.session(input.sessionId), input, this.deps.requestTimeoutMs)
+  readOptions = (input: { sessionId: string; fence: number }) =>
+    readClaudeStructuredSessionOptions(this.session(input.sessionId), this.deps.requestTimeoutMs)
+
+  readOptionRestoreFailures = (sessionId: string): readonly string[] => [
+    ...(this.sessions.get(sessionId)?.restoreSkippedOptions ?? [])
+  ]
+
+  releaseAcquisition = (input: { sessionId: string }): Promise<boolean> =>
+    releaseClaudeAcquisition({
+      sessionId: input.sessionId,
+      sessions: this.sessions,
+      acquisitions: this.acquisitions,
+      exits: this.exits,
+      onExitProven: (sessionId, exit) => this.settleUnexpectedExit(sessionId, exit),
+      ...(this.deps.persistHandle ? { persistHandle: this.deps.persistHandle } : {}),
+      ...(this.deps.onBackgroundTasksChanged
+        ? { onBackgroundTasksChanged: this.deps.onBackgroundTasksChanged }
+        : {}),
+      ...(this.deps.onEvent ? { onEvent: this.deps.onEvent } : {})
+    })
+
+  closeSession = (sessionId: string): Promise<boolean> => {
+    if (this.exits.has(sessionId)) {
+      return this.releaseAcquisition({ sessionId })
+    }
+    return closeClaudeSession({
+      sessionId,
+      sessions: this.sessions,
+      acquisitions: this.acquisitions,
+      ...(this.deps.persistHandle ? { persistHandle: this.deps.persistHandle } : {}),
+      ...(this.deps.readTranscriptLeaf ? { readTranscriptLeaf: this.deps.readTranscriptLeaf } : {}),
+      ...(this.deps.onBackgroundTasksChanged
+        ? { onBackgroundTasksChanged: this.deps.onBackgroundTasksChanged }
+        : {}),
+      ...(this.deps.onEvent ? { onEvent: this.deps.onEvent } : {})
+    })
+  }
+
+  closeAll = (): Promise<void> =>
+    closeAllClaudeSessions({
+      sessions: this.sessions,
+      acquisitions: this.acquisitions,
+      exits: this.exits,
+      closeSession: this.closeSession,
+      closeExit: (sessionId) => this.releaseAcquisition({ sessionId })
+    })
+
+  private session(sessionId: string): ClaudeSession {
+    const session = this.sessions.get(sessionId)
+    if (!session) {
+      throw new Error(`no live claude stream-json session for ${sessionId}`)
+    }
+    return session
+  }
+}
diff --git a/src/main/claude/claude-structured-session-close.test.ts b/src/main/claude/claude-structured-session-close.test.ts
new file mode 100644
index 00000000000..670c0daaf8c
--- /dev/null
+++ b/src/main/claude/claude-structured-session-close.test.ts
@@ -0,0 +1,90 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { StructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
+import type {
+  ClaudeStructuredSessionAdapterDeps,
+  ClaudeStructuredSessionEvent
+} from './claude-structured-session-adapter'
+import {
+  PROVIDER_SESSION_ID,
+  adapterFor,
+  fakeClaude,
+  identityFor
+} from './claude-structured-session-test-support'
+import type { AgentSessionBackgroundTaskState } from '../../shared/agent-session-wire'
+
+describe('Claude published session close lifecycle', () => {
+  it('ends the session even when the durable handle write rejects', async () => {
+    const claude = fakeClaude()
+    const events: ClaudeStructuredSessionEvent[] = []
+    const persistenceError = new Error('store unavailable')
+    const persistHandle = vi
+      .fn<NonNullable<ClaudeStructuredSessionAdapterDeps['persistHandle']>>()
+      .mockRejectedValueOnce(persistenceError)
+      .mockResolvedValueOnce(undefined)
+    const backgroundStates: (AgentSessionBackgroundTaskState | null)[] = []
+    const adapter = adapterFor(
+      claude,
+      {},
+      events,
+      [],
+      undefined,
+      undefined,
+      persistHandle,
+      (_sessionId, state) => backgroundStates.push(state)
+    )
+    const journalSink: StructuredAgentSessionEventSink = {
+      appendItem: () => {},
+      appendTombstone: () => {},
+      publish: () => {}
+    }
+    await adapter.acquire({
+      identity: identityFor(),
+      fence: 7,
+      spawnToken: 'spawn-9',
+      events: journalSink
+    })
+    claude.connections[0]!.handlers.onMessage?.({
+      type: 'system',
+      subtype: 'task_started',
+      session_id: PROVIDER_SESSION_ID,
+      uuid: 'task-start',
+      task_id: 'background-1',
+      task_type: 'local_agent',
+      is_backgrounded: true
+    })
+    expect(backgroundStates).toEqual([
+      {
+        state: 'monitoring',
+        tasks: [{ id: 'background-1', kind: 'agent' }],
+        supportsTaskStop: true
+      }
+    ])
+    const session = (
+      adapter as unknown as {
+        sessions: Map<string, { translator: { dispose: () => void } | null }>
+      }
+    ).sessions.get('session-1')
+    const disposeTranslator = vi.spyOn(session!.translator!, 'dispose')
+
+    await expect(adapter.closeSession('session-1')).rejects.toBe(persistenceError)
+    // The child is provably dead; a failed cursor write may not suppress the end.
+    expect(events.filter((event) => event.type === 'ended')).toHaveLength(1)
+    expect(events.filter((event) => event.type === 'handle')).toHaveLength(0)
+    expect(disposeTranslator).toHaveBeenCalledOnce()
+    expect(backgroundStates).toEqual([
+      {
+        state: 'monitoring',
+        tasks: [{ id: 'background-1', kind: 'agent' }],
+        supportsTaskStop: true
+      },
+      null
+    ])
+
+    await expect(adapter.closeSession('session-1')).resolves.toBe(true)
+    expect(persistHandle).toHaveBeenCalledTimes(2)
+    // The retry persists the same cursor without a second lifecycle end.
+    expect(events.filter((event) => event.type === 'handle')).toHaveLength(1)
+    expect(events.filter((event) => event.type === 'ended')).toHaveLength(1)
+    expect(disposeTranslator).toHaveBeenCalledOnce()
+  })
+})
diff --git a/src/main/claude/claude-structured-session-close.ts b/src/main/claude/claude-structured-session-close.ts
new file mode 100644
index 00000000000..de07439919d
--- /dev/null
+++ b/src/main/claude/claude-structured-session-close.ts
@@ -0,0 +1,272 @@
+import type {
+  ClaudeAcquisitionRegistry,
+  ClaudeSession,
+  ClaudeSessionExit,
+  ClaudeStructuredSessionEvent
+} from './claude-structured-session-state'
+import { cancelClaudeAcquisitionAttempt } from './claude-structured-session-state'
+import {
+  AgentSessionAcquisitionExitUnprovenError,
+  AgentSessionAcquisitionRootExitObservedError,
+  AgentSessionPreSpawnError
+} from '../native-chat/agent-session-wire/structured-agent-session-adapter'
+import type { ClaudeStreamJsonConnection } from './claude-stream-json-connection'
+import type { AgentSessionBackgroundTaskState } from '../../shared/agent-session-wire'
+import { closeProcessRegistry } from '../../shared/child-process/close-process-registry'
+import { readClaudeTranscriptLeafWithReproof } from './claude-transcript-branch-proof'
+
+export function claudeAcquisitionCleanupError(
+  connection: ClaudeStreamJsonConnection | null | undefined,
+  cause: unknown
+): Error {
+  const verdict = connection?.exitVerdict
+  if (verdict?.root === 'processless') {
+    return new AgentSessionPreSpawnError(cause)
+  }
+  return verdict?.root === 'exited' && verdict.tree === 'unverifiable'
+    ? new AgentSessionAcquisitionRootExitObservedError(cause)
+    : new AgentSessionAcquisitionExitUnprovenError(cause)
+}
+
+export function settleClaudeDispatchWaiters(session: ClaudeSession): void {
+  for (const waiter of session.dispatchWaiters.splice(0)) {
+    clearTimeout(waiter.timer)
+    waiter.resolve(null)
+  }
+}
+
+export function settleClaudeExitedSession(session: ClaudeSession): void {
+  settleClaudeDispatchWaiters(session)
+  for (const prompt of session.prompts.clear()) {
+    prompt.settle(null)
+  }
+  session.translator?.dispose()
+}
+
+type CloseClaudePublishedSessionInput = {
+  sessions: Map<string, ClaudeSession>
+  sessionId: string
+  persistHandle?: (handle: {
+    sessionId: string
+    providerSessionId: string
+    leafUuid: string | null
+    fence: number
+  }) => Promise<void>
+  onEvent?: (event: ClaudeStructuredSessionEvent) => void
+  onBackgroundTasksChanged?: (
+    sessionId: string,
+    state: AgentSessionBackgroundTaskState | null
+  ) => void
+  readTranscriptLeaf?: (input: {
+    providerSessionId: string
+    previousLeafUuid: string | null
+    claudeConfigDir: string
+  }) => Promise<string | null>
+}
+
+async function finalizeClaudePublishedSession(
+  input: CloseClaudePublishedSessionInput,
+  session: ClaudeSession
+): Promise<boolean> {
+  settleClaudeDispatchWaiters(session)
+  // Settle every in-flight permission callback so closing leaves no dangling promise; `null`
+  // writes no response, and the SDK ignores any post-cleanup answer regardless.
+  for (const prompt of session.prompts.clear()) {
+    prompt.settle(null)
+  }
+  if ((await session.connection.close()) !== true) {
+    return false
+  }
+  if (session.backgroundTasks.clear()) {
+    input.onBackgroundTasksChanged?.(input.sessionId, null)
+  }
+  try {
+    const transcriptLeaf = input.readTranscriptLeaf
+      ? await readClaudeTranscriptLeafWithReproof({
+          readTranscriptLeaf: input.readTranscriptLeaf,
+          providerSessionId: session.providerSessionId,
+          previousLeafUuid: session.leafUuid,
+          claudeConfigDir: session.claudeConfigDir
+        })
+      : null
+    if (transcriptLeaf) {
+      session.leafUuid = transcriptLeaf
+    }
+  } catch {
+    // Keep the last observed main-transcript frame when the durable tail is
+    // unavailable or proves a stale/divergent branch.
+  }
+  const persistence =
+    session.closePersistence ??
+    (session.closePersistence = (async () => {
+      await input.persistHandle?.({
+        sessionId: input.sessionId,
+        providerSessionId: session.providerSessionId,
+        leafUuid: session.leafUuid,
+        fence: session.fence
+      })
+    })())
+  const ended = {
+    type: 'ended',
+    sessionId: input.sessionId,
+    reason: 'claude session closed'
+  } as const
+  let callbackError: unknown
+  let callbackThrew = false
+  const deliver = (event: ClaudeStructuredSessionEvent): void => {
+    try {
+      input.onEvent?.(event)
+    } catch (error) {
+      callbackThrew = true
+      callbackError ??= error
+    }
+  }
+  let persistenceError: unknown
+  try {
+    await persistence
+    session.closeFinalized = true
+    input.sessions.delete(input.sessionId)
+    deliver({
+      type: 'handle',
+      sessionId: input.sessionId,
+      providerSessionId: session.providerSessionId,
+      leafUuid: session.leafUuid,
+      fence: session.fence
+    })
+  } catch (error) {
+    // Keep the closed session indexed so a retry can persist the same cursor.
+    // Removing it first would turn a durable-write failure into a no-op retry.
+    if (session.closePersistence === persistence) {
+      session.closePersistence = undefined
+    }
+    persistenceError = error
+  }
+  // The connection already proved the child dead, so the session has ended
+  // whatever the durable write did: withholding it would strand the renderer on
+  // a session nothing re-drives. Emitted once, so a retry only re-persists.
+  if (!session.closeEnded) {
+    session.closeEnded = true
+    try {
+      try {
+        session.translator?.handle(ended)
+      } catch (error) {
+        callbackThrew = true
+        callbackError ??= error
+      }
+      deliver(ended)
+    } finally {
+      session.translator?.dispose()
+    }
+  }
+  if (persistenceError) {
+    throw persistenceError
+  }
+  if (callbackThrew) {
+    throw callbackError
+  }
+  return true
+}
+
+export async function closeClaudePublishedSession(
+  input: CloseClaudePublishedSessionInput
+): Promise<boolean> {
+  const session = input.sessions.get(input.sessionId)
+  if (!session) {
+    return true
+  }
+  if (session.closeFinalized) {
+    return true
+  }
+  if (session.closeFinalization) {
+    return session.closeFinalization
+  }
+  const finalization = finalizeClaudePublishedSession(input, session)
+  session.closeFinalization = finalization
+  try {
+    return await finalization
+  } finally {
+    if (session.closeFinalization === finalization && !session.closeFinalized) {
+      session.closeFinalization = undefined
+    }
+  }
+}
+
+export function closeClaudePublishedSessionForDeps(
+  sessions: Map<string, ClaudeSession>,
+  sessionId: string,
+  deps: {
+    persistHandle?: (handle: {
+      sessionId: string
+      providerSessionId: string
+      leafUuid: string | null
+      fence: number
+    }) => Promise<void>
+    onEvent?: (event: ClaudeStructuredSessionEvent) => void
+    onBackgroundTasksChanged?: (
+      sessionId: string,
+      state: AgentSessionBackgroundTaskState | null
+    ) => void
+    readTranscriptLeaf?: (input: {
+      providerSessionId: string
+      previousLeafUuid: string | null
+      claudeConfigDir: string
+    }) => Promise<string | null>
+  }
+): Promise<boolean> {
+  return closeClaudePublishedSession({ sessions, sessionId, ...deps })
+}
+
+export async function closeClaudeSession(input: {
+  sessionId: string
+  sessions: Map<string, ClaudeSession>
+  acquisitions: ClaudeAcquisitionRegistry
+  persistHandle?: (handle: {
+    sessionId: string
+    providerSessionId: string
+    leafUuid: string | null
+    fence: number
+  }) => Promise<void>
+  onEvent?: (event: ClaudeStructuredSessionEvent) => void
+  onBackgroundTasksChanged?: (
+    sessionId: string,
+    state: AgentSessionBackgroundTaskState | null
+  ) => void
+  readTranscriptLeaf?: (input: {
+    providerSessionId: string
+    previousLeafUuid: string | null
+    claudeConfigDir: string
+  }) => Promise<string | null>
+}): Promise<boolean> {
+  const attempt = input.acquisitions.get(input.sessionId)
+  if (!(await cancelClaudeAcquisitionAttempt(attempt))) {
+    return false
+  }
+  if (attempt) {
+    input.acquisitions.deleteIfCurrent(input.sessionId, attempt)
+  }
+  return closeClaudePublishedSession(input)
+}
+
+export async function closeAllClaudeSessions(input: {
+  sessions: Map<string, ClaudeSession>
+  acquisitions: ClaudeAcquisitionRegistry
+  exits: Map<string, ClaudeSessionExit>
+  closeSession: (sessionId: string) => Promise<boolean>
+  closeExit: (sessionId: string) => Promise<boolean>
+}): Promise<void> {
+  input.acquisitions.close()
+  await closeProcessRegistry({
+    attempts: 3,
+    hasEntries: () =>
+      input.sessions.size > 0 || input.acquisitions.size > 0 || input.exits.size > 0,
+    entryIds: () =>
+      new Set([
+        ...input.sessions.keys(),
+        ...input.acquisitions.sessionIds(),
+        ...input.exits.keys()
+      ]),
+    closeEntry: async (sessionId) =>
+      input.exits.has(sessionId) ? input.closeExit(sessionId) : input.closeSession(sessionId),
+    failureMessage: 'claude structured session shutdown could not prove every child stopped'
+  })
+}
diff --git a/src/main/claude/claude-structured-session-options.ts b/src/main/claude/claude-structured-session-options.ts
new file mode 100644
index 00000000000..afb4fd65076
--- /dev/null
+++ b/src/main/claude/claude-structured-session-options.ts
@@ -0,0 +1,183 @@
+import type {
+  AgentSessionModelOption,
+  AgentSessionOptionChoice,
+  AgentSessionOptionsResult
+} from '../../shared/agent-session-wire'
+import { CLAUDE_SESSION_OPTION_CATALOG } from '../../shared/agent-session-option-catalog-claude-codex'
+import type { CatalogModel } from '../../shared/agent-session-option-catalog-types'
+import type { ClaudeSession } from './claude-structured-session-state'
+
+type ListedModel = AgentSessionModelOption & { resolvedModel: string | null }
+
+function record(value: unknown): Record<string, unknown> | null {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : null
+}
+
+function text(value: unknown): string | null {
+  return typeof value === 'string' && value.trim() ? value : null
+}
+
+/**
+ * The session's current effort, which only `get_settings` reports: the
+ * `system/init` frame carries `model` but has never carried an effort of any
+ * kind. Null when the provider stops reporting it, so the pill goes empty
+ * rather than showing an effort nothing measured.
+ */
+export function readClaudeSettingsEffort(settings: unknown): string | null {
+  return text(record(record(settings)?.effective)?.effortLevel)
+}
+
+function effortLabel(value: string): string {
+  return value === 'xhigh' ? 'Extra high' : `${value.charAt(0).toUpperCase()}${value.slice(1)}`
+}
+
+function listedEfforts(row: Record<string, unknown>): AgentSessionOptionChoice[] {
+  return row.supportsEffort === true && Array.isArray(row.supportedEffortLevels)
+    ? row.supportedEffortLevels.flatMap((value) => {
+        const effort = text(value)
+        return effort ? [{ value: effort, label: effortLabel(effort) }] : []
+      })
+    : []
+}
+
+function listedModels(value: unknown): ListedModel[] {
+  const response = record(value)
+  const rows = Array.isArray(response?.models)
+    ? response.models.map(record).filter((row): row is Record<string, unknown> => row !== null)
+    : []
+  const defaultRow = rows.find((row) => text(row.value) === 'default')
+  const defaultResolvedModel = text(defaultRow?.resolvedModel)
+  const seen = new Set<string>()
+  return rows.flatMap((row) => {
+    const id = text(row.value)
+    if (!id || id === 'default' || seen.has(id)) {
+      return []
+    }
+    seen.add(id)
+    const resolvedModel = text(row.resolvedModel)
+    const description = text(row.description)
+    return [
+      {
+        id,
+        label: text(row.displayName) ?? id,
+        ...(description ? { description } : {}),
+        isDefault: resolvedModel !== null && resolvedModel === defaultResolvedModel,
+        efforts: listedEfforts(row),
+        resolvedModel
+      }
+    ]
+  })
+}
+
+function seedEfforts(model: CatalogModel): AgentSessionOptionChoice[] {
+  const effort = model.options.find((option) => option.id === 'effort')
+  return effort?.kind.type === 'select' ? effort.kind.choices : []
+}
+
+function seedModels(): ListedModel[] {
+  return CLAUDE_SESSION_OPTION_CATALOG.models.map((model) => ({
+    id: model.id,
+    label: model.label,
+    ...(model.description ? { description: model.description } : {}),
+    isDefault: model.isDefault === true,
+    efforts: seedEfforts(model),
+    resolvedModel: null
+  }))
+}
+
+function currentModelId(models: ListedModel[], reportedModel: string | undefined): string {
+  const matched = reportedModel
+    ? models.find((model) => model.id === reportedModel || model.resolvedModel === reportedModel)
+    : undefined
+  return (
+    matched?.id ?? reportedModel ?? models.find((model) => model.isDefault)?.id ?? models[0]!.id
+  )
+}
+
+/**
+ * The model the session is running. A report the CLI made after the last write
+ * outranks the write: it names the model the session ran. An older one does not
+ * — a model set between turns has no report yet, and deferring to the previous
+ * turn's would flip the pill back.
+ *
+ * Sole resolver of that question: every surface that acts on "the current model"
+ * — the pill, the effort guard, the rejection it names — reads it here, so two
+ * of them cannot answer it differently and offer an effort a third then refuses.
+ */
+export function readClaudeCurrentModel(session: ClaudeSession): {
+  id: string | undefined
+  confirmed: boolean
+} {
+  const confirmed =
+    session.reportedModelMutation === session.optionMutationSequence &&
+    session.reportedOptions.model !== undefined
+  return {
+    id: confirmed
+      ? session.reportedOptions.model
+      : (session.options.get('model') ?? session.reportedOptions.model),
+    confirmed
+  }
+}
+
+/**
+ * The effort levels the session's current model advertises, with the catalog id
+ * that matched so a refusal names the model the pill shows. Levels are null when
+ * nothing identified the model: `apply_flag_settings` accepts and stores any
+ * level for a model with no effort control, so the catalog is the only evidence
+ * of a refusal — and an absent or unlisted one is not evidence, or a live CLI
+ * that predates `list_models` would have every effort refused under it.
+ */
+export async function readClaudeModelEffortLevels(
+  session: ClaudeSession,
+  timeoutMs: number | undefined
+): Promise<{ modelId: string | undefined; levels: ReadonlySet<string> | null }> {
+  const modelId = readClaudeCurrentModel(session).id
+  if (!modelId) {
+    return { modelId, levels: null }
+  }
+  const catalog = await session.connection.supportedModels({ timeoutMs }).catch(() => null)
+  const matched = catalog
+    ? listedModels({ models: catalog }).find(
+        (model) => model.id === modelId || model.resolvedModel === modelId
+      )
+    : undefined
+  return {
+    modelId: matched?.id ?? modelId,
+    levels: matched ? new Set(matched.efforts.map((choice) => choice.value)) : null
+  }
+}
+
+export async function readClaudeStructuredSessionOptions(
+  session: ClaudeSession,
+  timeoutMs: number | undefined
+): Promise<AgentSessionOptionsResult> {
+  const catalog = await session.connection.supportedModels({ timeoutMs }).catch(() => null)
+  const discovered = listedModels(catalog ? { models: catalog } : null)
+  const models = discovered.length > 0 ? discovered : seedModels()
+  const current = readClaudeCurrentModel(session)
+  const model = currentModelId(models, current.id)
+  if (!models.some((entry) => entry.id === model)) {
+    models.push({ id: model, label: model, isDefault: false, efforts: [], resolvedModel: null })
+  }
+  const effort = session.options.get('effort') ?? session.reportedOptions.effort
+  const confirmed = [
+    ...(current.confirmed ? ['model'] : []),
+    ...(effort && session.confirmedOptions.has('effort') ? ['effort'] : [])
+  ]
+  return {
+    models: models.map((entry) => ({
+      id: entry.id,
+      label: entry.label,
+      ...(entry.description ? { description: entry.description } : {}),
+      isDefault: entry.isDefault,
+      efforts: entry.efforts
+    })),
+    current: {
+      model,
+      ...(effort ? { effort } : {}),
+      ...(confirmed.length > 0 ? { confirmed } : {})
+    }
+  }
+}
diff --git a/src/main/claude/claude-structured-session-publication.ts b/src/main/claude/claude-structured-session-publication.ts
new file mode 100644
index 00000000000..7f8cc4b5692
--- /dev/null
+++ b/src/main/claude/claude-structured-session-publication.ts
@@ -0,0 +1,70 @@
+import type { AgentSessionAcquisition } from '../native-chat/agent-session-wire/structured-agent-session-adapter'
+import type { ClaudeInitObservation } from './claude-structured-init-proof'
+import { claudeProviderHandleLink } from './claude-structured-owner-identity'
+import type { ClaudePromptRegistry } from './claude-structured-prompt-replies'
+import type { ClaudeJournalTranslator } from './claude-structured-journal-translation'
+import type { ClaudeSession } from './claude-structured-session-state'
+import { ClaudeBackgroundTaskTracker } from './claude-background-task-tracker'
+
+export function createClaudeSessionPublication(input: {
+  connection: ClaudeSession['connection']
+  init: ClaudeInitObservation
+  claudeConfigDir: string
+  leafUuid: string | null
+  fence: number
+  acquisitionGeneration: string
+  resumed: boolean
+  prompts: ClaudePromptRegistry
+  translator: ClaudeJournalTranslator | null
+  events: ClaudeSession['events']
+  process: AgentSessionAcquisition['process']
+  linkId?: string
+  observedAt: number
+  options?: ReadonlyMap<string, string>
+  capabilities: readonly string[]
+  /** Read from `get_settings`; `system/init` never reports an effort. */
+  effort: string | null
+}): { acquisition: AgentSessionAcquisition; session: ClaudeSession } {
+  const model = input.init.model
+  const effort = input.effort
+  return {
+    acquisition: {
+      process: input.process,
+      link: claudeProviderHandleLink({
+        sessionId: input.init.providerSessionId,
+        leafUuid: input.leafUuid,
+        resumed: input.resumed,
+        fence: input.fence,
+        ...(input.linkId ? { linkId: input.linkId } : {}),
+        observedAt: input.observedAt
+      }),
+      acquisitionGeneration: input.acquisitionGeneration
+    },
+    session: {
+      connection: input.connection,
+      providerSessionId: input.init.providerSessionId,
+      claudeConfigDir: input.claudeConfigDir,
+      leafUuid: input.leafUuid,
+      fence: input.fence,
+      acquisitionGeneration: input.acquisitionGeneration,
+      prompts: input.prompts,
+      dispatchWaiters: [],
+      retiredDispatchWaiters: [],
+      replayContentFallbackBlocked: false,
+      backgroundTasks: new ClaudeBackgroundTaskTracker(),
+      dispatchSequence: 0,
+      optionMutationSequence: 0,
+      options: new Map(input.options),
+      capabilities: input.capabilities,
+      reportedOptions: {
+        ...(model ? { model } : {}),
+        ...(effort ? { effort } : {})
+      },
+      reportedModelMutation: 0,
+      confirmedOptions: new Set(effort ? ['effort'] : []),
+      restoreSkippedOptions: new Set(),
+      translator: input.translator,
+      events: input.events
+    }
+  }
+}
diff --git a/src/main/claude/claude-structured-session-recovery.test.ts b/src/main/claude/claude-structured-session-recovery.test.ts
new file mode 100644
index 00000000000..5bfe56cf156
--- /dev/null
+++ b/src/main/claude/claude-structured-session-recovery.test.ts
@@ -0,0 +1,619 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { StructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
+import {
+  ClaudeStructuredSessionAdapter,
+  type ClaudeStructuredSessionAdapterDeps,
+  type ClaudeStructuredSessionEvent
+} from './claude-structured-session-adapter'
+import { ClaudeTranscriptPreviousCursorMissingError } from './claude-transcript-branch-proof'
+import {
+  adapterFor,
+  fakeClaude,
+  identityFor,
+  invokeCanUseTool,
+  PROVIDER_SESSION_ID,
+  tick
+} from './claude-structured-session-test-support'
+
+describe('ClaudeStructuredSessionAdapter transcript-derived recovery', () => {
+  it('shares concurrent close finalization and emits lifecycle once', async () => {
+    const claude = fakeClaude()
+    const events: ClaudeStructuredSessionEvent[] = []
+    const persistence = Promise.withResolvers<void>()
+    const persistHandle = vi.fn(() => persistence.promise)
+    const adapter = adapterFor(claude, {}, events, [], undefined, undefined, persistHandle)
+    const journalSink: StructuredAgentSessionEventSink = {
+      appendItem: () => {},
+      appendTombstone: () => {},
+      publish: () => {}
+    }
+    await adapter.acquire({
+      identity: identityFor(),
+      fence: 7,
+      spawnToken: 'spawn-9',
+      events: journalSink
+    })
+    const session = (
+      adapter as unknown as {
+        sessions: Map<string, { translator: { dispose: () => void } | null }>
+      }
+    ).sessions.get('session-1')
+    const disposeTranslator = vi.spyOn(session!.translator!, 'dispose')
+
+    const first = adapter.closeSession('session-1')
+    const second = adapter.closeSession('session-1')
+    await tick()
+    expect(persistHandle).toHaveBeenCalledOnce()
+    expect(claude.connections[0].closeCount).toBe(1)
+
+    persistence.resolve()
+    await expect(Promise.all([first, second])).resolves.toEqual([true, true])
+    expect(events.filter((event) => event.type === 'handle')).toHaveLength(1)
+    expect(events.filter((event) => event.type === 'ended')).toHaveLength(1)
+    expect(disposeTranslator).toHaveBeenCalledOnce()
+  })
+
+  it('still emits ended and disposes state when handle delivery throws', async () => {
+    const claude = fakeClaude()
+    const events: ClaudeStructuredSessionEvent[] = []
+    const callbackError = new Error('handle delivery failed')
+    const adapter = new ClaudeStructuredSessionAdapter({
+      resolveLaunch: async () => ({
+        pathToClaudeCodeExecutable: 'claude',
+        options: {},
+        cwd: '/work/repo',
+        claudeConfigDir: '/accounts/claude',
+        providerSessionId: PROVIDER_SESSION_ID,
+        resumeLeafUuid: null,
+        resumed: false
+      }),
+      onEvent: (event) => {
+        events.push(event)
+        if (event.type === 'handle') {
+          throw callbackError
+        }
+      },
+      openConnection: claude.openConnection,
+      readProcessStartTime: async () => 1_700_000_000_000,
+      persistHandle: vi.fn(async () => undefined)
+    })
+    const journalSink: StructuredAgentSessionEventSink = {
+      appendItem: () => {},
+      appendTombstone: () => {},
+      publish: () => {}
+    }
+    await adapter.acquire({
+      identity: identityFor(),
+      fence: 7,
+      spawnToken: 'spawn-9',
+      events: journalSink
+    })
+    const session = (
+      adapter as unknown as {
+        sessions: Map<string, { translator: { dispose: () => void } | null }>
+      }
+    ).sessions.get('session-1')
+    const disposeTranslator = vi.spyOn(session!.translator!, 'dispose')
+
+    await expect(adapter.closeSession('session-1')).rejects.toBe(callbackError)
+    expect(events.filter((event) => event.type === 'handle')).toHaveLength(1)
+    expect(events.filter((event) => event.type === 'ended')).toHaveLength(1)
+    expect(disposeTranslator).toHaveBeenCalledOnce()
+  })
+
+  it('retains a closed session until its durable cursor persistence succeeds', async () => {
+    const claude = fakeClaude()
+    const persistenceError = new Error('store unavailable')
+    const persistHandle = vi
+      .fn<NonNullable<ClaudeStructuredSessionAdapterDeps['persistHandle']>>()
+      .mockRejectedValueOnce(persistenceError)
+      .mockResolvedValueOnce(undefined)
+    const adapter = adapterFor(claude, {}, [], [], undefined, undefined, persistHandle)
+    await adapter.acquire({ identity: identityFor(), fence: 7, spawnToken: 'spawn-9' })
+
+    await expect(adapter.closeSession('session-1')).rejects.toBe(persistenceError)
+    expect(persistHandle).toHaveBeenCalledTimes(1)
+    await expect(adapter.closeSession('session-1')).resolves.toBe(true)
+    expect(persistHandle).toHaveBeenCalledTimes(2)
+  })
+
+  it('persists only the last transcript-entry uuid before graceful close', async () => {
+    const claude = fakeClaude()
+    const events: ClaudeStructuredSessionEvent[] = []
+    const persistedHandles: unknown[] = []
+    const adapter = adapterFor(claude, {}, events, persistedHandles)
+    await adapter.acquire({ identity: identityFor(), fence: 7, spawnToken: 'spawn-9' })
+    claude.connections[0].handlers.onMessage?.({
+      type: 'assistant',
+      session_id: PROVIDER_SESSION_ID,
+      uuid: 'assistant-leaf'
+    })
+    claude.connections[0].handlers.onMessage?.({
+      type: 'result',
+      session_id: PROVIDER_SESSION_ID,
+      uuid: 'result-frame-uuid'
+    })
+    claude.connections[0].handlers.onMessage?.({
+      type: 'stream_event',
+      session_id: PROVIDER_SESSION_ID,
+      uuid: 'stream-event-frame-uuid'
+    })
+
+    await adapter.closeSession('session-1')
+
+    expect(persistedHandles).toEqual([
+      {
+        sessionId: 'session-1',
+        providerSessionId: PROVIDER_SESSION_ID,
+        leafUuid: 'assistant-leaf',
+        fence: 7
+      }
+    ])
+    expect(events.at(-2)).toEqual({
+      type: 'handle',
+      sessionId: 'session-1',
+      providerSessionId: PROVIDER_SESSION_ID,
+      leafUuid: 'assistant-leaf',
+      fence: 7
+    })
+    expect(claude.connections[0].closeCount).toBe(1)
+  })
+
+  it('prefers a validated durable transcript leaf at graceful close', async () => {
+    const claude = fakeClaude()
+    const persistedHandles: unknown[] = []
+    const readTranscriptLeaf = vi.fn().mockResolvedValue('durable-tail')
+    const adapter = adapterFor(claude, {}, [], persistedHandles, undefined, readTranscriptLeaf)
+    await adapter.acquire({ identity: identityFor(), fence: 7, spawnToken: 'spawn-9' })
+    claude.connections[0].handlers.onMessage?.({
+      type: 'assistant',
+      session_id: PROVIDER_SESSION_ID,
+      uuid: 'observed-tail'
+    })
+
+    await adapter.closeSession('session-1')
+
+    expect(readTranscriptLeaf).toHaveBeenCalledWith({
+      providerSessionId: PROVIDER_SESSION_ID,
+      previousLeafUuid: 'observed-tail',
+      claudeConfigDir: '/accounts/claude'
+    })
+    expect(persistedHandles.at(-1)).toMatchObject({ leafUuid: 'durable-tail' })
+  })
+
+  it('passes the pinned Claude account home to transcript validation', async () => {
+    const claude = fakeClaude()
+    const persistedHandles: unknown[] = []
+    const readTranscriptLeaf = vi.fn().mockResolvedValue('durable-tail')
+    const adapter = adapterFor(
+      claude,
+      { claudeConfigDir: '/accounts/selected' },
+      [],
+      persistedHandles,
+      undefined,
+      readTranscriptLeaf
+    )
+    await adapter.acquire({ identity: identityFor(), fence: 7, spawnToken: 'spawn-9' })
+    claude.connections[0].handlers.onMessage?.({
+      type: 'assistant',
+      session_id: PROVIDER_SESSION_ID,
+      uuid: 'observed-tail'
+    })
+
+    await adapter.closeSession('session-1')
+
+    expect(readTranscriptLeaf).toHaveBeenCalledWith({
+      providerSessionId: PROVIDER_SESSION_ID,
+      previousLeafUuid: 'observed-tail',
+      claudeConfigDir: '/accounts/selected'
+    })
+  })
+
+  it('re-proves from the transcript root when the observed cursor is missing', async () => {
+    const claude = fakeClaude()
+    const persistedHandles: unknown[] = []
+    const readTranscriptLeaf = vi
+      .fn()
+      .mockRejectedValueOnce(new ClaudeTranscriptPreviousCursorMissingError())
+      .mockResolvedValueOnce('reproved-main-leaf')
+    const adapter = adapterFor(claude, {}, [], persistedHandles, undefined, readTranscriptLeaf)
+    await adapter.acquire({ identity: identityFor(), fence: 7, spawnToken: 'spawn-9' })
+    claude.connections[0].handlers.onMessage?.({
+      type: 'assistant',
+      session_id: PROVIDER_SESSION_ID,
+      uuid: 'observed-tail'
+    })
+
+    await adapter.closeSession('session-1')
+
+    expect(readTranscriptLeaf).toHaveBeenNthCalledWith(1, {
+      providerSessionId: PROVIDER_SESSION_ID,
+      previousLeafUuid: 'observed-tail',
+      claudeConfigDir: '/accounts/claude'
+    })
+    expect(readTranscriptLeaf).toHaveBeenNthCalledWith(2, {
+      providerSessionId: PROVIDER_SESSION_ID,
+      previousLeafUuid: null,
+      claudeConfigDir: '/accounts/claude'
+    })
+    expect(persistedHandles.at(-1)).toMatchObject({ leafUuid: 'reproved-main-leaf' })
+  })
+
+  it('keeps the observed leaf when transcript validation proves a sibling branch', async () => {
+    const claude = fakeClaude()
+    const persistedHandles: unknown[] = []
+    const readTranscriptLeaf = vi
+      .fn()
+      .mockRejectedValue(new Error('latest marker is on a sibling branch'))
+    const adapter = adapterFor(claude, {}, [], persistedHandles, undefined, readTranscriptLeaf)
+    await adapter.acquire({ identity: identityFor(), fence: 7, spawnToken: 'spawn-9' })
+    claude.connections[0].handlers.onMessage?.({
+      type: 'assistant',
+      session_id: PROVIDER_SESSION_ID,
+      uuid: 'observed-tail'
+    })
+
+    await adapter.closeSession('session-1')
+
+    expect(readTranscriptLeaf).toHaveBeenCalledTimes(1)
+    expect(persistedHandles.at(-1)).toMatchObject({ leafUuid: 'observed-tail' })
+  })
+
+  it('persists the last transcript leaf before an unexpected first-hand exit', async () => {
+    const claude = fakeClaude()
+    const persistedHandles: unknown[] = []
+    const events: ClaudeStructuredSessionEvent[] = []
+    const adapter = adapterFor(claude, {}, events, persistedHandles)
+    await adapter.acquire({ identity: identityFor(), fence: 7, spawnToken: 'spawn-9' })
+    claude.connections[0].handlers.onMessage?.({
+      type: 'assistant',
+      session_id: PROVIDER_SESSION_ID,
+      uuid: 'crash-leaf'
+    })
+
+    claude.connections[0].handlers.onExit?.(
+      new Error('claude stream-json exited (code 1): crashed unexpectedly')
+    )
+    await tick()
+
+    expect(persistedHandles).toContainEqual({
+      sessionId: 'session-1',
+      providerSessionId: PROVIDER_SESSION_ID,
+      leafUuid: 'crash-leaf',
+      fence: 7
+    })
+    expect(events.at(-1)).toMatchObject({
+      type: 'ended',
+      cause: 'unexpected-exit',
+      fence: 7,
+      acquisitionGeneration: expect.any(String)
+    })
+  })
+
+  it('derives the crash cursor from the validated transcript tail', async () => {
+    const claude = fakeClaude()
+    const persistedHandles: unknown[] = []
+    const adapter = adapterFor(
+      claude,
+      {},
+      [],
+      persistedHandles,
+      undefined,
+      vi.fn().mockResolvedValue('durable-crash-leaf')
+    )
+    await adapter.acquire({ identity: identityFor(), fence: 7, spawnToken: 'spawn-9' })
+    claude.connections[0].handlers.onMessage?.({
+      type: 'assistant',
+      session_id: PROVIDER_SESSION_ID,
+      uuid: 'stale-observed-tail'
+    })
+    claude.connections[0].handlers.onExit?.(
+      new Error('claude stream-json exited (signal SIGKILL): crashed')
+    )
+    await tick()
+
+    expect(persistedHandles.at(-1)).toMatchObject({ leafUuid: 'durable-crash-leaf' })
+  })
+
+  it('re-proves a first-hand crash cursor from the transcript root after stale validation', async () => {
+    const claude = fakeClaude()
+    const persistedHandles: unknown[] = []
+    const readTranscriptLeaf = vi
+      .fn()
+      .mockRejectedValueOnce(new ClaudeTranscriptPreviousCursorMissingError())
+      .mockResolvedValueOnce('reproved-crash-leaf')
+    const adapter = adapterFor(claude, {}, [], persistedHandles, undefined, readTranscriptLeaf)
+    await adapter.acquire({ identity: identityFor(), fence: 7, spawnToken: 'spawn-9' })
+    claude.connections[0].handlers.onMessage?.({
+      type: 'assistant',
+      session_id: PROVIDER_SESSION_ID,
+      uuid: 'stale-observed-tail'
+    })
+    claude.connections[0].handlers.onExit?.(new Error('crashed'))
+    await tick()
+
+    expect(readTranscriptLeaf).toHaveBeenNthCalledWith(1, {
+      providerSessionId: PROVIDER_SESSION_ID,
+      previousLeafUuid: 'stale-observed-tail',
+      claudeConfigDir: '/accounts/claude'
+    })
+    expect(readTranscriptLeaf).toHaveBeenNthCalledWith(2, {
+      providerSessionId: PROVIDER_SESSION_ID,
+      previousLeafUuid: null,
+      claudeConfigDir: '/accounts/claude'
+    })
+    expect(persistedHandles.at(-1)).toMatchObject({ leafUuid: 'reproved-crash-leaf' })
+  })
+
+  it('keeps the observed crash leaf when transcript validation proves a sibling branch', async () => {
+    const claude = fakeClaude()
+    const persistedHandles: unknown[] = []
+    const readTranscriptLeaf = vi
+      .fn()
+      .mockRejectedValue(new Error('latest marker is on a sibling branch'))
+    const adapter = adapterFor(claude, {}, [], persistedHandles, undefined, readTranscriptLeaf)
+    await adapter.acquire({ identity: identityFor(), fence: 7, spawnToken: 'spawn-9' })
+    claude.connections[0].handlers.onMessage?.({
+      type: 'assistant',
+      session_id: PROVIDER_SESSION_ID,
+      uuid: 'observed-crash-tail'
+    })
+    claude.connections[0].handlers.onExit?.(new Error('crashed'))
+    await tick()
+
+    expect(readTranscriptLeaf).toHaveBeenCalledTimes(1)
+    expect(persistedHandles.at(-1)).toMatchObject({ leafUuid: 'observed-crash-tail' })
+  })
+
+  it('publishes lifecycle recovery even when crash-cursor persistence fails', async () => {
+    const claude = fakeClaude()
+    const events: ClaudeStructuredSessionEvent[] = []
+    const adapter = adapterFor(
+      claude,
+      {},
+      events,
+      [],
+      undefined,
+      undefined,
+      vi.fn().mockRejectedValue(new Error('store unavailable'))
+    )
+    await adapter.acquire({ identity: identityFor(), fence: 7, spawnToken: 'spawn-9' })
+
+    claude.connections[0].handlers.onExit?.(new Error('crashed'))
+    await tick()
+
+    expect(events.at(-1)).toMatchObject({ type: 'ended', cause: 'unexpected-exit' })
+  })
+
+  it('runs the child close proof before publishing unexpected-exit recovery', async () => {
+    const claude = fakeClaude()
+    const events: ClaudeStructuredSessionEvent[] = []
+    const adapter = adapterFor(claude, {}, events)
+    await adapter.acquire({ identity: identityFor(), fence: 7, spawnToken: 'spawn-9' })
+    const close = vi.spyOn(claude.connections[0], 'close').mockResolvedValue(true)
+
+    claude.connections[0].handlers.onExit?.(new Error('crashed'))
+    await tick()
+
+    expect(close).toHaveBeenCalledOnce()
+    expect(events.at(-1)).toMatchObject({ type: 'ended', cause: 'unexpected-exit' })
+  })
+
+  it('does not publish recovery while an unexpected-exit close proof is false', async () => {
+    const claude = fakeClaude()
+    const events: ClaudeStructuredSessionEvent[] = []
+    const persistedHandles: unknown[] = []
+    const adapter = adapterFor(claude, {}, events, persistedHandles)
+    await adapter.acquire({ identity: identityFor(), fence: 7, spawnToken: 'spawn-9' })
+    claude.connections[0].close = vi
+      .fn<() => Promise<boolean>>()
+      .mockResolvedValueOnce(false)
+      .mockResolvedValueOnce(true) as unknown as (typeof claude.connections)[0]['close']
+
+    claude.connections[0].handlers.onExit?.(new Error('crashed'))
+    await tick()
+
+    expect(events.filter((event) => event.type === 'ended')).toEqual([])
+    expect(persistedHandles).toEqual([])
+  })
+
+  it('retains pending prompts while an unexpected-exit proof is unproven', async () => {
+    const claude = fakeClaude()
+    const events: ClaudeStructuredSessionEvent[] = []
+    const adapter = adapterFor(claude, {}, events)
+    await adapter.acquire({ identity: identityFor(), fence: 7, spawnToken: 'spawn-9' })
+    const answered = invokeCanUseTool(claude.connections[0], 'Bash', 'permission-1', 'tool-1')
+    claude.connections[0].close = vi
+      .fn<() => Promise<boolean>>()
+      .mockResolvedValue(false) as unknown as (typeof claude.connections)[0]['close']
+
+    claude.connections[0].handlers.onExit?.(new Error('crashed'))
+    await tick()
+
+    expect(answered.settled()).toBe(false)
+    expect(events.filter((event) => event.type === 'ended')).toEqual([])
+  })
+
+  it('publishes unexpected recovery exactly once after a retained proof retries successfully', async () => {
+    const claude = fakeClaude()
+    const events: ClaudeStructuredSessionEvent[] = []
+    const adapter = adapterFor(claude, {}, events)
+    await adapter.acquire({ identity: identityFor(), fence: 7, spawnToken: 'spawn-9' })
+    claude.connections[0].close = vi
+      .fn<() => Promise<boolean>>()
+      .mockResolvedValueOnce(false)
+      .mockResolvedValueOnce(true) as unknown as (typeof claude.connections)[0]['close']
+
+    claude.connections[0].handlers.onExit?.(new Error('crashed'))
+    await tick()
+    await expect(adapter.releaseAcquisition({ sessionId: 'session-1' })).resolves.toBe(true)
+    await tick()
+
+    expect(events.filter((event) => event.type === 'ended')).toHaveLength(1)
+  })
+
+  it('launches the first replacement from the settled retained transcript cursor', async () => {
+    const claude = fakeClaude()
+    const events: ClaudeStructuredSessionEvent[] = []
+    const persistedHandles: unknown[] = []
+    const journalSink: StructuredAgentSessionEventSink = {
+      appendItem: () => {},
+      appendTombstone: () => {},
+      publish: () => {}
+    }
+    const readTranscriptLeaf = vi.fn().mockResolvedValue('durable-retained-leaf')
+    let durableLeafUuid: string | null = null
+    const resolveLaunch = vi.fn(async ({ identity }) => {
+      if (
+        identity.providerHandle.kind !== 'claude' ||
+        identity.providerHandle.sessionId !== PROVIDER_SESSION_ID ||
+        identity.providerHandle.leafUuid !== durableLeafUuid
+      ) {
+        throw new Error('claude durable resume identity changed before spawn')
+      }
+      if (durableLeafUuid === null) {
+        return {
+          pathToClaudeCodeExecutable: 'claude',
+          options: { sessionId: PROVIDER_SESSION_ID },
+          cwd: '/work/repo',
+          claudeConfigDir: '/accounts/claude',
+          providerSessionId: PROVIDER_SESSION_ID,
+          resumeLeafUuid: null,
+          resumed: false
+        }
+      }
+      return {
+        pathToClaudeCodeExecutable: 'claude',
+        options: { resume: PROVIDER_SESSION_ID, resumeSessionAt: durableLeafUuid },
+        cwd: '/work/repo',
+        claudeConfigDir: '/accounts/claude',
+        providerSessionId: PROVIDER_SESSION_ID,
+        resumeLeafUuid: durableLeafUuid,
+        resumed: true
+      }
+    })
+    const persistHandle = vi.fn<NonNullable<ClaudeStructuredSessionAdapterDeps['persistHandle']>>(
+      async (handle) => {
+        durableLeafUuid = handle.leafUuid
+        persistedHandles.push(handle)
+      }
+    )
+    const adapter = new ClaudeStructuredSessionAdapter({
+      resolveLaunch,
+      openConnection: claude.openConnection,
+      onEvent: (event) => events.push(event),
+      readProcessStartTime: async () => 1_700_000_000_000,
+      now: () => 1_700_000_000_500,
+      readTranscriptLeaf,
+      persistHandle
+    })
+    const firstAcquisition = await adapter.acquire({
+      identity: identityFor(),
+      fence: 7,
+      spawnToken: 'spawn-9',
+      events: journalSink
+    })
+    const first = claude.connections[0]
+    const oldPrompt = invokeCanUseTool(first, 'Bash', 'permission-retained', 'tool-retained')
+    const oldSession = (
+      adapter as unknown as {
+        sessions: Map<
+          string,
+          {
+            translator: { dispose: () => void } | null
+            prompts: {
+              find: (itemId: string) => { prompt: { settle: (value: unknown) => void } } | null
+            }
+          }
+        >
+      }
+    ).sessions.get('session-1')
+    expect(oldSession?.translator).not.toBeNull()
+    const disposeTranslator = vi.spyOn(oldSession!.translator!, 'dispose')
+    const pendingPrompt = oldSession?.prompts.find('permission-retained')
+    expect(pendingPrompt).not.toBeNull()
+    const settlePrompt = vi.spyOn(pendingPrompt!.prompt, 'settle')
+    first.handlers.onMessage?.({
+      type: 'assistant',
+      session_id: PROVIDER_SESSION_ID,
+      uuid: 'observed-retained-leaf'
+    })
+    first.close = vi
+      .fn<() => Promise<boolean>>()
+      .mockResolvedValueOnce(false)
+      .mockResolvedValueOnce(true) as unknown as (typeof first)['close']
+    first.handlers.onExit?.(new Error('crashed before replacement'))
+    await tick()
+
+    expect(oldPrompt.settled()).toBe(false)
+    expect(events.filter((event) => event.type === 'ended')).toEqual([])
+
+    const replacement = await adapter.acquire({
+      identity: {
+        ...identityFor(),
+        providerHandle: {
+          kind: 'claude',
+          sessionId: PROVIDER_SESSION_ID,
+          leafUuid: 'observed-retained-leaf'
+        }
+      },
+      fence: 8,
+      spawnToken: 'spawn-10',
+      events: journalSink
+    })
+
+    expect(disposeTranslator).toHaveBeenCalledOnce()
+    expect(settlePrompt).toHaveBeenCalledOnce()
+    expect(settlePrompt).toHaveBeenCalledWith(null)
+    expect(persistHandle).toHaveBeenCalledOnce()
+    expect(persistedHandles).toEqual([
+      {
+        sessionId: 'session-1',
+        providerSessionId: PROVIDER_SESSION_ID,
+        leafUuid: 'durable-retained-leaf',
+        fence: 7
+      }
+    ])
+    expect(readTranscriptLeaf).toHaveBeenCalledOnce()
+    expect(readTranscriptLeaf).toHaveBeenCalledWith({
+      providerSessionId: PROVIDER_SESSION_ID,
+      previousLeafUuid: 'observed-retained-leaf',
+      claudeConfigDir: '/accounts/claude'
+    })
+    expect(resolveLaunch).toHaveBeenNthCalledWith(2, {
+      identity: {
+        ...identityFor(),
+        providerHandle: {
+          kind: 'claude',
+          sessionId: PROVIDER_SESSION_ID,
+          leafUuid: 'durable-retained-leaf'
+        }
+      }
+    })
+    expect(oldPrompt.settled()).toBe(true)
+    expect(events.filter((event) => event.type === 'ended')).toEqual([
+      {
+        type: 'ended',
+        sessionId: 'session-1',
+        reason: 'crashed before replacement',
+        cause: 'unexpected-exit',
+        fence: 7,
+        acquisitionGeneration: firstAcquisition.acquisitionGeneration
+      }
+    ])
+    expect(replacement.link).toMatchObject({
+      handle: {
+        provider: 'claude',
+        sessionId: PROVIDER_SESSION_ID,
+        leafUuid: 'durable-retained-leaf'
+      },
+      origin: 'resumed',
+      mintedAtFence: 8
+    })
+    expect(claude.connections[1]?.launch.options).toMatchObject({
+      resume: PROVIDER_SESSION_ID,
+      resumeSessionAt: 'durable-retained-leaf'
+    })
+    expect(claude.connections).toHaveLength(2)
+  })
+})
diff --git a/src/main/claude/claude-structured-session-state.ts b/src/main/claude/claude-structured-session-state.ts
new file mode 100644
index 00000000000..1c0b1862913
--- /dev/null
+++ b/src/main/claude/claude-structured-session-state.ts
@@ -0,0 +1,286 @@
+import type { AgentSessionJournalIdentity } from '../../shared/agent-session-journal-types'
+import type { StructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
+import type {
+  ClaudeStreamJsonConnection,
+  openClaudeStreamJsonConnection
+} from './claude-stream-json-connection'
+import type { ClaudeStructuredLaunch } from './claude-structured-launch-resolution'
+import type { ClaudeJournalTranslator } from './claude-structured-journal-translation'
+import type { ClaudePendingPrompt, ClaudePromptRegistry } from './claude-structured-prompt-replies'
+import { cancelProcessAcquisition } from '../../shared/child-process/cancel-process-acquisition'
+import { randomUUID } from 'node:crypto'
+import type { AgentSessionBackgroundTaskState } from '../../shared/agent-session-wire'
+import type { ClaudeBackgroundTaskTracker } from './claude-background-task-tracker'
+
+export type ClaudeAuthDiagnostic = {
+  apiKeySourceConfigured: boolean
+  baseUrlConfigured: boolean
+  authTokenConfigured: boolean
+  apiKeyConfigured: boolean
+  settingSources: readonly string[]
+}
+
+export type ClaudeStructuredSessionEvent =
+  | {
+      type: 'message'
+      sessionId: string
+      message: Record<string, unknown>
+      /** Present only when this replay acknowledged Orca's in-flight dispatch. */
+      startsTurn?: true
+    }
+  | { type: 'provider-frame'; sessionId: string; kind: string; payload: unknown }
+  | { type: 'prompt'; sessionId: string; prompt: ClaudePendingPrompt }
+  | { type: 'prompt-cancelled'; sessionId: string; promptKey: string }
+  | { type: 'options'; sessionId: string; models: unknown[] }
+  | {
+      type: 'handle'
+      sessionId: string
+      providerSessionId: string
+      leafUuid: string | null
+      fence: number
+    }
+  | { type: 'auth-diagnostic'; sessionId: string; diagnostic: ClaudeAuthDiagnostic }
+  | {
+      type: 'ended'
+      sessionId: string
+      reason: string
+      /** Present for first-hand child exits so the host can fence recovery. */
+      cause?: 'unexpected-exit' | 'requested-close'
+      fence?: number
+      acquisitionGeneration?: string
+      settlementRetryRequired?: boolean
+    }
+
+export type ClaudeStructuredSessionAdapterDeps = {
+  resolveLaunch: (input: {
+    identity: AgentSessionJournalIdentity
+  }) => Promise<ClaudeStructuredLaunch>
+  onEvent?: (event: ClaudeStructuredSessionEvent) => void
+  onBackgroundTasksChanged?: (
+    sessionId: string,
+    state: AgentSessionBackgroundTaskState | null
+  ) => void
+  openConnection?: typeof openClaudeStreamJsonConnection
+  readProcessStartTime?: (pid: number) => Promise<number | null>
+  mintLinkId?: () => string
+  mintAcquisitionGeneration?: () => string
+  now?: () => number
+  requestTimeoutMs?: number
+  initTimeoutMs?: number
+  dispatchAckTimeoutMs?: number
+  persistHandle?: (input: {
+    sessionId: string
+    providerSessionId: string
+    leafUuid: string | null
+    fence: number
+  }) => Promise<void>
+  /** Read the durable transcript branch after a child has flushed its final rows. */
+  readTranscriptLeaf?: (input: {
+    providerSessionId: string
+    previousLeafUuid: string | null
+    /** Account-scoped Claude config root that owns this provider session. */
+    claudeConfigDir: string
+  }) => Promise<string | null>
+}
+
+export type ClaudeDispatchWaiter = {
+  resolve: (uuid: string | null) => void
+  timer: ReturnType<typeof setTimeout>
+  acceptsResult: boolean
+  /** Client uuid echoed by Claude so a replay is tied to its own dispatch. */
+  sentUuid: string
+  /** Sequence used to fence a late identity from a newer dispatch. */
+  dispatchSequence: number
+  /** Set when the provider replay settled this waiter before send returned. */
+  settledUuid?: string
+  /** The waiter timed out or its write failed, but its replay may still arrive. */
+  retired?: boolean
+  /** Bounded digest/summary for compatibility CLIs that mint UUIDs. */
+  replayContentKey: string
+}
+
+export type ClaudeSession = {
+  connection: ClaudeStreamJsonConnection
+  providerSessionId: string
+  /** Durable transcript files live under this account's `projects` directory. */
+  claudeConfigDir: string
+  leafUuid: string | null
+  fence: number
+  acquisitionGeneration: string
+  prompts: ClaudePromptRegistry
+  dispatchWaiters: ClaudeDispatchWaiter[]
+  /** Bounded identities for dispatches whose ack was unknown when they returned. */
+  retiredDispatchWaiters: ClaudeDispatchWaiter[]
+  /** Once a retired waiter is evicted, legacy content-only replay matching is unsafe. */
+  replayContentFallbackBlocked: boolean
+  options: Map<string, string>
+  reportedOptions: { model?: string; effort?: string }
+  /** `optionMutationSequence` when `reportedOptions.model` was last observed, so a
+   *  write still awaiting its first turn outranks the report it will replace. */
+  reportedModelMutation: number
+  /** Options whose recorded value the provider reported, not merely accepted. */
+  confirmedOptions: Set<string>
+  restoreSkippedOptions: Set<string>
+  /** CLI-advertised protocol capabilities from init; gates interrupt-receipt handling. */
+  capabilities: readonly string[]
+  /** Provider uuid of the most recently admitted turn, if one is active. */
+  activeTurnId?: string
+  backgroundTasks: ClaudeBackgroundTaskTracker
+  /** Monotonic fence advanced when a dispatch starts, including unresolved dispatches. */
+  dispatchSequence: number
+  /** Dispatch sequence that admitted activeTurnId. */
+  activeTurnSequence?: number
+  /** Fences overlapping option writes so a late completion cannot restore stale state. */
+  optionMutationSequence: number
+  /** Shared durable-close write; a failed write clears this for a retry. */
+  closePersistence?: Promise<void>
+  /** Shared full close/finalization operation; a failed operation clears this for a retry. */
+  closeFinalization?: Promise<boolean>
+  /** Set only after the durable close write succeeds, before lifecycle emission. */
+  closeFinalized?: boolean
+  /** Set once `ended` has been emitted, so a persistence retry cannot repeat it. */
+  closeEnded?: boolean
+  translator: ClaudeJournalTranslator | null
+  events: StructuredAgentSessionEventSink | undefined
+}
+
+export function mintClaudeAcquisitionGeneration(deps: ClaudeStructuredSessionAdapterDeps): string {
+  return deps.mintAcquisitionGeneration?.() ?? randomUUID()
+}
+
+/**
+ * The first-hand exit that removed a published session. Kept until the session
+ * is acquired again so acquisition cleanup that arrives after the exit finds
+ * what the ladder observed, not an absence it would otherwise report as proven.
+ */
+export type ClaudeSessionExit = {
+  connection: ClaudeStreamJsonConnection
+  /** Full session identity retained until its child tree is proven gone. */
+  session: ClaudeSession
+  error: Error
+  /** The exit path's first proof attempt; retries must observe this result. */
+  closePromise?: Promise<boolean>
+  /** Shared lifecycle settlement for concurrent proof retries. */
+  settlementPromise?: Promise<void>
+  /** The whole ladder-then-settle tail, retained so a barrier can await an exit
+   *  that is observed but not yet published. Never rejects. */
+  publication?: Promise<void>
+}
+
+export type ClaudeAcquisitionAttempt = {
+  connection: ClaudeStreamJsonConnection | null
+  prompts: ClaudePromptRegistry
+  buffered: (() => void)[]
+  published: boolean
+  cancelled: boolean
+  exitProven: boolean
+  finished: Promise<void>
+  finish: () => void
+}
+
+export function createClaudeAcquisitionAttempt(
+  prompts: ClaudePromptRegistry
+): ClaudeAcquisitionAttempt {
+  let finish = (): void => {}
+  const finished = new Promise<void>((resolve) => {
+    finish = resolve
+  })
+  return {
+    connection: null,
+    prompts,
+    buffered: [],
+    published: false,
+    cancelled: false,
+    exitProven: false,
+    finished,
+    finish
+  }
+}
+
+export class ClaudeAcquisitionRegistry {
+  private readonly attempts = new Map<string, ClaudeAcquisitionAttempt>()
+  private closing = false
+
+  get size(): number {
+    return this.attempts.size
+  }
+
+  start(
+    sessionId: string,
+    prompts: ClaudePromptRegistry
+  ): {
+    previous: ClaudeAcquisitionAttempt | undefined
+    attempt: ClaudeAcquisitionAttempt
+  } {
+    if (this.closing) {
+      throw new Error('claude structured session adapter is closing')
+    }
+    const previous = this.attempts.get(sessionId)
+    const attempt = createClaudeAcquisitionAttempt(prompts)
+    this.attempts.set(sessionId, attempt)
+    return { previous, attempt }
+  }
+
+  assertCurrent(sessionId: string, attempt: ClaudeAcquisitionAttempt): void {
+    if (this.closing || attempt.cancelled || this.attempts.get(sessionId) !== attempt) {
+      throw new Error(`claude session ${sessionId} was superseded while being acquired`)
+    }
+  }
+
+  get(sessionId: string): ClaudeAcquisitionAttempt | undefined {
+    return this.attempts.get(sessionId)
+  }
+
+  deleteIfCurrent(sessionId: string, attempt: ClaudeAcquisitionAttempt): void {
+    if (this.attempts.get(sessionId) === attempt) {
+      this.attempts.delete(sessionId)
+    }
+  }
+
+  restoreIfCurrent(
+    sessionId: string,
+    replacement: ClaudeAcquisitionAttempt,
+    previous: ClaudeAcquisitionAttempt
+  ): void {
+    if (this.attempts.get(sessionId) === replacement) {
+      this.attempts.set(sessionId, previous)
+    }
+  }
+
+  sessionIds(): IterableIterator<string> {
+    return this.attempts.keys()
+  }
+
+  close(): void {
+    this.closing = true
+  }
+}
+
+export async function cancelClaudeAcquisitionAttempt(
+  attempt: ClaudeAcquisitionAttempt | undefined
+): Promise<boolean> {
+  if (!attempt) {
+    return true
+  }
+  return cancelProcessAcquisition({
+    cancel: () => {
+      attempt.cancelled = true
+    },
+    connection: () => attempt.connection,
+    exitProven: () => attempt.exitProven,
+    finished: attempt.finished
+  })
+}
+
+/** What an acquisition hands back to the adapter that owns the session map:
+ *  event delivery ordered against publication, and the two exit settlements. */
+export type ClaudeAcquireCallbacks = {
+  deliver: (attempt: ClaudeAcquisitionAttempt, sessionId: string, event: () => void) => void
+  emit: (
+    session: ClaudeSession | null,
+    events: StructuredAgentSessionEventSink | undefined,
+    event: ClaudeStructuredSessionEvent
+  ) => void
+  handleExit: (sessionId: string, attempt: ClaudeAcquisitionAttempt, error: Error) => void
+  settleExit: (sessionId: string, exit: ClaudeSessionExit) => Promise<void>
+}
diff --git a/src/main/claude/claude-structured-session-test-support.ts b/src/main/claude/claude-structured-session-test-support.ts
new file mode 100644
index 00000000000..903cafae416
--- /dev/null
+++ b/src/main/claude/claude-structured-session-test-support.ts
@@ -0,0 +1,266 @@
+import type {
+  AgentJournalMessageItem,
+  AgentSessionJournalIdentity
+} from '../../shared/agent-session-journal-types'
+import type {
+  ClaudeStreamJsonConnection,
+  ClaudeStreamJsonConnectionHandlers,
+  ClaudeStreamJsonLaunch,
+  openClaudeStreamJsonConnection
+} from './claude-stream-json-connection'
+import {
+  ClaudeStructuredSessionAdapter,
+  type ClaudeStructuredSessionAdapterDeps,
+  type ClaudeStructuredLaunch,
+  type ClaudeStructuredSessionEvent
+} from './claude-structured-session-adapter'
+
+export const PROVIDER_SESSION_ID = '819cf9f8-e43c-4ad7-b50f-54aa158a726a'
+
+export const USER_MESSAGE: AgentJournalMessageItem = {
+  kind: 'message',
+  role: 'user',
+  blocks: [{ type: 'text', text: 'ship it' }]
+}
+
+export function identityFor(sessionId = 'session-1'): AgentSessionJournalIdentity {
+  return {
+    sessionId,
+    workspaceId: 'workspace-1',
+    hostId: 'host-1',
+    agent: 'claude',
+    providerHandle: { kind: 'claude', sessionId: PROVIDER_SESSION_ID, leafUuid: null }
+  }
+}
+
+type Route = (params: Record<string, unknown> | undefined) => unknown
+
+export type FakeConnection = Omit<ClaudeStreamJsonConnection, 'closed' | 'exitVerdict'> & {
+  closed: boolean
+  exitVerdict: ClaudeStreamJsonConnection['exitVerdict']
+  launch: ClaudeStreamJsonLaunch
+  handlers: ClaudeStreamJsonConnectionHandlers
+  calls: { subtype: string; params?: Record<string, unknown> }[]
+  sent: Record<string, unknown>[]
+  closeCount: number
+}
+
+export function fakeClaude(
+  options: {
+    initSessionId?: string
+    initUuid?: string
+    initModel?: string
+    initProof?: 'init' | 'session-start' | 'none'
+    initAccount?: unknown
+    exitBeforeInit?: string
+    settings?: unknown
+    replayUuid?: string | null
+    replayUuids?: (string | null)[]
+    capabilities?: string[]
+    unprovenCloseVerdict?: ClaudeStreamJsonConnection['exitVerdict']
+    routes?: Record<string, Route>
+  } = {}
+): {
+  connections: FakeConnection[]
+  openConnection: typeof openClaudeStreamJsonConnection
+  routes: Record<string, Route>
+} {
+  const connections: FakeConnection[] = []
+  const routes = options.routes ?? {}
+  let replayIndex = 0
+  const routed = (subtype: string, params?: Record<string, unknown>): unknown => {
+    const route = routes[subtype]
+    return route ? route(params) : undefined
+  }
+  const openConnection = (async (launch, handlers = {}) => {
+    const connection: FakeConnection = {
+      launch,
+      handlers,
+      calls: [],
+      sent: [],
+      closeCount: 0,
+      pid: 4321,
+      closed: false,
+      initializationResult: async () => {
+        connection.calls.push({ subtype: 'initialize' })
+        if (options.exitBeforeInit) {
+          handlers.onExit?.(new Error(options.exitBeforeInit))
+          return { models: [] }
+        }
+        if (options.initProof === 'session-start') {
+          handlers.onMessage?.({
+            type: 'system',
+            subtype: 'hook_started',
+            hook_name: 'SessionStart:startup',
+            session_id: options.initSessionId ?? PROVIDER_SESSION_ID,
+            uuid: options.initUuid ?? 'init-uuid'
+          })
+        } else if (options.initProof !== 'none') {
+          // Keys mirror the real system/init frame, which carries `model` but no
+          // effort of any kind: the current effort only comes back from
+          // get_settings. Never add a field the CLI does not send.
+          handlers.onMessage?.({
+            type: 'system',
+            subtype: 'init',
+            session_id: options.initSessionId ?? PROVIDER_SESSION_ID,
+            uuid: options.initUuid ?? 'init-uuid',
+            model: options.initModel ?? 'claude-sonnet-5',
+            apiKeySource: 'none',
+            ...(options.capabilities ? { capabilities: options.capabilities } : {})
+          })
+        }
+        return {
+          models: [{ value: 'claude-sonnet', displayName: 'Sonnet' }],
+          ...(options.initAccount === undefined ? {} : { account: options.initAccount })
+        }
+      },
+      getSettings: async () => {
+        connection.calls.push({ subtype: 'get_settings' })
+        // Shape measured from Claude Code 2.1.258: {applied, effective, sources},
+        // and the only place the session's current effort is reported.
+        return (
+          options.settings ?? {
+            applied: { model: 'claude-sonnet-5', effort: 'high', advisor: null, ultracode: false },
+            effective: { model: 'claude-sonnet-5', effortLevel: 'high', env: {} },
+            sources: {}
+          }
+        )
+      },
+      supportedModels: async () => {
+        connection.calls.push({ subtype: 'list_models' })
+        return (routed('list_models') as unknown[] | undefined) ?? []
+      },
+      setModel: async (model) => {
+        connection.calls.push({ subtype: 'set_model', params: { model } })
+        routed('set_model', { model })
+      },
+      setPermissionMode: async (mode) => {
+        connection.calls.push({ subtype: 'set_permission_mode', params: { mode } })
+        routed('set_permission_mode', { mode })
+      },
+      applyFlagSettings: async (settings) => {
+        connection.calls.push({ subtype: 'apply_flag_settings', params: { settings } })
+        routed('apply_flag_settings', { settings })
+      },
+      interrupt: async (interruptOptions) => {
+        connection.calls.push({
+          subtype: 'interrupt',
+          params: interruptOptions?.cancelQueued ? { cancelQueued: true } : {}
+        })
+        return routed('interrupt', interruptOptions) as
+          | Awaited<ReturnType<ClaudeStreamJsonConnection['interrupt']>>
+          | undefined
+      },
+      cancelAsyncMessage: async (uuid) => {
+        connection.calls.push({ subtype: 'cancel_async_message', params: { uuid } })
+        routed('cancel_async_message', { uuid })
+      },
+      stopTask: async (taskId) => {
+        connection.calls.push({ subtype: 'stop_task', params: { taskId } })
+        routed('stop_task', { taskId })
+      },
+      send: async (message) => {
+        connection.sent.push(message)
+        if (message.type === 'user' && options.replayUuid !== null) {
+          const configuredReplayUuid = options.replayUuids
+            ? options.replayUuids[replayIndex++]
+            : options.replayUuid
+          const replayUuid =
+            configuredReplayUuid === undefined ? `user-uuid-${replayIndex}` : configuredReplayUuid
+          if (replayUuid !== null) {
+            handlers.onMessage?.({
+              ...message,
+              uuid: replayUuid
+            })
+          }
+        }
+      },
+      exitVerdict: options.unprovenCloseVerdict ?? { root: 'live', tree: 'unverifiable' },
+      close: async () => {
+        connection.closeCount += 1
+        connection.closed = true
+        return options.unprovenCloseVerdict === undefined
+      }
+    }
+    connections.push(connection)
+    return connection
+  }) as typeof openClaudeStreamJsonConnection
+  return { connections, openConnection, routes }
+}
+
+export function adapterFor(
+  claude: ReturnType<typeof fakeClaude>,
+  launch: Partial<ClaudeStructuredLaunch> = {},
+  events: ClaudeStructuredSessionEvent[] = [],
+  persistedHandles: unknown[] = [],
+  initTimeoutMs?: number,
+  readTranscriptLeaf?: ClaudeStructuredSessionAdapterDeps['readTranscriptLeaf'],
+  persistHandle?: ClaudeStructuredSessionAdapterDeps['persistHandle'],
+  onBackgroundTasksChanged?: ClaudeStructuredSessionAdapterDeps['onBackgroundTasksChanged']
+): ClaudeStructuredSessionAdapter {
+  return new ClaudeStructuredSessionAdapter({
+    resolveLaunch: async () => ({
+      pathToClaudeCodeExecutable: 'claude',
+      options: {},
+      cwd: '/work/repo',
+      claudeConfigDir: '/accounts/claude',
+      providerSessionId: PROVIDER_SESSION_ID,
+      resumeLeafUuid: null,
+      resumed: false,
+      ...launch
+    }),
+    onEvent: (event) => events.push(event),
+    openConnection: claude.openConnection,
+    readProcessStartTime: async () => 1_700_000_000_000,
+    now: () => 1_700_000_000_500,
+    ...(initTimeoutMs === undefined ? {} : { initTimeoutMs }),
+    dispatchAckTimeoutMs: 10,
+    persistHandle:
+      persistHandle ??
+      (async (handle) => {
+        persistedHandles.push(handle)
+      }),
+    ...(onBackgroundTasksChanged ? { onBackgroundTasksChanged } : {}),
+    ...(readTranscriptLeaf ? { readTranscriptLeaf } : {})
+  })
+}
+
+export async function acquired(
+  claude: ReturnType<typeof fakeClaude>,
+  launch: Partial<ClaudeStructuredLaunch> = {},
+  events: ClaudeStructuredSessionEvent[] = []
+): Promise<ClaudeStructuredSessionAdapter> {
+  const adapter = adapterFor(claude, launch, events)
+  await adapter.acquire({ identity: identityFor(), fence: 7, spawnToken: 'spawn-9' })
+  return adapter
+}
+
+export function tick(): Promise<void> {
+  return new Promise((resolve) => setImmediate(resolve))
+}
+
+export function invokeCanUseTool(
+  connection: FakeConnection,
+  toolName: string,
+  requestId: string,
+  toolUseID: string,
+  extra: {
+    input?: Record<string, unknown>
+    suggestions?: unknown[]
+    signal?: AbortSignal
+  } = {}
+): { promise: Promise<unknown>; settled: () => boolean } {
+  const options = {
+    requestId,
+    toolUseID,
+    signal: extra.signal ?? new AbortController().signal,
+    ...(extra.suggestions ? { suggestions: extra.suggestions } : {})
+  } as unknown as Parameters<NonNullable<ClaudeStreamJsonConnectionHandlers['canUseTool']>>[2]
+  let done = false
+  const promise = Promise.resolve(
+    connection.handlers.canUseTool?.(toolName, extra.input ?? {}, options)
+  ).finally(() => {
+    done = true
+  })
+  return { promise, settled: () => done }
+}
diff --git a/src/main/claude/claude-transcript-branch-proof.ts b/src/main/claude/claude-transcript-branch-proof.ts
index d7065caa275..605f619eb92 100644
--- a/src/main/claude/claude-transcript-branch-proof.ts
+++ b/src/main/claude/claude-transcript-branch-proof.ts
@@ -5,6 +5,10 @@ const MAX_CLAUDE_TRANSCRIPT_ANCESTRY = 10_000
 type TranscriptNode = {
   parentUuid: string | null
   sessionId: string | null
+  /** First line where this UUID was observed in the append-only transcript. */
+  lineIndex: number
+  /** UUIDs from result/init/stream frames and sidechains are never leaves. */
+  disallowedLeaf: boolean
 }
 
 export type ClaudeTranscriptBranchProof = {
@@ -27,6 +31,54 @@ export class ClaudeTranscriptTailIncompleteError extends Error {
   }
 }
 
+/** The sampled cursor is no longer present, so a root proof may still recover safely. */
+export class ClaudeTranscriptPreviousCursorMissingError extends Error {
+  constructor() {
+    super(
+      'Claude transcript branch proof failed: previous cursor is missing from the session graph'
+    )
+    this.name = 'ClaudeTranscriptPreviousCursorMissingError'
+  }
+}
+
+function proveMainLineAncestry(
+  nodes: Map<string, TranscriptNode>,
+  startUuid: string,
+  providerSessionId: string
+): void {
+  const visited = new Set<string>()
+  let cursor: string | null = startUuid
+  for (let depth = 0; cursor !== null && depth < MAX_CLAUDE_TRANSCRIPT_ANCESTRY; depth += 1) {
+    if (visited.has(cursor)) {
+      throw transcriptError('cycle in parentUuid ancestry')
+    }
+    visited.add(cursor)
+    const node = nodes.get(cursor)
+    if (!node || node.sessionId !== providerSessionId) {
+      throw transcriptError(`missing ancestor ${cursor}`)
+    }
+    if (node.disallowedLeaf) {
+      throw transcriptError(`ancestor ${cursor} is not on the main transcript`)
+    }
+    cursor = node.parentUuid
+  }
+  if (cursor !== null) {
+    throw transcriptError('ancestry exceeds the bounded proof limit')
+  }
+}
+
+function proveAppendOrder(nodes: Map<string, TranscriptNode>): void {
+  for (const node of nodes.values()) {
+    if (!node.parentUuid) {
+      continue
+    }
+    const parent = nodes.get(node.parentUuid)
+    if (parent && parent.lineIndex >= node.lineIndex) {
+      throw transcriptError('parent row follows descendant')
+    }
+  }
+}
+
 export function proveClaudeTranscriptBranchFromJsonl(input: {
   contents: string
   providerSessionId: string
@@ -34,6 +86,7 @@ export function proveClaudeTranscriptBranchFromJsonl(input: {
 }): ClaudeTranscriptBranchProof {
   const nodes = new Map<string, TranscriptNode>()
   let leafUuid: string | null = null
+  let leafMarkerLineIndex = -1
   const lines = input.contents.split('\n')
   for (const [index, line] of lines.entries()) {
     if (!line.trim()) {
@@ -59,6 +112,7 @@ export function proveClaudeTranscriptBranchFromJsonl(input: {
         throw transcriptError('invalid last-prompt marker')
       }
       leafUuid = markerLeaf
+      leafMarkerLineIndex = index
     }
     const uuid = nonEmptyString(row.uuid)
     if (!uuid) {
@@ -70,27 +124,60 @@ export function proveClaudeTranscriptBranchFromJsonl(input: {
     }
     const sessionId = nonEmptyString(row.sessionId)
     const existing = nodes.get(uuid)
-    if (existing && (existing.parentUuid !== parentUuid || existing.sessionId !== sessionId)) {
+    const disallowedLeaf =
+      row.isSidechain === true ||
+      row.parent_tool_use_id != null ||
+      row.type === 'result' ||
+      row.type === 'stream_event' ||
+      (row.type === 'system' && row.subtype === 'init')
+    if (
+      existing &&
+      (existing.parentUuid !== parentUuid ||
+        existing.sessionId !== sessionId ||
+        existing.disallowedLeaf !== disallowedLeaf)
+    ) {
       throw transcriptError(`record ${uuid} has conflicting ancestry`)
     }
-    nodes.set(uuid, { parentUuid, sessionId })
+    nodes.set(uuid, {
+      parentUuid,
+      sessionId,
+      lineIndex: existing?.lineIndex ?? index,
+      disallowedLeaf
+    })
   }
   if (!leafUuid) {
     throw transcriptError('missing last-prompt marker')
   }
   const leaf = nodes.get(leafUuid)
-  if (!leaf || leaf.sessionId !== input.providerSessionId) {
+  if (!leaf || leaf.sessionId !== input.providerSessionId || leaf.disallowedLeaf) {
     throw transcriptError('marker leaf is missing from the session graph')
   }
+  if (leaf.lineIndex > leafMarkerLineIndex) {
+    throw transcriptError('marker precedes its leaf record')
+  }
   const previousLeafUuid = input.previousLeafUuid
   if (!previousLeafUuid) {
+    proveMainLineAncestry(nodes, leafUuid, input.providerSessionId)
+    // A branch proof is based on an append-only snapshot. A child that appears
+    // before its claimed parent is not a post-snapshot descendant observation;
+    // accepting that graph would turn reordered/torn rows into durable ancestry.
+    proveAppendOrder(nodes)
     return { leafUuid, relation: 'initial' }
   }
   const previous = nodes.get(previousLeafUuid)
-  if (!previous || previous.sessionId !== input.providerSessionId) {
-    throw transcriptError('previous cursor is missing from the session graph')
+  if (!previous) {
+    throw new ClaudeTranscriptPreviousCursorMissingError()
   }
+  if (previous.sessionId !== input.providerSessionId || previous.disallowedLeaf) {
+    throw transcriptError('previous cursor is not on the main transcript')
+  }
+  // The latest marker can be equal to, or descend from, a sampled cursor. In
+  // either case prove the sampled cursor's own ancestry before accepting it;
+  // otherwise a cursor that descended through a parent-tool-use sidechain
+  // could be persisted and resumed as if it were on the main transcript.
+  proveMainLineAncestry(nodes, previousLeafUuid, input.providerSessionId)
   if (leafUuid === previousLeafUuid) {
+    proveAppendOrder(nodes)
     return { leafUuid, relation: 'same' }
   }
   const visited = new Set<string>()
@@ -104,8 +191,12 @@ export function proveClaudeTranscriptBranchFromJsonl(input: {
     if (!node || node.sessionId !== input.providerSessionId) {
       throw transcriptError(`missing ancestor ${cursor}`)
     }
+    if (node.disallowedLeaf) {
+      throw transcriptError(`ancestor ${cursor} is not on the main transcript`)
+    }
     cursor = node.parentUuid
     if (cursor === previousLeafUuid) {
+      proveAppendOrder(nodes)
       return { leafUuid, relation: 'descendant' }
     }
   }
@@ -126,3 +217,37 @@ export async function proveClaudeTranscriptBranch(input: {
     previousLeafUuid: input.previousLeafUuid
   })
 }
+
+/** Re-run a durable branch proof from the transcript root when a sampled cursor is stale. */
+export async function readClaudeTranscriptLeafWithReproof(input: {
+  readTranscriptLeaf: (input: {
+    providerSessionId: string
+    previousLeafUuid: string | null
+    claudeConfigDir: string
+  }) => Promise<string | null>
+  claudeConfigDir: string
+  providerSessionId: string
+  previousLeafUuid: string | null
+}): Promise<string | null> {
+  try {
+    return await input.readTranscriptLeaf({
+      providerSessionId: input.providerSessionId,
+      previousLeafUuid: input.previousLeafUuid,
+      claudeConfigDir: input.claudeConfigDir
+    })
+  } catch (error) {
+    // A missing cursor can be stale after compaction and is safe to re-prove from the root. A torn
+    // tail is still being written; dropping the cursor would make a later sibling look admissible.
+    if (
+      input.previousLeafUuid === null ||
+      !(error instanceof ClaudeTranscriptPreviousCursorMissingError)
+    ) {
+      throw error
+    }
+    return input.readTranscriptLeaf({
+      providerSessionId: input.providerSessionId,
+      previousLeafUuid: null,
+      claudeConfigDir: input.claudeConfigDir
+    })
+  }
+}
diff --git a/src/main/claude/claude-tui-exit.test.ts b/src/main/claude/claude-tui-exit.test.ts
new file mode 100644
index 00000000000..6e1140b0f4d
--- /dev/null
+++ b/src/main/claude/claude-tui-exit.test.ts
@@ -0,0 +1,159 @@
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import {
+  completeClaudeTuiExit,
+  readClaudeTranscriptEntryUuid,
+  readClaudeTranscriptLeafUuid
+} from './claude-tui-exit'
+
+const roots: string[] = []
+
+afterEach(async () => {
+  await Promise.all(roots.splice(0).map((root) => rm(root, { recursive: true, force: true })))
+})
+
+describe('Claude TUI exit', () => {
+  it('does not sample UUIDs from subagent stdout frames with a parent tool use', () => {
+    expect(
+      readClaudeTranscriptEntryUuid({
+        type: 'assistant',
+        uuid: 'subagent-assistant',
+        parent_tool_use_id: 'parent-tool'
+      })
+    ).toBeNull()
+    expect(
+      readClaudeTranscriptEntryUuid({
+        type: 'assistant',
+        uuid: 'main-assistant',
+        parent_tool_use_id: null
+      })
+    ).toBe('main-assistant')
+  })
+
+  it('reads the authoritative last-prompt leaf from a transcript tail', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'orca-claude-tui-exit-'))
+    roots.push(root)
+    const transcriptPath = join(root, 'session.jsonl')
+    await writeFile(
+      transcriptPath,
+      [
+        { type: 'user', uuid: 'user-one' },
+        { type: 'assistant', uuid: 'assistant-one' },
+        { type: 'last-prompt', leafUuid: 'chain-head' },
+        { type: 'file-history-snapshot', snapshot: {} }
+      ]
+        .map((entry) => JSON.stringify(entry))
+        .join('\n')
+    )
+
+    await expect(readClaudeTranscriptLeafUuid(transcriptPath)).resolves.toBe('chain-head')
+  })
+
+  it('falls back to the last persisted message when last-prompt metadata is absent', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'orca-claude-tui-exit-'))
+    roots.push(root)
+    const transcriptPath = join(root, 'session.jsonl')
+    await writeFile(
+      transcriptPath,
+      [
+        { type: 'user', uuid: 'user-one' },
+        { type: 'assistant', uuid: 'assistant-one' },
+        { type: 'system', subtype: 'init', uuid: 'init-frame' },
+        { type: 'result', uuid: 'result-frame' },
+        { type: 'stream_event', uuid: 'stream-event-frame' }
+      ]
+        .map((entry) => JSON.stringify(entry))
+        .join('\n')
+    )
+
+    await expect(readClaudeTranscriptLeafUuid(transcriptPath)).resolves.toBe('assistant-one')
+  })
+
+  it('ignores sidechain messages when selecting a fallback transcript leaf', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'orca-claude-tui-sidechain-leaf-'))
+    const transcriptPath = join(root, 'session.jsonl')
+    await writeFile(
+      transcriptPath,
+      [
+        { type: 'assistant', uuid: 'main-assistant' },
+        { type: 'assistant', uuid: 'subagent-assistant', isSidechain: true },
+        { type: 'result', uuid: 'result-frame' }
+      ]
+        .map((entry) => JSON.stringify(entry))
+        .join('\n'),
+      'utf8'
+    )
+
+    await expect(readClaudeTranscriptLeafUuid(transcriptPath)).resolves.toBe('main-assistant')
+  })
+
+  it('persists the resumed chain head only after the exact Claude child exits', async () => {
+    let resolveExit!: (exit: {
+      pid: number
+      exitCode: number | null
+      signal: string | null
+    }) => void
+    const exitPromise = new Promise<{
+      pid: number
+      exitCode: number | null
+      signal: string | null
+    }>((resolve) => {
+      resolveExit = resolve
+    })
+    const persistHandle = vi.fn(async () => undefined)
+    const completion = completeClaudeTuiExit({
+      childPid: 4210,
+      waitForChildExit: () => exitPromise,
+      sessionId: 'provider-session',
+      transcriptPath: '/accounts/claude/session.jsonl',
+      fence: 7,
+      persistHandle,
+      readLeafUuid: async () => 'tui-leaf',
+      linkId: 'tui-resumed-link',
+      now: () => 12
+    })
+
+    expect(persistHandle).not.toHaveBeenCalled()
+    resolveExit({ pid: 4210, exitCode: 0, signal: null })
+
+    await expect(completion).resolves.toMatchObject({
+      link: {
+        linkId: 'tui-resumed-link',
+        handle: { provider: 'claude', sessionId: 'provider-session', leafUuid: 'tui-leaf' },
+        origin: 'resumed',
+        mintedAtFence: 7,
+        observedAt: 12
+      }
+    })
+    expect(persistHandle).toHaveBeenCalledTimes(1)
+  })
+
+  it('refuses another process exit and a missing transcript leaf', async () => {
+    const persistHandle = vi.fn(async () => undefined)
+    await expect(
+      completeClaudeTuiExit({
+        childPid: 4210,
+        waitForChildExit: async () => ({ pid: 4211, exitCode: 0, signal: null }),
+        sessionId: 'provider-session',
+        transcriptPath: '/session.jsonl',
+        fence: 2,
+        persistHandle,
+        readLeafUuid: async () => 'leaf'
+      })
+    ).rejects.toThrow(/did not belong to the Claude child/)
+    await expect(
+      completeClaudeTuiExit({
+        childPid: 4210,
+        waitForChildExit: async () => ({ pid: 4210, exitCode: 1, signal: null }),
+        sessionId: 'provider-session',
+        transcriptPath: '/session.jsonl',
+        fence: 2,
+        persistHandle,
+        readLeafUuid: async () => null
+      })
+    ).rejects.toThrow(/resumable transcript leaf/)
+    expect(persistHandle).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/claude/claude-tui-exit.ts b/src/main/claude/claude-tui-exit.ts
new file mode 100644
index 00000000000..3772e9c5e52
--- /dev/null
+++ b/src/main/claude/claude-tui-exit.ts
@@ -0,0 +1,119 @@
+import { open } from 'node:fs/promises'
+import type { AgentSessionProviderHandleLink } from '../../shared/agent-session-provider-handle'
+import { claudeProviderHandleLink } from './claude-structured-owner-identity'
+
+const TRANSCRIPT_TAIL_CHUNK_BYTES = 64 * 1024
+const TRANSCRIPT_TAIL_READ_LIMIT_BYTES = 4 * 1024 * 1024
+
+type TranscriptLeafCandidate = { leafUuid: string; authoritative: boolean }
+
+function validLeafUuid(value: unknown): string | null {
+  if (typeof value !== 'string' || value.length === 0 || value.length > 512) {
+    return null
+  }
+  const hasControlCharacter = [...value].some((character) => {
+    const code = character.codePointAt(0) ?? 0
+    return code <= 0x1f || code === 0x7f
+  })
+  return value === value.trim() && !hasControlCharacter ? value : null
+}
+
+export function readClaudeTranscriptEntryUuid(value: Record<string, unknown>): string | null {
+  return value.isSidechain === true ||
+    value.parent_tool_use_id != null ||
+    (value.type !== 'user' && value.type !== 'assistant')
+    ? null
+    : validLeafUuid(value.uuid)
+}
+
+function readLeafCandidate(line: string): TranscriptLeafCandidate | null {
+  try {
+    const value = JSON.parse(line) as Record<string, unknown>
+    const lastPromptLeaf = value.type === 'last-prompt' ? validLeafUuid(value.leafUuid) : null
+    if (lastPromptLeaf) {
+      return { leafUuid: lastPromptLeaf, authoritative: true }
+    }
+    const messageLeaf = readClaudeTranscriptEntryUuid(value)
+    return messageLeaf ? { leafUuid: messageLeaf, authoritative: false } : null
+  } catch {
+    return null
+  }
+}
+
+export async function readClaudeTranscriptLeafUuid(transcriptPath: string): Promise<string | null> {
+  const file = await open(transcriptPath, 'r')
+  try {
+    const { size } = await file.stat()
+    let position = size
+    let suffix = ''
+    let fallback: string | null = null
+    let scanned = 0
+    while (position > 0 && scanned < TRANSCRIPT_TAIL_READ_LIMIT_BYTES) {
+      const length = Math.min(TRANSCRIPT_TAIL_CHUNK_BYTES, position)
+      position -= length
+      scanned += length
+      const buffer = Buffer.alloc(length)
+      await file.read(buffer, 0, length, position)
+      const lines = `${buffer.toString('utf8')}${suffix}`.split(/\r?\n/)
+      suffix = position > 0 ? (lines.shift() ?? '') : ''
+      for (let index = lines.length - 1; index >= 0; index -= 1) {
+        const line = lines[index]?.trim()
+        if (!line) {
+          continue
+        }
+        const candidate = readLeafCandidate(line)
+        if (!candidate) {
+          continue
+        }
+        if (candidate.authoritative) {
+          return candidate.leafUuid
+        }
+        fallback ??= candidate.leafUuid
+      }
+    }
+    return fallback
+  } finally {
+    await file.close()
+  }
+}
+
+export type ClaudeTuiChildExit = {
+  pid: number
+  exitCode: number | null
+  signal: string | null
+}
+
+export async function completeClaudeTuiExit(input: {
+  childPid: number
+  waitForChildExit: () => Promise<ClaudeTuiChildExit>
+  sessionId: string
+  transcriptPath: string
+  fence: number
+  persistHandle: (link: AgentSessionProviderHandleLink) => Promise<void>
+  readLeafUuid?: (transcriptPath: string) => Promise<string | null>
+  linkId?: string
+  now?: () => number
+}): Promise<{
+  exit: ClaudeTuiChildExit
+  transcriptPath: string
+  link: AgentSessionProviderHandleLink
+}> {
+  const exit = await input.waitForChildExit()
+  if (exit.pid !== input.childPid) {
+    throw new Error('The observed process exit did not belong to the Claude child.')
+  }
+  const leafUuid = await (input.readLeafUuid ?? readClaudeTranscriptLeafUuid)(input.transcriptPath)
+  if (!leafUuid) {
+    throw new Error('The exited Claude TUI did not persist a resumable transcript leaf.')
+  }
+  const link = claudeProviderHandleLink({
+    sessionId: input.sessionId,
+    leafUuid,
+    resumed: true,
+    fence: input.fence,
+    ...(input.linkId ? { linkId: input.linkId } : {}),
+    observedAt: input.now?.() ?? Date.now()
+  })
+  await input.persistHandle(link)
+  return { exit, transcriptPath: input.transcriptPath, link }
+}
diff --git a/src/main/claude/claude-tui-resume-launch.test.ts b/src/main/claude/claude-tui-resume-launch.test.ts
new file mode 100644
index 00000000000..f907d1fcb4e
--- /dev/null
+++ b/src/main/claude/claude-tui-resume-launch.test.ts
@@ -0,0 +1,227 @@
+import { chmodSync, mkdtempSync, mkdirSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { delimiter, join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import type { AgentSessionRecord } from '../../shared/agent-session-record'
+import { CLAUDE_AUTH_ENV_CONFLICT_MESSAGE } from '../claude-accounts/environment'
+import { CLAUDE_DEFAULT_SETTING_SOURCES } from './claude-structured-launch-resolution'
+import { CLAUDE_SPAWN_TOKEN_ENV } from './claude-structured-owner-identity'
+import { createClaudeTuiResumeLaunchBuilder } from './claude-tui-resume-launch'
+
+function record(overrides: Partial<AgentSessionRecord> = {}): AgentSessionRecord {
+  return {
+    sessionId: 'orca-session-1',
+    provider: 'claude',
+    location: {
+      executionHostId: 'local',
+      wslDistro: null,
+      workspaceId: 'workspace-folder',
+      workspaceKind: 'folder'
+    },
+    accountHome: { variable: 'CLAUDE_CONFIG_DIR', path: '/accounts/claude-one' },
+    providerHandleChain: [
+      {
+        linkId: 'created',
+        handle: { provider: 'claude', sessionId: 'provider-session', leafUuid: 'leaf-one' },
+        origin: 'created',
+        mintedAtFence: 1,
+        observedAt: 1
+      }
+    ],
+    ...overrides
+  } as AgentSessionRecord
+}
+
+function makeExecutable(path: string): void {
+  mkdirSync(join(path, '..'), { recursive: true })
+  writeFileSync(path, '')
+  if (process.platform !== 'win32') {
+    chmodSync(path, 0o755)
+  }
+}
+
+describe('Claude TUI resume launch', () => {
+  it('pins the workspace, account home, setting sources, and launch identity', async () => {
+    const build = createClaudeTuiResumeLaunchBuilder({
+      resolveWorkspacePath: async (workspaceId) => `/workspaces/${workspaceId}`,
+      resolveCommand: () => '/usr/local/bin/claude',
+      resolveAuthPolicy: () => ({ stripAuthEnv: false }),
+      resolveEnv: () => ({
+        SELECTED_ACCOUNT: 'one',
+        ANTHROPIC_AUTH_TOKEN: 'selected-account-token'
+      }),
+      inheritedEnv: {
+        ANTHROPIC_API_KEY: 'inherited-gateway-key',
+        ANTHROPIC_BASE_URL: 'https://inherited-gateway.invalid',
+        CLAUDE_CODE_SESSION_ID: 'parent-session',
+        SAFE_PARENT: 'kept'
+      }
+    })
+
+    const launch = await build({ record: record(), spawnToken: 'spawn-one' })
+
+    expect(launch).toMatchObject({
+      command: '/usr/local/bin/claude',
+      args: [
+        '--setting-sources',
+        CLAUDE_DEFAULT_SETTING_SOURCES.join(','),
+        '--resume',
+        'provider-session'
+      ],
+      cwd: '/workspaces/workspace-folder',
+      providerSessionId: 'provider-session',
+      resumeLeafUuid: 'leaf-one'
+    })
+    expect(launch.env).toMatchObject({
+      SAFE_PARENT: 'kept',
+      SELECTED_ACCOUNT: 'one',
+      CLAUDE_CONFIG_DIR: '/accounts/claude-one',
+      ORCA_AGENT_LAUNCH_TOKEN: 'spawn-one',
+      [CLAUDE_SPAWN_TOKEN_ENV]: 'spawn-one',
+      ANTHROPIC_AUTH_TOKEN: 'selected-account-token'
+    })
+    // System auth (the only state an explicit ANTHROPIC_AUTH_TOKEN overlay is legal in):
+    // the user's own inherited key is their sign-in and survives. The managed-account
+    // half — where it is stripped — is covered by 'structured-to-TUI handoff auth'.
+    expect(launch.env.ANTHROPIC_API_KEY).toBe('inherited-gateway-key')
+    // Endpoint selection is not credential material; the existing adapter pinning preserves it.
+    expect(launch.env.ANTHROPIC_BASE_URL).toBe('https://inherited-gateway.invalid')
+    expect(launch.env.CLAUDE_CODE_SESSION_ID).toBeUndefined()
+  })
+
+  it('pairs the resumed Claude CLI with its sibling Node runtime', async () => {
+    const root = mkdtempSync(join(tmpdir(), 'orca-claude-resume-'))
+    const binDir = join(root, 'bin')
+    const claudeCommand = join(binDir, process.platform === 'win32' ? 'claude.cmd' : 'claude')
+    const nodeCommand = join(binDir, process.platform === 'win32' ? 'node.cmd' : 'node')
+    makeExecutable(claudeCommand)
+    makeExecutable(nodeCommand)
+
+    const build = createClaudeTuiResumeLaunchBuilder({
+      resolveWorkspacePath: async () => '/workspace',
+      resolveCommand: () => claudeCommand,
+      resolveAuthPolicy: () => ({ stripAuthEnv: true }),
+      resolveEnv: () => ({ PATH: '/usr/bin' }),
+      inheritedEnv: {}
+    })
+
+    const launch = await build({ record: record(), spawnToken: 'spawn' })
+
+    expect((launch.env.PATH ?? launch.env.Path)?.split(delimiter)[0]).toBe(binDir)
+  })
+
+  it('uses the durable session environment instead of current account settings', async () => {
+    const build = createClaudeTuiResumeLaunchBuilder({
+      resolveWorkspacePath: async () => '/workspace',
+      resolveCommand: () => 'claude',
+      resolveAuthPolicy: () => ({ stripAuthEnv: false }),
+      resolveEnv: () => ({ ANTHROPIC_AUTH_TOKEN: 'pinned-token' }),
+      inheritedEnv: {}
+    })
+
+    const launch = await build({ record: record(), spawnToken: 'spawn' })
+
+    expect(launch.env.ANTHROPIC_AUTH_TOKEN).toBe('pinned-token')
+  })
+
+  it('resolves the durable chain head instead of an earlier Claude leaf', async () => {
+    const nextRecord = record({
+      providerHandleChain: [
+        ...record().providerHandleChain,
+        {
+          linkId: 'resumed',
+          handle: { provider: 'claude', sessionId: 'provider-session', leafUuid: 'leaf-two' },
+          origin: 'resumed',
+          mintedAtFence: 2,
+          observedAt: 2
+        }
+      ]
+    })
+    const build = createClaudeTuiResumeLaunchBuilder({
+      resolveWorkspacePath: async () => '/workspace',
+      resolveCommand: () => 'claude',
+      resolveAuthPolicy: () => ({ stripAuthEnv: true }),
+      inheritedEnv: {}
+    })
+
+    await expect(build({ record: nextRecord, spawnToken: 'spawn-two' })).resolves.toMatchObject({
+      providerSessionId: 'provider-session',
+      resumeLeafUuid: 'leaf-two'
+    })
+  })
+
+  it('preserves durable Claude launch arguments before resume defaults', async () => {
+    const build = createClaudeTuiResumeLaunchBuilder({
+      resolveWorkspacePath: async () => '/workspace',
+      resolveCommand: () => 'claude',
+      resolveAuthPolicy: () => ({ stripAuthEnv: true }),
+      inheritedEnv: {}
+    })
+
+    const launch = await build({
+      record: record({ launchArgs: ['--model', 'claude-sonnet-4-5'] }),
+      spawnToken: 'spawn'
+    })
+
+    expect(launch.args.slice(0, 3)).toEqual(['--model', 'claude-sonnet-4-5', '--setting-sources'])
+  })
+
+  it('rejects missing Claude handles and unpinned account homes', async () => {
+    const build = createClaudeTuiResumeLaunchBuilder({
+      resolveWorkspacePath: async () => '/workspace',
+      resolveCommand: () => 'claude',
+      resolveAuthPolicy: () => ({ stripAuthEnv: true }),
+      inheritedEnv: {}
+    })
+
+    await expect(
+      build({ record: record({ providerHandleChain: [] }), spawnToken: 'spawn' })
+    ).rejects.toThrow('claude_tui_resume_handle_required')
+    await expect(
+      build({
+        record: record({ accountHome: { variable: 'CODEX_HOME', path: '/wrong' } }),
+        spawnToken: 'spawn'
+      })
+    ).rejects.toThrow(/CLAUDE_CONFIG_DIR/)
+  })
+})
+
+// buildClaudeChildProcessEnv strips its inherited half unconditionally, so this module
+// would have signed a system-auth user out of the session the structured path had just
+// honoured. It is not wired up yet; the required policy is what stops the next caller
+// from inheriting that.
+describe('structured-to-TUI handoff auth', () => {
+  it('carries a system-auth user their own inherited credential', async () => {
+    const launch = await createClaudeTuiResumeLaunchBuilder({
+      resolveWorkspacePath: async () => '/repos/workspace-1',
+      resolveCommand: () => '/usr/local/bin/claude',
+      resolveAuthPolicy: () => ({ stripAuthEnv: false }),
+      inheritedEnv: { ANTHROPIC_API_KEY: 'sk-ant-SHELL', PATH: '/usr/bin' }
+    })({ record: record(), spawnToken: 'token-1' })
+
+    expect(launch.env.ANTHROPIC_API_KEY).toBe('sk-ant-SHELL')
+  })
+
+  it('still strips it once a managed account owns the credential', async () => {
+    const launch = await createClaudeTuiResumeLaunchBuilder({
+      resolveWorkspacePath: async () => '/repos/workspace-1',
+      resolveCommand: () => '/usr/local/bin/claude',
+      resolveAuthPolicy: () => ({ stripAuthEnv: true }),
+      inheritedEnv: { ANTHROPIC_API_KEY: 'sk-ant-SHELL', PATH: '/usr/bin' }
+    })({ record: record(), spawnToken: 'token-1' })
+
+    expect(launch.env.ANTHROPIC_API_KEY).toBeUndefined()
+  })
+
+  it('refuses a configured override of a pinned managed account, as the terminal path does', async () => {
+    await expect(
+      createClaudeTuiResumeLaunchBuilder({
+        resolveWorkspacePath: async () => '/repos/workspace-1',
+        resolveCommand: () => '/usr/local/bin/claude',
+        resolveAuthPolicy: () => ({ stripAuthEnv: true }),
+        resolveEnv: () => ({ ANTHROPIC_API_KEY: 'sk-ant-CONFIGURED' }),
+        inheritedEnv: {}
+      })({ record: record(), spawnToken: 'token-1' })
+    ).rejects.toThrow(CLAUDE_AUTH_ENV_CONFLICT_MESSAGE)
+  })
+})
diff --git a/src/main/claude/claude-tui-resume-launch.ts b/src/main/claude/claude-tui-resume-launch.ts
new file mode 100644
index 00000000000..8c09335fd9d
--- /dev/null
+++ b/src/main/claude/claude-tui-resume-launch.ts
@@ -0,0 +1,101 @@
+import type { AgentSessionRecord } from '../../shared/agent-session-record'
+import { agentSessionProviderHandleChainHead } from '../../shared/agent-session-provider-handle'
+import { withCliRuntimeOnPath } from '../../shared/node-cli-command-resolution'
+import { resolveClaudeCommand } from '../codex-cli/command'
+import { getSpawnArgsForWindows } from '../win32-utils'
+import type { ClaudeStructuredAuthPolicy } from '../claude-accounts/claude-structured-auth-policy'
+import {
+  CLAUDE_AUTH_ENV_CONFLICT_MESSAGE,
+  claudeAuthEnvCarriedForward,
+  hasClaudeAuthEnvConflict
+} from '../claude-accounts/environment'
+import { buildClaudeChildProcessEnv } from './claude-child-process-environment'
+import { claudeConfigDirEnvPatch } from './claude-config-dir-pin'
+import { CLAUDE_DEFAULT_SETTING_SOURCES } from './claude-structured-launch-resolution'
+import { CLAUDE_SPAWN_TOKEN_ENV } from './claude-structured-owner-identity'
+
+export const CLAUDE_TUI_RESUME_BASE_ARGS = [
+  '--setting-sources',
+  CLAUDE_DEFAULT_SETTING_SOURCES.join(',')
+] as const
+
+export type ClaudeTuiResumeLaunch = {
+  command: string
+  args: string[]
+  cwd: string
+  env: Record<string, string>
+  providerSessionId: string
+  resumeLeafUuid: string | null
+}
+
+export type ClaudeTuiResumeLaunchBuilderDeps = {
+  resolveWorkspacePath: (workspaceId: string) => Promise<string>
+  resolveCommand?: () => string
+  resolveEnv?: () => Record<string, string>
+  inheritedEnv?: NodeJS.ProcessEnv
+  /**
+   * Required so whoever wires this module up has to answer the question rather than
+   * inherit the wrong default: buildClaudeChildProcessEnv strips its inherited half
+   * unconditionally, which would sign out a system-auth user whose own ANTHROPIC_*
+   * is their only credential. Build it with claudeStructuredAuthPolicyForSettings.
+   */
+  resolveAuthPolicy: () => Promise<ClaudeStructuredAuthPolicy> | ClaudeStructuredAuthPolicy
+}
+
+export function createClaudeTuiResumeLaunchBuilder(
+  deps: ClaudeTuiResumeLaunchBuilderDeps
+): (input: { record: AgentSessionRecord; spawnToken: string }) => Promise<ClaudeTuiResumeLaunch> {
+  return async ({ record, spawnToken }) => {
+    if (record.provider !== 'claude') {
+      throw new Error(`session ${record.sessionId} is a ${record.provider} session`)
+    }
+    if (record.accountHome.variable !== 'CLAUDE_CONFIG_DIR') {
+      throw new Error(`claude sessions pin CLAUDE_CONFIG_DIR, not ${record.accountHome.variable}`)
+    }
+    const head = agentSessionProviderHandleChainHead(record.providerHandleChain)
+    if (head?.handle.provider !== 'claude') {
+      throw new Error('claude_tui_resume_handle_required')
+    }
+
+    const command = (deps.resolveCommand ?? resolveClaudeCommand)()
+    const { spawnCmd, spawnArgs } = getSpawnArgsForWindows(command, [
+      ...(record.launchArgs ?? []),
+      ...CLAUDE_TUI_RESUME_BASE_ARGS,
+      '--resume',
+      head.handle.sessionId
+    ])
+    const auth = await deps.resolveAuthPolicy()
+    const configuredEnv = deps.resolveEnv?.() ?? {}
+    if (auth.stripAuthEnv && hasClaudeAuthEnvConflict(configuredEnv)) {
+      throw new Error(CLAUDE_AUTH_ENV_CONFLICT_MESSAGE)
+    }
+    // The inherited half is always stripped downstream, so a system-auth user's own
+    // credential only reaches the resumed TUI if it is carried in the configured half.
+    const carriedAuth = auth.stripAuthEnv
+      ? {}
+      : claudeAuthEnvCarriedForward(deps.inheritedEnv ?? process.env)
+    // Compared against what the child would otherwise inherit, so the record's account
+    // home still wins over a diverging overlay without a needless pin.
+    const inheritedEnv = { ...(deps.inheritedEnv ?? process.env), ...configuredEnv }
+    const env = buildClaudeChildProcessEnv(
+      {
+        ...carriedAuth,
+        ...configuredEnv,
+        ...claudeConfigDirEnvPatch(record.accountHome.path, { env: inheritedEnv }),
+        ORCA_AGENT_LAUNCH_TOKEN: spawnToken,
+        [CLAUDE_SPAWN_TOKEN_ENV]: spawnToken
+      },
+      { inheritedEnv: deps.inheritedEnv }
+    )
+    const pairedEnv = withCliRuntimeOnPath(command, env, { platform: process.platform })
+
+    return {
+      command: spawnCmd,
+      args: spawnArgs,
+      cwd: await deps.resolveWorkspacePath(record.location.workspaceId),
+      env: pairedEnv,
+      providerSessionId: head.handle.sessionId,
+      resumeLeafUuid: head.handle.leafUuid
+    }
+  }
+}
diff --git a/src/main/claude/claude-tui-resume-proof.test.ts b/src/main/claude/claude-tui-resume-proof.test.ts
new file mode 100644
index 00000000000..6d2e99d4b00
--- /dev/null
+++ b/src/main/claude/claude-tui-resume-proof.test.ts
@@ -0,0 +1,80 @@
+import { describe, expect, it } from 'vitest'
+import { proveClaudeTuiResume, readClaudeTuiSessionStartEvidence } from './claude-tui-resume-proof'
+
+const SESSION = '91deba8d-a398-4b69-a05d-35041536fe8e'
+const TRANSCRIPT = '/accounts/claude/projects/workspace/transcript.jsonl'
+
+function envelope(overrides: Record<string, unknown> = {}): Record<string, unknown> {
+  return {
+    launchToken: 'spawn-one',
+    payload: JSON.stringify({
+      hook_event_name: 'SessionStart',
+      source: 'resume',
+      session_id: SESSION,
+      transcript_path: TRANSCRIPT,
+      ...overrides
+    })
+  }
+}
+
+describe('Claude TUI resume proof', () => {
+  it('reads SessionStart identity from the hook envelope', () => {
+    expect(readClaudeTuiSessionStartEvidence(envelope())).toEqual({
+      hookEventName: 'SessionStart',
+      source: 'resume',
+      sessionId: SESSION,
+      transcriptPath: TRANSCRIPT,
+      launchToken: 'spawn-one'
+    })
+  })
+
+  it('proves the exact launched session and transcript without terminal output', async () => {
+    await expect(
+      proveClaudeTuiResume({
+        expectedSessionId: SESSION,
+        expectedTranscriptPath: TRANSCRIPT,
+        expectedLaunchToken: 'spawn-one',
+        waitForSessionStart: async () => envelope()
+      })
+    ).resolves.toMatchObject({ sessionId: SESSION, transcriptPath: TRANSCRIPT })
+  })
+
+  it.each([
+    ['source', { source: 'startup' }, /resume SessionStart/],
+    ['session', { session_id: 'other-session' }, /different Claude session/],
+    ['transcript', { transcript_path: '/other/transcript.jsonl' }, /different Claude transcript/]
+  ])('rejects a mismatched %s', async (_name, overrides, expected) => {
+    await expect(
+      proveClaudeTuiResume({
+        expectedSessionId: SESSION,
+        expectedTranscriptPath: TRANSCRIPT,
+        expectedLaunchToken: 'spawn-one',
+        waitForSessionStart: async () => envelope(overrides)
+      })
+    ).rejects.toThrow(expected)
+  })
+
+  it('rejects a SessionStart from another launched process', async () => {
+    await expect(
+      proveClaudeTuiResume({
+        expectedSessionId: SESSION,
+        expectedTranscriptPath: TRANSCRIPT,
+        expectedLaunchToken: 'spawn-two',
+        waitForSessionStart: async () => envelope()
+      })
+    ).rejects.toThrow(/different launched process/)
+  })
+
+  it('compares Windows paths using host path semantics', async () => {
+    await expect(
+      proveClaudeTuiResume({
+        expectedSessionId: SESSION,
+        expectedTranscriptPath: 'C:\\Users\\Dev\\session.jsonl',
+        expectedLaunchToken: 'spawn-one',
+        platform: 'win32',
+        waitForSessionStart: async () =>
+          envelope({ transcript_path: 'c:\\users\\dev\\session.jsonl' })
+      })
+    ).resolves.toMatchObject({ sessionId: SESSION })
+  })
+})
diff --git a/src/main/claude/claude-tui-resume-proof.ts b/src/main/claude/claude-tui-resume-proof.ts
new file mode 100644
index 00000000000..f352423116e
--- /dev/null
+++ b/src/main/claude/claude-tui-resume-proof.ts
@@ -0,0 +1,111 @@
+import { posix, win32 } from 'node:path'
+
+export type ClaudeTuiSessionStartEvidence = {
+  hookEventName: 'SessionStart'
+  source: 'resume'
+  sessionId: string
+  transcriptPath: string
+  launchToken: string
+}
+
+function record(value: unknown): Record<string, unknown> | null {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : null
+}
+
+function nonEmptyString(value: unknown): string | null {
+  return typeof value === 'string' && value.length > 0 ? value : null
+}
+
+function hookPayload(envelope: Record<string, unknown>): Record<string, unknown> | null {
+  if (typeof envelope.payload === 'string') {
+    try {
+      return record(JSON.parse(envelope.payload))
+    } catch {
+      return null
+    }
+  }
+  return record(envelope.payload) ?? envelope
+}
+
+export function readClaudeTuiSessionStartEvidence(
+  value: unknown
+): ClaudeTuiSessionStartEvidence | null {
+  const envelope = record(value)
+  if (!envelope) {
+    return null
+  }
+  const payload = hookPayload(envelope)
+  if (!payload) {
+    return null
+  }
+  const hookEventName = nonEmptyString(payload.hook_event_name ?? payload.hookEventName)
+  const source = nonEmptyString(payload.source)
+  const sessionId = nonEmptyString(payload.session_id ?? payload.sessionId)
+  const transcriptPath = nonEmptyString(payload.transcript_path ?? payload.transcriptPath)
+  const launchToken = nonEmptyString(envelope.launchToken ?? payload.launchToken)
+  return hookEventName === 'SessionStart' &&
+    source === 'resume' &&
+    sessionId &&
+    transcriptPath &&
+    launchToken
+    ? { hookEventName, source, sessionId, transcriptPath, launchToken }
+    : null
+}
+
+function comparablePath(value: string, platform: NodeJS.Platform): string | null {
+  if (value.includes('\0')) {
+    return null
+  }
+  const path = platform === 'win32' ? win32 : posix
+  if (!path.isAbsolute(value)) {
+    return null
+  }
+  const normalized = path.normalize(value)
+  return platform === 'win32' ? normalized.toLowerCase() : normalized
+}
+
+export async function proveClaudeTuiResume(input: {
+  expectedSessionId: string
+  expectedTranscriptPath: string
+  expectedLaunchToken: string
+  waitForSessionStart: () => Promise<unknown>
+  timeoutMs?: number
+  platform?: NodeJS.Platform
+}): Promise<ClaudeTuiSessionStartEvidence> {
+  const timeoutMs = input.timeoutMs ?? 15_000
+  let timer: ReturnType<typeof setTimeout> | undefined
+  try {
+    const evidence = readClaudeTuiSessionStartEvidence(
+      await Promise.race([
+        input.waitForSessionStart(),
+        new Promise<never>((_resolve, reject) => {
+          timer = setTimeout(
+            () => reject(new Error('The agent terminal did not prove the expected Claude resume.')),
+            timeoutMs
+          )
+          timer.unref?.()
+        })
+      ])
+    )
+    if (!evidence) {
+      throw new Error('The agent terminal did not emit a Claude resume SessionStart proof.')
+    }
+    if (evidence.launchToken !== input.expectedLaunchToken) {
+      throw new Error('The Claude resume proof came from a different launched process.')
+    }
+    if (evidence.sessionId !== input.expectedSessionId) {
+      throw new Error('The agent terminal resumed a different Claude session.')
+    }
+    const platform = input.platform ?? process.platform
+    const expectedPath = comparablePath(input.expectedTranscriptPath, platform)
+    const observedPath = comparablePath(evidence.transcriptPath, platform)
+    if (!expectedPath || !observedPath || observedPath !== expectedPath) {
+      throw new Error('The agent terminal resumed a different Claude transcript.')
+    }
+    return evidence
+  } finally {
+    clearTimeout(timer)
+  }
+}
diff --git a/src/main/claude/claude-tui-resume-real-binary.integration.test.ts b/src/main/claude/claude-tui-resume-real-binary.integration.test.ts
new file mode 100644
index 00000000000..9ba3daf2285
--- /dev/null
+++ b/src/main/claude/claude-tui-resume-real-binary.integration.test.ts
@@ -0,0 +1,279 @@
+import { spawnSync } from 'node:child_process'
+import { randomUUID } from 'node:crypto'
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { homedir, tmpdir } from 'node:os'
+import { join } from 'node:path'
+import * as pty from 'node-pty'
+import { afterEach, describe, expect, it } from 'vitest'
+import type { AgentSessionJournalIdentity } from '../../shared/agent-session-journal-types'
+import type { AgentSessionRecord } from '../../shared/agent-session-record'
+import { resolveClaudeCommand } from '../codex-cli/command'
+import { readStructuredTuiProcessIdentity } from '../runtime/structured-tui-process-identity'
+import { getSpawnArgsForWindows } from '../win32-utils'
+import { CLAUDE_STRUCTURED_BASE_OPTIONS } from './claude-structured-launch-resolution'
+import {
+  ClaudeStructuredSessionAdapter,
+  type ClaudeStructuredSessionEvent
+} from './claude-structured-session-adapter'
+import { createClaudeTuiResumeLaunchBuilder } from './claude-tui-resume-launch'
+import { proveClaudeTuiResume } from './claude-tui-resume-proof'
+
+const command = resolveClaudeCommand()
+const claudeAvailable =
+  spawnSync(command, ['--version'], { stdio: 'ignore', timeout: 5_000 }).status === 0
+const authStatusLaunch = getSpawnArgsForWindows(command, ['auth', 'status', '--json'])
+const claudeAuthenticated = (() => {
+  if (!claudeAvailable) {
+    return false
+  }
+  const result = spawnSync(authStatusLaunch.spawnCmd, authStatusLaunch.spawnArgs, {
+    encoding: 'utf8',
+    windowsHide: true,
+    timeout: 5_000
+  })
+  return result.status === 0 && /"loggedIn"\s*:\s*true/.test(result.stdout)
+})()
+const roots: string[] = []
+const transcripts: string[] = []
+
+function shellQuote(value: string): string {
+  return process.platform === 'win32'
+    ? `"${value.replace(/"/g, '""')}"`
+    : `'${value.replace(/'/g, `'"'"'`)}'`
+}
+
+async function installCaptureHook(
+  root: string
+): Promise<{ eventsPath: string; settingsPath: string }> {
+  const scriptPath = join(root, 'capture-session-start.cjs')
+  const eventsPath = join(root, 'session-start.jsonl')
+  const settingsPath = join(root, 'settings.json')
+  await writeFile(
+    scriptPath,
+    [
+      "const { appendFileSync } = require('node:fs')",
+      "let input = ''",
+      "process.stdin.setEncoding('utf8')",
+      "process.stdin.on('data', (chunk) => { input += chunk })",
+      "process.stdin.on('end', () => {",
+      '  const payload = JSON.parse(input)',
+      '  payload.launchToken = process.env.ORCA_AGENT_LAUNCH_TOKEN',
+      '  appendFileSync(process.argv[2], `${JSON.stringify(payload)}\\n`)',
+      '})',
+      ''
+    ].join('\n')
+  )
+  await writeFile(
+    settingsPath,
+    JSON.stringify({
+      theme: 'dark',
+      hooks: {
+        SessionStart: [
+          {
+            hooks: [
+              {
+                type: 'command',
+                command: [process.execPath, scriptPath, eventsPath].map(shellQuote).join(' ')
+              }
+            ]
+          }
+        ]
+      }
+    })
+  )
+  return { eventsPath, settingsPath }
+}
+
+async function waitForHook(
+  eventsPath: string,
+  source: 'startup' | 'resume'
+): Promise<Record<string, unknown>> {
+  const deadline = Date.now() + 15_000
+  while (Date.now() < deadline) {
+    const contents = await readFile(eventsPath, 'utf8').catch(() => '')
+    for (const line of contents.split(/\r?\n/)) {
+      if (!line.trim()) {
+        continue
+      }
+      const event = JSON.parse(line) as Record<string, unknown>
+      if (event.hook_event_name === 'SessionStart' && event.source === source) {
+        return event
+      }
+    }
+    await new Promise((resolve) => setTimeout(resolve, 50))
+  }
+  throw new Error(`Claude did not emit a ${source} SessionStart hook`)
+}
+
+type RunningTui = { proc: pty.IPty; exited: Promise<void> }
+
+function spawnResumeTui(args: string[], env: Record<string, string>): RunningTui {
+  const direct = process.platform === 'win32'
+  const proc = pty.spawn(
+    direct ? command : process.env.SHELL || '/bin/zsh',
+    direct ? args : ['-l'],
+    {
+      name: 'xterm-256color',
+      cols: 100,
+      rows: 30,
+      cwd: process.cwd(),
+      env: { ...env, TERM: 'xterm-256color' }
+    }
+  )
+  if (!direct) {
+    setTimeout(() => {
+      proc.write(`${[command, ...args].map(shellQuote).join(' ')}\r`)
+    }, 100).unref()
+  }
+  return { proc, exited: new Promise<void>((resolve) => proc.onExit(() => resolve())) }
+}
+
+function structuredIdentity(providerSessionId: string): AgentSessionJournalIdentity {
+  return {
+    sessionId: 'orca-real-claude-resume',
+    workspaceId: 'workspace-real',
+    hostId: 'local',
+    agent: 'claude',
+    providerHandle: { kind: 'claude', sessionId: providerSessionId, leafUuid: null }
+  }
+}
+
+async function waitForStructuredResult(events: ClaudeStructuredSessionEvent[]): Promise<void> {
+  const deadline = Date.now() + 30_000
+  while (Date.now() < deadline) {
+    if (events.some((event) => event.type === 'message' && event.message.type === 'result')) {
+      return
+    }
+    await new Promise((resolve) => setTimeout(resolve, 50))
+  }
+  throw new Error('Claude structured session did not finish its product-path turn')
+}
+
+async function stopTui(tui: RunningTui): Promise<void> {
+  try {
+    tui.proc.kill('SIGKILL')
+  } catch {
+    return
+  }
+  await Promise.race([
+    tui.exited,
+    new Promise<never>((_resolve, reject) =>
+      setTimeout(() => reject(new Error('Claude TUI did not exit after cleanup')), 5_000)
+    )
+  ])
+}
+
+afterEach(async () => {
+  await Promise.all(transcripts.splice(0).map((path) => rm(path, { force: true })))
+  await Promise.all(roots.splice(0).map((root) => rm(root, { recursive: true, force: true })))
+})
+
+describe.skipIf(!claudeAuthenticated)('real Claude TUI resume proof', () => {
+  it('resumes a product-created structured session and proves its exact child', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'orca-claude-tui-resume-'))
+    roots.push(root)
+    const { eventsPath, settingsPath } = await installCaptureHook(root)
+    const providerSessionId = randomUUID()
+    const claudeConfigDir = process.env.CLAUDE_CONFIG_DIR?.trim() || join(homedir(), '.claude')
+    const events: ClaudeStructuredSessionEvent[] = []
+    const adapter = new ClaudeStructuredSessionAdapter({
+      resolveLaunch: async () => ({
+        pathToClaudeCodeExecutable: command,
+        options: {
+          ...CLAUDE_STRUCTURED_BASE_OPTIONS,
+          extraArgs: { ...CLAUDE_STRUCTURED_BASE_OPTIONS.extraArgs, settings: settingsPath },
+          sessionId: providerSessionId
+        },
+        cwd: process.cwd(),
+        claudeConfigDir,
+        providerSessionId,
+        resumeLeafUuid: null,
+        resumed: false
+      }),
+      onEvent: (event) => events.push(event),
+      readProcessStartTime: async () => 1
+    })
+    let resumed: RunningTui | null = null
+    try {
+      const acquisition = await adapter.acquire({
+        identity: structuredIdentity(providerSessionId),
+        fence: 1,
+        spawnToken: 'real-create'
+      })
+      await expect(
+        adapter.dispatch({
+          sessionId: 'orca-real-claude-resume',
+          clientMessageId: 'real-product-turn',
+          fence: 1,
+          body: {
+            kind: 'message',
+            role: 'user',
+            blocks: [{ type: 'text', text: 'Reply only with ORCA_RESUME_READY.' }]
+          }
+        })
+      ).resolves.toMatchObject({ state: 'accepted' })
+      await waitForStructuredResult(events)
+      const started = await waitForHook(eventsPath, 'startup')
+      const transcriptPath = String(started.transcript_path)
+      transcripts.push(transcriptPath)
+      expect(started.session_id).toBe(providerSessionId)
+      await adapter.closeAll()
+
+      const record = {
+        sessionId: 'orca-real-claude-resume',
+        provider: 'claude',
+        location: { workspaceId: 'workspace-real' },
+        accountHome: { variable: 'CLAUDE_CONFIG_DIR', path: claudeConfigDir },
+        providerHandleChain: [
+          {
+            linkId: 'created-real',
+            handle: acquisition.link.handle,
+            origin: 'created',
+            mintedAtFence: 1,
+            observedAt: 1
+          }
+        ]
+      } as AgentSessionRecord
+      const launch = await createClaudeTuiResumeLaunchBuilder({
+        resolveWorkspacePath: async () => process.cwd(),
+        resolveCommand: () => command,
+        // The real binary authenticates from the developer's own environment here,
+        // which is the system-auth case: stripping it would sign the resume out.
+        resolveAuthPolicy: () => ({ stripAuthEnv: false })
+      })({ record, spawnToken: 'real-resume' })
+      resumed = spawnResumeTui([...launch.args, '--settings', settingsPath], launch.env)
+      let resumedOutput = ''
+      resumed.proc.onData((data) => {
+        resumedOutput = `${resumedOutput}${data}`.slice(-4_000)
+      })
+
+      const [processIdentity, proof] = await Promise.all([
+        readStructuredTuiProcessIdentity({
+          hostId: 'local',
+          rootPid: resumed.proc.pid,
+          spawnToken: 'real-resume',
+          agent: 'claude'
+        }),
+        proveClaudeTuiResume({
+          expectedSessionId: providerSessionId,
+          expectedTranscriptPath: transcriptPath,
+          expectedLaunchToken: 'real-resume',
+          waitForSessionStart: () => waitForHook(eventsPath, 'resume')
+        }).catch((error) => {
+          throw new Error(`${String(error)}\nClaude output: ${resumedOutput}`)
+        })
+      ])
+      expect(processIdentity).toMatchObject({
+        hostId: 'local',
+        spawnToken: 'real-resume',
+        pid: expect.any(Number)
+      })
+      expect(proof).toMatchObject({ sessionId: providerSessionId, transcriptPath })
+    } finally {
+      await adapter.closeAll()
+      if (resumed) {
+        await stopTui(resumed)
+      }
+    }
+  }, 30_000)
+})
diff --git a/src/main/claude/hook-service.test.ts b/src/main/claude/hook-service.test.ts
index e2937015bea..a4e48c98120 100644
--- a/src/main/claude/hook-service.test.ts
+++ b/src/main/claude/hook-service.test.ts
@@ -7,6 +7,7 @@ import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { vi, describe, expect, it } from 'vitest'
+import type * as GitBashModule from '../git-bash'
 
 vi.mock('electron', () => ({
   app: {
@@ -14,11 +15,23 @@ vi.mock('electron', () => ({
   }
 }))
 
+// Why: the installed hook shape depends on whether Git Bash is resolvable on the host, so the
+// install assertions below have to state which host they describe rather than inherit the box's.
+const { gitBashAvailableMock } = vi.hoisted(() => ({ gitBashAvailableMock: { value: true } }))
+vi.mock('../git-bash', async (importOriginal) => ({
+  ...(await importOriginal<typeof GitBashModule>()),
+  isGitBashAvailable: () => gitBashAvailableMock.value
+}))
+
 import type { SFTPWrapper } from 'ssh2'
-import { createManagedCommandMatcher } from '../agent-hooks/installer-utils'
+import { createManagedCommandMatcher, WINDOWS_CMD_SAFE_PATH } from '../agent-hooks/installer-utils'
 import { WINDOWS_HOOK_STDIN_DRAIN_LABEL } from '../agent-hooks/hook-stdin-contract'
 import { ClaudeHookService } from './hook-service'
-import { getWindowsManagedLifecycleHook, OPENCLAUDE_HOOK_SETTINGS } from './hook-settings'
+import {
+  CLAUDE_EVENTS,
+  getWindowsManagedLifecycleHook,
+  OPENCLAUDE_HOOK_SETTINGS
+} from './hook-settings'
 
 const CLAUDE_SCRIPT_FILE_NAME = process.platform === 'win32' ? 'claude-hook.cmd' : 'claude-hook.sh'
 const STATUSLINE_SCRIPT_FILE_NAME =
@@ -35,14 +48,29 @@ function hasManagedCommand(hook: TestHook, matcher: (command: string | undefined
 }
 
 describe('getWindowsManagedLifecycleHook', () => {
-  it('resolves the managed script from the runtime Windows profile, as a single command string', () => {
-    const scriptPath = 'C:\\Users\\%name%\\a^b&c\\.orca\\agent-hooks\\claude-hook.cmd'
-    const hook = getWindowsManagedLifecycleHook(scriptPath)
+  const SAFE_SCRIPT_PATH = 'C:\\Users\\alice\\.orca\\agent-hooks\\claude-hook.cmd'
+  const UNSAFE_SCRIPT_PATH = 'C:\\Users\\%name%\\a^b&c\\.orca\\agent-hooks\\claude-hook.cmd'
+
+  it('registers the script itself, with no interpreter in front of it (#18875)', () => {
+    // Why this is the whole point: the encoded launcher spent a PowerShell start-up per hook
+    // event (471ms vs 201ms measured) before the .cmd could reach its ORCA_PANE_KEY guard, and
+    // its orphan outlived the hook's timeout kill still holding the stdout the agent reads.
+    const hook = getWindowsManagedLifecycleHook(SAFE_SCRIPT_PATH, { gitBashAvailable: true })
+
+    expect(hook.args).toBeUndefined()
+    expect(hook.command).toBe('C:/Users/alice/.orca/agent-hooks/claude-hook.cmd || echo {}')
+    expect(hook.command).not.toMatch(/powershell|-EncodedCommand|conhost/i)
+    // Why: Git Bash/MSYS mangles backslash paths and rewrites slash-prefixed switches.
+    expect(hook.command).not.toMatch(/\\/)
+    expect(hook.command).not.toMatch(/ \/[a-zA-Z]+( |$)/)
+  })
+
+  it('falls back to the encoded launcher when the profile path is not cmd-safe', () => {
+    const hook = getWindowsManagedLifecycleHook(UNSAFE_SCRIPT_PATH, { gitBashAvailable: true })
 
     expect(hook.args).toBeUndefined()
     expect(hook.command).toMatch(/\/powershell\.exe -NoProfile -EncodedCommand /)
-    expect(hook.command).not.toContain(scriptPath)
-    // Why: Git Bash/MSYS mangles backslash paths and slash-prefixed switches.
+    expect(hook.command).not.toContain(UNSAFE_SCRIPT_PATH)
     expect(hook.command.replace(/-EncodedCommand \S+$/, '')).not.toMatch(/\\| \/[a-zA-Z]+( |$)/)
 
     const encoded = hook.command.match(/-EncodedCommand (\S+)$/)?.[1]
@@ -51,10 +79,21 @@ describe('getWindowsManagedLifecycleHook', () => {
     expect(decoded).toContain('.orca\\agent-hooks\\claude-hook.cmd')
   })
 
+  it('falls back to the encoded launcher when Git Bash is not resolvable', () => {
+    // Why: without Git Bash, Claude Code hosts the hook in PowerShell, and PowerShell 5.1
+    // rejects `||` as a statement separator (measured) — every event would be a parse error.
+    const hook = getWindowsManagedLifecycleHook(SAFE_SCRIPT_PATH, { gitBashAvailable: false })
+
+    expect(hook.command).toMatch(/\/powershell\.exe -NoProfile -EncodedCommand /)
+  })
+
   it('is still recognized as managed by createManagedCommandMatcher (#14825)', () => {
-    const scriptPath = 'C:\\Users\\alice\\.orca\\agent-hooks\\claude-hook.cmd'
-    const hook = getWindowsManagedLifecycleHook(scriptPath)
-    expect(isClaudeManagedCommand(hook.command)).toBe(true)
+    for (const hook of [
+      getWindowsManagedLifecycleHook(SAFE_SCRIPT_PATH, { gitBashAvailable: true }),
+      getWindowsManagedLifecycleHook(SAFE_SCRIPT_PATH, { gitBashAvailable: false })
+    ]) {
+      expect(isClaudeManagedCommand(hook.command)).toBe(true)
+    }
   })
 })
 
@@ -200,7 +239,13 @@ describe('ClaudeHookService.install', () => {
       const managedHook = legacyHooks.find((hook: TestHook) =>
         hasManagedCommand(hook, isClaudeManagedCommand)
       )
-      expect(JSON.stringify(managedHook)).not.toContain(tmpHome.replaceAll('\\', '/'))
+      // Why: POSIX resolves the profile at runtime (`${HOME-}`, STA-3348). Windows cannot —
+      // no single token expands in both Git Bash and cmd.exe — so it registers the absolute
+      // path, as Codex/Grok/Devin/Antigravity already do (#18875). A moved profile is caught
+      // by getStatus's exact match and rewritten, and `|| echo {}` keeps a stale entry neutral.
+      if (process.platform !== 'win32') {
+        expect(JSON.stringify(managedHook)).not.toContain(tmpHome.replaceAll('\\', '/'))
+      }
       expect(
         legacyHooks.some((hook: TestHook) => hasManagedCommand(hook, isClaudeManagedCommand))
       ).toBe(true)
@@ -365,7 +410,7 @@ describe('ClaudeHookService.install', () => {
   })
 
   it.skipIf(process.platform !== 'win32')(
-    'runs portable managed hooks through a single headless command string',
+    'pins the encoded-launcher fallback for a profile path the shells cannot carry bare',
     () => {
       const tmpHome = mkdtempSync(join(tmpdir(), 'orca claude home with spaces '))
       vi.stubEnv('HOME', tmpHome)
@@ -397,6 +442,137 @@ describe('ClaudeHookService.install', () => {
     }
   )
 
+  it.skipIf(process.platform !== 'win32')(
+    'installs the bare script path on every event when the profile path is cmd-safe (#18875)',
+    () => {
+      const tmpHome = mkdtempSync(join(tmpdir(), 'orca-claude-direct-'))
+      vi.stubEnv('HOME', tmpHome)
+      vi.stubEnv('USERPROFILE', tmpHome)
+      const scriptPath = join(tmpHome, '.orca', 'agent-hooks', CLAUDE_SCRIPT_FILE_NAME)
+      // Why: a runner whose tmpdir carries a space (a profile-scoped TEMP) belongs to the
+      // fallback case above, not this one; skip rather than assert the wrong contract.
+      if (!WINDOWS_CMD_SAFE_PATH.test(scriptPath)) {
+        vi.unstubAllEnvs()
+        rmSync(tmpHome, { recursive: true, force: true })
+        return
+      }
+      try {
+        expect(new ClaudeHookService().install().state).toBe('installed')
+
+        const settings = JSON.parse(
+          readFileSync(join(tmpHome, '.claude', 'settings.json'), 'utf-8')
+        ) as { hooks: Record<string, { hooks: TestHook[] }[]> }
+
+        const expected = `${scriptPath.replaceAll('\\', '/')} || echo {}`
+        for (const { eventName } of CLAUDE_EVENTS) {
+          const hook = settings.hooks[eventName]?.[0]?.hooks?.[0]
+          expect(hook?.args, eventName).toBeUndefined()
+          expect(hook?.command, eventName).toBe(expected)
+        }
+        // Why: the whole point of #18875 — no interpreter is started to reach the script.
+        expect(JSON.stringify(settings.hooks)).not.toMatch(/powershell|EncodedCommand/i)
+        expect(new ClaudeHookService().getStatus().state).toBe('installed')
+      } finally {
+        vi.unstubAllEnvs()
+        rmSync(tmpHome, { recursive: true, force: true })
+      }
+    }
+  )
+
+  it.skipIf(process.platform !== 'win32')(
+    'sweeps a previously installed encoded launcher on reinstall, keeping user hooks',
+    () => {
+      const tmpHome = mkdtempSync(join(tmpdir(), 'orca-claude-migrate-'))
+      vi.stubEnv('HOME', tmpHome)
+      vi.stubEnv('USERPROFILE', tmpHome)
+      const scriptPath = join(tmpHome, '.orca', 'agent-hooks', CLAUDE_SCRIPT_FILE_NAME)
+      if (!WINDOWS_CMD_SAFE_PATH.test(scriptPath)) {
+        vi.unstubAllEnvs()
+        rmSync(tmpHome, { recursive: true, force: true })
+        return
+      }
+      try {
+        const settingsPath = join(tmpHome, '.claude', 'settings.json')
+        mkdirSync(join(tmpHome, '.claude'), { recursive: true })
+        const stale = getWindowsManagedLifecycleHook(scriptPath, { gitBashAvailable: false })
+        writeFileSync(
+          settingsPath,
+          JSON.stringify({
+            hooks: {
+              Stop: [{ hooks: [stale] }],
+              PreToolUse: [{ matcher: '*', hooks: [stale] }],
+              UserPromptSubmit: [{ hooks: [{ type: 'command', command: 'echo mine' }] }]
+            }
+          }),
+          'utf-8'
+        )
+
+        expect(new ClaudeHookService().install().state).toBe('installed')
+
+        const settings = JSON.parse(readFileSync(settingsPath, 'utf-8')) as {
+          hooks: Record<string, { hooks: TestHook[] }[]>
+        }
+        expect(JSON.stringify(settings.hooks)).not.toContain('-EncodedCommand')
+        expect(
+          settings.hooks.UserPromptSubmit.some((definition) =>
+            definition.hooks.some((hook) => hook.command === 'echo mine')
+          )
+        ).toBe(true)
+      } finally {
+        vi.unstubAllEnvs()
+        rmSync(tmpHome, { recursive: true, force: true })
+      }
+    }
+  )
+
+  it.skipIf(process.platform !== 'win32')(
+    'reports a stale absolute path as not_installed and rewrites it on install (#18875)',
+    () => {
+      // Why: the direct shape bakes the profile path in, where the encoded launcher resolved
+      // %USERPROFILE% at run time (STA-3348). That is only safe because a moved profile is
+      // caught here and rewritten, so this is the test that carries the replaced contract.
+      const tmpHome = mkdtempSync(join(tmpdir(), 'orca-claude-moved-'))
+      vi.stubEnv('HOME', tmpHome)
+      vi.stubEnv('USERPROFILE', tmpHome)
+      const scriptPath = join(tmpHome, '.orca', 'agent-hooks', CLAUDE_SCRIPT_FILE_NAME)
+      if (!WINDOWS_CMD_SAFE_PATH.test(scriptPath)) {
+        vi.unstubAllEnvs()
+        rmSync(tmpHome, { recursive: true, force: true })
+        return
+      }
+      try {
+        const settingsPath = join(tmpHome, '.claude', 'settings.json')
+        mkdirSync(join(tmpHome, '.claude'), { recursive: true })
+        const staleCommand = 'C:/Users/someone-else/.orca/agent-hooks/claude-hook.cmd || echo {}'
+        const stale = { type: 'command', command: staleCommand, timeout: 10 }
+        writeFileSync(
+          settingsPath,
+          JSON.stringify({
+            hooks: Object.fromEntries(
+              CLAUDE_EVENTS.map(({ eventName }) => [eventName, [{ hooks: [stale] }]])
+            )
+          }),
+          'utf-8'
+        )
+
+        expect(new ClaudeHookService().getStatus().state).toBe('not_installed')
+        expect(new ClaudeHookService().install().state).toBe('installed')
+
+        const settings = JSON.parse(readFileSync(settingsPath, 'utf-8')) as {
+          hooks: Record<string, { hooks: TestHook[] }[]>
+        }
+        expect(JSON.stringify(settings.hooks)).not.toContain('someone-else')
+        expect(settings.hooks.PreToolUse[0].hooks[0].command).toBe(
+          `${scriptPath.replaceAll('\\', '/')} || echo {}`
+        )
+        expect(new ClaudeHookService().getStatus().state).toBe('installed')
+      } finally {
+        vi.unstubAllEnvs()
+        rmSync(tmpHome, { recursive: true, force: true })
+      }
+    }
+  )
+
   it.skipIf(process.platform !== 'win32')(
     'posts from the managed .cmd via curl.exe, not a second PowerShell',
     () => {
diff --git a/src/main/claude/hook-settings.ts b/src/main/claude/hook-settings.ts
index c6cf3a9b53c..047fcbb26b6 100644
--- a/src/main/claude/hook-settings.ts
+++ b/src/main/claude/hook-settings.ts
@@ -14,23 +14,25 @@ import {
   type HooksConfig
 } from '../agent-hooks/installer-utils'
 import { wrapRuntimeHomeHookCommand } from '../agent-hooks/runtime-home-hook-command'
+import { wrapWindowsDirectCmdHookCommand } from '../agent-hooks/windows-direct-cmd-hook-command'
+import { isGitBashAvailable } from '../git-bash'
 
 export type ClaudeCompatibleHookSettings = {
   configDirName: '.claude' | '.openclaude'
   scriptBaseName: 'claude-hook' | 'openclaude-hook'
-  usesWindowsPowerShellLauncher: boolean
+  usesWindowsCompatLauncher: boolean
 }
 
 export const CLAUDE_HOOK_SETTINGS: ClaudeCompatibleHookSettings = {
   configDirName: '.claude',
   scriptBaseName: 'claude-hook',
-  usesWindowsPowerShellLauncher: true
+  usesWindowsCompatLauncher: true
 }
 
 export const OPENCLAUDE_HOOK_SETTINGS: ClaudeCompatibleHookSettings = {
   configDirName: '.openclaude',
   scriptBaseName: 'openclaude-hook',
-  usesWindowsPowerShellLauncher: false
+  usesWindowsCompatLauncher: false
 }
 
 export const CLAUDE_EVENTS = [
@@ -153,16 +155,31 @@ export function getManagedCommand(
 
 export function getManagedLifecycleHook(
   scriptPath: string,
-  settings = CLAUDE_HOOK_SETTINGS
+  settings = CLAUDE_HOOK_SETTINGS,
+  options: WindowsManagedLifecycleHookOptions = {}
 ): HookCommandConfig {
-  if (process.platform !== 'win32' || !settings.usesWindowsPowerShellLauncher) {
+  if (process.platform !== 'win32' || !settings.usesWindowsCompatLauncher) {
     return buildManagedCommandHook(getManagedCommand(scriptPath, { neutralJsonWhenMissing: true }))
   }
-  return getWindowsManagedLifecycleHook(scriptPath)
+  return getWindowsManagedLifecycleHook(scriptPath, options)
 }
 
+export type WindowsManagedLifecycleHookOptions = { gitBashAvailable?: boolean }
+
 // Why: some Claude-compatible consumers ignore `args`, so the invocation must be self-contained.
-export function getWindowsManagedLifecycleHook(scriptPath: string): HookCommandConfig {
+export function getWindowsManagedLifecycleHook(
+  scriptPath: string,
+  options: WindowsManagedLifecycleHookOptions = {}
+): HookCommandConfig {
+  // Why (#18875): the encoded launcher cost a PowerShell start-up per hook event. Take the direct
+  // path only where the host can parse `||` — Git Bash can, Windows PowerShell 5.1 cannot.
+  const directCommand =
+    (options.gitBashAvailable ?? isGitBashAvailable())
+      ? wrapWindowsDirectCmdHookCommand(scriptPath)
+      : null
+  if (directCommand) {
+    return { type: 'command', command: directCommand, timeout: MANAGED_HOOK_TIMEOUT_SECONDS }
+  }
   const scriptFileName = win32.basename(scriptPath)
   // Why: runtime profile resolution keeps the managed entry portable across users (STA-3348).
   const quotedRelativePath = quotePowerShellString(`.orca\\agent-hooks\\${scriptFileName}`)
diff --git a/src/main/codex/codex-app-server-process-teardown.test.ts b/src/main/codex/codex-app-server-process-teardown.test.ts
index 1ddb672a531..cec8f91d081 100644
--- a/src/main/codex/codex-app-server-process-teardown.test.ts
+++ b/src/main/codex/codex-app-server-process-teardown.test.ts
@@ -1,7 +1,14 @@
 import type { ChildProcess } from 'node:child_process'
-import { describe, expect, it, vi } from 'vitest'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  findSelfInitiatedTreeKills,
+  resetSelfInitiatedTreeKillLogForTest
+} from '../crash-reporting/self-initiated-tree-kill-log'
 import { terminateCodexAppServerProcessTree } from './codex-app-server-process-teardown'
 
+/** Above pid_max on every supported POSIX host, so the group signal is a real ESRCH. */
+const UNREACHABLE_PGID = 2_147_483_647
+
 function child() {
   return {
     pid: 1234,
@@ -10,6 +17,10 @@ function child() {
 }
 
 describe('terminateCodexAppServerProcessTree', () => {
+  beforeEach(() => {
+    resetSelfInitiatedTreeKillLogForTest()
+  })
+
   it('waits for the Windows tree kill before releasing the wrapper', async () => {
     const target = child()
     const release = Promise.withResolvers<void>()
@@ -120,6 +131,55 @@ describe('terminateCodexAppServerProcessTree', () => {
     expect(target.kill).not.toHaveBeenCalled()
   })
 
+  /**
+   * `selfInitiatedTreeKillCount` decides whether a `render-process-gone` was
+   * ours. A group that had already exited was killed by nobody, so crediting it
+   * puts a suspect in the five-second window that Orca never issued. Exercised
+   * through the real `process.kill(-pgid)` because the swallow being tested
+   * lives in the production default, not in an injectable seam.
+   */
+  it('does not claim a snapshot group that was already gone', async () => {
+    const target = { pid: UNREACHABLE_PGID, kill: vi.fn(() => true) as ChildProcess['kill'] }
+
+    await expect(
+      terminateCodexAppServerProcessTree(target, undefined, {
+        platform: 'darwin',
+        captureDescendants: async () => ({
+          rootPgid: UNREACHABLE_PGID,
+          descendants: [],
+          capturedAtMs: 1
+        }),
+        terminateDescendants: async () => true
+      })
+    ).resolves.toBe(true)
+
+    expect(target.kill).toHaveBeenLastCalledWith('SIGKILL')
+    expect(findSelfInitiatedTreeKills(Date.now())).toEqual([])
+  })
+
+  it('claims a snapshot group the signal actually reached', async () => {
+    const target = child()
+    const signalProcessGroup = vi.fn()
+
+    await expect(
+      terminateCodexAppServerProcessTree(target, undefined, {
+        platform: 'darwin',
+        captureDescendants: async () => ({ rootPgid: 1234, descendants: [], capturedAtMs: 1 }),
+        terminateDescendants: async () => true,
+        signalProcessGroup
+      })
+    ).resolves.toBe(true)
+
+    expect(signalProcessGroup).toHaveBeenCalledWith(1234, 'SIGKILL')
+    expect(findSelfInitiatedTreeKills(Date.now())).toEqual([
+      expect.objectContaining({
+        pid: 1234,
+        site: 'codex-app-server-teardown',
+        scope: 'posix-process-group'
+      })
+    ])
+  })
+
   it('tears down 40 dedicated groups without process-table scans or cross-group fanout', async () => {
     const killMocks = Array.from({ length: 40 }, () => vi.fn(() => true))
     const targets = killMocks.map((kill, index) => ({
diff --git a/src/main/codex/codex-app-server-process-teardown.ts b/src/main/codex/codex-app-server-process-teardown.ts
index a35ad4d3164..5a9c6e3574b 100644
--- a/src/main/codex/codex-app-server-process-teardown.ts
+++ b/src/main/codex/codex-app-server-process-teardown.ts
@@ -128,19 +128,24 @@ async function terminatePosixTree(
   if (descendantsExited && snapshot.rootPgid === rootPid) {
     const signalGroup =
       deps.signalProcessGroup ??
-      ((pgid: number, signal: NodeJS.Signals) => {
-        try {
-          process.kill(-pgid, signal)
-        } catch {
-          // Group already exited.
-        }
+      ((pgid: number, signal: NodeJS.Signals) => process.kill(-pgid, signal))
+    let groupSignalled = false
+    try {
+      signalGroup(snapshot.rootPgid, 'SIGKILL')
+      groupSignalled = true
+    } catch {
+      // Already-gone is still the desired outcome, but nothing here killed it,
+      // and a crumb for a kill we never landed is a false render-process-gone suspect.
+    }
+    if (groupSignalled) {
+      // Outside the try, as in terminateDedicatedPosixGroup: that catch is the
+      // already-gone contract, not a breadcrumb handler.
+      recordSelfInitiatedTreeKill({
+        pid: snapshot.rootPgid,
+        site: 'codex-app-server-teardown',
+        scope: 'posix-process-group'
       })
-    signalGroup(snapshot.rootPgid, 'SIGKILL')
-    recordSelfInitiatedTreeKill({
-      pid: snapshot.rootPgid,
-      site: 'codex-app-server-teardown',
-      scope: 'posix-process-group'
-    })
+    }
   }
   if (!descendantsExited) {
     child.kill('SIGCONT')
diff --git a/src/main/codex/codex-app-server-session.ts b/src/main/codex/codex-app-server-session.ts
index d1ac17fc6cc..cef7f40c66b 100644
--- a/src/main/codex/codex-app-server-session.ts
+++ b/src/main/codex/codex-app-server-session.ts
@@ -3,6 +3,7 @@ import { waitForProcessExitUntil } from './codex-process-exit-deadline'
 import { stderrIndicatesMissingAppServer } from './codex-app-server-capability-signal'
 import { withCliRuntimeOnPath } from '../../shared/node-cli-command-resolution'
 import { createCodexAppServerRecordReader } from './codex-app-server-record-reader'
+import { admitProcessTreeKill } from '../../shared/child-process/process-tree-kill-gate'
 
 // Why: `codex app-server` is Orca's sanctioned RPC surface into Codex-owned
 // state (hook trust hashes, the sqlite thread index). This module owns the
@@ -74,6 +75,18 @@ export function killCodexAppServerProcessTree(
   const platform = options.platform ?? process.platform
   const spawnImpl = options.spawnImpl ?? spawn
   if (platform === 'win32' && child.pid) {
+    if (
+      !admitProcessTreeKill({
+        pid: child.pid,
+        site: 'codex-app-server-session-deadline',
+        scope: 'win-taskkill-tree'
+      })
+    ) {
+      // Refusal blocks the tree walk, not the termination: the root kill is
+      // handle-addressed, so it cannot reach the recycled pid we refused.
+      child.kill('SIGKILL')
+      return
+    }
     try {
       // Why: npm-installed Codex runs behind cmd.exe; killing only that wrapper
       // leaves the app-server child alive after a timeout or failed shutdown.
diff --git a/src/main/codex/codex-command-action-class.ts b/src/main/codex/codex-command-action-class.ts
new file mode 100644
index 00000000000..81360691ef9
--- /dev/null
+++ b/src/main/codex/codex-command-action-class.ts
@@ -0,0 +1,71 @@
+import { readRecord, readString } from './codex-item-field-readers'
+import type { CodexThreadItem } from './codex-thread-item-identity'
+
+/**
+ * Codex's own classification of a shell call: the tool name to show, and the
+ * fields worth lifting into `input` for the shared label helper (a file target,
+ * a search term, a scanned root). A `Map`, not an object — an object index
+ * answers `__proto__` with a truthy non-string. Every other action type stays an
+ * unclassified `shell` row.
+ *
+ * Nothing is invented for a field Codex sends as null: a stand-in path is a
+ * claim about a target, and the label helper turns any path into a file link.
+ */
+type CommandActionClass = {
+  name: string
+  /** Action field to the `input` key it lifts to. A scan root and a listed
+   *  directory lift to `directory`, never `path`: the label helper reads `path`
+   *  as a file target, which mobile turns into a tappable open-file link. */
+  keys: Readonly<Record<string, string>>
+}
+
+const COMMAND_ACTION_CLASSES = new Map<string, CommandActionClass>([
+  ['read', { name: 'read', keys: { path: 'path' } }],
+  ['search', { name: 'search', keys: { query: 'query', path: 'directory' } }],
+  ['listFiles', { name: 'list', keys: { path: 'directory' } }]
+])
+
+/** The one class every classified `commandActions` entry agrees on, with the
+ *  fields they all agree on; null leaves the row exactly as a Codex that sends no
+ *  classification renders it. `cat a.txt && ls src` classifies as two different
+ *  things, and naming that row after either would drop the other, so it stays a
+ *  `shell` row that shows the whole command. */
+export function commandActionFacts(
+  item: CodexThreadItem
+): { name: string; fields: Record<string, string> } | null {
+  const actions = item.commandActions
+  if (!Array.isArray(actions)) {
+    return null
+  }
+  let matched: { class: CommandActionClass; fields: Record<string, string> } | null = null
+  for (const action of actions) {
+    const record = readRecord(action)
+    const type = readString(record, 'type')
+    const classified = type === null ? undefined : COMMAND_ACTION_CLASSES.get(type)
+    if (classified === undefined) {
+      continue
+    }
+    if (matched === null) {
+      const fields: Record<string, string> = {}
+      for (const [source, lifted] of Object.entries(classified.keys)) {
+        const value = readString(record, source)
+        if (value !== null) {
+          fields[lifted] = value
+        }
+      }
+      matched = { class: classified, fields }
+      continue
+    }
+    if (matched.class.name !== classified.name) {
+      return null
+    }
+    // The same class twice keeps the class, but only a target both entries name.
+    for (const [source, lifted] of Object.entries(matched.class.keys)) {
+      const kept = matched.fields[lifted]
+      if (kept !== undefined && readString(record, source) !== kept) {
+        delete matched.fields[lifted]
+      }
+    }
+  }
+  return matched === null ? null : { name: matched.class.name, fields: matched.fields }
+}
diff --git a/src/main/codex/codex-item-field-readers.ts b/src/main/codex/codex-item-field-readers.ts
new file mode 100644
index 00000000000..bbe2551615a
--- /dev/null
+++ b/src/main/codex/codex-item-field-readers.ts
@@ -0,0 +1,45 @@
+// Field readers for the loosely-typed records Codex sends on thread items.
+
+export function readRecord(value: unknown): Record<string, unknown> {
+  return typeof value === 'object' && value !== null ? (value as Record<string, unknown>) : {}
+}
+
+export function readString(source: Record<string, unknown>, key: string): string | null {
+  const value = source[key]
+  return typeof value === 'string' && value.length > 0 ? value : null
+}
+
+export function readFirstString(
+  source: Record<string, unknown>,
+  keys: readonly string[]
+): string | null {
+  for (const key of keys) {
+    const value = readString(source, key)
+    if (value !== null) {
+      return value
+    }
+  }
+  return null
+}
+
+export function readTextContent(source: Record<string, unknown>, key: string): string | null {
+  const direct = readString(source, key)
+  if (direct) {
+    return direct
+  }
+  const value = source[key]
+  if (!Array.isArray(value)) {
+    return null
+  }
+  const parts = value.flatMap((part) => {
+    if (typeof part === 'string') {
+      return part.length > 0 ? [part] : []
+    }
+    if (typeof part !== 'object' || part === null) {
+      return []
+    }
+    const text = readString(part as Record<string, unknown>, 'text')
+    return text ? [text] : []
+  })
+  return parts.length > 0 ? parts.join('\n') : null
+}
diff --git a/src/main/codex/codex-prompt-registry-bounds.ts b/src/main/codex/codex-prompt-registry-bounds.ts
index 84b3cda6151..e5f79fe3a31 100644
--- a/src/main/codex/codex-prompt-registry-bounds.ts
+++ b/src/main/codex/codex-prompt-registry-bounds.ts
@@ -20,10 +20,7 @@ export function codexJournalPromptIdPart(value: string): string {
   }
   const suffix = `#${digestPayload(value).slice(0, 32)}`
   const bounded = boundPayload(value, {
-    inlineHeadBytes: CODEX_JOURNAL_PROMPT_ID_COMPONENT_MAX_BYTES - suffix.length,
-    maxSessionBytes: Number.MAX_SAFE_INTEGER,
-    maxAppendsPerWindow: Number.MAX_SAFE_INTEGER,
-    appendWindowMs: Number.MAX_SAFE_INTEGER
+    inlineHeadBytes: CODEX_JOURNAL_PROMPT_ID_COMPONENT_MAX_BYTES - suffix.length
   })
   return `${bounded.head}${suffix}`
 }
diff --git a/src/main/codex/codex-structured-item-stream-bounds.ts b/src/main/codex/codex-structured-item-stream-bounds.ts
index e84d8dd2efa..572c954b010 100644
--- a/src/main/codex/codex-structured-item-stream-bounds.ts
+++ b/src/main/codex/codex-structured-item-stream-bounds.ts
@@ -17,14 +17,8 @@ export function codexStructuredItemKey(threadId: string, itemId: string): string
   return `${key.slice(0, 960)}:${(hash >>> 0).toString(16)}`
 }
 
-export function pendingPatchBytes(pending: {
-  body: unknown
-  blobs: readonly { payload: string }[]
-}): number {
-  return (
-    Buffer.byteLength(JSON.stringify(pending.body), 'utf8') +
-    pending.blobs.reduce((total, blob) => total + Buffer.byteLength(blob.payload, 'utf8'), 0)
-  )
+export function pendingPatchBytes(pending: { body: unknown }): number {
+  return Buffer.byteLength(JSON.stringify(pending.body), 'utf8')
 }
 
 export function boundStreamItem(item: Record<string, unknown>): Record<string, unknown> {
diff --git a/src/main/codex/codex-structured-item-stream-contracts.ts b/src/main/codex/codex-structured-item-stream-contracts.ts
index cf8aff5795d..f252d048210 100644
--- a/src/main/codex/codex-structured-item-stream-contracts.ts
+++ b/src/main/codex/codex-structured-item-stream-contracts.ts
@@ -24,7 +24,6 @@ export type CodexItemStreamState = {
 export type CodexPendingItemPatch = {
   identity: AgentJournalItemIdentity
   body: NonNullable<ReturnType<typeof codexJournalItem>['body']>
-  blobs: ReturnType<typeof codexJournalItem>['blobs']
 }
 
 export type CodexStructuredItemStreamAdmission =
diff --git a/src/main/codex/codex-structured-item-streams.ts b/src/main/codex/codex-structured-item-streams.ts
index dda5e9688bd..a765f8339da 100644
--- a/src/main/codex/codex-structured-item-streams.ts
+++ b/src/main/codex/codex-structured-item-streams.ts
@@ -103,8 +103,8 @@ export function createCodexStructuredItemStreams(
     }
     const options = { coalescingKey: `checkpoint:${agentJournalItemKey(state.identity)}` }
     const admission = deps.sink.tryAppendItem
-      ? deps.sink.tryAppendItem(state.identity, translated.body, translated.blobs, options)
-      : (deps.sink.appendItem(state.identity, translated.body, translated.blobs, options),
+      ? deps.sink.tryAppendItem(state.identity, translated.body, options)
+      : (deps.sink.appendItem(state.identity, translated.body, options),
         { accepted: true as const })
     if (!admission.accepted) {
       return false
@@ -167,9 +167,8 @@ export function createCodexStructuredItemStreams(
     }
     for (const [key, pending] of pendingPatches) {
       const admission = deps.sink.tryAppendItem
-        ? deps.sink.tryAppendItem(pending.identity, pending.body, pending.blobs)
-        : (deps.sink.appendItem(pending.identity, pending.body, pending.blobs),
-          { accepted: true as const })
+        ? deps.sink.tryAppendItem(pending.identity, pending.body)
+        : (deps.sink.appendItem(pending.identity, pending.body), { accepted: true as const })
       if (!admission.accepted) {
         flushed = false
         continue
@@ -193,9 +192,8 @@ export function createCodexStructuredItemStreams(
       return { accepted: true }
     }
     const admission = deps.sink.tryAppendItem
-      ? deps.sink.tryAppendItem(pending.identity, pending.body, pending.blobs)
-      : (deps.sink.appendItem(pending.identity, pending.body, pending.blobs),
-        { accepted: true as const })
+      ? deps.sink.tryAppendItem(pending.identity, pending.body)
+      : (deps.sink.appendItem(pending.identity, pending.body), { accepted: true as const })
     if (!admission.accepted) {
       return admission
     }
@@ -237,8 +235,7 @@ export function createCodexStructuredItemStreams(
         if (translated.body) {
           const nextPending: CodexPendingItemPatch = {
             identity: state.identity,
-            body: translated.body,
-            blobs: translated.blobs
+            body: translated.body
           }
           const previous = pendingPatches.get(key)
           const previousBytes = previous ? pendingPatchBytes(previous) : 0
diff --git a/src/main/codex/codex-structured-item-translation.test.ts b/src/main/codex/codex-structured-item-translation.test.ts
index 63c3d59b0b9..2558f4b60de 100644
--- a/src/main/codex/codex-structured-item-translation.test.ts
+++ b/src/main/codex/codex-structured-item-translation.test.ts
@@ -1,5 +1,10 @@
 import { describe, expect, it } from 'vitest'
 import { agentJournalItemKey } from '../../shared/agent-session-journal-item-key'
+import {
+  briefToolArg,
+  createToolInputDisplay,
+  describeToolInput
+} from '../../shared/native-chat-tool-summary'
 import {
   codexItemBody,
   codexItemIdentity,
@@ -13,6 +18,13 @@ import {
   type CodexThreadItem
 } from './codex-structured-item-translation'
 
+/** The tool-call input a Codex item lands on, which is what the row label and
+ *  the collapsed run header are both derived from. */
+function toolCallInput(item: CodexThreadItem): unknown {
+  const body = codexItemBody(item)
+  return body !== null && body.kind === 'tool-call' ? body.input : null
+}
+
 const THREAD_ID = 'thread-abc'
 const TURN_ID = 'turn-1'
 
@@ -195,6 +207,279 @@ describe('codex item bodies', () => {
     })
   })
 
+  it('names a classified read command by its class and keeps the raw command', () => {
+    const body = codexItemBody({
+      type: 'commandExecution',
+      id: 'item-read',
+      command: "sed -n '1,200p' notes.txt",
+      cwd: '/repo',
+      status: 'completed',
+      exitCode: 0,
+      commandActions: [
+        {
+          type: 'read',
+          command: "sed -n '1,200p' notes.txt",
+          name: 'notes.txt',
+          path: '/repo/notes.txt'
+        }
+      ]
+    })
+
+    expect(body).toEqual({
+      kind: 'tool-call',
+      name: 'read',
+      // `name` is the target's basename, which `path` already carries and no
+      // label ever reads, so it stays out of the bounded journal payload.
+      input: { command: "sed -n '1,200p' notes.txt", cwd: '/repo', path: '/repo/notes.txt' },
+      state: 'completed'
+    })
+    // `read` is the one class that keeps `path`, so its row stays a tappable
+    // file on mobile — the other half of the rule `list`/`search` obey below.
+    const display = createToolInputDisplay(body?.kind === 'tool-call' ? body.input : null)
+    expect(display.filePath).toBe('/repo/notes.txt')
+    expect(display.label).toBe('/repo/notes.txt')
+  })
+
+  it('carries a classified search query so the row labels by term, not scan root', () => {
+    expect(
+      codexItemBody({
+        type: 'commandExecution',
+        id: 'item-search',
+        command: 'rg -n --no-heading beta .',
+        cwd: '/repo',
+        status: 'inProgress',
+        commandActions: [
+          { type: 'search', command: 'rg -n --no-heading beta .', query: 'beta', path: '.' }
+        ]
+      })
+    ).toEqual({
+      kind: 'tool-call',
+      name: 'search',
+      input: { command: 'rg -n --no-heading beta .', cwd: '/repo', query: 'beta', directory: '.' },
+      state: 'running'
+    })
+  })
+
+  it('omits a null classified field rather than standing it in as a target', () => {
+    expect(
+      codexItemBody({
+        type: 'commandExecution',
+        id: 'item-search-bare',
+        command: 'rg beta',
+        cwd: '/repo',
+        status: 'completed',
+        exitCode: 0,
+        commandActions: [{ type: 'search', command: 'rg beta', query: null, path: null }]
+      })
+    ).toEqual({
+      kind: 'tool-call',
+      name: 'search',
+      input: { command: 'rg beta', cwd: '/repo' },
+      state: 'completed'
+    })
+  })
+
+  it('names a classified listFiles command `list` and invents no target for a null path', () => {
+    const body = codexItemBody({
+      type: 'commandExecution',
+      id: 'item-list',
+      command: 'ls',
+      cwd: '/repo',
+      status: 'completed',
+      exitCode: 0,
+      commandActions: [{ type: 'listFiles', command: 'ls', path: null }]
+    })
+
+    expect(body).toEqual({
+      kind: 'tool-call',
+      name: 'list',
+      input: { command: 'ls', cwd: '/repo' },
+      state: 'completed'
+    })
+    // A stand-in `.` reaches mobile as a tappable "open file" link onto a
+    // directory, which can only fail. The raw command is the honest label.
+    const display = createToolInputDisplay(body?.kind === 'tool-call' ? body.input : null)
+    expect(display.filePath).toBeNull()
+    expect(display.label).toBe('ls')
+  })
+
+  it('keeps the shell row when one command did two different classified things', () => {
+    // `cat a.txt && ls src` classifies as a read and a listing; naming the row
+    // after either drops the other.
+    expect(
+      codexItemBody({
+        type: 'commandExecution',
+        id: 'item-mixed',
+        command: 'cat a.txt && ls src',
+        cwd: '/repo',
+        status: 'completed',
+        exitCode: 0,
+        commandActions: [
+          { type: 'read', command: 'cat a.txt', name: 'a.txt', path: 'a.txt' },
+          { type: 'listFiles', command: 'ls src', path: 'src' }
+        ]
+      })
+    ).toEqual({
+      kind: 'tool-call',
+      name: 'shell',
+      input: { command: 'cat a.txt && ls src', cwd: '/repo' },
+      state: 'completed'
+    })
+  })
+
+  it('keeps one class run twice, naming no target when the two disagree', () => {
+    expect(
+      codexItemBody({
+        type: 'commandExecution',
+        id: 'item-two-reads',
+        command: 'cat a.ts && cat b.ts',
+        cwd: '/repo',
+        status: 'completed',
+        exitCode: 0,
+        commandActions: [
+          { type: 'read', command: 'cat a.ts', path: 'a.ts' },
+          { type: 'read', command: 'cat b.ts', path: 'b.ts' }
+        ]
+      })
+    ).toEqual({
+      kind: 'tool-call',
+      name: 'read',
+      input: { command: 'cat a.ts && cat b.ts', cwd: '/repo' },
+      state: 'completed'
+    })
+  })
+
+  it('keeps a target both entries of one class name', () => {
+    expect(
+      codexItemBody({
+        type: 'commandExecution',
+        id: 'item-same-read',
+        command: 'head a.ts && tail a.ts',
+        cwd: '/repo',
+        status: 'completed',
+        exitCode: 0,
+        commandActions: [
+          { type: 'read', command: 'head a.ts', path: 'a.ts' },
+          { type: 'read', command: 'tail a.ts', path: 'a.ts' }
+        ]
+      })
+    ).toMatchObject({ name: 'read', input: { path: 'a.ts' } })
+  })
+
+  it('keeps the listed directory as a label, never as a file target', () => {
+    const body = codexItemBody({
+      type: 'commandExecution',
+      id: 'item-list-path',
+      command: 'ls src',
+      cwd: '/repo',
+      status: 'completed',
+      exitCode: 0,
+      commandActions: [{ type: 'listFiles', command: 'ls src', path: 'src' }]
+    })
+
+    expect(body).toMatchObject({ name: 'list', input: { directory: 'src' } })
+    // Under `path` this reaches mobile as a tappable open-file link onto a
+    // directory — the same dead link a stand-in `.` would have produced.
+    const display = createToolInputDisplay(body?.kind === 'tool-call' ? body.input : null)
+    expect(display.filePath).toBeNull()
+    expect(display.label).toBe('src')
+  })
+
+  it('keeps a scan root off the file-target key even when the search has no term', () => {
+    const body = codexItemBody({
+      type: 'commandExecution',
+      id: 'item-search-root',
+      command: 'rg --files src',
+      cwd: '/repo',
+      status: 'completed',
+      exitCode: 0,
+      commandActions: [{ type: 'search', command: 'rg --files src', query: null, path: 'src' }]
+    })
+
+    expect(body).toMatchObject({ name: 'search', input: { directory: 'src' } })
+    // `path` is only excluded from the file target while a query is present, so
+    // a term-less search under it would link to the folder it scanned.
+    expect(
+      createToolInputDisplay(body?.kind === 'tool-call' ? body.input : null).filePath
+    ).toBeNull()
+  })
+
+  it('leaves the other classes without a stand-in target', () => {
+    expect(
+      codexItemBody({
+        type: 'commandExecution',
+        id: 'item-read-null',
+        command: 'cat',
+        cwd: '/repo',
+        status: 'completed',
+        exitCode: 0,
+        commandActions: [{ type: 'read', command: 'cat', path: null, name: null }]
+      })
+    ).toEqual({
+      kind: 'tool-call',
+      name: 'read',
+      input: { command: 'cat', cwd: '/repo' },
+      state: 'completed'
+    })
+  })
+
+  it('skips unclassified actions to reach the first classified one', () => {
+    expect(
+      codexItemBody({
+        type: 'commandExecution',
+        id: 'item-piped',
+        command: 'true && cat a.ts',
+        cwd: '/repo',
+        status: 'completed',
+        exitCode: 0,
+        commandActions: [
+          { type: 'unknown', command: 'true' },
+          { type: 'read', command: 'cat a.ts', name: 'a.ts', path: 'a.ts' }
+        ]
+      })
+    ).toMatchObject({ name: 'read', input: { path: 'a.ts' } })
+  })
+
+  it('falls back to the unclassified shell row for absent or malformed commandActions', () => {
+    const shellRow = {
+      kind: 'tool-call',
+      name: 'shell',
+      input: { command: 'ls', cwd: '/tmp' },
+      state: 'completed'
+    }
+    const base = {
+      type: 'commandExecution',
+      id: 'item-fallback',
+      command: 'ls',
+      cwd: '/tmp',
+      status: 'completed',
+      exitCode: 0
+    }
+
+    expect(codexItemBody(base)).toEqual(shellRow)
+    expect(codexItemBody({ ...base, commandActions: null })).toEqual(shellRow)
+    expect(codexItemBody({ ...base, commandActions: [] })).toEqual(shellRow)
+    expect(
+      codexItemBody({ ...base, commandActions: [{ type: 'unknown', command: 'ls' }] })
+    ).toEqual(shellRow)
+    expect(codexItemBody({ ...base, commandActions: 'read' })).toEqual(shellRow)
+    expect(codexItemBody({ ...base, commandActions: [null, 7, 'read', {}, { type: 5 }] })).toEqual(
+      shellRow
+    )
+    // The classification table is a Map because an object index answers
+    // `__proto__`/`constructor` with a truthy non-string tool name.
+    expect(
+      codexItemBody({ ...base, commandActions: [{ type: '__proto__', command: 'ls' }] })
+    ).toEqual(shellRow)
+    expect(
+      codexItemBody({ ...base, commandActions: [{ type: 'constructor', command: 'ls' }] })
+    ).toEqual(shellRow)
+    // The rollout-file shape is a different lane and never reaches app-server.
+    expect(
+      codexItemBody({ ...base, parsedCmd: [{ type: 'read', cmd: 'ls', path: 'a.ts' }] })
+    ).toEqual(shellRow)
+  })
+
   it('accepts snake-case command completion output and preserves blob evidence', () => {
     const output = 'x'.repeat(1_100_000)
     const translated = codexJournalItem({
@@ -220,12 +505,6 @@ describe('codex item bodies', () => {
       throw new Error('expected bounded command output')
     }
     expect(body.output.head.length).toBeLessThan(20_000)
-    expect(translated.blobs).toEqual([
-      {
-        digest: body.output.digest,
-        payload: output
-      }
-    ])
   })
 
   it('continues to accept camel-case command completion output', () => {
@@ -304,10 +583,226 @@ describe('codex item bodies', () => {
     })
     expect(codexItemBody({ type: 'reasoning', id: 'r' })).toBeNull()
     expect(codexItemBody({ type: 'agentMessage', id: 'm', text: '' })).toBeNull()
-    expect(codexItemBody({ type: 'webSearch', id: 'w' })).toMatchObject({
+    expect(codexItemBody({ type: 'somethingCodexAddedLater', id: 'x' })).toMatchObject({
       kind: 'status',
-      text: 'codex · item:webSearch',
-      providerFrame: { provider: 'codex', kind: 'item:webSearch' }
+      text: 'codex · item:somethingCodexAddedLater',
+      providerFrame: { provider: 'codex', kind: 'item:somethingCodexAddedLater' }
+    })
+  })
+
+  it('gives an mcp tool call a typed body with its own arguments as input', () => {
+    expect(
+      codexItemBody({
+        type: 'mcpToolCall',
+        id: 'mcp-1',
+        server: 'weather',
+        tool: 'get_forecast',
+        status: 'completed',
+        arguments: { city: 'Oslo' },
+        result: { content: [{ type: 'text', text: '12C' }] }
+      })
+    ).toEqual({
+      kind: 'tool-call',
+      // Server-qualified, and the arguments stay top level so the row label can
+      // read `query`/`command`/`file_path` out of them.
+      name: 'weather/get_forecast',
+      input: { city: 'Oslo' },
+      state: 'completed',
+      output: { head: '12C', byteLength: 3, truncated: false, digest: expect.any(String) }
+    })
+  })
+
+  it('passes an mcp tool name through with no casing transform', () => {
+    // Downstream dispatch is exact-match on raw identifiers, so every shape —
+    // bare snake_case included — has to survive byte-identical.
+    for (const tool of ['get_forecast', 'mcp__server__tool', 'ns.tool', 'urn:tool', 'listTools']) {
+      expect(
+        codexItemBody({ type: 'mcpToolCall', id: 'm', tool, status: 'inProgress' }),
+        tool
+      ).toMatchObject({ kind: 'tool-call', name: tool, state: 'running' })
+      expect(
+        codexItemBody({ type: 'mcpToolCall', id: 'm', server: 'srv', tool, status: 'inProgress' }),
+        tool
+      ).toMatchObject({ kind: 'tool-call', name: `srv/${tool}`, state: 'running' })
+    }
+  })
+
+  it('falls back to the bare tool, then to `mcp`, when the item is under-specified', () => {
+    expect(
+      codexItemBody({ type: 'mcpToolCall', id: 'm', tool: 'get_forecast', status: 'inProgress' })
+    ).toMatchObject({ name: 'get_forecast' })
+    expect(
+      codexItemBody({ type: 'mcpToolCall', id: 'm', server: '', tool: 'ping', status: 'completed' })
+    ).toMatchObject({ name: 'ping' })
+    expect(
+      codexItemBody({ type: 'mcpToolCall', id: 'm', server: 'weather', status: 'completed' })
+    ).toMatchObject({ name: 'mcp' })
+  })
+
+  it('keeps non-object mcp arguments addressable and empty ones off the label', () => {
+    // `arguments` is arbitrary JSON upstream; a scalar or array must still reach
+    // the row rather than being dropped or unwrapped into a bare value.
+    expect(
+      codexItemBody({ type: 'mcpToolCall', id: 'm', tool: 't', arguments: 'raw text' })
+    ).toMatchObject({ input: { arguments: 'raw text' } })
+    expect(
+      codexItemBody({ type: 'mcpToolCall', id: 'm', tool: 't', arguments: [1, 2] })
+    ).toMatchObject({ input: { arguments: [1, 2] } })
+    // `arguments` is required on the wire, so `{}` — not an absent key — is what
+    // an argument-less MCP tool sends, and passing it through labels the row `{}`.
+    expect(codexItemBody({ type: 'mcpToolCall', id: 'm', tool: 't', arguments: {} })).toEqual({
+      kind: 'tool-call',
+      name: 't',
+      input: null,
+      state: 'running'
+    })
+    expect(codexItemBody({ type: 'mcpToolCall', id: 'm', tool: 't' })).toMatchObject({
+      input: null
+    })
+    expect(
+      codexItemBody({ type: 'mcpToolCall', id: 'm', tool: 't', arguments: null })
+    ).toMatchObject({ input: null })
+  })
+
+  it('renders an argument-less mcp call as a bare server/tool row', () => {
+    const input = toolCallInput({
+      type: 'mcpToolCall',
+      id: 'm',
+      server: 'srv',
+      tool: 'list_tools',
+      arguments: {}
+    })
+    expect(describeToolInput(input)).toBe('')
+    expect(briefToolArg(input)).toBe('')
+  })
+
+  it('reports an mcp error as a failed call carrying the server message', () => {
+    expect(
+      codexItemBody({
+        type: 'mcpToolCall',
+        id: 'mcp-2',
+        server: 's',
+        tool: 'ping',
+        status: 'completed',
+        error: { message: 'server unreachable' }
+      })
+    ).toMatchObject({
+      kind: 'tool-call',
+      name: 's/ping',
+      state: 'failed',
+      output: { head: 'server unreachable', truncated: false }
+    })
+  })
+
+  it('models a web search as a tool call that runs until codex sends the action', () => {
+    // The start frame Codex actually emits: empty query, no action. Nothing is
+    // labelable yet, so the input is absent rather than a hull of null keys.
+    expect(codexItemBody({ type: 'webSearch', id: 'w', query: '', action: null })).toEqual({
+      kind: 'tool-call',
+      name: 'web_search',
+      input: null,
+      state: 'running'
+    })
+    expect(
+      codexItemBody({
+        type: 'webSearch',
+        id: 'w',
+        query: 'orca release notes',
+        action: { type: 'search', query: 'orca release notes', queries: null },
+        results: null
+      })
+    ).toEqual({
+      kind: 'tool-call',
+      name: 'web_search',
+      input: {
+        query: 'orca release notes',
+        description: 'search',
+        action: { type: 'search', query: 'orca release notes', queries: null }
+      },
+      state: 'completed'
+    })
+  })
+
+  it('carries the web search hits as the call output', () => {
+    const results = [{ title: 'Orca 1.0', url: 'https://example.com/notes' }]
+    expect(
+      codexItemBody({
+        type: 'webSearch',
+        id: 'w',
+        query: 'orca release notes',
+        action: { type: 'search', query: 'orca release notes', queries: null },
+        results
+      })
+    ).toMatchObject({
+      kind: 'tool-call',
+      name: 'web_search',
+      state: 'completed',
+      output: { head: JSON.stringify(results), truncated: false }
+    })
+    // Nothing to show is no output block at all, not an empty one.
+    for (const empty of [undefined, null, []]) {
+      expect(
+        codexItemBody({
+          type: 'webSearch',
+          id: 'w',
+          query: 'q',
+          action: { type: 'search' },
+          results: empty
+        }),
+        String(empty)
+      ).not.toHaveProperty('output')
+    }
+  })
+
+  it('labels every web search shape without falling back to raw JSON', () => {
+    // Both the row label and the run header read top-level input keys only, so a
+    // shape whose detail sits inside `action` renders as the input's raw JSON.
+    const url = 'https://example.com/docs/page'
+    const shapes: [string, unknown, string, string][] = [
+      ['started', null, '', ''],
+      [
+        'search',
+        { type: 'search', query: 'a sample query', queries: null },
+        'a sample query',
+        'a sample query'
+      ],
+      ['openPage', { type: 'openPage', url }, url, ''],
+      [
+        'findInPage',
+        { type: 'findInPage', url, pattern: 'a needle' },
+        'a sample query',
+        'a sample query'
+      ],
+      ['other', { type: 'other' }, 'other', '']
+    ]
+    for (const [name, action, label, brief] of shapes) {
+      // Codex leaves the item's own `query` empty on most completed searches.
+      const query = name === 'search' || name === 'findInPage' ? 'a sample query' : ''
+      const input = toolCallInput({ type: 'webSearch', id: 'w', query, action })
+      expect(describeToolInput(input), name).toBe(label)
+      expect(briefToolArg(input), name).toBe(brief)
+    }
+  })
+
+  it('leaves subagent items on the generic row until a real renderer exists', () => {
+    expect(
+      codexJournalItem({
+        type: 'subAgentActivity',
+        id: 'a-1',
+        kind: 'started',
+        agentThreadId: 'thread-child',
+        agentPath: '/root/list_directory'
+      })
+    ).toMatchObject({
+      handled: false,
+      body: { kind: 'status', providerFrame: { kind: 'item:subAgentActivity' } }
+    })
+  })
+
+  it('drops the sleep item, which codex itself renders as nothing', () => {
+    expect(codexJournalItem({ type: 'sleep', id: 's-1', durationMs: 20_000 })).toEqual({
+      body: null,
+      handled: true
     })
   })
 
diff --git a/src/main/codex/codex-structured-item-translation.ts b/src/main/codex/codex-structured-item-translation.ts
index f640ad5fb3d..ad08525a5f5 100644
--- a/src/main/codex/codex-structured-item-translation.ts
+++ b/src/main/codex/codex-structured-item-translation.ts
@@ -1,7 +1,4 @@
-import type {
-  AgentJournalItemBody,
-  AgentJournalItemIdentity
-} from '../../shared/agent-session-journal-types'
+import type { AgentJournalItemBody } from '../../shared/agent-session-journal-types'
 import type { NativeChatBlock } from '../../shared/native-chat-types'
 import {
   boundInlineText,
@@ -9,116 +6,27 @@ import {
   DEFAULT_JOURNAL_PAYLOAD_LIMITS
 } from '../native-chat/agent-session-journal/journal-payload-bounds'
 import { unhandledProviderFrameJournalItem } from '../native-chat/agent-session-wire/unhandled-provider-frame'
-import type { CodexTurnOrdinals } from './codex-turn-ordinals'
+import { commandActionFacts } from './codex-command-action-class'
+import {
+  readFirstString,
+  readRecord,
+  readString,
+  readTextContent
+} from './codex-item-field-readers'
+import type { CodexThreadItem } from './codex-thread-item-identity'
+export {
+  codexItemIdentity,
+  isCodexMessageItemType,
+  readCodexThreadItem,
+  type CodexThreadItem
+} from './codex-thread-item-identity'
 export {
   CodexTurnOrdinals,
   MAX_CODEX_TURN_ORDINAL_BYTES,
   MAX_CODEX_TURN_ORDINAL_ENTRIES
 } from './codex-turn-ordinals'
 
-// Codex thread items → journal item bodies and durable identities.
-//
-// THE ORDINAL RULE, and why it is not "index within the turn". Codex renumbers
-// item ids positionally on resume (`item-1`…`item-N` across the whole thread),
-// and a resumed turn does NOT contain every item the live turn emitted —
-// reasoning and command execution are dropped from persisted history. Numbering
-// by live position would therefore shift every message after the first tool
-// call and hand the user a duplicate of the assistant's answer after a resume.
-//
-// So the ordinal counts MESSAGE items only, and the same projection is applied
-// to the live stream and to a resumed turn's item list. Any other item type —
-// including ones this build does not model — is skipped identically on both
-// sides, which is what makes the key survive a Codex release that adds one.
-
-/** Only these carry a durable `(threadId, turnId, ordinal)` identity. */
-const CODEX_MESSAGE_ITEM_TYPES = new Set(['userMessage', 'agentMessage'])
-
-export type CodexThreadItem = {
-  type: string
-  id: string
-  [key: string]: unknown
-}
-
-export function isCodexMessageItemType(type: string): boolean {
-  return CODEX_MESSAGE_ITEM_TYPES.has(type)
-}
-
-export function readCodexThreadItem(value: unknown): CodexThreadItem | null {
-  if (typeof value !== 'object' || value === null) {
-    return null
-  }
-  const record = value as Record<string, unknown>
-  return typeof record.type === 'string' && typeof record.id === 'string'
-    ? (record as CodexThreadItem)
-    : null
-}
-
-function readRecord(value: unknown): Record<string, unknown> {
-  return typeof value === 'object' && value !== null ? (value as Record<string, unknown>) : {}
-}
-
-/**
- * Durable identity for a Codex item, or null for one that has none.
- *
- * Non-message items fall back to the `orca` namespace keyed by the Codex item
- * id. That id is unstable across resume, so those rows are live-session detail
- * that a recovered journal simply will not contain — which is correct: Codex
- * itself does not persist them either.
- */
-export function codexItemIdentity(input: {
-  threadId: string
-  turnId: string | null
-  item: CodexThreadItem
-  ordinals: CodexTurnOrdinals
-}): AgentJournalItemIdentity {
-  const { item, turnId } = input
-  if (turnId && isCodexMessageItemType(item.type)) {
-    return {
-      provider: 'codex',
-      threadId: input.threadId,
-      turnId,
-      ordinal: input.ordinals.ordinalFor(input.threadId, turnId, item.id)
-    }
-  }
-  return { provider: 'orca', clientMessageId: `codex-item:${input.threadId}:${item.id}` }
-}
-
-function readString(source: Record<string, unknown>, key: string): string | null {
-  const value = source[key]
-  return typeof value === 'string' && value.length > 0 ? value : null
-}
-
-function readFirstString(source: Record<string, unknown>, keys: readonly string[]): string | null {
-  for (const key of keys) {
-    const value = readString(source, key)
-    if (value !== null) {
-      return value
-    }
-  }
-  return null
-}
-
-function readTextContent(source: Record<string, unknown>, key: string): string | null {
-  const direct = readString(source, key)
-  if (direct) {
-    return direct
-  }
-  const value = source[key]
-  if (!Array.isArray(value)) {
-    return null
-  }
-  const parts = value.flatMap((part) => {
-    if (typeof part === 'string') {
-      return part.length > 0 ? [part] : []
-    }
-    if (typeof part !== 'object' || part === null) {
-      return []
-    }
-    const text = readString(part as Record<string, unknown>, 'text')
-    return text ? [text] : []
-  })
-  return parts.length > 0 ? parts.join('\n') : null
-}
+// Codex thread items → journal item bodies.
 
 /** `userMessage` carries structured content parts; `agentMessage` a flat text. */
 export function codexMessageBlocks(item: CodexThreadItem): NativeChatBlock[] {
@@ -172,28 +80,25 @@ function commandState(item: CodexThreadItem): 'running' | 'completed' | 'failed'
 
 export type CodexJournalItem = {
   body: AgentJournalItemBody | null
-  blobs: { digest: string; payload: string }[]
   handled: boolean
 }
 
 function commandItem(item: CodexThreadItem): CodexJournalItem {
   const output = readFirstString(item, ['aggregatedOutput', 'aggregated_output'])
   const bounded = output === null ? null : boundInlineText(output, DEFAULT_JOURNAL_PAYLOAD_LIMITS)
+  const parsed = commandActionFacts(item)
   return {
     body: {
       kind: 'tool-call',
-      name: 'shell',
+      name: parsed?.name ?? 'shell',
+      // Raw command and cwd stay so the expanded view still shows what ran.
       input: boundToolInput(
-        { command: item.command ?? null, cwd: item.cwd ?? null },
+        { command: item.command ?? null, cwd: item.cwd ?? null, ...parsed?.fields },
         DEFAULT_JOURNAL_PAYLOAD_LIMITS
       ),
       state: commandState(item),
       ...(bounded === null ? {} : { output: bounded.bounded })
     },
-    blobs:
-      output !== null && bounded?.bounded.truncated
-        ? [{ digest: bounded.bounded.digest, payload: output }]
-        : [],
     handled: true
   }
 }
@@ -215,7 +120,6 @@ function fileChangeItem(item: CodexThreadItem): CodexJournalItem {
         input: boundToolInput({ changes: item.changes ?? null }, DEFAULT_JOURNAL_PAYLOAD_LIMITS),
         state: commandState(item)
       },
-      blobs: [],
       handled: true
     }
   }
@@ -227,7 +131,85 @@ function fileChangeItem(item: CodexThreadItem): CodexJournalItem {
       path: changes.length === 1 ? changes[0]!.path : `${changes.length} files`,
       patch: bounded
     },
-    blobs: bounded.truncated ? [{ digest: bounded.digest, payload: patch }] : [],
+    handled: true
+  }
+}
+
+/** The tool name reaches the row verbatim — downstream dispatch (diff renderer,
+ *  question parsers, input previews) matches raw identifiers, so any casing
+ *  transform would silently miss them. `server/` qualifies it so two servers
+ *  exposing the same tool stay distinguishable and neither shadows a built-in. */
+function mcpToolCallName(item: CodexThreadItem): string {
+  const tool = readString(item, 'tool')
+  const server = readString(item, 'server')
+  return tool === null ? 'mcp' : server === null ? tool : `${server}/${tool}`
+}
+
+/** Row-label derivation only reads top-level keys, so the call's own arguments
+ *  have to be the input itself. `arguments` is arbitrary JSON upstream: a
+ *  non-object stays addressable under a key rather than being dropped, while a
+ *  no-argument call — `{}` on the wire, the shape every argument-less MCP tool
+ *  sends — becomes null so the row reads as a bare `server/tool` instead of a
+ *  literal `{}`. */
+function mcpToolArguments(value: unknown): unknown {
+  if (typeof value !== 'object' || value === null) {
+    return value === null || value === undefined ? null : { arguments: value }
+  }
+  return Array.isArray(value) ? { arguments: value } : Object.keys(value).length > 0 ? value : null
+}
+
+function mcpToolCallItem(item: CodexThreadItem): CodexJournalItem {
+  const failure = readString(readRecord(item.error), 'message')
+  const text = failure ?? readTextContent(readRecord(item.result), 'content')
+  const bounded = text === null ? null : boundInlineText(text, DEFAULT_JOURNAL_PAYLOAD_LIMITS)
+  return {
+    body: {
+      kind: 'tool-call',
+      name: mcpToolCallName(item),
+      input: boundToolInput(mcpToolArguments(item.arguments), DEFAULT_JOURNAL_PAYLOAD_LIMITS),
+      state: failure === null ? commandState(item) : 'failed',
+      ...(bounded === null ? {} : { output: bounded.bounded })
+    },
+    handled: true
+  }
+}
+
+/** A row label is read off top-level keys only, so the action's own labelable
+ *  fields are hoisted beside the query while `action` stays whole for the
+ *  expanded detail. The action `type` lands on `description`, the lowest-ranked
+ *  label key, so it names only an action that carries nothing better. */
+function webSearchInput(item: CodexThreadItem): Record<string, unknown> | null {
+  const action = readRecord(item.action)
+  const fields: [string, unknown][] = [
+    ['url', readString(action, 'url')],
+    ['pattern', readString(action, 'pattern')],
+    ['description', readString(action, 'type')],
+    ['action', item.action ?? null]
+  ]
+  const query = readString(item, 'query') ?? readString(action, 'query')
+  const present = fields.filter(([, value]) => value !== null)
+  // A blank `query` is the run header's "this call has no brief argument"
+  // signal; drop the key and the header stands the row's raw JSON in for one.
+  return query === null && present.length === 0
+    ? null
+    : { query: query ?? '', ...Object.fromEntries(present) }
+}
+
+/** `webSearch` carries no status: Codex starts it with an empty query and a null
+ *  action, then sends the action, so `action` is the completion signal — a
+ *  completed item's own `query` is routinely still empty. The hits arrive on
+ *  `results` and are the call's output. */
+function webSearchItem(item: CodexThreadItem): CodexJournalItem {
+  const hits = Array.isArray(item.results) && item.results.length > 0 ? item.results : null
+  const bounded = hits && boundInlineText(JSON.stringify(hits), DEFAULT_JOURNAL_PAYLOAD_LIMITS)
+  return {
+    body: {
+      kind: 'tool-call',
+      name: 'web_search',
+      input: boundToolInput(webSearchInput(item), DEFAULT_JOURNAL_PAYLOAD_LIMITS),
+      state: item.action === null || item.action === undefined ? 'running' : 'completed',
+      ...(bounded === null ? {} : { output: bounded.bounded })
+    },
     handled: true
   }
 }
@@ -246,7 +228,6 @@ export function codexJournalItem(item: CodexThreadItem): CodexJournalItem {
         blocks.length === 0
           ? null
           : { kind: 'message', role: item.type === 'userMessage' ? 'user' : 'assistant', blocks },
-      blobs: [],
       handled: true
     }
   }
@@ -256,6 +237,12 @@ export function codexJournalItem(item: CodexThreadItem): CodexJournalItem {
   if (item.type === 'fileChange') {
     return fileChangeItem(item)
   }
+  if (item.type === 'mcpToolCall') {
+    return mcpToolCallItem(item)
+  }
+  if (item.type === 'webSearch') {
+    return webSearchItem(item)
+  }
   if (item.type === 'reasoning' || item.type === 'plan') {
     const text =
       readTextContent(item, 'text') ??
@@ -266,14 +253,11 @@ export function codexJournalItem(item: CodexThreadItem): CodexJournalItem {
         text === null
           ? null
           : { kind: 'status', text: boundInlineText(text, DEFAULT_JOURNAL_PAYLOAD_LIMITS).text },
-      blobs: [],
       handled: true
     }
   }
   const unhandled = unhandledProviderFrameJournalItem('codex', `item:${item.type}`, item)
-  return unhandled
-    ? { body: unhandled.body, blobs: unhandled.blobs, handled: false }
-    : { body: null, blobs: [], handled: true }
+  return unhandled ? { body: unhandled.body, handled: false } : { body: null, handled: true }
 }
 
 export function codexItemBody(item: CodexThreadItem): AgentJournalItemBody | null {
@@ -292,7 +276,7 @@ export function codexStreamingMessageBody(text: string): AgentJournalItemBody {
 /** Snapshot body for any item-level stream, keyed onto its parent item. */
 export function codexStreamingJournalItem(item: CodexThreadItem, text: string): CodexJournalItem {
   if (item.type === 'agentMessage') {
-    return { body: codexStreamingMessageBody(text), blobs: [], handled: true }
+    return { body: codexStreamingMessageBody(text), handled: true }
   }
   if (item.type === 'commandExecution') {
     return commandItem({ ...item, aggregatedOutput: text })
@@ -304,10 +288,9 @@ export function codexStreamingJournalItem(item: CodexThreadItem, text: string):
     const bounded = boundInlineText(text, DEFAULT_JOURNAL_PAYLOAD_LIMITS).bounded
     return {
       body: { kind: 'diff', path: path ?? 'pending patch', patch: bounded },
-      blobs: bounded.truncated ? [{ digest: bounded.digest, payload: text }] : [],
       handled: true
     }
   }
   const bounded = boundInlineText(text, DEFAULT_JOURNAL_PAYLOAD_LIMITS)
-  return { body: { kind: 'status', text: bounded.text }, blobs: [], handled: true }
+  return { body: { kind: 'status', text: bounded.text }, handled: true }
 }
diff --git a/src/main/codex/codex-structured-journal-generic-frames.ts b/src/main/codex/codex-structured-journal-generic-frames.ts
index f6b9ff375d3..6c211a8f5a4 100644
--- a/src/main/codex/codex-structured-journal-generic-frames.ts
+++ b/src/main/codex/codex-structured-journal-generic-frames.ts
@@ -91,13 +91,11 @@ export class CodexJournalGenericFrames {
     const admission = this.deps.sink.tryAppendItem
       ? this.deps.sink.tryAppendItem(
           { provider: 'orca', clientMessageId: `provider-frame:codex:${this.fallbackSequence}` },
-          translated.body,
-          translated.blobs
+          translated.body
         )
       : (this.deps.sink.appendItem(
           { provider: 'orca', clientMessageId: `provider-frame:codex:${this.fallbackSequence}` },
-          translated.body,
-          translated.blobs
+          translated.body
         ),
         CODEX_JOURNAL_ADMITTED)
     if (!admission.accepted) {
@@ -136,13 +134,11 @@ export class CodexJournalGenericFrames {
               kind: 'status',
               text
             },
-            [],
             { coalescingKey: `provider-frame-suppressed:codex:${bucket}` }
           )
         : (this.deps.sink.appendItem(
             { provider: 'orca', clientMessageId: `provider-frame-suppressed:codex:${bucket}` },
             { kind: 'status', text },
-            [],
             { coalescingKey: `provider-frame-suppressed:codex:${bucket}` }
           ),
           CODEX_JOURNAL_ADMITTED)
diff --git a/src/main/codex/codex-structured-journal-items.ts b/src/main/codex/codex-structured-journal-items.ts
index 2b5d8c04bba..0e4e3f5a900 100644
--- a/src/main/codex/codex-structured-journal-items.ts
+++ b/src/main/codex/codex-structured-journal-items.ts
@@ -2,7 +2,7 @@ import type {
   AgentJournalItemBody,
   AgentJournalItemIdentity
 } from '../../shared/agent-session-journal-types'
-import { requiresTerminalSettlement } from '../native-chat/agent-session-journal/journal-lifecycle-capacity'
+import { requiresTerminalSettlement } from '../native-chat/agent-session-journal/journal-terminal-settlement'
 import {
   codexItemIdentity,
   codexJournalItem,
@@ -126,19 +126,13 @@ export class CodexJournalItems {
       return CODEX_JOURNAL_ADMITTED
     }
     if (method === 'item/completed') {
-      const admission = appendCodexLifecycleItem(
-        this.deps.sink,
-        identity,
-        translated.body,
-        translated.blobs
-      )
+      const admission = appendCodexLifecycleItem(this.deps.sink, identity, translated.body)
       return admission.accepted ? publishCodexLifecycle(this.deps.sink) : admission
     }
     const options = requiresTerminalSettlement(translated.body) ? { lifecycle: true } : {}
     const admission = this.deps.sink.tryAppendItem
-      ? this.deps.sink.tryAppendItem(identity, translated.body, translated.blobs, options)
-      : (this.deps.sink.appendItem(identity, translated.body, translated.blobs),
-        CODEX_JOURNAL_ADMITTED)
+      ? this.deps.sink.tryAppendItem(identity, translated.body, options)
+      : (this.deps.sink.appendItem(identity, translated.body), CODEX_JOURNAL_ADMITTED)
     if (!admission.accepted) {
       return admission
     }
diff --git a/src/main/codex/codex-structured-journal-settlement.ts b/src/main/codex/codex-structured-journal-settlement.ts
index f4378d1a16f..2b8eb627d4f 100644
--- a/src/main/codex/codex-structured-journal-settlement.ts
+++ b/src/main/codex/codex-structured-journal-settlement.ts
@@ -243,14 +243,12 @@ function appendLifecycleMutations(
       for (const mutation of chunk) {
         if (mutation.kind === 'item') {
           if (sink.tryAppendItem) {
-            admission = sink.tryAppendItem(mutation.identity, mutation.body, [], {
-              lifecycle: true
-            })
+            admission = sink.tryAppendItem(mutation.identity, mutation.body, { lifecycle: true })
             if (!admission.accepted) {
               return admission
             }
           } else {
-            sink.appendItem(mutation.identity, mutation.body, [], { lifecycle: true })
+            sink.appendItem(mutation.identity, mutation.body, { lifecycle: true })
           }
         } else {
           if (sink.tryAppendTombstone) {
diff --git a/src/main/codex/codex-structured-journal-sink.ts b/src/main/codex/codex-structured-journal-sink.ts
index b135c89ec0a..5c4ecec9658 100644
--- a/src/main/codex/codex-structured-journal-sink.ts
+++ b/src/main/codex/codex-structured-journal-sink.ts
@@ -4,7 +4,6 @@ import type {
 } from '../../shared/agent-session-journal-types'
 import type {
   StructuredAgentSessionEventSink,
-  StructuredAgentSessionJournalBlob,
   StructuredAgentSessionSinkAdmission
 } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
 import type { CodexPendingJournalPrompt } from './codex-structured-journal-settlement'
@@ -20,13 +19,12 @@ function criticalAdmission(
 export function appendCodexLifecycleItem(
   sink: StructuredAgentSessionEventSink,
   identity: AgentJournalItemIdentity,
-  body: AgentJournalItemBody,
-  blobs: readonly StructuredAgentSessionJournalBlob[] = []
+  body: AgentJournalItemBody
 ): CodexJournalTranslationAdmission {
   if (sink.tryAppendItem) {
-    return criticalAdmission(sink.tryAppendItem(identity, body, blobs, { lifecycle: true }))
+    return criticalAdmission(sink.tryAppendItem(identity, body, { lifecycle: true }))
   }
-  sink.appendItem(identity, body, blobs, { lifecycle: true })
+  sink.appendItem(identity, body, { lifecycle: true })
   return CODEX_JOURNAL_ADMITTED
 }
 
diff --git a/src/main/codex/codex-structured-journal-translation-streams.test.ts b/src/main/codex/codex-structured-journal-translation-streams.test.ts
index c06d468a1ba..a9bc79b71c4 100644
--- a/src/main/codex/codex-structured-journal-translation-streams.test.ts
+++ b/src/main/codex/codex-structured-journal-translation-streams.test.ts
@@ -89,11 +89,11 @@ describe('codex journal translation', () => {
     const { translator, tap } = translatorWith()
     let rejectTerminal = true
     const appendItem = tap.sink.appendItem
-    tap.sink.tryAppendItem = (identity, body, blobs, options) => {
+    tap.sink.tryAppendItem = (identity, body, options) => {
       if (rejectTerminal && body.kind === 'tool-call' && body.state === 'failed') {
         return { accepted: false as const, reason: 'backpressure' as const }
       }
-      appendItem(identity, body, blobs, options)
+      appendItem(identity, body, options)
       return { accepted: true as const }
     }
     for (let index = 0; index <= 256; index += 1) {
diff --git a/src/main/codex/codex-structured-journal-translation-turns.ts b/src/main/codex/codex-structured-journal-translation-turns.ts
index 3f295d2add1..06bb28f85f9 100644
--- a/src/main/codex/codex-structured-journal-translation-turns.ts
+++ b/src/main/codex/codex-structured-journal-translation-turns.ts
@@ -40,7 +40,6 @@ export function publishCodexTurnLifecycle(input: {
             text: 'Codex is working…',
             turnLifecycle: { turnId: input.turnId, state: input.state }
           },
-          [],
           { lifecycle: true }
         )
       : (input.sink.appendItem(
@@ -50,7 +49,6 @@ export function publishCodexTurnLifecycle(input: {
             text: 'Codex is working…',
             turnLifecycle: { turnId: input.turnId, state: input.state }
           },
-          [],
           { lifecycle: true }
         ),
         ADMITTED)
diff --git a/src/main/codex/codex-structured-session-close.test.ts b/src/main/codex/codex-structured-session-close.test.ts
index 4238c75de9e..b04e7bc2540 100644
--- a/src/main/codex/codex-structured-session-close.test.ts
+++ b/src/main/codex/codex-structured-session-close.test.ts
@@ -11,6 +11,8 @@ import {
 } from './codex-structured-session-adapter'
 import { handleCodexSessionExit } from './codex-structured-session-close'
 import type { CodexSession } from './codex-structured-session-state'
+import type { StructuredAgentSessionAdapter } from '../native-chat/agent-session-wire/structured-agent-session-adapter'
+import { StructuredAgentSessionAdapterRouter } from '../native-chat/agent-session-wire/structured-agent-session-adapter-router'
 
 const THREAD = 'thread-1'
 
@@ -60,6 +62,16 @@ function adapterFixture() {
   return { adapter, connections, events }
 }
 
+function claudeAdapterStub(): StructuredAgentSessionAdapter {
+  return {
+    acquire: vi.fn(async () => ({ process: { pid: 1 } }) as never),
+    dispatch: vi.fn(),
+    cancelTurn: vi.fn(),
+    answerPrompt: vi.fn(),
+    setOption: vi.fn()
+  }
+}
+
 describe('Codex structured session close lifecycle', () => {
   it('forwards a one-shot exit when lifecycle admission is rejected', () => {
     const connection: CodexAppServerConnection = {
@@ -164,4 +176,27 @@ describe('Codex structured session close lifecycle', () => {
       { cause: 'unexpected-exit', reason: 'sink failed', fence: 7 }
     ])
   })
+
+  it('routes Codex sink-failure recovery through force-close and preserves unexpected-exit settlement', async () => {
+    const { adapter, connections, events } = adapterFixture()
+    const router = new StructuredAgentSessionAdapterRouter(
+      { claude: claudeAdapterStub(), codex: adapter },
+      async () => {}
+    )
+    await router.acquire({ identity: identity('session-1'), fence: 7, spawnToken: 'spawn-1' })
+    const current = connections[0]
+    if (!current) {
+      throw new Error('missing connection')
+    }
+    current.connection.close = async () => {
+      current.handlers.onExit?.(new Error('journal sink failed'))
+      return true
+    }
+
+    const forceCloseSession = router.forceCloseSession
+    await expect(forceCloseSession('session-1')).resolves.toBe(true)
+    expect(events.filter((event) => event.type === 'ended')).toMatchObject([
+      { cause: 'unexpected-exit', reason: 'journal sink failed', fence: 7 }
+    ])
+  })
 })
diff --git a/src/main/codex/codex-structured-turn-processes.ts b/src/main/codex/codex-structured-turn-processes.ts
index 6bb4b960a1b..163cbb098fb 100644
--- a/src/main/codex/codex-structured-turn-processes.ts
+++ b/src/main/codex/codex-structured-turn-processes.ts
@@ -57,6 +57,8 @@ async function terminateWindowsAddedProcesses(
   const added = current.filter((row) => baseline.get(row.pid) !== windowsIdentity(row))
   const addedPids = new Set(added.map((row) => row.pid))
   const roots = added.filter((row) => !addedPids.has(row.ppid))
+  // Added roots come from a table walk, not a spawn, so a refused tree walk has
+  // no handle to fall back to: the row stays in `remaining` and this reports false.
   await Promise.all(
     roots.map((row) => terminateWindowsProcessTree(row.pid, { site: 'codex-turn-added-roots' }))
   )
diff --git a/src/main/codex/codex-thread-item-identity.ts b/src/main/codex/codex-thread-item-identity.ts
new file mode 100644
index 00000000000..0488e5c00e9
--- /dev/null
+++ b/src/main/codex/codex-thread-item-identity.ts
@@ -0,0 +1,65 @@
+import type { AgentJournalItemIdentity } from '../../shared/agent-session-journal-types'
+import type { CodexTurnOrdinals } from './codex-turn-ordinals'
+
+// Codex thread items → durable journal identities.
+//
+// THE ORDINAL RULE, and why it is not "index within the turn". Codex renumbers
+// item ids positionally on resume (`item-1`…`item-N` across the whole thread),
+// and a resumed turn does NOT contain every item the live turn emitted —
+// reasoning and command execution are dropped from persisted history. Numbering
+// by live position would therefore shift every message after the first tool
+// call and hand the user a duplicate of the assistant's answer after a resume.
+//
+// So the ordinal counts MESSAGE items only, and the same projection is applied
+// to the live stream and to a resumed turn's item list. Any other item type —
+// including ones this build does not model — is skipped identically on both
+// sides, which is what makes the key survive a Codex release that adds one.
+
+/** Only these carry a durable `(threadId, turnId, ordinal)` identity. */
+const CODEX_MESSAGE_ITEM_TYPES = new Set(['userMessage', 'agentMessage'])
+
+export type CodexThreadItem = {
+  type: string
+  id: string
+  [key: string]: unknown
+}
+
+export function isCodexMessageItemType(type: string): boolean {
+  return CODEX_MESSAGE_ITEM_TYPES.has(type)
+}
+
+export function readCodexThreadItem(value: unknown): CodexThreadItem | null {
+  if (typeof value !== 'object' || value === null) {
+    return null
+  }
+  const record = value as Record<string, unknown>
+  return typeof record.type === 'string' && typeof record.id === 'string'
+    ? (record as CodexThreadItem)
+    : null
+}
+
+/**
+ * Durable identity for a Codex item, or null for one that has none.
+ *
+ * Non-message items fall back to the `orca` namespace keyed by the Codex item
+ * id. That id is unstable across resume, so those rows are live-session detail
+ * that a recovered journal simply will not contain — which is correct: Codex
+ * itself does not persist them either.
+ */
+export function codexItemIdentity(input: {
+  threadId: string
+  turnId: string | null
+  item: CodexThreadItem
+  ordinals: CodexTurnOrdinals
+}): AgentJournalItemIdentity {
+  const { item, turnId } = input
+  if (turnId && isCodexMessageItemType(item.type)) {
+    return {
+      provider: 'codex',
+      threadId: input.threadId,
+      turnId,
+      ordinal: input.ordinals.ordinalFor(input.threadId, turnId, item.id)
+    }
+  }
+  return { provider: 'orca', clientMessageId: `codex-item:${input.threadId}:${item.id}` }
+}
diff --git a/src/main/codex/codex-turn-ordinals.ts b/src/main/codex/codex-turn-ordinals.ts
index 7087c28e4ac..e2b4132d2b2 100644
--- a/src/main/codex/codex-turn-ordinals.ts
+++ b/src/main/codex/codex-turn-ordinals.ts
@@ -37,10 +37,7 @@ export class CodexTurnOrdinals {
     const suffix = `#${digestPayload(value).slice(0, 24)}`
     return `${
       boundPayload(encoded, {
-        inlineHeadBytes: 256 - Buffer.byteLength(suffix, 'utf8'),
-        maxSessionBytes: Number.MAX_SAFE_INTEGER,
-        maxAppendsPerWindow: Number.MAX_SAFE_INTEGER,
-        appendWindowMs: Number.MAX_SAFE_INTEGER
+        inlineHeadBytes: 256 - Buffer.byteLength(suffix, 'utf8')
       }).head
     }${suffix}`
   }
diff --git a/src/main/computer/computer-sidecar-diagnostics.test.ts b/src/main/computer/computer-sidecar-diagnostics.test.ts
new file mode 100644
index 00000000000..06d1b1cfa02
--- /dev/null
+++ b/src/main/computer/computer-sidecar-diagnostics.test.ts
@@ -0,0 +1,45 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import {
+  isComputerSidecarDiagnostic,
+  reportComputerDiagnostic
+} from './computer-sidecar-diagnostics'
+
+describe('computer sidecar diagnostics', () => {
+  const originalSend = process.send
+
+  afterEach(() => {
+    process.send = originalSend
+    vi.restoreAllMocks()
+  })
+
+  it('sends over IPC when running inside the sidecar', () => {
+    const send = vi.fn((_message: unknown) => true)
+    process.send = send as unknown as typeof process.send
+    const console_ = vi.spyOn(console, 'warn').mockImplementation(() => {})
+
+    reportComputerDiagnostic('fell back to Bypass')
+
+    // The sidecar's stdout is piped and never read, so this must not go there.
+    expect(console_).not.toHaveBeenCalled()
+    expect(send).toHaveBeenCalledWith({
+      kind: 'computer-sidecar-diagnostic',
+      message: 'fell back to Bypass'
+    })
+    expect(isComputerSidecarDiagnostic(send.mock.calls[0][0])).toBe(true)
+  })
+
+  it('logs directly when there is no IPC channel', () => {
+    process.send = undefined
+    const console_ = vi.spyOn(console, 'warn').mockImplementation(() => {})
+
+    reportComputerDiagnostic('fell back to Bypass')
+
+    expect(console_).toHaveBeenCalledWith('[computer-use] fell back to Bypass')
+  })
+
+  it('does not mistake a sidecar response for a diagnostic', () => {
+    expect(isComputerSidecarDiagnostic({ id: 1, ok: true, result: {} })).toBe(false)
+    expect(isComputerSidecarDiagnostic({ kind: 'computer-sidecar-diagnostic' })).toBe(false)
+    expect(isComputerSidecarDiagnostic(null)).toBe(false)
+  })
+})
diff --git a/src/main/computer/computer-sidecar-diagnostics.ts b/src/main/computer/computer-sidecar-diagnostics.ts
new file mode 100644
index 00000000000..2b23418940d
--- /dev/null
+++ b/src/main/computer/computer-sidecar-diagnostics.ts
@@ -0,0 +1,38 @@
+/**
+ * Warnings from the computer-use provider, routed to somewhere a human sees.
+ *
+ * Why not `console.warn`: the provider runs inside the forked sidecar, which
+ * `sidecar-client.ts` starts with piped stdio that nothing ever reads. Anything
+ * written there is discarded — including the only signal that a machine has
+ * fallen back to `-ExecutionPolicy Bypass`, a state that persists for the
+ * session. The sidecar has an IPC channel already, so the warning takes it.
+ */
+export type ComputerSidecarDiagnostic = {
+  kind: 'computer-sidecar-diagnostic'
+  message: string
+}
+
+const DIAGNOSTIC_KIND = 'computer-sidecar-diagnostic'
+
+export function isComputerSidecarDiagnostic(
+  message: unknown
+): message is ComputerSidecarDiagnostic {
+  if (!message || typeof message !== 'object') {
+    return false
+  }
+  const record = message as Record<string, unknown>
+  return record.kind === DIAGNOSTIC_KIND && typeof record.message === 'string'
+}
+
+export function reportComputerDiagnostic(message: string): void {
+  if (process.send) {
+    process.send({ kind: DIAGNOSTIC_KIND, message } satisfies ComputerSidecarDiagnostic)
+    return
+  }
+  logComputerDiagnostic(message)
+}
+
+/** The main-process end: how a sidecar's forwarded diagnostic is printed. */
+export function logComputerDiagnostic(message: string): void {
+  console.warn(`[computer-use] ${message}`)
+}
diff --git a/src/main/computer/desktop-script-action.ts b/src/main/computer/desktop-script-action.ts
index 38dde4b56fa..7c2c21f1e8c 100644
--- a/src/main/computer/desktop-script-action.ts
+++ b/src/main/computer/desktop-script-action.ts
@@ -228,3 +228,17 @@ export function elementParam(
   }
   return element
 }
+
+/**
+ * Tools that only observe, and so may be safely re-sent to a fresh helper.
+ *
+ * Why an allowlist: a helper can die after running an operation but before
+ * writing its reply, so a replayed mutation is a second click, keystroke or
+ * paste. Only the observation tools are provably safe to repeat, and a tool
+ * added later has to opt in rather than inherit a replay by default.
+ */
+const OBSERVATION_TOOLS = new Set(['handshake', 'list_apps', 'list_windows', 'get_app_state'])
+
+export function isReplayableTool(tool: string): boolean {
+  return OBSERVATION_TOOLS.has(tool)
+}
diff --git a/src/main/computer/desktop-script-provider-bridge.ts b/src/main/computer/desktop-script-provider-bridge.ts
index c3c21496d29..fecc4036df1 100644
--- a/src/main/computer/desktop-script-provider-bridge.ts
+++ b/src/main/computer/desktop-script-provider-bridge.ts
@@ -1,28 +1,98 @@
 import { execFile } from 'node:child_process'
+import { windowsPowerShellPath } from '../../shared/child-process/windows-system-binary'
+import { reportComputerDiagnostic } from './computer-sidecar-diagnostics'
 import { RuntimeClientError } from './runtime-client-error'
 import type { DesktopScriptPlatform } from './desktop-script-provider-paths'
+import {
+  FALLBACK_WINDOWS_EXECUTION_POLICY,
+  PREFERRED_WINDOWS_EXECUTION_POLICY,
+  isExecutionPolicyBlocked,
+  windowsPowerShellRuntimeArgs
+} from './windows-powershell-execution-policy'
 
 const REQUEST_TIMEOUT_MS = 30_000
 const FORCE_KILL_GRACE_MS = 1_000
 
-export function execBridge(
+export async function execBridge(
   platform: DesktopScriptPlatform,
   scriptPath: string,
   operationPath: string
 ): Promise<{ stdout: string; stderr: string }> {
-  const command = platform === 'windows' ? 'powershell.exe' : 'python3'
-  const args =
-    platform === 'windows'
-      ? [
-          '-NoProfile',
-          '-NonInteractive',
-          '-ExecutionPolicy',
-          'Bypass',
-          '-File',
-          scriptPath,
-          operationPath
-        ]
-      : [scriptPath, operationPath]
+  if (platform !== 'windows') {
+    return await mapped(runBridgeProcess('python3', [scriptPath, operationPath]))
+  }
+  const command = windowsPowerShellPath()
+  try {
+    return await runBridgeProcess(
+      command,
+      windowsPowerShellRuntimeArgs(scriptPath, PREFERRED_WINDOWS_EXECUTION_POLICY, [operationPath])
+    )
+  } catch (error) {
+    if (!isPolicyBlockedStart(error)) {
+      throw error instanceof BridgeProcessFailure ? error.mapped : error
+    }
+    reportComputerDiagnostic(
+      `bridge start blocked at ${PREFERRED_WINDOWS_EXECUTION_POLICY}; retrying once with ${FALLBACK_WINDOWS_EXECUTION_POLICY}`
+    )
+    return await mapped(
+      runBridgeProcess(
+        command,
+        windowsPowerShellRuntimeArgs(scriptPath, FALLBACK_WINDOWS_EXECUTION_POLICY, [operationPath])
+      )
+    )
+  }
+}
+
+/** Unwrap the raw-stream carrier back into the error callers expect. */
+async function mapped(
+  run: Promise<{ stdout: string; stderr: string }>
+): Promise<{ stdout: string; stderr: string }> {
+  try {
+    return await run
+  } catch (error) {
+    throw error instanceof BridgeProcessFailure ? error.mapped : error
+  }
+}
+
+/**
+ * Only a run that produced no stdout at all may be replayed.
+ *
+ * What the stdout guard covers: operations are not idempotent, and the response
+ * embeds window titles and element names, so a snapshot that merely contains
+ * the word "SecurityError" must not be read as a policy block and replayed as a
+ * second click, keystroke or paste. It closes that injection route only.
+ *
+ * What it does not cover: one-shot mode runs the operation to completion and
+ * writes stdout only afterwards, so stdout is empty for the whole action, not
+ * just before it starts. A crash after the click but before the write looks
+ * identical to a helper that never started. Nothing here can tell those apart —
+ * only a policy pattern that cannot match a non-policy failure keeps the replay
+ * off, which is why its `\b` is load-bearing rather than cosmetic.
+ */
+function isPolicyBlockedStart(error: unknown): error is BridgeProcessFailure {
+  return (
+    error instanceof BridgeProcessFailure &&
+    !error.stdout.trim() &&
+    isExecutionPolicyBlocked(error.stderr)
+  )
+}
+
+/** Carries the raw streams so the retry decision does not read a mapped message. */
+class BridgeProcessFailure extends Error {
+  constructor(
+    readonly stdout: string,
+    readonly stderr: string,
+    readonly mapped: RuntimeClientError
+  ) {
+    super(mapped.message)
+    this.name = 'BridgeProcessFailure'
+  }
+}
+
+function runBridgeProcess(
+  command: string,
+  args: readonly string[]
+): Promise<{ stdout: string; stderr: string }> {
   return new Promise((resolve, reject) => {
     let child: ReturnType<typeof execFile> | null = null
     let settled = false
@@ -76,7 +146,7 @@ export function execBridge(
     try {
       child = execFile(
         command,
-        args,
+        [...args],
         {
           env: process.env,
           maxBuffer: 20 * 1024 * 1024,
@@ -86,11 +156,10 @@ export function execBridge(
         (error, stdout, stderr) => {
           if (error) {
             const message = stderr.trim() || stdout.trim() || error.message
-            finish(
-              error.killed
-                ? new RuntimeClientError('action_timeout', message)
-                : mapBridgeError(message)
-            )
+            const mapped = error.killed
+              ? new RuntimeClientError('action_timeout', message)
+              : mapBridgeError(message)
+            finish(new BridgeProcessFailure(stdout, stderr, mapped))
             return
           }
           finish(null, { stdout, stderr })
diff --git a/src/main/computer/desktop-script-provider-client.ts b/src/main/computer/desktop-script-provider-client.ts
index 5e8e01e0d44..a655eeddb07 100644
--- a/src/main/computer/desktop-script-provider-client.ts
+++ b/src/main/computer/desktop-script-provider-client.ts
@@ -35,6 +35,7 @@ import type {
   BridgeResponse,
   NativeActionMethod
 } from './desktop-script-provider-types'
+import { DesktopScriptRuntimeHost, isRuntimeHostUnavailable } from './desktop-script-runtime-host'
 import { DesktopScriptSnapshotStore } from './desktop-script-snapshot-store'
 import { normalizeBridgeApp, renderSnapshot } from './desktop-script-snapshot-rendering'
 import { normalizeComputerActionResult } from './computer-action-verification-normalization'
@@ -51,12 +52,17 @@ export class DesktopScriptProviderClient {
 
   constructor(
     private readonly platform: DesktopScriptPlatform = requiredPlatform(),
-    private readonly scriptPath: string = requiredScriptPath()
+    private readonly scriptPath: string = requiredScriptPath(),
+    private readonly runtimeHost: DesktopScriptRuntimeHost | null = defaultRuntimeHost(
+      platform,
+      scriptPath
+    )
   ) {}
 
   shutdown(): void {
     this.snapshotStore.clear()
     this.providerCapabilities = null
+    this.runtimeHost?.dispose()
   }
 
   async listApps(): Promise<ComputerListAppsResult> {
@@ -203,6 +209,23 @@ export class DesktopScriptProviderClient {
   }
 
   private async callBridge(request: BridgeRequest): Promise<BridgeResponse> {
+    const host = this.runtimeHost
+    if (host) {
+      try {
+        return checkedBridgeResponse(await host.request(request), '')
+      } catch (error) {
+        // Only a helper that cannot start falls back; operation errors surface.
+        // The host is kept: it re-probes after its cooldown, so a transient bad
+        // spawn cannot strand the session on one powershell.exe per operation.
+        if (!isRuntimeHostUnavailable(error)) {
+          throw error
+        }
+      }
+    }
+    return await this.callOneShotBridge(request)
+  }
+
+  private async callOneShotBridge(request: BridgeRequest): Promise<BridgeResponse> {
     const operationDirectory = await mkdtemp(join(tmpdir(), 'orca-computer-use-'))
     const operationPath = join(operationDirectory, 'operation.json')
     try {
@@ -217,10 +240,7 @@ export class DesktopScriptProviderClient {
           `desktop provider returned invalid JSON: ${error instanceof Error ? error.message : String(error)}`
         )
       }
-      if (!response.ok) {
-        throw mapBridgeError(response.error ?? stderr)
-      }
-      return response
+      return checkedBridgeResponse(response, stderr)
     } finally {
       await rm(operationDirectory, { force: true, recursive: true })
     }
@@ -255,6 +275,21 @@ export class DesktopScriptProviderClient {
   }
 }
 
+function checkedBridgeResponse(response: BridgeResponse, stderr: string): BridgeResponse {
+  if (!response.ok) {
+    throw mapBridgeError(response.error ?? stderr)
+  }
+  return response
+}
+
+// Why Windows only: the Linux provider is a python3 one-shot with no serve mode.
+function defaultRuntimeHost(
+  platform: DesktopScriptPlatform,
+  scriptPath: string
+): DesktopScriptRuntimeHost | null {
+  return platform === 'windows' ? new DesktopScriptRuntimeHost(scriptPath) : null
+}
+
 function requiredPlatform(): DesktopScriptPlatform {
   const platform = desktopScriptPlatform()
   if (!platform) {
diff --git a/src/main/computer/desktop-script-provider-runtime-host-routing.test.ts b/src/main/computer/desktop-script-provider-runtime-host-routing.test.ts
new file mode 100644
index 00000000000..e50a3878a11
--- /dev/null
+++ b/src/main/computer/desktop-script-provider-runtime-host-routing.test.ts
@@ -0,0 +1,139 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import {
+  bridgeProcessArgs,
+  createDesktopScriptProviderClient,
+  expectDesktopProviderSubprocessStartCount,
+  mockBridgeProcessFailure,
+  mockBridgeResponse,
+  resetDesktopScriptProviderTestHarness,
+  sampleCapabilities
+} from './desktop-script-provider-test-harness'
+import type { BridgeResponse } from './desktop-script-provider-types'
+import type { DesktopScriptRuntimeHost } from './desktop-script-runtime-host'
+import { RuntimeClientError } from './runtime-client-error'
+
+const POLICY_STDERR =
+  'File runtime.ps1 cannot be loaded because running scripts is disabled on this system. + CategoryInfo : SecurityError'
+
+function fakeRuntimeHost(request: DesktopScriptRuntimeHost['request']) {
+  const dispose = vi.fn()
+  return { host: { request, dispose } as unknown as DesktopScriptRuntimeHost, dispose }
+}
+
+describe('desktop script provider runtime host routing', () => {
+  afterEach(resetDesktopScriptProviderTestHarness)
+
+  it('serves Windows operations from the runtime host without spawning a one-shot bridge', async () => {
+    const request = vi.fn(
+      async () => ({ ok: true, capabilities: sampleCapabilities() }) as BridgeResponse
+    )
+    const { host } = fakeRuntimeHost(request)
+
+    const client = await createDesktopScriptProviderClient('windows', 'C:\\runtime.ps1', host)
+
+    await expect(client.capabilities()).resolves.toMatchObject({ platform: 'linux' })
+    expect(request).toHaveBeenCalledWith({ tool: 'handshake' })
+    expectDesktopProviderSubprocessStartCount(0)
+  })
+
+  it('maps runtime host operation failures without falling back to the one-shot bridge', async () => {
+    const { host } = fakeRuntimeHost(
+      vi.fn(async () => ({ ok: false, error: 'appBlocked("1Password")' }) as BridgeResponse)
+    )
+
+    const client = await createDesktopScriptProviderClient('windows', 'C:\\runtime.ps1', host)
+
+    await expect(client.listApps()).rejects.toMatchObject({ code: 'app_blocked' })
+    expectDesktopProviderSubprocessStartCount(0)
+  })
+
+  it('degrades to the one-shot bridge for the operations a host cannot serve', async () => {
+    const request = vi.fn(async () => {
+      throw new RuntimeClientError('runtime_host_unavailable', 'could not start')
+    })
+    const { host, dispose } = fakeRuntimeHost(request as never)
+    mockBridgeResponse({ ok: true, apps: [{ name: 'Notepad', pid: 42 }] })
+    mockBridgeResponse({ ok: true, apps: [{ name: 'Notepad', pid: 42 }] })
+
+    const client = await createDesktopScriptProviderClient('windows', 'C:\\runtime.ps1', host)
+
+    await expect(client.listApps()).resolves.toMatchObject({ apps: [{ pid: 42 }] })
+    await client.listApps()
+
+    // The host is kept and asked again: it owns its own cooldown, so one bad
+    // spawn must not stand the session down to a powershell.exe per click.
+    expect(request).toHaveBeenCalledTimes(2)
+    expect(dispose).not.toHaveBeenCalled()
+    expectDesktopProviderSubprocessStartCount(2)
+  })
+
+  it('returns to the runtime host once it recovers', async () => {
+    let healthy = false
+    const request = vi.fn(async () => {
+      if (!healthy) {
+        throw new RuntimeClientError('runtime_host_unavailable', 'could not start')
+      }
+      return { ok: true, apps: [] } as BridgeResponse
+    })
+    const { host } = fakeRuntimeHost(request)
+    mockBridgeResponse({ ok: true, apps: [] })
+
+    const client = await createDesktopScriptProviderClient('windows', 'C:\\runtime.ps1', host)
+
+    await client.listApps()
+    expectDesktopProviderSubprocessStartCount(1)
+
+    healthy = true
+    await expect(client.listApps()).resolves.toEqual({ apps: [] })
+    expectDesktopProviderSubprocessStartCount(1)
+  })
+
+  it('runs the one-shot bridge under RemoteSigned and falls back to Bypass once', async () => {
+    mockBridgeProcessFailure(POLICY_STDERR)
+    mockBridgeResponse({ ok: true, apps: [] })
+
+    const client = await createDesktopScriptProviderClient('windows', 'C:\\runtime.ps1')
+
+    await expect(client.listApps()).resolves.toEqual({ apps: [] })
+    expectDesktopProviderSubprocessStartCount(2)
+    expect(bridgeProcessArgs(0)).toContain('-NoLogo')
+    expect(bridgeProcessArgs(0)).toContain('RemoteSigned')
+    expect(bridgeProcessArgs(0)).not.toContain('Bypass')
+    expect(bridgeProcessArgs(1)).toContain('Bypass')
+  })
+
+  it('does not retry the one-shot bridge for a non-policy failure', async () => {
+    mockBridgeProcessFailure('No top-level UI Automation window is available for Notepad')
+
+    const client = await createDesktopScriptProviderClient('windows', 'C:\\runtime.ps1')
+
+    await expect(client.listApps()).rejects.toMatchObject({ code: 'window_not_found' })
+    expectDesktopProviderSubprocessStartCount(1)
+  })
+
+  it('never replays an operation whose own output merely mentions a policy error', async () => {
+    // Window titles and element names are user-controlled text that lands in
+    // stdout; matching them would double a click, a keystroke or a paste.
+    mockBridgeProcessFailure({
+      stdout: JSON.stringify({
+        ok: true,
+        snapshot: { windowTitle: 'SecurityError - UnauthorizedAccess.log - Notepad' }
+      }),
+      stderr: ''
+    })
+
+    const client = await createDesktopScriptProviderClient('windows', 'C:\\runtime.ps1')
+
+    await expect(client.listApps()).rejects.toBeInstanceOf(Error)
+    expectDesktopProviderSubprocessStartCount(1)
+  })
+
+  it('keeps Linux on the one-shot python bridge with no execution policy flags', async () => {
+    mockBridgeResponse({ ok: true, apps: [] })
+
+    const client = await createDesktopScriptProviderClient('linux', '/tmp/runtime.py')
+
+    await expect(client.listApps()).resolves.toEqual({ apps: [] })
+    expect(bridgeProcessArgs(0)).toEqual(['/tmp/runtime.py', expect.any(String)])
+  })
+})
diff --git a/src/main/computer/desktop-script-provider-test-harness.ts b/src/main/computer/desktop-script-provider-test-harness.ts
index 2cbd1e9a776..bcb0a4b0118 100644
--- a/src/main/computer/desktop-script-provider-test-harness.ts
+++ b/src/main/computer/desktop-script-provider-test-harness.ts
@@ -1,4 +1,5 @@
 import { expect, vi } from 'vitest'
+import type { DesktopScriptRuntimeHost } from './desktop-script-runtime-host'
 
 const { execFileMock, operationFiles, mkdtempMock, rmMock, writeFileMock } = vi.hoisted(() => {
   const files = new Map<string, string>()
@@ -23,12 +24,14 @@ vi.mock('fs/promises', () => ({
   writeFile: writeFileMock
 }))
 
+/** Builds a client on the one-shot bridge; pass a host to exercise serve mode. */
 export async function createDesktopScriptProviderClient(
   platform: 'linux' | 'windows',
-  executablePath: string
+  executablePath: string,
+  runtimeHost: DesktopScriptRuntimeHost | null = null
 ) {
   const { DesktopScriptProviderClient } = await import('./desktop-script-provider-client')
-  return new DesktopScriptProviderClient(platform, executablePath)
+  return new DesktopScriptProviderClient(platform, executablePath, runtimeHost)
 }
 
 export function resetDesktopScriptProviderTestHarness(): void {
@@ -77,6 +80,19 @@ export function mockBridgeResponse(
   })
 }
 
+export function mockBridgeProcessFailure(streams: string | { stdout?: string; stderr?: string }) {
+  const { stdout = '', stderr = '' } = typeof streams === 'string' ? { stderr: streams } : streams
+  execFileMock.mockImplementationOnce((_command, _args, _options, callback) => {
+    const done = callback as (error: Error | null, stdout: string, stderr: string) => void
+    done(new Error('Command failed'), stdout, stderr)
+    return null as never
+  })
+}
+
+export function bridgeProcessArgs(call: number): string[] {
+  return (execFileMock.mock.calls[call]?.[1] ?? []) as string[]
+}
+
 export function sampleBridgeSnapshot(name: string, value: string) {
   return {
     app: { name, bundleIdentifier: name, pid: 100 },
diff --git a/src/main/computer/desktop-script-provider-types.ts b/src/main/computer/desktop-script-provider-types.ts
index 0ff48e80b4f..6e474fdcf29 100644
--- a/src/main/computer/desktop-script-provider-types.ts
+++ b/src/main/computer/desktop-script-provider-types.ts
@@ -101,6 +101,8 @@ export type BridgeWindow = {
 
 export type BridgeResponse = {
   ok: boolean
+  /** Echo of BridgeRequest.requestId; set only on the persistent serve path. */
+  requestId?: number
   error?: string
   capabilities?: ComputerProviderCapabilities
   apps?: {
@@ -122,6 +124,8 @@ export type BridgeResponse = {
 
 export type BridgeRequest = {
   tool: string
+  /** Correlates a serve-mode reply with its request; the one-shot path omits it. */
+  requestId?: number
   app?: string
   element?: BridgeElement
   fromElement?: BridgeElement
diff --git a/src/main/computer/desktop-script-request-queue.ts b/src/main/computer/desktop-script-request-queue.ts
new file mode 100644
index 00000000000..8f32b5f6888
--- /dev/null
+++ b/src/main/computer/desktop-script-request-queue.ts
@@ -0,0 +1,73 @@
+import { RuntimeClientError } from './runtime-client-error'
+
+/**
+ * Serializes operations onto one helper and bounds how long one may wait its
+ * turn.
+ *
+ * Why the wait needs its own deadline: the in-flight timeout is armed only once
+ * a request reaches a helper, so a request behind N timing-out ones waited N
+ * times that timeout with no deadline of its own — bounded, but the caller sees
+ * an `await` that looks hung for minutes and gets no error to act on.
+ *
+ * Why only the wait: a request that reaches a helper still gets its full
+ * execution budget. A single deadline covering both would fail operations that
+ * queued briefly and would otherwise have succeeded.
+ */
+export class DesktopScriptRequestQueue {
+  /**
+   * Never rejects: downstream turns chain onto it, and a rejection here would
+   * be delivered to whichever request happened to queue behind the failure.
+   */
+  private tail: Promise<void> | null = null
+
+  constructor(
+    private readonly waitTimeoutMs: number,
+    /** Called when the queue empties, so the host can arm its idle shutdown. */
+    private readonly onDrained: () => void
+  ) {}
+
+  enqueue<T>(run: () => Promise<T>): Promise<T> {
+    const queued = this.tail
+    if (!queued) {
+      return this.track(run())
+    }
+    let expiry: RuntimeClientError | null = null
+    let waitTimer: NodeJS.Timeout | undefined
+    const waited = new Promise<never>((_resolve, reject) => {
+      waitTimer = setTimeout(() => {
+        expiry = new RuntimeClientError(
+          'action_timeout',
+          `desktop provider timed out after ${this.waitTimeoutMs}ms waiting for earlier operations`
+        )
+        reject(expiry)
+      }, this.waitTimeoutMs)
+      waitTimer.unref?.()
+    })
+    // An abandoned request is never handed to a helper. The caller has already
+    // been told it failed, and a click delivered after that is worse than none.
+    const turn = (): Promise<T> => {
+      clearTimeout(waitTimer)
+      return expiry ? Promise.reject(expiry) : run()
+    }
+    // The tail chains on the turn, not on the race: a caller giving up early
+    // must not release the next request while this one's predecessor is still
+    // in flight.
+    return Promise.race([waited, this.track(queued.then(turn, turn))])
+  }
+
+  private track<T>(result: Promise<T>): Promise<T> {
+    const tail = result.then(
+      () => undefined,
+      () => undefined
+    )
+    this.tail = tail
+    void tail.finally(() => {
+      if (this.tail !== tail) {
+        return
+      }
+      this.tail = null
+      this.onDrained()
+    })
+    return result
+  }
+}
diff --git a/src/main/computer/desktop-script-runtime-availability.ts b/src/main/computer/desktop-script-runtime-availability.ts
new file mode 100644
index 00000000000..58123f5eab7
--- /dev/null
+++ b/src/main/computer/desktop-script-runtime-availability.ts
@@ -0,0 +1,176 @@
+import {
+  FALLBACK_WINDOWS_EXECUTION_POLICY,
+  PREFERRED_WINDOWS_EXECUTION_POLICY,
+  type WindowsExecutionPolicy
+} from './windows-powershell-execution-policy'
+
+/**
+ * Consecutive child failures before the helper is believed dead, and how long
+ * the one-shot bridge covers for it afterwards.
+ *
+ * Why not a latch: every plausible cause is transient — a Defender scan touching
+ * the script mid-launch, a locked CSC temp directory failing one `Add-Type`,
+ * momentary memory pressure. Giving up permanently silently restores the
+ * per-click process burst the host exists to remove, and computer use keeps
+ * working throughout, so nothing looks wrong while the MDE signature returns.
+ */
+export const MAX_START_ATTEMPTS = 3
+export const START_FAILURE_COOLDOWN_MS = 60_000
+
+/**
+ * Why not `Date.now`: an NTP correction, a VM snapshot restore or a user changing
+ * the clock steps the wall clock backwards, which extended the cooldown by the
+ * size of the step. Nothing shortens it from there — only `recordSuccess` clears
+ * it, and no request can reach a helper to succeed while it holds — so a one-hour
+ * step disabled the persistent helper for the life of the sidecar, silently
+ * restoring the per-click process burst. Elapsed monotonic time cannot go
+ * backwards.
+ */
+const monotonicNowMs = (): number => performance.now()
+
+/**
+ * Whether the persistent helper is currently believed usable, and the execution
+ * policy it should be started under.
+ *
+ * Split from the host so the recovery rules are readable on their own: they are
+ * what stands between a transient bad spawn and a session that silently spends
+ * the rest of its life on one powershell.exe per click.
+ */
+export class RuntimeHostAvailability {
+  private policy: WindowsExecutionPolicy = PREFERRED_WINDOWS_EXECUTION_POLICY
+  private retryUnderFallbackPolicy = false
+  private consecutiveFailures = 0
+  private consecutiveSuccesses = 0
+  /** Null, not 0, for "no cooldown": `performance.now()` legitimately returns 0. */
+  private cooldownStartedAtMs: number | null = null
+  /**
+   * Set while the escalated policy has yet to start a helper, so a wrong
+   * diagnosis can be taken back.
+   *
+   * Why it can be wrong: AppLocker and WDAC constrained language mode raise
+   * PSSecurityException under the same SecurityError category a policy block
+   * uses, but they refuse the script at parse time, which `Bypass` cannot lift.
+   * Latching there would spend the session putting the most heavily weighted
+   * MDE token on every command line, on exactly the hardened hosts watching
+   * for it.
+   */
+  private fallbackPolicyUnproven = false
+
+  constructor(
+    private readonly cooldownMs: number,
+    /** Public so the host can report its own start attempts to the same sink. */
+    readonly warn: (message: string) => void,
+    /** Overridden only by tests; the default must stay monotonic. */
+    private readonly now: () => number = monotonicNowMs
+  ) {}
+
+  get executionPolicy(): WindowsExecutionPolicy {
+    return this.policy
+  }
+
+  get policyRetryPending(): boolean {
+    return this.retryUnderFallbackPolicy
+  }
+
+  get atPreferredPolicy(): boolean {
+    return this.policy === PREFERRED_WINDOWS_EXECUTION_POLICY
+  }
+
+  /** Milliseconds left before the host may try a helper again; 0 when it may. */
+  remainingCooldown(): number {
+    if (this.cooldownStartedAtMs === null) {
+      return 0
+    }
+    // Elapsed since the cooldown began, never a stored deadline: a deadline is
+    // only as trustworthy as the clock it was computed against.
+    return Math.max(0, Math.ceil(this.cooldownMs - (this.now() - this.cooldownStartedAtMs)))
+  }
+
+  requestPolicyRetry(): void {
+    this.retryUnderFallbackPolicy = true
+  }
+
+  escalateExecutionPolicy(): void {
+    this.retryUnderFallbackPolicy = false
+    this.policy = FALLBACK_WINDOWS_EXECUTION_POLICY
+    this.fallbackPolicyUnproven = true
+    // Sticky once proven: a genuinely Restricted machine would otherwise pay a
+    // guaranteed failed spawn per operation. Only a helper that produced no
+    // output at all can reach here, so a snapshot cannot talk the host into it.
+    this.warn(
+      `runtime host start blocked at ${PREFERRED_WINDOWS_EXECUTION_POLICY}; trying ${FALLBACK_WINDOWS_EXECUTION_POLICY}`
+    )
+  }
+
+  /** A helper started under the current policy, so the policy is the right one. */
+  confirmExecutionPolicy(): void {
+    this.fallbackPolicyUnproven = false
+  }
+
+  /**
+   * Undo an escalation the fallback never justified.
+   *
+   * The escalation is a diagnosis, and a fallback that cannot start a helper
+   * either disproves it: the policy was not what stopped the first attempt. Go
+   * back rather than latch, so a re-probe can escalate again later if the real
+   * cause clears. Re-probing costs one spawn per outage, which the failure
+   * count and its cooldown already bound, and never latching is the whole point
+   * of this class.
+   */
+  abandonUnprovenFallback(): void {
+    if (!this.fallbackPolicyUnproven) {
+      return
+    }
+    this.fallbackPolicyUnproven = false
+    this.policy = PREFERRED_WINDOWS_EXECUTION_POLICY
+    this.warn(
+      `${FALLBACK_WINDOWS_EXECUTION_POLICY} did not start a helper either, so the execution policy was not the cause; returning to ${PREFERRED_WINDOWS_EXECUTION_POLICY}`
+    )
+  }
+
+  recordFailure(): void {
+    this.consecutiveSuccesses = 0
+    this.consecutiveFailures++
+  }
+
+  /** True once a helper has died often enough that respawning is just thrash. */
+  get exhausted(): boolean {
+    return this.consecutiveFailures >= MAX_START_ATTEMPTS
+  }
+
+  recordSuccess(): void {
+    this.consecutiveSuccesses++
+    this.fallbackPolicyUnproven = false
+    // Why a clean run and not a single reply: a helper that answers one
+    // operation and dies on the next would otherwise reset the count forever,
+    // and respawn once per operation — the exact burst the host removes.
+    if (this.consecutiveSuccesses >= MAX_START_ATTEMPTS) {
+      this.consecutiveFailures = 0
+    }
+    if (this.cooldownStartedAtMs === null) {
+      return
+    }
+    this.cooldownStartedAtMs = null
+    this.warn('runtime host recovered; operations are served by the persistent helper again')
+  }
+
+  enterCooldown(): void {
+    // An escalation that never started a helper must not outlive the outage it
+    // was guessed from; the next one re-diagnoses from the preferred policy.
+    this.abandonUnprovenFallback()
+    const failures = this.consecutiveFailures
+    this.cooldownStartedAtMs = this.now()
+    // The wait is the penalty; leaving the count at the limit would charge twice
+    // and let the first death after recovery re-enter a full cooldown, so an
+    // interleaved workload would spend its life on the one-shot bridge.
+    this.consecutiveFailures = 0
+    this.consecutiveSuccesses = 0
+    this.warn(
+      `runtime host unavailable after ${failures} consecutive failures; falling back to one powershell.exe per operation for ${this.cooldownMs}ms`
+    )
+  }
+
+  clearCooldown(): void {
+    this.cooldownStartedAtMs = null
+  }
+}
diff --git a/src/main/computer/desktop-script-runtime-host.test.ts b/src/main/computer/desktop-script-runtime-host.test.ts
new file mode 100644
index 00000000000..4d42a3c3e37
--- /dev/null
+++ b/src/main/computer/desktop-script-runtime-host.test.ts
@@ -0,0 +1,857 @@
+import { EventEmitter } from 'node:events'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { ProcessSpec } from '../../shared/child-process/process-spec'
+import type { RuntimeChildProcess } from './desktop-script-serve-channel'
+import { DesktopScriptRuntimeHost, isRuntimeHostUnavailable } from './desktop-script-runtime-host'
+
+const POLICY_ERROR =
+  'File runtime.ps1 cannot be loaded because running scripts\nis disabled on this system.\n    + CategoryInfo : SecurityError'
+
+class FakeRuntimeChild extends EventEmitter {
+  readonly stdout = new EventEmitter()
+  readonly stderr = new EventEmitter()
+  readonly writes: string[] = []
+  killed = false
+  stdinEnded = false
+  /** Holds write callbacks so a late stdin failure can be fired deliberately. */
+  deferWrites = false
+  private readonly pendingWrites: ((error?: Error | null) => void)[] = []
+
+  readonly stdin = {
+    write: (chunk: string, callback?: (error?: Error | null) => void): boolean => {
+      this.writes.push(chunk)
+      if (this.deferWrites) {
+        if (callback) {
+          this.pendingWrites.push(callback)
+        }
+        return true
+      }
+      callback?.(null)
+      return true
+    },
+    end: (): void => {
+      this.stdinEnded = true
+    },
+    on: (): void => {}
+  }
+
+  kill(): boolean {
+    this.killed = true
+    return true
+  }
+
+  /** What a destroyed stdin does to writes still queued at teardown. */
+  failQueuedWrites(): void {
+    for (const callback of this.pendingWrites.splice(0)) {
+      callback(new Error('ERR_STREAM_DESTROYED'))
+    }
+  }
+
+  /** Fail one queued write, leaving later ones outstanding. */
+  failQueuedWrite(index: number): void {
+    this.pendingWrites.splice(index, 1)[0](new Error('EPIPE'))
+  }
+
+  /** Requests written to this child, decoded. */
+  requests(): Record<string, unknown>[] {
+    return this.writes.map((line) => JSON.parse(line) as Record<string, unknown>)
+  }
+
+  /** The id the host is currently waiting on, so replies can echo it. */
+  pendingId(): number {
+    return this.requests().at(-1)?.requestId as number
+  }
+
+  /** The announcement the real serve loop writes before its first read. */
+  ready(): void {
+    this.write('{"ready":true}\n')
+  }
+
+  respond(response: Record<string, unknown>, requestId = this.pendingId()): void {
+    this.write(`${JSON.stringify({ ...response, requestId })}\n`)
+  }
+
+  write(raw: string): void {
+    this.stdout.emit('data', Buffer.from(raw, 'utf8'))
+  }
+
+  exit(code: number | null, stderr = ''): void {
+    if (stderr) {
+      this.stderr.emit('data', Buffer.from(stderr, 'utf8'))
+    }
+    this.emit('close', code, null)
+  }
+}
+
+function createHost(
+  options: {
+    idleShutdownMs?: number
+    requestTimeoutMs?: number
+    cooldownMs?: number
+    now?: () => number
+    deferWrites?: boolean
+  } = {}
+) {
+  const children: FakeRuntimeChild[] = []
+  const specs: ProcessSpec[] = []
+  const warnings: string[] = []
+  const host = new DesktopScriptRuntimeHost('C:\\orca\\runtime.ps1', {
+    ...options,
+    powerShellPath: () => 'C:\\Windows\\System32\\powershell.exe',
+    warn: (message) => warnings.push(message),
+    spawn: (spec) => {
+      specs.push(spec)
+      const child = new FakeRuntimeChild()
+      child.deferWrites = options.deferWrites === true
+      children.push(child)
+      return child as unknown as RuntimeChildProcess
+    }
+  })
+  return { host, children, specs, warnings }
+}
+
+/** Let the host's queue microtasks drain so the next request reaches its child. */
+async function settle(): Promise<void> {
+  for (let index = 0; index < 6; index++) {
+    await Promise.resolve()
+  }
+}
+
+/** The wait the host reported, read back out of its refusal message. */
+function remainingCooldownMs(error: Error | null): number {
+  const match = /retrying the runtime host in (\d+)ms/.exec(error?.message ?? '')
+  return match ? Number(match[1]) : Number.NaN
+}
+
+/** Kill each helper the host starts, until it stops starting them. */
+async function failEveryStart(children: FakeRuntimeChild[], stderr: string): Promise<void> {
+  for (let index = 0; index < 8; index++) {
+    if (index >= children.length) {
+      return
+    }
+    children[index].exit(1, stderr)
+    await settle()
+  }
+}
+
+describe('DesktopScriptRuntimeHost', () => {
+  afterEach(() => {
+    vi.useRealTimers()
+    vi.restoreAllMocks()
+  })
+
+  it('starts one helper for many operations and never writes an operation file', async () => {
+    const { host, children, specs } = createHost()
+
+    const first = host.request({ tool: 'handshake' })
+    await settle()
+    children[0].respond({ ok: true, capabilities: {} })
+    await expect(first).resolves.toMatchObject({ ok: true })
+
+    for (let index = 0; index < 5; index++) {
+      const next = host.request({ tool: 'click', app: 'Notepad' })
+      await settle()
+      children[0].respond({ ok: true, action: { path: 'synthetic' } })
+      await expect(next).resolves.toMatchObject({ ok: true })
+    }
+
+    expect(children).toHaveLength(1)
+    expect(children[0].requests()).toHaveLength(6)
+    expect(specs[0].args).toEqual([
+      '-NoLogo',
+      '-NoProfile',
+      '-NonInteractive',
+      '-ExecutionPolicy',
+      'RemoteSigned',
+      '-File',
+      'C:\\orca\\runtime.ps1',
+      '-Serve'
+    ])
+    host.dispose()
+  })
+
+  it('serializes requests so only one operation is ever in flight', async () => {
+    const { host, children } = createHost()
+
+    const first = host.request({ tool: 'click', app: 'A' })
+    const second = host.request({ tool: 'click', app: 'B' })
+    await settle()
+
+    expect(children[0].requests()).toEqual([{ tool: 'click', app: 'A', requestId: 1 }])
+
+    children[0].respond({ ok: true, action: { path: 'synthetic' } })
+    await expect(first).resolves.toMatchObject({ ok: true })
+    await settle()
+
+    expect(children[0].requests()).toHaveLength(2)
+    children[0].respond({ ok: true, action: { path: 'accessibility' } })
+    await expect(second).resolves.toMatchObject({ ok: true })
+    host.dispose()
+  })
+
+  it('strips the echoed id from the response it hands back', async () => {
+    const { host, children } = createHost()
+    const promise = host.request({ tool: 'handshake' })
+    await settle()
+    children[0].respond({ ok: true, capabilities: {} })
+
+    await expect(promise).resolves.toEqual({ ok: true, capabilities: {} })
+    host.dispose()
+  })
+
+  it('reassembles a response split across chunks, including a split code point', async () => {
+    const { host, children } = createHost()
+    const promise = host.request({ tool: 'get_app_state', app: 'Editor' })
+    await settle()
+
+    const payload = Buffer.from(
+      `${JSON.stringify({ ok: true, snapshot: { app: 'né' }, requestId: 1 })}\r\n`,
+      'utf8'
+    )
+    const split = payload.indexOf(Buffer.from('é', 'utf8')) + 1
+    children[0].stdout.emit('data', payload.subarray(0, split))
+    children[0].stdout.emit('data', payload.subarray(split))
+
+    await expect(promise).resolves.toEqual({ ok: true, snapshot: { app: 'né' } })
+    host.dispose()
+  })
+
+  it('kills the helper rather than answering a request with another reply', async () => {
+    const { host, children } = createHost()
+
+    const first = host.request({ tool: 'handshake' })
+    await settle()
+    // A stray line would otherwise shift every later response by one.
+    children[0].respond({ ok: true, capabilities: {} }, 999)
+
+    await expect(first).rejects.toThrow(/did not match the pending request/)
+    expect(children[0].killed).toBe(true)
+    host.dispose()
+  })
+
+  it('kills the helper when an unsolicited line arrives with nothing pending', async () => {
+    const { host, children } = createHost()
+
+    const first = host.request({ tool: 'handshake' })
+    await settle()
+    children[0].respond({ ok: true, capabilities: {} })
+    await first
+
+    children[0].write(`${JSON.stringify({ ok: true, requestId: 77 })}\n`)
+    expect(children[0].killed).toBe(true)
+    host.dispose()
+  })
+
+  it('times out a wedged operation and starts a fresh helper for the next one', async () => {
+    vi.useFakeTimers()
+    const { host, children } = createHost({ requestTimeoutMs: 30_000 })
+
+    const promise = host.request({ tool: 'click', app: 'Frozen' })
+    await settle()
+    await vi.advanceTimersByTimeAsync(30_001)
+
+    await expect(promise).rejects.toMatchObject({ code: 'action_timeout' })
+    expect(children[0].killed).toBe(true)
+
+    const next = host.request({ tool: 'handshake' })
+    await settle()
+    expect(children).toHaveLength(2)
+    children[1].respond({ ok: true, capabilities: {} })
+    await expect(next).resolves.toMatchObject({ ok: true })
+    host.dispose()
+  })
+
+  it('rejects the in-flight request when a working helper crashes, then restarts', async () => {
+    const { host, children } = createHost()
+
+    const first = host.request({ tool: 'handshake' })
+    await settle()
+    children[0].respond({ ok: true, capabilities: {} })
+    await first
+
+    const second = host.request({ tool: 'click', app: 'Notepad' })
+    await settle()
+    children[0].exit(1, 'boom')
+
+    await expect(second).rejects.toMatchObject({ code: 'accessibility_error' })
+    await expect(second).rejects.toThrow(/runtime host exited/)
+
+    const third = host.request({ tool: 'handshake' })
+    await settle()
+    expect(children).toHaveLength(2)
+    children[1].respond({ ok: true, capabilities: {} })
+    await expect(third).resolves.toMatchObject({ ok: true })
+    host.dispose()
+  })
+
+  it('stops respawning a helper that dies on every second operation', async () => {
+    let clock = 1_000
+    const { host, children } = createHost({ cooldownMs: 60_000, now: () => clock })
+
+    // One good answer per helper is exactly the pattern that used to respawn
+    // forever: the success reset the failure count before it could ever trip.
+    for (let round = 0; round < 3; round++) {
+      const good = host.request({ tool: 'handshake' })
+      await settle()
+      children.at(-1)?.respond({ ok: true, capabilities: {} })
+      await expect(good).resolves.toMatchObject({ ok: true })
+      await settle()
+
+      const crash = host.request({ tool: 'click', app: 'Crashy' })
+      await settle()
+      children.at(-1)?.exit(1, 'boom')
+      await expect(crash).rejects.toThrow(/runtime host exited/)
+      await settle()
+    }
+
+    const spawned = children.length
+    await expect(host.request({ tool: 'handshake' })).rejects.toSatisfy(isRuntimeHostUnavailable)
+    expect(children).toHaveLength(spawned)
+    host.dispose()
+  })
+
+  it('keeps serving a healthy helper after an isolated crash', async () => {
+    const { host, children } = createHost({ cooldownMs: 60_000 })
+
+    const crashed = host.request({ tool: 'handshake' })
+    await settle()
+    children[0].respond({ ok: true, capabilities: {} })
+    await crashed
+    const second = host.request({ tool: 'click', app: 'Notepad' })
+    await settle()
+    children[0].exit(1, 'boom')
+    await expect(second).rejects.toThrow(/runtime host exited/)
+
+    for (let index = 0; index < 4; index++) {
+      const next = host.request({ tool: 'handshake' })
+      await settle()
+      children.at(-1)?.respond({ ok: true, capabilities: {} })
+      await expect(next).resolves.toMatchObject({ ok: true })
+    }
+
+    // A clean run clears the count, so one bad helper cannot degrade a good one.
+    expect(children).toHaveLength(2)
+    host.dispose()
+  })
+
+  it('stops respawning a helper that keeps answering the wrong request', async () => {
+    let clock = 1_000
+    const { host, children } = createHost({ cooldownMs: 60_000, now: () => clock })
+
+    // Desync is host-detected, so it bypassed the exit handler entirely: without
+    // its own accounting this respawned once per operation, forever.
+    for (let round = 0; round < 3; round++) {
+      const promise = host.request({ tool: 'handshake' })
+      await settle()
+      const child = children.at(-1)
+      child?.respond({ ok: true, capabilities: {} }, child.pendingId() + 500)
+      await expect(promise).rejects.toThrow(/did not match the pending request/)
+      await settle()
+    }
+
+    const spawned = children.length
+    await expect(host.request({ tool: 'handshake' })).rejects.toSatisfy(isRuntimeHostUnavailable)
+    expect(children).toHaveLength(spawned)
+    host.dispose()
+  })
+
+  it('stops respawning a helper that times out on every operation', async () => {
+    vi.useFakeTimers()
+    let clock = 1_000
+    const { host, children } = createHost({
+      requestTimeoutMs: 1_000,
+      cooldownMs: 60_000,
+      now: () => clock
+    })
+
+    for (let round = 0; round < 3; round++) {
+      const promise = host.request({ tool: 'get_app_state', app: 'Frozen' })
+      await settle()
+      await vi.advanceTimersByTimeAsync(1_001)
+      await expect(promise).rejects.toMatchObject({ code: 'action_timeout' })
+      await settle()
+    }
+
+    const spawned = children.length
+    await expect(host.request({ tool: 'handshake' })).rejects.toSatisfy(isRuntimeHostUnavailable)
+    expect(children).toHaveLength(spawned)
+    host.dispose()
+  })
+
+  it('never re-sends a mutation to a fresh helper after a pre-answer death', async () => {
+    const { host, children } = createHost()
+
+    const promise = host.request({ tool: 'click', app: 'Notepad', x: 10, y: 10 })
+    await settle()
+    children[0].exit(1, 'Add-Type : Cannot access the temporary directory')
+
+    // The click may already have landed inside the helper that died; replaying
+    // it would click twice. An observation in the same position is retried.
+    await expect(promise).rejects.toSatisfy(isRuntimeHostUnavailable)
+    expect(children).toHaveLength(1)
+    host.dispose()
+  })
+
+  it('never replays a mutation once the helper announced it was reading', async () => {
+    const { host, children } = createHost()
+
+    const promise = host.request({ tool: 'click', app: 'Notepad', x: 10, y: 10 })
+    await settle()
+    children[0].ready()
+    // Past the announcement the click may already have been synthesized: the
+    // snapshot that follows it is the fault-prone part, so a missing reply
+    // proves nothing about whether the input landed.
+    children[0].exit(1, 'faulting module gdiplus.dll')
+
+    await expect(promise).rejects.toThrow(/runtime host exited/)
+    expect(children).toHaveLength(1)
+    host.dispose()
+  })
+
+  it('replays a mutation only for a helper that died before announcing readiness', async () => {
+    const { host, children } = createHost()
+
+    const first = host.request({ tool: 'handshake' })
+    await settle()
+    children[0].ready()
+    children[0].respond({ ok: true, capabilities: {} })
+    await first
+
+    const crashed = host.request({ tool: 'click', app: 'Notepad', x: 1, y: 1 })
+    await settle()
+    children[0].exit(1, 'boom')
+    await expect(crashed).rejects.toThrow(/runtime host exited/)
+
+    const retried = host.request({ tool: 'click', app: 'Notepad', x: 1, y: 1 })
+    await settle()
+    // This helper never announced, so it cannot have read the click: replaying
+    // is a fact rather than a guess, and the caller never sees the stumble.
+    children[1].exit(1, 'Add-Type : Cannot access the temporary directory')
+    await settle()
+
+    expect(children).toHaveLength(3)
+    children[2].ready()
+    children[2].respond({ ok: true, action: { path: 'synthetic' } })
+    await expect(retried).resolves.toMatchObject({ ok: true })
+    host.dispose()
+  })
+
+  it('does not treat the readiness announcement as an unmatched reply', async () => {
+    const { host, children } = createHost()
+
+    const promise = host.request({ tool: 'handshake' })
+    await settle()
+    children[0].ready()
+
+    expect(children[0].killed).toBe(false)
+    children[0].respond({ ok: true, capabilities: {} })
+    await expect(promise).resolves.toEqual({ ok: true, capabilities: {} })
+    host.dispose()
+  })
+
+  it('charges one cooldown per outage, not one per later death', async () => {
+    let clock = 1_000
+    const { host, children } = createHost({ cooldownMs: 60_000, now: () => clock })
+
+    const failed = host.request({ tool: 'handshake' })
+    await settle()
+    await failEveryStart(children, 'The term is not recognized')
+    await expect(failed).rejects.toSatisfy(isRuntimeHostUnavailable)
+
+    clock += 61_000
+    const recovered = host.request({ tool: 'handshake' })
+    await settle()
+    children.at(-1)?.respond({ ok: true, capabilities: {} })
+    await recovered
+
+    // One death after recovery must not re-enter a full cooldown; the previous
+    // outage was already paid for.
+    const crashed = host.request({ tool: 'handshake' })
+    await settle()
+    children.at(-1)?.exit(1, 'boom')
+    await expect(crashed).rejects.toBeInstanceOf(Error)
+
+    const next = host.request({ tool: 'handshake' })
+    await settle()
+    children.at(-1)?.respond({ ok: true, capabilities: {} })
+    await expect(next).resolves.toMatchObject({ ok: true })
+    host.dispose()
+  })
+
+  it('charges one failure when a write fails after the helper was torn down', async () => {
+    const { host, children, warnings } = createHost({ deferWrites: true })
+
+    const promise = host.request({ tool: 'handshake' })
+    await settle()
+    children[0].respond({ ok: true, capabilities: {} }, 999)
+    await expect(promise).rejects.toThrow(/did not match the pending request/)
+
+    // stop() destroys stdin, so the queued write calls back with an error. That
+    // is the same operation failing, not a second one, and counting it twice
+    // would drive a 3-strike cooldown at half the intended rate.
+    children[0].failQueuedWrites()
+
+    expect(warnings.filter((line) => /helper stopped/.test(line))).toHaveLength(1)
+    host.dispose()
+  })
+
+  it('never lets a stale write error stop a replacement helper', async () => {
+    const { host, children } = createHost({ deferWrites: true })
+
+    const first = host.request({ tool: 'handshake' })
+    await settle()
+    children[0].respond({ ok: true, capabilities: {} }, 999)
+    await expect(first).rejects.toBeInstanceOf(Error)
+
+    const second = host.request({ tool: 'handshake' })
+    await settle()
+    expect(children).toHaveLength(2)
+
+    // The late callback belongs to a channel and a request that are both gone.
+    children[0].failQueuedWrites()
+
+    expect(children[1].killed).toBe(false)
+    children[1].respond({ ok: true, capabilities: {} })
+    await expect(second).resolves.toMatchObject({ ok: true })
+    host.dispose()
+  })
+
+  it('ignores a write error for a request that already finished', async () => {
+    const { host, children } = createHost({ deferWrites: true })
+
+    const first = host.request({ tool: 'handshake' })
+    await settle()
+    children[0].respond({ ok: true, capabilities: {} })
+    await first
+
+    const second = host.request({ tool: 'handshake' })
+    await settle()
+
+    // Backpressure can hold a write callback past its own response. The channel
+    // is alive and was never stopped, so only the request id can tell that this
+    // report is stale — this is what pins the host-side guard on its own.
+    children[0].failQueuedWrite(0)
+
+    expect(children[0].killed).toBe(false)
+    children[0].respond({ ok: true, capabilities: {} })
+    await expect(second).resolves.toMatchObject({ ok: true })
+    host.dispose()
+  })
+
+  it('shuts the helper down when idle and starts a new one on the next operation', async () => {
+    vi.useFakeTimers()
+    const { host, children } = createHost({ idleShutdownMs: 60_000 })
+
+    const first = host.request({ tool: 'handshake' })
+    await settle()
+    children[0].respond({ ok: true, capabilities: {} })
+    await first
+    await settle()
+
+    expect(children[0].killed).toBe(false)
+    await vi.advanceTimersByTimeAsync(60_001)
+    expect(children[0].stdinEnded).toBe(true)
+    expect(children[0].killed).toBe(true)
+
+    const next = host.request({ tool: 'handshake' })
+    await settle()
+    expect(children).toHaveLength(2)
+    children[1].respond({ ok: true, capabilities: {} })
+    await expect(next).resolves.toMatchObject({ ok: true })
+    host.dispose()
+  })
+
+  it('disposes the helper and rejects the in-flight request', async () => {
+    const { host, children } = createHost()
+    const promise = host.request({ tool: 'click', app: 'Notepad' })
+    await settle()
+
+    host.dispose()
+
+    expect(children[0].stdinEnded).toBe(true)
+    expect(children[0].killed).toBe(true)
+    await expect(promise).rejects.toThrow(/shut down/)
+  })
+
+  it('never respawns for a request queued behind dispose', async () => {
+    const { host, children } = createHost()
+    const first = host.request({ tool: 'handshake' })
+    const queued = host.request({ tool: 'handshake' })
+    await settle()
+
+    host.dispose()
+    await expect(first).rejects.toBeInstanceOf(Error)
+    await expect(queued).rejects.toSatisfy(isRuntimeHostUnavailable)
+    await settle()
+
+    expect(children).toHaveLength(1)
+  })
+
+  it('falls back to Bypass once when the execution policy blocks the start', async () => {
+    const { host, children, specs, warnings } = createHost()
+
+    const promise = host.request({ tool: 'handshake' })
+    await settle()
+    children[0].exit(1, POLICY_ERROR)
+    await settle()
+
+    expect(children).toHaveLength(2)
+    expect(specs[1].args).toContain('Bypass')
+    children[1].respond({ ok: true, capabilities: {} })
+    await expect(promise).resolves.toMatchObject({ ok: true })
+    expect(warnings.some((line) => /trying Bypass/.test(line))).toBe(true)
+
+    // A helper started under Bypass, so the diagnosis is proven and the fallback
+    // is remembered for the session rather than re-probed per call.
+    const next = host.request({ tool: 'handshake' })
+    await settle()
+    expect(children).toHaveLength(2)
+    children[1].respond({ ok: true, capabilities: {} })
+    await next
+    expect(warnings.some((line) => /returning to RemoteSigned/.test(line))).toBe(false)
+    host.dispose()
+  })
+
+  it('returns to RemoteSigned when Bypass does not start a helper either', async () => {
+    let clock = 1_000
+    const { host, children, specs, warnings } = createHost({ cooldownMs: 60_000, now: () => clock })
+
+    // What AppLocker and WDAC constrained language mode look like: the same
+    // SecurityError category, but the block is at script load, so Bypass cannot
+    // lift it and the escalation was a misdiagnosis.
+    const promise = host.request({ tool: 'handshake' })
+    await settle()
+    await failEveryStart(children, POLICY_ERROR)
+    await expect(promise).rejects.toSatisfy(isRuntimeHostUnavailable)
+
+    expect(specs[1].args).toContain('Bypass')
+    expect(warnings.some((line) => /returning to RemoteSigned/.test(line))).toBe(true)
+    // The revert lands inside the outage, not just at its end: every attempt
+    // after the fallback is disproved is back on the preferred policy, so the
+    // misdiagnosis costs one Bypass command line rather than one per attempt.
+    expect(specs).toHaveLength(3)
+    expect(specs[2].args).not.toContain('Bypass')
+
+    // Latching here would put the most heavily weighted MDE token on every
+    // later command line, on exactly the hardened host that is watching.
+    clock += 61_000
+    const recovered = host.request({ tool: 'handshake' })
+    await settle()
+    expect(specs.at(-1)?.args).not.toContain('Bypass')
+    children.at(-1)?.respond({ ok: true, capabilities: {} })
+    await expect(recovered).resolves.toMatchObject({ ok: true })
+    host.dispose()
+  })
+
+  it('reports itself unavailable when Bypass is also refused', async () => {
+    const { host, children } = createHost()
+
+    const promise = host.request({ tool: 'handshake' })
+    await settle()
+    await failEveryStart(children, POLICY_ERROR)
+
+    await expect(promise).rejects.toSatisfy(isRuntimeHostUnavailable)
+    host.dispose()
+  })
+
+  it('reports itself unavailable when the helper cannot be spawned at all', async () => {
+    const host = new DesktopScriptRuntimeHost('C:\\orca\\runtime.ps1', {
+      powerShellPath: () => 'C:\\Windows\\System32\\powershell.exe',
+      warn: () => {},
+      spawn: () => {
+        throw new Error('spawn ENOENT')
+      }
+    })
+
+    await expect(host.request({ tool: 'handshake' })).rejects.toSatisfy(isRuntimeHostUnavailable)
+    host.dispose()
+  })
+
+  it('retries a transient pre-answer death without the caller ever seeing it', async () => {
+    const { host, children } = createHost()
+
+    const promise = host.request({ tool: 'handshake' })
+    await settle()
+    children[0].exit(1, 'Add-Type : Cannot access the temporary directory')
+    await settle()
+
+    expect(children).toHaveLength(2)
+    children[1].respond({ ok: true, capabilities: {} })
+
+    await expect(promise).resolves.toMatchObject({ ok: true })
+    host.dispose()
+  })
+
+  it('gives up only after repeated start failures, then serves from the host again after the cooldown', async () => {
+    let clock = 1_000
+    const { host, children, warnings } = createHost({ cooldownMs: 60_000, now: () => clock })
+
+    const failed = host.request({ tool: 'handshake' })
+    await settle()
+    await failEveryStart(children, 'The term is not recognized')
+    await expect(failed).rejects.toSatisfy(isRuntimeHostUnavailable)
+
+    const attempts = children.length
+    expect(attempts).toBe(3)
+
+    // Inside the cooldown the host stays out of the way without respawning.
+    clock += 30_000
+    await expect(host.request({ tool: 'handshake' })).rejects.toSatisfy(isRuntimeHostUnavailable)
+    expect(children).toHaveLength(attempts)
+
+    // Past it, the next operation re-probes rather than staying degraded forever.
+    clock += 31_000
+    const recovered = host.request({ tool: 'handshake' })
+    await settle()
+    expect(children).toHaveLength(attempts + 1)
+    children[attempts].respond({ ok: true, capabilities: {} })
+    await expect(recovered).resolves.toMatchObject({ ok: true })
+
+    expect(warnings.at(-1)).toMatch(/recovered/)
+    host.dispose()
+  })
+
+  it('keeps the helper account of a reply it could not tag', async () => {
+    const { host, children } = createHost()
+
+    const promise = host.request({ tool: 'handshake' })
+    await settle()
+    const child = children[0]
+    // What an old runtime.ps1 sends when a request will not parse: a real error,
+    // with no id to route it by. The desync is honest, but replacing its message
+    // reports a broken stream and loses the only account of the cause.
+    child.respond({ ok: false, error: 'Invalid object passed in' }, child.pendingId() + 500)
+
+    await expect(promise).rejects.toThrow(
+      /did not match the pending request: Invalid object passed in/
+    )
+    host.dispose()
+  })
+
+  it('does not charge a cooldown for requests the helper rejects as malformed', async () => {
+    const { host, children } = createHost({ cooldownMs: 60_000 })
+
+    // A tagged error is the helper working, not failing. Three of them used to
+    // arrive untagged, and three desync aborts is exactly the cooldown.
+    for (let round = 0; round < 3; round++) {
+      const promise = host.request({ tool: 'handshake' })
+      await settle()
+      children[0].respond({ ok: false, error: 'Invalid object passed in' })
+      await expect(promise).resolves.toMatchObject({ ok: false })
+      await settle()
+    }
+
+    expect(children).toHaveLength(1)
+    const next = host.request({ tool: 'handshake' })
+    await settle()
+    children[0].respond({ ok: true, capabilities: {} })
+    await expect(next).resolves.toMatchObject({ ok: true })
+    host.dispose()
+  })
+
+  it('fails a request that spends its whole timeout queued behind others', async () => {
+    vi.useFakeTimers()
+    const { host, children } = createHost({ requestTimeoutMs: 1_000 })
+
+    // Two ahead of it, because one puts the turn exactly on the deadline.
+    const first = host.request({ tool: 'get_app_state', app: 'Frozen' })
+    const second = host.request({ tool: 'get_app_state', app: 'Frozen' })
+    const queued = host.request({ tool: 'click', app: 'Notepad' })
+    // Asserted before the clock moves: both reject while the test is still
+    // inside advanceTimersByTimeAsync.
+    const firstFailed = expect(first).rejects.toMatchObject({ code: 'action_timeout' })
+    // Its own deadline, not the one it would inherit by reaching the head.
+    const queuedFailed = expect(queued).rejects.toMatchObject({
+      code: 'action_timeout',
+      message: /waiting for earlier operations/
+    })
+    await settle()
+    expect(children[0].requests()).toHaveLength(1)
+
+    await vi.advanceTimersByTimeAsync(1_001)
+    await firstFailed
+    await queuedFailed
+
+    // Drain past the abandoned request: it is never handed to a helper, because
+    // a click the caller has been told failed must not still land.
+    children[1].respond({ ok: true, state: {} })
+    await expect(second).resolves.toMatchObject({ ok: true })
+    await settle()
+    expect(children.flatMap((child) => child.requests())).not.toContainEqual(
+      expect.objectContaining({ tool: 'click' })
+    )
+
+    // The request that gave up does not poison the queue behind it.
+    const next = host.request({ tool: 'handshake' })
+    await settle()
+    children[1].respond({ ok: true, capabilities: {} })
+    await expect(next).resolves.toMatchObject({ ok: true })
+    host.dispose()
+  })
+
+  it('gives a queued request its full timeout once it reaches the helper', async () => {
+    vi.useFakeTimers()
+    const { host, children } = createHost({ requestTimeoutMs: 1_000 })
+
+    const head = host.request({ tool: 'handshake' })
+    const queued = host.request({ tool: 'get_app_state', app: 'Slow' })
+    await settle()
+
+    await vi.advanceTimersByTimeAsync(900)
+    children[0].respond({ ok: true, capabilities: {} })
+    await expect(head).resolves.toMatchObject({ ok: true })
+    await settle()
+
+    // Past the point the enqueue deadline would have fired: waiting its turn
+    // must not eat the budget the operation itself is entitled to.
+    await vi.advanceTimersByTimeAsync(900)
+    children[0].respond({ ok: true, state: {} })
+    await expect(queued).resolves.toMatchObject({ ok: true })
+    host.dispose()
+  })
+
+  // Both of these deliberately leave `now` unset: the bug was in the default the
+  // host picks, so a test that injects a clock cannot see it.
+  it('does not stretch the cooldown when the wall clock steps backwards', async () => {
+    const wallClock = vi.spyOn(Date, 'now').mockReturnValue(2_000_000_000_000)
+    const { host, children } = createHost({ cooldownMs: 60_000 })
+
+    const failed = host.request({ tool: 'handshake' })
+    await settle()
+    await failEveryStart(children, 'The term is not recognized')
+    await expect(failed).rejects.toSatisfy(isRuntimeHostUnavailable)
+
+    // An NTP correction, a VM snapshot restore, a user changing the clock.
+    wallClock.mockReturnValue(2_000_000_000_000 - 3_600_000)
+
+    const refused = await host.request({ tool: 'handshake' }).then(
+      () => null,
+      (error: Error) => error
+    )
+    expect(refused?.message).toMatch(/retrying the runtime host in/)
+    expect(remainingCooldownMs(refused)).toBeLessThanOrEqual(60_000)
+    host.dispose()
+  })
+
+  it('serves from the persistent helper again after a backwards clock step', async () => {
+    vi.spyOn(Date, 'now').mockReturnValue(2_000_000_000_000)
+    const { host, children } = createHost({ cooldownMs: 25 })
+
+    const failed = host.request({ tool: 'handshake' })
+    await settle()
+    await failEveryStart(children, 'The term is not recognized')
+    await expect(failed).rejects.toSatisfy(isRuntimeHostUnavailable)
+    const attempts = children.length
+
+    vi.mocked(Date.now).mockReturnValue(2_000_000_000_000 - 3_600_000)
+    // Real elapsed time, because the clock under test is the real monotonic one.
+    await new Promise((resolve) => setTimeout(resolve, 60))
+
+    const recovered = host.request({ tool: 'handshake' })
+    await settle()
+    expect(children).toHaveLength(attempts + 1)
+    children[attempts].respond({ ok: true, capabilities: {} })
+    await expect(recovered).resolves.toMatchObject({ ok: true })
+    host.dispose()
+  })
+})
diff --git a/src/main/computer/desktop-script-runtime-host.ts b/src/main/computer/desktop-script-runtime-host.ts
new file mode 100644
index 00000000000..09aff5ec479
--- /dev/null
+++ b/src/main/computer/desktop-script-runtime-host.ts
@@ -0,0 +1,384 @@
+import { spawnProcess } from '../../shared/child-process/run-process'
+import { windowsPowerShellPath } from '../../shared/child-process/windows-system-binary'
+import { reportComputerDiagnostic } from './computer-sidecar-diagnostics'
+import { isReplayableTool } from './desktop-script-action'
+import type { BridgeRequest, BridgeResponse } from './desktop-script-provider-types'
+import { DesktopScriptRequestQueue } from './desktop-script-request-queue'
+import {
+  startServeChannel,
+  type DesktopScriptServeChannel,
+  type RuntimeProcessSpawn
+} from './desktop-script-serve-channel'
+import {
+  MAX_START_ATTEMPTS,
+  RuntimeHostAvailability,
+  START_FAILURE_COOLDOWN_MS
+} from './desktop-script-runtime-availability'
+import { RuntimeClientError } from './runtime-client-error'
+import {
+  isExecutionPolicyBlocked,
+  windowsPowerShellRuntimeArgs
+} from './windows-powershell-execution-policy'
+
+const REQUEST_TIMEOUT_MS = 30_000
+const IDLE_SHUTDOWN_MS = 120_000
+
+/** Code the client keys on to serve this one operation from the one-shot bridge. */
+export const RUNTIME_HOST_UNAVAILABLE = 'runtime_host_unavailable'
+
+export type DesktopScriptRuntimeHostOptions = {
+  spawn?: RuntimeProcessSpawn
+  powerShellPath?: () => string
+  requestTimeoutMs?: number
+  idleShutdownMs?: number
+  cooldownMs?: number
+  now?: () => number
+  warn?: (message: string) => void
+}
+
+type PendingRequest = {
+  id: number
+  resolve: (response: BridgeResponse) => void
+  reject: (error: Error) => void
+  timer: NodeJS.Timeout
+}
+
+export function isRuntimeHostUnavailable(error: unknown): boolean {
+  return error instanceof RuntimeClientError && error.code === RUNTIME_HOST_UNAVAILABLE
+}
+
+/**
+ * One long-lived `runtime.ps1 -Serve` process serving every computer-use
+ * operation over NDJSON on stdin/stdout.
+ *
+ * Why persistent: the one-shot bridge started a powershell.exe per click, and
+ * each one re-emitted the script's inline `Add-Type` P/Invoke assembly, which
+ * Defender for Endpoint reports as suspicious MSIL emission alongside the
+ * screen capture. Compiling once per session collapses a burst of short-lived
+ * PIDs into a single process.
+ *
+ * Requests are strictly serialized, and each carries an id the helper echoes.
+ * Serialization alone would leave a single stray line answering every later
+ * request with the previous response — silently acting on stale element
+ * indexes, with no error raised — so the id is checked and a mismatch is fatal
+ * to the child rather than merely logged.
+ */
+export class DesktopScriptRuntimeHost {
+  private channel: DesktopScriptServeChannel | null = null
+  private pending: PendingRequest | null = null
+  private idleTimer: NodeJS.Timeout | null = null
+  private childReady = false
+  private childAnswered = false
+  /**
+   * Set once any helper has announced itself, which proves the script on disk
+   * speaks the ready protocol. Until then a mutating request is not replayed
+   * even on a clean start failure, because ORCA_COMPUTER_DESKTOP_SCRIPT_PROVIDER_PATH
+   * can point at an older runtime.ps1 that simply never announces.
+   */
+  private readyProtocolConfirmed = false
+  private disposed = false
+  private nextRequestId = 1
+  private readonly availability: RuntimeHostAvailability
+  private readonly queue: DesktopScriptRequestQueue
+  private readonly requestTimeoutMs: number
+  private readonly idleShutdownMs: number
+
+  constructor(
+    private readonly scriptPath: string,
+    private readonly options: DesktopScriptRuntimeHostOptions = {}
+  ) {
+    this.requestTimeoutMs = options.requestTimeoutMs ?? REQUEST_TIMEOUT_MS
+    this.idleShutdownMs = options.idleShutdownMs ?? IDLE_SHUTDOWN_MS
+    this.queue = new DesktopScriptRequestQueue(this.requestTimeoutMs, () => this.armIdleTimer())
+    this.availability = new RuntimeHostAvailability(
+      options.cooldownMs ?? START_FAILURE_COOLDOWN_MS,
+      (message) => (options.warn ?? reportComputerDiagnostic)(message),
+      options.now
+    )
+  }
+
+  request(request: BridgeRequest): Promise<BridgeResponse> {
+    return this.queue.enqueue(() => this.send(request))
+  }
+
+  /** Permanently stop this host. Callers build a new one for a new session. */
+  dispose(): void {
+    this.disposed = true
+    this.clearIdleTimer()
+    this.availability.clearCooldown()
+    this.stopChannel()
+    this.rejectPending(
+      new RuntimeClientError('accessibility_error', 'desktop provider runtime host was shut down')
+    )
+  }
+
+  private async send(request: BridgeRequest): Promise<BridgeResponse> {
+    this.clearIdleTimer()
+    // Why checked here and not only on entry: requests queue, and dispose can
+    // land while one waits its turn. Without this a teardown respawns a helper.
+    if (this.disposed) {
+      throw this.unavailableError('runtime host was disposed')
+    }
+    const cooldown = this.availability.remainingCooldown()
+    if (cooldown > 0) {
+      throw this.unavailableError(`retrying the runtime host in ${cooldown}ms`)
+    }
+    let lastError: unknown
+    for (let attempt = 1; attempt <= MAX_START_ATTEMPTS; attempt++) {
+      try {
+        const response = await this.sendOnce(request)
+        this.availability.recordSuccess()
+        return response
+      } catch (error) {
+        lastError = error
+        if (this.availability.policyRetryPending) {
+          this.availability.escalateExecutionPolicy()
+          continue
+        }
+        // Only this error proves no helper started, which is what disproves the
+        // escalation; a helper that started and then died proves the opposite.
+        if (isRuntimeHostUnavailable(error)) {
+          this.availability.abandonUnprovenFallback()
+        }
+        // A helper that answered and then died is a crash, not a bad start: the
+        // caller sees it and the next operation gets a fresh process — unless it
+        // keeps happening, which is thrash the one-shot bridge should absorb.
+        if (!isRuntimeHostUnavailable(error) || !this.mayReplay(request)) {
+          if (this.availability.exhausted) {
+            this.availability.enterCooldown()
+          }
+          throw error
+        }
+        this.availability.warn(
+          `runtime host failed to start (attempt ${attempt}/${MAX_START_ATTEMPTS}): ${errorText(error)}`
+        )
+      }
+    }
+    this.availability.enterCooldown()
+    throw lastError
+  }
+
+  private sendOnce(request: BridgeRequest): Promise<BridgeResponse> {
+    let channel: DesktopScriptServeChannel
+    try {
+      channel = this.ensureChannel()
+    } catch (error) {
+      this.availability.recordFailure()
+      return Promise.reject(this.unavailableError(errorText(error)))
+    }
+    const id = this.nextRequestId++
+    return new Promise((resolve, reject) => {
+      // Why kill rather than wait: a hung UI Automation call cannot be
+      // cancelled, so the process itself is the only thing left to reclaim.
+      const timer = setTimeout(() => {
+        this.abortChannel(
+          new RuntimeClientError(
+            'action_timeout',
+            `desktop provider timed out after ${this.requestTimeoutMs}ms`
+          )
+        )
+      }, this.requestTimeoutMs)
+      timer.unref?.()
+      this.pending = { id, resolve, reject, timer }
+      channel.write(`${JSON.stringify({ ...request, requestId: id })}\n`, (error) => {
+        // Bind the report to what it was written for: a late callback must not
+        // charge a second failure for this operation, nor stop a replacement
+        // helper and reject a later request with this one's error. Deliberately
+        // redundant with the channel's own closed guard — keep both. This one
+        // also covers a live channel whose request has already been answered,
+        // which the channel cannot see; that case is what pins it.
+        //
+        // Redundant does not mean untested: removing either guard alone fails a
+        // test, so neither can be deleted as "the one the other covers".
+        if (this.channel !== channel || this.pending?.id !== id) {
+          return
+        }
+        this.abortChannel(new RuntimeClientError('accessibility_error', error.message))
+      })
+    })
+  }
+
+  private ensureChannel(): DesktopScriptServeChannel {
+    if (this.channel) {
+      return this.channel
+    }
+    this.childReady = false
+    this.childAnswered = false
+    const channel: DesktopScriptServeChannel = startServeChannel(
+      {
+        program: (this.options.powerShellPath ?? windowsPowerShellPath)(),
+        args: windowsPowerShellRuntimeArgs(this.scriptPath, this.availability.executionPolicy, [
+          '-Serve'
+        ]),
+        env: process.env
+      },
+      this.options.spawn ?? spawnProcess,
+      {
+        onLine: (line) => this.deliver(line),
+        // A replaced channel can still report; that must not fail the live one.
+        onGone: (detail) => {
+          if (this.channel === channel) {
+            this.handleGone(detail)
+          }
+        },
+        onOverflow: () =>
+          this.abortChannel(
+            new RuntimeClientError(
+              'accessibility_error',
+              'desktop provider response exceeded the runtime host buffer'
+            )
+          )
+      }
+    )
+    this.channel = channel
+    return channel
+  }
+
+  /**
+   * Whether the helper that just died can be proved not to have run the request.
+   *
+   * Why proof and not inference: "no reply came back" is not "nothing happened".
+   * runtime.ps1 synthesizes the input and only then builds the snapshot, which
+   * allocates a full-window bitmap and walks the UIA tree — a native fault there
+   * is uncatchable and would leave a click already delivered. Retrying on that
+   * inference turns one requested click into four.
+   */
+  private mayReplay(request: BridgeRequest): boolean {
+    if (this.childReady || this.childAnswered) {
+      return false
+    }
+    return this.readyProtocolConfirmed || isReplayableTool(request.tool)
+  }
+
+  private deliver(line: string): void {
+    let parsed: Record<string, unknown>
+    try {
+      parsed = JSON.parse(line) as Record<string, unknown>
+    } catch {
+      // Not a response at all — a PowerShell banner, a stray write. Dropping it
+      // is safe now that the id below is what decides which request is answered,
+      // and it keeps a chatty console from making the helper unusable.
+      return
+    }
+    // The readiness announcement carries no request id and answers nothing.
+    if (parsed.ready === true && parsed.requestId === undefined) {
+      this.childReady = true
+      this.readyProtocolConfirmed = true
+      this.availability.confirmExecutionPolicy()
+      return
+    }
+    const pending = this.pending
+    if (!pending || parsed.requestId !== pending.id) {
+      // One unmatched reply would otherwise shift every later response by one.
+      // Carry the helper's own message when it sent one: a line it could not tag
+      // with an id is usually the only account of what went wrong, and reporting
+      // a bare desync in its place loses the cause for good.
+      const reported = typeof parsed.error === 'string' ? `: ${parsed.error}` : ''
+      this.abortChannel(
+        new RuntimeClientError(
+          'accessibility_error',
+          `desktop provider response did not match the pending request${reported}`
+        )
+      )
+      return
+    }
+    // Only a reply this host can prove is its own counts as the helper working.
+    this.childAnswered = true
+    this.pending = null
+    clearTimeout(pending.timer)
+    const { requestId: _echoed, ...response } = parsed
+    pending.resolve(response as BridgeResponse)
+  }
+
+  private handleGone(detail: string): void {
+    const started = this.childReady || this.childAnswered
+    this.channel = null
+    this.availability.recordFailure()
+    if (!started && this.availability.atPreferredPolicy && isExecutionPolicyBlocked(detail)) {
+      this.availability.requestPolicyRetry()
+      // Unavailable rather than a generic error, because this can now be the
+      // final attempt: reverting an unproven escalation puts the host back on
+      // the preferred policy, so a later attempt can land here again. Only this
+      // code routes the operation to the one-shot bridge, which carries its own
+      // policy fallback; anything else fails the operation outright.
+      this.rejectPending(this.unavailableError(detail))
+      return
+    }
+    if (!started) {
+      this.rejectPending(this.unavailableError(detail))
+      return
+    }
+    this.rejectPending(
+      new RuntimeClientError(
+        'accessibility_error',
+        `desktop provider runtime host exited: ${detail}`
+      )
+    )
+  }
+
+  /**
+   * Stop a helper this host has judged unusable — a timeout, a desynchronised
+   * reply, an oversized line.
+   *
+   * Why it counts as a failure: stopping the channel suppresses the exit
+   * handler, so without this these paths bypassed the accounting entirely and a
+   * helper that failed this way on every operation was respawned once per
+   * operation forever — the burst this host exists to remove, restored through
+   * its own recovery path.
+   */
+  private abortChannel(error: Error): void {
+    this.stopChannel()
+    this.availability.recordFailure()
+    this.availability.warn(`runtime host helper stopped: ${error.message}`)
+    this.rejectPending(error)
+  }
+
+  private stopChannel(): void {
+    const channel = this.channel
+    this.channel = null
+    channel?.stop()
+  }
+
+  private takePending(): PendingRequest | null {
+    const pending = this.pending
+    this.pending = null
+    if (pending) {
+      clearTimeout(pending.timer)
+    }
+    return pending
+  }
+
+  private rejectPending(error: Error): void {
+    this.takePending()?.reject(error)
+  }
+
+  private armIdleTimer(): void {
+    this.clearIdleTimer()
+    if (!this.channel) {
+      return
+    }
+    this.idleTimer = setTimeout(() => {
+      this.idleTimer = null
+      this.stopChannel()
+    }, this.idleShutdownMs)
+    this.idleTimer.unref?.()
+  }
+
+  private clearIdleTimer(): void {
+    if (this.idleTimer) {
+      clearTimeout(this.idleTimer)
+      this.idleTimer = null
+    }
+  }
+
+  private unavailableError(message: string): RuntimeClientError {
+    return new RuntimeClientError(
+      RUNTIME_HOST_UNAVAILABLE,
+      `desktop provider runtime host could not start: ${message}`
+    )
+  }
+}
+
+function errorText(error: unknown): string {
+  return error instanceof Error ? error.message : String(error)
+}
diff --git a/src/main/computer/desktop-script-runtime-host.win32.test.ts b/src/main/computer/desktop-script-runtime-host.win32.test.ts
new file mode 100644
index 00000000000..76927a7dd65
--- /dev/null
+++ b/src/main/computer/desktop-script-runtime-host.win32.test.ts
@@ -0,0 +1,130 @@
+import { resolve } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import { spawnProcess } from '../../shared/child-process/run-process'
+import { windowsPowerShellPath } from '../../shared/child-process/windows-system-binary'
+import { DesktopScriptRuntimeHost } from './desktop-script-runtime-host'
+import { startServeChannel } from './desktop-script-serve-channel'
+import {
+  PREFERRED_WINDOWS_EXECUTION_POLICY,
+  windowsPowerShellRuntimeArgs
+} from './windows-powershell-execution-policy'
+
+/**
+ * The other half of the serve-mode proof: the unit test drives a fake child,
+ * this one drives the real `runtime.ps1 -Serve` on a real Windows box.
+ *
+ * Both are needed. The framing that matters — one NDJSON line per response,
+ * megabyte-scale screenshot payloads, a console writer that actually flushes —
+ * only exists in PowerShell, and a fake child cannot disprove any of it.
+ *
+ * Runs only on win32; skipped elsewhere.
+ */
+const describeOnWindows = process.platform === 'win32' ? describe : describe.skip
+
+const SCRIPT_PATH = resolve(__dirname, '../../../native/computer-use-windows/runtime.ps1')
+
+describeOnWindows('runtime.ps1 serve mode', () => {
+  let host: DesktopScriptRuntimeHost | null = null
+  let spawns = 0
+
+  function startHost(): DesktopScriptRuntimeHost {
+    spawns = 0
+    host = new DesktopScriptRuntimeHost(SCRIPT_PATH, {
+      warn: () => {},
+      spawn: (spec) => {
+        spawns++
+        return spawnProcess(spec)
+      }
+    })
+    return host
+  }
+
+  afterEach(() => {
+    host?.dispose()
+    host = null
+  })
+
+  it('answers repeated operations from a single PowerShell process', async () => {
+    const runtime = startHost()
+
+    await expect(runtime.request({ tool: 'handshake' })).resolves.toMatchObject({
+      ok: true,
+      capabilities: { protocolVersion: 1, provider: 'orca-computer-use-windows' }
+    })
+
+    const apps = await runtime.request({ tool: 'list_apps' })
+    expect(apps.ok).toBe(true)
+    expect(Array.isArray(apps.apps)).toBe(true)
+
+    await expect(runtime.request({ tool: 'handshake' })).resolves.toMatchObject({ ok: true })
+
+    expect(spawns).toBe(1)
+  })
+
+  it('returns a structured error for a bad request without killing the helper', async () => {
+    const runtime = startHost()
+
+    await expect(runtime.request({ tool: 'not_a_tool' })).resolves.toMatchObject({ ok: false })
+    await expect(runtime.request({ tool: 'handshake' })).resolves.toMatchObject({ ok: true })
+    expect(spawns).toBe(1)
+  })
+
+  /**
+   * The host can only write well-formed JSON, so the parse-failure branch of the
+   * serve loop is unreachable through it. Driving the channel directly is the
+   * only way to prove what the real PowerShell answers.
+   */
+  it('echoes the id it can recover when a request will not parse', async () => {
+    const answer = await answerRawLine('{"tool":"handshake","requestId":7')
+
+    // Tagged, so the host resolves the waiting request with a failed operation
+    // instead of reading an untagged line as a desynchronised stream.
+    expect(answer).toMatchObject({ ok: false, requestId: 7 })
+    expect(String(answer.error)).not.toBe('')
+  })
+
+  it('reports an error for a line with no recoverable id', async () => {
+    const answer = await answerRawLine('{"tool":"handshake"')
+
+    expect(answer).toMatchObject({ ok: false })
+    expect(answer.requestId).toBeUndefined()
+    expect(String(answer.error)).not.toBe('')
+  })
+})
+
+/** One raw line into a real `runtime.ps1 -Serve`, and the line it writes back. */
+function answerRawLine(raw: string): Promise<Record<string, unknown>> {
+  return new Promise((settle, fail) => {
+    const channel = startServeChannel(
+      {
+        program: windowsPowerShellPath(),
+        args: windowsPowerShellRuntimeArgs(SCRIPT_PATH, PREFERRED_WINDOWS_EXECUTION_POLICY, [
+          '-Serve'
+        ]),
+        env: process.env
+      },
+      spawnProcess,
+      {
+        onLine: (line) => {
+          let parsed: Record<string, unknown>
+          try {
+            parsed = JSON.parse(line) as Record<string, unknown>
+          } catch {
+            return
+          }
+          if (parsed.ready === true) {
+            channel.write(`${raw}\n`, fail)
+            return
+          }
+          channel.stop()
+          settle(parsed)
+        },
+        onGone: (detail) => fail(new Error(`helper exited before answering: ${detail}`)),
+        onOverflow: () => {
+          channel.stop()
+          fail(new Error('helper overflowed the response buffer'))
+        }
+      }
+    )
+  })
+}
diff --git a/src/main/computer/desktop-script-serve-channel.test.ts b/src/main/computer/desktop-script-serve-channel.test.ts
new file mode 100644
index 00000000000..80a5dd491d3
--- /dev/null
+++ b/src/main/computer/desktop-script-serve-channel.test.ts
@@ -0,0 +1,99 @@
+import { EventEmitter } from 'node:events'
+import { describe, expect, it, vi } from 'vitest'
+import { DesktopScriptServeChannel, type RuntimeChildProcess } from './desktop-script-serve-channel'
+
+class FakeChild extends EventEmitter {
+  readonly stdout = new EventEmitter()
+  readonly stderr = new EventEmitter()
+  readonly writes: string[] = []
+  killed = false
+  private readonly pendingWrites: ((error?: Error | null) => void)[] = []
+
+  readonly stdin = {
+    write: (chunk: string, callback?: (error?: Error | null) => void): boolean => {
+      this.writes.push(chunk)
+      if (callback) {
+        this.pendingWrites.push(callback)
+      }
+      return true
+    },
+    end: (): void => {},
+    on: (): void => {}
+  }
+
+  kill(): boolean {
+    this.killed = true
+    return true
+  }
+
+  /** What a destroyed stdin does to writes still queued at teardown. */
+  failQueuedWrites(): void {
+    for (const callback of this.pendingWrites.splice(0)) {
+      callback(new Error('ERR_STREAM_DESTROYED'))
+    }
+  }
+}
+
+function createChannel() {
+  const child = new FakeChild()
+  const handlers = { onLine: vi.fn(), onGone: vi.fn(), onOverflow: vi.fn() }
+  const channel = new DesktopScriptServeChannel(child as unknown as RuntimeChildProcess, handlers)
+  return { channel, child, handlers }
+}
+
+describe('DesktopScriptServeChannel', () => {
+  it('splits responses into lines and tolerates a trailing carriage return', () => {
+    const { child, handlers } = createChannel()
+
+    child.stdout.emit('data', Buffer.from('{"a":1}\r\n{"b":2}\n', 'utf8'))
+
+    expect(handlers.onLine.mock.calls.map(([line]) => line)).toEqual(['{"a":1}', '{"b":2}'])
+  })
+
+  it('reports the exit reason with the stderr tail', () => {
+    const { child, handlers } = createChannel()
+
+    child.stderr.emit('data', Buffer.from('it broke', 'utf8'))
+    child.emit('close', 1, null)
+
+    expect(handlers.onGone).toHaveBeenCalledWith('code 1: it broke')
+  })
+
+  describe('once stopped', () => {
+    /**
+     * The channel's half of the stale-callback guard, pinned here rather than
+     * through the host: the host refuses a stale report too, so a host-level
+     * test passes with either guard alone and neither ends up covered.
+     */
+    it('accepts no further writes', () => {
+      const { channel, child } = createChannel()
+
+      channel.stop()
+      channel.write('{"tool":"click"}\n', vi.fn())
+
+      expect(child.writes).toEqual([])
+    })
+
+    it('reports no error from a write that was already queued', () => {
+      const { channel, child } = createChannel()
+      const onError = vi.fn()
+
+      channel.write('{"tool":"click"}\n', onError)
+      channel.stop()
+      child.failQueuedWrites()
+
+      expect(onError).not.toHaveBeenCalled()
+    })
+
+    it('reports neither lines nor the exit it was asked to cause', () => {
+      const { channel, child, handlers } = createChannel()
+
+      channel.stop()
+      child.stdout.emit('data', Buffer.from('{"a":1}\n', 'utf8'))
+      child.emit('close', 0, null)
+
+      expect(handlers.onLine).not.toHaveBeenCalled()
+      expect(handlers.onGone).not.toHaveBeenCalled()
+    })
+  })
+})
diff --git a/src/main/computer/desktop-script-serve-channel.ts b/src/main/computer/desktop-script-serve-channel.ts
new file mode 100644
index 00000000000..afabb47962a
--- /dev/null
+++ b/src/main/computer/desktop-script-serve-channel.ts
@@ -0,0 +1,145 @@
+import { StringDecoder } from 'node:string_decoder'
+import type { ProcessSpec } from '../../shared/child-process/process-spec'
+import type { spawnProcess } from '../../shared/child-process/run-process'
+
+/** The all-pipes child `spawnProcess` returns; avoids a node:child_process import. */
+export type RuntimeChildProcess = ReturnType<typeof spawnProcess>
+
+export type RuntimeProcessSpawn = (spec: ProcessSpec) => RuntimeChildProcess
+
+/** UTF-16 units, not bytes — this bounds the buffer, it is not a payload contract. */
+const MAX_RESPONSE_CHARS = 20 * 1024 * 1024
+const MAX_STDERR_CHARS = 4096
+
+export type ServeChannelHandlers = {
+  /** One complete line from the helper, without its terminator. */
+  onLine: (line: string) => void
+  /** The helper is gone; detail carries the exit reason and its stderr tail. */
+  onGone: (detail: string) => void
+  /** The helper produced more than one buffer's worth without a line break. */
+  onOverflow: () => void
+}
+
+/**
+ * One `runtime.ps1 -Serve` child, framed as NDJSON lines.
+ *
+ * Split from the host so the host reads as what it is — a queue, a retry policy
+ * and a correlation check — rather than that plus stream plumbing. Responses
+ * carry base64 screenshots and routinely exceed a megabyte, so lines are
+ * reassembled across chunks with a decoder that survives a code point split
+ * across a chunk boundary.
+ */
+export class DesktopScriptServeChannel {
+  private readonly decoder = new StringDecoder('utf8')
+  private buffer = ''
+  private stderrTail = ''
+  private detach: (() => void) | null = null
+  private closed = false
+
+  constructor(
+    private readonly child: RuntimeChildProcess,
+    private readonly handlers: ServeChannelHandlers
+  ) {
+    const onStdout = (chunk: Buffer | string): void => this.readStdout(chunk)
+    const onStderr = (chunk: Buffer | string): void => {
+      this.stderrTail = `${this.stderrTail}${chunk.toString()}`.slice(-MAX_STDERR_CHARS)
+    }
+    // Why close and not exit: the caller classifies the failure from stderr, and
+    // only close guarantees the stdio streams were drained first.
+    const onClose = (code: number | null, signal: NodeJS.Signals | null): void =>
+      this.reportGone(signal ? `signal ${signal}` : `code ${code ?? 'unknown'}`)
+    const onError = (error: Error): void => this.reportGone(error.message)
+    child.stdout.on('data', onStdout)
+    child.stderr.on('data', onStderr)
+    child.once('close', onClose)
+    child.once('error', onError)
+    // An unhandled stream error is an uncaught exception in the main process.
+    child.stdin.on('error', () => {})
+    this.detach = (): void => {
+      child.stdout.off('data', onStdout)
+      child.stderr.off('data', onStderr)
+      child.off('close', onClose)
+      child.off('error', onError)
+      child.on('error', () => {})
+    }
+  }
+
+  write(payload: string, onError: (error: Error) => void): void {
+    if (this.closed) {
+      return
+    }
+    this.child.stdin.write(payload, (error) => {
+      // A destroyed stdin calls back after stop(); reporting then charges the
+      // caller a second failure for one operation. Deliberately redundant with
+      // the host's own staleness check — keep both, and note that each is
+      // pinned separately, this one by the "once stopped" tests here.
+      if (error && !this.closed) {
+        onError(error)
+      }
+    })
+  }
+
+  /** Stop the helper and go silent; handlers are not called afterwards. */
+  stop(): void {
+    if (this.closed) {
+      return
+    }
+    this.closed = true
+    this.detach?.()
+    this.detach = null
+    this.buffer = ''
+    // Closing stdin ends the serve loop; the kill covers a wedged helper.
+    try {
+      this.child.stdin.end()
+    } catch {
+      /* already closed */
+    }
+    this.child.kill()
+  }
+
+  private reportGone(detail: string): void {
+    if (this.closed) {
+      return
+    }
+    const text = [detail, this.stderrTail.trim()].filter(Boolean).join(': ')
+    this.closed = true
+    this.detach?.()
+    this.detach = null
+    this.handlers.onGone(text)
+  }
+
+  private readStdout(chunk: Buffer | string): void {
+    if (this.closed) {
+      return
+    }
+    this.buffer += typeof chunk === 'string' ? chunk : this.decoder.write(chunk)
+    if (this.buffer.length > MAX_RESPONSE_CHARS) {
+      this.buffer = ''
+      this.handlers.onOverflow()
+      return
+    }
+    for (let newline = this.buffer.indexOf('\n'); newline >= 0;) {
+      // Slice a trailing CR off by index; trimming copies the whole payload.
+      const end = newline > 0 && this.buffer.charCodeAt(newline - 1) === 13 ? newline - 1 : newline
+      const line = this.buffer.slice(0, end)
+      this.buffer = this.buffer.slice(newline + 1)
+      if (line.length > 0) {
+        this.handlers.onLine(line)
+        // A handler may have stopped this channel; stop reading its backlog.
+        if (this.closed) {
+          this.buffer = ''
+          return
+        }
+      }
+      newline = this.buffer.indexOf('\n')
+    }
+  }
+}
+
+export function startServeChannel(
+  spec: ProcessSpec,
+  spawn: RuntimeProcessSpawn,
+  handlers: ServeChannelHandlers
+): DesktopScriptServeChannel {
+  return new DesktopScriptServeChannel(spawn(spec), handlers)
+}
diff --git a/src/main/computer/sidecar-client.ts b/src/main/computer/sidecar-client.ts
index 489c463dd93..23af1aa603b 100644
--- a/src/main/computer/sidecar-client.ts
+++ b/src/main/computer/sidecar-client.ts
@@ -9,6 +9,7 @@ import type {
   ComputerSnapshotResult
 } from '../../shared/runtime-types'
 import { normalizeComputerActionResult } from './computer-action-verification-normalization'
+import { isComputerSidecarDiagnostic, logComputerDiagnostic } from './computer-sidecar-diagnostics'
 import { validateComputerSidecarPasteText } from './computer-sidecar-paste-validation'
 import { RuntimeClientError } from './runtime-client-error'
 
@@ -245,6 +246,11 @@ class ComputerSidecarProcess {
   }
 
   private handleMessage(message: unknown): void {
+    // The sidecar's stdio is piped and unread, so its warnings arrive here.
+    if (isComputerSidecarDiagnostic(message)) {
+      logComputerDiagnostic(message.message)
+      return
+    }
     if (!isSidecarResponse(message)) {
       return
     }
diff --git a/src/main/computer/sidecar-entry.ts b/src/main/computer/sidecar-entry.ts
index 8489f71e7f3..961d2261ede 100644
--- a/src/main/computer/sidecar-entry.ts
+++ b/src/main/computer/sidecar-entry.ts
@@ -8,6 +8,11 @@ type SidecarRequest = {
   params?: Record<string, unknown>
 }
 
+// Why disconnect carries the weight on Windows: the parent stops the sidecar
+// with kill('SIGTERM'), which is TerminateProcess there, so the SIGTERM handler
+// below never runs and teardown rides on the IPC channel closing instead. A
+// helper wedged inside a UI Automation call can still outlive that and deliver
+// input after teardown; only a real signal would preempt it.
 process.once('disconnect', shutdownProviders)
 process.once('SIGTERM', () => {
   shutdownProviders()
diff --git a/src/main/computer/windows-powershell-execution-policy.test.ts b/src/main/computer/windows-powershell-execution-policy.test.ts
new file mode 100644
index 00000000000..033eec58fb5
--- /dev/null
+++ b/src/main/computer/windows-powershell-execution-policy.test.ts
@@ -0,0 +1,92 @@
+import { describe, expect, it } from 'vitest'
+import {
+  FALLBACK_WINDOWS_EXECUTION_POLICY,
+  PREFERRED_WINDOWS_EXECUTION_POLICY,
+  isExecutionPolicyBlocked,
+  windowsPowerShellRuntimeArgs
+} from './windows-powershell-execution-policy'
+
+/**
+ * Captured from powershell.exe on Windows, verbatim including the hard wrapping.
+ *
+ * The discriminator has to be pinned in both directions: a policy block must
+ * escalate once, and a plain access denial must not, because escalation is
+ * sticky for the session and lands on `-ExecutionPolicy Bypass`.
+ */
+const POLICY_BLOCKED_RESTRICTED = [
+  'File C:\\Temp\\runtime.ps1 cannot be loaded because running scripts is disabled on this system. For more ',
+  'information, see about_Execution_Policies at https:/go.microsoft.com/fwlink/?LinkID=135170.',
+  '    + CategoryInfo          : SecurityError: (:) [], ParentContainsErrorRecordException',
+  '    + FullyQualifiedErrorId : UnauthorizedAccess'
+].join('\r\n')
+
+const POLICY_BLOCKED_REMOTE_SIGNED = [
+  'File C:\\Temp\\runtime.ps1 cannot be loaded. The file ',
+  'C:\\Temp\\runtime.ps1 is not digitally signed. You cannot run this script on the current system. For more ',
+  'information about running scripts and setting execution policy, see about_Execution_Policies at https:/go.microsoft.com/fwlink/?LinkID=135170.',
+  '    + CategoryInfo          : SecurityError: (:) [], ParentContainsErrorRecordException',
+  '    + FullyQualifiedErrorId : UnauthorizedAccess'
+].join('\r\n')
+
+/** No execution policy involved: .NET refusing a file the process may not read. */
+const GENUINE_ACCESS_DENIED = [
+  'Exception calling "ReadAllText" with "1" argument(s): "Access to the path \'C:\\Windows\\System32\\config\\SAM\' is denied."',
+  'At C:\\Temp\\runtime.ps1:1 char:1',
+  '+ [System.IO.File]::ReadAllText("C:\\Windows\\System32\\config\\SAM")',
+  '+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~',
+  '    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException',
+  '    + FullyQualifiedErrorId : UnauthorizedAccessException'
+].join('\r\n')
+
+describe('isExecutionPolicyBlocked', () => {
+  it('recognises a policy block under either policy', () => {
+    expect(isExecutionPolicyBlocked(POLICY_BLOCKED_RESTRICTED)).toBe(true)
+    expect(isExecutionPolicyBlocked(POLICY_BLOCKED_REMOTE_SIGNED)).toBe(true)
+  })
+
+  it('does not read a plain access denial as a policy block', () => {
+    // UnauthorizedAccessException merely starts with the policy error id. Without
+    // the word boundary this matched, and one locked file downgraded the whole
+    // session to Bypass with no path back.
+    expect(isExecutionPolicyBlocked(GENUINE_ACCESS_DENIED)).toBe(false)
+  })
+
+  it('keeps recognising a block when the record labels are localized', () => {
+    // The labels are translated on a non-English host; the ids and the help
+    // topic are not, so the match must not depend on the labels.
+    const localized = POLICY_BLOCKED_RESTRICTED.replace('CategoryInfo', 'Categoria')
+      .replace('FullyQualifiedErrorId', 'IdErroreCompleto')
+      .replace(
+        'cannot be loaded because running scripts is disabled on this system',
+        'non puo essere caricato'
+      )
+    expect(isExecutionPolicyBlocked(localized)).toBe(true)
+  })
+
+  it('ignores the failures the helper reports every day', () => {
+    expect(isExecutionPolicyBlocked('code 1: The term is not recognized')).toBe(false)
+    expect(isExecutionPolicyBlocked('Add-Type : Cannot access the temporary directory')).toBe(false)
+    expect(isExecutionPolicyBlocked('')).toBe(false)
+  })
+})
+
+describe('windowsPowerShellRuntimeArgs', () => {
+  it('never emits Bypass unless the caller escalated to it', () => {
+    const preferred = windowsPowerShellRuntimeArgs(
+      'C:\\orca\\runtime.ps1',
+      PREFERRED_WINDOWS_EXECUTION_POLICY,
+      ['-Serve']
+    )
+    expect(preferred).not.toContain(FALLBACK_WINDOWS_EXECUTION_POLICY)
+    expect(preferred).toEqual([
+      '-NoLogo',
+      '-NoProfile',
+      '-NonInteractive',
+      '-ExecutionPolicy',
+      'RemoteSigned',
+      '-File',
+      'C:\\orca\\runtime.ps1',
+      '-Serve'
+    ])
+  })
+})
diff --git a/src/main/computer/windows-powershell-execution-policy.ts b/src/main/computer/windows-powershell-execution-policy.ts
new file mode 100644
index 00000000000..204f5b02b06
--- /dev/null
+++ b/src/main/computer/windows-powershell-execution-policy.ts
@@ -0,0 +1,59 @@
+/**
+ * Execution-policy handling for the Windows computer-use runtime script.
+ *
+ * Why not `Bypass` outright: it is the highest-weighted token on a
+ * powershell.exe command line for Defender for Endpoint, and the shipped
+ * runtime.ps1 does not need it — NSIS extraction writes no Zone.Identifier, so
+ * an unsigned local script runs under `RemoteSigned`. `Restricted` is still the
+ * Windows client default though, so a policy-blocked start must fall back once
+ * rather than leaving computer use broken.
+ */
+export type WindowsExecutionPolicy = 'RemoteSigned' | 'Bypass'
+
+export const PREFERRED_WINDOWS_EXECUTION_POLICY: WindowsExecutionPolicy = 'RemoteSigned'
+export const FALLBACK_WINDOWS_EXECUTION_POLICY: WindowsExecutionPolicy = 'Bypass'
+
+/**
+ * Matches the SecurityError PowerShell emits for `-File` under a blocking policy.
+ *
+ * Every alternative is a PowerShell or .NET identifier, never prose. The prose
+ * differs by policy ("running scripts is disabled" under Restricted, "is not
+ * digitally signed" under RemoteSigned), is localized, and PowerShell hard-wraps
+ * it mid-sentence at the console width, so it can anchor nothing.
+ *
+ * The `\b` after UnauthorizedAccess is the whole discriminator and must not be
+ * dropped. `UnauthorizedAccess` is the FullyQualifiedErrorId of a policy block,
+ * but it is also a strict prefix of `UnauthorizedAccessException`, which .NET
+ * raises for an ordinary locked or ACL-denied file: an AV scan holding
+ * runtime.ps1, a locked CSC temp directory, a roaming-profile hiccup. Matching
+ * that escalates to `Bypass` for the rest of the session — the exact command
+ * line token this stack exists to stop emitting — and on the one-shot path
+ * replays an operation that already ran.
+ *
+ * Anchoring on the `FullyQualifiedErrorId:`/`CategoryInfo:` labels would be more
+ * precise still, but the labels are localized where these values are not, so a
+ * non-English host would stop recognising a real block and lose the fallback.
+ */
+const EXECUTION_POLICY_BLOCKED = /\bUnauthorizedAccess\b|\bSecurityError\b|about_Execution_Policies/
+
+export function isExecutionPolicyBlocked(text: string): boolean {
+  return EXECUTION_POLICY_BLOCKED.test(text)
+}
+
+export function windowsPowerShellRuntimeArgs(
+  scriptPath: string,
+  policy: WindowsExecutionPolicy,
+  scriptArgs: readonly string[] = []
+): string[] {
+  return [
+    // -NoLogo: a banner on stdout would be read as a malformed response line.
+    '-NoLogo',
+    '-NoProfile',
+    '-NonInteractive',
+    '-ExecutionPolicy',
+    policy,
+    '-File',
+    scriptPath,
+    ...scriptArgs
+  ]
+}
diff --git a/src/main/crash-reporting/expected-teardown-state.ts b/src/main/crash-reporting/expected-teardown-state.ts
index 1480ecbbfe2..c2993769633 100644
--- a/src/main/crash-reporting/expected-teardown-state.ts
+++ b/src/main/crash-reporting/expected-teardown-state.ts
@@ -10,9 +10,17 @@ type Clock = () => number
 const monotonicNow = (): number => performance.now()
 let now: Clock = monotonicNow
 let systemSessionEndedAt: number | null = null
+let systemSessionEnded = false
 
 export function markSystemSessionEnding(): void {
   systemSessionEndedAt = now()
+  systemSessionEnded = true
+}
+
+// Why latched, unlike the 5s crash-suppression window below: a native dialog or a recovery verdict is never
+// right once the OS is tearing the session down, however long the process outlives the signal.
+export function isSystemSessionEnding(): boolean {
+  return systemSessionEnded
 }
 
 function isRecentSystemSessionEnd(): boolean {
@@ -55,4 +63,5 @@ export function resolveExpectedTeardownScope({
 export function resetExpectedTeardownStateForTest(clock: Clock = monotonicNow): void {
   now = clock
   systemSessionEndedAt = null
+  systemSessionEnded = false
 }
diff --git a/src/main/crash-reporting/gone-time-system-memory.ts b/src/main/crash-reporting/gone-time-system-memory.ts
deleted file mode 100644
index 7cca89d2d4b..00000000000
--- a/src/main/crash-reporting/gone-time-system-memory.ts
+++ /dev/null
@@ -1,77 +0,0 @@
-import type { CrashReportDetailValue } from '../../shared/crash-reporting'
-
-// ─── System memory at gone time ─────────────────────────────────────
-// Why: the system outlives the crashed process, so this IS sampleable at
-// process-gone — it separates "renderer grew huge" from "machine out of
-// memory/commit", which the per-process buckets alone cannot.
-// Timing honesty: this reads AFTER the crashed process's memory returned to
-// the OS, so free/swapFree can look healthier than they were at kill time.
-// Platform honesty: swap* exist on Windows/Linux only. On Linux `free` is
-// /proc/meminfo MemFree and is NOT the pressure signal — it excludes page cache
-// and other reclaimable memory; `available` (MemAvailable, Linux-only) is. On
-// macOS `free` is near-meaningless (file cache and compression keep it low on
-// healthy machines); fileBacked/purgeable are the only reclaimability proxy this
-// API gives there, and none of these fields answers "was the machine under
-// pressure" on macOS — that needs a signal Electron does not expose.
-
-type CrashReportDetails = Record<string, CrashReportDetailValue>
-
-export function memoryKBFieldMB(value: unknown): number | undefined {
-  const kb = typeof value === 'number' && Number.isFinite(value) ? value : undefined
-  return kb === undefined ? undefined : Math.round(Math.max(0, kb) / 1024)
-}
-
-type SystemMemoryInfoLike = {
-  total?: unknown
-  free?: unknown
-  available?: unknown
-  swapTotal?: unknown
-  swapFree?: unknown
-  fileBacked?: unknown
-  purgeable?: unknown
-}
-
-type SystemMemoryInfoReader = () => SystemMemoryInfoLike | null
-
-function readElectronSystemMemoryInfo(): SystemMemoryInfoLike | null {
-  const read = (process as NodeJS.Process & { getSystemMemoryInfo?: () => SystemMemoryInfoLike })
-    .getSystemMemoryInfo
-  if (typeof read !== 'function') {
-    return null
-  }
-  try {
-    return read.call(process)
-  } catch {
-    return null
-  }
-}
-
-let systemMemoryInfoReader: SystemMemoryInfoReader = readElectronSystemMemoryInfo
-
-export function setSystemMemoryInfoReaderForTest(reader: SystemMemoryInfoReader | null): void {
-  systemMemoryInfoReader = reader ?? readElectronSystemMemoryInfo
-}
-
-export function getSystemMemoryAtGoneDetails(): CrashReportDetails {
-  const info = systemMemoryInfoReader()
-  if (!info) {
-    return {}
-  }
-  const details: CrashReportDetails = {}
-  const fields: readonly [keyof SystemMemoryInfoLike, string][] = [
-    ['total', 'systemMemoryTotalMB'],
-    ['free', 'systemMemoryFreeMB'],
-    ['available', 'systemMemoryAvailableMB'],
-    ['swapTotal', 'systemMemorySwapTotalMB'],
-    ['swapFree', 'systemMemorySwapFreeMB'],
-    ['fileBacked', 'systemMemoryFileBackedMB'],
-    ['purgeable', 'systemMemoryPurgeableMB']
-  ]
-  for (const [field, key] of fields) {
-    const mb = memoryKBFieldMB(info[field])
-    if (mb !== undefined) {
-      details[key] = mb
-    }
-  }
-  return details
-}
diff --git a/src/main/crash-reporting/pre-gone-host-memory.test.ts b/src/main/crash-reporting/pre-gone-host-memory.test.ts
new file mode 100644
index 00000000000..0df13d4fee5
--- /dev/null
+++ b/src/main/crash-reporting/pre-gone-host-memory.test.ts
@@ -0,0 +1,379 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  getSystemMemoryDetails,
+  setSystemMemoryInfoReaderForTest,
+  withSwapVolumeFreeSpace
+} from './system-memory-details'
+import {
+  readSwapVolumeFreeSpace,
+  setSwapVolumeFreeSpaceReaderForTest,
+  type SwapVolumeFreeSpace
+} from './swap-volume-free-space'
+import { samplePreGoneSystemMemory } from './pre-gone-host-memory'
+import {
+  buildProcessGoneCrashDetails,
+  resetPreGoneCrashSamplingForTest,
+  samplePreGoneProcessMetrics,
+  startPreGoneCrashSampling
+} from './process-gone-diagnostics'
+
+type MetricFixture = {
+  pid: number
+  creationTime: number
+  type: string
+  memory: { workingSetSize: number; peakWorkingSetSize?: number; privateBytes?: number }
+}
+
+const { appMetricsMock } = vi.hoisted(() => ({
+  appMetricsMock: vi.fn<() => MetricFixture[]>(() => [])
+}))
+
+vi.mock('electron', () => ({ app: { getAppMetrics: appMetricsMock } }))
+
+const BROWSER_AND_RENDERER: MetricFixture[] = [
+  { pid: 10, creationTime: 1, type: 'Browser', memory: { workingSetSize: 1024 * 250 } },
+  {
+    pid: 11,
+    creationTime: 2,
+    type: 'Tab',
+    memory: { workingSetSize: 1024 * 400, peakWorkingSetSize: 1024 * 420, privateBytes: 1024 * 260 }
+  }
+]
+
+const BROWSER_ONLY: MetricFixture[] = [BROWSER_AND_RENDERER[0]]
+
+const UNDER_COMMIT_PRESSURE = {
+  total: 16_000 * 1024,
+  free: 400 * 1024,
+  swapTotal: 48_000 * 1024,
+  swapFree: 200 * 1024
+}
+
+const AFTER_THE_CORPSE_RELEASED = {
+  total: 16_000 * 1024,
+  free: 3_000 * 1024,
+  swapTotal: 48_000 * 1024,
+  swapFree: 2_900 * 1024
+}
+
+// Commit limit ~= RAM: a disabled or fixed pagefile, which no amount of empty
+// disk can grow into. `swapTotal > total` is all this API can say about that.
+const FIXED_PAGEFILE_UNDER_PRESSURE = {
+  total: 16_000 * 1024,
+  free: 300 * 1024,
+  swapTotal: 16_100 * 1024,
+  swapFree: 180 * 1024
+}
+
+const NO_PAGEFILE_UNDER_PRESSURE = {
+  ...FIXED_PAGEFILE_UNDER_PRESSURE,
+  swapTotal: 15_900 * 1024
+}
+
+const BEFORE_THE_STORM = {
+  total: 16_000 * 1024,
+  free: 9_000 * 1024,
+  swapTotal: 48_000 * 1024,
+  swapFree: 30_000 * 1024
+}
+
+describe('pre-gone host memory', () => {
+  beforeEach(() => {
+    resetPreGoneCrashSamplingForTest()
+    setSystemMemoryInfoReaderForTest(null)
+    setSwapVolumeFreeSpaceReaderForTest(null)
+    appMetricsMock.mockClear()
+    appMetricsMock.mockReturnValue(BROWSER_AND_RENDERER)
+  })
+
+  it('carries a pre-gone host reading, not only the post-mortem one', async () => {
+    setSystemMemoryInfoReaderForTest(() => UNDER_COMMIT_PRESSURE)
+    setSwapVolumeFreeSpaceReaderForTest(() => Promise.resolve({ freeMB: 120, volume: 'C:' }))
+    await samplePreGoneSystemMemory(Date.now() - 5_000)
+
+    // The renderer dies; its ~400 MB returns to the OS, so the gone-time read
+    // now shows a much healthier machine than the one that refused the alloc.
+    setSystemMemoryInfoReaderForTest(() => AFTER_THE_CORPSE_RELEASED)
+    appMetricsMock.mockReturnValue(BROWSER_ONLY)
+
+    const details = buildProcessGoneCrashDetails({ processType: 'renderer' }, 'renderer')
+
+    expect(details.systemMemorySwapFreeMB).toBe(2_900)
+    expect(details.systemMemoryPreGoneSwapFreeMB).toBe(200)
+    expect(details.systemMemoryPreGoneFreeMB).toBe(400)
+    expect(details.systemMemoryPreGoneTotalMB).toBe(16_000)
+    // Why: host memory keeps its own key family, so a `systemMemory` prefix scan sees both reads.
+    expect(
+      Object.keys(details).filter((key) => key.startsWith('processMetricsPreGoneSystem'))
+    ).toEqual([])
+  })
+
+  // Why this decides the cluster: 200 MB available commit is only a REFUSAL when
+  // the pagefile cannot grow, which is what the volume's free space says.
+  it('reports swap-volume free space so low commit can be told from refused commit', async () => {
+    setSystemMemoryInfoReaderForTest(() => UNDER_COMMIT_PRESSURE)
+    setSwapVolumeFreeSpaceReaderForTest(() => Promise.resolve({ freeMB: 120, volume: 'C:' }))
+    await samplePreGoneSystemMemory(Date.now() - 5_000)
+
+    const details = buildProcessGoneCrashDetails({ processType: 'renderer' }, 'renderer')
+
+    expect(details.systemMemoryPreGoneSwapVolumeFreeMB).toBe(120)
+    // Which volume was measured: Windows only names the DEFAULT pagefile drive.
+    expect(details.systemMemoryPreGoneSwapVolume).toBe('C:')
+  })
+
+  it('omits swap-volume free space on Linux, where swap cannot grow into free disk', async () => {
+    // Linux swap is a fixed partition, a fixed-size swapfile, or zram; reporting
+    // root-fs free space next to SwapFreeMB 0 would read as headroom that is not there.
+    setSwapVolumeFreeSpaceReaderForTest(null)
+
+    await expect(readSwapVolumeFreeSpace('linux')).resolves.toBeUndefined()
+  })
+
+  it('labels the reading with the pressure verdict the platform can actually give', () => {
+    // Windows available commit is only a REFUSAL when the pagefile cannot grow,
+    // which nothing here proves, so no label may read as that verdict.
+    setSystemMemoryInfoReaderForTest(() => UNDER_COMMIT_PRESSURE)
+    const windowsCommit = getSystemMemoryDetails('win32')
+    expect(windowsCommit.systemMemoryPressureSignal).toBe('available-commit-unqualified')
+    expect(
+      withSwapVolumeFreeSpace(windowsCommit, { freeMB: 120, volume: 'C:' }, 'win32')
+        .systemMemoryPressureSignal
+    ).toBe('available-commit-volume-cotimed')
+    // A volume number from a different moment describes a different machine.
+    expect(
+      withSwapVolumeFreeSpace(windowsCommit, { freeMB: 120, volume: 'C:' }, 'win32', false)
+        .systemMemoryPressureSignal
+    ).toBe('available-commit-unqualified')
+
+    setSystemMemoryInfoReaderForTest(() => ({ total: 16_000 * 1024, free: 400 * 1024 }))
+    expect(getSystemMemoryDetails('linux').systemMemoryPressureSignal).toBe('none')
+
+    setSystemMemoryInfoReaderForTest(() => ({ total: 16_000 * 1024, available: 900 * 1024 }))
+    expect(getSystemMemoryDetails('linux').systemMemoryPressureSignal).toBe('mem-available')
+
+    // darwin free/fileBacked/purgeable answer reclaimability, never pressure.
+    setSystemMemoryInfoReaderForTest(() => ({
+      total: 16_000 * 1024,
+      free: 272 * 1024,
+      fileBacked: 2_694 * 1024,
+      purgeable: 0
+    }))
+    expect(getSystemMemoryDetails('darwin').systemMemoryPressureSignal).toBe('none')
+  })
+
+  // Why this and not the volume number: the branch's own repro needed a pagefile
+  // that CANNOT grow to kill anything, and neither the pagefile maximum nor its
+  // drive is readable here — `swapVolumeAnchor` measures SystemRoot's volume,
+  // which a relocated pagefile does not live on.
+  it('never reads free disk as proof the pagefile could have grown', () => {
+    setSystemMemoryInfoReaderForTest(() => FIXED_PAGEFILE_UNDER_PRESSURE)
+    const fixedPagefile = withSwapVolumeFreeSpace(
+      getSystemMemoryDetails('win32'),
+      { freeMB: 812_000, volume: 'C:' },
+      'win32'
+    )
+    // 180 MB of commit beside 812 GB of free disk: co-timed, and still not a
+    // verdict — reading it as "the pagefile had room" is the opposite conclusion.
+    expect(fixedPagefile.systemMemoryPressureSignal).toBe('available-commit-volume-cotimed')
+
+    // The one decisive win32 case: commit limit at or below RAM means there is
+    // no pagefile behind it, so the floor cannot heal however empty the disk is.
+    setSystemMemoryInfoReaderForTest(() => NO_PAGEFILE_UNDER_PRESSURE)
+    expect(
+      withSwapVolumeFreeSpace(
+        getSystemMemoryDetails('win32'),
+        { freeMB: 812_000, volume: 'C:' },
+        'win32'
+      ).systemMemoryPressureSignal
+    ).toBe('available-commit-hard-capped')
+  })
+
+  // Why the verdict and not just the field: a statfs issued on a healthy host at
+  // t=0 that resolves 20 s into a commit storm prints "200 MB commit, 40 GB of
+  // pagefile headroom" — which reads as NOT a commit refusal, the opposite
+  // conclusion, under the branch's most confident label.
+  it('will not let a statfs that outlived its tick qualify the win32 commit verdict', async () => {
+    const platform = Object.getOwnPropertyDescriptor(process, 'platform')!
+    Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+    vi.useFakeTimers()
+    let resolveVolume: (value: SwapVolumeFreeSpace) => void = () => {}
+    try {
+      setSystemMemoryInfoReaderForTest(() => BEFORE_THE_STORM)
+      setSwapVolumeFreeSpaceReaderForTest(
+        () =>
+          new Promise<SwapVolumeFreeSpace>((resolve) => {
+            resolveVolume = resolve
+          })
+      )
+      void samplePreGoneSystemMemory(0)
+
+      // The storm arrives; the in-flight latch makes every tick skip the merge,
+      // so the pending statfs is as old as the tick that STARTED it.
+      setSystemMemoryInfoReaderForTest(() => UNDER_COMMIT_PRESSURE)
+      await samplePreGoneSystemMemory(10_000)
+      await samplePreGoneSystemMemory(20_000)
+
+      resolveVolume({ freeMB: 40_000, volume: 'C:' })
+      await vi.advanceTimersByTimeAsync(0)
+
+      vi.setSystemTime(20_000)
+      const stale = buildProcessGoneCrashDetails({}, 'renderer')
+      expect(stale.systemMemoryPreGoneSwapFreeMB).toBe(200)
+      // The pre-storm volume number still ships — but carrying its own age, and
+      // without promoting the verdict the analyst reads.
+      expect(stale.systemMemoryPreGoneSwapVolumeFreeMB).toBe(40_000)
+      expect(stale.systemMemoryPreGoneSampleAgeMs).toBe(0)
+      expect(stale.systemMemoryPreGoneSwapVolumeAgeMs).toBe(20_000)
+      expect(stale.systemMemoryPreGonePressureSignal).toBe('available-commit-unqualified')
+
+      // The next tick's statfs answers on its own tick, so it qualifies again.
+      setSwapVolumeFreeSpaceReaderForTest(() => Promise.resolve({ freeMB: 900, volume: 'C:' }))
+      await samplePreGoneSystemMemory(30_000)
+      vi.setSystemTime(30_000)
+      const fresh = buildProcessGoneCrashDetails({}, 'renderer')
+      expect(fresh.systemMemoryPreGoneSwapVolumeFreeMB).toBe(900)
+      expect(fresh.systemMemoryPreGoneSwapVolumeAgeMs).toBe(0)
+      expect(fresh.systemMemoryPreGonePressureSignal).toBe('available-commit-volume-cotimed')
+    } finally {
+      vi.useRealTimers()
+      Object.defineProperty(process, 'platform', platform)
+    }
+  })
+
+  // Round 5: sample identity alone could not see these ticks. A host read that
+  // returns nothing leaves the sample object in place, so `sample === issuedFor`
+  // still held 25 s and two ticks later and the statfs re-qualified the verdict.
+  it('will not let ticks with a failed host read pass a stale statfs off as co-timed', async () => {
+    const platform = Object.getOwnPropertyDescriptor(process, 'platform')!
+    Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+    vi.useFakeTimers()
+    let resolveVolume: (value: SwapVolumeFreeSpace) => void = () => {}
+    try {
+      setSystemMemoryInfoReaderForTest(() => BEFORE_THE_STORM)
+      setSwapVolumeFreeSpaceReaderForTest(
+        () =>
+          new Promise<SwapVolumeFreeSpace>((resolve) => {
+            resolveVolume = resolve
+          })
+      )
+      void samplePreGoneSystemMemory(0)
+
+      // GlobalMemoryStatusEx starts failing: the sample is neither replaced nor erased.
+      setSystemMemoryInfoReaderForTest(() => null)
+      await samplePreGoneSystemMemory(10_000)
+      await samplePreGoneSystemMemory(20_000)
+
+      resolveVolume({ freeMB: 40_000, volume: 'C:' })
+      await vi.advanceTimersByTimeAsync(0)
+
+      vi.setSystemTime(25_000)
+      const details = buildProcessGoneCrashDetails({}, 'renderer')
+      // 25 s of lag: the label must not say co-timed beside that age.
+      expect(details.systemMemoryPreGoneSwapVolumeAgeMs).toBe(25_000)
+      expect(details.systemMemoryPreGonePressureSignal).toBe('available-commit-unqualified')
+    } finally {
+      vi.useRealTimers()
+      Object.defineProperty(process, 'platform', platform)
+    }
+  })
+
+  it("arms the host sampler on its own unref'd 10 s timer, not the metric sweep's", async () => {
+    vi.useFakeTimers()
+    vi.setSystemTime(0)
+    const readHostMemory = vi.fn(() => UNDER_COMMIT_PRESSURE)
+    setSystemMemoryInfoReaderForTest(readHostMemory)
+    setSwapVolumeFreeSpaceReaderForTest(() => Promise.resolve({ freeMB: 120, volume: 'C:' }))
+    const setIntervalSpy = vi.spyOn(globalThis, 'setInterval')
+    try {
+      startPreGoneCrashSampling()
+
+      // Literal millisecond values: asserting the constants against themselves
+      // would let a cadence regression through, and 37 s of staleness is the bug.
+      expect(setIntervalSpy.mock.calls.map(([, ms]) => ms)).toEqual([60_000, 10_000])
+      for (const { value } of setIntervalSpy.mock.results) {
+        expect((value as NodeJS.Timeout).hasRef()).toBe(false)
+      }
+      expect(readHostMemory).toHaveBeenCalledTimes(1)
+
+      readHostMemory.mockReturnValue(AFTER_THE_CORPSE_RELEASED)
+      await vi.advanceTimersByTimeAsync(10_000)
+      // One host tick, no extra metric sweep: the two samplers run independently.
+      expect(readHostMemory).toHaveBeenCalledTimes(2)
+      expect(appMetricsMock).toHaveBeenCalledTimes(1)
+
+      const details = buildProcessGoneCrashDetails({}, 'renderer')
+      expect(details.systemMemoryPreGoneSampleAgeMs).toBe(0)
+      expect(details.systemMemoryPreGoneSwapFreeMB).toBe(2_900)
+    } finally {
+      setIntervalSpy.mockRestore()
+      vi.useRealTimers()
+    }
+  })
+
+  it('commits the host reading without waiting on the swap-volume statfs', async () => {
+    // Why: statfs is slowest during the paging storm this sampler targets, and
+    // a hung volume must not stall or silently skip host sampling.
+    setSystemMemoryInfoReaderForTest(() => UNDER_COMMIT_PRESSURE)
+    setSwapVolumeFreeSpaceReaderForTest(() => new Promise(() => {}))
+
+    void samplePreGoneSystemMemory(Date.now() - 5_000)
+    expect(buildProcessGoneCrashDetails({}, 'renderer').systemMemoryPreGoneSwapFreeMB).toBe(200)
+
+    // A second tick still refreshes the reading while that statfs hangs.
+    setSystemMemoryInfoReaderForTest(() => AFTER_THE_CORPSE_RELEASED)
+    void samplePreGoneSystemMemory(Date.now())
+    expect(buildProcessGoneCrashDetails({}, 'renderer').systemMemoryPreGoneSwapFreeMB).toBe(2_900)
+  })
+
+  it('publishes no pre-gone host keys when every memory field failed to read', async () => {
+    // Why not "no keys at all": the reading always carries its signal label, so a
+    // committed empty one would ship an age and a volume number with no memory
+    // numbers beside them — a disk-free figure standing in for a host reading.
+    setSystemMemoryInfoReaderForTest(() => ({ total: Number.NaN, free: undefined }))
+    await samplePreGoneSystemMemory(Date.now())
+
+    const details = buildProcessGoneCrashDetails({}, 'renderer')
+
+    expect(Object.keys(details).filter((key) => key.startsWith('systemMemoryPreGone'))).toEqual([])
+  })
+
+  it('carries the last volume reading forward, aged, instead of dropping it', async () => {
+    vi.useFakeTimers()
+    try {
+      setSystemMemoryInfoReaderForTest(() => UNDER_COMMIT_PRESSURE)
+      setSwapVolumeFreeSpaceReaderForTest(() => Promise.resolve({ freeMB: 42, volume: 'C:' }))
+      await samplePreGoneSystemMemory(0)
+
+      // The next tick's statfs hangs — during the paging storm this targets, that
+      // is the normal case — so the tick has no volume reading of its own, and
+      // the sample that replaces the last one would otherwise drop the field.
+      setSwapVolumeFreeSpaceReaderForTest(() => new Promise<never>(() => {}))
+      void samplePreGoneSystemMemory(10_000)
+      vi.setSystemTime(10_000)
+
+      const details = buildProcessGoneCrashDetails({}, 'renderer')
+      expect(details.systemMemoryPreGoneSwapVolumeFreeMB).toBe(42)
+      expect(details.systemMemoryPreGoneSwapVolume).toBe('C:')
+      expect(details.systemMemoryPreGoneSampleAgeMs).toBe(0)
+      // Carried, not re-read: it ships at its real age, never as a fresh number.
+      expect(details.systemMemoryPreGoneSwapVolumeAgeMs).toBe(10_000)
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('keeps a failed host read from erasing the process-metric sample', async () => {
+    samplePreGoneProcessMetrics(Date.now() - 5_000)
+    setSystemMemoryInfoReaderForTest(() => {
+      throw new Error('getSystemMemoryInfo unavailable')
+    })
+    await samplePreGoneSystemMemory(Date.now() - 5_000)
+    setSystemMemoryInfoReaderForTest(null)
+
+    const details = buildProcessGoneCrashDetails({ processType: 'renderer' }, 'renderer')
+
+    expect(details.processMetricsPreGoneRendererWorkingSetMB).toBe(400)
+    expect(Object.keys(details).filter((key) => key.startsWith('systemMemoryPreGone'))).toEqual([])
+  })
+})
diff --git a/src/main/crash-reporting/pre-gone-host-memory.ts b/src/main/crash-reporting/pre-gone-host-memory.ts
new file mode 100644
index 00000000000..0db56796750
--- /dev/null
+++ b/src/main/crash-reporting/pre-gone-host-memory.ts
@@ -0,0 +1,164 @@
+import type { CrashReportDetailValue } from '../../shared/crash-reporting'
+import { readSwapVolumeFreeSpace } from './swap-volume-free-space'
+import {
+  getSystemMemoryDetails,
+  SYSTEM_MEMORY_KEY_PREFIX,
+  withSwapVolumeFreeSpace
+} from './system-memory-details'
+
+// ─── Pre-gone host memory sampling ──────────────────────────────────
+// Why sample at all: the gone-time host read lands after the corpse released
+// its pages, so it reports a healthier machine than the one that refused the
+// allocation.
+// Why 10 s and not the 60 s process-metrics cadence: at 60 s, four of five
+// field OOMs carried a ~37 s old host reading — far too stale to see a
+// transient commit refusal. A refusal shorter than the interval stays
+// invisible; no cadence fixes that.
+
+export const PRE_GONE_SYSTEM_MEMORY_SAMPLE_INTERVAL_MS = 10_000
+
+type CrashReportDetails = Record<string, CrashReportDetailValue>
+
+type PreGoneSystemMemorySample = {
+  details: CrashReportDetails
+  sampledAtMs: number
+  /** Tick that ISSUED the statfs now merged in — never the tick it resolved on. */
+  swapVolumeSampledAtMs?: number
+}
+
+let preGoneSample: PreGoneSystemMemorySample | null = null
+let preGoneTimer: ReturnType<typeof setInterval> | null = null
+let swapVolumeReadInFlight = false
+let samplingGeneration = 0
+let sampleTick = 0
+
+const PRESSURE_SIGNAL_KEY = `${SYSTEM_MEMORY_KEY_PREFIX}PressureSignal`
+
+/**
+ * Carries the last volume reading onto the sample that replaces its own.
+ *
+ * Why: a statfs slower than one tick would otherwise make the field vanish from
+ * the reports it exists for — the next tick replaces the sample wholesale, and
+ * the in-flight latch keeps intervening ticks from merging anything. It ships
+ * with its own (now larger) age and, not being co-timed, never names the label.
+ */
+function withCarriedSwapVolume(sample: PreGoneSystemMemorySample): PreGoneSystemMemorySample {
+  const previous = preGoneSample
+  if (!previous || previous.swapVolumeSampledAtMs === undefined) {
+    return sample
+  }
+  const freeMB = previous.details[`${SYSTEM_MEMORY_KEY_PREFIX}SwapVolumeFreeMB`]
+  const volume = previous.details[`${SYSTEM_MEMORY_KEY_PREFIX}SwapVolume`]
+  if (typeof freeMB !== 'number' || typeof volume !== 'string') {
+    return sample
+  }
+  return {
+    ...sample,
+    details: withSwapVolumeFreeSpace(sample.details, { freeMB, volume }, process.platform, false),
+    swapVolumeSampledAtMs: previous.swapVolumeSampledAtMs
+  }
+}
+
+function commitHostMemorySample(nowMs: number): boolean {
+  try {
+    const details = getSystemMemoryDetails()
+    // Why not `length === 0`: the signal label is appended unconditionally, so a
+    // reading that resolved no memory field at all still arrives with one key.
+    if (!Object.keys(details).some((key) => key !== PRESSURE_SIGNAL_KEY)) {
+      return false
+    }
+    preGoneSample = withCarriedSwapVolume({ details, sampledAtMs: nowMs })
+    return true
+  } catch {
+    // Why: a failed read must not erase the previous good sample.
+    return false
+  }
+}
+
+async function mergeSwapVolumeFreeSpace(issuedOnTick: number): Promise<void> {
+  if (swapVolumeReadInFlight) {
+    return
+  }
+  swapVolumeReadInFlight = true
+  const generation = samplingGeneration
+  const issuedFor = preGoneSample
+  try {
+    const volume = await readSwapVolumeFreeSpace()
+    if (volume && preGoneSample && generation === samplingGeneration) {
+      // Why only its own tick qualifies: a statfs that outlived its tick carries a
+      // pre-storm volume number, and the latch makes that lag unbounded. It still
+      // ships beside its age, but it may not decide the verdict.
+      // Why the tick counter and not sample identity: a tick whose host read fails
+      // leaves the sample object in place, so identity alone reads as co-timed.
+      const coTimed = issuedOnTick === sampleTick
+      preGoneSample = {
+        ...preGoneSample,
+        details: withSwapVolumeFreeSpace(preGoneSample.details, volume, process.platform, coTimed),
+        swapVolumeSampledAtMs: issuedFor?.sampledAtMs
+      }
+    }
+  } catch {
+    // Why: the memory reading is already committed and stands on its own.
+  } finally {
+    swapVolumeReadInFlight = false
+  }
+}
+
+export async function samplePreGoneSystemMemory(nowMs: number = Date.now()): Promise<void> {
+  // Why commit before awaiting: the volume read is a statfs, and under the very
+  // paging storm this targets it is slowest — it must never delay, or (via an
+  // in-flight latch) skip, the cheap synchronous host reading.
+  const tick = ++sampleTick
+  if (!commitHostMemorySample(nowMs)) {
+    return
+  }
+  await mergeSwapVolumeFreeSpace(tick)
+}
+
+export function startPreGoneSystemMemorySampling(
+  intervalMs: number = PRE_GONE_SYSTEM_MEMORY_SAMPLE_INTERVAL_MS
+): void {
+  if (preGoneTimer) {
+    return
+  }
+  void samplePreGoneSystemMemory()
+  preGoneTimer = setInterval(() => void samplePreGoneSystemMemory(), intervalMs)
+  preGoneTimer.unref?.()
+}
+
+export function resetPreGoneSystemMemorySamplingForTest(): void {
+  if (preGoneTimer) {
+    clearInterval(preGoneTimer)
+  }
+  preGoneTimer = null
+  preGoneSample = null
+  swapVolumeReadInFlight = false
+  // Why bump: an already-awaited volume read must not repopulate a reset sample.
+  samplingGeneration += 1
+}
+
+/** Keyed as `systemMemoryPreGone*` so a scan over the `systemMemory` family sees both reads. */
+export function preGoneSystemMemoryDetails(nowMs: number): CrashReportDetails {
+  if (!preGoneSample) {
+    return {}
+  }
+  const details: CrashReportDetails = {
+    [`${SYSTEM_MEMORY_KEY_PREFIX}PreGoneSampleAgeMs`]: Math.max(
+      0,
+      nowMs - preGoneSample.sampledAtMs
+    )
+  }
+  // Why its own age: the volume read resolves out of band, so it can be older
+  // than the memory reading printed beside it, and that gap must be readable.
+  if (preGoneSample.swapVolumeSampledAtMs !== undefined) {
+    details[`${SYSTEM_MEMORY_KEY_PREFIX}PreGoneSwapVolumeAgeMs`] = Math.max(
+      0,
+      nowMs - preGoneSample.swapVolumeSampledAtMs
+    )
+  }
+  for (const [key, value] of Object.entries(preGoneSample.details)) {
+    details[`${SYSTEM_MEMORY_KEY_PREFIX}PreGone${key.slice(SYSTEM_MEMORY_KEY_PREFIX.length)}`] =
+      value
+  }
+  return details
+}
diff --git a/src/main/crash-reporting/process-gone-diagnostics.test.ts b/src/main/crash-reporting/process-gone-diagnostics.test.ts
index e31645865d8..6a6ec410733 100644
--- a/src/main/crash-reporting/process-gone-diagnostics.test.ts
+++ b/src/main/crash-reporting/process-gone-diagnostics.test.ts
@@ -2,11 +2,11 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import {
   buildProcessGoneCrashDetails,
   collectProcessGoneMetricDetails,
-  resetPreGoneProcessMetricsSamplingForTest,
+  resetPreGoneCrashSamplingForTest,
   samplePreGoneProcessMetrics,
-  startPreGoneProcessMetricsSampling
+  startPreGoneCrashSampling
 } from './process-gone-diagnostics'
-import { setSystemMemoryInfoReaderForTest } from './gone-time-system-memory'
+import { setSystemMemoryInfoReaderForTest } from './system-memory-details'
 
 type MetricFixture = {
   pid?: number
@@ -27,7 +27,7 @@ vi.mock('electron', () => ({
 
 describe('process gone diagnostics', () => {
   beforeEach(() => {
-    resetPreGoneProcessMetricsSamplingForTest()
+    resetPreGoneCrashSamplingForTest()
     setSystemMemoryInfoReaderForTest(null)
   })
 
@@ -141,8 +141,8 @@ describe('process gone diagnostics', () => {
     appMetricsMock.mockReturnValue([
       { pid: 30, type: 'Tab', memory: { workingSetSize: 1024 * 100 } }
     ])
-    startPreGoneProcessMetricsSampling(1_000)
-    startPreGoneProcessMetricsSampling(1_000)
+    startPreGoneCrashSampling(1_000)
+    startPreGoneCrashSampling(1_000)
 
     // A crash inside the first interval already has a sample to draw from.
     expect(buildProcessGoneCrashDetails({}, 'renderer')).toMatchObject({
@@ -582,12 +582,12 @@ describe('process gone diagnostics', () => {
   it("arms an unref'd interval so sampling never holds the event loop open", () => {
     const setIntervalSpy = vi.spyOn(globalThis, 'setInterval')
     try {
-      startPreGoneProcessMetricsSampling(60_000)
+      startPreGoneCrashSampling(60_000)
       const timer = setIntervalSpy.mock.results[0]?.value as NodeJS.Timeout
       expect(timer.hasRef()).toBe(false)
     } finally {
       setIntervalSpy.mockRestore()
-      resetPreGoneProcessMetricsSamplingForTest()
+      resetPreGoneCrashSamplingForTest()
     }
   })
 
@@ -641,7 +641,7 @@ describe('process gone diagnostics', () => {
     expect(details.systemMemoryTotalMB).toBe(16_384)
   })
 
-  it('samples system memory at gone time but never into the pre-gone snapshot', () => {
+  it('samples system memory at gone time but never into the processMetrics family', () => {
     appMetricsMock.mockReturnValue([{ pid: 1, type: 'Browser', memory: { workingSetSize: 0 } }])
     samplePreGoneProcessMetrics()
     setSystemMemoryInfoReaderForTest(() => ({
@@ -658,7 +658,9 @@ describe('process gone diagnostics', () => {
       systemMemorySwapTotalMB: 8_192,
       systemMemorySwapFreeMB: 40
     })
-    expect(details.processMetricsPreGoneSystemMemoryTotalMB).toBeUndefined()
+    expect(
+      Object.keys(details).filter((key) => key.startsWith('processMetricsPreGoneSystem'))
+    ).toEqual([])
   })
 
   it('leaves records unflagged when the crashed bucket is still populated', () => {
diff --git a/src/main/crash-reporting/process-gone-diagnostics.ts b/src/main/crash-reporting/process-gone-diagnostics.ts
index d0bb380a2b6..bf0d735a2c7 100644
--- a/src/main/crash-reporting/process-gone-diagnostics.ts
+++ b/src/main/crash-reporting/process-gone-diagnostics.ts
@@ -3,7 +3,13 @@ import {
   sanitizeCrashReportDetails,
   type CrashReportDetailValue
 } from '../../shared/crash-reporting'
-import { getSystemMemoryAtGoneDetails, memoryKBFieldMB } from './gone-time-system-memory'
+import { getSystemMemoryDetails, memoryKBFieldMB } from './system-memory-details'
+import {
+  PRE_GONE_SYSTEM_MEMORY_SAMPLE_INTERVAL_MS,
+  preGoneSystemMemoryDetails,
+  resetPreGoneSystemMemorySamplingForTest,
+  startPreGoneSystemMemorySampling
+} from './pre-gone-host-memory'
 
 type ProcessMetricLike = {
   pid?: unknown
@@ -204,8 +210,9 @@ export function samplePreGoneProcessMetrics(nowMs: number = Date.now()): void {
   }
 }
 
-export function startPreGoneProcessMetricsSampling(
-  intervalMs: number = PROCESS_METRICS_PRE_GONE_SAMPLE_INTERVAL_MS
+export function startPreGoneCrashSampling(
+  intervalMs: number = PROCESS_METRICS_PRE_GONE_SAMPLE_INTERVAL_MS,
+  systemMemoryIntervalMs: number = PRE_GONE_SYSTEM_MEMORY_SAMPLE_INTERVAL_MS
 ): void {
   if (preGoneSampleTimer) {
     return
@@ -213,14 +220,16 @@ export function startPreGoneProcessMetricsSampling(
   samplePreGoneProcessMetrics()
   preGoneSampleTimer = setInterval(() => samplePreGoneProcessMetrics(), intervalMs)
   preGoneSampleTimer.unref?.()
+  startPreGoneSystemMemorySampling(systemMemoryIntervalMs)
 }
 
-export function resetPreGoneProcessMetricsSamplingForTest(): void {
+export function resetPreGoneCrashSamplingForTest(): void {
   if (preGoneSampleTimer) {
     clearInterval(preGoneSampleTimer)
   }
   preGoneSampleTimer = null
   preGoneSample = null
+  resetPreGoneSystemMemorySamplingForTest()
 }
 
 const PROCESS_METRICS_KEY_PREFIX = 'processMetrics'
@@ -271,7 +280,7 @@ export function buildProcessGoneCrashDetails(
   const crashDetails: CrashReportDetails = {
     ...sanitizedDetails,
     ...liveMetricDetails,
-    ...getSystemMemoryAtGoneDetails()
+    ...getSystemMemoryDetails()
   }
   // Why: with the crasher gone, Largest names a survivor — flag that so the
   // live buckets are read as "everyone else", not as the crashed process.
@@ -290,8 +299,10 @@ export function buildProcessGoneCrashDetails(
   if (liveMetricDetails[crashedBucketCountKey] === 0 || sampledSameBucketProcessVanished) {
     crashDetails.processMetricsCrashedProcessAbsent = true
   }
+  const nowMs = Date.now()
   if (preGoneSample) {
-    Object.assign(crashDetails, preGoneSampleDetails(preGoneSample, Date.now()))
+    Object.assign(crashDetails, preGoneSampleDetails(preGoneSample, nowMs))
   }
+  Object.assign(crashDetails, preGoneSystemMemoryDetails(nowMs))
   return crashDetails
 }
diff --git a/src/main/crash-reporting/self-initiated-tree-kill-log.test.ts b/src/main/crash-reporting/self-initiated-tree-kill-log.test.ts
index c57c1796a35..e958dac42f8 100644
--- a/src/main/crash-reporting/self-initiated-tree-kill-log.test.ts
+++ b/src/main/crash-reporting/self-initiated-tree-kill-log.test.ts
@@ -17,17 +17,17 @@ import { recordProcessGoneCrash, type ProcessGoneCrashEvent } from './process-go
 import { resetProcessGoneSiblingCorrelationForTest } from './process-gone-sibling-correlation'
 import {
   findSelfInitiatedTreeKills,
-  installProcessTreeKillBreadcrumbObserver,
   recordRefusedOwnChromiumTreeKill,
   recordSelfInitiatedTreeKill,
   resetSelfInitiatedTreeKillLogForTest,
   selfInitiatedTreeKillDetails
 } from './self-initiated-tree-kill-log'
 import {
-  notifyProcessTreeKill,
-  setProcessTreeKillObserver
-} from '../../shared/child-process/process-tree-kill-observer'
+  admitProcessTreeKill,
+  setProcessTreeKillGate
+} from '../../shared/child-process/process-tree-kill-gate'
 import { terminateWindowsProcessTree } from '../windows-process-tree-kill'
+import { installMainProcessTreeKillGate } from '../own-chromium-tree-kill-guard'
 import { _resetTracerForTests, setActiveSink } from '../observability/tracer'
 
 /** The field shape: renderer, `reason=killed exitCode=1`, win32 (#G2). */
@@ -252,12 +252,90 @@ describe('self-initiated tree kill breadcrumb', () => {
     expect(String(details.selfInitiatedKills)).toContain('more)')
   })
 
-  it('records a kill issued through the shared runProcess choke point', () => {
-    installProcessTreeKillBreadcrumbObserver()
+  it('keeps the pid-addressed kill when a window-close burst overruns the ring', () => {
+    // Review probe: one taskkill, then 32 routine Job Object teardowns. Under
+    // plain FIFO the discriminating entry is evicted and the persisted detail
+    // becomes byte-identical to the external-kill arm.
+    const goneAt = 5_000_000
+    recordSelfInitiatedTreeKill({
+      pid: 4242,
+      site: 'pty-descendant-sweep',
+      scope: 'win-taskkill-tree',
+      at: goneAt - 4_000
+    })
+    for (let index = 0; index < 32; index += 1) {
+      recordSelfInitiatedTreeKill({
+        pid: 6000 + index,
+        site: 'windows-pty-job-teardown',
+        scope: 'win-pty-job',
+        at: goneAt - 100
+      })
+    }
 
-    notifyProcessTreeKill({ pid: 3131, site: 'run-process-tree', scope: 'posix-process-group' })
+    const details = selfInitiatedTreeKillDetails(goneAt)
+
+    expect(details.selfInitiatedTreeKillCount).toBe(1)
+    expect(details.selfInitiatedGroupKillCount).toBe(31)
+    expect(String(details.selfInitiatedKills)).toMatch(
+      /^win-taskkill-tree\/pty-descendant-sweep\/pid4242 -4000ms/
+    )
+  })
+
+  it('keeps the newest teardown when a session has saturated the ring with pid kills', () => {
+    // Review probe, the mirror of the case above: 32 session-old taskkills (six
+    // routine families feed them) then the Job Object teardown 50ms before the
+    // death. A scope-preference eviction with no floor splices the entry it just
+    // pushed, and `{}` is byte-identical to the external-kill arm.
+    const goneAt = 5_000_000
+    for (let index = 0; index < 32; index += 1) {
+      recordSelfInitiatedTreeKill({
+        pid: 6000 + index,
+        site: 'pty-descendant-sweep',
+        scope: 'win-taskkill-tree',
+        at: goneAt - 600_000 + index * 1_000
+      })
+    }
+    recordSelfInitiatedTreeKill({
+      pid: 7777,
+      site: 'windows-pty-job-teardown',
+      scope: 'win-pty-job',
+      at: goneAt - 50
+    })
+
+    const details = selfInitiatedTreeKillDetails(goneAt)
+
+    expect(details.selfInitiatedGroupKillCount).toBe(1)
+    expect(String(details.selfInitiatedKills)).toContain(
+      'win-pty-job/windows-pty-job-teardown/pid7777 -50ms'
+    )
+  })
+
+  it('evicts the oldest pid kill, not the newest, once every candidate is pid-addressed', () => {
+    const goneAt = 5_000_000
+    for (let index = 0; index < 33; index += 1) {
+      recordSelfInitiatedTreeKill({
+        pid: 6000 + index,
+        site: 'git-command-tree-kill',
+        scope: 'win-taskkill-tree',
+        at: goneAt - 1_000
+      })
+    }
+
+    const pids = findSelfInitiatedTreeKills(goneAt).map((kill) => kill.pid)
+
+    expect(pids).toHaveLength(32)
+    expect(pids).toContain(6032)
+    expect(pids).not.toContain(6000)
+  })
+
+  it('records a kill issued through the shared runProcess choke point', () => {
+    installMainProcessTreeKillGate()
+
+    expect(
+      admitProcessTreeKill({ pid: 3131, site: 'run-process-tree', scope: 'posix-process-group' })
+    ).toBe(true)
 
     expect(findSelfInitiatedTreeKills(Date.now()).map((kill) => kill.pid)).toEqual([3131])
-    setProcessTreeKillObserver(null)
+    setProcessTreeKillGate(null)
   })
 })
diff --git a/src/main/crash-reporting/self-initiated-tree-kill-log.ts b/src/main/crash-reporting/self-initiated-tree-kill-log.ts
index e819795074f..809d421ac61 100644
--- a/src/main/crash-reporting/self-initiated-tree-kill-log.ts
+++ b/src/main/crash-reporting/self-initiated-tree-kill-log.ts
@@ -1,8 +1,5 @@
 import type { CrashReportDetailValue } from '../../shared/crash-reporting'
-import {
-  setProcessTreeKillObserver,
-  type ProcessTreeKillScope
-} from '../../shared/child-process/process-tree-kill-observer'
+import type { ProcessTreeKillScope } from '../../shared/child-process/process-tree-kill-gate'
 import { recordCoalescedDurableCrashBreadcrumb } from './durable-crash-breadcrumb'
 
 /**
@@ -19,24 +16,38 @@ import { recordCoalescedDurableCrashBreadcrumb } from './durable-crash-breadcrum
  * The ring is per-process and its only reader is `process-gone-recorder`, which
  * exists in Electron main. So a count reported on a `render-process-gone` covers
  * kills issued *from Electron main*, and nothing else:
- * - Main only: the three `taskkill /T /F` families that gate on
- *   `admitSelfInitiatedTreeKill` (`terminateWindowsProcessTree` and the codex /
- *   claude account-login teardowns) and the codex app-server POSIX group
+ * - Main only: the families that import the gate directly —
+ *   `terminateWindowsProcessTree`, the codex and claude account-login
+ *   teardowns, the git command-runner abort, the notebook-cell and
+ *   automation-precheck timeouts — plus the codex app-server POSIX group
  *   teardowns.
- * - Main *and* other hosts: `signalProcessTree` (the `runProcess` choke point,
- *   reached from the CLI, relay and daemon too — a fourth pid-addressed
- *   `taskkill` family, gated on the child not being reaped rather than on the
- *   Chromium set it cannot read), the POSIX PTY process-group sweep and the
- *   Windows PTY Job Object (relay `pty-handler`, daemon
- *   `subprocess-handle`). When those run outside main they record into that
- *   process's own ring, which nothing reads — no observer is installed there,
- *   and the tracer sink is a no-op.
- * - Never instrumented: the direct `process.kill(-pid)` calls in the browser
- *   routes, notebooks, automation prechecks and ephemeral-VM recipes.
+ * - Main *and* other hosts, through the `process-tree-kill-gate` seam main
+ *   installs the same guard into: `signalProcessTree` (the `runProcess` choke
+ *   point, reached from the CLI, relay and daemon too), the codex app-server
+ *   deadline kill (compiled into the CLI as well) and the ephemeral-VM recipe
+ *   kill. Also host-spanning but recording directly: the POSIX PTY
+ *   process-group sweep and the Windows PTY Job Object (relay `pty-handler`,
+ *   daemon `subprocess-handle`). When any of these run outside main they record
+ *   into that process's own ring, which nothing reads — no gate is installed
+ *   there, and the tracer sink is a no-op.
+ * - Never instrumented, and none of them a pid-addressed kill issued from main:
+ *   the POSIX `process.kill(-pid, …)` group arms of the notebook, precheck,
+ *   browser-route and ephemeral-VM kills, plus the macOS keyboard-input-source
+ *   probe's group kill in `ipc/app.ts`; the relay's own
+ *   `subprocess-tree-termination` taskkill and the CLI's login-interruption
+ *   taskkill (neither runs in main); and the browser-route Electron probes,
+ *   which are reached only from `*.electron.test.ts`.
+ *
+ * `main-process-tree-kill-gate.test.ts` is the ratchet that keeps that list
+ * closed: it counts `/pid` call sites against gate admissions per file, so a new
+ * pid-addressed kill fails it whether it lands in a new file or inside a family
+ * that already asks the gate. It does not see a `/pid` argument built from a
+ * variable.
  *
  * A daemon or relay kill missing from the count is a diagnostics gap, not a
  * missed suspect: those hosts cannot reach a Chromium pid in the first place
- * (see `orca-chromium-process-pids.ts`). Absence is evidence, not proof.
+ * (see `orca-chromium-process-pids.ts`), and a group or Job-Object kill can
+ * only contain what Orca put in it. Absence is evidence, not proof.
  */
 
 /** Which mechanism issued the kill; each has a different blast radius. */
@@ -81,6 +92,25 @@ function isPidAddressedTreeKill(scope: SelfInitiatedTreeKillScope): boolean {
   return scope === 'win-taskkill-tree'
 }
 
+/**
+ * Drop one entry, newest-first-preserving.
+ *
+ * Two rules, in order. The entry just recorded is never a candidate: it is the
+ * one closest to any death that follows, and evicting it leaves a detail
+ * byte-identical to the external-kill arm. Among the rest, routine group/job
+ * teardown goes before a pid-addressed kill — a window-close burst is 30+ group
+ * kills and plain FIFO would drop the one entry that can explain the death —
+ * falling back to plain FIFO once every candidate is pid-addressed, which is
+ * what an ordinary session saturates the ring with.
+ */
+function evictOneSelfInitiatedTreeKill(): void {
+  const lastCandidate = selfInitiatedKills.length - 1
+  const oldestGroupKill = selfInitiatedKills.findIndex(
+    (kill, index) => index < lastCandidate && !isPidAddressedTreeKill(kill.scope)
+  )
+  selfInitiatedKills.splice(Math.max(oldestGroupKill, 0), 1)
+}
+
 export function recordSelfInitiatedTreeKill({
   pid,
   site,
@@ -96,13 +126,15 @@ export function recordSelfInitiatedTreeKill({
     return
   }
   selfInitiatedKills.push({ pid, site, scope, at })
-  if (selfInitiatedKills.length > MAX_TRACKED_SELF_KILLS) {
-    selfInitiatedKills = selfInitiatedKills.slice(-MAX_TRACKED_SELF_KILLS)
+  while (selfInitiatedKills.length > MAX_TRACKED_SELF_KILLS) {
+    evictOneSelfInitiatedTreeKill()
   }
   // Durable so it survives into the diagnostic bundle even when the kill takes
   // the reporting renderer with it; coalesced because the crash detail above is
   // the primary record and a teardown burst must not cost 30 ring slots plus a
-  // forced disk flush each. The newest pid still rides the emitted crumb.
+  // forced disk flush each. The retained ring crumb carries the newest pid, but
+  // the span trail emits only the first of a coalesced burst — read
+  // `selfInitiatedKills` for the rest.
   recordCoalescedDurableCrashBreadcrumb({
     name: 'self_tree_kill',
     data: { pid, site, scope },
@@ -133,11 +165,6 @@ export function recordRefusedOwnChromiumTreeKill(target: {
   })
 }
 
-/** Routes the `runProcess` choke point's kills here; shared code cannot import us. */
-export function installProcessTreeKillBreadcrumbObserver(): void {
-  setProcessTreeKillObserver((kill) => recordSelfInitiatedTreeKill(kill))
-}
-
 export function findSelfInitiatedTreeKills(at: number): SelfInitiatedTreeKill[] {
   return selfInitiatedKills.filter((kill) => {
     const offsetMs = kill.at - at
diff --git a/src/main/crash-reporting/swap-volume-free-space.ts b/src/main/crash-reporting/swap-volume-free-space.ts
new file mode 100644
index 00000000000..3ad40b7629b
--- /dev/null
+++ b/src/main/crash-reporting/swap-volume-free-space.ts
@@ -0,0 +1,67 @@
+import { statfs } from 'node:fs/promises'
+import path from 'node:path'
+
+// Why: a system-managed Windows pagefile — and a macOS swapfile — only grows
+// into free space on its own volume, so low available commit is a REFUSED
+// allocation only when that volume is full too. Linux is excluded on purpose:
+// its swap is a fixed partition, a fixed-size swapfile, or zram, none of which
+// grow into root-fs free space, so the number would read as headroom that
+// cannot exist. The measured volume ships alongside because Windows only names
+// the DEFAULT pagefile drive; a relocated pagefile lives elsewhere.
+
+const BYTES_PER_MB = 1024 * 1024
+
+export type SwapVolumeFreeSpace = {
+  freeMB: number
+  /** Which volume was measured, separator-trimmed so redaction sees no path. */
+  volume: string
+}
+
+type SwapVolumeFreeSpaceReader = (
+  platform: NodeJS.Platform
+) => Promise<SwapVolumeFreeSpace | undefined>
+
+function swapVolumeAnchor(platform: NodeJS.Platform): string | undefined {
+  if (platform === 'win32') {
+    const anchor = process.env.SystemRoot || process.env.SystemDrive
+    return anchor ? path.parse(anchor).root || anchor : undefined
+  }
+  return platform === 'darwin' ? path.sep : undefined
+}
+
+function volumeLabel(root: string): string {
+  const trimmed = root.replace(/[\\/]+$/, '')
+  return trimmed.length > 0 ? trimmed : root
+}
+
+async function statfsSwapVolumeFreeSpace(
+  platform: NodeJS.Platform
+): Promise<SwapVolumeFreeSpace | undefined> {
+  const root = swapVolumeAnchor(platform)
+  if (!root) {
+    return undefined
+  }
+  try {
+    const stats = await statfs(root)
+    const bytes = Number(stats.bsize) * Number(stats.bavail)
+    return Number.isFinite(bytes)
+      ? { freeMB: Math.round(Math.max(0, bytes) / BYTES_PER_MB), volume: volumeLabel(root) }
+      : undefined
+  } catch {
+    return undefined
+  }
+}
+
+let swapVolumeFreeSpaceReader: SwapVolumeFreeSpaceReader = statfsSwapVolumeFreeSpace
+
+export function setSwapVolumeFreeSpaceReaderForTest(
+  reader: SwapVolumeFreeSpaceReader | null
+): void {
+  swapVolumeFreeSpaceReader = reader ?? statfsSwapVolumeFreeSpace
+}
+
+export function readSwapVolumeFreeSpace(
+  platform: NodeJS.Platform = process.platform
+): Promise<SwapVolumeFreeSpace | undefined> {
+  return swapVolumeFreeSpaceReader(platform)
+}
diff --git a/src/main/crash-reporting/system-memory-details.ts b/src/main/crash-reporting/system-memory-details.ts
new file mode 100644
index 00000000000..1f2cf556faa
--- /dev/null
+++ b/src/main/crash-reporting/system-memory-details.ts
@@ -0,0 +1,161 @@
+import type { CrashReportDetailValue } from '../../shared/crash-reporting'
+import type { SwapVolumeFreeSpace } from './swap-volume-free-space'
+
+// ─── Host system memory for crash reports ───────────────────────────
+// Why: the system outlives the crashed process, so this IS sampleable at
+// process-gone — it separates "renderer grew huge" from "machine out of
+// memory/commit", which the per-process buckets alone cannot. The gone-time
+// caller reads AFTER the corpse returned its pages, so free/swapFree read
+// healthier than at kill time; the pre-gone sampler carries a live reading past
+// that.
+// Every reading is labelled `systemMemoryPressureSignal` so no report can be
+// read as a pressure verdict the platform never gave:
+//   win32  — swapFree is MEMORYSTATUSEX.ullAvailPageFile, i.e. available
+//     COMMIT, which pagefile growth can heal (a 127 MB commit floor healed to
+//     2029 MB mid-hold on the win-lowspec repro, killing nothing). Free space on
+//     the swap volume does NOT establish that it could: a fixed-size or disabled
+//     pagefile grows into no amount of empty disk, its maximum is unreadable
+//     here (needs a registry read), and the measured volume is only the DEFAULT
+//     pagefile drive. So a co-timed volume reading is context beside the commit
+//     number — `available-commit-volume-cotimed` — never a verdict. The one
+//     decisive win32 case is a commit limit at or below RAM: no pagefile exists
+//     to grow, so the floor cannot heal (`available-commit-hard-capped`).
+//   linux  — MemAvailable is the real signal; MemFree is not (it excludes page
+//     cache and other reclaimable memory).
+//   darwin — none. `free` stays low on healthy machines and
+//     fileBacked/purgeable are only a reclaimability proxy. The real signal
+//     needs `memory_pressure -Q`; Orca's reader for it
+//     (src/main/memory/host-memory.ts) is on-demand, and spawning a subprocess
+//     on a 10 s app-lifetime timer costs more than the gap it closes.
+
+type CrashReportDetails = Record<string, CrashReportDetailValue>
+
+export const SYSTEM_MEMORY_KEY_PREFIX = 'systemMemory'
+
+export function memoryKBFieldMB(value: unknown): number | undefined {
+  const kb = typeof value === 'number' && Number.isFinite(value) ? value : undefined
+  return kb === undefined ? undefined : Math.round(Math.max(0, kb) / 1024)
+}
+
+type SystemMemoryInfoLike = {
+  total?: unknown
+  free?: unknown
+  available?: unknown
+  swapTotal?: unknown
+  swapFree?: unknown
+  fileBacked?: unknown
+  purgeable?: unknown
+}
+
+type SystemMemoryInfoReader = () => SystemMemoryInfoLike | null
+
+/** How far this reading may be read as a "was the host under pressure" verdict. */
+export type SystemMemoryPressureSignal =
+  | 'available-commit-hard-capped'
+  | 'available-commit-volume-cotimed'
+  | 'available-commit-unqualified'
+  | 'mem-available'
+  | 'none'
+
+function readElectronSystemMemoryInfo(): SystemMemoryInfoLike | null {
+  const read = (process as NodeJS.Process & { getSystemMemoryInfo?: () => SystemMemoryInfoLike })
+    .getSystemMemoryInfo
+  if (typeof read !== 'function') {
+    return null
+  }
+  try {
+    return read.call(process)
+  } catch {
+    return null
+  }
+}
+
+let systemMemoryInfoReader: SystemMemoryInfoReader = readElectronSystemMemoryInfo
+
+export function setSystemMemoryInfoReaderForTest(reader: SystemMemoryInfoReader | null): void {
+  systemMemoryInfoReader = reader ?? readElectronSystemMemoryInfo
+}
+
+function numericDetail(details: CrashReportDetails, suffix: string): number | undefined {
+  const value = details[`${SYSTEM_MEMORY_KEY_PREFIX}${suffix}`]
+  return typeof value === 'number' ? value : undefined
+}
+
+/** Windows commit limit = RAM + pagefile, so a limit at or below RAM has no pagefile behind it. */
+function pagefileBacksCommit(details: CrashReportDetails): boolean | undefined {
+  const total = numericDetail(details, 'TotalMB')
+  const swapTotal = numericDetail(details, 'SwapTotalMB')
+  return total === undefined || swapTotal === undefined ? undefined : swapTotal > total
+}
+
+function pressureSignal(
+  platform: NodeJS.Platform,
+  details: CrashReportDetails,
+  volumeCoTimed = true
+): SystemMemoryPressureSignal {
+  if (platform === 'win32' && `${SYSTEM_MEMORY_KEY_PREFIX}SwapFreeMB` in details) {
+    if (pagefileBacksCommit(details) === false) {
+      return 'available-commit-hard-capped'
+    }
+    return volumeCoTimed && `${SYSTEM_MEMORY_KEY_PREFIX}SwapVolumeFreeMB` in details
+      ? 'available-commit-volume-cotimed'
+      : 'available-commit-unqualified'
+  }
+  if (platform === 'linux' && `${SYSTEM_MEMORY_KEY_PREFIX}AvailableMB` in details) {
+    return 'mem-available'
+  }
+  return 'none'
+}
+
+export function getSystemMemoryDetails(
+  platform: NodeJS.Platform = process.platform
+): CrashReportDetails {
+  const info = systemMemoryInfoReader()
+  if (!info) {
+    return {}
+  }
+  const details: CrashReportDetails = {}
+  const fields: readonly [keyof SystemMemoryInfoLike, string][] = [
+    ['total', 'TotalMB'],
+    ['free', 'FreeMB'],
+    ['available', 'AvailableMB'],
+    ['swapTotal', 'SwapTotalMB'],
+    ['swapFree', 'SwapFreeMB'],
+    ['fileBacked', 'FileBackedMB'],
+    ['purgeable', 'PurgeableMB']
+  ]
+  for (const [field, suffix] of fields) {
+    const mb = memoryKBFieldMB(info[field])
+    if (mb !== undefined) {
+      details[`${SYSTEM_MEMORY_KEY_PREFIX}${suffix}`] = mb
+    }
+  }
+  details[`${SYSTEM_MEMORY_KEY_PREFIX}PressureSignal`] = pressureSignal(platform, details)
+  return details
+}
+
+/**
+ * Merges the statfs-derived volume datum, which needs an await and so is only
+ * reachable from the periodic sampler, and relabels the reading it sits beside.
+ *
+ * `coTimed` false means the statfs outlived the tick that issued it, so this
+ * volume number and the commit number beside it describe different moments —
+ * during a pagefile-growth storm that is exactly when they diverge, and a
+ * pre-storm 40 GB printed next to 200 MB of commit reads as "the pagefile had
+ * room", the opposite conclusion. The datum still ships (with its own age), but
+ * only a co-timed one is named in the label.
+ */
+export function withSwapVolumeFreeSpace(
+  details: CrashReportDetails,
+  volume: SwapVolumeFreeSpace,
+  platform: NodeJS.Platform = process.platform,
+  coTimed = true
+): CrashReportDetails {
+  const merged: CrashReportDetails = {
+    ...details,
+    [`${SYSTEM_MEMORY_KEY_PREFIX}SwapVolumeFreeMB`]: volume.freeMB,
+    [`${SYSTEM_MEMORY_KEY_PREFIX}SwapVolume`]: volume.volume
+  }
+  merged[`${SYSTEM_MEMORY_KEY_PREFIX}PressureSignal`] = pressureSignal(platform, merged, coTimed)
+  return merged
+}
diff --git a/src/main/daemon/agent-startup-prompt-latency.node-pty.test.ts b/src/main/daemon/agent-startup-prompt-latency.node-pty.test.ts
new file mode 100644
index 00000000000..cfa01fed8e5
--- /dev/null
+++ b/src/main/daemon/agent-startup-prompt-latency.node-pty.test.ts
@@ -0,0 +1,123 @@
+import { appendFileSync, existsSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { createPtySubprocess } from './pty-subprocess'
+import { Session } from './session'
+
+const SHELLS = process.platform === 'win32' ? [] : ['/bin/bash', '/bin/zsh'].filter(existsSync)
+const COMMAND = "printf 'AGENT_%s\\n' STARTED"
+
+async function launch(
+  shell: string,
+  slow: boolean,
+  legacy = false
+): Promise<{ output: string; ms: number }> {
+  const root = mkdtempSync(join(tmpdir(), 'orca-startup-latency-'))
+  const bash = shell.endsWith('bash')
+  const pause = slow ? 'sleep 0.6\n' : ''
+  const prompt = slow ? "PS1='$(sleep 0.3)prompt> '\n" : "PS1='prompt> '\n"
+  writeFileSync(
+    join(root, bash ? '.bash_profile' : '.zshrc'),
+    `${pause}${bash ? '' : 'setopt PROMPT_SUBST\n'}${prompt}`
+  )
+  vi.stubEnv('HOME', root)
+  vi.stubEnv('ZDOTDIR', root)
+  vi.stubEnv('ORCA_ORIG_ZDOTDIR', root)
+  let session: Session | undefined
+  let timer: ReturnType<typeof setTimeout> | undefined
+  let legacyTimer: ReturnType<typeof setTimeout> | undefined
+  const readinessEvents: string[] = []
+  const started = performance.now()
+  try {
+    const subprocess = await createPtySubprocess({
+      sessionId: 'startup-latency',
+      cols: 120,
+      rows: 30,
+      cwd: root,
+      shellOverride: shell,
+      command: COMMAND,
+      env: { HOME: root, SHELL: shell, TERM: 'xterm-256color' }
+    })
+    session = new Session({
+      sessionId: 'startup-latency',
+      cols: 120,
+      rows: 30,
+      subprocess,
+      shellReadySupported: !legacy,
+      reportReadinessEvent: (event) => readinessEvents.push(event)
+    })
+    const active = session
+    return await new Promise((resolve, reject) => {
+      let output = ''
+      timer = setTimeout(
+        () => reject(new Error(`Startup timed out: ${JSON.stringify(output)}`)),
+        5000
+      )
+      active.attachClient({
+        onExit: () => {},
+        onData: (data) => {
+          output += data
+          if (output.includes('AGENT_STARTED')) {
+            resolve({ output, ms: performance.now() - started })
+          }
+        }
+      })
+      if (legacy) {
+        legacyTimer = setTimeout(() => active.write(`${COMMAND}\n`), 300)
+      } else {
+        active.write(`${COMMAND}\n`)
+      }
+    })
+  } finally {
+    clearTimeout(timer)
+    clearTimeout(legacyTimer)
+    if (session) {
+      await session.forceKillAndWaitForExit(3000)
+      session.dispose()
+    }
+    vi.unstubAllEnvs()
+    rmSync(root, { recursive: true, force: true })
+    expect(readinessEvents).toEqual([])
+  }
+}
+
+describe('agent startup at the rendered shell prompt', () => {
+  afterEach(() => vi.unstubAllEnvs())
+  it.each(SHELLS)(
+    '%s displays the command once after slow startup and prompt expansion',
+    async (shell) => {
+      const before = await launch(shell, true, true)
+      expect(before.output.split(COMMAND)).toHaveLength(3)
+      const result = await launch(shell, true)
+      expect(result.output).not.toContain('orca-shell-ready')
+      expect(result.output.split(COMMAND)).toHaveLength(2)
+      expect(result.output.indexOf('prompt> ')).toBeLessThan(result.output.indexOf(COMMAND))
+    }
+  )
+
+  it.skipIf(!process.env.ORCA_STARTUP_BENCH || SHELLS.length === 0)(
+    'compares legacy input timing with prompt delivery',
+    async () => {
+      for (const shell of SHELLS) {
+        for (const slow of [false, true]) {
+          const legacy: number[] = []
+          const current: number[] = []
+          for (let i = 0; i < 5; i++) {
+            legacy.push((await launch(shell, slow, true)).ms)
+            const result = await launch(shell, slow)
+            expect(result.output).not.toContain('orca-shell-ready')
+            expect(result.output.split(COMMAND)).toHaveLength(2)
+            current.push(result.ms)
+          }
+          const result = JSON.stringify({ shell, slow, legacy, current })
+          if (process.env.ORCA_STARTUP_BENCH_OUTPUT) {
+            appendFileSync(process.env.ORCA_STARTUP_BENCH_OUTPUT, `${result}\n`)
+          }
+          console.log(result)
+        }
+      }
+    },
+    60_000
+  )
+})
diff --git a/src/main/daemon/daemon-bash-shell-ready-rcfile.ts b/src/main/daemon/daemon-bash-shell-ready-rcfile.ts
index 142c0c131d9..f7834dba9d7 100644
--- a/src/main/daemon/daemon-bash-shell-ready-rcfile.ts
+++ b/src/main/daemon/daemon-bash-shell-ready-rcfile.ts
@@ -2,7 +2,6 @@ import { getPosixOmpShellWrapper } from '../pty/omp-shell-wrapper'
 import { getPosixCodexShellLaunchPreflight } from '../pty/codex-shell-launch-preflight'
 import { BASH_PROMPT_COMMAND_COMPOSITION_BLOCK } from '../bash-prompt-command-composition'
 import { BASH_FEATURE_CHANNEL_BLOCK, SHELL_STARTUP_IDENTITY_MARKER_BLOCK } from '../shell-templates'
-import { SHELL_READY_MARKER } from './daemon-shell-ready-marker'
 
 export function getDaemonBashShellReadyRcfileContent(): string {
   return `# Orca daemon bash shell-ready wrapper
@@ -56,10 +55,6 @@ __orca_osc133_precmd() {
     unset __orca_in_command
   fi
   printf "\\033]133;A\\007"
-  # Why: emit the shell-ready marker here (not a trailing PROMPT_COMMAND entry)
-  # so a framework that must be last in PROMPT_COMMAND — bash-preexec — is not
-  # displaced by one of Orca's own hooks.
-  [[ -n "$__orca_ready_marker" ]] && printf "${SHELL_READY_MARKER}"
   return "$exit_code"
 }
 __orca_osc133_preexec() {
@@ -117,6 +112,11 @@ __orca_osc133_epilogue() {
   unset __orca_in_prompt_command
   __orca_adopt_outer_debug_trap
   trap '__orca_osc133_preexec' DEBUG
+  # Readline renders PS1 after entering raw mode; prompt hooks still run in cooked mode.
+  if [[ -n "$__orca_ready_marker" ]]; then
+    PS1="\${PS1-}"'\\[\\e]777;orca-shell-ready\\a\\]'
+    __orca_ready_marker=""
+  fi
 }
 ${BASH_PROMPT_COMMAND_COMPOSITION_BLOCK}
 __orca_prepend_prompt_command "__orca_osc133_precmd"
diff --git a/src/main/daemon/daemon-foreground-process-protocol.ts b/src/main/daemon/daemon-foreground-process-protocol.ts
index 25c6113057c..5c29e8a9e31 100644
--- a/src/main/daemon/daemon-foreground-process-protocol.ts
+++ b/src/main/daemon/daemon-foreground-process-protocol.ts
@@ -18,5 +18,7 @@ export type InspectProcessRequest = Omit<GetForegroundProcessRequest, 'type'> &
   type: 'inspectProcess'
   payload: GetForegroundProcessRequest['payload'] & {
     expectedIncarnationId?: string
+    /** Optional; a daemon that predates it answers with the full capture as it always did. */
+    steadyState?: boolean
   }
 }
diff --git a/src/main/daemon/daemon-host-relocation.test.ts b/src/main/daemon/daemon-host-relocation.test.ts
index 0d2323fd449..e899a67ed43 100644
--- a/src/main/daemon/daemon-host-relocation.test.ts
+++ b/src/main/daemon/daemon-host-relocation.test.ts
@@ -5,12 +5,13 @@ import {
   mkdtempSync,
   readFileSync,
   readdirSync,
+  renameSync,
   rmSync,
   utimesSync,
   writeFileSync
 } from 'node:fs'
 import os from 'node:os'
-import { dirname, join } from 'node:path'
+import { basename, dirname, join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
 import { setAppEnvironment, type AppEnvironment } from '../../shared/app-environment'
@@ -141,12 +142,11 @@ describe('buildDaemonHostManifest', () => {
       entryRelPath: 'resources/app.asar.unpacked/out/main/daemon-entry.js'
     })
     const byDest = new Map(ops.map((op) => [op.destRel, op]))
-    // The host exe is renamed to a distinct image name (NOT the source basename)
-    // so the NSIS updater's name-based `taskkill /IM Orca.exe` can't kill it.
-    expect(byDest.get('orca-terminal-daemon.exe')?.kind).toBe('file')
-    expect(byDest.has('Orca.exe')).toBe(false)
+    // The host exe keeps the source basename: a verbatim, signature-preserving copy with no
+    // image-name mismatch. What escapes the updater's sweep is the path, not the name.
+    expect(byDest.get('Orca.exe')?.kind).toBe('file')
     const exeOp = ops.find((op) => op.sourcePath === 'C:\\app\\Orca.exe')
-    expect(exeOp?.destRel).not.toBe('Orca.exe')
+    expect(exeOp?.destRel).toBe('Orca.exe')
     // V8/ICU data blobs are read by the Electron bootstrap and kept.
     expect(byDest.has('icudtl.dat')).toBe(true)
     // GPU/graphics DLLs are never loaded by the windowless host, so not copied.
@@ -170,7 +170,7 @@ describe('materializeRelocatedDaemonHost', () => {
     const result = materializeRelocatedDaemonHost()
     expect(result).not.toBeNull()
     const dest = join(localAppDataDir, 'Orca', 'daemon-host', '9.9.9')
-    expect(result?.execPath).toBe(join(dest, 'orca-terminal-daemon.exe'))
+    expect(result?.execPath).toBe(join(dest, 'Orca.exe'))
     expect(result?.entryPath).toBe(
       join(dest, 'resources', 'app.asar.unpacked', 'out', 'main', 'daemon-entry.js')
     )
@@ -203,6 +203,28 @@ describe('materializeRelocatedDaemonHost', () => {
     expect(marker.entryRelPath).toBe('resources/app.asar.unpacked/out/main/daemon-entry.js')
   })
 
+  it('copies the exe verbatim: same file name and same bytes as the install-dir exe', () => {
+    const result = materializeRelocatedDaemonHost()
+    const sourceExe = join(installDir, 'Orca.exe')
+    // Byte-for-byte under the same name is what preserves the Authenticode signature and leaves
+    // no renamed-image signal for endpoint detection to read as masquerading.
+    expect(basename(result!.execPath)).toBe(basename(sourceExe))
+    expect(readFileSync(result!.execPath)).toEqual(readFileSync(sourceExe))
+  })
+
+  it('tracks a differently-named app exe rather than pinning an image name of its own', () => {
+    // A dev-channel or rebranded build ships a different executableName; the host copy must follow
+    // it, which is what keeps the copy verbatim instead of reintroducing a name mismatch.
+    renameSync(join(installDir, 'Orca.exe'), join(installDir, 'Orca Nightly.exe'))
+    setProcessProp('execPath', join(installDir, 'Orca Nightly.exe'))
+    const result = materializeRelocatedDaemonHost()
+    const dest = join(localAppDataDir, 'Orca', 'daemon-host', '9.9.9')
+    expect(result?.execPath).toBe(join(dest, 'Orca Nightly.exe'))
+    expect(existsSync(join(dest, 'orca-terminal-daemon.exe'))).toBe(false)
+    // Re-resolution must agree with materialization or the fork would target a missing exe.
+    expect(getRelocatedDaemonHost()?.execPath).toBe(join(dest, 'Orca Nightly.exe'))
+  })
+
   it('is idempotent: a valid marker short-circuits without recopying', () => {
     materializeRelocatedDaemonHost()
     const dest = join(localAppDataDir, 'Orca', 'daemon-host', '9.9.9')
@@ -210,7 +232,7 @@ describe('materializeRelocatedDaemonHost', () => {
     const sentinel = join(dest, 'sentinel.txt')
     writeFileSync(sentinel, 'keep')
     const result = materializeRelocatedDaemonHost()
-    expect(result?.execPath).toBe(join(dest, 'orca-terminal-daemon.exe'))
+    expect(result?.execPath).toBe(join(dest, 'Orca.exe'))
     expect(existsSync(sentinel)).toBe(true)
   })
 
diff --git a/src/main/daemon/daemon-host-relocation.ts b/src/main/daemon/daemon-host-relocation.ts
index 6d94bea06e4..13aab9fd8f9 100644
--- a/src/main/daemon/daemon-host-relocation.ts
+++ b/src/main/daemon/daemon-host-relocation.ts
@@ -22,6 +22,10 @@ import { inspectProcessLiveness, mergeProcessLivenessVerdict } from './daemon-pr
  * imaged under it, which would otherwise kill the daemon and its live terminals. The relocated exe is a
  * run-as-node Orca.exe copy (not node.exe) so there's no console flash and asar still resolves. Fail-open:
  * any failure returns null and the caller forks the install-dir host (pre-relocation behavior).
+ *
+ * What escapes the updater is the PATH, not the file name: electron-builder's kill sweep selects
+ * processes whose image path sits under $INSTDIR. See docs/reference/windows-daemon-host-relocation.md
+ * for the survival contract and why the exe is copied verbatim rather than renamed.
  */
 
 export type RelocatedDaemonHost = {
@@ -37,8 +41,14 @@ const MARKER_NAME = '.materialized.json'
 // LOCAL appData (not roaming) so OneDrive/roaming never syncs this ~260MB runtime. Shared with NSIS uninstall (config/nsis/orca-installer-hooks.nsh) — keep in sync.
 const LOCAL_HOST_ROOT_NAME = 'Orca'
 
-// Copy of Orca.exe renamed to a distinct image name so the NSIS updater's `taskkill /IM Orca.exe` can't match it.
-const DAEMON_HOST_EXE_NAME = 'orca-terminal-daemon.exe'
+/**
+ * The host exe keeps the app exe's own file name, so the relocated image is a byte-for-byte,
+ * name-included copy of a signed binary — nothing for EDR to read as a renamed image (MITRE T1036).
+ * Survival comes from the path (see the module header). The one name-sensitive updater path is the
+ * no-PowerShell `taskkill /IM` fallback, where the daemon is killed and terminals cold-restore —
+ * the documented pre-relocation outcome, not a failure.
+ */
+const daemonHostExeName = (execPath: string): string => winPath.basename(execPath)
 
 // V8 snapshots + ICU data the Electron bootstrap reads even under ELECTRON_RUN_AS_NODE; siblings of Orca.exe.
 const RUNTIME_DATA_FILES = ['icudtl.dat', 'snapshot_blob.bin', 'v8_context_snapshot.bin']
@@ -146,8 +156,8 @@ export function buildDaemonHostManifest(sources: DaemonHostSources): CopyOp[] {
   const { appDir, execPath, resourcesPath, entrySourcePath, entryRelPath } = sources
   const ops: CopyOp[] = []
 
-  // Host exe (renamed) + V8/ICU blobs at dest root. Top-level DLLs omitted: GPU/media libs a windowless run-as-node host never loads (~48MB saved).
-  ops.push({ sourcePath: execPath, destRel: DAEMON_HOST_EXE_NAME, kind: 'file' })
+  // Host exe (verbatim name) + V8/ICU blobs at dest root. Top-level DLLs omitted: GPU/media libs a windowless run-as-node host never loads (~48MB saved).
+  ops.push({ sourcePath: execPath, destRel: daemonHostExeName(execPath), kind: 'file' })
   for (const name of RUNTIME_DATA_FILES) {
     ops.push({ sourcePath: join(appDir, name), destRel: name, kind: 'file', optional: true })
   }
@@ -245,7 +255,7 @@ export function getRelocatedDaemonHost(): RelocatedDaemonHost | null {
   if (!marker || marker.version !== version) {
     return null
   }
-  const execPath = join(dest, DAEMON_HOST_EXE_NAME)
+  const execPath = join(dest, daemonHostExeName(sources.execPath))
   const entryPath = destPath(dest, marker.entryRelPath)
   if (!existsSync(execPath) || !existsSync(entryPath)) {
     return null
@@ -281,7 +291,9 @@ export function materializeRelocatedDaemonHost(): RelocatedDaemonHost | null {
       entryRelPath: sources.entryRelPath
     }
     writeFileSync(join(staging, MARKER_NAME), JSON.stringify(marker))
-    // Replace any stale/partial dest, then publish the staging dir atomically.
+    // Replace any stale/partial dest, then publish atomically. Windows refuses to delete a running
+    // image, so a live daemon already hosted in THIS version's dir (same-version reinstall, or a dev
+    // channel reusing a version) throws here and materialization fails open to the install-dir host.
     rmSync(dest, { recursive: true, force: true })
     renameSync(staging, dest)
   } catch {
diff --git a/src/main/daemon/daemon-pty-adapter-steady-state-compat.test.ts b/src/main/daemon/daemon-pty-adapter-steady-state-compat.test.ts
new file mode 100644
index 00000000000..ae7c29847c9
--- /dev/null
+++ b/src/main/daemon/daemon-pty-adapter-steady-state-compat.test.ts
@@ -0,0 +1,78 @@
+import { describe, expect, it, vi } from 'vitest'
+import { DaemonPtyAdapter } from './daemon-pty-adapter'
+import { COMPLETION_PROCESS_INSPECTION_PROTOCOL_VERSION, PROTOCOL_VERSION } from './types'
+
+type ClientInternals = {
+  client: { request: ReturnType<typeof vi.fn>; disconnect: ReturnType<typeof vi.fn> }
+}
+
+function createAdapter(
+  protocolVersion: number,
+  request: ReturnType<typeof vi.fn>
+): DaemonPtyAdapter {
+  const adapter = new DaemonPtyAdapter({
+    socketPath: '/tmp/orca-steady-state-compat.sock',
+    tokenPath: '/tmp/orca-steady-state-compat.token',
+    protocolVersion
+  })
+  ;(adapter as unknown as ClientInternals).client = { request, disconnect: vi.fn() }
+  return adapter
+}
+
+describe('steadyState across daemon versions', () => {
+  it('sends steadyState as an additive optional field on the existing inspectProcess request', async () => {
+    const request = vi.fn(async () => ({ foregroundProcess: 'claude', hasChildProcesses: true }))
+    const adapter = createAdapter(PROTOCOL_VERSION, request)
+    await adapter.inspectProcess('sess-a', { steadyState: true })
+    expect(request).toHaveBeenCalledWith('inspectProcess', {
+      sessionId: 'sess-a',
+      steadyState: true
+    })
+    adapter.dispose()
+  })
+
+  it('omits the field entirely when not requested, so the wire is byte-identical to before', async () => {
+    const request = vi.fn(async () => ({ foregroundProcess: null, hasChildProcesses: false }))
+    const adapter = createAdapter(PROTOCOL_VERSION, request)
+    await adapter.inspectProcess('sess-a', { expectedIncarnationId: 'inc-1', steadyState: false })
+    expect(request).toHaveBeenCalledWith('inspectProcess', {
+      sessionId: 'sess-a',
+      expectedIncarnationId: 'inc-1'
+    })
+    adapter.dispose()
+  })
+
+  it('an old daemon that ignores steadyState still answers with the full-capture shape, and the client accepts it', async () => {
+    // A pre-field daemon returns exactly what it always did: name + evidence, never a cheap answer.
+    const oldDaemonAnswer = {
+      foregroundProcess: 'claude',
+      hasChildProcesses: true,
+      foregroundProcessEvidence: {
+        verdict: 'live',
+        processName: 'claude',
+        authorityGeneration: 'gen',
+        observationEpoch: 1,
+        capturedAgeMs: 0,
+        ptyId: 'sess-a',
+        ptyIncarnationId: 'inc-1'
+      }
+    }
+    const request = vi.fn(async () => oldDaemonAnswer)
+    const adapter = createAdapter(COMPLETION_PROCESS_INSPECTION_PROTOCOL_VERSION, request)
+    await expect(adapter.inspectProcess('sess-a', { steadyState: true })).resolves.toEqual(
+      oldDaemonAnswer
+    )
+    adapter.dispose()
+  })
+
+  it('a pre-inspection daemon never sees the field: the client composes from getForegroundProcess as before', async () => {
+    const request = vi.fn(async () => ({ foregroundProcess: 'codex' }))
+    const adapter = createAdapter(COMPLETION_PROCESS_INSPECTION_PROTOCOL_VERSION - 1, request)
+    await expect(adapter.inspectProcess('sess-a', { steadyState: true })).resolves.toEqual({
+      foregroundProcess: 'codex',
+      hasChildProcesses: true
+    })
+    expect(request).toHaveBeenCalledWith('getForegroundProcess', { sessionId: 'sess-a' })
+    adapter.dispose()
+  })
+})
diff --git a/src/main/daemon/daemon-pty-adapter.test.ts b/src/main/daemon/daemon-pty-adapter.test.ts
index fc2f9365f23..5eba73d8ad2 100644
--- a/src/main/daemon/daemon-pty-adapter.test.ts
+++ b/src/main/daemon/daemon-pty-adapter.test.ts
@@ -27,8 +27,6 @@ const {
   isDaemonStaleForCurrentBundleMock: vi.fn(async () => false)
 }))
 
-const itOnPosix = process.platform === 'win32' ? it.skip : it
-
 vi.mock('./daemon-health', async (importOriginal) => {
   const actual = await importOriginal<typeof DaemonHealthModule>()
   return {
@@ -343,37 +341,6 @@ describe('DaemonPtyAdapter (IPtyProvider)', () => {
         }
       }
     })
-
-    itOnPosix('keeps plain Codex startup on the short daemon shell-ready timeout', async () => {
-      await adapter.spawn({
-        cols: 80,
-        rows: 24,
-        command: 'codex',
-        env: { SHELL: '/bin/zsh' }
-      })
-
-      await waitFor(() => vi.mocked(lastSubprocess.write).mock.calls.length > 0)
-      expect(lastSubprocess.write).toHaveBeenCalledWith('codex\n')
-    })
-
-    itOnPosix('waits for shell-ready for delivery-hinted Codex startup', async () => {
-      await adapter.spawn({
-        cols: 80,
-        rows: 24,
-        command: "codex 'linked issue context'",
-        startupCommandDelivery: 'shell-ready',
-        env: { SHELL: '/bin/zsh' }
-      })
-
-      await new Promise((resolve) => setTimeout(resolve, 350))
-      expect(lastSubprocess.write).not.toHaveBeenCalled()
-
-      lastSubprocess._simulateData('\x1b]777;orca-shell-ready\x07')
-      lastSubprocess._simulateData('\r\nuser@host $ ')
-
-      await waitFor(() => vi.mocked(lastSubprocess.write).mock.calls.length > 0)
-      expect(lastSubprocess.write).toHaveBeenCalledWith("codex 'linked issue context'\n")
-    })
   })
 
   describe('write', () => {
diff --git a/src/main/daemon/daemon-pty-process-inspection.ts b/src/main/daemon/daemon-pty-process-inspection.ts
index b05a8a6c6b6..335c641da62 100644
--- a/src/main/daemon/daemon-pty-process-inspection.ts
+++ b/src/main/daemon/daemon-pty-process-inspection.ts
@@ -25,7 +25,7 @@ export abstract class DaemonPtyProcessInspection extends DaemonPtyBufferSnapshot
 
   async inspectProcess(
     id: string,
-    options?: { expectedIncarnationId?: string }
+    options?: { expectedIncarnationId?: string; steadyState?: boolean }
   ): Promise<PtyProcessInspection> {
     if (this.protocolVersion < GET_FOREGROUND_PROCESS_PROTOCOL_VERSION) {
       return clientOnlyUnverifiableInspection('old_host')
@@ -47,7 +47,9 @@ export abstract class DaemonPtyProcessInspection extends DaemonPtyBufferSnapshot
       sessionId: id,
       ...(options?.expectedIncarnationId
         ? { expectedIncarnationId: options.expectedIncarnationId }
-        : {})
+        : {}),
+      // Additive: an older daemon ignores it and pays for the full capture.
+      ...(options?.steadyState === true ? { steadyState: true } : {})
     })
   }
 
diff --git a/src/main/daemon/daemon-pty-router.ts b/src/main/daemon/daemon-pty-router.ts
index 78e12215504..962cde6760e 100644
--- a/src/main/daemon/daemon-pty-router.ts
+++ b/src/main/daemon/daemon-pty-router.ts
@@ -179,7 +179,7 @@ export class DaemonPtyRouter implements IPtyProvider {
 
   async inspectProcess(
     id: string,
-    options?: { expectedIncarnationId?: string }
+    options?: { expectedIncarnationId?: string; steadyState?: boolean }
   ): Promise<PtyProcessInspection> {
     return this.adapterForInspection(id).inspectProcess(id, options)
   }
diff --git a/src/main/daemon/daemon-pty-session-spawn.ts b/src/main/daemon/daemon-pty-session-spawn.ts
index 235b286b0bc..bbb899b64a3 100644
--- a/src/main/daemon/daemon-pty-session-spawn.ts
+++ b/src/main/daemon/daemon-pty-session-spawn.ts
@@ -1,5 +1,6 @@
 import { recognizeAgentProcessFromCommandLine } from '../../shared/agent-process-recognition'
 import { shouldUseShellReadyStartupDelivery } from '../../shared/codex-startup-delivery'
+import { CODEX_SHELL_READY_TIMEOUT_MS } from './session-shell-ready-barrier'
 import type {
   HistoryRecoveryContext,
   PendingDaemonSpawnOperation
@@ -11,8 +12,8 @@ import { DaemonPtySpawnResult } from './daemon-pty-spawn-result'
 import type { DaemonPtySpawnContext } from './daemon-pty-spawn-request'
 import type { ColdRestoreInfo } from './history-reader'
 import { mintPtySessionId } from './pty-session-id'
-import { CODEX_SHELL_READY_TIMEOUT_MS } from './session-shell-ready-barrier'
-import { supportsPtyStartupBarrier } from './shell-ready'
+import { shellPathSupportsPtyStartupBarrier, resolvePtyShellPath } from './shell-ready'
+import { shellReadyMarkerComesFromLineEditor } from '../../shared/shell-ready-marker-timing'
 import { getRecoveredHistorySeedSegments } from './terminal-history-seed-segments'
 import { AGENT_SESSION_CLAIM_DAEMON_PROTOCOL_VERSION, type CreateOrAttachResult } from './types'
 import { normalizeWslColdRestoreCwd } from './wsl-cold-restore-cwd'
@@ -212,22 +213,26 @@ export abstract class DaemonPtySessionSpawn extends DaemonPtySpawnResult {
     let effectiveCols = restoreInfo?.cols ?? opts.cols
     let effectiveRows = restoreInfo?.rows ?? opts.rows
 
-    const shellReadySupported = opts.command ? supportsPtyStartupBarrier(opts.env ?? {}) : false
-    const isCodexStartupCommand =
-      recognizeAgentProcessFromCommandLine(opts.command)?.agent === 'codex'
-    const shouldWaitForShellReady =
-      isCodexStartupCommand &&
-      shouldUseShellReadyStartupDelivery({
+    const effectiveShellPath =
+      process.platform !== 'win32' && opts.command
+        ? resolveUnixShellPath(opts.shellOverride || resolvePtyShellPath(opts.env ?? {}))
+        : ''
+    const shellReadySupported = shellPathSupportsPtyStartupBarrier(effectiveShellPath)
+    const immediateMarker = shellReadyMarkerComesFromLineEditor(effectiveShellPath)
+    const shellReadyTimeoutMs =
+      shellReadySupported &&
+      !immediateMarker &&
+      recognizeAgentProcessFromCommandLine(opts.command)?.agent === 'codex' &&
+      !shouldUseShellReadyStartupDelivery({
         command: opts.command,
         startupCommandDelivery: opts.startupCommandDelivery
       })
-    const shellReadyTimeoutMs =
-      shellReadySupported && isCodexStartupCommand && !shouldWaitForShellReady
         ? CODEX_SHELL_READY_TIMEOUT_MS
         : undefined
-
     const context: DaemonPtySpawnContext = {
-      opts,
+      // Older daemons also need the existing hint to enable their ready marker.
+      opts:
+        opts.command && immediateMarker ? { ...opts, startupCommandDelivery: 'shell-ready' } : opts,
       operation,
       historyRecovery,
       requestedSessionId,
diff --git a/src/main/daemon/daemon-pty-startup-delivery.test.ts b/src/main/daemon/daemon-pty-startup-delivery.test.ts
new file mode 100644
index 00000000000..4b72070bb42
--- /dev/null
+++ b/src/main/daemon/daemon-pty-startup-delivery.test.ts
@@ -0,0 +1,107 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { rmSync } from 'node:fs'
+import { basename, join } from 'node:path'
+import * as localPtyUtils from '../providers/local-pty-utils'
+import {
+  createMockSubprocess,
+  startDaemonAdapterHarness,
+  waitFor,
+  type DaemonAdapterHarness,
+  type SpawnSubprocess
+} from './daemon-pty-adapter-test-harness'
+
+const itOnPosix = process.platform === 'win32' ? it.skip : it
+
+describe('DaemonPtyAdapter startup delivery', () => {
+  let harness: DaemonAdapterHarness
+  let adapter: DaemonAdapterHarness['adapter']
+  let dir: string
+  let lastSubprocess: ReturnType<typeof createMockSubprocess>
+  let lastSpawnOpts: Parameters<SpawnSubprocess>[0] | null
+
+  beforeEach(async () => {
+    lastSpawnOpts = null
+    harness = await startDaemonAdapterHarness((opts) => {
+      lastSpawnOpts = opts
+      lastSubprocess = createMockSubprocess()
+      return lastSubprocess
+    })
+    adapter = harness.adapter
+    dir = harness.dir
+  })
+
+  afterEach(async () => {
+    adapter.dispose()
+    await harness.server.shutdown()
+    rmSync(dir, { recursive: true, force: true })
+  })
+
+  itOnPosix('preserves the existing fast-start timing for fish', async () => {
+    // The mock subprocess represents installed fish even on hosts without it.
+    const resolveShell = vi
+      .spyOn(localPtyUtils, 'resolveUnixShellPath')
+      .mockReturnValue('/usr/bin/fish')
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+    try {
+      await adapter.spawn({
+        cols: 80,
+        rows: 24,
+        command: 'codex',
+        env: { SHELL: '/usr/bin/fish' }
+      })
+      await vi.advanceTimersByTimeAsync(299)
+      expect(lastSubprocess.write).not.toHaveBeenCalled()
+      await vi.advanceTimersByTimeAsync(1)
+      expect(lastSubprocess.write).toHaveBeenCalledExactlyOnceWith('codex\n')
+      expect(lastSpawnOpts).not.toEqual(
+        expect.objectContaining({ startupCommandDelivery: 'shell-ready' })
+      )
+    } finally {
+      vi.useRealTimers()
+      resolveShell.mockRestore()
+    }
+  })
+
+  itOnPosix.for(['environment', 'override'] as const)(
+    'waits for the fallback shell when the %s shell is missing',
+    async (source, context) => {
+      const missingShell = join(dir, 'missing-fish')
+      const fallbackName = basename(localPtyUtils.resolveUnixShellPath(missingShell))
+      context.skip(!['bash', 'zsh'].includes(fallbackName), 'Requires a Bash/zsh fallback')
+      await adapter.spawn({
+        cols: 80,
+        rows: 24,
+        command: 'codex',
+        env: { SHELL: source === 'environment' ? missingShell : '/bin/sh' },
+        ...(source === 'override' ? { shellOverride: missingShell } : {})
+      })
+      await new Promise((resolve) => setTimeout(resolve, 350))
+      expect(lastSubprocess.write).not.toHaveBeenCalled()
+      expect(lastSpawnOpts).toEqual(
+        expect.objectContaining({ startupCommandDelivery: 'shell-ready' })
+      )
+      lastSubprocess._simulateData('\x1b]777;orca-shell-ready\x07\r\nuser@host $ ')
+      await waitFor(() => vi.mocked(lastSubprocess.write).mock.calls.length > 0)
+      expect(lastSubprocess.write).toHaveBeenCalledExactlyOnceWith('codex\n')
+    }
+  )
+
+  itOnPosix.each([
+    { command: 'codex' },
+    { command: 'codex', startupCommandDelivery: 'fast' as const },
+    { command: "codex 'linked issue context'", startupCommandDelivery: 'shell-ready' as const }
+  ])('waits past 300ms and submits once after readiness: %j', async (startup) => {
+    await adapter.spawn({ cols: 80, rows: 24, ...startup, env: { SHELL: '/bin/zsh' } })
+
+    await new Promise((resolve) => setTimeout(resolve, 350))
+    expect(lastSubprocess.write).not.toHaveBeenCalled()
+    expect(lastSpawnOpts).toEqual(
+      expect.objectContaining({ startupCommandDelivery: 'shell-ready' })
+    )
+    lastSubprocess._simulateData('\x1b]777;orca-shell-ready\x07')
+    lastSubprocess._simulateData('\r\nuser@host $ ')
+
+    await waitFor(() => vi.mocked(lastSubprocess.write).mock.calls.length > 0)
+    expect(lastSubprocess.write).toHaveBeenCalledExactlyOnceWith(`${startup.command}\n`)
+  })
+})
diff --git a/src/main/daemon/daemon-request-router.ts b/src/main/daemon/daemon-request-router.ts
index e081281fa8a..bb7d0d1a256 100644
--- a/src/main/daemon/daemon-request-router.ts
+++ b/src/main/daemon/daemon-request-router.ts
@@ -105,12 +105,17 @@ export class DaemonRequestRouter {
         return {
           foregroundProcess: this.options.host.getForegroundProcess(request.payload.sessionId)
         }
-      case 'inspectProcess':
-        return request.payload.expectedIncarnationId
-          ? this.options.host.inspectProcess(request.payload.sessionId, {
-              expectedIncarnationId: request.payload.expectedIncarnationId
-            })
+      case 'inspectProcess': {
+        const options = {
+          ...(request.payload.expectedIncarnationId
+            ? { expectedIncarnationId: request.payload.expectedIncarnationId }
+            : {}),
+          ...(request.payload.steadyState === true ? { steadyState: true } : {})
+        }
+        return Object.keys(options).length > 0
+          ? this.options.host.inspectProcess(request.payload.sessionId, options)
           : this.options.host.inspectProcess(request.payload.sessionId)
+      }
       case 'confirmForegroundProcess':
         return {
           foregroundProcess: await this.options.host.confirmForegroundProcess(
diff --git a/src/main/daemon/post-ready-flush-gate.test.ts b/src/main/daemon/post-ready-flush-gate.test.ts
index f8e58ba7c7d..06ff64db99f 100644
--- a/src/main/daemon/post-ready-flush-gate.test.ts
+++ b/src/main/daemon/post-ready-flush-gate.test.ts
@@ -20,6 +20,14 @@ describe('PostReadyFlushGate', () => {
     vi.useRealTimers()
   })
 
+  it('flushes synchronously when the marker comes from the line editor', () => {
+    gate = new PostReadyFlushGate(onFlush, true)
+    gate.arm()
+    expect(onFlush).toHaveBeenCalledTimes(1)
+    expect(gate.isPending).toBe(false)
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
   it('does not flush immediately when armed', () => {
     gate.arm()
     expect(onFlush).not.toHaveBeenCalled()
diff --git a/src/main/daemon/post-ready-flush-gate.ts b/src/main/daemon/post-ready-flush-gate.ts
index 199bb601024..f7f7a2f1869 100644
--- a/src/main/daemon/post-ready-flush-gate.ts
+++ b/src/main/daemon/post-ready-flush-gate.ts
@@ -1,23 +1,5 @@
-/**
- * Defers a flush callback until after the shell has drawn its prompt and
- * switched the PTY into raw mode.
- *
- * Why: the OSC 777 shell-ready marker fires from zsh's precmd_functions /
- * bash's PROMPT_COMMAND — before the shell draws its prompt and before
- * zle/readline flips the PTY into raw mode. Flushing queued input then lets
- * the kernel (ECHO still on) echo the command once, and the line editor
- * redraws it under the prompt — producing a visible duplicate (e.g. "claude"
- * appears twice on agent launch).
- *
- * Strategy: after arm() is called, wait for prompt bytes plus a short delay
- * for the tcsetattr() that enables raw mode. If the marker-completing scan
- * already saw post-marker bytes, use that same short path immediately.
- * A conservative wall-clock fallback covers ambiguous marker-only cases.
- *
- * Mirrors the gate in local-pty-shell-ready.ts::writeStartupCommandWhenShellReady,
- * which solves the same race on the non-daemon path.
- */
-
+// Bash's prompt and zsh's line-init marker are ready for input immediately.
+// Other shells retain the existing settling delay.
 export const POST_READY_FLUSH_DELAY_MS = 30
 export const POST_READY_FLUSH_FALLBACK_MS = 200
 
@@ -26,7 +8,10 @@ export class PostReadyFlushGate {
   private postDataTimer: ReturnType<typeof setTimeout> | null = null
   private fallbackTimer: ReturnType<typeof setTimeout> | null = null
 
-  constructor(private readonly onFlush: () => void) {}
+  constructor(
+    private readonly onFlush: () => void,
+    private readonly markerIsLineEditorReady = false
+  ) {}
 
   /** True between arm() and the actual flush firing. Callers should treat
    *  input as still-queued during this window to preserve ordering. */
@@ -38,6 +23,10 @@ export class PostReadyFlushGate {
    *  wall-clock fallback unless the marker scan already observed post-marker
    *  bytes, in which case the short post-data settle path is enough. */
   arm(postMarkerBytesObserved = false): void {
+    if (this.markerIsLineEditorReady) {
+      this.onFlush()
+      return
+    }
     this.awaitingPromptDraw = true
     if (postMarkerBytesObserved) {
       this.notifyData()
diff --git a/src/main/daemon/pty-subprocess-managed-agent-env.test.ts b/src/main/daemon/pty-subprocess-managed-agent-env.test.ts
index 5267778088c..d5dbc33246c 100644
--- a/src/main/daemon/pty-subprocess-managed-agent-env.test.ts
+++ b/src/main/daemon/pty-subprocess-managed-agent-env.test.ts
@@ -261,7 +261,7 @@ describe('createPtySubprocess', () => {
     expect(lastCall[2].env.ORCA_SHELL_FEATURES).not.toContain('ready')
   })
 
-  it('keeps plain Codex startup commands on the no-marker wrapper', async () => {
+  it('enables readiness and shell identity for plain Codex startup', async () => {
     const proc = mockPtyProcess()
     spawnMock.mockReturnValue(proc)
     const platform = Object.getOwnPropertyDescriptor(process, 'platform')
@@ -285,7 +285,8 @@ describe('createPtySubprocess', () => {
     const lastCall = spawnMock.mock.calls.at(-1)!
     expect(lastCall[1]).toEqual(['-l'])
     expect(lastCall[2].env.ZDOTDIR).toMatch(ZSH_SHELL_READY_DIR)
-    expect(lastCall[2].env.ORCA_SHELL_FEATURES).not.toContain('ready')
+    expect(lastCall[2].env.ORCA_SHELL_FEATURES).toContain('ready')
+    expect(lastCall[2].env.ORCA_SHELL_FEATURES).toContain('identity')
   })
 
   it('uses shell-ready wrapper for delivery-hinted Codex startup commands', async () => {
diff --git a/src/main/daemon/pty-subprocess/foreground-process-tracker.ts b/src/main/daemon/pty-subprocess/foreground-process-tracker.ts
index 115b795202d..8726dc87281 100644
--- a/src/main/daemon/pty-subprocess/foreground-process-tracker.ts
+++ b/src/main/daemon/pty-subprocess/foreground-process-tracker.ts
@@ -36,7 +36,9 @@ type CachedAgentForeground = { processName: string; pid: number | null; refreshe
 export type PtyForegroundProcessTracker = {
   recordOutput(data: string): void
   markDead(): void
-  getForegroundProcess(): string | null
+  /** `rawFallback`: node-pty's own name only, with no identity cache and no background
+   *  process-table refresh -- the cheap-tier tick must not fork a full `ps` as a side effect. */
+  getForegroundProcess(options?: { rawFallback?: boolean }): string | null
   confirmForegroundProcess(): Promise<string | null>
   confirmShellForeground(): Promise<boolean>
 }
@@ -213,10 +215,13 @@ export function createPtyForegroundProcessTracker(args: {
       cachedAgentForeground = null
       startupAgentForeground = null
     },
-    getForegroundProcess: () => {
+    getForegroundProcess: (options) => {
       if (args.isDead()) {
         return null
       }
+      if (options?.rawFallback === true) {
+        return getFallbackProcess()
+      }
       try {
         const fallbackProcess = getFallbackProcess()
         const fallbackRecognition = recognizeAgentProcess(fallbackProcess)
diff --git a/src/main/daemon/pty-subprocess/shell-launch-plan.ts b/src/main/daemon/pty-subprocess/shell-launch-plan.ts
index ed8cd5e6a22..ba60e592743 100644
--- a/src/main/daemon/pty-subprocess/shell-launch-plan.ts
+++ b/src/main/daemon/pty-subprocess/shell-launch-plan.ts
@@ -1,3 +1,4 @@
+import { shouldUseShellReadyStartupDelivery } from '../../../shared/codex-startup-delivery'
 import { win32 as pathWin32 } from 'node:path'
 import { isWindowsGitBashShellPath, resolveWindowsGitBashShellPath } from '../../git-bash'
 import { isPwshAvailable } from '../../pwsh'
@@ -32,7 +33,6 @@ import {
   recognizeAgentProcessFromCommandLine,
   type RecognizedAgentProcess
 } from '../../../shared/agent-process-recognition'
-import { shouldUseShellReadyStartupDelivery } from '../../../shared/codex-startup-delivery'
 import { ORCA_HERMES_STARTUP_QUERY_ENV } from '../../../shared/hermes-startup-query'
 import { WINDOWS_GIT_BASH_SHELL } from '../../../shared/windows-terminal-shell'
 import { getShellLaunchConfig, resolvePtyShellPath } from '../shell-ready'
@@ -60,7 +60,6 @@ export function createPtyShellLaunchPlan(
   let startupCommandDeliveredInShellArgs = false
   let windowsFallbackAttempts: WindowsShellSpawnAttempt[] = []
   const startupAgentRecognition = recognizeAgentProcessFromCommandLine(opts.command)
-  const isCodexStartupCommand = startupAgentRecognition?.agent === 'codex'
   const requestedCwd = opts.cwd || resolveSafePtyDefaultCwd()
   if (opts.command && startupAgentRecognition) {
     assertSafeAgentStartupCwd(requestedCwd, opts.command)
@@ -192,10 +191,11 @@ export function createPtyShellLaunchPlan(
     }
     const waitsForShellReady =
       Boolean(opts.command) &&
-      (!isCodexStartupCommand ||
+      (startupAgentRecognition?.agent !== 'codex' ||
         shouldUseShellReadyStartupDelivery({
-          command: opts.command as string,
-          startupCommandDelivery: opts.startupCommandDelivery
+          command: opts.command,
+          startupCommandDelivery: opts.startupCommandDelivery,
+          shellPath
         }))
     delete env.ORCA_SHELL_FEATURES
     const shellLaunch = getShellLaunchConfig(
diff --git a/src/main/daemon/repro-13767-shell-ready-marker-lost-to-exec.test.ts b/src/main/daemon/repro-13767-shell-ready-marker-lost-to-exec.test.ts
index 52462e3a2eb..a1db9461070 100644
--- a/src/main/daemon/repro-13767-shell-ready-marker-lost-to-exec.test.ts
+++ b/src/main/daemon/repro-13767-shell-ready-marker-lost-to-exec.test.ts
@@ -1,7 +1,7 @@
 import { spawnSync } from 'node:child_process'
-import { existsSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { existsSync, mkdtempSync, realpathSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
-import { join } from 'node:path'
+import { dirname, join } from 'node:path'
 import { describe, expect, it, vi } from 'vitest'
 import { createPtySubprocess } from './pty-subprocess'
 import { Session } from './session'
@@ -10,6 +10,20 @@ const describePosix = process.platform === 'win32' ? describe.skip : describe
 const hasZsh = process.platform !== 'win32' && spawnSync('/bin/zsh', ['--version']).status === 0
 const hasBash = process.platform !== 'win32' && spawnSync('/bin/bash', ['--version']).status === 0
 const COMMAND_OUTPUT = 'ORCA_STARTUP_COMMAND_RAN'
+// A second Bash install with its own canonical path -- the shape a login profile
+// switches to (`exec /opt/homebrew/bin/bash`) and the one #18768 stalled on. A
+// symlink cannot stand in: both sides are realpath'd before they are compared.
+const alternateBashPath = ['/opt/homebrew/bin/bash', '/usr/local/bin/bash', '/usr/bin/bash'].find(
+  (candidate) =>
+    hasBash && existsSync(candidate) && realpathSync(candidate) !== realpathSync('/bin/bash')
+)
+if (process.platform !== 'win32' && !alternateBashPath) {
+  // Why announced: usrmerge hosts resolve /usr/bin/bash back to /bin/bash, so these
+  // two skip on most Linux CI. A silent skip reads as coverage that does not exist.
+  console.warn(
+    '[repro-13767] no second Bash install with a distinct realpath; skipping the alternate-install recovery tests'
+  )
+}
 const READ_STARTED_FILE = '.orca-read-started'
 
 type ShellFixture = {
@@ -122,7 +136,8 @@ type RunningFixture = {
 async function startFixture(
   fixture: ShellFixture,
   startupContent: string,
-  extraFiles: Record<string, string> = {}
+  extraFiles: Record<string, string> = {},
+  pathEnv: string = process.env.PATH ?? '/usr/bin:/bin'
 ): Promise<RunningFixture> {
   const tempHome = mkdtempSync(join(tmpdir(), 'orca-shell-ready-exec-'))
   const previousHome = process.env.HOME
@@ -150,7 +165,7 @@ async function startFixture(
       shellOverride: fixture.shellPath,
       env: {
         HOME: tempHome,
-        PATH: process.env.PATH ?? '/usr/bin:/bin',
+        PATH: pathEnv,
         SHELL: fixture.shellPath,
         TERM: 'xterm-256color'
       },
@@ -416,4 +431,49 @@ fi
     },
     10_000
   )
+
+  const bashFixture = FIXTURES[2] as ShellFixture
+  const alternateBashTest = alternateBashPath ? it : it.skip
+  const alternateBashProfile = `if [[ -z "\${ORCA_EXEC_REPRO_DONE:-}" ]]; then
+  export ORCA_EXEC_REPRO_DONE=1
+  exec ${alternateBashPath ?? '/bin/bash'} --noprofile --norc -l -i
+fi
+`
+
+  alternateBashTest(
+    'releases at the prompt of a second Bash install the pane PATH resolves',
+    async () => {
+      const running = await startFixture(
+        bashFixture,
+        alternateBashProfile,
+        {},
+        `${dirname(alternateBashPath ?? '/bin/bash')}:/usr/bin:/bin`
+      )
+      try {
+        await waitForOutput(running.subscribe, () => running.output().includes(COMMAND_OUTPUT))
+        expect(running.session.shellState).toBe('ready')
+        expect(count(running.output(), COMMAND_OUTPUT)).toBe(1)
+        expect(running.output()).not.toContain('orca-shell-start')
+      } finally {
+        await running.cleanup()
+      }
+    },
+    10_000
+  )
+
+  alternateBashTest(
+    'does not trust a Bash install that the pane PATH cannot reach',
+    async () => {
+      const running = await startFixture(bashFixture, alternateBashProfile, {}, '/usr/bin:/bin')
+      try {
+        await waitForOutput(running.subscribe, () => running.output().includes('$'))
+        await new Promise((resolve) => setTimeout(resolve, 500))
+        expect(running.session.shellState).toBe('pending')
+        expect(running.output()).not.toContain(COMMAND_OUTPUT)
+      } finally {
+        await running.cleanup()
+      }
+    },
+    10_000
+  )
 })
diff --git a/src/main/daemon/session-shell-ready-barrier.ts b/src/main/daemon/session-shell-ready-barrier.ts
index e7562e23224..6fce89af89e 100644
--- a/src/main/daemon/session-shell-ready-barrier.ts
+++ b/src/main/daemon/session-shell-ready-barrier.ts
@@ -1,3 +1,4 @@
+import { shellReadyMarkerComesFromLineEditor } from '../../shared/shell-ready-marker-timing'
 import {
   installDeviceAttributesResponder,
   STARTUP_DA1_RESPONSE
@@ -19,7 +20,6 @@ import { basename } from 'node:path'
 import type { ShellReadyState } from './types'
 
 const SHELL_READY_TIMEOUT_MS = 15_000
-// Why: Codex skips marker-gated command delivery; this only bounds older daemon/local paths that still report shell-ready for Codex.
 export const CODEX_SHELL_READY_TIMEOUT_MS = 300
 
 export type SessionShellReadyBarrierDeps = {
@@ -69,7 +69,10 @@ export class SessionShellReadyBarrier {
       this._state = 'unsupported'
     }
 
-    this.postReadyFlushGate = new PostReadyFlushGate(() => this.flushPreReadyQueue())
+    this.postReadyFlushGate = new PostReadyFlushGate(
+      () => this.flushPreReadyQueue(),
+      shellReadyMarkerComesFromLineEditor(deps.subprocess.shellPath ?? '')
+    )
   }
 
   get state(): ShellReadyState {
diff --git a/src/main/daemon/session-subprocess-handle.ts b/src/main/daemon/session-subprocess-handle.ts
index f14469afbb4..9268686d78e 100644
--- a/src/main/daemon/session-subprocess-handle.ts
+++ b/src/main/daemon/session-subprocess-handle.ts
@@ -6,7 +6,7 @@ export type SubprocessHandle = {
   pid: number
   /** Live foreground process name of the PTY (node-pty's `.process`), e.g.
    *  'claude' / 'codex' / 'zsh'. Null once the child has exited. */
-  getForegroundProcess(): string | null
+  getForegroundProcess(options?: { rawFallback?: boolean }): string | null
   /** Await process-table evidence captured after this confirmation request. */
   confirmForegroundProcess?(): Promise<string | null>
   /** Proves a fresh post-boundary PTY process tree contains only the shell. */
diff --git a/src/main/daemon/session.ts b/src/main/daemon/session.ts
index b0f1dfa538d..9265b2acfef 100644
--- a/src/main/daemon/session.ts
+++ b/src/main/daemon/session.ts
@@ -252,8 +252,8 @@ export class Session {
     return this.output.getCwd()
   }
 
-  getForegroundProcess(): string | null {
-    return this.subprocess.getForegroundProcess()
+  getForegroundProcess(options?: { rawFallback?: boolean }): string | null {
+    return this.subprocess.getForegroundProcess(options)
   }
 
   async confirmForegroundProcess(): Promise<string | null> {
diff --git a/src/main/daemon/shell-ready.test.ts b/src/main/daemon/shell-ready.test.ts
index 6772a52d46e..01cdad10be9 100644
--- a/src/main/daemon/shell-ready.test.ts
+++ b/src/main/daemon/shell-ready.test.ts
@@ -198,11 +198,9 @@ describePosix('daemon shell-ready launch config', () => {
   })
 
   it('extends the startup barrier to fish so launch commands queue until the prompt', async () => {
-    const { shellPathSupportsPtyStartupBarrier, supportsPtyStartupBarrier } =
-      await importFreshShellReady()
+    const { shellPathSupportsPtyStartupBarrier } = await importFreshShellReady()
 
     expect(shellPathSupportsPtyStartupBarrier('/opt/homebrew/bin/fish')).toBe(true)
-    expect(supportsPtyStartupBarrier({ SHELL: '/usr/local/bin/fish' })).toBe(true)
     // Why: unwrapped shells must stay off the barrier or their first command queues forever.
     expect(shellPathSupportsPtyStartupBarrier('/usr/bin/tcsh')).toBe(false)
   })
diff --git a/src/main/daemon/shell-ready.ts b/src/main/daemon/shell-ready.ts
index 9dc60b7c980..5208f9ced6b 100644
--- a/src/main/daemon/shell-ready.ts
+++ b/src/main/daemon/shell-ready.ts
@@ -108,13 +108,6 @@ export function shellPathSupportsPtyStartupBarrier(shellPath: string): boolean {
   return shellName === 'zsh' || shellName === 'bash' || shellName === 'fish'
 }
 
-export function supportsPtyStartupBarrier(env: Record<string, string>): boolean {
-  if (process.platform === 'win32') {
-    return false
-  }
-  return shellPathSupportsPtyStartupBarrier(resolvePtyShellPath(env))
-}
-
 export type ShellLaunchConfig = {
   args: string[] | null
   env: Record<string, string>
diff --git a/src/main/daemon/terminal-host-cheap-tier-ps-scan-volume.test.ts b/src/main/daemon/terminal-host-cheap-tier-ps-scan-volume.test.ts
new file mode 100644
index 00000000000..b02eec33773
--- /dev/null
+++ b/src/main/daemon/terminal-host-cheap-tier-ps-scan-volume.test.ts
@@ -0,0 +1,217 @@
+// Measurement for the cheap-tier process inspection. Drives the REAL daemon inspection
+// entrypoint (`inspectTerminalHostProcess`) for 8 idle agent panes over a simulated 60s idle
+// cadence (POLL_TIER_INTERVAL_MS.idle = 2,000ms) and counts `ps` forks BY COLUMN SET: a fork
+// asking for `command=` is the full capture (measured 0.34-0.50s on a 1,900-process Mac, 1.15s
+// on Linux), one without it is the cheap capture (0.03s on both). CI cannot time a real `ps`
+// portably, so fork counts by column set are what this test measures; the per-fork costs above
+// are the numbers measured by hand on the reference hosts.
+//
+// The second test is the zero-trade-off proof: the same tick sequence, including an agent exit
+// and a restart, produces the identical foregroundProcess series with the cheap tier on and off.
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+// Two seams because the two tiers spawn differently: the full evidence reader still forks
+// through node:child_process, the cheap reader through Orca's runProcess entry point.
+const { execFileMock, runProcessMock } = vi.hoisted(() => ({
+  execFileMock: vi.fn(),
+  runProcessMock: vi.fn()
+}))
+vi.mock('node:child_process', () => ({ execFile: execFileMock }))
+vi.mock('../../shared/child-process/run-process', () => ({ runProcess: runProcessMock }))
+
+import { resetCheapProcessTableSnapshotForTests } from '../../shared/cheap-process-table-snapshot-reader'
+import { resetProcessTableSnapshotForTests } from '../../shared/process-table-snapshot-reader'
+import { createPtyForegroundProcessTracker } from './pty-subprocess/foreground-process-tracker'
+import { inspectTerminalHostProcess } from './terminal-host-process-inspection'
+import type { Session } from './session'
+
+const PANE_COUNT = 8
+const IDLE_POLL_INTERVAL_MS = 2_000 // POLL_TIER_INTERVAL_MS.idle
+const WINDOW_SECONDS = 60
+const TICKS = Math.floor((WINDOW_SECONDS * 1000) / IDLE_POLL_INTERVAL_MS)
+
+const shellPid = (pane: number): number => 1000 + pane * 100
+const agentPid = (pane: number): number => shellPid(pane) + 1
+
+type PaneState = { agent: boolean; agentStart: string }
+const panes: PaneState[] = Array.from({ length: PANE_COUNT }, () => ({
+  agent: true,
+  agentStart: 'Thu Sep  3 16:02:05 2026'
+}))
+
+const forks = { full: 0, cheap: 0 }
+
+function renderRows(): { full: string; cheap: string } {
+  const full: string[] = []
+  const cheap: string[] = []
+  panes.forEach((pane, i) => {
+    const s = shellPid(i)
+    const a = agentPid(i)
+    const tpgid = pane.agent ? a : s
+    const shellStat = pane.agent ? 'Ss' : 'Ss+'
+    cheap.push(`${s} 1 ${s} ${tpgid} ${shellStat} Thu Sep  3 16:02:01 2026`)
+    full.push(`${s} 1 ${s} ${tpgid} ${shellStat} ttys00${i} Thu Sep  3 16:02:01 2026 -zsh`)
+    if (pane.agent) {
+      cheap.push(`${a} ${s} ${a} ${a} S+ ${pane.agentStart}`)
+      full.push(`${a} ${s} ${a} ${a} S+ ttys00${i} ${pane.agentStart} node /usr/local/bin/claude`)
+    }
+  })
+  return { full: `${full.join('\n')}\n`, cheap: `${cheap.join('\n')}\n` }
+}
+
+function installCountingPs(): void {
+  execFileMock.mockImplementation((_cmd: string, args: string[], _opts: unknown, cb: unknown) => {
+    expect(args[1]).toContain('command=')
+    forks.full += 1
+    ;(cb as (err: unknown, r: { stdout: string; stderr: string }) => void)(null, {
+      stdout: renderRows().full,
+      stderr: ''
+    })
+  })
+  runProcessMock.mockImplementation(async (spec: { args: readonly string[] }) => {
+    expect(spec.args[1]).not.toContain('command=')
+    forks.cheap += 1
+    return { code: 0, signal: null, stdout: renderRows().cheap, stderr: '', timedOut: false }
+  })
+}
+
+function createSession(pane: number): Session {
+  const tracker = createPtyForegroundProcessTracker({
+    process: {
+      pid: shellPid(pane),
+      get process() {
+        return panes[pane].agent ? 'node' : 'zsh'
+      }
+    } as never,
+    shellPath: '/bin/zsh',
+    sessionId: `wt:pane-${pane}`,
+    startupAgentRecognition: null,
+    isDead: () => false
+  })
+  return {
+    pid: shellPid(pane),
+    incarnationId: `inc-${pane}`,
+    isAlive: true,
+    getForegroundProcess: (options?: { rawFallback?: boolean }) =>
+      tracker.getForegroundProcess(options)
+  } as unknown as Session
+}
+
+async function settle(): Promise<void> {
+  for (let i = 0; i < 8; i += 1) {
+    await Promise.resolve()
+  }
+}
+
+async function runTick(sessions: Session[], steadyState: boolean): Promise<(string | null)[]> {
+  const results = await Promise.all(
+    sessions.map((session, pane) =>
+      inspectTerminalHostProcess({
+        sessionId: `wt:pane-${pane}`,
+        session,
+        ...(steadyState ? { steadyState: true } : {}),
+        authorityGeneration: 'gen',
+        nextObservationEpoch: () => 1
+      })
+    )
+  )
+  await settle()
+  return results.map((r) => r.foregroundProcess)
+}
+
+describe('cheap-tier ps scan volume at 8 idle agent panes over 60s', () => {
+  let platform: PropertyDescriptor | undefined
+
+  beforeEach(() => {
+    execFileMock.mockReset()
+    runProcessMock.mockReset()
+    resetProcessTableSnapshotForTests()
+    resetCheapProcessTableSnapshotForTests()
+    forks.full = 0
+    forks.cheap = 0
+    panes.forEach((pane) => {
+      pane.agent = true
+      pane.agentStart = 'Thu Sep  3 16:02:05 2026'
+    })
+    platform = Object.getOwnPropertyDescriptor(process, 'platform')
+    Object.defineProperty(process, 'platform', { configurable: true, value: 'darwin' })
+    vi.useFakeTimers({ toFake: ['Date'] })
+    vi.setSystemTime(1_000_000)
+    installCountingPs()
+  })
+
+  afterEach(() => {
+    vi.useRealTimers()
+    if (platform) {
+      Object.defineProperty(process, 'platform', platform)
+    }
+  })
+
+  it('replaces ~all full captures with cheap ones once every pane holds an anchor', async () => {
+    const sessions = Array.from({ length: PANE_COUNT }, (_, pane) => createSession(pane))
+    for (let tick = 0; tick < TICKS; tick += 1) {
+      vi.setSystemTime(1_000_000 + tick * IDLE_POLL_INTERVAL_MS)
+      const names = await runTick(sessions, true)
+      expect(names.every((name) => name === 'claude')).toBe(true)
+    }
+    // Baseline today: one full capture per tick (TTL-shared across the 8 panes) = TICKS.
+    // Now: the first tick establishes every anchor from one full capture; every later tick is
+    // one TTL-shared cheap capture. Published numbers, from this run:
+    //   before: 30 full (~0.34-0.50s each on macOS, 1.15s Linux) + 0 cheap
+    //   after:   1 full + 29 cheap (~0.03s each)
+    expect(forks.full).toBe(1)
+    expect(forks.cheap).toBe(TICKS - 1)
+    expect(forks.full + forks.cheap).toBe(TICKS)
+  })
+
+  it('keeps today’s cost when the caller does not opt in (old client / remote / restore)', async () => {
+    const sessions = Array.from({ length: PANE_COUNT }, (_, pane) => createSession(pane))
+    for (let tick = 0; tick < TICKS; tick += 1) {
+      vi.setSystemTime(1_000_000 + tick * IDLE_POLL_INTERVAL_MS)
+      await runTick(sessions, false)
+    }
+    expect(forks.cheap).toBe(0)
+    expect(forks.full).toBe(TICKS)
+  })
+
+  it('completion detection is byte-for-byte unchanged: exit, idle, and restart resolve identically with and without the cheap tier', async () => {
+    const script = async (steadyState: boolean): Promise<(string | null)[][]> => {
+      resetProcessTableSnapshotForTests()
+      resetCheapProcessTableSnapshotForTests()
+      panes.forEach((pane) => {
+        pane.agent = true
+        pane.agentStart = 'Thu Sep  3 16:02:05 2026'
+      })
+      const sessions = Array.from({ length: PANE_COUNT }, (_, pane) => createSession(pane))
+      const series: (string | null)[][] = []
+      for (let tick = 0; tick < TICKS; tick += 1) {
+        vi.setSystemTime(1_000_000 + tick * IDLE_POLL_INTERVAL_MS)
+        if (tick === 5) {
+          panes[2].agent = false // pane 2's agent exits
+        }
+        if (tick === 12) {
+          panes[2].agent = true // ...and is restarted with a new start time
+          panes[2].agentStart = 'Thu Sep  3 16:30:00 2026'
+        }
+        if (tick === 20) {
+          panes[6].agent = false
+        }
+        series.push(await runTick(sessions, steadyState))
+      }
+      return series
+    }
+    const withCheapTier = await script(true)
+    const cheapForks = forks.cheap
+    forks.cheap = 0
+    forks.full = 0
+    const fullOnly = await script(false)
+    expect(withCheapTier).toEqual(fullOnly)
+    // And the exit was seen on the very tick it happened, in both modes.
+    expect(withCheapTier[4][2]).toBe('claude')
+    expect(withCheapTier[5][2]).not.toBe('claude')
+    expect(withCheapTier[12][2]).toBe('claude')
+    expect(withCheapTier[19][6]).toBe('claude')
+    expect(withCheapTier[20][6]).not.toBe('claude')
+    expect(cheapForks).toBeGreaterThan(0)
+  })
+})
diff --git a/src/main/daemon/terminal-host-process-inspection-cheap-tier.test.ts b/src/main/daemon/terminal-host-process-inspection-cheap-tier.test.ts
new file mode 100644
index 00000000000..abf086e6e46
--- /dev/null
+++ b/src/main/daemon/terminal-host-process-inspection-cheap-tier.test.ts
@@ -0,0 +1,297 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+// Two seams because the two tiers spawn differently: the full evidence reader still forks
+// through node:child_process, the cheap reader through Orca's runProcess entry point.
+const { execFileMock, runProcessMock } = vi.hoisted(() => ({
+  execFileMock: vi.fn(),
+  runProcessMock: vi.fn()
+}))
+vi.mock('node:child_process', () => ({ execFile: execFileMock }))
+vi.mock('../../shared/child-process/run-process', () => ({ runProcess: runProcessMock }))
+
+import { resetCheapProcessTableSnapshotForTests } from '../../shared/cheap-process-table-snapshot-reader'
+import { resetProcessTableSnapshotForTests } from '../../shared/process-table-snapshot-reader'
+import { createPtyForegroundProcessTracker } from './pty-subprocess/foreground-process-tracker'
+import {
+  inspectTerminalHostProcess,
+  type TerminalHostInspectionTier
+} from './terminal-host-process-inspection'
+import { getSteadyStateAnchor } from './terminal-host-steady-state-anchor'
+import type { Session } from './session'
+
+const SHELL_PID = 4242
+const AGENT_PID = 4300
+const START_SHELL = 'Thu Sep  3 16:02:01 2026'
+const START_AGENT = 'Thu Sep  3 16:02:05 2026'
+
+type Table = { agent: 'claude' | 'stopped' | 'gone' | 'replaced'; children?: number }
+
+/** One host table rendered in both column sets, so each fork answers by the args it asked for. */
+function renderTable(table: Table): { full: string; cheap: string } {
+  const shellTpgid = table.agent === 'claude' || table.agent === 'replaced' ? AGENT_PID : SHELL_PID
+  const shellStat = shellTpgid === SHELL_PID ? 'Ss+' : 'Ss'
+  const rows: { cheap: string; full: string }[] = [
+    {
+      cheap: `${SHELL_PID} 1 ${SHELL_PID} ${shellTpgid} ${shellStat} ${START_SHELL}`,
+      full: `${SHELL_PID} 1 ${SHELL_PID} ${shellTpgid} ${shellStat} ttys004 ${START_SHELL} -zsh`
+    },
+    {
+      cheap: `9000 1 9000 9000 Ss+ Thu Sep  3 12:00:00 2026`,
+      full: `9000 1 9000 9000 Ss+ ttys009 Thu Sep  3 12:00:00 2026 -zsh`
+    }
+  ]
+  if (table.agent !== 'gone') {
+    const stat = table.agent === 'stopped' ? 'T' : 'S+'
+    const start = table.agent === 'replaced' ? 'Thu Sep  3 16:30:00 2026' : START_AGENT
+    rows.push({
+      cheap: `${AGENT_PID} ${SHELL_PID} ${AGENT_PID} ${shellTpgid} ${stat} ${start}`,
+      full: `${AGENT_PID} ${SHELL_PID} ${AGENT_PID} ${shellTpgid} ${stat} ttys004 ${start} node /usr/local/bin/claude`
+    })
+    for (let i = 0; i < (table.children ?? 0); i += 1) {
+      const pid = AGENT_PID + 10 + i
+      rows.push({
+        cheap: `${pid} ${AGENT_PID} ${AGENT_PID} ${shellTpgid} S+ Thu Sep  3 16:05:0${i} 2026`,
+        full: `${pid} ${AGENT_PID} ${AGENT_PID} ${shellTpgid} S+ ttys004 Thu Sep  3 16:05:0${i} 2026 rg --files`
+      })
+    }
+  }
+  return {
+    full: `${rows.map((r) => r.full).join('\n')}\n`,
+    cheap: `${rows.map((r) => r.cheap).join('\n')}\n`
+  }
+}
+
+const forks = { full: 0, cheap: 0 }
+let table: Table = { agent: 'claude' }
+
+function installPs(): void {
+  execFileMock.mockImplementation((_cmd: string, args: string[], _opts: unknown, cb: unknown) => {
+    expect(args[1]).toContain('command=')
+    forks.full += 1
+    ;(cb as (err: unknown, r: { stdout: string; stderr: string }) => void)(null, {
+      stdout: renderTable(table).full,
+      stderr: ''
+    })
+  })
+  runProcessMock.mockImplementation(async (spec: { args: readonly string[] }) => {
+    expect(spec.args[1]).not.toContain('command=')
+    forks.cheap += 1
+    return {
+      code: 0,
+      signal: null,
+      stdout: renderTable(table).cheap,
+      stderr: '',
+      timedOut: false
+    }
+  })
+}
+
+function createSession(processName: () => string): Session {
+  let dead = false
+  const tracker = createPtyForegroundProcessTracker({
+    process: {
+      pid: SHELL_PID,
+      get process() {
+        return processName()
+      }
+    } as never,
+    shellPath: '/bin/zsh',
+    sessionId: 'wt-1:pane-1',
+    startupAgentRecognition: null,
+    isDead: () => dead
+  })
+  return {
+    pid: SHELL_PID,
+    incarnationId: 'inc-1',
+    get isAlive() {
+      return !dead
+    },
+    getForegroundProcess: (options?: { rawFallback?: boolean }) =>
+      tracker.getForegroundProcess(options),
+    markDead: () => {
+      dead = true
+      tracker.markDead()
+    }
+  } as unknown as Session & { markDead(): void }
+}
+
+async function inspect(
+  session: Session,
+  options: { steadyState?: boolean; expectedIncarnationId?: string } = {}
+): Promise<{
+  tier: TerminalHostInspectionTier
+  result: Awaited<ReturnType<typeof inspectTerminalHostProcess>>
+}> {
+  let tier: TerminalHostInspectionTier = 'full'
+  const result = await inspectTerminalHostProcess({
+    sessionId: 'wt-1:pane-1',
+    session,
+    ...options,
+    authorityGeneration: 'gen-1',
+    nextObservationEpoch: () => 1,
+    onTier: (t) => {
+      tier = t
+    }
+  })
+  return { tier, result }
+}
+
+async function settle(): Promise<void> {
+  // The tracker's recognizing refresh runs off the same TTL-shared capture; let it land.
+  for (let i = 0; i < 8; i += 1) {
+    await Promise.resolve()
+  }
+}
+
+async function advance(ms: number): Promise<void> {
+  vi.setSystemTime(Date.now() + ms)
+}
+
+describe('daemon cheap-tier process inspection', () => {
+  let platform: PropertyDescriptor | undefined
+
+  beforeEach(() => {
+    execFileMock.mockReset()
+    runProcessMock.mockReset()
+    resetProcessTableSnapshotForTests()
+    resetCheapProcessTableSnapshotForTests()
+    forks.full = 0
+    forks.cheap = 0
+    table = { agent: 'claude' }
+    platform = Object.getOwnPropertyDescriptor(process, 'platform')
+    Object.defineProperty(process, 'platform', { configurable: true, value: 'darwin' })
+    vi.useFakeTimers({ toFake: ['Date'] })
+    vi.setSystemTime(1_000_000)
+    installPs()
+  })
+
+  afterEach(() => {
+    vi.useRealTimers()
+    if (platform) {
+      Object.defineProperty(process, 'platform', platform)
+    }
+  })
+
+  /** Bring a session to a recognized anchor the way production does: one full cadence tick. */
+  async function anchoredSession(): Promise<Session> {
+    const session = createSession(() => 'node')
+    const first = await inspect(session, { steadyState: true })
+    await settle()
+    expect(first.tier).toBe('full')
+    expect(first.result.foregroundProcess).toBe('claude')
+    expect(getSteadyStateAnchor(session)?.agentName).toBe('claude')
+    return session
+  }
+
+  it('a pane with NO recognized anchor never takes the cheap path, even when asked', async () => {
+    table = { agent: 'gone' }
+    const session = createSession(() => 'zsh')
+    for (let tick = 0; tick < 5; tick += 1) {
+      await advance(2_000)
+      const { tier, result } = await inspect(session, { steadyState: true })
+      expect(tier).toBe('full')
+      expect(result.foregroundProcessEvidence).toBeDefined()
+    }
+    expect(forks.cheap).toBe(0)
+    expect(forks.full).toBe(5)
+  })
+
+  it('serves an unchanged anchored pane from the cheap tier and OMITS evidence rather than faking it', async () => {
+    const session = await anchoredSession()
+    const fullBefore = forks.full
+    for (let tick = 0; tick < 4; tick += 1) {
+      await advance(2_000)
+      const { tier, result } = await inspect(session, { steadyState: true })
+      expect(tier).toBe('cheap')
+      expect(result.foregroundProcess).toBe('claude')
+      expect(result.hasChildProcesses).toBe(true)
+      expect(result).not.toHaveProperty('foregroundProcessEvidence')
+    }
+    expect(forks.cheap).toBe(4)
+    expect(forks.full).toBe(fullBefore)
+  })
+
+  it('a request without steadyState (old client, remote client, restore path) always gets the full capture with evidence', async () => {
+    const session = await anchoredSession()
+    await advance(2_000)
+    const { tier, result } = await inspect(session)
+    expect(tier).toBe('full')
+    expect(result.foregroundProcessEvidence).toMatchObject({
+      verdict: 'live',
+      processName: 'claude'
+    })
+    expect(forks.cheap).toBe(0)
+  })
+
+  it('escalates to the full capture the moment the agent exits, and reports the exit', async () => {
+    const session = await anchoredSession()
+    await advance(2_000)
+    expect((await inspect(session, { steadyState: true })).tier).toBe('cheap')
+    table = { agent: 'gone' }
+    await advance(2_000)
+    const { tier, result } = await inspect(session, { steadyState: true })
+    expect(tier).toBe('full')
+    expect(result.foregroundProcessEvidence).toMatchObject({ verdict: 'live', processName: null })
+  })
+
+  it.each<[string, Table]>([
+    ['Ctrl-Z stops the agent', { agent: 'stopped' }],
+    ['exit-and-replace reuses the pid', { agent: 'replaced' }],
+    ['a child spawns under the agent', { agent: 'claude', children: 1 }]
+  ])('escalates when %s', async (_name, next) => {
+    const session = await anchoredSession()
+    await advance(2_000)
+    expect((await inspect(session, { steadyState: true })).tier).toBe('cheap')
+    table = next
+    await advance(2_000)
+    expect((await inspect(session, { steadyState: true })).tier).toBe('full')
+  })
+
+  it('escalates when node-pty reports a different foreground name, without waiting on ps', async () => {
+    let name = 'node'
+    const session = createSession(() => name)
+    await inspect(session, { steadyState: true })
+    await settle()
+    await advance(2_000)
+    expect((await inspect(session, { steadyState: true })).tier).toBe('cheap')
+    name = 'zsh'
+    await advance(2_000)
+    const cheapBefore = forks.cheap
+    expect((await inspect(session, { steadyState: true })).tier).toBe('full')
+    expect(forks.cheap).toBe(cheapBefore)
+  })
+
+  it('falls through to the full capture when the cheap fork fails, and after an incarnation mismatch', async () => {
+    const session = await anchoredSession()
+    await advance(2_000)
+    runProcessMock.mockRejectedValueOnce(new Error('ps died'))
+    expect((await inspect(session, { steadyState: true })).tier).toBe('full')
+    await advance(2_000)
+    const mismatched = await inspect(session, { steadyState: true, expectedIncarnationId: 'other' })
+    expect(mismatched.tier).toBe('full')
+    expect(mismatched.result.foregroundProcessEvidence).toMatchObject({
+      reason: 'incarnation_mismatch'
+    })
+  })
+
+  it('a dead session is never served from its anchor', async () => {
+    const session = (await anchoredSession()) as Session & { markDead(): void }
+    session.markDead()
+    await expect(inspect(session, { steadyState: true })).rejects.toThrow('not found')
+    expect(forks.cheap).toBe(0)
+  })
+
+  it('an anchor is dropped when a full capture stops naming a recognized agent', async () => {
+    const session = await anchoredSession()
+    table = { agent: 'gone' }
+    await advance(2_000)
+    await inspect(session, { steadyState: true })
+    expect(getSteadyStateAnchor(session)).toBeNull()
+    // Back with a new agent, but the pane must re-anchor via a FULL capture first.
+    table = { agent: 'claude' }
+    await advance(2_000)
+    const cheapBefore = forks.cheap
+    expect((await inspect(session, { steadyState: true })).tier).toBe('full')
+    expect(forks.cheap).toBe(cheapBefore)
+  })
+})
diff --git a/src/main/daemon/terminal-host-process-inspection.ts b/src/main/daemon/terminal-host-process-inspection.ts
index 181ca7266d7..6810687631e 100644
--- a/src/main/daemon/terminal-host-process-inspection.ts
+++ b/src/main/daemon/terminal-host-process-inspection.ts
@@ -1,8 +1,15 @@
 import { isShellProcess } from '../../shared/agent-detection'
 import type { RemoteForegroundEvidence } from '../../shared/foreground-process-evidence'
+import { getCheapProcessTableSnapshot } from '../../shared/cheap-process-table-snapshot-reader'
 import { getStrictProcessTableSnapshotWithAge } from '../../shared/process-table-snapshot-reader'
 import { resolveRemoteForegroundEvidence } from '../providers/agent-foreground-process'
+import { buildPaneProcessFingerprint } from '../providers/posix-pane-foreground-fingerprint'
 import type { Session } from './session'
+import {
+  clearSteadyStateAnchor,
+  getSteadyStateAnchor,
+  rememberSteadyStateAnchor
+} from './terminal-host-steady-state-anchor'
 import { SessionNotFoundError } from './types'
 
 export type TerminalHostProcessInspection = {
@@ -13,13 +20,23 @@ export type TerminalHostProcessInspection = {
 
 type RetiredIncarnation = { incarnationId: string; code: number; expiresAt: number }
 
+/**
+ * Tick tiers for a POSIX pane. `cheap` forks `ps` without `tty=`/`command=` (11-38x cheaper)
+ * and answers from the anchored identity when the pane fingerprint is unchanged; anything it
+ * cannot prove escalates to `full`, today's evidence capture.
+ */
+export type TerminalHostInspectionTier = 'full' | 'cheap'
+
 export async function inspectTerminalHostProcess(args: {
   sessionId: string
   session: Session | null
   expectedIncarnationId?: string
+  /** The caller is a self-correcting poll that only reads the process name, never evidence. */
+  steadyState?: boolean
   retiredIncarnation?: RetiredIncarnation
   authorityGeneration: string
   nextObservationEpoch: () => number
+  onTier?: (tier: TerminalHostInspectionTier) => void
 }): Promise<TerminalHostProcessInspection> {
   const { sessionId, session, expectedIncarnationId, retiredIncarnation } = args
   if (!session || !session.isAlive) {
@@ -45,9 +62,22 @@ export async function inspectTerminalHostProcess(args: {
     throw new SessionNotFoundError(sessionId)
   }
 
+  const incarnationMatches =
+    !expectedIncarnationId || expectedIncarnationId === session.incarnationId
+  if (args.steadyState === true && incarnationMatches) {
+    const anchored = await readAnchoredForeground(session)
+    if (anchored !== null) {
+      args.onTier?.('cheap')
+      // No evidence member on purpose: a tty-less capture cannot fence anything, and a
+      // fabricated fence would be read by remote/restore consumers as an observation.
+      return { foregroundProcess: anchored, hasChildProcesses: true }
+    }
+  }
+  args.onTier?.('full')
+
   const foregroundProcess = session.getForegroundProcess()
   let evidence: RemoteForegroundEvidence
-  if (expectedIncarnationId && expectedIncarnationId !== session.incarnationId) {
+  if (!incarnationMatches) {
     evidence = unverifiableEvidence(args, session, 'incarnation_mismatch')
   } else {
     try {
@@ -64,8 +94,10 @@ export async function inspectTerminalHostProcess(args: {
         },
         snapshot.rows
       )
+      await rememberSteadyStateAnchor(session, evidence, snapshot.rows)
     } catch {
       evidence = unverifiableEvidence(args, session, 'process_table_unreadable')
+      clearSteadyStateAnchor(session)
     }
   }
   return {
@@ -75,6 +107,32 @@ export async function inspectTerminalHostProcess(args: {
   }
 }
 
+/**
+ * Cheap tier, gated on an anchor the last full capture established. Start discovery therefore
+ * keeps today's exact behaviour: a pane with no anchor never gets here. A recognized agent's
+ * exit is a pid vanishing from the subtree, which the fingerprint always sees, so completion
+ * detection is unaffected. Any mismatch, unreadable capture, changed node-pty name, or non-POSIX
+ * host answers null -> full tier.
+ */
+async function readAnchoredForeground(session: Session): Promise<string | null> {
+  const anchor = getSteadyStateAnchor(session)
+  if (process.platform === 'win32' || !anchor) {
+    return null
+  }
+  if (session.getForegroundProcess({ rawFallback: true }) !== anchor.rawFallback) {
+    return null
+  }
+  try {
+    const observed = await buildPaneProcessFingerprint(
+      await getCheapProcessTableSnapshot(),
+      session.pid
+    )
+    return observed !== null && observed === anchor.fingerprint ? anchor.agentName : null
+  } catch {
+    return null
+  }
+}
+
 function unverifiableEvidence(
   args: {
     sessionId: string
diff --git a/src/main/daemon/terminal-host-steady-state-anchor.ts b/src/main/daemon/terminal-host-steady-state-anchor.ts
new file mode 100644
index 00000000000..562224f856f
--- /dev/null
+++ b/src/main/daemon/terminal-host-steady-state-anchor.ts
@@ -0,0 +1,58 @@
+import { recognizeAgentProcess } from '../../shared/agent-process-recognition'
+import type { RemoteForegroundEvidence } from '../../shared/foreground-process-evidence'
+import { buildPaneProcessFingerprint } from '../providers/posix-pane-foreground-fingerprint'
+import type { Session } from './session'
+
+/**
+ * What the last FULL capture proved about a pane: a recognized agent name, the pane subtree
+ * fingerprint at that moment, and node-pty's raw foreground name at that moment. A later cheap
+ * tick may re-serve `agentName` only while both of the latter still match.
+ */
+export type SteadyStateAnchor = {
+  agentName: string
+  fingerprint: string
+  rawFallback: string | null
+}
+
+// Weakly keyed: an anchor dies with its Session, and a recycled pid under a new Session can
+// never inherit one. Retired sessions fail `isAlive` before any read gets here regardless.
+const anchors = new WeakMap<Session, SteadyStateAnchor>()
+
+export function getSteadyStateAnchor(session: Session): SteadyStateAnchor | null {
+  return anchors.get(session) ?? null
+}
+
+export function clearSteadyStateAnchor(session: Session): void {
+  anchors.delete(session)
+}
+
+/**
+ * Record (or drop) the anchor after a full capture. Only a `live` verdict naming a recognized
+ * agent establishes one: the cheap tier is licensed by proven identity, never by a fallback name
+ * or an unverifiable read, so a pane without one always pays for the full capture.
+ */
+export async function rememberSteadyStateAnchor(
+  session: Session,
+  evidence: RemoteForegroundEvidence,
+  rows: Parameters<typeof buildPaneProcessFingerprint>[0]
+): Promise<void> {
+  if (evidence.verdict !== 'live' || !recognizeAgentProcess(evidence.processName)) {
+    anchors.delete(session)
+    return
+  }
+  let fingerprint: string | null
+  try {
+    fingerprint = await buildPaneProcessFingerprint(rows, session.pid)
+  } catch {
+    fingerprint = null
+  }
+  if (fingerprint === null || evidence.processName === null) {
+    anchors.delete(session)
+    return
+  }
+  anchors.set(session, {
+    agentName: evidence.processName,
+    fingerprint,
+    rawFallback: session.getForegroundProcess({ rawFallback: true })
+  })
+}
diff --git a/src/main/daemon/terminal-host.ts b/src/main/daemon/terminal-host.ts
index 18f7b82a90f..95bedd1a7fd 100644
--- a/src/main/daemon/terminal-host.ts
+++ b/src/main/daemon/terminal-host.ts
@@ -233,7 +233,7 @@ export class TerminalHost {
 
   inspectProcess(
     sessionId: string,
-    options?: { expectedIncarnationId?: string }
+    options?: { expectedIncarnationId?: string; steadyState?: boolean }
   ): Promise<TerminalHostProcessInspection> {
     pruneRetiredPtyIncarnations(this.retiredIncarnations)
     const session = this.sessions.get(sessionId)
@@ -253,6 +253,7 @@ export class TerminalHost {
       ...(options?.expectedIncarnationId
         ? { expectedIncarnationId: options.expectedIncarnationId }
         : {}),
+      ...(options?.steadyState === true ? { steadyState: true } : {}),
       retiredIncarnation: this.retiredIncarnations.get(sessionId),
       authorityGeneration: this.authorityGeneration,
       nextObservationEpoch: () => ++this.observationEpoch
diff --git a/src/main/git/command-runner/git-exec-file.ts b/src/main/git/command-runner/git-exec-file.ts
index dbd861d4897..acfeb9f8a3e 100644
--- a/src/main/git/command-runner/git-exec-file.ts
+++ b/src/main/git/command-runner/git-exec-file.ts
@@ -10,6 +10,7 @@ import {
   prepareWslLinkedWorktreeGitRouting
 } from '../wsl-linked-worktree-git-routing'
 import { resolveCommand, type ResolvedCommand } from './wsl-command-resolution'
+import { annotateWslHostFailure } from './wsl-host-failure'
 import type { GitAdmissionTier, GitExecOptions } from './git-exec-options'
 import { execFileCapture, execFileCaptureToTermination } from './exec-file-capture'
 import {
@@ -96,7 +97,7 @@ async function gitExecFileAsyncUnlocked(
             ? {}
             : { createTimeoutError: () => new GitCommandTimeoutError(timeoutMs) })
         }
-        return options.terminationBarrier
+        const captured = options.terminationBarrier
           ? execFileCaptureToTermination(
               command.binary,
               command.args,
@@ -104,6 +105,10 @@ async function gitExecFileAsyncUnlocked(
               command.termination
             )
           : execFileCapture(command.binary, command.args, captureOptions)
+        // Why: a dead WSL distro fails with an empty stderr, so the span would carry no cause at all.
+        return captured.catch((error: unknown) => {
+          throw annotateWslHostFailure(error, command)
+        })
       }
       const runCapturedCommand = async (): Promise<{ stdout: string; stderr: string }> => {
         let result: { stdout: string | Buffer; stderr: string | Buffer }
diff --git a/src/main/git/command-runner/git-process-env.ts b/src/main/git/command-runner/git-process-env.ts
index 6154364e5ab..9064f5ed900 100644
--- a/src/main/git/command-runner/git-process-env.ts
+++ b/src/main/git/command-runner/git-process-env.ts
@@ -63,6 +63,11 @@ export function nonInteractiveGitEnv(
   platform: NodeJS.Platform = process.platform
 ): NodeJS.ProcessEnv {
   const next = promptGuardGitEnv(env, platform)
+  if (platform === 'win32') {
+    // Why: without it wsl.exe writes its OWN failures ("no distribution with the supplied name") as
+    // UTF-16LE (#9010), which is how a dead distro reached telemetry as an error with no text.
+    next.WSL_UTF8 = '1'
+  }
   if (!next.GIT_SSH_COMMAND) {
     next.GIT_SSH_COMMAND = 'ssh -o BatchMode=yes'
     if (platform === 'win32') {
diff --git a/src/main/git/command-runner/spawned-command-tree-kill.ts b/src/main/git/command-runner/spawned-command-tree-kill.ts
index c2fefcba1bc..324e04f1db3 100644
--- a/src/main/git/command-runner/spawned-command-tree-kill.ts
+++ b/src/main/git/command-runner/spawned-command-tree-kill.ts
@@ -1,4 +1,5 @@
 import { spawn, type ChildProcess } from 'node:child_process'
+import { admitSelfInitiatedTreeKill } from '../../own-chromium-tree-kill-guard'
 
 const WINDOWS_TREE_KILL_WAIT_MS = 2_000
 
@@ -8,6 +9,14 @@ export function killSpawnedCommandTree(child: ChildProcess): Promise<void> {
     child.kill()
     return Promise.resolve()
   }
+  if (
+    !admitSelfInitiatedTreeKill({ pid, site: 'git-command-tree-kill', scope: 'win-taskkill-tree' })
+  ) {
+    // Refusal blocks the pid-addressed tree walk, never the termination: the
+    // handle-addressed root kill cannot reach a recycled pid.
+    child.kill()
+    return Promise.resolve()
+  }
   return new Promise((resolve) => {
     let killer: ChildProcess
     try {
diff --git a/src/main/git/command-runner/wsl-host-failure.test.ts b/src/main/git/command-runner/wsl-host-failure.test.ts
new file mode 100644
index 00000000000..4b495817f6f
--- /dev/null
+++ b/src/main/git/command-runner/wsl-host-failure.test.ts
@@ -0,0 +1,143 @@
+import { EventEmitter } from 'node:events'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { execFileMock } = vi.hoisted(() => ({ execFileMock: vi.fn() }))
+
+vi.mock('node:child_process', () => ({
+  execFile: execFileMock,
+  execFileSync: vi.fn(),
+  spawn: vi.fn()
+}))
+vi.mock('../../observability/instrumentation', () => ({
+  withGitSpan: (_attributes: unknown, run: (span: unknown) => unknown) =>
+    run({ setAttribute: () => {} })
+}))
+vi.mock('../../diagnostics/main-thread-churn-probe', () => ({ recordSubprocessSpawn: vi.fn() }))
+
+import { gitExecFileAsync } from '../runner'
+import { _resetGitAdmissionForTests } from './git-subprocess-admission'
+import { nonInteractiveGitEnv } from './git-process-env'
+import { annotateWslHostFailure, readWslHostFailureDiagnostic } from './wsl-host-failure'
+import type { ResolvedCommand } from './wsl-command-resolution'
+
+const WSL_COMMAND: ResolvedCommand = {
+  binary: 'wsl.exe',
+  args: ['-d', 'kali-linux', '--exec', 'sh', '-lc', 'git worktree list'],
+  cwd: 'C:\\Users\\paulius',
+  wsl: { distro: 'kali-linux', linuxPath: '/home/paulius/bugbounty' },
+  wslMode: 'login-shell'
+}
+
+const WSL_DIAGNOSTIC =
+  'There is no distribution with the supplied name.\r\nError code: Wsl/Service/WSL_E_DISTRO_NOT_FOUND\r\n'
+
+/** wsl.exe without WSL_UTF8 writes its own diagnostic as UTF-16LE, which reaches Node as NUL-riddled text. */
+function asUtf16Mojibake(text: string): string {
+  return [...text].map((character) => `${character}\u0000`).join('')
+}
+
+function hostFailure(stdout: string): Error {
+  return Object.assign(new Error('Command failed: wsl.exe -d kali-linux --exec sh -lc ...'), {
+    code: 4294967295,
+    stdout,
+    stderr: ''
+  })
+}
+
+async function withPlatform<T>(platform: NodeJS.Platform, run: () => Promise<T>): Promise<T> {
+  const original = process.platform
+  Object.defineProperty(process, 'platform', { configurable: true, value: platform })
+  try {
+    return await run()
+  } finally {
+    Object.defineProperty(process, 'platform', { configurable: true, value: original })
+  }
+}
+
+describe('wsl.exe host failure classification', () => {
+  it('reads the diagnostic wsl.exe left on stdout, including UTF-16 output', () => {
+    expect(readWslHostFailureDiagnostic(hostFailure(WSL_DIAGNOSTIC), WSL_COMMAND)).toContain(
+      'Wsl/Service/WSL_E_DISTRO_NOT_FOUND'
+    )
+    expect(
+      readWslHostFailureDiagnostic(hostFailure(asUtf16Mojibake(WSL_DIAGNOSTIC)), WSL_COMMAND)
+    ).toContain('Wsl/Service/WSL_E_DISTRO_NOT_FOUND')
+  })
+
+  it('leaves a guest failure and a non-WSL command alone', () => {
+    const guestFailure = Object.assign(new Error('Command failed'), {
+      code: 1,
+      stdout: '',
+      stderr: 'fatal: not a git repository\n'
+    })
+    expect(readWslHostFailureDiagnostic(guestFailure, WSL_COMMAND)).toBeNull()
+    // Same exit code, but wsl.exe was never involved.
+    expect(
+      readWslHostFailureDiagnostic(hostFailure(WSL_DIAGNOSTIC), {
+        binary: 'git',
+        args: ['status'],
+        cwd: '/repo',
+        wsl: null,
+        wslMode: null
+      })
+    ).toBeNull()
+  })
+
+  it('moves the diagnostic into the message the span records', () => {
+    const error = annotateWslHostFailure(hostFailure(WSL_DIAGNOSTIC), WSL_COMMAND) as Error & {
+      wslHostFailure?: boolean
+      wslDistro?: string
+      code?: number
+    }
+    expect(error.message).toContain('Wsl/Service/WSL_E_DISTRO_NOT_FOUND')
+    expect(error.message).toContain('kali-linux')
+    expect(error.wslHostFailure).toBe(true)
+    expect(error.wslDistro).toBe('kali-linux')
+    // The original failure detail must survive for callers that classify on it.
+    expect(error.code).toBe(4294967295)
+    expect(error.message).toContain('Command failed: wsl.exe')
+  })
+})
+
+describe('WSL-routed git subprocess', () => {
+  beforeEach(() => {
+    execFileMock.mockReset()
+  })
+
+  afterEach(() => {
+    _resetGitAdmissionForTests()
+  })
+
+  it('sets WSL_UTF8 so wsl.exe explains itself in UTF-8', () => {
+    expect(nonInteractiveGitEnv({}, 'win32').WSL_UTF8).toBe('1')
+    expect(nonInteractiveGitEnv({}, 'darwin').WSL_UTF8).toBeUndefined()
+  })
+
+  it('reports a dead distro instead of an empty git error', async () => {
+    execFileMock.mockImplementation((_command, _args, _options, callback) => {
+      const child = new EventEmitter() as EventEmitter & { pid: number; kill: () => void }
+      child.pid = 4321
+      child.kill = () => {}
+      queueMicrotask(() =>
+        callback?.(
+          hostFailure(asUtf16Mojibake(WSL_DIAGNOSTIC)),
+          asUtf16Mojibake(WSL_DIAGNOSTIC),
+          ''
+        )
+      )
+      return child
+    })
+
+    const failure = await withPlatform('win32', () =>
+      gitExecFileAsync(['worktree', 'list', '--porcelain', '-z'], {
+        cwd: '\\\\wsl.localhost\\kali-linux\\home\\paulius\\bugbounty'
+      }).then(
+        () => null,
+        (error: unknown) => error as Error
+      )
+    )
+
+    expect(failure?.message).toContain('Wsl/Service/WSL_E_DISTRO_NOT_FOUND')
+    expect(execFileMock.mock.calls.at(-1)?.[2]?.env?.WSL_UTF8).toBe('1')
+  })
+})
diff --git a/src/main/git/command-runner/wsl-host-failure.ts b/src/main/git/command-runner/wsl-host-failure.ts
new file mode 100644
index 00000000000..74f98509d0b
--- /dev/null
+++ b/src/main/git/command-runner/wsl-host-failure.ts
@@ -0,0 +1,55 @@
+import type { ResolvedCommand } from './wsl-command-resolution'
+
+/** wsl.exe's own launch-failure exit, distinct from any status the guest process can return. */
+export const WSL_HOST_FAILURE_EXIT_CODE = 0xffffffff
+
+function outputText(value: unknown): string {
+  if (typeof value === 'string') {
+    return value
+  }
+  return Buffer.isBuffer(value) ? value.toString('utf8') : ''
+}
+
+/**
+ * The message wsl.exe prints when it — not the guest — failed: a distro that was renamed or
+ * removed, or a VM that would not start.
+ *
+ * Why this needs decoding at all: wsl.exe exits 0xFFFFFFFF, leaves stderr EMPTY, and writes
+ * `Error code: Wsl/Service/WSL_E_*` to stdout, so every caller that reports stderr reports nothing.
+ * NULs are stripped because a wsl.exe that ignores WSL_UTF8 writes that line as UTF-16LE (#9010).
+ */
+export function readWslHostFailureDiagnostic(
+  error: unknown,
+  command: ResolvedCommand
+): string | null {
+  if (!command.wsl || !error || typeof error !== 'object') {
+    return null
+  }
+  const { code, status, stdout, stderr } = error as {
+    code?: unknown
+    status?: unknown
+    stdout?: unknown
+    stderr?: unknown
+  }
+  const exitCode = typeof code === 'number' ? code : typeof status === 'number' ? status : null
+  // A guest failure always explains itself on stderr; an empty one plus this exit is the host.
+  if (exitCode !== WSL_HOST_FAILURE_EXIT_CODE || outputText(stderr).trim().length > 0) {
+    return null
+  }
+  const diagnostic = outputText(stdout).replaceAll('\u0000', '').trim()
+  return diagnostic.length > 0 ? diagnostic : 'wsl.exe reported no diagnostic.'
+}
+
+/**
+ * Move a wsl.exe host failure into the error's message, which is what `git.exec` spans record ahead
+ * of the stack. Left untouched when the failure came from git itself.
+ */
+export function annotateWslHostFailure(error: unknown, command: ResolvedCommand): unknown {
+  const diagnostic = readWslHostFailureDiagnostic(error, command)
+  if (diagnostic === null || !(error instanceof Error) || !command.wsl) {
+    return error
+  }
+  const distro = command.wsl.distro
+  error.message = `wsl.exe host failure (distro "${distro}"): ${diagnostic}\n${error.message}`
+  return Object.assign(error, { wslHostFailure: true, wslDistro: distro })
+}
diff --git a/src/main/git/git-username.ts b/src/main/git/git-username.ts
index da91361d0b8..88c7c5603c2 100644
--- a/src/main/git/git-username.ts
+++ b/src/main/git/git-username.ts
@@ -259,7 +259,15 @@ async function getConfiguredBranchRemote(repoPath: string, branch: string | null
  * the GitHub account name as its branch prefix.
  */
 async function localRepoHasEffectiveGitHubRemote(repoPath: string): Promise<boolean> {
-  const remotes = (await readGitStdout(repoPath, ['remote'])).split('\n').filter(Boolean)
+  const remoteList = await gitExecFileAsync(['remote'], {
+    cwd: repoPath,
+    timeout: LOCAL_GIT_READ_TIMEOUT_MS
+  }).catch(() => null)
+  const remotes = (remoteList?.stdout.trim() ?? '').split('\n').filter(Boolean)
+  // Only a successful empty list proves there is no hosted remote to inspect.
+  if (remoteList && remotes.length === 0) {
+    return false
+  }
   const defaultBaseRef = await resolveDefaultBaseRefViaExec((argv) =>
     gitExecFileAsync(argv, { cwd: repoPath, timeout: LOCAL_GIT_READ_TIMEOUT_MS })
   )
diff --git a/src/main/git/repo-branch-conflict.test.ts b/src/main/git/repo-branch-conflict.test.ts
index 873c8bd3340..82bd1e65c9d 100644
--- a/src/main/git/repo-branch-conflict.test.ts
+++ b/src/main/git/repo-branch-conflict.test.ts
@@ -21,7 +21,7 @@ describe('getBranchConflictKindViaExec', () => {
 
     await expect(getBranchConflictKindViaExec(exec, 'feature/fix')).resolves.toBe('remote')
     expect(calls).toEqual([
-      ['rev-parse', '--verify', 'refs/heads/feature/fix'],
+      ['rev-parse', '--verify', '--quiet', 'refs/heads/feature/fix'],
       ['remote'],
       ['show-ref', '--verify', '--quiet', '--', 'refs/remotes/foo/bar/feature/fix'],
       ['show-ref', '--verify', '--quiet', '--', 'refs/remotes/origin/feature/fix']
@@ -41,7 +41,10 @@ describe('getBranchConflictKindViaExec', () => {
     await expect(
       getBranchConflictKindViaExec(exec, 'feature/fix', 'origin/feature/fix')
     ).resolves.toBeNull()
-    expect(calls).toEqual([['rev-parse', '--verify', 'refs/heads/feature/fix'], ['remote']])
+    expect(calls).toEqual([
+      ['rev-parse', '--verify', '--quiet', 'refs/heads/feature/fix'],
+      ['remote']
+    ])
   })
 
   it('keeps longest configured remote-name matching semantics', async () => {
@@ -176,7 +179,7 @@ describe('getBranchConflictKindViaExec batched remote probe', () => {
       getBranchConflictKindViaExec(exec, 'feature', undefined, {}, batched)
     ).resolves.toBeNull()
     expect(calls).toEqual([
-      ['rev-parse', '--verify', 'refs/heads/feature'],
+      ['rev-parse', '--verify', '--quiet', 'refs/heads/feature'],
       ['remote'],
       ['cat-file', '--batch-check']
     ])
@@ -254,3 +257,68 @@ describe('getBranchConflictKindViaExec batched remote probe', () => {
     expect(calls.filter((argv) => argv[0] === 'show-ref')).toHaveLength(3)
   })
 })
+
+describe('branch conflict with existing-branch adoption', () => {
+  const absent = () => Object.assign(new Error('missing'), { code: 1, stderr: '' })
+
+  it('skips adoption and its commit probe for a proven missing local ref', async () => {
+    const exec = vi.fn(async (argv: string[]) => {
+      if (argv[0] === 'rev-parse') {
+        throw absent()
+      }
+      return { stdout: '' }
+    })
+    const adopt = vi.fn(async () => false)
+    await expect(
+      getBranchConflictKindViaExec(exec, 'new', undefined, {}, undefined, adopt)
+    ).resolves.toBeNull()
+    expect(adopt).not.toHaveBeenCalled()
+    expect(exec).toHaveBeenCalledTimes(2)
+  })
+
+  it('allows an existing branch without querying remote refs', async () => {
+    const exec = vi.fn(async () => ({ stdout: 'a'.repeat(40) }))
+    const adopt = vi.fn(async () => true)
+    await expect(
+      getBranchConflictKindViaExec(exec, 'existing', undefined, {}, undefined, adopt)
+    ).resolves.toBeNull()
+    expect(adopt).toHaveBeenCalledOnce()
+    expect(exec).toHaveBeenCalledOnce()
+  })
+
+  it('retains conflicts for refs whose objects cannot be adopted as commits', async () => {
+    const exec = vi.fn(async () => ({ stdout: 'a'.repeat(40) }))
+    const adopt = vi.fn(async () => false)
+    await expect(
+      getBranchConflictKindViaExec(exec, 'dangling', undefined, {}, undefined, adopt)
+    ).resolves.toBe('local')
+    expect(adopt).toHaveBeenCalledOnce()
+    expect(exec).toHaveBeenCalledTimes(2)
+  })
+
+  it.each([
+    Object.assign(new Error('transport'), { code: 1, stderr: 'transport failed' }),
+    Object.assign(new Error('timeout'), { code: 'ETIMEDOUT' })
+  ])('still attempts adoption after an undecided ref probe: %s', async (error) => {
+    const exec = vi.fn(async () => {
+      throw error
+    })
+    const adopt = vi.fn(async () => true)
+    await expect(
+      getBranchConflictKindViaExec(exec, 'existing', undefined, {}, undefined, adopt)
+    ).resolves.toBeNull()
+    expect(adopt).toHaveBeenCalledOnce()
+  })
+
+  it('rechecks a ref that disappeared while adoption was running', async () => {
+    const exec = vi
+      .fn()
+      .mockResolvedValueOnce({ stdout: 'a'.repeat(40) })
+      .mockRejectedValueOnce(absent())
+      .mockResolvedValueOnce({ stdout: '' })
+    await expect(
+      getBranchConflictKindViaExec(exec, 'removed', undefined, {}, undefined, async () => false)
+    ).resolves.toBeNull()
+    expect(exec).toHaveBeenCalledTimes(3)
+  })
+})
diff --git a/src/main/git/repo-branch-conflict.ts b/src/main/git/repo-branch-conflict.ts
index 5c6e03b94b0..f22fd97f99e 100644
--- a/src/main/git/repo-branch-conflict.ts
+++ b/src/main/git/repo-branch-conflict.ts
@@ -3,6 +3,7 @@ import { gitExecOptions, type LocalGitExecOptions } from './repo-default-base-re
 import { gitExecFileAsync } from './runner'
 import { isSafeGitRefName } from '../../shared/git-status-upstream-ref'
 import {
+  isShowRefNoMatchError,
   probeAnyExactRef,
   probeAnyExactRefBatched,
   type ExactRefProbeExec,
@@ -29,16 +30,17 @@ function canQueryRemoteBranchName(branchName: string): boolean {
   return !branchName.startsWith('-') && isSafeGitRefName(`refs/heads/${branchName}`)
 }
 
-async function hasGitRefAsync(
+async function probeLocalBranchRef(
   exec: ExactRefProbeExec,
   ref: string,
   options: ExactRefProbeExecOptions
-): Promise<boolean> {
+): Promise<'present' | 'absent' | 'unknown'> {
   try {
-    const { stdout } = await runGit(exec, ['rev-parse', '--verify', ref], options)
-    return stdout.trim().length > 0
-  } catch {
-    return false
+    // Quiet absence avoids retrying the WSL probe through a login shell.
+    const { stdout } = await runGit(exec, ['rev-parse', '--verify', '--quiet', ref], options)
+    return stdout.trim().length > 0 ? 'present' : 'unknown'
+  } catch (error) {
+    return isShowRefNoMatchError(error) ? 'absent' : 'unknown'
   }
 }
 
@@ -105,7 +107,8 @@ export async function getBranchConflictKindViaExec(
   branchName: string,
   allowedBaseRef?: string,
   options: ExactRefProbeExecOptions = {},
-  batchedExec?: ExactRefProbeStdinExec
+  batchedExec?: ExactRefProbeStdinExec,
+  allowLocalBranch?: () => Promise<boolean>
 ): Promise<BranchConflictKind | null> {
   if (!canQueryRemoteBranchName(branchName)) {
     return null
@@ -114,7 +117,16 @@ export async function getBranchConflictKindViaExec(
   // are quiet, so introducing a smaller implicit cap would only make a large
   // remote configuration look like a missing conflict.
   const probeOptions: ExactRefProbeExecOptions = options
-  if (await hasGitRefAsync(exec, `refs/heads/${branchName}`, probeOptions)) {
+  const localRef = `refs/heads/${branchName}`
+  let presence = await probeLocalBranchRef(exec, localRef, probeOptions)
+  if (allowLocalBranch && presence !== 'absent') {
+    if (await allowLocalBranch()) {
+      return null
+    }
+    // Adoption can span ref changes; preserve the fresh conflict check after it fails.
+    presence = await probeLocalBranchRef(exec, localRef, probeOptions)
+  }
+  if (presence === 'present') {
     return 'local'
   }
 
@@ -142,7 +154,8 @@ export function getBranchConflictKind(
   path: string,
   branchName: string,
   allowedBaseRef?: string,
-  options: LocalGitExecOptions = {}
+  options: LocalGitExecOptions = {},
+  allowLocalBranch?: () => Promise<boolean>
 ): Promise<BranchConflictKind | null> {
   const execOptions = gitExecOptions(path, options)
   const runLocalGit = (
@@ -168,7 +181,8 @@ export function getBranchConflictKind(
     // one `show-ref` subprocess per remote -- the exact cost the batch exists to remove.
     // `show-ref --verify --quiet` prints nothing and is read by exit code, so it needs
     // no fence; the capture wrapper preserves the payload's exit status either way.
-    (argv, commandOptions) => runLocalGit(argv, commandOptions, true)
+    (argv, commandOptions) => runLocalGit(argv, commandOptions, true),
+    allowLocalBranch
   )
 }
 
diff --git a/src/main/git/repo-username.test.ts b/src/main/git/repo-username.test.ts
index 8d2180791b6..9add077c9f8 100644
--- a/src/main/git/repo-username.test.ts
+++ b/src/main/git/repo-username.test.ts
@@ -140,6 +140,33 @@ describe('resolveLocalGitUsername', () => {
     await expect(resolveLocalGitUsername('/repo')).resolves.toBe('gh-demo')
   })
 
+  it('stops after a successful empty remote list', async () => {
+    await expect(resolveLocalGitUsernameDetailed('/repo')).resolves.toEqual({
+      username: '',
+      authoritative: true
+    })
+    expect(gitExecFileAsyncMock.mock.calls.map(([args]) => args)).toEqual([
+      ['config', '--get', 'github.user'],
+      ['config', '--get', 'user.username'],
+      ['remote']
+    ])
+    expect(ghExecFileAsyncMock).not.toHaveBeenCalled()
+  })
+
+  it('keeps remote fallback probes when remote enumeration fails', async () => {
+    originRemoteUrl = 'https://github.com/stablyai/orca.git'
+    const original = gitExecFileAsyncMock.getMockImplementation()!
+    gitExecFileAsyncMock.mockImplementation(async (...args) => {
+      if (args[0].length === 1 && args[0][0] === 'remote') {
+        throw makeExecError('remote enumeration failed')
+      }
+      return original(...args)
+    })
+    ghExecFileAsyncMock.mockResolvedValue({ stdout: 'gh-demo\n', stderr: '' })
+
+    await expect(resolveLocalGitUsername('/repo')).resolves.toBe('gh-demo')
+  })
+
   it('uses GitHub CLI login for GitHub remotes instead of repo-local author identity', async () => {
     originRemoteUrl = 'https://github.com/stablyai/orca.git'
     gitConfig['user.email'] = 'demo@example.com'
diff --git a/src/main/git/runner-wsl-direct-read.test.ts b/src/main/git/runner-wsl-direct-read.test.ts
index 284cda55718..e7ea423f78e 100644
--- a/src/main/git/runner-wsl-direct-read.test.ts
+++ b/src/main/git/runner-wsl-direct-read.test.ts
@@ -17,6 +17,7 @@ vi.mock('../observability/instrumentation', () => ({
 }))
 vi.mock('../diagnostics/main-thread-churn-probe', () => ({ recordSubprocessSpawn: vi.fn() }))
 
+import { getBranchConflictKind } from './repo-branch-conflict'
 import { pendingWslDirectGitReadEnvironment } from './command-runner/git-command-resolution'
 import { gitExecFileAsync, gitSpawn, gitStreamStdout } from './runner'
 import {
@@ -584,6 +585,33 @@ describe('WSL direct Git reads', () => {
     })
   })
 
+  it('checks a missing branch conflict without retrying through a login shell', async () => {
+    await withPlatform('win32', async () => {
+      seedWslGitReadEnvironmentForTests(DISTRO, LOGIN_ENVIRONMENT)
+      execFileMock.mockImplementation((_command, args: string[], _options, callback) => {
+        const child = createMockChild()
+        queueMicrotask(() => {
+          const missingRef = args.join(' ').includes('rev-parse')
+          const quiet = args.includes('--quiet')
+          const code = missingRef ? (quiet ? 1 : 128) : 0
+          callback?.(
+            code ? Object.assign(new Error('missing ref'), { code }) : null,
+            '',
+            missingRef && !quiet ? 'fatal: Needed a single revision' : ''
+          )
+          child.emit('close', code, null)
+        })
+        return child
+      })
+
+      await expect(
+        getBranchConflictKind(String.raw`\\wsl.localhost\Ubuntu\repo`, 'new-feature')
+      ).resolves.toBeNull()
+      expect(execFileMock).toHaveBeenCalledTimes(2)
+      expect(execFileMock.mock.calls[0]?.[1]).toContain('--quiet')
+    })
+  })
+
   it('keeps the fast path when direct and login Git both report an expected failure', async () => {
     await withPlatform('win32', async () => {
       seedWslGitReadEnvironmentForTests(DISTRO, LOGIN_ENVIRONMENT)
diff --git a/src/main/git/source-control/status-read.ts b/src/main/git/source-control/status-read.ts
index 276bf26e646..1ec81694d33 100644
--- a/src/main/git/source-control/status-read.ts
+++ b/src/main/git/source-control/status-read.ts
@@ -14,7 +14,10 @@ import {
 } from '../../../shared/git-status-line-stats-cache'
 import { resolveWorktreeHostPath } from '../../../shared/git-metadata-path'
 import { gitOptionalLocksDisabledEnv, gitStreamStdout } from '../runner'
-import { findExistingWorktreeSymlinkPaths } from '../worktree-symlink-detection'
+import {
+  findExistingWorktreeSymlinkPaths,
+  getSafeRelativePath
+} from '../worktree-symlink-detection'
 import type { GetStatusOptions } from './get-status-options'
 import { statusReadLeaseOwner } from './git-read-cache-invalidation'
 import { detectConflictOperation } from './git-conflict-operation'
@@ -89,8 +92,18 @@ async function dropSharedSymlinkUntrackedEntries(
   if (sharedLinkPaths.length === 0 || !entries.some((entry) => entry.area === 'untracked')) {
     return
   }
+  const untrackedPaths = new Set(
+    entries.filter((entry) => entry.area === 'untracked').map((entry) => entry.path)
+  )
+  const candidatePaths = sharedLinkPaths.filter((rawPath) => {
+    const path = getSafeRelativePath(rawPath)
+    return path.safe && untrackedPaths.has(path.rel)
+  })
+  if (candidatePaths.length === 0) {
+    return
+  }
   const sharedLinks = new Set(
-    await findExistingWorktreeSymlinkPaths(worktreePath, sharedLinkPaths, {
+    await findExistingWorktreeSymlinkPaths(worktreePath, candidatePaths, {
       wslDistro: options.wslDistro
     })
   )
diff --git a/src/main/git/source-control/submodule-status.ts b/src/main/git/source-control/submodule-status.ts
index f3c808c9f2f..fb4ca8449e3 100644
--- a/src/main/git/source-control/submodule-status.ts
+++ b/src/main/git/source-control/submodule-status.ts
@@ -26,17 +26,22 @@ export async function getSubmoduleStatus(
   const submoduleWorktreePath = resolveSubmoduleWorktreePath(worktreePath, submodulePath)
   const limit = resolveGitStatusLimit(options.limit)
   // Why: staged expansion only represents HEAD→index; scanning the submodule worktree is wasted work.
-  const workingResult = options.staged
-    ? ({ entries: [], conflictOperation: 'unknown' } satisfies GitStatusResult)
-    : await getStatus(submoduleWorktreePath, options)
-  // Why: a moved gitlink (clean worktree) has no status rows; surface the parent-commit→checkout range as inner rows.
-  const fromOid = options.staged
-    ? await readGitlinkOidFromTree(worktreePath, 'HEAD', submodulePath, options)
-    : (await readGitlinkOidFromIndex(worktreePath, submodulePath, options)) ||
-      (await readGitlinkOidFromTree(worktreePath, 'HEAD', submodulePath, options))
-  const toOid = options.staged
-    ? await readGitlinkOidFromIndex(worktreePath, submodulePath, options)
-    : await readWorkingSubmoduleHead(submoduleWorktreePath, options)
+  // These three reads are independent, so they run concurrently — on SSH/WSL each one is a real round trip.
+  const [workingResult, fromOid, toOid] = await Promise.all([
+    options.staged
+      ? Promise.resolve<GitStatusResult>({ entries: [], conflictOperation: 'unknown' })
+      : getStatus(submoduleWorktreePath, options),
+    // Why: a moved gitlink (clean worktree) has no status rows; surface the parent-commit→checkout range as inner rows.
+    options.staged
+      ? readGitlinkOidFromTree(worktreePath, 'HEAD', submodulePath, options)
+      : readGitlinkOidFromIndex(worktreePath, submodulePath, options).then(
+          (indexOid) =>
+            indexOid || readGitlinkOidFromTree(worktreePath, 'HEAD', submodulePath, options)
+        ),
+    options.staged
+      ? readGitlinkOidFromIndex(worktreePath, submodulePath, options)
+      : readWorkingSubmoduleHead(submoduleWorktreePath, options)
+  ])
   if (fromOid && toOid && fromOid !== toOid) {
     const rangeEntries = await computeSubmoduleRangeEntries(
       submoduleWorktreePath,
diff --git a/src/main/git/status-submodule.test.ts b/src/main/git/status-submodule.test.ts
index b67a4eca9a0..6528d373a78 100644
--- a/src/main/git/status-submodule.test.ts
+++ b/src/main/git/status-submodule.test.ts
@@ -395,4 +395,35 @@ describe('getSubmoduleStatus', () => {
     expect(result.didHitLimit).toBe(true)
     expect(result.statusLength).toBe(2)
   })
+
+  it('overlaps the inner status, index and HEAD reads instead of serializing them', async () => {
+    const OLD_OID = 'a'.repeat(40)
+    const NEW_OID = 'b'.repeat(40)
+    readFileMock.mockResolvedValue('gitdir: /repo/flutter_mine/.git\n')
+    existsSyncMock.mockReturnValue(false)
+    const events: string[] = []
+    gitExecFileAsyncMock.mockReset()
+    gitExecFileAsyncMock.mockImplementation(async (args: string[]) => {
+      const name = args.includes('status') ? 'status' : args[0]
+      events.push(`start:${name}`)
+      if (name === 'status') {
+        // Hold the inner status open so a serialized caller could not have started the oid reads.
+        await new Promise((resolve) => setTimeout(resolve, 5))
+      }
+      events.push(`end:${name}`)
+      if (name === 'ls-files') {
+        return { stdout: `160000 ${OLD_OID} 0\tflutter_mine\n` }
+      }
+      if (name === 'rev-parse') {
+        return { stdout: `${NEW_OID}\n` }
+      }
+      return { stdout: '' }
+    })
+
+    await getSubmoduleStatus('/repo', 'flutter_mine')
+
+    // Serialized reads only start ls-files/rev-parse once the inner status has resolved.
+    expect(events.indexOf('start:ls-files')).toBeLessThan(events.indexOf('end:status'))
+    expect(events.indexOf('start:rev-parse')).toBeLessThan(events.indexOf('end:status'))
+  })
 })
diff --git a/src/main/git/status-symlink-probe-budget.test.ts b/src/main/git/status-symlink-probe-budget.test.ts
new file mode 100644
index 00000000000..b312048078b
--- /dev/null
+++ b/src/main/git/status-symlink-probe-budget.test.ts
@@ -0,0 +1,81 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { resolve } from 'node:path'
+import { getStatus } from './source-control/status-read'
+
+const { lstat, stream, conflict } = vi.hoisted(() => ({
+  lstat: vi.fn(),
+  stream: vi.fn(),
+  conflict: vi.fn()
+}))
+vi.mock('node:fs/promises', () => ({ lstat }))
+vi.mock('./source-control/git-conflict-operation', () => ({ detectConflictOperation: conflict }))
+vi.mock('./runner', () => ({
+  gitStreamStdout: stream,
+  gitOptionalLocksDisabledEnv: () => ({ GIT_OPTIONAL_LOCKS: '0' })
+}))
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  conflict.mockResolvedValue(undefined)
+  lstat.mockResolvedValue({ isSymbolicLink: () => true })
+  stream.mockImplementation(async (_args, options) => {
+    options.onStdout('? unrelated.txt\n')
+    return { stoppedEarly: false }
+  })
+})
+
+function status(sharedLinkPaths: string[]) {
+  return getStatus('/repo', { sharedLinkPaths, includeLineStats: false })
+}
+
+describe('status shared symlink probe budget', () => {
+  it.each([1, 8, 32])(
+    'does no unrelated symlink probes for %i configured paths over 100 refreshes',
+    async (count) => {
+      const paths = Array.from({ length: count }, (_, index) => `shared-${index}`)
+      for (let refresh = 0; refresh < 100; refresh++) {
+        expect((await status(paths)).entries).toEqual([
+          { path: 'unrelated.txt', status: 'untracked', area: 'untracked' }
+        ])
+      }
+      expect(lstat).not.toHaveBeenCalled()
+      expect(stream).toHaveBeenCalledTimes(100)
+    }
+  )
+
+  it('probes matching normalized paths, retaining duplicate probes and original order', async () => {
+    stream.mockImplementation(async (_args, options) => {
+      options.onStdout('? link\n? 日本 語\n? unrelated.txt\n')
+      return { stoppedEarly: false }
+    })
+    const result = await status(['absent', ' /link ', '\\日本 語', 'link', '../link', 'C:link'])
+    expect(lstat.mock.calls.map(([path]) => path)).toEqual([
+      resolve('/repo', 'link'),
+      resolve('/repo', '日本 語'),
+      resolve('/repo', 'link')
+    ])
+    expect(result.entries.map((entry) => entry.path)).toEqual(['unrelated.txt'])
+  })
+
+  it('rechecks matching paths after the filesystem changes and preserves unreadable paths', async () => {
+    const paths = ['unrelated.txt']
+    expect((await status(paths)).entries).toEqual([])
+    lstat.mockResolvedValueOnce({ isSymbolicLink: () => false })
+    expect((await status(paths)).entries).toHaveLength(1)
+    lstat.mockRejectedValueOnce(new Error('EACCES'))
+    expect((await status(paths)).entries).toHaveLength(1)
+    expect(lstat).toHaveBeenCalledTimes(3)
+  })
+
+  it('does not broaden exact path matching to descendants or case variants', async () => {
+    stream.mockImplementation(async (_args, options) => {
+      options.onStdout('? link/child\n? LINK\n')
+      return { stoppedEarly: false }
+    })
+    expect((await status(['link'])).entries.map((entry) => entry.path)).toEqual([
+      'link/child',
+      'LINK'
+    ])
+    expect(lstat).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/git/worktree-add-creation-config.test.ts b/src/main/git/worktree-add-creation-config.test.ts
index 44394b7728d..ff44ca7ac6d 100644
--- a/src/main/git/worktree-add-creation-config.test.ts
+++ b/src/main/git/worktree-add-creation-config.test.ts
@@ -199,7 +199,7 @@ describe('addWorktree', () => {
     })
 
     const worktreeAddCall = gitExecFileAsyncMock.mock.calls.find(
-      ([argv]) => Array.isArray(argv) && argv[0] === 'worktree' && argv[1] === 'add'
+      ([argv]) => Array.isArray(argv) && argv.includes('worktree') && argv.includes('add')
     )
     expect(worktreeAddCall?.[1]).toMatchObject({ timeout: WORKTREE_ADD_TIMEOUT_MS })
     expect(WORKTREE_ADD_TIMEOUT_MS).toBeGreaterThan(0)
@@ -214,7 +214,7 @@ describe('addWorktree', () => {
     })
 
     const worktreeAddCall = gitExecFileAsyncMock.mock.calls.find(
-      ([argv]) => Array.isArray(argv) && argv[0] === 'worktree' && argv[1] === 'add'
+      ([argv]) => Array.isArray(argv) && argv.includes('worktree') && argv.includes('add')
     )
     expect(worktreeAddCall?.[1]).toMatchObject({ timeout: 600_000 })
   })
diff --git a/src/main/git/worktree-add-local-base-refresh.test.ts b/src/main/git/worktree-add-local-base-refresh.test.ts
index dba4303647c..1ba2e6c16b8 100644
--- a/src/main/git/worktree-add-local-base-refresh.test.ts
+++ b/src/main/git/worktree-add-local-base-refresh.test.ts
@@ -1,5 +1,5 @@
 // addWorktree: fast-forwarding the local base ref (reset --hard / update-ref) and its safety bailouts.
-import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
 const {
   gitExecFileAsyncMock,
@@ -32,11 +32,14 @@ import { registerWorktreeSuiteHooks } from './worktree-test-harness'
 registerWorktreeSuiteHooks()
 
 describe('addWorktree', () => {
+  afterEach(() => vi.restoreAllMocks())
   const resolveCreationBaseConfigWrite = () => {
     gitExecFileAsyncMock.mockResolvedValueOnce({ stdout: '' }) // config --local --replace-all branch.<branch>.base
   }
 
   beforeEach(() => {
+    // These branch-safety assertions use POSIX argv; Windows flags have separate coverage.
+    vi.spyOn(process, 'platform', 'get').mockReturnValue('darwin')
     gitExecFileAsyncMock.mockReset()
     gitExecFileSyncMock.mockReset()
     translateWslOutputPathsMock.mockClear()
diff --git a/src/main/git/worktree-add-local-base-suggestion.test.ts b/src/main/git/worktree-add-local-base-suggestion.test.ts
index a65f77dd77d..3b449c339f6 100644
--- a/src/main/git/worktree-add-local-base-suggestion.test.ts
+++ b/src/main/git/worktree-add-local-base-suggestion.test.ts
@@ -1,5 +1,5 @@
 // addWorktree: advisory local-base-ref update suggestions when the refresh setting is off.
-import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
 const {
   gitExecFileAsyncMock,
@@ -32,7 +32,10 @@ import { registerWorktreeSuiteHooks } from './worktree-test-harness'
 registerWorktreeSuiteHooks()
 
 describe('addWorktree', () => {
+  afterEach(() => vi.restoreAllMocks())
   beforeEach(() => {
+    // These branch-safety assertions use POSIX argv; Windows flags have separate coverage.
+    vi.spyOn(process, 'platform', 'get').mockReturnValue('darwin')
     gitExecFileAsyncMock.mockReset()
     gitExecFileSyncMock.mockReset()
     translateWslOutputPathsMock.mockClear()
diff --git a/src/main/git/worktree-add.ts b/src/main/git/worktree-add.ts
index ea6ec704b46..380f3a3cc34 100644
--- a/src/main/git/worktree-add.ts
+++ b/src/main/git/worktree-add.ts
@@ -12,7 +12,7 @@ import {
   getLocalBaseRefUpdateSuggestionForWorktreeCreate,
   refreshLocalBaseRefForWorktreeCreate
 } from './worktree-base-refresh'
-import { hasWorktreeBaseCommitRef } from './worktree-base-ref-probe'
+import { resolveWorktreeBaseCommitOid } from './worktree-base-ref-probe'
 import type {
   AddWorktreeOptions,
   AddWorktreeResult,
@@ -23,6 +23,7 @@ import { bumpWorktreeScanGeneration } from './worktree-scan-cache'
 
 export type WorktreeAddBaseContext = AddWorktreeResult & {
   effectiveBase: string
+  effectiveBaseOid?: string
 }
 
 export async function resolveWorktreeAddBaseContext(
@@ -31,9 +32,11 @@ export async function resolveWorktreeAddBaseContext(
   refreshLocalBaseRef: boolean,
   options: AddWorktreeOptions
 ): Promise<WorktreeAddBaseContext> {
-  const effectiveBase = await resolveWorktreeAddBaseRef(baseBranch, (qualifiedRef) =>
-    hasWorktreeBaseCommitRef(repoPath, qualifiedRef, options)
-  )
+  let effectiveBaseOid: string | null = null
+  const effectiveBase = await resolveWorktreeAddBaseRef(baseBranch, async (qualifiedRef) => {
+    effectiveBaseOid = await resolveWorktreeBaseCommitOid(repoPath, qualifiedRef, options)
+    return effectiveBaseOid !== null
+  })
   const localBaseRefRefresh = refreshLocalBaseRef
     ? await refreshLocalBaseRefForWorktreeCreate(
         repoPath,
@@ -55,6 +58,10 @@ export async function resolveWorktreeAddBaseContext(
       : undefined
   return {
     effectiveBase,
+    // Refresh/suggestion work can span ref changes; only reuse the immediate resolution probe.
+    ...(!refreshLocalBaseRef && !options.suggestLocalBaseRefUpdate && effectiveBaseOid
+      ? { effectiveBaseOid }
+      : {}),
     ...(localBaseRefRefresh ? { localBaseRefRefresh } : {}),
     ...(localBaseRefUpdateSuggestion ? { localBaseRefUpdateSuggestion } : {})
   }
diff --git a/src/main/git/worktree-base-divergence-real-git.test.ts b/src/main/git/worktree-base-divergence-real-git.test.ts
index 377b63b48f9..4aa1734c792 100644
--- a/src/main/git/worktree-base-divergence-real-git.test.ts
+++ b/src/main/git/worktree-base-divergence-real-git.test.ts
@@ -3,6 +3,7 @@ import { mkdtemp, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, describe, expect, it } from 'vitest'
+import { GIT_FETCH_SKIP_AUTO_MAINTENANCE_CONFIG_ARGS } from '../../shared/git-fetch-auto-maintenance'
 import {
   measureRetargetDivergence,
   RETARGET_MAX_COMMIT_DIVERGENCE
@@ -10,8 +11,13 @@ import {
 
 const tempRoots: string[] = []
 
+// Why the maintenance suppression: `git commit` detaches `git maintenance run --auto`, and its
+// commit-graph task arms once a fixture crosses 100 new commits — which the cap-sized histories
+// below always do. That detached process keeps writing `.git/objects/info/commit-graphs` after the
+// synchronous exec has returned, so it re-creates entries under a `.git/objects` the temp-root
+// teardown is midway through deleting, and the recursive remove dies with ENOTEMPTY.
 function git(cwd: string, args: string[]): string {
-  return execFileSync('git', args, {
+  return execFileSync('git', [...GIT_FETCH_SKIP_AUTO_MAINTENANCE_CONFIG_ARGS, ...args], {
     cwd,
     encoding: 'utf8',
     stdio: ['pipe', 'pipe', 'pipe']
diff --git a/src/main/git/worktree-create-preparation-real-git.test.ts b/src/main/git/worktree-create-preparation-real-git.test.ts
index 63f8021a7ae..19c023a2403 100644
--- a/src/main/git/worktree-create-preparation-real-git.test.ts
+++ b/src/main/git/worktree-create-preparation-real-git.test.ts
@@ -1,8 +1,10 @@
 import { execFileSync } from 'node:child_process'
+import { existsSync, watch, type FSWatcher } from 'node:fs'
 import { mkdir, mkdtemp, readFile, realpath, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
-import { afterEach, describe, expect, it } from 'vitest'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import * as gitRunner from './runner'
 import {
   createWorktreePreparationLockReason,
   isWorktreeCreatePreparation,
@@ -15,6 +17,13 @@ import {
   prepareWorktreeCreateCheckout
 } from './worktree-create-preparation'
 import { areWorktreePathsEqual } from './worktree-path-comparison'
+import {
+  _resetPreparationPoolForTests,
+  listPreparations,
+  startPreparation,
+  takePreparation
+} from '../worktree-create-preparation-pool'
+import { hasPendingStalePreparationCleanup } from '../worktree-create-preparation-stale-cleanup'
 
 const tempRoots: string[] = []
 
@@ -46,6 +55,159 @@ afterEach(async () => {
 })
 
 describe('prepared worktree creation with real Git', () => {
+  it('retains preparation ownership when the removal command cannot start', async () => {
+    const fixture = await createRepo()
+    const repoPath = await realpath(fixture.repoPath)
+    const root = await realpath(fixture.root)
+    const preparedPath = join(root, WORKTREE_CREATE_PREPARATION_DIRECTORY, 'owned-removal')
+    await mkdir(join(root, WORKTREE_CREATE_PREPARATION_DIRECTORY), { recursive: true })
+    const lockReason = createWorktreePreparationLockReason('removal-failure')
+    await prepareWorktreeCreateCheckout(repoPath, preparedPath, 'main', lockReason)
+    const original = gitRunner.gitExecFileAsync
+    const spy = vi.spyOn(gitRunner, 'gitExecFileAsync').mockImplementation((args, options) => {
+      if (args.includes('remove') && args.includes(preparedPath)) {
+        return Promise.reject(new Error('injected removal launch failure'))
+      }
+      return original(args, options)
+    })
+    try {
+      await expect(discardPreparedWorktree(repoPath, preparedPath)).rejects.toThrow(
+        'injected removal launch failure'
+      )
+      const remaining = await listWorktrees(repoPath, { includeCreatePreparations: true })
+      const prepared = remaining.find((worktree) =>
+        areWorktreePathsEqual(worktree.path, preparedPath)
+      )
+      expect(prepared).toBeDefined()
+      expect(prepared?.lockReason).toBe(lockReason)
+      expect(await readFile(join(preparedPath, 'version.txt'), 'utf8')).toBe('one\n')
+    } finally {
+      spy.mockRestore()
+      await discardPreparedWorktree(repoPath, preparedPath)
+    }
+    expect(existsSync(preparedPath)).toBe(false)
+  })
+
+  it('creates and finalizes while dead-owner reclamation is stalled', async () => {
+    const fixture = await createRepo()
+    const repoPath = await realpath(fixture.repoPath)
+    const root = await realpath(fixture.root)
+    const preparationRoot = join(root, WORKTREE_CREATE_PREPARATION_DIRECTORY)
+    const stalePath = join(preparationRoot, '999999999-11111111-1111-4111-8111-111111111111')
+    await mkdir(preparationRoot, { recursive: true })
+    await prepareWorktreeCreateCheckout(
+      repoPath,
+      stalePath,
+      'main',
+      'orca-create-preparation:v1:999999999:stale'
+    )
+    let releaseRemoval!: () => void
+    const removalGate = new Promise<void>((resolve) => {
+      releaseRemoval = resolve
+    })
+    let markRemovalStarted!: () => void
+    const removalStarted = new Promise<void>((resolve) => {
+      markRemovalStarted = resolve
+    })
+    const original = gitRunner.gitExecFileAsync
+    const spy = vi
+      .spyOn(gitRunner, 'gitExecFileAsync')
+      .mockImplementation(async (args, options) => {
+        if (args.includes('remove') && args.includes(stalePath)) {
+          markRemovalStarted()
+          await removalGate
+        }
+        return original(args, options)
+      })
+    try {
+      const preparing = startPreparation({
+        repoPath,
+        workspaceRoot: root,
+        baseBranch: 'main',
+        canonicalBase: 'refs/heads/main',
+        options: {}
+      })
+      await removalStarted
+      expect(hasPendingStalePreparationCleanup()).toBe(true)
+      await preparing
+      const [entry] = listPreparations()
+      expect(entry).toBeDefined()
+      takePreparation(entry)
+      const finalPath = join(root, 'fresh-worktree')
+      await finalizePreparedWorktree(repoPath, entry.preparedPath, finalPath, 'fresh', 'main')
+      expect(git(finalPath, ['status', '--porcelain'])).toBe('')
+      expect(git(finalPath, ['symbolic-ref', '--short', 'HEAD'])).toBe('fresh')
+      expect(await readFile(join(finalPath, 'version.txt'), 'utf8')).toBe('one\n')
+      expect(existsSync(stalePath)).toBe(true)
+      expect(hasPendingStalePreparationCleanup()).toBe(true)
+      releaseRemoval()
+      await _resetPreparationPoolForTests()
+      expect(existsSync(stalePath)).toBe(false)
+      const remaining = await listWorktrees(repoPath, { includeCreatePreparations: true })
+      expect(remaining).toHaveLength(2)
+      expect(remaining.map((w) => w.path)).toEqual(expect.arrayContaining([repoPath, finalPath]))
+      expect(hasPendingStalePreparationCleanup()).toBe(false)
+    } finally {
+      releaseRemoval()
+      await _resetPreparationPoolForTests()
+      spy.mockRestore()
+    }
+  })
+
+  it('removes partial checkout files and registration after materialization is aborted', async () => {
+    const { repoPath, root } = await createRepo()
+    await Promise.all(
+      Array.from({ length: 1000 }, (_, index) =>
+        writeFile(
+          join(repoPath, `payload-${index.toString().padStart(4, '0')}.txt`),
+          'payload'.repeat(128)
+        )
+      )
+    )
+    git(repoPath, ['add', '.'])
+    git(repoPath, ['commit', '--quiet', '-m', 'materialization fixture'])
+    const preparationRoot = join(root, WORKTREE_CREATE_PREPARATION_DIRECTORY)
+    const preparedPath = join(preparationRoot, `${process.pid}-partial`)
+    await mkdir(preparationRoot, { recursive: true })
+    const controller = new AbortController()
+    const original = gitRunner.gitExecFileAsync
+    let watcher: FSWatcher | undefined
+    let observedMaterialization = false
+    const calls: string[][] = []
+    const spy = vi.spyOn(gitRunner, 'gitExecFileAsync').mockImplementation((args, options) => {
+      calls.push([...args])
+      if (args.includes('reset')) {
+        watcher = watch(preparedPath, (_event, filename) => {
+          // Only the reset writes here, so an event without a filename is still materialization.
+          if (filename === null || filename.toString().startsWith('payload-')) {
+            observedMaterialization = true
+            watcher?.close()
+            controller.abort()
+          }
+        })
+      }
+      return original(args, options)
+    })
+    try {
+      await expect(
+        prepareWorktreeCreateCheckout(
+          repoPath,
+          preparedPath,
+          'main',
+          createWorktreePreparationLockReason('partial-test'),
+          { signal: controller.signal }
+        )
+      ).rejects.toThrow()
+      expect(observedMaterialization).toBe(true)
+      expect(calls.some((args) => args[args.indexOf('worktree') + 1] === 'lock')).toBe(false)
+      expect(existsSync(preparedPath)).toBe(false)
+      expect(await listWorktrees(repoPath, { includeCreatePreparations: true })).toHaveLength(1)
+    } finally {
+      watcher?.close()
+      spy.mockRestore()
+    }
+  })
+
   it('cleans up when the create signal is canceled', async () => {
     const { repoPath, root } = await createRepo()
     const preparationRoot = join(root, WORKTREE_CREATE_PREPARATION_DIRECTORY)
@@ -117,6 +279,58 @@ describe('prepared worktree creation with real Git', () => {
     )
   })
 
+  it.each(['before reset', 'after reset'])(
+    'finalizes refreshed content when the base moves %s',
+    async (when) => {
+      const { repoPath, root } = await createRepo()
+      const preparedPath = join(root, WORKTREE_CREATE_PREPARATION_DIRECTORY, 'fetch-overlap')
+      const finalPath = join(root, 'final-overlap')
+      await mkdir(join(root, WORKTREE_CREATE_PREPARATION_DIRECTORY), { recursive: true })
+      const original = git(repoPath, ['rev-parse', 'HEAD'])
+      await writeFile(join(repoPath, 'version.txt'), 'refreshed\n')
+      git(repoPath, ['commit', '-am', 'remote update'])
+      const refreshed = git(repoPath, ['rev-parse', 'HEAD'])
+      git(repoPath, ['update-ref', 'refs/remotes/origin/main', original])
+      const exec = gitRunner.gitExecFileAsync
+      let moved = false
+      const spy = vi
+        .spyOn(gitRunner, 'gitExecFileAsync')
+        .mockImplementation(async (args, options) => {
+          if (!moved && args.includes('reset') && when === 'before reset') {
+            git(repoPath, ['update-ref', 'refs/remotes/origin/main', refreshed])
+            moved = true
+          }
+          const result = await exec(args, options)
+          if (!moved && args.includes('reset') && when === 'after reset') {
+            git(repoPath, ['update-ref', 'refs/remotes/origin/main', refreshed])
+            moved = true
+          }
+          return result
+        })
+      try {
+        await prepareWorktreeCreateCheckout(
+          repoPath,
+          preparedPath,
+          'refs/remotes/origin/main',
+          createWorktreePreparationLockReason('fetch-overlap')
+        )
+        expect(moved).toBe(true)
+        await finalizePreparedWorktree(
+          repoPath,
+          preparedPath,
+          finalPath,
+          'feature/overlap',
+          'refs/remotes/origin/main'
+        )
+        expect(git(finalPath, ['rev-parse', 'HEAD'])).toBe(refreshed)
+        expect(await readFile(join(finalPath, 'version.txt'), 'utf8')).toBe('refreshed\n')
+        expect(git(finalPath, ['status', '--porcelain'])).toBe('')
+      } finally {
+        spy.mockRestore()
+      }
+    }
+  )
+
   it('hides the preparation, retargets an advanced base, and attaches the final branch', async () => {
     const { repoPath, root } = await createRepo()
     const preparationRoot = join(root, WORKTREE_CREATE_PREPARATION_DIRECTORY)
diff --git a/src/main/git/worktree-create-preparation-real-wsl.test.ts b/src/main/git/worktree-create-preparation-real-wsl.test.ts
new file mode 100644
index 00000000000..8ccaf3c23bf
--- /dev/null
+++ b/src/main/git/worktree-create-preparation-real-wsl.test.ts
@@ -0,0 +1,77 @@
+import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { join } from 'node:path'
+import { expect, it } from 'vitest'
+import { createWorktreePreparationLockReason } from '../../shared/worktree/create-preparation'
+import { gitExecFileAsync } from './runner'
+import {
+  discardPreparedWorktree,
+  finalizePreparedWorktree,
+  prepareWorktreeCreateCheckout
+} from './worktree-create-preparation'
+
+// Opt in on Windows with a running distro; all Git commands use the production WSL router.
+const wslDistro = process.env.ORCA_TEST_WSL_DISTRO
+
+it.skipIf(process.platform !== 'win32' || !wslDistro)(
+  'prepares, retargets, moves and cleans up a real WSL checkout from Windows',
+  async () => {
+    const fixtureParent = process.env.ORCA_TEST_WSL_ROOT ?? `\\\\wsl.localhost\\${wslDistro}\\tmp`
+    const root = await mkdtemp(join(fixtureParent, 'orca-create-route-'))
+    const repoPath = join(root, 'repo')
+    const preparedPath = join(root, 'prepared checkout')
+    const finalPath = join(root, 'final checkout')
+    const options = { wslDistro, timeout: 60_000 }
+    const git = async (cwd: string, args: string[]): Promise<string> =>
+      (await gitExecFileAsync(args, { cwd, ...options })).stdout.trim()
+
+    try {
+      await mkdir(repoPath)
+      await git(repoPath, ['init', '--quiet'])
+      expect(await git(repoPath, ['rev-parse', '--show-toplevel'])).toMatch(/^\/(?!\/)/)
+      await git(repoPath, ['symbolic-ref', 'HEAD', 'refs/heads/main'])
+      await git(repoPath, ['config', 'user.name', 'Test User'])
+      await git(repoPath, ['config', 'user.email', 'test@example.com'])
+      await writeFile(join(repoPath, 'version.txt'), 'one\n')
+      await git(repoPath, ['add', 'version.txt'])
+      await git(repoPath, ['commit', '--quiet', '-m', 'initial'])
+      await prepareWorktreeCreateCheckout(
+        repoPath,
+        preparedPath,
+        'main',
+        createWorktreePreparationLockReason('real-wsl-test'),
+        options
+      )
+      expect(await git(repoPath, ['worktree', 'list', '--porcelain'])).toContain(
+        'locked orca-create-preparation:v1:'
+      )
+
+      await writeFile(join(repoPath, 'version.txt'), 'two\n')
+      await git(repoPath, ['commit', '--quiet', '-am', 'advance base'])
+      const target = await git(repoPath, ['rev-parse', 'HEAD'])
+      await finalizePreparedWorktree(
+        repoPath,
+        preparedPath,
+        finalPath,
+        'feature/routed',
+        'main',
+        false,
+        options
+      )
+      expect(await git(finalPath, ['rev-parse', 'HEAD'])).toBe(target)
+      expect(await git(finalPath, ['symbolic-ref', '--short', 'HEAD'])).toBe('feature/routed')
+      expect(await git(finalPath, ['status', '--porcelain'])).toBe('')
+      expect(await readFile(join(finalPath, 'version.txt'), 'utf8')).toBe('two\n')
+      expect(await git(finalPath, ['config', '--get', 'branch.feature/routed.base'])).toBe(
+        'refs/heads/main'
+      )
+      expect(await git(repoPath, ['worktree', 'list', '--porcelain'])).not.toContain('locked ')
+      await discardPreparedWorktree(repoPath, finalPath, options)
+      expect(
+        (await git(repoPath, ['worktree', 'list', '--porcelain'])).match(/^worktree /gm)
+      ).toHaveLength(1)
+    } finally {
+      await rm(root, { recursive: true, force: true })
+    }
+  },
+  120_000
+)
diff --git a/src/main/git/worktree-create-preparation.ts b/src/main/git/worktree-create-preparation.ts
index b60dc01ec33..0f27f045287 100644
--- a/src/main/git/worktree-create-preparation.ts
+++ b/src/main/git/worktree-create-preparation.ts
@@ -45,16 +45,16 @@ async function performDiscardPreparedWorktree(
     timeout: options.timeout ?? WORKTREE_REMOVAL_REGISTRATION_TIMEOUT_MS
   }
   try {
+    // Preserve the ownership lock if removal cannot start; Git 2.25 supports locked removal.
     await gitExecFileAsync(
-      [...windowsLongPathGitArgs(repoPath), 'worktree', 'unlock', worktreePath],
-      cleanupGitOptions
-    )
-  } catch {
-    // It may be unlocked already or only partially registered.
-  }
-  try {
-    await gitExecFileAsync(
-      [...windowsLongPathGitArgs(repoPath), 'worktree', 'remove', '--force', worktreePath],
+      [
+        ...windowsLongPathGitArgs(repoPath),
+        'worktree',
+        'remove',
+        '--force',
+        '--force',
+        worktreePath
+      ],
       cleanupGitOptions
     )
   } finally {
@@ -195,25 +195,38 @@ export async function finalizePreparedWorktree(
   }
   try {
     return await runWithGitReadCacheInvalidation(async () => {
-      const baseContext = await resolveWorktreeAddBaseContext(
-        repoPath,
-        baseBranch,
-        refreshLocalBaseRef,
-        finalizeGitOptions
-      )
-      const [targetHeadResult, preparedHeadResult] = await Promise.all([
-        gitExecFileAsync(
-          ['rev-parse', '--verify', `${baseContext.effectiveBase}^{commit}`],
-          gitExecOptions(repoPath, finalizeGitOptions)
-        ),
+      const [targetResult, preparedResult] = await Promise.allSettled([
+        (async () => {
+          const baseContext = await resolveWorktreeAddBaseContext(
+            repoPath,
+            baseBranch,
+            refreshLocalBaseRef,
+            finalizeGitOptions
+          )
+          const targetHead =
+            baseContext.effectiveBaseOid ??
+            (
+              await gitExecFileAsync(
+                ['rev-parse', '--verify', `${baseContext.effectiveBase}^{commit}`],
+                gitExecOptions(repoPath, finalizeGitOptions)
+              )
+            ).stdout.trim()
+          return { baseContext, targetHead }
+        })(),
         gitExecFileAsync(
           ['rev-parse', '--verify', 'HEAD'],
           gitExecOptions(preparedPath, finalizeGitOptions)
         )
       ])
-      const { stdout: targetHeadOutput } = targetHeadResult
-      const targetHead = targetHeadOutput.trim()
-      const { stdout: preparedHeadOutput } = preparedHeadResult
+      // Settle both reads before failure cleanup can remove the prepared checkout.
+      if (targetResult.status === 'rejected') {
+        throw targetResult.reason
+      }
+      if (preparedResult.status === 'rejected') {
+        throw preparedResult.reason
+      }
+      const { baseContext, targetHead } = targetResult.value
+      const preparedHeadOutput = preparedResult.value.stdout
       if (preparedHeadOutput.trim() !== targetHead) {
         await gitExecFileAsync(
           [...windowsLongPathGitArgs(preparedPath), 'reset', '--hard', targetHead],
diff --git a/src/main/git/worktree-listing.ts b/src/main/git/worktree-listing.ts
index a60819181d4..f027bac4bc1 100644
--- a/src/main/git/worktree-listing.ts
+++ b/src/main/git/worktree-listing.ts
@@ -35,17 +35,7 @@ export async function listWorktreeGraph(
       ? worktrees
       : worktrees.filter((worktree) => !isWorktreeCreatePreparation(worktree))
   } catch (err) {
-    if (getErrorCode(err) === 'ENOENT') {
-      try {
-        await stat(repoPath)
-      } catch (statErr) {
-        if (getErrorCode(statErr) === 'ENOENT') {
-          console.warn(`[git/worktree] repo path missing; skipping worktree list: ${repoPath}`)
-          return []
-        }
-      }
-    }
-    if (isNotGitRepositoryError(err)) {
+    if (await isTrueEmptyWorktreeListing(repoPath, err)) {
       return []
     }
     console.warn(`[git/worktree] listWorktreeGraph failed for ${repoPath}:`, err)
@@ -64,17 +54,7 @@ export async function listWorktreesUnshared(
       : worktrees.filter((worktree) => !isWorktreeCreatePreparation(worktree))
     return annotateSparseCheckoutStatus(repoPath, visibleWorktrees, options)
   } catch (err) {
-    if (getErrorCode(err) === 'ENOENT') {
-      try {
-        await stat(repoPath)
-      } catch (statErr) {
-        if (getErrorCode(statErr) === 'ENOENT') {
-          console.warn(`[git/worktree] repo path missing; skipping worktree list: ${repoPath}`)
-          return []
-        }
-      }
-    }
-    if (isNotGitRepositoryError(err)) {
+    if (await isTrueEmptyWorktreeListing(repoPath, err)) {
       return []
     }
     // Why: don't swallow git-compat/repo-state failures — else they resurface as opaque "created but not found in listing" errors.
@@ -83,6 +63,24 @@ export async function listWorktreesUnshared(
   }
 }
 
+/**
+ * The two failures where an empty listing is the repo's true answer, not a broken scan: the repo
+ * path is gone, or it is not a Git repo. Every other failure means the scan could not read Git.
+ */
+async function isTrueEmptyWorktreeListing(repoPath: string, err: unknown): Promise<boolean> {
+  if (getErrorCode(err) === 'ENOENT') {
+    try {
+      await stat(repoPath)
+    } catch (statErr) {
+      if (getErrorCode(statErr) === 'ENOENT') {
+        console.warn(`[git/worktree] repo path missing; skipping worktree list: ${repoPath}`)
+        return true
+      }
+    }
+  }
+  return isNotGitRepositoryError(err)
+}
+
 export async function listWorktreesStrict(
   repoPath: string,
   options: GitWorktreeExecOptions = {}
@@ -97,6 +95,28 @@ export async function listWorktreesStrict(
   return annotateSparseCheckoutStatus(repoPath, visibleWorktrees, options)
 }
 
+/**
+ * Strict except for the two true empties above.
+ *
+ * Why: a Git or host failure (dead WSL distro, hung mount) softened to `[]` reaches the detected
+ * listing as an *authoritative* empty scan, which then permanently prunes the repo's worktrees and
+ * the agent tabs attached to them. Rejecting keeps that listing non-authoritative, while a deleted
+ * repo still reports empty so real removals prune.
+ */
+export async function listWorktreesStrictAllowingTrueEmpty(
+  repoPath: string,
+  options: GitWorktreeExecOptions = {}
+): Promise<GitWorktreeInfo[]> {
+  try {
+    return await listWorktreesStrict(repoPath, options)
+  } catch (err) {
+    if (await isTrueEmptyWorktreeListing(repoPath, err)) {
+      return []
+    }
+    throw err
+  }
+}
+
 export async function annotateSparseCheckoutStatus(
   repoPath: string,
   worktrees: GitWorktreeInfo[],
diff --git a/src/main/git/worktree-preparation-base-oid.test.ts b/src/main/git/worktree-preparation-base-oid.test.ts
new file mode 100644
index 00000000000..5864b9d305a
--- /dev/null
+++ b/src/main/git/worktree-preparation-base-oid.test.ts
@@ -0,0 +1,98 @@
+import { beforeEach, expect, it, vi } from 'vitest'
+
+const gitExec = vi.hoisted(() => vi.fn())
+vi.mock('./runner', () => ({ gitExecFileAsync: gitExec }))
+vi.mock('./worktree-base-refresh', () => ({
+  refreshLocalBaseRefForWorktreeCreate: vi.fn(),
+  getLocalBaseRefUpdateSuggestionForWorktreeCreate: vi.fn()
+}))
+vi.mock('./status', () => ({ runWithGitReadCacheInvalidation: (run: () => unknown) => run() }))
+vi.mock('./wsl-linked-worktree-git-routing', () => ({
+  invalidateWslLinkedWorktreeGitRouting: vi.fn()
+}))
+
+import { finalizePreparedWorktree } from './worktree-create-preparation'
+
+const originalOid = '1'.repeat(40)
+const refreshedOid = '2'.repeat(40)
+
+beforeEach(() => {
+  gitExec.mockReset().mockImplementation(async (args: string[]) => ({
+    stdout:
+      args[0] === 'rev-parse'
+        ? args.includes('--quiet') || args.at(-1) === 'HEAD'
+          ? originalOid
+          : refreshedOid
+        : ''
+  }))
+})
+
+it('reuses the current base-resolution oid and preserves WSL routing', async () => {
+  await finalizePreparedWorktree('/repo', '/prepared', '/final', 'feature', 'main', false, {
+    wslDistro: 'Ubuntu',
+    timeout: 8000
+  })
+  const revisions = gitExec.mock.calls.filter(([args]) => args[0] === 'rev-parse')
+  expect(revisions.map(([args]) => args)).toEqual([
+    ['rev-parse', '--verify', '--quiet', 'refs/heads/main^{commit}'],
+    ['rev-parse', '--verify', 'HEAD']
+  ])
+  expect(gitExec.mock.calls.find(([args]) => args.includes('checkout'))?.[0]).toContain(originalOid)
+  expect(gitExec.mock.calls.some(([args]) => args.includes('reset'))).toBe(false)
+  for (const [, options] of gitExec.mock.calls) {
+    expect(options).toMatchObject({ wslDistro: 'Ubuntu', timeout: 8000 })
+  }
+})
+
+it.each([
+  { base: 'refs/heads/main', refresh: false, options: {} },
+  { base: 'main', refresh: true, options: {} },
+  { base: 'main', refresh: false, options: { suggestLocalBaseRefUpdate: true } }
+])('re-reads the target for $base, refresh=$refresh, options=$options', async (test) => {
+  await finalizePreparedWorktree(
+    '/repo',
+    '/prepared',
+    '/final',
+    'feature',
+    test.base,
+    test.refresh,
+    test.options
+  )
+  expect(gitExec).toHaveBeenCalledWith(
+    ['rev-parse', '--verify', 'refs/heads/main^{commit}'],
+    expect.objectContaining({ cwd: '/repo' })
+  )
+  expect(gitExec.mock.calls.find(([args]) => args.includes('reset'))?.[0]).toContain(refreshedOid)
+  expect(gitExec.mock.calls.find(([args]) => args.includes('checkout'))?.[0]).toContain(
+    refreshedOid
+  )
+})
+
+it('starts both independent probes before either resolves and settles them before failure', async () => {
+  let resolveBase!: (value: { stdout: string }) => void
+  let rejectPrepared!: (reason: Error) => void
+  gitExec.mockImplementation((args: string[]) => {
+    if (args.includes('--quiet')) {
+      return new Promise((resolve) => (resolveBase = resolve))
+    }
+    if (args.at(-1) === 'HEAD') {
+      return new Promise((_, reject) => (rejectPrepared = reject))
+    }
+    return Promise.resolve({ stdout: '' })
+  })
+  let settled = false
+  const error = new Error('prepared HEAD unreadable')
+  const result = finalizePreparedWorktree('/repo', '/prepared', '/final', 'feature', 'main')
+  const checked = expect(result).rejects.toBe(error)
+  void result.then(
+    () => (settled = true),
+    () => (settled = true)
+  )
+  await vi.waitFor(() => expect(gitExec).toHaveBeenCalledTimes(2))
+  rejectPrepared(error)
+  await Promise.resolve()
+  expect(settled).toBe(false)
+  resolveBase({ stdout: originalOid })
+  await checked
+  expect(gitExec.mock.calls.some(([args]) => args.includes('move'))).toBe(false)
+})
diff --git a/src/main/git/worktree-preparation-cancel-latency.bench.test.ts b/src/main/git/worktree-preparation-cancel-latency.bench.test.ts
new file mode 100644
index 00000000000..e2750df839d
--- /dev/null
+++ b/src/main/git/worktree-preparation-cancel-latency.bench.test.ts
@@ -0,0 +1,158 @@
+// Opt in: ORCA_WORKTREE_PREPARATION_CANCEL_BENCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/git/worktree-preparation-cancel-latency.bench.test.ts
+//
+// Measures the create-side cost of an obsolete preparation: the wall time of a fresh checkout
+// (the next Create's critical path) while an evicted preparation's checkout is either left running
+// (main before #18951) or aborted (after). Same code, same fixture; only the abort differs.
+import { execFileSync } from 'node:child_process'
+import { existsSync } from 'node:fs'
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { performance } from 'node:perf_hooks'
+import { afterAll, beforeAll, describe, expect, it } from 'vitest'
+import {
+  createWorktreePreparationLockReason,
+  WORKTREE_CREATE_PREPARATION_DIRECTORY
+} from '../../shared/worktree/create-preparation'
+import {
+  discardPreparedWorktree,
+  prepareWorktreeCreateCheckout
+} from './worktree-create-preparation'
+
+const describeBench = process.env.ORCA_WORKTREE_PREPARATION_CANCEL_BENCH ? describe : describe.skip
+const FILE_COUNT = Number(process.env.ORCA_WORKTREE_PREPARATION_CANCEL_BENCH_FILES ?? 6000)
+const FILE_BYTES = 48 * 1024
+const TRIALS = Number(process.env.ORCA_WORKTREE_PREPARATION_CANCEL_BENCH_TRIALS ?? 5)
+const OBSOLETE_COUNTS = [1, 3]
+const RESULT_PATH = process.env.ORCA_WORKTREE_PREPARATION_CANCEL_BENCH_RESULT
+
+type Variant = 'running' | 'aborted'
+type Sample = { variant: Variant; obsolete: number; freshCheckoutMs: number }
+
+let root = ''
+let repoPath = ''
+let preparationRoot = ''
+let sequence = 0
+
+function git(cwd: string, args: string[]): void {
+  execFileSync('git', args, { cwd, stdio: ['ignore', 'ignore', 'pipe'] })
+}
+
+function nextPreparedPath(label: string): string {
+  sequence += 1
+  return join(preparationRoot, `${process.pid}-${label}-${sequence}`)
+}
+
+function checkout(preparedPath: string, signal?: AbortSignal): Promise<void> {
+  return prepareWorktreeCreateCheckout(
+    repoPath,
+    preparedPath,
+    'main',
+    createWorktreePreparationLockReason(`bench-${sequence}`),
+    signal ? { signal } : {}
+  )
+}
+
+async function runTrial(variant: Variant, obsolete: number): Promise<Sample> {
+  const controllers = Array.from({ length: obsolete }, () => new AbortController())
+  const obsoletePaths = controllers.map(() => nextPreparedPath('obsolete'))
+  const obsoleteWork = obsoletePaths.map((path, index) =>
+    checkout(path, controllers[index].signal).catch(() => {})
+  )
+  if (variant === 'aborted') {
+    // Eviction aborts in the same turn the incoming preparation is armed, so abort before the
+    // fresh checkout starts.
+    controllers.forEach((controller) => controller.abort())
+  }
+  const freshPath = nextPreparedPath('fresh')
+  const started = performance.now()
+  await checkout(freshPath)
+  const freshCheckoutMs = performance.now() - started
+  await Promise.all(obsoleteWork)
+  await Promise.all(
+    [...obsoletePaths, freshPath].map((path) =>
+      discardPreparedWorktree(repoPath, path).catch(() => {})
+    )
+  )
+  return { variant, obsolete, freshCheckoutMs }
+}
+
+function median(values: number[]): number {
+  const sorted = [...values].sort((left, right) => left - right)
+  const middle = Math.floor(sorted.length / 2)
+  return sorted.length % 2 ? sorted[middle] : (sorted[middle - 1] + sorted[middle]) / 2
+}
+
+describeBench('obsolete preparation cancellation latency', () => {
+  beforeAll(async () => {
+    root = await mkdtemp(join(tmpdir(), 'orca-preparation-cancel-bench-'))
+    repoPath = join(root, 'repo')
+    preparationRoot = join(root, WORKTREE_CREATE_PREPARATION_DIRECTORY)
+    await mkdir(preparationRoot, { recursive: true })
+    execFileSync('git', ['init', '--quiet', repoPath])
+    git(repoPath, ['symbolic-ref', 'HEAD', 'refs/heads/main'])
+    git(repoPath, ['config', 'user.email', 'bench@example.com'])
+    git(repoPath, ['config', 'user.name', 'Bench'])
+    git(repoPath, ['config', 'core.autocrlf', 'false'])
+    // Unique content per file so the object store cannot dedupe the materialization work.
+    for (let batch = 0; batch < FILE_COUNT; batch += 500) {
+      await Promise.all(
+        Array.from({ length: Math.min(500, FILE_COUNT - batch) }, (_, offset) => {
+          const index = batch + offset
+          return writeFile(
+            join(repoPath, `payload-${index.toString().padStart(5, '0')}.txt`),
+            `${index}\n`.repeat(Math.ceil(FILE_BYTES / `${index}\n`.length))
+          )
+        })
+      )
+    }
+    git(repoPath, ['add', '.'])
+    git(repoPath, ['commit', '--quiet', '-m', 'bench fixture'])
+  }, 600_000)
+
+  afterAll(async () => {
+    await rm(root, { recursive: true, force: true })
+  })
+
+  it('reports fresh checkout wall time with obsolete checkouts running vs aborted', async () => {
+    // Warm the object store and page cache once so the first variant is not penalised.
+    const warm = nextPreparedPath('warm')
+    await checkout(warm)
+    await discardPreparedWorktree(repoPath, warm)
+
+    const samples: Sample[] = []
+    for (const obsolete of OBSOLETE_COUNTS) {
+      for (let trial = 0; trial < TRIALS; trial += 1) {
+        // Alternate order so drift in cache or thermal state does not favour one variant.
+        const order: Variant[] = trial % 2 ? ['aborted', 'running'] : ['running', 'aborted']
+        for (const variant of order) {
+          samples.push(await runTrial(variant, obsolete))
+        }
+      }
+    }
+    const summary = OBSOLETE_COUNTS.map((obsolete) => {
+      const pick = (variant: Variant): number[] =>
+        samples
+          .filter((sample) => sample.variant === variant && sample.obsolete === obsolete)
+          .map((sample) => sample.freshCheckoutMs)
+      const running = median(pick('running'))
+      const aborted = median(pick('aborted'))
+      return {
+        obsolete,
+        trials: TRIALS,
+        freshCheckoutMedianMs: { obsoleteRunning: running, obsoleteAborted: aborted },
+        speedup: running / aborted
+      }
+    })
+    const report = JSON.stringify(
+      { fixture: { files: FILE_COUNT, bytesPerFile: FILE_BYTES }, samples, summary },
+      null,
+      2
+    )
+    console.log(report)
+    if (RESULT_PATH) {
+      await writeFile(RESULT_PATH, `${report}\n`)
+    }
+    expect(existsSync(preparationRoot)).toBe(true)
+  }, 900_000)
+})
diff --git a/src/main/git/worktree-scan-cache.ts b/src/main/git/worktree-scan-cache.ts
index 59a7691fe7f..a35f0a4f275 100644
--- a/src/main/git/worktree-scan-cache.ts
+++ b/src/main/git/worktree-scan-cache.ts
@@ -2,7 +2,8 @@ import type { GitWorktreeInfo } from '../../shared/worktree/types'
 import {
   annotateSparseCheckoutStatus,
   listWorktreeGraph as listWorktreeGraphUnshared,
-  listWorktreesStrict as listWorktreesStrictUnshared
+  listWorktreesStrict as listWorktreesStrictUnshared,
+  listWorktreesStrictAllowingTrueEmpty as listWorktreesStrictAllowingTrueEmptyUnshared
 } from './worktree-listing'
 import type { GitWorktreeExecOptions } from './worktree-operation-options'
 import { WORKTREE_LIST_TIMEOUT_MS } from './worktree-operation-options'
@@ -10,7 +11,7 @@ import { WORKTREE_LIST_TIMEOUT_MS } from './worktree-operation-options'
 // Why: share concurrent `git worktree list` scans, which are expensive on Windows.
 const inFlightWorktreeScans = new Map<string, Promise<GitWorktreeInfo[]>>()
 
-type WorktreeScanKind = 'graph' | 'lenient' | 'strict'
+type WorktreeScanKind = 'graph' | 'lenient' | 'strict' | 'strict-true-empty'
 
 // Why: mutation generations prevent listings from joining stale scans.
 const worktreeScanGenerations = new Map<string, number>()
@@ -139,3 +140,20 @@ export function listWorktreesSharedStrict(
 ): Promise<GitWorktreeInfo[]> {
   return shareWorktreeScan(repoPath, options, 'strict', listWorktreesStrictUnshared)
 }
+
+/**
+ * The detected scan's discipline: reject a Git/host failure so it cannot publish as an
+ * authoritative empty listing, but still answer `[]` for a repo that is gone or not a repo.
+ * Its own kind because neither a strict nor a lenient joiner may inherit that middle contract.
+ */
+export function listWorktreesSharedStrictAllowingTrueEmpty(
+  repoPath: string,
+  options: GitWorktreeExecOptions = {}
+): Promise<GitWorktreeInfo[]> {
+  return shareWorktreeScan(
+    repoPath,
+    options,
+    'strict-true-empty',
+    listWorktreesStrictAllowingTrueEmptyUnshared
+  )
+}
diff --git a/src/main/git/worktree.ts b/src/main/git/worktree.ts
index 18e92e2873a..024485b6981 100644
--- a/src/main/git/worktree.ts
+++ b/src/main/git/worktree.ts
@@ -32,7 +32,8 @@ export {
   _resetWorktreeScanCacheForTests,
   listWorktreeGraph,
   listWorktrees,
-  listWorktreesSharedStrict
+  listWorktreesSharedStrict,
+  listWorktreesSharedStrictAllowingTrueEmpty
 } from './worktree-scan-cache'
 export { bumpWorktreeScanGeneration as notifyPreparedWorktreeMutation } from './worktree-scan-cache'
 export { addSparseWorktree } from './worktree-sparse-add'
diff --git a/src/main/github/project-view/project-view-field-normalization.ts b/src/main/github/project-view/project-view-field-normalization.ts
index 1441a999809..ab41b812e08 100644
--- a/src/main/github/project-view/project-view-field-normalization.ts
+++ b/src/main/github/project-view/project-view-field-normalization.ts
@@ -145,7 +145,8 @@ export function normalizeFieldValue(
         iterationId: raw.iterationId,
         title: raw.title ?? '',
         startDate: raw.startDate ?? '',
-        duration: typeof raw.duration === 'number' ? raw.duration : 0
+        duration: typeof raw.duration === 'number' ? raw.duration : 0,
+        ...(typeof raw.field.name === 'string' ? { fieldName: raw.field.name } : {})
       }
     case 'ProjectV2ItemFieldTextValue':
       return { kind: 'text', fieldId, text: raw.text ?? '' }
@@ -155,7 +156,12 @@ export function normalizeFieldValue(
       }
       return { kind: 'number', fieldId, number: raw.number }
     case 'ProjectV2ItemFieldDateValue':
-      return { kind: 'date', fieldId, date: raw.date ?? '' }
+      return {
+        kind: 'date',
+        fieldId,
+        date: raw.date ?? '',
+        ...(typeof raw.field.name === 'string' ? { fieldName: raw.field.name } : {})
+      }
     case 'ProjectV2ItemFieldLabelValue': {
       const labels = (raw.labels?.nodes ?? [])
         .map(normalizeLabel)
diff --git a/src/main/github/project-view/project-view-table.test.ts b/src/main/github/project-view/project-view-table.test.ts
new file mode 100644
index 00000000000..b51a08d4bf0
--- /dev/null
+++ b/src/main/github/project-view/project-view-table.test.ts
@@ -0,0 +1,107 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fetchProjectViewsPage, type RawProjectView } from './project-view-config'
+import type * as ProjectViewConfig from './project-view-config'
+import { fetchAllItems, fetchItemsCountOnly } from './project-view-items'
+import { getProjectViewTable } from './project-view-table'
+
+vi.mock('./project-view-config', async (importOriginal) => ({
+  ...(await importOriginal<typeof ProjectViewConfig>()),
+  fetchProjectViewsPage: vi.fn()
+}))
+vi.mock('./project-view-items', () => ({
+  fetchAllItems: vi.fn(),
+  fetchItemsCountOnly: vi.fn()
+}))
+
+const args = {
+  owner: 'acme',
+  ownerType: 'organization',
+  projectNumber: 1,
+  host: 'github.acme.test'
+} as const
+const view = (id: string, layout: string): RawProjectView => ({
+  id,
+  number: 1,
+  name: id,
+  layout,
+  filter: 'status:open',
+  fields: { nodes: [] },
+  groupByFields: { nodes: [] },
+  sortByFields: { nodes: [] }
+})
+function page(views: RawProjectView[], hasNextPage = false) {
+  return {
+    ok: true as const,
+    project: { id: 'project', title: 'Plan', url: 'https://github.acme.test/orgs/acme/projects/1' },
+    views,
+    hasNextPage,
+    endCursor: hasNextPage ? 'next' : null
+  }
+}
+
+beforeEach(() => {
+  vi.resetAllMocks()
+  vi.mocked(fetchAllItems).mockResolvedValue({
+    ok: true,
+    rows: [],
+    totalCount: 0,
+    parentFieldDropped: false
+  })
+  vi.mocked(fetchItemsCountOnly).mockResolvedValue(12)
+})
+
+describe('project view layout selection', () => {
+  it('fetches roadmap items with the selected host and filter', async () => {
+    vi.mocked(fetchProjectViewsPage).mockResolvedValue(page([view('roadmap', 'ROADMAP_LAYOUT')]))
+    const result = await getProjectViewTable({ ...args, viewId: 'roadmap' })
+    expect(result).toMatchObject({ ok: true, data: { selectedView: { layout: 'ROADMAP_LAYOUT' } } })
+    expect(fetchAllItems).toHaveBeenCalledWith({ ...args, query: 'status:open' })
+    expect(fetchItemsCountOnly).not.toHaveBeenCalled()
+  })
+
+  it('defaults to a roadmap when no table exists across all view pages', async () => {
+    vi.mocked(fetchProjectViewsPage)
+      .mockResolvedValueOnce(page([view('roadmap', 'ROADMAP_LAYOUT')], true))
+      .mockResolvedValueOnce(page([view('board', 'BOARD_LAYOUT')]))
+    expect(await getProjectViewTable(args)).toMatchObject({
+      ok: true,
+      data: { selectedView: { id: 'roadmap' } }
+    })
+    expect(fetchProjectViewsPage).toHaveBeenLastCalledWith({ ...args, after: 'next' })
+  })
+
+  it('prefers a table on a later page over an earlier roadmap', async () => {
+    vi.mocked(fetchProjectViewsPage)
+      .mockResolvedValueOnce(page([view('roadmap', 'ROADMAP_LAYOUT')], true))
+      .mockResolvedValueOnce(page([view('table', 'TABLE_LAYOUT')]))
+    expect(await getProjectViewTable(args)).toMatchObject({
+      ok: true,
+      data: { selectedView: { id: 'table' } }
+    })
+  })
+
+  it('does not substitute a roadmap for a missing explicit selection', async () => {
+    vi.mocked(fetchProjectViewsPage).mockResolvedValue(page([view('roadmap', 'ROADMAP_LAYOUT')]))
+    expect(await getProjectViewTable({ ...args, viewId: 'missing' })).toMatchObject({
+      ok: false,
+      error: { type: 'not_found' }
+    })
+    expect(fetchAllItems).not.toHaveBeenCalled()
+  })
+
+  it.each(['BOARD_LAYOUT', 'FUTURE_LAYOUT'])(
+    'rejects %s without fetching items',
+    async (layout) => {
+      vi.mocked(fetchProjectViewsPage).mockResolvedValue(page([view('unsupported', layout)]))
+      expect(
+        await getProjectViewTable({ ...args, viewId: 'unsupported', queryOverride: '' })
+      ).toMatchObject({
+        ok: false,
+        error: { type: 'unsupported_layout' },
+        totalCount: 12
+      })
+      expect(fetchAllItems).not.toHaveBeenCalled()
+      expect(fetchItemsCountOnly).toHaveBeenCalledWith({ ...args, query: '' })
+    }
+  )
+})
diff --git a/src/main/github/project-view/project-view-table.ts b/src/main/github/project-view/project-view-table.ts
index 042aeb333cf..bb580cb78e0 100644
--- a/src/main/github/project-view/project-view-table.ts
+++ b/src/main/github/project-view/project-view-table.ts
@@ -84,6 +84,14 @@ export async function getProjectViewTable(
   if (!project) {
     return { ok: false, error: { type: 'not_found', message: 'Project not found.' } }
   }
+  const noSelector =
+    args.viewId === undefined && args.viewNumber === undefined && args.viewName === undefined
+  if (!selectedRaw && noSelector) {
+    // Why: `matchesSelector` only defaults to a table view, so a project whose
+    // views are all roadmaps resolved to nothing even though we can now render
+    // one. Table stays the preferred default; this is the empty-handed case.
+    selectedRaw = viewsSeen.find((v) => v.layout === 'ROADMAP_LAYOUT') ?? null
+  }
   if (!selectedRaw) {
     return { ok: false, error: { type: 'not_found', message: 'Could not find the selected view.' } }
   }
@@ -109,8 +117,10 @@ export async function getProjectViewTable(
   const effectiveQuery =
     typeof args.queryOverride === 'string' ? args.queryOverride : selectedView.filter
 
-  // Unsupported layout: skip item pagination; best-effort count-only query.
-  if (selectedView.layout !== 'TABLE_LAYOUT') {
+  // Why: roadmaps read the same item stream as a table — only the renderer
+  // differs. Allowlist, not `=== 'BOARD_LAYOUT'`: raw.layout is cast unchecked,
+  // so a future GitHub layout must reject cleanly, not render as a table.
+  if (selectedView.layout !== 'TABLE_LAYOUT' && selectedView.layout !== 'ROADMAP_LAYOUT') {
     const count = await fetchItemsCountOnly({
       owner: args.owner,
       ownerType: args.ownerType,
@@ -122,7 +132,7 @@ export async function getProjectViewTable(
       ok: false,
       error: {
         type: 'unsupported_layout',
-        message: `Orca only renders table views. This is a ${selectedView.layout.replace('_LAYOUT', '').toLowerCase()} view.`
+        message: `Orca renders table and roadmap views. This is a ${selectedView.layout.replace('_LAYOUT', '').toLowerCase()} view.`
       },
       ...(typeof count === 'number' ? { totalCount: count } : {})
     }
diff --git a/src/main/ipc/crash-reporting-renderer-breadcrumbs.ts b/src/main/ipc/crash-reporting-renderer-breadcrumbs.ts
index 97e0a8f9d65..8d126f557b5 100644
--- a/src/main/ipc/crash-reporting-renderer-breadcrumbs.ts
+++ b/src/main/ipc/crash-reporting-renderer-breadcrumbs.ts
@@ -49,6 +49,7 @@ function recordRendererBreadcrumbTrace(
 const DUPLICATE_TAB_OWNER_BREADCRUMB = 'terminal_tab_id_owned_by_multiple_worktrees'
 const PARK_VERDICT_CHURN_BREADCRUMB = 'terminal_park_verdict_churn'
 const REACT_COMMIT_CASCADE_BREADCRUMB = 'react_commit_cascade'
+const REPLAY_GUARD_WEDGED_BREADCRUMB = 'terminal_replay_guard_wedged_release'
 const COALESCED_RENDERER_BREADCRUMB_NAMES = new Set([
   'renderer_error',
   'renderer_unhandled_rejection',
@@ -56,6 +57,7 @@ const COALESCED_RENDERER_BREADCRUMB_NAMES = new Set([
   DUPLICATE_TAB_OWNER_BREADCRUMB,
   PARK_VERDICT_CHURN_BREADCRUMB,
   REACT_COMMIT_CASCADE_BREADCRUMB,
+  REPLAY_GUARD_WEDGED_BREADCRUMB,
   TERMINAL_WEBGL_DIAGNOSTIC_BREADCRUMB
 ])
 const RENDERER_BREADCRUMB_COALESCE_MS = 30_000
@@ -69,6 +71,11 @@ const RENDERER_BREADCRUMB_COALESCE_MS = 30_000
 // 30-entry ring to two such bursts. `suppressedSinceLast` keeps the pane count
 // — the only signal these carry — in one slot.
 const NAME_ONLY_COALESCED_BREADCRUMB_NAMES = new Set(['terminal_safe_fit_retry_exhausted'])
+// Why: the 30-slot ring is the scarce sink; the durable span stream is not. For
+// bounded-rate pane telemetry whose multiplicity is the whole signal, spans are the
+// only place a burst survives the restart that clears the ring, so coalesce the ring
+// but keep every event's span.
+const PER_EVENT_TRACED_COALESCED_BREADCRUMB_NAMES = new Set([REPLAY_GUARD_WEDGED_BREADCRUMB])
 
 function rendererBreadcrumbCoalesceKey(
   name: string,
@@ -77,6 +84,13 @@ function rendererBreadcrumbCoalesceKey(
   if (NAME_ONLY_COALESCED_BREADCRUMB_NAMES.has(name)) {
     return name
   }
+  // Why presence and not value: `ptyId`/`tabIdHash` are absent on the restore call
+  // site (layout-serialization restoreScrollbackBuffers) and present on reattach, so
+  // their presence is the call-site identity a mixed burst would otherwise lose. Four
+  // slots per storm at most, regardless of pane count.
+  if (name === REPLAY_GUARD_WEDGED_BREADCRUMB) {
+    return `${name}:${data?.ptyId ? 'pty' : ''}:${data?.tabIdHash ? 'tab' : ''}`
+  }
   // Why trigger and not name alone: `burst` means damping engaged a commit
   // short of React #185, `window` means slow benign churn. Collapsing them
   // would drop the near-crash signal into a slow-churn slot. Still bounded —
@@ -191,9 +205,13 @@ export function recordRendererBreadcrumbFromRenderer(
       minIntervalMs: RENDERER_BREADCRUMB_COALESCE_MS,
       ...(origin ? { origin } : {})
     })
-    // Why: tracing every suppressed duplicate would preserve the same
-    // serialization and disk churn that breadcrumb coalescing removes.
-    if (coalesceResult) {
+    if (PER_EVENT_TRACED_COALESCED_BREADCRUMB_NAMES.has(args.name)) {
+      // Why the raw data: every event already gets its own span, so folding the ring's
+      // running count in here would double-count in any span-stream total.
+      recordRendererBreadcrumbTrace(args.name, data)
+    } else if (coalesceResult) {
+      // Why gated: tracing every suppressed duplicate would preserve the same
+      // serialization and disk churn that breadcrumb coalescing removes.
       recordRendererBreadcrumbTrace(
         args.name,
         coalesceResult.suppressedSinceLast > 0
diff --git a/src/main/ipc/crash-reporting-replay-guard-wedge-burst.test.ts b/src/main/ipc/crash-reporting-replay-guard-wedge-burst.test.ts
new file mode 100644
index 00000000000..e3823f0b313
--- /dev/null
+++ b/src/main/ipc/crash-reporting-replay-guard-wedge-burst.test.ts
@@ -0,0 +1,128 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+import {
+  clearCrashBreadcrumbsForTest,
+  getCrashBreadcrumbSnapshot,
+  recordCrashBreadcrumb
+} from '../crash-reporting/crash-breadcrumb-store'
+import { recordRendererBreadcrumbFromRenderer } from './crash-reporting-renderer-breadcrumbs'
+
+type SpanOptions = { attributes: Record<string, unknown> }
+const startSpanMock = vi.fn((_name: string, _options: SpanOptions) => ({ end: () => {} }))
+vi.mock('../observability/tracer', () => ({
+  startSpan: (name: string, options: SpanOptions) => startSpanMock(name, options)
+}))
+
+const WEDGE_BREADCRUMB = 'terminal_replay_guard_wedged_release'
+
+/** Reattach-path shape: identity-bearing (`tabIdHash`, optionally `ptyId`). */
+function emitReattachWedge(pane: number, withPtyId = false): void {
+  recordRendererBreadcrumbFromRenderer({
+    name: WEDGE_BREADCRUMB,
+    data: {
+      paneId: pane,
+      leafIdHash: `leaf${String(pane).padStart(5, '0')}`,
+      tabIdHash: `tab${String(pane).padStart(6, '0')}`,
+      worktreeIdHash: 'caa15fa9',
+      ...(withPtyId ? { ptyId: `…@@pty-${pane}` } : {})
+    }
+  })
+}
+
+/** Restore-path shape (restoreScrollbackBuffers): no tabIdHash, no ptyId. */
+function emitRestoreWedge(pane: number): void {
+  recordRendererBreadcrumbFromRenderer({
+    name: WEDGE_BREADCRUMB,
+    data: { paneId: pane, leafIdHash: `leaf${String(pane).padStart(5, '0')}` }
+  })
+}
+
+function wedgeCrumbs(): ReturnType<typeof getCrashBreadcrumbSnapshot> {
+  return getCrashBreadcrumbSnapshot().filter((entry) => entry.name === WEDGE_BREADCRUMB)
+}
+
+function wedgeSpanCount(): number {
+  return startSpanMock.mock.calls.filter(
+    (call) => call[1].attributes['breadcrumb.name'] === WEDGE_BREADCRUMB
+  ).length
+}
+
+beforeEach(() => {
+  startSpanMock.mockClear()
+})
+
+afterEach(() => {
+  clearCrashBreadcrumbsForTest()
+})
+
+// One mount/reveal/wake transition expires every in-flight replay write at once, so
+// the burst reaches the 30-slot ring as N distinct entries. Field span streams measure
+// bursts of 26 in 0.96s and 62 over 85s. No captured report in the 09-02 corpus shows
+// a ring that actually drained — all nine bursts predate their report's ring window —
+// so this bounds a demonstrated hazard, not an observed loss, and must not cost the
+// durable span evidence that did carry those bursts.
+describe('replay-guard wedge burst against the fixed-size breadcrumb ring', () => {
+  it('costs one ring slot per call site and preserves the pre-crash trail', () => {
+    for (let index = 0; index < 10; index += 1) {
+      recordCrashBreadcrumb(`pre_crash_evidence_${index}`, { index })
+    }
+
+    for (let pane = 0; pane < 26; pane += 1) {
+      emitReattachWedge(pane)
+    }
+
+    const snapshot = getCrashBreadcrumbSnapshot()
+    expect(snapshot.filter((entry) => entry.name.startsWith('pre_crash_evidence_'))).toHaveLength(
+      10
+    )
+    expect(wedgeCrumbs()).toHaveLength(1)
+  })
+
+  it('carries the burst multiplicity into the ring as suppressedSinceLast', () => {
+    for (let pane = 0; pane < 26; pane += 1) {
+      emitReattachWedge(pane)
+    }
+
+    // 26 emissions: one owns the slot, 25 fold into it.
+    expect(wedgeCrumbs()[0]?.data?.suppressedSinceLast).toBe(25)
+  })
+
+  // The 121-event field corpus lives entirely in the renderer.breadcrumb span stream,
+  // and the ring is cleared by the restart that usually precedes the crash report, so
+  // ring coalescing must not suppress the per-event spans.
+  it('still emits one durable span per wedge event', () => {
+    for (let pane = 0; pane < 26; pane += 1) {
+      emitReattachWedge(pane)
+    }
+
+    expect(wedgeSpanCount()).toBe(26)
+    // Why no count on the span: one span per event already carries the multiplicity.
+    expect(
+      startSpanMock.mock.calls.some((call) =>
+        JSON.stringify(call[1]).includes('suppressedSinceLast')
+      )
+    ).toBe(false)
+  })
+
+  // Bundle 8907a508 mixes restore-path (identity-less) and reattach-path crumbs in one
+  // window; name-only keying would report only the last one's shape.
+  it('keeps restore-path and reattach-path call sites in separate slots', () => {
+    emitRestoreWedge(1)
+    emitRestoreWedge(2)
+    emitReattachWedge(3)
+    emitReattachWedge(4, true)
+
+    const crumbs = wedgeCrumbs()
+    expect(crumbs).toHaveLength(3)
+    expect(crumbs.map((crumb) => Boolean(crumb.data?.tabIdHash))).toEqual([false, true, true])
+    expect(crumbs.map((crumb) => Boolean(crumb.data?.ptyId))).toEqual([false, false, true])
+  })
+
+  it('bounds a many-pane burst to one slot within a call site', () => {
+    for (let pane = 0; pane < 40; pane += 1) {
+      emitReattachWedge(pane, pane % 2 === 0)
+    }
+
+    expect(wedgeCrumbs()).toHaveLength(2)
+  })
+})
diff --git a/src/main/ipc/dashboard-popout.test.ts b/src/main/ipc/dashboard-popout.test.ts
index ce10b3556fc..9bead362816 100644
--- a/src/main/ipc/dashboard-popout.test.ts
+++ b/src/main/ipc/dashboard-popout.test.ts
@@ -97,6 +97,14 @@ function makeStore(enabled = true) {
   }
 }
 
+// These cases exercise foreground behavior against Electron mocks.
+beforeEach(() => {
+  vi.stubEnv('ORCA_BACKGROUND_LAUNCH', undefined)
+  vi.stubEnv('ORCA_E2E_HEADLESS', undefined)
+  vi.stubEnv('ORCA_E2E_HEADFUL', undefined)
+})
+afterEach(() => vi.unstubAllEnvs())
+
 describe('registerDashboardPopoutHandlers', () => {
   let store: ReturnType<typeof makeStore>
 
diff --git a/src/main/ipc/filesystem-search-git.ts b/src/main/ipc/filesystem-search-git.ts
index da54799cad1..8e930dbf8b1 100644
--- a/src/main/ipc/filesystem-search-git.ts
+++ b/src/main/ipc/filesystem-search-git.ts
@@ -1,3 +1,4 @@
+import { SearchSubprocessLineAccumulator } from '../../shared/search-subprocess-lines'
 import type { SearchOptions, SearchResult } from '../../shared/code-search-types'
 import {
   buildGitGrepArgs,
@@ -39,7 +40,7 @@ export async function searchWithGitGrep(
   return new Promise((resolve) => {
     const matchRegex = buildSubmatchRegex(args.query, args)
     const acc = createAccumulator()
-    let stdoutBuffer = ''
+    const lines = new SearchSubprocessLineAccumulator(Number.MAX_SAFE_INTEGER)
     let done = false
 
     let killTimeout: ReturnType<typeof setTimeout>
@@ -49,6 +50,7 @@ export async function searchWithGitGrep(
         return
       }
       done = true
+      lines.clear()
       clearTimeout(killTimeout)
       // Why: child.kill() is advisory. If git ignores it, detach our
       // closures so repeated fallback searches do not retain old scans.
@@ -67,12 +69,7 @@ export async function searchWithGitGrep(
     }
 
     function handleStdoutData(chunk: string): void {
-      stdoutBuffer += chunk
-      const lines = stdoutBuffer.split('\n')
-      stdoutBuffer = lines.pop() ?? ''
-      for (const l of lines) {
-        processLine(l)
-      }
+      lines.push(chunk, processLine)
     }
 
     function handleStderrData(): void {
@@ -84,8 +81,9 @@ export async function searchWithGitGrep(
     }
 
     function handleClose(): void {
-      if (stdoutBuffer) {
-        processLine(stdoutBuffer)
+      const tail = lines.finish()
+      if (tail !== null) {
+        processLine(tail)
       }
       resolveOnce()
     }
diff --git a/src/main/ipc/filesystem-watcher-local-events.test.ts b/src/main/ipc/filesystem-watcher-local-events.test.ts
index e08145e7ad2..1907383bd6b 100644
--- a/src/main/ipc/filesystem-watcher-local-events.test.ts
+++ b/src/main/ipc/filesystem-watcher-local-events.test.ts
@@ -12,6 +12,7 @@ vi.mock('fs/promises', () => ({ stat: statMock }))
 vi.mock('./parcel-watcher-process', () => ({ subscribeViaWatcherProcess: subscribeMock }))
 
 import { createLocalWatcher } from './filesystem-watcher-local-events'
+import { cancelLocalBatchFlush } from './filesystem-watcher-batch-control'
 
 function deferred<T>(): { promise: Promise<T>; resolve: (value: T) => void } {
   let resolve!: (value: T) => void
@@ -170,6 +171,35 @@ describe('local filesystem watcher flush serialization', () => {
     )
   })
 
+  it('starts no further stats when a full inflight batch is cancelled', async () => {
+    const eventCount = 5_000
+    const pendingStats = deferred<{ isDirectory: () => boolean }>()
+    statMock.mockReturnValue(pendingStats.promise)
+    const root = await createLocalWatcher('/repo', '/repo')
+    root.listeners.set(1, sender as never)
+
+    watcherCallback?.(
+      null,
+      Array.from({ length: eventCount }, (_, index) => ({
+        type: 'update' as const,
+        path: `/repo/file-${index}.ts`
+      }))
+    )
+    vi.advanceTimersByTime(WATCH_BATCH_TRAILING_MS)
+    await flushMicrotasks()
+    expect(statMock).toHaveBeenCalledTimes(8)
+
+    cancelLocalBatchFlush(root)
+    pendingStats.resolve({ isDirectory: () => false })
+    for (let i = 0; i < eventCount * 4 && root.batch.flushInFlight; i++) {
+      await Promise.resolve()
+    }
+
+    expect(root.batch.flushInFlight).toBe(false)
+    expect(statMock).toHaveBeenCalledTimes(8)
+    expect(sender.send).not.toHaveBeenCalled()
+  })
+
   it('leaves an open debounce window to the armed timer instead of draining early', async () => {
     const firstStat = deferred<{ isDirectory: () => boolean }>()
     const secondStat = deferred<{ isDirectory: () => boolean }>()
diff --git a/src/main/ipc/filesystem-watcher-local-events.ts b/src/main/ipc/filesystem-watcher-local-events.ts
index 57ef7da4e1f..9f31adde4bd 100644
--- a/src/main/ipc/filesystem-watcher-local-events.ts
+++ b/src/main/ipc/filesystem-watcher-local-events.ts
@@ -139,7 +139,10 @@ async function flushBatch(root: WatchedRoot): Promise<void> {
       DIRECTORY_STAT_CONCURRENCY,
       async (evt) => {
         // Why: a deleted path can't be stat'd; leave isDirectory undefined and let the renderer infer from dirCache.
-        const isDirectory = evt.type === 'delete' ? undefined : await tryStatIsDirectory(evt.path)
+        const isDirectory =
+          root.batch.cancelled || evt.type === 'delete'
+            ? undefined
+            : await tryStatIsDirectory(evt.path)
 
         return {
           kind: evt.type,
diff --git a/src/main/ipc/filesystem/filesystem-search-handlers.ts b/src/main/ipc/filesystem/filesystem-search-handlers.ts
index 77a26c1e58d..2facbbfb445 100644
--- a/src/main/ipc/filesystem/filesystem-search-handlers.ts
+++ b/src/main/ipc/filesystem/filesystem-search-handlers.ts
@@ -1,3 +1,4 @@
+import { SearchSubprocessLineAccumulator } from '../../../shared/search-subprocess-lines'
 import { ipcMain } from 'electron'
 import type { ChildProcess } from 'node:child_process'
 import type { SearchOptions, SearchResult } from '../../../shared/code-search-types'
@@ -68,7 +69,7 @@ export function registerFilesystemSearchHandlers(context: FilesystemHandlerConte
         }
 
         const acc = createAccumulator()
-        let stdoutBuffer = ''
+        const lines = new SearchSubprocessLineAccumulator(Number.MAX_SAFE_INTEGER)
         let resolved = false
         let processErrorObserved = false
         let unavailableExitObserved = false
@@ -88,6 +89,7 @@ export function registerFilesystemSearchHandlers(context: FilesystemHandlerConte
           if (activeTextSearches.get(searchKey) === child) {
             activeTextSearches.delete(searchKey)
           }
+          lines.clear()
           clearTimeout(killTimeout)
           // Why: child.kill() is advisory; detach our closures so repeated searches don't retain old scans if rg ignores it.
           child?.stdout?.off('data', handleStdoutData)
@@ -121,12 +123,7 @@ export function registerFilesystemSearchHandlers(context: FilesystemHandlerConte
         activeTextSearches.set(searchKey, nextChild)
 
         const handleStdoutData = (chunk: string): void => {
-          stdoutBuffer += chunk
-          const lines = stdoutBuffer.split('\n')
-          stdoutBuffer = lines.pop() ?? ''
-          for (const line of lines) {
-            processLine(line)
-          }
+          lines.push(chunk, processLine)
         }
         const handleStderrData = (): void => {
           // Drain stderr so rg cannot block on a full pipe.
@@ -150,8 +147,9 @@ export function registerFilesystemSearchHandlers(context: FilesystemHandlerConte
             resolveWithoutRipgrep()
             return
           }
-          if (stdoutBuffer) {
-            processLine(stdoutBuffer)
+          const tail = lines.finish()
+          if (tail !== null) {
+            processLine(tail)
           }
           resolveOnce()
         }
diff --git a/src/main/ipc/notebook.ts b/src/main/ipc/notebook.ts
index 9255ab7383d..d90ab3616de 100644
--- a/src/main/ipc/notebook.ts
+++ b/src/main/ipc/notebook.ts
@@ -4,6 +4,7 @@ import { dirname } from 'node:path'
 import { ipcMain } from 'electron'
 import type { Store } from '../persistence'
 import { resolveAuthorizedPath } from './filesystem-auth'
+import { admitSelfInitiatedTreeKill } from '../own-chromium-tree-kill-guard'
 
 export type NotebookRunResult = {
   stdout: string
@@ -53,7 +54,8 @@ function appendBounded(capture: BoundedCapture, chunk: Buffer): void {
   capture.truncated = true
 }
 
-function terminateNotebookProcessTree(
+/** Exported for the refusal-fallback test; the timeout path is otherwise unreachable. */
+export function terminateNotebookProcessTree(
   child: ChildProcessWithoutNullStreams
 ): ReturnType<typeof setTimeout> | null {
   if (!child.pid) {
@@ -62,6 +64,18 @@ function terminateNotebookProcessTree(
   }
 
   if (process.platform === 'win32') {
+    if (
+      !admitSelfInitiatedTreeKill({
+        pid: child.pid,
+        site: 'notebook-cell-timeout',
+        scope: 'win-taskkill-tree'
+      })
+    ) {
+      // Refusal blocks the tree walk, not the termination: killing the root by
+      // handle cannot reach a recycled pid, and a timed-out cell must still stop.
+      child.kill()
+      return null
+    }
     try {
       // Why: a timed-out cell can spawn descendants. taskkill /T is the
       // Windows equivalent of terminating the whole process group.
diff --git a/src/main/ipc/notifications-retention-lifecycle.test.ts b/src/main/ipc/notifications-retention-lifecycle.test.ts
index 278ca8f13ae..9705cf85a58 100644
--- a/src/main/ipc/notifications-retention-lifecycle.test.ts
+++ b/src/main/ipc/notifications-retention-lifecycle.test.ts
@@ -1,4 +1,4 @@
-import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
 import {
   getAllWindowsMock,
@@ -30,6 +30,14 @@ vi.mock('../tray/system-tray', async () =>
 
 import { registerNotificationHandlers } from './notifications'
 
+// These cases exercise foreground behavior against Electron mocks.
+beforeEach(() => {
+  vi.stubEnv('ORCA_BACKGROUND_LAUNCH', undefined)
+  vi.stubEnv('ORCA_E2E_HEADLESS', undefined)
+  vi.stubEnv('ORCA_E2E_HEADFUL', undefined)
+})
+afterEach(() => vi.unstubAllEnvs())
+
 describe('registerNotificationHandlers', () => {
   beforeEach(() => {
     vi.useFakeTimers()
diff --git a/src/main/ipc/orca-profile-auth-status-broadcast.ts b/src/main/ipc/orca-profile-auth-status-broadcast.ts
new file mode 100644
index 00000000000..b5ac8483943
--- /dev/null
+++ b/src/main/ipc/orca-profile-auth-status-broadcast.ts
@@ -0,0 +1,15 @@
+import { BrowserWindow } from 'electron'
+import { ORCA_PROFILE_AUTH_STATUS_CHANGED_CHANNEL } from '../../shared/orca-profiles'
+
+export function broadcastOrcaProfileAuthStatusChanged(): void {
+  for (const window of BrowserWindow.getAllWindows()) {
+    if (window.isDestroyed()) {
+      continue
+    }
+    try {
+      window.webContents.send(ORCA_PROFILE_AUTH_STATUS_CHANGED_CHANNEL)
+    } catch {
+      // A renderer can disappear between isDestroyed() and send().
+    }
+  }
+}
diff --git a/src/main/ipc/orca-profiles.ts b/src/main/ipc/orca-profiles.ts
index bf1bf666270..480c6f350f9 100644
--- a/src/main/ipc/orca-profiles.ts
+++ b/src/main/ipc/orca-profiles.ts
@@ -45,6 +45,8 @@ import {
   signOutCurrentOrcaProfile
 } from '../orca-profiles/profile-cloud-service'
 import { registerOrcaProfileOrgMemberHandlers } from './orca-profile-org-members-handlers'
+import { onOrcaCloudSessionInvalidated } from '../orca-profiles/profile-cloud-session-invalidation'
+import { broadcastOrcaProfileAuthStatusChanged } from './orca-profile-auth-status-broadcast'
 
 type RegisterOrcaProfileHandlersOptions = {
   onBeforeRelaunch?: () => void | Promise<void>
@@ -178,6 +180,12 @@ export function registerOrcaProfileHandlers(
     getCurrentOrcaProfileAuthStatus(getProfileUserDataPath())
   )
 
+  // Why: a background refresh can revoke the session with no renderer request in
+  // flight, so push the change instead of waiting for the next pane to ask.
+  // Why not options.onAuthMutation: that hook drives the relay coordinator, which
+  // is the caller that just failed the refresh — re-entering it here would be a loop.
+  onOrcaCloudSessionInvalidated(broadcastOrcaProfileAuthStatusChanged)
+
   ipcMain.handle(
     'orcaProfiles:createLocal',
     (_event, args?: CreateLocalOrcaProfileArgs): CreateLocalOrcaProfileResult => {
diff --git a/src/main/ipc/pty/delivery/attached-pty-size.test.ts b/src/main/ipc/pty/delivery/attached-pty-size.test.ts
new file mode 100644
index 00000000000..90ff37c744d
--- /dev/null
+++ b/src/main/ipc/pty/delivery/attached-pty-size.test.ts
@@ -0,0 +1,166 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import {
+  commitAttachedPtySize,
+  resolveCommittedPtySize,
+  shouldSeedPreAttachPtySize
+} from './attached-pty-size'
+import { ptySizes } from './visibility-state'
+
+const REQUESTED = { cols: 80, rows: 24 }
+const CACHED = { cols: 180, rows: 50 }
+const LIVE = { cols: 211, rows: 57 }
+
+describe('shouldSeedPreAttachPtySize', () => {
+  it('seeds a fresh session id even when the pane never measured itself', () => {
+    expect(
+      shouldSeedPreAttachPtySize({
+        isFreshSessionId: true,
+        hasCachedSize: true,
+        requestIsUnmeasured: true
+      })
+    ).toBe(true)
+  })
+
+  it('never overwrites a size main already holds for the session', () => {
+    expect(
+      shouldSeedPreAttachPtySize({
+        isFreshSessionId: false,
+        hasCachedSize: true,
+        requestIsUnmeasured: false
+      })
+    ).toBe(false)
+  })
+
+  it('refuses an unmeasured request on an attach even with nothing cached', () => {
+    expect(
+      shouldSeedPreAttachPtySize({
+        isFreshSessionId: false,
+        hasCachedSize: false,
+        requestIsUnmeasured: true
+      })
+    ).toBe(false)
+  })
+
+  it('seeds a measured attach request when main holds nothing better', () => {
+    expect(
+      shouldSeedPreAttachPtySize({
+        isFreshSessionId: false,
+        hasCachedSize: false,
+        requestIsUnmeasured: false
+      })
+    ).toBe(true)
+  })
+})
+
+describe('resolveCommittedPtySize', () => {
+  it('records the requested grid for a fresh spawn, ignoring any stale cache', () => {
+    expect(
+      resolveCommittedPtySize({
+        result: {},
+        requested: REQUESTED,
+        cachedBeforeAttach: CACHED
+      })
+    ).toEqual(REQUESTED)
+  })
+
+  it('prefers a grid the provider applied on attach', () => {
+    expect(
+      resolveCommittedPtySize({
+        result: {
+          isReattach: true,
+          attachedGrid: { cols: 100, rows: 30 },
+          snapshotCols: LIVE.cols,
+          snapshotRows: LIVE.rows
+        },
+        requested: REQUESTED,
+        cachedBeforeAttach: CACHED
+      })
+    ).toEqual({ cols: 100, rows: 30 })
+  })
+
+  it('falls back to the reattach snapshot grid', () => {
+    expect(
+      resolveCommittedPtySize({
+        result: { isReattach: true, snapshotCols: LIVE.cols, snapshotRows: LIVE.rows },
+        requested: REQUESTED,
+        cachedBeforeAttach: CACHED
+      })
+    ).toEqual(LIVE)
+  })
+
+  it('falls back to the size main held when the provider proves nothing', () => {
+    expect(
+      resolveCommittedPtySize({
+        result: { isReattach: true },
+        requested: REQUESTED,
+        cachedBeforeAttach: CACHED
+      })
+    ).toEqual(CACHED)
+  })
+
+  it('rejects a non-integer provider grid as unproven', () => {
+    expect(
+      resolveCommittedPtySize({
+        result: { isReattach: true, snapshotCols: 120.5, snapshotRows: 40 },
+        requested: REQUESTED,
+        cachedBeforeAttach: CACHED
+      })
+    ).toEqual(CACHED)
+  })
+
+  it('takes the request only when nothing better exists', () => {
+    expect(
+      resolveCommittedPtySize({
+        result: { isReattach: true },
+        requested: REQUESTED,
+        cachedBeforeAttach: undefined
+      })
+    ).toEqual(REQUESTED)
+  })
+
+  it('rejects a non-positive provider grid rather than publishing a zero-width model', () => {
+    expect(
+      resolveCommittedPtySize({
+        result: { isReattach: true, snapshotCols: 0, snapshotRows: 0 },
+        requested: REQUESTED,
+        cachedBeforeAttach: CACHED
+      })
+    ).toEqual(CACHED)
+  })
+})
+
+describe('commitAttachedPtySize', () => {
+  afterEach(() => {
+    ptySizes.delete('pty-commit')
+  })
+
+  it('records the resolved grid and reflows the model onto it for a reattach', () => {
+    const reflow = vi.fn()
+    const committed = commitAttachedPtySize({
+      result: {
+        id: 'pty-commit',
+        isReattach: true,
+        snapshotCols: LIVE.cols,
+        snapshotRows: LIVE.rows
+      },
+      requested: REQUESTED,
+      cachedBeforeAttach: undefined,
+      reflowHeadlessTerminalToPtyGrid: reflow
+    })
+    expect(committed).toEqual(LIVE)
+    expect(ptySizes.get('pty-commit')).toEqual(LIVE)
+    expect(reflow).toHaveBeenCalledWith('pty-commit', LIVE.cols, LIVE.rows)
+  })
+
+  it('reflows a fresh spawn onto the request too: bytes can create the model before the reply', () => {
+    const reflow = vi.fn()
+    commitAttachedPtySize({
+      result: { id: 'pty-commit' },
+      requested: REQUESTED,
+      cachedBeforeAttach: CACHED,
+      reflowHeadlessTerminalToPtyGrid: reflow
+    })
+    expect(ptySizes.get('pty-commit')).toEqual(REQUESTED)
+    expect(reflow).toHaveBeenCalledWith('pty-commit', REQUESTED.cols, REQUESTED.rows)
+  })
+})
diff --git a/src/main/ipc/pty/delivery/attached-pty-size.ts b/src/main/ipc/pty/delivery/attached-pty-size.ts
new file mode 100644
index 00000000000..d8b14267cb8
--- /dev/null
+++ b/src/main/ipc/pty/delivery/attached-pty-size.ts
@@ -0,0 +1,81 @@
+import type { PtySpawnResult } from '../../../providers/types'
+import { ptySizes } from './visibility-state'
+
+export type PtyGrid = { cols: number; rows: number }
+
+function positiveGrid(cols: unknown, rows: unknown): PtyGrid | undefined {
+  return typeof cols === 'number' &&
+    typeof rows === 'number' &&
+    Number.isInteger(cols) &&
+    Number.isInteger(rows) &&
+    cols > 0 &&
+    rows > 0
+    ? { cols, rows }
+    : undefined
+}
+
+/** Pre-attach seed for `ptySizes`. Daemon PTYs can emit before spawn() resolves, so a genuinely
+ *  fresh session must record its geometry now or early bytes parse at xterm's 80x24 default.
+ *  An attach must not seed: a pane that mounted while hidden reports xterm's unmeasured default,
+ *  and the live PTY's real grid is either already cached or arrives with the attach result. */
+export function shouldSeedPreAttachPtySize(args: {
+  isFreshSessionId: boolean
+  hasCachedSize: boolean
+  requestIsUnmeasured: boolean
+}): boolean {
+  return args.isFreshSessionId || (!args.hasCachedSize && !args.requestIsUnmeasured)
+}
+
+/** Grid to record for a settled spawn. Daemon and relay attach never resize the session they hand
+ *  back, so on a reattach the requested grid describes the pane, not the live process — take the
+ *  provider's proven grid, then the size main already held, before trusting the request. */
+export function resolveCommittedPtySize(args: {
+  result: Pick<PtySpawnResult, 'isReattach' | 'attachedGrid' | 'snapshotCols' | 'snapshotRows'>
+  requested: PtyGrid
+  cachedBeforeAttach: PtyGrid | undefined
+}): PtyGrid {
+  if (args.result.isReattach !== true) {
+    return args.requested
+  }
+  return (
+    positiveGrid(args.result.attachedGrid?.cols, args.result.attachedGrid?.rows) ??
+    positiveGrid(args.result.snapshotCols, args.result.snapshotRows) ??
+    positiveGrid(args.cachedBeforeAttach?.cols, args.cachedBeforeAttach?.rows) ??
+    args.requested
+  )
+}
+
+type HeadlessReflow = ((ptyId: string, cols: number, rows: number) => void) | undefined
+
+/** Reflow main's model onto the committed grid, whatever the spawn was. Why unconditional: live
+ *  bytes can lazily create the model at the 80x24 default before the reply arrives, a seed skips an
+ *  existing model, and the pre-attach seed is now withheld for unmeasured attaches, so a session the
+ *  daemon re-created instead of attaching would otherwise keep the default forever. */
+export function reflowHeadlessTerminalToCommittedGrid(args: {
+  result: Pick<PtySpawnResult, 'id'>
+  committedSize: PtyGrid
+  reflowHeadlessTerminalToPtyGrid: HeadlessReflow
+}): void {
+  args.reflowHeadlessTerminalToPtyGrid?.(
+    args.result.id,
+    args.committedSize.cols,
+    args.committedSize.rows
+  )
+}
+
+/** Record the settled grid, then reflow the model onto it. Callers that seed the model between the
+ *  two steps (ipc spawn commit) call the halves separately. */
+export function commitAttachedPtySize(args: {
+  result: Pick<
+    PtySpawnResult,
+    'id' | 'isReattach' | 'attachedGrid' | 'snapshotCols' | 'snapshotRows'
+  >
+  requested: PtyGrid
+  cachedBeforeAttach: PtyGrid | undefined
+  reflowHeadlessTerminalToPtyGrid: HeadlessReflow
+}): PtyGrid {
+  const committedSize = resolveCommittedPtySize(args)
+  ptySizes.set(args.result.id, committedSize)
+  reflowHeadlessTerminalToCommittedGrid({ ...args, committedSize })
+  return committedSize
+}
diff --git a/src/main/ipc/pty/ipc/inspect.ts b/src/main/ipc/pty/ipc/inspect.ts
index c13c4242fea..5a6d03d8855 100644
--- a/src/main/ipc/pty/ipc/inspect.ts
+++ b/src/main/ipc/pty/ipc/inspect.ts
@@ -170,7 +170,15 @@ export function installPtyInspectIpcHandlers(deps: {
 
   ipcMain.handle(
     'pty:inspectProcess',
-    async (_event, args: { id: string; expectedIncarnationId?: string }) => {
+    async (
+      _event,
+      args: {
+        id: string
+        expectedIncarnationId?: string
+        scanChildProcesses?: boolean
+        steadyState?: boolean
+      }
+    ) => {
       // Why: same routing hazard as pty:hasPty — an unroutable id must read as client-only unverifiable, not as a local-provider answer or a raised IPC error.
       if (typeof args?.id !== 'string' || !args.id || args.id.startsWith('remote:')) {
         return clientOnlyUnverifiableInspection('terminal_gone')
@@ -182,10 +190,15 @@ export function installPtyInspectIpcHandlers(deps: {
       if (!hasPtyProviderForInspection(args.id)) {
         return clientOnlyUnverifiableInspection('terminal_gone')
       }
-      return args.expectedIncarnationId
-        ? inspectPtyProviderProcessForRenderer(getProviderForPty(args.id), args.id, {
-            expectedIncarnationId: args.expectedIncarnationId
-          })
+      const options = {
+        ...(args.expectedIncarnationId
+          ? { expectedIncarnationId: args.expectedIncarnationId }
+          : {}),
+        ...(args.scanChildProcesses === true ? { scanChildProcesses: true } : {}),
+        ...(args.steadyState === true ? { steadyState: true } : {})
+      }
+      return Object.keys(options).length > 0
+        ? inspectPtyProviderProcessForRenderer(getProviderForPty(args.id), args.id, options)
         : inspectPtyProviderProcessForRenderer(getProviderForPty(args.id), args.id)
     }
   )
diff --git a/src/main/ipc/pty/ipc/spawn-commit-persist.ts b/src/main/ipc/pty/ipc/spawn-commit-persist.ts
index 540ada9397d..d9bee3e6934 100644
--- a/src/main/ipc/pty/ipc/spawn-commit-persist.ts
+++ b/src/main/ipc/pty/ipc/spawn-commit-persist.ts
@@ -11,12 +11,14 @@ import {
 } from '../pane/serializer-state'
 import { ptyOwnership, ptyIncarnationById, deletePtyOwnership } from '../provider/ownership-state'
 import { ptySizes } from '../delivery/visibility-state'
+import { resolveCommittedPtySize, type PtyGrid } from '../delivery/attached-pty-size'
 import { clearProviderPtyState } from '../provider/state-cleanup'
 import type { PtyIpcSpawnState } from './spawn-state'
 
 export async function persistPtyIpcSpawnCommit(ctx: PtyIpcSpawnState): Promise<{
   rendererPreSignaled: boolean
   rendererAlreadyRegistered: boolean
+  committedSize: PtyGrid
 }> {
   const args = ctx.args
   try {
@@ -89,7 +91,12 @@ export async function persistPtyIpcSpawnCommit(ctx: PtyIpcSpawnState): Promise<{
       ctx.agentTeamsLeaderHandle = null
     }
   }
-  ptySizes.set(ctx.result.id, { cols: args.cols, rows: args.rows })
+  const committedSize = resolveCommittedPtySize({
+    result: ctx.result,
+    requested: { cols: args.cols, rows: args.rows },
+    cachedBeforeAttach: ctx.sessionSizeBeforeAttach
+  })
+  ptySizes.set(ctx.result.id, committedSize)
   if (ctx.effectiveSessionAppId !== undefined && ctx.effectiveSessionAppId !== ctx.result.id) {
     ptySizes.delete(ctx.effectiveSessionAppId)
   }
@@ -157,5 +164,5 @@ export async function persistPtyIpcSpawnCommit(ctx: PtyIpcSpawnState): Promise<{
       pendingPtyIdBySerializerGeneration.set(pending.gen, ctx.result.id)
     }
   }
-  return { rendererPreSignaled, rendererAlreadyRegistered }
+  return { rendererPreSignaled, rendererAlreadyRegistered, committedSize }
 }
diff --git a/src/main/ipc/pty/ipc/spawn-commit.ts b/src/main/ipc/pty/ipc/spawn-commit.ts
index f02eb215c87..90b700f24b2 100644
--- a/src/main/ipc/pty/ipc/spawn-commit.ts
+++ b/src/main/ipc/pty/ipc/spawn-commit.ts
@@ -24,10 +24,12 @@ import {
 } from '../pane/launch-authority'
 import type { PtyIpcSpawnState } from './spawn-state'
 import { persistPtyIpcSpawnCommit } from './spawn-commit-persist'
+import { reflowHeadlessTerminalToCommittedGrid } from '../delivery/attached-pty-size'
 
 export async function commitPtyIpcSpawn(ctx: PtyIpcSpawnState): Promise<PtySpawnResult> {
   const args = ctx.args
-  const { rendererPreSignaled, rendererAlreadyRegistered } = await persistPtyIpcSpawnCommit(ctx)
+  const { rendererPreSignaled, rendererAlreadyRegistered, committedSize } =
+    await persistPtyIpcSpawnCommit(ctx)
 
   // Why: seed the headless emulator before registerPty so concurrent live PTY data lands on top of the seed, not replacing it (mobile keeps the daemon-restored scrollback).
   // Skip when the renderer will be authoritative — its xterm buffer is richer than the daemon snapshot.
@@ -71,6 +73,15 @@ export async function commitPtyIpcSpawn(ctx: PtyIpcSpawnState): Promise<PtySpawn
       ctx.deps.runtime.seedHeadlessTerminal(ctx.result.id, ctx.result.replay)
     }
   }
+  // Why after the seed: a seed skips an existing model, and live bytes may have lazily created
+  // one at the 80x24 default before the spawn reply revealed the session's real grid.
+  reflowHeadlessTerminalToCommittedGrid({
+    result: ctx.result,
+    committedSize,
+    reflowHeadlessTerminalToPtyGrid: ctx.deps.runtime?.reflowHeadlessTerminalToPtyGrid?.bind(
+      ctx.deps.runtime
+    )
+  })
   if (
     typeof args.worktreeId === 'string' &&
     args.worktreeId.length > 0 &&
diff --git a/src/main/ipc/pty/ipc/spawn-env.ts b/src/main/ipc/pty/ipc/spawn-env.ts
index af5da3858bd..94f1acf363e 100644
--- a/src/main/ipc/pty/ipc/spawn-env.ts
+++ b/src/main/ipc/pty/ipc/spawn-env.ts
@@ -7,7 +7,11 @@ import { isRemoteAgentHooksEnabled } from '../../../../shared/agent-hook-relay'
 import { isOpaqueRemintedPaneKey } from '../../../../shared/pane-key-alias'
 import { isValidTerminalTabId } from '../../../../shared/terminal-tab-id'
 import { isClaudeAuthSwitchInProgress } from '../../../claude-accounts/live-pty-gate'
-import { hasClaudeAuthEnvConflict } from '../../../claude-accounts/environment'
+import {
+  CLAUDE_AUTH_ENV_CONFLICT_MESSAGE,
+  CLAUDE_AUTH_SWITCH_IN_PROGRESS_MESSAGE,
+  hasClaudeAuthEnvConflict
+} from '../../../claude-accounts/environment'
 import { LocalPtyProvider } from '../../../providers/local-pty-provider'
 import { resolvePathEnvKey } from '../../../pty/windows-environment-path'
 import { routesFreshSpawnsToLocalProvider } from '../host-env/fresh-spawn-routing'
@@ -20,12 +24,10 @@ import { assemblePtyIpcSpawnCodexEnv } from './spawn-env-codex'
 export async function assemblePtyIpcSpawnEnv(ctx: PtyIpcSpawnState): Promise<void> {
   const args = ctx.args
   if (ctx.isClaudeLaunch && isClaudeAuthSwitchInProgress()) {
-    throw new Error('A Claude account switch is in progress. Try again after it finishes.')
+    throw new Error(CLAUDE_AUTH_SWITCH_IN_PROGRESS_MESSAGE)
   }
   if (ctx.claudeAuth?.stripAuthEnv && hasClaudeAuthEnvConflict(args.env)) {
-    throw new Error(
-      'This Claude launch defines explicit Anthropic auth environment variables. Remove those overrides before using a managed Claude account.'
-    )
+    throw new Error(CLAUDE_AUTH_ENV_CONFLICT_MESSAGE)
   }
   // Why: the daemon-backed provider skips LocalPtyProvider's buildSpawnEnv, so assemble the same host-local env here for parity.
   // Safety: skip entirely for SSH — every injection is a loopback secret or a local path that leaks or misleads on the remote host.
diff --git a/src/main/ipc/pty/ipc/spawn-options.ts b/src/main/ipc/pty/ipc/spawn-options.ts
index ed75b989f6d..78747e6a462 100644
--- a/src/main/ipc/pty/ipc/spawn-options.ts
+++ b/src/main/ipc/pty/ipc/spawn-options.ts
@@ -17,6 +17,7 @@ import {
   pendingRuntimePaneCreatesByOwnerKey
 } from '../pane/spawn-reservation'
 import { ptySizes } from '../delivery/visibility-state'
+import { shouldSeedPreAttachPtySize } from '../delivery/attached-pty-size'
 import { getStartupTerminalColorQueryReplyColors } from '../../terminal-startup-color-query-replies'
 import type { PtyIpcSpawnState } from './spawn-state'
 
@@ -97,7 +98,14 @@ export async function buildPtyIpcSpawnOptions(
     ctx.effectiveSessionAppId !== undefined ? ptySizes.has(ctx.effectiveSessionAppId) : false
   ctx.sessionSizeBeforeAttach =
     ctx.effectiveSessionAppId !== undefined ? ptySizes.get(ctx.effectiveSessionAppId) : undefined
-  if (ctx.effectiveSessionId !== undefined) {
+  if (
+    ctx.effectiveSessionId !== undefined &&
+    shouldSeedPreAttachPtySize({
+      isFreshSessionId: ctx.isMintedSessionId,
+      hasCachedSize: ctx.hadSessionSizeBeforeAttach,
+      requestIsUnmeasured: args.initiallyHidden === true
+    })
+  ) {
     // Why: daemon PTYs can emit before spawn() resolves; set real geometry now or early bytes default to 80x24 and wrap TUIs.
     ptySizes.set(ctx.effectiveSessionAppId ?? ctx.effectiveSessionId, {
       cols: args.cols,
diff --git a/src/main/ipc/pty/ipc/spawn-preflight.ts b/src/main/ipc/pty/ipc/spawn-preflight.ts
index f40b46e5dd5..f885d6e2f6f 100644
--- a/src/main/ipc/pty/ipc/spawn-preflight.ts
+++ b/src/main/ipc/pty/ipc/spawn-preflight.ts
@@ -4,6 +4,7 @@ import {
 } from '../../../../shared/local-windows-terminal-runtime'
 import { isWslUncPath, toWindowsWslPath } from '../../../../shared/wsl-paths'
 import { isClaudeAuthSwitchInProgress } from '../../../claude-accounts/live-pty-gate'
+import { CLAUDE_AUTH_SWITCH_IN_PROGRESS_MESSAGE } from '../../../claude-accounts/environment'
 import { mintPtySessionId } from '../../../daemon/pty-session-id'
 import { resolveWslSessionContext } from '../../../daemon/wsl-session-context'
 import { LocalPtyProvider } from '../../../providers/local-pty-provider'
@@ -193,7 +194,7 @@ export async function preparePtyIpcSpawnPreflight(ctx: PtyIpcSpawnState): Promis
   ctx.isClaudeLaunch =
     !ctx.preAdoptedStablePane && !args.connectionId && isClaudeLaunchCommand(args.command)
   if (ctx.isClaudeLaunch && isClaudeAuthSwitchInProgress()) {
-    throw new Error('A Claude account switch is in progress. Try again after it finishes.')
+    throw new Error(CLAUDE_AUTH_SWITCH_IN_PROGRESS_MESSAGE)
   }
   ctx.terminalRuntimeOptions =
     process.platform === 'win32' && !args.connectionId
diff --git a/src/main/ipc/pty/ipc/spawn-reattach-size-cache.test.ts b/src/main/ipc/pty/ipc/spawn-reattach-size-cache.test.ts
new file mode 100644
index 00000000000..53b361bc8fe
--- /dev/null
+++ b/src/main/ipc/pty/ipc/spawn-reattach-size-cache.test.ts
@@ -0,0 +1,136 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { PtySpawnResult } from '../../../providers/types'
+import { ptySizes } from '../delivery/visibility-state'
+import { buildPtyIpcSpawnOptions } from './spawn-options'
+import { commitPtyIpcSpawn } from './spawn-commit'
+import { createPtyIpcSpawnState, type PtyIpcSpawnState } from './spawn-state'
+import type { PtySpawnIpcArgs, PtySpawnIpcDeps } from './spawn-types'
+
+const SESSION_ID = 'orca-pty-session-1'
+/** What a pane that mounted while `display:none` reports: xterm's unmeasured default. */
+const HIDDEN_PANE_REQUEST = { cols: 80, rows: 24 }
+/** The grid the surviving daemon session is actually running at. */
+const LIVE_GRID = { cols: 211, rows: 57 }
+
+function makeRuntime() {
+  return {
+    seedHeadlessTerminal: vi.fn(),
+    reflowHeadlessTerminalToPtyGrid: vi.fn(),
+    registerPty: vi.fn(),
+    cancelPendingPtyRegistration: vi.fn(),
+    noteTerminalSpawnCommand: vi.fn(),
+    seedTerminalRestoreTail: vi.fn(),
+    registerPreAllocatedHandleForPty: vi.fn()
+  }
+}
+
+function makeCtx(args: PtySpawnIpcArgs, runtime: ReturnType<typeof makeRuntime>): PtyIpcSpawnState {
+  const deps = {
+    transitionSpawnHiddenRendererPtyDeliveryState: vi.fn(),
+    syncPtyBackgroundedDelivery: vi.fn(),
+    sendPtySpawnedToRenderer: vi.fn(),
+    runtime
+  } as unknown as PtySpawnIpcDeps
+  const ctx = createPtyIpcSpawnState(deps, args)
+  ctx.env = {}
+  ctx.isDaemonHostSpawn = true
+  ctx.effectiveSessionId = SESSION_ID
+  ctx.effectiveSessionAppId = SESSION_ID
+  // Mirrors spawn-preflight: a caller-supplied sessionId is an attach, never a fresh mint.
+  ctx.isMintedSessionId = args.sessionId === undefined
+  return ctx
+}
+
+async function runSpawn(
+  args: PtySpawnIpcArgs,
+  result: PtySpawnResult
+): Promise<{
+  runtime: ReturnType<typeof makeRuntime>
+  preAttachSize: { cols: number; rows: number } | undefined
+}> {
+  const runtime = makeRuntime()
+  const ctx = makeCtx(args, runtime)
+  await buildPtyIpcSpawnOptions(ctx)
+  const preAttachSize = ptySizes.get(SESSION_ID)
+  ctx.result = result
+  await commitPtyIpcSpawn(ctx)
+  return { runtime, preAttachSize }
+}
+
+describe('spawn size cache on reattach', () => {
+  afterEach(() => {
+    ptySizes.delete(SESSION_ID)
+    vi.restoreAllMocks()
+  })
+
+  it('records the reattached session real grid, not a hidden pane placeholder', async () => {
+    const { runtime, preAttachSize } = await runSpawn(
+      { ...HIDDEN_PANE_REQUEST, sessionId: SESSION_ID, initiallyHidden: true },
+      {
+        id: SESSION_ID,
+        isReattach: true,
+        snapshotCols: LIVE_GRID.cols,
+        snapshotRows: LIVE_GRID.rows
+      }
+    )
+
+    // Pre-attach: an unmeasured request must not be published as the live PTY's size.
+    expect(preAttachSize).toBeUndefined()
+    expect(ptySizes.get(SESSION_ID)).toEqual(LIVE_GRID)
+    expect(runtime.reflowHeadlessTerminalToPtyGrid).toHaveBeenCalledWith(
+      SESSION_ID,
+      LIVE_GRID.cols,
+      LIVE_GRID.rows
+    )
+  })
+
+  it('records the requested grid for a genuinely fresh spawn', async () => {
+    const { runtime, preAttachSize } = await runSpawn({ cols: 120, rows: 40 }, { id: SESSION_ID })
+
+    expect(preAttachSize).toEqual({ cols: 120, rows: 40 })
+    expect(ptySizes.get(SESSION_ID)).toEqual({ cols: 120, rows: 40 })
+    expect(runtime.reflowHeadlessTerminalToPtyGrid).toHaveBeenCalledWith(SESSION_ID, 120, 40)
+  })
+
+  // Why: the pre-attach seed is withheld for an unmeasured attach, and a daemon that restarted
+  // re-creates the session instead of attaching, so only the commit can size the model.
+  it('reflows a hidden attach the daemon answered with a fresh session onto the request', async () => {
+    const { runtime, preAttachSize } = await runSpawn(
+      { cols: 100, rows: 30, sessionId: SESSION_ID, initiallyHidden: true },
+      { id: SESSION_ID }
+    )
+
+    expect(preAttachSize).toBeUndefined()
+    expect(ptySizes.get(SESSION_ID)).toEqual({ cols: 100, rows: 30 })
+    expect(runtime.reflowHeadlessTerminalToPtyGrid).toHaveBeenCalledWith(SESSION_ID, 100, 30)
+  })
+
+  it('keeps the size main already held when the reattach carries no snapshot grid', async () => {
+    ptySizes.set(SESSION_ID, { cols: 180, rows: 50 })
+
+    const { preAttachSize } = await runSpawn(
+      { ...HIDDEN_PANE_REQUEST, sessionId: SESSION_ID, initiallyHidden: true },
+      { id: SESSION_ID, isReattach: true }
+    )
+
+    expect(preAttachSize).toEqual({ cols: 180, rows: 50 })
+    expect(ptySizes.get(SESSION_ID)).toEqual({ cols: 180, rows: 50 })
+  })
+
+  it('prefers the grid the provider applied on attach over every other source', async () => {
+    ptySizes.set(SESSION_ID, { cols: 180, rows: 50 })
+
+    await runSpawn(
+      { ...HIDDEN_PANE_REQUEST, sessionId: SESSION_ID, initiallyHidden: true },
+      {
+        id: SESSION_ID,
+        isReattach: true,
+        attachedGrid: { cols: 100, rows: 30 },
+        snapshotCols: LIVE_GRID.cols,
+        snapshotRows: LIVE_GRID.rows
+      }
+    )
+
+    expect(ptySizes.get(SESSION_ID)).toEqual({ cols: 100, rows: 30 })
+  })
+})
diff --git a/src/main/ipc/pty/ipc/write-input-chunk-yield.test.ts b/src/main/ipc/pty/ipc/write-input-chunk-yield.test.ts
new file mode 100644
index 00000000000..86e16121f5c
--- /dev/null
+++ b/src/main/ipc/pty/ipc/write-input-chunk-yield.test.ts
@@ -0,0 +1,134 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+import { TERMINAL_INPUT_CHUNK_MAX_BYTES } from '../../../../shared/terminal-input'
+import { agentSessionPtyWriteGate } from '../../../runtime/agent-session-pty-write-gate'
+import { ptyOwnership } from '../provider/ownership-state'
+import { createPtyWriteInput } from './write-input'
+
+const PTY_ID = 'pty-chunk-yield'
+
+const { provider } = vi.hoisted(() => ({ provider: { write: vi.fn() } }))
+
+vi.mock('../provider/registry', () => ({
+  tryGetProviderForPty: (id: string) => (id === PTY_ID ? provider : undefined)
+}))
+
+const realSetImmediate = globalThis.setImmediate
+const realReadmit = agentSessionPtyWriteGate.readmit.bind(agentSessionPtyWriteGate)
+const THREE_CHUNK_INPUT = 'x'.repeat(TERMINAL_INPUT_CHUNK_MAX_BYTES * 2 + 8)
+
+const mainWindow = {
+  isDestroyed: () => false,
+  webContents: { isDestroyed: () => false, send: vi.fn() }
+}
+
+/** Resolves after `turns` real check-phase passes; never touches the (faked) timer queue. */
+function afterImmediateTurns(turns: number): Promise<'stalled'> {
+  return new Promise((resolve) => {
+    const step = (remaining: number): void => {
+      if (remaining === 0) {
+        resolve('stalled')
+        return
+      }
+      realSetImmediate(() => step(remaining - 1))
+    }
+    step(turns)
+  })
+}
+
+function createWriteInput(): ReturnType<typeof createPtyWriteInput>['writePtyInput'] {
+  return createPtyWriteInput({
+    mainWindow: mainWindow as never,
+    clearHiddenRendererResizeOutput: vi.fn()
+  }).writePtyInput
+}
+
+beforeEach(() => {
+  ptyOwnership.set(PTY_ID, null)
+  provider.write.mockReset()
+  mainWindow.webContents.send.mockReset()
+  // Why: only setTimeout is faked. A setTimeout(0) yield would stall the write forever here,
+  // while a setImmediate yield still runs in Node's check phase — the race below is deterministic.
+  vi.useFakeTimers({ toFake: ['setTimeout'] })
+})
+
+afterEach(() => {
+  ptyOwnership.delete(PTY_ID)
+  vi.restoreAllMocks()
+  vi.useRealTimers()
+})
+
+describe('chunked pty write yield', () => {
+  it('yields between chunks via setImmediate, not a timer, and readmits before each later chunk', async () => {
+    const events: string[] = []
+    provider.write.mockImplementation((_id: string, data: string) => {
+      events.push(`write:${data.length}`)
+    })
+    vi.spyOn(agentSessionPtyWriteGate, 'readmit').mockImplementation((...args) => {
+      events.push('readmit')
+      return realReadmit(...args)
+    })
+    vi.spyOn(globalThis, 'setImmediate').mockImplementation(((callback: () => void) => {
+      events.push('yield')
+      return realSetImmediate(callback)
+    }) as typeof setImmediate)
+
+    const outcome = await Promise.race([
+      createWriteInput()({ id: PTY_ID, data: THREE_CHUNK_INPUT }),
+      afterImmediateTurns(50)
+    ])
+
+    expect(outcome).toBe(true)
+    expect(vi.getTimerCount()).toBe(0)
+    expect(events).toEqual([
+      `write:${TERMINAL_INPUT_CHUNK_MAX_BYTES}`,
+      'yield',
+      'readmit',
+      `write:${TERMINAL_INPUT_CHUNK_MAX_BYTES}`,
+      'yield',
+      'readmit',
+      'write:8'
+    ])
+    expect(mainWindow.webContents.send).not.toHaveBeenCalled()
+  })
+
+  it('does not yield for input that fits in a single chunk', async () => {
+    const immediate = vi.spyOn(globalThis, 'setImmediate')
+
+    const outcome = createWriteInput()({
+      id: PTY_ID,
+      data: 'x'.repeat(TERMINAL_INPUT_CHUNK_MAX_BYTES)
+    })
+
+    expect(outcome).toBe(true)
+    expect(provider.write).toHaveBeenCalledTimes(1)
+    expect(immediate).not.toHaveBeenCalled()
+  })
+
+  it('stops after a yield once readmission refuses', async () => {
+    const readmit = vi.spyOn(agentSessionPtyWriteGate, 'readmit').mockReturnValue({
+      admitted: false,
+      refusal: {
+        code: 'agent_session_checkpoint_stale',
+        sessionId: 'session-1',
+        ownerRuntimeKind: null,
+        handoffStage: null,
+        ownerPid: null,
+        runtimeFence: null
+      }
+    })
+
+    const outcome = await Promise.race([
+      createWriteInput()({ id: PTY_ID, data: THREE_CHUNK_INPUT }),
+      afterImmediateTurns(50)
+    ])
+
+    expect(outcome).toBe(false)
+    expect(provider.write).toHaveBeenCalledTimes(1)
+    expect(readmit).toHaveBeenCalledTimes(1)
+    expect(mainWindow.webContents.send).toHaveBeenCalledWith(
+      'pty:writeUnavailable',
+      expect.objectContaining({ id: PTY_ID })
+    )
+  })
+})
diff --git a/src/main/ipc/pty/ipc/write-input.ts b/src/main/ipc/pty/ipc/write-input.ts
index f27604dc9f8..6713e49000b 100644
--- a/src/main/ipc/pty/ipc/write-input.ts
+++ b/src/main/ipc/pty/ipc/write-input.ts
@@ -152,7 +152,9 @@ export function createPtyWriteInput(deps: {
         first = false
         provider.write(id, chunk.value)
         if (!nextChunk.done) {
-          await new Promise((resolve) => setTimeout(resolve, 0))
+          // setImmediate, not setTimeout(0): the yield exists to let abort/data callbacks run
+          // between chunks, and a clamped timer tick per 16 KiB is pure latency.
+          await new Promise((resolve) => setImmediate(resolve))
         }
         chunk = nextChunk
         nextChunk = chunks.next()
diff --git a/src/main/ipc/pty/runtime/queried-host-kinds.test.ts b/src/main/ipc/pty/runtime/queried-host-kinds.test.ts
new file mode 100644
index 00000000000..1f7ce2459d8
--- /dev/null
+++ b/src/main/ipc/pty/runtime/queried-host-kinds.test.ts
@@ -0,0 +1,60 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { parseExecutionHostId } from '../../../../shared/execution-host'
+import { sshProviders } from '../provider/registry'
+import { listProcessesWithHostScopeFromRuntimeController } from './inventory-operations'
+import type { PtyRuntimeControllerDeps } from './controller-deps'
+
+/**
+ * `hostScopeCensusIsComplete` discounts a `runtime:` host in `omittedHostIds` on the strength of
+ * one fact about this process: it has no paired-runtime PTY provider, so it never queried that
+ * host and never owed it coverage. This file pins the producer side of that fact.
+ *
+ * What it catches: a new branch here that spells a queried host `runtime:`. Every id this
+ * function emits is built by `toSshExecutionHostId` or is `LOCAL_EXECUTION_HOST_ID`, so a third
+ * shape is the observable form of "a runtime host can now answer an inventory" — at which point
+ * the client predicate would start calling a genuine gap complete.
+ *
+ * What it does NOT catch, so do not lean on it: a runtime-backed transport registered under an
+ * SSH connection id still reports as `ssh:` and passes, which is fine — the predicate only
+ * discounts the `runtime:` spelling. The consolidation moving the SSH path onto orcad is expected
+ * to look exactly like that. The other route into `queriedHostIds` is separately fenced to
+ * `kind === 'ssh'` in `orca-runtime-refresh-pty-worktree-records-with-controller-inventory.ts`.
+ */
+describe('the hosts a PTY inventory can report having queried', () => {
+  afterEach(() => {
+    sshProviders.clear()
+  })
+
+  it('emits only local and ssh spellings, never a paired-runtime one', async () => {
+    const listProcesses = vi.fn(async () => [])
+    sshProviders.set('box-1', { listProcesses } as never)
+    // A connection id shaped like an environment uuid still has to come back `ssh:`; the spelling
+    // is what the gate keys on, so a `runtime:` id appearing here is the breakage that matters.
+    sshProviders.set('a2478221-1d5c-4603-b8bf-b6b728eac9df', { listProcesses } as never)
+
+    const { hostIds } = await listProcessesWithHostScopeFromRuntimeController({
+      runtime: null
+    } as unknown as PtyRuntimeControllerDeps)
+
+    expect(hostIds).toContain('ssh:a2478221-1d5c-4603-b8bf-b6b728eac9df')
+    expect(new Set(hostIds.map((hostId) => parseExecutionHostId(hostId)?.kind))).toEqual(
+      new Set(['local', 'ssh'])
+    )
+  })
+
+  it('drops a provider that threw rather than reporting its host as queried', async () => {
+    sshProviders.set('box-live', { listProcesses: vi.fn(async () => []) } as never)
+    sshProviders.set('box-down', {
+      listProcesses: vi.fn(async () => {
+        throw new Error('relay unavailable')
+      })
+    } as never)
+
+    const { hostIds } = await listProcessesWithHostScopeFromRuntimeController({
+      runtime: { markPtyLivenessUnverifiable: vi.fn() }
+    } as unknown as PtyRuntimeControllerDeps)
+
+    expect(hostIds).toContain('ssh:box-live')
+    expect(hostIds).not.toContain('ssh:box-down')
+  })
+})
diff --git a/src/main/ipc/pty/runtime/spawn-commit-pty-size.test.ts b/src/main/ipc/pty/runtime/spawn-commit-pty-size.test.ts
new file mode 100644
index 00000000000..84d87b75005
--- /dev/null
+++ b/src/main/ipc/pty/runtime/spawn-commit-pty-size.test.ts
@@ -0,0 +1,80 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { ptySizes } from '../delivery/visibility-state'
+import { commitRuntimePtySpawn } from './spawn-commit'
+import { createRuntimePtySpawnState, type RuntimePtySpawnArgs } from './spawn-state'
+import type { PtyRuntimeControllerDeps } from './controller-deps'
+
+const PTY_ID = 'orca-pty-adopted'
+const LIVE_GRID = { cols: 211, rows: 57 }
+
+function makeRuntime() {
+  return {
+    registerPreAllocatedHandleForPty: vi.fn(),
+    registerPty: vi.fn(),
+    reflowHeadlessTerminalToPtyGrid: vi.fn(),
+    seedHeadlessTerminal: vi.fn(),
+    noteTerminalSpawnCommand: vi.fn()
+  }
+}
+
+describe('runtime spawn commit: adopted agent-session claim', () => {
+  afterEach(() => {
+    ptySizes.delete(PTY_ID)
+  })
+
+  function makeAdoptedCtx(result: Record<string, unknown>) {
+    const runtime = makeRuntime()
+    const deps = { runtime, store: undefined, options: {} } as unknown as PtyRuntimeControllerDeps
+    const args = { cols: 120, rows: 40, worktreeId: 'wt-1' } as unknown as RuntimePtySpawnArgs
+    const ctx = createRuntimePtySpawnState(deps, args)
+    ctx.result = {
+      id: PTY_ID,
+      ...result,
+      agentSessionEnsure: {
+        disposition: 'adopted',
+        owner: {
+          claim: { kind: 'terminal' },
+          generation: 'g1',
+          phase: 'live',
+          ptyId: PTY_ID,
+          surface: { worktreeId: 'wt-1', tabId: 'tab-1', leafId: 'leaf-1', terminalHandle: 'h1' }
+        }
+      }
+    } as unknown as typeof ctx.result
+    return { runtime, ctx }
+  }
+
+  it('commits the live grid from the adoption reply before the early return', async () => {
+    const { runtime, ctx } = makeAdoptedCtx({
+      isReattach: true,
+      snapshotCols: LIVE_GRID.cols,
+      snapshotRows: LIVE_GRID.rows
+    })
+
+    await commitRuntimePtySpawn(ctx)
+
+    expect(ptySizes.get(PTY_ID)).toEqual(LIVE_GRID)
+    expect(runtime.reflowHeadlessTerminalToPtyGrid).toHaveBeenCalledWith(
+      PTY_ID,
+      LIVE_GRID.cols,
+      LIVE_GRID.rows
+    )
+  })
+
+  // Why: the SSH relay's adopted reply carries neither isReattach nor snapshot dims; the
+  // adoption itself proves a live owner, so main keeps what it held rather than the request.
+  it('treats an adoption without a reattach flag as an attach and keeps the held size', async () => {
+    ptySizes.set(PTY_ID, LIVE_GRID)
+    const { runtime, ctx } = makeAdoptedCtx({})
+    ctx.sessionSizeBeforeAttach = LIVE_GRID
+
+    await commitRuntimePtySpawn(ctx)
+
+    expect(ptySizes.get(PTY_ID)).toEqual(LIVE_GRID)
+    expect(runtime.reflowHeadlessTerminalToPtyGrid).toHaveBeenCalledWith(
+      PTY_ID,
+      LIVE_GRID.cols,
+      LIVE_GRID.rows
+    )
+  })
+})
diff --git a/src/main/ipc/pty/runtime/spawn-commit-pty-size.ts b/src/main/ipc/pty/runtime/spawn-commit-pty-size.ts
new file mode 100644
index 00000000000..9b73f093761
--- /dev/null
+++ b/src/main/ipc/pty/runtime/spawn-commit-pty-size.ts
@@ -0,0 +1,18 @@
+import { commitAttachedPtySize } from '../delivery/attached-pty-size'
+import type { RuntimePtySpawnState } from './spawn-state'
+
+/** Record the settled grid for a runtime-path spawn; `result` is passed explicitly because the
+ *  adopted-claim branch commits before it returns early. */
+export function commitRuntimePtySize(
+  ctx: RuntimePtySpawnState,
+  result: RuntimePtySpawnState['result']
+): void {
+  commitAttachedPtySize({
+    result,
+    requested: { cols: ctx.args.cols, rows: ctx.args.rows },
+    cachedBeforeAttach: ctx.sessionSizeBeforeAttach,
+    reflowHeadlessTerminalToPtyGrid: ctx.deps.runtime?.reflowHeadlessTerminalToPtyGrid?.bind(
+      ctx.deps.runtime
+    )
+  })
+}
diff --git a/src/main/ipc/pty/runtime/spawn-commit.ts b/src/main/ipc/pty/runtime/spawn-commit.ts
index 23592604bea..7f8a9e38267 100644
--- a/src/main/ipc/pty/runtime/spawn-commit.ts
+++ b/src/main/ipc/pty/runtime/spawn-commit.ts
@@ -1,6 +1,7 @@
 import { isValidTerminalTabId } from '../../../../shared/terminal-tab-id'
 import { ptyOwnership, ptyIncarnationById, deletePtyOwnership } from '../provider/ownership-state'
 import { ptySizes } from '../delivery/visibility-state'
+import { commitRuntimePtySize } from './spawn-commit-pty-size'
 import {
   shouldSkipCodexHomeEnvForWindowsShell,
   recordCodexPaneAccountForSpawn,
@@ -57,6 +58,9 @@ export async function commitRuntimePtySpawn(ctx: RuntimePtySpawnState) {
     })
   }
   if (ctx.result.agentSessionEnsure?.disposition === 'adopted') {
+    // Why: an adoption is an attach to a live owner by definition, but the SSH relay's adopted
+    // reply omits isReattach; derive it once so the size commit and the reservation agree.
+    const adoptedResult = { ...ctx.result, isReattach: true }
     const owner = ctx.result.agentSessionEnsure.owner
     ptyOwnership.set(ctx.result.id, args.connectionId ?? ptyOwnership.get(ctx.result.id) ?? null)
     ctx.deps.runtime?.registerPreAllocatedHandleForPty(ctx.result.id, owner.surface.terminalHandle)
@@ -86,13 +90,17 @@ export async function commitRuntimePtySpawn(ctx: RuntimePtySpawnState) {
         ...(ctx.env ? { launchEnv: ctx.env } : {})
       })
     }
+    // Why: this branch returns before the normal commit site; without this the cache keeps
+    // whatever the caller requested.
+    commitRuntimePtySize(ctx, adoptedResult)
     // Why: the adopted branch returns before the normal settle site, so the
     // reservation must be resolved here or every later spawn for this pane
     // awaits a promise that never settles.
-    resolvePaneSpawnReservation(ctx.paneSpawnReservationKey, ctx.paneSpawnReservation, {
-      ...ctx.result,
-      isReattach: true
-    })
+    resolvePaneSpawnReservation(
+      ctx.paneSpawnReservationKey,
+      ctx.paneSpawnReservation,
+      adoptedResult
+    )
     return {
       id: ctx.result.id,
       ...(ctx.result.incarnationId ? { incarnationId: ctx.result.incarnationId } : {}),
@@ -125,7 +133,7 @@ export async function commitRuntimePtySpawn(ctx: RuntimePtySpawnState) {
   if (!ctx.hostSessionBinding) {
     persistSshLease()
   }
-  ptySizes.set(ctx.result.id, { cols: args.cols, rows: args.rows })
+  commitRuntimePtySize(ctx, ctx.result)
   if (ctx.effectiveSessionAppId !== undefined && ctx.effectiveSessionAppId !== ctx.result.id) {
     ptySizes.delete(ctx.effectiveSessionAppId)
   }
diff --git a/src/main/ipc/pty/runtime/spawn-options.ts b/src/main/ipc/pty/runtime/spawn-options.ts
index fcba7770a39..2e81bdeafdb 100644
--- a/src/main/ipc/pty/runtime/spawn-options.ts
+++ b/src/main/ipc/pty/runtime/spawn-options.ts
@@ -3,6 +3,7 @@ import { LocalPtyProvider } from '../../../providers/local-pty-provider'
 import { makePaneKey, isTerminalLeafId } from '../../../../shared/stable-pane-id'
 import { isValidTerminalTabId } from '../../../../shared/terminal-tab-id'
 import { ptySizes } from '../delivery/visibility-state'
+import { shouldSeedPreAttachPtySize } from '../delivery/attached-pty-size'
 import { CODEX_HOME_ENV_KEYS } from '../host-env/codex-home'
 import {
   mergePtyEnvDeletions,
@@ -110,7 +111,17 @@ export async function buildRuntimePtySpawnOptions(
     ctx.effectiveSessionAppId !== undefined ? ptySizes.get(ctx.effectiveSessionAppId) : undefined
   if (ctx.sessionId !== undefined) {
     ctx.spawnOptions.sessionId = ctx.sessionId
-    ptySizes.set(ctx.effectiveSessionAppId ?? ctx.sessionId, { cols: args.cols, rows: args.rows })
+    if (
+      shouldSeedPreAttachPtySize({
+        isFreshSessionId: ctx.isNewDaemonSession,
+        hasCachedSize: ctx.hadSessionSizeBeforeAttach,
+        // Why false: runtime callers (CLI, headless serve) have no hidden pane to report, so a
+        // cached size is the only source that can outrank their requested grid here.
+        requestIsUnmeasured: false
+      })
+    ) {
+      ptySizes.set(ctx.effectiveSessionAppId ?? ctx.sessionId, { cols: args.cols, rows: args.rows })
+    }
   }
   ctx.materializedPaneKey = ctx.hostSessionBinding
     ? makePaneKey(ctx.hostSessionBinding.tabId, ctx.hostSessionBinding.leafId)
diff --git a/src/main/ipc/pty/runtime/spawn-preflight.ts b/src/main/ipc/pty/runtime/spawn-preflight.ts
index aed89b44df8..43fd2778119 100644
--- a/src/main/ipc/pty/runtime/spawn-preflight.ts
+++ b/src/main/ipc/pty/runtime/spawn-preflight.ts
@@ -23,7 +23,11 @@ import {
 import { stripRemotePaneEnvWhenHooksDisabled } from '../provider/liveness'
 import { isTuiAgent } from '../../../../shared/tui-agent-config'
 import { isClaudeAuthSwitchInProgress } from '../../../claude-accounts/live-pty-gate'
-import { hasClaudeAuthEnvConflict } from '../../../claude-accounts/environment'
+import {
+  CLAUDE_AUTH_ENV_CONFLICT_MESSAGE,
+  CLAUDE_AUTH_SWITCH_IN_PROGRESS_MESSAGE,
+  hasClaudeAuthEnvConflict
+} from '../../../claude-accounts/environment'
 import {
   isSafePtySessionId,
   mintPtySessionId,
@@ -65,7 +69,7 @@ export async function prepareRuntimePtySpawn(
   ctx.isClaudeLaunch =
     !ctx.preAdoptedStablePane && !args.connectionId && isClaudeLaunchCommand(args.command)
   if (ctx.isClaudeLaunch && isClaudeAuthSwitchInProgress()) {
-    throw new Error('A Claude account switch is in progress. Try again after it finishes.')
+    throw new Error(CLAUDE_AUTH_SWITCH_IN_PROGRESS_MESSAGE)
   }
   // Why: runtime-created terminals carry no renderer-computed projectRuntime; resolve from worktreeId to honor the project's Windows runtime.
   ctx.terminalRuntimeOptions =
@@ -134,12 +138,10 @@ export async function prepareRuntimePtySpawn(
       ? await ctx.deps.prepareClaudeAuth(ctx.codexSelectionTarget)
       : null
   if (ctx.isClaudeLaunch && isClaudeAuthSwitchInProgress()) {
-    throw new Error('A Claude account switch is in progress. Try again after it finishes.')
+    throw new Error(CLAUDE_AUTH_SWITCH_IN_PROGRESS_MESSAGE)
   }
   if (ctx.claudeAuth?.stripAuthEnv && hasClaudeAuthEnvConflict(args.env)) {
-    throw new Error(
-      'This Claude launch defines explicit Anthropic auth environment variables. Remove those overrides before using a managed Claude account.'
-    )
+    throw new Error(CLAUDE_AUTH_ENV_CONFLICT_MESSAGE)
   }
 
   ctx.shouldPersistHostSessionBinding = args.persistHostSessionBinding === true
diff --git a/src/main/ipc/runtime.test.ts b/src/main/ipc/runtime.test.ts
index dc7f8a01cd7..07010087363 100644
--- a/src/main/ipc/runtime.test.ts
+++ b/src/main/ipc/runtime.test.ts
@@ -136,6 +136,40 @@ describe('registerRuntimeHandlers', () => {
     })
   })
 
+  it('projects Claude structured tabs to the same-version desktop client', async () => {
+    const claudeTab = {
+      type: 'agent-session',
+      id: 'agent-session:claude-1',
+      title: 'Claude Chat',
+      sessionId: 'claude-1',
+      agent: 'claude',
+      isActive: true
+    }
+    const runtime = {
+      getRuntimeId: vi.fn().mockReturnValue('runtime-1'),
+      restoreStructuredAgentSessionTabs: vi.fn(async () => undefined),
+      listMobileSessionTabs: vi.fn(async () => ({
+        worktree: 'workspace-1',
+        publicationEpoch: 'epoch-1',
+        snapshotVersion: 1,
+        activeGroupId: 'group-1',
+        activeTabId: claudeTab.id,
+        activeTabType: 'agent-session',
+        tabGroups: [{ id: 'group-1', activeTabId: claudeTab.id, tabOrder: [claudeTab.id] }],
+        tabs: [claudeTab]
+      }))
+    }
+
+    registerRuntimeHandlers(runtime as never)
+    const callRegistration = handleMock.mock.calls.find(([channel]) => channel === 'runtime:call')
+    const result = await callRegistration![1](runtimeCallEvent(), {
+      method: 'session.tabs.list',
+      params: { worktree: 'id:workspace-1' }
+    })
+
+    expect(result).toMatchObject({ ok: true, result: { tabs: [claudeTab] } })
+  })
+
   it('registers project group runtime RPC methods for local desktop callers', async () => {
     const runtime = {
       syncWindowGraph: vi.fn(),
diff --git a/src/main/ipc/runtime.ts b/src/main/ipc/runtime.ts
index 901d14bfce6..3901d8b1ffa 100644
--- a/src/main/ipc/runtime.ts
+++ b/src/main/ipc/runtime.ts
@@ -10,7 +10,10 @@ import type {
 import type { RuntimeRpcResponse } from '../../shared/runtime-rpc-envelope'
 import type { ClientHostedBrowserRowsEvent } from '../../shared/client-hosted-browser-rows'
 import { TERMINAL_FIT_RESTORE_DEADLINE_MS } from '../../shared/terminal-fit-restore-deadline'
-import { STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY } from '../../shared/protocol-version'
+import {
+  CLAUDE_STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY,
+  STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY
+} from '../../shared/protocol-version'
 import { RpcDispatcher } from '../runtime/rpc/dispatcher'
 import { ALL_RPC_METHODS } from '../runtime/rpc/methods'
 import { DesktopRuntimeSenderLifecycle } from './desktop-runtime-sender-lifecycle'
@@ -76,7 +79,10 @@ export function registerRuntimeHandlers(runtime: OrcaRuntimeService): void {
           clientId: 'desktop-renderer',
           clientKind: 'runtime',
           connectionId: desktopSenders.connectionIdFor(event.sender),
-          clientCapabilities: [STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY]
+          clientCapabilities: [
+            STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY,
+            CLAUDE_STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY
+          ]
         }
       )) as RuntimeRpcResponse<unknown>
     }
@@ -121,7 +127,10 @@ export function registerRuntimeHandlers(runtime: OrcaRuntimeService): void {
             clientId: 'desktop-renderer',
             clientKind: 'runtime',
             connectionId,
-            clientCapabilities: [STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY]
+            clientCapabilities: [
+              STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY,
+              CLAUDE_STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY
+            ]
           }
         )
         .finally(stop)
diff --git a/src/main/ipc/worktree-logic-wsl.test.ts b/src/main/ipc/worktree-logic-wsl.test.ts
index c30c387263e..c21c20e0050 100644
--- a/src/main/ipc/worktree-logic-wsl.test.ts
+++ b/src/main/ipc/worktree-logic-wsl.test.ts
@@ -16,6 +16,7 @@ vi.mock('../wsl', () => ({
 import {
   computeWorktreePath,
   computeWorktreePathAsync,
+  computeWorkspaceRootAsync,
   getWorktreePathSettings
 } from './worktree-logic'
 import {
@@ -32,6 +33,26 @@ describe('computeWorktreePath WSL layout', () => {
     parseWslPathMock.mockReset()
   })
 
+  it('reuses an asynchronously resolved root for every name candidate without a sync probe', async () => {
+    parseWslPathMock.mockReturnValue({ distro: 'Ubuntu', linuxPath: '/home/jin/repo' })
+    const repoPath = String.raw`\\wsl.localhost\Ubuntu\home\jin\repo`
+    const home = String.raw`\\wsl.localhost\Ubuntu\home\jin`
+    const settings = { workspaceDir: 'C:\\workspaces', nestWorkspaces: true }
+    let resolveHome!: (home: string) => void
+    getWslHomeAsyncMock.mockReturnValue(new Promise<string>((resolve) => (resolveHome = resolve)))
+    const pendingRoot = computeWorkspaceRootAsync(repoPath, settings)
+    expect(getWslHomeMock).not.toHaveBeenCalled()
+    resolveHome(home)
+    const root = await pendingRoot
+    for (const name of ['feature', 'feature-2', 'feature-3']) {
+      expect(computeWorktreePath(name, repoPath, settings, root)).toBe(
+        win32.join(home, 'orca', 'workspaces', 'repo', name)
+      )
+    }
+    expect(getWslHomeAsyncMock).toHaveBeenCalledExactlyOnceWith('Ubuntu')
+    expect(getWslHomeMock).not.toHaveBeenCalled()
+  })
+
   it('places WSL repo worktrees under the distro home workspace root', () => {
     parseWslPathMock.mockReturnValue({
       distro: 'Ubuntu',
diff --git a/src/main/ipc/worktree-logic.ts b/src/main/ipc/worktree-logic.ts
index 7a8fe175c89..744572f6e37 100644
--- a/src/main/ipc/worktree-logic.ts
+++ b/src/main/ipc/worktree-logic.ts
@@ -103,12 +103,13 @@ export function ensurePathWithinWorkspace(targetPath: string, workspaceDir: stri
 export function computeWorktreePath(
   sanitizedName: string,
   repoPath: string,
-  settings: WorktreePathSettings
+  settings: WorktreePathSettings,
+  workspaceRoot?: string
 ): string {
   return computeWorktreePathFromWorkspaceRoot(
     sanitizedName,
     repoPath,
-    computeWorkspaceRoot(repoPath, settings),
+    workspaceRoot ?? computeWorkspaceRoot(repoPath, settings),
     settings.nestWorkspaces
   )
 }
@@ -130,7 +131,7 @@ function computeWorktreePathFromWorkspaceRoot(
 }
 
 /** Async twin of computeWorktreePath. Same result; resolves the WSL home without blocking the main
- *  thread, so callers off the create path never freeze the app on a stopped distro. */
+ *  thread, so callers never freeze the app on a stopped distro. */
 export async function computeWorktreePathAsync(
   sanitizedName: string,
   repoPath: string,
@@ -147,7 +148,7 @@ export async function computeWorktreePathAsync(
 /** Async twin of computeWorkspaceRoot. Same result; the WSL home probe spawns `wsl.exe`, so
  *  background preparation uses this variant rather than blocking the Electron main thread for up
  *  to the probe timeout. The sync twin below still serves callers that cannot await (allowed-roots
- *  resolution, the create click, CLI create, watch targets, worktree trash). */
+ *  resolution, CLI create, watch targets, worktree trash). */
 export async function computeWorkspaceRootAsync(
   repoPath: string,
   settings: { workspaceDir: string; wslMirrorDistro?: string }
diff --git a/src/main/ipc/worktree-remote.ts b/src/main/ipc/worktree-remote.ts
index 27eaa9264db..ef65f2fcb53 100644
--- a/src/main/ipc/worktree-remote.ts
+++ b/src/main/ipc/worktree-remote.ts
@@ -87,7 +87,7 @@ import {
   computeValidatedBranchName,
   computeWorktreePath,
   computeRemoteWorktreePath,
-  computeWorkspaceRoot,
+  computeWorkspaceRootAsync,
   ensurePathWithinWorkspace,
   getWorktreeCreationLayout,
   getWorktreePathSettings,
@@ -2444,7 +2444,7 @@ export async function createLocalWorktree(
       emitCreateWorktreeProgress(mainWindow, 'fetching', args.creationId)
     }
   }
-  const workspaceRoot = computeWorkspaceRoot(repo.path, worktreePathSettings)
+  const workspaceRoot = await computeWorkspaceRootAsync(repo.path, worktreePathSettings)
 
   // Why: this validation doesn't depend on remote refs, so it can overlap a required remote-tracking base refresh.
   const primarySetupScript = getEffectiveHooks(repo)?.scripts.setup
@@ -2530,19 +2530,33 @@ export async function createLocalWorktree(
         username,
         localWorktreeGitOptions
       )
-      checkoutExistingBranch = await canCheckoutExistingLocalBranch(
-        repo.path,
-        branchName,
-        baseBranch,
-        localWorktreeGitOptions
-      )
-      if (checkoutExistingBranch && !selectedExistingLocalBranchName) {
-        // Why: suffix retries may need a new path, but an existing-branch checkout must keep the user-selected branch, not a sibling.
-        selectedExistingLocalBranchName = branchName
+      const tryExistingBranch = async (): Promise<boolean> => {
+        checkoutExistingBranch = await canCheckoutExistingLocalBranch(
+          repo.path,
+          branchName,
+          baseBranch,
+          localWorktreeGitOptions
+        )
+        return checkoutExistingBranch
       }
+      // Explicit branch selections retain the adoption-first path.
+      const preferExistingBranch = Boolean(
+        args.branchNameOverride || selectedExistingLocalBranchName
+      )
+      checkoutExistingBranch = preferExistingBranch && (await tryExistingBranch())
       lastBranchConflictKind = checkoutExistingBranch
         ? null
-        : await getBranchConflictKind(repo.path, branchName, baseBranch, localWorktreeGitOptions)
+        : await getBranchConflictKind(
+            repo.path,
+            branchName,
+            baseBranch,
+            localWorktreeGitOptions,
+            preferExistingBranch ? undefined : tryExistingBranch
+          )
+      if (checkoutExistingBranch && !selectedExistingLocalBranchName) {
+        // Path retries must retain the adopted branch.
+        selectedExistingLocalBranchName = branchName
+      }
       const allowedPushTargetRemoteConflict =
         lastBranchConflictKind &&
         isAllowedPushTargetRemoteConflict(lastBranchConflictKind, branchName, args)
@@ -2604,7 +2618,7 @@ export async function createLocalWorktree(
       }
 
       worktreePath = ensurePathWithinWorkspace(
-        computeWorktreePath(effectiveSanitizedName, repo.path, worktreePathSettings),
+        computeWorktreePath(effectiveSanitizedName, repo.path, worktreePathSettings, workspaceRoot),
         workspaceRoot
       )
       if (existsSync(worktreePath)) {
@@ -3010,6 +3024,8 @@ export async function createLocalWorktree(
     }
   })
 
+  // Startup resolves the new id before lifecycle notifications invalidate runtime caches.
+  runtime?.invalidateWorktreeCatalog?.(repo.id)
   const stagedStartup = await timing.time('spawn_startup_terminal', () =>
     spawnLocalStartupAndSetupTerminals({
       runtime,
diff --git a/src/main/ipc/worktrees-local-create-flow.test.ts b/src/main/ipc/worktrees-local-create-flow.test.ts
index abc711bbd9b..fc57c6969b6 100644
--- a/src/main/ipc/worktrees-local-create-flow.test.ts
+++ b/src/main/ipc/worktrees-local-create-flow.test.ts
@@ -2,6 +2,8 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { resolve } from 'node:path'
 import type { CreateWorktreeResult } from '../../shared/worktree/create-types'
 import { resolveRegisteredWorktreePath } from './registered-worktree-roots-cache'
+import { computeWorkspaceRootAsync } from './worktree-logic'
+import type * as WorktreeLogic from './worktree-logic'
 import {
   listWorktreesMock,
   describeCreatedWorktreeMock,
@@ -78,11 +80,13 @@ vi.mock('../setup-hook-env-vars', async (importOriginal) =>
     (await importOriginal()) as Record<string, unknown>
   )
 )
-vi.mock('./worktree-logic', async (importOriginal) =>
-  (await import('./worktrees-test-module-mocks')).worktreeLogicModuleMock(
-    (await importOriginal()) as Record<string, unknown>
-  )
-)
+vi.mock('./worktree-logic', async (importOriginal) => {
+  const actual = await importOriginal<typeof WorktreeLogic>()
+  return {
+    ...(await import('./worktrees-test-module-mocks')).worktreeLogicModuleMock(actual),
+    computeWorkspaceRootAsync: vi.fn(actual.computeWorkspaceRootAsync)
+  }
+})
 vi.mock('../terminal-history-deletion', async () =>
   (await import('./worktrees-test-module-mocks')).terminalHistoryDeletionModuleMock()
 )
@@ -409,15 +413,23 @@ describe('registerWorktreeHandlers', () => {
       }
     ])
 
-    await handlers['worktrees:create'](null, {
+    const root = Promise.withResolvers<string>()
+    vi.mocked(computeWorkspaceRootAsync).mockReturnValueOnce(root.promise)
+    const create = handlers['worktrees:create'](null, {
       repoId: 'repo-1',
       name: 'feature'
     })
 
-    expect(computeWorktreePathMock).toHaveBeenCalledWith('feature', '/workspace/repo', {
-      nestWorkspaces: false,
-      workspaceDir: '../worktrees'
-    })
+    await vi.waitFor(() => expect(computeWorkspaceRootAsync).toHaveBeenCalled())
+    expect(addWorktreeMock).not.toHaveBeenCalled()
+    root.resolve('/workspace/worktrees')
+    await create
+    expect(computeWorktreePathMock).toHaveBeenCalledWith(
+      'feature',
+      '/workspace/repo',
+      { nestWorkspaces: false, workspaceDir: '../worktrees' },
+      '/workspace/worktrees'
+    )
     expect(addWorktreeMock).toHaveBeenCalledWith(
       '/workspace/repo',
       '../worktrees/feature',
@@ -689,6 +701,10 @@ describe('registerWorktreeHandlers', () => {
     expect(setupCommand).toBe('bash /workspace/repo/.git/orca/setup-runner.sh')
     expect(result.setup).toBeUndefined()
     expect(result.startupTerminal).toEqual({ spawned: true, surface: 'visible' })
+    expect(runtimeStub.invalidateWorktreeCatalog).toHaveBeenCalledWith('repo-1')
+    expect(runtimeStub.invalidateWorktreeCatalog.mock.invocationCallOrder[0]).toBeLessThan(
+      runtimeStub.createTerminal.mock.invocationCallOrder[0]
+    )
     expect(result.timing?.phases.map((phase) => phase.phase)).toEqual(
       expect.arrayContaining([
         'git_worktree_add',
diff --git a/src/main/ipc/worktrees-test-module-mocks.ts b/src/main/ipc/worktrees-test-module-mocks.ts
index f31f6ae1dd6..8d2787fcf2f 100644
--- a/src/main/ipc/worktrees-test-module-mocks.ts
+++ b/src/main/ipc/worktrees-test-module-mocks.ts
@@ -1,4 +1,5 @@
 import { type Mock, vi } from 'vitest'
+import type { computeWorktreePath } from './worktree-logic'
 import type { HandlerMap } from './worktrees-test-ipc-surface'
 
 /** Loose signature: one mock stands in for many unrelated module exports. */
@@ -78,13 +79,7 @@ export const resolveSetupRunnerShellMock: ModuleMock = vi.fn()
 export const runHookMock: ModuleMock = vi.fn()
 export const hasHooksFileMock: ModuleMock = vi.fn()
 export const loadHooksMock: ModuleMock = vi.fn()
-export const computeWorktreePathMock: Mock<
-  (
-    sanitizedName: string,
-    repoPath: string,
-    settings: { nestWorkspaces: boolean; workspaceDir: string }
-  ) => string
-> = vi.fn()
+export const computeWorktreePathMock: Mock<typeof computeWorktreePath> = vi.fn()
 export const ensurePathWithinWorkspaceMock: StringArgMock = vi.fn()
 export const gitExecFileAsyncMock: GitArgvMock = vi.fn()
 export const getSshGitProviderMock: StringArgMock = vi.fn()
@@ -115,6 +110,7 @@ export const gitWorktreeModuleMock = () => ({
   listWorktrees: listWorktreesMock,
   listWorktreesStrict: listWorktreesMock,
   listWorktreesSharedStrict: listWorktreesMock,
+  listWorktreesSharedStrictAllowingTrueEmpty: listWorktreesMock,
   describeCreatedWorktree: describeCreatedWorktreeMock,
   parseWorktreeList: parseWorktreeListMock,
   assertWorktreeCleanForRemoval: assertWorktreeCleanForRemovalMock,
@@ -137,7 +133,19 @@ export const gitRepoModuleMock = () => ({
   resolveDefaultBaseRefWithLocalGit: resolveDefaultBaseRefWithLocalGitMock,
   resolveDefaultBaseRefViaExec: resolveDefaultBaseRefViaExecMock,
   getDefaultRemote: getDefaultRemoteMock,
-  getBranchConflictKind: getBranchConflictKindMock
+  getBranchConflictKind: async (
+    repoPath: string,
+    branch: string,
+    base?: string,
+    options?: { wslDistro?: string },
+    allowLocalBranch?: () => Promise<boolean>
+  ) => {
+    // These handler tests stub ref presence; policy tests cover the absent-ref fast path.
+    if (allowLocalBranch && (await allowLocalBranch())) {
+      return null
+    }
+    return getBranchConflictKindMock(repoPath, branch, base, options)
+  }
 })
 
 export const githubClientModuleMock = () => ({
diff --git a/src/main/ipc/worktrees-test-runtime-stub.ts b/src/main/ipc/worktrees-test-runtime-stub.ts
index 647d4801d13..bb2f33cb05e 100644
--- a/src/main/ipc/worktrees-test-runtime-stub.ts
+++ b/src/main/ipc/worktrees-test-runtime-stub.ts
@@ -12,6 +12,7 @@ export type WorktreeRuntimeStub = {
   clearOptimisticReconcileToken: ReturnType<typeof vi.fn>
   resolveManagedMrBase: ReturnType<typeof vi.fn>
   createTerminal: ReturnType<typeof vi.fn>
+  invalidateWorktreeCatalog: ReturnType<typeof vi.fn>
   splitTerminal: ReturnType<typeof vi.fn>
   notifyWorktreesChangedForRemoteClients: ReturnType<typeof vi.fn>
   closeFileWatchersForRemoval: ReturnType<typeof vi.fn>
@@ -38,6 +39,7 @@ export function createWorktreeRuntimeStub(): WorktreeRuntimeStub {
       title: null,
       surface: 'visible'
     }),
+    invalidateWorktreeCatalog: vi.fn(),
     splitTerminal: vi.fn().mockResolvedValue({
       handle: 'term-setup',
       tabId: 'tab-startup',
diff --git a/src/main/ipc/worktrees-windows.test.ts b/src/main/ipc/worktrees-windows.test.ts
index 4d4115264a3..7a54200d9f8 100644
--- a/src/main/ipc/worktrees-windows.test.ts
+++ b/src/main/ipc/worktrees-windows.test.ts
@@ -74,6 +74,7 @@ vi.mock('../git/worktree', () => ({
   listWorktrees: listWorktreesMock,
   listWorktreesStrict: listWorktreesMock,
   listWorktreesSharedStrict: listWorktreesMock,
+  listWorktreesSharedStrictAllowingTrueEmpty: listWorktreesMock,
   describeCreatedWorktree: vi.fn().mockResolvedValue(undefined),
   assertWorktreeCleanForRemoval: assertWorktreeCleanForRemovalMock,
   addWorktree: addWorktreeMock,
diff --git a/src/main/ipc/worktrees/create/register-worktree-prefetch-handler.ts b/src/main/ipc/worktrees/create/register-worktree-prefetch-handler.ts
index 2f1ab7abad9..c1bcbbf3d59 100644
--- a/src/main/ipc/worktrees/create/register-worktree-prefetch-handler.ts
+++ b/src/main/ipc/worktrees/create/register-worktree-prefetch-handler.ts
@@ -15,15 +15,13 @@ export function registerWorktreePrefetchHandler(context: WorktreeIpcContext): vo
         return
       }
       try {
-        const baseBranch = await prefetchWorktreeCreateBase({
+        await prefetchWorktreeCreateBase({
           repo,
           baseBranch: args.baseBranch,
           runtime,
-          gitOptions: getWorktreeCreatePrefetchGitOptions(store, repo)
+          gitOptions: getWorktreeCreatePrefetchGitOptions(store, repo),
+          prepareCheckout: (base) => prepareWorktreeCreateForRepo(store, repo, base)
         })
-        if (baseBranch) {
-          await prepareWorktreeCreateForRepo(store, repo, baseBranch)
-        }
       } catch {
         // Why: optimistic warm-up; the real create path awaits the same refresh and reports failures there.
       }
diff --git a/src/main/ipc/worktrees/listing/detected-provider-listing.ts b/src/main/ipc/worktrees/listing/detected-provider-listing.ts
index 25c08d262fb..ec5e7606e45 100644
--- a/src/main/ipc/worktrees/listing/detected-provider-listing.ts
+++ b/src/main/ipc/worktrees/listing/detected-provider-listing.ts
@@ -25,9 +25,12 @@ import {
   type DetectedWorktreeMetadataPrune,
   type DetectedWorktreeSideEffectToken
 } from './detected-worktree-scan-cache'
-import { loggedWorktreeListFailures, warnOnce } from './worktree-listing-diagnostics'
-import { readAllWorktreeMetaForHost } from '../../../persistence/host-qualified-worktree-meta'
-import { getRepoExecutionHostId } from '../../../../shared/execution-host'
+import {
+  describeWorktreeScanFailure,
+  loggedWorktreeListFailures,
+  warnOnce
+} from './worktree-listing-diagnostics'
+import { readAllWorktreeMetaForRepo } from '../../../persistence/host-qualified-worktree-meta'
 
 export async function listDetectedWorktreesForCapturedRepo(
   store: Store,
@@ -40,9 +43,7 @@ export async function listDetectedWorktreesForCapturedRepo(
     providerAbort?.signal.aborted
       ? ({ providerAbortStatus: providerAbort.status() } as const)
       : undefined
-  const allMeta = isFolderRepo(repo)
-    ? undefined
-    : readAllWorktreeMetaForHost(store, getRepoExecutionHostId(repo))
+  const allMeta = isFolderRepo(repo) ? undefined : readAllWorktreeMetaForRepo(store, repo)
   // Why: only the disconnected fallbacks read this, so keep parseWorktreeId over the whole host snapshot
   // off the connected path entirely.
   let cachedSshWorktreeMetaIndex: SshWorktreeMetaIndex | undefined
@@ -160,16 +161,25 @@ export async function listDetectedWorktreesForCapturedRepo(
       `[worktrees] failed to list detected worktrees for repo "${repo.displayName}" (${repo.id}) at ${repo.path}`,
       err
     )
+    // Why: retention alone leaves inert rows with no explanation; the cause rides with the listing.
+    const unavailableReason = describeWorktreeScanFailure(err)
     if (repo.connectionId) {
       const worktrees = listDisconnectedSshWorktrees(store, repo, sshWorktreeMetaIndex())
       return {
         repoId: repo.id,
         authoritative: false,
         source: 'metadata-fallback',
-        worktrees: buildDisconnectedDetectedWorktrees(store, repo, worktrees)
+        worktrees: buildDisconnectedDetectedWorktrees(store, repo, worktrees),
+        unavailableReason
       }
     }
-    return { repoId: repo.id, authoritative: false, source: 'metadata-fallback', worktrees: [] }
+    return {
+      repoId: repo.id,
+      authoritative: false,
+      source: 'metadata-fallback',
+      worktrees: [],
+      unavailableReason
+    }
   }
 }
 
diff --git a/src/main/ipc/worktrees/listing/detected-scan-failure-authority.test.ts b/src/main/ipc/worktrees/listing/detected-scan-failure-authority.test.ts
new file mode 100644
index 00000000000..4e436b8dcf1
--- /dev/null
+++ b/src/main/ipc/worktrees/listing/detected-scan-failure-authority.test.ts
@@ -0,0 +1,166 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { Repo } from '../../../../shared/repo-types'
+import type { DetectedWorktreeListResult } from '../../../../shared/worktree/types'
+
+const gitExecFileAsyncMock = vi.hoisted(() => vi.fn())
+
+vi.mock('electron', () => ({
+  ipcMain: { handle: vi.fn(), removeHandler: vi.fn() },
+  app: { getPath: () => '/tmp/orca-test' }
+}))
+vi.mock('../../../git/runner', async (importOriginal) => ({
+  ...(await importOriginal<Record<string, unknown>>()),
+  gitExecFileAsync: gitExecFileAsyncMock
+}))
+
+const { listDetectedWorktreesForCapturedRepo } = await import('./detected-provider-listing')
+const { __resetDetectedWorktreeScanCacheForTests } = await import('./detected-worktree-scan-cache')
+const { _resetWorktreeScanCacheForTests } = await import('../../../git/worktree-scan-cache')
+const { isRegisteredWorktreePath, invalidateAuthorizedRootsCache } =
+  await import('../../registered-worktree-roots-cache')
+
+const REPO_PATH = '/workspace/repo'
+const repo = {
+  id: 'repo-1',
+  path: REPO_PATH,
+  displayName: 'repo',
+  badgeColor: '#000',
+  addedAt: 0
+} as Repo
+
+const removeWorktreeLineage = vi.fn()
+
+function createStore() {
+  return {
+    getRepo: () => repo,
+    getRepos: () => [repo],
+    getProjects: () => [],
+    getSettings: () => ({}),
+    getAllWorktreeMeta: () => ({}),
+    getProjectHostSetups: () => [],
+    getWorktreeMeta: () => undefined,
+    setWorktreeMeta: vi.fn(),
+    getAllWorktreeLineage: () => ({}),
+    getAllWorkspaceLineage: () => ({}),
+    removeWorktreeLineage,
+    captureNativeLocalWorktreeMetadataScanExpectation: () => undefined
+  } as never
+}
+
+/** The field failure: wsl.exe exits 0xFFFFFFFF, says nothing on stderr, and git never ran. */
+function wslHostFailure(): Error {
+  return Object.assign(new Error('Command failed: wsl.exe -d kali-linux --exec sh -lc ...'), {
+    code: 4294967295,
+    stdout: 'Error code: Wsl/Service/WSL_E_DISTRO_NOT_FOUND\r\n',
+    stderr: ''
+  })
+}
+
+async function listDetected(): Promise<DetectedWorktreeListResult> {
+  const result = await listDetectedWorktreesForCapturedRepo(createStore(), repo, () => true)
+  return result as DetectedWorktreeListResult
+}
+
+describe('detected worktree listing authority', () => {
+  beforeEach(() => {
+    gitExecFileAsyncMock.mockReset()
+    removeWorktreeLineage.mockReset()
+    __resetDetectedWorktreeScanCacheForTests()
+    _resetWorktreeScanCacheForTests()
+    invalidateAuthorizedRootsCache()
+  })
+
+  it('reports a failed scan as non-authoritative and prunes nothing', async () => {
+    gitExecFileAsyncMock.mockRejectedValue(wslHostFailure())
+
+    const result = await listDetected()
+
+    expect(result.authoritative).toBe(false)
+    expect(result.source).toBe('metadata-fallback')
+    expect(result.worktrees).toEqual([])
+    // Why: the retained rows must carry the cause, or the user sees inert worktrees with no explanation.
+    expect(result.unavailableReason).toContain('Command failed: wsl.exe')
+    // The destructive halves of a fresh scan must not run against a listing that failed.
+    expect(isRegisteredWorktreePath(REPO_PATH)).toBe(false)
+    expect(removeWorktreeLineage).not.toHaveBeenCalled()
+  })
+
+  it('surfaces the annotated wsl.exe diagnostic as the unavailable reason', async () => {
+    gitExecFileAsyncMock.mockRejectedValue(
+      Object.assign(
+        new Error(
+          'wsl.exe host failure (distro "kali-linux"): There is no distribution with the supplied name.\r\nError code: Wsl/Service/WSL_E_DISTRO_NOT_FOUND\nCommand failed: wsl.exe -d kali-linux --exec sh -lc ...'
+        ),
+        { code: 4294967295, stdout: '', stderr: '' }
+      )
+    )
+
+    const result = await listDetected()
+
+    expect(result.authoritative).toBe(false)
+    expect(result.unavailableReason).toBe(
+      'wsl.exe host failure (distro "kali-linux"): There is no distribution with the supplied name. Error code: Wsl/Service/WSL_E_DISTRO_NOT_FOUND'
+    )
+  })
+
+  // Why (measured on a real Windows host): under WSL the spawn cwd is the interop directory, so a
+  // deleted guest repo fails as `bash: cd` exit 1 — not ENOENT — and must stay retained, not pruned.
+  it('retains a WSL repo whose guest directory is gone, and says why', async () => {
+    gitExecFileAsyncMock.mockRejectedValue(
+      Object.assign(new Error('bash: line 1: cd: /home/neil/repo: No such file or directory'), {
+        code: 1,
+        stdout: '',
+        stderr: 'bash: line 1: cd: /home/neil/repo: No such file or directory\n'
+      })
+    )
+
+    const result = await listDetected()
+
+    expect(result.authoritative).toBe(false)
+    expect(result.unavailableReason).toContain('No such file or directory')
+    expect(isRegisteredWorktreePath(REPO_PATH)).toBe(false)
+    expect(removeWorktreeLineage).not.toHaveBeenCalled()
+  })
+
+  it('keeps an empty listing authoritative when the path is not a Git repo', async () => {
+    gitExecFileAsyncMock.mockRejectedValue(
+      Object.assign(new Error('Command failed: git worktree list'), {
+        code: 128,
+        stderr: 'fatal: not a git repository (or any of the parent directories): .git\n'
+      })
+    )
+
+    const result = await listDetected()
+
+    expect(result.authoritative).toBe(true)
+    expect(result.source).toBe('git')
+    expect(result.worktrees).toEqual([])
+    expect(result.unavailableReason).toBeUndefined()
+    expect(isRegisteredWorktreePath(REPO_PATH)).toBe(true)
+  })
+
+  it('keeps an empty listing authoritative when the repo path is gone', async () => {
+    gitExecFileAsyncMock.mockRejectedValue(
+      Object.assign(new Error('spawn git ENOENT'), { code: 'ENOENT', stderr: '' })
+    )
+
+    const result = await listDetected()
+
+    expect(result.authoritative).toBe(true)
+    expect(result.source).toBe('git')
+    expect(result.worktrees).toEqual([])
+  })
+
+  it('stays authoritative for a healthy scan', async () => {
+    gitExecFileAsyncMock.mockResolvedValue({
+      stdout: `worktree ${REPO_PATH}\u0000HEAD abc\u0000branch refs/heads/main\u0000\u0000`,
+      stderr: ''
+    })
+
+    const result = await listDetected()
+
+    expect(result.authoritative).toBe(true)
+    expect(result.worktrees.map((worktree) => worktree.path)).toEqual([REPO_PATH])
+    expect(isRegisteredWorktreePath(REPO_PATH)).toBe(true)
+  })
+})
diff --git a/src/main/ipc/worktrees/listing/detected-worktree-scan-cache.ts b/src/main/ipc/worktrees/listing/detected-worktree-scan-cache.ts
index b694bfbf11d..09b0156cb54 100644
--- a/src/main/ipc/worktrees/listing/detected-worktree-scan-cache.ts
+++ b/src/main/ipc/worktrees/listing/detected-worktree-scan-cache.ts
@@ -3,7 +3,7 @@ import type { Store } from '../../../persistence/loading-store/store'
 import type { Repo } from '../../../../shared/repo-types'
 import { getLocalProjectWorktreeGitOptions } from '../../../project-runtime-git-options'
 import { isFolderRepo } from '../../../../shared/repo-kind'
-import { listRepoWorktrees } from '../../../repo-worktrees'
+import { listRepoWorktreesForDetectedScan } from '../../../repo-worktrees'
 import {
   getRegisteredWorktreeRootsRevision,
   registerWorktreeRootsForRepo
@@ -111,7 +111,7 @@ export async function listDetectedGitWorktrees(
   const localWorktreeGitOptions = getLocalProjectWorktreeGitOptions(store, repo)
   if (repo.connectionId || isFolderRepo(repo)) {
     return {
-      gitWorktrees: await listRepoWorktrees(repo, localWorktreeGitOptions),
+      gitWorktrees: await listRepoWorktreesForDetectedScan(repo, localWorktreeGitOptions),
       fresh: true
     }
   }
@@ -144,7 +144,7 @@ export async function listDetectedGitWorktrees(
       : undefined
   const scan: DetectedWorktreeScan = {
     invalidated: false,
-    promise: listRepoWorktrees(repo, localWorktreeGitOptions),
+    promise: listRepoWorktreesForDetectedScan(repo, localWorktreeGitOptions),
     sideEffectToken: { generation, authorizedRootsRevision },
     hygieneDue,
     ...(metadataPruneExpectation
diff --git a/src/main/ipc/worktrees/listing/detected-worktree-scan-hygiene-gate.test.ts b/src/main/ipc/worktrees/listing/detected-worktree-scan-hygiene-gate.test.ts
index cb8c48833ef..655cca4fa77 100644
--- a/src/main/ipc/worktrees/listing/detected-worktree-scan-hygiene-gate.test.ts
+++ b/src/main/ipc/worktrees/listing/detected-worktree-scan-hygiene-gate.test.ts
@@ -10,7 +10,9 @@ const { listRepoWorktreesMock, pruneLineageMock, pruneMetadataMock, registerWork
     registerWorktreeRootsMock: vi.fn()
   }))
 
-vi.mock('../../../repo-worktrees', () => ({ listRepoWorktrees: listRepoWorktreesMock }))
+vi.mock('../../../repo-worktrees', () => ({
+  listRepoWorktreesForDetectedScan: listRepoWorktreesMock
+}))
 vi.mock('../../../project-runtime-git-options', () => ({
   getLocalProjectWorktreeGitOptions: () => ({})
 }))
diff --git a/src/main/ipc/worktrees/listing/register-worktree-catalog-handlers.ts b/src/main/ipc/worktrees/listing/register-worktree-catalog-handlers.ts
index d684461a381..4f3055c63a2 100644
--- a/src/main/ipc/worktrees/listing/register-worktree-catalog-handlers.ts
+++ b/src/main/ipc/worktrees/listing/register-worktree-catalog-handlers.ts
@@ -23,7 +23,10 @@ import {
   warnOnce
 } from './worktree-listing-diagnostics'
 import type { WorktreeIpcContext } from '../worktree-ipc-context'
-import { readAllWorktreeMetaForHost } from '../../../persistence/host-qualified-worktree-meta'
+import {
+  readAllWorktreeMetaForHost,
+  readAllWorktreeMetaForRepo
+} from '../../../persistence/host-qualified-worktree-meta'
 import type { WorktreeMeta } from '../../../../shared/worktree/meta-types'
 
 const WORKTREE_LIST_ALL_CONCURRENCY = 8
@@ -174,9 +177,7 @@ export function registerWorktreeCatalogHandlers(context: WorktreeIpcContext): vo
     if (!repo) {
       return []
     }
-    const allMeta = repo.connectionId
-      ? readAllWorktreeMetaForHost(store, getRepoExecutionHostId(repo))
-      : undefined
+    const allMeta = repo.connectionId ? readAllWorktreeMetaForRepo(store, repo) : undefined
     const sshWorktreeMetaIndex = repo.connectionId
       ? createSshWorktreeMetaIndex(Object.entries(allMeta ?? {}))
       : new Map()
@@ -226,7 +227,7 @@ export function registerWorktreeCatalogHandlers(context: WorktreeIpcContext): vo
         })
       }
       loggedWorktreeListFailures.delete(`${repo.id}:${repo.path}`)
-      const metadata = allMeta ?? readAllWorktreeMetaForHost(store, getRepoExecutionHostId(repo))
+      const metadata = allMeta ?? readAllWorktreeMetaForRepo(store, repo)
       return buildDetectedGitWorktrees(store, repo, gitWorktrees, metadata)
         .filter((worktree) => worktree.visible)
         .map((worktree) => stampAndMergeVisibleDetectedWorktree(store, repo, worktree, metadata))
diff --git a/src/main/ipc/worktrees/listing/ssh-worktree-fallback.ts b/src/main/ipc/worktrees/listing/ssh-worktree-fallback.ts
index 5c734d8bcd9..ecf8ab3abc1 100644
--- a/src/main/ipc/worktrees/listing/ssh-worktree-fallback.ts
+++ b/src/main/ipc/worktrees/listing/ssh-worktree-fallback.ts
@@ -9,7 +9,7 @@ import type { GitWorktreeInfo, DetectedWorktree, Worktree } from '../../../../sh
 import type { Store } from '../../../persistence/loading-store/store'
 import { getRepoExecutionHostId } from '../../../../shared/execution-host'
 import {
-  readWorktreeMetaForHost,
+  readWorktreeMetaForRepo,
   writeWorktreeMetaForHost
 } from '../../../persistence/host-qualified-worktree-meta'
 import { getRepoOwnedWorktreeMeta } from '../../../worktree-metadata-ownership'
@@ -159,7 +159,7 @@ export function buildDetectedGitWorktrees(
     const legacyMeta = allMeta === undefined ? store.getWorktreeMeta?.(worktreeId) : undefined
     const metaById = allMeta ?? (legacyMeta ? { [worktreeId]: legacyMeta } : {})
     const meta =
-      readWorktreeMetaForHost(store, worktreeId, getRepoExecutionHostId(repo)) ??
+      readWorktreeMetaForRepo(store, worktreeId, repo) ??
       getRepoOwnedWorktreeMeta(repo, worktreeId, metaById, repoOwnerCount)
     const worktree = mergeWorktree(repo.id, gitWorktree, meta, repo.displayName)
     const detected = toDetectedWorktree({
diff --git a/src/main/ipc/worktrees/listing/worktree-discovery-metadata.ts b/src/main/ipc/worktrees/listing/worktree-discovery-metadata.ts
index b17677ddfcc..3edb8efc1d7 100644
--- a/src/main/ipc/worktrees/listing/worktree-discovery-metadata.ts
+++ b/src/main/ipc/worktrees/listing/worktree-discovery-metadata.ts
@@ -4,7 +4,7 @@ import type { WorktreeMeta } from '../../../../shared/worktree/meta-types'
 import { getProjectHostSetupWorktreeMeta } from '../../../../shared/project-host-setup-lookup'
 import { getRepoExecutionHostId } from '../../../../shared/execution-host'
 import {
-  readWorktreeMetaForHost,
+  readWorktreeMetaForRepo,
   writeWorktreeMetaForHost
 } from '../../../persistence/host-qualified-worktree-meta'
 import { getRepoOwnedWorktreeMeta } from '../../../worktree-metadata-ownership'
@@ -44,7 +44,7 @@ export function resolveWorktreeMetaWithDiscoveryBackfill(
   // Why: the locator-keyed row is only a stand-in for a missing snapshot, so don't read it when we have one.
   const legacyMeta = allMeta === undefined ? store.getWorktreeMeta?.(worktreeId) : undefined
   const existing =
-    readWorktreeMetaForHost(store, worktreeId, executionHostId) ??
+    readWorktreeMetaForRepo(store, worktreeId, repo) ??
     getRepoOwnedWorktreeMeta(
       repo,
       worktreeId,
diff --git a/src/main/ipc/worktrees/listing/worktree-listing-diagnostics.ts b/src/main/ipc/worktrees/listing/worktree-listing-diagnostics.ts
index 128bb46dd28..56bbe5d4ad2 100644
--- a/src/main/ipc/worktrees/listing/worktree-listing-diagnostics.ts
+++ b/src/main/ipc/worktrees/listing/worktree-listing-diagnostics.ts
@@ -14,3 +14,23 @@ export function warnOnce(keySet: Set<string>, key: string, message: string, erro
     console.warn(message)
   }
 }
+
+const SCAN_FAILURE_REASON_MAX_CHARS = 240
+
+/**
+ * The cause a retained-but-unscannable repo shows the user. The first two lines carry the
+ * classifier's summary plus its `Wsl/Service/WSL_E_*` code; everything after is the raw command.
+ */
+export function describeWorktreeScanFailure(error: unknown): string {
+  const message = error instanceof Error ? error.message : String(error)
+  const summary = message
+    .split(/\r?\n/)
+    .map((line) => line.trim())
+    .filter((line) => line.length > 0)
+    .slice(0, 2)
+    .join(' ')
+  const reason = summary.length > 0 ? summary : 'Worktree scan failed with no diagnostic.'
+  return reason.length > SCAN_FAILURE_REASON_MAX_CHARS
+    ? `${reason.slice(0, SCAN_FAILURE_REASON_MAX_CHARS - 1)}…`
+    : reason
+}
diff --git a/src/main/jira/attachment-image-cache-generation.test.ts b/src/main/jira/attachment-image-cache-generation.test.ts
new file mode 100644
index 00000000000..e92ca5c5a53
--- /dev/null
+++ b/src/main/jira/attachment-image-cache-generation.test.ts
@@ -0,0 +1,57 @@
+import { beforeEach, describe, expect, it } from 'vitest'
+import {
+  _resetAttachmentImageCache,
+  clearAttachmentImagesForSite,
+  getCachedAttachmentDataUrl,
+  loadAttachmentDataUrlWithCache
+} from './attachment-image-cache'
+
+type Image = { dataUrl: string; byteSize: number } | null
+function deferredImage() {
+  let resolve!: (image: Image) => void
+  let reject!: (error: Error) => void
+  const promise = new Promise<Image>((done, fail) => {
+    resolve = done
+    reject = fail
+  })
+  return { promise, resolve, reject }
+}
+
+beforeEach(_resetAttachmentImageCache)
+
+describe.each(['site', 'all'] as const)('attachment download after clearing %s', (scope) => {
+  it.each(['success', 'empty', 'failure'] as const)(
+    'keeps the replacement singleflight when the old download completes with %s',
+    async (outcome) => {
+      const old = deferredImage()
+      const replacement = deferredImage()
+      let downloads = 0
+      const load = () => {
+        downloads += 1
+        return downloads === 1 ? old.promise : replacement.promise
+      }
+      const args = { siteId: 'site-a', attachmentId: 'image-1', load }
+      const first = loadAttachmentDataUrlWithCache(args).catch(() => 'old failure')
+      clearAttachmentImagesForSite(scope === 'site' ? 'site-a' : undefined)
+      const second = loadAttachmentDataUrlWithCache(args)
+      expect(downloads).toBe(2)
+
+      if (outcome === 'failure') {
+        old.reject(new Error('old failure'))
+      } else {
+        old.resolve(outcome === 'empty' ? null : { dataUrl: 'old image', byteSize: 3 })
+      }
+      expect(await first).toBe(
+        outcome === 'failure' ? 'old failure' : outcome === 'empty' ? null : 'old image'
+      )
+      expect(getCachedAttachmentDataUrl('site-a', 'image-1')).toBeNull()
+
+      const third = loadAttachmentDataUrlWithCache(args)
+      expect(downloads).toBe(2)
+      replacement.resolve({ dataUrl: 'new image', byteSize: 3 })
+      expect(await second).toBe('new image')
+      expect(await third).toBe('new image')
+      expect(getCachedAttachmentDataUrl('site-a', 'image-1')).toBe('new image')
+    }
+  )
+})
diff --git a/src/main/jira/attachment-image-cache.ts b/src/main/jira/attachment-image-cache.ts
index f9fdbfe3f7d..9d118ffdc9c 100644
--- a/src/main/jira/attachment-image-cache.ts
+++ b/src/main/jira/attachment-image-cache.ts
@@ -133,7 +133,10 @@ export async function loadAttachmentDataUrlWithCache(args: {
       }
       return loaded.dataUrl
     } finally {
-      inFlight.delete(key)
+      // A cleared generation no longer owns the current download's singleflight slot.
+      if (currentEpoch(args.siteId) === epochAtStart) {
+        inFlight.delete(key)
+      }
     }
   })()
 
diff --git a/src/main/main-process-tree-kill-gate.test.ts b/src/main/main-process-tree-kill-gate.test.ts
new file mode 100644
index 00000000000..40b1421c32f
--- /dev/null
+++ b/src/main/main-process-tree-kill-gate.test.ts
@@ -0,0 +1,184 @@
+import { readFileSync, readdirSync, statSync } from 'node:fs'
+import { join, relative, resolve } from 'node:path'
+import { describe, expect, it } from 'vitest'
+
+/**
+ * The ratchet behind the guard's claim to be a choke point.
+ *
+ * `admitSelfInitiatedTreeKill` is only "one decision" for as long as every
+ * pid-addressed `taskkill /pid <pid> /t /f` in Electron main asks it. Each such
+ * kill can land on a recycled pid that is now one of Orca's own Chromium
+ * processes (#10680), and an ungated one is also invisible to
+ * `selfInitiatedTreeKillCount`, which makes a zero read as exculpatory when it
+ * is not. A new family fails here rather than in the field.
+ *
+ * Exactly what is enforced, so no comment elsewhere claims more: per file, the
+ * number of gate admissions must be at least the number of `/pid` call sites.
+ * Counting sites rather than files is the point — a file-granular scan would let
+ * a second, ungated taskkill land inside a family that already mentions the gate,
+ * which is the shape the six highest-risk files now have. What it still cannot
+ * see: a site that pairs an ungated kill with a second admission of an already
+ * gated one in the same file, and a kill whose `/pid` argument is itself built
+ * from a variable.
+ */
+const REPOSITORY_ROOT = resolve(__dirname, '..', '..')
+const MAIN_DIRECTORY = 'src/main/'
+const SCANNED_EXTENSIONS = ['.ts', '.tsx']
+const IGNORED_DIRECTORIES = new Set([
+  'node_modules',
+  'dist',
+  'out',
+  'build',
+  '.git',
+  '__fixtures__'
+])
+
+/**
+ * One match per call site. Keyed on the `/pid` argument rather than the program
+ * name because `/pid <n>` is what makes the kill pid-addressed — it walks
+ * whatever tree owns that pid *now* — and because the literal survives a
+ * `taskkill` spawned through a constant or a variable, which a quoted-program
+ * pattern misses entirely.
+ */
+const PID_ADDRESSED_KILL_SITE = /['"]\/pid['"]/gi
+
+/**
+ * A call, not an import or a comment: `admitSelfInitiatedTreeKill` in main, and
+ * `admitProcessTreeKill` for the `src/shared` seam main installs the same gate
+ * into, which shared code cannot import directly.
+ */
+const GATE_ADMISSION = /\badmit(?:SelfInitiatedTreeKill|ProcessTreeKill)\s*\(/g
+
+function countMatches(source: string, pattern: RegExp): number {
+  return source.match(pattern)?.length ?? 0
+}
+
+/** Sites left over once each admission in the file has claimed one. */
+function ungatedKillSiteCount(source: string): number {
+  return Math.max(
+    countMatches(source, PID_ADDRESSED_KILL_SITE) - countMatches(source, GATE_ADMISSION),
+    0
+  )
+}
+
+/**
+ * Only ever shrinks. Each entry states why the gate cannot reach it — never
+ * "not got to yet", which is what a new ungated family would also look like.
+ */
+const UNGATED_TASKKILL_ALLOWLIST = new Map<string, string>([
+  [
+    'src/main/browser/browser-route-egress-electron-launch.ts',
+    'Electron probe reached only from *.electron.test.ts; kills the probe Electron it spawned'
+  ],
+  [
+    'src/main/browser/browser-route-persisted-worker-electron-process.ts',
+    'Electron probe reached only from *.electron.test.ts; kills the probe Electron it spawned'
+  ],
+  [
+    'src/cli/handlers/interactive-login-interruption.ts',
+    'CLI host: no Chromium pid on the machine to reach, and no reader for the ring'
+  ],
+  [
+    'src/relay/subprocess-tree-termination.ts',
+    'Relay host: same, and the relay cannot import the main-process gate'
+  ]
+])
+
+function isTestFile(path: string): boolean {
+  return /\.(?:test|spec)\.tsx?$/.test(path) || /(?:test-harness|test-fixture|fixture)/.test(path)
+}
+
+function scanSourceFiles(directory: string, found: string[] = []): string[] {
+  for (const entry of readdirSync(directory)) {
+    if (IGNORED_DIRECTORIES.has(entry)) {
+      continue
+    }
+    const path = join(directory, entry)
+    if (statSync(path).isDirectory()) {
+      scanSourceFiles(path, found)
+      continue
+    }
+    if (SCANNED_EXTENSIONS.some((extension) => entry.endsWith(extension)) && !isTestFile(path)) {
+      found.push(path)
+    }
+  }
+  return found
+}
+
+// Only the Node-side hosts: a renderer or preload cannot spawn a process at all.
+const SCANNED_HOSTS = ['src/main', 'src/shared', 'src/cli', 'src/relay']
+
+/** Scanned once at import: 10k files is seconds, and every case below reuses it. */
+const PID_ADDRESSED_KILL_FILES = SCANNED_HOSTS.flatMap((host) =>
+  scanSourceFiles(join(REPOSITORY_ROOT, host))
+    .map((path) => ({
+      path: relative(REPOSITORY_ROOT, path).split('\\').join('/'),
+      source: readFileSync(path, 'utf8')
+    }))
+    .filter((file) => countMatches(file.source, PID_ADDRESSED_KILL_SITE) > 0)
+)
+
+function pidAddressedKillFiles(): { path: string; source: string }[] {
+  return PID_ADDRESSED_KILL_FILES
+}
+
+describe('main-process tree-kill gate', () => {
+  it('finds the taskkill families it is meant to police', () => {
+    // Falsifiable: a scanner that matched nothing would pass every case below.
+    expect(pidAddressedKillFiles().map((file) => file.path)).toContain(
+      'src/main/windows-process-tree-kill.ts'
+    )
+  })
+
+  it('routes every pid-addressed taskkill in Electron main through the gate', () => {
+    const ungated = pidAddressedKillFiles()
+      .filter((file) => file.path.startsWith(MAIN_DIRECTORY))
+      .filter((file) => ungatedKillSiteCount(file.source) > 0)
+      .map((file) => file.path)
+      .filter((path) => !UNGATED_TASKKILL_ALLOWLIST.has(path))
+
+    expect(ungated).toEqual([])
+  })
+
+  it('leaves no pid-addressed taskkill outside main unaccounted for', () => {
+    const unaccounted = pidAddressedKillFiles()
+      .filter((file) => !file.path.startsWith(MAIN_DIRECTORY))
+      .filter((file) => ungatedKillSiteCount(file.source) > 0)
+      .map((file) => file.path)
+      .filter((path) => !UNGATED_TASKKILL_ALLOWLIST.has(path))
+
+    expect(unaccounted).toEqual([])
+  })
+
+  it('counts call sites, not files: a second ungated kill in a gated file is caught', () => {
+    // The failure a file-granular scan let through: one gate mention exempting
+    // every taskkill in the file.
+    const gated = `
+      import { admitSelfInitiatedTreeKill } from './own-chromium-tree-kill-guard'
+      if (admitSelfInitiatedTreeKill({ pid, site: 's', scope: 'win-taskkill-tree' })) {
+        spawn('taskkill', ['/pid', String(pid), '/t', '/f'])
+      }
+    `
+
+    expect(ungatedKillSiteCount(gated)).toBe(0)
+    expect(
+      ungatedKillSiteCount(`${gated}\nspawn('taskkill', ['/pid', String(other), '/t', '/f'])`)
+    ).toBe(1)
+  })
+
+  it('sees a kill whose program name comes from a constant', () => {
+    // A quoted-program pattern misses this shape; the `/pid` argument does not.
+    expect(
+      ungatedKillSiteCount(`
+        const KILLER = 'taskkill'
+        spawn(KILLER, ['/pid', String(pid), '/t', '/f'])
+      `)
+    ).toBe(1)
+  })
+
+  it('keeps the allowlist honest: every entry still spawns a taskkill', () => {
+    const spawning = new Set(pidAddressedKillFiles().map((file) => file.path))
+
+    expect([...UNGATED_TASKKILL_ALLOWLIST.keys()].filter((path) => !spawning.has(path))).toEqual([])
+  })
+})
diff --git a/src/main/native-chat/agent-session-journal/journal-blob-store.ts b/src/main/native-chat/agent-session-journal/journal-blob-store.ts
deleted file mode 100644
index 9b02877cec7..00000000000
--- a/src/main/native-chat/agent-session-journal/journal-blob-store.ts
+++ /dev/null
@@ -1,110 +0,0 @@
-// Content-addressed store for the remainder of a bounded payload.
-//
-// Blobs are named by their sha256, so writing the same output twice costs one
-// file and re-import is idempotent. They live beside the journal (host-side
-// per-workspace state, never inside the user's working tree) and share the
-// epoch's retention: compaction prunes every blob no retained row references.
-
-import { mkdir, readFile, readdir, rm, stat } from 'node:fs/promises'
-import { join } from 'node:path'
-import { durableWriteTempPath, writeFileDurable } from '../../durable-file-write'
-
-export const JOURNAL_BLOB_DIR = 'blobs'
-const DIGEST_PATTERN = /^[0-9a-f]{64}$/
-
-/** A digest arrives back from a row on disk, so it is untrusted by the time it
- *  reaches the filesystem: anything but a bare sha256 could escape the store. */
-function blobPath(journalDir: string, digest: string): string | null {
-  return DIGEST_PATTERN.test(digest) ? join(journalDir, JOURNAL_BLOB_DIR, digest) : null
-}
-
-/** Persist `payload` under its digest. Returns the digest so the caller can
- *  stamp it on the row it is about to append. */
-export async function putJournalBlob(
-  journalDir: string,
-  digest: string,
-  payload: string
-): Promise<string> {
-  const target = blobPath(journalDir, digest)
-  if (!target) {
-    throw new Error('refusing to write a journal blob under a name that is not a sha256 digest')
-  }
-  // Content addressing makes a rewrite pointless: identical digest, identical bytes.
-  if (await pathExists(target)) {
-    return digest
-  }
-  await mkdir(join(journalDir, JOURNAL_BLOB_DIR), { recursive: true })
-  await writeFileDurable(durableWriteTempPath(target), target, payload)
-  return digest
-}
-
-export async function readJournalBlob(journalDir: string, digest: string): Promise<string | null> {
-  const source = blobPath(journalDir, digest)
-  if (!source) {
-    return null
-  }
-  try {
-    return await readFile(source, 'utf-8')
-  } catch {
-    return null
-  }
-}
-
-/** Remove a blob written speculatively for a row that was rejected. */
-export async function removeJournalBlob(journalDir: string, digest: string): Promise<void> {
-  const target = blobPath(journalDir, digest)
-  if (target) {
-    await rm(target, { force: true })
-  }
-}
-
-/** Drop every blob outside `retained`. Called from compaction, under the
- *  current lease fence, after the snapshot is durable — so a crash mid-prune
- *  leaves extra blobs rather than dangling references. */
-export async function pruneJournalBlobs(
-  journalDir: string,
-  retained: ReadonlySet<string>
-): Promise<number> {
-  let removed = 0
-  let names: string[]
-  try {
-    names = await readdir(join(journalDir, JOURNAL_BLOB_DIR))
-  } catch {
-    return 0
-  }
-  for (const name of names) {
-    if (retained.has(name)) {
-      continue
-    }
-    await rm(join(journalDir, JOURNAL_BLOB_DIR, name), { force: true }).catch(() => {})
-    removed += 1
-  }
-  return removed
-}
-
-async function pathExists(path: string): Promise<boolean> {
-  try {
-    await stat(path)
-    return true
-  } catch {
-    return false
-  }
-}
-
-export async function journalBlobFileSize(
-  journalDir: string,
-  digest: string
-): Promise<number | null> {
-  const target = blobPath(journalDir, digest)
-  if (!target) {
-    return null
-  }
-  try {
-    return (await stat(target)).size
-  } catch (error) {
-    if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
-      return null
-    }
-    throw error
-  }
-}
diff --git a/src/main/native-chat/agent-session-journal/journal-close-retry.ts b/src/main/native-chat/agent-session-journal/journal-close-retry.ts
new file mode 100644
index 00000000000..e73be0a59b8
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-close-retry.ts
@@ -0,0 +1,68 @@
+// Where a journal goes when its close REJECTS.
+//
+// `AgentSessionJournal.close()` is deliberately retryable: a rejection does not
+// release the handle, and a second call is a real second attempt. Every caller
+// that did `close().catch(() => undefined)` and then threw or overwrote its map
+// entry defeated that contract — the store became unreachable with its SQLite
+// connection still open. On POSIX that is a silent leak; on Windows the open
+// handle blocks renaming or removing the journal directory outright.
+//
+// So a rejected close hands the journal here instead of dropping it, and host
+// teardown retries everything this holds. Retention is bounded by construction:
+// an entry leaves the set the moment its close fulfils, and a journal can be
+// retained only once because the set is keyed by identity.
+
+/** Everything the registry needs; `AgentSessionJournal` satisfies it. */
+export type RetryableJournalClose = {
+  close: () => Promise<void>
+  readonly directory: string
+}
+
+export class JournalCloseRetryRegistry {
+  private readonly retained = new Set<RetryableJournalClose>()
+
+  /** Directories still held by a journal whose close has not fulfilled. */
+  get pendingDirectories(): string[] {
+    return [...this.retained].map((journal) => journal.directory)
+  }
+
+  /**
+   * Close it. Returns true when the handle is actually released; on a rejection
+   * the journal is RETAINED for `retryAll` and the rejection is returned rather
+   * than thrown, because every caller of this is already unwinding a different
+   * failure it must not lose.
+   */
+  async closeOrRetain(
+    journal: RetryableJournalClose
+  ): Promise<{ closed: boolean; error?: unknown }> {
+    try {
+      await journal.close()
+      this.retained.delete(journal)
+      return { closed: true }
+    } catch (error) {
+      this.retained.add(journal)
+      return { closed: false, error }
+    }
+  }
+
+  /** Retry every retained close. Ones that fulfil are dropped; ones that reject
+   *  stay retained and their rejections are returned for the caller to report. */
+  async retryAll(): Promise<unknown[]> {
+    const entries = [...this.retained]
+    const failures: unknown[] = []
+    for (const journal of entries) {
+      const result = await this.closeOrRetain(journal)
+      if (!result.closed) {
+        failures.push(result.error)
+      }
+    }
+    return failures
+  }
+}
+
+/**
+ * Process-wide, because ownership of these handles is process-wide: the attach
+ * path, the recovery wrapper and runtime teardown are separate call trees that
+ * must all be able to reach the same orphan.
+ */
+export const agentSessionJournalCloseRetries = new JournalCloseRetryRegistry()
diff --git a/src/main/native-chat/agent-session-journal/journal-compaction.ts b/src/main/native-chat/agent-session-journal/journal-compaction.ts
deleted file mode 100644
index b9600a4f4e9..00000000000
--- a/src/main/native-chat/agent-session-journal/journal-compaction.ts
+++ /dev/null
@@ -1,206 +0,0 @@
-// Retention and compaction.
-//
-// The snapshot carries the retained tail with it, so publishing both is ONE
-// atomic write and there is no window where the folded state exists without the
-// rows a reconnecting client still needs. Truncating the log afterwards is
-// idempotent: a crash before it leaves the log a superset of the tail.
-//
-// The retained tail must cover the longest reconnect window Orca supports, or a
-// client that was merely asleep gets a full snapshot reload instead of a resume.
-
-import { blobDigestsInBody, renderJournalState, type JournalReducerState } from './journal-reducer'
-import { pruneJournalBlobs } from './journal-blob-store'
-import {
-  rewriteJournalLog,
-  writeJournalSnapshotFile,
-  type JournalSnapshotFile
-} from './journal-log-file'
-import { AGENT_SESSION_JOURNAL_SCHEMA_VERSION } from '../../../shared/agent-session-journal-types'
-import type { JournalRow } from './journal-row-schema'
-import { AgentSessionJournalError } from './journal-write-guards'
-import { assertJournalPhysicalCapacity, journalDirectoryBytes } from './journal-physical-quota'
-
-export type JournalCompactionPolicy = {
-  /** Always keep at least this many rows, however old they are. */
-  minTailRows: number
-  /** Keep every row observed within this window. */
-  retainTailMs: number
-  /**
-   * `window` honours `retainTailMs` outright. `budget-pressure` lets it yield:
-   * the alternative is refusing the user's writes until the window ages out,
-   * and the tail is only a resume optimization — compaction folds every shed
-   * row into the snapshot before truncating the log, so a client that loses
-   * its resume point reloads instead of losing conversation. Defaults to
-   * `window`.
-   */
-  retention?: 'window' | 'budget-pressure'
-}
-
-/** Two hours of tail comfortably covers a phone that slept through a commute,
- *  which is the longest reconnect Orca resumes rather than reloads. */
-export const DEFAULT_JOURNAL_COMPACTION_POLICY: JournalCompactionPolicy = {
-  minTailRows: 512,
-  retainTailMs: 2 * 60 * 60 * 1000
-}
-
-export type JournalCompactionResult = {
-  tailRows: JournalRow[]
-  compactedThrough: number
-  oldestSequence: number
-}
-
-export async function compactJournal(input: {
-  journalDir: string
-  /** Parent quota root when compacting an in-directory staging journal. */
-  physicalQuotaRoot?: string
-  state: JournalReducerState
-  tailRows: readonly JournalRow[]
-  policy?: JournalCompactionPolicy
-  now: number
-  maxSessionBytes: number
-  sessionId?: string
-}): Promise<JournalCompactionResult> {
-  const policy = input.policy ?? DEFAULT_JOURNAL_COMPACTION_POLICY
-  const retained = retainTail(input.tailRows, policy, input.now)
-  const rendered = renderJournalState(input.state)
-  const compactedThrough = input.state.lastSequence
-
-  const snapshot: JournalSnapshotFile = {
-    v: AGENT_SESSION_JOURNAL_SCHEMA_VERSION,
-    epoch: input.state.epoch,
-    compactedThrough,
-    highestFence: input.state.highestFence,
-    items: rendered.items,
-    submissions: rendered.submissions,
-    receipts: [...input.state.receipts.values()].map((receipt) => ({
-      clientMessageId: receipt.clientMessageId,
-      providerItemId: receipt.providerItemId,
-      epoch: receipt.cursor.epoch,
-      sequence: receipt.cursor.sequence,
-      acceptedAt: receipt.acceptedAt
-    })),
-    aliases: [...input.state.aliases.entries()].map(([providerItemId, itemId]) => ({
-      providerItemId,
-      itemId
-    })),
-    tombstones: [...input.state.tombstones.entries()].map(([itemId, revision]) => ({
-      itemId,
-      revision
-    })),
-    appliedSettlementIds: [...input.state.appliedSettlementIds],
-    tail: retained
-  }
-
-  const snapshotBytes = Buffer.byteLength(JSON.stringify(snapshot), 'utf8')
-  if (snapshotBytes > input.maxSessionBytes) {
-    throw new AgentSessionJournalError(
-      'journal_bound_exceeded',
-      `agent-session journal snapshot reached its ${input.maxSessionBytes}-byte bound`
-    )
-  }
-
-  const sessionId = input.sessionId ?? input.state.sessionId
-  const quotaRoot = input.physicalQuotaRoot ?? input.journalDir
-  const retainedLogBytes = retained.reduce(
-    (total, row) => total + Buffer.byteLength(JSON.stringify(row), 'utf8') + 1,
-    0
-  )
-  // Durable writes keep the old final alongside the new temp until rename.
-  // Reserve the complete compaction peak up front so a later copy cannot leave
-  // a half-published snapshot/log pair when the quota is tight.
-  await assertJournalPhysicalCapacity({
-    journalDir: quotaRoot,
-    sessionId,
-    maxBytes: input.maxSessionBytes,
-    peakAdditionalBytes: snapshotBytes + retainedLogBytes
-  })
-  await writeJournalSnapshotFile(input.journalDir, snapshot)
-  await rewriteJournalLog(input.journalDir, retained)
-  // Blobs are pruned last: a crash before this leaks bytes, whereas pruning
-  // first would strand a snapshot pointing at a payload that no longer exists.
-  // Recompute from exactly what the durable snapshot and retained log carry;
-  // this preserves reused/pre-existing blobs while allowing stale payloads to
-  // be pruned safely after both files are published.
-  const retainedDigests = new Set<string>()
-  for (const item of snapshot.items) {
-    blobDigestsInBody(item.body, retainedDigests)
-  }
-  for (const row of retained) {
-    if (row.kind === 'item') {
-      blobDigestsInBody(row.body, retainedDigests)
-    } else if (row.kind === 'lifecycle-batch') {
-      for (const mutation of row.mutations) {
-        if (mutation.kind === 'item') {
-          blobDigestsInBody(mutation.body, retainedDigests)
-        }
-      }
-    }
-  }
-  await pruneJournalBlobs(input.journalDir, retainedDigests)
-
-  if ((await journalDirectoryBytes(quotaRoot)) > input.maxSessionBytes) {
-    throw new AgentSessionJournalError(
-      'journal_bound_exceeded',
-      `agent-session journal for ${sessionId} exceeds its physical bound after compaction`
-    )
-  }
-
-  return {
-    tailRows: retained,
-    compactedThrough,
-    oldestSequence: retained[0]?.seq ?? compactedThrough + 1
-  }
-}
-
-function retainTail(
-  rows: readonly JournalRow[],
-  policy: JournalCompactionPolicy,
-  now: number
-): JournalRow[] {
-  if (rows.length <= policy.minTailRows) {
-    return [...rows]
-  }
-  const floor = now - policy.retainTailMs
-  const byAge = rows.findIndex((row) => row.ts >= floor)
-  const byCount = rows.length - policy.minTailRows
-  const start = byAge === -1 ? byCount : Math.min(byAge, byCount)
-  if (policy.retention !== 'budget-pressure') {
-    return rows.slice(start)
-  }
-  // Halve rather than empty: the newer half keeps live clients resuming, and
-  // shedding at least one row guarantees the append that triggered this makes
-  // progress instead of latching the session read-only.
-  return rows.slice(Math.max(start, Math.ceil(rows.length / 2)))
-}
-
-/** Only when the retention window would actually drop rows: inside it,
- *  compaction rewrites an identical log, and doing that per append is a full
- *  state serialization on the hot path. */
-export function journalTailIsReadyToCompact(
-  tailRows: readonly JournalRow[],
-  policy: JournalCompactionPolicy,
-  now: number
-): boolean {
-  if (tailRows.length <= policy.minTailRows * 2) {
-    return false
-  }
-  return (tailRows[0]?.ts ?? now) < now - policy.retainTailMs
-}
-
-/** The policy an append falls back to when the size bound would otherwise
- *  refuse it: both floors that normally protect the tail step aside. */
-export function budgetPressurePolicy(policy: JournalCompactionPolicy): JournalCompactionPolicy {
-  return { ...policy, minTailRows: 0, retention: 'budget-pressure' }
-}
-
-/** Budget pressure may need to shed rows before the ordinary batching threshold.
- *  Pass a `budget-pressure` policy, or a tail wholly inside the retention
- *  window answers false and the size bound refuses every append until it ages
- *  out — two hours of a session the user cannot write to. */
-export function journalTailCanShedRows(
-  tailRows: readonly JournalRow[],
-  policy: JournalCompactionPolicy,
-  now: number
-): boolean {
-  return retainTail(tailRows, policy, now).length < tailRows.length
-}
diff --git a/src/main/native-chat/agent-session-journal/journal-corruption-quarantine.ts b/src/main/native-chat/agent-session-journal/journal-corruption-quarantine.ts
deleted file mode 100644
index e12d5b67a0a..00000000000
--- a/src/main/native-chat/agent-session-journal/journal-corruption-quarantine.ts
+++ /dev/null
@@ -1,102 +0,0 @@
-// Corruption never deletes history. A journal that cannot be read end to end
-// keeps its intact prefix live and moves the unreadable remainder aside, so the
-// bytes stay on disk for inspection instead of being rebuilt into an empty epoch.
-
-import { readFile } from 'node:fs/promises'
-import { join } from 'node:path'
-import {
-  JOURNAL_SNAPSHOT_FILE,
-  quarantineJournalRemainder,
-  readJournalLog,
-  rewriteJournalLog
-} from './journal-log-file'
-import type { JournalRow } from './journal-row-schema'
-import { assertJournalPhysicalCapacity } from './journal-physical-quota'
-
-/** Keep the readable prefix and set the unreadable suffix aside. */
-export async function quarantineCorruptSuffix(
-  journalDir: string,
-  retainedRows: readonly JournalRow[],
-  remainder: string | undefined,
-  quota?: { sessionId: string; maxBytes: number }
-): Promise<void> {
-  if (remainder) {
-    if (quota) {
-      await assertJournalPhysicalCapacity({
-        journalDir,
-        ...quota,
-        peakAdditionalBytes: Buffer.byteLength(remainder, 'utf8')
-      })
-    }
-    await quarantineJournalRemainder(journalDir, remainder)
-  }
-  if (quota) {
-    const retainedBytes = retainedRows.reduce(
-      (total, row) => total + Buffer.byteLength(JSON.stringify(row), 'utf8') + 1,
-      0
-    )
-    await assertJournalPhysicalCapacity({
-      journalDir,
-      ...quota,
-      peakAdditionalBytes: retainedBytes
-    })
-  }
-  await rewriteJournalLog(journalDir, retainedRows)
-}
-
-/** Copy everything aside before a read-only journal is rebuilt under a newer
- *  schema: those rows are unreadable to THIS build, not worthless. The
- *  snapshot is preserved as raw bytes — a future-version snapshot does not
- *  parse under this build's schema, and its bytes must survive verbatim. */
-export async function quarantineUnreadableSchema(
-  journalDir: string,
-  quota?: { sessionId: string; maxBytes: number }
-): Promise<void> {
-  const snapshot = await readSnapshotBytes(journalDir)
-  const log = await readJournalLog(journalDir)
-  const preserved = [
-    snapshot ?? '',
-    log.rows.map((row) => JSON.stringify(row)).join('\n'),
-    log.remainder ?? ''
-  ]
-    .filter(Boolean)
-    .join('\n')
-  if (preserved) {
-    if (quota) {
-      await assertJournalPhysicalCapacity({
-        journalDir,
-        ...quota,
-        peakAdditionalBytes: Buffer.byteLength(preserved, 'utf8')
-      })
-    }
-    await quarantineJournalRemainder(journalDir, preserved)
-  }
-}
-
-async function readSnapshotBytes(journalDir: string): Promise<string | null> {
-  try {
-    return await readFile(join(journalDir, JOURNAL_SNAPSHOT_FILE), 'utf-8')
-  } catch (error) {
-    if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
-      return null
-    }
-    throw error
-  }
-}
-
-/** The disclosure row for lines that failed to parse. Skipped lines are lost
- *  rows; counting them silently is the drop this exists to prevent. */
-export function malformedRowsDisclosure(count: number): {
-  identity: { provider: 'orca'; clientMessageId: string }
-  body: { kind: 'status'; text: string }
-} {
-  const plural = count === 1 ? '' : 's'
-  return {
-    // One stable identity, so a reopen upserts the same row instead of adding one.
-    identity: { provider: 'orca', clientMessageId: 'journal-malformed-lines' },
-    body: {
-      kind: 'status',
-      text: `${count} journal line${plural} could not be read and ${count === 1 ? 'was' : 'were'} skipped`
-    }
-  }
-}
diff --git a/src/main/native-chat/agent-session-journal/journal-corruption-repair.test.ts b/src/main/native-chat/agent-session-journal/journal-corruption-repair.test.ts
new file mode 100644
index 00000000000..978f076d6e9
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-corruption-repair.test.ts
@@ -0,0 +1,265 @@
+// A repair drops what it cannot replay, and says so.
+//
+// Two things make a suffix unreplayable: a row this build cannot parse, and a
+// sequence gap that makes every later row unanchored. The rejected suffix is
+// DELETED; the load reports `corrupt`, and recovery rebuilds the epoch from
+// provider history. Every case here asserts the same two halves: the live epoch
+// holds only the replayable prefix, AND the epoch stays anchored so nothing
+// replays a repaired journal as a clean timeline.
+
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import type {
+  AgentJournalItemBody,
+  AgentJournalItemIdentity,
+  AgentSessionJournalIdentity
+} from '../../../shared/agent-session-journal-types'
+import type Database from '../../sqlite/sync-database'
+import { openJournalDatabase } from './journal-database'
+import { journalDatabaseFile } from './journal-paths'
+import { parseJournalRow, type JournalRow } from './journal-row-schema'
+import { loadJournal } from './journal-open'
+import type { openAgentSessionJournal } from './journal-store-factory'
+import { createTrackedJournalOpener } from './journal-store-test-open'
+
+const IDENTITY: AgentSessionJournalIdentity = {
+  sessionId: 'session-1',
+  workspaceId: 'ws-1',
+  hostId: 'host-1',
+  agent: 'codex',
+  providerHandle: { kind: 'codex', threadId: 'thread-1' }
+}
+
+let root: string
+let clock = 1_000
+const journals = createTrackedJournalOpener()
+
+function tick(): number {
+  clock += 1
+  return clock
+}
+
+function item(ordinal: number): AgentJournalItemIdentity {
+  return { provider: 'codex', threadId: 'thread-1', turnId: 'turn-1', ordinal }
+}
+
+function body(value: string): AgentJournalItemBody {
+  return { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text: value }] }
+}
+
+function open(overrides: Partial<Parameters<typeof openAgentSessionJournal>[0]> = {}) {
+  return journals.open({
+    identity: IDENTITY,
+    journalDir: root,
+    now: tick,
+    mintEpoch: () => `epoch-${clock}`,
+    ...overrides
+  })
+}
+
+async function withJournalDatabase(run: (db: Database.Database) => void): Promise<void> {
+  const opened = openJournalDatabase(journalDatabaseFile(root))
+  try {
+    run(opened.db)
+  } finally {
+    opened.db.close()
+  }
+}
+
+/** The row replay anchors on, parsed exactly as replay parses it. */
+function firstLiveRow(): Promise<JournalRow | null> {
+  let row: JournalRow | null = null
+  return withJournalDatabase((db) => {
+    const stored = db.prepare('SELECT row_json FROM journal_rows ORDER BY seq LIMIT 1').get() as
+      | { row_json: string }
+      | undefined
+    const parsed = stored ? parseJournalRow(stored.row_json) : null
+    row = parsed?.ok ? parsed.row : null
+  }).then(() => row)
+}
+
+function liveSequences(): Promise<number[]> {
+  let sequences: number[] = []
+  return withJournalDatabase((db) => {
+    sequences = (
+      db.prepare('SELECT seq FROM journal_rows ORDER BY seq').all() as { seq: number }[]
+    ).map((row) => row.seq)
+  }).then(() => sequences)
+}
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-journal-repair-'))
+  clock = 1_000
+})
+
+afterEach(async () => {
+  await journals.closeAll()
+  await rm(root, { recursive: true, force: true })
+})
+
+describe('a malformed row', () => {
+  it('keeps the readable prefix live and drops the rest of the epoch', async () => {
+    const journal = await open()
+    await journal.appendItem(item(0), body('readable'), { fence: 1 })
+    await journal.appendItem(item(1), body('unreadable'), { fence: 1 })
+    await journal.appendItem(item(2), body('after the fault'), { fence: 1 })
+    await journal.close()
+    await withJournalDatabase((db) => {
+      db.prepare('UPDATE journal_rows SET row_json = ? WHERE seq = ?').run('{"not":"a row"}', 3)
+    })
+
+    const reopened = await open()
+    expect(reopened.repair.malformedRows).toBe(1)
+    // 1..2 is the surviving prefix; 3 is the disclosure the repair appends.
+    expect(await liveSequences()).toEqual([1, 2, 3])
+  })
+
+  it('discloses the line it could not read', async () => {
+    const journal = await open()
+    await journal.appendItem(item(0), body('readable'), { fence: 1 })
+    await journal.appendItem(item(1), body('later'), { fence: 1 })
+    await journal.close()
+    await withJournalDatabase((db) => {
+      db.prepare('UPDATE journal_rows SET row_json = ? WHERE seq = ?').run('}{', 2)
+    })
+
+    const reopened = await open()
+    const disclosure = reopened
+      .snapshot()
+      .items.map((entry) => entry.body)
+      .find((entry) => entry.kind === 'status')
+    expect(disclosure).toMatchObject({ kind: 'status' })
+    expect(disclosure && 'text' in disclosure ? disclosure.text : '').toContain(
+      '1 journal line could not be read'
+    )
+  })
+})
+
+describe('a sequence gap', () => {
+  it('drops every row after the hole and reports the epoch corrupt', async () => {
+    const journal = await open()
+    for (let ordinal = 0; ordinal < 5; ordinal += 1) {
+      await journal.appendItem(item(ordinal), body(`m${ordinal}`), { fence: 1 })
+    }
+    await journal.close()
+    // Sequence 1 is the epoch row, so the items occupy 2..6. Removing 4 leaves
+    // 5 and 6 valid but unanchored.
+    await withJournalDatabase((db) => {
+      db.prepare('DELETE FROM journal_rows WHERE seq = ?').run(4)
+    })
+
+    const reopened = await open()
+    expect(await liveSequences()).toEqual([1, 2, 3])
+    expect(reopened.repair).toEqual({ malformedRows: 0 })
+    expect(reopened.snapshot().items.map((entry) => entry.body)).toEqual([body('m0'), body('m1')])
+  })
+
+  // The prefix survives, so there is no emptied epoch to re-anchor and — a gap
+  // costing no malformed row — no disclosure either. Without a durable marker
+  // the next probe reads a contiguous anchored prefix and calls it clean, and
+  // the rows the repair deleted are never asked for again.
+  it('still reports corrupt on the next probe, with the deleted suffix unrebuilt', async () => {
+    const journal = await open()
+    for (let ordinal = 0; ordinal < 5; ordinal += 1) {
+      await journal.appendItem(item(ordinal), body(`m${ordinal}`), { fence: 1 })
+    }
+    await journal.close()
+    await withJournalDatabase((db) => {
+      db.prepare('DELETE FROM journal_rows WHERE seq = ?').run(4)
+    })
+
+    const repaired = await open()
+    await repaired.close()
+    expect(loadJournal(root, IDENTITY.sessionId)).toMatchObject({ corrupt: true })
+
+    // Same policy the emptied-epoch repair takes: a session that writes into the
+    // epoch owns it, and a later import must not replace rows the user has seen.
+    const writable = await open()
+    await writable.appendItem(item(9), body('typed after the repair'), { fence: 1 })
+    await writable.close()
+    expect(loadJournal(root, IDENTITY.sessionId)).toMatchObject({ corrupt: false })
+  })
+
+  // The disclosure is the repair talking about itself, not the session writing:
+  // counting it as content would retire the marker the instant it was raised.
+  it('is not settled by the repair disclosure it appends for a malformed row', async () => {
+    const journal = await open()
+    for (let ordinal = 0; ordinal < 3; ordinal += 1) {
+      await journal.appendItem(item(ordinal), body(`m${ordinal}`), { fence: 1 })
+    }
+    await journal.close()
+    await withJournalDatabase((db) => {
+      db.prepare('UPDATE journal_rows SET row_json = ? WHERE seq = ?').run('}{', 3)
+    })
+
+    const repaired = await open()
+    expect(repaired.repair.malformedRows).toBe(1)
+    await repaired.close()
+    expect(loadJournal(root, IDENTITY.sessionId)).toMatchObject({ corrupt: true })
+  })
+})
+
+describe('a missing epoch row', () => {
+  // Sequence 1 is the anchor for the whole epoch. Validating from the first row
+  // that HAPPENS to remain declares the leftovers contiguous, and replay then
+  // renders a repaired journal as a clean timeline.
+  it('rejects the whole surviving range rather than declaring it contiguous', async () => {
+    const journal = await open()
+    await journal.appendItem(item(0), body('anchor'), { fence: 1 })
+    await journal.appendSubmission({
+      clientMessageId: 'client-message-1',
+      payloadFingerprint: 'fingerprint-1',
+      body: {
+        kind: 'message',
+        role: 'user',
+        blocks: [{ type: 'text', text: 'the user typed this' }]
+      },
+      fence: 1
+    })
+    await journal.resolveDispatch({
+      clientMessageId: 'client-message-1',
+      state: 'accepted',
+      providerIdentity: item(1),
+      fence: 1
+    })
+    await journal.close()
+    await withJournalDatabase((db) => {
+      db.prepare('DELETE FROM journal_rows WHERE seq = ?').run(1)
+    })
+
+    const reopened = await open()
+    expect(reopened.repair).toEqual({ malformedRows: 0 })
+    expect(reopened.snapshot().items).toEqual([])
+
+    // The epoch cannot be left row-less. An ordinary append would then take
+    // sequence 1, and replay would call that non-epoch row a clean timeline.
+    expect(await liveSequences()).toEqual([1])
+    const anchor = await firstLiveRow()
+    expect(anchor).toMatchObject({ kind: 'epoch', reason: 'unreconcilable_prefix' })
+  })
+
+  // The repair epoch is a placeholder for history it could not rebuild. Left
+  // clean it would end automatic recovery: the provider transcript is never
+  // consulted again and the dropped rows never come back.
+  it('keeps asking for provider history until the epoch has content of its own', async () => {
+    const journal = await open()
+    await journal.appendItem(item(0), body('anchor'), { fence: 1 })
+    await journal.close()
+    await withJournalDatabase((db) => {
+      db.prepare('DELETE FROM journal_rows WHERE seq = ?').run(1)
+    })
+
+    const repaired = await open()
+    await repaired.close()
+    expect(loadJournal(root, IDENTITY.sessionId)).toMatchObject({ corrupt: true })
+
+    // A session that writes into the epoch owns it: its own rows are not a
+    // repair placeholder, and a later import must not replace them.
+    const writable = await open()
+    await writable.appendItem(item(1), body('typed after the repair'), { fence: 1 })
+    await writable.close()
+    expect(loadJournal(root, IDENTITY.sessionId)).toMatchObject({ corrupt: false })
+  })
+})
diff --git a/src/main/native-chat/agent-session-journal/journal-crash-boundary.test.ts b/src/main/native-chat/agent-session-journal/journal-crash-boundary.test.ts
index c58f1b57bc8..a7f54a14a4c 100644
--- a/src/main/native-chat/agent-session-journal/journal-crash-boundary.test.ts
+++ b/src/main/native-chat/agent-session-journal/journal-crash-boundary.test.ts
@@ -21,7 +21,7 @@ import {
   type ProviderHistoryItem,
   type ProviderHistoryWindow
 } from './journal-submission-reconciler'
-import { openAgentSessionJournal } from './journal-store-factory'
+import { createTrackedJournalOpener } from './journal-store-test-open'
 
 const IDENTITY: AgentSessionJournalIdentity = {
   sessionId: 'session-1',
@@ -52,8 +52,10 @@ function userMessage(text: string): AgentJournalMessageItem {
   return { kind: 'message', role: 'user', blocks: [{ type: 'text', text }] }
 }
 
+const journals = createTrackedJournalOpener()
+
 async function open() {
-  return openAgentSessionJournal({
+  return journals.open({
     identity: IDENTITY,
     journalDir: root,
     now: tick,
@@ -89,6 +91,7 @@ beforeEach(async () => {
 })
 
 afterEach(async () => {
+  await journals.closeAll()
   await rm(root, { recursive: true, force: true })
 })
 
@@ -195,14 +198,8 @@ describe('crash between provider accept and journal commit', () => {
     ).toEqual([])
   })
 
-  it('keeps the receipt after the row that minted it was compacted away', async () => {
-    const journal = await openAgentSessionJournal({
-      identity: IDENTITY,
-      journalDir: root,
-      now: tick,
-      mintEpoch: () => `epoch-${clock}`,
-      compaction: { minTailRows: 1, retainTailMs: 0 }
-    })
+  it('keeps the receipt across a reopen', async () => {
+    const journal = await open()
     await journal.appendSubmission({
       clientMessageId: 'cm_1',
       payloadFingerprint: digestPayload('kept'),
@@ -215,7 +212,7 @@ describe('crash between provider accept and journal commit', () => {
       providerIdentity: ACCEPTED_IDENTITY,
       fence: 1
     })
-    await journal.compact()
+    await journal.close()
 
     const reopened = await open()
     expect(reopened.receiptFor('cm_1')?.providerItemId).toBe(agentJournalItemKey(ACCEPTED_IDENTITY))
diff --git a/src/main/native-chat/agent-session-journal/journal-cursor.ts b/src/main/native-chat/agent-session-journal/journal-cursor.ts
index bdec8adfd19..bd43623ae49 100644
--- a/src/main/native-chat/agent-session-journal/journal-cursor.ts
+++ b/src/main/native-chat/agent-session-journal/journal-cursor.ts
@@ -77,7 +77,7 @@ export function findSequenceGap(
 export function readJournalSince(
   source: {
     state: { epoch: string; lastSequence: number; oldestSequence: number }
-    tailRows: readonly JournalRow[]
+    rowsAfter: (afterSequence: number) => JournalRow[]
     readOnly: boolean
   },
   cursor: AgentJournalCursor,
@@ -92,7 +92,7 @@ export function readJournalSince(
   }
   return {
     ok: true,
-    rows: source.tailRows.filter((row) => row.seq > resume.afterSequence),
+    rows: source.rowsAfter(resume.afterSequence),
     cursor: currentCursor()
   }
 }
diff --git a/src/main/native-chat/agent-session-journal/journal-database-schema.ts b/src/main/native-chat/agent-session-journal/journal-database-schema.ts
new file mode 100644
index 00000000000..37675fbcd8e
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-database-schema.ts
@@ -0,0 +1,37 @@
+// Table shape for one session's journal database.
+//
+// `journal_rows` is the append-only log; `journal_sessions` is the derived
+// projection, upserted in the SAME transaction as every row insert so the live
+// epoch and the rows that belong to it can never disagree. `journal_repairs`
+// carries at most one row per session: the standing demand for a rebuild a
+// partial repair leaves behind (see journal-repair-marker.ts).
+
+/** DB shape version, carried in `PRAGMA user_version`. Independent of the row
+ *  body version (`JournalRow.v`): a newer build can change either alone.
+ *  v2 added `journal_repairs`; a build without it would replay a partially
+ *  repaired journal as clean, so it must latch read-only rather than write. */
+export const JOURNAL_DB_SCHEMA_VERSION = 2
+
+export function createJournalTablesSql(): string {
+  return `
+CREATE TABLE IF NOT EXISTS journal_rows (
+  session_id TEXT    NOT NULL,
+  epoch      TEXT    NOT NULL,
+  seq        INTEGER NOT NULL,
+  ts         INTEGER NOT NULL,
+  row_json   TEXT    NOT NULL,
+  PRIMARY KEY (session_id, epoch, seq)
+);
+CREATE TABLE IF NOT EXISTS journal_sessions (
+  session_id TEXT PRIMARY KEY,
+  epoch      TEXT    NOT NULL,
+  updated_at INTEGER NOT NULL
+);
+CREATE TABLE IF NOT EXISTS journal_repairs (
+  session_id   TEXT PRIMARY KEY,
+  epoch        TEXT    NOT NULL,
+  content_from INTEGER NOT NULL,
+  repaired_at  INTEGER NOT NULL
+);
+`
+}
diff --git a/src/main/native-chat/agent-session-journal/journal-database.test.ts b/src/main/native-chat/agent-session-journal/journal-database.test.ts
new file mode 100644
index 00000000000..358c42c8d55
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-database.test.ts
@@ -0,0 +1,201 @@
+import { mkdtemp, rm, stat } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import Database from '../../sqlite/sync-database'
+import {
+  JOURNAL_BUSY_TIMEOUT_MS,
+  journalPragmaNumber,
+  openJournalDatabase
+} from './journal-database'
+import { JOURNAL_DB_SCHEMA_VERSION } from './journal-database-schema'
+import { journalDatabaseFile } from './journal-paths'
+import {
+  deleteAllJournalRows,
+  deleteJournalRowSuffix,
+  insertJournalRow,
+  readJournalEpochRows,
+  readJournalRowsAfter,
+  readJournalSessionEpoch,
+  upsertJournalSessionRow
+} from './journal-row-table'
+import type { JournalRow } from './journal-row-schema'
+import { AGENT_SESSION_JOURNAL_SCHEMA_VERSION } from '../../../shared/agent-session-journal-types'
+
+let root: string
+let dbPath: string
+
+function epochRow(seq: number, epoch = 'epoch-1'): JournalRow {
+  return {
+    kind: 'epoch',
+    reason: 'session_created',
+    providerHandle: { kind: 'codex', threadId: 'thread-1' },
+    v: AGENT_SESSION_JOURNAL_SCHEMA_VERSION,
+    epoch,
+    seq,
+    fence: 0,
+    ts: 1_700_000_000_000 + seq
+  }
+}
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-journal-db-'))
+  dbPath = journalDatabaseFile(root)
+})
+
+afterEach(async () => {
+  vi.restoreAllMocks()
+  await rm(root, { recursive: true, force: true })
+})
+
+describe('journal database open', () => {
+  it('creates both tables and reads back every load-bearing pragma', () => {
+    const opened = openJournalDatabase(dbPath)
+    try {
+      const tables = opened.db
+        .prepare("SELECT name FROM sqlite_master WHERE type = 'table' ORDER BY name")
+        .all()
+        .map((entry) => (entry as { name: string }).name)
+      expect(tables).toContain('journal_rows')
+      expect(tables).toContain('journal_sessions')
+      expect(opened.db.pragma('journal_mode', { simple: true })).toBe('wal')
+      expect(journalPragmaNumber(opened.db, 'synchronous')).toBe(2)
+      expect(journalPragmaNumber(opened.db, 'busy_timeout')).toBe(JOURNAL_BUSY_TIMEOUT_MS)
+      expect(journalPragmaNumber(opened.db, 'foreign_keys')).toBe(1)
+      expect(journalPragmaNumber(opened.db, 'user_version')).toBe(JOURNAL_DB_SCHEMA_VERSION)
+      expect(opened.readOnly).toBe(false)
+    } finally {
+      opened.db.close()
+    }
+  })
+
+  it('latches read-only on a future user_version without touching the file', async () => {
+    const seeded = openJournalDatabase(dbPath)
+    upsertJournalSessionRow(seeded.db, 'session-1', 'epoch-1', 1)
+    insertJournalRow(seeded.db, 'session-1', epochRow(1))
+    seeded.db.pragma(`user_version = ${JOURNAL_DB_SCHEMA_VERSION + 5}`)
+    seeded.db.close()
+    const before = await stat(dbPath)
+
+    const latched = openJournalDatabase(dbPath)
+    try {
+      expect(latched.readOnly).toBe(true)
+      expect(journalPragmaNumber(latched.db, 'user_version')).toBe(JOURNAL_DB_SCHEMA_VERSION + 5)
+      expect(readJournalEpochRows(latched.db, 'session-1', 'epoch-1')).toHaveLength(1)
+      expect(() => latched.db.exec("INSERT INTO journal_sessions VALUES ('x', 'y', 1)")).toThrow()
+    } finally {
+      latched.db.close()
+    }
+    expect((await stat(dbPath)).size).toBe(before.size)
+    expect(journalPragmaNumber(openJournalDatabase(dbPath).db, 'user_version')).toBe(
+      JOURNAL_DB_SCHEMA_VERSION + 5
+    )
+  })
+
+  // Site 1: the raw connection is owned by the open call until it returns.
+  it('closes the raw connection when schema setup throws', async () => {
+    const failing = join(root, 'nested', 'journal.db')
+    expect(() => openJournalDatabase(failing)).toThrow()
+    await expect(stat(`${failing}-wal`)).rejects.toThrow()
+    await expect(rm(root, { recursive: true, force: true })).resolves.toBeUndefined()
+    root = await mkdtemp(join(tmpdir(), 'orca-journal-db-'))
+  })
+})
+
+describe('journal row statements', () => {
+  it('serves replay, resume, discard and suffix truncation from the primary key', () => {
+    const opened = openJournalDatabase(dbPath)
+    try {
+      const { db } = opened
+      db.exec('BEGIN IMMEDIATE')
+      for (let seq = 1; seq <= 5; seq += 1) {
+        insertJournalRow(db, 'session-1', epochRow(seq))
+      }
+      insertJournalRow(db, 'session-1', epochRow(1, 'epoch-old'))
+      upsertJournalSessionRow(db, 'session-1', 'epoch-1', 42)
+      db.exec('COMMIT')
+
+      expect(readJournalSessionEpoch(db, 'session-1')).toBe('epoch-1')
+      expect(readJournalSessionEpoch(db, 'absent')).toBeNull()
+      expect(readJournalEpochRows(db, 'session-1', 'epoch-1').map((row) => row.seq)).toEqual([
+        1, 2, 3, 4, 5
+      ])
+      expect(readJournalRowsAfter(db, 'session-1', 'epoch-1', 3).map((row) => row.seq)).toEqual([
+        4, 5
+      ])
+
+      // The rejected suffix leaves `journal_rows`, scoped to its own epoch.
+      expect(deleteJournalRowSuffix(db, 'session-1', 'epoch-1', 4)).toBe(2)
+      expect(readJournalEpochRows(db, 'session-1', 'epoch-1').map((row) => row.seq)).toEqual([
+        1, 2, 3
+      ])
+      expect(readJournalEpochRows(db, 'session-1', 'epoch-old')).toHaveLength(1)
+
+      deleteAllJournalRows(db)
+      expect(readJournalEpochRows(db, 'session-1', 'epoch-1')).toHaveLength(0)
+      expect(readJournalEpochRows(db, 'session-1', 'epoch-old')).toHaveLength(0)
+      expect(readJournalSessionEpoch(db, 'session-1')).toBe('epoch-1')
+    } finally {
+      opened.db.close()
+    }
+  })
+
+  it('refuses a duplicate sequence inside one epoch', () => {
+    const opened = openJournalDatabase(dbPath)
+    try {
+      insertJournalRow(opened.db, 'session-1', epochRow(1))
+      expect(() => insertJournalRow(opened.db, 'session-1', epochRow(1))).toThrow()
+      insertJournalRow(opened.db, 'session-1', epochRow(1, 'epoch-2'))
+    } finally {
+      opened.db.close()
+    }
+  })
+
+  it('upserts the session projection in place', () => {
+    const opened = openJournalDatabase(dbPath)
+    try {
+      upsertJournalSessionRow(opened.db, 'session-1', 'epoch-1', 1)
+      upsertJournalSessionRow(opened.db, 'session-1', 'epoch-2', 2)
+      expect(readJournalSessionEpoch(opened.db, 'session-1')).toBe('epoch-2')
+      expect(
+        opened.db.prepare('SELECT count(*) AS total FROM journal_sessions').get()
+      ).toMatchObject({ total: 1 })
+    } finally {
+      opened.db.close()
+    }
+  })
+})
+
+describe('schema creation', () => {
+  // Creating the tables outside the migration transaction left a v2-shaped
+  // database still reporting version 0, which an older build does not latch
+  // read-only: it stamps its own version on and writes through v1 SQL.
+  it('publishes no table until the version bump commits with it', () => {
+    const original = Database.prototype.pragma
+    const pragma = vi.spyOn(Database.prototype, 'pragma').mockImplementation(function (
+      this: Database.Database,
+      sql: string,
+      options?: { simple?: boolean }
+    ) {
+      if (sql.startsWith('user_version =')) {
+        throw new Error('crash before the version is published')
+      }
+      return original.call(this, sql, options)
+    })
+
+    expect(() => openJournalDatabase(dbPath)).toThrow('crash before the version is published')
+    pragma.mockRestore()
+
+    const inspected = new Database(dbPath)
+    try {
+      expect(inspected.pragma('user_version', { simple: true })).toBe(0)
+      expect(
+        inspected
+          .prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'journal_rows'")
+          .get()
+      ).toBeUndefined()
+    } finally {
+      inspected.close()
+    }
+  })
+})
diff --git a/src/main/native-chat/agent-session-journal/journal-database.ts b/src/main/native-chat/agent-session-journal/journal-database.ts
new file mode 100644
index 00000000000..6f1cd60733b
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-database.ts
@@ -0,0 +1,80 @@
+// Opening one session's journal database.
+//
+// `PRAGMA user_version` is read FIRST, on a connection that has set no
+// persistent pragma and run no DDL: a future-schema database must be left
+// byte-identical, and `journal_mode = WAL` writes the file header.
+
+import Database from '../../sqlite/sync-database'
+import { hardenSqliteDatabaseFiles } from '../../sqlite/harden-database-files'
+import { createJournalTablesSql, JOURNAL_DB_SCHEMA_VERSION } from './journal-database-schema'
+
+export const JOURNAL_BUSY_TIMEOUT_MS = 5000
+
+export type OpenJournalDatabase = {
+  db: Database.Database
+  /** A newer `user_version` was met: this build reads and never writes. */
+  readOnly: boolean
+}
+
+export function journalPragmaNumber(db: Database.Database, name: string): number {
+  return Number(db.pragma(name, { simple: true }) ?? 0)
+}
+
+export function openJournalDatabase(dbPath: string): OpenJournalDatabase {
+  const probe = new Database(dbPath)
+  let stored: number
+  try {
+    stored = journalPragmaNumber(probe, 'user_version')
+  } catch (error) {
+    probe.close()
+    throw error
+  }
+  if (stored > JOURNAL_DB_SCHEMA_VERSION) {
+    probe.close()
+    return { db: new Database(dbPath, { readonly: true, fileMustExist: true }), readOnly: true }
+  }
+  let transferred = false
+  try {
+    configureJournalPragmas(probe)
+    createJournalSchema(probe, stored)
+    hardenSqliteDatabaseFiles(dbPath)
+    const opened = { db: probe, readOnly: false }
+    transferred = true
+    return opened
+  } finally {
+    if (!transferred) {
+      probe.close()
+    }
+  }
+}
+
+function configureJournalPragmas(db: Database.Database): void {
+  db.pragma('journal_mode = WAL')
+  db.pragma(`busy_timeout = ${JOURNAL_BUSY_TIMEOUT_MS}`)
+  db.pragma('foreign_keys = ON')
+  // Why FULL rather than the house NORMAL: the write-ahead submission row must
+  // survive a power loss before the adapter dispatches anything, and NORMAL in
+  // WAL mode does not fsync at commit.
+  db.pragma('synchronous = FULL')
+}
+
+/**
+ * Table creation and the `user_version` bump are ONE transaction. Creating the
+ * tables first left a shaped database still reporting version 0, which an older
+ * build does not latch read-only: it stamped its own version on and wrote
+ * through SQL for a schema it did not have.
+ */
+function createJournalSchema(db: Database.Database, stored: number): void {
+  if (stored >= JOURNAL_DB_SCHEMA_VERSION) {
+    return
+  }
+  db.exec('BEGIN IMMEDIATE')
+  try {
+    db.exec(createJournalTablesSql())
+    db.pragma(`user_version = ${JOURNAL_DB_SCHEMA_VERSION}`)
+    db.exec('COMMIT')
+  } catch (error) {
+    db.exec('ROLLBACK')
+    throw error
+  }
+}
diff --git a/src/main/native-chat/agent-session-journal/journal-epoch-controller.ts b/src/main/native-chat/agent-session-journal/journal-epoch-controller.ts
index 087ac9e6a26..f428675fb2c 100644
--- a/src/main/native-chat/agent-session-journal/journal-epoch-controller.ts
+++ b/src/main/native-chat/agent-session-journal/journal-epoch-controller.ts
@@ -2,28 +2,21 @@ import type {
   AgentJournalCursor,
   AgentSessionJournalIdentity
 } from '../../../shared/agent-session-journal-types'
-import type { JournalCompactionPolicy } from './journal-compaction'
-import { quarantineUnreadableSchema } from './journal-corruption-quarantine'
+import type Database from '../../sqlite/sync-database'
 import { replaceJournalEpoch, type JournalReplacementItem } from './journal-epoch-replacement'
 import { publishNewEpoch } from './journal-epoch-rollover'
 import type { JournalLoad } from './journal-open'
 import type { AgentJournalEpochReason } from './journal-row-schema'
-import {
-  assertJournalFence,
-  assertJournalWritable,
-  type JournalAppendBudget
-} from './journal-write-guards'
+import { assertJournalFence, assertJournalWritable } from './journal-write-guards'
 
 export class JournalEpochController {
   constructor(
     private readonly deps: {
       identity: AgentSessionJournalIdentity
-      journalDir: string
-      budget: JournalAppendBudget
-      compaction: JournalCompactionPolicy
       now: () => number
       mintEpoch: () => string
       serialize: <T>(run: () => Promise<T>) => Promise<T>
+      database: () => { db: Database.Database }
       readOnly: () => boolean
       setReadOnly: (readOnly: boolean) => void
       highestFence: () => number
@@ -32,33 +25,33 @@ export class JournalEpochController {
     }
   ) {}
 
-  async start(reason: AgentJournalEpochReason, fence: number): Promise<void> {
-    this.deps.adopt(
-      await publishNewEpoch({
-        journalDir: this.deps.journalDir,
-        sessionId: this.deps.identity.sessionId,
-        providerHandle: this.deps.identity.providerHandle,
-        epoch: this.deps.mintEpoch(),
-        reason,
-        fence,
-        now: this.deps.now(),
-        maxSessionBytes: this.deps.budget.maxSessionBytes
-      })
-    )
+  start(reason: AgentJournalEpochReason, fence: number): void {
+    publishNewEpoch({
+      db: this.deps.database().db,
+      sessionId: this.deps.identity.sessionId,
+      providerHandle: this.deps.identity.providerHandle,
+      epoch: this.deps.mintEpoch(),
+      reason,
+      fence,
+      now: this.deps.now(),
+      onPublished: this.deps.adopt
+    })
   }
 
-  async roll(reason: AgentJournalEpochReason, fence: number): Promise<AgentJournalCursor> {
-    if (reason !== 'schema_unreadable') {
+  /**
+   * Every reason takes the same writable guard. A latched store refuses a roll
+   * like any other write, and `schema_unreadable` has no production caller.
+   *
+   * Serialized like every other write, so the discard cannot land between an
+   * admitted append's sequence assignment and its commit.
+   */
+  roll(reason: AgentJournalEpochReason, fence: number): Promise<AgentJournalCursor> {
+    return this.deps.serialize(async () => {
       assertJournalWritable(this.deps.readOnly(), this.deps.identity.sessionId)
-    } else if (this.deps.readOnly()) {
-      await quarantineUnreadableSchema(this.deps.journalDir, {
-        sessionId: this.deps.identity.sessionId,
-        maxBytes: this.deps.budget.maxSessionBytes
-      })
-    }
-    await this.start(reason, fence)
-    this.deps.setReadOnly(false)
-    return this.deps.cursor()
+      this.start(reason, fence)
+      this.deps.setReadOnly(false)
+      return this.deps.cursor()
+    })
   }
 
   replace(
@@ -69,17 +62,15 @@ export class JournalEpochController {
     return this.deps.serialize(async () => {
       assertJournalWritable(this.deps.readOnly(), this.deps.identity.sessionId)
       assertJournalFence(fence, this.deps.highestFence())
-      await replaceJournalEpoch({
-        journalDir: this.deps.journalDir,
+      replaceJournalEpoch({
+        db: this.deps.database().db,
         identity: this.deps.identity,
         reason,
         fence,
         items,
-        budget: this.deps.budget.fork(),
-        compaction: this.deps.compaction,
         now: this.deps.now,
         mintEpoch: this.deps.mintEpoch,
-        onSnapshotPublished: this.deps.adopt
+        onPublished: this.deps.adopt
       })
       return this.deps.cursor()
     })
diff --git a/src/main/native-chat/agent-session-journal/journal-epoch-replacement.test.ts b/src/main/native-chat/agent-session-journal/journal-epoch-replacement.test.ts
index d4036755fda..96273366d5f 100644
--- a/src/main/native-chat/agent-session-journal/journal-epoch-replacement.test.ts
+++ b/src/main/native-chat/agent-session-journal/journal-epoch-replacement.test.ts
@@ -1,18 +1,19 @@
-import { mkdtemp, readdir, rm } from 'node:fs/promises'
+// Republishing an epoch is ONE transaction.
+
+import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it } from 'vitest'
 import type {
-  AgentJournalItemBody,
+  AgentJournalItemIdentity,
   AgentSessionJournalIdentity
 } from '../../../shared/agent-session-journal-types'
-import { DEFAULT_JOURNAL_COMPACTION_POLICY } from './journal-compaction'
+import { openJournalDatabase, type OpenJournalDatabase } from './journal-database'
 import { replaceJournalEpoch } from './journal-epoch-replacement'
-import { putJournalBlob, readJournalBlob } from './journal-blob-store'
-import { boundPayload, DEFAULT_JOURNAL_PAYLOAD_LIMITS } from './journal-payload-bounds'
-import { journalDirectoryBytes } from './journal-physical-quota'
-import { JournalAppendBudget } from './journal-write-guards'
-import { openAgentSessionJournal } from './journal-store-factory'
+import type { JournalLoad } from './journal-open'
+import { journalDatabaseFile } from './journal-paths'
+import { readJournalEpochRows, readJournalSessionEpoch } from './journal-row-table'
+import { createTrackedJournalOpener } from './journal-store-test-open'
 
 const IDENTITY: AgentSessionJournalIdentity = {
   sessionId: 'session-1',
@@ -24,150 +25,79 @@ const IDENTITY: AgentSessionJournalIdentity = {
 
 let root: string
 let clock = 1_000
-
-beforeEach(async () => {
-  root = await mkdtemp(join(tmpdir(), 'orca-journal-replace-'))
-  clock = 1_000
-})
-
-afterEach(async () => {
-  await rm(root, { recursive: true, force: true })
-})
+let database: OpenJournalDatabase
+const journals = createTrackedJournalOpener()
 
 function now(): number {
   clock += 1
   return clock
 }
 
-function toolBody(output: ReturnType<typeof boundPayload>): AgentJournalItemBody {
-  return {
-    kind: 'tool-call',
-    name: 'shell',
-    input: {},
-    state: 'completed',
-    output
-  }
+function item(ordinal: number): AgentJournalItemIdentity {
+  return { provider: 'codex', threadId: 'thread-1', turnId: 'turn-1', ordinal }
 }
 
-describe('journal epoch replacement', () => {
-  it('publishes one observable replacement and prunes stale root blobs afterward', async () => {
-    const limits = { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, inlineHeadBytes: 8 }
-    const stalePayload = 'stale'.repeat(1_000)
-    const retainedPayload = 'retained'.repeat(1_000)
-    const stale = boundPayload(stalePayload, limits)
-    const retained = boundPayload(retainedPayload, limits)
-    const published: unknown[] = []
-    await putJournalBlob(root, stale.digest, stalePayload)
+function replace(input: {
+  items: Parameters<typeof replaceJournalEpoch>[0]['items']
+  onPublished?: (loaded: JournalLoad) => void
+}): void {
+  replaceJournalEpoch({
+    db: database.db,
+    identity: IDENTITY,
+    reason: 'legacy_import',
+    fence: 1,
+    items: input.items,
+    now,
+    mintEpoch: () => `epoch-${clock}`,
+    onPublished: input.onPublished ?? (() => undefined)
+  })
+}
 
-    await replaceJournalEpoch({
-      journalDir: root,
-      identity: IDENTITY,
-      reason: 'handle_forked',
-      fence: 2,
-      items: [
-        {
-          identity: { provider: 'codex', threadId: 'thread-1', turnId: 'turn-1', ordinal: 0 },
-          body: toolBody(retained),
-          blobs: [{ digest: retained.digest, payload: retainedPayload }]
-        }
-      ],
-      budget: new JournalAppendBudget(IDENTITY.sessionId, {
-        ...limits,
-        maxSessionBytes: 512 * 1024
-      }),
-      compaction: DEFAULT_JOURNAL_COMPACTION_POLICY,
-      now,
-      mintEpoch: () => 'epoch-new',
-      onSnapshotPublished: (loaded) => published.push(loaded)
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-journal-replace-'))
+  clock = 1_000
+  database = openJournalDatabase(journalDatabaseFile(root))
+})
+
+afterEach(async () => {
+  try {
+    database.db.close()
+  } catch {
+    // Already closed by the case.
+  }
+  await journals.closeAll()
+  await rm(root, { recursive: true, force: true })
+})
+
+describe('journal epoch replacement', () => {
+  it('publishes one observable replacement', () => {
+    const published: JournalLoad[] = []
+
+    replace({
+      items: [{ identity: item(1), body: { kind: 'status', text: 'republished' } }],
+      onPublished: (loaded) => published.push(loaded)
     })
 
     expect(published).toHaveLength(1)
-    expect(await readJournalBlob(root, stale.digest)).toBeNull()
-    expect(await readJournalBlob(root, retained.digest)).toBe(retainedPayload)
-    expect((published[0] as { sizeBytes: number }).sizeBytes).toBe(
-      await journalDirectoryBytes(root)
-    )
+    const epoch = readJournalSessionEpoch(database.db, IDENTITY.sessionId)
+    expect(epoch).toBe(published[0]?.state.epoch)
+    expect(readJournalEpochRows(database.db, IDENTITY.sessionId, epoch ?? '')).toHaveLength(2)
   })
 
-  it('keeps root blobs and reports no publication when replacement never becomes authoritative', async () => {
-    const limits = { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, inlineHeadBytes: 8, maxSessionBytes: 6_000 }
-    const stalePayload = 'stale'.repeat(500)
-    const stale = boundPayload(stalePayload, limits)
-    const published: unknown[] = []
-    await putJournalBlob(root, stale.digest, stalePayload)
+  it('discards every superseded row in the same transaction', async () => {
+    const journal = await journals.open({ identity: IDENTITY, journalDir: root })
+    await journal.appendItem(item(1), { kind: 'status', text: 'old' }, { fence: 1 })
+    await journal.appendItem(item(2), { kind: 'status', text: 'older' }, { fence: 1 })
+    const before = journal.epoch
 
-    await expect(
-      replaceJournalEpoch({
-        journalDir: root,
-        identity: IDENTITY,
-        reason: 'handle_forked',
-        fence: 2,
-        items: [
-          {
-            identity: { provider: 'codex', threadId: 'thread-1', turnId: 'turn-1', ordinal: 0 },
-            body: {
-              kind: 'message',
-              role: 'assistant',
-              blocks: [{ type: 'text', text: 'x'.repeat(10_000) }]
-            }
-          }
-        ],
-        budget: new JournalAppendBudget(IDENTITY.sessionId, limits),
-        compaction: DEFAULT_JOURNAL_COMPACTION_POLICY,
-        now,
-        mintEpoch: () => 'epoch-new',
-        onSnapshotPublished: (loaded) => published.push(loaded)
-      })
-    ).rejects.toMatchObject({ code: 'journal_bound_exceeded' })
+    await journal.replaceEpochItems('legacy_import', 1, [
+      { identity: item(9), body: { kind: 'status', text: 'republished' } }
+    ])
 
-    expect(published).toHaveLength(0)
-    expect(await readJournalBlob(root, stale.digest)).toBe(stalePayload)
-    expect((await readdir(root)).some((name) => name.startsWith('.epoch-replacement-'))).toBe(false)
-  })
-
-  it('charges replacement blobs cumulatively and rolls back staging on quota refusal', async () => {
-    const limits = { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, inlineHeadBytes: 8, maxSessionBytes: 7_000 }
-    const journal = await openAgentSessionJournal({
-      identity: IDENTITY,
-      journalDir: root,
-      limits,
-      autoCompact: false,
-      now,
-      mintEpoch: () => `epoch-${clock}`
-    })
-    const existingPayload = 'existing'.repeat(250)
-    const existing = boundPayload(existingPayload, limits)
-    await journal.appendItemWithBlobs(
-      { provider: 'codex', threadId: 'thread-1', turnId: 'turn-1', ordinal: 0 },
-      toolBody(existing),
-      [{ digest: existing.digest, payload: existingPayload }],
-      { fence: 1 }
-    )
-
-    const replacementPayload = 'replacement'.repeat(200)
-    const replacement = boundPayload(replacementPayload, limits)
-    const secondPayload = 'second'.repeat(200)
-    const second = boundPayload(secondPayload, limits)
-    await expect(
-      journal.replaceEpochItems('handle_forked', 2, [
-        {
-          identity: { provider: 'codex', threadId: 'thread-1', turnId: 'turn-1', ordinal: 1 },
-          body: toolBody(replacement),
-          blobs: [{ digest: replacement.digest, payload: replacementPayload }]
-        },
-        {
-          identity: { provider: 'codex', threadId: 'thread-1', turnId: 'turn-1', ordinal: 2 },
-          body: toolBody(second),
-          blobs: [{ digest: second.digest, payload: secondPayload }]
-        }
-      ])
-    ).rejects.toMatchObject({ code: 'journal_bound_exceeded' })
-
-    expect(journal.epoch).toMatch(/^epoch-/)
-    expect(await readJournalBlob(root, existing.digest)).toBe(existingPayload)
-    expect(await readJournalBlob(root, replacement.digest)).toBeNull()
-    expect(await readJournalBlob(root, second.digest)).toBeNull()
-    expect((await readdir(root)).some((name) => name.startsWith('.epoch-replacement-'))).toBe(false)
-    expect(await journalDirectoryBytes(root)).toBeLessThanOrEqual(limits.maxSessionBytes)
+    expect(journal.epoch).not.toBe(before)
+    expect(readJournalEpochRows(database.db, IDENTITY.sessionId, before)).toHaveLength(0)
+    expect(journal.snapshot().items.map((entry) => entry.body)).toEqual([
+      { kind: 'status', text: 'republished' }
+    ])
   })
 })
diff --git a/src/main/native-chat/agent-session-journal/journal-epoch-replacement.ts b/src/main/native-chat/agent-session-journal/journal-epoch-replacement.ts
index 342c60c4f1d..9512d5e9fa1 100644
--- a/src/main/native-chat/agent-session-journal/journal-epoch-replacement.ts
+++ b/src/main/native-chat/agent-session-journal/journal-epoch-replacement.ts
@@ -1,298 +1,85 @@
-import { mkdir, mkdtemp, rm, stat } from 'node:fs/promises'
-import { join } from 'node:path'
-import { copyFileDurable } from '../../durable-file-write'
+// Republishing a live item set into a fresh epoch.
+//
+// One transaction: discard every row, insert the epoch row plus the replacement
+// items, move the session projection, and retire any repair marker — this
+// republished history is exactly what the marker was holding out for.
+
 import type {
   AgentJournalItemBody,
   AgentJournalItemIdentity,
   AgentSessionJournalIdentity
 } from '../../../shared/agent-session-journal-types'
-import { compactJournal, type JournalCompactionPolicy } from './journal-compaction'
-import { JOURNAL_LOG_FILE, JOURNAL_SNAPSHOT_FILE, appendJournalRows } from './journal-log-file'
-import {
-  applyJournalRow,
-  blobDigestsInBody,
-  createJournalReducerState,
-  referencedBlobDigests,
-  type JournalReducerState
-} from './journal-reducer'
-import { buildJournalItemRow, journalRowBase } from './journal-row-builders'
-import type { AgentJournalEpochReason, JournalRow } from './journal-row-schema'
-import { journalRowByteLength } from './journal-row-schema'
-import { assertJournalFence, type JournalAppendBudget } from './journal-write-guards'
+import type Database from '../../sqlite/sync-database'
 import type { JournalLoad } from './journal-open'
-import { assertJournalPhysicalCapacity, journalDirectoryBytes } from './journal-physical-quota'
+import { clearJournalRepairMarker } from './journal-repair-marker'
+import { applyJournalRow, createJournalReducerState } from './journal-reducer'
+import { buildJournalItemRow, journalRowBase } from './journal-row-builders'
 import {
-  JOURNAL_BLOB_DIR,
-  journalBlobFileSize,
-  putJournalBlob,
-  pruneJournalBlobs,
-  removeJournalBlob
-} from './journal-blob-store'
+  deleteAllJournalRows,
+  insertJournalRow,
+  upsertJournalSessionRow
+} from './journal-row-table'
+import type { AgentJournalEpochReason, JournalRow } from './journal-row-schema'
+import { assertJournalFence } from './journal-write-guards'
 
 export type JournalReplacementItem = {
   identity: AgentJournalItemIdentity
   body: AgentJournalItemBody
-  blobs?: readonly { digest: string; payload: string }[]
   observedAt?: number
 }
 
-export async function replaceJournalEpoch(input: {
-  journalDir: string
+export function replaceJournalEpoch(input: {
+  db: Database.Database
   identity: AgentSessionJournalIdentity
   reason: AgentJournalEpochReason
   fence: number
   items: readonly JournalReplacementItem[]
-  budget: JournalAppendBudget
-  compaction: JournalCompactionPolicy
   now: () => number
   mintEpoch: () => string
-  onSnapshotPublished: (loaded: JournalLoad) => void
-}): Promise<void> {
-  const stagingDir = await mkdtemp(join(input.journalDir, '.epoch-replacement-'))
-  const stagedBlobDigests = new Set<string>()
-  const publishedBlobDigests: string[] = []
-  let snapshotPublished = false
-  let adoptionReported = false
-  let publishedLoad: JournalLoad | null = null
+  /** Called the instant the transaction commits, before any fallible follow-up. */
+  onPublished: (loaded: JournalLoad) => void
+}): void {
+  const epoch = input.mintEpoch()
+  const state = createJournalReducerState(input.identity.sessionId, epoch)
+  const epochRow: JournalRow = {
+    kind: 'epoch',
+    reason: input.reason,
+    providerHandle: input.identity.providerHandle,
+    ...journalRowBase(epoch, 1, input.fence, input.now())
+  }
+  const rows: JournalRow[] = [epochRow]
+  applyJournalRow(state, epochRow)
+  for (const item of input.items) {
+    const row = buildJournalItemRow({
+      state,
+      identity: item.identity,
+      body: item.body,
+      seq: state.lastSequence + 1,
+      fence: input.fence,
+      ts: item.observedAt ?? input.now()
+    })
+    assertJournalFence(row.fence, state.highestFence)
+    applyJournalRow(state, row)
+    rows.push(row)
+  }
+
+  input.db.exec('BEGIN IMMEDIATE')
   try {
-    const epoch = input.mintEpoch()
-    const state = createJournalReducerState(input.identity.sessionId, epoch)
-    const epochRow: JournalRow = {
-      kind: 'epoch',
-      reason: input.reason,
-      providerHandle: input.identity.providerHandle,
-      ...journalRowBase(epoch, 1, input.fence, input.now())
-    }
-    const rows: JournalRow[] = [epochRow]
-    applyJournalRow(state, epochRow)
-    let sizeBytes = journalRowByteLength(epochRow)
-    await assertStagingCapacity(input, sizeBytes)
-    await appendJournalRows(stagingDir, [epochRow])
-
-    for (const item of input.items) {
-      sizeBytes += await stageReplacementBlobs({
-        journalDir: input.journalDir,
-        stagingDir,
-        identity: input.identity,
-        budget: input.budget,
-        stagedBlobDigests,
-        blobs: item.blobs ?? []
-      })
-      const appendTime = input.now()
-      const row = buildJournalItemRow({
-        state,
-        identity: item.identity,
-        body: item.body,
-        seq: state.lastSequence + 1,
-        fence: input.fence,
-        ts: item.observedAt ?? appendTime
-      })
-      assertJournalFence(row.fence, state.highestFence)
-      input.budget.assert(row, appendTime, sizeBytes)
-      await assertStagingCapacity(input, journalRowByteLength(row))
-      await appendJournalRows(stagingDir, [row])
-      applyJournalRow(state, row)
-      rows.push(row)
-      sizeBytes += journalRowByteLength(row)
-    }
-
-    const compacted = await compactJournal({
-      journalDir: stagingDir,
-      physicalQuotaRoot: input.journalDir,
-      state,
-      tailRows: rows,
-      policy: input.compaction,
-      now: input.now(),
-      maxSessionBytes: input.budget.maxSessionBytes
-    })
-    // All destination publishes use durable temp files while the staging
-    // source and existing finals remain present. Reserve the whole publication
-    // peak before touching the live epoch so a later file cannot fail halfway
-    // through replacement.
-    const stagedSnapshotBytes = (await stat(join(stagingDir, JOURNAL_SNAPSHOT_FILE))).size
-    const stagedLogBytes = (await stat(join(stagingDir, JOURNAL_LOG_FILE))).size
-    let stagedPublishBytes = stagedSnapshotBytes + stagedLogBytes
-    for (const digest of stagedBlobDigests) {
-      stagedPublishBytes += (await stat(join(stagingDir, JOURNAL_BLOB_DIR, digest))).size
-    }
-    await assertJournalPhysicalCapacity({
-      journalDir: input.journalDir,
-      sessionId: input.identity.sessionId,
-      maxBytes: input.budget.maxSessionBytes,
-      peakAdditionalBytes: stagedPublishBytes
-    })
-    for (const digest of stagedBlobDigests) {
-      if (
-        await publishPreparedBlob(
-          stagingDir,
-          input.journalDir,
-          digest,
-          input.identity.sessionId,
-          input.budget.maxSessionBytes
-        )
-      ) {
-        publishedBlobDigests.push(digest)
-      }
-    }
-    await publishPreparedFile(
-      stagingDir,
-      input.journalDir,
-      JOURNAL_SNAPSHOT_FILE,
-      input.identity.sessionId,
-      input.budget.maxSessionBytes
-    )
-    snapshotPublished = true
-    state.oldestSequence = compacted.oldestSequence
-    publishedLoad = {
-      state,
-      tailRows: compacted.tailRows,
-      compactedThrough: compacted.compactedThrough,
-      readOnly: false,
-      corrupt: false,
-      malformedRows: 0,
-      sizeBytes: 0
-    }
-    await publishPreparedFile(
-      stagingDir,
-      input.journalDir,
-      JOURNAL_LOG_FILE,
-      input.identity.sessionId,
-      input.budget.maxSessionBytes
-    )
-    await pruneJournalBlobs(
-      input.journalDir,
-      replacementRetainedBlobDigests(state, compacted.tailRows)
-    )
-  } finally {
-    if (!snapshotPublished) {
-      for (const digest of publishedBlobDigests) {
-        await removeJournalBlob(input.journalDir, digest)
-      }
-    }
-    await rm(stagingDir, { recursive: true, force: true })
-    if (snapshotPublished && publishedLoad && !adoptionReported) {
-      adoptionReported = true
-      input.onSnapshotPublished({
-        ...publishedLoad,
-        sizeBytes: await journalDirectoryBytes(input.journalDir)
-      })
+    deleteAllJournalRows(input.db)
+    clearJournalRepairMarker(input.db, input.identity.sessionId)
+    for (const row of rows) {
+      insertJournalRow(input.db, input.identity.sessionId, row)
     }
+    upsertJournalSessionRow(input.db, input.identity.sessionId, epoch, epochRow.ts)
+    input.db.exec('COMMIT')
+  } catch (error) {
+    input.db.exec('ROLLBACK')
+    throw error
   }
-}
 
-function replacementRetainedBlobDigests(
-  state: JournalReducerState,
-  tailRows: readonly JournalRow[]
-): Set<string> {
-  const retained = referencedBlobDigests(state)
-  for (const row of tailRows) {
-    if (row.kind === 'item') {
-      blobDigestsInBody(row.body, retained)
-    } else if (row.kind === 'lifecycle-batch') {
-      for (const mutation of row.mutations) {
-        if (mutation.kind === 'item') {
-          blobDigestsInBody(mutation.body, retained)
-        }
-      }
-    }
-  }
-  return retained
-}
-
-async function stageReplacementBlobs(input: {
-  journalDir: string
-  stagingDir: string
-  identity: AgentSessionJournalIdentity
-  budget: JournalAppendBudget
-  stagedBlobDigests: Set<string>
-  blobs: readonly { digest: string; payload: string }[]
-}): Promise<number> {
-  const toStage: { digest: string; payload: string; bytes: number }[] = []
-  const unique = new Map(input.blobs.map((blob) => [blob.digest, blob]))
-  for (const blob of unique.values()) {
-    if (input.stagedBlobDigests.has(blob.digest)) {
-      continue
-    }
-    if ((await journalBlobFileSize(input.journalDir, blob.digest)) !== null) {
-      continue
-    }
-    const bytes = Buffer.byteLength(blob.payload, 'utf8')
-    toStage.push({ ...blob, bytes })
-  }
-  // Reserve all new payloads together. The staging directory lives under the
-  // journal root, so the capacity check includes existing session bytes and
-  // every other .epoch-replacement-* directory already present.
-  const stagedBytes = toStage.reduce((total, blob) => total + blob.bytes, 0)
-  await assertStagingCapacity(input, stagedBytes)
-  for (const blob of toStage) {
-    await putJournalBlob(input.stagingDir, blob.digest, blob.payload)
-    input.stagedBlobDigests.add(blob.digest)
-  }
-  return stagedBytes
-}
-
-function assertStagingCapacity(
-  input: {
-    journalDir: string
-    identity: AgentSessionJournalIdentity
-    budget: JournalAppendBudget
-  },
-  additionalBytes: number
-): Promise<number> {
-  return assertJournalPhysicalCapacity({
-    journalDir: input.journalDir,
-    sessionId: input.identity.sessionId,
-    maxBytes: input.budget.maxSessionBytes,
-    peakAdditionalBytes: additionalBytes
-  })
-}
-
-async function publishPreparedFile(
-  stagingDir: string,
-  journalDir: string,
-  fileName: string,
-  sessionId: string,
-  maxBytes: number
-): Promise<void> {
-  await assertJournalPhysicalCapacity({
-    journalDir,
-    sessionId,
-    maxBytes,
-    peakAdditionalBytes: (await stat(join(stagingDir, fileName))).size
-  })
-  const copied = await copyFileDurable(join(stagingDir, fileName), join(journalDir, fileName))
-  if (!copied) {
-    throw new Error(`prepared journal file disappeared before publish: ${fileName}`)
-  }
-}
-
-async function publishPreparedBlob(
-  stagingDir: string,
-  journalDir: string,
-  digest: string,
-  sessionId: string,
-  maxBytes: number
-): Promise<boolean> {
-  if ((await journalBlobFileSize(journalDir, digest)) !== null) {
-    return false
-  }
-  const size = await journalBlobFileSize(stagingDir, digest)
-  if (size === null) {
-    throw new Error(`prepared journal blob disappeared before publish: ${digest}`)
-  }
-  await assertJournalPhysicalCapacity({
-    journalDir,
-    sessionId,
-    maxBytes,
-    peakAdditionalBytes: size
-  })
-  await mkdir(join(journalDir, JOURNAL_BLOB_DIR), { recursive: true })
-  const copied = await copyFileDurable(
-    join(stagingDir, JOURNAL_BLOB_DIR, digest),
-    join(journalDir, JOURNAL_BLOB_DIR, digest)
-  )
-  if (!copied) {
-    throw new Error(`prepared journal blob disappeared before publish: ${digest}`)
-  }
-  return true
+  // COMMIT landed: on disk the superseded rows are gone and this epoch is the
+  // live one. The caller adopts that immediately, or a later failure leaves the
+  // live store writing into an epoch whose rows were just deleted.
+  state.oldestSequence = 1
+  input.onPublished({ state, readOnly: false, corrupt: false, malformedRows: 0 })
 }
diff --git a/src/main/native-chat/agent-session-journal/journal-epoch-rollover.ts b/src/main/native-chat/agent-session-journal/journal-epoch-rollover.ts
index 40e1bc3a542..e95ff821058 100644
--- a/src/main/native-chat/agent-session-journal/journal-epoch-rollover.ts
+++ b/src/main/native-chat/agent-session-journal/journal-epoch-rollover.ts
@@ -1,29 +1,34 @@
 // Opening a new epoch.
 //
-// The snapshot is what names the live epoch, so it is published BEFORE the log
-// is reset. A crash mid-rollover therefore leaves stale-epoch rows behind the
-// new snapshot, which `loadJournal` drops — the reverse order would leave a
-// journal whose log no longer matches any epoch anyone can name.
+// One transaction: discard every row of the superseded epoch, insert the new
+// epoch row at sequence 1, move the session projection onto it, and retire any
+// repair marker the superseded epoch was carrying. Superseded rows are DELETED
+// rather than retained — nothing would ever shed them.
 
 import { AGENT_SESSION_JOURNAL_SCHEMA_VERSION } from '../../../shared/agent-session-journal-types'
 import type { AgentSessionProviderHandle } from '../../../shared/agent-session-journal-types'
-import { compactJournal } from './journal-compaction'
-import { applyJournalRow, createJournalReducerState } from './journal-reducer'
-import type { AgentJournalEpochReason, JournalRow } from './journal-row-schema'
-import { journalRowByteLength } from './journal-row-schema'
+import type Database from '../../sqlite/sync-database'
 import type { JournalLoad } from './journal-open'
-import { DEFAULT_JOURNAL_PAYLOAD_LIMITS } from './journal-payload-bounds'
+import { clearJournalRepairMarker } from './journal-repair-marker'
+import { applyJournalRow, createJournalReducerState } from './journal-reducer'
+import {
+  deleteAllJournalRows,
+  insertJournalRow,
+  upsertJournalSessionRow
+} from './journal-row-table'
+import type { AgentJournalEpochReason, JournalRow } from './journal-row-schema'
 
-export async function publishNewEpoch(input: {
-  journalDir: string
+export function publishNewEpoch(input: {
+  db: Database.Database
   sessionId: string
   providerHandle: AgentSessionProviderHandle
   epoch: string
   reason: AgentJournalEpochReason
   fence: number
   now: number
-  maxSessionBytes?: number
-}): Promise<JournalLoad> {
+  /** Called the instant the transaction commits, before any fallible follow-up. */
+  onPublished: (loaded: JournalLoad) => void
+}): void {
   const row: JournalRow = {
     kind: 'epoch',
     reason: input.reason,
@@ -34,25 +39,24 @@ export async function publishNewEpoch(input: {
     fence: input.fence,
     ts: input.now
   }
+
+  input.db.exec('BEGIN IMMEDIATE')
+  try {
+    deleteAllJournalRows(input.db)
+    clearJournalRepairMarker(input.db, input.sessionId)
+    insertJournalRow(input.db, input.sessionId, row)
+    upsertJournalSessionRow(input.db, input.sessionId, input.epoch, input.now)
+    input.db.exec('COMMIT')
+  } catch (error) {
+    input.db.exec('ROLLBACK')
+    throw error
+  }
+
+  // COMMIT landed: on disk the superseded prefix is gone and this epoch is the
+  // live one. The caller adopts that immediately, or a later failure leaves the
+  // store writing into an epoch that no longer exists.
   const state = createJournalReducerState(input.sessionId, input.epoch)
-  await compactJournal({
-    journalDir: input.journalDir,
-    state,
-    tailRows: [row],
-    policy: { minTailRows: 1, retainTailMs: Number.POSITIVE_INFINITY },
-    now: input.now,
-    maxSessionBytes: input.maxSessionBytes ?? DEFAULT_JOURNAL_PAYLOAD_LIMITS.maxSessionBytes,
-    sessionId: input.sessionId
-  })
   applyJournalRow(state, row)
   state.oldestSequence = 1
-  return {
-    state,
-    tailRows: [row],
-    compactedThrough: 0,
-    readOnly: false,
-    corrupt: false,
-    malformedRows: 0,
-    sizeBytes: journalRowByteLength(row)
-  }
+  input.onPublished({ state, readOnly: false, corrupt: false, malformedRows: 0 })
 }
diff --git a/src/main/native-chat/agent-session-journal/journal-file-format-remnant.test.ts b/src/main/native-chat/agent-session-journal/journal-file-format-remnant.test.ts
new file mode 100644
index 00000000000..d6424ce7952
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-file-format-remnant.test.ts
@@ -0,0 +1,196 @@
+// An empty chat beside a pre-SQLite journal explains itself.
+//
+// The SQLite move shipped no importer, so a session whose history is a
+// `log.jsonl` founds a fresh empty journal beside it and looks exactly like a
+// chat created seconds ago. One status row is the difference.
+
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import Database from '../../sqlite/sync-database'
+import { agentJournalItemKey } from '../../../shared/agent-session-journal-item-key'
+import type { AgentSessionJournalIdentity } from '../../../shared/agent-session-journal-types'
+import { projectStructuredItemsToNativeChat } from '../../../shared/structured-agent-session-projection'
+import { openJournalDatabase } from './journal-database'
+import { JOURNAL_DB_SCHEMA_VERSION } from './journal-database-schema'
+import { JOURNAL_FILE_FORMAT_REMNANT_DISCLOSURE_IDENTITY } from './journal-file-format-remnant'
+import { loadJournal } from './journal-open'
+import { journalDatabaseFile } from './journal-paths'
+import type { AgentSessionJournal } from './journal-store'
+import type { openAgentSessionJournal } from './journal-store-factory'
+import { createTrackedJournalOpener } from './journal-store-test-open'
+
+const IDENTITY: AgentSessionJournalIdentity = {
+  sessionId: 'session-1',
+  workspaceId: 'ws-1',
+  hostId: 'host-1',
+  agent: 'codex',
+  providerHandle: { kind: 'codex', threadId: 'thread-1' }
+}
+
+const DISCLOSURE_ITEM_ID = agentJournalItemKey(JOURNAL_FILE_FORMAT_REMNANT_DISCLOSURE_IDENTITY)
+
+let root: string
+let clock = 1_000
+const journals = createTrackedJournalOpener()
+
+function open(overrides: Partial<Parameters<typeof openAgentSessionJournal>[0]> = {}) {
+  return journals.open({
+    identity: IDENTITY,
+    journalDir: root,
+    now: () => (clock += 1),
+    mintEpoch: () => `epoch-${clock}`,
+    ...overrides
+  })
+}
+
+function writeRemnant(name = 'log.jsonl'): Promise<void> {
+  return writeFile(join(root, name), '{"kind":"epoch","v":1,"seq":1}\n', 'utf8')
+}
+
+function disclosure(journal: AgentSessionJournal): string | null {
+  const row = journal.snapshot().items.find((entry) => entry.itemId === DISCLOSURE_ITEM_ID)
+  return row?.body.kind === 'status' ? row.body.text : null
+}
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-journal-remnant-'))
+  clock = 1_000
+})
+
+afterEach(async () => {
+  await journals.closeAll()
+  await rm(root, { recursive: true, force: true })
+})
+
+describe('a chat whose history is still in the pre-SQLite format', () => {
+  it('says how to carry on, and where the transcript is', async () => {
+    await writeRemnant()
+
+    const journal = await open()
+
+    expect(disclosure(journal)).toContain('send a message to pick up where you left off')
+    expect(disclosure(journal)).toContain(join(root, 'log.jsonl'))
+    expect(disclosure(journal)).toContain('Codex')
+  })
+
+  // Both files is the normal shape of a pre-SQLite directory: every epoch roll
+  // staged a snapshot whether or not anything compacted into it, so preferring
+  // the snapshot would name an empty file for ~every affected chat.
+  it('names the log, not the snapshot staged beside it', async () => {
+    await writeRemnant('log.jsonl')
+    await writeRemnant('snapshot.json')
+
+    const journal = await open()
+
+    expect(disclosure(journal)).toContain(join(root, 'log.jsonl'))
+    expect(disclosure(journal)).not.toContain('snapshot.json')
+  })
+
+  it('falls back to the snapshot when a chat has no log beside it', async () => {
+    await writeRemnant('snapshot.json')
+
+    const journal = await open()
+
+    expect(disclosure(journal)).toContain(join(root, 'snapshot.json'))
+  })
+
+  it('says nothing to a chat that is genuinely new', async () => {
+    const journal = await open()
+
+    expect(journal.snapshot().items).toEqual([])
+  })
+
+  // Counting rows proves nothing here — the append upserts by identity, so a
+  // second append would still leave exactly one. The revision is what moves.
+  it('does not re-append the row on a later open', async () => {
+    await writeRemnant()
+    const first = await open()
+    const firstRevision = first
+      .snapshot()
+      .items.find((e) => e.itemId === DISCLOSURE_ITEM_ID)?.revision
+    await first.close()
+
+    const reopened = await open()
+
+    const row = reopened.snapshot().items.find((e) => e.itemId === DISCLOSURE_ITEM_ID)
+    expect(firstRevision).toBe(1)
+    expect(row?.revision).toBe(1)
+    expect(reopened.cursor().sequence).toBe(2)
+  })
+
+  // The epoch commit and this append are separate transactions; if the append is
+  // lost the epoch exists but holds nothing, and every later open takes the
+  // adopt branch. The offer has to survive that.
+  it('offers the message again when a committed epoch holds nothing', async () => {
+    const founded = await open()
+    await founded.close()
+    await writeRemnant()
+
+    const reopened = await open()
+
+    expect(disclosure(reopened)).toContain(join(root, 'log.jsonl'))
+  })
+
+  // A repair's epoch is the marker that history was deleted and never rebuilt,
+  // and any row that is not the repair's own disclosure retires it. Appending
+  // here would silently stop the session ever asking the provider for that
+  // history — with the journal still holding none.
+  it('stays out of a journal this open just repaired', async () => {
+    const journal = await open()
+    await journal.appendItem(
+      { provider: 'codex', threadId: 'thread-1', turnId: 'turn-1', ordinal: 0 },
+      { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text: 'history' }] },
+      { fence: 1 }
+    )
+    await journal.close()
+    // Deleting the anchor leaves every row unanchored: replay keeps nothing, so
+    // the repair publishes an empty `unreconcilable_prefix` epoch and — costing
+    // no malformed row — appends no disclosure of its own. That is the one state
+    // where this branch and a repair meet.
+    const opened = openJournalDatabase(journalDatabaseFile(root))
+    try {
+      opened.db.prepare('DELETE FROM journal_rows WHERE seq = ?').run(1)
+    } finally {
+      opened.db.close()
+    }
+    await writeRemnant()
+
+    const repaired = await open()
+
+    expect(disclosure(repaired)).toBeNull()
+    // Still asking the provider for the history the repair dropped.
+    expect(loadJournal(root, IDENTITY.sessionId)).toMatchObject({ corrupt: true })
+  })
+
+  // A latched journal loads empty, so it reaches the same branch — and an append
+  // into one throws, which would make the session unopenable rather than read-only.
+  it('writes nothing into a journal latched by a newer schema', async () => {
+    const founded = await open()
+    await founded.close()
+    const db = new Database(journalDatabaseFile(root))
+    try {
+      db.pragma(`user_version = ${JOURNAL_DB_SCHEMA_VERSION + 1}`)
+    } finally {
+      db.close()
+    }
+    await writeRemnant()
+
+    const latched = await open()
+
+    expect(latched.isReadOnly).toBe(true)
+    expect(disclosure(latched)).toBeNull()
+  })
+
+  // A row nothing projects is a row nobody reads.
+  it('renders in the transcript as a system line', async () => {
+    await writeRemnant()
+
+    const journal = await open()
+
+    const messages = projectStructuredItemsToNativeChat(journal.snapshot().items)
+    expect(messages).toHaveLength(1)
+    expect(messages[0]?.role).toBe('system')
+  })
+})
diff --git a/src/main/native-chat/agent-session-journal/journal-file-format-remnant.ts b/src/main/native-chat/agent-session-journal/journal-file-format-remnant.ts
new file mode 100644
index 00000000000..69dcc04bf64
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-file-format-remnant.ts
@@ -0,0 +1,60 @@
+// A journal directory left behind by the pre-SQLite file format.
+//
+// Not `journal-legacy-import.ts`, which reads the PROVIDER's own transcript.
+// This is Orca's own `log.jsonl`, which no build after the SQLite move reads.
+// Nothing imports it, so the session it belonged to opens empty and is
+// indistinguishable from a chat created seconds ago — same `session_created`
+// epoch, same empty timeline. The remnant is the one durable fact that tells
+// them apart, so the empty session says where its history went and how to carry
+// on instead of silently claiming it never had any.
+
+import { existsSync } from 'node:fs'
+import { join } from 'node:path'
+import type { AgentJournalItemIdentity } from '../../../shared/agent-session-journal-types'
+import { boundJournalStatusText } from './journal-prompt-body-bounds'
+import { formatAgentTypeLabel } from '../../../shared/agent-type-label'
+import type { AgentType } from '../../../shared/agent-status-types'
+
+/** The remnant's transcript, or null when the directory never held one.
+ *
+ *  `log.jsonl` first, and the order matters: every epoch roll staged a
+ *  `snapshot.json` whether or not anything was ever compacted into it, so the
+ *  file's existence says nothing about where the history lives. Measured across
+ *  a real profile, `compactedThrough` was 0 in all 80 — the log holds the
+ *  transcript and the snapshot is the fallback for a session that has no log. */
+export function findJournalFileFormatRemnant(journalDir: string): string | null {
+  for (const name of ['log.jsonl', 'snapshot.json']) {
+    const path = join(journalDir, name)
+    if (existsSync(path)) {
+      return path
+    }
+  }
+  return null
+}
+
+/** One stable identity, so a reopen upserts the same row instead of adding one. */
+export const JOURNAL_FILE_FORMAT_REMNANT_DISCLOSURE_IDENTITY: AgentJournalItemIdentity = {
+  provider: 'orca',
+  clientMessageId: 'journal-file-format-remnant'
+}
+
+/** How to carry on. The session attaches on the record's own provider handle, so it
+ *  still names the conversation the transcript no longer shows — whether the provider
+ *  itself still holds that thread is its own business, hence "points at". */
+export function journalFileFormatRemnantDisclosure(input: {
+  transcriptPath: string
+  agent: AgentType
+}): { identity: AgentJournalItemIdentity; body: { kind: 'status'; text: string } } {
+  return {
+    identity: JOURNAL_FILE_FORMAT_REMNANT_DISCLOSURE_IDENTITY,
+    body: {
+      kind: 'status',
+      text: boundJournalStatusText(
+        `This chat's history was saved in an older format Orca no longer reads, so it starts ` +
+          `empty. The session still points at the same ${formatAgentTypeLabel(input.agent)} ` +
+          `conversation — send a message to pick up where you left off. The original ` +
+          `transcript is on the session's host at \`${input.transcriptPath}\``
+      )
+    }
+  }
+}
diff --git a/src/main/native-chat/agent-session-journal/journal-handle-ownership.test.ts b/src/main/native-chat/agent-session-journal/journal-handle-ownership.test.ts
new file mode 100644
index 00000000000..592f7471c5c
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-handle-ownership.test.ts
@@ -0,0 +1,161 @@
+// Every path that can open a SQLite connection releases it.
+//
+// Asserting that the happy path closes cleanly proves nothing: these sites are
+// reached only when something has already gone wrong. On POSIX a leak is
+// SILENT — the unlink succeeds — so each case asserts BOTH that the sidecars
+// are gone and that the directory renames and removes, which is the half that
+// actually fails on Windows.
+
+import { access, mkdtemp, rename, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type {
+  AgentJournalItemBody,
+  AgentJournalItemIdentity,
+  AgentSessionJournalIdentity
+} from '../../../shared/agent-session-journal-types'
+import Database from '../../sqlite/sync-database'
+import { openJournalDatabase } from './journal-database'
+import { JOURNAL_DB_SCHEMA_VERSION } from './journal-database-schema'
+import { loadJournal } from './journal-open'
+import { journalDatabaseFile } from './journal-paths'
+import { createTrackedJournalOpener } from './journal-store-test-open'
+
+const IDENTITY: AgentSessionJournalIdentity = {
+  sessionId: 'session-1',
+  workspaceId: 'ws-1',
+  hostId: 'host-1',
+  agent: 'codex',
+  providerHandle: { kind: 'codex', threadId: 'thread-1' }
+}
+
+let base: string
+let root: string
+const journals = createTrackedJournalOpener()
+
+function item(ordinal: number): AgentJournalItemIdentity {
+  return { provider: 'codex', threadId: 'thread-1', turnId: 'turn-1', ordinal }
+}
+
+function runningTool(): AgentJournalItemBody {
+  return { kind: 'tool-call', name: 'command', input: {}, state: 'running' }
+}
+
+async function exists(path: string): Promise<boolean> {
+  return access(path)
+    .then(() => true)
+    .catch(() => false)
+}
+
+/** The platform-independent proof: an open handle blocks both of these on
+ *  Windows, where every leak in this file actually shows up. */
+async function expectNothingHoldsTheDirectory(): Promise<void> {
+  const dbPath = journalDatabaseFile(root)
+  expect(await exists(`${dbPath}-wal`)).toBe(false)
+  expect(await exists(`${dbPath}-shm`)).toBe(false)
+  const moved = `${root}-recovered-vtest`
+  await rename(root, moved)
+  await rm(moved, { recursive: true })
+  root = join(base, `journal-${Math.random().toString(36).slice(2)}`)
+}
+
+beforeEach(async () => {
+  base = await mkdtemp(join(tmpdir(), 'orca-journal-handles-'))
+  root = join(base, 'journal')
+})
+
+afterEach(async () => {
+  await journals.closeAll()
+  await rm(base, { recursive: true, force: true })
+})
+
+describe('the standalone probe owns its own connection', () => {
+  it('leaves no handle behind after fifty repeated loads', async () => {
+    const journal = await journals.open({ identity: IDENTITY, journalDir: root })
+    await journal.appendItem(item(1), { kind: 'message', role: 'user', blocks: [] }, { fence: 1 })
+    await journal.close()
+
+    for (let attempt = 0; attempt < 50; attempt += 1) {
+      const loaded = await loadJournal(root, IDENTITY.sessionId)
+      expect(loaded?.readOnly).toBe(false)
+    }
+    await expectNothingHoldsTheDirectory()
+  })
+
+  it('leaves no handle behind after fifty loads of a latched future schema', async () => {
+    const journal = await journals.open({ identity: IDENTITY, journalDir: root })
+    await journal.close()
+    const seeded = openJournalDatabase(journalDatabaseFile(root))
+    seeded.db.pragma(`user_version = ${JOURNAL_DB_SCHEMA_VERSION + 3}`)
+    seeded.db.close()
+
+    for (let attempt = 0; attempt < 50; attempt += 1) {
+      // The latched open closes the probe connection and returns the read-only
+      // reopen, so probing repeatedly leaves nothing on a file we must not touch.
+      expect((await loadJournal(root, IDENTITY.sessionId))?.readOnly).toBe(true)
+    }
+    // A read-only connection cannot remove the sidecars it materialized, so only
+    // the rename/remove half is expected to hold here.
+    const moved = `${root}-recovered-vtest`
+    await rename(root, moved)
+    await rm(moved, { recursive: true })
+    root = join(base, 'journal-after-latched')
+  })
+
+  it('returns null for a session with no journal, without creating one', async () => {
+    expect(await loadJournal(root, IDENTITY.sessionId)).toBeNull()
+    expect(await exists(journalDatabaseFile(root))).toBe(false)
+  })
+})
+
+describe('failure paths inside the open call', () => {
+  // Site 1: the raw connection is owned by `openJournalDatabase` until it returns.
+  it('closes the raw connection when the version read cannot run', async () => {
+    await journals.open({ identity: IDENTITY, journalDir: root }).then((journal) => journal.close())
+    await writeFile(journalDatabaseFile(root), 'this is not a database', 'utf8')
+
+    expect(() => openJournalDatabase(journalDatabaseFile(root))).toThrow()
+    await expectNothingHoldsTheDirectory()
+  })
+
+  it('closes the raw connection when the migration cannot start', async () => {
+    const journal = await journals.open({ identity: IDENTITY, journalDir: root })
+    await journal.close()
+    const blocker = openJournalDatabase(journalDatabaseFile(root))
+    // Roll the stored version back so the migration runs, then hold the write
+    // lock it needs: the throw lands after the connection already exists.
+    blocker.db.pragma('user_version = 0')
+    blocker.db.exec('BEGIN IMMEDIATE')
+    blocker.db.exec("INSERT INTO journal_sessions VALUES ('other', 'e', 1)")
+    try {
+      expect(() => openJournalDatabase(journalDatabaseFile(root))).toThrow()
+    } finally {
+      blocker.db.exec('ROLLBACK')
+      blocker.db.close()
+    }
+    await expectNothingHoldsTheDirectory()
+  }, 60_000)
+
+  // Sites 2 and 3: `open()` closes its own connection on any throw after the
+  // connection exists, which is what lets the factory need no `finally`.
+  it('leaves nothing open when a post-connection step of open() throws', async () => {
+    const journal = await journals.open({ identity: IDENTITY, journalDir: root })
+    await journal.appendItem(item(1), runningTool(), { fence: 1 })
+    await journal.close()
+
+    // Replay runs after the connection is open, so a read it cannot serve
+    // throws with the handle already held.
+    const exec = vi.spyOn(Database.prototype, 'prepare').mockImplementation(() => {
+      throw new Error('replay cannot read this journal')
+    })
+    try {
+      await expect(journals.open({ identity: IDENTITY, journalDir: root })).rejects.toThrow(
+        'replay cannot read this journal'
+      )
+    } finally {
+      exec.mockRestore()
+    }
+    await expectNothingHoldsTheDirectory()
+  })
+})
diff --git a/src/main/native-chat/agent-session-journal/journal-item-appender.ts b/src/main/native-chat/agent-session-journal/journal-item-appender.ts
index 3ed2b58b230..1bbc3d4fab3 100644
--- a/src/main/native-chat/agent-session-journal/journal-item-appender.ts
+++ b/src/main/native-chat/agent-session-journal/journal-item-appender.ts
@@ -5,23 +5,16 @@ import type {
 } from '../../../shared/agent-session-journal-types'
 import { journalItemRowBuilder } from './journal-row-builders'
 import type { JournalReducerState } from './journal-reducer'
-import type { AgentSessionJournal } from './journal-store'
 import type { JournalAppendResult } from './journal-store-contracts'
 import type { JournalRow } from './journal-row-schema'
-import { appendToolOutputFallback } from './journal-tool-output-fallback'
 
 type ItemAppendOptions = { fence: number; observedAt?: number; recovered?: true }
-type JournalBlob = { digest: string; payload: string }
 
 export class JournalItemAppender {
   constructor(
     private readonly deps: {
-      journal: () => AgentSessionJournal
       state: () => JournalReducerState
-      enqueue: (
-        build: (seq: number, ts: number) => JournalRow,
-        blobs?: readonly JournalBlob[]
-      ) => Promise<JournalRow>
+      enqueue: (build: (seq: number, ts: number) => JournalRow) => Promise<JournalRow>
     }
   ) {}
 
@@ -33,37 +26,10 @@ export class JournalItemAppender {
     const itemId = agentJournalItemKey(identity)
     return this.deps
       .enqueue(journalItemRowBuilder(this.deps.state, identity, body, options))
-      .then((row) => itemAppendResult(row, itemId))
-  }
-
-  appendWithBlobs(
-    identity: AgentJournalItemIdentity,
-    body: AgentJournalItemBody,
-    blobs: readonly JournalBlob[],
-    options: ItemAppendOptions
-  ): Promise<JournalAppendResult> {
-    const itemId = agentJournalItemKey(identity)
-    return this.deps
-      .enqueue(journalItemRowBuilder(this.deps.state, identity, body, options), blobs)
-      .then((row) => itemAppendResult(row, itemId))
-      .catch((error: unknown) =>
-        appendToolOutputFallback({
-          journal: this.deps.journal(),
-          error,
-          identity,
-          body,
-          blobs,
-          itemId,
-          fence: options.fence
-        })
-      )
-  }
-}
-
-function itemAppendResult(row: JournalRow, itemId: string): JournalAppendResult {
-  return {
-    cursor: { epoch: row.epoch, sequence: row.seq },
-    itemId,
-    revision: (row as Extract<JournalRow, { kind: 'item' }>).revision
+      .then((row) => ({
+        cursor: { epoch: row.epoch, sequence: row.seq },
+        itemId,
+        revision: (row as Extract<JournalRow, { kind: 'item' }>).revision
+      }))
   }
 }
diff --git a/src/main/native-chat/agent-session-journal/journal-legacy-import.test.ts b/src/main/native-chat/agent-session-journal/journal-legacy-import.test.ts
index a5a3e2be852..ed86d81861e 100644
--- a/src/main/native-chat/agent-session-journal/journal-legacy-import.test.ts
+++ b/src/main/native-chat/agent-session-journal/journal-legacy-import.test.ts
@@ -2,19 +2,21 @@
 // results by identity read off the same raw lines. Fixtures are shaped like the
 // files the providers actually write.
 
-import { mkdtemp, readdir, readFile, rm, writeFile } from 'node:fs/promises'
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it } from 'vitest'
 import { agentJournalItemKey } from '../../../shared/agent-session-journal-item-key'
-import type { AgentSessionJournalIdentity } from '../../../shared/agent-session-journal-types'
-import { JOURNAL_BLOB_DIR, readJournalBlob } from './journal-blob-store'
+import type {
+  AgentSessionJournalIdentity,
+  AgentSessionProviderHandle
+} from '../../../shared/agent-session-journal-types'
 import { createLegacyIdentityTracker } from './journal-legacy-identity'
 import {
   appendLegacyTranscriptMessages,
   importLegacyTranscriptIntoJournal
 } from './journal-legacy-import'
-import { boundPayload, DEFAULT_JOURNAL_PAYLOAD_LIMITS } from './journal-payload-bounds'
+import { DEFAULT_JOURNAL_PAYLOAD_LIMITS } from './journal-payload-bounds'
 import { openAgentSessionJournal } from './journal-store-factory'
 import type { AgentSessionJournal } from './journal-store'
 
@@ -29,21 +31,29 @@ function tick(): number {
   return clock
 }
 
-function identity(agent: 'claude' | 'codex', sessionId: string): AgentSessionJournalIdentity {
+type ImportAgent = 'claude' | 'codex' | 'grok' | 'omp'
+
+function providerHandle(agent: ImportAgent, sessionId: string): AgentSessionProviderHandle {
+  if (agent === 'claude') {
+    return { kind: 'claude', sessionId, leafUuid: null }
+  }
+  return agent === 'codex'
+    ? { kind: 'codex', threadId: sessionId }
+    : { kind: 'opaque', agent, value: sessionId }
+}
+
+function identity(agent: ImportAgent, sessionId: string): AgentSessionJournalIdentity {
   return {
     sessionId,
     workspaceId: 'ws-1',
     hostId: 'host-1',
     agent,
-    providerHandle:
-      agent === 'claude'
-        ? { kind: 'claude', sessionId, leafUuid: null }
-        : { kind: 'codex', threadId: sessionId }
+    providerHandle: providerHandle(agent, sessionId)
   }
 }
 
 async function open(
-  agent: 'claude' | 'codex',
+  agent: ImportAgent,
   sessionId: string,
   overrides: Partial<Parameters<typeof openAgentSessionJournal>[0]> = {}
 ): Promise<AgentSessionJournal> {
@@ -387,7 +397,7 @@ describe('codex import', () => {
 })
 
 describe('payload bounds on import', () => {
-  it('marks a clipped tool result and parks the remainder in the blob store', async () => {
+  it('marks a clipped tool result and discards the remainder', async () => {
     const output = 'y'.repeat(64 * 1024)
     const filePath = await writeFixture('claude-big.jsonl', [
       {
@@ -421,167 +431,13 @@ describe('payload bounds on import', () => {
     expect(body.output.truncated).toBe(true)
     expect(body.output.byteLength).toBe(64 * 1024)
     expect(body.output.head).toHaveLength(1_024)
-    expect(await readJournalBlob(root, body.output.digest)).toBe(output)
-  })
-
-  it('deduplicates staged blobs while importing a replacement epoch', async () => {
-    const journalDir = join(root, 'dedupe-journal')
-    const limits = {
-      ...DEFAULT_JOURNAL_PAYLOAD_LIMITS,
-      inlineHeadBytes: 512,
-      maxSessionBytes: 512 * 1024
-    }
-    const output = 'd'.repeat(32 * 1024)
-    const bounded = boundPayload(output, limits)
-    const toolResultLine = (uuid: string) => ({
-      parentUuid: null,
-      isSidechain: false,
-      type: 'user',
-      message: {
-        role: 'user',
-        content: [{ type: 'tool_result', tool_use_id: `toolu_${uuid}`, content: output }]
-      },
-      uuid,
-      timestamp: '2026-08-05T10:00:09.000Z',
-      sessionId: CLAUDE_SESSION
-    })
-    const filePath = await writeFixture('claude-duplicate-blobs.jsonl', [
-      toolResultLine('aa11bb22-cc33-4d44-8e55-6f7788990011'),
-      toolResultLine('bb22cc33-dd44-4e55-8f66-778899001122')
-    ])
-    const journal = await open('claude', CLAUDE_SESSION, {
-      journalDir,
-      limits,
-      autoCompact: false
-    })
-
-    await importLegacyTranscriptIntoJournal({
-      journal,
-      agent: 'claude',
-      sessionId: CLAUDE_SESSION,
-      fence: 1,
-      options: { filePath, limits }
-    })
-
-    expect(await readJournalBlob(journalDir, bounded.digest)).toBe(output)
-    expect(await readdir(join(journalDir, JOURNAL_BLOB_DIR))).toEqual([bounded.digest])
-    expect(
-      journal
-        .snapshot()
-        .items.map((item) => (item.body.kind === 'tool-call' ? item.body.output?.digest : null))
-    ).toEqual([bounded.digest, bounded.digest])
-  })
-
-  it('prunes root-level blobs made stale by a later legacy import', async () => {
-    const journalDir = join(root, 'prune-journal')
-    const limits = {
-      ...DEFAULT_JOURNAL_PAYLOAD_LIMITS,
-      inlineHeadBytes: 512,
-      maxSessionBytes: 512 * 1024
-    }
-    const output = 's'.repeat(32 * 1024)
-    const bounded = boundPayload(output, limits)
-    const first = await writeFixture('claude-stale-blob.jsonl', [
-      {
-        parentUuid: null,
-        isSidechain: false,
-        type: 'user',
-        message: {
-          role: 'user',
-          content: [{ type: 'tool_result', tool_use_id: 'toolu_stale', content: output }]
-        },
-        uuid: 'aa11bb22-cc33-4d44-8e55-6f7788990011',
-        timestamp: '2026-08-05T10:00:09.000Z',
-        sessionId: CLAUDE_SESSION
-      }
-    ])
-    const second = await writeFixture('claude-without-blob.jsonl', [
-      {
-        parentUuid: null,
-        isSidechain: false,
-        type: 'assistant',
-        message: { role: 'assistant', content: [{ type: 'text', text: 'replacement' }] },
-        uuid: 'cc33dd44-ee55-4666-8777-889900112233',
-        timestamp: '2026-08-05T10:00:10.000Z',
-        sessionId: CLAUDE_SESSION
-      }
-    ])
-    const journal = await open('claude', CLAUDE_SESSION, {
-      journalDir,
-      limits,
-      autoCompact: false
-    })
-
-    await importLegacyTranscriptIntoJournal({
-      journal,
-      agent: 'claude',
-      sessionId: CLAUDE_SESSION,
-      fence: 1,
-      options: { filePath: first, limits }
-    })
-    expect(await readJournalBlob(journalDir, bounded.digest)).toBe(output)
-
-    await importLegacyTranscriptIntoJournal({
-      journal,
-      agent: 'claude',
-      sessionId: CLAUDE_SESSION,
-      fence: 2,
-      options: { filePath: second, limits }
-    })
-
-    expect(await readJournalBlob(journalDir, bounded.digest)).toBeNull()
-    expect(journal.snapshot().items[0]?.body).toMatchObject({
-      kind: 'message',
-      blocks: [{ type: 'text', text: 'replacement' }]
-    })
-  })
-
-  it('uses managed catch-up appends when a tool-result blob exceeds quota', async () => {
-    const journalDir = join(root, 'catchup-journal')
-    const limits = {
-      ...DEFAULT_JOURNAL_PAYLOAD_LIMITS,
-      inlineHeadBytes: 128,
-      maxSessionBytes: 8_000
-    }
-    const journal = await open('codex', CODEX_SESSION, {
-      journalDir,
-      limits,
-      autoCompact: false
-    })
-    const output = 'z'.repeat(12_000)
-    const bounded = boundPayload(output, limits)
-
-    await expect(
-      appendLegacyTranscriptMessages({
-        journal,
-        agent: 'codex',
-        sessionId: CODEX_SESSION,
-        fence: 1,
-        messages: [
-          {
-            id: 'catchup-tool-output',
-            role: 'tool',
-            blocks: [{ type: 'tool-result', output }],
-            timestamp: 1_800_000_000_000,
-            source: 'transcript'
-          }
-        ]
-      })
-    ).rejects.toMatchObject({ code: 'journal_bound_exceeded' })
-
-    expect(await readJournalBlob(journalDir, bounded.digest)).toBeNull()
-    expect(journal.snapshot().items).toEqual([])
   })
 })
 
 describe('import failures', () => {
   it('rejects a legacy source above the fixed 16 MiB import cap before decoding', async () => {
     const journalDir = join(root, 'oversized-source-journal')
-    const journal = await open('claude', CLAUDE_SESSION, {
-      journalDir,
-      limits: { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, maxSessionBytes: 256 * 1024 * 1024 },
-      autoCompact: false
-    })
+    const journal = await open('claude', CLAUDE_SESSION, { journalDir })
     const filePath = join(root, 'oversized-source.jsonl')
     await writeFile(filePath, 'x'.repeat(16 * 1024 * 1024 + 1), 'utf8')
     const epoch = journal.epoch
@@ -602,115 +458,10 @@ describe('import failures', () => {
     expect(journal.snapshot().items).toEqual([])
   })
 
-  it('keeps the live epoch intact when a staged rebuild runs out of budget', async () => {
-    const limits = { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, maxSessionBytes: 2_000 }
-    const journal = await open('codex', CODEX_SESSION, { limits })
-    await appendLegacyTranscriptMessages({
-      journal,
-      agent: 'codex',
-      sessionId: CODEX_SESSION,
-      fence: 1,
-      messages: [
-        {
-          id: 'durable-prefix',
-          role: 'assistant',
-          blocks: [{ type: 'text', text: 'keep me' }],
-          timestamp: 1_800_000_000_000,
-          source: 'transcript'
-        }
-      ]
-    })
-    const filePath = await writeFixture('oversized-rollout.jsonl', [
-      CODEX_LINES[0],
-      CODEX_LINES[1],
-      CODEX_LINES[2],
-      {
-        type: 'event_msg',
-        timestamp: '2026-08-05T10:00:03.000Z',
-        payload: { type: 'agent_message', message: 'x'.repeat(2_000) }
-      }
-    ])
-    const epoch = journal.epoch
-    const snapshotPath = join(root, 'snapshot.json')
-    const logPath = join(root, 'log.jsonl')
-    const before = {
-      snapshot: await readFile(snapshotPath, 'utf-8'),
-      log: await readFile(logPath, 'utf-8')
-    }
-
-    await expect(
-      importLegacyTranscriptIntoJournal({
-        journal,
-        agent: 'codex',
-        sessionId: CODEX_SESSION,
-        fence: 1,
-        options: { filePath, limits }
-      })
-    ).rejects.toMatchObject({ code: 'journal_bound_exceeded' })
-    expect(journal.epoch).toBe(epoch)
-    expect(await readFile(snapshotPath, 'utf-8')).toBe(before.snapshot)
-    expect(await readFile(logPath, 'utf-8')).toBe(before.log)
-    expect(journal.snapshot().items[0]?.body).toMatchObject({
-      kind: 'message',
-      blocks: [{ type: 'text', text: 'keep me' }]
-    })
-  })
-
-  it('cleans staged replacement blobs when legacy import exceeds physical quota', async () => {
-    const journalDir = join(root, 'replacement-journal')
-    const limits = {
-      ...DEFAULT_JOURNAL_PAYLOAD_LIMITS,
-      inlineHeadBytes: 128,
-      maxSessionBytes: 8_000
-    }
-    const journal = await open('claude', CLAUDE_SESSION, {
-      journalDir,
-      limits,
-      autoCompact: false
-    })
-    const output = 'q'.repeat(12_000)
-    const bounded = boundPayload(output, limits)
-    const filePath = await writeFixture('oversized-tool-result.jsonl', [
-      {
-        parentUuid: null,
-        isSidechain: false,
-        type: 'user',
-        message: {
-          role: 'user',
-          content: [{ type: 'tool_result', tool_use_id: 'toolu_oversized', content: output }]
-        },
-        uuid: 'ba11ad00-1111-4222-8333-444455556666',
-        timestamp: '2026-08-05T10:00:09.000Z',
-        sessionId: CLAUDE_SESSION
-      }
-    ])
-    const epoch = journal.epoch
-
-    await expect(
-      importLegacyTranscriptIntoJournal({
-        journal,
-        agent: 'claude',
-        sessionId: CLAUDE_SESSION,
-        fence: 1,
-        options: { filePath, limits }
-      })
-    ).rejects.toMatchObject({ code: 'journal_bound_exceeded' })
-
-    expect(journal.epoch).toBe(epoch)
-    expect(await readJournalBlob(journalDir, bounded.digest)).toBeNull()
-    expect((await readdir(journalDir)).some((name) => name.startsWith('.epoch-replacement-'))).toBe(
-      false
-    )
-  })
-
   it('bounds oversized legacy tool-call input before journal publication', async () => {
     const journalDir = join(root, 'bounded-tool-input-journal')
     const limits = { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, inlineHeadBytes: 64 }
-    const journal = await open('claude', CLAUDE_SESSION, {
-      journalDir,
-      limits,
-      autoCompact: false
-    })
+    const journal = await open('claude', CLAUDE_SESSION, { journalDir })
     const filePath = await writeFixture('oversized-tool-input.jsonl', [
       {
         parentUuid: null,
@@ -768,6 +519,39 @@ describe('import failures', () => {
     expect(journal.epoch).toBe(before)
   })
 
+  // A transcript with no decodable messages recovers nothing. Publishing an
+  // empty replacement would roll the epoch and drop whatever the journal held —
+  // including a repair's own anchor and disclosure.
+  it('leaves the epoch untouched when the transcript decodes to no messages', async () => {
+    const journal = await open('codex', CODEX_SESSION)
+    await journal.appendItem(
+      { provider: 'codex', threadId: CODEX_SESSION, turnId: 'turn-1', ordinal: 1 },
+      { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text: 'kept' }] },
+      { fence: 1 }
+    )
+    const before = journal.epoch
+    const metadataOnly = await writeFixture('metadata-only.jsonl', [
+      {
+        type: 'session_meta',
+        timestamp: '2026-08-05T10:00:00.000Z',
+        payload: { id: CODEX_SESSION, session_id: CODEX_SESSION, cwd: '/Users/dev/project' }
+      }
+    ])
+
+    const result = await importLegacyTranscriptIntoJournal({
+      journal,
+      agent: 'codex',
+      sessionId: CODEX_SESSION,
+      fence: 1,
+      options: { filePath: metadataOnly }
+    })
+
+    expect(result).toMatchObject({ ok: true, imported: 0, replaced: false })
+    expect(journal.epoch).toBe(before)
+    expect(journal.snapshot().items).toHaveLength(1)
+    await journal.close()
+  })
+
   it('rejects an agent with no transcript decoder', async () => {
     const journal = await open('claude', CLAUDE_SESSION)
     const result = await importLegacyTranscriptIntoJournal({
@@ -780,3 +564,132 @@ describe('import failures', () => {
     expect(result).toMatchObject({ ok: false })
   })
 })
+
+// A tool call is only the SOLE block of its message when the provider wrote it
+// that way. Claude interleaves it with narration, Grok hangs `tool_calls` off a
+// row that also has text, and omp's execution cells always pair the invocation
+// with its output — so the multi-block path carries untrusted tool input too.
+describe('multi-block legacy messages', () => {
+  const limits = { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, inlineHeadBytes: 64 }
+  const oversized = 'x'.repeat(10_000)
+
+  /** The tool-call block of the first imported multi-block message. */
+  function importedToolCallBlock(journal: AgentSessionJournal): unknown {
+    for (const entry of journal.snapshot().items) {
+      if (entry.body.kind !== 'message') {
+        continue
+      }
+      const block = entry.body.blocks.find((candidate) => candidate.type === 'tool-call')
+      if (block) {
+        return block.input
+      }
+    }
+    return null
+  }
+
+  it('bounds a Claude tool call that shares its message with narration', async () => {
+    const journal = await open('claude', CLAUDE_SESSION, {
+      journalDir: join(root, 'claude-mixed-journal')
+    })
+    const filePath = await writeFixture('claude-mixed.jsonl', [
+      {
+        parentUuid: null,
+        isSidechain: false,
+        type: 'assistant',
+        message: {
+          role: 'assistant',
+          content: [
+            { type: 'text', text: 'Editing the file.' },
+            {
+              type: 'tool_use',
+              id: 'toolu_mixed',
+              name: 'Edit',
+              input: { file_path: 'a.ts', patch: oversized }
+            }
+          ]
+        },
+        uuid: 'dd22be00-1111-4222-8333-444455556666',
+        timestamp: '2026-08-05T10:00:09.000Z',
+        sessionId: CLAUDE_SESSION
+      }
+    ])
+
+    const result = await importLegacyTranscriptIntoJournal({
+      journal,
+      agent: 'claude',
+      sessionId: CLAUDE_SESSION,
+      fence: 1,
+      options: { filePath, limits }
+    })
+
+    expect(result.ok).toBe(true)
+    expect(importedToolCallBlock(journal)).toMatchObject({
+      truncated: true,
+      byteLength: expect.any(Number),
+      digest: expect.stringMatching(/^[0-9a-f]{64}$/),
+      head: expect.any(String)
+    })
+    expect(JSON.stringify(journal.snapshot().items)).not.toContain('x'.repeat(1_000))
+    await journal.close()
+  })
+
+  it('bounds a Grok tool call that shares its row with assistant text', async () => {
+    const journal = await open('grok', CODEX_SESSION, {
+      journalDir: join(root, 'grok-mixed-journal')
+    })
+    const filePath = await writeFixture('grok-mixed.jsonl', [
+      {
+        type: 'assistant',
+        id: 'asst-mixed',
+        timestamp: '2026-08-05T10:00:09.000Z',
+        content: [{ type: 'text', text: 'Searching.' }],
+        tool_calls: [{ id: 'c1', name: 'grep', arguments: JSON.stringify({ pattern: oversized }) }]
+      }
+    ])
+
+    const result = await importLegacyTranscriptIntoJournal({
+      journal,
+      agent: 'grok',
+      sessionId: CODEX_SESSION,
+      fence: 1,
+      options: { filePath, limits }
+    })
+
+    expect(result.ok).toBe(true)
+    expect(importedToolCallBlock(journal)).toMatchObject({ truncated: true })
+    expect(JSON.stringify(journal.snapshot().items)).not.toContain('x'.repeat(1_000))
+    await journal.close()
+  })
+
+  it('bounds an omp execution cell, whose invocation always ships with its output', async () => {
+    const journal = await open('omp', CODEX_SESSION, {
+      journalDir: join(root, 'omp-mixed-journal')
+    })
+    const filePath = await writeFixture('omp-mixed.jsonl', [
+      {
+        type: 'message',
+        id: 'omp-mixed-1',
+        timestamp: '2026-08-05T10:00:09.000Z',
+        message: {
+          role: 'bashExecution',
+          command: `echo ${oversized}`,
+          output: 'done',
+          exitCode: 0
+        }
+      }
+    ])
+
+    const result = await importLegacyTranscriptIntoJournal({
+      journal,
+      agent: 'omp',
+      sessionId: CODEX_SESSION,
+      fence: 1,
+      options: { filePath, limits }
+    })
+
+    expect(result.ok).toBe(true)
+    expect(importedToolCallBlock(journal)).toMatchObject({ truncated: true })
+    expect(JSON.stringify(journal.snapshot().items)).not.toContain('x'.repeat(1_000))
+    await journal.close()
+  })
+})
diff --git a/src/main/native-chat/agent-session-journal/journal-legacy-import.ts b/src/main/native-chat/agent-session-journal/journal-legacy-import.ts
index 126196af38e..6a2ff099dbc 100644
--- a/src/main/native-chat/agent-session-journal/journal-legacy-import.ts
+++ b/src/main/native-chat/agent-session-journal/journal-legacy-import.ts
@@ -49,7 +49,14 @@ export type LegacyImportOptions = ResolveSessionFileOptions & {
 const MAX_LEGACY_IMPORT_SOURCE_BYTES = 16 * 1024 * 1024
 
 export type LegacyImportResult =
-  | { ok: true; epoch: string; cursor: AgentJournalCursor; imported: number }
+  | {
+      ok: true
+      epoch: string
+      cursor: AgentJournalCursor
+      imported: number
+      /** False when the transcript held no messages and the epoch was left as it stood. */
+      replaced: boolean
+    }
   | { ok: false; error: string }
 
 export async function appendLegacyTranscriptMessages(input: {
@@ -61,16 +68,14 @@ export async function appendLegacyTranscriptMessages(input: {
 }): Promise<number> {
   let appended = 0
   for (const message of input.messages) {
-    const mapped = legacyItemBody(message, DEFAULT_JOURNAL_PAYLOAD_LIMITS)
-    await input.journal.appendItemWithBlobs(
+    await input.journal.appendItem(
       {
         provider: 'legacy',
         agent: input.agent,
         sessionId: input.sessionId,
         recordId: message.id
       },
-      mapped.body,
-      mapped.blobs,
+      legacyItemBody(message, DEFAULT_JOURNAL_PAYLOAD_LIMITS),
       { fence: input.fence, observedAt: message.timestamp ?? undefined }
     )
     appended += 1
@@ -134,16 +139,28 @@ export async function importLegacyTranscriptIntoJournal(input: {
     if (!identity) {
       continue
     }
-    const mapped = legacyItemBody(message, limits)
     replacement.push({
       identity,
-      body: mapped.body,
-      blobs: mapped.blobs,
+      body: legacyItemBody(message, limits),
       observedAt: message.timestamp ?? undefined
     })
   }
+  // A transcript that decodes to nothing reconstructs nothing, and an empty
+  // replacement is not a harmless no-op: it would delete the repair's anchor and
+  // its disclosure, leaving nothing to ask for the history again. The epoch
+  // stands so a later read can still rebuild it.
+  if (replacement.length === 0) {
+    const current = input.journal.cursor()
+    return { ok: true, epoch: current.epoch, cursor: current, imported: 0, replaced: false }
+  }
   const cursor = await input.journal.replaceEpochItems('legacy_import', input.fence, replacement)
-  return { ok: true, epoch: cursor.epoch, cursor, imported: decoded.messages.length }
+  return {
+    ok: true,
+    epoch: cursor.epoch,
+    cursor,
+    imported: decoded.messages.length,
+    replaced: true
+  }
 }
 
 const TRANSCRIPT_DECODERS = {
@@ -199,11 +216,6 @@ async function decodeWithIdentities(input: {
   return { messages, identities }
 }
 
-type MappedLegacyItem = {
-  body: AgentJournalItemBody
-  blobs: { digest: string; payload: string }[]
-}
-
 /**
  * A message whose only content is a tool invocation becomes a tool-call item so
  * the reducer renders it as one. Everything else stays a message item with its
@@ -212,49 +224,40 @@ type MappedLegacyItem = {
 function legacyItemBody(
   message: NativeChatMessage,
   limits: JournalPayloadLimits
-): MappedLegacyItem {
+): AgentJournalItemBody {
   const only = message.blocks.length === 1 ? message.blocks[0] : undefined
   if (only?.type === 'tool-call') {
+    // Legacy transcripts are untrusted and can contain arbitrarily large tool
+    // arguments. Keep them on the same bounded path as live events before the
+    // replacement epoch is published.
     return {
-      // Legacy transcripts are untrusted and can contain arbitrarily large
-      // tool arguments. Keep them on the same bounded path as live events
-      // before the replacement epoch is staged or published.
-      body: {
-        kind: 'tool-call',
-        name: only.name,
-        input: boundToolInput(only.input, limits),
-        state: 'completed'
-      },
-      blobs: []
+      kind: 'tool-call',
+      name: only.name,
+      input: boundToolInput(only.input, limits),
+      state: 'completed'
     }
   }
   if (only?.type === 'tool-result') {
-    const output = boundPayload(only.output, limits)
     return {
-      body: {
-        kind: 'tool-call',
-        name: 'tool-result',
-        input: null,
-        state: only.isError ? 'failed' : 'completed',
-        output
-      },
-      blobs: output.truncated ? [{ digest: output.digest, payload: only.output }] : []
+      kind: 'tool-call',
+      name: 'tool-result',
+      input: null,
+      state: only.isError ? 'failed' : 'completed',
+      output: boundPayload(only.output, limits)
     }
   }
   return {
-    body: {
-      kind: 'message',
-      role: message.role,
-      blocks: message.blocks.map((block) => boundBlock(block, limits))
-    },
-    blobs: []
+    kind: 'message',
+    role: message.role,
+    blocks: message.blocks.map((block) => boundBlock(block, limits))
   }
 }
 
-/** Inline block text keeps only a bounded head plus an explicit marker. No blob
- *  is written: the marker carries the digest and byte length, and the source
- *  transcript remains the full copy — a blob here would be unreferenced by the
- *  render model and pruned at the next compaction. */
+/** Every block that can carry untrusted bulk is bounded here, tool calls
+ *  included: a provider decoder is free to put one alongside narration, and the
+ *  sole-block path above never sees those. The remainder is discarded rather
+ *  than stored elsewhere — the marker keeps its digest and byte length, and the
+ *  source transcript remains the full copy. */
 function boundBlock(block: NativeChatBlock, limits: JournalPayloadLimits): NativeChatBlock {
   if (block.type === 'text') {
     return { ...block, text: boundInlineText(block.text, limits).text }
@@ -262,5 +265,8 @@ function boundBlock(block: NativeChatBlock, limits: JournalPayloadLimits): Nativ
   if (block.type === 'tool-result') {
     return { ...block, output: boundInlineText(block.output, limits).text }
   }
+  if (block.type === 'tool-call') {
+    return { ...block, input: boundToolInput(block.input, limits) }
+  }
   return block
 }
diff --git a/src/main/native-chat/agent-session-journal/journal-lifecycle-admission.ts b/src/main/native-chat/agent-session-journal/journal-lifecycle-admission.ts
deleted file mode 100644
index 063e807038e..00000000000
--- a/src/main/native-chat/agent-session-journal/journal-lifecycle-admission.ts
+++ /dev/null
@@ -1,160 +0,0 @@
-import type {
-  AgentJournalItemBody,
-  AgentJournalSnapshot
-} from '../../../shared/agent-session-journal-types'
-import {
-  dispatchReservationId,
-  JournalLifecycleCapacity,
-  lifecycleReservationIdForItem,
-  requiresTerminalSettlement,
-  terminalReservationBytes,
-  type JournalLifecycleReservation
-} from './journal-lifecycle-capacity'
-import type { JournalRow } from './journal-row-schema'
-import { journalRowByteLength } from './journal-row-schema'
-import { AgentSessionJournalError } from './journal-write-guards'
-
-export type JournalLifecycleRowAdmission = {
-  releaseAfter: string[]
-  protectedBytes: number
-  lifecycleCovered: boolean
-  proposedCapacity: JournalLifecycleCapacity
-}
-
-export class JournalLifecycleAdmission {
-  private readonly capacity = new JournalLifecycleCapacity()
-
-  constructor(
-    private readonly sessionId: string,
-    private readonly maxBytes: number,
-    private readonly canonicalItemId: (itemId: string) => string,
-    private readonly maxAppendSlots = Number.MAX_SAFE_INTEGER
-  ) {}
-
-  get state(): { reservedBytes: number; reservedAppendSlots: number } {
-    return {
-      reservedBytes: this.capacity.reservedBytes,
-      reservedAppendSlots: this.capacity.reservedAppendSlots
-    }
-  }
-
-  rebuild(snapshot: AgentJournalSnapshot, currentPhysicalBytes: number): void {
-    if (
-      !this.capacity.rebuild(snapshot, this.maxBytes, currentPhysicalBytes, this.maxAppendSlots)
-    ) {
-      throw this.capacityError('cannot rebuild lifecycle capacity')
-    }
-  }
-
-  reserve(token: JournalLifecycleReservation, currentPhysicalBytes: number): boolean {
-    return this.capacity.reserve(token, currentPhysicalBytes, this.maxBytes, this.maxAppendSlots)
-  }
-
-  transfer(fromId: string, toId: string): boolean {
-    return this.capacity.transfer(fromId, toId)
-  }
-
-  release(id: string): void {
-    this.capacity.release(id)
-  }
-
-  prepare(row: JournalRow, currentPhysicalBytes: number): JournalLifecycleRowAdmission {
-    const proposedCapacity = this.capacity.clone()
-    this.ensureActionable(row, currentPhysicalBytes, proposedCapacity)
-    const releaseAfter = this.reservationsSettledBy(row, proposedCapacity)
-    const releasedBytes = releaseAfter.reduce(
-      (total, id) => total + (proposedCapacity.token(id)?.bytes ?? 0),
-      0
-    )
-    return {
-      releaseAfter,
-      protectedBytes: proposedCapacity.reservedBytes - releasedBytes,
-      lifecycleCovered: proposedCapacity.covers(releaseAfter, journalRowByteLength(row), 1),
-      proposedCapacity
-    }
-  }
-
-  commit(admission: JournalLifecycleRowAdmission): void {
-    this.capacity.replaceFrom(admission.proposedCapacity)
-    for (const id of admission.releaseAfter) {
-      this.capacity.release(id)
-    }
-  }
-
-  private ensureActionable(
-    row: JournalRow,
-    currentPhysicalBytes: number,
-    capacity: JournalLifecycleCapacity
-  ): void {
-    if (row.kind === 'item') {
-      this.ensureActionableItem(row.itemId, row.body, currentPhysicalBytes, capacity)
-      return
-    }
-    if (row.kind !== 'lifecycle-batch') {
-      return
-    }
-    for (const mutation of row.mutations) {
-      if (mutation.kind === 'item') {
-        this.ensureActionableItem(mutation.itemId, mutation.body, currentPhysicalBytes, capacity)
-      }
-    }
-  }
-
-  private ensureActionableItem(
-    itemId: string,
-    body: AgentJournalItemBody,
-    currentPhysicalBytes: number,
-    capacity: JournalLifecycleCapacity
-  ): void {
-    if (!requiresTerminalSettlement(body)) {
-      return
-    }
-    const id = lifecycleReservationIdForItem(this.canonicalItemId(itemId))
-    if (body.kind === 'status' && body.turnLifecycle?.state === 'running' && !capacity.has(id)) {
-      capacity.claimFirst('tentative-turn:', id)
-    }
-    if (
-      !capacity.reserve(
-        { id, bytes: terminalReservationBytes(body), appendSlots: 1 },
-        currentPhysicalBytes,
-        this.maxBytes,
-        this.maxAppendSlots
-      )
-    ) {
-      throw this.capacityError('cannot reserve terminal capacity')
-    }
-  }
-
-  private reservationsSettledBy(row: JournalRow, capacity: JournalLifecycleCapacity): string[] {
-    if (row.kind === 'dispatch') {
-      const id = dispatchReservationId(row.clientMessageId)
-      return capacity.has(id) ? [id] : []
-    }
-    const itemIds =
-      row.kind === 'item'
-        ? requiresTerminalSettlement(row.body)
-          ? []
-          : [row.itemId]
-        : row.kind === 'tombstone'
-          ? [row.itemId]
-          : row.kind === 'lifecycle-batch'
-            ? row.mutations.flatMap((mutation) =>
-                mutation.kind === 'item' && requiresTerminalSettlement(mutation.body)
-                  ? []
-                  : [mutation.itemId]
-              )
-            : []
-    return [
-      ...new Set(
-        itemIds.map((itemId) => lifecycleReservationIdForItem(this.canonicalItemId(itemId)))
-      )
-    ].filter((id) => capacity.has(id))
-  }
-
-  private capacityError(detail: string): AgentSessionJournalError {
-    return new AgentSessionJournalError(
-      'journal_bound_exceeded',
-      `agent-session journal for ${this.sessionId} ${detail}`
-    )
-  }
-}
diff --git a/src/main/native-chat/agent-session-journal/journal-lifecycle-capacity.test.ts b/src/main/native-chat/agent-session-journal/journal-lifecycle-capacity.test.ts
deleted file mode 100644
index 331bc63c9dc..00000000000
--- a/src/main/native-chat/agent-session-journal/journal-lifecycle-capacity.test.ts
+++ /dev/null
@@ -1,30 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import type { AgentJournalSnapshot } from '../../../shared/agent-session-journal-types'
-import { JournalLifecycleCapacity } from './journal-lifecycle-capacity'
-
-describe('JournalLifecycleCapacity', () => {
-  it('enforces append-slot limits for both rebuilt submission reservations', () => {
-    const snapshot: AgentJournalSnapshot = {
-      sessionId: 'session-1',
-      cursor: { epoch: 'epoch-1', sequence: 1 },
-      items: [],
-      submissions: [
-        {
-          clientMessageId: 'message-1',
-          fence: 0,
-          payloadFingerprint: 'fingerprint',
-          dispatchState: 'pending',
-          providerItemId: null,
-          reason: null,
-          submittedAt: 1,
-          resolvedAt: null
-        }
-      ]
-    }
-
-    const capacity = new JournalLifecycleCapacity()
-
-    expect(capacity.rebuild(snapshot, Number.MAX_SAFE_INTEGER, 0, 1)).toBe(false)
-    expect(capacity.reservedAppendSlots).toBe(1)
-  })
-})
diff --git a/src/main/native-chat/agent-session-journal/journal-lifecycle-capacity.ts b/src/main/native-chat/agent-session-journal/journal-lifecycle-capacity.ts
deleted file mode 100644
index 0c99070b1e4..00000000000
--- a/src/main/native-chat/agent-session-journal/journal-lifecycle-capacity.ts
+++ /dev/null
@@ -1,193 +0,0 @@
-import type {
-  AgentJournalItemBody,
-  AgentJournalSnapshot
-} from '../../../shared/agent-session-journal-types'
-
-export type JournalLifecycleReservation = {
-  id: string
-  bytes: number
-  appendSlots: number
-}
-
-export const JOURNAL_TURN_TERMINAL_RESERVATION_BYTES = 128 * 1024
-export const JOURNAL_ITEM_TERMINAL_RESERVATION_BYTES = 64 * 1024
-export const JOURNAL_DISPATCH_RESERVATION_BYTES = 32 * 1024
-
-export class JournalLifecycleCapacity {
-  private readonly reservations = new Map<string, JournalLifecycleReservation>()
-
-  get reservedBytes(): number {
-    return [...this.reservations.values()].reduce((total, token) => total + token.bytes, 0)
-  }
-
-  get reservedAppendSlots(): number {
-    return [...this.reservations.values()].reduce((total, token) => total + token.appendSlots, 0)
-  }
-
-  has(id: string): boolean {
-    return this.reservations.has(id)
-  }
-
-  token(id: string): JournalLifecycleReservation | null {
-    return this.reservations.get(id) ?? null
-  }
-
-  clone(): JournalLifecycleCapacity {
-    const copy = new JournalLifecycleCapacity()
-    for (const token of this.reservations.values()) {
-      copy.reservations.set(token.id, { ...token })
-    }
-    return copy
-  }
-
-  replaceFrom(source: JournalLifecycleCapacity): void {
-    this.reservations.clear()
-    for (const token of source.reservations.values()) {
-      this.reservations.set(token.id, { ...token })
-    }
-  }
-
-  reserve(
-    token: JournalLifecycleReservation,
-    currentPhysicalBytes: number,
-    maxBytes: number,
-    maxAppendSlots = Number.MAX_SAFE_INTEGER
-  ): boolean {
-    if (this.reservations.has(token.id)) {
-      return true
-    }
-    if (currentPhysicalBytes + this.reservedBytes + token.bytes > maxBytes) {
-      return false
-    }
-    if (this.reservedAppendSlots + token.appendSlots > maxAppendSlots) {
-      return false
-    }
-    this.reservations.set(token.id, token)
-    return true
-  }
-
-  transfer(fromId: string, toId: string): boolean {
-    const existing = this.reservations.get(fromId)
-    if (!existing) {
-      return false
-    }
-    this.reservations.delete(fromId)
-    this.reservations.set(toId, { ...existing, id: toId })
-    return true
-  }
-
-  claimFirst(prefix: string, toId: string): boolean {
-    const fromId = [...this.reservations.keys()].find((id) => id.startsWith(prefix))
-    return fromId ? this.transfer(fromId, toId) : false
-  }
-
-  release(id: string): void {
-    this.reservations.delete(id)
-  }
-
-  covers(ids: readonly string[], bytes: number, appendSlots: number): boolean {
-    const tokens = ids.flatMap((id) => {
-      const token = this.reservations.get(id)
-      return token ? [token] : []
-    })
-    return (
-      tokens.length > 0 &&
-      tokens.reduce((total, token) => total + token.bytes, 0) >= bytes &&
-      tokens.reduce((total, token) => total + token.appendSlots, 0) >= appendSlots
-    )
-  }
-
-  rebuild(
-    snapshot: AgentJournalSnapshot,
-    maxBytes: number,
-    currentPhysicalBytes: number,
-    maxAppendSlots = Number.MAX_SAFE_INTEGER
-  ): boolean {
-    this.reservations.clear()
-    for (const item of snapshot.items) {
-      if (!requiresTerminalSettlement(item.body)) {
-        continue
-      }
-      if (
-        !this.reserve(
-          {
-            id: lifecycleReservationIdForItem(item.itemId),
-            bytes: terminalReservationBytes(item.body),
-            appendSlots: 1
-          },
-          currentPhysicalBytes,
-          maxBytes,
-          maxAppendSlots
-        )
-      ) {
-        return false
-      }
-    }
-    for (const submission of snapshot.submissions) {
-      if (submission.dispatchState !== 'pending' && submission.dispatchState !== 'unknown') {
-        continue
-      }
-      // A write-ahead submission owns both its dispatch attempt and the
-      // terminal turn settlement. Rebuild both reservations after restart;
-      // restoring only the tentative turn token would let a new send consume
-      // the dispatch headroom still owed to this unresolved submission.
-      if (
-        !this.reserve(
-          {
-            id: dispatchReservationId(submission.clientMessageId),
-            bytes: JOURNAL_DISPATCH_RESERVATION_BYTES,
-            appendSlots: 1
-          },
-          currentPhysicalBytes,
-          maxBytes,
-          maxAppendSlots
-        )
-      ) {
-        return false
-      }
-      if (
-        !this.reserve(
-          {
-            id: tentativeTurnReservationId(submission.clientMessageId),
-            bytes: JOURNAL_TURN_TERMINAL_RESERVATION_BYTES,
-            appendSlots: 1
-          },
-          currentPhysicalBytes,
-          maxBytes,
-          maxAppendSlots
-        )
-      ) {
-        return false
-      }
-    }
-    return true
-  }
-}
-
-export function lifecycleReservationIdForItem(itemId: string): string {
-  return `item:${itemId}`
-}
-
-export function dispatchReservationId(clientMessageId: string): string {
-  return `dispatch:${clientMessageId}`
-}
-
-export function tentativeTurnReservationId(clientMessageId: string): string {
-  return `tentative-turn:${clientMessageId}`
-}
-
-export function requiresTerminalSettlement(body: AgentJournalItemBody): boolean {
-  if (body.kind === 'tool-call') {
-    return body.state === 'running'
-  }
-  if (body.kind === 'approval' || body.kind === 'question') {
-    return body.resolution.state === 'pending'
-  }
-  return body.kind === 'status' && body.turnLifecycle?.state === 'running'
-}
-
-export function terminalReservationBytes(body: AgentJournalItemBody): number {
-  return body.kind === 'status' && body.turnLifecycle?.state === 'running'
-    ? JOURNAL_TURN_TERMINAL_RESERVATION_BYTES
-    : JOURNAL_ITEM_TERMINAL_RESERVATION_BYTES
-}
diff --git a/src/main/native-chat/agent-session-journal/journal-log-file.test.ts b/src/main/native-chat/agent-session-journal/journal-log-file.test.ts
deleted file mode 100644
index 98c0b5029d3..00000000000
--- a/src/main/native-chat/agent-session-journal/journal-log-file.test.ts
+++ /dev/null
@@ -1,374 +0,0 @@
-import { mkdtemp, readdir, rm, writeFile } from 'node:fs/promises'
-import type * as FsPromises from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { appendJournalRows, JOURNAL_SNAPSHOT_FILE, readJournalSnapshot } from './journal-log-file'
-import type { JournalSnapshotFile } from './journal-log-file'
-import type { JournalRow } from './journal-row-schema'
-import { openAgentSessionJournal } from './journal-store-factory'
-import {
-  projectStructuredAgentSessionStatus,
-  projectStructuredItemsToNativeChat
-} from '../../../shared/structured-agent-session-projection'
-
-type FakeDirectoryHandle = { sync: ReturnType<typeof vi.fn>; close: ReturnType<typeof vi.fn> }
-
-let openDirectoryHook: ((path: unknown, flags: unknown) => FakeDirectoryHandle | undefined) | null =
-  null
-
-vi.mock('node:fs/promises', async (importOriginal) => {
-  const actual = await importOriginal<typeof FsPromises>()
-  return {
-    ...actual,
-    open: (async (...args: Parameters<typeof actual.open>) => {
-      const fake = openDirectoryHook?.(args[0], args[1])
-      return fake ?? actual.open(...args)
-    }) as typeof actual.open
-  }
-})
-
-let root: string
-
-beforeEach(async () => {
-  root = await mkdtemp(join(tmpdir(), 'orca-journal-log-file-'))
-  openDirectoryHook = null
-})
-
-afterEach(async () => {
-  openDirectoryHook = null
-  await rm(root, { recursive: true, force: true })
-})
-
-function validSnapshot(): JournalSnapshotFile {
-  return {
-    v: 1,
-    epoch: 'epoch-A',
-    compactedThrough: 2,
-    highestFence: 1,
-    items: [
-      {
-        itemId: 'codex:thread-1:turn-1:1',
-        revision: 1,
-        body: { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text: 'hi' }] },
-        sequence: 2,
-        observedAt: 1_000
-      }
-    ],
-    submissions: [],
-    receipts: [],
-    aliases: [],
-    tombstones: [{ itemId: 'codex:thread-1:turn-1:2', revision: 3 }],
-    tail: []
-  }
-}
-
-async function writeSnapshot(snapshot: unknown): Promise<void> {
-  await writeFile(join(root, JOURNAL_SNAPSHOT_FILE), JSON.stringify(snapshot), 'utf-8')
-}
-
-describe('readJournalSnapshot validation', () => {
-  it('accepts a well-formed snapshot, with and without the tombstones collection', async () => {
-    await writeSnapshot(validSnapshot())
-    expect((await readJournalSnapshot(root)).status).toBe('valid')
-
-    const { tombstones: _tombstones, ...withoutTombstones } = validSnapshot()
-    await writeSnapshot(withoutTombstones)
-    expect((await readJournalSnapshot(root)).status).toBe('valid')
-  })
-
-  it('accepts every canonical item kind and a fully-formed submission', async () => {
-    const snapshot = validSnapshot()
-    const payload = { head: 'x', byteLength: 4, digest: 'd'.repeat(64), truncated: true }
-    snapshot.items = [
-      { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'hi' }] },
-      {
-        kind: 'tool-call',
-        name: 'Read',
-        input: { path: 'a' },
-        state: 'completed',
-        output: payload
-      },
-      { kind: 'diff', path: 'a.ts', patch: payload },
-      {
-        kind: 'approval',
-        title: 'Run?',
-        detail: null,
-        options: [{ id: 'a', label: 'Yes' }],
-        resolution: { state: 'pending', selectedOptionId: null, resolvedBy: null, resolvedAt: null }
-      },
-      {
-        kind: 'question',
-        question: 'Deploy?',
-        options: [{ id: 'a', label: 'Yes' }],
-        freeTextQuestionId: 'q-free',
-        resolution: { state: 'resolved', selectedOptionId: 'a', resolvedBy: 'c', resolvedAt: 5 }
-      },
-      {
-        kind: 'status',
-        text: 'working',
-        turnLifecycle: { turnId: 'turn-1', state: 'running' },
-        providerFrame: { provider: 'codex', kind: 'raw', payload }
-      }
-    ].map((body, index) => ({
-      itemId: `codex:thread-1:turn-1:${index + 1}`,
-      revision: 1,
-      body: body as JournalSnapshotFile['items'][number]['body'],
-      sequence: index + 1,
-      observedAt: 1_000,
-      ...(index === 0 ? { recovered: true as const } : {})
-    }))
-    snapshot.compactedThrough = snapshot.items.length
-    snapshot.submissions = [
-      {
-        clientMessageId: 'm-1',
-        fence: 1,
-        payloadFingerprint: 'a'.repeat(64),
-        dispatchState: 'accepted',
-        providerItemId: 'codex:thread-1:turn-1:1',
-        reason: null,
-        submittedAt: 1_000,
-        resolvedAt: 1_001
-      }
-    ]
-    await writeSnapshot(snapshot)
-    expect((await readJournalSnapshot(root)).status).toBe('valid')
-  })
-
-  it('classifies a JSON-valid non-array tombstones collection as invalid instead of valid', async () => {
-    await writeSnapshot({ ...validSnapshot(), tombstones: {} })
-    expect((await readJournalSnapshot(root)).status).toBe('invalid')
-  })
-
-  it('rejects tombstone entries that would poison seeding', async () => {
-    for (const tombstones of [
-      [{ itemId: 42, revision: 1 }],
-      [{ itemId: 'codex:thread-1:turn-1:1', revision: 'one' }],
-      [{ itemId: 'codex:thread-1:turn-1:1', revision: Number.NaN }],
-      ['codex:thread-1:turn-1:1']
-    ]) {
-      await writeSnapshot({ ...validSnapshot(), tombstones })
-      expect((await readJournalSnapshot(root)).status).toBe('invalid')
-    }
-  })
-
-  it('rejects JSON-valid nested item corruption instead of admitting it', async () => {
-    // A resolved question with `options: null` used to pass shallow admission and
-    // then throw `TypeError` in the shared projection's `options.map`.
-    const poisonedQuestion = validSnapshot()
-    poisonedQuestion.items = [
-      {
-        itemId: 'codex:thread-1:turn-1:1',
-        revision: 1,
-        body: {
-          kind: 'question',
-          question: 'Deploy?',
-          options: null,
-          resolution: { state: 'resolved', selectedOptionId: 'a', resolvedBy: 'c', resolvedAt: 1 }
-        },
-        sequence: 2,
-        observedAt: 1_000
-      }
-    ] as unknown as JournalSnapshotFile['items']
-    await writeSnapshot(poisonedQuestion)
-    expect((await readJournalSnapshot(root)).status).toBe('invalid')
-
-    // Pending-prompt surfaces read `resolution.state` before anything else.
-    const nullResolution = validSnapshot()
-    nullResolution.items = [
-      {
-        itemId: 'codex:thread-1:turn-1:1',
-        revision: 1,
-        body: { kind: 'question', question: 'Deploy?', options: [], resolution: null },
-        sequence: 2,
-        observedAt: 1_000
-      }
-    ] as unknown as JournalSnapshotFile['items']
-    await writeSnapshot(nullResolution)
-    expect((await readJournalSnapshot(root)).status).toBe('invalid')
-  })
-
-  it('rejects a JSON-valid nested corruption in the retained tail', async () => {
-    const poisonedTail = validSnapshot()
-    poisonedTail.tail = [
-      {
-        v: 1,
-        epoch: 'epoch-A',
-        seq: 3,
-        fence: 1,
-        ts: 1_000,
-        kind: 'item',
-        itemId: 'codex:thread-1:turn-1:3',
-        revision: 1,
-        body: {
-          kind: 'question',
-          question: 'Deploy?',
-          options: null,
-          resolution: { state: 'resolved', selectedOptionId: 'a', resolvedBy: 'c', resolvedAt: 1 }
-        }
-      }
-    ] as unknown as JournalSnapshotFile['tail']
-    await writeSnapshot(poisonedTail)
-    expect((await readJournalSnapshot(root)).status).toBe('invalid')
-  })
-
-  it('rejects a submission that only carries a client message id', async () => {
-    const shallowSubmission = validSnapshot()
-    shallowSubmission.submissions = [
-      { clientMessageId: 'm-1' }
-    ] as unknown as JournalSnapshotFile['submissions']
-    await writeSnapshot(shallowSubmission)
-    expect((await readJournalSnapshot(root)).status).toBe('invalid')
-  })
-
-  it('rejects items and counters that only look shallowly plausible', async () => {
-    const missingSequence = validSnapshot()
-    missingSequence.items = [
-      { itemId: 'codex:thread-1:turn-1:1', revision: 1, body: { kind: 'status', text: 'x' } }
-    ] as unknown as JournalSnapshotFile['items']
-    await writeSnapshot(missingSequence)
-    expect((await readJournalSnapshot(root)).status).toBe('invalid')
-
-    await writeSnapshot({ ...validSnapshot(), compactedThrough: Number.NaN })
-    expect((await readJournalSnapshot(root)).status).toBe('invalid')
-  })
-})
-
-describe('future-version snapshot classification', () => {
-  it('classifies a future version before shape validation so unknown bodies stay unreadable', async () => {
-    // The version can only advance because bodies changed, so a future snapshot
-    // legitimately carries kinds this build cannot parse. That is the
-    // schema-unreadable contract, not corruption.
-    const future = validSnapshot() as unknown as Record<string, unknown>
-    future.v = 99
-    future.items = [
-      {
-        itemId: 'codex:thread-1:turn-1:1',
-        revision: 1,
-        body: { kind: 'future-render-kind', payload: { anything: true } },
-        sequence: 2,
-        observedAt: 1_000
-      }
-    ]
-    await writeSnapshot(future)
-    expect((await readJournalSnapshot(root)).status).toBe('unreadable')
-  })
-
-  it('classifies a future version as unreadable even when its shapes still parse today', async () => {
-    await writeSnapshot({ ...validSnapshot(), v: 99 })
-    expect((await readJournalSnapshot(root)).status).toBe('unreadable')
-  })
-
-  it('treats a non-integer or sub-1 version as invalid, matching row admission', async () => {
-    for (const v of [0, 1.5]) {
-      await writeSnapshot({ ...validSnapshot(), v })
-      expect((await readJournalSnapshot(root)).status).toBe('invalid')
-    }
-  })
-})
-
-describe('journal startup isolation from a malformed snapshot', () => {
-  it('quarantines a JSON-valid malformed snapshot instead of throwing through open', async () => {
-    await writeSnapshot({ ...validSnapshot(), tombstones: {} })
-
-    const journal = await openAgentSessionJournal({
-      identity: {
-        sessionId: 'session-1',
-        workspaceId: 'ws-1',
-        hostId: 'host-1',
-        agent: 'codex',
-        providerHandle: { kind: 'codex', threadId: 'thread-1' }
-      },
-      journalDir: root
-    })
-
-    // Degraded exactly like other corrupt snapshots: quarantined on disk, never
-    // silently deleted, and the session does not adopt state it cannot trust.
-    const entries = await readdir(root)
-    expect(entries.some((entry) => entry.startsWith('quarantine-snapshot-'))).toBe(true)
-    expect(entries.includes(JOURNAL_SNAPSHOT_FILE)).toBe(false)
-    expect(journal.snapshot().items).toEqual([])
-  })
-})
-
-describe('reopen after a persisted JSON-valid poisoned question', () => {
-  it('quarantines the snapshot so reopen-to-render cannot throw in projection', async () => {
-    const poisoned = validSnapshot()
-    poisoned.items = [
-      {
-        itemId: 'codex:thread-1:turn-1:1',
-        revision: 1,
-        body: {
-          kind: 'question',
-          question: 'Deploy?',
-          options: null,
-          resolution: { state: 'resolved', selectedOptionId: 'a', resolvedBy: 'c', resolvedAt: 1 }
-        },
-        sequence: 2,
-        observedAt: 1_000
-      }
-    ] as unknown as JournalSnapshotFile['items']
-    await writeSnapshot(poisoned)
-
-    const journal = await openAgentSessionJournal({
-      identity: {
-        sessionId: 'session-1',
-        workspaceId: 'ws-1',
-        hostId: 'host-1',
-        agent: 'codex',
-        providerHandle: { kind: 'codex', threadId: 'thread-1' }
-      },
-      journalDir: root
-    })
-
-    // The poisoned item must land in quarantine, not in the reopened state:
-    // pre-fix it was admitted and the render path below threw
-    // `TypeError: Cannot read properties of null (reading 'map')`.
-    const entries = await readdir(root)
-    expect(entries.some((entry) => entry.startsWith('quarantine-snapshot-'))).toBe(true)
-    const items = journal.snapshot().items
-    expect(() => projectStructuredItemsToNativeChat(items)).not.toThrow()
-    expect(() => projectStructuredAgentSessionStatus(items)).not.toThrow()
-    expect(items).toEqual([])
-  })
-})
-
-describe('appendJournalRows directory fsync', () => {
-  const ROW: JournalRow = {
-    kind: 'epoch',
-    reason: 'session_created',
-    providerHandle: { kind: 'codex', threadId: 'thread-1' },
-    v: 1,
-    epoch: 'epoch-A',
-    seq: 1,
-    fence: 0,
-    ts: 1_000
-  }
-
-  function hookDirectoryOpen(sync: ReturnType<typeof vi.fn>): FakeDirectoryHandle {
-    const fake: FakeDirectoryHandle = { sync, close: vi.fn(async () => undefined) }
-    openDirectoryHook = (path, flags) => (path === root && flags === 'r' ? fake : undefined)
-    return fake
-  }
-
-  it('closes the directory handle when directory fsync fails', async () => {
-    const fake = hookDirectoryOpen(
-      vi.fn(async () => {
-        throw new Error('EINVAL: sync')
-      })
-    )
-
-    // Tolerating unsupported directory fsync must not turn into a leak.
-    await expect(appendJournalRows(root, [ROW])).resolves.toBeUndefined()
-    expect(fake.sync).toHaveBeenCalledTimes(1)
-    expect(fake.close).toHaveBeenCalledTimes(1)
-  })
-
-  it('closes the directory handle when directory fsync succeeds', async () => {
-    const fake = hookDirectoryOpen(vi.fn(async () => undefined))
-
-    await expect(appendJournalRows(root, [ROW])).resolves.toBeUndefined()
-    expect(fake.sync).toHaveBeenCalledTimes(1)
-    expect(fake.close).toHaveBeenCalledTimes(1)
-  })
-})
diff --git a/src/main/native-chat/agent-session-journal/journal-log-file.ts b/src/main/native-chat/agent-session-journal/journal-log-file.ts
deleted file mode 100644
index 44cbc26d0d5..00000000000
--- a/src/main/native-chat/agent-session-journal/journal-log-file.ts
+++ /dev/null
@@ -1,365 +0,0 @@
-// On-disk layout for one session's journal.
-//
-//   <journal dir>/log.jsonl    append-only rows, fsynced before the caller is told the write landed
-//   <journal dir>/snapshot.json  folded state at a compaction boundary PLUS the retained tail
-//   <journal dir>/blobs/<sha256> bounded-payload remainders
-//
-// The snapshot carries its own tail so compaction is one atomic write. A crash
-// between publishing the snapshot and truncating the log leaves the log a
-// superset of the tail, and recovery unions the two by sequence — never a hole.
-
-import { appendFile, mkdir, open, readFile, stat, type FileHandle } from 'node:fs/promises'
-import { randomUUID } from 'node:crypto'
-import { join } from 'node:path'
-import { durableWriteTempPath, renameDurable, writeFileDurable } from '../../durable-file-write'
-import {
-  AGENT_SESSION_JOURNAL_SCHEMA_VERSION,
-  type AgentJournalRenderItem,
-  type AgentJournalSubmission
-} from '../../../shared/agent-session-journal-types'
-import {
-  isAdmissibleAgentJournalRenderItem,
-  isAdmissibleAgentJournalSubmission
-} from '../../../shared/agent-session-journal-schemas'
-import { parseJournalRow, serializeJournalRow, type JournalRow } from './journal-row-schema'
-import { assertJournalPhysicalCapacity } from './journal-physical-quota'
-
-export const JOURNAL_LOG_FILE = 'log.jsonl'
-export const JOURNAL_SNAPSHOT_FILE = 'snapshot.json'
-
-export type JournalSnapshotFile = {
-  v: number
-  epoch: string
-  /** Highest sequence folded into `items`; the tail starts after it. */
-  compactedThrough: number
-  /** Fence monotonicity survives compaction and restart. */
-  highestFence: number
-  items: AgentJournalRenderItem[]
-  submissions: AgentJournalSubmission[]
-  /** Receipts outlive the rows that minted them: a client reconnecting after
-   *  compaction must still get the same answer instead of re-sending. */
-  receipts: {
-    clientMessageId: string
-    providerItemId: string
-    epoch: string
-    sequence: number
-    acceptedAt: number
-  }[]
-  /** Provider item id → submission slot, preserved so a post-compaction echo
-   *  still reconciles into the bubble it belongs to. */
-  aliases: { providerItemId: string; itemId: string }[]
-  tombstones: { itemId: string; revision: number }[]
-  /** Bounded by compaction retention; used to deduplicate a replayed settlement. */
-  appliedSettlementIds?: string[]
-  tail: JournalRow[]
-}
-
-export type JournalReadResult = {
-  rows: JournalRow[]
-  /** True when a line used a schema version this build cannot read. Reading
-   *  STOPS there — the row must not be skipped — and the host degrades to
-   *  read-only: no writes, no compaction, no deletion. */
-  unreadable: boolean
-  /** Lines that failed to parse for reasons other than schema version. */
-  malformed: number
-  /** Raw suffix beginning at the first malformed line, if any. */
-  remainder?: string
-  /** Distinguishes an absent/empty log from bytes that could not name an epoch. */
-  hasBytes: boolean
-}
-
-export type JournalSnapshotReadResult =
-  | { status: 'missing' }
-  | { status: 'valid'; snapshot: JournalSnapshotFile }
-  | { status: 'invalid' }
-  /** A future schema version: unreadable by this build, not corrupt. The file
-   *  stays authoritative in place and the caller degrades to read-only. */
-  | { status: 'unreadable' }
-
-const NEWLINE_BYTE = 0x0a
-
-export async function ensureJournalDir(journalDir: string): Promise<void> {
-  await mkdir(journalDir, { recursive: true })
-}
-
-export async function readJournalSnapshot(journalDir: string): Promise<JournalSnapshotReadResult> {
-  try {
-    const raw = await readFile(join(journalDir, JOURNAL_SNAPSHOT_FILE), 'utf-8')
-    const parsed: unknown = JSON.parse(raw)
-    const version = snapshotSchemaVersion(parsed)
-    if (version === null) {
-      return { status: 'invalid' }
-    }
-    // Version is classified BEFORE shape validation, matching row admission: a
-    // version only advances because bodies changed, so a valid newer snapshot
-    // carries kinds this build cannot parse — unreadable, never corruption.
-    if (version > AGENT_SESSION_JOURNAL_SCHEMA_VERSION) {
-      return { status: 'unreadable' }
-    }
-    return isJournalSnapshotFile(parsed)
-      ? { status: 'valid', snapshot: parsed }
-      : { status: 'invalid' }
-  } catch (error) {
-    if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
-      return { status: 'missing' }
-    }
-    if (error instanceof SyntaxError) {
-      return { status: 'invalid' }
-    }
-    throw error
-  }
-}
-
-export async function quarantineInvalidJournalSnapshot(
-  journalDir: string,
-  quota?: { sessionId: string; maxBytes: number }
-): Promise<string> {
-  // Rename is normally same-filesystem and size-neutral, but admission must
-  // happen before retaining evidence so a full journal never creates an
-  // unbounded quarantine artifact (or relies on a copy fallback).
-  if (quota) {
-    const source = join(journalDir, JOURNAL_SNAPSHOT_FILE)
-    // Account for the complete source bytes: rename is usually neutral, but a
-    // cross-device/filesystem fallback may briefly retain both inodes.
-    const sourceBytes = await stat(source)
-      .then((info) => info.size)
-      .catch((error) => {
-        if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
-          return 0
-        }
-        throw error
-      })
-    await assertJournalPhysicalCapacity({
-      journalDir,
-      ...quota,
-      peakAdditionalBytes: sourceBytes
-    })
-  }
-  const source = join(journalDir, JOURNAL_SNAPSHOT_FILE)
-  const target = join(journalDir, `quarantine-snapshot-${Date.now()}-${randomUUID()}.json`)
-  await renameDurable(source, target)
-  return target
-}
-
-export async function writeJournalSnapshotFile(
-  journalDir: string,
-  snapshot: JournalSnapshotFile
-): Promise<void> {
-  const target = join(journalDir, JOURNAL_SNAPSHOT_FILE)
-  await writeFileDurable(durableWriteTempPath(target), target, JSON.stringify(snapshot))
-}
-
-export async function readJournalLog(journalDir: string): Promise<JournalReadResult> {
-  let raw: string
-  try {
-    raw = await readFile(join(journalDir, JOURNAL_LOG_FILE), 'utf-8')
-  } catch (error) {
-    if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
-      return { rows: [], unreadable: false, malformed: 0, hasBytes: false }
-    }
-    throw error
-  }
-  const rows: JournalRow[] = []
-  let unreadable = false
-  let malformed = 0
-  const lines = raw.split('\n')
-  let offset = 0
-  for (const line of lines) {
-    if (!line.trim()) {
-      offset += line.length + 1
-      continue
-    }
-    const parsed = parseJournalRow(line)
-    if (parsed.ok) {
-      rows.push(parsed.row)
-      offset += line.length + 1
-      continue
-    }
-    if (parsed.unreadable) {
-      unreadable = true
-      return { rows, unreadable, malformed, remainder: raw.slice(offset), hasBytes: raw.length > 0 }
-    }
-    malformed += 1
-    return { rows, unreadable, malformed, remainder: raw.slice(offset), hasBytes: raw.length > 0 }
-  }
-  return { rows, unreadable, malformed, hasBytes: raw.length > 0 }
-}
-
-/** Row admission requires an integer version of at least 1; a snapshot whose
- *  version cannot even be read is malformed, not a schema statement. */
-function snapshotSchemaVersion(value: unknown): number | null {
-  const snapshot = recordOf(value)
-  const version = snapshot?.v
-  return typeof version === 'number' && Number.isInteger(version) && version >= 1 ? version : null
-}
-
-function isJournalSnapshotFile(value: unknown): value is JournalSnapshotFile {
-  if (!value || typeof value !== 'object' || Array.isArray(value)) {
-    return false
-  }
-  const snapshot = value as Record<string, unknown>
-  return (
-    typeof snapshot.v === 'number' &&
-    typeof snapshot.epoch === 'string' &&
-    snapshot.epoch.length > 0 &&
-    Number.isInteger(snapshot.compactedThrough) &&
-    (snapshot.compactedThrough as number) >= 0 &&
-    Number.isInteger(snapshot.highestFence) &&
-    // Deep discriminated admission: a JSON-valid item with a corrupt nested
-    // shape (e.g. a question whose options are null) must land this snapshot
-    // in quarantine rather than throw later in projection or prompt render.
-    arrayOf(snapshot.items, isAdmissibleAgentJournalRenderItem) &&
-    arrayOf(snapshot.submissions, isAdmissibleAgentJournalSubmission) &&
-    arrayOf(snapshot.receipts, isReceipt) &&
-    arrayOf(snapshot.aliases, isAlias) &&
-    // Older snapshots predate tombstones; absence is fine, a non-array is not —
-    // seeding iterates this collection, so a JSON-valid wrong shape must land
-    // in quarantine rather than throw through startup restoration.
-    (snapshot.tombstones === undefined || arrayOf(snapshot.tombstones, isTombstone)) &&
-    (snapshot.appliedSettlementIds === undefined ||
-      arrayOf(snapshot.appliedSettlementIds, (entry) => typeof entry === 'string')) &&
-    arrayOf(snapshot.tail, (row) => parseJournalRow(JSON.stringify(row)).ok)
-  )
-}
-
-function arrayOf(value: unknown, predicate: (entry: unknown) => boolean): value is unknown[] {
-  return Array.isArray(value) && value.every(predicate)
-}
-
-function recordOf(value: unknown): Record<string, unknown> | null {
-  return value && typeof value === 'object' && !Array.isArray(value)
-    ? (value as Record<string, unknown>)
-    : null
-}
-
-function isTombstone(value: unknown): boolean {
-  const tombstone = recordOf(value)
-  return Boolean(
-    tombstone && typeof tombstone.itemId === 'string' && Number.isInteger(tombstone.revision)
-  )
-}
-
-function isReceipt(value: unknown): boolean {
-  const receipt = recordOf(value)
-  return Boolean(
-    receipt &&
-    typeof receipt.clientMessageId === 'string' &&
-    typeof receipt.providerItemId === 'string' &&
-    typeof receipt.epoch === 'string' &&
-    typeof receipt.sequence === 'number' &&
-    typeof receipt.acceptedAt === 'number'
-  )
-}
-
-function isAlias(value: unknown): boolean {
-  const alias = recordOf(value)
-  return Boolean(
-    alias && typeof alias.providerItemId === 'string' && typeof alias.itemId === 'string'
-  )
-}
-
-/**
- * Append rows and fsync before returning. The caller treats a resolved promise
- * as "this row survives a power loss" — the write-ahead submission row depends
- * on exactly that, so this must never be relaxed to a buffered write.
- */
-export async function appendJournalRows(
-  journalDir: string,
-  rows: readonly JournalRow[]
-): Promise<void> {
-  if (rows.length === 0) {
-    return
-  }
-  const path = join(journalDir, JOURNAL_LOG_FILE)
-  // A process death can leave a final JSON fragment without its newline. Never
-  // concatenate a new durable row onto that fragment: truncate the torn tail
-  // first, then fsync the repair before acknowledging this append.
-  try {
-    await repairJournalLogTail(path)
-  } catch (error) {
-    if ((error as NodeJS.ErrnoException).code !== 'ENOENT') {
-      throw error
-    }
-    // The append below creates a missing log.
-  }
-  const payload = `${rows.map(serializeJournalRow).join('\n')}\n`
-  await appendFile(path, payload, 'utf-8')
-  const handle = await open(path, 'r+')
-  try {
-    await handle.sync()
-  } finally {
-    await handle.close()
-  }
-  let directory: FileHandle | undefined
-  try {
-    directory = await open(journalDir, 'r')
-    await directory.sync()
-  } catch {
-    // Directory fsync is unavailable on some platforms (notably Windows).
-  } finally {
-    // The tolerance above must not leak the descriptor when open succeeded
-    // but sync failed — one leaked handle per append adds up fast.
-    await directory?.close().catch(() => undefined)
-  }
-}
-
-/** Repair only a torn final row. The normal append path reads one byte; scanning
- * backward is reserved for the crash-recovery case and never rereads the log. */
-async function repairJournalLogTail(path: string): Promise<void> {
-  const handle = await open(path, 'r+')
-  try {
-    const { size } = await handle.stat()
-    if (size === 0) {
-      return
-    }
-    const lastByte = Buffer.alloc(1)
-    await handle.read(lastByte, 0, 1, size - 1)
-    if (lastByte[0] === NEWLINE_BYTE) {
-      return
-    }
-
-    const scanChunkBytes = 64 * 1024
-    let scanEnd = size
-    let boundary = -1
-    while (scanEnd > 0 && boundary === -1) {
-      const scanStart = Math.max(0, scanEnd - scanChunkBytes)
-      const chunk = Buffer.alloc(scanEnd - scanStart)
-      await handle.read(chunk, 0, chunk.length, scanStart)
-      const newline = chunk.lastIndexOf(NEWLINE_BYTE)
-      if (newline !== -1) {
-        boundary = scanStart + newline
-      }
-      scanEnd = scanStart
-    }
-
-    const lineStart = boundary + 1
-    const finalLine = Buffer.alloc(size - lineStart)
-    await handle.read(finalLine, 0, finalLine.length, lineStart)
-    // A whole row that merely lost its newline is kept; a real fragment goes.
-    const complete = parseJournalRow(finalLine.toString('utf-8')).ok
-    await (complete ? handle.write('\n', size) : handle.truncate(lineStart))
-    await handle.sync()
-  } finally {
-    await handle.close()
-  }
-}
-
-export async function quarantineJournalRemainder(
-  journalDir: string,
-  remainder: string
-): Promise<string> {
-  const path = join(journalDir, `quarantine-${Date.now()}-${randomUUID()}.jsonl`)
-  await writeFileDurable(durableWriteTempPath(path), path, remainder)
-  return path
-}
-
-/** Replace the log with exactly the retained tail. Runs only after the snapshot
- *  carrying that tail is durable, so a crash here loses nothing. */
-export async function rewriteJournalLog(
-  journalDir: string,
-  rows: readonly JournalRow[]
-): Promise<void> {
-  const target = join(journalDir, JOURNAL_LOG_FILE)
-  const payload = rows.length ? `${rows.map(serializeJournalRow).join('\n')}\n` : ''
-  await writeFileDurable(durableWriteTempPath(target), target, payload)
-}
diff --git a/src/main/native-chat/agent-session-journal/journal-open.ts b/src/main/native-chat/agent-session-journal/journal-open.ts
index 94fb3137f26..350d2e9cfb9 100644
--- a/src/main/native-chat/agent-session-journal/journal-open.ts
+++ b/src/main/native-chat/agent-session-journal/journal-open.ts
@@ -1,194 +1,205 @@
-// Loading a journal from disk: snapshot + log → folded state.
+// Loading a journal: the session projection names the live epoch, and that
+// epoch's rows are folded through the reducer in sequence order.
 //
-// The snapshot is authoritative for the current epoch. Log rows belonging to a
-// superseded epoch are dropped rather than merged — a crash between publishing
-// a rollover snapshot and rewriting the log is the ordinary way that happens.
-// A gap in the surviving sequence is corruption, and the caller rolls the epoch
+// There is no snapshot to anchor to and no superseded-epoch rows to drop — a
+// roll deletes them in the same transaction that publishes the new epoch. A gap
+// in the surviving sequence is corruption, and the caller rolls the epoch
 // rather than rendering a partial timeline.
 
-import type { AgentJournalSubmission } from '../../../shared/agent-session-journal-types'
+import { existsSync } from 'node:fs'
+import type Database from '../../sqlite/sync-database'
 import { findSequenceGap } from './journal-cursor'
-import {
-  quarantineInvalidJournalSnapshot,
-  readJournalLog,
-  readJournalSnapshot,
-  type JournalSnapshotFile
-} from './journal-log-file'
+import { openJournalDatabase } from './journal-database'
+import { journalDatabaseFile } from './journal-paths'
 import {
   applyJournalRow,
   createJournalReducerState,
-  rememberAppliedSettlementId,
   type JournalReducerState
 } from './journal-reducer'
-import { journalRowByteLength, type JournalRow } from './journal-row-schema'
+import {
+  readJournalEpochRows,
+  readJournalRowsAfter,
+  readJournalSessionEpoch
+} from './journal-row-table'
+import { JOURNAL_REPAIR_DISCLOSURE_ITEM_ID } from './journal-repair-disclosure'
+import { pendingJournalRepairSequence } from './journal-repair-marker'
+import { parseJournalRow, type JournalRow } from './journal-row-schema'
+
+/** Every epoch row is sequence 1, and no compaction moves that floor. */
+const FIRST_JOURNAL_SEQUENCE = 1
 
 export type JournalLoad = {
   state: JournalReducerState
-  /** Rows still individually replayable, oldest first. */
-  tailRows: JournalRow[]
-  /** Highest sequence folded into the snapshot; the tail starts after it. */
-  compactedThrough: number
-  /** A future schema version was met: no writes, no compaction, no deletion. */
+  /** A future schema version was met: no writes, no deletion. */
   readOnly: boolean
   /** Set when the surviving prefix is unusable and the caller must roll the epoch. */
   corrupt: boolean
-  /** Log lines skipped because they failed to parse (schema-version rows are
+  /** Rows skipped because their body failed to parse (future-version rows are
    *  `readOnly`, never counted here). The store discloses these in the timeline. */
   malformedRows: number
-  sizeBytes: number
-  /** Raw unreadable suffix retained for quarantine instead of deletion. */
-  quarantineRemainder?: string
+  /** Directory-internal: the first sequence of an unusable suffix. The store
+   *  deletes from here before it accepts a write; a probe leaves it alone. */
+  truncateFrom?: number
 }
 
-/** Returns null when no journal exists yet for this session. */
-export async function loadJournal(
-  journalDir: string,
-  sessionId: string,
-  quota?: { maxBytes: number }
-): Promise<JournalLoad | null> {
-  const snapshotRead = await readJournalSnapshot(journalDir)
-  if (snapshotRead.status === 'unreadable') {
-    // Written by a newer schema: not corrupt, so never quarantined. The file
-    // stays authoritative in place, and this build must not write, compact,
-    // delete, or render a partial timeline from rows it cannot anchor to the
-    // snapshot it cannot read.
+/**
+ * Replay on a connection this function does NOT own. Returns null when the
+ * session has no journal yet.
+ */
+export function replayJournal(
+  db: Database.Database,
+  readOnly: boolean,
+  sessionId: string
+): JournalLoad | null {
+  if (readOnly) {
     return emptyReadOnlyLoad(sessionId)
   }
-  if (snapshotRead.status === 'invalid') {
-    await quarantineInvalidJournalSnapshot(
-      journalDir,
-      quota ? { sessionId, maxBytes: quota.maxBytes } : undefined
-    )
-  }
-  const snapshot = snapshotRead.status === 'valid' ? snapshotRead.snapshot : null
-  const log = await readJournalLog(journalDir)
-  const epoch = resolveEpoch(snapshot, log.rows)
+  const epoch = readJournalSessionEpoch(db, sessionId)
   if (!epoch) {
-    return snapshotRead.status === 'invalid' || log.hasBytes ? emptyReadOnlyLoad(sessionId) : null
+    return null
+  }
+  const state = createJournalReducerState(sessionId, epoch)
+  const stored = readJournalEpochRows(db, sessionId, epoch)
+  // A partial repair keeps its prefix, so the surviving rows look contiguous and
+  // anchored however much of the timeline it deleted. Its marker is what still
+  // says otherwise, naming the sequence past which the epoch would be its own
+  // history again.
+  const repairedFrom = pendingJournalRepairSequence(db, sessionId, epoch)
+  const rows: JournalRow[] = []
+  let malformedRows = 0
+  let latched = false
+  let truncateFrom: number | undefined
+  for (const entry of stored) {
+    const parsed = parseJournalRow(entry.rowJson)
+    if (parsed.ok) {
+      rows.push(parsed.row)
+      continue
+    }
+    // Reading STOPS at the first row this build cannot represent. A future
+    // version latches read-only; anything else is one skipped row, disclosed.
+    truncateFrom = entry.seq
+    if (parsed.unreadable) {
+      latched = true
+    } else {
+      malformedRows = 1
+    }
+    break
   }
 
-  const compactedThrough = snapshot?.epoch === epoch ? snapshot.compactedThrough : 0
-  const state = seedState(sessionId, epoch, snapshot?.epoch === epoch ? snapshot : null)
-  const liveRows = log.rows.filter((row) => row.epoch === epoch)
-  let tailRows = unionBySequence(snapshot?.epoch === epoch ? snapshot.tail : [], liveRows, epoch)
-
-  const oldest = tailRows[0]?.seq ?? compactedThrough + 1
+  // Anchored at 1, never at the first row that HAPPENS to remain: nothing trims
+  // a prefix, so a missing epoch row is a hole like any other and everything
+  // behind it is unanchored. Validating from `rows[0].seq` would call the
+  // leftovers contiguous and leave them out of the repair that runs before
+  // provider history replaces the epoch.
   const gap = findSequenceGap(
-    tailRows.map((row) => row.seq),
-    oldest
+    rows.map((row) => row.seq),
+    FIRST_JOURNAL_SEQUENCE
   )
-  // A hole below the snapshot boundary is unrecoverable too: the snapshot only
-  // covers `compactedThrough`, so a tail that starts above it lost rows.
-  let corrupt = Boolean(gap) || oldest > compactedThrough + 1 || log.malformed > 0
-  let quarantineRemainder = log.remainder
   if (gap) {
-    const firstBad = tailRows.findIndex((row, index) => {
-      const expected = (tailRows[0]?.seq ?? compactedThrough + 1) + index
-      return row.seq !== expected
-    })
+    const firstBad = rows.findIndex((row, index) => row.seq !== FIRST_JOURNAL_SEQUENCE + index)
     if (firstBad !== -1) {
-      const suffix = tailRows.slice(firstBad)
-      tailRows = tailRows.slice(0, firstBad)
-      quarantineRemainder ??= `${suffix.map((row) => JSON.stringify(row)).join('\n')}\n`
+      truncateFrom = rows[firstBad]?.seq ?? truncateFrom
+      rows.length = firstBad
     }
   }
-
-  for (const row of tailRows) {
-    if (row.seq > compactedThrough) {
-      applyJournalRow(state, row)
-    }
+  // Contiguity from 1 is not the whole invariant: sequence 1 has to BE the epoch
+  // row. An ordinary row there is an epoch nothing anchors, and replaying it as
+  // clean is how a repaired journal silently adopts a timeline whose real
+  // history was never rebuilt.
+  if (rows.length > 0 && rows[0]?.kind !== 'epoch') {
+    truncateFrom = rows[0]?.seq ?? truncateFrom
+    rows.length = 0
   }
-  state.oldestSequence = oldest
-  state.lastSequence = Math.max(state.lastSequence, compactedThrough)
+  for (const row of rows) {
+    applyJournalRow(state, row)
+  }
+  state.oldestSequence = FIRST_JOURNAL_SEQUENCE
 
+  // A latched journal reduces to nothing by design; only a writable one can be
+  // held to the anchor.
+  const unanchored = !latched && rows[0]?.kind !== 'epoch'
   return {
     state,
-    tailRows,
-    compactedThrough,
-    // A future-version snapshot never reaches here: it is classified
-    // unreadable above, so `valid` implies a version this build can write.
-    readOnly: log.unreadable,
-    corrupt,
-    malformedRows: log.malformed,
-    sizeBytes: tailRows.reduce((total, row) => total + journalRowByteLength(row), 0),
-    quarantineRemainder
+    readOnly: latched,
+    corrupt:
+      Boolean(gap) ||
+      malformedRows > 0 ||
+      unanchored ||
+      (repairedFrom !== null && awaitsRebuild(rows, repairedFrom)) ||
+      awaitsProviderHistory(rows),
+    malformedRows,
+    ...(truncateFrom !== undefined && !latched ? { truncateFrom } : {})
+  }
+}
+
+/**
+ * The epoch a total repair published, still holding nothing but its own anchor
+ * and disclosure. The rows it dropped were never reconstructed, so provider
+ * history has to be retried rather than this being called a clean timeline.
+ */
+function awaitsProviderHistory(rows: readonly JournalRow[]): boolean {
+  const anchor = rows[0]
+  if (anchor?.kind !== 'epoch' || anchor.reason !== 'unreconcilable_prefix') {
+    return false
+  }
+  // The anchor sits at sequence 1, so content of the epoch's own starts at 2.
+  return awaitsRebuild(rows, FIRST_JOURNAL_SEQUENCE + 1)
+}
+
+/**
+ * True while everything at or above `contentFrom` is the repair's own
+ * bookkeeping: the deleted history was never rebuilt, so the provider has to be
+ * asked again. The moment the session writes content of its own past that
+ * sequence the epoch IS its own history, and the retry stops rather than a
+ * later import replacing rows the user has since seen.
+ */
+function awaitsRebuild(rows: readonly JournalRow[], contentFrom: number): boolean {
+  return rows.every(
+    (row) =>
+      row.seq < contentFrom ||
+      (row.kind === 'item' && row.itemId === JOURNAL_REPAIR_DISCLOSURE_ITEM_ID)
+  )
+}
+
+/** Rows after a cursor, in sequence order. Stops at the first row this build
+ *  cannot parse, exactly as replay does. */
+export function readJournalRowsAfterCursor(
+  db: Database.Database,
+  sessionId: string,
+  epoch: string,
+  afterSequence: number
+): JournalRow[] {
+  const rows: JournalRow[] = []
+  for (const stored of readJournalRowsAfter(db, sessionId, epoch, afterSequence)) {
+    const parsed = parseJournalRow(stored.rowJson)
+    if (!parsed.ok) {
+      break
+    }
+    rows.push(parsed.row)
+  }
+  return rows
+}
+
+/** Standalone probe. Opens its own connection and closes it before returning,
+ *  so a caller holding only the returned value holds no handle. */
+export function loadJournal(journalDir: string, sessionId: string): JournalLoad | null {
+  const dbPath = journalDatabaseFile(journalDir)
+  if (!existsSync(dbPath)) {
+    return null
+  }
+  const opened = openJournalDatabase(dbPath)
+  try {
+    return replayJournal(opened.db, opened.readOnly, sessionId)
+  } finally {
+    opened.db.close()
   }
 }
 
 function emptyReadOnlyLoad(sessionId: string): JournalLoad {
-  const state = createJournalReducerState(sessionId, '')
   return {
-    state,
-    tailRows: [],
-    compactedThrough: 0,
+    state: createJournalReducerState(sessionId, ''),
     readOnly: true,
     corrupt: false,
-    malformedRows: 0,
-    sizeBytes: 0
+    malformedRows: 0
   }
 }
-
-/** The snapshot names the live epoch; without one, the newest valid row does. */
-function resolveEpoch(snapshot: JournalSnapshotFile | null, rows: JournalRow[]): string | null {
-  if (snapshot?.epoch) {
-    return snapshot.epoch
-  }
-  return rows.at(-1)?.epoch ?? null
-}
-
-function seedState(
-  sessionId: string,
-  epoch: string,
-  snapshot: JournalSnapshotFile | null
-): JournalReducerState {
-  const state = createJournalReducerState(sessionId, epoch)
-  if (!snapshot) {
-    return state
-  }
-  for (const item of snapshot.items) {
-    state.items.set(item.itemId, item)
-  }
-  for (const submission of snapshot.submissions) {
-    state.submissions.set(submission.clientMessageId, { ...submission } as AgentJournalSubmission)
-  }
-  for (const receipt of snapshot.receipts) {
-    state.receipts.set(receipt.clientMessageId, {
-      clientMessageId: receipt.clientMessageId,
-      providerItemId: receipt.providerItemId,
-      cursor: { epoch: receipt.epoch, sequence: receipt.sequence },
-      acceptedAt: receipt.acceptedAt
-    })
-  }
-  for (const alias of snapshot.aliases) {
-    state.aliases.set(alias.providerItemId, alias.itemId)
-  }
-  for (const tombstone of snapshot.tombstones ?? []) {
-    state.tombstones.set(tombstone.itemId, tombstone.revision)
-  }
-  for (const settlementId of snapshot.appliedSettlementIds ?? []) {
-    rememberAppliedSettlementId(state, settlementId)
-  }
-  state.highestFence = snapshot.highestFence ?? 0
-  state.lastSequence = snapshot.compactedThrough
-  state.oldestSequence = snapshot.compactedThrough + 1
-  return state
-}
-
-/** Merge the snapshot's retained tail with the live log, preferring the log's
- *  copy of any sequence both hold, and dropping rows from a superseded epoch. */
-function unionBySequence(
-  retained: readonly JournalRow[],
-  live: readonly JournalRow[],
-  epoch: string
-): JournalRow[] {
-  const bySequence = new Map<number, JournalRow>()
-  for (const row of retained) {
-    if (row.epoch === epoch) {
-      bySequence.set(row.seq, row)
-    }
-  }
-  for (const row of live) {
-    bySequence.set(row.seq, row)
-  }
-  return [...bySequence.values()].sort((a, b) => a.seq - b.seq)
-}
diff --git a/src/main/native-chat/agent-session-journal/journal-paths.ts b/src/main/native-chat/agent-session-journal/journal-paths.ts
index 87616b25b96..c21a7675f00 100644
--- a/src/main/native-chat/agent-session-journal/journal-paths.ts
+++ b/src/main/native-chat/agent-session-journal/journal-paths.ts
@@ -40,3 +40,10 @@ export function journalDirectoryFor(
 export function defaultJournalRoot(): Promise<string> {
   return Promise.resolve(getAppEnvironment().getPath('userData'))
 }
+
+export const JOURNAL_DATABASE_FILE = 'journal.db'
+
+/** The session's SQLite database, inside the directory `journalDirectoryFor` names. */
+export function journalDatabaseFile(journalDir: string): string {
+  return join(journalDir, JOURNAL_DATABASE_FILE)
+}
diff --git a/src/main/native-chat/agent-session-journal/journal-payload-bounds.ts b/src/main/native-chat/agent-session-journal/journal-payload-bounds.ts
index b47d1a1511c..ea09ecf6df3 100644
--- a/src/main/native-chat/agent-session-journal/journal-payload-bounds.ts
+++ b/src/main/native-chat/agent-session-journal/journal-payload-bounds.ts
@@ -1,11 +1,9 @@
 // Payload bounds for tool output and diffs.
 //
-// A looping agent must not be able to fill the host disk, and a 40 MB tool
-// result must not be inlined into a row that every reconnecting client
-// replays. A bounded payload keeps a head plus the original byte length and
-// digest; the remainder lives in the content-addressed blob store under the
-// same retention as its epoch. Crossing a bound is always marked — never a
-// silent drop.
+// A 40 MB tool result must not be inlined into a row that every reconnecting
+// client replays. A bounded payload keeps a head plus the original byte length
+// and digest; the remainder is discarded. Crossing a bound is always marked —
+// never a silent drop.
 
 import { createHash } from 'node:crypto'
 import type { AgentJournalBoundedPayload } from '../../../shared/agent-session-journal-types'
@@ -13,18 +11,10 @@ import type { AgentJournalBoundedPayload } from '../../../shared/agent-session-j
 export type JournalPayloadLimits = {
   /** Bytes of the payload kept inline on the row. */
   inlineHeadBytes: number
-  /** Total bytes of journal rows one session may hold before appends are refused. */
-  maxSessionBytes: number
-  /** Appends allowed inside `appendWindowMs`, bounding a runaway agent's rate. */
-  maxAppendsPerWindow: number
-  appendWindowMs: number
 }
 
 export const DEFAULT_JOURNAL_PAYLOAD_LIMITS: JournalPayloadLimits = {
-  inlineHeadBytes: 16 * 1024,
-  maxSessionBytes: 256 * 1024 * 1024,
-  maxAppendsPerWindow: 5000,
-  appendWindowMs: 60_000
+  inlineHeadBytes: 16 * 1024
 }
 
 /** Marker appended to a clipped inline string so the UI never presents a
@@ -38,10 +28,8 @@ export function digestPayload(payload: string): string {
   return createHash('sha256').update(payload, 'utf8').digest('hex')
 }
 
-/**
- * Clip `payload` to the inline head. `truncated` means the remainder must be
- * written to the blob store under `digest` before the row is appended.
- */
+/** Clip `payload` to the inline head. `truncated` means the remainder was
+ *  discarded; `digest` and `byteLength` describe the original. */
 export function boundPayload(
   payload: string,
   limits: JournalPayloadLimits
@@ -60,7 +48,7 @@ export function boundPayload(
 }
 
 /** Bound a plain string that must stay a string (a tool-result block's output),
- *  keeping the explicit marker inline. Returns the blob payload to persist. */
+ *  keeping the explicit marker inline. */
 export function boundInlineText(
   payload: string,
   limits: JournalPayloadLimits
@@ -75,7 +63,7 @@ export function boundInlineText(
   }
 }
 
-/** Keep arbitrary tool input JSON bounded before lifecycle admission. */
+/** Keep arbitrary tool input JSON bounded before it reaches a row. */
 export function boundToolInput(input: unknown, limits: JournalPayloadLimits): unknown {
   let encoded: string
   try {
diff --git a/src/main/native-chat/agent-session-journal/journal-physical-quota.test.ts b/src/main/native-chat/agent-session-journal/journal-physical-quota.test.ts
deleted file mode 100644
index b3ee4699fc0..00000000000
--- a/src/main/native-chat/agent-session-journal/journal-physical-quota.test.ts
+++ /dev/null
@@ -1,125 +0,0 @@
-import { mkdtemp, readdir, readFile, rm, writeFile } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { afterEach, beforeEach, describe, expect, it } from 'vitest'
-import type {
-  AgentJournalItemBody,
-  AgentJournalItemIdentity,
-  AgentSessionJournalIdentity
-} from '../../../shared/agent-session-journal-types'
-import { JOURNAL_SNAPSHOT_FILE } from './journal-log-file'
-import { DEFAULT_JOURNAL_PAYLOAD_LIMITS } from './journal-payload-bounds'
-import { journalDirectoryBytes } from './journal-physical-quota'
-import { openAgentSessionJournal } from './journal-store-factory'
-
-const IDENTITY: AgentSessionJournalIdentity = {
-  sessionId: 'session-1',
-  workspaceId: 'ws-1',
-  hostId: 'host-1',
-  agent: 'codex',
-  providerHandle: { kind: 'codex', threadId: 'thread-1' }
-}
-
-let root: string
-
-function item(ordinal: number): AgentJournalItemIdentity {
-  return { provider: 'codex', threadId: 'thread-1', turnId: 'turn-1', ordinal }
-}
-
-function body(value: string): AgentJournalItemBody {
-  return { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text: value }] }
-}
-
-beforeEach(async () => {
-  root = await mkdtemp(join(tmpdir(), 'orca-journal-quota-'))
-})
-
-afterEach(async () => {
-  await rm(root, { recursive: true, force: true })
-})
-
-describe('journal physical quota peaks', () => {
-  it('refuses an epoch replacement whose staging peak exceeds the quota', async () => {
-    const limits = { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, maxSessionBytes: 8_000 }
-    const journal = await openAgentSessionJournal({
-      identity: IDENTITY,
-      journalDir: root,
-      limits,
-      autoCompact: false
-    })
-    await journal.appendItem(item(1), body('old'.repeat(500)), { fence: 1 })
-    const epoch = journal.epoch
-
-    await expect(
-      journal.replaceEpochItems('handle_forked', 2, [
-        { identity: item(2), body: body('replacement'.repeat(250)) }
-      ])
-    ).rejects.toMatchObject({ code: 'journal_bound_exceeded' })
-
-    expect(journal.epoch).toBe(epoch)
-    expect((await readdir(root)).some((name) => name.startsWith('.epoch-replacement-'))).toBe(false)
-    expect(await journalDirectoryBytes(root)).toBeLessThanOrEqual(limits.maxSessionBytes)
-  })
-
-  it('refuses schema quarantine when its peak copy would exceed the quota', async () => {
-    const limits = { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, maxSessionBytes: 7_000 }
-    await openAgentSessionJournal({ identity: IDENTITY, journalDir: root, limits })
-    const snapshotPath = join(root, JOURNAL_SNAPSHOT_FILE)
-    const snapshot = JSON.parse(await readFile(snapshotPath, 'utf-8')) as Record<string, unknown>
-    snapshot.v = 99
-    snapshot.items = [{ body: { kind: 'future', payload: 'x'.repeat(4_000) } }]
-    await writeFile(snapshotPath, JSON.stringify(snapshot), 'utf-8')
-    const reopened = await openAgentSessionJournal({ identity: IDENTITY, journalDir: root, limits })
-
-    await expect(reopened.rollEpoch('schema_unreadable', 2)).rejects.toMatchObject({
-      code: 'journal_bound_exceeded'
-    })
-
-    expect(reopened.isReadOnly).toBe(true)
-    expect((await readdir(root)).some((name) => name.startsWith('quarantine-'))).toBe(false)
-    expect(await journalDirectoryBytes(root)).toBeLessThanOrEqual(limits.maxSessionBytes)
-  })
-
-  it('does not rename an invalid snapshot when the directory is already full', async () => {
-    const limits = { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, maxSessionBytes: 2_000 }
-    await openAgentSessionJournal({ identity: IDENTITY, journalDir: root, limits })
-    const snapshotPath = join(root, JOURNAL_SNAPSHOT_FILE)
-    await writeFile(snapshotPath, '{"invalid":', 'utf8')
-    const current = await journalDirectoryBytes(root)
-    await writeFile(
-      join(root, 'quota-filler'),
-      'x'.repeat(Math.max(0, limits.maxSessionBytes - current)),
-      'utf8'
-    )
-
-    await expect(
-      openAgentSessionJournal({ identity: IDENTITY, journalDir: root, limits })
-    ).rejects.toMatchObject({ code: 'journal_bound_exceeded' })
-    expect(await readFile(snapshotPath, 'utf8')).toBe('{"invalid":')
-    expect((await readdir(root)).some((name) => name.startsWith('quarantine-snapshot-'))).toBe(
-      false
-    )
-  })
-
-  it('counts pre-existing durable-write temps while staging an epoch replacement', async () => {
-    const limits = { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, maxSessionBytes: 8_000 }
-    const journal = await openAgentSessionJournal({
-      identity: IDENTITY,
-      journalDir: root,
-      limits,
-      autoCompact: false
-    })
-    await journal.appendItem(item(1), body('old'), { fence: 1 })
-    // Simulate a temp left by a crash. Replacement must refuse before writing
-    // its epoch row or creating a staging blob beside this file.
-    await writeFile(join(root, 'snapshot.json.crashed-write.tmp'), 'x'.repeat(7_500), 'utf8')
-    const epoch = journal.epoch
-
-    await expect(
-      journal.replaceEpochItems('handle_forked', 2, [{ identity: item(2), body: body('new') }])
-    ).rejects.toMatchObject({ code: 'journal_bound_exceeded' })
-
-    expect(journal.epoch).toBe(epoch)
-    expect((await readdir(root)).some((name) => name.startsWith('.epoch-replacement-'))).toBe(false)
-  })
-})
diff --git a/src/main/native-chat/agent-session-journal/journal-physical-quota.ts b/src/main/native-chat/agent-session-journal/journal-physical-quota.ts
deleted file mode 100644
index 478451b615c..00000000000
--- a/src/main/native-chat/agent-session-journal/journal-physical-quota.ts
+++ /dev/null
@@ -1,41 +0,0 @@
-import { lstat, readdir } from 'node:fs/promises'
-import type { Dirent } from 'node:fs'
-import { join } from 'node:path'
-import { AgentSessionJournalError } from './journal-write-guards'
-
-/** Counts every physical file owned by one session, including blobs, durable
- * write temps, and retained quarantine evidence. Symlinks are charged as files
- * but never followed outside the journal directory. */
-export async function journalDirectoryBytes(directory: string): Promise<number> {
-  let entries: Dirent<string>[]
-  try {
-    entries = await readdir(directory, { withFileTypes: true, encoding: 'utf8' })
-  } catch (error) {
-    if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
-      return 0
-    }
-    throw error
-  }
-  let total = 0
-  for (const entry of entries) {
-    const path = join(directory, entry.name)
-    total += entry.isDirectory() ? await journalDirectoryBytes(path) : (await lstat(path)).size
-  }
-  return total
-}
-
-export async function assertJournalPhysicalCapacity(input: {
-  journalDir: string
-  sessionId: string
-  maxBytes: number
-  peakAdditionalBytes?: number
-}): Promise<number> {
-  const current = await journalDirectoryBytes(input.journalDir)
-  if (current + (input.peakAdditionalBytes ?? 0) > input.maxBytes) {
-    throw new AgentSessionJournalError(
-      'journal_bound_exceeded',
-      `agent-session journal for ${input.sessionId} reached its ${input.maxBytes}-byte physical bound`
-    )
-  }
-  return current
-}
diff --git a/src/main/native-chat/agent-session-journal/journal-prompt-body-bounds.ts b/src/main/native-chat/agent-session-journal/journal-prompt-body-bounds.ts
index fb8243b6926..58d12dfcf89 100644
--- a/src/main/native-chat/agent-session-journal/journal-prompt-body-bounds.ts
+++ b/src/main/native-chat/agent-session-journal/journal-prompt-body-bounds.ts
@@ -12,10 +12,7 @@ import {
 
 export const MAX_JOURNAL_PROMPT_OPTIONS = 64
 
-const JOURNAL_PROMPT_OPTION_LIMITS = {
-  ...DEFAULT_JOURNAL_PAYLOAD_LIMITS,
-  inlineHeadBytes: 1024
-}
+const JOURNAL_PROMPT_OPTION_LIMITS = { inlineHeadBytes: 1024 }
 const JOURNAL_PROMPT_ID_MAX_BYTES = 1024
 
 export function cancelledJournalPromptBody(
@@ -78,11 +75,6 @@ function boundPromptIdentifier(value: string): string {
   if (Buffer.byteLength(value, 'utf8') <= JOURNAL_PROMPT_ID_MAX_BYTES) {
     return value
   }
-  const bounded = boundPayload(value, {
-    inlineHeadBytes: JOURNAL_PROMPT_ID_MAX_BYTES - 33,
-    maxSessionBytes: Number.MAX_SAFE_INTEGER,
-    maxAppendsPerWindow: Number.MAX_SAFE_INTEGER,
-    appendWindowMs: Number.MAX_SAFE_INTEGER
-  })
+  const bounded = boundPayload(value, { inlineHeadBytes: JOURNAL_PROMPT_ID_MAX_BYTES - 33 })
   return `${bounded.head}#${bounded.digest.slice(0, 32)}`
 }
diff --git a/src/main/native-chat/agent-session-journal/journal-reducer.test.ts b/src/main/native-chat/agent-session-journal/journal-reducer.test.ts
index cbdc35a4698..676a37f63a7 100644
--- a/src/main/native-chat/agent-session-journal/journal-reducer.test.ts
+++ b/src/main/native-chat/agent-session-journal/journal-reducer.test.ts
@@ -11,7 +11,6 @@ import {
   applyJournalRow,
   createJournalReducerState,
   MAX_JOURNAL_APPLIED_SETTLEMENT_IDS,
-  referencedBlobDigests,
   renderJournalState,
   type JournalReducerState
 } from './journal-reducer'
@@ -379,58 +378,6 @@ describe('lifecycle settlement deduplication', () => {
   })
 })
 
-describe('blob retention', () => {
-  it('reports the digests live rows still reference', () => {
-    const state = fold([
-      {
-        kind: 'item',
-        itemId: 'tool',
-        revision: 1,
-        body: {
-          kind: 'tool-call',
-          name: 'bash',
-          input: {},
-          state: 'completed',
-          output: { head: 'x', byteLength: 999, digest: 'digest-a', truncated: true }
-        },
-        ...base(1)
-      },
-      {
-        kind: 'item',
-        itemId: 'inline',
-        revision: 1,
-        body: {
-          kind: 'tool-call',
-          name: 'bash',
-          input: {},
-          state: 'completed',
-          output: { head: 'y', byteLength: 1, digest: 'digest-b', truncated: false }
-        },
-        ...base(2)
-      }
-    ])
-    expect([...referencedBlobDigests(state)]).toEqual(['digest-a'])
-  })
-
-  it('stops referencing a digest once its item is tombstoned', () => {
-    const state = fold([
-      {
-        kind: 'item',
-        itemId: 'tool',
-        revision: 1,
-        body: {
-          kind: 'diff',
-          path: 'a.ts',
-          patch: { head: 'x', byteLength: 999, digest: 'digest-a', truncated: true }
-        },
-        ...base(1)
-      },
-      { kind: 'tombstone', itemId: 'tool', revision: 2, ...base(2) }
-    ])
-    expect(referencedBlobDigests(state).size).toBe(0)
-  })
-})
-
 describe('malformed persisted item keys', () => {
   it('degrades a malformed-percent item id to an opaque key instead of throwing', () => {
     // A user-message body drives identity resolution through the key parser;
diff --git a/src/main/native-chat/agent-session-journal/journal-reducer.ts b/src/main/native-chat/agent-session-journal/journal-reducer.ts
index c660f80611f..3dc4385d797 100644
--- a/src/main/native-chat/agent-session-journal/journal-reducer.ts
+++ b/src/main/native-chat/agent-session-journal/journal-reducer.ts
@@ -9,7 +9,6 @@
 
 import type {
   AgentJournalAcceptanceReceipt,
-  AgentJournalItemBody,
   AgentJournalRenderItem,
   AgentJournalSnapshot,
   AgentJournalSubmission
@@ -272,26 +271,3 @@ export function renderJournalState(state: JournalReducerState): AgentJournalSnap
     submissions: [...state.submissions.values()].sort((a, b) => a.submittedAt - b.submittedAt)
   }
 }
-
-/** Blob digests one body points at. A retained row can outlive its render item
- *  (a tombstone drops the item), so compaction reads rows through this too. */
-export function blobDigestsInBody(body: AgentJournalItemBody, into: Set<string>): void {
-  if (body.kind === 'tool-call' && body.output?.truncated) {
-    into.add(body.output.digest)
-  }
-  if (body.kind === 'diff' && body.patch.truncated) {
-    into.add(body.patch.digest)
-  }
-  if (body.kind === 'status' && body.providerFrame?.payload.truncated) {
-    into.add(body.providerFrame.payload.digest)
-  }
-}
-
-/** Digests referenced by live rows, so compaction knows which blobs to keep. */
-export function referencedBlobDigests(state: JournalReducerState): Set<string> {
-  const digests = new Set<string>()
-  for (const item of state.items.values()) {
-    blobDigestsInBody(item.body, digests)
-  }
-  return digests
-}
diff --git a/src/main/native-chat/agent-session-journal/journal-repair-disclosure.ts b/src/main/native-chat/agent-session-journal/journal-repair-disclosure.ts
new file mode 100644
index 00000000000..fee5edf142b
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-repair-disclosure.ts
@@ -0,0 +1,32 @@
+// What a repair tells the user it did.
+//
+// The identity is a constant because replay reads it back: an epoch holding
+// nothing but its anchor and this row is a repair that has not been
+// reconstructed yet, not a timeline.
+
+import { agentJournalItemKey } from '../../../shared/agent-session-journal-item-key'
+import type { AgentJournalItemIdentity } from '../../../shared/agent-session-journal-types'
+
+/** One stable identity, so a reopen upserts the same row instead of adding one. */
+export const JOURNAL_REPAIR_DISCLOSURE_IDENTITY: AgentJournalItemIdentity = {
+  provider: 'orca',
+  clientMessageId: 'journal-malformed-lines'
+}
+
+export const JOURNAL_REPAIR_DISCLOSURE_ITEM_ID = agentJournalItemKey(
+  JOURNAL_REPAIR_DISCLOSURE_IDENTITY
+)
+
+export type JournalRepairDisclosure = {
+  identity: AgentJournalItemIdentity
+  body: { kind: 'status'; text: string }
+}
+
+/** Disclosed when a repair skipped a row it could not read. */
+export function journalRepairDisclosure(input: { malformedRows: number }): JournalRepairDisclosure {
+  const lines = `${input.malformedRows} journal line${input.malformedRows === 1 ? '' : 's'}`
+  return {
+    identity: JOURNAL_REPAIR_DISCLOSURE_IDENTITY,
+    body: { kind: 'status', text: `${lines} could not be read` }
+  }
+}
diff --git a/src/main/native-chat/agent-session-journal/journal-repair-marker.ts b/src/main/native-chat/agent-session-journal/journal-repair-marker.ts
new file mode 100644
index 00000000000..f9ef09e688d
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-repair-marker.ts
@@ -0,0 +1,69 @@
+// The standing demand for a rebuild that a repair leaves behind.
+//
+// A repair that empties the epoch republishes an `unreconcilable_prefix` anchor,
+// and replay reads that back as history still owed. A repair that KEEPS a prefix
+// has no such anchor to publish and — for a plain sequence gap — no malformed
+// row to disclose either, so nothing on disk would record that the deleted
+// suffix was never reconstructed. This marker is that record, written in the
+// SAME transaction as the deletion: a crash between the two would otherwise
+// leave the rows gone with nothing left asking for them back.
+//
+// It records the first sequence at which the epoch would hold content of its
+// own again, because it retires under exactly the rule the emptied-epoch anchor
+// takes: a fresh epoch carries the rebuild, and a session that writes past that
+// sequence owns the epoch and stops the retry.
+
+import type Database from '../../sqlite/sync-database'
+import { deleteJournalRowSuffix } from './journal-row-table'
+
+const SELECT_REPAIR = 'SELECT epoch, content_from FROM journal_repairs WHERE session_id = ?'
+const UPSERT_REPAIR = `INSERT INTO journal_repairs (session_id, epoch, content_from, repaired_at)
+VALUES (?, ?, ?, ?)
+ON CONFLICT(session_id) DO UPDATE SET
+  epoch = excluded.epoch, content_from = excluded.content_from, repaired_at = excluded.repaired_at`
+const DELETE_REPAIR = 'DELETE FROM journal_repairs WHERE session_id = ?'
+
+/**
+ * The sequence a pending repair on THIS epoch left free, or null when none is
+ * pending. Epoch-scoped: a marker raised on an epoch that has since been
+ * superseded says nothing about the live one.
+ */
+export function pendingJournalRepairSequence(
+  db: Database.Database,
+  sessionId: string,
+  epoch: string
+): number | null {
+  const row = db.prepare(SELECT_REPAIR).get(sessionId) as
+    | { epoch?: string; content_from?: number }
+    | undefined
+  return row?.epoch === epoch ? (row.content_from ?? null) : null
+}
+
+/** Retires the marker. Called from inside the epoch transactions, whose new
+ *  epoch is the rebuilt history the marker was holding out for. */
+export function clearJournalRepairMarker(db: Database.Database, sessionId: string): void {
+  db.prepare(DELETE_REPAIR).run(sessionId)
+}
+
+/** Drop the rejected suffix and record that it is owed, atomically. */
+export function deleteJournalRepairedSuffix(input: {
+  db: Database.Database
+  sessionId: string
+  epoch: string
+  /** First sequence of the rejected suffix. */
+  fromSeq: number
+  /** First sequence left free once the suffix is gone. */
+  contentFrom: number
+  now: number
+}): number {
+  input.db.exec('BEGIN IMMEDIATE')
+  try {
+    const deleted = deleteJournalRowSuffix(input.db, input.sessionId, input.epoch, input.fromSeq)
+    input.db.prepare(UPSERT_REPAIR).run(input.sessionId, input.epoch, input.contentFrom, input.now)
+    input.db.exec('COMMIT')
+    return deleted
+  } catch (error) {
+    input.db.exec('ROLLBACK')
+    throw error
+  }
+}
diff --git a/src/main/native-chat/agent-session-journal/journal-row-table.ts b/src/main/native-chat/agent-session-journal/journal-row-table.ts
new file mode 100644
index 00000000000..306b3b300f2
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-row-table.ts
@@ -0,0 +1,92 @@
+// Every statement the journal issues against `journal_rows` / `journal_sessions`.
+//
+// Each one is a prefix or range scan on the `(session_id, epoch, seq)` primary
+// key; there is no secondary index, and no `max(seq)` tip query — replay folds
+// the epoch to obtain `lastSequence`, so nothing needs the tip from SQL.
+// Columns are always named: `SELECT *` is uncacheable and can drop a column.
+
+import type Database from '../../sqlite/sync-database'
+import { serializeJournalRow, type JournalRow } from './journal-row-schema'
+
+export type JournalStoredRow = { epoch: string; seq: number; ts: number; rowJson: string }
+
+const SELECT_SESSION = 'SELECT epoch FROM journal_sessions WHERE session_id = ?'
+const UPSERT_SESSION = `INSERT INTO journal_sessions (session_id, epoch, updated_at)
+VALUES (?, ?, ?)
+ON CONFLICT(session_id) DO UPDATE SET epoch = excluded.epoch, updated_at = excluded.updated_at`
+const INSERT_ROW =
+  'INSERT INTO journal_rows (session_id, epoch, seq, ts, row_json) VALUES (?, ?, ?, ?, ?)'
+const SELECT_EPOCH_ROWS = `SELECT epoch, seq, ts, row_json FROM journal_rows
+WHERE session_id = ? AND epoch = ? ORDER BY seq ASC`
+const SELECT_ROWS_AFTER = `SELECT epoch, seq, ts, row_json FROM journal_rows
+WHERE session_id = ? AND epoch = ? AND seq > ? ORDER BY seq ASC`
+const DELETE_SUFFIX = 'DELETE FROM journal_rows WHERE session_id = ? AND epoch = ? AND seq >= ?'
+
+export function readJournalSessionEpoch(db: Database.Database, sessionId: string): string | null {
+  const row = db.prepare(SELECT_SESSION).get(sessionId) as { epoch?: string } | undefined
+  return row?.epoch ?? null
+}
+
+export function upsertJournalSessionRow(
+  db: Database.Database,
+  sessionId: string,
+  epoch: string,
+  updatedAt: number
+): void {
+  db.prepare(UPSERT_SESSION).run(sessionId, epoch, updatedAt)
+}
+
+export function insertJournalRow(
+  db: Database.Database,
+  sessionId: string,
+  row: JournalRow
+): number {
+  const rowJson = serializeJournalRow(row)
+  db.prepare(INSERT_ROW).run(sessionId, row.epoch, row.seq, row.ts, rowJson)
+  return Buffer.byteLength(rowJson, 'utf8')
+}
+
+export function readJournalEpochRows(
+  db: Database.Database,
+  sessionId: string,
+  epoch: string
+): JournalStoredRow[] {
+  return toStoredRows(db.prepare(SELECT_EPOCH_ROWS).all(sessionId, epoch))
+}
+
+export function readJournalRowsAfter(
+  db: Database.Database,
+  sessionId: string,
+  epoch: string,
+  afterSeq: number
+): JournalStoredRow[] {
+  return toStoredRows(db.prepare(SELECT_ROWS_AFTER).all(sessionId, epoch, afterSeq))
+}
+
+/**
+ * Unqualified on purpose. One database per session means every row here belongs
+ * to this session, and the unqualified form takes SQLite's truncate
+ * optimization: measured at 0.26% of the database in WAL bytes where the
+ * `WHERE session_id = ?` form rewrote every emptied leaf at up to 99%.
+ */
+export function deleteAllJournalRows(db: Database.Database): void {
+  db.exec('DELETE FROM journal_rows')
+}
+
+/** Drop the rejected suffix a repair found, from `fromSeq` to the tip. */
+export function deleteJournalRowSuffix(
+  db: Database.Database,
+  sessionId: string,
+  epoch: string,
+  fromSeq: number
+): number {
+  const deleted = db.prepare(DELETE_SUFFIX).run(sessionId, epoch, fromSeq)
+  return Number(deleted.changes ?? 0)
+}
+
+function toStoredRows(rows: readonly unknown[]): JournalStoredRow[] {
+  return rows.map((entry) => {
+    const record = entry as { epoch: string; seq: number; ts: number; row_json: string }
+    return { epoch: record.epoch, seq: record.seq, ts: record.ts, rowJson: record.row_json }
+  })
+}
diff --git a/src/main/native-chat/agent-session-journal/journal-row-writer-read-only-latch.test.ts b/src/main/native-chat/agent-session-journal/journal-row-writer-read-only-latch.test.ts
deleted file mode 100644
index 2b318bc5320..00000000000
--- a/src/main/native-chat/agent-session-journal/journal-row-writer-read-only-latch.test.ts
+++ /dev/null
@@ -1,362 +0,0 @@
-import { mkdtemp, rm, writeFile } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { afterEach, beforeEach, describe, expect, it } from 'vitest'
-import type { AgentJournalItemBody } from '../../../shared/agent-session-journal-types'
-import { AGENT_SESSION_JOURNAL_SCHEMA_VERSION } from '../../../shared/agent-session-journal-types'
-import { readJournalBlob } from './journal-blob-store'
-import { appendJournalRows } from './journal-log-file'
-import { JournalLifecycleAdmission } from './journal-lifecycle-admission'
-import { JOURNAL_ITEM_TERMINAL_RESERVATION_BYTES } from './journal-lifecycle-capacity'
-import { loadJournal } from './journal-open'
-import { boundPayload, DEFAULT_JOURNAL_PAYLOAD_LIMITS } from './journal-payload-bounds'
-import { journalRowByteLength, type JournalRow } from './journal-row-schema'
-import { JournalRowWriter } from './journal-row-writer'
-import { JournalAppendBudget } from './journal-write-guards'
-
-const SESSION_ID = 'session-1'
-
-function row(seq: number, ts: number): JournalRow {
-  return {
-    v: AGENT_SESSION_JOURNAL_SCHEMA_VERSION,
-    epoch: 'epoch-1',
-    seq,
-    fence: 0,
-    ts,
-    kind: 'item',
-    itemId: 'item-1',
-    revision: 1,
-    body: { kind: 'status', text: 'ambiguous append' }
-  }
-}
-
-function rowWithBlob(seq: number, ts: number, output: ReturnType<typeof boundPayload>): JournalRow {
-  return {
-    v: AGENT_SESSION_JOURNAL_SCHEMA_VERSION,
-    epoch: 'epoch-1',
-    seq,
-    fence: 0,
-    ts,
-    kind: 'item',
-    itemId: 'item-with-blob',
-    revision: 1,
-    body: {
-      kind: 'tool-call',
-      name: 'shell',
-      input: {},
-      state: 'completed',
-      output
-    }
-  }
-}
-
-function runningToolRow(seq: number, ts: number, itemId = 'running-tool'): JournalRow {
-  return {
-    v: AGENT_SESSION_JOURNAL_SCHEMA_VERSION,
-    epoch: 'epoch-1',
-    seq,
-    fence: 0,
-    ts,
-    kind: 'item',
-    itemId,
-    revision: 1,
-    body: runningToolBody()
-  }
-}
-
-function runningToolBody(): AgentJournalItemBody {
-  return { kind: 'tool-call', name: 'shell', input: {}, state: 'running' }
-}
-
-describe('journal row writer read-only latch', () => {
-  let root: string
-  let readOnly = false
-
-  beforeEach(async () => {
-    root = await mkdtemp(join(tmpdir(), 'orca-journal-row-writer-'))
-    readOnly = false
-  })
-
-  afterEach(async () => {
-    await rm(root, { recursive: true, force: true })
-  })
-
-  it('enforces the lifecycle append rate and allows a retry after the window', () => {
-    const appendWindowMs = 100
-    const budget = new JournalAppendBudget(SESSION_ID, {
-      ...DEFAULT_JOURNAL_PAYLOAD_LIMITS,
-      maxAppendsPerWindow: 1,
-      appendWindowMs
-    })
-
-    budget.assertLifecycle(row(1, 1), 0)
-    expect(() => budget.assertLifecycle(row(2, 1), 0)).toThrow(
-      expect.objectContaining({ code: 'journal_rate_exceeded' })
-    )
-    expect(() => budget.assertLifecycle(row(2, appendWindowMs + 1), 0)).not.toThrow()
-  })
-
-  it('refuses lifecycle reservations once aggregate append capacity is saturated', () => {
-    const admission = new JournalLifecycleAdmission(SESSION_ID, 1_000_000, (itemId) => itemId, 2)
-    expect(admission.reserve({ id: 'first', bytes: 1, appendSlots: 1 }, 0)).toBe(true)
-    expect(admission.reserve({ id: 'second', bytes: 1, appendSlots: 1 }, 0)).toBe(true)
-    expect(admission.reserve({ id: 'third', bytes: 1, appendSlots: 1 }, 0)).toBe(false)
-  })
-
-  function writerHarness(
-    overrides: {
-      limits?: typeof DEFAULT_JOURNAL_PAYLOAD_LIMITS
-      physicalBytes?: number
-      appendRows?: (journalDir: string, rows: readonly JournalRow[]) => Promise<void>
-      commit?: (row: JournalRow, physicalBytes: number) => void
-    } = {}
-  ) {
-    const limits = overrides.limits ?? DEFAULT_JOURNAL_PAYLOAD_LIMITS
-    const lifecycleAdmission = new JournalLifecycleAdmission(
-      SESSION_ID,
-      limits.maxSessionBytes,
-      (itemId) => itemId
-    )
-    let physicalBytes = overrides.physicalBytes ?? 0
-    let nextSequence = 1
-    const committedRows: JournalRow[] = []
-    const writer = new JournalRowWriter({
-      journalDir: root,
-      sessionId: SESSION_ID,
-      budget: new JournalAppendBudget(SESSION_ID, limits),
-      lifecycleAdmission,
-      autoCompact: false,
-      compaction: { minTailRows: 0, retainTailMs: 0 },
-      now: () => 1,
-      serialize: (run) => run(),
-      readOnly: () => readOnly,
-      setReadOnly: (value) => {
-        readOnly = value
-      },
-      physicalBytes: () => physicalBytes,
-      highestFence: () => 0,
-      nextSequence: () => nextSequence,
-      tailRows: () => committedRows,
-      referencedBlobDigests: () => new Set(),
-      compact: async () => undefined,
-      commit: (row, nextPhysicalBytes) => {
-        overrides.commit?.(row, nextPhysicalBytes)
-        committedRows.push(row)
-        physicalBytes = nextPhysicalBytes
-        nextSequence = row.seq + 1
-      },
-      ...(overrides.appendRows ? { appendRows: overrides.appendRows } : {})
-    })
-    return { writer, lifecycleAdmission, committedRows }
-  }
-
-  it('latches read-only when a post-append failure makes durability ambiguous', async () => {
-    let committed = false
-    const writer = new JournalRowWriter({
-      journalDir: root,
-      sessionId: 'session-1',
-      budget: new JournalAppendBudget('session-1', DEFAULT_JOURNAL_PAYLOAD_LIMITS),
-      lifecycleAdmission: new JournalLifecycleAdmission(
-        'session-1',
-        DEFAULT_JOURNAL_PAYLOAD_LIMITS.maxSessionBytes,
-        (itemId) => itemId
-      ),
-      autoCompact: false,
-      compaction: { minTailRows: 0, retainTailMs: 0 },
-      now: () => 1,
-      serialize: (run) => run(),
-      readOnly: () => readOnly,
-      setReadOnly: (value) => {
-        readOnly = value
-      },
-      physicalBytes: () => 0,
-      highestFence: () => 0,
-      nextSequence: () => 1,
-      tailRows: () => [],
-      referencedBlobDigests: () => new Set(),
-      compact: async () => undefined,
-      commit: () => {
-        committed = true
-      },
-      appendRows: async (journalDir, rows) => {
-        await appendJournalRows(journalDir, rows)
-        throw new Error('fsync failed after append')
-      }
-    })
-
-    await expect(writer.enqueue(row)).rejects.toThrow('fsync failed after append')
-
-    expect(readOnly).toBe(true)
-    expect(committed).toBe(false)
-    await expect(writer.enqueue(row)).rejects.toMatchObject({ code: 'journal_read_only' })
-  })
-
-  it('keeps blobs for a durable row when a post-append crash is reported', async () => {
-    const payload = 'durable blob payload'.repeat(2_000)
-    const bounded = boundPayload(payload, {
-      ...DEFAULT_JOURNAL_PAYLOAD_LIMITS,
-      inlineHeadBytes: 32
-    })
-    const writer = new JournalRowWriter({
-      journalDir: root,
-      sessionId: 'session-1',
-      budget: new JournalAppendBudget('session-1', DEFAULT_JOURNAL_PAYLOAD_LIMITS),
-      lifecycleAdmission: new JournalLifecycleAdmission(
-        'session-1',
-        DEFAULT_JOURNAL_PAYLOAD_LIMITS.maxSessionBytes,
-        (itemId) => itemId
-      ),
-      autoCompact: false,
-      compaction: { minTailRows: 0, retainTailMs: 0 },
-      now: () => 1,
-      serialize: (run) => run(),
-      readOnly: () => readOnly,
-      setReadOnly: (value) => {
-        readOnly = value
-      },
-      physicalBytes: () => 0,
-      highestFence: () => 0,
-      nextSequence: () => 1,
-      tailRows: () => [],
-      referencedBlobDigests: () => new Set(),
-      compact: async () => undefined,
-      commit: () => undefined,
-      appendRows: async (journalDir, rows) => {
-        await appendJournalRows(journalDir, rows)
-        throw new Error('crash after row append')
-      }
-    })
-
-    await expect(
-      writer.enqueue(
-        (seq, ts) => rowWithBlob(seq, ts, bounded),
-        [{ digest: bounded.digest, payload }]
-      )
-    ).rejects.toThrow('crash after row append')
-
-    expect(readOnly).toBe(true)
-    await expect(writer.enqueue(row)).rejects.toMatchObject({ code: 'journal_read_only' })
-    expect(await readJournalBlob(root, bounded.digest)).toBe(payload)
-    const reopened = await loadJournal(root, 'session-1')
-    const item = reopened?.state.items.get('item-with-blob')
-    expect(item?.body).toMatchObject({
-      kind: 'tool-call',
-      output: { digest: bounded.digest, truncated: true }
-    })
-  })
-
-  it('does not leak a lifecycle reservation after budget refusal', async () => {
-    const probe = runningToolRow(1, 1)
-    const limits = {
-      ...DEFAULT_JOURNAL_PAYLOAD_LIMITS,
-      maxSessionBytes: JOURNAL_ITEM_TERMINAL_RESERVATION_BYTES + journalRowByteLength(probe) - 1
-    }
-    const { writer, lifecycleAdmission, committedRows } = writerHarness({ limits })
-
-    await expect(writer.enqueue((seq, ts) => runningToolRow(seq, ts))).rejects.toMatchObject({
-      code: 'journal_bound_exceeded'
-    })
-
-    expect(lifecycleAdmission.state).toEqual({ reservedBytes: 0, reservedAppendSlots: 0 })
-    await expect(writer.enqueue(row)).resolves.toMatchObject({ kind: 'item', itemId: 'item-1' })
-    expect(
-      committedRows.map((entry) => (entry.kind === 'item' ? entry.itemId : 'non-item'))
-    ).toEqual(['item-1'])
-  })
-
-  it('preflights existing durable-write temps before creating a blob or row', async () => {
-    const tempBytes = 512
-    const tempPath = join(root, 'log.jsonl.existing-write.tmp')
-    await writeFile(tempPath, 't'.repeat(tempBytes), 'utf8')
-    const probe = row(1, 1)
-    const limits = {
-      ...DEFAULT_JOURNAL_PAYLOAD_LIMITS,
-      maxSessionBytes: tempBytes + journalRowByteLength(probe) - 1
-    }
-    const { writer, committedRows } = writerHarness({ limits })
-
-    await expect(writer.enqueue((seq, ts) => row(seq, ts))).rejects.toMatchObject({
-      code: 'journal_bound_exceeded'
-    })
-    expect(committedRows).toHaveLength(0)
-    expect(await readJournalBlob(root, 'a'.repeat(64))).toBeNull()
-  })
-
-  it('does not leak a lifecycle reservation after blob lookup failure', async () => {
-    const { writer, lifecycleAdmission } = writerHarness()
-    const digest = 'a'.repeat(64)
-    await writeFile(join(root, 'blobs'), 'not a directory', 'utf8')
-
-    await expect(
-      writer.enqueue((seq, ts) => runningToolRow(seq, ts), [{ digest, payload: 'payload' }])
-    ).rejects.toThrow()
-
-    expect(lifecycleAdmission.state).toEqual({ reservedBytes: 0, reservedAppendSlots: 0 })
-    await rm(join(root, 'blobs'), { force: true })
-    await expect(writer.enqueue((seq, ts) => runningToolRow(seq, ts))).resolves.toMatchObject({
-      kind: 'item',
-      itemId: 'running-tool'
-    })
-    expect(lifecycleAdmission.state).toEqual({
-      reservedBytes: JOURNAL_ITEM_TERMINAL_RESERVATION_BYTES,
-      reservedAppendSlots: 1
-    })
-  })
-
-  it('rolls back ordinary append-rate reservation after blob preflight failure', async () => {
-    const limits = {
-      ...DEFAULT_JOURNAL_PAYLOAD_LIMITS,
-      maxAppendsPerWindow: 1,
-      appendWindowMs: 100
-    }
-    const { writer, committedRows } = writerHarness({ limits })
-    const payload = 'retryable blob payload'.repeat(100)
-    const bounded = boundPayload(payload, limits)
-    await writeFile(join(root, 'blobs'), 'not a directory', 'utf8')
-
-    await expect(
-      writer.enqueue(
-        (seq, ts) => rowWithBlob(seq, ts, bounded),
-        [{ digest: bounded.digest, payload }]
-      )
-    ).rejects.toThrow()
-
-    await rm(join(root, 'blobs'), { force: true })
-    await expect(
-      writer.enqueue(
-        (seq, ts) => rowWithBlob(seq, ts, bounded),
-        [{ digest: bounded.digest, payload }]
-      )
-    ).resolves.toMatchObject({ kind: 'item', itemId: 'item-with-blob' })
-    expect(committedRows).toHaveLength(1)
-  })
-
-  it('does not leak a lifecycle reservation after durable append failure', async () => {
-    const { writer, lifecycleAdmission } = writerHarness({
-      appendRows: async () => {
-        throw new Error('append failed before a durable row existed')
-      }
-    })
-
-    await expect(writer.enqueue((seq, ts) => runningToolRow(seq, ts))).rejects.toThrow(
-      'append failed before a durable row existed'
-    )
-
-    expect(readOnly).toBe(true)
-    expect(lifecycleAdmission.state).toEqual({ reservedBytes: 0, reservedAppendSlots: 0 })
-  })
-
-  it('does not leak a lifecycle reservation after reducer commit failure', async () => {
-    const { writer, lifecycleAdmission } = writerHarness({
-      commit: () => {
-        throw new Error('commit failed after durable append')
-      }
-    })
-
-    await expect(writer.enqueue((seq, ts) => runningToolRow(seq, ts))).rejects.toThrow(
-      'commit failed after durable append'
-    )
-
-    expect(lifecycleAdmission.state).toEqual({ reservedBytes: 0, reservedAppendSlots: 0 })
-  })
-})
diff --git a/src/main/native-chat/agent-session-journal/journal-row-writer.test.ts b/src/main/native-chat/agent-session-journal/journal-row-writer.test.ts
new file mode 100644
index 00000000000..dc08739a8bc
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-row-writer.test.ts
@@ -0,0 +1,94 @@
+// The write path's transaction.
+//
+// A transaction either commits or does not, so the old "a post-append failure
+// makes durability ambiguous" latch has nothing left to latch on: the case that
+// used to assert the latch asserts the rollback instead.
+
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { AGENT_SESSION_JOURNAL_SCHEMA_VERSION } from '../../../shared/agent-session-journal-types'
+import { openJournalDatabase, type OpenJournalDatabase } from './journal-database'
+import { journalDatabaseFile } from './journal-paths'
+import {
+  insertJournalRow,
+  readJournalEpochRows,
+  upsertJournalSessionRow
+} from './journal-row-table'
+import type { JournalRow } from './journal-row-schema'
+import { JournalRowWriter } from './journal-row-writer'
+
+const SESSION_ID = 'session-1'
+const EPOCH = 'epoch-1'
+
+function row(seq: number, ts: number): JournalRow {
+  return {
+    v: AGENT_SESSION_JOURNAL_SCHEMA_VERSION,
+    epoch: EPOCH,
+    seq,
+    fence: 0,
+    ts,
+    kind: 'item',
+    itemId: 'item-1',
+    revision: 1,
+    body: { kind: 'status', text: 'plain append' }
+  }
+}
+
+describe('journal row writer', () => {
+  let root: string
+  let database: OpenJournalDatabase
+  let readOnly = false
+
+  beforeEach(async () => {
+    root = await mkdtemp(join(tmpdir(), 'orca-journal-row-writer-'))
+    database = openJournalDatabase(journalDatabaseFile(root))
+    upsertJournalSessionRow(database.db, SESSION_ID, EPOCH, 1)
+    readOnly = false
+  })
+
+  afterEach(async () => {
+    try {
+      database.db.close()
+    } catch {
+      // Already closed by the case.
+    }
+    await rm(root, { recursive: true, force: true })
+  })
+
+  function writerHarness() {
+    const committedRows: JournalRow[] = []
+    let sequence = 1
+    const writer = new JournalRowWriter({
+      sessionId: SESSION_ID,
+      now: () => 1,
+      serialize: (run) => run(),
+      database: () => database,
+      readOnly: () => readOnly,
+      highestFence: () => 0,
+      nextSequence: () => sequence,
+      commit: (committed) => {
+        committedRows.push(committed)
+        sequence = committed.seq + 1
+      }
+    })
+    return { writer, committedRows }
+  }
+
+  it('rolls the transaction back and sets no latch when the insert fails', async () => {
+    const { writer, committedRows } = writerHarness()
+    // A row already occupies sequence 1, so the insert violates the primary key.
+    insertJournalRow(database.db, SESSION_ID, row(1, 1))
+
+    await expect(writer.enqueue(row)).rejects.toThrow()
+
+    expect(readOnly).toBe(false)
+    expect(committedRows).toHaveLength(0)
+    expect(readJournalEpochRows(database.db, SESSION_ID, EPOCH)).toHaveLength(1)
+    // Still writable: there is no ambiguity for a latch to protect against.
+    await expect(writer.enqueue((seq, ts) => row(seq + 1, ts))).resolves.toMatchObject({
+      kind: 'item'
+    })
+  })
+})
diff --git a/src/main/native-chat/agent-session-journal/journal-row-writer.ts b/src/main/native-chat/agent-session-journal/journal-row-writer.ts
index 980275d4c72..85ff7da7a3f 100644
--- a/src/main/native-chat/agent-session-journal/journal-row-writer.ts
+++ b/src/main/native-chat/agent-session-journal/journal-row-writer.ts
@@ -1,188 +1,42 @@
-import {
-  budgetPressurePolicy,
-  journalTailCanShedRows,
-  journalTailIsReadyToCompact,
-  type JournalCompactionPolicy
-} from './journal-compaction'
-import { journalBlobFileSize, putJournalBlob, removeJournalBlob } from './journal-blob-store'
-import { appendJournalRows } from './journal-log-file'
-import { blobDigestsInBody } from './journal-reducer'
-import { journalDirectoryBytes } from './journal-physical-quota'
-import type { JournalLifecycleAdmission } from './journal-lifecycle-admission'
-import { journalRowByteLength, type JournalRow } from './journal-row-schema'
-import {
-  AgentSessionJournalError,
-  assertJournalFence,
-  assertJournalWritable,
-  type JournalAppendBudget
-} from './journal-write-guards'
-
-type JournalBlob = { digest: string; payload: string }
+import type Database from '../../sqlite/sync-database'
+import { insertJournalRow, upsertJournalSessionRow } from './journal-row-table'
+import type { JournalRow } from './journal-row-schema'
+import { assertJournalFence, assertJournalWritable } from './journal-write-guards'
 
 export type JournalRowWriterDeps = {
-  journalDir: string
   sessionId: string
-  budget: JournalAppendBudget
-  lifecycleAdmission: JournalLifecycleAdmission
-  autoCompact: boolean
-  compaction: JournalCompactionPolicy
   now: () => number
   serialize: <T>(run: () => Promise<T>) => Promise<T>
+  database: () => { db: Database.Database }
   readOnly: () => boolean
-  setReadOnly: (readOnly: boolean) => void
-  physicalBytes: () => number
   highestFence: () => number
   nextSequence: () => number
-  tailRows: () => readonly JournalRow[]
-  referencedBlobDigests: () => ReadonlySet<string>
-  compact: (now: number, policy: JournalCompactionPolicy) => Promise<void>
-  commit: (row: JournalRow, physicalBytes: number) => void
-  appendRows?: (journalDir: string, rows: readonly JournalRow[]) => Promise<void>
+  commit: (row: JournalRow) => void
 }
 
 export class JournalRowWriter {
   constructor(private readonly deps: JournalRowWriterDeps) {}
 
-  enqueue(
-    build: (seq: number, ts: number) => JournalRow,
-    blobs: readonly JournalBlob[] = []
-  ): Promise<JournalRow> {
+  enqueue(build: (seq: number, ts: number) => JournalRow): Promise<JournalRow> {
     return this.deps.serialize(async () => {
       assertJournalWritable(this.deps.readOnly(), this.deps.sessionId)
-      const ts = this.deps.now()
-      const row = build(this.deps.nextSequence(), ts)
+      const row = build(this.deps.nextSequence(), this.deps.now())
       assertJournalFence(row.fence, this.deps.highestFence())
-      // The in-memory counter is an optimization, not the quota source of
-      // truth: a prior crash may have left a durable-write temp beside the
-      // finals, and a concurrent/retried opener may have materialized files
-      // after the last commit callback. Recount before any speculative write
-      // so the peak check includes those bytes.
-      let physicalBytes = Math.max(
-        this.deps.physicalBytes(),
-        await journalDirectoryBytes(this.deps.journalDir)
-      )
-      const admission = this.deps.lifecycleAdmission.prepare(row, physicalBytes)
-      const newBlobs = await uniqueNewBlobs(this.deps.journalDir, blobs)
-      const blobBytes = newBlobs.reduce(
-        (total, blob) => total + Buffer.byteLength(blob.payload, 'utf8'),
-        0
-      )
-      const budgetCompaction = budgetPressurePolicy(this.deps.compaction)
-      let effectiveSize = physicalBytes + blobBytes + admission.protectedBytes
-      if (
-        this.deps.autoCompact &&
-        this.deps.budget.wouldExceedSize(row, effectiveSize) &&
-        journalTailCanShedRows(this.deps.tailRows(), budgetCompaction, ts)
-      ) {
-        await this.deps.compact(ts, budgetCompaction)
-        physicalBytes = this.deps.physicalBytes()
-        effectiveSize = physicalBytes + blobBytes + admission.protectedBytes
-      }
-      const lifecycleRateCheckpoint = admission.lifecycleCovered
-        ? this.deps.budget.checkpoint()
-        : null
-      const appendRateCheckpoint = this.deps.budget.checkpoint()
-      let committed = false
-      let appendMayHaveLanded = false
+      const { db } = this.deps.database()
+      db.exec('BEGIN IMMEDIATE')
       try {
-        if (admission.lifecycleCovered) {
-          this.deps.budget.assertReservedLifecycle(row, effectiveSize)
-        } else {
-          this.deps.budget.assert(row, ts, effectiveSize)
-        }
-        const appendedBytes = blobBytes + journalRowByteLength(row)
-        if (
-          physicalBytes + appendedBytes >
-          this.deps.budget.maxSessionBytes - admission.protectedBytes
-        ) {
-          throw new AgentSessionJournalError(
-            'journal_bound_exceeded',
-            `agent-session journal for ${this.deps.sessionId} reached its ${this.deps.budget.maxSessionBytes}-byte physical bound`
-          )
-        }
-        await this.commitFiles(row, newBlobs, () => {
-          appendMayHaveLanded = true
-        })
-        physicalBytes += appendedBytes
-        this.deps.commit(row, physicalBytes)
-        this.deps.lifecycleAdmission.commit(admission)
-        committed = true
+        insertJournalRow(db, this.deps.sessionId, row)
+        upsertJournalSessionRow(db, this.deps.sessionId, row.epoch, row.ts)
+        db.exec('COMMIT')
       } catch (error) {
-        if (!committed && lifecycleRateCheckpoint) {
-          this.deps.budget.restore(lifecycleRateCheckpoint)
-        }
-        if (!committed && !appendMayHaveLanded) {
-          this.deps.budget.restore(appendRateCheckpoint)
-        }
+        db.exec('ROLLBACK')
         throw error
       }
-      if (
-        this.deps.autoCompact &&
-        journalTailIsReadyToCompact(this.deps.tailRows(), this.deps.compaction, ts)
-      ) {
-        await this.deps.compact(ts, this.deps.compaction)
-      }
+      // COMMIT landed, so the row is durable: adopt it before anything that can
+      // fail. Rejecting here instead would leave the next append reusing a
+      // sequence the table already holds.
+      this.deps.commit(row)
       return row
     })
   }
-
-  private async commitFiles(
-    row: JournalRow,
-    blobs: readonly JournalBlob[],
-    markAppendLanded: () => void
-  ): Promise<void> {
-    const persisted: string[] = []
-    let appendMayHaveLanded = false
-    try {
-      for (const blob of blobs) {
-        await putJournalBlob(this.deps.journalDir, blob.digest, blob.payload)
-        persisted.push(blob.digest)
-      }
-      appendMayHaveLanded = true
-      markAppendLanded()
-      await (this.deps.appendRows ?? appendJournalRows)(this.deps.journalDir, [row])
-    } catch (error) {
-      if (appendMayHaveLanded) {
-        this.deps.setReadOnly(true)
-        throw error
-      }
-      const retained = this.referencedBlobDigestsIncludingTail()
-      for (const digest of persisted) {
-        if (!retained.has(digest)) {
-          await removeJournalBlob(this.deps.journalDir, digest)
-        }
-      }
-      throw error
-    }
-  }
-
-  private referencedBlobDigestsIncludingTail(): Set<string> {
-    const retained = new Set(this.deps.referencedBlobDigests())
-    for (const row of this.deps.tailRows()) {
-      if (row.kind === 'item') {
-        blobDigestsInBody(row.body, retained)
-      } else if (row.kind === 'lifecycle-batch') {
-        for (const mutation of row.mutations) {
-          if (mutation.kind === 'item') {
-            blobDigestsInBody(mutation.body, retained)
-          }
-        }
-      }
-    }
-    return retained
-  }
-}
-
-async function uniqueNewBlobs(
-  journalDir: string,
-  blobs: readonly JournalBlob[]
-): Promise<JournalBlob[]> {
-  const unique = new Map(blobs.map((blob) => [blob.digest, blob]))
-  const result: JournalBlob[] = []
-  for (const blob of unique.values()) {
-    if ((await journalBlobFileSize(journalDir, blob.digest)) === null) {
-      result.push(blob)
-    }
-  }
-  return result
 }
diff --git a/src/main/native-chat/agent-session-journal/journal-store-close.test.ts b/src/main/native-chat/agent-session-journal/journal-store-close.test.ts
new file mode 100644
index 00000000000..960c65a638a
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-store-close.test.ts
@@ -0,0 +1,259 @@
+// `close()`: enqueue-time admission, and the fulfilled/rejected split.
+//
+// The two failures this file exists to prevent: an append enqueued in the same
+// turn as `close()` being rejected AFTER the queue accepted it, and a rejected
+// close leaving a connection live but permanently unreachable through the API.
+
+import { access, mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import type {
+  AgentJournalItemBody,
+  AgentJournalItemIdentity,
+  AgentSessionJournalIdentity
+} from '../../../shared/agent-session-journal-types'
+import { journalDatabaseFile } from './journal-paths'
+import type { AgentSessionJournal } from './journal-store'
+import { createTrackedJournalOpener } from './journal-store-test-open'
+
+const IDENTITY: AgentSessionJournalIdentity = {
+  sessionId: 'session-1',
+  workspaceId: 'ws-1',
+  hostId: 'host-1',
+  agent: 'codex',
+  providerHandle: { kind: 'codex', threadId: 'thread-1' }
+}
+
+let root: string
+const journals = createTrackedJournalOpener()
+
+function item(ordinal: number): AgentJournalItemIdentity {
+  return { provider: 'codex', threadId: 'thread-1', turnId: 'turn-1', ordinal }
+}
+
+function body(value: string): AgentJournalItemBody {
+  return { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text: value }] }
+}
+
+function openJournal(): Promise<AgentSessionJournal> {
+  return journals.open({ identity: IDENTITY, journalDir: root })
+}
+
+/** Replaces the store's own release step, which is the only step that can
+ *  reject the attempt in production. */
+function injectReleaseFailure(journal: AgentSessionJournal): {
+  calls: () => number
+  stopFailing: () => void
+} {
+  const internals = journal as unknown as { database: { db: { close: () => void } } }
+  const release = internals.database.db.close.bind(internals.database.db)
+  let calls = 0
+  let failing = true
+  internals.database.db.close = () => {
+    calls += 1
+    if (failing) {
+      throw new Error('injected release failure')
+    }
+    release()
+  }
+  return { calls: () => calls, stopFailing: () => (failing = false) }
+}
+
+async function exists(path: string): Promise<boolean> {
+  return access(path)
+    .then(() => true)
+    .catch(() => false)
+}
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-journal-close-'))
+})
+
+afterEach(async () => {
+  await journals.closeAll()
+  await rm(root, { recursive: true, force: true })
+})
+
+describe('closed-state admission happens at enqueue', () => {
+  it('completes a write enqueued in the same turn as the close', async () => {
+    const journal = await openJournal()
+    const append = journal.appendItem(item(1), body('before'), { fence: 1 })
+    const closed = journal.close()
+
+    await expect(append).resolves.toBeDefined()
+    await expect(closed).resolves.toBeUndefined()
+    const reopened = await openJournal()
+    expect(reopened.snapshot().items).toHaveLength(1)
+  })
+
+  it('refuses a write offered while the close is still in flight, without queueing it', async () => {
+    const journal = await openJournal()
+    const closing = journal.close()
+    const refused = journal.appendItem(item(1), body('during'), { fence: 1 })
+
+    // The rejection is available before the close step has run: it never joined
+    // the queue, so nothing is ever chained behind a close.
+    await expect(refused).rejects.toMatchObject({ code: 'journal_closed' })
+    await expect(closing).resolves.toBeUndefined()
+  })
+
+  it('refuses every write entry point after the close has settled', async () => {
+    const journal = await openJournal()
+    await journal.close()
+    const settle = (attempt: Promise<unknown>): Promise<unknown> =>
+      attempt.then(
+        () => new Error('resolved instead of refusing'),
+        (error: unknown) => error
+      )
+    const refusals = [
+      settle(journal.appendItem(item(1), body('after'), { fence: 1 })),
+      settle(journal.appendTombstone(item(3), { fence: 1 })),
+      settle(
+        journal.appendSubmission({
+          clientMessageId: 'cm_1',
+          payloadFingerprint: 'f',
+          body: { kind: 'message', role: 'user', blocks: [] },
+          fence: 1
+        })
+      ),
+      settle(journal.resolveDispatch({ clientMessageId: 'cm_1', state: 'rejected', fence: 1 })),
+      settle(
+        journal.appendLifecycleBatch({
+          settlementId: 'settle',
+          fence: 1,
+          mutations: [{ kind: 'item', identity: item(4), body: body('x') }]
+        })
+      ),
+      settle(journal.rollEpoch('handle_forked', 1)),
+      settle(journal.replaceEpochItems('handle_forked', 1, []))
+    ]
+    for (const refusal of refusals) {
+      expect(await refusal).toMatchObject({ code: 'journal_closed' })
+    }
+  })
+
+  // The property part 1 rests on: every entry point reaches the gate in the
+  // caller's own turn, so a refusal never advances the queue.
+  it('rejects without waiting for the queue to advance', async () => {
+    const journal = await openJournal()
+    const inFlight = journal.appendItem(item(1), body('admitted'), { fence: 1 })
+    const closing = journal.close()
+
+    // Settles while the admitted append is still running: it reached the gate in
+    // the caller's own turn and never joined the queue behind it.
+    await expect(journal.appendItem(item(2), body('later'), { fence: 1 })).rejects.toMatchObject({
+      code: 'journal_closed'
+    })
+    await expect(inFlight).resolves.toBeDefined()
+    await expect(closing).resolves.toBeUndefined()
+  })
+
+  it('resolves a second close as a no-op without running the routine again', async () => {
+    const journal = await openJournal()
+    const injected = injectReleaseFailure(journal)
+    injected.stopFailing()
+    await journal.close()
+    expect(injected.calls()).toBe(1)
+
+    await expect(journal.close()).resolves.toBeUndefined()
+    expect(injected.calls()).toBe(1)
+  })
+})
+
+describe('a rejected close is a real retry', () => {
+  it('retries the release, releases the handle, and then goes terminal', async () => {
+    const journal = await openJournal()
+    await journal.appendItem(item(1), body('durable'), { fence: 1 })
+    const injected = injectReleaseFailure(journal)
+
+    await expect(journal.close()).rejects.toThrow('injected release failure')
+    expect(injected.calls()).toBe(1)
+
+    // Write-closed anyway: retry exists to release the OS handle, never to
+    // resurrect the store.
+    await expect(journal.appendItem(item(2), body('after'), { fence: 1 })).rejects.toMatchObject({
+      code: 'journal_closed'
+    })
+
+    injected.stopFailing()
+    await expect(journal.close()).resolves.toBeUndefined()
+    // The retry RE-ENTERED the release. A completion flag on it would skip the
+    // one step that had not succeeded, and the handle would never be released.
+    expect(injected.calls()).toBe(2)
+    const dbPath = journalDatabaseFile(root)
+    expect(await exists(`${dbPath}-wal`)).toBe(false)
+    expect(await exists(`${dbPath}-shm`)).toBe(false)
+
+    // Fulfilment is terminal: a third call must not issue a second db.close(),
+    // which `node:sqlite` answers with ERR_INVALID_STATE.
+    await expect(journal.close()).resolves.toBeUndefined()
+    expect(injected.calls()).toBe(2)
+  })
+
+  it('hands concurrent callers the same outcome', async () => {
+    const journal = await openJournal()
+    const injected = injectReleaseFailure(journal)
+    const first = journal.close()
+    const second = journal.close()
+    await expect(first).rejects.toThrow('injected release failure')
+    await expect(second).rejects.toThrow('injected release failure')
+    expect(injected.calls()).toBe(1)
+  })
+})
+
+// The two rejected readings of the contract, as models, because a green run on
+// the real store proves nothing about what the alternatives would have done.
+describe('negative controls', () => {
+  class UnconditionalNoOpClose {
+    calls = 0
+    private called = false
+    constructor(private readonly release: () => void) {}
+    async close(): Promise<void> {
+      if (this.called) {
+        return
+      }
+      this.called = true
+      this.calls += 1
+      this.release()
+    }
+  }
+
+  class AlwaysReentrantClose {
+    calls = 0
+    async close(release: () => void): Promise<void> {
+      this.calls += 1
+      release()
+    }
+  }
+
+  it('an unconditional second-call no-op leaves a failed close unreleasable', async () => {
+    let failing = true
+    let released = false
+    const model = new UnconditionalNoOpClose(() => {
+      if (failing) {
+        throw new Error('injected release failure')
+      }
+      released = true
+    })
+    await expect(model.close()).rejects.toThrow('injected release failure')
+    failing = false
+    await expect(model.close()).resolves.toBeUndefined()
+    // Fulfilled without the routine running: the handle is still held.
+    expect(model.calls).toBe(1)
+    expect(released).toBe(false)
+  })
+
+  it('an always-reentrant close issues the second db.close() that throws', async () => {
+    let open = true
+    const release = (): void => {
+      if (!open) {
+        throw new Error('ERR_INVALID_STATE: database is not open')
+      }
+      open = false
+    }
+    const model = new AlwaysReentrantClose()
+    await model.close(release)
+    await expect(model.close(release)).rejects.toThrow('database is not open')
+  })
+})
diff --git a/src/main/native-chat/agent-session-journal/journal-store-close.ts b/src/main/native-chat/agent-session-journal/journal-store-close.ts
new file mode 100644
index 00000000000..f1b56d6a0db
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-store-close.ts
@@ -0,0 +1,106 @@
+// Releasing the one SQLite connection a store holds for its lifetime.
+//
+// The contract, in five parts:
+//
+//  1. Closed-state admission happens at ENQUEUE, once, and is permanent. The
+//     flag lives on the store's write gate; it is never cleared, not by a
+//     rejection and not by a retry. A store that failed to close is still a
+//     store nobody may write to.
+//  2. The close step shares the write queue and BYPASSES that gate — a close
+//     that consulted the flag it had just set would refuse itself. Same queue
+//     orders the release behind admitted work; separate gate lets it run.
+//  3. One in-flight attempt, shared: concurrent callers get the same outcome.
+//  4. Fulfilled is TERMINAL; rejected is not. A later call after fulfilment is a
+//     genuine no-op — `DatabaseSync.close()` throws `ERR_INVALID_STATE` on a
+//     second call, so re-entering after success is the bug, not the fix.
+//  5. The release is deliberately unguarded. There is no way to ask whether a
+//     `db.close()` that threw released the handle first, and guarding the step
+//     would skip it on retry — guaranteeing a permanent leak in exactly the case
+//     where it did not release.
+
+import { AgentSessionJournalError } from './journal-write-guards'
+import type Database from '../../sqlite/sync-database'
+
+/**
+ * The write queue and its closed gate. Admission is checked at ENQUEUE and is
+ * permanent; the close step reaches the same queue through `serializePastGate`,
+ * because a close that consulted the flag it had just set would refuse itself.
+ */
+export class JournalWriteQueue {
+  private writes: Promise<unknown> = Promise.resolve()
+  private closed = false
+
+  constructor(private readonly sessionId: string) {}
+
+  markClosed(): void {
+    this.closed = true
+  }
+
+  serialize<T>(run: () => Promise<T>): Promise<T> {
+    if (this.closed) {
+      return Promise.reject(
+        new AgentSessionJournalError(
+          'journal_closed',
+          `agent-session journal for ${this.sessionId} is closed`
+        )
+      )
+    }
+    return this.serializePastGate(run)
+  }
+
+  serializePastGate<T>(run: () => Promise<T>): Promise<T> {
+    const started = this.writes.then(run)
+    this.writes = started.catch(() => undefined)
+    return started
+  }
+}
+
+export class JournalConnectionCloser {
+  private released = false
+  private inFlight: Promise<void> | null = null
+
+  constructor(
+    private readonly deps: {
+      connection: () => Database.Database | null
+      /** Chains onto the store's write queue past the closed gate. */
+      enqueue: (run: () => Promise<void>) => Promise<void>
+    }
+  ) {}
+
+  get isReleased(): boolean {
+    return this.released
+  }
+
+  close(): Promise<void> {
+    if (this.released) {
+      return Promise.resolve()
+    }
+    if (this.inFlight) {
+      return this.inFlight
+    }
+    const attempt = this.deps
+      .enqueue(() => this.release())
+      .then(
+        () => {
+          this.released = true
+          this.inFlight = null
+        },
+        (error: unknown) => {
+          this.inFlight = null
+          throw error
+        }
+      )
+    this.inFlight = attempt
+    return attempt
+  }
+
+  private async release(): Promise<void> {
+    const db = this.deps.connection()
+    if (!db) {
+      return
+    }
+    // SQLite checkpoints and removes the WAL itself when the last connection to
+    // the database closes.
+    db.close()
+  }
+}
diff --git a/src/main/native-chat/agent-session-journal/journal-store-collaborators.ts b/src/main/native-chat/agent-session-journal/journal-store-collaborators.ts
new file mode 100644
index 00000000000..a4ff455b31f
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-store-collaborators.ts
@@ -0,0 +1,88 @@
+// Wiring for the store's collaborators.
+//
+// Split out of the store itself so the class stays a description of the public
+// surface rather than sixty lines of constructor plumbing.
+
+import type {
+  AgentJournalCursor,
+  AgentSessionJournalIdentity
+} from '../../../shared/agent-session-journal-types'
+import type { OpenJournalDatabase } from './journal-database'
+import { JournalEpochController } from './journal-epoch-controller'
+import { JournalItemAppender } from './journal-item-appender'
+import { JournalLifecycleBatchAppender } from './journal-lifecycle-batch-appender'
+import type { JournalLoad } from './journal-open'
+import type { JournalReducerState } from './journal-reducer'
+import { JournalRowWriter } from './journal-row-writer'
+import { restoreJournalStore } from './journal-store-restore'
+import type { JournalRow } from './journal-row-schema'
+import type { AgentSessionJournal } from './journal-store'
+
+export type JournalStoreHost = {
+  identity: AgentSessionJournalIdentity
+  journalDir: string
+  now: () => number
+  mintEpoch: () => string
+  serialize: <T>(run: () => Promise<T>) => Promise<T>
+  database: () => OpenJournalDatabase
+  state: () => JournalReducerState
+  readOnly: () => boolean
+  setReadOnly: (readOnly: boolean) => void
+  cursor: () => AgentJournalCursor
+  adopt: (loaded: JournalLoad) => void
+  commit: (row: JournalRow) => void
+  /** A caller-supplied load, which suppresses replay entirely when present. */
+  loaded: () => JournalLoad | null | undefined
+  malformedRows: () => number
+  setMalformedRows: (count: number) => void
+  journal: () => AgentSessionJournal
+  enqueue: (build: (seq: number, ts: number) => JournalRow) => Promise<JournalRow>
+}
+
+export type JournalStoreCollaborators = {
+  rowWriter: JournalRowWriter
+  epochController: JournalEpochController
+  itemAppender: JournalItemAppender
+  lifecycleBatchAppender: JournalLifecycleBatchAppender
+  /** Restores the store's state from disk. Owned here because it needs the same
+   *  collaborators the constructor just built. */
+  restore: () => Promise<void>
+}
+
+export function createJournalStoreCollaborators(host: JournalStoreHost): JournalStoreCollaborators {
+  const epochController = new JournalEpochController({
+    identity: host.identity,
+    now: host.now,
+    mintEpoch: host.mintEpoch,
+    serialize: host.serialize,
+    database: host.database,
+    readOnly: host.readOnly,
+    setReadOnly: host.setReadOnly,
+    highestFence: () => host.state().highestFence,
+    cursor: host.cursor,
+    adopt: host.adopt
+  })
+  return {
+    epochController,
+    restore: () => restoreJournalStore(host, { epochController }),
+    rowWriter: new JournalRowWriter({
+      sessionId: host.identity.sessionId,
+      now: host.now,
+      serialize: host.serialize,
+      database: host.database,
+      readOnly: host.readOnly,
+      highestFence: () => host.state().highestFence,
+      nextSequence: () => host.state().lastSequence + 1,
+      commit: host.commit
+    }),
+    itemAppender: new JournalItemAppender({
+      state: host.state,
+      enqueue: host.enqueue
+    }),
+    lifecycleBatchAppender: new JournalLifecycleBatchAppender({
+      state: host.state,
+      cursor: host.cursor,
+      enqueue: host.enqueue
+    })
+  }
+}
diff --git a/src/main/native-chat/agent-session-journal/journal-store-contracts.ts b/src/main/native-chat/agent-session-journal/journal-store-contracts.ts
index 45a723a0f23..22e3a4c7cca 100644
--- a/src/main/native-chat/agent-session-journal/journal-store-contracts.ts
+++ b/src/main/native-chat/agent-session-journal/journal-store-contracts.ts
@@ -6,19 +6,13 @@ import type {
   AgentJournalResetReason,
   AgentSessionJournalIdentity
 } from '../../../shared/agent-session-journal-types'
-import type { JournalCompactionPolicy } from './journal-compaction'
 import type { JournalLoad } from './journal-open'
-import type { JournalPayloadLimits } from './journal-payload-bounds'
 import type { JournalLifecycleMutationInput } from './journal-row-builders'
 import type { JournalRow } from './journal-row-schema'
 
 export type AgentSessionJournalOptions = {
   identity: AgentSessionJournalIdentity
   journalDir: string
-  limits?: JournalPayloadLimits
-  compaction?: JournalCompactionPolicy
-  /** Compact as the tail grows. Defaults on: without it the log never sheds. */
-  autoCompact?: boolean
   now?: () => number
   mintEpoch?: () => string
   /** A caller that already loaded the journal can avoid reading the same files again. */
@@ -45,7 +39,6 @@ export type JournalAppendResult = {
 }
 
 export type JournalItemAppendOptions = { fence: number; observedAt?: number; recovered?: true }
-export type JournalBlobInput = { digest: string; payload: string }
 export type JournalTombstoneInput = { fence: number }
 
 export type JournalLifecycleBatchInput = {
diff --git a/src/main/native-chat/agent-session-journal/journal-store-open.ts b/src/main/native-chat/agent-session-journal/journal-store-open.ts
index 67d05c0b0c3..721e5f4ba7f 100644
--- a/src/main/native-chat/agent-session-journal/journal-store-open.ts
+++ b/src/main/native-chat/agent-session-journal/journal-store-open.ts
@@ -1,16 +1,23 @@
-import type { AgentJournalSnapshot } from '../../../shared/agent-session-journal-types'
-import { malformedRowsDisclosure, quarantineCorruptSuffix } from './journal-corruption-quarantine'
-import { ensureJournalDir } from './journal-log-file'
-import { loadJournal, type JournalLoad } from './journal-open'
-import { assertJournalPhysicalCapacity, journalDirectoryBytes } from './journal-physical-quota'
-import type { JournalRow } from './journal-row-schema'
+import { mkdir } from 'node:fs/promises'
+import type { AgentType } from '../../../shared/agent-status-types'
+import {
+  findJournalFileFormatRemnant,
+  journalFileFormatRemnantDisclosure
+} from './journal-file-format-remnant'
+import type { JournalLoad } from './journal-open'
+import { journalRepairDisclosure, type JournalRepairDisclosure } from './journal-repair-disclosure'
+
+/** What any of this file's disclosures hands the store — a repair's, or the
+ *  pre-SQLite notice's. Same shape, and neither is only a repair. */
+type JournalDisclosure = JournalRepairDisclosure
+
+export async function ensureJournalDir(journalDir: string): Promise<void> {
+  await mkdir(journalDir, { recursive: true })
+}
 
 export function journalStoreLoadedFields(loaded: JournalLoad) {
   return {
     state: loaded.state,
-    tailRows: loaded.tailRows,
-    compactedThrough: loaded.compactedThrough,
-    sizeBytes: loaded.sizeBytes,
     readOnly: loaded.readOnly,
     malformedRows: loaded.malformedRows
   }
@@ -18,60 +25,88 @@ export function journalStoreLoadedFields(loaded: JournalLoad) {
 
 export async function openJournalStoreState(input: {
   journalDir: string
-  sessionId: string
-  maxBytes: number
   loaded: JournalLoad | null | undefined
-  start: () => Promise<void>
+  replay: () => JournalLoad | null
+  /** Drops the rejected suffix and records the rebuild it owes, in ONE
+   *  transaction. Corruption is not preserved; replay keeps reporting `corrupt`
+   *  until provider history republishes the epoch or the session writes past
+   *  `contentFrom`, the first sequence the repair left free. */
+  deleteSuffix: (fromSeq: number, contentFrom: number) => number
+  start: () => void
   adopt: (loaded: JournalLoad) => void
-  tailRows: () => readonly JournalRow[]
-  snapshot: () => AgentJournalSnapshot
-  rebuildLifecycle: (snapshot: AgentJournalSnapshot, physicalBytes: number) => void
+  /** Republishes an anchor row for an epoch a repair emptied. */
+  publishRepairEpoch: () => void
   appendDisclosure: (
-    identity: ReturnType<typeof malformedRowsDisclosure>['identity'],
-    body: ReturnType<typeof malformedRowsDisclosure>['body'],
+    identity: JournalRepairDisclosure['identity'],
+    body: JournalRepairDisclosure['body'],
     fence: number
   ) => Promise<unknown>
+  agent: AgentType
   highestFence: () => number
   malformedRows: () => number
+  setMalformedRows: (count: number) => void
   readOnly: () => boolean
-  setPhysicalBytes: (bytes: number) => void
 }): Promise<void> {
-  await ensureJournalDir(input.journalDir)
-  input.setPhysicalBytes(
-    await assertJournalPhysicalCapacity({
-      journalDir: input.journalDir,
-      sessionId: input.sessionId,
-      maxBytes: input.maxBytes
-    })
-  )
-  const loaded =
-    input.loaded !== undefined
-      ? input.loaded
-      : await loadJournal(input.journalDir, input.sessionId, { maxBytes: input.maxBytes })
+  const loaded = input.loaded !== undefined ? input.loaded : input.replay()
   if (!loaded) {
-    await input.start()
-    input.setPhysicalBytes(await journalDirectoryBytes(input.journalDir))
+    input.start()
+    await discloseFileFormatRemnant(input)
     return
   }
   input.adopt(loaded)
-  if (loaded.corrupt && !loaded.readOnly) {
-    await quarantineCorruptSuffix(input.journalDir, input.tailRows(), loaded.quarantineRemainder, {
-      sessionId: input.sessionId,
-      maxBytes: input.maxBytes
-    })
+  if (loaded.truncateFrom !== undefined && !loaded.readOnly) {
+    input.deleteSuffix(loaded.truncateFrom, loaded.state.lastSequence + 1)
   }
-  let physicalBytes = await journalDirectoryBytes(input.journalDir)
-  input.setPhysicalBytes(physicalBytes)
-  // A future-schema/read-only journal is inspection-only. Its reduced state is
-  // intentionally empty, and rebuilding reservations from it would mutate the
-  // in-memory quota model (and could influence later admission decisions).
-  if (!loaded.readOnly) {
-    input.rebuildLifecycle(input.snapshot(), physicalBytes)
+  // A repair that took every live row leaves the epoch with no anchor. Publish
+  // one before anything can append into it: an ordinary row at sequence 1 would
+  // replay as a clean timeline and hide that the history was never rebuilt.
+  if (!loaded.readOnly && loaded.state.lastSequence === 0) {
+    input.publishRepairEpoch()
+    // The replacement epoch adopts a clean load; what this open's repair did is
+    // still the answer `repair` and the disclosure below owe the caller.
+    input.setMalformedRows(loaded.malformedRows)
   }
   if (input.malformedRows() > 0 && !input.readOnly()) {
-    const disclosure = malformedRowsDisclosure(input.malformedRows())
+    const disclosure = journalRepairDisclosure({ malformedRows: input.malformedRows() })
     await input.appendDisclosure(disclosure.identity, disclosure.body, input.highestFence())
   }
-  physicalBytes = await journalDirectoryBytes(input.journalDir)
-  input.setPhysicalBytes(physicalBytes)
+  // Founding the epoch and appending the row are two transactions, and a
+  // committed epoch sends every later open down this branch instead. Anything
+  // that interrupts between them — a quit during startup restore, a failed
+  // append — would otherwise lose the message for good. An epoch holding nothing
+  // is exactly the state that append was owed, so offer it again.
+  //
+  // Never onto a repair, though: `loaded.state` is the PRE-repair load, so a
+  // journal this open just emptied looks identical. The repair's epoch is the
+  // marker that its history was deleted and never rebuilt, and any row that is
+  // not the repair's own disclosure retires it — this row would silently stop
+  // the session ever asking the provider for that history again.
+  if (!loaded.corrupt && loaded.state.items.size === 0 && loaded.state.submissions.size === 0) {
+    await discloseFileFormatRemnant(input)
+  }
+}
+
+/** Says what happened to a chat whose history is in the abandoned file format.
+ *  Upserts by a constant identity, so the offer above is exactly-once in effect:
+ *  once the row exists the epoch is no longer empty. */
+async function discloseFileFormatRemnant(input: {
+  journalDir: string
+  agent: AgentType
+  appendDisclosure: (
+    identity: JournalDisclosure['identity'],
+    body: JournalDisclosure['body'],
+    fence: number
+  ) => Promise<unknown>
+  highestFence: () => number
+  readOnly: () => boolean
+}): Promise<void> {
+  if (input.readOnly()) {
+    return
+  }
+  const transcriptPath = findJournalFileFormatRemnant(input.journalDir)
+  if (!transcriptPath) {
+    return
+  }
+  const disclosure = journalFileFormatRemnantDisclosure({ transcriptPath, agent: input.agent })
+  await input.appendDisclosure(disclosure.identity, disclosure.body, input.highestFence())
 }
diff --git a/src/main/native-chat/agent-session-journal/journal-store-restore.ts b/src/main/native-chat/agent-session-journal/journal-store-restore.ts
new file mode 100644
index 00000000000..3a5d3c7ac6e
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-store-restore.ts
@@ -0,0 +1,50 @@
+// Bringing a store's in-memory state up from disk.
+//
+// Split out of the store for the same reason its collaborators were: this is the
+// ORDERING between replay, suffix repair and disclosure, and none of it belongs
+// to the store's public surface. Every step here reads or writes through the
+// same host the collaborators use, so the store keeps the state and this owns
+// the sequence.
+
+import type { JournalEpochController } from './journal-epoch-controller'
+import { replayJournal } from './journal-open'
+import type { JournalStoreHost } from './journal-store-collaborators'
+import { openJournalStoreState } from './journal-store-open'
+import { deleteJournalRepairedSuffix } from './journal-repair-marker'
+
+export function restoreJournalStore(
+  host: JournalStoreHost,
+  collaborators: { epochController: JournalEpochController }
+): Promise<void> {
+  return openJournalStoreState({
+    journalDir: host.journalDir,
+    loaded: host.loaded(),
+    replay: () => {
+      const opened = host.database()
+      return replayJournal(opened.db, opened.readOnly, host.identity.sessionId)
+    },
+    deleteSuffix: (fromSeq, contentFrom) =>
+      deleteJournalRepairedSuffix({
+        db: host.database().db,
+        sessionId: host.identity.sessionId,
+        epoch: host.state().epoch,
+        fromSeq,
+        contentFrom,
+        now: host.now()
+      }),
+    start: () => collaborators.epochController.start('session_created', 0),
+    // `unreconcilable_prefix` is the durable statement that this epoch exists
+    // because a repair emptied one: replay reads it back and keeps asking for
+    // provider history until the timeline is rebuilt or the session writes.
+    publishRepairEpoch: () =>
+      collaborators.epochController.start('unreconcilable_prefix', host.state().highestFence),
+    adopt: host.adopt,
+    appendDisclosure: (identity, body, fence) =>
+      host.journal().appendItem(identity, body, { fence }),
+    agent: host.identity.agent,
+    highestFence: () => host.state().highestFence,
+    malformedRows: host.malformedRows,
+    setMalformedRows: host.setMalformedRows,
+    readOnly: host.readOnly
+  })
+}
diff --git a/src/main/native-chat/agent-session-journal/journal-store-schema.test.ts b/src/main/native-chat/agent-session-journal/journal-store-schema.test.ts
index d78adeb30f5..df34ef73e73 100644
--- a/src/main/native-chat/agent-session-journal/journal-store-schema.test.ts
+++ b/src/main/native-chat/agent-session-journal/journal-store-schema.test.ts
@@ -1,4 +1,11 @@
-import { mkdtemp, readdir, readFile, rm, writeFile } from 'node:fs/promises'
+// Two independent version axes, both fail closed.
+//
+//   `PRAGMA user_version`  the DB SHAPE, known before the first read
+//   the row's `v` field    the row BODY shape, met during replay
+//
+// A newer build can change either alone, so both are needed.
+
+import { mkdtemp, rm, stat } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it } from 'vitest'
@@ -7,8 +14,12 @@ import type {
   AgentJournalItemIdentity,
   AgentSessionJournalIdentity
 } from '../../../shared/agent-session-journal-types'
-import { JOURNAL_LOG_FILE, JOURNAL_SNAPSHOT_FILE } from './journal-log-file'
-import { openAgentSessionJournal } from './journal-store-factory'
+import type Database from '../../sqlite/sync-database'
+import { openJournalDatabase } from './journal-database'
+import { JOURNAL_DB_SCHEMA_VERSION } from './journal-database-schema'
+import { journalDatabaseFile } from './journal-paths'
+import type { AgentSessionJournal } from './journal-store'
+import { createTrackedJournalOpener } from './journal-store-test-open'
 
 const IDENTITY: AgentSessionJournalIdentity = {
   sessionId: 'session-1',
@@ -20,6 +31,7 @@ const IDENTITY: AgentSessionJournalIdentity = {
 
 let root: string
 let clock = 1_000
+const journals = createTrackedJournalOpener()
 
 function tick(): number {
   clock += 1
@@ -34,87 +46,139 @@ function body(value: string): AgentJournalItemBody {
   return { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text: value }] }
 }
 
-async function open(overrides: Partial<Parameters<typeof openAgentSessionJournal>[0]> = {}) {
-  return openAgentSessionJournal({
+function open(): Promise<AgentSessionJournal> {
+  return journals.open({
     identity: IDENTITY,
     journalDir: root,
     now: tick,
-    mintEpoch: () => `epoch-${clock}`,
-    ...overrides
+    mintEpoch: () => `epoch-${clock}`
+  })
+}
+
+async function withDatabase(run: (db: Database.Database) => void): Promise<void> {
+  const opened = openJournalDatabase(journalDatabaseFile(root))
+  try {
+    run(opened.db)
+  } finally {
+    opened.db.close()
+  }
+}
+
+/** Appends a raw `row_json` the way a newer build or a bad write would leave it. */
+async function appendRawRow(epoch: string, seq: number, rowJson: string): Promise<void> {
+  await withDatabase((db) => {
+    db.prepare(
+      'INSERT INTO journal_rows (session_id, epoch, seq, ts, row_json) VALUES (?, ?, ?, ?, ?)'
+    ).run(IDENTITY.sessionId, epoch, seq, 1, rowJson)
   })
 }
 
 beforeEach(async () => {
-  root = await mkdtemp(join(tmpdir(), 'orca-journal-'))
+  root = await mkdtemp(join(tmpdir(), 'orca-journal-schema-'))
   clock = 1_000
 })
 
 afterEach(async () => {
+  await journals.closeAll()
   await rm(root, { recursive: true, force: true })
 })
 
-describe('schema', () => {
-  it('quarantines an invalid compacted snapshot without replacing its tail', async () => {
-    const journal = await open({ compaction: { minTailRows: 2, retainTailMs: 0 } })
-    for (let index = 0; index < 6; index += 1) {
-      await journal.appendItem(item(index), body(`m${index}`), { fence: 1 })
-    }
-    await journal.compact()
-    const epoch = journal.epoch
-    const snapshotPath = join(root, JOURNAL_SNAPSHOT_FILE)
-    const logPath = join(root, JOURNAL_LOG_FILE)
-    const invalidSnapshot = '{"folded history":'
-    await writeFile(snapshotPath, invalidSnapshot, 'utf-8')
-    const retainedTail = await readFile(logPath, 'utf-8')
-    expect(retainedTail).not.toContain('"kind":"epoch"')
-
-    const reopened = await open()
-    expect(reopened.epoch).toBe(epoch)
-    expect(await readFile(logPath, 'utf-8')).toBe(retainedTail)
-    const quarantined = (await readdir(root)).find((name) =>
-      name.startsWith('quarantine-snapshot-')
-    )
-    expect(quarantined).toBeDefined()
-    expect(await readFile(join(root, quarantined!), 'utf-8')).toBe(invalidSnapshot)
-  })
-
-  it('degrades to read-only on a row from a newer build, without skipping or deleting it', async () => {
+describe('axis 1: the database shape', () => {
+  it('latches read-only on a newer user_version and writes nothing', async () => {
     const journal = await open()
     await journal.appendItem(item(0), body('a'), { fence: 1 })
-    const logPath = join(root, JOURNAL_LOG_FILE)
-    const future = JSON.stringify({
-      v: 99,
-      kind: 'item',
-      epoch: journal.epoch,
-      seq: 99,
-      fence: 1,
-      ts: 1,
-      itemId: 'future',
-      revision: 1,
-      body: { kind: 'status', text: 'from a newer host' }
-    })
-    const before = await readFile(logPath, 'utf-8')
-    await writeFile(logPath, `${before}${future}\n`, 'utf-8')
+    await journal.close()
+    await withDatabase((db) => db.pragma(`user_version = ${JOURNAL_DB_SCHEMA_VERSION + 1}`))
+    const before = await stat(journalDatabaseFile(root))
 
     const reopened = await open()
     expect(reopened.isReadOnly).toBe(true)
     await expect(reopened.appendItem(item(1), body('b'), { fence: 1 })).rejects.toMatchObject({
       code: 'journal_read_only'
     })
-    await expect(reopened.compact()).rejects.toMatchObject({ code: 'journal_read_only' })
-    expect(reopened.readSince({ epoch: reopened.epoch, sequence: 0 })).toEqual({
-      ok: false,
-      reset: 'schema_unreadable'
+    // The file this build must not touch is byte-identical afterwards.
+    await reopened.close()
+    expect((await stat(journalDatabaseFile(root))).size).toBe(before.size)
+    await withDatabase((db) => {
+      expect(db.pragma('user_version', { simple: true })).toBe(JOURNAL_DB_SCHEMA_VERSION + 1)
     })
-    // The unreadable row is still on disk, and nothing was compacted past it.
-    expect(await readFile(logPath, 'utf-8')).toContain('"v":99')
   })
 
-  it('skips a malformed line without giving up the journal, and discloses the skip', async () => {
+  it('refuses the schema escape hatch on a latched store', async () => {
+    const journal = await open()
+    await journal.close()
+    await withDatabase((db) => db.pragma(`user_version = ${JOURNAL_DB_SCHEMA_VERSION + 1}`))
+
+    const reopened = await open()
+    // With byte-copy quarantine gone there is nothing for `schema_unreadable` to
+    // do differently, so it takes the same writable guard as every other reason.
+    await expect(reopened.rollEpoch('schema_unreadable', 2)).rejects.toMatchObject({
+      code: 'journal_read_only'
+    })
+    expect(reopened.isReadOnly).toBe(true)
+  })
+
+  it('migrates an older user_version forward on reopen', async () => {
     const journal = await open()
     await journal.appendItem(item(0), body('a'), { fence: 1 })
-    const logPath = join(root, JOURNAL_LOG_FILE)
-    await writeFile(logPath, `${await readFile(logPath, 'utf-8')}{not json\n`, 'utf-8')
+    await journal.close()
+    await withDatabase((db) => db.pragma('user_version = 0'))
+
+    const reopened = await open()
+    expect(reopened.isReadOnly).toBe(false)
+    expect(reopened.snapshot().items).toHaveLength(1)
+    await reopened.close()
+    await withDatabase((db) => {
+      expect(db.pragma('user_version', { simple: true })).toBe(JOURNAL_DB_SCHEMA_VERSION)
+    })
+  })
+})
+
+describe('axis 2: the row body shape', () => {
+  it('degrades to read-only on a row from a newer build, without skipping it', async () => {
+    const journal = await open()
+    await journal.appendItem(item(0), body('a'), { fence: 1 })
+    const epoch = journal.epoch
+    const nextSeq = journal.cursor().sequence + 1
+    await journal.close()
+    await appendRawRow(
+      epoch,
+      nextSeq,
+      JSON.stringify({
+        v: 99,
+        kind: 'item',
+        epoch,
+        seq: nextSeq,
+        fence: 1,
+        ts: 1,
+        itemId: 'future',
+        revision: 1,
+        body: { kind: 'status', text: 'from a newer build' }
+      })
+    )
+
+    const reopened = await open()
+    expect(reopened.isReadOnly).toBe(true)
+    await expect(reopened.appendItem(item(1), body('b'), { fence: 1 })).rejects.toMatchObject({
+      code: 'journal_read_only'
+    })
+    await reopened.close()
+    // Never skipped, never deleted: the row this build cannot read is still there.
+    await withDatabase((db) => {
+      const stored = db.prepare('SELECT row_json FROM journal_rows WHERE seq = ?').get(nextSeq) as {
+        row_json: string
+      }
+      expect(stored.row_json).toContain('"v":99')
+    })
+  })
+
+  it('skips a malformed row without giving up the journal, and discloses the skip', async () => {
+    const journal = await open()
+    await journal.appendItem(item(0), body('a'), { fence: 1 })
+    const epoch = journal.epoch
+    const nextSeq = journal.cursor().sequence + 1
+    await journal.close()
+    await appendRawRow(epoch, nextSeq, '{not json')
 
     const reopened = await open()
     expect(reopened.isReadOnly).toBe(false)
@@ -132,10 +196,12 @@ describe('schema', () => {
   it('keeps one disclosure row across reopens instead of stacking duplicates', async () => {
     const journal = await open()
     await journal.appendItem(item(0), body('a'), { fence: 1 })
-    const logPath = join(root, JOURNAL_LOG_FILE)
-    await writeFile(logPath, `${await readFile(logPath, 'utf-8')}{not json\n`, 'utf-8')
+    const epoch = journal.epoch
+    const nextSeq = journal.cursor().sequence + 1
+    await journal.close()
+    await appendRawRow(epoch, nextSeq, '{not json')
 
-    await open()
+    await open().then((first) => first.close())
     const reopened = await open()
     expect(
       reopened
@@ -146,168 +212,32 @@ describe('schema', () => {
     ).toHaveLength(1)
   })
 
-  it('repairs a torn tail before acknowledging the next append', async () => {
+  it('reopens a journal holding an admitted malformed-percent item id without throwing', async () => {
     const journal = await open()
     await journal.appendItem(item(0), body('a'), { fence: 1 })
-    const logPath = join(root, JOURNAL_LOG_FILE)
-    const intact = await readFile(logPath, 'utf-8')
-    await writeFile(logPath, intact.slice(0, -1), 'utf-8')
-
-    await journal.appendItem(item(1), body('b'), { fence: 1 })
-    const reopened = await open()
-    expect(reopened.snapshot().items.map((entry) => entry.body)).toEqual([body('a'), body('b')])
-  })
-
-  // Transcripts are full of emoji and CJK, so the repair's file offsets must be
-  // bytes: string indices would truncate mid-character and corrupt the prefix.
-  it('repairs a torn tail whose rows contain multi-byte characters', async () => {
-    const journal = await open()
-    await journal.appendItem(item(0), body('안녕하세요 🌊 café'), { fence: 1 })
-    const logPath = join(root, JOURNAL_LOG_FILE)
-    const intact = await readFile(logPath)
-    // Kill mid-row: keep the complete first row plus a fragment of the second.
-    const torn = Buffer.concat([intact, Buffer.from('{"seq":2,"kind":"it', 'utf-8')])
-    await writeFile(logPath, torn)
-
-    await journal.appendItem(item(1), body('b'), { fence: 1 })
-    const reopened = await open()
-    expect(reopened.snapshot().items.map((entry) => entry.body)).toEqual([
-      body('안녕하세요 🌊 café'),
-      body('b')
-    ])
-  })
-
-  it('degrades to read-only when the snapshot comes from a newer schema', async () => {
-    const journal = await open()
-    await journal.appendItem(item(0), body('a'), { fence: 1 })
-    const snapshotPath = join(root, JOURNAL_SNAPSHOT_FILE)
-    const snapshot = JSON.parse(await readFile(snapshotPath, 'utf-8')) as Record<string, unknown>
-    snapshot.v = 99
-    await writeFile(snapshotPath, JSON.stringify(snapshot), 'utf-8')
-
-    const reopened = await open()
-    expect(reopened.isReadOnly).toBe(true)
-    await expect(reopened.appendItem(item(1), body('b'), { fence: 1 })).rejects.toMatchObject({
-      code: 'journal_read_only'
-    })
-  })
-
-  it('preserves a future-version snapshot with an unknown body kind in place instead of quarantining it', async () => {
-    const journal = await open()
-    await journal.appendItem(item(0), body('a'), { fence: 1 })
-    const snapshotPath = join(root, JOURNAL_SNAPSHOT_FILE)
-    const snapshot = JSON.parse(await readFile(snapshotPath, 'utf-8')) as Record<string, unknown>
-    snapshot.v = 99
-    // The version advances because bodies changed: a valid newer snapshot
-    // carries kinds this build cannot parse and must stay unreadable in place.
-    snapshot.items = [
-      {
-        itemId: 'codex:thread-1:turn-1:1',
-        revision: 1,
-        body: { kind: 'future-render-kind', payload: { anything: true } },
-        sequence: 1,
-        observedAt: 1_000
-      }
-    ]
-    await writeFile(snapshotPath, JSON.stringify(snapshot), 'utf-8')
-
-    const reopened = await open()
-    const entries = await readdir(root)
-    expect(entries.some((name) => name.startsWith('quarantine-'))).toBe(false)
-    expect(entries.includes(JOURNAL_SNAPSHOT_FILE)).toBe(true)
-    expect(reopened.isReadOnly).toBe(true)
-    expect(reopened.snapshot().items).toHaveLength(0)
-    await expect(reopened.appendItem(item(1), body('b'), { fence: 1 })).rejects.toMatchObject({
-      code: 'journal_read_only'
-    })
-  })
-
-  it('keeps the future-version snapshot bytes when the schema escape hatch rolls the epoch', async () => {
-    const journal = await open()
-    await journal.appendItem(item(0), body('a'), { fence: 1 })
-    const snapshotPath = join(root, JOURNAL_SNAPSHOT_FILE)
-    const snapshot = JSON.parse(await readFile(snapshotPath, 'utf-8')) as Record<string, unknown>
-    snapshot.v = 99
-    snapshot.items = [
-      {
-        itemId: 'codex:thread-1:turn-1:1',
-        revision: 1,
-        body: { kind: 'future-render-kind', payload: { anything: true } },
-        sequence: 1,
-        observedAt: 1_000
-      }
-    ]
-    await writeFile(snapshotPath, JSON.stringify(snapshot), 'utf-8')
-    const reopened = await open()
-    // Still live in place before the explicit escape hatch runs.
-    expect((await readdir(root)).some((name) => name.startsWith('quarantine-'))).toBe(false)
-
-    await reopened.rollEpoch('schema_unreadable', 2)
-    expect(reopened.isReadOnly).toBe(false)
-    const quarantine = (await readdir(root)).find((name) => name.startsWith('quarantine-'))
-    expect(quarantine).toBeDefined()
-    expect(await readFile(join(root, quarantine!), 'utf-8')).toContain('future-render-kind')
-  })
-
-  it('reopens a log holding an admitted malformed-percent item id without throwing', async () => {
-    const journal = await open()
-    await journal.appendItem(item(0), body('a'), { fence: 1 })
-    const logPath = join(root, JOURNAL_LOG_FILE)
+    const epoch = journal.epoch
+    const nextSeq = journal.cursor().sequence + 1
+    await journal.close()
     // `parseJournalRow` admits any string itemId, so replay must degrade a
     // malformed percent key to an opaque id instead of throwing URIError.
-    const malformedKeyRow = JSON.stringify({
-      v: 1,
-      epoch: journal.epoch,
-      seq: journal.cursor().sequence + 1,
-      fence: 1,
-      ts: 1,
-      kind: 'item',
-      itemId: '%',
-      revision: 1,
-      body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'hi' }] }
-    })
-    await writeFile(logPath, `${await readFile(logPath, 'utf-8')}${malformedKeyRow}\n`, 'utf-8')
+    await appendRawRow(
+      epoch,
+      nextSeq,
+      JSON.stringify({
+        v: 1,
+        epoch,
+        seq: nextSeq,
+        fence: 1,
+        ts: 1,
+        kind: 'item',
+        itemId: '%',
+        revision: 1,
+        body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'hi' }] }
+      })
+    )
 
     const reopened = await open()
     expect(reopened.isReadOnly).toBe(false)
     expect(reopened.snapshot().items.some((entry) => entry.itemId === '%')).toBe(true)
   })
-
-  it('allows the explicit schema-unreadable epoch escape hatch while preserving the old files', async () => {
-    const journal = await open()
-    await journal.appendItem(item(0), body('a'), { fence: 1 })
-    const snapshotPath = join(root, JOURNAL_SNAPSHOT_FILE)
-    const snapshot = JSON.parse(await readFile(snapshotPath, 'utf-8')) as Record<string, unknown>
-    snapshot.v = 99
-    await writeFile(snapshotPath, JSON.stringify(snapshot), 'utf-8')
-    const reopened = await open()
-
-    await reopened.rollEpoch('schema_unreadable', 2)
-    expect(reopened.isReadOnly).toBe(false)
-    expect(reopened.snapshot().items).toHaveLength(0)
-    expect((await readdir(root)).some((name) => name.startsWith('quarantine-'))).toBe(true)
-  })
-
-  it('keeps the unreadable log suffix in the schema escape quarantine', async () => {
-    const journal = await open()
-    const logPath = join(root, JOURNAL_LOG_FILE)
-    const future = JSON.stringify({
-      v: 99,
-      kind: 'item',
-      epoch: journal.epoch,
-      seq: 2,
-      fence: 1,
-      ts: 1,
-      itemId: 'future',
-      revision: 1,
-      body: { kind: 'status', text: 'preserve these bytes' }
-    })
-    await writeFile(logPath, `${await readFile(logPath, 'utf-8')}${future}\n`, 'utf-8')
-    const reopened = await open()
-
-    await reopened.rollEpoch('schema_unreadable', 2)
-    const quarantine = (await readdir(root)).find((name) => name.startsWith('quarantine-'))
-    expect(quarantine).toBeDefined()
-    expect(await readFile(join(root, quarantine!), 'utf-8')).toContain('preserve these bytes')
-  })
 })
diff --git a/src/main/native-chat/agent-session-journal/journal-store-test-open.ts b/src/main/native-chat/agent-session-journal/journal-store-test-open.ts
new file mode 100644
index 00000000000..fc8bce5af39
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-store-test-open.ts
@@ -0,0 +1,34 @@
+// Shared tracked-open helper for journal tests.
+//
+// Tracking every opened INSTANCE rather than a variable is the point: `close()`
+// is idempotent, a module-level `journal` binding can be reassigned to a second
+// store mid-suite, and `allSettled` means one failing close cannot skip the rest
+// or the directory removal behind it.
+
+import type { AgentSessionJournal } from './journal-store'
+import type { AgentSessionJournalOptions } from './journal-store-contracts'
+import { openAgentSessionJournal } from './journal-store-factory'
+
+export type TrackedJournalOpener = {
+  open: (options: AgentSessionJournalOptions) => Promise<AgentSessionJournal>
+  track: <T extends AgentSessionJournal>(journal: T) => T
+  closeAll: () => Promise<void>
+}
+
+export function createTrackedJournalOpener(): TrackedJournalOpener {
+  const opened: AgentSessionJournal[] = []
+  return {
+    open: async (options) => {
+      const journal = await openAgentSessionJournal(options)
+      opened.push(journal)
+      return journal
+    },
+    track: (journal) => {
+      opened.push(journal)
+      return journal
+    },
+    closeAll: async () => {
+      await Promise.allSettled(opened.splice(0).map((journal) => journal.close()))
+    }
+  }
+}
diff --git a/src/main/native-chat/agent-session-journal/journal-store.test.ts b/src/main/native-chat/agent-session-journal/journal-store.test.ts
index 9ff37774d27..97eac02fe75 100644
--- a/src/main/native-chat/agent-session-journal/journal-store.test.ts
+++ b/src/main/native-chat/agent-session-journal/journal-store.test.ts
@@ -1,4 +1,4 @@
-import { mkdtemp, readdir, readFile, rm, writeFile } from 'node:fs/promises'
+import { mkdtemp, readdir, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it } from 'vitest'
@@ -11,24 +11,17 @@ import {
   boundJournalKeyComponent,
   MAX_JOURNAL_KEY_COMPONENT_CHARS
 } from '../../../shared/agent-session-journal-item-key'
-import { readJournalBlob } from './journal-blob-store'
-import { JOURNAL_LOG_FILE, JOURNAL_SNAPSHOT_FILE } from './journal-log-file'
 import { loadJournal } from './journal-open'
 import {
   boundInlineText,
   boundPayload,
   DEFAULT_JOURNAL_PAYLOAD_LIMITS
 } from './journal-payload-bounds'
-import { journalDirectoryFor, journalPathSegment } from './journal-paths'
-import { journalDirectoryBytes } from './journal-physical-quota'
-import type { JournalLifecycleMutationInput } from './journal-row-builders'
+import { journalDatabaseFile, journalDirectoryFor, journalPathSegment } from './journal-paths'
 import { AgentSessionJournalError, type AgentSessionJournal } from './journal-store'
-import { openAgentSessionJournal } from './journal-store-factory'
-import {
-  JOURNAL_DISPATCH_RESERVATION_BYTES,
-  JOURNAL_ITEM_TERMINAL_RESERVATION_BYTES,
-  JOURNAL_TURN_TERMINAL_RESERVATION_BYTES
-} from './journal-lifecycle-capacity'
+import type { openAgentSessionJournal } from './journal-store-factory'
+import { createTrackedJournalOpener } from './journal-store-test-open'
+import type Database from '../../sqlite/sync-database'
 
 const IDENTITY: AgentSessionJournalIdentity = {
   sessionId: 'session-1',
@@ -54,8 +47,10 @@ function body(value: string): AgentJournalItemBody {
   return { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text: value }] }
 }
 
+const journals = createTrackedJournalOpener()
+
 async function open(overrides: Partial<Parameters<typeof openAgentSessionJournal>[0]> = {}) {
-  return openAgentSessionJournal({
+  return journals.open({
     identity: IDENTITY,
     journalDir: root,
     now: tick,
@@ -70,6 +65,7 @@ beforeEach(async () => {
 })
 
 afterEach(async () => {
+  await journals.closeAll()
   await rm(root, { recursive: true, force: true })
 })
 
@@ -151,14 +147,12 @@ describe('fences', () => {
 })
 
 describe('replay', () => {
-  it('adopts a caller-provided load without reading the journal files again', async () => {
+  it('adopts a caller-provided load without replaying the rows again', async () => {
     const journal = await open()
     await journal.appendItem(item(0), body('a'), { fence: 1 })
     const loaded = await loadJournal(root, IDENTITY.sessionId)
     expect(loaded).not.toBeNull()
-
-    await rm(join(root, JOURNAL_LOG_FILE), { force: true })
-    await rm(join(root, JOURNAL_SNAPSHOT_FILE), { force: true })
+    await journal.close()
 
     const reopened = await open({ loaded })
     expect(reopened.snapshot()).toEqual(journal.snapshot())
@@ -200,208 +194,27 @@ describe('replay', () => {
     expect(reopened.snapshot().items).toHaveLength(0)
   })
 
-  it('preserves the intact prefix and quarantines a corrupt suffix', async () => {
+  it('keeps the intact prefix and drops the rejected suffix', async () => {
     const journal = await open()
     for (let index = 0; index < 4; index += 1) {
       await journal.appendItem(item(index), body(`m${index}`), { fence: 1 })
     }
     const before = journal.epoch
-    const logPath = join(root, JOURNAL_LOG_FILE)
-    const lines = (await readFile(logPath, 'utf-8')).split('\n').filter(Boolean)
-    await writeFile(logPath, `${[...lines.slice(0, 2), ...lines.slice(3)].join('\n')}\n`, 'utf-8')
+    await journal.close()
+    await withJournalDatabase(root, (db) => {
+      db.prepare('DELETE FROM journal_rows WHERE seq = ?').run(3)
+    })
 
     const reopened = await open()
     expect(reopened.epoch).toBe(before)
     expect(reopened.snapshot().items.map((entry) => entry.body)).toEqual([body('m0')])
-    const files = await readdir(root)
-    expect(files.some((name) => name.startsWith('quarantine-'))).toBe(true)
-  })
-})
-
-describe('automatic compaction', () => {
-  // Production passes no policy and never called compact(), so the log only
-  // ever grew — until the size bound refused every append for good.
-  it('compacts on append once the retention window has rows to shed', async () => {
-    const policy = { minTailRows: 2, retainTailMs: 0 }
-    const journal = await open({ compaction: policy })
-    for (let index = 0; index < 6; index += 1) {
-      await journal.appendItem(item(index), body(`m${index}`), { fence: 1 })
-    }
-    expect(journal.compactionBoundary).toBeGreaterThan(0)
-    // The log sheds instead of growing with every append (7 = epoch row + 6).
-    const log = await readFile(join(root, JOURNAL_LOG_FILE), 'utf-8')
-    expect(log.trim().split('\n').length).toBeLessThan(7)
-    // Nothing is lost: the folded prefix is served from the snapshot.
-    expect(journal.snapshot().items).toHaveLength(6)
-  })
-
-  it('does not rewrite the log while every row is inside the retention window', async () => {
-    const journal = await open({ compaction: { minTailRows: 2, retainTailMs: 60_000 } })
-    for (let index = 0; index < 6; index += 1) {
-      await journal.appendItem(item(index), body(`m${index}`), { fence: 1 })
-    }
-    expect(journal.compactionBoundary).toBe(0)
-  })
-
-  it('can be turned off explicitly', async () => {
-    const journal = await open({
-      autoCompact: false,
-      compaction: { minTailRows: 2, retainTailMs: 0 }
+    // Sequences 4 and 5 are VALID rows that the gap at 3 made unreplayable.
+    // Nothing preserves them; recovery rebuilds the epoch from provider history.
+    await withJournalDatabase(root, (db) => {
+      const rows = db.prepare('SELECT seq FROM journal_rows ORDER BY seq').all()
+      expect(rows.map((row) => (row as { seq: number }).seq)).toEqual([1, 2])
     })
-    for (let index = 0; index < 6; index += 1) {
-      await journal.appendItem(item(index), body(`m${index}`), { fence: 1 })
-    }
-    expect(journal.compactionBoundary).toBe(0)
-  })
-
-  it('refuses an append when a tail shorter than the row floor cannot make room', async () => {
-    const journal = await open({
-      limits: { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, maxSessionBytes: 900 },
-      // The tail never reaches the floor, so honouring it would shed nothing.
-      compaction: { minTailRows: 512, retainTailMs: 10_000 }
-    })
-    let rejected = 0
-    for (let index = 0; index < 20; index += 1) {
-      try {
-        await journal.appendItem(item(index), body('x'.repeat(96)), { fence: 1 })
-      } catch (error) {
-        expect(error).toMatchObject({ code: 'journal_bound_exceeded' })
-        rejected += 1
-      }
-    }
-    expect(rejected).toBeGreaterThan(0)
-  })
-
-  it('refuses once the retained snapshot itself reaches the session bound', async () => {
-    const journal = await open({
-      limits: { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, maxSessionBytes: 10_000 },
-      compaction: { minTailRows: 10, retainTailMs: 2 * 60 * 60 * 1000 }
-    })
-    let rejected = 0
-    for (let index = 0; index < 30; index += 1) {
-      try {
-        await journal.appendItem(item(index), body('x'.repeat(128)), { fence: 1 })
-      } catch (error) {
-        expect(error).toMatchObject({ code: 'journal_bound_exceeded' })
-        rejected += 1
-      }
-    }
-
-    expect(rejected).toBeGreaterThan(0)
-    expect(journal.snapshot().items.length).toBeLessThan(30)
-  })
-
-  it('keeps the newest rows resumable while shedding under budget pressure', async () => {
-    const journal = await open({
-      limits: { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, maxSessionBytes: 10_000 },
-      compaction: { minTailRows: 10, retainTailMs: 2 * 60 * 60 * 1000 }
-    })
-    for (let index = 0; index < 30; index += 1) {
-      await journal.appendItem(item(index), body('x'.repeat(64)), { fence: 1 })
-    }
-
-    // The window yields oldest-first, never wholesale: the latest append is
-    // still in the log, so a client resuming from it does not reload.
-    const log = (await readFile(join(root, JOURNAL_LOG_FILE), 'utf-8')).trim().split('\n')
-    expect(log.length).toBeGreaterThan(0)
-    expect(log.at(-1)).toContain('"seq"')
-  })
-})
-
-describe('compaction and retention', () => {
-  it('preserves the highest fence across compaction and reopen', async () => {
-    const journal = await open({ compaction: { minTailRows: 1, retainTailMs: 0 } })
-    await journal.appendItem(item(0), body('a'), { fence: 7 })
-    await journal.compact()
-    const reopened = await open({ compaction: { minTailRows: 1, retainTailMs: 0 } })
-    await expect(reopened.appendItem(item(1), body('stale'), { fence: 6 })).rejects.toMatchObject({
-      code: 'journal_stale_fence'
-    })
-  })
-
-  it('preserves tombstones across compaction and reopen', async () => {
-    const journal = await open({ compaction: { minTailRows: 1, retainTailMs: 0 } })
-    await journal.appendItem(item(0), body('a'), { fence: 1 })
-    await journal.appendTombstone(item(0), { fence: 1 })
-    await journal.compact()
-    const reopened = await open({ compaction: { minTailRows: 1, retainTailMs: 0 } })
-    await reopened.appendItem(item(0), body('stale'), { fence: 1 })
-    expect(reopened.snapshot().items).toHaveLength(0)
-  })
-
-  it('folds the prefix into the snapshot and keeps serving the retained tail', async () => {
-    const journal = await open({ compaction: { minTailRows: 2, retainTailMs: 0 } })
-    for (let index = 0; index < 6; index += 1) {
-      await journal.appendItem(item(index), body(`m${index}`), { fence: 1 })
-    }
-    const rendered = journal.snapshot()
-    const tip = journal.cursor()
-    await journal.compact()
-
-    expect(journal.snapshot()).toEqual(rendered)
-    expect(journal.readSince({ epoch: tip.epoch, sequence: 1 })).toEqual({
-      ok: false,
-      reset: 'cursor_compacted'
-    })
-    const nearTip = journal.readSince({ epoch: tip.epoch, sequence: tip.sequence - 1 })
-    expect(nearTip.ok && nearTip.rows).toHaveLength(1)
-
-    const reopened = await open({ compaction: { minTailRows: 2, retainTailMs: 0 } })
-    expect(reopened.snapshot()).toEqual(rendered)
-    expect(reopened.compactionBoundary).toBe(tip.sequence)
-  })
-
-  it('publishes the snapshot and its tail as one write, so a crash before the log rewrite loses nothing', async () => {
-    const journal = await open({ compaction: { minTailRows: 2, retainTailMs: 0 } })
-    for (let index = 0; index < 5; index += 1) {
-      await journal.appendItem(item(index), body(`m${index}`), { fence: 1 })
-    }
-    const rendered = journal.snapshot()
-    const logBefore = await readFile(join(root, JOURNAL_LOG_FILE), 'utf-8')
-    await journal.compact()
-    const persistedSnapshot = JSON.parse(
-      await readFile(join(root, JOURNAL_SNAPSHOT_FILE), 'utf-8')
-    ) as { tail: unknown[] }
-    expect(persistedSnapshot.tail).toHaveLength(2)
-    // Simulate the crash: the snapshot landed, the truncation did not.
-    await writeFile(join(root, JOURNAL_LOG_FILE), logBefore, 'utf-8')
-
-    const reopened = await open()
-    expect(reopened.snapshot()).toEqual(rendered)
-    expect(reopened.snapshot().items).toHaveLength(5)
-  })
-
-  it('prunes blobs no live row references and keeps the ones that survive', async () => {
-    const journal = await open({ compaction: { minTailRows: 1, retainTailMs: 0 } })
-    const kept = boundPayload('k'.repeat(64), {
-      ...DEFAULT_JOURNAL_PAYLOAD_LIMITS,
-      inlineHeadBytes: 8
-    })
-    const dropped = boundPayload('d'.repeat(64), {
-      ...DEFAULT_JOURNAL_PAYLOAD_LIMITS,
-      inlineHeadBytes: 8
-    })
-    const { putJournalBlob } = await import('./journal-blob-store')
-    await putJournalBlob(root, kept.digest, 'k'.repeat(64))
-    await putJournalBlob(root, dropped.digest, 'd'.repeat(64))
-    await journal.appendItem(
-      item(0),
-      { kind: 'tool-call', name: 'bash', input: {}, state: 'completed', output: kept },
-      { fence: 1 }
-    )
-    await journal.compact()
-
-    expect(await readJournalBlob(root, kept.digest)).toBe('k'.repeat(64))
-    expect(await readJournalBlob(root, dropped.digest)).toBeNull()
-  })
-
-  it('refuses a blob name that is not a bare digest, on either slash', async () => {
-    const { putJournalBlob } = await import('./journal-blob-store')
-    // A corrupt or crafted row must not steer a read or a write out of the store.
-    for (const name of ['../../escape', '..\\..\\escape', 'nested/name', 'NOTHEX']) {
-      expect(await readJournalBlob(root, name)).toBeNull()
-      await expect(putJournalBlob(root, name, 'payload')).rejects.toThrow('sha256 digest')
-    }
+    expect(reopened.repair).toEqual({ malformedRows: 0 })
   })
 })
 
@@ -429,244 +242,9 @@ describe('bounds', () => {
     expect(bounded.head).toBe('small')
     expect(boundInlineText('small', DEFAULT_JOURNAL_PAYLOAD_LIMITS).text).toBe('small')
   })
-
-  it('refuses a single row larger than the per-session size bound', async () => {
-    const journal = await open({
-      limits: { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, maxSessionBytes: 2_000 }
-    })
-    // Shedding the whole tail still cannot make room, so the bound holds.
-    await expect(
-      journal.appendItem(item(0), body('x'.repeat(4_096)), { fence: 1 })
-    ).rejects.toMatchObject({ code: 'journal_bound_exceeded' })
-  })
-
-  it('refuses an append past the per-session size bound when compaction is off', async () => {
-    const journal = await open({
-      autoCompact: false,
-      limits: { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, maxSessionBytes: 2_000 }
-    })
-    await expect(
-      (async () => {
-        for (let index = 0; index < 50; index += 1) {
-          await journal.appendItem(item(index), body('x'.repeat(64)), { fence: 1 })
-        }
-      })()
-    ).rejects.toMatchObject({ code: 'journal_bound_exceeded' })
-  })
-
-  it('refuses an append past the per-window rate bound', async () => {
-    const journal = await open({
-      limits: { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, maxAppendsPerWindow: 3, appendWindowMs: 60_000 }
-    })
-    await expect(
-      (async () => {
-        for (let index = 0; index < 10; index += 1) {
-          await journal.appendItem(item(index), body('x'), { fence: 1 })
-        }
-      })()
-    ).rejects.toMatchObject({ code: 'journal_rate_exceeded' })
-  })
-
-  it('charges unique blobs and abandoned staging files to one physical quota', async () => {
-    const limits = { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, maxSessionBytes: 8_000 }
-    const journal = await open({ limits, autoCompact: false })
-    const payload = 'z'.repeat(1_200)
-    const bounded = boundPayload(payload, { ...limits, inlineHeadBytes: 8 })
-    const toolBody: AgentJournalItemBody = {
-      kind: 'tool-call',
-      name: 'command',
-      input: {},
-      state: 'completed',
-      output: bounded
-    }
-
-    await journal.appendItemWithBlobs(item(1), toolBody, [{ digest: bounded.digest, payload }], {
-      fence: 1
-    })
-    const afterFirst = await journalDirectoryBytes(root)
-    await journal.appendItemWithBlobs(item(2), toolBody, [{ digest: bounded.digest, payload }], {
-      fence: 1
-    })
-    const afterDuplicate = await journalDirectoryBytes(root)
-
-    expect(afterDuplicate - afterFirst).toBeLessThan(payload.length)
-    expect(await readdir(join(root, 'blobs'))).toEqual([bounded.digest])
-    expect(afterDuplicate).toBeLessThanOrEqual(limits.maxSessionBytes)
-
-    await writeFile(join(root, 'log.jsonl.abandoned.tmp'), 's'.repeat(2_000), 'utf8')
-    const physical = await journalDirectoryBytes(root)
-    await expect(
-      open({ limits: { ...limits, maxSessionBytes: physical - 1 } })
-    ).rejects.toMatchObject({ code: 'journal_bound_exceeded' })
-  })
-
-  it('uses a running tool reservation when its authoritative blob cannot fit', async () => {
-    const limits = { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, maxSessionBytes: 220 * 1024 }
-    const journal = await open({ limits, autoCompact: false })
-    await journal.appendItem(
-      item(1),
-      { kind: 'tool-call', name: 'command', input: {}, state: 'running' },
-      { fence: 1 }
-    )
-    for (let ordinal = 10; ordinal < 100; ordinal += 1) {
-      try {
-        await journal.appendItem(item(ordinal), body('f'.repeat(4_000)), { fence: 1 })
-      } catch (error) {
-        expect(error).toMatchObject({ code: 'journal_bound_exceeded' })
-        break
-      }
-    }
-    const payload = 'o'.repeat(100 * 1024)
-    const bounded = boundPayload(payload, { ...limits, inlineHeadBytes: 16 * 1024 })
-
-    await journal.appendItemWithBlobs(
-      item(1),
-      {
-        kind: 'tool-call',
-        name: 'command',
-        input: {},
-        state: 'completed',
-        output: bounded
-      },
-      [{ digest: bounded.digest, payload }],
-      { fence: 1 }
-    )
-
-    const tool = journal.snapshot().items.find((entry) => entry.itemId.includes('turn-1:1'))
-    expect(tool?.body).toEqual({
-      kind: 'tool-call',
-      name: 'command',
-      input: {},
-      state: 'completed'
-    })
-    expect(
-      journal
-        .snapshot()
-        .items.some(
-          (entry) =>
-            entry.body.kind === 'status' && entry.body.text.includes('could not be retained')
-        )
-    ).toBe(true)
-    expect(await readJournalBlob(root, bounded.digest)).toBeNull()
-    expect(journal.lifecycleCapacityState()).toEqual({ reservedBytes: 0, reservedAppendSlots: 0 })
-  })
-
-  it('keeps cached physical bytes aligned after blob dedupe and compaction', async () => {
-    const limits = { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, maxSessionBytes: 45_000 }
-    const journal = await open({
-      limits,
-      autoCompact: false,
-      compaction: { minTailRows: 0, retainTailMs: 0 }
-    })
-    const payload = 'p'.repeat(20_000)
-    const bounded = boundPayload(payload, { ...limits, inlineHeadBytes: 8 })
-    const toolBody: AgentJournalItemBody = {
-      kind: 'tool-call',
-      name: 'command',
-      input: {},
-      state: 'completed',
-      output: bounded
-    }
-
-    await journal.appendItemWithBlobs(item(1), toolBody, [{ digest: bounded.digest, payload }], {
-      fence: 1
-    })
-    await journal.appendItemWithBlobs(item(2), toolBody, [{ digest: bounded.digest, payload }], {
-      fence: 1
-    })
-    await journal.compact(tick() + 10, { minTailRows: 0, retainTailMs: 0 })
-    const compactedBytes = await journalDirectoryBytes(root)
-    expect(compactedBytes).toBeLessThan(limits.maxSessionBytes)
-
-    await journal.appendItem(item(3), body('after compaction'), { fence: 1 })
-
-    expect(await journalDirectoryBytes(root)).toBeLessThanOrEqual(limits.maxSessionBytes)
-    expect(await readdir(join(root, 'blobs'))).toEqual([bounded.digest])
-  })
 })
 
 describe('lifecycle batches', () => {
-  it('uses a reserved append slot after ordinary rate pressure', async () => {
-    const journal = await open({
-      autoCompact: false,
-      limits: { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, maxAppendsPerWindow: 1, appendWindowMs: 60_000 }
-    })
-    const identity: AgentJournalItemIdentity = {
-      provider: 'orca',
-      clientMessageId: 'reserved-prompt'
-    }
-    const pending: AgentJournalItemBody = {
-      kind: 'approval',
-      title: 'Run a command?',
-      detail: null,
-      options: [{ id: 'accept', label: 'Allow' }],
-      resolution: { state: 'pending', selectedOptionId: null, resolvedBy: null, resolvedAt: null }
-    }
-
-    // The pending row spends the only ordinary slot while reserving its
-    // terminal append slot for recovery.
-    await journal.appendLifecycleBatch({
-      settlementId: 'reserved-start',
-      fence: 1,
-      mutations: [{ kind: 'item', identity, body: pending }]
-    })
-    await expect(
-      journal.appendItem(
-        identity,
-        {
-          ...pending,
-          resolution: {
-            state: 'resolved',
-            selectedOptionId: 'accept',
-            resolvedBy: 'test',
-            resolvedAt: 1
-          }
-        },
-        { fence: 1 }
-      )
-    ).resolves.toBeDefined()
-  })
-
-  it('rate-limits an unreserved lifecycle batch', async () => {
-    const journal = await open({
-      autoCompact: false,
-      limits: { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, maxAppendsPerWindow: 1, appendWindowMs: 60_000 }
-    })
-    const mutation = (id: string): JournalLifecycleMutationInput => ({
-      kind: 'item',
-      identity: { provider: 'orca', clientMessageId: id },
-      body: { kind: 'status', text: 'provider diagnostic' }
-    })
-    await journal.appendLifecycleBatch({
-      settlementId: 'unreserved-1',
-      fence: 1,
-      mutations: [mutation('one')]
-    })
-    await expect(
-      journal.appendLifecycleBatch({
-        settlementId: 'unreserved-2',
-        fence: 1,
-        mutations: [mutation('two')]
-      })
-    ).rejects.toMatchObject({ code: 'journal_rate_exceeded' })
-  })
-
-  it('rebuilds dispatch and turn reservations for pending submissions after reopen', async () => {
-    const journal = await open({ autoCompact: false })
-    await journal.appendSubmission({
-      clientMessageId: 'pending-send',
-      payloadFingerprint: 'fingerprint',
-      body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'hello' }] },
-      fence: 1
-    })
-
-    const reopened = await open({ autoCompact: false })
-    expect(reopened.lifecycleCapacityState()).toEqual({
-      reservedBytes: JOURNAL_DISPATCH_RESERVATION_BYTES + JOURNAL_TURN_TERMINAL_RESERVATION_BYTES,
-      reservedAppendSlots: 2
-    })
-  })
-
   it('deduplicates concurrent submissions before appending a second row', async () => {
     const journal = await open()
     const input = {
@@ -684,7 +262,7 @@ describe('lifecycle batches', () => {
   })
 
   it('applies every mutation at one sequence and deduplicates a replay across reopen', async () => {
-    const journal = await open({ autoCompact: false })
+    const journal = await open()
     const turn: AgentJournalItemIdentity = {
       provider: 'legacy',
       agent: 'codex',
@@ -715,9 +293,9 @@ describe('lifecycle batches', () => {
         .snapshot()
         .items.some((entry) => entry.body.kind === 'status' && entry.body.text === 'working')
     ).toBe(false)
-    await journal.compact(tick() + 10, { minTailRows: 0, retainTailMs: 0 })
+    await journal.close()
 
-    const reopened = await open({ autoCompact: false })
+    const reopened = await open()
     const beforeReplay = reopened.cursor()
     const replay = await reopened.appendLifecycleBatch({
       settlementId: 'exit:turn-1',
@@ -737,53 +315,6 @@ describe('lifecycle batches', () => {
         )
     ).toBe(false)
   })
-
-  it('reserves and releases terminal prompts created inside lifecycle batches', async () => {
-    const journal = await open()
-    const identity: AgentJournalItemIdentity = { provider: 'orca', clientMessageId: 'prompt-1' }
-    const pending: AgentJournalItemBody = {
-      kind: 'approval',
-      title: 'Run a command?',
-      detail: null,
-      options: [{ id: 'accept', label: 'Allow' }],
-      resolution: {
-        state: 'pending',
-        selectedOptionId: null,
-        resolvedBy: null,
-        resolvedAt: null
-      }
-    }
-
-    await journal.appendLifecycleBatch({
-      settlementId: 'prompt-start',
-      fence: 1,
-      mutations: [{ kind: 'item', identity, body: pending }]
-    })
-
-    expect(journal.lifecycleCapacityState()).toEqual({
-      reservedBytes: JOURNAL_ITEM_TERMINAL_RESERVATION_BYTES,
-      reservedAppendSlots: 1
-    })
-
-    await journal.appendItem(
-      identity,
-      {
-        ...pending,
-        resolution: {
-          state: 'resolved',
-          selectedOptionId: 'accept',
-          resolvedBy: 'test',
-          resolvedAt: tick()
-        }
-      },
-      { fence: 1 }
-    )
-
-    expect(journal.lifecycleCapacityState()).toEqual({
-      reservedBytes: 0,
-      reservedAppendSlots: 0
-    })
-  })
 })
 
 describe('journal location', () => {
@@ -808,12 +339,32 @@ describe('journal location', () => {
 })
 
 describe('on-disk layout', () => {
-  it('writes the log and snapshot beside each other', async () => {
+  it('keeps the session database and its projection in one directory', async () => {
     const journal: AgentSessionJournal = await open()
     await journal.appendItem(item(0), body('a'), { fence: 1 })
-    await expect(readFile(join(root, JOURNAL_LOG_FILE), 'utf-8')).resolves.toContain(
-      '"kind":"item"'
-    )
-    await expect(readFile(join(root, JOURNAL_SNAPSHOT_FILE), 'utf-8')).resolves.toContain('"epoch"')
+    expect(await readdir(root)).toContain('journal.db')
+    await journal.close()
+    await withJournalDatabase(root, (db) => {
+      const row = db.prepare('SELECT row_json FROM journal_rows WHERE seq = 2').get()
+      expect((row as { row_json: string }).row_json).toContain('"kind":"item"')
+      expect(db.prepare('SELECT epoch FROM journal_sessions').get()).toMatchObject({
+        epoch: journal.epoch
+      })
+    })
   })
 })
+
+/** Opens the session database directly, so a case can stage a fault or read
+ *  back what a commit actually stored. */
+async function withJournalDatabase(
+  journalDir: string,
+  run: (db: Database.Database) => void
+): Promise<void> {
+  const { openJournalDatabase } = await import('./journal-database')
+  const opened = openJournalDatabase(journalDatabaseFile(journalDir))
+  try {
+    run(opened.db)
+  } finally {
+    opened.db.close()
+  }
+}
diff --git a/src/main/native-chat/agent-session-journal/journal-store.ts b/src/main/native-chat/agent-session-journal/journal-store.ts
index 33f9be0c2e4..ab2715d0d86 100644
--- a/src/main/native-chat/agent-session-journal/journal-store.ts
+++ b/src/main/native-chat/agent-session-journal/journal-store.ts
@@ -11,20 +11,16 @@ import type {
   AgentSessionJournalIdentity
 } from '../../../shared/agent-session-journal-types'
 import { agentJournalItemKey } from '../../../shared/agent-session-journal-item-key'
-import {
-  compactJournal,
-  DEFAULT_JOURNAL_COMPACTION_POLICY,
-  type JournalCompactionPolicy
-} from './journal-compaction'
+import { agentSessionJournalCloseRetries } from './journal-close-retry'
+import { openJournalDatabase, type OpenJournalDatabase } from './journal-database'
 import type { JournalReplacementItem } from './journal-epoch-replacement'
 import { readJournalSince } from './journal-cursor'
-import type { JournalLoad } from './journal-open'
-import { DEFAULT_JOURNAL_PAYLOAD_LIMITS } from './journal-payload-bounds'
+import { readJournalRowsAfterCursor, type JournalLoad } from './journal-open'
+import { journalDatabaseFile } from './journal-paths'
 import { markJournalPendingSubmissionsUnknown } from './journal-pending-submission-recovery'
 import {
   applyJournalRow,
   createJournalReducerState,
-  referencedBlobDigests,
   renderJournalState,
   resolveJournalItemId,
   type JournalReducerState
@@ -37,7 +33,6 @@ import {
 import type {
   AgentSessionJournalOptions,
   JournalAppendResult,
-  JournalBlobInput,
   JournalItemAppendOptions,
   JournalLifecycleBatchInput,
   JournalReadSince,
@@ -46,112 +41,79 @@ import type {
   ResolveDispatchInput
 } from './journal-store-contracts'
 import type { AgentJournalEpochReason, JournalRow } from './journal-row-schema'
-import { assertJournalWritable, JournalAppendBudget } from './journal-write-guards'
-import { journalDirectoryBytes } from './journal-physical-quota'
-import type { JournalLifecycleReservation } from './journal-lifecycle-capacity'
-import { JournalLifecycleAdmission } from './journal-lifecycle-admission'
-import { JournalRowWriter } from './journal-row-writer'
-import { JournalEpochController } from './journal-epoch-controller'
-import { journalStoreLoadedFields, openJournalStoreState } from './journal-store-open'
-import { JournalItemAppender } from './journal-item-appender'
-import { JournalLifecycleBatchAppender } from './journal-lifecycle-batch-appender'
+import { AgentSessionJournalError } from './journal-write-guards'
+import type { JournalRowWriter } from './journal-row-writer'
+import type { JournalEpochController } from './journal-epoch-controller'
+import { JournalConnectionCloser, JournalWriteQueue } from './journal-store-close'
+import { createJournalStoreCollaborators } from './journal-store-collaborators'
+import { ensureJournalDir, journalStoreLoadedFields } from './journal-store-open'
+import type { JournalItemAppender } from './journal-item-appender'
+import type { JournalLifecycleBatchAppender } from './journal-lifecycle-batch-appender'
 
 export { AgentSessionJournalError } from './journal-write-guards'
 
 export class AgentSessionJournal {
   private readonly identity: AgentSessionJournalIdentity
   private readonly journalDir: string
-  private readonly budget: JournalAppendBudget
-  private readonly compaction: JournalCompactionPolicy
-  private readonly autoCompact: boolean
+  private readonly dbPath: string
   private readonly now: () => number
   private readonly mintEpoch: () => string
   private readonly loaded: JournalLoad | null | undefined
 
   private state: JournalReducerState
-  private tailRows: JournalRow[] = []
-  private compactedThrough = 0
-  private sizeBytes = 0
   private readOnly = false
   private malformedRows = 0
-  private readonly lifecycleAdmission: JournalLifecycleAdmission
+  private database: OpenJournalDatabase | null = null
+  private readonly queue: JournalWriteQueue
+  private readonly closer: JournalConnectionCloser
   private readonly rowWriter: JournalRowWriter
   private readonly epochController: JournalEpochController
   private readonly itemAppender: JournalItemAppender
   private readonly lifecycleBatchAppender: JournalLifecycleBatchAppender
-  /** Serializes sequence assignment with the durable write behind it. */
-  private writes: Promise<unknown> = Promise.resolve()
+  private readonly restore: () => Promise<void>
 
   constructor(options: AgentSessionJournalOptions) {
     this.identity = options.identity
     this.journalDir = options.journalDir
-    this.budget = new JournalAppendBudget(
-      options.identity.sessionId,
-      options.limits ?? DEFAULT_JOURNAL_PAYLOAD_LIMITS
-    )
-    this.autoCompact = options.autoCompact ?? true
-    this.compaction = options.compaction ?? DEFAULT_JOURNAL_COMPACTION_POLICY
+    this.dbPath = journalDatabaseFile(options.journalDir)
     this.now = options.now ?? (() => Date.now())
     this.mintEpoch = options.mintEpoch ?? randomUUID
     this.loaded = options.loaded
     this.state = createJournalReducerState(options.identity.sessionId, '')
-    this.lifecycleAdmission = new JournalLifecycleAdmission(
-      options.identity.sessionId,
-      this.budget.maxSessionBytes,
-      (itemId) => resolveJournalItemId(this.state, itemId),
-      this.budget.maxAppendsPerWindow
-    )
-    this.rowWriter = new JournalRowWriter({
-      journalDir: this.journalDir,
-      sessionId: options.identity.sessionId,
-      budget: this.budget,
-      lifecycleAdmission: this.lifecycleAdmission,
-      autoCompact: this.autoCompact,
-      compaction: this.compaction,
-      now: this.now,
-      serialize: (run) => this.serializeWrite(run),
-      readOnly: () => this.readOnly,
-      setReadOnly: (readOnly) => {
-        this.readOnly = readOnly
-      },
-      physicalBytes: () => this.sizeBytes,
-      highestFence: () => this.state.highestFence,
-      nextSequence: () => this.state.lastSequence + 1,
-      tailRows: () => this.tailRows,
-      referencedBlobDigests: () => referencedBlobDigests(this.state),
-      compact: (now, policy) => this.compact(now, policy),
-      commit: (row, physicalBytes) => {
-        applyJournalRow(this.state, row)
-        this.tailRows.push(row)
-        this.sizeBytes = physicalBytes
-      }
+    // Serializes sequence assignment with the durable write behind it.
+    this.queue = new JournalWriteQueue(options.identity.sessionId)
+    this.closer = new JournalConnectionCloser({
+      connection: () => this.database?.db ?? null,
+      enqueue: (run) => this.queue.serializePastGate(run)
     })
-    this.epochController = new JournalEpochController({
+    const collaborators = createJournalStoreCollaborators({
       identity: this.identity,
       journalDir: this.journalDir,
-      budget: this.budget,
-      compaction: this.compaction,
       now: this.now,
       mintEpoch: this.mintEpoch,
-      serialize: (run) => this.serializeWrite(run),
+      serialize: (run) => this.queue.serialize(run),
+      database: () => this.requireDatabase(),
+      state: () => this.state,
       readOnly: () => this.readOnly,
       setReadOnly: (readOnly) => {
         this.readOnly = readOnly
       },
-      highestFence: () => this.state.highestFence,
       cursor: this.cursor,
-      adopt: (loaded) => this.adoptLoadedJournal(loaded)
-    })
-    this.itemAppender = new JournalItemAppender({
+      adopt: (loaded) => this.adoptLoadedJournal(loaded),
+      commit: (row) => applyJournalRow(this.state, row),
+      loaded: () => this.loaded,
+      malformedRows: () => this.malformedRows,
+      setMalformedRows: (count) => {
+        this.malformedRows = count
+      },
       journal: () => this,
-      state: () => this.state,
-      enqueue: (build, blobs) => this.enqueue(build, blobs)
-    })
-    this.lifecycleBatchAppender = new JournalLifecycleBatchAppender({
-      state: () => this.state,
-      cursor: this.cursor,
       enqueue: (build) => this.enqueue(build)
     })
+    this.rowWriter = collaborators.rowWriter
+    this.epochController = collaborators.epochController
+    this.itemAppender = collaborators.itemAppender
+    this.lifecycleBatchAppender = collaborators.lifecycleBatchAppender
+    this.restore = collaborators.restore
   }
 
   get isReadOnly(): boolean {
@@ -166,31 +128,31 @@ export class AgentSessionJournal {
     return this.journalDir
   }
 
-  /** Highest sequence folded into the snapshot; rows at or below it are no
-   *  longer individually replayable. */
-  get compactionBoundary(): number {
-    return this.compactedThrough
+  /** What the last open's repair did. */
+  get repair(): { malformedRows: number } {
+    return { malformedRows: this.malformedRows }
   }
 
   async open(): Promise<void> {
-    await openJournalStoreState({
-      journalDir: this.journalDir,
-      sessionId: this.identity.sessionId,
-      maxBytes: this.budget.maxSessionBytes,
-      loaded: this.loaded,
-      start: () => this.epochController.start('session_created', 0),
-      adopt: (loaded) => this.adoptLoadedJournal(loaded),
-      tailRows: () => this.tailRows,
-      snapshot: this.snapshot,
-      rebuildLifecycle: (snapshot, bytes) => this.lifecycleAdmission.rebuild(snapshot, bytes),
-      appendDisclosure: (identity, body, fence) => this.appendItem(identity, body, { fence }),
-      highestFence: () => this.state.highestFence,
-      malformedRows: () => this.malformedRows,
-      readOnly: () => this.readOnly,
-      setPhysicalBytes: (bytes) => {
-        this.sizeBytes = bytes
-      }
-    })
+    await ensureJournalDir(this.journalDir)
+    this.database = openJournalDatabase(this.dbPath)
+    try {
+      await this.restore()
+    } catch (error) {
+      // Nothing else holds a reference to this connection, so a throw here is
+      // the leak site unless the store releases it itself — and a close that
+      // REJECTS has not released it, so the store is retained for a later retry
+      // instead of being dropped with its handle open.
+      await agentSessionJournalCloseRetries.closeOrRetain(this)
+      throw error
+    }
+  }
+
+  /** Releases the session's SQLite handle. Idempotent on success, a real retry
+   *  after a failure, and permanently closed to writes either way (§ close). */
+  close(): Promise<void> {
+    this.queue.markClosed()
+    return this.closer.close()
   }
 
   cursor = (): AgentJournalCursor => ({
@@ -212,27 +174,19 @@ export class AgentSessionJournal {
 
   canonicalItemId = (itemId: string): string => resolveJournalItemId(this.state, itemId)
 
-  reserveLifecycleCapacity(token: JournalLifecycleReservation): Promise<boolean> {
-    return this.serializeCapacityMutation(async () => {
-      this.sizeBytes = await journalDirectoryBytes(this.journalDir)
-      return this.lifecycleAdmission.reserve(token, this.sizeBytes)
-    })
-  }
-
-  transferLifecycleCapacity(fromId: string, toId: string): Promise<boolean> {
-    return this.serializeCapacityMutation(() => this.lifecycleAdmission.transfer(fromId, toId))
-  }
-
-  releaseLifecycleCapacity(id: string): Promise<void> {
-    return this.serializeCapacityMutation(() => this.lifecycleAdmission.release(id))
-  }
-
-  lifecycleCapacityState = (): { reservedBytes: number; reservedAppendSlots: number } =>
-    this.lifecycleAdmission.state
-
   readSince(cursor: AgentJournalCursor): JournalReadSince {
     return readJournalSince(
-      { state: this.state, tailRows: this.tailRows, readOnly: this.readOnly },
+      {
+        state: this.state,
+        rowsAfter: (afterSequence) =>
+          readJournalRowsAfterCursor(
+            this.requireDatabase().db,
+            this.identity.sessionId,
+            this.state.epoch,
+            afterSequence
+          ),
+        readOnly: this.readOnly
+      },
       cursor,
       () => this.cursor()
     )
@@ -248,16 +202,6 @@ export class AgentSessionJournal {
     return this.itemAppender.append(identity, body, options)
   }
 
-  /** Blob-before-row admission on the same serialized path as sequence assignment. */
-  appendItemWithBlobs(
-    identity: AgentJournalItemIdentity,
-    body: AgentJournalItemBody,
-    blobs: readonly JournalBlobInput[],
-    options: JournalItemAppendOptions = { fence: 0 }
-  ): Promise<JournalAppendResult> {
-    return this.itemAppender.appendWithBlobs(identity, body, blobs, options)
-  }
-
   appendTombstone(
     identity: AgentJournalItemIdentity,
     options: JournalTombstoneInput
@@ -303,26 +247,6 @@ export class AgentSessionJournal {
     return markJournalPendingSubmissionsUnknown(this, fence)
   }
 
-  async compact(
-    now = this.now(),
-    policy: JournalCompactionPolicy = this.compaction
-  ): Promise<void> {
-    assertJournalWritable(this.readOnly, this.identity.sessionId)
-    const result = await compactJournal({
-      journalDir: this.journalDir,
-      state: this.state,
-      tailRows: this.tailRows,
-      policy,
-      now,
-      maxSessionBytes: this.budget.maxSessionBytes,
-      sessionId: this.identity.sessionId
-    })
-    this.tailRows = result.tailRows
-    this.compactedThrough = result.compactedThrough
-    this.state.oldestSequence = result.oldestSequence
-    this.sizeBytes = await journalDirectoryBytes(this.journalDir)
-  }
-
   /** The escape hatch for corruption, an unreconcilable prefix, a forked handle,
    *  and an unreadable schema. It invalidates every cursor; clients reload. */
   async rollEpoch(reason: AgentJournalEpochReason, fence: number): Promise<AgentJournalCursor> {
@@ -341,24 +265,22 @@ export class AgentSessionJournal {
     Object.assign(this, journalStoreLoadedFields(loaded))
   }
 
+  private requireDatabase(): OpenJournalDatabase {
+    if (!this.database) {
+      throw new AgentSessionJournalError(
+        'journal_closed',
+        `agent-session journal for ${this.identity.sessionId} is not open`
+      )
+    }
+    return this.database
+  }
+
   /**
    * Assign the next sequence, make the row durable, and fold it through the
    * SAME reducer replay uses — all inside one serialized step, so concurrent
    * callers cannot interleave and mint the same sequence.
    */
-  private enqueue(
-    build: (seq: number, ts: number) => JournalRow,
-    blobs: readonly JournalBlobInput[] = []
-  ): Promise<JournalRow> {
-    return this.rowWriter.enqueue(build, blobs)
-  }
-
-  private serializeCapacityMutation = <T>(runMutation: () => Promise<T> | T): Promise<T> =>
-    this.serializeWrite(async () => runMutation())
-
-  private serializeWrite<T>(runWrite: () => Promise<T>): Promise<T> {
-    const run = this.writes.then(runWrite)
-    this.writes = run.catch(() => undefined)
-    return run
+  private enqueue(build: (seq: number, ts: number) => JournalRow): Promise<JournalRow> {
+    return this.rowWriter.enqueue(build)
   }
 }
diff --git a/src/main/native-chat/agent-session-journal/journal-terminal-settlement.ts b/src/main/native-chat/agent-session-journal/journal-terminal-settlement.ts
new file mode 100644
index 00000000000..ade04667174
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-terminal-settlement.ts
@@ -0,0 +1,13 @@
+import type { AgentJournalItemBody } from '../../../shared/agent-session-journal-types'
+
+/** True while an item is still awaiting the row that settles it, so a sink can
+ *  treat that row as lifecycle-critical rather than sheddable under pressure. */
+export function requiresTerminalSettlement(body: AgentJournalItemBody): boolean {
+  if (body.kind === 'tool-call') {
+    return body.state === 'running'
+  }
+  if (body.kind === 'approval' || body.kind === 'question') {
+    return body.resolution.state === 'pending'
+  }
+  return body.kind === 'status' && body.turnLifecycle?.state === 'running'
+}
diff --git a/src/main/native-chat/agent-session-journal/journal-tool-output-fallback.ts b/src/main/native-chat/agent-session-journal/journal-tool-output-fallback.ts
deleted file mode 100644
index 5b3209ea594..00000000000
--- a/src/main/native-chat/agent-session-journal/journal-tool-output-fallback.ts
+++ /dev/null
@@ -1,58 +0,0 @@
-import type {
-  AgentJournalItemBody,
-  AgentJournalItemIdentity
-} from '../../../shared/agent-session-journal-types'
-import type { AgentSessionJournal } from './journal-store'
-import type { JournalAppendResult } from './journal-store-contracts'
-import { AgentSessionJournalError } from './journal-write-guards'
-import { boundToolInput, DEFAULT_JOURNAL_PAYLOAD_LIMITS } from './journal-payload-bounds'
-
-export async function appendToolOutputFallback(input: {
-  journal: AgentSessionJournal
-  error: unknown
-  identity: AgentJournalItemIdentity
-  body: AgentJournalItemBody
-  blobs: readonly { digest: string; payload: string }[]
-  itemId: string
-  fence: number
-}): Promise<JournalAppendResult> {
-  if (
-    !(input.error instanceof AgentSessionJournalError) ||
-    input.error.code !== 'journal_bound_exceeded' ||
-    input.body.kind !== 'tool-call' ||
-    input.body.state === 'running' ||
-    input.blobs.length === 0
-  ) {
-    throw input.error
-  }
-  const digest = input.blobs[0]?.digest ?? 'unknown'
-  const cursor = await input.journal.appendLifecycleBatch({
-    settlementId: `tool-output-unavailable:${input.itemId}:${digest}`,
-    fence: input.fence,
-    mutations: [
-      {
-        kind: 'item',
-        identity: input.identity,
-        body: {
-          kind: 'tool-call',
-          name: input.body.name,
-          input: boundToolInput(input.body.input, DEFAULT_JOURNAL_PAYLOAD_LIMITS),
-          state: input.body.state
-        }
-      },
-      {
-        kind: 'item',
-        identity: { provider: 'orca', clientMessageId: `output-unavailable:${input.itemId}` },
-        body: {
-          kind: 'status',
-          text: 'The tool completed, but its output could not be retained within the session storage limit.'
-        }
-      }
-    ]
-  })
-  const item = input.journal.snapshot().items.find((entry) => entry.itemId === input.itemId)
-  if (!item) {
-    throw new Error('journal_tool_output_fallback_lost')
-  }
-  return { cursor, itemId: input.itemId, revision: item.revision }
-}
diff --git a/src/main/native-chat/agent-session-journal/journal-write-guards.ts b/src/main/native-chat/agent-session-journal/journal-write-guards.ts
index 9f76de55745..e1869ae0c73 100644
--- a/src/main/native-chat/agent-session-journal/journal-write-guards.ts
+++ b/src/main/native-chat/agent-session-journal/journal-write-guards.ts
@@ -1,18 +1,11 @@
 // Guards an append clears before it becomes durable.
 //
-// All four refuse loudly rather than degrade: a silent drop here is a message
+// Both refuse loudly rather than degrade: a silent drop here is a message
 // missing from the transcript with nothing to explain it.
 
-import type { JournalPayloadLimits } from './journal-payload-bounds'
-import { journalRowByteLength, type JournalRow } from './journal-row-schema'
-
 export class AgentSessionJournalError extends Error {
   constructor(
-    readonly code:
-      | 'journal_read_only'
-      | 'journal_stale_fence'
-      | 'journal_bound_exceeded'
-      | 'journal_rate_exceeded',
+    readonly code: 'journal_read_only' | 'journal_stale_fence' | 'journal_closed',
     message: string
   ) {
     super(message)
@@ -41,94 +34,3 @@ export function assertJournalFence(fence: number, highestFence: number): void {
     )
   }
 }
-
-/** Total size and append rate for one session, bounding a runaway agent. */
-export class JournalAppendBudget {
-  private windowStart = 0
-  private appendsInWindow = 0
-
-  constructor(
-    private readonly sessionId: string,
-    private readonly limits: JournalPayloadLimits
-  ) {}
-
-  fork(): JournalAppendBudget {
-    return new JournalAppendBudget(this.sessionId, this.limits)
-  }
-
-  get maxSessionBytes(): number {
-    return this.limits.maxSessionBytes
-  }
-
-  get maxAppendsPerWindow(): number {
-    return this.limits.maxAppendsPerWindow
-  }
-
-  /** Capture rate state so a speculative append can be rolled back safely. */
-  checkpoint(): { windowStart: number; appendsInWindow: number } {
-    return { windowStart: this.windowStart, appendsInWindow: this.appendsInWindow }
-  }
-
-  restore(checkpoint: { windowStart: number; appendsInWindow: number }): void {
-    this.windowStart = checkpoint.windowStart
-    this.appendsInWindow = checkpoint.appendsInWindow
-  }
-
-  wouldExceedSize(row: JournalRow, sizeBytes: number): boolean {
-    return sizeBytes + journalRowByteLength(row) > this.limits.maxSessionBytes
-  }
-
-  assert(row: JournalRow, ts: number, sizeBytes: number): void {
-    if (this.wouldExceedSize(row, sizeBytes)) {
-      throw new AgentSessionJournalError(
-        'journal_bound_exceeded',
-        `agent-session journal for ${this.sessionId} reached its ${this.limits.maxSessionBytes}-byte bound`
-      )
-    }
-    this.assertRate(ts)
-  }
-
-  /** Lifecycle capacity cannot bypass the session-wide append rate. */
-  assertLifecycle(row: JournalRow, sizeBytes: number): void {
-    if (this.wouldExceedSize(row, sizeBytes)) {
-      throw new AgentSessionJournalError(
-        'journal_bound_exceeded',
-        `agent-session journal for ${this.sessionId} reached its ${this.limits.maxSessionBytes}-byte bound`
-      )
-    }
-    this.assertRate(row.ts)
-  }
-
-  /**
-   * Consume a lifecycle row covered by a pre-reserved append slot. Reserved
-   * rows still observe the physical quota, but do not spend ordinary window
-   * rate headroom that may be needed by unrelated traffic.
-   */
-  assertReservedLifecycle(row: JournalRow, sizeBytes: number): void {
-    if (this.wouldExceedSize(row, sizeBytes)) {
-      throw new AgentSessionJournalError(
-        'journal_bound_exceeded',
-        `agent-session journal for ${this.sessionId} reached its ${this.limits.maxSessionBytes}-byte bound`
-      )
-    }
-  }
-
-  private assertRate(ts: number): void {
-    let windowStart = this.windowStart
-    let appendsInWindow = this.appendsInWindow
-    if (ts - windowStart >= this.limits.appendWindowMs) {
-      windowStart = ts
-      appendsInWindow = 0
-    }
-    appendsInWindow += 1
-    if (appendsInWindow > this.limits.maxAppendsPerWindow) {
-      // A refusal must not consume a slot, so a later retry can succeed.
-      throw new AgentSessionJournalError(
-        'journal_rate_exceeded',
-        `agent-session journal for ${this.sessionId} exceeded ${this.limits.maxAppendsPerWindow} appends per ${this.limits.appendWindowMs}ms`
-      )
-    }
-    this.windowStart = windowStart
-    this.appendsInWindow = appendsInWindow
-  }
-}
diff --git a/src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts b/src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts
index 3930abb6fe8..cda878f5a01 100644
--- a/src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts
+++ b/src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts
@@ -1,4 +1,4 @@
-import { appendFile, mkdtemp, rm } from 'node:fs/promises'
+import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it } from 'vitest'
@@ -19,15 +19,16 @@ import {
   serializeRemoteRuntimePayload
 } from '../../../shared/remote-runtime-memory-limits'
 import { structuredAgentSessionPayloadFingerprint } from '../../../shared/structured-agent-session-mutation'
-import { JOURNAL_LOG_FILE } from '../agent-session-journal/journal-log-file'
-import {
-  serializeJournalRow,
-  type JournalItemRow,
-  type JournalRow,
-  type JournalTombstoneRow
+import { openJournalDatabase } from '../agent-session-journal/journal-database'
+import { journalDatabaseFile } from '../agent-session-journal/journal-paths'
+import { insertJournalRow } from '../agent-session-journal/journal-row-table'
+import { createTrackedJournalOpener } from '../agent-session-journal/journal-store-test-open'
+import type {
+  JournalItemRow,
+  JournalRow,
+  JournalTombstoneRow
 } from '../agent-session-journal/journal-row-schema'
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
-import { openAgentSessionJournal } from '../agent-session-journal/journal-store-factory'
 import { projectJournalBatch } from './agent-session-journal-batch'
 import { readAgentSessionHistory, resolveHistoryLimit } from './agent-session-history-page'
 
@@ -39,6 +40,7 @@ const IDENTITY: AgentSessionJournalIdentity = {
   providerHandle: { kind: 'codex', threadId: 'thread-1' }
 }
 
+const journals = createTrackedJournalOpener()
 let root: string
 let clock = 1_000
 let epochs = 0
@@ -67,7 +69,7 @@ beforeEach(async () => {
   root = await mkdtemp(join(tmpdir(), 'orca-wire-history-'))
   clock = 1_000
   epochs = 0
-  journal = await openAgentSessionJournal({
+  journal = await journals.open({
     identity: IDENTITY,
     journalDir: root,
     now: tick,
@@ -79,6 +81,7 @@ beforeEach(async () => {
 })
 
 afterEach(async () => {
+  await journals.closeAll()
   await rm(root, { recursive: true, force: true })
 })
 
@@ -477,12 +480,20 @@ async function reopenWithRawRows(rows: readonly RawSeedRow[]): Promise<AgentSess
         ts: tick()
       }) as JournalRow
   )
-  await appendFile(
-    join(root, JOURNAL_LOG_FILE),
-    `${full.map(serializeJournalRow).join('\n')}\n`,
-    'utf-8'
-  )
-  return openAgentSessionJournal({ identity: IDENTITY, journalDir: root, now: tick })
+  // Rows are staged straight into the session database: the reopen below has to
+  // see them exactly as a previous writer would have committed them.
+  await journal.close()
+  const opened = openJournalDatabase(journalDatabaseFile(root))
+  try {
+    opened.db.exec('BEGIN IMMEDIATE')
+    for (const row of full) {
+      insertJournalRow(opened.db, IDENTITY.sessionId, row)
+    }
+    opened.db.exec('COMMIT')
+  } finally {
+    opened.db.close()
+  }
+  return journals.open({ identity: IDENTITY, journalDir: root, now: tick })
 }
 
 describe('pre-existing oversized identities', () => {
diff --git a/src/main/native-chat/agent-session-wire/agent-session-journal-recovery.test.ts b/src/main/native-chat/agent-session-wire/agent-session-journal-recovery.test.ts
index 2efcc08cde9..214c889b5c9 100644
--- a/src/main/native-chat/agent-session-wire/agent-session-journal-recovery.test.ts
+++ b/src/main/native-chat/agent-session-wire/agent-session-journal-recovery.test.ts
@@ -1,7 +1,9 @@
 // Recovery drives the real journal loader against real on-disk damage: a hole
-// punched in the log, and a row stamped with a schema this host cannot read.
+// punched in the row sequence, and a row stamped with a schema this host cannot
+// read — on both version axes, because only one of them is detectable before a
+// read.
 
-import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it } from 'vitest'
@@ -9,7 +11,13 @@ import type {
   AgentJournalItemIdentity,
   AgentSessionJournalIdentity
 } from '../../../shared/agent-session-journal-types'
-import { openAgentSessionJournal } from '../agent-session-journal/journal-store-factory'
+import { openJournalDatabase } from '../agent-session-journal/journal-database'
+import { JOURNAL_DB_SCHEMA_VERSION } from '../agent-session-journal/journal-database-schema'
+import { loadJournal } from '../agent-session-journal/journal-open'
+import { journalDatabaseFile } from '../agent-session-journal/journal-paths'
+import { readJournalEpochRows } from '../agent-session-journal/journal-row-table'
+import { createTrackedJournalOpener } from '../agent-session-journal/journal-store-test-open'
+import type Database from '../../sqlite/sync-database'
 import {
   openAgentSessionJournalWithRecovery,
   providerHistoryId,
@@ -53,14 +61,15 @@ const CODEX_LINES = [
 let root: string
 let journalDir: string
 let historyFilePath: string
+const journals = createTrackedJournalOpener()
 
 function item(ordinal: number): AgentJournalItemIdentity {
   return { provider: 'codex', threadId: CODEX_SESSION, turnId: 'turn-1', ordinal }
 }
 
-/** Fills a journal with `count` items and hands back the raw log lines. */
-async function seedJournal(count: number): Promise<string[]> {
-  const journal = await openAgentSessionJournal({ identity: IDENTITY, journalDir })
+/** Fills a journal with `count` items and hands back its epoch. */
+async function seedJournal(count: number): Promise<string> {
+  const journal = await journals.open({ identity: IDENTITY, journalDir })
   for (let ordinal = 1; ordinal <= count; ordinal += 1) {
     await journal.appendItem(
       item(ordinal),
@@ -68,8 +77,48 @@ async function seedJournal(count: number): Promise<string[]> {
       { fence: 1 }
     )
   }
-  const raw = await readFile(join(journalDir, 'log.jsonl'), 'utf-8')
-  return raw.split('\n').filter((line) => line.trim().length > 0)
+  const epoch = journal.epoch
+  await journal.close()
+  return epoch
+}
+
+/** A journal whose epoch row is gone: every surviving row is unanchored, so a
+ *  repair has to set aside the whole range. */
+async function seedRepairableSession(): Promise<void> {
+  const journal = await journals.open({ identity: IDENTITY, journalDir })
+  await journal.appendSubmission({
+    clientMessageId: 'client-message-1',
+    payloadFingerprint: 'fingerprint-1',
+    body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'add a retry' }] },
+    fence: 1
+  })
+  await journal.resolveDispatch({
+    clientMessageId: 'client-message-1',
+    state: 'accepted',
+    providerIdentity: item(1),
+    fence: 1
+  })
+  await journal.close()
+  await deleteRow(1)
+}
+
+async function withJournalDatabase(
+  directory: string,
+  run: (db: Database.Database) => void
+): Promise<void> {
+  const opened = openJournalDatabase(journalDatabaseFile(directory))
+  try {
+    run(opened.db)
+  } finally {
+    opened.db.close()
+  }
+}
+
+/** The same logical hole `findSequenceGap` detects at replay. */
+async function deleteRow(seq: number): Promise<void> {
+  await withJournalDatabase(journalDir, (db) => {
+    db.prepare('DELETE FROM journal_rows WHERE seq = ?').run(seq)
+  })
 }
 
 beforeEach(async () => {
@@ -84,6 +133,7 @@ beforeEach(async () => {
 })
 
 afterEach(async () => {
+  await journals.closeAll()
   await rm(root, { recursive: true, force: true })
 })
 
@@ -99,20 +149,20 @@ describe('providerHistoryId', () => {
 describe('openAgentSessionJournalWithRecovery', () => {
   it('opens a healthy journal untouched', async () => {
     await seedJournal(2)
-    const opened = await openAgentSessionJournalWithRecovery({
-      identity: IDENTITY,
-      journalDir,
-      fence: 1,
-      historyFilePath
-    })
-    expect(opened.recovery).toBeNull()
-    expect(opened.journal.snapshot().items).toHaveLength(2)
+    const opened = journals.track(
+      await openAgentSessionJournalWithRecovery({
+        identity: IDENTITY,
+        journalDir,
+        fence: 1,
+        historyFilePath
+      }).then((result) => result.journal)
+    )
+    expect(opened.snapshot().items).toHaveLength(2)
   })
 
   it('rebuilds a holed journal in place on a fresh epoch', async () => {
-    const lines = await seedJournal(3)
-    const holed = lines.filter((_line, index) => index !== 1)
-    await writeFile(join(journalDir, 'log.jsonl'), `${holed.join('\n')}\n`, 'utf-8')
+    await seedJournal(3)
+    await deleteRow(3)
 
     const opened = await openAgentSessionJournalWithRecovery({
       identity: IDENTITY,
@@ -120,6 +170,7 @@ describe('openAgentSessionJournalWithRecovery', () => {
       fence: 1,
       historyFilePath
     })
+    journals.track(opened.journal)
     expect(opened.recovery).toMatchObject({ trigger: 'journal_corrupt', reset: 'epoch_changed' })
     expect(opened.recovery?.imported).toBeGreaterThan(0)
     expect(opened.journal.isReadOnly).toBe(false)
@@ -130,12 +181,46 @@ describe('openAgentSessionJournalWithRecovery', () => {
     expect(texts.some((text) => text.includes('add a retry'))).toBe(true)
   })
 
-  it('reconstructs a future-schema journal into a schema-scoped sibling, never in place', async () => {
-    const lines = await seedJournal(1)
-    await writeFile(
-      join(journalDir, 'log.jsonl'),
-      `${lines.join('\n')}\n${JSON.stringify({ v: 99, seq: 2, epoch: 'e', kind: 'item' })}\n`,
-      'utf-8'
+  it('reconstructs a future row-body version into a sibling, never in place', async () => {
+    const epoch = await seedJournal(1)
+    await withJournalDatabase(journalDir, (db) => {
+      db.prepare(
+        'INSERT INTO journal_rows (session_id, epoch, seq, ts, row_json) VALUES (?, ?, ?, ?, ?)'
+      ).run(
+        CODEX_SESSION,
+        epoch,
+        3,
+        1,
+        JSON.stringify({ v: 99, seq: 3, epoch, kind: 'item', fence: 1, ts: 1 })
+      )
+    })
+
+    const opened = journals.track(
+      await openAgentSessionJournalWithRecovery({
+        identity: IDENTITY,
+        journalDir,
+        fence: 1,
+        historyFilePath
+      }).then((result) => result.journal)
+    )
+
+    // The unreadable journal is left exactly as found; a newer host still owns it.
+    await withJournalDatabase(journalDir, (db) => {
+      const rows = readJournalEpochRows(db, CODEX_SESSION, epoch)
+      expect(rows.some((entry) => entry.rowJson.includes('"v":99'))).toBe(true)
+      expect(rows).toHaveLength(3)
+    })
+    await opened.close()
+    await withJournalDatabase(recoveryJournalDir(journalDir), (db) => {
+      const sibling = db.prepare('SELECT row_json FROM journal_rows').all()
+      expect(JSON.stringify(sibling)).toContain('add a retry')
+    })
+  })
+
+  it('reconstructs a future database version into a sibling, never in place', async () => {
+    await seedJournal(1)
+    await withJournalDatabase(journalDir, (db) =>
+      db.pragma(`user_version = ${JOURNAL_DB_SCHEMA_VERSION + 1}`)
     )
 
     const opened = await openAgentSessionJournalWithRecovery({
@@ -144,23 +229,71 @@ describe('openAgentSessionJournalWithRecovery', () => {
       fence: 1,
       historyFilePath
     })
+    journals.track(opened.journal)
     expect(opened.recovery).toMatchObject({
       trigger: 'schema_unreadable',
       reset: 'schema_unreadable'
     })
     expect(opened.recovery?.imported).toBeGreaterThan(0)
+    // No schema change, no row written, no row deleted.
+    await withJournalDatabase(journalDir, (db) => {
+      expect(db.pragma('user_version', { simple: true })).toBe(JOURNAL_DB_SCHEMA_VERSION + 1)
+      expect(db.prepare('SELECT count(*) AS total FROM journal_rows').get()).toMatchObject({
+        total: 2
+      })
+    })
+  })
 
-    // The unreadable journal is left exactly as found; a newer host still owns it.
-    const untouched = await readFile(join(journalDir, 'log.jsonl'), 'utf-8')
-    expect(untouched).toContain('"v":99')
-    const sibling = await readFile(join(recoveryJournalDir(journalDir), 'log.jsonl'), 'utf-8')
-    expect(sibling).toContain('add a retry')
+  // The rehydrate deletes every live row to publish its replacement epoch, so
+  // everything replay rejected is gone for good by the time the import runs.
+  // Orca minted the submission, receipt and lifecycle identities; no provider
+  // transcript can hand them back.
+  it('rebuilds from provider history when the epoch row itself is gone', async () => {
+    const journal = await journals.open({ identity: IDENTITY, journalDir })
+    await journal.appendSubmission({
+      clientMessageId: 'client-message-1',
+      payloadFingerprint: 'fingerprint-1',
+      body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'add a retry' }] },
+      fence: 1
+    })
+    await journal.resolveDispatch({
+      clientMessageId: 'client-message-1',
+      state: 'accepted',
+      providerIdentity: item(1),
+      fence: 1
+    })
+    await journal.appendLifecycleBatch({
+      settlementId: 'settlement-1',
+      fence: 1,
+      mutations: [
+        {
+          kind: 'item',
+          identity: { provider: 'orca', clientMessageId: 'approval-1' },
+          body: { kind: 'status', text: 'approved' }
+        }
+      ]
+    })
+    await journal.close()
+    // Sequence 1 is the epoch row: everything behind it is valid but unanchored.
+    await deleteRow(1)
+
+    const opened = await openAgentSessionJournalWithRecovery({
+      identity: IDENTITY,
+      journalDir,
+      fence: 1,
+      historyFilePath
+    })
+    journals.track(opened.journal)
+    expect(opened.recovery).toMatchObject({ trigger: 'journal_corrupt' })
+    expect(opened.recovery?.imported).toBeGreaterThan(0)
+    expect(JSON.stringify(opened.journal.snapshot().items.map((entry) => entry.body))).toContain(
+      'add a retry'
+    )
   })
 
   it('still opens the session when provider history cannot be read', async () => {
-    const lines = await seedJournal(3)
-    const holed = lines.filter((_line, index) => index !== 2)
-    await writeFile(join(journalDir, 'log.jsonl'), `${holed.join('\n')}\n`, 'utf-8')
+    await seedJournal(3)
+    await deleteRow(3)
 
     const opened = await openAgentSessionJournalWithRecovery({
       identity: IDENTITY,
@@ -168,9 +301,170 @@ describe('openAgentSessionJournalWithRecovery', () => {
       fence: 1,
       historyFilePath: join(root, 'missing.jsonl')
     })
+    journals.track(opened.journal)
     expect(opened.recovery).toMatchObject({ trigger: 'journal_corrupt', imported: 0 })
     expect(opened.recovery?.error).toBeTruthy()
     // A missing provider transcript must not clear the intact journal prefix.
-    expect(opened.journal.snapshot().items).toHaveLength(1)
+    expect(opened.journal.snapshot().items.map((entry) => entry.body.kind)).toEqual(['message'])
+  })
+
+  // A repair that KEEPS a prefix has no emptied epoch to anchor, so nothing
+  // about the surviving rows records that the deleted suffix was never rebuilt.
+  // Unmarked, the next probe reads a contiguous anchored prefix, calls it clean,
+  // and the dropped stretch of timeline is gone for good.
+  it('keeps a partially repaired journal corrupt until provider history replaces it', async () => {
+    await seedJournal(3)
+    await deleteRow(3)
+    const empty = join(root, 'empty.jsonl')
+    await writeFile(empty, '', 'utf-8')
+
+    const first = await openAgentSessionJournalWithRecovery({
+      identity: IDENTITY,
+      journalDir,
+      fence: 1,
+      historyFilePath: empty
+    })
+    journals.track(first.journal)
+    expect(first.recovery).toMatchObject({ trigger: 'journal_corrupt', imported: 0 })
+    expect(first.recovery?.error).toBeTruthy()
+    // Only the unanchored suffix went; the prefix the repair kept is still live.
+    expect(first.journal.snapshot().items.map((entry) => entry.body.kind)).toEqual(['message'])
+    await first.journal.close()
+
+    // The deletion is durable, so the demand for a rebuild has to be too.
+    expect(await loadJournal(journalDir, CODEX_SESSION)).toMatchObject({ corrupt: true })
+
+    // A readable transcript rebuilds the epoch, and THAT is what retires it.
+    const retried = await openAgentSessionJournalWithRecovery({
+      identity: IDENTITY,
+      journalDir,
+      fence: 1,
+      historyFilePath
+    })
+    journals.track(retried.journal)
+    expect(retried.recovery?.imported).toBeGreaterThan(0)
+    await retried.journal.close()
+    expect(await loadJournal(journalDir, CODEX_SESSION)).toMatchObject({ corrupt: false })
+  })
+
+  // The reproduced path. Deleting sequence 1 leaves every surviving row
+  // unanchored, so the repair drops ALL of them — and provider history is not
+  // there to publish a replacement. A journal in that state used to reopen as
+  // clean: an append took sequence 1 as an ordinary row, replay accepted it,
+  // and recovery never asked the provider for the timeline again.
+  it('does not normalize an epoch a repair emptied while provider history was unavailable', async () => {
+    await seedRepairableSession()
+    const missing = join(root, 'missing.jsonl')
+
+    const first = await openAgentSessionJournalWithRecovery({
+      identity: IDENTITY,
+      journalDir,
+      fence: 1,
+      historyFilePath: missing
+    })
+    journals.track(first.journal)
+    expect(first.recovery?.error).toBeTruthy()
+    expect(first.recovery?.imported).toBe(0)
+    await first.journal.close()
+
+    // Reopen: the epoch still holds nothing but the repair, so recovery runs again.
+    expect(await loadJournal(journalDir, CODEX_SESSION)).toMatchObject({ corrupt: true })
+    const reopened = await openAgentSessionJournalWithRecovery({
+      identity: IDENTITY,
+      journalDir,
+      fence: 1,
+      historyFilePath: missing
+    })
+    journals.track(reopened.journal)
+    expect(reopened.recovery).toMatchObject({ trigger: 'journal_corrupt', imported: 0 })
+    // Nothing but the anchor: the repair rebuilt no history of its own.
+    expect(reopened.journal.snapshot().items).toEqual([])
+
+    // The append lands ABOVE the epoch anchor, never on top of it.
+    await reopened.journal.appendItem(
+      item(2),
+      { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text: 'typed later' }] },
+      { fence: 1 }
+    )
+    const epoch = reopened.journal.epoch
+    await reopened.journal.close()
+    await withJournalDatabase(journalDir, (db) => {
+      const rows = readJournalEpochRows(db, CODEX_SESSION, epoch)
+      expect(JSON.parse(rows[0]?.rowJson ?? '{}')).toMatchObject({ kind: 'epoch', seq: 1 })
+    })
+  })
+
+  // An empty transcript is a plausible transient provider state, and it used to
+  // end recovery for good: the import published an empty replacement epoch that
+  // deleted the repair's anchor, the next probe called that clean, and the user's
+  // timeline was never rebuilt.
+  it('does not retire the repair marker when provider history exists but holds no messages', async () => {
+    await seedRepairableSession()
+    const empty = join(root, 'empty.jsonl')
+    await writeFile(empty, '', 'utf-8')
+
+    const first = await openAgentSessionJournalWithRecovery({
+      identity: IDENTITY,
+      journalDir,
+      fence: 1,
+      historyFilePath: empty
+    })
+    journals.track(first.journal)
+    expect(first.recovery).toMatchObject({ trigger: 'journal_corrupt', imported: 0 })
+    expect(first.recovery?.error).toBeTruthy()
+    // The anchor the repair published is still the epoch; the empty import did
+    // not replace it with a clean one.
+    expect(first.journal.snapshot().items).toEqual([])
+    const epoch = first.journal.epoch
+    await first.journal.close()
+    await withJournalDatabase(journalDir, (db) => {
+      const rows = readJournalEpochRows(db, CODEX_SESSION, epoch)
+      expect(JSON.parse(rows[0]?.rowJson ?? '{}')).toMatchObject({
+        kind: 'epoch',
+        seq: 1,
+        reason: 'unreconcilable_prefix'
+      })
+    })
+
+    // The session still reports corrupt, so the next attach retries.
+    expect(await loadJournal(journalDir, CODEX_SESSION)).toMatchObject({ corrupt: true })
+
+    // And a transcript that DOES have content still rebuilds the timeline.
+    const retried = await openAgentSessionJournalWithRecovery({
+      identity: IDENTITY,
+      journalDir,
+      fence: 1,
+      historyFilePath
+    })
+    journals.track(retried.journal)
+    expect(retried.recovery?.imported).toBeGreaterThan(0)
+    expect(JSON.stringify(retried.journal.snapshot().items.map((entry) => entry.body))).toContain(
+      'add a retry'
+    )
+  })
+
+  it('rebuilds the emptied epoch once provider history is readable again', async () => {
+    await seedRepairableSession()
+
+    const first = await openAgentSessionJournalWithRecovery({
+      identity: IDENTITY,
+      journalDir,
+      fence: 1,
+      historyFilePath: join(root, 'missing.jsonl')
+    })
+    journals.track(first.journal)
+    await first.journal.close()
+
+    const retried = await openAgentSessionJournalWithRecovery({
+      identity: IDENTITY,
+      journalDir,
+      fence: 1,
+      historyFilePath
+    })
+    journals.track(retried.journal)
+    expect(retried.recovery?.imported).toBeGreaterThan(0)
+    expect(JSON.stringify(retried.journal.snapshot().items.map((entry) => entry.body))).toContain(
+      'add a retry'
+    )
   })
 })
diff --git a/src/main/native-chat/agent-session-wire/agent-session-journal-recovery.ts b/src/main/native-chat/agent-session-wire/agent-session-journal-recovery.ts
index 05f58a25afe..6e771a31809 100644
--- a/src/main/native-chat/agent-session-wire/agent-session-journal-recovery.ts
+++ b/src/main/native-chat/agent-session-wire/agent-session-journal-recovery.ts
@@ -14,6 +14,7 @@ import {
   type AgentSessionJournalIdentity,
   type AgentSessionProviderHandle
 } from '../../../shared/agent-session-journal-types'
+import { agentSessionJournalCloseRetries } from '../agent-session-journal/journal-close-retry'
 import { importLegacyTranscriptIntoJournal } from '../agent-session-journal/journal-legacy-import'
 import { loadJournal } from '../agent-session-journal/journal-open'
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
@@ -25,7 +26,8 @@ export type AgentSessionJournalRecovery = {
   reset: AgentJournalResetReason
   epoch: string
   imported: number
-  /** Set when provider history could not be read; the intact journal prefix remains live. */
+  /** Set when provider history could not be read, or held nothing to restore; the
+   *  intact journal prefix remains live. */
   error?: string
 }
 
@@ -55,16 +57,13 @@ export async function openAgentSessionJournalWithRecovery(input: {
   /** Resolve directly to a transcript instead of discovering it by session id. */
   historyFilePath?: string | null
 }): Promise<AgentSessionJournalOpened> {
-  const probe = await loadJournal(input.journalDir, input.identity.sessionId)
+  const probe = loadJournal(input.journalDir, input.identity.sessionId)
   if (probe?.readOnly) {
     const journal = await openAgentSessionJournal({
       identity: input.identity,
       journalDir: recoveryJournalDir(input.journalDir)
     })
-    return {
-      journal,
-      recovery: await rehydrate({ ...input, journal, trigger: 'schema_unreadable' })
-    }
+    return { journal, recovery: await rehydrateOrClose(input, journal, 'schema_unreadable') }
   }
   const journal = await openAgentSessionJournal({
     identity: input.identity,
@@ -73,9 +72,30 @@ export async function openAgentSessionJournalWithRecovery(input: {
   if (!probe?.corrupt) {
     return { journal, recovery: null }
   }
-  // `open()` quarantines the unusable suffix; a successful import rolls once
-  // more so the rebuilt timeline is the only content of its epoch.
-  return { journal, recovery: await rehydrate({ ...input, journal, trigger: 'journal_corrupt' }) }
+  // `open()` drops the unusable suffix; a successful import rolls once more so
+  // the rebuilt timeline is the only content of its epoch.
+  return { journal, recovery: await rehydrateOrClose(input, journal, 'journal_corrupt') }
+}
+
+/** `importLegacyTranscriptIntoJournal` can THROW rather than report `ok: false`
+ *  — a journal write failure, for instance — and nothing else holds a reference
+ *  to the journal this function just opened. A close that rejects is retryable,
+ *  so the journal is retained rather than dropped with its handle still open. */
+async function rehydrateOrClose(
+  input: {
+    identity: AgentSessionJournalIdentity
+    fence: number
+    historyFilePath?: string | null
+  },
+  journal: AgentSessionJournal,
+  trigger: AgentSessionJournalRecovery['trigger']
+): Promise<AgentSessionJournalRecovery> {
+  try {
+    return await rehydrate({ ...input, journal, trigger })
+  } catch (error) {
+    await agentSessionJournalCloseRetries.closeOrRetain(journal)
+    throw error
+  }
 }
 
 async function rehydrate(input: {
@@ -94,13 +114,16 @@ async function rehydrate(input: {
     fence: input.fence,
     ...(input.historyFilePath ? { options: { filePath: input.historyFilePath } } : {})
   })
-  if (!result.ok) {
+  // A transcript that held nothing is the same outcome as one that could not be
+  // read: nothing was restored, so the repair's marker has to stand and be
+  // retried on a later attach rather than being retired as a completed recovery.
+  if (!result.ok || !result.replaced) {
     return {
       trigger: input.trigger,
       reset,
       epoch: input.journal.epoch,
       imported: 0,
-      error: result.error
+      error: result.ok ? 'Provider history held no messages to restore' : result.error
     }
   }
   return {
diff --git a/src/main/native-chat/agent-session-wire/claude-stream-json-frame-schema.ts b/src/main/native-chat/agent-session-wire/claude-stream-json-frame-schema.ts
index 4f3ef118af5..4f21285e417 100644
--- a/src/main/native-chat/agent-session-wire/claude-stream-json-frame-schema.ts
+++ b/src/main/native-chat/agent-session-wire/claude-stream-json-frame-schema.ts
@@ -1,4 +1,4 @@
-// SDKMessage discriminators from Claude Agent SDK 0.3.231 / Claude Code 2.1.231.
+// SDKMessage discriminators from Claude Agent SDK 0.3.251 / Claude Code 2.1.258.
 export const CLAUDE_STREAM_JSON_FRAME_KINDS = [
   'message:assistant',
   'message:user',
@@ -42,7 +42,15 @@ export const CLAUDE_STREAM_JSON_FRAME_KINDS = [
   'message:prompt_suggestion',
   'message:system:mirror_error',
   'message:system:informational',
-  'message:conversation_reset'
+  'message:conversation_reset',
+  // Queue bookkeeping the CLI emits per client-supplied command uuid. Absent
+  // from the SDK's SDKMessage union, which is why it reached users as raw JSON.
+  'message:command_lifecycle',
+  'message:result:success',
+  'message:result:error_during_execution',
+  'message:result:error_max_turns',
+  'message:result:error_max_budget_usd',
+  'message:result:error_max_structured_output_retries'
 ] as const
 
 export type ClaudeStreamJsonFrameKind = (typeof CLAUDE_STREAM_JSON_FRAME_KINDS)[number]
diff --git a/src/main/native-chat/agent-session-wire/provider-frame-disposition.test.ts b/src/main/native-chat/agent-session-wire/provider-frame-disposition.test.ts
index ad9ca66c52a..9860aaa81d8 100644
--- a/src/main/native-chat/agent-session-wire/provider-frame-disposition.test.ts
+++ b/src/main/native-chat/agent-session-wire/provider-frame-disposition.test.ts
@@ -65,6 +65,29 @@ describe('provider frame classification catalog', () => {
     ).toBe('error-surface')
   })
 
+  it('keeps command queue bookkeeping off the transcript without hiding a failed one', () => {
+    expect(
+      classifyProviderFrame('claude', 'message:command_lifecycle', {
+        command_uuid: 'command-1',
+        state: 'started'
+      })
+    ).toBe('status-chrome')
+    expect(
+      classifyProviderFrame('claude', 'message:command_lifecycle', {
+        command_uuid: 'command-1',
+        state: 'cancelled'
+      })
+    ).toBe('status-chrome')
+    // Payload inspection outranks the catalogue, so suppressing the kind cannot
+    // swallow a state the provider reports as a failure.
+    expect(
+      classifyProviderFrame('claude', 'message:command_lifecycle', {
+        command_uuid: 'command-1',
+        state: 'failed'
+      })
+    ).toBe('error-surface')
+  })
+
   it('keeps unknown future frames on the substantive bounded fallback path', () => {
     expect(classifyProviderFrame('codex', 'notification:future/event', {})).toBe(
       'timeline-substantive'
@@ -89,4 +112,52 @@ describe('provider frame classification catalog', () => {
     // An item type nobody has dispositioned still falls through visibly.
     expect(classifyProviderFrame('codex', 'item:futureThing', {})).toBe('timeline-substantive')
   })
+
+  it('chromes the one unmodelled codex item type that carries no content', () => {
+    expect(classifyProviderFrame('codex', 'item:sleep', { id: 's', durationMs: 20_000 })).toBe(
+      'status-chrome'
+    )
+    // Payload inspection still outranks the item catalog, so chroming a type
+    // cannot swallow one that reports a failure.
+    expect(classifyProviderFrame('codex', 'item:sleep', { id: 's', status: 'failed' })).toBe(
+      'error-surface'
+    )
+  })
+
+  it('keeps subagent items visible — the only evidence a spawned agent is working', () => {
+    expect(
+      classifyProviderFrame('codex', 'item:subAgentActivity', {
+        id: 'a-1',
+        kind: 'started',
+        agentThreadId: 'thread-child',
+        agentPath: '/root/list_directory'
+      })
+    ).toBe('timeline-substantive')
+    expect(
+      classifyProviderFrame('codex', 'item:collabAgentToolCall', {
+        id: 'c-1',
+        tool: 'spawn',
+        status: 'inProgress',
+        senderThreadId: 'thread-root',
+        receiverThreadIds: ['thread-child'],
+        agentsStates: {}
+      })
+    ).toBe('timeline-substantive')
+  })
+
+  it('leaves content-bearing codex item types on the visible fallback', () => {
+    // Each carries text or a path a user would want: review output, the image
+    // the agent looked at or generated, injected hook prompt text.
+    for (const type of [
+      'imageView',
+      'imageGeneration',
+      'enteredReviewMode',
+      'exitedReviewMode',
+      'hookPrompt'
+    ]) {
+      expect(classifyProviderFrame('codex', `item:${type}`, { id: 'i' }), type).toBe(
+        'timeline-substantive'
+      )
+    }
+  })
 })
diff --git a/src/main/native-chat/agent-session-wire/provider-frame-disposition.ts b/src/main/native-chat/agent-session-wire/provider-frame-disposition.ts
index 8d11df995a6..f05f4cd4c6c 100644
--- a/src/main/native-chat/agent-session-wire/provider-frame-disposition.ts
+++ b/src/main/native-chat/agent-session-wire/provider-frame-disposition.ts
@@ -131,7 +131,18 @@ export const PROVIDER_FRAME_CLASSIFICATIONS = {
     'message:prompt_suggestion': 'status-chrome',
     'message:system:mirror_error': 'error-surface',
     'message:system:informational': 'timeline-substantive',
-    'message:conversation_reset': 'status-chrome'
+    'message:conversation_reset': 'status-chrome',
+    // A `started`/`completed`/`cancelled` state for one queued command uuid and
+    // nothing else; the CLI keeps it out of its own transcript too. A state that
+    // reads as a failure still surfaces, via the payload check in classify.
+    'message:command_lifecycle': 'status-chrome',
+    // The turn-complete signal: lifecycle, never a transcript row. Error subtypes
+    // included — the turn's assistant frames already carry any user-facing text.
+    'message:result:success': 'status-chrome',
+    'message:result:error_during_execution': 'status-chrome',
+    'message:result:error_max_turns': 'status-chrome',
+    'message:result:error_max_budget_usd': 'status-chrome',
+    'message:result:error_max_structured_output_retries': 'status-chrome'
   }
 } as const satisfies ProviderFrameClassificationTable
 
@@ -186,7 +197,12 @@ function hasProviderError(payload: unknown): boolean {
 const CODEX_ITEM_CLASSIFICATIONS: Record<string, ProviderFrameClassification> = {
   // The `thread/compacted` notification is already chrome; its item form is the
   // same event and must not read as a mysterious opcode row.
-  contextCompaction: 'status-chrome'
+  contextCompaction: 'status-chrome',
+  // `{id, durationMs}` and nothing else — Codex's own transcript renders it as
+  // nothing at all. Every other item type this build does not model carries text
+  // a user would want (review output, an image path, hook prompt text, subagent
+  // progress), so those keep their visible fallback row.
+  sleep: 'status-chrome'
 }
 
 function notificationKind(kind: string): string {
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-adapter-router.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-adapter-router.test.ts
new file mode 100644
index 00000000000..c6566083eac
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-adapter-router.test.ts
@@ -0,0 +1,114 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
+import { StructuredAgentSessionAdapterRouter } from './structured-agent-session-adapter-router'
+
+function adapterOf(
+  releaseAcquisition: StructuredAgentSessionAdapter['releaseAcquisition']
+): StructuredAgentSessionAdapter {
+  return {
+    acquire: vi.fn(async () => ({ process: { pid: 1 } }) as never),
+    releaseAcquisition,
+    dispatch: vi.fn(),
+    cancelTurn: vi.fn(),
+    answerPrompt: vi.fn(),
+    setOption: vi.fn()
+  } as unknown as StructuredAgentSessionAdapter
+}
+
+describe('StructuredAgentSessionAdapterRouter.releaseAcquisition', () => {
+  it('drops the owner even when its release reports a typed failure', async () => {
+    const failure = new Error('root exited')
+    const claude = adapterOf(vi.fn().mockRejectedValueOnce(failure).mockResolvedValue(false))
+    const codex = adapterOf(vi.fn(async () => false))
+    const router = new StructuredAgentSessionAdapterRouter({ claude, codex }, async () => {})
+    const identity = { sessionId: 'session-1', agent: 'claude' } as never
+    await router.acquire({ identity, fence: 1, spawnToken: 'spawn-1' })
+
+    await expect(router.releaseAcquisition({ sessionId: 'session-1' })).rejects.toBe(failure)
+    // With no owner left, a later release asks every adapter instead of the stale one.
+    await expect(router.releaseAcquisition({ sessionId: 'session-1' })).resolves.toBe(false)
+    expect(claude.releaseAcquisition).toHaveBeenCalledTimes(2)
+    expect(codex.releaseAcquisition).toHaveBeenCalledTimes(1)
+  })
+})
+
+describe('StructuredAgentSessionAdapterRouter.closeSession', () => {
+  it('retains the owner after an unproven close so a later retry reaches the same adapter', async () => {
+    const claude = adapterOf(vi.fn(async () => true))
+    const closeSession = vi.fn().mockResolvedValueOnce(false).mockResolvedValueOnce(true)
+    const dispatch = vi.fn().mockResolvedValue({ state: 'unknown', reason: 'test' })
+    claude.closeSession = closeSession
+    claude.dispatch = dispatch
+    const codex = adapterOf(vi.fn(async () => false))
+    const router = new StructuredAgentSessionAdapterRouter({ claude, codex }, async () => {})
+    const identity = { sessionId: 'session-1', agent: 'claude' } as never
+    await router.acquire({ identity, fence: 1, spawnToken: 'spawn-1' })
+
+    await expect(router.closeSession('session-1')).resolves.toBe(false)
+    await expect(
+      router.dispatch({
+        sessionId: 'session-1',
+        clientMessageId: 'client-1',
+        body: {} as never,
+        fence: 1
+      })
+    ).resolves.toMatchObject({ state: 'unknown' })
+    await expect(router.closeSession('session-1')).resolves.toBe(true)
+    expect(closeSession).toHaveBeenCalledTimes(2)
+    expect(dispatch).toHaveBeenCalledTimes(1)
+  })
+})
+
+describe('StructuredAgentSessionAdapterRouter optional lifecycle methods', () => {
+  it.each([
+    ['forceCloseSession', 'forceCloseSession'],
+    ['disposeSession', 'disposeSession']
+  ] as const)(
+    '%s forwards to the owner and retains it until proven stopped',
+    async (_label, method) => {
+      const claude = adapterOf(vi.fn(async () => true))
+      const stop = vi.fn().mockResolvedValueOnce(false).mockResolvedValueOnce(true)
+      claude[method] = stop
+      const dispatch = vi.fn().mockResolvedValue({ state: 'unknown', reason: 'test' })
+      claude.dispatch = dispatch
+      const codex = adapterOf(vi.fn(async () => false))
+      const router = new StructuredAgentSessionAdapterRouter({ claude, codex }, async () => {})
+      const identity = { sessionId: 'session-1', agent: 'claude' } as never
+      await router.acquire({ identity, fence: 1, spawnToken: 'spawn-1' })
+      const stopSession = router[method]
+
+      await expect(stopSession('session-1')).resolves.toBe(false)
+      await expect(
+        router.dispatch({
+          sessionId: 'session-1',
+          clientMessageId: 'client-1',
+          body: {} as never,
+          fence: 1
+        })
+      ).resolves.toMatchObject({ state: 'unknown' })
+      await expect(stopSession('session-1')).resolves.toBe(true)
+      expect(stop).toHaveBeenCalledTimes(2)
+      expect(dispatch).toHaveBeenCalledOnce()
+    }
+  )
+
+  it.each(['forceCloseSession', 'disposeSession'] as const)(
+    'falls back to closeSession when an owner lacks %s',
+    async (method) => {
+      const closeSession = vi.fn().mockResolvedValue(true)
+      const claude = adapterOf(vi.fn(async () => true))
+      claude.closeSession = closeSession
+      const codex = adapterOf(vi.fn(async () => false))
+      const router = new StructuredAgentSessionAdapterRouter({ claude, codex }, async () => {})
+      await router.acquire({
+        identity: { sessionId: 'session-1', agent: 'claude' } as never,
+        fence: 1,
+        spawnToken: 'spawn-1'
+      })
+      const stopSession = router[method]
+
+      await expect(stopSession('session-1')).resolves.toBe(true)
+      expect(closeSession).toHaveBeenCalledWith('session-1')
+    }
+  )
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-adapter-router.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-adapter-router.ts
new file mode 100644
index 00000000000..226b9c1aab5
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-adapter-router.ts
@@ -0,0 +1,135 @@
+import type { AgentSessionJournalIdentity } from '../../../shared/agent-session-journal-types'
+import type { AgentSessionExecutionLocation } from '../../../shared/agent-session-record'
+import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
+
+type RoutedAgent = 'claude' | 'codex'
+
+export class StructuredAgentSessionAdapterRouter implements StructuredAgentSessionAdapter {
+  private readonly owners = new Map<string, StructuredAgentSessionAdapter>()
+
+  constructor(
+    private readonly adapters: Record<RoutedAgent, StructuredAgentSessionAdapter>,
+    private readonly closeAdapters: () => Promise<void>
+  ) {}
+
+  supportsCreate = (location: AgentSessionExecutionLocation, agent: string): boolean => {
+    const adapter = this.adapterForAgent(agent)
+    return adapter ? (adapter.supportsLocation?.(location) ?? false) : false
+  }
+
+  supportsLocation = (location: AgentSessionExecutionLocation): boolean =>
+    Object.values(this.adapters).some((adapter) => adapter.supportsLocation?.(location) ?? false)
+
+  async acquire(input: Parameters<StructuredAgentSessionAdapter['acquire']>[0]) {
+    const adapter = this.requireAgent(input.identity)
+    const acquired = await adapter.acquire(input)
+    this.owners.set(input.identity.sessionId, adapter)
+    return acquired
+  }
+
+  async releaseAcquisition(input: { sessionId: string }): Promise<boolean> {
+    const adapter = this.owners.get(input.sessionId)
+    if (adapter) {
+      try {
+        return (await adapter.releaseAcquisition?.(input)) === true
+      } finally {
+        this.owners.delete(input.sessionId)
+      }
+    }
+    let released = false
+    for (const candidate of Object.values(this.adapters)) {
+      released = (await candidate.releaseAcquisition?.(input)) === true || released
+    }
+    return released
+  }
+
+  dispatch: StructuredAgentSessionAdapter['dispatch'] = (input) =>
+    this.owner(input.sessionId).dispatch(input)
+
+  cancelTurn: StructuredAgentSessionAdapter['cancelTurn'] = (input) =>
+    this.owner(input.sessionId).cancelTurn(input)
+
+  stopBackgroundTasks: NonNullable<StructuredAgentSessionAdapter['stopBackgroundTasks']> = (
+    input
+  ) => {
+    const stop = this.owner(input.sessionId).stopBackgroundTasks
+    return stop ? stop(input) : Promise.resolve({ cancelled: false })
+  }
+
+  backgroundTaskState: NonNullable<StructuredAgentSessionAdapter['backgroundTaskState']> = (
+    sessionId
+  ) => this.owners.get(sessionId)?.backgroundTaskState?.(sessionId)
+
+  answerPrompt: StructuredAgentSessionAdapter['answerPrompt'] = (input) =>
+    this.owner(input.sessionId).answerPrompt(input)
+
+  setOption: StructuredAgentSessionAdapter['setOption'] = (input) =>
+    this.owner(input.sessionId).setOption(input)
+
+  readOptions = (input: { sessionId: string; fence: number }) => {
+    const reader = this.owner(input.sessionId).readOptions
+    if (!reader) {
+      throw new Error(`structured session ${input.sessionId} does not report options`)
+    }
+    return reader(input)
+  }
+
+  readOptionRestoreFailures = (sessionId: string): readonly string[] =>
+    this.owner(sessionId).readOptionRestoreFailures?.(sessionId) ?? []
+
+  historyFilePath = (input: { identity: AgentSessionJournalIdentity }) =>
+    this.requireAgent(input.identity).historyFilePath?.(input) ?? Promise.resolve(null)
+
+  closeSession = (sessionId: string): Promise<boolean> =>
+    this.stopSession(sessionId, (adapter) => adapter.closeSession)
+
+  forceCloseSession = (sessionId: string): Promise<boolean> =>
+    this.stopSession(sessionId, (adapter) => adapter.forceCloseSession ?? adapter.closeSession)
+
+  disposeSession = (sessionId: string): Promise<boolean> =>
+    this.stopSession(sessionId, (adapter) => adapter.disposeSession ?? adapter.closeSession)
+
+  private async stopSession(
+    sessionId: string,
+    selectStop: (
+      adapter: StructuredAgentSessionAdapter
+    ) => NonNullable<StructuredAgentSessionAdapter['closeSession']> | undefined
+  ): Promise<boolean> {
+    const adapter = this.owners.get(sessionId)
+    if (!adapter) {
+      return false
+    }
+    const stop = selectStop(adapter)
+    const stopped = await stop?.call(adapter, sessionId)
+    if (stopped === true) {
+      this.owners.delete(sessionId)
+      return true
+    }
+    return false
+  }
+
+  async closeAll(): Promise<void> {
+    this.owners.clear()
+    await this.closeAdapters()
+  }
+
+  private owner(sessionId: string): StructuredAgentSessionAdapter {
+    const adapter = this.owners.get(sessionId)
+    if (!adapter) {
+      throw new Error(`no live structured adapter owns ${sessionId}`)
+    }
+    return adapter
+  }
+
+  private requireAgent(identity: AgentSessionJournalIdentity): StructuredAgentSessionAdapter {
+    const adapter = this.adapterForAgent(identity.agent)
+    if (!adapter) {
+      throw new Error(`structured sessions do not support ${identity.agent}`)
+    }
+    return adapter
+  }
+
+  private adapterForAgent(agent: string): StructuredAgentSessionAdapter | null {
+    return agent === 'claude' || agent === 'codex' ? this.adapters[agent] : null
+  }
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-adapter.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-adapter.test.ts
index 5f67240c1c6..77cce9153f5 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-adapter.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-adapter.test.ts
@@ -2,6 +2,7 @@ import { describe, expect, it, vi } from 'vitest'
 
 import {
   AgentSessionAcquisitionExitUnprovenError,
+  AgentSessionAcquisitionRootExitObservedError,
   rethrowAfterAgentSessionAcquisitionCleanup
 } from './structured-agent-session-adapter'
 
@@ -28,6 +29,27 @@ describe('failed agent-session acquisition cleanup', () => {
     ).rejects.toBeInstanceOf(AgentSessionAcquisitionExitUnprovenError)
   })
 
+  it('keeps a first-hand root exit that cleanup observed, with the provider diagnostic', async () => {
+    const cause = new Error('proof failed')
+    const exit = new AgentSessionAcquisitionRootExitObservedError(
+      new Error('claude stream-json exited (code 1): crashed')
+    )
+    const error = await rethrowAfterAgentSessionAcquisitionCleanup(
+      {
+        releaseAcquisition: vi.fn(async () => {
+          throw exit
+        })
+      },
+      'session-1',
+      cause
+    ).catch((thrown: unknown) => thrown)
+
+    expect(error).toBeInstanceOf(AgentSessionAcquisitionRootExitObservedError)
+    expect(error).not.toBeInstanceOf(AgentSessionAcquisitionExitUnprovenError)
+    expect((error as Error).message).toBe('claude stream-json exited (code 1): crashed')
+    expect((error as Error).cause).toMatchObject({ errors: [cause, exit] })
+  })
+
   it('reports unproven exit when cleanup throws', async () => {
     const error = await rethrowAfterAgentSessionAcquisitionCleanup(
       {
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-adapter.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-adapter.ts
index cccc8ce6f13..e6f8e478695 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-adapter.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-adapter.ts
@@ -17,6 +17,7 @@ import type {
   AgentSessionProcessIdentity
 } from '../../../shared/agent-session-record'
 import type {
+  AgentSessionBackgroundTaskState,
   AgentSessionOptionsResult,
   AgentSessionWireRefusalCode
 } from '../../../shared/agent-session-wire'
@@ -32,6 +33,20 @@ export class AgentSessionAcquisitionRefusal extends Error {
   }
 }
 
+/**
+ * The provider's own root process was observed to exit, but its descendant tree
+ * could not be verified. The lease keys on the root's pid and start time, so its
+ * observed death releases the reservation; nothing is claimed about descendants.
+ * Never thrown when a descendant was observed still alive — that stays unproven.
+ */
+export class AgentSessionAcquisitionRootExitObservedError extends Error {
+  constructor(cause: unknown) {
+    // The provider's own diagnostic is the only thing the user can act on.
+    super(cause instanceof Error ? cause.message : String(cause), { cause })
+    this.name = 'AgentSessionAcquisitionRootExitObservedError'
+  }
+}
+
 export class AgentSessionAcquisitionExitUnprovenError extends Error {
   constructor(cause: unknown) {
     super('agent_session_acquisition_exit_unproven', { cause })
@@ -49,7 +64,7 @@ export type AgentSessionAcquisition = {
   acquisitionGeneration?: string
 }
 
-/** Acquisition validation failed before the adapter attempted to spawn. */
+/** Acquisition failed with first-hand proof that no provider process existed. */
 export class AgentSessionPreSpawnError extends Error {
   constructor(cause: unknown) {
     super(cause instanceof Error ? cause.message : String(cause), { cause })
@@ -105,7 +120,9 @@ export type StructuredAgentSessionAdapter = {
    *  at — the store rejects a link minted at any other fence. */
   acquire(input: StructuredAgentSessionAcquireInput): Promise<AgentSessionAcquisition>
   /** Reaps an acquired provider when the host cannot commit or prove its lease.
-   *  Returns true only after provider child exit is proven. */
+   *  Returns true only after provider child exit is proven. Throws
+   *  `AgentSessionAcquisitionRootExitObservedError` when the provider root's own
+   *  exit was observed first-hand but its descendants could not be verified. */
   releaseAcquisition?(input: { sessionId: string }): Promise<boolean>
   dispatch(input: {
     sessionId: string
@@ -120,6 +137,12 @@ export type StructuredAgentSessionAdapter = {
     turnId: string
     fence: number
   }): Promise<{ cancelled: boolean }>
+  stopBackgroundTasks?(input: {
+    sessionId: string
+    fence: number
+    taskId?: string
+  }): Promise<{ cancelled: boolean }>
+  backgroundTaskState?(sessionId: string): AgentSessionBackgroundTaskState | null | undefined
   /** Fires the provider callback for an approval or a question. The wire calls
    *  this only after the durable compare-and-set won, so it runs exactly once. */
   answerPrompt(input: {
@@ -133,6 +156,8 @@ export type StructuredAgentSessionAdapter = {
     input: StructuredAgentSessionSetOptionInput
   ): Promise<void | Readonly<Record<string, string>>>
   readOptions?(input: { sessionId: string; fence: number }): Promise<AgentSessionOptionsResult>
+  /** Option keys skipped after a provider rejected their persisted restore value. */
+  readOptionRestoreFailures?(sessionId: string): readonly string[]
   /** Transcript path for journal recovery. Omit to let the existing session-file
    *  resolver discover it from the provider session id. */
   historyFilePath?(input: { identity: AgentSessionJournalIdentity }): Promise<string | null>
@@ -154,9 +179,15 @@ export async function rethrowAfterAgentSessionAcquisitionCleanup(
   try {
     released = (await adapter.releaseAcquisition?.({ sessionId })) === true
   } catch (cleanupError) {
-    throw new AgentSessionAcquisitionExitUnprovenError(
-      new AggregateError([cause, cleanupError], 'agent session acquisition cleanup failed')
-    )
+    // A root exit the cleanup observed first-hand keeps its classification and its
+    // provider diagnostic; the failure that triggered cleanup rides along as cause.
+    throw cleanupError instanceof AgentSessionAcquisitionRootExitObservedError
+      ? new AgentSessionAcquisitionRootExitObservedError(
+          new AggregateError([cause, cleanupError], cleanupError.message)
+        )
+      : new AgentSessionAcquisitionExitUnprovenError(
+          new AggregateError([cause, cleanupError], 'agent session acquisition cleanup failed')
+        )
   }
   if (released) {
     throw cause
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-attach-context.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-attach-context.ts
index 05c3d8c9e5e..7113be8d54b 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-attach-context.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-attach-context.ts
@@ -5,7 +5,6 @@
 
 import type { AgentSessionWireRefusal } from '../../../shared/agent-session-wire'
 import type { AgentJournalResetReason } from '../../../shared/agent-session-journal-types'
-import type { AgentSessionAttachParams } from './structured-agent-session-attach'
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
 import type {
   StructuredAgentSessionHostDeps,
@@ -30,8 +29,6 @@ export type StructuredAgentSessionAttachContext = {
   }
   tasks: StructuredAgentSessionTaskQueue
   reconcileLeases: (sessionId: string) => Promise<AgentSessionWireRefusal | null>
-  /** Retries a durable provider-exit journal settlement before a new owner is reserved. */
-  retryPendingSettlement?: (sessionId: string, params: AgentSessionAttachParams) => Promise<boolean>
   serialize: <T>(sessionId: string, task: () => Promise<T>) => Promise<T>
   now: () => number
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-attach-flow.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-attach-flow.ts
index 5be2d8ed09e..b08a56ea4d9 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-attach-flow.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-attach-flow.ts
@@ -26,6 +26,7 @@ import type { AgentSessionRecordStore } from '../../runtime/agent-session-record
 import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
 import {
   AgentSessionAcquisitionExitUnprovenError,
+  AgentSessionAcquisitionRootExitObservedError,
   AgentSessionAcquisitionRefusal,
   AgentSessionPreSpawnError,
   isAgentSessionPreSpawnError,
@@ -58,8 +59,9 @@ export type AttachFlowInput = {
   onAcquiring?: () => Promise<void> | void
   /** Settles writes already captured by the superseded journal before opening another. */
   beforeJournalOpen?: () => Promise<void> | void
-  /** Removes any partial host publication after journal attachment fails. */
-  onAttachFailed?: () => void
+  /** Removes any partial host publication after journal attachment fails, and
+   *  closes the journal handle of the map entry it drops. Awaited: see eviction. */
+  onAttachFailed?: () => Promise<void>
 }
 
 export async function performAttach(
@@ -118,7 +120,9 @@ export async function performAttach(
         ? 'processless'
         : error instanceof AgentSessionAcquisitionExitUnprovenError
           ? 'unproven'
-          : 'exit-proven'
+          : error instanceof AgentSessionAcquisitionRootExitObservedError
+            ? 'root-exit-observed'
+            : 'exit-proven'
       const outcome =
         error instanceof AgentSessionAcquisitionExitUnprovenError
           ? {
@@ -208,15 +212,21 @@ async function settlePostAcquisitionAttachFailure(
   cause: unknown
 ): Promise<never> {
   let cleanupError: unknown = cause
-  let exitProof: 'exit-proven' | 'unproven' = 'unproven'
+  let exitProof: 'exit-proven' | 'root-exit-observed' | 'unproven' = 'unproven'
   try {
     await rethrowAfterAgentSessionAcquisitionCleanup(input.adapter, record.sessionId, cause)
   } catch (error) {
     cleanupError = error
     exitProof =
-      error instanceof AgentSessionAcquisitionExitUnprovenError ? 'unproven' : 'exit-proven'
+      error instanceof AgentSessionAcquisitionExitUnprovenError
+        ? 'unproven'
+        : error instanceof AgentSessionAcquisitionRootExitObservedError
+          ? 'root-exit-observed'
+          : 'exit-proven'
   }
-  input.onAttachFailed?.()
+  // Why: the close is awaited so the map entry is gone only once its handle is
+  // released, but a failed close must not also cost the store settlement below.
+  await Promise.resolve(input.onAttachFailed?.()).catch(() => undefined)
   try {
     await input.store.settleFailedPostAcquisitionAttachment({
       sessionId: record.sessionId,
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-attach-orchestration.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-attach-orchestration.ts
index bd79bb1bb45..a22bbdcbb3e 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-attach-orchestration.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-attach-orchestration.ts
@@ -17,7 +17,11 @@ import {
   pinnedAgentSessionLaunchEnv
 } from './structured-agent-session-launch-env'
 import { refuseAgentSessionMutation } from './structured-agent-session-mutation-admission'
+import { retryPendingStructuredAgentSessionSettlement } from './structured-agent-session-settlement-retry'
 import type { StructuredAgentSessionAttachContext } from './structured-agent-session-attach-context'
+import type { DeferredStructuredAgentSessionEventSink } from './structured-agent-session-event-sink'
+import { agentSessionJournalCloseRetries } from '../agent-session-journal/journal-close-retry'
+import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
 
 export function attachStructuredAgentSession(
   context: StructuredAgentSessionAttachContext,
@@ -38,14 +42,20 @@ export function attachStructuredAgentSession(
       return refuseAgentSessionMutation(unreconciled)
     }
     await context.runtimeState.resolveRecovery(sessionId)
-    if (context.retryPendingSettlement) {
-      const settled = await context.retryPendingSettlement(sessionId, params)
-      if (!settled) {
-        return refuseAgentSessionMutation({
-          code: 'agent_session_ownership_unknown',
-          message: 'The provider-exit terminal journal settlement is still pending; retry attach.'
-        })
-      }
+    // Retries a durable provider-exit journal settlement before a new owner is reserved. Answers
+    // settled when the record has none pending, so every attach can ask unconditionally.
+    const settled = await retryPendingStructuredAgentSessionSettlement({
+      deps: context.deps,
+      sessions: context.sessions,
+      sessionId,
+      params,
+      now: () => context.now()
+    })
+    if (!settled) {
+      return refuseAgentSessionMutation({
+        code: 'agent_session_ownership_unknown',
+        message: 'The provider-exit terminal journal settlement is still pending; retry attach.'
+      })
     }
     const eventSink = context.runtimeState.eventSinkFor(sessionId)
     const attached = await performAttach({
@@ -71,7 +81,10 @@ export function attachStructuredAgentSession(
       callerKey,
       params,
       now: () => context.now(),
-      onAttachFailed: () => {
+      // Site 9: this closes the PRIOR map entry it drops, never the provisional
+      // journal — it has no reference to that one. `onAttached` owns that.
+      onAttachFailed: async () => {
+        await context.sessions.get(sessionId)?.journal.close()
         context.sessions.delete(sessionId)
         eventSink.close()
         context.runtimeState.discardEventSink(sessionId)
@@ -80,14 +93,27 @@ export function attachStructuredAgentSession(
         const fence = context.deps.store.getRecord(sessionId)?.lease.runtimeFence ?? 0
         const previous = context.sessions.get(sessionId)
         const previousFence = previous?.fence
-        eventSink.bind({
-          journal: attached.journal,
-          fence,
-          publish: () => context.subscribers.publish(sessionId, attached.journal)
-        })
-        const barrier = await eventSink.drained()
-        if (!barrier.ok) {
-          throw barrier.error
+        // Site 8: the provisional journal has no owner until the map takes it,
+        // and the barrier below throws by design.
+        try {
+          await bindAndDrain(eventSink, attached.journal, fence, () =>
+            context.subscribers.publish(sessionId, attached.journal)
+          )
+        } catch (error) {
+          await agentSessionJournalCloseRetries.closeOrRetain(attached.journal)
+          throw error
+        }
+        // Site 10: a `set` over a live entry would orphan its handle — and a
+        // close that REJECTED did not release it. The replacement is therefore
+        // ABORTED rather than completed over a handle nothing can reach again:
+        // `previous` stays indexed, so teardown still owns it and can retry.
+        if (previous && previous.journal !== attached.journal) {
+          try {
+            await previous.journal.close()
+          } catch (error) {
+            await agentSessionJournalCloseRetries.closeOrRetain(attached.journal)
+            throw error
+          }
         }
         context.sessions.set(sessionId, {
           journal: attached.journal,
@@ -115,3 +141,18 @@ export function attachStructuredAgentSession(
   })
   return context.tasks.trackAttach(attaching)
 }
+
+/** Binds the sink to the journal and waits for the barrier the host publishes
+ *  behind. It throws by design when a sink barrier fails. */
+async function bindAndDrain(
+  eventSink: DeferredStructuredAgentSessionEventSink,
+  journal: AgentSessionJournal,
+  fence: number,
+  publish: () => void
+): Promise<void> {
+  eventSink.bind({ journal, fence, publish })
+  const barrier = await eventSink.drained()
+  if (!barrier.ok) {
+    throw barrier.error
+  }
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-attach.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-attach.ts
index cfdbf786e14..ce58e31b4ee 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-attach.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-attach.ts
@@ -5,7 +5,6 @@
 // the record store's compare-and-swap, which also owns the idempotency row, so
 // a retried attach replays instead of reserving a second owner.
 
-import type { AgentType } from '../../../shared/agent-status-types'
 import type {
   AgentSessionJournalIdentity,
   AgentSessionProviderHandle
@@ -32,6 +31,7 @@ import {
 } from '../../../shared/agent-session-mutation-envelope'
 import type { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
 import { agentSessionProviderHandleChainHead } from '../../../shared/agent-session-provider-handle'
+import { agentSessionJournalCloseRetries } from '../agent-session-journal/journal-close-retry'
 import { journalDirectoryFor } from '../agent-session-journal/journal-paths'
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
 import {
@@ -51,7 +51,7 @@ export type AgentSessionAttachParams = {
   envelope: AgentSessionMutationEnvelope
   location: AgentSessionExecutionLocation
   provider: AgentSessionHandleProvider
-  agent: AgentType
+  agent: AgentSessionHandleProvider
   accountHome: AgentSessionAccountHome
   runtimeKind: AgentSessionOwnerRuntimeKind
   /** Omitted only for create-by-intent; the adapter proves the durable handle. */
@@ -162,9 +162,18 @@ export async function attachJournal(input: {
     fence,
     historyFilePath
   })
-  return {
-    ...opened,
-    unconfirmedClientMessageIds: await opened.journal.markPendingSubmissionsUnknown(fence)
+  try {
+    // That await is a WRITE. A failure in it leaves the journal with no caller
+    // holding a reference to close it.
+    return {
+      ...opened,
+      unconfirmedClientMessageIds: await opened.journal.markPendingSubmissionsUnknown(fence)
+    }
+  } catch (error) {
+    // A rejected close leaves the handle open, so the journal is retained for a
+    // later retry rather than dropped along with the only reference to it.
+    await agentSessionJournalCloseRetries.closeOrRetain(opened.journal)
+    throw error
   }
 }
 
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-background-task-channel.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-background-task-channel.ts
new file mode 100644
index 00000000000..4592dea26e9
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-background-task-channel.ts
@@ -0,0 +1,62 @@
+import type {
+  AgentSessionBackgroundTaskState,
+  AgentSessionHistoryRequest,
+  AgentSessionHistoryResult
+} from '../../../shared/agent-session-wire'
+import { readStructuredAgentSessionHistoryResult } from './structured-agent-session-history-result'
+import type {
+  AgentSessionSubscribers,
+  AgentSessionSubscribeInput
+} from './structured-agent-session-subscribers'
+import type {
+  StructuredAgentSessionHostDeps,
+  StructuredAgentSessionHostSession
+} from './structured-agent-session-host-types'
+
+export class StructuredAgentSessionBackgroundTaskChannel {
+  constructor(
+    private readonly deps: StructuredAgentSessionHostDeps,
+    private readonly sessions: Map<string, StructuredAgentSessionHostSession>,
+    private readonly subscribers: AgentSessionSubscribers,
+    private readonly requireSession: (sessionId: string) => StructuredAgentSessionHostSession,
+    private readonly handoffStatus: (
+      sessionId: string
+    ) => Parameters<AgentSessionSubscribers['open']>[0]['handoff']
+  ) {}
+
+  history(request: AgentSessionHistoryRequest): AgentSessionHistoryResult {
+    const result = readStructuredAgentSessionHistoryResult({
+      journal: this.requireSession(request.sessionId).journal,
+      record: this.deps.store.getRecord(request.sessionId),
+      request
+    })
+    const backgroundTasks = this.state(request.sessionId)
+    return backgroundTasks === undefined
+      ? result
+      : { ...result, page: { ...result.page, backgroundTasks } }
+  }
+
+  subscribe(input: AgentSessionSubscribeInput): () => void {
+    const session = this.requireSession(input.sessionId)
+    const backgroundTasks = this.state(input.sessionId)
+    return this.subscribers.open({
+      ...input,
+      journal: session.journal,
+      fence: this.deps.store.getRecord(input.sessionId)?.lease.runtimeFence ?? 0,
+      handoff: this.handoffStatus(input.sessionId),
+      ...(backgroundTasks !== undefined ? { backgroundTasks } : {})
+    })
+  }
+
+  publish(sessionId: string, publishedState?: AgentSessionBackgroundTaskState | null): void {
+    const session = this.sessions.get(sessionId)
+    const state = publishedState !== undefined ? publishedState : this.state(sessionId)
+    if (session && state !== undefined) {
+      this.subscribers.backgroundTasks(sessionId, state, session.fence)
+    }
+  }
+
+  private state(sessionId: string): AgentSessionBackgroundTaskState | null | undefined {
+    return this.deps.adapter.backgroundTaskState?.(sessionId)
+  }
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-claude-options-round-trip.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-claude-options-round-trip.test.ts
new file mode 100644
index 00000000000..87bc33bc4b9
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-claude-options-round-trip.test.ts
@@ -0,0 +1,182 @@
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi, type Mock } from 'vitest'
+import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
+import type {
+  AgentSessionHandoffDirection,
+  AgentSessionHandoffRequest,
+  AgentSessionMutationEnvelope
+} from '../../../shared/agent-session-wire'
+import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
+import { StructuredAgentSessionHost } from './structured-agent-session-host'
+import {
+  HOST_TEST_NOW as NOW,
+  HOST_TEST_SESSION as SESSION,
+  hostTestAttachParams,
+  hostTestOperationId,
+  resetHostTestOperationIds
+} from './structured-agent-session-host-test-data'
+import type {
+  StructuredAgentSessionHandoffTransport,
+  StructuredTuiOwner
+} from './structured-agent-session-handoff-types'
+
+const CALLER = { callerKey: 'client-claude' }
+const CLAUDE_SESSION = '019fd532-7c11-7a90-b6de-4e1a2c3d5f61'
+const DEFAULT_MODEL = 'sonnet'
+const PICKED_MODEL = 'opus'
+
+let root: string
+let store: AgentSessionRecordStore
+let host: StructuredAgentSessionHost
+let acquire: Mock<StructuredAgentSessionAdapter['acquire']>
+let activeModel: string
+let transcriptPath: string
+
+function envelope(method: string, fields: Record<string, unknown>): AgentSessionMutationEnvelope {
+  return {
+    sessionId: SESSION,
+    clientOperationId: hostTestOperationId(),
+    expectedRuntimeFence: store.getRecord(SESSION)?.lease.runtimeFence ?? null,
+    payloadFingerprint: computeAgentSessionPayloadFingerprint({
+      method,
+      sessionId: SESSION,
+      fields
+    })
+  }
+}
+
+function handoff(direction: AgentSessionHandoffDirection): AgentSessionHandoffRequest {
+  const fields = { direction, mode: 'now' as const, action: 'start' as const }
+  return { envelope: envelope('agentSession.requestHandoff', fields), ...fields }
+}
+
+function owner(fence: number, spawnToken: string): StructuredTuiOwner {
+  return {
+    terminal: {
+      handle: 'term-claude',
+      tabId: 'tab-claude',
+      paneKey: 'pane-claude',
+      ptyId: 'pty-claude'
+    },
+    process: { hostId: 'local', pid: 5200, processStartTimeMs: NOW, spawnToken },
+    link: {
+      linkId: `claude-tui-${fence}`,
+      handle: { provider: 'claude', sessionId: CLAUDE_SESSION, leafUuid: 'tui-leaf' },
+      origin: 'resumed',
+      mintedAtFence: fence,
+      observedAt: NOW
+    },
+    transcriptPath
+  }
+}
+
+function transport(): StructuredAgentSessionHandoffTransport {
+  return {
+    hostLabel: 'Test host',
+    launchTui: async ({ fence, spawnToken }) => owner(fence, spawnToken),
+    reproveTuiOwner: async ({ owner: current }) => current,
+    recoverTuiOwner: async (record) =>
+      owner(
+        record.lease.runtimeFence,
+        record.lease.ownerProcess?.spawnToken ?? record.lease.reservedSpawnToken ?? 'recovered'
+      ),
+    stopRecoveredOwner: async () => undefined,
+    waitForTuiExit: async (current) => ({ transcriptPath: current.transcriptPath }),
+    waitForTuiIdleOrExit: async () => 'idle',
+    tuiStatus: () => 'idle'
+  }
+}
+
+function adapter(): StructuredAgentSessionAdapter {
+  acquire = vi.fn(async ({ fence, spawnToken, options }) => {
+    activeModel = options?.model ?? DEFAULT_MODEL
+    return {
+      process: { hostId: 'local', pid: 4200, processStartTimeMs: NOW, spawnToken },
+      link: {
+        linkId: `claude-native-${fence}`,
+        handle: { provider: 'claude', sessionId: CLAUDE_SESSION, leafUuid: 'native-leaf' },
+        origin: acquire.mock.calls.length === 1 ? 'created' : 'resumed',
+        mintedAtFence: fence,
+        observedAt: NOW
+      }
+    }
+  })
+  return {
+    acquire,
+    dispatch: vi.fn(),
+    cancelTurn: vi.fn(async () => ({ cancelled: true })),
+    answerPrompt: vi.fn(async () => undefined),
+    setOption: vi.fn(async ({ value }) => {
+      activeModel = value
+      return { model: value }
+    }),
+    readOptions: vi.fn(async () => ({ current: { model: activeModel }, models: [] })),
+    closeSession: vi.fn(async () => {
+      activeModel = DEFAULT_MODEL
+      return true
+    })
+  }
+}
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-claude-handoff-options-'))
+  resetHostTestOperationIds()
+  activeModel = DEFAULT_MODEL
+  transcriptPath = join(root, 'claude.jsonl')
+  await writeFile(transcriptPath, '', 'utf8')
+  store = await AgentSessionRecordStore.open({ directory: join(root, 'store'), hostId: 'local' })
+  host = new StructuredAgentSessionHost({
+    store,
+    adapter: adapter(),
+    journalRoot: root,
+    claimKeyId: 'key-1',
+    mintSpawnToken: () => 'spawn-claude',
+    handoffTransport: transport(),
+    now: () => NOW
+  })
+  expect(
+    await host.attach(
+      CALLER,
+      hostTestAttachParams(null, {
+        provider: 'claude',
+        agent: 'claude',
+        accountHome: { variable: 'CLAUDE_CONFIG_DIR', path: join(root, 'claude-home') },
+        providerHandle: { kind: 'claude', sessionId: CLAUDE_SESSION, leafUuid: 'native-leaf' }
+      })
+    )
+  ).toMatchObject({ ok: true })
+})
+
+afterEach(async () => {
+  await new Promise((resolve) => setTimeout(resolve, 100))
+  await host.flushAllStreamedEvents()
+  await rm(root, { recursive: true, force: true, maxRetries: 3, retryDelay: 50 })
+})
+
+describe('Claude structured session handoff options', () => {
+  it('keeps a directly selected model through chat to TUI to chat', async () => {
+    const fields = { key: 'model', value: PICKED_MODEL }
+    expect(
+      await host.setOption(CALLER, {
+        envelope: envelope('agentSession.setOption', fields),
+        ...fields
+      })
+    ).toMatchObject({ ok: true, value: { options: { model: PICKED_MODEL } } })
+
+    expect(await host.requestHandoff(CALLER, handoff('to-tui'))).toMatchObject({ ok: true })
+    await vi.waitFor(async () =>
+      expect(await host.handoffStatus(SESSION)).toMatchObject({ owner: 'tui' })
+    )
+    expect(await host.requestHandoff(CALLER, handoff('to-native'))).toMatchObject({ ok: true })
+    await vi.waitFor(async () =>
+      expect(await host.handoffStatus(SESSION)).toMatchObject({ owner: 'native' })
+    )
+
+    expect(acquire.mock.calls[1]?.[0].options).toEqual({ model: PICKED_MODEL })
+    expect(store.getRecord(SESSION)?.options).toEqual({ model: PICKED_MODEL })
+    expect(activeModel).toBe(PICKED_MODEL)
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-close-retry.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-close-retry.test.ts
new file mode 100644
index 00000000000..a4666b4f045
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-close-retry.test.ts
@@ -0,0 +1,257 @@
+// A close that REJECTED did not release the handle.
+//
+// `AgentSessionJournal.close()` is retryable by design: the release step is
+// unguarded precisely so a second call is a second attempt. Callers that did
+// `close().catch(() => undefined)` and then threw or overwrote their map entry
+// turned that retryable failure into a permanent orphan — on POSIX a silent
+// leak, on Windows a handle that blocks renaming or removing the directory.
+//
+// These drive the REAL callers: the attach orchestration's `onAttached`, and
+// host teardown, which is what runtime stop calls. Only the lease/record
+// machinery around them is stubbed.
+
+import { access, mkdtemp, rename, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { AgentSessionJournalIdentity } from '../../../shared/agent-session-journal-types'
+import {
+  agentSessionJournalCloseRetries,
+  JournalCloseRetryRegistry
+} from '../agent-session-journal/journal-close-retry'
+import { journalDatabaseFile } from '../agent-session-journal/journal-paths'
+import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
+import { createTrackedJournalOpener } from '../agent-session-journal/journal-store-test-open'
+import { attachStructuredAgentSession } from './structured-agent-session-attach-orchestration'
+import type { StructuredAgentSessionAttachContext } from './structured-agent-session-attach-context'
+import { tearDownStructuredAgentSessionHost } from './structured-agent-session-host-teardown'
+import type { StructuredAgentSessionHostSession } from './structured-agent-session-host-types'
+
+const attachFlow = vi.hoisted(() => ({
+  journal: null as AgentSessionJournal | null
+}))
+
+// The lease reservation, the record store and the provider child are not what
+// these cases are about; `onAttached` is, and it is the real one.
+vi.mock('./structured-agent-session-attach-flow', () => ({
+  performAttach: async (input: {
+    onAttached: (
+      attached: { journal: AgentSessionJournal; recovery: null },
+      generation: string | null
+    ) => Promise<void>
+  }) => {
+    await input.onAttached({ journal: attachFlow.journal!, recovery: null }, null)
+    return { ok: true, value: {} }
+  }
+}))
+
+const SESSION = '019fd532-7c11-7a90-b6de-4e1a2c3d5f60'
+
+const IDENTITY: AgentSessionJournalIdentity = {
+  sessionId: SESSION,
+  workspaceId: 'ws-1',
+  hostId: 'host-1',
+  agent: 'codex',
+  providerHandle: { kind: 'codex', threadId: SESSION }
+}
+
+let root: string
+const journals = createTrackedJournalOpener()
+
+async function exists(path: string): Promise<boolean> {
+  return access(path)
+    .then(() => true)
+    .catch(() => false)
+}
+
+async function expectNothingHoldsTheDirectory(directory: string): Promise<void> {
+  const dbPath = journalDatabaseFile(directory)
+  expect(await exists(`${dbPath}-wal`)).toBe(false)
+  expect(await exists(`${dbPath}-shm`)).toBe(false)
+  // The half that actually fails on Windows when a handle is still open.
+  const moved = `${directory}-moved`
+  await rename(directory, moved)
+  await rm(moved, { recursive: true })
+}
+
+function hostSession(journal: AgentSessionJournal): StructuredAgentSessionHostSession {
+  return {
+    journal,
+    params: {} as StructuredAgentSessionHostSession['params'],
+    fence: 1,
+    hasProviderChild: false,
+    acquisitionGeneration: null
+  }
+}
+
+/** A journal whose close rejects until `failures` is exhausted, wrapping a real
+ *  store so the handle it holds is a real one. */
+function flakyClose(journal: AgentSessionJournal, failures: number): AgentSessionJournal {
+  let remaining = failures
+  return new Proxy(journal, {
+    get(target, property, receiver) {
+      if (property !== 'close') {
+        return Reflect.get(target, property, receiver)
+      }
+      return async () => {
+        if (remaining > 0) {
+          remaining -= 1
+          throw new Error('close rejected')
+        }
+        await target.close()
+      }
+    }
+  })
+}
+
+function attachContext(
+  sessions: Map<string, StructuredAgentSessionHostSession>
+): StructuredAgentSessionAttachContext {
+  const eventSink = {
+    sink: {},
+    drained: async () => ({ ok: true }) as const,
+    unbind: () => undefined,
+    bind: () => undefined,
+    close: () => undefined
+  }
+  return {
+    deps: { store: { getRecord: () => null }, claimKeyId: 'key-1', journalRoot: root },
+    runtimeState: {
+      resolveRecovery: async () => undefined,
+      eventSinkFor: () => eventSink,
+      probeOwner: async () => ({ outcome: 'pid-absent' }),
+      discardEventSink: () => undefined
+    },
+    sessions,
+    subscribers: {
+      reset: () => undefined,
+      snapshot: () => undefined,
+      publish: () => undefined
+    },
+    tasks: { trackAttach: <T>(task: Promise<T>) => task },
+    reconcileLeases: async () => null,
+    serialize: <T>(_sessionId: string, task: () => Promise<T>) => task(),
+    now: () => 1
+  } as unknown as StructuredAgentSessionAttachContext
+}
+
+const attachParams = {
+  envelope: { sessionId: SESSION, clientOperationId: 'op-1' }
+} as unknown as Parameters<typeof attachStructuredAgentSession>[2]
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-close-retry-'))
+  // The registry is process-wide; drain it so one case cannot see another's.
+  await agentSessionJournalCloseRetries.retryAll()
+})
+
+afterEach(async () => {
+  await agentSessionJournalCloseRetries.retryAll()
+  await journals.closeAll()
+  await rm(root, { recursive: true, force: true })
+})
+
+describe('the registry', () => {
+  it('retains a journal whose close rejected and releases it on the retry', async () => {
+    const directory = join(root, 'retained')
+    const registry = new JournalCloseRetryRegistry()
+    const journal = flakyClose(
+      await journals.open({ identity: IDENTITY, journalDir: directory }),
+      1
+    )
+
+    const first = await registry.closeOrRetain(journal)
+    expect(first.closed).toBe(false)
+    expect(registry.pendingDirectories).toEqual([directory])
+
+    expect(await registry.retryAll()).toEqual([])
+    expect(registry.pendingDirectories).toEqual([])
+    await expectNothingHoldsTheDirectory(directory)
+  })
+})
+
+describe('the attach orchestration', () => {
+  it('ABORTS the map replacement when the previous journal will not close', async () => {
+    const previousDir = join(root, 'previous')
+    const provisionalDir = join(root, 'provisional')
+    const previous = flakyClose(
+      await journals.open({ identity: IDENTITY, journalDir: previousDir }),
+      1
+    )
+    const provisional = await journals.open({
+      identity: IDENTITY,
+      journalDir: provisionalDir
+    })
+    attachFlow.journal = provisional
+    const sessions = new Map([[SESSION, hostSession(previous)]])
+
+    await expect(
+      attachStructuredAgentSession(attachContext(sessions), 'caller-1', attachParams)
+    ).rejects.toThrow('close rejected')
+
+    // The live entry is UNTOUCHED: overwriting it would have left its handle
+    // open with nothing able to reach it again.
+    expect(sessions.get(SESSION)?.journal).toBe(previous)
+    // And the provisional journal is owned by the registry, not orphaned.
+    expect(agentSessionJournalCloseRetries.pendingDirectories).toEqual([])
+    await expectNothingHoldsTheDirectory(provisionalDir)
+  })
+
+  it('retains the provisional journal when its own close rejects on the barrier path', async () => {
+    const provisionalDir = join(root, 'provisional-barrier')
+    const provisional = flakyClose(
+      await journals.open({ identity: IDENTITY, journalDir: provisionalDir }),
+      1
+    )
+    attachFlow.journal = provisional
+    const sessions = new Map<string, StructuredAgentSessionHostSession>()
+    const context = attachContext(sessions)
+    const failing = {
+      sink: {},
+      drained: async () => ({ ok: false, error: new Error('sink barrier failed') }) as const,
+      unbind: () => undefined,
+      bind: () => undefined,
+      close: () => undefined
+    }
+    context.runtimeState.eventSinkFor = (() =>
+      failing) as unknown as typeof context.runtimeState.eventSinkFor
+
+    await expect(attachStructuredAgentSession(context, 'caller-1', attachParams)).rejects.toThrow(
+      'sink barrier failed'
+    )
+
+    expect(sessions.size).toBe(0)
+    // Retained rather than dropped, so teardown can still release the handle.
+    expect(agentSessionJournalCloseRetries.pendingDirectories).toEqual([provisionalDir])
+  })
+})
+
+describe('teardown, which is what runtime stop calls', () => {
+  it('retries the journals earlier failure paths could not close', async () => {
+    const orphanDir = join(root, 'orphan')
+    const orphan = flakyClose(await journals.open({ identity: IDENTITY, journalDir: orphanDir }), 1)
+    expect((await agentSessionJournalCloseRetries.closeOrRetain(orphan)).closed).toBe(false)
+
+    // The first teardown reports the still-failing close instead of hiding it.
+    await tearDownStructuredAgentSessionHost({ phases: [], sessions: new Map() })
+
+    expect(agentSessionJournalCloseRetries.pendingDirectories).toEqual([])
+    await expectNothingHoldsTheDirectory(orphanDir)
+  })
+
+  it('surfaces a retained close that still rejects, and keeps it for the next stop', async () => {
+    const orphanDir = join(root, 'stubborn')
+    const orphan = flakyClose(await journals.open({ identity: IDENTITY, journalDir: orphanDir }), 2)
+    await agentSessionJournalCloseRetries.closeOrRetain(orphan)
+
+    await expect(
+      tearDownStructuredAgentSessionHost({ phases: [], sessions: new Map() })
+    ).rejects.toMatchObject({ errors: [expect.objectContaining({ message: 'close rejected' })] })
+    expect(agentSessionJournalCloseRetries.pendingDirectories).toEqual([orphanDir])
+
+    // A later stop is a real retry, not a no-op.
+    await tearDownStructuredAgentSessionHost({ phases: [], sessions: new Map() })
+    expect(agentSessionJournalCloseRetries.pendingDirectories).toEqual([])
+    await expectNothingHoldsTheDirectory(orphanDir)
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-event-sink-estimate.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-event-sink-estimate.ts
index 4aed742f51d..e16f6a63c9d 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-event-sink-estimate.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-event-sink-estimate.ts
@@ -2,16 +2,10 @@ import type {
   AgentJournalItemBody,
   AgentJournalItemIdentity
 } from '../../../shared/agent-session-journal-types'
-import type { StructuredAgentSessionJournalBlob } from './structured-agent-session-event-sink'
 
 export function estimateStructuredAgentSessionItemBytes(
   identity: AgentJournalItemIdentity,
-  body: AgentJournalItemBody,
-  blobs: readonly StructuredAgentSessionJournalBlob[]
+  body: AgentJournalItemBody
 ): number {
-  return (
-    Buffer.byteLength(JSON.stringify({ identity, body }), 'utf8') +
-    blobs.reduce((total, blob) => total + Buffer.byteLength(blob.payload, 'utf8'), 0) +
-    512
-  )
+  return Buffer.byteLength(JSON.stringify({ identity, body }), 'utf8') + 512
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-event-sink.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-event-sink.test.ts
index 6befa3b0b62..c97161ce3dd 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-event-sink.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-event-sink.test.ts
@@ -287,13 +287,13 @@ describe('deferred structured agent-session event sink', () => {
     releaseSecond?.()
   })
 
-  it('replaces a queued same-item checkpoint before any blob is created', async () => {
+  it('replaces a queued same-item checkpoint before it runs', async () => {
     const log: Recorded[] = []
     const deferred = createDeferredStructuredAgentSessionEventSink()
     const options = { coalescingKey: 'checkpoint:item-1' }
 
-    deferred.sink.appendItem(identity(0), BODY, [], options)
-    deferred.sink.appendItem(identity(1), BODY, [], options)
+    deferred.sink.appendItem(identity(0), BODY, options)
+    deferred.sink.appendItem(identity(1), BODY, options)
     expect(deferred.state().queuedOperations).toBe(1)
 
     deferred.bind(target(6, log))
@@ -306,9 +306,9 @@ describe('deferred structured agent-session event sink', () => {
     const deferred = createDeferredStructuredAgentSessionEventSink()
     const options = { coalescingKey: 'checkpoint:item-1' }
 
-    deferred.sink.appendItem(identity(0), BODY, [], options)
+    deferred.sink.appendItem(identity(0), BODY, options)
     deferred.sink.appendItem(identity(1), BODY)
-    deferred.sink.appendItem(identity(2), BODY, [], options)
+    deferred.sink.appendItem(identity(2), BODY, options)
     deferred.bind(target(6, log))
     await deferred.drained()
 
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-event-sink.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-event-sink.ts
index e0d91f93b71..7e0192f179c 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-event-sink.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-event-sink.ts
@@ -8,8 +8,6 @@ import type { JournalLifecycleMutationInput } from '../agent-session-journal/jou
 import { estimateStructuredAgentSessionItemBytes } from './structured-agent-session-event-sink-estimate'
 import { StructuredAgentSessionSinkQueue } from './structured-agent-session-event-sink-queue'
 
-export type StructuredAgentSessionJournalBlob = { digest: string; payload: string }
-
 export type StructuredAgentSessionSinkAdmission =
   | { accepted: true }
   | { accepted: false; reason: 'backpressure' | 'failed' | 'closed' }
@@ -24,7 +22,7 @@ export type StructuredAgentSessionSinkState = {
 export type StructuredAgentSessionSinkBarrier = { ok: true } | { ok: false; error: unknown }
 
 export type StructuredAgentSessionAppendOptions = {
-  /** Pending checkpoints with this key replace one another before blob writes. */
+  /** Pending checkpoints with this key replace one another before they run. */
   coalescingKey?: string
   /** Marks a critical lifecycle operation for lifecycle barriers and diagnostics. */
   lifecycle?: boolean
@@ -34,7 +32,6 @@ export type StructuredAgentSessionEventSink = {
   appendItem(
     identity: AgentJournalItemIdentity,
     body: AgentJournalItemBody,
-    blobs?: readonly StructuredAgentSessionJournalBlob[],
     options?: StructuredAgentSessionAppendOptions
   ): void
   appendTombstone(
@@ -49,7 +46,6 @@ export type StructuredAgentSessionEventSink = {
   tryAppendItem?(
     identity: AgentJournalItemIdentity,
     body: AgentJournalItemBody,
-    blobs?: readonly StructuredAgentSessionJournalBlob[],
     options?: StructuredAgentSessionAppendOptions
   ): StructuredAgentSessionSinkAdmission
   appendLifecycleBatch?(
@@ -159,32 +155,22 @@ export function createDeferredStructuredAgentSessionEventSink(
 
   return {
     sink: {
-      appendItem: (identity, body, blobs = [], options = {}) => {
+      appendItem: (identity, body, options = {}) => {
         queue.submit(
           {
-            bytes: estimateStructuredAgentSessionItemBytes(identity, body, blobs),
+            bytes: estimateStructuredAgentSessionItemBytes(identity, body),
             coalescingKey: options.coalescingKey,
-            run: (bound) =>
-              blobs.length > 0 && typeof bound.journal.appendItemWithBlobs === 'function'
-                ? bound.journal.appendItemWithBlobs(identity, body, blobs, {
-                    fence: bound.fence
-                  })
-                : bound.journal.appendItem(identity, body, { fence: bound.fence })
+            run: (bound) => bound.journal.appendItem(identity, body, { fence: bound.fence })
           },
           options
         )
       },
-      tryAppendItem: (identity, body, blobs = [], options = {}) =>
+      tryAppendItem: (identity, body, options = {}) =>
         queue.submit(
           {
-            bytes: estimateStructuredAgentSessionItemBytes(identity, body, blobs),
+            bytes: estimateStructuredAgentSessionItemBytes(identity, body),
             coalescingKey: options.coalescingKey,
-            run: (bound) =>
-              blobs.length > 0 && typeof bound.journal.appendItemWithBlobs === 'function'
-                ? bound.journal.appendItemWithBlobs(identity, body, blobs, {
-                    fence: bound.fence
-                  })
-                : bound.journal.appendItem(identity, body, { fence: bound.fence })
+            run: (bound) => bound.journal.appendItem(identity, body, { fence: bound.fence })
           },
           options
         ),
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-eviction.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-eviction.test.ts
index d1430ac237c..0d2c693c75f 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-eviction.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-eviction.test.ts
@@ -26,7 +26,9 @@ function context(): StructuredAgentSessionEvictionContext & { order: string[] }
         return true
       })
     } as unknown as StructuredAgentSessionEvictionContext['adapter'],
-    forget: vi.fn(() => order.push('forget')),
+    forget: vi.fn(async () => {
+      order.push('forget')
+    }),
     discardSink: vi.fn(() => order.push('discardSink')),
     releaseLease: vi.fn(async () => {
       order.push('releaseLease')
@@ -122,7 +124,7 @@ describe('rows the provider emits while closing', () => {
           return true
         }
       } as never,
-      forget: () => {},
+      forget: async () => {},
       discardSink: () => state.discardEventSink(sessionId),
       releaseLease: async () => {}
     })
@@ -171,7 +173,7 @@ describe('eviction against the real sink cache', () => {
       sessionId,
       eventSink: state.eventSinkFor(sessionId),
       adapter: { closeSession: async () => true } as never,
-      forget: () => {},
+      forget: async () => {},
       discardSink: () => state.discardEventSink(sessionId),
       releaseLease: async () => {}
     })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-eviction.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-eviction.ts
index 5d1bcaf180c..c2591bba567 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-eviction.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-eviction.ts
@@ -25,7 +25,10 @@ export type StructuredAgentSessionEvictionContext = {
   hasProviderChild?: boolean
   eventSink: DeferredStructuredAgentSessionEventSink
   adapter: StructuredAgentSessionAdapter
-  forget: () => void
+  /** Closes the session's journal handle and drops the map entry. Async and
+   *  awaited: `close()` is ordered behind queued writes, and a delete that
+   *  returns while the close is still queued leaves nothing to retry. */
+  forget: () => Promise<void>
   /** Drops the cached sink so a later attach mints a fresh one. */
   discardSink: () => void
   /** Hands the lease back now that this host's child is proven gone. No-ops when the record is
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-grouped-prompt.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-grouped-prompt.test.ts
new file mode 100644
index 00000000000..6082ab074f5
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-grouped-prompt.test.ts
@@ -0,0 +1,166 @@
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi, type Mock } from 'vitest'
+import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
+import type { AgentSessionMutationEnvelope } from '../../../shared/agent-session-wire'
+import { encodeAgentSessionQuestionAnswers } from '../../../shared/agent-session-question-answer'
+import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import { journalDirectoryFor } from '../agent-session-journal/journal-paths'
+import { openAgentSessionJournal } from '../agent-session-journal/journal-store-factory'
+import type {
+  AgentSessionDispatchOutcome,
+  StructuredAgentSessionAdapter
+} from './structured-agent-session-adapter'
+import type { AgentSessionAttachParams } from './structured-agent-session-attach'
+import { StructuredAgentSessionHost } from './structured-agent-session-host'
+import {
+  HOST_TEST_NOW as NOW,
+  HOST_TEST_SESSION as SESSION,
+  HOST_TEST_THREAD as THREAD,
+  hostTestAttachParams,
+  hostTestOperationId,
+  resetHostTestOperationIds
+} from './structured-agent-session-host-test-data'
+
+const CALLER = { callerKey: 'client-1' }
+
+function envelope(method: string, fields: Record<string, unknown>): AgentSessionMutationEnvelope {
+  return {
+    sessionId: SESSION,
+    clientOperationId: hostTestOperationId(),
+    expectedRuntimeFence: store.getRecord(SESSION)?.lease.runtimeFence ?? 1,
+    payloadFingerprint: computeAgentSessionPayloadFingerprint({
+      method,
+      sessionId: SESSION,
+      fields
+    })
+  }
+}
+
+const attachParams = (): AgentSessionAttachParams => hostTestAttachParams(null)
+
+let root: string
+let store: AgentSessionRecordStore
+let host: StructuredAgentSessionHost
+let acquire: Mock<StructuredAgentSessionAdapter['acquire']>
+let answerPrompt: Mock<StructuredAgentSessionAdapter['answerPrompt']>
+let ordinal = 0
+
+function adapter(): StructuredAgentSessionAdapter {
+  const dispatch = vi.fn(async (): Promise<AgentSessionDispatchOutcome> => {
+    ordinal += 1
+    return {
+      state: 'accepted',
+      providerIdentity: { provider: 'codex', threadId: THREAD, turnId: 'turn-1', ordinal }
+    }
+  })
+  return {
+    acquire,
+    releaseAcquisition: vi.fn(async () => true),
+    dispatch,
+    cancelTurn: vi.fn(async () => ({ cancelled: true })),
+    answerPrompt,
+    setOption: vi.fn(async () => undefined)
+  }
+}
+
+async function seedGroupedQuestion(): Promise<{ itemId: string; revision: number }> {
+  const journal = await openAgentSessionJournal({
+    identity: {
+      sessionId: SESSION,
+      workspaceId: 'workspace-1',
+      hostId: 'local',
+      agent: 'codex',
+      providerHandle: { kind: 'codex', threadId: THREAD }
+    },
+    journalDir: journalDirectoryFor(root, { workspaceId: 'workspace-1', sessionId: SESSION })
+  })
+  const appended = await journal.appendItem(
+    { provider: 'codex', threadId: THREAD, turnId: 'turn-1', ordinal: 100 },
+    {
+      kind: 'question',
+      question: '2 grouped questions from Claude',
+      options: [],
+      questions: [
+        {
+          id: 'q1',
+          question: 'Targets',
+          multiSelect: true,
+          options: [
+            { id: 'target-web', label: 'Web' },
+            { id: 'target-mobile', label: 'Mobile' }
+          ]
+        },
+        {
+          id: 'q2',
+          question: 'Host',
+          multiSelect: false,
+          options: [],
+          freeTextQuestionId: 'q2'
+        }
+      ],
+      resolution: { state: 'pending', selectedOptionId: null, resolvedBy: null, resolvedAt: null }
+    },
+    { fence: 1 }
+  )
+  return { itemId: appended.itemId, revision: appended.revision }
+}
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-wire-grouped-'))
+  resetHostTestOperationIds()
+  ordinal = 0
+  acquire = vi.fn(async ({ fence }) => ({
+    process: {
+      hostId: 'local',
+      pid: 4242,
+      processStartTimeMs: 1_700_000_000_000,
+      spawnToken: store.getRecord(SESSION)?.lease.reservedSpawnToken ?? 'spawn-a'
+    },
+    link: {
+      linkId: `link-${fence}`,
+      handle: { provider: 'codex', threadId: THREAD },
+      origin: store.getRecord(SESSION)?.providerHandleChain.length ? 'resumed' : 'created',
+      mintedAtFence: fence,
+      observedAt: NOW
+    }
+  }))
+  answerPrompt = vi.fn(async () => undefined)
+  store = await AgentSessionRecordStore.open({ directory: join(root, 'store'), hostId: 'local' })
+  host = new StructuredAgentSessionHost({
+    store,
+    adapter: adapter(),
+    journalRoot: root,
+    claimKeyId: 'key-1',
+    mintSpawnToken: () => 'spawn-a',
+    now: () => NOW
+  })
+})
+
+afterEach(async () => {
+  await host.flushAllStreamedEvents()
+  await rm(root, { recursive: true, force: true })
+})
+
+describe('grouped question admission', () => {
+  it('admits renderer question-group payloads with child ids and multi-select answers', async () => {
+    const prompt = await seedGroupedQuestion()
+    const attached = await host.attach(CALLER, attachParams())
+    expect(attached.ok).toBe(true)
+    const optionId = encodeAgentSessionQuestionAnswers([
+      { questionId: 'q1', optionIds: ['target-web', 'target-mobile'] },
+      { questionId: 'q2', optionIds: [], other: 'SSH host' }
+    ])
+    const fields = { itemId: prompt.itemId, expectedRevision: prompt.revision, optionId }
+    const result = await host.respondToPrompt(CALLER, {
+      envelope: envelope('agentSession.respondTo:question', fields),
+      kind: 'question',
+      ...fields
+    })
+    expect(result).toMatchObject({ ok: true, value: { resolution: { state: 'resolved' } } })
+    expect(answerPrompt).toHaveBeenCalledWith(
+      expect.objectContaining({ itemId: prompt.itemId, optionId })
+    )
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-admission.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-admission.ts
new file mode 100644
index 00000000000..b881d55e771
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-admission.ts
@@ -0,0 +1,138 @@
+import type { AgentSessionRecord } from '../../../shared/agent-session-record'
+import type { AgentSessionOperationOutcome } from '../../../shared/agent-session-operation-ledger'
+import type {
+  AgentSessionHandoffRequest,
+  AgentSessionHandoffResult,
+  AgentSessionHandoffStatus,
+  AgentSessionMutationResult,
+  AgentSessionWireRefusal
+} from '../../../shared/agent-session-wire'
+import { AGENT_SESSION_WIRE_REFUSAL_CODES } from '../../../shared/agent-session-wire'
+import {
+  agentSessionFingerprintConflict,
+  computeAgentSessionPayloadFingerprint
+} from '../../../shared/agent-session-mutation-envelope'
+import type { StructuredAgentSessionHandoffOperationGuard } from './structured-agent-session-handoff-operation-guard'
+import type { StructuredAgentSessionHandoffDeps } from './structured-agent-session-handoff-types'
+
+export type StructuredHandoffAdmission =
+  | { decision: 'continue'; record: AgentSessionRecord; fingerprint: string }
+  | { decision: 'replay'; outcome: AgentSessionOperationOutcome }
+  | { decision: 'refused'; refusal: AgentSessionWireRefusal }
+
+export async function admitStructuredHandoffRequest(input: {
+  deps: StructuredAgentSessionHandoffDeps
+  operationGuard: StructuredAgentSessionHandoffOperationGuard
+  callerKey: string
+  params: AgentSessionHandoffRequest
+  record: AgentSessionRecord
+  status?: AgentSessionHandoffStatus
+}): Promise<StructuredHandoffAdmission> {
+  const action = input.params.action ?? 'start'
+  const requestFingerprint = computeAgentSessionPayloadFingerprint({
+    method: 'agentSession.requestHandoff',
+    sessionId: input.record.sessionId,
+    fields: { direction: input.params.direction, mode: input.params.mode, action }
+  })
+  const conflict = agentSessionFingerprintConflict(input.params.envelope, requestFingerprint)
+  if (conflict) {
+    return { decision: 'refused', refusal: conflict }
+  }
+  const fingerprint = computeAgentSessionPayloadFingerprint({
+    method: 'agentSession.requestHandoff.operation',
+    sessionId: input.record.sessionId,
+    fields: { direction: input.params.direction }
+  })
+  const operation = await input.operationGuard.check({
+    callerKey: input.callerKey,
+    sessionId: input.record.sessionId,
+    operationId: input.params.envelope.clientOperationId,
+    fingerprint,
+    action,
+    ...(input.status ? { status: input.status } : {}),
+    now: input.deps.now()
+  })
+  if (operation.decision === 'replay') {
+    return { decision: 'replay', outcome: operation.outcome }
+  }
+  if (operation.decision === 'refused') {
+    return {
+      decision: 'refused',
+      refusal: {
+        code: operation.code as 'agent_session_operation_conflict',
+        message: 'This handoff operation could not be admitted.'
+      }
+    }
+  }
+  if (input.params.envelope.expectedRuntimeFence !== input.record.lease.runtimeFence) {
+    await input.deps.store.recordOperationOutcome({
+      callerKey: input.callerKey,
+      operationId: input.params.envelope.clientOperationId,
+      outcome: { status: 'failed', code: 'agent_session_checkpoint_stale' }
+    })
+    input.operationGuard.finish(input.record.sessionId, input.params.envelope.clientOperationId)
+    return {
+      decision: 'refused',
+      refusal: {
+        code: 'agent_session_checkpoint_stale',
+        message: 'The session owner changed before the handoff request arrived.',
+        currentFence: input.record.lease.runtimeFence
+      }
+    }
+  }
+  return { decision: 'continue', record: input.record, fingerprint }
+}
+
+export function replayedStructuredHandoffRefusal(
+  outcome: AgentSessionOperationOutcome
+): AgentSessionWireRefusal | null {
+  if (
+    outcome.status !== 'failed' ||
+    !AGENT_SESSION_WIRE_REFUSAL_CODES.includes(
+      outcome.code as (typeof AGENT_SESSION_WIRE_REFUSAL_CODES)[number]
+    )
+  ) {
+    return null
+  }
+  return {
+    code: outcome.code as (typeof AGENT_SESSION_WIRE_REFUSAL_CODES)[number],
+    message: 'This handoff request was previously refused.'
+  }
+}
+
+export async function refuseAdmittedStructuredHandoff(input: {
+  deps: StructuredAgentSessionHandoffDeps
+  callerKey: string
+  params: AgentSessionHandoffRequest
+  refusal: AgentSessionWireRefusal
+}): Promise<AgentSessionMutationResult<AgentSessionHandoffResult>> {
+  await input.deps.store.recordOperationOutcome({
+    callerKey: input.callerKey,
+    operationId: input.params.envelope.clientOperationId,
+    outcome: { status: 'failed', code: input.refusal.code }
+  })
+  return { ok: false, refusal: input.refusal }
+}
+
+export function structuredHandoffRetryIsAdmissible(
+  status: AgentSessionHandoffStatus,
+  params: AgentSessionHandoffRequest
+): boolean {
+  return (
+    status.phase === 'failed' &&
+    status.direction === params.direction &&
+    status.operationId === params.envelope.clientOperationId &&
+    status.error?.recoverableOwner !== 'none'
+  )
+}
+
+export function structuredHandoffRetryResumesStoppedOwner(
+  record: AgentSessionRecord,
+  params: AgentSessionHandoffRequest
+): boolean {
+  return (
+    record.lease.claimStatus === 'released' &&
+    record.lease.handoffStage === 'old-owner-stopped' &&
+    record.lease.handoffOperationId === params.envelope.clientOperationId
+  )
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-flow-runner.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-flow-runner.test.ts
new file mode 100644
index 00000000000..20402c8c05e
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-flow-runner.test.ts
@@ -0,0 +1,130 @@
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
+import type { AgentSessionHandoffRequest } from '../../../shared/agent-session-wire'
+import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import { openAgentSessionJournal } from '../agent-session-journal/journal-store-factory'
+import { StructuredAgentSessionHandoffFlowRunner } from './structured-agent-session-handoff-flow-runner'
+import { StructuredAgentSessionHandoffOperationGuard } from './structured-agent-session-handoff-operation-guard'
+import type { StructuredAgentSessionHandoffFlowContext } from './structured-agent-session-handoff-types'
+
+const NOW = 1_800_000_000_000
+const SESSION = 'session-flow-runner-outcome-write-failure'
+const THREAD = '019fd532-7c11-7a90-b6de-4e1a2c3d5f61'
+const OPERATION = `${NOW}-00000000000000000000000000000002`
+const roots: string[] = []
+
+afterEach(async () => {
+  await Promise.all(roots.splice(0).map((root) => rm(root, { recursive: true, force: true })))
+})
+
+const fields = { direction: 'to-native' as const, mode: 'now' as const, action: 'retry' as const }
+
+const params: AgentSessionHandoffRequest = {
+  envelope: {
+    sessionId: SESSION,
+    clientOperationId: OPERATION,
+    expectedRuntimeFence: null,
+    payloadFingerprint: computeAgentSessionPayloadFingerprint({
+      method: 'agentSession.requestHandoff',
+      sessionId: SESSION,
+      fields
+    })
+  },
+  ...fields
+}
+
+/** A runner whose scheduled flow always rejects, so every case here exercises the failure path. */
+async function failingFlowRunner(
+  fail: (params: AgentSessionHandoffRequest, error: unknown) => void
+): Promise<{
+  runner: StructuredAgentSessionHandoffFlowRunner
+  store: AgentSessionRecordStore
+  root: string
+}> {
+  const root = await mkdtemp(join(tmpdir(), 'orca-handoff-flow-runner-'))
+  roots.push(root)
+  const store = await AgentSessionRecordStore.open({
+    directory: join(root, 'store'),
+    hostId: 'local'
+  })
+  const journal = await openAgentSessionJournal({
+    identity: {
+      sessionId: SESSION,
+      workspaceId: 'workspace-1',
+      hostId: 'local',
+      agent: 'codex',
+      providerHandle: { kind: 'codex', threadId: THREAD }
+    },
+    journalDir: join(root, 'journal')
+  })
+  const runner = new StructuredAgentSessionHandoffFlowRunner({
+    deps: {
+      store,
+      claimKeyId: 'key-1',
+      session: () => ({ journal, fence: 1 }),
+      suspendNative: async () => ({ state: 'stopped' as const }),
+      acquireNative: async () => {
+        throw new Error('unused')
+      },
+      importTuiHistory: async () => {},
+      publish: () => {},
+      schedule: async () => {
+        throw new Error('scheduling failed')
+      },
+      now: () => NOW
+    },
+    operationGuard: new StructuredAgentSessionHandoffOperationGuard(store),
+    flowContext: (): StructuredAgentSessionHandoffFlowContext => {
+      throw new Error('unreachable: scheduling rejects before the flow needs context')
+    },
+    fail
+  })
+  return { runner, store, root }
+}
+
+describe('structured handoff flow runner outcome-write failure', () => {
+  it('still reports the flow failure when the failed-outcome ledger write throws', async () => {
+    const failures: unknown[] = []
+    const { runner, store, root } = await failingFlowRunner(
+      (_params, error) => void failures.push(error)
+    )
+    // Materialize the store file so its later disappearance reads as corruption, making every
+    // subsequent ledger write reject.
+    await store.admitOperation({
+      callerKey: 'seed',
+      operationId: `${NOW}-00000000000000000000000000000009`,
+      fingerprint: 'seed',
+      now: NOW
+    })
+    await rm(join(root, 'store'), { recursive: true, force: true })
+
+    runner.begin({ callerKey: 'client-1', params, turnId: null, fingerprint: 'fp' })
+    await runner.drain()
+
+    expect(failures).toHaveLength(1)
+    expect((failures[0] as Error).message).toBe('scheduling failed')
+  })
+
+  it('does not leak an unhandled rejection when the failure notification itself throws', async () => {
+    // The host's status publish threw exactly here once eviction had dropped the session.
+    const { runner } = await failingFlowRunner(() => {
+      throw new Error('agent_session_ownership_unknown')
+    })
+    const leaked: unknown[] = []
+    const observe = (reason: unknown): void => void leaked.push(reason)
+    process.on('unhandledRejection', observe)
+    try {
+      runner.begin({ callerKey: 'client-1', params, turnId: null, fingerprint: 'fp' })
+      await runner.drain()
+      // Node reports an orphaned rejection on the tick after it settles.
+      await new Promise<void>((resolve) => setImmediate(resolve))
+    } finally {
+      process.off('unhandledRejection', observe)
+    }
+
+    expect(leaked).toEqual([])
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-flow-runner.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-flow-runner.ts
new file mode 100644
index 00000000000..4259fc61725
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-flow-runner.ts
@@ -0,0 +1,114 @@
+import type { AgentSessionHandoffRequest } from '../../../shared/agent-session-wire'
+import { stopStructuredNativeTurn } from './structured-agent-session-handoff-flow-context'
+import { handoffStructuredSessionToTui } from './structured-agent-session-handoff-forward'
+import type { StructuredAgentSessionHandoffOperationGuard } from './structured-agent-session-handoff-operation-guard'
+import { assertScheduledStructuredHandoffIsAdmissible } from './structured-agent-session-handoff-revalidation'
+import { handoffStructuredSessionToNative } from './structured-agent-session-handoff-reverse'
+import { structuredTuiStatus } from './structured-agent-session-handoff-status'
+import type {
+  StructuredAgentSessionHandoffDeps,
+  StructuredAgentSessionHandoffFlowContext
+} from './structured-agent-session-handoff-types'
+
+export class StructuredAgentSessionHandoffFlowRunner {
+  private readonly active = new Set<Promise<void>>()
+
+  constructor(
+    private readonly input: {
+      deps: StructuredAgentSessionHandoffDeps
+      operationGuard: StructuredAgentSessionHandoffOperationGuard
+      flowContext: () => StructuredAgentSessionHandoffFlowContext
+      fail: (params: AgentSessionHandoffRequest, error: unknown) => void
+    }
+  ) {}
+
+  async drain(): Promise<void> {
+    await Promise.allSettled(this.active)
+  }
+
+  track(task: Promise<void>): void {
+    this.active.add(task)
+    // Settle-only bookkeeping. `.finally` forwards a rejection onto a promise nobody awaits, so a
+    // failure notification that threw escaped as an unhandled rejection even though `drain` — the
+    // one consumer — settles the flow through `allSettled`.
+    const forget = (): void => void this.active.delete(task)
+    void task.then(forget, forget)
+  }
+
+  begin(input: {
+    callerKey: string
+    params: AgentSessionHandoffRequest
+    turnId: string | null
+    fingerprint: string
+    tuiAlreadyExited?: boolean
+  }): void {
+    const { callerKey, params, turnId, fingerprint, tuiAlreadyExited = false } = input
+    const sessionId = params.envelope.sessionId
+    const journalSequence = this.input.deps.session(sessionId).journal.cursor().sequence
+    this.input.operationGuard.start(sessionId, {
+      callerKey,
+      operationId: params.envelope.clientOperationId,
+      fingerprint
+    })
+    const flow = this.run(params, turnId, tuiAlreadyExited, journalSequence)
+      .then(() => {
+        this.input.operationGuard.finish(sessionId, params.envelope.clientOperationId)
+        return this.input.deps.store.recordOperationOutcome({
+          callerKey,
+          operationId: params.envelope.clientOperationId,
+          outcome: { status: 'succeeded', sessionId }
+        })
+      })
+      .catch(async (error) => {
+        try {
+          await this.input.deps.store.recordOperationOutcome({
+            callerKey,
+            operationId: params.envelope.clientOperationId,
+            outcome: { status: 'failed', code: 'agent_session_handoff_failed' }
+          })
+        } catch {
+          // Best-effort: a store write failure must not suppress the client's failure
+          // notification or leak the flow as an unhandled rejection.
+        }
+        this.input.operationGuard.finish(sessionId, params.envelope.clientOperationId)
+        this.input.fail(params, error)
+      })
+      .finally(() => this.input.operationGuard.finish(sessionId, params.envelope.clientOperationId))
+    this.track(flow)
+  }
+
+  private run(
+    params: AgentSessionHandoffRequest,
+    turnId: string | null,
+    tuiAlreadyExited: boolean,
+    journalSequence: number
+  ): Promise<void> {
+    const sessionId = params.envelope.sessionId
+    return this.input.deps.schedule(sessionId, async () => {
+      const context = this.input.flowContext()
+      assertScheduledStructuredHandoffIsAdmissible({
+        record: context.requireRecord(sessionId),
+        journal: this.input.deps.session(sessionId).journal,
+        params,
+        turnId,
+        journalSequence,
+        tuiAlreadyExited,
+        tuiStatus: structuredTuiStatus(context.owner(sessionId), this.input.deps.transport)
+      })
+      if (turnId && params.mode === 'stop-turn') {
+        const stopped = await stopStructuredNativeTurn(this.input.deps, sessionId, turnId)
+        if (!stopped) {
+          throw new Error('The current turn did not acknowledge cancellation.')
+        }
+      }
+      await (params.direction === 'to-tui'
+        ? handoffStructuredSessionToTui(context, params, params.action === 'retry')
+        : handoffStructuredSessionToNative(
+            context,
+            params,
+            params.action === 'retry',
+            tuiAlreadyExited
+          ))
+    })
+  }
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-operation-guard.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-operation-guard.test.ts
new file mode 100644
index 00000000000..7c77806ad91
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-operation-guard.test.ts
@@ -0,0 +1,221 @@
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import {
+  agentSessionLeaseFixture,
+  agentSessionRecordFixture
+} from '../../../shared/agent-session-record.test-fixture'
+import type {
+  AgentSessionHandoffRequest,
+  AgentSessionHandoffStatus
+} from '../../../shared/agent-session-wire'
+import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import { openAgentSessionJournal } from '../agent-session-journal/journal-store-factory'
+import {
+  queuedStructuredHandoffCanBegin,
+  StructuredAgentSessionHandoffQueue
+} from './structured-agent-session-handoff-queue'
+import { StructuredAgentSessionHandoffOperationGuard } from './structured-agent-session-handoff-operation-guard'
+import { assertScheduledStructuredHandoffIsAdmissible } from './structured-agent-session-handoff-revalidation'
+
+const NOW = 1_800_000_000_000
+const SESSION = 'session-alpha-1'
+const OPERATION_A = `${NOW}-00000000000000000000000000000001`
+const OPERATION_B = `${NOW}-00000000000000000000000000000002`
+
+let root: string | null = null
+
+afterEach(async () => {
+  if (root) {
+    await rm(root, { recursive: true, force: true })
+    root = null
+  }
+})
+
+async function createGuard() {
+  root = await mkdtemp(join(tmpdir(), 'orca-handoff-operation-guard-'))
+  const store = await AgentSessionRecordStore.open({ directory: root, hostId: 'local' })
+  return { guard: new StructuredAgentSessionHandoffOperationGuard(store), store }
+}
+
+function status(phase: 'switching' | 'queued' | 'idle'): AgentSessionHandoffStatus {
+  return {
+    owner: phase === 'idle' ? 'native' : 'none',
+    direction: phase === 'idle' ? null : 'to-tui',
+    phase,
+    stage: phase === 'switching' ? 'preparing' : null,
+    operationId: phase === 'idle' ? null : OPERATION_A
+  }
+}
+
+describe('structured handoff operation ownership', () => {
+  it('reserves one winner across concurrent admissions', async () => {
+    const { guard } = await createGuard()
+    const check = (operationId: string) =>
+      guard.check({
+        callerKey: operationId,
+        sessionId: SESSION,
+        operationId,
+        fingerprint: operationId,
+        action: 'start',
+        now: NOW
+      })
+
+    const decisions = await Promise.all([check(OPERATION_A), check(OPERATION_B)])
+
+    expect(decisions.map(({ decision }) => decision).sort()).toEqual(['new', 'refused'])
+  })
+
+  it.each(['switching', 'queued'] as const)(
+    'durably refuses a distinct operation while the %s operation owns the session',
+    async (phase) => {
+      const { guard } = await createGuard()
+      guard.start(SESSION, {
+        callerKey: 'client-a',
+        operationId: OPERATION_A,
+        fingerprint: 'fingerprint-a'
+      })
+
+      expect(
+        await guard.check({
+          callerKey: 'client-b',
+          sessionId: SESSION,
+          operationId: OPERATION_B,
+          fingerprint: 'fingerprint-b',
+          action: 'start',
+          status: status(phase),
+          now: NOW
+        })
+      ).toEqual({ decision: 'refused', code: 'agent_session_operation_conflict' })
+
+      guard.finish(SESSION, OPERATION_A)
+      expect(
+        await guard.check({
+          callerKey: 'client-b',
+          sessionId: SESSION,
+          operationId: OPERATION_B,
+          fingerprint: 'fingerprint-b',
+          action: 'start',
+          status: status('idle'),
+          now: NOW
+        })
+      ).toMatchObject({
+        decision: 'replay',
+        outcome: { status: 'failed', code: 'agent_session_operation_conflict' }
+      })
+    }
+  )
+
+  it('admits only cancellation beside a queued operation', async () => {
+    const { guard } = await createGuard()
+    guard.start(SESSION, {
+      callerKey: 'client-a',
+      operationId: OPERATION_A,
+      fingerprint: 'fingerprint-a'
+    })
+
+    await expect(
+      guard.check({
+        callerKey: 'client-b',
+        sessionId: SESSION,
+        operationId: OPERATION_B,
+        fingerprint: 'fingerprint-b',
+        action: 'cancel-queued',
+        status: status('queued'),
+        now: NOW
+      })
+    ).resolves.toEqual({ decision: 'new' })
+  })
+})
+
+describe('queued handoff fence revalidation', () => {
+  const params: AgentSessionHandoffRequest = {
+    envelope: {
+      sessionId: SESSION,
+      clientOperationId: OPERATION_A,
+      expectedRuntimeFence: 7,
+      payloadFingerprint: 'fingerprint'
+    },
+    direction: 'to-tui',
+    mode: 'after-turn',
+    action: 'start'
+  }
+  const queued = status('queued')
+
+  it('accepts the same live owner and fence', () => {
+    const record = agentSessionRecordFixture(
+      agentSessionLeaseFixture({ runtimeKind: 'native', ownerProcess: null })
+    )
+    expect(queuedStructuredHandoffCanBegin(record, queued, params)).toBe(true)
+  })
+
+  it.each([
+    agentSessionLeaseFixture({ runtimeKind: 'native', runtimeFence: 8, ownerProcess: null }),
+    agentSessionLeaseFixture({ runtimeKind: 'tui' }),
+    agentSessionLeaseFixture({
+      runtimeKind: 'native',
+      ownerProcess: null,
+      handoffStage: 'preparing'
+    })
+  ])('refuses a changed durable owner or fence', (lease) => {
+    expect(queuedStructuredHandoffCanBegin(agentSessionRecordFixture(lease), queued, params)).toBe(
+      false
+    )
+  })
+
+  it('cannot cancel after the idle waiter claims the queued operation', async () => {
+    const queue = new StructuredAgentSessionHandoffQueue()
+    const ready = vi.fn()
+    queue.enqueue(SESSION, () => true, ready)
+    await vi.waitFor(() => expect(ready).toHaveBeenCalledOnce())
+    expect(queue.cancel(SESSION)).toBe(false)
+  })
+})
+
+describe('scheduled handoff revalidation', () => {
+  it('refuses a native turn accepted ahead of the scheduled handoff', async () => {
+    root = await mkdtemp(join(tmpdir(), 'orca-handoff-revalidation-'))
+    const journal = await openAgentSessionJournal({
+      identity: {
+        sessionId: SESSION,
+        workspaceId: 'workspace-1',
+        hostId: 'local',
+        agent: 'claude',
+        providerHandle: { kind: 'claude', sessionId: SESSION, leafUuid: null }
+      },
+      journalDir: join(root, 'journal')
+    })
+    const journalSequence = journal.cursor().sequence
+    await journal.appendItem(
+      { provider: 'orca', clientMessageId: 'turn-running' },
+      { kind: 'status', text: 'running', turnLifecycle: { turnId: 'turn-1', state: 'running' } },
+      { fence: 7 }
+    )
+    const params: AgentSessionHandoffRequest = {
+      envelope: {
+        sessionId: SESSION,
+        clientOperationId: OPERATION_A,
+        expectedRuntimeFence: 7,
+        payloadFingerprint: 'fingerprint'
+      },
+      direction: 'to-tui',
+      mode: 'now',
+      action: 'start'
+    }
+
+    expect(() =>
+      assertScheduledStructuredHandoffIsAdmissible({
+        record: agentSessionRecordFixture(
+          agentSessionLeaseFixture({ runtimeKind: 'native', ownerProcess: null })
+        ),
+        journal,
+        params,
+        turnId: null,
+        journalSequence,
+        tuiAlreadyExited: false,
+        tuiStatus: 'busy'
+      })
+    ).toThrow('session changed')
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-operation-guard.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-operation-guard.ts
new file mode 100644
index 00000000000..da8d2eaad3d
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-operation-guard.ts
@@ -0,0 +1,125 @@
+import type { AgentSessionHandoffStatus } from '../../../shared/agent-session-wire'
+import type {
+  AgentSessionOperationOutcome,
+  AgentSessionOperationRefusalCode
+} from '../../../shared/agent-session-operation-ledger'
+import type { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+
+type ActiveOperation = { callerKey: string; operationId: string; fingerprint: string }
+
+export type HandoffOperationDecision =
+  | { decision: 'new' }
+  | { decision: 'replay'; outcome: AgentSessionOperationOutcome }
+  | { decision: 'retry' }
+  | { decision: 'refused'; code: AgentSessionOperationRefusalCode }
+
+export class StructuredAgentSessionHandoffOperationGuard {
+  private readonly activeBySession = new Map<string, ActiveOperation>()
+
+  constructor(private readonly store: AgentSessionRecordStore) {}
+
+  async check(input: {
+    callerKey: string
+    sessionId: string
+    operationId: string
+    fingerprint: string
+    action: 'start' | 'cancel-queued' | 'retry' | 'recover'
+    status?: AgentSessionHandoffStatus
+    now: number
+  }): Promise<HandoffOperationDecision> {
+    const ledger = await this.store.admitOperation({
+      callerKey: input.callerKey,
+      operationId: input.operationId,
+      fingerprint: input.fingerprint,
+      now: input.now
+    })
+    if (ledger.decision === 'refused') {
+      return { decision: 'refused', code: ledger.code }
+    }
+    const active = this.activeBySession.get(input.sessionId)
+    const queuedCancellation =
+      input.action === 'cancel-queued' &&
+      input.status?.phase === 'queued' &&
+      input.status.operationId === active?.operationId
+    const activeConflict = Boolean(
+      active &&
+      ((active.operationId === input.operationId &&
+        (active.fingerprint !== input.fingerprint || active.callerKey !== input.callerKey)) ||
+        (active.operationId !== input.operationId && !queuedCancellation))
+    )
+    const queuedConflict = Boolean(
+      !active &&
+      input.status?.phase === 'queued' &&
+      input.status.operationId !== input.operationId &&
+      input.action !== 'cancel-queued'
+    )
+    if (activeConflict || queuedConflict) {
+      if (ledger.decision === 'admit') {
+        await this.store.recordOperationOutcome({
+          callerKey: input.callerKey,
+          operationId: input.operationId,
+          outcome: { status: 'failed', code: 'agent_session_operation_conflict' }
+        })
+      }
+      return { decision: 'refused', code: 'agent_session_operation_conflict' }
+    }
+    if (ledger.decision === 'admit') {
+      this.reserve(input)
+      return { decision: 'new' }
+    }
+    if (input.action === 'retry' && ledger.row.outcome.status === 'failed') {
+      await this.store.recordOperationOutcome({
+        callerKey: input.callerKey,
+        operationId: input.operationId,
+        outcome: { status: 'pending' }
+      })
+      this.reserve(input)
+      return { decision: 'retry' }
+    }
+    if (
+      ledger.row.outcome.status === 'pending' &&
+      !active &&
+      input.status?.operationId !== input.operationId
+    ) {
+      this.reserve(input)
+      return { decision: 'new' }
+    }
+    return { decision: 'replay', outcome: ledger.row.outcome }
+  }
+
+  start(sessionId: string, operation: ActiveOperation): void {
+    this.activeBySession.set(sessionId, operation)
+  }
+
+  private reserve(input: {
+    action: 'start' | 'cancel-queued' | 'retry' | 'recover'
+    callerKey: string
+    sessionId: string
+    operationId: string
+    fingerprint: string
+  }): void {
+    if (input.action !== 'cancel-queued') {
+      this.start(input.sessionId, input)
+    }
+  }
+
+  finish(sessionId: string, operationId: string): void {
+    if (this.activeBySession.get(sessionId)?.operationId === operationId) {
+      this.activeBySession.delete(sessionId)
+    }
+  }
+
+  async settle(
+    sessionId: string,
+    operationId: string,
+    outcome: AgentSessionOperationOutcome
+  ): Promise<void> {
+    const active = this.activeBySession.get(sessionId)
+    await this.store.recordOperationOutcome({
+      ...(active?.operationId === operationId ? { callerKey: active.callerKey } : {}),
+      operationId,
+      outcome
+    })
+    this.finish(sessionId, operationId)
+  }
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-options.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-options.test.ts
new file mode 100644
index 00000000000..e5ee4f7ca9b
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-options.test.ts
@@ -0,0 +1,286 @@
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi, type Mock } from 'vitest'
+import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
+import type {
+  AgentSessionHandoffDirection,
+  AgentSessionHandoffRequest,
+  AgentSessionMutationEnvelope
+} from '../../../shared/agent-session-wire'
+import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
+import { AgentSessionOptionRejectedError } from './structured-agent-session-option-error'
+import { StructuredAgentSessionHost } from './structured-agent-session-host'
+import {
+  HOST_TEST_NOW as NOW,
+  HOST_TEST_SESSION as SESSION,
+  HOST_TEST_THREAD as THREAD,
+  hostTestAttachParams,
+  hostTestMessage,
+  hostTestOperationId,
+  resetHostTestOperationIds
+} from './structured-agent-session-host-test-data'
+import type {
+  StructuredAgentSessionHandoffTransport,
+  StructuredTuiOwner
+} from './structured-agent-session-handoff-types'
+
+const CALLER = { callerKey: 'client-1' }
+const DEFAULT_MODEL = 'gpt-default'
+const PICKED_MODEL = 'gpt-picked'
+const PICKED_EFFORT = 'medium'
+
+let root: string
+let store: AgentSessionRecordStore
+let host: StructuredAgentSessionHost
+let acquire: Mock<StructuredAgentSessionAdapter['acquire']>
+let activeModel: string
+let activeEffort: string | null
+let transcriptPath: string
+let optionFailure: Error | null
+const dispatchedModels: string[] = []
+const launchedOptions: (Readonly<Record<string, string>> | undefined)[] = []
+const closedTuiOwners: StructuredTuiOwner[] = []
+
+function envelope(method: string, fields: Record<string, unknown>): AgentSessionMutationEnvelope {
+  return {
+    sessionId: SESSION,
+    clientOperationId: hostTestOperationId(),
+    expectedRuntimeFence: store.getRecord(SESSION)?.lease.runtimeFence ?? null,
+    payloadFingerprint: computeAgentSessionPayloadFingerprint({
+      method,
+      sessionId: SESSION,
+      fields
+    })
+  }
+}
+
+function handoff(direction: AgentSessionHandoffDirection): AgentSessionHandoffRequest {
+  const fields = { direction, mode: 'now' as const, action: 'start' as const }
+  return { envelope: envelope('agentSession.requestHandoff', fields), ...fields }
+}
+
+function tuiOwner(fence: number, spawnToken: string): StructuredTuiOwner {
+  return {
+    terminal: { handle: 'term-tui', tabId: 'tab-tui', paneKey: 'pane-tui', ptyId: 'pty-tui' },
+    process: {
+      hostId: 'local',
+      pid: 5200,
+      processStartTimeMs: NOW,
+      spawnToken
+    },
+    link: {
+      linkId: `tui-link-${fence}`,
+      handle: { provider: 'codex', threadId: THREAD },
+      origin: 'resumed',
+      mintedAtFence: fence,
+      observedAt: NOW
+    },
+    transcriptPath
+  }
+}
+
+function handoffTransport(): StructuredAgentSessionHandoffTransport {
+  return {
+    hostLabel: 'Test host',
+    launchTui: async ({ record, fence, spawnToken }) => {
+      launchedOptions.push(record.options)
+      return tuiOwner(fence, spawnToken)
+    },
+    reproveTuiOwner: async ({ owner }) => owner,
+    recoverTuiOwner: async (record) =>
+      tuiOwner(
+        record.lease.runtimeFence,
+        record.lease.ownerProcess?.spawnToken ?? record.lease.reservedSpawnToken ?? 'recovered'
+      ),
+    stopRecoveredOwner: async () => undefined,
+    closeTuiOwner: async (owner) => {
+      closedTuiOwners.push(owner)
+      return { transcriptPath: owner.transcriptPath }
+    },
+    waitForTuiExit: async (owner) => ({ transcriptPath: owner.transcriptPath }),
+    waitForTuiIdleOrExit: async () => 'idle',
+    tuiStatus: () => 'idle'
+  }
+}
+
+function adapter(): StructuredAgentSessionAdapter {
+  acquire = vi.fn(async ({ fence, spawnToken, options }) => {
+    activeModel = options?.model ?? DEFAULT_MODEL
+    activeEffort = options?.effort ?? null
+    return {
+      process: {
+        hostId: 'local',
+        pid: 4200 + acquire.mock.calls.length,
+        processStartTimeMs: NOW,
+        spawnToken
+      },
+      link: {
+        linkId: `native-link-${fence}`,
+        handle: { provider: 'codex', threadId: THREAD },
+        origin: acquire.mock.calls.length === 1 ? 'created' : 'resumed',
+        mintedAtFence: fence,
+        observedAt: NOW
+      }
+    }
+  })
+  return {
+    acquire,
+    dispatch: vi.fn<StructuredAgentSessionAdapter['dispatch']>(async () => {
+      dispatchedModels.push(activeModel)
+      return {
+        state: 'accepted',
+        providerIdentity: { provider: 'codex', threadId: THREAD, turnId: 'turn-1', ordinal: 1 }
+      }
+    }),
+    cancelTurn: vi.fn(async () => ({ cancelled: true })),
+    answerPrompt: vi.fn(async () => undefined),
+    setOption: vi.fn(async ({ key, value }) => {
+      if (optionFailure) {
+        const error = optionFailure
+        optionFailure = null
+        throw error
+      }
+      if (key === 'model') {
+        activeModel = value
+      } else if (key === 'effort') {
+        activeEffort = value
+      }
+      return {
+        model: activeModel,
+        ...(activeEffort ? { effort: activeEffort } : {})
+      }
+    }),
+    readOptions: vi.fn(async () => ({
+      current: { model: activeModel, ...(activeEffort ? { effort: activeEffort } : {}) },
+      models: []
+    })),
+    closeSession: vi.fn(async () => {
+      activeModel = DEFAULT_MODEL
+      return true
+    })
+  }
+}
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-handoff-options-'))
+  resetHostTestOperationIds()
+  activeModel = DEFAULT_MODEL
+  activeEffort = null
+  optionFailure = null
+  dispatchedModels.length = 0
+  launchedOptions.length = 0
+  closedTuiOwners.length = 0
+  const accountHome = join(root, 'codex-home')
+  const sessionsDir = join(accountHome, 'sessions', '2026', '08', '12')
+  transcriptPath = join(sessionsDir, `rollout-2026-08-12T10-00-00-${THREAD}.jsonl`)
+  await mkdir(sessionsDir, { recursive: true })
+  await writeFile(
+    transcriptPath,
+    `${JSON.stringify({
+      type: 'session_meta',
+      timestamp: '2026-08-12T10:00:00.000Z',
+      payload: { id: THREAD, session_id: THREAD }
+    })}\n`,
+    'utf8'
+  )
+  store = await AgentSessionRecordStore.open({ directory: join(root, 'store'), hostId: 'local' })
+  host = new StructuredAgentSessionHost({
+    store,
+    adapter: adapter(),
+    journalRoot: root,
+    claimKeyId: 'key-1',
+    mintSpawnToken: () => 'spawn-native',
+    handoffTransport: handoffTransport(),
+    now: () => NOW
+  })
+  const attached = await host.attach(
+    CALLER,
+    hostTestAttachParams(null, { accountHome: { variable: 'CODEX_HOME', path: accountHome } })
+  )
+  expect(attached).toMatchObject({ ok: true })
+})
+
+afterEach(async () => {
+  await host.flushAllStreamedEvents()
+  await rm(root, { recursive: true, force: true })
+})
+
+describe('structured session handoff options', () => {
+  it('settles a pre-mutation rejection so a fresh retry can succeed', async () => {
+    optionFailure = new AgentSessionOptionRejectedError('model list unavailable')
+    const fields = { key: 'model', value: PICKED_MODEL }
+    const rejected = {
+      envelope: envelope('agentSession.setOption', fields),
+      ...fields
+    }
+
+    expect(await host.setOption(CALLER, rejected)).toMatchObject({
+      ok: false,
+      refusal: { code: 'agent_session_operation_invalid', message: 'model list unavailable' }
+    })
+    expect(await host.setOption(CALLER, rejected)).toMatchObject({
+      ok: false,
+      refusal: { code: 'agent_session_operation_invalid' }
+    })
+    expect(
+      await host.setOption(CALLER, {
+        envelope: envelope('agentSession.setOption', fields),
+        ...fields
+      })
+    ).toMatchObject({ ok: true, value: { options: { model: PICKED_MODEL } } })
+    expect(store.getRecord(SESSION)?.options).toEqual({ model: PICKED_MODEL })
+  })
+
+  it('keeps a picked model through a native to TUI to native round trip', async () => {
+    const optionFields = { key: 'model', value: PICKED_MODEL }
+    expect(
+      await host.setOption(CALLER, {
+        envelope: envelope('agentSession.setOption', optionFields),
+        ...optionFields
+      })
+    ).toMatchObject({ ok: true })
+    expect(store.getRecord(SESSION)?.options).toEqual({ model: PICKED_MODEL })
+
+    const effortFields = { key: 'effort', value: PICKED_EFFORT }
+    expect(
+      await host.setOption(CALLER, {
+        envelope: envelope('agentSession.setOption', effortFields),
+        ...effortFields
+      })
+    ).toMatchObject({ ok: true })
+    expect(store.getRecord(SESSION)?.options).toEqual({
+      model: PICKED_MODEL,
+      effort: PICKED_EFFORT
+    })
+
+    expect(await host.requestHandoff(CALLER, handoff('to-tui'))).toMatchObject({ ok: true })
+    await vi.waitFor(async () =>
+      expect(await host.handoffStatus(SESSION)).toMatchObject({ owner: 'tui' })
+    )
+    expect(await host.requestHandoff(CALLER, handoff('to-native'))).toMatchObject({ ok: true })
+    await vi.waitFor(async () =>
+      expect(await host.handoffStatus(SESSION)).toMatchObject({ owner: 'native' })
+    )
+
+    expect(launchedOptions).toEqual([{ model: PICKED_MODEL, effort: PICKED_EFFORT }])
+    expect(closedTuiOwners).toHaveLength(1)
+    expect(acquire.mock.calls[1]?.[0].options).toEqual({
+      model: PICKED_MODEL,
+      effort: PICKED_EFFORT
+    })
+    expect(store.getRecord(SESSION)?.options).toEqual({
+      model: PICKED_MODEL,
+      effort: PICKED_EFFORT
+    })
+    const body = hostTestMessage('use the selected model')
+    expect(
+      await host.send(CALLER, {
+        envelope: envelope('agentSession.send', { body }),
+        body
+      })
+    ).toMatchObject({ ok: true })
+    expect(dispatchedModels).toEqual([PICKED_MODEL])
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-options.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-options.ts
new file mode 100644
index 00000000000..a5afd9891a1
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-options.ts
@@ -0,0 +1,23 @@
+import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
+
+export async function readNativeHandoffSessionOptions(input: {
+  adapter: Pick<StructuredAgentSessionAdapter, 'readOptions'>
+  sessionId: string
+  fence: number
+  priorOptions?: Readonly<Record<string, string>>
+}): Promise<Readonly<Record<string, string>> | undefined> {
+  const { adapter, sessionId, fence, priorOptions } = input
+  const reported = await adapter.readOptions?.({
+    sessionId,
+    fence
+  })
+  if (!reported) {
+    return undefined
+  }
+  const { model: _model, effort: _effort, ...restored } = priorOptions ?? {}
+  return {
+    ...restored,
+    model: reported.current.model,
+    ...(reported.current.effort ? { effort: reported.current.effort } : {})
+  }
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-queue-start.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-queue-start.ts
new file mode 100644
index 00000000000..f8d6db2bace
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-queue-start.ts
@@ -0,0 +1,46 @@
+import type { AgentSessionHandoffRequest } from '../../../shared/agent-session-wire'
+import { activeStructuredAgentSessionTurnId } from '../../../shared/structured-agent-session-projection'
+import type { StructuredAgentSessionHandoffQueue } from './structured-agent-session-handoff-queue'
+import type {
+  StructuredAgentSessionHandoffDeps,
+  StructuredTuiOwner
+} from './structured-agent-session-handoff-types'
+
+export function queueStructuredHandoffAfterTurn(input: {
+  callerKey: string
+  params: AgentSessionHandoffRequest
+  deps: StructuredAgentSessionHandoffDeps
+  queue: StructuredAgentSessionHandoffQueue
+  owner: (sessionId: string) => StructuredTuiOwner | undefined
+  setStatus: (
+    sessionId: string,
+    status: Parameters<StructuredAgentSessionHandoffDeps['publish']>[1]
+  ) => void
+  begin: (callerKey: string, params: AgentSessionHandoffRequest, tuiAlreadyExited?: boolean) => void
+}): void {
+  const { callerKey, params, deps, queue, owner, setStatus, begin } = input
+  const sessionId = params.envelope.sessionId
+  let tuiReadiness: 'idle' | 'exited' | null = null
+  setStatus(sessionId, {
+    owner: params.direction === 'to-tui' ? 'native' : 'tui',
+    direction: params.direction,
+    phase: 'queued',
+    stage: null,
+    operationId: params.envelope.clientOperationId,
+    hostLabel: deps.transport?.hostLabel
+  })
+  const tuiOwner = owner(sessionId)
+  queue.enqueue(
+    sessionId,
+    async (signal) => {
+      if (params.direction === 'to-tui') {
+        return !activeStructuredAgentSessionTurnId(deps.session(sessionId).journal.snapshot().items)
+      }
+      tuiReadiness = tuiOwner
+        ? ((await deps.transport?.waitForTuiIdleOrExit(tuiOwner, signal)) ?? null)
+        : null
+      return tuiReadiness !== null
+    },
+    () => begin(callerKey, { ...params, mode: 'now' }, tuiReadiness === 'exited')
+  )
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-queue.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-queue.ts
new file mode 100644
index 00000000000..9ea3d7ff08f
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-queue.ts
@@ -0,0 +1,133 @@
+import type {
+  AgentSessionHandoffRequest,
+  AgentSessionHandoffStatus
+} from '../../../shared/agent-session-wire'
+import type { AgentSessionRecord } from '../../../shared/agent-session-record'
+import { activeStructuredAgentSessionTurnId } from '../../../shared/structured-agent-session-projection'
+import type {
+  StructuredAgentSessionHandoffDeps,
+  StructuredTuiOwner
+} from './structured-agent-session-handoff-types'
+
+export class StructuredAgentSessionHandoffQueue {
+  private readonly controllers = new Map<string, AbortController>()
+
+  cancel(sessionId: string): boolean {
+    const controller = this.controllers.get(sessionId)
+    controller?.abort()
+    this.controllers.delete(sessionId)
+    return controller !== undefined
+  }
+
+  enqueue(
+    sessionId: string,
+    isIdle: (signal: AbortSignal) => boolean | Promise<boolean>,
+    onReady: () => void
+  ): void {
+    this.cancel(sessionId)
+    const controller = new AbortController()
+    this.controllers.set(sessionId, controller)
+    void this.waitUntilIdle(sessionId, controller, isIdle).then((ready) => {
+      if (ready) {
+        onReady()
+      }
+    })
+  }
+
+  private async waitUntilIdle(
+    sessionId: string,
+    controller: AbortController,
+    isIdle: (signal: AbortSignal) => boolean | Promise<boolean>
+  ): Promise<boolean> {
+    while (this.controllers.get(sessionId) === controller && !controller.signal.aborted) {
+      try {
+        if (await isIdle(controller.signal)) {
+          this.controllers.delete(sessionId)
+          return true
+        }
+      } catch {
+        if (controller.signal.aborted) {
+          return false
+        }
+      }
+      await new Promise((resolve) => setTimeout(resolve, 150))
+    }
+    return false
+  }
+}
+
+export function queuedStructuredHandoffCanBegin(
+  record: AgentSessionRecord,
+  status: AgentSessionHandoffStatus,
+  params: AgentSessionHandoffRequest
+): boolean {
+  const expectedOwner = params.direction === 'to-tui' ? 'native' : 'tui'
+  return (
+    record.sessionId === params.envelope.sessionId &&
+    status.phase === 'queued' &&
+    status.direction === params.direction &&
+    status.operationId === params.envelope.clientOperationId &&
+    record.lease.runtimeFence === params.envelope.expectedRuntimeFence &&
+    record.lease.runtimeKind === expectedOwner &&
+    record.lease.claimStatus === 'live' &&
+    record.lease.handoffStage === null &&
+    !record.lease.unreconciled
+  )
+}
+
+export function enqueueStructuredHandoffAfterTurn(input: {
+  deps: StructuredAgentSessionHandoffDeps
+  queue: StructuredAgentSessionHandoffQueue
+  params: AgentSessionHandoffRequest
+  tuiOwner: StructuredTuiOwner | undefined
+  status: () => AgentSessionHandoffStatus
+  requireRecord: () => AgentSessionRecord
+  setStatus: (status: AgentSessionHandoffStatus) => void
+  begin: (params: AgentSessionHandoffRequest, tuiAlreadyExited: boolean) => void
+  refuse: (record: AgentSessionRecord) => void
+}): void {
+  const { deps, params, queue, tuiOwner } = input
+  const sessionId = params.envelope.sessionId
+  let tuiReadiness: 'idle' | 'exited' | null = null
+  let observedTuiQueue = false
+  input.setStatus({
+    owner: params.direction === 'to-tui' ? 'native' : 'tui',
+    direction: params.direction,
+    phase: 'queued',
+    stage: null,
+    operationId: params.envelope.clientOperationId,
+    hostLabel: deps.transport?.hostLabel
+  })
+  queue.enqueue(
+    sessionId,
+    async (signal) => {
+      if (params.direction === 'to-tui') {
+        return !activeStructuredAgentSessionTurnId(deps.session(sessionId).journal.snapshot().items)
+      }
+      if (!observedTuiQueue) {
+        observedTuiQueue = true
+        return false
+      }
+      tuiReadiness = tuiOwner
+        ? ((await deps.transport?.waitForTuiIdleOrExit(tuiOwner, signal)) ?? null)
+        : null
+      if (tuiReadiness === 'exited') {
+        return true
+      }
+      if (!activeStructuredAgentSessionTurnId(deps.session(sessionId).journal.snapshot().items)) {
+        tuiReadiness = 'idle'
+        return true
+      }
+      return false
+    },
+    () => {
+      const record = input.requireRecord()
+      const status = input.status()
+      if (!queuedStructuredHandoffCanBegin(record, status, params)) {
+        input.refuse(record)
+        return
+      }
+      input.begin(params, tuiReadiness === 'exited')
+    }
+  )
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-recover.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-recover.ts
new file mode 100644
index 00000000000..0aab4f0335b
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-recover.ts
@@ -0,0 +1,30 @@
+import type {
+  AgentSessionHandoffRequest,
+  AgentSessionHandoffStatus
+} from '../../../shared/agent-session-wire'
+import {
+  beginStructuredManualRecovery,
+  structuredManualRecoveryIsAdmissible
+} from './structured-agent-session-manual-recovery'
+import type { StructuredAgentSessionHandoffDeps } from './structured-agent-session-handoff-types'
+import type { StructuredAgentSessionHandoffOperationGuard } from './structured-agent-session-handoff-operation-guard'
+import type { AgentSessionRecord } from '../../../shared/agent-session-record'
+
+export async function requestStructuredManualRecovery(input: {
+  deps: StructuredAgentSessionHandoffDeps
+  operationGuard: StructuredAgentSessionHandoffOperationGuard
+  callerKey: string
+  params: AgentSessionHandoffRequest
+  fingerprint: string
+  record: AgentSessionRecord
+  status: AgentSessionHandoffStatus
+  requireRecord: (sessionId: string) => AgentSessionRecord
+  restore: (sessionId: string) => Promise<void>
+  setStatus: (sessionId: string, status: AgentSessionHandoffStatus) => void
+}): Promise<boolean> {
+  if (!structuredManualRecoveryIsAdmissible(input.record, input.status)) {
+    return false
+  }
+  beginStructuredManualRecovery(input)
+  return true
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-result.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-result.ts
new file mode 100644
index 00000000000..fe480d6359c
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-result.ts
@@ -0,0 +1,32 @@
+import type {
+  AgentSessionHandoffResult,
+  AgentSessionMutationResult,
+  AgentSessionWireRefusal
+} from '../../../shared/agent-session-wire'
+import type { StructuredAgentSessionHandoffDeps } from './structured-agent-session-handoff-types'
+
+export function structuredHandoffRefusal(
+  code: AgentSessionWireRefusal['code'],
+  message: string
+): AgentSessionWireRefusal {
+  return { code, message }
+}
+
+export function structuredHandoffSuccess(
+  deps: StructuredAgentSessionHandoffDeps,
+  sessionId: string,
+  replayed: boolean,
+  status: AgentSessionHandoffResult['status']
+): AgentSessionMutationResult<AgentSessionHandoffResult> {
+  const record = deps.store.getRecord(sessionId)
+  if (!record) {
+    throw new Error('agent_session_identity_required')
+  }
+  return {
+    ok: true,
+    replayed,
+    fence: record.lease.runtimeFence,
+    cursor: deps.session(sessionId).journal.cursor(),
+    value: { status }
+  }
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-revalidation.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-revalidation.ts
new file mode 100644
index 00000000000..66005959378
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-revalidation.ts
@@ -0,0 +1,52 @@
+import type { AgentSessionRecord } from '../../../shared/agent-session-record'
+import type { AgentSessionHandoffRequest } from '../../../shared/agent-session-wire'
+import { activeStructuredAgentSessionTurnId } from '../../../shared/structured-agent-session-projection'
+import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
+import { structuredHandoffRetryResumesStoppedOwner } from './structured-agent-session-handoff-admission'
+import { structuredSessionHasPendingPrompt } from './structured-agent-session-handoff-status'
+
+export function assertScheduledStructuredHandoffIsAdmissible(input: {
+  record: AgentSessionRecord
+  journal: AgentSessionJournal
+  params: AgentSessionHandoffRequest
+  turnId: string | null
+  journalSequence: number
+  tuiAlreadyExited: boolean
+  tuiStatus: 'idle' | 'busy'
+}): void {
+  const { params, record } = input
+  if (params.action === 'retry' && structuredHandoffRetryResumesStoppedOwner(record, params)) {
+    return
+  }
+  const expectedOwner = params.direction === 'to-tui' ? 'native' : 'tui'
+  if (
+    record.lease.runtimeFence !== params.envelope.expectedRuntimeFence ||
+    record.lease.runtimeKind !== expectedOwner ||
+    record.lease.claimStatus !== 'live' ||
+    record.lease.handoffStage !== null ||
+    record.lease.unreconciled
+  ) {
+    throw new Error('agent_session_checkpoint_stale')
+  }
+  if (structuredSessionHasPendingPrompt(input.journal)) {
+    throw new Error('Resolve the pending question or approval before switching.')
+  }
+  if (params.mode !== 'stop-turn' && input.journal.cursor().sequence !== input.journalSequence) {
+    throw new Error('The session changed before the handoff started.')
+  }
+  const activeTurn = activeStructuredAgentSessionTurnId(input.journal.snapshot().items)
+  if (params.direction === 'to-tui') {
+    const expectedTurn = params.mode === 'stop-turn' ? input.turnId : null
+    if (activeTurn !== expectedTurn) {
+      throw new Error('The native turn changed before the handoff started.')
+    }
+    return
+  }
+  if (
+    !input.tuiAlreadyExited &&
+    input.tuiStatus !== 'idle' &&
+    (params.mode !== 'after-turn' || activeTurn !== null)
+  ) {
+    throw new Error('The agent terminal became busy before the handoff started.')
+  }
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-reverse.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-reverse.test.ts
new file mode 100644
index 00000000000..91c6163bd17
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-reverse.test.ts
@@ -0,0 +1,100 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { AgentSessionHandoffStatus } from '../../../shared/agent-session-wire'
+import type { AgentSessionRecord } from '../../../shared/agent-session-record'
+import { handoffStructuredSessionToNative } from './structured-agent-session-handoff-reverse'
+import type { StructuredAgentSessionHandoffFlowContext } from './structured-agent-session-handoff-types'
+
+const OPERATION_ID = 'operation-1'
+const SESSION_ID = 'session-1'
+
+vi.mock('../../runtime/agent-session-handoff-record-transitions', () => ({
+  abandonStoredAgentSessionHandoffAttempt: vi.fn(async () => undefined),
+  reserveStoredAgentSessionHandoffOwner: vi.fn(async () => record()),
+  rollbackStoredAgentSessionHandoffPreparation: vi.fn(async () => undefined),
+  stopStoredAgentSessionOwnerForHandoff: vi.fn(async () => record())
+}))
+
+function record(): AgentSessionRecord {
+  return {
+    sessionId: SESSION_ID,
+    provider: 'claude',
+    location: {
+      executionHostId: 'local',
+      wslDistro: null,
+      workspaceId: 'workspace-1',
+      workspaceKind: 'git-worktree'
+    },
+    lease: {
+      runtimeFence: 3,
+      handoffStage: 'old-owner-stopped',
+      handoffOperationId: OPERATION_ID
+    }
+  } as unknown as AgentSessionRecord
+}
+
+function contextWith(
+  revealNativeSession: () => Promise<void>,
+  statuses: AgentSessionHandoffStatus[]
+): StructuredAgentSessionHandoffFlowContext {
+  return {
+    deps: {
+      store: {} as never,
+      claimKeyId: 'key-1',
+      now: () => 1_800_000_000_000,
+      importTuiHistory: vi.fn(async () => undefined),
+      acquireNative: vi.fn(async () => record()),
+      transport: { revealNativeSession }
+    } as never,
+    owner: () => undefined,
+    retainOwner: vi.fn(),
+    releaseOwner: vi.fn(),
+    setStatus: (_sessionId, status) => statuses.push(status),
+    enterPreparing: vi.fn(async () => undefined),
+    publishStage: vi.fn(),
+    requireRecord: () => record()
+  }
+}
+
+// Why this ordering matters: releaseOwner has already run by the time the reveal fires,
+// so a reveal that rejects before the status flip leaves the session released but never
+// marked native — a stuck chat with no owner on either side.
+describe('handoffStructuredSessionToNative', () => {
+  it('marks the session native before revealing it', async () => {
+    const statuses: AgentSessionHandoffStatus[] = []
+    const order: string[] = []
+    const context = contextWith(async () => {
+      order.push('reveal')
+    }, statuses)
+    const setStatus = context.setStatus
+    context.setStatus = (sessionId, status) => {
+      order.push('status')
+      setStatus(sessionId, status)
+    }
+
+    await handoffStructuredSessionToNative(
+      context,
+      { envelope: { sessionId: SESSION_ID, clientOperationId: OPERATION_ID } } as never,
+      true
+    )
+
+    expect(order).toEqual(['status', 'reveal'])
+    expect(statuses.at(-1)).toMatchObject({ owner: 'native', direction: null, phase: 'idle' })
+  })
+
+  it('still leaves the session marked native when the reveal rejects', async () => {
+    const statuses: AgentSessionHandoffStatus[] = []
+    const context = contextWith(async () => {
+      throw new Error('publish failed')
+    }, statuses)
+
+    await expect(
+      handoffStructuredSessionToNative(
+        context,
+        { envelope: { sessionId: SESSION_ID, clientOperationId: OPERATION_ID } } as never,
+        true
+      )
+    ).rejects.toThrow('publish failed')
+
+    expect(statuses.at(-1)).toMatchObject({ owner: 'native' })
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-reverse.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-reverse.ts
index f59f7735245..ebfca81525c 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-reverse.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-reverse.ts
@@ -130,12 +130,8 @@ export async function handoffStructuredSessionToNative(
     throw error
   }
   context.releaseOwner(sessionId)
-  await deps.transport?.revealNativeSession?.({
-    workspaceId: record.location.workspaceId,
-    sessionId,
-    agent: record.provider,
-    ...(owner?.adoptedTerminal ? { adoptedTerminal: true } : {})
-  })
+  // Why status lands before the reveal: the native owner is already proven here, and a
+  // reveal that rejects must not leave the session released but never marked native.
   context.setStatus(sessionId, {
     owner: 'native',
     direction: null,
@@ -143,4 +139,10 @@ export async function handoffStructuredSessionToNative(
     stage: record.lease.handoffStage,
     operationId: record.lease.handoffOperationId
   })
+  await deps.transport?.revealNativeSession?.({
+    workspaceId: record.location.workspaceId,
+    sessionId,
+    agent: record.provider,
+    ...(owner?.adoptedTerminal ? { adoptedTerminal: true } : {})
+  })
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-test-coordinator.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-test-coordinator.ts
new file mode 100644
index 00000000000..e5dd478f719
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-test-coordinator.ts
@@ -0,0 +1,80 @@
+import type { AgentSessionRecord } from '../../../shared/agent-session-record'
+import type { AgentSessionHandoffStatus } from '../../../shared/agent-session-wire'
+import type { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
+import { StructuredAgentSessionHandoffCoordinator } from './structured-agent-session-handoff'
+import type {
+  StructuredAgentSessionHandoffTransport,
+  StructuredTuiOwner
+} from './structured-agent-session-handoff-types'
+
+type TestCoordinatorInput = {
+  store: AgentSessionRecordStore
+  journal: AgentSessionJournal
+  sessionId: string
+  provider: 'claude' | 'codex'
+  claudeSessionId: string
+  codexThreadId: string
+  now: number
+  launchTui: StructuredAgentSessionHandoffTransport['launchTui']
+  reproveTuiOwner: StructuredAgentSessionHandoffTransport['reproveTuiOwner']
+  stopRecoveredOwner: StructuredAgentSessionHandoffTransport['stopRecoveredOwner']
+  closeTuiOwner: NonNullable<StructuredAgentSessionHandoffTransport['closeTuiOwner']>
+  waitForTuiExit: StructuredAgentSessionHandoffTransport['waitForTuiExit']
+  waitForTuiIdleOrExit: StructuredAgentSessionHandoffTransport['waitForTuiIdleOrExit']
+  stopFailedTuiLaunch: NonNullable<StructuredAgentSessionHandoffTransport['stopFailedTuiLaunch']>
+  recoverTuiOwner: (record: AgentSessionRecord) => Promise<StructuredTuiOwner>
+  tuiStatus: () => 'idle' | 'busy'
+  acquireNative: (input: {
+    sessionId: string
+    fence: number
+    spawnToken: string
+  }) => Promise<AgentSessionRecord>
+  acquireNativeStop: (turnId: string) => Promise<boolean>
+  takeImportFailure: () => Error | null
+  statuses: AgentSessionHandoffStatus[]
+}
+
+export function createStructuredAgentSessionHandoffTestCoordinator(
+  input: TestCoordinatorInput
+): StructuredAgentSessionHandoffCoordinator {
+  return new StructuredAgentSessionHandoffCoordinator({
+    store: input.store,
+    claimKeyId: 'key-1',
+    transport: {
+      hostLabel: 'Test host',
+      launchTui: input.launchTui,
+      reproveTuiOwner: input.reproveTuiOwner,
+      recoverTuiOwner: input.recoverTuiOwner,
+      stopRecoveredOwner: input.stopRecoveredOwner,
+      closeTuiOwner: input.closeTuiOwner,
+      waitForTuiExit: input.waitForTuiExit,
+      waitForTuiIdleOrExit: input.waitForTuiIdleOrExit,
+      tuiStatus: input.tuiStatus,
+      stopFailedTuiLaunch: input.stopFailedTuiLaunch
+    },
+    session: () => ({
+      journal: input.journal,
+      fence: input.store.getRecord(input.sessionId)?.lease.runtimeFence ?? 1
+    }),
+    suspendNative: async () => ({ state: 'stopped' as const }),
+    acquireNative: input.acquireNative,
+    acquireNativeStop: (_sessionId, turnId) => input.acquireNativeStop(turnId),
+    importTuiHistory: async ({ fence }) => {
+      const importFailure = input.takeImportFailure()
+      if (importFailure) {
+        throw importFailure
+      }
+      await input.journal.appendItem(
+        input.provider === 'claude'
+          ? { provider: 'claude', sessionId: input.claudeSessionId, uuid: 'tui-turn' }
+          : { provider: 'codex', threadId: input.codexThreadId, turnId: 'tui-turn', ordinal: 0 },
+        { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text: 'from tui' }] },
+        { fence, recovered: true }
+      )
+    },
+    publish: (_sessionId, status) => input.statuses.push(status),
+    schedule: async (_sessionId, task) => task(),
+    now: () => input.now
+  })
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-test-identities.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-test-identities.ts
new file mode 100644
index 00000000000..ca33e486999
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-test-identities.ts
@@ -0,0 +1,40 @@
+export type StructuredHandoffProviderCase = {
+  provider: 'claude' | 'codex'
+  accountHome: { variable: 'CLAUDE_CONFIG_DIR' | 'CODEX_HOME'; pathName: string }
+}
+
+export const STRUCTURED_HANDOFF_PROVIDER_CASES: StructuredHandoffProviderCase[] = [
+  { provider: 'codex', accountHome: { variable: 'CODEX_HOME', pathName: 'codex-home' } },
+  {
+    provider: 'claude',
+    accountHome: { variable: 'CLAUDE_CONFIG_DIR', pathName: 'claude-home' }
+  }
+]
+
+export function structuredHandoffTestProcess(now: number, spawnToken: string, pid: number) {
+  return { hostId: 'local', pid, processStartTimeMs: now - 1_000, spawnToken }
+}
+
+export function structuredHandoffTestLink(input: {
+  provider: 'claude' | 'codex'
+  fence: number
+  id: string
+  now: number
+  claudeSessionId: string
+  codexThreadId: string
+}) {
+  return {
+    linkId: input.id,
+    handle:
+      input.provider === 'claude'
+        ? ({
+            provider: 'claude' as const,
+            sessionId: input.claudeSessionId,
+            leafUuid: input.id.startsWith('native-link') ? 'tui-exit-leaf' : 'current-leaf'
+          } as const)
+        : ({ provider: 'codex' as const, threadId: input.codexThreadId } as const),
+    origin: 'resumed' as const,
+    mintedAtFence: input.fence,
+    observedAt: input.now
+  }
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-test-requests.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-test-requests.ts
new file mode 100644
index 00000000000..550ebded0da
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-handoff-test-requests.ts
@@ -0,0 +1,53 @@
+import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
+import type {
+  AgentSessionHandoffDirection,
+  AgentSessionHandoffAction,
+  AgentSessionHandoffMode,
+  AgentSessionHandoffRequest
+} from '../../../shared/agent-session-wire'
+
+export type StructuredHandoffTestRequestOptions = {
+  action?: AgentSessionHandoffAction
+  operationId?: string
+}
+
+export class StructuredHandoffTestRequests {
+  private operations = 0
+
+  constructor(
+    private readonly now: number,
+    private readonly sessionId: string,
+    private readonly readFence: () => number
+  ) {}
+
+  reset(): void {
+    this.operations = 0
+  }
+
+  operationId(): string {
+    this.operations += 1
+    return `${this.now}-${this.operations.toString(16).padStart(32, '0')}`
+  }
+
+  request(
+    direction: AgentSessionHandoffDirection,
+    mode: AgentSessionHandoffMode,
+    options: StructuredHandoffTestRequestOptions = {}
+  ): AgentSessionHandoffRequest {
+    const action = options.action ?? 'start'
+    const fields = { direction, mode, action }
+    return {
+      envelope: {
+        sessionId: this.sessionId,
+        clientOperationId: options.operationId ?? this.operationId(),
+        expectedRuntimeFence: this.readFence(),
+        payloadFingerprint: computeAgentSessionPayloadFingerprint({
+          method: 'agentSession.requestHandoff',
+          sessionId: this.sessionId,
+          fields
+        })
+      },
+      ...fields
+    }
+  }
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-handoff.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-handoff.test.ts
index e125d3e49ae..f0f410b66aa 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-handoff.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-handoff.test.ts
@@ -12,7 +12,8 @@ import {
   setStoredAgentSessionHandoffStage,
   stopStoredAgentSessionOwnerForHandoff
 } from '../../runtime/agent-session-handoff-record-transitions'
-import { openAgentSessionJournal } from '../agent-session-journal/journal-store-factory'
+import type { openAgentSessionJournal } from '../agent-session-journal/journal-store-factory'
+import { createTrackedJournalOpener } from '../agent-session-journal/journal-store-test-open'
 import { StructuredAgentSessionHandoffCoordinator } from './structured-agent-session-handoff'
 import { createStructuredHandoffFlowContext } from './structured-agent-session-handoff-flow-context'
 import { handoffStructuredSessionToTui } from './structured-agent-session-handoff-forward'
@@ -21,6 +22,8 @@ import type {
   StructuredTuiOwner
 } from './structured-agent-session-handoff-types'
 
+const journals = createTrackedJournalOpener()
+
 const NOW = 1_800_000_000_000
 const SESSION = 'session-handoff'
 const PLAIN_RESIDUE = 'session-plain-residue'
@@ -211,7 +214,7 @@ beforeEach(async () => {
   stopRecoveredOwner = vi.fn(async () => undefined)
   store = await AgentSessionRecordStore.open({ directory: join(root, 'store'), hostId: 'local' })
   await establishNativeOwner()
-  journal = await openAgentSessionJournal({
+  journal = await journals.open({
     identity: {
       sessionId: SESSION,
       workspaceId: 'workspace-1',
@@ -232,6 +235,7 @@ beforeEach(async () => {
 })
 
 afterEach(async () => {
+  await journals.closeAll()
   await rm(root, { recursive: true, force: true })
 })
 
@@ -426,7 +430,7 @@ describe('structured session ownership recovery on restore', () => {
           : { outcome: 'pid-absent' },
       now: NOW + 1_000
     })
-    journal = await openAgentSessionJournal({
+    journal = await journals.open({
       identity: {
         sessionId: SESSION,
         workspaceId: 'workspace-1',
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-handoff.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-handoff.ts
index 0e213921609..57333d1c90c 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-handoff.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-handoff.ts
@@ -1,63 +1,286 @@
 import type { AgentSessionRecord } from '../../../shared/agent-session-record'
-import type { AgentSessionHandoffStatus } from '../../../shared/agent-session-wire'
+import type {
+  AgentSessionHandoffRequest,
+  AgentSessionHandoffResult,
+  AgentSessionHandoffStatus,
+  AgentSessionMutationResult,
+  AgentSessionWireRefusal
+} from '../../../shared/agent-session-wire'
+import { activeStructuredAgentSessionTurnId } from '../../../shared/structured-agent-session-projection'
+import {
+  admitStructuredHandoffRequest,
+  refuseAdmittedStructuredHandoff,
+  replayedStructuredHandoffRefusal,
+  structuredHandoffRetryIsAdmissible
+} from './structured-agent-session-handoff-admission'
 import {
   createStructuredHandoffFlowContext,
   requireStructuredHandoffRecord
 } from './structured-agent-session-handoff-flow-context'
-import { restoreStructuredAgentSessionHandoff } from './structured-agent-session-handoff-restart'
+import { StructuredAgentSessionHandoffFlowRunner } from './structured-agent-session-handoff-flow-runner'
+import { StructuredAgentSessionHandoffOperationGuard } from './structured-agent-session-handoff-operation-guard'
+import { StructuredAgentSessionHandoffQueue } from './structured-agent-session-handoff-queue'
+import { queueStructuredHandoffAfterTurn } from './structured-agent-session-handoff-queue-start'
 import { closeRetainedTuiOwner } from './structured-agent-session-handoff-owner-close'
+import { requestStructuredManualRecovery } from './structured-agent-session-handoff-recover'
+import { restoreStructuredAgentSessionHandoff } from './structured-agent-session-handoff-restart'
+import {
+  structuredHandoffRefusal as refusal,
+  structuredHandoffSuccess
+} from './structured-agent-session-handoff-result'
+import {
+  failedStructuredHandoffStatus,
+  idleStructuredHandoffStatus,
+  structuredSessionHasPendingPrompt,
+  structuredTuiStatus
+} from './structured-agent-session-handoff-status'
 import type {
   StructuredAgentSessionHandoffDeps,
   StructuredAgentSessionHandoffFlowContext
 } from './structured-agent-session-handoff-types'
 import { StructuredAgentSessionHandoffState } from './structured-agent-session-handoff-state'
-
 export class StructuredAgentSessionHandoffCoordinator {
   private readonly state: StructuredAgentSessionHandoffState
-
+  private readonly queue = new StructuredAgentSessionHandoffQueue()
+  private readonly operationGuard: StructuredAgentSessionHandoffOperationGuard
+  private readonly flowRunner: StructuredAgentSessionHandoffFlowRunner
   constructor(private readonly deps: StructuredAgentSessionHandoffDeps) {
-    // oxfmt-ignore
-    this.state = new StructuredAgentSessionHandoffState({ requireRecord: (sessionId) => this.requireRecord(sessionId), publish: deps.publish, hostLabel: deps.transport?.hostLabel })
-  }
-
-  status = (sessionId: string) => this.state.status(sessionId)
-
-  closeRetainedTuiOwner = (sessionId: string): Promise<boolean> =>
-    closeRetainedTuiOwner({
-      sessionId,
-      deps: this.deps,
-      owner: this.state.owner,
-      requireRecord: this.requireRecord,
-      releaseOwner: this.state.releaseOwner
+    this.state = new StructuredAgentSessionHandoffState({
+      requireRecord: (sessionId) => this.requireRecord(sessionId),
+      publish: deps.publish,
+      hostLabel: deps.transport?.hostLabel
     })
-
+    this.operationGuard = new StructuredAgentSessionHandoffOperationGuard(deps.store)
+    this.flowRunner = new StructuredAgentSessionHandoffFlowRunner({
+      deps,
+      operationGuard: this.operationGuard,
+      flowContext: () => this.flowContext(),
+      fail: (params, error) => this.fail(params, error)
+    })
+  }
+  status = (sessionId: string): AgentSessionHandoffStatus => this.state.status(sessionId)
+  drain = (): Promise<void> => this.flowRunner.drain()
+  closeRetainedTuiOwner = (sessionId: string): Promise<boolean> =>
+    this.closeRetainedOwner(sessionId)
   setStatus = (sessionId: string, status: AgentSessionHandoffStatus): void =>
     this.state.setStatus(sessionId, status)
-
+  async request(
+    callerKey: string,
+    params: AgentSessionHandoffRequest
+  ): Promise<AgentSessionMutationResult<AgentSessionHandoffResult>> {
+    const record = this.requireRecord(params.envelope.sessionId)
+    const currentStatus = this.state.cachedStatus(record.sessionId)
+    const admission = await admitStructuredHandoffRequest({
+      deps: this.deps,
+      operationGuard: this.operationGuard,
+      callerKey,
+      params,
+      record,
+      ...(currentStatus ? { status: currentStatus } : {})
+    })
+    if (admission.decision === 'replay') {
+      const replayedRefusal = replayedStructuredHandoffRefusal(admission.outcome)
+      if (replayedRefusal) {
+        return { ok: false, refusal: replayedRefusal }
+      }
+      return this.success(record.sessionId, true)
+    }
+    if (admission.decision === 'refused') {
+      return { ok: false, refusal: admission.refusal }
+    }
+    const { fingerprint } = admission
+    const action = params.action ?? 'start'
+    if (action === 'cancel-queued') {
+      if (currentStatus?.phase !== 'queued' || currentStatus?.direction !== params.direction) {
+        return this.refuseAdmitted(
+          callerKey,
+          params,
+          'agent_session_operation_conflict',
+          'No matching queued handoff exists.'
+        )
+      }
+      this.queue.cancel(record.sessionId)
+      this.setStatus(record.sessionId, idleStructuredHandoffStatus(record))
+      await this.deps.store.recordOperationOutcome({
+        callerKey,
+        operationId: params.envelope.clientOperationId,
+        outcome: { status: 'succeeded', sessionId: record.sessionId }
+      })
+      return this.success(record.sessionId, false)
+    }
+    if (!this.deps.transport) {
+      return this.refuseAdmitted(
+        callerKey,
+        params,
+        'structured_agent_session_unsupported',
+        'Agent TUI handoff is unavailable on this host.'
+      )
+    }
+    if (action === 'recover') {
+      const status = this.status(record.sessionId)
+      const started = await requestStructuredManualRecovery({
+        deps: this.deps,
+        operationGuard: this.operationGuard,
+        callerKey,
+        params,
+        fingerprint,
+        record,
+        status,
+        requireRecord: this.requireRecord,
+        restore: this.restore,
+        setStatus: this.setStatus
+      })
+      if (!started) {
+        return this.refuseAdmitted(
+          callerKey,
+          params,
+          'agent_session_operation_conflict',
+          'This handoff is no longer eligible for proof recovery.'
+        )
+      }
+      return this.success(record.sessionId, false)
+    }
+    if (action === 'retry') {
+      if (!structuredHandoffRetryIsAdmissible(this.status(record.sessionId), params)) {
+        return this.refuseAdmitted(
+          callerKey,
+          params,
+          'agent_session_operation_conflict',
+          'This handoff is no longer retryable.'
+        )
+      }
+      this.begin(callerKey, params, null, fingerprint)
+      return this.success(record.sessionId, false)
+    }
+    const expectedOwner = params.direction === 'to-tui' ? 'native' : 'tui'
+    if (record.lease.runtimeKind !== expectedOwner || record.lease.claimStatus !== 'live') {
+      return this.refuseAdmitted(
+        callerKey,
+        params,
+        'agent_session_conflict',
+        `The ${expectedOwner} runtime does not own this session.`
+      )
+    }
+    if (structuredSessionHasPendingPrompt(this.deps.session(record.sessionId).journal)) {
+      return this.refuseAdmitted(
+        callerKey,
+        params,
+        'agent_session_conflict',
+        'Resolve the pending question or approval before switching.'
+      )
+    }
+    const turnId = activeStructuredAgentSessionTurnId(
+      this.deps.session(record.sessionId).journal.snapshot().items
+    )
+    const tuiOwner = this.state.owner(record.sessionId)
+    const busy =
+      expectedOwner === 'native'
+        ? turnId !== null
+        : structuredTuiStatus(tuiOwner, this.deps.transport) !== 'idle'
+    if (busy && params.mode === 'now') {
+      return this.refuseAdmitted(
+        callerKey,
+        params,
+        'agent_session_conflict',
+        'The current turn must finish before switching.'
+      )
+    }
+    if (busy && params.mode === 'after-turn') {
+      queueStructuredHandoffAfterTurn({
+        callerKey,
+        params,
+        deps: this.deps,
+        queue: this.queue,
+        owner: (sessionId) => this.state.owner(sessionId),
+        setStatus: this.setStatus,
+        begin: (key, next, tuiAlreadyExited) =>
+          this.begin(key, next, null, fingerprint, tuiAlreadyExited)
+      })
+      return this.success(record.sessionId, false)
+    }
+    if (busy && expectedOwner === 'tui' && params.mode === 'stop-turn') {
+      return this.refuseAdmitted(
+        callerKey,
+        params,
+        'structured_agent_session_unsupported',
+        'Exit the agent terminal after this turn to continue in chat.'
+      )
+    }
+    this.begin(callerKey, params, turnId, fingerprint)
+    return this.success(record.sessionId, false)
+  }
   async restore(sessionId: string): Promise<void> {
     await restoreStructuredAgentSessionHandoff(
       {
         deps: this.deps,
         requireRecord: (id) => this.requireRecord(id),
         flowContext: () => this.flowContext(),
-        retainOwner: this.state.retainOwner,
-        setStatus: this.state.setStatus
+        retainOwner: (id, owner) => this.state.retainOwner(id, owner),
+        setStatus: (id, status) => this.state.setStatus(id, status)
       },
       sessionId
     )
   }
-
+  private refuseAdmitted(
+    callerKey: string,
+    params: AgentSessionHandoffRequest,
+    code: AgentSessionWireRefusal['code'],
+    message: string
+  ): Promise<AgentSessionMutationResult<AgentSessionHandoffResult>> {
+    return refuseAdmittedStructuredHandoff({
+      deps: this.deps,
+      callerKey,
+      params,
+      refusal: refusal(code, message)
+    })
+  }
+  private success(
+    sessionId: string,
+    replayed: boolean
+  ): AgentSessionMutationResult<AgentSessionHandoffResult> {
+    return structuredHandoffSuccess(this.deps, sessionId, replayed, this.status(sessionId))
+  }
+  private begin(
+    callerKey: string,
+    params: AgentSessionHandoffRequest,
+    turnId: string | null,
+    fingerprint: string,
+    tuiAlreadyExited = false
+  ): void {
+    this.flowRunner.begin({
+      callerKey,
+      params,
+      turnId,
+      fingerprint,
+      tuiAlreadyExited
+    })
+  }
   private flowContext(): StructuredAgentSessionHandoffFlowContext {
     return createStructuredHandoffFlowContext({
       deps: this.deps,
-      owner: this.state.owner,
-      retainOwner: this.state.retainOwner,
-      releaseOwner: this.state.releaseOwner,
-      setStatus: this.state.setStatus,
+      owner: (sessionId) => this.state.owner(sessionId),
+      retainOwner: (sessionId, owner) => this.state.retainOwner(sessionId, owner),
+      releaseOwner: (sessionId) => this.state.releaseOwner(sessionId),
+      setStatus: (sessionId, status) => this.state.setStatus(sessionId, status),
       requireRecord: (sessionId) => this.requireRecord(sessionId)
     })
   }
-
+  private fail(params: AgentSessionHandoffRequest, error: unknown): void {
+    const record = this.requireRecord(params.envelope.sessionId)
+    this.setStatus(
+      record.sessionId,
+      failedStructuredHandoffStatus(record, params, error, this.deps.transport?.hostLabel)
+    )
+  }
+  private closeRetainedOwner(sessionId: string): Promise<boolean> {
+    return closeRetainedTuiOwner({
+      sessionId,
+      deps: this.deps,
+      owner: this.state.owner,
+      requireRecord: this.requireRecord,
+      releaseOwner: this.state.releaseOwner
+    })
+  }
   private requireRecord = (sessionId: string): AgentSessionRecord =>
     requireStructuredHandoffRecord(this.deps, sessionId)
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-history-result.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-history-result.ts
index 70fc9a43ed2..b8e198c9b6b 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-history-result.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-history-result.ts
@@ -8,7 +8,7 @@ import type {
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
 import { readAgentSessionHistory } from './agent-session-history-page'
 
-function providerSessionMetadata(
+export function structuredAgentSessionProviderSessionMetadata(
   record: AgentSessionRecord | null
 ): AgentProviderSessionMetadata | undefined {
   const head = record ? agentSessionProviderHandleChainHead(record.providerHandleChain) : null
@@ -27,7 +27,7 @@ export function readStructuredAgentSessionHistoryResult(input: {
 }): AgentSessionHistoryResult {
   const result = readAgentSessionHistory(input.journal, input.request)
   const fence = input.record?.lease.runtimeFence
-  const providerSession = providerSessionMetadata(input.record)
+  const providerSession = structuredAgentSessionProviderSessionMetadata(input.record)
   if (fence === undefined) {
     return providerSession ? { ...result, providerSession } : result
   }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-host-handoff.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-host-handoff.test.ts
index 1828807f887..9bf27a11106 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-host-handoff.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-host-handoff.test.ts
@@ -6,15 +6,19 @@ import type {
   AgentSessionExecutionLocation,
   AgentSessionRecord
 } from '../../../shared/agent-session-record'
+import type { AgentSessionHandoffStatus } from '../../../shared/agent-session-wire'
 import { LOCAL_EXECUTION_HOST_ID } from '../../../shared/execution-host'
 import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
-import { openAgentSessionJournal } from '../agent-session-journal/journal-store-factory'
+import { createTrackedJournalOpener } from '../agent-session-journal/journal-store-test-open'
 import { createDeferredStructuredAgentSessionEventSink } from './structured-agent-session-event-sink'
 import {
   acquireNativeHandoffOwner,
+  createStructuredAgentSessionHostHandoff,
   structuredTuiTranscriptImportOptions
 } from './structured-agent-session-host-handoff'
 
+const journals = createTrackedJournalOpener()
+
 function importRecord(provider: 'claude' | 'codex', accountHome: string): AgentSessionRecord {
   return {
     provider,
@@ -54,6 +58,7 @@ describe('native handoff acquisition', () => {
   })
 
   afterEach(async () => {
+    await journals.closeAll()
     await rm(root, { recursive: true, force: true })
   })
 
@@ -82,7 +87,7 @@ describe('native handoff acquisition', () => {
       },
       now
     })
-    const journal = await openAgentSessionJournal({
+    const journal = await journals.open({
       identity: {
         sessionId,
         workspaceId: location.workspaceId,
@@ -170,6 +175,7 @@ describe('native handoff acquisition', () => {
       },
       {
         session: () => session,
+        findSession: () => session,
         eventSink: () => eventSink,
         flush: async () => undefined,
         serialize: async (_session, task) => task(),
@@ -197,3 +203,91 @@ describe('native handoff acquisition', () => {
     expect(order).toEqual(['append-entered', 'append-complete', 'unbind', 'acquire'])
   })
 })
+
+describe('handoff status published for a session the host no longer holds', () => {
+  const sessionId = 'session-handoff-publish-detached'
+  const now = 1_800_000_000_000
+  const failed: AgentSessionHandoffStatus = {
+    owner: 'native',
+    direction: 'to-tui',
+    phase: 'failed',
+    stage: null,
+    operationId: null
+  }
+  let root: string
+  let store: AgentSessionRecordStore
+
+  beforeEach(async () => {
+    root = await mkdtemp(join(tmpdir(), 'orca-handoff-publish-'))
+    store = await AgentSessionRecordStore.open({ directory: join(root, 'store'), hostId: 'local' })
+  })
+
+  afterEach(async () => {
+    await rm(root, { recursive: true, force: true })
+  })
+
+  function detachedHandoff(frames: { fence: number; status: AgentSessionHandoffStatus }[]) {
+    return createStructuredAgentSessionHostHandoff(
+      { store, adapter: {} as never, journalRoot: root, claimKeyId: 'key-1' },
+      {
+        // Eviction and host teardown both drop the map entry while a flow is still settling.
+        session: () => {
+          throw new Error('agent_session_ownership_unknown')
+        },
+        findSession: () => undefined,
+        eventSink: () => {
+          throw new Error('unreachable: publishing reads no sink')
+        },
+        flush: async () => undefined,
+        serialize: async (_sessionId, task) => task(),
+        subscribers: {
+          publish: vi.fn(),
+          reset: vi.fn(),
+          snapshot: vi.fn(),
+          handoff: (_id: string, fence: number, status: AgentSessionHandoffStatus) =>
+            void frames.push({ fence, status })
+        } as never,
+        now: () => now
+      }
+    )
+  }
+
+  it('still reaches subscribers at the record fence instead of throwing', async () => {
+    const reserved = await store.reserveOwner({
+      sessionId,
+      location: {
+        executionHostId: LOCAL_EXECUTION_HOST_ID,
+        wslDistro: null,
+        workspaceId: 'workspace-1',
+        workspaceKind: 'git-worktree'
+      },
+      provider: 'codex',
+      accountHome: { variable: 'CODEX_HOME', path: join(root, 'codex-home') },
+      runtimeKind: 'native',
+      expectedFence: null,
+      spawnToken: 'detached-publish',
+      claimKeyId: 'key-1',
+      handoffOperationId: `${now}-00000000000000000000000000000001`,
+      probe: { outcome: 'reservation-unused' },
+      operation: {
+        callerKey: 'test',
+        operationId: `${now}-00000000000000000000000000000002`,
+        fingerprint: 'handoff'
+      },
+      now
+    })
+    const frames: { fence: number; status: AgentSessionHandoffStatus }[] = []
+
+    expect(() => detachedHandoff(frames).setStatus(sessionId, failed)).not.toThrow()
+
+    expect(frames).toEqual([{ fence: reserved.record.lease.runtimeFence, status: failed }])
+  })
+
+  it('drops the publish when neither a session nor a record remains', () => {
+    const frames: { fence: number; status: AgentSessionHandoffStatus }[] = []
+
+    expect(() => detachedHandoff(frames).setStatus(sessionId, failed)).not.toThrow()
+
+    expect(frames).toEqual([])
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-host-handoff.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-host-handoff.ts
index 6fb12f9bd13..586df1476cf 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-host-handoff.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-host-handoff.ts
@@ -17,6 +17,8 @@ import { StructuredTuiTranscriptCatchup } from './structured-tui-transcript-catc
 
 type HostHandoffAccess = {
   session: (sessionId: string) => StructuredAgentSessionHostSession
+  /** Non-throwing lookup, for the paths that only observe a detached session. */
+  findSession: (sessionId: string) => StructuredAgentSessionHostSession | undefined
   eventSink: (sessionId: string) => DeferredStructuredAgentSessionEventSink
   flush: (sessionId: string) => Promise<void>
   serialize: (sessionId: string, task: () => Promise<void>) => Promise<void>
@@ -95,8 +97,14 @@ export function createStructuredAgentSessionHostHandoff(
     activateTuiHistoryCatchup: (sessionId) => tuiHistoryCatchup.activate(sessionId),
     stopTuiHistoryCatchup: (sessionId) => tuiHistoryCatchup.stop(sessionId),
     publish: (sessionId, status) => {
-      const session = host.session(sessionId)
-      const fence = deps.store.getRecord(sessionId)?.lease.runtimeFence ?? session.fence
+      // A status publish is a notification, not a mutation. Eviction and host teardown both drop
+      // the session while a handoff flow is still settling, and `requireSession` would turn that
+      // last publish — usually the FAILED one — into an unhandled rejection nothing can catch.
+      const fence =
+        deps.store.getRecord(sessionId)?.lease.runtimeFence ?? host.findSession(sessionId)?.fence
+      if (fence === undefined) {
+        return
+      }
       host.subscribers.handoff(sessionId, fence, status)
     },
     schedule: host.serialize,
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-host-lifetime.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-host-lifetime.ts
index 5f3bbc5c731..ba62db1704e 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-host-lifetime.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-host-lifetime.ts
@@ -19,6 +19,8 @@ import type {
   StructuredAgentSessionHostSession
 } from './structured-agent-session-host-types'
 import { releaseStoredStructuredAgentSessionOwner } from './structured-agent-session-lease-release'
+import { resumeHeldStructuredAgentSession } from './structured-agent-session-hold-resume'
+import type { AgentSessionWireRefusal } from '../../../shared/agent-session-wire'
 
 export type StructuredAgentSessionLifetimeContext = {
   deps: StructuredAgentSessionHostDeps
@@ -48,7 +50,10 @@ export async function evictHeldStructuredAgentSession(
     hasProviderChild: hasProviderChild(context, sessionId),
     eventSink: context.runtimeState.eventSinkFor(sessionId),
     adapter: context.deps.adapter,
-    forget: () => context.sessions.delete(sessionId),
+    forget: async () => {
+      await context.sessions.get(sessionId)?.journal.close()
+      context.sessions.delete(sessionId)
+    },
     discardSink: () => context.runtimeState.discardEventSink(sessionId),
     releaseLease: () =>
       releaseStoredStructuredAgentSessionOwner({
@@ -64,6 +69,27 @@ export async function evictHeldStructuredAgentSession(
   )
 }
 
+/** The first hold on a childless session: reconcile the lease, settle recovery, then attach. */
+export async function resumeStructuredAgentSessionForHold(
+  context: StructuredAgentSessionLifetimeContext & {
+    reconcileLeases: (sessionId: string) => Promise<AgentSessionWireRefusal | null>
+  },
+  sessionId: string,
+  attach: Parameters<typeof resumeHeldStructuredAgentSession>[0]['attach']
+): Promise<void> {
+  const unreconciled = await context.reconcileLeases(sessionId)
+  if (unreconciled) {
+    throw new Error(unreconciled.code)
+  }
+  await context.runtimeState.resolveRecovery(sessionId)
+  await resumeHeldStructuredAgentSession({
+    sessionId,
+    deps: context.deps,
+    now: context.now,
+    attach
+  })
+}
+
 export function createStructuredAgentSessionHolds(
   context: StructuredAgentSessionLifetimeContext,
   input: {
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-host-mutations.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-host-mutations.ts
index c9afa06e525..f4a0244d0af 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-host-mutations.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-host-mutations.ts
@@ -74,7 +74,12 @@ export function sendStructuredAgentSessionTurn(
 export function cancelStructuredAgentSessionTurn(
   context: StructuredAgentSessionMutationContext,
   caller: StructuredAgentSessionCaller,
-  params: { envelope: AgentSessionMutationEnvelope; turnId: string }
+  params: {
+    envelope: AgentSessionMutationEnvelope
+    turnId: string
+    scope?: 'background-tasks'
+    taskId?: string
+  }
 ): Promise<AgentSessionMutationResult<AgentSessionCancelResult>> {
   return mutate(context, caller, params.envelope, cancelPlan(params))
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-host-teardown.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-host-teardown.ts
new file mode 100644
index 00000000000..2b230db1357
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-host-teardown.ts
@@ -0,0 +1,53 @@
+// Host teardown, made failure-complete.
+//
+// A trailing "close every journal" statement is skipped on exactly the path
+// that leaks: `flushAllEventSinks` throws BY DESIGN when a sink barrier fails,
+// and the attach drain can reject too. Every connection would then be left open
+// with the global runtime reference already cleared — the one state from which
+// nothing can ever close them.
+
+import { agentSessionJournalCloseRetries } from '../agent-session-journal/journal-close-retry'
+import type { StructuredAgentSessionHostSession } from './structured-agent-session-host-types'
+
+export type StructuredAgentSessionTeardownPhase = {
+  name: string
+  run: () => Promise<void> | void
+}
+
+export async function tearDownStructuredAgentSessionHost(input: {
+  phases: readonly StructuredAgentSessionTeardownPhase[]
+  sessions: Map<string, StructuredAgentSessionHostSession>
+}): Promise<void> {
+  const failures: unknown[] = []
+  for (const phase of input.phases) {
+    try {
+      await phase.run()
+    } catch (error) {
+      failures.push(error)
+    }
+  }
+
+  const entries = [...input.sessions.entries()]
+  // `allSettled`, so one rejected close cannot skip the others.
+  const closed = await Promise.allSettled(entries.map(([, session]) => session.journal.close()))
+  closed.forEach((result, index) => {
+    const sessionId = entries[index]?.[0]
+    if (result.status === 'fulfilled') {
+      // Only a FULFILLED close drops the entry. One that rejected stays indexed,
+      // which is what makes a later close a real retry rather than a no-op.
+      if (sessionId !== undefined) {
+        input.sessions.delete(sessionId)
+      }
+      return
+    }
+    failures.push(result.reason)
+  })
+
+  // Journals an earlier failure path could not close are retried HERE, which is
+  // the only place that owns them once their caller has unwound.
+  failures.push(...(await agentSessionJournalCloseRetries.retryAll()))
+
+  if (failures.length > 0) {
+    throw new AggregateError(failures, 'agent session host teardown failed')
+  }
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-host-types.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-host-types.ts
index bda921d9d7f..ea4b594ac44 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-host-types.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-host-types.ts
@@ -10,6 +10,17 @@ import type { StructuredAgentSessionHandoffTransport } from './structured-agent-
 
 export type StructuredAgentSessionCaller = { callerKey: string }
 
+/** What the host believes about a session it just made addressable again. The workspace and agent
+ *  come from the record, so a caller publishes the host's view rather than a client's assertion.
+ *  `readable` is false when the journal could not be opened — the tab is still worth publishing,
+ *  because attach recovers what read restore cannot. */
+export type StructuredAgentSessionReveal = {
+  sessionId: string
+  workspaceId: string
+  agent: 'claude' | 'codex'
+  readable: boolean
+}
+
 export type StructuredAgentSessionHostSession = {
   journal: AgentSessionJournal
   params: AgentSessionAttachParams
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-host.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-host.test.ts
index 8de64e3f419..5354670fa0b 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-host.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-host.test.ts
@@ -13,7 +13,7 @@ import type {
 import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
 import { journalDirectoryFor } from '../agent-session-journal/journal-paths'
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
-import { openAgentSessionJournal } from '../agent-session-journal/journal-store-factory'
+import { createTrackedJournalOpener } from '../agent-session-journal/journal-store-test-open'
 import type {
   AgentSessionDispatchOutcome,
   StructuredAgentSessionAdapter
@@ -30,6 +30,8 @@ import {
   resetHostTestOperationIds
 } from './structured-agent-session-host-test-data'
 
+const journals = createTrackedJournalOpener()
+
 const CALLER = { callerKey: 'client-1' }
 
 function envelope(
@@ -97,7 +99,7 @@ async function attach(): Promise<AgentSessionRecord | null> {
 async function seedApproval(optionId = 'allow'): Promise<{ itemId: string; revision: number }> {
   const identity = { provider: 'codex' as const, threadId: THREAD, turnId: 'turn-1', ordinal: 99 }
   const journalDir = journalDirectoryFor(root, { workspaceId: 'workspace-1', sessionId: SESSION })
-  const journal = await openAgentSessionJournal({
+  const journal = await journals.open({
     identity: {
       sessionId: SESSION,
       workspaceId: 'workspace-1',
@@ -157,6 +159,7 @@ beforeEach(async () => {
 })
 
 afterEach(async () => {
+  await journals.closeAll()
   await host.flushAllStreamedEvents()
   await rm(root, { recursive: true, force: true })
 })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-host.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-host.ts
index 3c5256cece0..13b7d7b441e 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-host.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-host.ts
@@ -2,15 +2,7 @@
 // Mutations share one durable admission path and serialize per session.
 
 import type { AgentSessionExecutionLocation } from '../../../shared/agent-session-record'
-import type {
-  AgentSessionAttachResult,
-  AgentSessionHistoryRequest,
-  AgentSessionHistoryResult,
-  AgentSessionHandoffStatus,
-  AgentSessionMutationResult,
-  AgentSessionOptionsResult,
-  AgentSessionWireRefusal
-} from '../../../shared/agent-session-wire'
+import type * as SessionWire from '../../../shared/agent-session-wire'
 import type { AgentSessionAttachParams } from './structured-agent-session-attach'
 import { AGENT_SESSION_NOT_ATTACHED } from './structured-agent-session-mutation-admission'
 import { createRestartReconciler } from './structured-agent-session-restart-reconcile'
@@ -20,7 +12,7 @@ import {
 } from './structured-agent-session-subscribers'
 import { StructuredAgentSessionTaskQueue } from './structured-agent-session-task-queue'
 import * as providerSupport from './structured-agent-session-provider-support'
-import { StructuredAgentSessionRestartRestoreGate } from './structured-agent-session-restart-restore-gate'
+import { createStructuredAgentSessionHostRestore } from './structured-agent-session-reveal'
 import {
   createStructuredAgentSessionHostHandoff,
   refreshRecoverableStructuredHandoffStatus,
@@ -31,13 +23,13 @@ import { attachStructuredAgentSession } from './structured-agent-session-attach-
 import {
   createStructuredAgentSessionHolds,
   evictHeldStructuredAgentSession,
+  resumeStructuredAgentSessionForHold,
   type StructuredAgentSessionLifetimeContext
 } from './structured-agent-session-host-lifetime'
 import type {
   StructuredAgentSessionHolds,
   StructuredAgentSessionHoldOptions
 } from './structured-agent-session-holds'
-import { resumeHeldStructuredAgentSession } from './structured-agent-session-hold-resume'
 import type { StructuredAgentSessionAttachContext } from './structured-agent-session-attach-context'
 import { listStructuredAgentSessionTabs } from './structured-agent-session-host-tabs'
 import {
@@ -48,29 +40,50 @@ import {
   setStructuredAgentSessionOption,
   type StructuredAgentSessionMutationContext
 } from './structured-agent-session-host-mutations'
-import { StructuredAgentSessionReadableRestorer } from './structured-agent-session-readable-restorer'
+import { tearDownStructuredAgentSessionHost } from './structured-agent-session-host-teardown'
 import type {
   StructuredAgentSessionCaller,
   StructuredAgentSessionHostDeps,
-  StructuredAgentSessionHostSession
+  StructuredAgentSessionHostSession,
+  StructuredAgentSessionReveal
 } from './structured-agent-session-host-types'
-import { readStructuredAgentSessionHistoryResult } from './structured-agent-session-history-result'
-import { retryPendingStructuredAgentSessionSettlement } from './structured-agent-session-settlement-retry'
+import { StructuredAgentSessionStatusFeed } from './structured-agent-session-status-feed'
 import { StructuredAgentSessionEventRecovery } from './structured-agent-session-event-recovery'
+import { StructuredAgentSessionBackgroundTaskChannel } from './structured-agent-session-background-task-channel'
+import { withTimeout } from '../../../shared/promise-timeout-fallback'
 export type { StructuredAgentSessionHostDeps } from './structured-agent-session-host-types'
+/** Quit must not wait indefinitely on an in-flight handoff; see the drain phase below. */
+const HANDOFF_DRAIN_TIMEOUT_MS = 5_000
+
 export class StructuredAgentSessionHost {
   private readonly sessions = new Map<string, StructuredAgentSessionHostSession>()
-  private readonly subscribers = new AgentSessionSubscribers()
+  private readonly statusFeed = new StructuredAgentSessionStatusFeed({
+    sessions: this.sessions,
+    getRecord: (sessionId) => this.deps.store.getRecord(sessionId),
+    now: () => this.now()
+  })
+  private readonly subscribers = new AgentSessionSubscribers({
+    onJournalPublished: (sessionId, journal) => this.statusFeed.publish(sessionId, journal)
+  })
   private readonly tasks = new StructuredAgentSessionTaskQueue()
   private readonly runtimeState: StructuredAgentSessionHostRuntimeState
-  private readonly reconcileLeases: (sessionId: string) => Promise<AgentSessionWireRefusal | null>
+  private readonly reconcileLeases: (
+    sessionId: string
+  ) => Promise<SessionWire.AgentSessionWireRefusal | null>
   private readonly handoffs: StructuredAgentSessionHostHandoff
-  private readonly readableRestorer: StructuredAgentSessionReadableRestorer
-  private readonly restartRestore = new StructuredAgentSessionRestartRestoreGate()
+  private readonly restore: ReturnType<typeof createStructuredAgentSessionHostRestore>
   private readonly holds: StructuredAgentSessionHolds
   private readonly eventRecovery: StructuredAgentSessionEventRecovery
+  private readonly backgroundTasks: StructuredAgentSessionBackgroundTaskChannel
 
   constructor(readonly deps: StructuredAgentSessionHostDeps) {
+    this.backgroundTasks = new StructuredAgentSessionBackgroundTaskChannel(
+      deps,
+      this.sessions,
+      this.subscribers,
+      (sessionId) => this.requireSession(sessionId),
+      (sessionId) => this.handoffs.status(sessionId)
+    )
     this.runtimeState = new StructuredAgentSessionHostRuntimeState(
       deps,
       (record) => this.restoreRenewedHandoff(record.sessionId),
@@ -90,6 +103,7 @@ export class StructuredAgentSessionHost {
     })
     this.handoffs = createStructuredAgentSessionHostHandoff(deps, {
       session: (sessionId) => this.requireSession(sessionId),
+      findSession: (sessionId) => this.sessions.get(sessionId),
       eventSink: (sessionId) => this.runtimeState.eventSinkFor(sessionId),
       flush: (sessionId) => this.flushStreamedEvents(sessionId),
       serialize: (sessionId, task) => this.serialize(sessionId, task),
@@ -97,18 +111,25 @@ export class StructuredAgentSessionHost {
       now: this.now
     })
     this.holds = createStructuredAgentSessionHolds(this.lifetimeContext(), {
-      resume: (sessionId) => this.resumeForHold(sessionId),
+      resume: (sessionId) =>
+        resumeStructuredAgentSessionForHold(
+          { ...this.lifetimeContext(), reconcileLeases: this.reconcileLeases },
+          sessionId,
+          (params) => this.attach({ callerKey: 'trusted-local:surface-hold' }, params)
+        ),
       evict: (sessionId) => this.close(sessionId)
     })
-    this.readableRestorer = new StructuredAgentSessionReadableRestorer({
-      store: deps.store,
-      journalRoot: deps.journalRoot,
-      supportsRecord: (record) => providerSupport.adapterSupportsRecord(deps.adapter, record),
+    this.restore = createStructuredAgentSessionHostRestore(deps, {
       reconcile: this.reconcileLeases,
       resolveRecovery: (sessionId) => this.runtimeState.resolveRecovery(sessionId),
       serialize: (sessionId, task) => this.serialize(sessionId, task),
-      hasSession: (sessionId) => this.sessions.has(sessionId),
-      onReadable: (sessionId, restored) => this.sessions.set(sessionId, restored),
+      hasSession: this.hasSession,
+      // Site 10: cannot overwrite a live entry — the restorer returns early on
+      // `hasSession` inside the same serialized step as this `set`.
+      onReadable: (sessionId, restored) => {
+        this.sessions.set(sessionId, restored)
+        this.statusFeed.publish(sessionId)
+      },
       restoreHandoff: (sessionId) => this.handoffs.restore(sessionId)
     })
     this.eventRecovery = new StructuredAgentSessionEventRecovery({
@@ -143,20 +164,6 @@ export class StructuredAgentSessionHost {
   /** That surface is gone. The child outlives it by the release grace, and by any running turn. */
   release = (sessionId: string, holderId: string): void => this.holds.release(sessionId, holderId)
 
-  private async resumeForHold(sessionId: string): Promise<void> {
-    const unreconciled = await this.reconcileLeases(sessionId)
-    if (unreconciled) {
-      throw new Error(unreconciled.code)
-    }
-    await this.runtimeState.resolveRecovery(sessionId)
-    await resumeHeldStructuredAgentSession({
-      sessionId,
-      deps: this.deps,
-      now: () => this.now(),
-      attach: (params) => this.attach({ callerKey: 'trusted-local:surface-hold' }, params)
-    })
-  }
-
   handleAdapterEvent = (event: Parameters<StructuredAgentSessionEventRecovery['handle']>[0]) =>
     this.eventRecovery.handle(event)
 
@@ -178,14 +185,6 @@ export class StructuredAgentSessionHost {
       subscribers: this.subscribers,
       tasks: this.tasks,
       reconcileLeases: (sessionId) => this.reconcileLeases(sessionId),
-      retryPendingSettlement: (sessionId, params) =>
-        retryPendingStructuredAgentSessionSettlement({
-          deps: this.deps,
-          sessions: this.sessions,
-          sessionId,
-          params,
-          now: () => this.now()
-        }),
       serialize: (sessionId, task) => this.serialize(sessionId, task),
       now: () => this.now()
     }
@@ -225,7 +224,11 @@ export class StructuredAgentSessionHost {
   }
 
   restoreReadableSessions = (sessionIds?: readonly string[]): Promise<void> =>
-    this.restartRestore.run(() => this.readableRestorer.restore(sessionIds))
+    this.restore.restoreReadableSessions(sessionIds)
+
+  /** Make one persisted session addressable again; see `structured-agent-session-reveal`. */
+  revealSession = (sessionId: string): Promise<StructuredAgentSessionReveal> =>
+    this.restore.revealSession(sessionId)
 
   private serialize = <T>(sessionId: string, task: () => Promise<T>): Promise<T> =>
     this.tasks.serialize(sessionId, task)
@@ -241,7 +244,7 @@ export class StructuredAgentSessionHost {
   attach(
     caller: StructuredAgentSessionCaller,
     params: AgentSessionAttachParams
-  ): Promise<AgentSessionMutationResult<AgentSessionAttachResult>> {
+  ): Promise<SessionWire.AgentSessionMutationResult<SessionWire.AgentSessionAttachResult>> {
     return attachStructuredAgentSession(this.attachContext(), caller.callerKey, params)
   }
 
@@ -249,11 +252,25 @@ export class StructuredAgentSessionHost {
     this.runtimeState.flushEventSink(sessionId)
 
   async flushAllStreamedEvents(): Promise<void> {
-    this.holds.dispose()
-    this.runtimeState.stopLeaseRenewal()
-    this.handoffs.stopTuiHistoryCatchup()
-    await this.tasks.drainAttaches()
-    await this.runtimeState.flushAllEventSinks()
+    await tearDownStructuredAgentSessionHost({
+      phases: [
+        { name: 'dispose-holds', run: () => this.holds.dispose() },
+        { name: 'stop-lease-renewal', run: () => this.runtimeState.stopLeaseRenewal() },
+        { name: 'stop-tui-catchup', run: () => this.handoffs.stopTuiHistoryCatchup() },
+        // Before the session map is dropped: a handoff flow left running writes rows into a
+        // journal this teardown is about to close, and publishes against a session it removed.
+        // Why bounded: this phase is on the app-quit path, and a flow wedged in `launchTui` would
+        // otherwise hold the quit open forever. Giving up merely restores the old orphaning, which
+        // the publish guard above already makes survivable.
+        {
+          name: 'drain-handoffs',
+          run: () => withTimeout(this.handoffs.drain(), HANDOFF_DRAIN_TIMEOUT_MS, undefined)
+        },
+        { name: 'drain-attaches', run: () => this.tasks.drainAttaches() },
+        { name: 'flush-event-sinks', run: () => this.runtimeState.flushAllEventSinks() }
+      ],
+      sessions: this.sessions
+    })
   }
 
   private mutationContext(): StructuredAgentSessionMutationContext {
@@ -291,36 +308,40 @@ export class StructuredAgentSessionHost {
   ): ReturnType<typeof setStructuredAgentSessionOption> =>
     setStructuredAgentSessionOption(this.mutationContext(), caller, params)
 
-  readOptions = (sessionId: string): Promise<AgentSessionOptionsResult> =>
+  requestHandoff = (
+    caller: StructuredAgentSessionCaller,
+    params: SessionWire.AgentSessionHandoffRequest
+  ): Promise<SessionWire.AgentSessionMutationResult<SessionWire.AgentSessionHandoffResult>> =>
+    this.handoffs.request(caller.callerKey, params)
+
+  readOptions = (sessionId: string): Promise<SessionWire.AgentSessionOptionsResult> =>
     readStructuredAgentSessionOptions(this.mutationContext(), sessionId)
 
-  async handoffStatus(sessionId: string): Promise<AgentSessionHandoffStatus> {
+  async handoffStatus(sessionId: string): Promise<SessionWire.AgentSessionHandoffStatus> {
     this.requireSession(sessionId)
     return this.serialize(sessionId, () =>
       refreshRecoverableStructuredHandoffStatus(this.handoffs, this.deps.store, sessionId)
     )
   }
 
-  history(request: AgentSessionHistoryRequest): AgentSessionHistoryResult {
-    return readStructuredAgentSessionHistoryResult({
-      journal: this.requireSession(request.sessionId).journal,
-      record: this.deps.store.getRecord(request.sessionId),
-      request
-    })
-  }
+  history = (
+    request: SessionWire.AgentSessionHistoryRequest
+  ): SessionWire.AgentSessionHistoryResult => this.backgroundTasks.history(request)
 
-  subscribe(input: AgentSessionSubscribeInput): () => void {
-    const session = this.requireSession(input.sessionId)
-    const fence = this.deps.store.getRecord(input.sessionId)?.lease.runtimeFence ?? 0
-    return this.subscribers.open({
-      ...input,
-      journal: session.journal,
-      fence,
-      handoff: this.handoffs.status(input.sessionId)
-    })
-  }
+  subscribe = (input: AgentSessionSubscribeInput): (() => void) =>
+    this.backgroundTasks.subscribe(input)
+
+  publishBackgroundTaskState: StructuredAgentSessionBackgroundTaskChannel['publish'] = (
+    sessionId,
+    state
+  ) => this.backgroundTasks.publish(sessionId, state)
   unsubscribe = (sessionId: string, id: string): void => this.subscribers.close(sessionId, id)
 
+  /** Every session's projected status for session lists; unlike `subscribe`, retains nothing. */
+  subscribeStatus = (
+    subscriber: Parameters<StructuredAgentSessionStatusFeed['subscribe']>[0]
+  ): (() => void) => this.statusFeed.subscribe(subscriber)
+
   private requireSession(sessionId: string): StructuredAgentSessionHostSession {
     const session = this.sessions.get(sessionId)
     if (!session) {
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-journal-handles.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-journal-handles.test.ts
new file mode 100644
index 00000000000..b1cfd81b2a5
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-journal-handles.test.ts
@@ -0,0 +1,250 @@
+// Journal handle ownership across the wire layer.
+//
+// Every one of these sites is reached only when something has already gone
+// wrong, so a happy-path assertion proves nothing about them. On POSIX a leak
+// is silent; the rename/remove pair below is the half that actually fails on
+// Windows.
+
+import { access, mkdtemp, rename, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { AgentSessionJournalIdentity } from '../../../shared/agent-session-journal-types'
+import type * as JournalLegacyImport from '../agent-session-journal/journal-legacy-import'
+import { journalDatabaseFile } from '../agent-session-journal/journal-paths'
+import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
+import { createTrackedJournalOpener } from '../agent-session-journal/journal-store-test-open'
+import { openAgentSessionJournalWithRecovery } from './agent-session-journal-recovery'
+import {
+  evictStructuredAgentSession,
+  STRUCTURED_AGENT_SESSION_EVICTION_STEPS,
+  type StructuredAgentSessionEvictionContext
+} from './structured-agent-session-eviction'
+import { tearDownStructuredAgentSessionHost } from './structured-agent-session-host-teardown'
+import type { StructuredAgentSessionHostSession } from './structured-agent-session-host-types'
+
+const legacyImport = vi.hoisted(() => ({ throws: false }))
+
+vi.mock('../agent-session-journal/journal-legacy-import', async (importOriginal) => {
+  const actual = await importOriginal<typeof JournalLegacyImport>()
+  return {
+    ...actual,
+    importLegacyTranscriptIntoJournal: async (
+      input: Parameters<typeof actual.importLegacyTranscriptIntoJournal>[0]
+    ) => {
+      if (legacyImport.throws) {
+        throw new Error('legacy import threw instead of reporting a failure')
+      }
+      return actual.importLegacyTranscriptIntoJournal(input)
+    }
+  }
+})
+
+const SESSION = '019fd532-7c11-7a90-b6de-4e1a2c3d5f60'
+
+const IDENTITY: AgentSessionJournalIdentity = {
+  sessionId: SESSION,
+  workspaceId: 'ws-1',
+  hostId: 'host-1',
+  agent: 'codex',
+  providerHandle: { kind: 'codex', threadId: SESSION }
+}
+
+let root: string
+let journalDir: string
+const journals = createTrackedJournalOpener()
+
+async function exists(path: string): Promise<boolean> {
+  return access(path)
+    .then(() => true)
+    .catch(() => false)
+}
+
+async function expectNothingHoldsTheDirectory(directory: string): Promise<void> {
+  const dbPath = journalDatabaseFile(directory)
+  expect(await exists(`${dbPath}-wal`)).toBe(false)
+  expect(await exists(`${dbPath}-shm`)).toBe(false)
+  const moved = `${directory}-moved`
+  await rename(directory, moved)
+  await rm(moved, { recursive: true })
+}
+
+function hostSession(journal: AgentSessionJournal): StructuredAgentSessionHostSession {
+  return {
+    journal,
+    params: {} as StructuredAgentSessionHostSession['params'],
+    fence: 1,
+    hasProviderChild: false,
+    acquisitionGeneration: null
+  }
+}
+
+function evictionContext(
+  overrides: Partial<StructuredAgentSessionEvictionContext>
+): StructuredAgentSessionEvictionContext {
+  return {
+    sessionId: SESSION,
+    hasProviderChild: false,
+    eventSink: {
+      drained: async () => ({ ok: true }) as const,
+      unbind: () => undefined,
+      close: () => undefined
+    } as unknown as StructuredAgentSessionEvictionContext['eventSink'],
+    adapter: {} as StructuredAgentSessionEvictionContext['adapter'],
+    forget: async () => undefined,
+    discardSink: () => undefined,
+    releaseLease: async () => undefined,
+    ...overrides
+  }
+}
+
+beforeEach(async () => {
+  legacyImport.throws = false
+  root = await mkdtemp(join(tmpdir(), 'orca-wire-handles-'))
+  journalDir = join(root, 'journal')
+})
+
+afterEach(async () => {
+  await journals.closeAll()
+  await rm(root, { recursive: true, force: true })
+})
+
+describe('site 6: recovery rehydration', () => {
+  it('closes the journal it opened when the legacy import throws', async () => {
+    const seeded = await journals.open({ identity: IDENTITY, journalDir })
+    for (let ordinal = 1; ordinal <= 3; ordinal += 1) {
+      await seeded.appendItem(
+        { provider: 'codex', threadId: SESSION, turnId: 'turn-1', ordinal },
+        { kind: 'status', text: `seed-${ordinal}` },
+        { fence: 1 }
+      )
+    }
+    await seeded.close()
+    // Punch a hole in the middle so recovery takes the `journal_corrupt` branch.
+    const { openJournalDatabase } = await import('../agent-session-journal/journal-database')
+    const opened = openJournalDatabase(journalDatabaseFile(journalDir))
+    opened.db.prepare('DELETE FROM journal_rows WHERE seq = ?').run(3)
+    opened.db.close()
+    legacyImport.throws = true
+
+    await expect(
+      openAgentSessionJournalWithRecovery({
+        identity: IDENTITY,
+        journalDir,
+        fence: 1,
+        historyFilePath: join(root, 'missing.jsonl')
+      })
+    ).rejects.toThrow('legacy import threw')
+    await expectNothingHoldsTheDirectory(journalDir)
+  })
+})
+
+describe('sites 9 and 10: the delete and overwrite callbacks', () => {
+  it('awaits the journal close before dropping the map entry', async () => {
+    const journal = await journals.open({ identity: IDENTITY, journalDir })
+    const sessions = new Map([[SESSION, hostSession(journal)]])
+    const order: string[] = []
+
+    await evictStructuredAgentSession(
+      evictionContext({
+        forget: async () => {
+          order.push('close-started')
+          await sessions.get(SESSION)?.journal.close()
+          order.push('closed')
+          sessions.delete(SESSION)
+          order.push('forgotten')
+        }
+      }),
+      STRUCTURED_AGENT_SESSION_EVICTION_STEPS
+    )
+
+    expect(order).toEqual(['close-started', 'closed', 'forgotten'])
+    expect(sessions.size).toBe(0)
+    await expectNothingHoldsTheDirectory(journalDir)
+  })
+
+  it('aborts the eviction with the session still indexed when the close rejects', async () => {
+    const journal = await journals.open({ identity: IDENTITY, journalDir })
+    const sessions = new Map([[SESSION, hostSession(journal)]])
+
+    await expect(
+      evictStructuredAgentSession(
+        evictionContext({
+          forget: async () => {
+            await Promise.reject(new Error('close rejected'))
+          }
+        }),
+        STRUCTURED_AGENT_SESSION_EVICTION_STEPS
+      )
+    ).rejects.toMatchObject({ step: 'forget-session' })
+    // Still indexed, so the next close is a real retry.
+    expect(sessions.has(SESSION)).toBe(true)
+  })
+})
+
+describe('site 11: host teardown is failure-complete', () => {
+  async function twoSessions(): Promise<Map<string, StructuredAgentSessionHostSession>> {
+    const first = await journals.open({ identity: IDENTITY, journalDir })
+    const second = await journals.open({
+      identity: { ...IDENTITY, sessionId: `${SESSION}-b` },
+      journalDir: join(root, 'journal-b')
+    })
+    return new Map([
+      [SESSION, hostSession(first)],
+      [`${SESSION}-b`, hostSession(second)]
+    ])
+  }
+
+  it('closes every journal and clears the map on the happy path', async () => {
+    const sessions = await twoSessions()
+    await tearDownStructuredAgentSessionHost({ phases: [], sessions })
+
+    expect(sessions.size).toBe(0)
+    await expectNothingHoldsTheDirectory(journalDir)
+    await expectNothingHoldsTheDirectory(join(root, 'journal-b'))
+  })
+
+  // Against a trailing-statement design this case fails: `flushAllEventSinks`
+  // throws by design, so the close would be skipped on exactly the leaking path.
+  it('still closes every journal when a teardown phase throws', async () => {
+    const sessions = await twoSessions()
+    const barrierError = new Error('sink barrier failed')
+
+    await expect(
+      tearDownStructuredAgentSessionHost({
+        phases: [
+          {
+            name: 'flush-event-sinks',
+            run: () => {
+              throw barrierError
+            }
+          }
+        ],
+        sessions
+      })
+    ).rejects.toMatchObject({ errors: [barrierError] })
+
+    expect(sessions.size).toBe(0)
+    await expectNothingHoldsTheDirectory(journalDir)
+    await expectNothingHoldsTheDirectory(join(root, 'journal-b'))
+  })
+
+  it('keeps the entry whose close rejected, and surfaces the rejection', async () => {
+    const sessions = await twoSessions()
+    const failing = sessions.get(SESSION)
+    const closeError = new Error('close rejected')
+    if (failing) {
+      failing.journal = {
+        close: () => Promise.reject(closeError)
+      } as unknown as AgentSessionJournal
+    }
+
+    await expect(
+      tearDownStructuredAgentSessionHost({ phases: [], sessions })
+    ).rejects.toMatchObject({ errors: [closeError] })
+
+    // Only the failure stays indexed — `status === 'fulfilled'`, not "settled".
+    expect([...sessions.keys()]).toEqual([SESSION])
+    await expectNothingHoldsTheDirectory(join(root, 'journal-b'))
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-manual-recovery.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-manual-recovery.ts
new file mode 100644
index 00000000000..91be1a15aa5
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-manual-recovery.ts
@@ -0,0 +1,103 @@
+import type { AgentSessionRecord } from '../../../shared/agent-session-record'
+import type {
+  AgentSessionHandoffRequest,
+  AgentSessionHandoffStatus
+} from '../../../shared/agent-session-wire'
+import { setStoredAgentSessionHandoffStage } from '../../runtime/agent-session-handoff-record-transitions'
+import type { StructuredAgentSessionHandoffOperationGuard } from './structured-agent-session-handoff-operation-guard'
+import { idleStructuredHandoffStatus } from './structured-agent-session-handoff-status'
+import type { StructuredAgentSessionHandoffDeps } from './structured-agent-session-handoff-types'
+
+export function structuredManualRecoveryIsAdmissible(
+  record: AgentSessionRecord,
+  status: AgentSessionHandoffStatus | undefined
+): boolean {
+  return (
+    record.lease.handoffStage === 'manual-recovery' &&
+    record.lease.runtimeKind === 'tui' &&
+    record.lease.ownerProcess !== null &&
+    status?.error?.canRetryProof === true
+  )
+}
+
+export function beginStructuredManualRecovery(input: {
+  deps: StructuredAgentSessionHandoffDeps
+  operationGuard: StructuredAgentSessionHandoffOperationGuard
+  callerKey: string
+  params: AgentSessionHandoffRequest
+  fingerprint: string
+  requireRecord: (sessionId: string) => AgentSessionRecord
+  restore: (sessionId: string) => Promise<void>
+  setStatus: (sessionId: string, status: AgentSessionHandoffStatus) => void
+}): Promise<void> {
+  const {
+    callerKey,
+    deps,
+    fingerprint,
+    operationGuard,
+    params,
+    requireRecord,
+    restore,
+    setStatus
+  } = input
+  const sessionId = params.envelope.sessionId
+  operationGuard.start(sessionId, {
+    callerKey,
+    operationId: params.envelope.clientOperationId,
+    fingerprint
+  })
+  setStatus(sessionId, {
+    owner: 'none',
+    direction: params.direction,
+    phase: 'switching',
+    stage: 'recovering',
+    operationId: params.envelope.clientOperationId,
+    hostLabel: deps.transport?.hostLabel
+  })
+  return deps
+    .schedule(sessionId, async () => {
+      let record = requireRecord(sessionId)
+      if (record.lease.claimStatus === 'reserved' && record.lease.handoffOperationId !== null) {
+        record = await setStoredAgentSessionHandoffStage(deps.store, {
+          sessionId,
+          fence: record.lease.runtimeFence,
+          stage: 'new-owner-proving',
+          handoffOperationId: record.lease.handoffOperationId,
+          now: deps.now()
+        })
+      }
+      await restore(record.sessionId)
+      if (requireRecord(sessionId).lease.handoffStage === 'manual-recovery') {
+        throw new Error('The TUI owner proof is still unavailable.')
+      }
+    })
+    .then(() => {
+      operationGuard.finish(sessionId, params.envelope.clientOperationId)
+      return deps.store.recordOperationOutcome({
+        callerKey,
+        operationId: params.envelope.clientOperationId,
+        outcome: { status: 'succeeded', sessionId }
+      })
+    })
+    .catch(async (error) => {
+      await deps.store.recordOperationOutcome({
+        callerKey,
+        operationId: params.envelope.clientOperationId,
+        outcome: { status: 'failed', code: 'agent_session_handoff_failed' }
+      })
+      operationGuard.finish(sessionId, params.envelope.clientOperationId)
+      const status = idleStructuredHandoffStatus(requireRecord(sessionId))
+      setStatus(sessionId, {
+        ...status,
+        ...(status.error
+          ? {
+              error: {
+                ...status.error,
+                details: error instanceof Error ? error.message : String(error)
+              }
+            }
+          : {})
+      })
+    })
+    .finally(() => operationGuard.finish(sessionId, params.envelope.clientOperationId))
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-mutation-plans.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-mutation-plans.ts
index 99835da7cea..1194f0c87ff 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-mutation-plans.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-mutation-plans.ts
@@ -75,14 +75,22 @@ export function sendPlan(params: {
 export function cancelPlan(params: {
   envelope: AgentSessionMutationEnvelope
   turnId: string
+  scope?: 'background-tasks'
+  taskId?: string
 }): MutationPlan<AgentSessionCancelResult> {
   return {
     method: 'agentSession.cancel',
-    fields: { turnId: params.turnId },
+    fields: {
+      turnId: params.turnId,
+      ...(params.scope ? { scope: params.scope } : {}),
+      ...(params.taskId ? { taskId: params.taskId } : {})
+    },
     run: (ctx) =>
       performCancel(ctx, {
         clientOperationId: params.envelope.clientOperationId,
-        turnId: params.turnId
+        turnId: params.turnId,
+        ...(params.scope ? { scope: params.scope } : {}),
+        ...(params.taskId ? { taskId: params.taskId } : {})
       }),
     // Interrupting twice would kill a turn the client never asked to stop, so a
     // replay reports the turn as already handled instead.
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-option-restoration.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-option-restoration.ts
index b9ba03ff327..6e71f822170 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-option-restoration.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-option-restoration.ts
@@ -1,7 +1,7 @@
 import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
 
 export async function readNativeSessionOptions(input: {
-  adapter: Pick<StructuredAgentSessionAdapter, 'readOptions'>
+  adapter: Pick<StructuredAgentSessionAdapter, 'readOptions' | 'readOptionRestoreFailures'>
   sessionId: string
   fence: number
   priorOptions?: Readonly<Record<string, string>>
@@ -11,7 +11,13 @@ export async function readNativeSessionOptions(input: {
   if (!reported) {
     return undefined
   }
-  const { model: _model, effort: _effort, ...restored } = priorOptions ?? {}
+  const skipped = new Set(input.adapter.readOptionRestoreFailures?.(sessionId) ?? [])
+  const restored = priorOptions ? { ...priorOptions } : {}
+  delete restored.model
+  delete restored.effort
+  for (const key of skipped) {
+    delete restored[key]
+  }
   return {
     ...restored,
     model: reported.current.model,
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-proven-dead-retry.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-proven-dead-retry.test.ts
new file mode 100644
index 00000000000..3caba894cb9
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-proven-dead-retry.test.ts
@@ -0,0 +1,178 @@
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
+import type { AgentSessionHandoffRequest } from '../../../shared/agent-session-wire'
+import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import { recoverStoredDeadTuiOwnerForHandoff } from '../../runtime/agent-session-handoff-record-transitions'
+import { openAgentSessionJournal } from '../agent-session-journal/journal-store-factory'
+import { StructuredAgentSessionHandoffCoordinator } from './structured-agent-session-handoff'
+import type { StructuredAgentSessionHandoffTransport } from './structured-agent-session-handoff-types'
+
+const NOW = 1_800_000_000_000
+const SESSION = 'session-proven-dead-retry'
+const THREAD = '019fd532-7c11-7a90-b6de-4e1a2c3d5f60'
+const CREATE_OPERATION = `${NOW}-00000000000000000000000000000000`
+const OPERATION = `${NOW}-00000000000000000000000000000001`
+const roots: string[] = []
+
+afterEach(async () => {
+  await Promise.all(roots.splice(0).map((root) => rm(root, { recursive: true, force: true })))
+})
+
+describe('structured session proven-dead TUI retry', () => {
+  it('acquires native ownership without trying to close the dead TUI again', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'orca-handoff-dead-retry-'))
+    roots.push(root)
+    const store = await AgentSessionRecordStore.open({
+      directory: join(root, 'store'),
+      hostId: 'local'
+    })
+    const reserved = await store.reserveOwner({
+      sessionId: SESSION,
+      location: {
+        executionHostId: 'local',
+        wslDistro: null,
+        workspaceId: 'workspace-1',
+        workspaceKind: 'folder'
+      },
+      provider: 'codex',
+      accountHome: { variable: 'CODEX_HOME', path: join(root, 'codex-home') },
+      runtimeKind: 'tui',
+      expectedFence: null,
+      spawnToken: 'tui-spawn',
+      claimKeyId: 'key-1',
+      handoffOperationId: null,
+      probe: { outcome: 'reservation-unused' },
+      operation: { callerKey: 'test', operationId: CREATE_OPERATION, fingerprint: 'create' },
+      now: NOW
+    })
+    const tuiFence = reserved.record.lease.runtimeFence
+    await store.commitProcessIdentity({
+      sessionId: SESSION,
+      fence: tuiFence,
+      process: {
+        hostId: 'local',
+        pid: 4200,
+        processStartTimeMs: NOW - 1_000,
+        spawnToken: 'tui-spawn'
+      },
+      now: NOW
+    })
+    await store.proveOwner({
+      sessionId: SESSION,
+      fence: tuiFence,
+      link: {
+        linkId: 'tui-link',
+        handle: { provider: 'codex', threadId: THREAD },
+        origin: 'created',
+        mintedAtFence: tuiFence,
+        observedAt: NOW
+      },
+      now: NOW
+    })
+    await recoverStoredDeadTuiOwnerForHandoff(store, {
+      sessionId: SESSION,
+      expectedFence: tuiFence,
+      operationId: OPERATION,
+      probe: { outcome: 'pid-absent' },
+      now: NOW
+    })
+    const journal = await openAgentSessionJournal({
+      identity: {
+        sessionId: SESSION,
+        workspaceId: 'workspace-1',
+        hostId: 'local',
+        agent: 'codex',
+        providerHandle: { kind: 'codex', threadId: THREAD }
+      },
+      journalDir: join(root, 'journal')
+    })
+    const closeTuiOwner =
+      vi.fn<NonNullable<StructuredAgentSessionHandoffTransport['closeTuiOwner']>>()
+    const coordinator = new StructuredAgentSessionHandoffCoordinator({
+      store,
+      claimKeyId: 'key-1',
+      transport: {
+        hostLabel: 'Test host',
+        launchTui: vi.fn(),
+        reproveTuiOwner: vi.fn(),
+        recoverTuiOwner: vi.fn(),
+        stopRecoveredOwner: vi.fn(),
+        closeTuiOwner,
+        waitForTuiExit: vi.fn(),
+        waitForTuiIdleOrExit: vi.fn(),
+        tuiStatus: () => 'busy'
+      },
+      session: () => ({ journal, fence: store.getRecord(SESSION)?.lease.runtimeFence ?? 1 }),
+      suspendNative: vi.fn(),
+      acquireNative: async ({ fence, spawnToken }) => {
+        await store.commitProcessIdentity({
+          sessionId: SESSION,
+          fence,
+          process: {
+            hostId: 'local',
+            pid: 4300,
+            processStartTimeMs: NOW,
+            spawnToken
+          },
+          now: NOW
+        })
+        return store.proveOwner({
+          sessionId: SESSION,
+          fence,
+          link: {
+            linkId: 'native-link',
+            handle: { provider: 'codex', threadId: THREAD },
+            origin: 'resumed',
+            mintedAtFence: fence,
+            observedAt: NOW
+          },
+          now: NOW
+        })
+      },
+      acquireNativeStop: vi.fn(async () => true),
+      importTuiHistory: vi.fn(),
+      publish: vi.fn(),
+      schedule: async (_sessionId, task) => task(),
+      now: () => NOW
+    })
+    const fields = {
+      direction: 'to-native' as const,
+      mode: 'now' as const,
+      action: 'retry' as const
+    }
+    const request: AgentSessionHandoffRequest = {
+      envelope: {
+        sessionId: SESSION,
+        clientOperationId: OPERATION,
+        expectedRuntimeFence: store.getRecord(SESSION)?.lease.runtimeFence ?? null,
+        payloadFingerprint: computeAgentSessionPayloadFingerprint({
+          method: 'agentSession.requestHandoff',
+          sessionId: SESSION,
+          fields
+        })
+      },
+      ...fields
+    }
+
+    expect(coordinator.status(SESSION)).toMatchObject({ phase: 'failed', owner: 'tui' })
+    expect(
+      await (
+        coordinator as {
+          request: (callerKey: string, params: AgentSessionHandoffRequest) => Promise<unknown>
+        }
+      ).request('client-1', request)
+    ).toMatchObject({ ok: true })
+    await vi.waitFor(() => expect(coordinator.status(SESSION).owner).toBe('native'))
+    // Settle the flow's trailing outcome write before afterEach removes the store root.
+    await coordinator.drain()
+    expect(closeTuiOwner).not.toHaveBeenCalled()
+    expect(store.getRecord(SESSION)?.lease).toMatchObject({
+      runtimeKind: 'native',
+      claimStatus: 'live',
+      handoffStage: null
+    })
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-read-restore.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-read-restore.test.ts
new file mode 100644
index 00000000000..34e3fb8a4cf
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-read-restore.test.ts
@@ -0,0 +1,110 @@
+// Read restore decides whether a session comes back at all.
+//
+// A chat still in the pre-SQLite format has no `journal.db`, so the probe that
+// loads one reports nothing. Reading that as "no session" is what removed these
+// chats: an unpublished session is also what prunes its tab out of the saved
+// workspace, so the tab is gone before anything can explain itself.
+
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import type { AgentSessionRecord } from '../../../shared/agent-session-record'
+import type { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import { journalDirectoryFor } from '../agent-session-journal/journal-paths'
+import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
+import { restoreStructuredAgentSessionRead } from './structured-agent-session-read-restore'
+
+const SESSION_ID = 'codex_read_restore_fixture'
+const WORKSPACE_ID = 'repo-1::/tmp/workspace'
+
+const RECORD = {
+  schemaVersion: 2,
+  sessionId: SESSION_ID,
+  location: {
+    executionHostId: 'local',
+    wslDistro: null,
+    workspaceId: WORKSPACE_ID,
+    workspaceKind: 'git-worktree'
+  },
+  provider: 'codex',
+  providerHandleChain: [
+    {
+      linkId: 'codex-1-thread-1',
+      handle: { provider: 'codex', threadId: 'thread-1' },
+      origin: 'created',
+      mintedAtFence: 1,
+      observedAt: 1
+    }
+  ],
+  accountHome: { variable: 'CODEX_HOME', path: '/tmp/codex-home' },
+  createdAt: 1,
+  updatedAt: 2,
+  lease: { sessionId: SESSION_ID, runtimeKind: 'native', runtimeFence: 1 }
+} as unknown as AgentSessionRecord
+
+const store = {
+  getRecord: (sessionId: string) => (sessionId === SESSION_ID ? RECORD : null)
+} as unknown as AgentSessionRecordStore
+
+let journalRoot: string
+const opened: AgentSessionJournal[] = []
+
+async function writeRemnant(name: string): Promise<string> {
+  const dir = journalDirectoryFor(journalRoot, {
+    workspaceId: WORKSPACE_ID,
+    sessionId: SESSION_ID
+  })
+  await mkdir(dir, { recursive: true })
+  await writeFile(join(dir, name), '{"kind":"epoch","v":1,"seq":1}\n', 'utf8')
+  return join(dir, name)
+}
+
+beforeEach(async () => {
+  journalRoot = await mkdtemp(join(tmpdir(), 'orca-read-restore-'))
+})
+
+afterEach(async () => {
+  await Promise.allSettled(opened.splice(0).map((journal) => journal.close()))
+  await rm(journalRoot, { recursive: true, force: true })
+})
+
+describe('a session whose journal is still the pre-SQLite format', () => {
+  it('is published, carrying the message that explains it', async () => {
+    const transcript = await writeRemnant('log.jsonl')
+
+    const restored = await restoreStructuredAgentSessionRead(store, journalRoot, SESSION_ID)
+
+    expect(restored).not.toBeNull()
+    opened.push(restored!.journal)
+    const disclosed = restored!.journal
+      .snapshot()
+      .items.map((entry) => (entry.body.kind === 'status' ? entry.body.text : ''))
+    expect(disclosed.join('')).toContain(transcript)
+    // Publishing it costs no agent process; acquisition still waits for the user.
+    expect(restored!.hasProviderChild).toBe(false)
+  })
+
+  it('is published for a remnant whose log is gone', async () => {
+    await writeRemnant('snapshot.json')
+
+    const restored = await restoreStructuredAgentSessionRead(store, journalRoot, SESSION_ID)
+
+    expect(restored).not.toBeNull()
+    opened.push(restored!.journal)
+  })
+
+  it('still drops a session with neither a journal nor a remnant', async () => {
+    const restored = await restoreStructuredAgentSessionRead(store, journalRoot, SESSION_ID)
+
+    expect(restored).toBeNull()
+  })
+
+  it('still drops a session with no record', async () => {
+    await writeRemnant('log.jsonl')
+
+    const restored = await restoreStructuredAgentSessionRead(store, journalRoot, 'unknown-session')
+
+    expect(restored).toBeNull()
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-read-restore.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-read-restore.ts
index 5f2589de4f2..34fd6452b08 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-read-restore.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-read-restore.ts
@@ -3,6 +3,7 @@ import type {
   AgentSessionRecord
 } from '../../../shared/agent-session-record'
 import type { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import { findJournalFileFormatRemnant } from '../agent-session-journal/journal-file-format-remnant'
 import { loadJournal } from '../agent-session-journal/journal-open'
 import { journalDirectoryFor } from '../agent-session-journal/journal-paths'
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
@@ -39,16 +40,28 @@ export async function restoreStructuredAgentSessionRead(
     workspaceId: record.location.workspaceId,
     sessionId
   })
-  const loaded = await loadJournal(journalDir, sessionId)
-  if (!loaded || loaded.corrupt) {
+  const loaded = loadJournal(journalDir, sessionId)
+  if (loaded?.corrupt) {
+    return null
+  }
+  // A session still in the pre-SQLite format has no `journal.db` to load. Dropping
+  // it here leaves it unpublished, which is also what prunes its tab out of the
+  // saved workspace — so the chat disappears with nowhere to explain itself.
+  if (!loaded && !findJournalFileFormatRemnant(journalDir)) {
     return null
   }
   const journal = await openAgentSessionJournal({
     identity: journalIdentityFor(record, params),
     journalDir,
-    loaded
+    // Omitted, not `null`: the store reads `null` as "replay already ran and
+    // found nothing" and founds a fresh epoch. In process the probe above is the
+    // previous statement, so the window is zero-width; this holds the line for a
+    // database another process creates in between.
+    ...(loaded ? { loaded } : {})
   })
-  // Read restore opens the journal and nothing else: no adapter call, so no provider child.
+  // Read restore opens the journal and nothing else: no adapter call, so no
+  // provider child. Opening it can still write — a session whose history is in
+  // the old format founds its epoch and commits the row explaining that here.
   return {
     journal,
     params,
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-readable-restorer.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-readable-restorer.ts
index f4e09509b07..e3b96dbd36a 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-readable-restorer.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-readable-restorer.ts
@@ -2,7 +2,10 @@ import type { AgentSessionRecord } from '../../../shared/agent-session-record'
 import type { AgentSessionWireRefusal } from '../../../shared/agent-session-wire'
 import type { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
 import type { RestoredStructuredAgentSessionRead } from './structured-agent-session-read-restore'
-import { restoreStructuredAgentSessionsOnRestart } from './structured-agent-session-restart-restore'
+import {
+  restoreOneStructuredAgentSessionRead,
+  restoreStructuredAgentSessionsOnRestart
+} from './structured-agent-session-restart-restore'
 
 export class StructuredAgentSessionReadableRestorer {
   private restorePromise: Promise<void> | null = null
@@ -29,6 +32,26 @@ export class StructuredAgentSessionReadableRestorer {
     return this.restorePromise
   }
 
+  /**
+   * One session, on demand, after startup.
+   *
+   * Deliberately outside `restorePromise`: that latch answers "has the startup sweep run", and a
+   * surface asking for a session the sweep never covered — or that was closed since — must not be
+   * told yes because the sweep finished. Needs no dedupe of its own; the per-session task queue
+   * `serialize` runs on already orders concurrent callers, and the second one sees `hasSession`.
+   *
+   * Provider-agnostic by construction: eligibility is `supportsRecord`, which the adapter router
+   * answers for Claude and Codex from the record's own provider.
+   */
+  async restoreOne(sessionId: string): Promise<boolean> {
+    const record = this.input.store.getRecord(sessionId)
+    if (!record || !this.input.supportsRecord(record)) {
+      return false
+    }
+    await restoreOneStructuredAgentSessionRead(this.input, sessionId)
+    return this.input.hasSession(sessionId)
+  }
+
   private async restoreReadableSessions(sessionIds?: readonly string[]): Promise<void> {
     const targetOrder = sessionIds
       ? new Map(sessionIds.map((sessionId, index) => [sessionId, index]))
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-recovery-exits.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-recovery-exits.test.ts
index a5927dc0c14..5cd888cc5cc 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-recovery-exits.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-recovery-exits.test.ts
@@ -8,7 +8,7 @@ import { spawnProcess } from '../../../shared/child-process/run-process'
 import { CODEX_SPAWN_TOKEN_ENV } from '../../codex/codex-structured-owner-identity'
 import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
 import { readProcessStartTimeMs } from '../../runtime/agent-session-process-identity-probe'
-import { createStructuredAgentSessionOwnerProbe } from '../../runtime/structured-agent-session-runtime'
+import { createStructuredAgentSessionOwnerProbe } from '../../runtime/structured-agent-session-owner-probe'
 import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
 import { StructuredAgentSessionHost } from './structured-agent-session-host'
 import type { StructuredAgentSessionHostDeps } from './structured-agent-session-host-types'
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-restore.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-restore.ts
index 6eb6fe15059..174aac7d72b 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-restore.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-restore.ts
@@ -22,39 +22,56 @@ import {
 
 const JOURNAL_RESTORE_CONCURRENCY = 4
 
-export async function restoreStructuredAgentSessionsOnRestart(input: {
+export type StructuredAgentSessionReadRestoreDeps = {
   store: AgentSessionRecordStore
   journalRoot: string
-  records: AgentSessionRecord[]
   reconcile: (sessionId: string) => Promise<AgentSessionWireRefusal | null>
   resolveRecovery: (sessionId: string) => Promise<unknown>
   serialize: <T>(sessionId: string, task: () => Promise<T>) => Promise<T>
   hasSession: (sessionId: string) => boolean
   onReadable: (sessionId: string, restored: RestoredStructuredAgentSessionRead) => void
   restoreHandoff: (sessionId: string) => Promise<void>
-}): Promise<void> {
-  await mapWithConcurrency(input.records, JOURNAL_RESTORE_CONCURRENCY, async ({ sessionId }) => {
-    const unreconciled = await input.reconcile(sessionId)
-    if (!unreconciled) {
-      // A session latched in recovery exits here at startup, without waiting for a client.
-      await input.resolveRecovery(sessionId)
-    }
-    await input.serialize(sessionId, async () => {
-      if (input.hasSession(sessionId)) {
-        // A surface that took a hold mid-restore already attached this one.
-        await input.restoreHandoff(sessionId)
-        return
-      }
-      const restored = await restoreStructuredAgentSessionRead(
-        input.store,
-        input.journalRoot,
-        sessionId
-      )
-      if (!restored) {
-        return
-      }
-      input.onReadable(sessionId, restored)
+}
+
+/**
+ * One session's share of the restart restore, and the whole of an on-demand one.
+ *
+ * Startup maps this over every supported record; a surface asking for a session it cannot see
+ * calls it for one id. The CALLER decides which records are eligible — startup filters by
+ * `supportsRecord` before mapping, so an on-demand caller owes the same check.
+ */
+export async function restoreOneStructuredAgentSessionRead(
+  input: StructuredAgentSessionReadRestoreDeps,
+  sessionId: string
+): Promise<void> {
+  const unreconciled = await input.reconcile(sessionId)
+  if (!unreconciled) {
+    // A session latched in recovery exits here at startup, without waiting for a client.
+    await input.resolveRecovery(sessionId)
+  }
+  await input.serialize(sessionId, async () => {
+    if (input.hasSession(sessionId)) {
+      // A surface that took a hold mid-restore already attached this one.
       await input.restoreHandoff(sessionId)
-    })
+      return
+    }
+    const restored = await restoreStructuredAgentSessionRead(
+      input.store,
+      input.journalRoot,
+      sessionId
+    )
+    if (!restored) {
+      return
+    }
+    input.onReadable(sessionId, restored)
+    await input.restoreHandoff(sessionId)
   })
 }
+
+export async function restoreStructuredAgentSessionsOnRestart(
+  input: StructuredAgentSessionReadRestoreDeps & { records: AgentSessionRecord[] }
+): Promise<void> {
+  await mapWithConcurrency(input.records, JOURNAL_RESTORE_CONCURRENCY, ({ sessionId }) =>
+    restoreOneStructuredAgentSessionRead(input, sessionId)
+  )
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-status-publication.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-status-publication.test.ts
new file mode 100644
index 00000000000..884fba78a4e
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-status-publication.test.ts
@@ -0,0 +1,149 @@
+// Startup restore has to publish status, not just index the session.
+//
+// A tab nobody reopens after a restart still owes the sidebar a row. The host restores such a
+// session read-only, without a provider child, so the only thing that can surface its state is
+// the status publication the restore wiring makes.
+
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import type {
+  AgentSessionMutationEnvelope,
+  AgentSessionStatusEvent
+} from '../../../shared/agent-session-wire'
+import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
+import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
+import { StructuredAgentSessionHost } from './structured-agent-session-host'
+import {
+  HOST_TEST_NOW as NOW,
+  HOST_TEST_SESSION as SESSION,
+  HOST_TEST_THREAD as THREAD,
+  hostTestAttachParams,
+  hostTestMessage,
+  hostTestOperationId,
+  resetHostTestOperationIds
+} from './structured-agent-session-host-test-data'
+
+const CALLER = { callerKey: 'client-1' }
+
+const hosts: StructuredAgentSessionHost[] = []
+let root = ''
+
+function adapter(): StructuredAgentSessionAdapter {
+  return {
+    acquire: async ({ fence, spawnToken }) => ({
+      process: { hostId: 'local', pid: 4242, processStartTimeMs: 1_700_000_000_000, spawnToken },
+      link: {
+        linkId: `link-${fence}`,
+        handle: { provider: 'codex', threadId: THREAD },
+        origin: 'created',
+        mintedAtFence: fence,
+        observedAt: NOW
+      }
+    }),
+    dispatch: async () => ({
+      state: 'accepted',
+      providerIdentity: { provider: 'codex', threadId: THREAD, turnId: 'turn-1', ordinal: 1 }
+    }),
+    cancelTurn: async () => ({ cancelled: true }),
+    answerPrompt: async () => undefined,
+    setOption: async () => undefined
+  }
+}
+
+function createHost(store: AgentSessionRecordStore): StructuredAgentSessionHost {
+  const host = new StructuredAgentSessionHost({
+    store,
+    adapter: adapter(),
+    journalRoot: root,
+    claimKeyId: 'key-1',
+    mintSpawnToken: () => 'spawn-a',
+    probeOwner: async () => ({
+      outcome: 'indeterminate',
+      reason: 'read does not need ownership'
+    }),
+    now: () => NOW
+  })
+  hosts.push(host)
+  return host
+}
+
+function sendEnvelope(
+  store: AgentSessionRecordStore,
+  fields: Record<string, unknown>
+): AgentSessionMutationEnvelope {
+  return {
+    sessionId: SESSION,
+    clientOperationId: hostTestOperationId(),
+    expectedRuntimeFence: store.getRecord(SESSION)?.lease.runtimeFence ?? 1,
+    payloadFingerprint: computeAgentSessionPayloadFingerprint({
+      method: 'agentSession.send',
+      sessionId: SESSION,
+      fields
+    })
+  }
+}
+
+/** Persists one turn, then hands back a restarted host over the same directories. */
+async function restartWithPersistedTurn(): Promise<StructuredAgentSessionHost> {
+  root = await mkdtemp(join(tmpdir(), 'orca-restart-status-'))
+  resetHostTestOperationIds()
+  const directory = join(root, 'store')
+  const store = await AgentSessionRecordStore.open({ directory, hostId: 'local' })
+  const host = createHost(store)
+  expect(await host.attach(CALLER, hostTestAttachParams(null))).toMatchObject({ ok: true })
+  const body = hostTestMessage('persisted conversation')
+  await host.send(CALLER, { envelope: sendEnvelope(store, { body }), body })
+  await host.flushAllStreamedEvents()
+  return createHost(await AgentSessionRecordStore.open({ directory, hostId: 'local' }))
+}
+
+afterEach(async () => {
+  await Promise.all(hosts.splice(0).map((host) => host.flushAllStreamedEvents()))
+  await rm(root, { recursive: true, force: true })
+  root = ''
+})
+
+describe('structured session restart status publication', () => {
+  // Served by the subscribe-time re-projection rather than the restore's own publish, so this
+  // covers what a restored journal projects — not the restore wiring. The test below pins that.
+  it('projects the persisted turn of a session restored without a provider', async () => {
+    const restarted = await restartWithPersistedTurn()
+
+    await restarted.restoreReadableSessions()
+    const events: AgentSessionStatusEvent[] = []
+    restarted.subscribeStatus({ id: 'session-list', emit: (event) => events.push(event) })
+
+    expect(events).toEqual([
+      {
+        type: 'snapshot',
+        sessions: [
+          expect.objectContaining({
+            sessionId: SESSION,
+            workspaceId: 'workspace-1',
+            agent: 'codex',
+            status: 'idle',
+            latestPrompt: 'persisted conversation'
+          })
+        ]
+      }
+    ])
+  })
+
+  it('publishes a restored session to a list already sitting on the stream', async () => {
+    const restarted = await restartWithPersistedTurn()
+    const events: AgentSessionStatusEvent[] = []
+    restarted.subscribeStatus({ id: 'session-list', emit: (event) => events.push(event) })
+    expect(events).toEqual([{ type: 'snapshot', sessions: [] }])
+
+    await restarted.restoreReadableSessions()
+
+    // The restore wiring publishes; without it this list never hears about the session at all.
+    expect(events.at(-1)).toEqual({
+      type: 'status',
+      session: expect.objectContaining({ sessionId: SESSION, status: 'idle' })
+    })
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-reveal.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-reveal.test.ts
new file mode 100644
index 00000000000..e2ef20503d6
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-reveal.test.ts
@@ -0,0 +1,236 @@
+/**
+ * Revealing a persisted chat, for both structured providers.
+ *
+ * The reveal path is the only way an Agent Session History row reaches a chat whose tab this
+ * process never published — a chat closed cleanly, or one this process has not opened since
+ * launch. It is exercised here through the readable restorer rather than the whole host, because
+ * what it must get right is which records it accepts and what it does when the journal is gone.
+ */
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { AgentSessionRecord } from '../../../shared/agent-session-record'
+import {
+  agentSessionLeaseFixture,
+  agentSessionRecordFixture
+} from '../../../shared/agent-session-record.test-fixture'
+import { StructuredAgentSessionReadableRestorer } from './structured-agent-session-readable-restorer'
+import * as readRestore from './structured-agent-session-read-restore'
+import * as providerSupport from './structured-agent-session-provider-support'
+import { revealStructuredAgentSession } from './structured-agent-session-reveal'
+
+function recordFor(provider: 'claude' | 'codex', sessionId: string): AgentSessionRecord {
+  const record = agentSessionRecordFixture(agentSessionLeaseFixture({ sessionId }))
+  return {
+    ...record,
+    provider,
+    providerHandleChain:
+      provider === 'codex'
+        ? [
+            {
+              ...record.providerHandleChain[0]!,
+              handle: { provider: 'codex', threadId: `thread-${sessionId}` }
+            }
+          ]
+        : record.providerHandleChain
+  }
+}
+
+function harness(
+  records: AgentSessionRecord[],
+  options: { supports?: (record: AgentSessionRecord) => boolean } = {}
+) {
+  const live = new Map<string, unknown>()
+  const restoreHandoff = vi.fn(async () => undefined)
+  const serializedIds: string[] = []
+  const serialize = <T>(sessionId: string, task: () => Promise<T>): Promise<T> => {
+    serializedIds.push(sessionId)
+    return task()
+  }
+  const restorer = new StructuredAgentSessionReadableRestorer({
+    store: {
+      getRecord: (sessionId: string) => records.find((r) => r.sessionId === sessionId) ?? null,
+      listRecords: () => records
+    } as never,
+    journalRoot: '/journals',
+    supportsRecord: options.supports ?? (() => true),
+    reconcile: async () => null,
+    resolveRecovery: async () => undefined,
+    serialize,
+    hasSession: (sessionId) => live.has(sessionId),
+    onReadable: (sessionId, restored) => live.set(sessionId, restored),
+    restoreHandoff
+  })
+  return { restorer, live, restoreHandoff, serializedIds }
+}
+
+const readable = { journal: {}, params: {}, fence: 1 } as never
+
+afterEach(() => {
+  vi.restoreAllMocks()
+})
+
+describe('revealing one structured session on demand', () => {
+  beforeEach(() => {
+    vi.spyOn(readRestore, 'restoreStructuredAgentSessionRead').mockResolvedValue(readable)
+  })
+
+  it.each(['claude', 'codex'] as const)('restores a persisted %s chat', async (provider) => {
+    const sessionId = `session-${provider}`
+    const { restorer, live } = harness([recordFor(provider, sessionId)])
+
+    await expect(restorer.restoreOne(sessionId)).resolves.toBe(true)
+    expect(live.has(sessionId)).toBe(true)
+  })
+
+  it('does not need the startup sweep to have run, or run it', async () => {
+    // The whole point: `restore()` is latched to once per process, and a surface asking later must
+    // not be answered from that latch — nor trip it, which would skip every other record.
+    const records = [recordFor('codex', 'session-asked'), recordFor('claude', 'session-untouched')]
+    const { restorer, live } = harness(records)
+
+    await restorer.restoreOne('session-asked')
+
+    expect(live.has('session-asked')).toBe(true)
+    expect(live.has('session-untouched')).toBe(false)
+  })
+
+  it('serializes against the session it restores', async () => {
+    const { restorer, serializedIds } = harness([recordFor('claude', 'session-serialized')])
+
+    await restorer.restoreOne('session-serialized')
+
+    // Ordering against close/eviction is the task queue's job, so the restore must be inside it.
+    expect(serializedIds).toEqual(['session-serialized'])
+  })
+
+  it('returns the live session instead of restoring over it', async () => {
+    const { restorer, live } = harness([recordFor('codex', 'session-live')])
+    live.set('session-live', readable)
+
+    await expect(restorer.restoreOne('session-live')).resolves.toBe(true)
+    expect(readRestore.restoreStructuredAgentSessionRead).not.toHaveBeenCalled()
+  })
+
+  it('refuses a record no adapter supports', async () => {
+    const { restorer } = harness([recordFor('codex', 'session-unsupported')], {
+      supports: () => false
+    })
+
+    await expect(restorer.restoreOne('session-unsupported')).resolves.toBe(false)
+    expect(readRestore.restoreStructuredAgentSessionRead).not.toHaveBeenCalled()
+  })
+
+  it('refuses a session this host holds no record for', async () => {
+    const { restorer } = harness([])
+
+    await expect(restorer.restoreOne('session-absent')).resolves.toBe(false)
+  })
+})
+
+describe('a record whose journal cannot be read', () => {
+  it('reports not-readable without throwing, for either provider', async () => {
+    // A chat whose journal predates the SQLite store restores to nothing here. That is not a
+    // refusal: attach still recovers it, so the caller publishes the tab and lets the pane's hold
+    // finish the job. Throwing, or reporting success, would both be wrong.
+    vi.spyOn(readRestore, 'restoreStructuredAgentSessionRead').mockResolvedValue(null)
+    const { restorer, live } = harness([
+      recordFor('claude', 'session-no-journal-claude'),
+      recordFor('codex', 'session-no-journal-codex')
+    ])
+
+    await expect(restorer.restoreOne('session-no-journal-claude')).resolves.toBe(false)
+    await expect(restorer.restoreOne('session-no-journal-codex')).resolves.toBe(false)
+    expect(live.size).toBe(0)
+  })
+})
+
+describe('the host answer a client acts on', () => {
+  beforeEach(() => {
+    // Eligibility is the router's call; these cases are about what the answer carries.
+    vi.spyOn(providerSupport, 'adapterSupportsRecord').mockReturnValue(true)
+  })
+
+  function record(provider: 'claude' | 'codex', workspaceId: string) {
+    const base = recordFor(provider, 'session-answered')
+    return { ...base, location: { ...base.location, workspaceId } }
+  }
+
+  it("answers with the record's own workspace and provider, never a caller's", async () => {
+    // The security property: a client sends only a session id, so the tab cannot be aimed at
+    // another workspace by asking for one.
+    const stored = record('claude', 'workspace-from-record')
+
+    await expect(
+      revealStructuredAgentSession(
+        { store: { getRecord: () => stored } as never, adapter: {} as never },
+        'session-answered',
+        () => true,
+        async () => true
+      )
+    ).resolves.toEqual({
+      sessionId: 'session-answered',
+      workspaceId: 'workspace-from-record',
+      agent: 'claude',
+      readable: true
+    })
+  })
+
+  it('refuses a session this host holds no record for', async () => {
+    await expect(
+      revealStructuredAgentSession(
+        { store: { getRecord: () => null } as never, adapter: {} as never },
+        'session-absent',
+        () => false,
+        async () => false
+      )
+    ).rejects.toThrow('agent_session_identity_required')
+  })
+
+  it('refuses a record no adapter of this host supports', async () => {
+    vi.mocked(providerSupport.adapterSupportsRecord).mockReturnValue(false)
+
+    await expect(
+      revealStructuredAgentSession(
+        {
+          store: { getRecord: () => record('codex', 'workspace-1') } as never,
+          adapter: {} as never
+        },
+        'session-answered',
+        () => false,
+        async () => false
+      )
+    ).rejects.toThrow('structured_agent_session_unsupported')
+  })
+
+  it('answers not-readable without refusing when the journal could not be restored', async () => {
+    // The tab is still worth publishing: attach recovers what read restore cannot.
+    await expect(
+      revealStructuredAgentSession(
+        {
+          store: { getRecord: () => record('codex', 'workspace-1') } as never,
+          adapter: {} as never
+        },
+        'session-answered',
+        () => false,
+        async () => false
+      )
+    ).resolves.toMatchObject({ readable: false, agent: 'codex' })
+  })
+
+  it('does not restore over a session that is already live', async () => {
+    const restoreReadable = vi.fn(async () => true)
+
+    await expect(
+      revealStructuredAgentSession(
+        {
+          store: { getRecord: () => record('codex', 'workspace-1') } as never,
+          adapter: {} as never
+        },
+        'session-answered',
+        () => true,
+        restoreReadable
+      )
+    ).resolves.toMatchObject({ readable: true })
+    expect(restoreReadable).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-reveal.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-reveal.ts
new file mode 100644
index 00000000000..41774a9d719
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-reveal.ts
@@ -0,0 +1,80 @@
+// Making a persisted chat addressable again, for a surface that can no longer see it.
+//
+// `close` keeps the record and the journal on disk precisely so a session can be attached again;
+// what it does not keep is the tab, and a client drops every unpublished `agent-session` tab on
+// each session-tabs sync. So a chat the user closed — or one this process has not opened since
+// launch — is reachable in Agent Session History by id and by nothing else. This is the lookup that
+// turns that id back into something a client can publish.
+//
+// It is deliberately the whole of what reveal does on the host. It takes no hold: a provider child
+// exists because a surface asked for one, and the chat pane asks when it binds. And a journal it
+// cannot read is not a refusal — a chat whose journal predates the SQLite store restores to nothing
+// here, yet attach still recovers it, so the tab is worth publishing either way.
+
+import { adapterSupportsRecord } from './structured-agent-session-provider-support'
+import { StructuredAgentSessionReadableRestorer } from './structured-agent-session-readable-restorer'
+import { StructuredAgentSessionRestartRestoreGate } from './structured-agent-session-restart-restore-gate'
+import type {
+  StructuredAgentSessionHostDeps,
+  StructuredAgentSessionReveal
+} from './structured-agent-session-host-types'
+
+/** Throws its refusal as the code itself, matching `resumeHeldStructuredAgentSession`. */
+export async function revealStructuredAgentSession(
+  deps: Pick<StructuredAgentSessionHostDeps, 'store' | 'adapter'>,
+  sessionId: string,
+  hasSession: (sessionId: string) => boolean,
+  restoreReadable: (sessionId: string) => Promise<boolean>
+): Promise<StructuredAgentSessionReveal> {
+  const record = deps.store.getRecord(sessionId)
+  if (!record) {
+    throw new Error('agent_session_identity_required')
+  }
+  if (!adapterSupportsRecord(deps.adapter, record)) {
+    throw new Error('structured_agent_session_unsupported')
+  }
+  // Lease state is not consulted on purpose: this neither claims the lease nor spawns a child, so a
+  // contested or reconciling chat still reveals and the hold that follows adjudicates it. Refusing
+  // here would hide the one view of a session a user needs when its ownership is in doubt.
+  const readable = hasSession(sessionId) || (await restoreReadable(sessionId))
+  return {
+    sessionId,
+    // From the record, never from a caller: a client that knows only a session id must not be able
+    // to aim the tab publication at another workspace.
+    workspaceId: record.location.workspaceId,
+    agent: record.provider,
+    readable
+  }
+}
+
+/**
+ * The host's whole readable-restore surface: the startup sweep and the on-demand reveal.
+ *
+ * Bundled the way the handoff and lifetime collaborators are, because the two share the restorer
+ * and differ only in who is asking — startup, once, for everything; a surface, later, for one.
+ */
+export function createStructuredAgentSessionHostRestore(
+  deps: StructuredAgentSessionHostDeps,
+  wiring: Omit<
+    ConstructorParameters<typeof StructuredAgentSessionReadableRestorer>[0],
+    'store' | 'journalRoot' | 'supportsRecord'
+  >
+): {
+  restoreReadableSessions: (sessionIds?: readonly string[]) => Promise<void>
+  revealSession: (sessionId: string) => Promise<StructuredAgentSessionReveal>
+} {
+  const restorer = new StructuredAgentSessionReadableRestorer({
+    store: deps.store,
+    journalRoot: deps.journalRoot,
+    supportsRecord: (record) => adapterSupportsRecord(deps.adapter, record),
+    ...wiring
+  })
+  const gate = new StructuredAgentSessionRestartRestoreGate()
+  return {
+    restoreReadableSessions: (sessionIds) => gate.run(() => restorer.restore(sessionIds)),
+    revealSession: (sessionId) =>
+      revealStructuredAgentSession(deps, sessionId, wiring.hasSession, (id) =>
+        restorer.restoreOne(id)
+      )
+  }
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-send-idempotency.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-send-idempotency.test.ts
index b06ec51018f..581743633c0 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-send-idempotency.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-send-idempotency.test.ts
@@ -4,17 +4,19 @@ import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type { AgentJournalMessageItem } from '../../../shared/agent-session-journal-types'
 import { structuredAgentSessionPayloadFingerprint } from '../../../shared/structured-agent-session-mutation'
-import { openAgentSessionJournal } from '../agent-session-journal/journal-store-factory'
+import { createTrackedJournalOpener } from '../agent-session-journal/journal-store-test-open'
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
 import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
 import { performSend, type AgentSessionTurnContext } from './structured-agent-session-turns'
 
+const journals = createTrackedJournalOpener()
+
 let root: string
 let journal: AgentSessionJournal
 
 beforeEach(async () => {
   root = await mkdtemp(join(tmpdir(), 'orca-send-idempotency-'))
-  journal = await openAgentSessionJournal({
+  journal = await journals.open({
     identity: {
       sessionId: 'session-1',
       workspaceId: 'workspace-1',
@@ -27,6 +29,7 @@ beforeEach(async () => {
 })
 
 afterEach(async () => {
+  await journals.closeAll()
   await rm(root, { recursive: true, force: true })
 })
 
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-status-feed.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-status-feed.test.ts
new file mode 100644
index 00000000000..7efd147c420
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-status-feed.test.ts
@@ -0,0 +1,242 @@
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import type { AgentSessionStatusEvent } from '../../../shared/agent-session-wire'
+import { createTrackedJournalOpener } from '../agent-session-journal/journal-store-test-open'
+import { StructuredAgentSessionStatusFeed } from './structured-agent-session-status-feed'
+
+const SESSION = 'status-session'
+const TURN_IDENTITY = {
+  provider: 'codex',
+  threadId: 'thread-1',
+  turnId: 'turn-1',
+  ordinal: 0
+} as const
+const USER_IDENTITY = {
+  provider: 'codex',
+  threadId: 'thread-1',
+  turnId: 'turn-1',
+  ordinal: 1
+} as const
+
+let root: string
+const journals = createTrackedJournalOpener()
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-agent-status-feed-'))
+})
+
+afterEach(async () => {
+  await journals.closeAll()
+  await rm(root, { recursive: true, force: true })
+})
+
+async function openJournal(sessionId = SESSION) {
+  return journals.open({
+    identity: {
+      sessionId,
+      workspaceId: 'workspace-1',
+      hostId: 'local',
+      agent: 'codex',
+      providerHandle: { kind: 'codex', threadId: 'thread-1' }
+    },
+    journalDir: join(root, sessionId)
+  })
+}
+
+function indexed(session: { journal: Awaited<ReturnType<typeof openJournal>> }) {
+  return {
+    journal: session.journal,
+    params: { location: { workspaceId: 'workspace-1' }, provider: 'codex' as const }
+  }
+}
+
+function feedFor(sessions: Map<string, { journal: Awaited<ReturnType<typeof openJournal>> }>) {
+  let now = 1_000
+  const feed = new StructuredAgentSessionStatusFeed({
+    sessions: {
+      get: (sessionId: string) => {
+        const session = sessions.get(sessionId)
+        return session ? indexed(session) : undefined
+      },
+      [Symbol.iterator]: function* () {
+        for (const [sessionId, session] of sessions) {
+          yield [sessionId, indexed(session)] as const
+        }
+      }
+    } as unknown as ReadonlyMap<string, ReturnType<typeof indexed>>,
+    getRecord: () => null,
+    now: () => (now += 1)
+  })
+  const events: AgentSessionStatusEvent[] = []
+  const dispose = feed.subscribe({ id: 'list-1', emit: (event) => events.push(event) })
+  return { feed, events, dispose }
+}
+
+describe('StructuredAgentSessionStatusFeed', () => {
+  it('opens with every readable session and reports no status before a persisted turn', async () => {
+    const journal = await openJournal()
+    const { events } = feedFor(new Map([[SESSION, { journal }]]))
+
+    expect(events).toEqual([
+      {
+        type: 'snapshot',
+        sessions: [
+          {
+            sessionId: SESSION,
+            workspaceId: 'workspace-1',
+            agent: 'codex',
+            status: null,
+            latestPrompt: '',
+            updatedAt: expect.any(Number)
+          }
+        ]
+      }
+    ])
+  })
+
+  it('publishes working, then idle once the running marker is tombstoned, and never a repeat', async () => {
+    const journal = await openJournal()
+    const { feed, events } = feedFor(new Map([[SESSION, { journal }]]))
+    await journal.appendItem(
+      USER_IDENTITY,
+      { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'write a poem' }] },
+      { fence: 1 }
+    )
+    await journal.appendItem(
+      TURN_IDENTITY,
+      { kind: 'status', text: 'Working', turnLifecycle: { turnId: 'turn-1', state: 'running' } },
+      { fence: 1 }
+    )
+
+    feed.publish(SESSION)
+    feed.publish(SESSION)
+    expect(events.slice(1)).toEqual([
+      {
+        type: 'status',
+        session: expect.objectContaining({
+          sessionId: SESSION,
+          status: 'working',
+          latestPrompt: 'write a poem'
+        })
+      }
+    ])
+
+    await journal.appendTombstone(TURN_IDENTITY, { fence: 1 })
+    feed.publish(SESSION)
+    expect(events.at(-1)).toEqual({
+      type: 'status',
+      session: expect.objectContaining({ sessionId: SESSION, status: 'idle' })
+    })
+    expect(events).toHaveLength(3)
+  })
+
+  it('reports a pending approval as attention', async () => {
+    const journal = await openJournal()
+    const { feed, events } = feedFor(new Map([[SESSION, { journal }]]))
+    await journal.appendItem(
+      USER_IDENTITY,
+      { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'run it' }] },
+      { fence: 1 }
+    )
+    await journal.appendItem(
+      TURN_IDENTITY,
+      {
+        kind: 'approval',
+        title: 'Run command?',
+        detail: null,
+        options: [{ id: 'yes', label: 'Allow' }],
+        resolution: { state: 'pending', selectedOptionId: null, resolvedBy: null, resolvedAt: null }
+      },
+      { fence: 1 }
+    )
+
+    feed.publish(SESSION)
+    expect(events.at(-1)).toEqual({
+      type: 'status',
+      session: expect.objectContaining({ status: 'attention' })
+    })
+  })
+
+  it('keeps the last projection for an evicted session and serves it to a new subscriber', async () => {
+    const journal = await openJournal()
+    const sessions = new Map([[SESSION, { journal }]])
+    const { feed, events } = feedFor(sessions)
+    await journal.appendItem(
+      USER_IDENTITY,
+      { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'hello' }] },
+      { fence: 1 }
+    )
+    feed.publish(SESSION)
+    expect(events.at(-1)).toEqual({
+      type: 'status',
+      session: expect.objectContaining({ status: 'idle', latestPrompt: 'hello' })
+    })
+
+    // Eviction drops the host's index entry; the projection it already made stays true.
+    sessions.delete(SESSION)
+    feed.publish(SESSION)
+    const late: AgentSessionStatusEvent[] = []
+    feed.subscribe({ id: 'list-late', emit: (event) => late.push(event) })
+
+    expect(events).toHaveLength(2)
+    expect(late).toEqual([
+      {
+        type: 'snapshot',
+        sessions: [expect.objectContaining({ sessionId: SESSION, status: 'idle' })]
+      }
+    ])
+  })
+
+  it('tells the sitting subscribers about a change a new subscriber re-projected', async () => {
+    const journal = await openJournal()
+    const { feed, events } = feedFor(new Map([[SESSION, { journal }]]))
+    // Journal appends and the feed's publish are separate queue submissions, so the journal
+    // can already hold the turn when a second client connects and re-projects it.
+    await journal.appendItem(
+      USER_IDENTITY,
+      { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'hello' }] },
+      { fence: 1 }
+    )
+
+    const late: AgentSessionStatusEvent[] = []
+    feed.subscribe({ id: 'list-late', emit: (event) => late.push(event) })
+
+    expect(events.at(-1)).toEqual({
+      type: 'status',
+      session: expect.objectContaining({ status: 'idle', latestPrompt: 'hello' })
+    })
+    // The arriving subscriber reads that same state once, from its snapshot.
+    expect(late).toEqual([
+      {
+        type: 'snapshot',
+        sessions: [expect.objectContaining({ status: 'idle', latestPrompt: 'hello' })]
+      }
+    ])
+    // The cache is not left holding a value nobody was told about.
+    feed.publish(SESSION)
+    expect(events).toHaveLength(2)
+  })
+
+  it('ends a closed subscriber and keeps publishing to the rest', async () => {
+    const journal = await openJournal()
+    const { feed, events, dispose } = feedFor(new Map([[SESSION, { journal }]]))
+    const others: AgentSessionStatusEvent[] = []
+    feed.subscribe({ id: 'list-2', emit: (event) => others.push(event) })
+
+    dispose()
+    await journal.appendItem(
+      USER_IDENTITY,
+      { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'hello' }] },
+      { fence: 1 }
+    )
+    feed.publish(SESSION)
+
+    expect(events.at(-1)).toEqual({ type: 'end' })
+    expect(others.at(-1)).toEqual({
+      type: 'status',
+      session: expect.objectContaining({ status: 'idle' })
+    })
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-status-feed.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-status-feed.ts
new file mode 100644
index 00000000000..5ad494cf830
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-status-feed.ts
@@ -0,0 +1,130 @@
+// The host's answer to "what is every structured session doing", fanned out to session lists.
+//
+// A client used to learn whether a turn was running by replaying the journal through its own
+// reducer, which tied the answer to whichever surface happened to hold a reader open: hide the
+// chat and the sidebar froze on the last thing it had heard. The host always has the journal, so
+// it projects the status once per journal publication and sends only the changes.
+//
+// The last projection is kept after the session's provider child is evicted: an idle session is
+// still idle without a process, and a renderer that reloads must not lose every settled row until
+// each chat is reopened. Restart is the one boundary that forgets, and restoring readable sessions
+// republishes them.
+
+import { agentProviderSessionsEqual } from '../../../shared/agent-session-resume'
+import type { AgentSessionRecord } from '../../../shared/agent-session-record'
+import type {
+  AgentSessionStatusEvent,
+  AgentSessionStatusSummary
+} from '../../../shared/agent-session-wire'
+import { projectStructuredAgentSessionStatusSummary } from '../../../shared/structured-agent-session-projection'
+import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
+import { structuredAgentSessionProviderSessionMetadata } from './structured-agent-session-history-result'
+
+export type StructuredAgentSessionStatusSubscriber = {
+  id: string
+  emit: (event: AgentSessionStatusEvent) => void
+}
+
+type StatusFeedSession = {
+  journal: AgentSessionJournal
+  params: { location: { workspaceId: string }; provider: AgentSessionRecord['provider'] }
+}
+
+export type StructuredAgentSessionStatusFeedDeps = {
+  sessions: ReadonlyMap<string, StatusFeedSession>
+  getRecord: (sessionId: string) => AgentSessionRecord | null
+  now: () => number
+}
+
+function summariesEqual(a: AgentSessionStatusSummary, b: AgentSessionStatusSummary): boolean {
+  return (
+    a.workspaceId === b.workspaceId &&
+    a.agent === b.agent &&
+    a.status === b.status &&
+    a.latestPrompt === b.latestPrompt &&
+    agentProviderSessionsEqual(undefined, a.providerSession, b.providerSession)
+  )
+}
+
+export class StructuredAgentSessionStatusFeed {
+  private readonly subscribers = new Map<string, StructuredAgentSessionStatusSubscriber>()
+  private readonly published = new Map<string, AgentSessionStatusSummary>()
+
+  constructor(private readonly deps: StructuredAgentSessionStatusFeedDeps) {}
+
+  /** Opens with every session this host has projected, live ones re-read, then only changes. */
+  subscribe(subscriber: StructuredAgentSessionStatusSubscriber): () => void {
+    // Re-project before registering: a change found here has to reach the subscribers that
+    // already read the old value, and the arriving one carries it in its snapshot instead.
+    for (const [sessionId] of this.deps.sessions) {
+      this.publish(sessionId)
+    }
+    this.subscribers.set(subscriber.id, subscriber)
+    this.emit(subscriber, { type: 'snapshot', sessions: [...this.published.values()] })
+    return () => this.unsubscribe(subscriber.id)
+  }
+
+  unsubscribe(id: string): void {
+    const subscriber = this.subscribers.get(id)
+    if (!subscriber) {
+      return
+    }
+    this.subscribers.delete(id)
+    try {
+      subscriber.emit({ type: 'end' })
+    } catch {
+      // The transport is already gone; teardown must remain idempotent.
+    }
+  }
+
+  /** Re-projects one session after its journal changed; equal projections are not re-sent. */
+  publish(sessionId: string, journal?: AgentSessionJournal): void {
+    const session = this.deps.sessions.get(sessionId)
+    if (!session) {
+      return
+    }
+    const summary = this.summaryFor(sessionId, session, journal ?? session.journal)
+    const previous = this.published.get(sessionId)
+    if (previous && summariesEqual(previous, summary)) {
+      return
+    }
+    this.published.set(sessionId, summary)
+    this.broadcast({ type: 'status', session: summary })
+  }
+
+  private summaryFor(
+    sessionId: string,
+    session: StatusFeedSession,
+    journal: AgentSessionJournal
+  ): AgentSessionStatusSummary {
+    // An unreadable journal projects as "no turn": the chat itself shows the reset.
+    const items = journal.isReadOnly ? [] : journal.snapshot().items
+    const providerSession = structuredAgentSessionProviderSessionMetadata(
+      this.deps.getRecord(sessionId)
+    )
+    return {
+      sessionId,
+      workspaceId: session.params.location.workspaceId,
+      agent: session.params.provider,
+      ...projectStructuredAgentSessionStatusSummary(items),
+      ...(providerSession ? { providerSession } : {}),
+      updatedAt: this.deps.now()
+    }
+  }
+
+  private broadcast(event: AgentSessionStatusEvent): void {
+    // A Map skips entries deleted mid-iteration, so a failing subscriber can drop itself here.
+    for (const subscriber of this.subscribers.values()) {
+      this.emit(subscriber, event)
+    }
+  }
+
+  /** A dead transport must not poison every later publication. */
+  private emit(subscriber: StructuredAgentSessionStatusSubscriber, event: AgentSessionStatusEvent) {
+    try {
+      subscriber.emit(event)
+    } catch {
+      this.subscribers.delete(subscriber.id)
+    }
+  }
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts
index bd4dd1958ef..81bcfa82b40 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts
@@ -1,36 +1,42 @@
-import { appendFile, mkdtemp, rm } from 'node:fs/promises'
+import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it } from 'vitest'
 import { AGENT_SESSION_JOURNAL_SCHEMA_VERSION } from '../../../shared/agent-session-journal-types'
 import type {
   AgentSessionHandoffStatus,
+  AgentSessionStatusEvent,
   AgentSessionSubscribeEvent
 } from '../../../shared/agent-session-wire'
 import {
   REMOTE_RUNTIME_MAX_OUTBOUND_JSON_BYTES,
   serializeRemoteRuntimePayload
 } from '../../../shared/remote-runtime-memory-limits'
-import { JOURNAL_LOG_FILE } from '../agent-session-journal/journal-log-file'
-import { serializeJournalRow, type JournalRow } from '../agent-session-journal/journal-row-schema'
-import { openAgentSessionJournal } from '../agent-session-journal/journal-store-factory'
+import { openJournalDatabase } from '../agent-session-journal/journal-database'
+import { journalDatabaseFile } from '../agent-session-journal/journal-paths'
+import { insertJournalRow } from '../agent-session-journal/journal-row-table'
+import type { JournalRow } from '../agent-session-journal/journal-row-schema'
+import { createTrackedJournalOpener } from '../agent-session-journal/journal-store-test-open'
+import { StructuredAgentSessionStatusFeed } from './structured-agent-session-status-feed'
 import { AgentSessionSubscribers } from './structured-agent-session-subscribers'
 
 const SESSION = 'subscriber-session'
 
 let root: string
+const journals = createTrackedJournalOpener()
 
 beforeEach(async () => {
   root = await mkdtemp(join(tmpdir(), 'orca-agent-subscribers-'))
 })
 
 afterEach(async () => {
+  await journals.closeAll()
   await rm(root, { recursive: true, force: true })
 })
 
 describe('AgentSessionSubscribers', () => {
   it('publishes the current fence when a resumed cursor is already caught up', async () => {
-    const journal = await openAgentSessionJournal({
+    const journal = await journals.open({
       identity: {
         sessionId: SESSION,
         workspaceId: 'workspace-1',
@@ -66,8 +72,98 @@ describe('AgentSessionSubscribers', () => {
     ])
   })
 
+  it('reports every content publication to the journal hook, subscribed or not', async () => {
+    const journal = await journals.open({
+      identity: {
+        sessionId: SESSION,
+        workspaceId: 'workspace-1',
+        hostId: 'local',
+        agent: 'codex',
+        providerHandle: { kind: 'codex', threadId: 'thread-1' }
+      },
+      journalDir: join(root, 'hook-journal')
+    })
+    const published: string[] = []
+    const subscribers = new AgentSessionSubscribers({
+      onJournalPublished: (sessionId, published_journal) => {
+        expect(published_journal).toBe(journal)
+        published.push(sessionId)
+      }
+    })
+
+    subscribers.publish(SESSION, journal)
+    subscribers.reset(SESSION, journal, 'epoch_changed', 1)
+    subscribers.snapshot(SESSION, journal, 1)
+    subscribers.handoff(SESSION, 1, {
+      owner: 'native',
+      direction: null,
+      phase: 'idle',
+      stage: null,
+      operationId: null
+    })
+
+    expect(published).toEqual([SESSION, SESSION, SESSION])
+  })
+
+  it('settles a session nobody is reading, from running to idle', async () => {
+    // The defect this whole feed exists for: status used to come from a transcript reader, so a
+    // session with no open pane had no reader and froze on whatever it last said. Nothing here
+    // ever calls `subscribers.open`.
+    const journal = await journals.open({
+      identity: {
+        sessionId: SESSION,
+        workspaceId: 'workspace-1',
+        hostId: 'local',
+        agent: 'codex',
+        providerHandle: { kind: 'codex', threadId: 'thread-1' }
+      },
+      journalDir: join(root, 'unread-journal')
+    })
+    const statusFeed = new StructuredAgentSessionStatusFeed({
+      sessions: new Map([
+        [
+          SESSION,
+          { journal, params: { location: { workspaceId: 'workspace-1' }, provider: 'codex' } }
+        ]
+      ]),
+      getRecord: () => null,
+      now: () => 1_000
+    })
+    const subscribers = new AgentSessionSubscribers({
+      onJournalPublished: (sessionId, published) => statusFeed.publish(sessionId, published)
+    })
+    const statuses: AgentSessionStatusEvent[] = []
+    statusFeed.subscribe({ id: 'session-list', emit: (event) => statuses.push(event) })
+    const turn = { provider: 'codex', threadId: 'thread-1', turnId: 'turn-1', ordinal: 0 } as const
+
+    await journal.appendItem(
+      { ...turn, ordinal: 1 },
+      { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'write a poem' }] },
+      { fence: 1 }
+    )
+    await journal.appendItem(
+      turn,
+      { kind: 'status', text: 'Working', turnLifecycle: { turnId: 'turn-1', state: 'running' } },
+      { fence: 1 }
+    )
+    subscribers.publish(SESSION, journal)
+
+    expect(statuses.at(-1)).toEqual({
+      type: 'status',
+      session: expect.objectContaining({ status: 'working', latestPrompt: 'write a poem' })
+    })
+
+    await journal.appendTombstone(turn, { fence: 1 })
+    subscribers.publish(SESSION, journal)
+
+    expect(statuses.at(-1)).toEqual({
+      type: 'status',
+      session: expect.objectContaining({ status: 'idle' })
+    })
+  })
+
   it('publishes handoff-only changes without serializing a transcript snapshot', async () => {
-    const journal = await openAgentSessionJournal({
+    const journal = await journals.open({
       identity: {
         sessionId: SESSION,
         workspaceId: 'workspace-1',
@@ -110,9 +206,57 @@ describe('AgentSessionSubscribers', () => {
     })
   })
 
+  it('publishes background lifecycle without advancing the journal and carries its fence forward', async () => {
+    const journal = await journals.open({
+      identity: {
+        sessionId: SESSION,
+        workspaceId: 'workspace-1',
+        hostId: 'local',
+        agent: 'claude',
+        providerHandle: { kind: 'claude', sessionId: 'provider-1', leafUuid: null }
+      },
+      journalDir: join(root, 'background-journal')
+    })
+    const subscribers = new AgentSessionSubscribers()
+    const events: AgentSessionSubscribeEvent[] = []
+    subscribers.open({
+      id: 'subscriber-1',
+      sessionId: SESSION,
+      journal,
+      fence: 1,
+      backgroundTasks: null,
+      emit: (event) => events.push(event)
+    })
+    const cursor = journal.cursor()
+
+    const backgroundTasks = {
+      state: 'monitoring' as const,
+      tasks: [{ id: 'task-1', kind: 'command' as const, description: 'run the build' }]
+    }
+    subscribers.backgroundTasks(SESSION, backgroundTasks, 2)
+
+    expect(journal.cursor()).toEqual(cursor)
+    expect(events.at(-1)).toEqual({
+      type: 'batch',
+      sessionId: SESSION,
+      batch: { cursor, items: [], removedItemIds: [], submissions: [] },
+      fence: 2,
+      backgroundTasks
+    })
+
+    await journal.appendItem(
+      { provider: 'orca', clientMessageId: 'after-background-fence' },
+      { kind: 'status', text: 'After background state' },
+      { fence: 2 }
+    )
+    subscribers.publish(SESSION, journal)
+
+    expect(events.at(-1)).toMatchObject({ type: 'batch', fence: 2 })
+  })
+
   it('catches a subscriber up past a pre-existing unsendable removal with a bounded reset', async () => {
     const journalDir = join(root, 'oversized-removal-journal')
-    const seeded = await openAgentSessionJournal({
+    const seeded = await journals.open({
       identity: {
         sessionId: SESSION,
         workspaceId: 'workspace-1',
@@ -150,12 +294,20 @@ describe('AgentSessionSubscribers', () => {
         ts: 2_001
       }
     ]
-    await appendFile(
-      join(journalDir, JOURNAL_LOG_FILE),
-      `${rows.map(serializeJournalRow).join('\n')}\n`,
-      'utf-8'
-    )
-    const journal = await openAgentSessionJournal({
+    // Staged straight into the session database, exactly as a previous writer
+    // would have committed them.
+    await seeded.close()
+    const opened = openJournalDatabase(journalDatabaseFile(journalDir))
+    try {
+      opened.db.exec('BEGIN IMMEDIATE')
+      for (const row of rows) {
+        insertJournalRow(opened.db, SESSION, row)
+      }
+      opened.db.exec('COMMIT')
+    } finally {
+      opened.db.close()
+    }
+    const journal = await journals.open({
       identity: {
         sessionId: SESSION,
         workspaceId: 'workspace-1',
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.ts
index 3fa80b28d85..29dffa6a687 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.ts
@@ -10,6 +10,7 @@ import type {
 } from '../../../shared/agent-session-journal-types'
 import {
   AGENT_SESSION_HISTORY_MAX_LIMIT,
+  type AgentSessionBackgroundTaskState,
   type AgentSessionHandoffStatus,
   type AgentSessionSubscribeEvent
 } from '../../../shared/agent-session-wire'
@@ -35,9 +36,17 @@ type Subscriber = {
   fence: number
 }
 
+export type AgentSessionSubscribersHooks = {
+  /** Fires after any publication that can change journal content, whether or not anyone
+   *  is subscribed to the transcript: session lists project status from this same edge. */
+  onJournalPublished?: (sessionId: string, journal: AgentSessionJournal) => void
+}
+
 export class AgentSessionSubscribers {
   private readonly bySession = new Map<string, Map<string, Subscriber>>()
 
+  constructor(private readonly hooks: AgentSessionSubscribersHooks = {}) {}
+
   /** Opens the stream with a bounded tail page or, when the client's cursor
    *  still resolves, with the rows it missed. Returns the disposer. */
   open(input: {
@@ -48,6 +57,7 @@ export class AgentSessionSubscribers {
     emit: AgentSessionSubscriberEmit
     cursor?: AgentJournalCursor
     handoff?: AgentSessionHandoffStatus
+    backgroundTasks?: AgentSessionBackgroundTaskState | null
   }): () => void {
     const liveCursor = input.journal.cursor()
     const subscriber: Subscriber = {
@@ -62,7 +72,7 @@ export class AgentSessionSubscribers {
     this.bySession.set(input.sessionId, session)
 
     if (input.cursor) {
-      this.deliver(subscriber, input.journal, input.handoff, true)
+      this.deliver(subscriber, input.journal, input.handoff, true, input.backgroundTasks)
     } else {
       const page = readAgentSessionHydrationPage(input.journal, input.fence)
       this.emit(subscriber, {
@@ -70,7 +80,8 @@ export class AgentSessionSubscribers {
         sessionId: input.sessionId,
         page,
         fence: input.fence,
-        ...(input.handoff ? { handoff: input.handoff } : {})
+        ...(input.handoff ? { handoff: input.handoff } : {}),
+        ...(input.backgroundTasks !== undefined ? { backgroundTasks: input.backgroundTasks } : {})
       })
       subscriber.cursor = page.liveCursor ?? page.window.nextCursor
     }
@@ -96,6 +107,7 @@ export class AgentSessionSubscribers {
     for (const subscriber of this.subscribers(sessionId)) {
       this.deliver(subscriber, journal)
     }
+    this.hooks.onJournalPublished?.(sessionId, journal)
   }
 
   /** Force every subscriber back to a bounded tail page — recovery, epoch
@@ -104,23 +116,44 @@ export class AgentSessionSubscribers {
     sessionId: string,
     journal: AgentSessionJournal,
     reason: AgentJournalResetReason,
-    fence: number
+    fence: number,
+    backgroundTasks?: AgentSessionBackgroundTaskState | null
   ): void {
     const page = readAgentSessionHydrationPage(journal, fence)
     for (const subscriber of this.subscribers(sessionId)) {
-      this.emit(subscriber, { type: 'reset', sessionId, reset: reason, page, fence })
+      this.emit(subscriber, {
+        type: 'reset',
+        sessionId,
+        reset: reason,
+        page,
+        fence,
+        ...(backgroundTasks !== undefined ? { backgroundTasks } : {})
+      })
       subscriber.cursor = page.liveCursor ?? page.window.nextCursor
       subscriber.fence = fence
     }
+    this.hooks.onJournalPublished?.(sessionId, journal)
   }
 
-  snapshot(sessionId: string, journal: AgentSessionJournal, fence: number): void {
+  snapshot(
+    sessionId: string,
+    journal: AgentSessionJournal,
+    fence: number,
+    backgroundTasks?: AgentSessionBackgroundTaskState | null
+  ): void {
     const page = readAgentSessionHydrationPage(journal, fence)
     for (const subscriber of this.subscribers(sessionId)) {
-      this.emit(subscriber, { type: 'snapshot', sessionId, page, fence })
+      this.emit(subscriber, {
+        type: 'snapshot',
+        sessionId,
+        page,
+        fence,
+        ...(backgroundTasks !== undefined ? { backgroundTasks } : {})
+      })
       subscriber.cursor = page.liveCursor ?? page.window.nextCursor
       subscriber.fence = fence
     }
+    this.hooks.onJournalPublished?.(sessionId, journal)
   }
 
   handoff(sessionId: string, fence: number, handoff: AgentSessionHandoffStatus): void {
@@ -141,6 +174,28 @@ export class AgentSessionSubscribers {
     }
   }
 
+  backgroundTasks(
+    sessionId: string,
+    state: AgentSessionBackgroundTaskState | null,
+    fence: number
+  ): void {
+    for (const subscriber of this.subscribers(sessionId)) {
+      this.emit(subscriber, {
+        type: 'batch',
+        sessionId,
+        batch: {
+          cursor: subscriber.cursor,
+          items: [],
+          removedItemIds: [],
+          submissions: []
+        },
+        fence,
+        backgroundTasks: state
+      })
+      subscriber.fence = fence
+    }
+  }
+
   private subscribers(sessionId: string): Subscriber[] {
     return [...(this.bySession.get(sessionId)?.values() ?? [])]
   }
@@ -149,7 +204,8 @@ export class AgentSessionSubscribers {
     subscriber: Subscriber,
     journal: AgentSessionJournal,
     handoff?: AgentSessionHandoffStatus,
-    emitCheckpoint = false
+    emitCheckpoint = false,
+    backgroundTasks?: AgentSessionBackgroundTaskState | null
   ): void {
     while (true) {
       const result = readAgentSessionHistory(journal, {
@@ -166,7 +222,8 @@ export class AgentSessionSubscribers {
           reset: result.reset,
           page,
           fence: subscriber.fence,
-          ...(handoff ? { handoff } : {})
+          ...(handoff ? { handoff } : {}),
+          ...(backgroundTasks !== undefined ? { backgroundTasks } : {})
         })
         subscriber.cursor = page.liveCursor ?? page.window.nextCursor
         return
@@ -185,7 +242,8 @@ export class AgentSessionSubscribers {
               submissions: []
             },
             fence: subscriber.fence,
-            ...(handoff ? { handoff } : {})
+            ...(handoff ? { handoff } : {}),
+            ...(backgroundTasks !== undefined ? { backgroundTasks } : {})
           })
         }
         return
@@ -200,7 +258,8 @@ export class AgentSessionSubscribers {
           submissions: page.submissions
         },
         fence: subscriber.fence,
-        ...(handoff ? { handoff } : {})
+        ...(handoff ? { handoff } : {}),
+        ...(backgroundTasks !== undefined ? { backgroundTasks } : {})
       })
       subscriber.cursor = page.window.nextCursor
       if (!page.hasNewer || !this.isActive(subscriber)) {
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-teardown-handoff-drain.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-teardown-handoff-drain.test.ts
new file mode 100644
index 00000000000..340d45c05af
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-teardown-handoff-drain.test.ts
@@ -0,0 +1,165 @@
+// Host teardown against a handoff that has not finished switching owners.
+//
+// The flow runs on the session's serialized chain and nothing else awaits it, so a teardown that
+// only flushed sinks left it writing into a journal it had just closed — and publishing a status
+// against a session it had just dropped, which surfaced as an unhandled rejection.
+
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
+import { StructuredAgentSessionHost } from './structured-agent-session-host'
+import {
+  HOST_TEST_NOW as NOW,
+  HOST_TEST_SESSION as SESSION,
+  HOST_TEST_THREAD as THREAD,
+  hostTestAttachParams,
+  hostTestOperationId,
+  resetHostTestOperationIds
+} from './structured-agent-session-host-test-data'
+import { StructuredHandoffTestRequests } from './structured-agent-session-handoff-test-requests'
+import type {
+  StructuredAgentSessionHandoffTransport,
+  StructuredTuiOwner
+} from './structured-agent-session-handoff-types'
+
+const CALLER = { callerKey: 'client-1' }
+
+let root: string
+let store: AgentSessionRecordStore
+let host: StructuredAgentSessionHost
+let launchEntered: PromiseWithResolvers<void>
+let launchGate: PromiseWithResolvers<void>
+
+const requests = new StructuredHandoffTestRequests(
+  NOW,
+  SESSION,
+  () => store.getRecord(SESSION)?.lease.runtimeFence ?? 0
+)
+
+function tuiOwner(fence: number, spawnToken: string): StructuredTuiOwner {
+  return {
+    terminal: { handle: 'term-tui', tabId: 'tab-tui', paneKey: 'pane-tui', ptyId: 'pty-tui' },
+    process: { hostId: 'local', pid: 5200, processStartTimeMs: NOW, spawnToken },
+    link: {
+      linkId: `tui-link-${fence}`,
+      handle: { provider: 'codex', threadId: THREAD },
+      origin: 'resumed',
+      mintedAtFence: fence,
+      observedAt: NOW
+    }
+  }
+}
+
+function gatedTransport(): StructuredAgentSessionHandoffTransport {
+  return {
+    hostLabel: 'Test host',
+    launchTui: async ({ fence, spawnToken }) => {
+      launchEntered.resolve()
+      await launchGate.promise
+      return tuiOwner(fence, spawnToken)
+    },
+    reproveTuiOwner: async ({ owner }) => owner,
+    recoverTuiOwner: async (record) =>
+      tuiOwner(record.lease.runtimeFence, record.lease.reservedSpawnToken ?? 'recovered'),
+    stopRecoveredOwner: async () => undefined,
+    closeTuiOwner: async (owner) => ({ transcriptPath: owner.transcriptPath }),
+    waitForTuiExit: async (owner) => ({ transcriptPath: owner.transcriptPath }),
+    waitForTuiIdleOrExit: async () => 'idle',
+    tuiStatus: () => 'idle'
+  }
+}
+
+function adapter(): StructuredAgentSessionAdapter {
+  return {
+    acquire: vi.fn(async ({ fence, spawnToken }) => ({
+      process: { hostId: 'local', pid: 4242, processStartTimeMs: NOW, spawnToken },
+      link: {
+        linkId: `native-link-${fence}`,
+        handle: { provider: 'codex' as const, threadId: THREAD },
+        origin: 'created' as const,
+        mintedAtFence: fence,
+        observedAt: NOW
+      }
+    })),
+    dispatchTurn: vi.fn(async () => ({ state: 'accepted' as const })),
+    cancelTurn: vi.fn(async () => ({ cancelled: true })),
+    answerPrompt: vi.fn(async () => undefined),
+    setOption: vi.fn(async () => undefined),
+    closeSession: vi.fn(async () => true),
+    supportsCreate: () => true,
+    supportsRecord: () => true
+  } as unknown as StructuredAgentSessionAdapter
+}
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-teardown-handoff-drain-'))
+  resetHostTestOperationIds()
+  launchEntered = Promise.withResolvers<void>()
+  launchGate = Promise.withResolvers<void>()
+  store = await AgentSessionRecordStore.open({ directory: join(root, 'store'), hostId: 'local' })
+  host = new StructuredAgentSessionHost({
+    store,
+    adapter: adapter(),
+    journalRoot: root,
+    claimKeyId: 'key-1',
+    mintSpawnToken: () => 'spawn-native',
+    handoffTransport: gatedTransport(),
+    now: () => NOW
+  })
+  expect(await host.attach(CALLER, hostTestAttachParams(null))).toMatchObject({ ok: true })
+})
+
+afterEach(async () => {
+  launchGate.resolve()
+  await host.flushAllStreamedEvents()
+  await rm(root, { recursive: true, force: true })
+})
+
+describe('structured agent-session host teardown', () => {
+  it('waits for an in-flight handoff before dropping the session it is switching', async () => {
+    // One operation-id source with attach, so the durable ledger sees no duplicate.
+    const request = requests.request('to-tui', 'now', { operationId: hostTestOperationId() })
+    expect(await host.requestHandoff(CALLER, request)).toMatchObject({ ok: true })
+    await launchEntered.promise
+
+    let settled = false
+    const teardown = host.flushAllStreamedEvents().then(() => {
+      settled = true
+    })
+    // Quiescence probe, not a wait for the flow: teardown must still be blocked on it.
+    for (let tick = 0; tick < 20; tick += 1) {
+      await new Promise<void>((resolve) => setTimeout(resolve, 0))
+    }
+    expect(settled).toBe(false)
+
+    launchGate.resolve()
+    await teardown
+
+    // The new owner was proven while the session was still indexed, not after it vanished.
+    expect(store.getRecord(SESSION)?.lease).toMatchObject({
+      runtimeKind: 'tui',
+      claimStatus: 'live',
+      handoffStage: null
+    })
+    expect(host.hasSession(SESSION)).toBe(false)
+  })
+
+  it('gives up on a wedged handoff instead of holding the quit open', async () => {
+    const request = requests.request('to-tui', 'now', { operationId: hostTestOperationId() })
+    expect(await host.requestHandoff(CALLER, request)).toMatchObject({ ok: true })
+    await launchEntered.promise
+
+    // The gate is never opened: this is the flow that never comes back.
+    vi.useFakeTimers()
+    try {
+      const teardown = host.flushAllStreamedEvents()
+      await vi.advanceTimersByTimeAsync(5_000)
+      await expect(teardown).resolves.toBeUndefined()
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-turns-prompt.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-turns-prompt.ts
index 9d16e19a7f7..26ad85b5cfb 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-turns-prompt.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-turns-prompt.ts
@@ -1,6 +1,11 @@
 import { parseAgentJournalItemKey } from '../../../shared/agent-session-journal-item-key'
+import {
+  decodeAgentSessionQuestionAnswers,
+  isValidAgentSessionQuestionAnswers
+} from '../../../shared/agent-session-question-answer'
 import type {
   AgentJournalItemBody,
+  AgentJournalQuestion,
   AgentJournalResolution
 } from '../../../shared/agent-session-journal-types'
 import type { AgentSessionPromptResult } from '../../../shared/agent-session-wire'
@@ -14,6 +19,7 @@ function invalid(message: string): TurnOutcome<never> {
 function promptBodyOf(body: AgentJournalItemBody): {
   options: readonly { id: string }[]
   freeTextQuestionId?: string
+  questions?: AgentJournalQuestion[]
   resolution: AgentJournalResolution
 } | null {
   return body.kind === 'approval' || body.kind === 'question' ? body : null
@@ -64,7 +70,19 @@ export async function performPrompt(
     prompt.freeTextQuestionId !== undefined &&
     freeText?.questionId === prompt.freeTextQuestionId &&
     freeText.answer.trim().length > 0
-  if (!acceptsFreeText && !prompt.options.some((option) => option.id === input.optionId)) {
+  const grouped =
+    item.body.kind === 'question' && prompt.questions
+      ? decodeAgentSessionQuestionAnswers(input.optionId)
+      : null
+  const acceptsGrouped =
+    grouped !== null &&
+    prompt.questions !== undefined &&
+    isValidAgentSessionQuestionAnswers(prompt.questions, grouped)
+  if (
+    !acceptsFreeText &&
+    !acceptsGrouped &&
+    !prompt.options.some((option) => option.id === input.optionId)
+  ) {
     return invalid(`Option ${input.optionId} is not offered by item ${input.itemId}.`)
   }
   const identity = parseAgentJournalItemKey(input.itemId)
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-turns.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-turns.test.ts
index 47edf3470e6..31df2c44551 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-turns.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-turns.test.ts
@@ -3,14 +3,9 @@ import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import type { AgentSessionJournalIdentity } from '../../../shared/agent-session-journal-types'
-import { openAgentSessionJournal } from '../agent-session-journal/journal-store-factory'
+import { createTrackedJournalOpener } from '../agent-session-journal/journal-store-test-open'
 import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
-import {
-  performCancel,
-  performSend,
-  type AgentSessionTurnContext
-} from './structured-agent-session-turns'
-import { DEFAULT_JOURNAL_PAYLOAD_LIMITS } from '../agent-session-journal/journal-payload-bounds'
+import { performCancel, type AgentSessionTurnContext } from './structured-agent-session-turns'
 
 const IDENTITY: AgentSessionJournalIdentity = {
   sessionId: 'session-1',
@@ -21,8 +16,10 @@ const IDENTITY: AgentSessionJournalIdentity = {
 }
 
 let root: string | null = null
+const journals = createTrackedJournalOpener()
 
 afterEach(async () => {
+  await journals.closeAll()
   if (root) {
     await rm(root, { recursive: true, force: true })
     root = null
@@ -32,7 +29,7 @@ afterEach(async () => {
 describe('performCancel', () => {
   it('acknowledges only the request and leaves the running lifecycle row intact', async () => {
     root = await mkdtemp(join(tmpdir(), 'orca-turn-cancel-'))
-    const journal = await openAgentSessionJournal({ identity: IDENTITY, journalDir: root })
+    const journal = await journals.open({ identity: IDENTITY, journalDir: root })
     const lifecycleIdentity = {
       provider: 'legacy' as const,
       agent: 'codex' as const,
@@ -76,191 +73,71 @@ describe('performCancel', () => {
       { kind: 'status', text: 'Cancellation requested.' }
     ])
   })
-})
 
-describe('performSend lifecycle capacity', () => {
-  it('refuses before provider contact when dispatch plus terminal capacity cannot fit', async () => {
-    root = await mkdtemp(join(tmpdir(), 'orca-turn-capacity-'))
-    const journal = await openAgentSessionJournal({
-      identity: IDENTITY,
-      journalDir: root,
-      limits: { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, maxSessionBytes: 100 * 1024 }
-    })
-    const dispatch = vi.fn()
-    const ctx = turnContext(journal, { dispatch } as unknown as StructuredAgentSessionAdapter)
-
-    const result = await performSend(ctx, {
-      clientMessageId: 'message-1',
-      payloadFingerprint: 'a'.repeat(64),
-      body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'run' }] }
-    })
-
-    expect(result).toMatchObject({ ok: false })
-    expect(dispatch).not.toHaveBeenCalled()
-    expect(journal.submissions()).toEqual([])
-    expect(journal.lifecycleCapacityState()).toEqual({ reservedBytes: 0, reservedAppendSlots: 0 })
-  })
-
-  it('binds a synchronous turn start to tentative capacity and releases only on terminality', async () => {
-    root = await mkdtemp(join(tmpdir(), 'orca-turn-capacity-'))
-    const journal = await openAgentSessionJournal({
-      identity: IDENTITY,
-      journalDir: root,
-      limits: { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, maxSessionBytes: 400 * 1024 }
-    })
-    const turnIdentity = {
-      provider: 'legacy' as const,
-      agent: 'codex' as const,
+  it('stops background tasks without interrupting the foreground turn or writing a row', async () => {
+    root = await mkdtemp(join(tmpdir(), 'orca-background-task-cancel-'))
+    const journal = await journals.open({ identity: IDENTITY, journalDir: root })
+    const cancelTurn = vi.fn(async () => ({ cancelled: true }))
+    const stopBackgroundTasks = vi.fn(async () => ({ cancelled: true }))
+    const ctx: AgentSessionTurnContext = {
       sessionId: 'session-1',
-      recordId: 'turn-lifecycle:turn-1'
-    }
-    const dispatch = vi.fn(async () => {
-      await journal.appendItem(
-        turnIdentity,
-        {
-          kind: 'status',
-          text: 'Agent is working…',
-          turnLifecycle: { turnId: 'turn-1', state: 'running' }
-        },
-        { fence: 1 }
-      )
-      return {
-        state: 'accepted' as const,
-        providerIdentity: {
-          provider: 'codex' as const,
-          threadId: 'thread-1',
-          turnId: 'turn-1',
-          ordinal: 0
-        }
-      }
-    })
-    const ctx = turnContext(journal, { dispatch } as unknown as StructuredAgentSessionAdapter)
-
-    const result = await performSend(ctx, {
-      clientMessageId: 'message-1',
-      payloadFingerprint: 'a'.repeat(64),
-      body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'run' }] }
-    })
-
-    expect(result).toMatchObject({ ok: true })
-    expect(journal.lifecycleCapacityState()).toEqual({
-      reservedBytes: 128 * 1024,
-      reservedAppendSlots: 1
-    })
-    await journal.appendLifecycleBatch({
-      settlementId: 'turn-completed:turn-1',
+      journal,
       fence: 1,
-      mutations: [{ kind: 'tombstone', identity: turnIdentity }]
+      adapter: { cancelTurn, stopBackgroundTasks } as unknown as StructuredAgentSessionAdapter,
+      persistOptions: async () => undefined,
+      resolvedBy: 'client-1',
+      publish: vi.fn(),
+      now: () => 1
+    }
+
+    const result = await performCancel(ctx, {
+      clientOperationId: 'cancel-background-tasks',
+      turnId: 'background-tasks',
+      scope: 'background-tasks'
     })
-    expect(journal.lifecycleCapacityState()).toEqual({ reservedBytes: 0, reservedAppendSlots: 0 })
+
+    expect(result).toEqual({
+      ok: true,
+      value: { turnId: 'background-tasks', cancelled: true }
+    })
+    expect(stopBackgroundTasks).toHaveBeenCalledWith({ sessionId: 'session-1', fence: 1 })
+    expect(cancelTurn).not.toHaveBeenCalled()
+    expect(journal.snapshot().items).toEqual([])
   })
 
-  it('keeps response-before-start capacity on the Codex turn lifecycle identity', async () => {
-    root = await mkdtemp(join(tmpdir(), 'orca-turn-capacity-'))
-    const journal = await openAgentSessionJournal({
-      identity: IDENTITY,
-      journalDir: root,
-      limits: { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, maxSessionBytes: 220 * 1024 }
-    })
-    const turnIdentity = {
-      provider: 'legacy' as const,
-      agent: 'codex' as const,
+  it('routes one background task id without interrupting the foreground turn or writing a row', async () => {
+    root = await mkdtemp(join(tmpdir(), 'orca-background-task-targeted-cancel-'))
+    const journal = await journals.open({ identity: IDENTITY, journalDir: root })
+    const cancelTurn = vi.fn(async () => ({ cancelled: true }))
+    const stopBackgroundTasks = vi.fn(async () => ({ cancelled: true }))
+    const ctx: AgentSessionTurnContext = {
       sessionId: 'session-1',
-      recordId: 'turn-lifecycle:turn-1'
+      journal,
+      fence: 1,
+      adapter: { cancelTurn, stopBackgroundTasks } as unknown as StructuredAgentSessionAdapter,
+      persistOptions: async () => undefined,
+      resolvedBy: 'client-1',
+      publish: vi.fn(),
+      now: () => 1
     }
-    const ctx = turnContext(journal, {
-      dispatch: vi.fn(async () => ({
-        state: 'accepted' as const,
-        providerIdentity: {
-          provider: 'codex' as const,
-          threadId: 'thread-1',
-          turnId: 'turn-1',
-          ordinal: 0
-        }
-      }))
-    } as unknown as StructuredAgentSessionAdapter)
 
-    await expect(
-      performSend(ctx, {
-        clientMessageId: 'message-1',
-        payloadFingerprint: 'a'.repeat(64),
-        body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'run' }] }
-      })
-    ).resolves.toMatchObject({ ok: true })
-    await expect(
-      journal.appendItem(
-        turnIdentity,
-        {
-          kind: 'status',
-          text: 'Agent is working…',
-          turnLifecycle: { turnId: 'turn-1', state: 'running' }
-        },
-        { fence: 1 }
-      )
-    ).resolves.toBeDefined()
-    expect(
-      journal
-        .snapshot()
-        .items.some(
-          (item) =>
-            item.body.kind === 'status' &&
-            item.body.turnLifecycle?.turnId === 'turn-1' &&
-            item.body.turnLifecycle.state === 'running'
-        )
-    ).toBe(true)
-  })
-
-  it('transfers non-Codex reservations so repeated sends can settle without leaking capacity', async () => {
-    root = await mkdtemp(join(tmpdir(), 'orca-turn-capacity-'))
-    const journal = await openAgentSessionJournal({
-      identity: IDENTITY,
-      journalDir: root,
-      limits: { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, maxSessionBytes: 220 * 1024 }
+    const result = await performCancel(ctx, {
+      clientOperationId: 'cancel-background-task-2',
+      turnId: 'background-tasks',
+      scope: 'background-tasks',
+      taskId: 'task-2'
     })
-    const dispatch = vi.fn(async ({ clientMessageId }: { clientMessageId: string }) => ({
-      state: 'accepted' as const,
-      providerIdentity: {
-        provider: 'claude' as const,
-        sessionId: 'claude-session',
-        uuid: `turn-${clientMessageId}`
-      }
-    }))
-    const ctx = turnContext(journal, { dispatch } as unknown as StructuredAgentSessionAdapter)
 
-    for (let index = 0; index < 6; index += 1) {
-      const clientMessageId = `message-${index}`
-      const result = await performSend(ctx, {
-        clientMessageId,
-        payloadFingerprint: 'a'.repeat(64),
-        body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'run' }] }
-      })
-      expect(result).toMatchObject({ ok: true })
-      await journal.appendItem(
-        {
-          provider: 'claude',
-          sessionId: 'claude-session',
-          uuid: `turn-${clientMessageId}`
-        },
-        { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text: 'done' }] },
-        { fence: 1 }
-      )
-      expect(journal.lifecycleCapacityState()).toEqual({ reservedBytes: 0, reservedAppendSlots: 0 })
-    }
+    expect(result).toEqual({
+      ok: true,
+      value: { turnId: 'background-tasks', cancelled: true }
+    })
+    expect(stopBackgroundTasks).toHaveBeenCalledWith({
+      sessionId: 'session-1',
+      fence: 1,
+      taskId: 'task-2'
+    })
+    expect(cancelTurn).not.toHaveBeenCalled()
+    expect(journal.snapshot().items).toEqual([])
   })
 })
-
-function turnContext(
-  journal: Awaited<ReturnType<typeof openAgentSessionJournal>>,
-  adapter: StructuredAgentSessionAdapter
-): AgentSessionTurnContext {
-  return {
-    sessionId: 'session-1',
-    journal,
-    fence: 1,
-    adapter,
-    persistOptions: async () => undefined,
-    resolvedBy: 'client-1',
-    publish: vi.fn(),
-    now: () => 1
-  }
-}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-turns.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-turns.ts
index 0c8f43efe1b..3bd98a61735 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-turns.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-turns.ts
@@ -7,7 +7,6 @@
 // turn the provider already accepted.
 
 import type { AgentJournalMessageItem } from '../../../shared/agent-session-journal-types'
-import { agentJournalItemKey } from '../../../shared/agent-session-journal-item-key'
 import type {
   AgentSessionCancelResult,
   AgentSessionSendResult,
@@ -18,14 +17,6 @@ import type {
   AgentSessionDispatchOutcome,
   StructuredAgentSessionAdapter
 } from './structured-agent-session-adapter'
-import {
-  dispatchReservationId,
-  JOURNAL_DISPATCH_RESERVATION_BYTES,
-  JOURNAL_TURN_TERMINAL_RESERVATION_BYTES,
-  lifecycleReservationIdForItem,
-  tentativeTurnReservationId
-} from '../agent-session-journal/journal-lifecycle-capacity'
-
 export { performSetOption } from './structured-agent-session-turns-options'
 export { performPrompt } from './structured-agent-session-turns-prompt'
 
@@ -104,42 +95,8 @@ export async function performSend(
     }
   }
   if (!(input.retryUnknown && existing?.dispatchState === 'unknown')) {
-    const dispatchReservation = dispatchReservationId(input.clientMessageId)
-    const tentativeReservation = tentativeTurnReservationId(input.clientMessageId)
-    const dispatchReserved = await ctx.journal.reserveLifecycleCapacity({
-      id: dispatchReservation,
-      bytes: JOURNAL_DISPATCH_RESERVATION_BYTES,
-      appendSlots: 1
-    })
-    const turnReserved =
-      dispatchReserved &&
-      (await ctx.journal.reserveLifecycleCapacity({
-        id: tentativeReservation,
-        bytes: JOURNAL_TURN_TERMINAL_RESERVATION_BYTES,
-        appendSlots: 1
-      }))
-    if (!dispatchReserved || !turnReserved) {
-      await ctx.journal.releaseLifecycleCapacity(dispatchReservation)
-      await ctx.journal.releaseLifecycleCapacity(tentativeReservation)
-      return invalid('The session does not have enough durable capacity to start another turn.')
-    }
-    try {
-      await ctx.journal.appendSubmission({ ...input, fence: ctx.fence })
-    } catch (error) {
-      await ctx.journal.releaseLifecycleCapacity(dispatchReservation)
-      await ctx.journal.releaseLifecycleCapacity(tentativeReservation)
-      throw error
-    }
+    await ctx.journal.appendSubmission({ ...input, fence: ctx.fence })
     ctx.publish()
-  } else {
-    const retryReserved = await ctx.journal.reserveLifecycleCapacity({
-      id: dispatchReservationId(input.clientMessageId),
-      bytes: JOURNAL_DISPATCH_RESERVATION_BYTES,
-      appendSlots: 1
-    })
-    if (!retryReserved) {
-      return invalid('The session does not have enough durable capacity to retry this turn.')
-    }
   }
 
   const outcome = await dispatchSafely(ctx, input.clientMessageId, input.body)
@@ -161,7 +118,7 @@ export async function performSend(
     )
   } catch (error) {
     // A failed resolution must not strand a pending row; an unknown result is
-    // explicitly replayable and keeps tentative capacity for that retry.
+    // explicitly replayable.
     try {
       await ctx.journal.resolveDispatch({
         clientMessageId: input.clientMessageId,
@@ -171,34 +128,11 @@ export async function performSend(
         recovered: true
       })
     } catch {
-      await ctx.journal.releaseLifecycleCapacity(dispatchReservationId(input.clientMessageId))
+      // Nothing further to record; the pending row is settled on the next attach.
     }
     ctx.publish()
     throw error
   }
-  if (outcome.state === 'accepted') {
-    // Codex publishes its running lifecycle row under the legacy turn identity,
-    // while the dispatch response identifies the user's message item.  Bind the
-    // tentative turn reservation to the lifecycle identity so a response that
-    // wins the race with turn/started cannot strand that row at the quota edge.
-    const reservationTarget =
-      outcome.providerIdentity.provider === 'codex'
-        ? {
-            provider: 'legacy' as const,
-            agent: 'codex' as const,
-            sessionId: ctx.sessionId,
-            recordId: `turn-lifecycle:${outcome.providerIdentity.turnId}`
-          }
-        : outcome.providerIdentity
-    await ctx.journal.transferLifecycleCapacity(
-      tentativeTurnReservationId(input.clientMessageId),
-      lifecycleReservationIdForItem(
-        ctx.journal.canonicalItemId(agentJournalItemKey(reservationTarget))
-      )
-    )
-  } else if (outcome.state === 'rejected') {
-    await ctx.journal.releaseLifecycleCapacity(tentativeTurnReservationId(input.clientMessageId))
-  }
   ctx.publish()
 
   const submission = ctx.journal
@@ -212,18 +146,31 @@ export async function performSend(
 
 export async function performCancel(
   ctx: AgentSessionTurnContext,
-  input: { clientOperationId: string; turnId: string }
+  input: {
+    clientOperationId: string
+    turnId: string
+    scope?: 'background-tasks'
+    taskId?: string
+  }
 ): Promise<TurnOutcome<AgentSessionCancelResult>> {
   let cancelled = false
   let note = 'Cancellation requested.'
   try {
-    cancelled = (
-      await ctx.adapter.cancelTurn({
-        sessionId: ctx.sessionId,
-        turnId: input.turnId,
-        fence: ctx.fence
-      })
-    ).cancelled
+    cancelled = input.scope
+      ? (
+          await ctx.adapter.stopBackgroundTasks?.({
+            sessionId: ctx.sessionId,
+            fence: ctx.fence,
+            ...(input.taskId ? { taskId: input.taskId } : {})
+          })
+        )?.cancelled === true
+      : (
+          await ctx.adapter.cancelTurn({
+            sessionId: ctx.sessionId,
+            turnId: input.turnId,
+            fence: ctx.fence
+          })
+        ).cancelled
     if (!cancelled) {
       note = 'The provider had already finished this turn.'
     }
@@ -232,6 +179,9 @@ export async function performCancel(
       error instanceof Error ? error.message : String(error)
     }`
   }
+  if (input.scope) {
+    return { ok: true, value: { turnId: input.turnId, cancelled } }
+  }
   // Keyed by the operation id so a replayed cancel upserts one item, not two.
   await appendStatus(ctx, input.clientOperationId, note)
   return { ok: true, value: { turnId: input.turnId, cancelled } }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-wire-admission.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-wire-admission.test.ts
index f1b127c3fd4..fcd5625a48a 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-wire-admission.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-wire-admission.test.ts
@@ -9,8 +9,13 @@ import type {
 import type { AgentSessionSubscribeEvent } from '../../../shared/agent-session-wire'
 import { REMOTE_RUNTIME_MAX_OUTBOUND_JSON_BYTES } from '../../../shared/remote-runtime-memory-limits'
 import { mobileE2EETextPayloadAdmissionBytes } from '../../runtime/rpc/mobile-e2ee-outbound-admission'
+import { AGENT_SESSION_JOURNAL_SCHEMA_VERSION } from '../../../shared/agent-session-journal-types'
+import { openJournalDatabase } from '../agent-session-journal/journal-database'
+import { journalDatabaseFile } from '../agent-session-journal/journal-paths'
+import { insertJournalRow } from '../agent-session-journal/journal-row-table'
+import type { JournalRow } from '../agent-session-journal/journal-row-schema'
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
-import { openAgentSessionJournal } from '../agent-session-journal/journal-store-factory'
+import { createTrackedJournalOpener } from '../agent-session-journal/journal-store-test-open'
 import { readAgentSessionHistory } from './agent-session-history-page'
 import { AgentSessionSubscribers } from './structured-agent-session-subscribers'
 
@@ -19,10 +24,11 @@ const LARGE_TEXT = 'x'.repeat(250 * 1024)
 
 let root: string
 let journal: AgentSessionJournal
+const journals = createTrackedJournalOpener()
 
 beforeEach(async () => {
   root = await mkdtemp(join(tmpdir(), 'orca-wire-admission-'))
-  journal = await openAgentSessionJournal({
+  journal = await journals.open({
     identity: {
       sessionId: SESSION,
       workspaceId: 'workspace-1',
@@ -30,8 +36,7 @@ beforeEach(async () => {
       agent: 'codex',
       providerHandle: { kind: 'codex', threadId: 'thread-1' }
     },
-    journalDir: root,
-    autoCompact: false
+    journalDir: root
   })
   for (let ordinal = 1; ordinal <= 20; ordinal += 1) {
     await journal.appendItem(item(ordinal), body(`${ordinal}:${LARGE_TEXT}`), { fence: 1 })
@@ -39,6 +44,7 @@ beforeEach(async () => {
 })
 
 afterEach(async () => {
+  await journals.closeAll()
   await rm(root, { recursive: true, force: true })
 })
 
@@ -91,23 +97,16 @@ describe('structured agent-session outbound admission', () => {
     expect(epochHistory).toMatchObject({ ok: false, reset: 'epoch_changed' })
     expectAdmitted(epochHistory)
 
-    await journal.compact(Date.now() + 1, { minTailRows: 0, retainTailMs: 0 })
-    const compactedReset: AgentSessionSubscribeEvent[] = []
-    subscribers.open({
-      id: 'compacted',
-      sessionId: SESSION,
-      journal,
-      fence: 2,
-      cursor: { epoch: journal.epoch, sequence: 0 },
-      emit: (event) => compactedReset.push(event)
-    })
-    expect(compactedReset[0]).toMatchObject({ type: 'reset', reset: 'cursor_compacted' })
-    expectAdmitted(compactedReset[0])
-
-    const history = readAgentSessionHistory(journal, {
+    // The store can no longer produce a `cursor_compacted` reset — with no row
+    // shedding inside an epoch, `oldestSequence` is always 1. The reset reason
+    // stays in the wire vocabulary through the over-budget page path, which is
+    // where this file's subject — is such a frame admitted outbound? — now lives.
+    const cursorBefore = journal.cursor()
+    const overBudget = await reopenWithOversizedRemoval(cursorBefore.sequence)
+    const history = readAgentSessionHistory(overBudget, {
       sessionId: SESSION,
       direction: 'after',
-      cursor: { epoch: journal.epoch, sequence: 0 }
+      cursor: cursorBefore
     })
     expect(history).toMatchObject({ ok: false, reset: 'cursor_compacted' })
     expectAdmitted(history)
@@ -156,3 +155,42 @@ function item(ordinal: number): AgentJournalItemIdentity {
 function body(text: string): AgentJournalItemBody {
   return { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text }] }
 }
+
+/** Stages a pre-bounding oversized removal id — the one remaining producer of a
+ *  `cursor_compacted` reset — straight into the session database. */
+async function reopenWithOversizedRemoval(afterSequence: number): Promise<AgentSessionJournal> {
+  const hugeItemId = `codex:thread-1:${'h'.repeat(5 * 1024 * 1024)}:1`
+  const base = { v: AGENT_SESSION_JOURNAL_SCHEMA_VERSION, epoch: journal.epoch, fence: 1, ts: 1 }
+  const rows: JournalRow[] = [
+    {
+      ...base,
+      kind: 'item',
+      itemId: hugeItemId,
+      revision: 1,
+      seq: afterSequence + 1,
+      body: { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text: 'big' }] }
+    },
+    { ...base, kind: 'tombstone', itemId: hugeItemId, revision: 2, seq: afterSequence + 2 }
+  ]
+  await journal.close()
+  const opened = openJournalDatabase(journalDatabaseFile(root))
+  try {
+    opened.db.exec('BEGIN IMMEDIATE')
+    for (const row of rows) {
+      insertJournalRow(opened.db, SESSION, row)
+    }
+    opened.db.exec('COMMIT')
+  } finally {
+    opened.db.close()
+  }
+  return journals.open({
+    identity: {
+      sessionId: SESSION,
+      workspaceId: 'workspace-1',
+      hostId: 'local',
+      agent: 'codex',
+      providerHandle: { kind: 'codex', threadId: 'thread-1' }
+    },
+    journalDir: root
+  })
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-tui-transcript-catchup.test.ts b/src/main/native-chat/agent-session-wire/structured-tui-transcript-catchup.test.ts
index 956e8a0eaa8..6e4cf64b5bf 100644
--- a/src/main/native-chat/agent-session-wire/structured-tui-transcript-catchup.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-tui-transcript-catchup.test.ts
@@ -3,9 +3,11 @@ import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
-import { openAgentSessionJournal } from '../agent-session-journal/journal-store-factory'
+import { createTrackedJournalOpener } from '../agent-session-journal/journal-store-test-open'
 import { StructuredTuiTranscriptCatchup } from './structured-tui-transcript-catchup'
 
+const journals = createTrackedJournalOpener()
+
 const NOW = 1_800_000_000_000
 const SESSION = 'session-catchup'
 const THREAD = '019fd532-7c11-7a90-b6de-4e1a2c3d5f60'
@@ -27,6 +29,7 @@ beforeEach(async () => {
 })
 
 afterEach(async () => {
+  await journals.closeAll()
   await rm(root, { recursive: true, force: true })
 })
 
@@ -83,7 +86,7 @@ async function createCatchupFixture() {
     },
     now: NOW
   })
-  const journal = await openAgentSessionJournal({
+  const journal = await journals.open({
     identity: {
       sessionId: SESSION,
       workspaceId: 'workspace-1',
diff --git a/src/main/native-chat/agent-session-wire/unhandled-provider-frame.test.ts b/src/main/native-chat/agent-session-wire/unhandled-provider-frame.test.ts
index d287838a13c..e389b30aba2 100644
--- a/src/main/native-chat/agent-session-wire/unhandled-provider-frame.test.ts
+++ b/src/main/native-chat/agent-session-wire/unhandled-provider-frame.test.ts
@@ -8,12 +8,7 @@ describe('unhandled provider frame journal fallback', () => {
       'future-provider',
       'notification:new/event',
       { body: 'abcdefghij' },
-      {
-        inlineHeadBytes: 8,
-        maxSessionBytes: 1024,
-        maxAppendsPerWindow: 10,
-        appendWindowMs: 1000
-      }
+      { inlineHeadBytes: 8 }
     )
 
     expect(item).not.toBeNull()
@@ -32,12 +27,6 @@ describe('unhandled provider frame journal fallback', () => {
     expect(
       Buffer.byteLength(item.body.providerFrame?.payload.head ?? '', 'utf8')
     ).toBeLessThanOrEqual(8)
-    expect(item.blobs).toEqual([
-      {
-        digest: item.body.providerFrame?.payload.digest,
-        payload: '{"body":"abcdefghij"}'
-      }
-    ])
   })
 
   it('turns an unserializable message-shaped payload into an explicit visible value', () => {
@@ -198,12 +187,7 @@ describe('unhandled provider frame journal fallback', () => {
       'codex',
       'notification:warning',
       { message },
-      {
-        inlineHeadBytes: 8,
-        maxSessionBytes: 1024,
-        maxAppendsPerWindow: 10,
-        appendWindowMs: 1000
-      }
+      { inlineHeadBytes: 8 }
     )
 
     expect(row?.body.text).toContain('abcdefgh')
diff --git a/src/main/native-chat/agent-session-wire/unhandled-provider-frame.ts b/src/main/native-chat/agent-session-wire/unhandled-provider-frame.ts
index b4651cfc952..60f34707ac9 100644
--- a/src/main/native-chat/agent-session-wire/unhandled-provider-frame.ts
+++ b/src/main/native-chat/agent-session-wire/unhandled-provider-frame.ts
@@ -9,7 +9,6 @@ import { classifyProviderFrame } from './provider-frame-disposition'
 
 export type UnhandledProviderFrameJournalItem = {
   body: AgentJournalStatusItem
-  blobs: { digest: string; payload: string }[]
   /** Why the frame surfaced. Error frames are exempt from generic-row caps. */
   classification: 'timeline-substantive' | 'error-surface'
 }
@@ -55,7 +54,8 @@ function directReadableMessage(payload: unknown): string | null {
   return null
 }
 
-function readableMessage(payload: unknown): string | null {
+/** The provider's own sentence for a frame, when it carries one. */
+export function readableProviderFrameText(payload: unknown): string | null {
   const direct = directReadableMessage(payload)
   if (direct || typeof payload !== 'object' || payload === null || Array.isArray(payload)) {
     return direct
@@ -90,7 +90,7 @@ export function unhandledProviderFrameJournalItem(
   // Why: the opcode alone ("codex · notification:warning") tells the user nothing
   // and reads as protocol noise. Lead with the provider's own sentence when it has
   // one; the raw frame stays behind the row's disclosure either way.
-  const message = readableMessage(payload)
+  const message = readableProviderFrameText(payload)
   const display = message ? boundInlineText(message, limits) : null
   return {
     body: {
@@ -98,7 +98,6 @@ export function unhandledProviderFrameJournalItem(
       text: display?.text ?? `${provider} · ${kind}`,
       providerFrame: { provider, kind, payload: bounded }
     },
-    blobs: bounded.truncated ? [{ digest: bounded.digest, payload: serialized }] : [],
     classification: classification === 'error-surface' ? 'error-surface' : 'timeline-substantive'
   }
 }
diff --git a/src/main/native-chat/claude-structured-managed-account-support.test.ts b/src/main/native-chat/claude-structured-managed-account-support.test.ts
new file mode 100644
index 00000000000..f647579d03e
--- /dev/null
+++ b/src/main/native-chat/claude-structured-managed-account-support.test.ts
@@ -0,0 +1,154 @@
+import { describe, expect, it } from 'vitest'
+import { getSelectedClaudeAccountIdForTarget } from '../claude-accounts/runtime-selection'
+import {
+  structuredClaudeMatchesActiveManagedAccount,
+  type ClaudeManagedAccountGateSettings
+} from './claude-structured-managed-account-support'
+
+function account(id: string, managedAuthRuntime: 'host' | 'wsl') {
+  return {
+    id,
+    email: `${id}@example.com`,
+    managedAuthPath: `/managed/${id}`,
+    managedAuthRuntime,
+    authMethod: 'subscription-oauth' as const,
+    createdAt: 0,
+    updatedAt: 0,
+    lastAuthenticatedAt: 0
+  }
+}
+
+function settings(
+  overrides: Partial<ClaudeManagedAccountGateSettings>
+): ClaudeManagedAccountGateSettings {
+  return { claudeManagedAccounts: [], activeClaudeManagedAccountId: null, ...overrides }
+}
+
+describe('structuredClaudeMatchesActiveManagedAccount', () => {
+  it('allows an unmanaged install, where nothing claims an identity', () => {
+    expect(structuredClaudeMatchesActiveManagedAccount(settings({}))).toBe(true)
+  })
+
+  it('allows a selected host account, which the runtime syncs into the ambient config', () => {
+    expect(
+      structuredClaudeMatchesActiveManagedAccount(
+        settings({
+          claudeManagedAccounts: [account('host-1', 'host')],
+          activeClaudeManagedAccountIdsByRuntime: { host: 'host-1', wsl: {} }
+        })
+      )
+    ).toBe(true)
+  })
+
+  it('refuses a WSL-only managed account, which never reaches the ambient config', () => {
+    expect(
+      structuredClaudeMatchesActiveManagedAccount(
+        settings({
+          claudeManagedAccounts: [account('wsl-1', 'wsl')],
+          activeClaudeManagedAccountIdsByRuntime: { host: null, wsl: { Ubuntu: 'wsl-1' } }
+        })
+      )
+    ).toBe(false)
+  })
+
+  it('refuses when a host selection names an account that is WSL-bound or missing', () => {
+    expect(
+      structuredClaudeMatchesActiveManagedAccount(
+        settings({
+          claudeManagedAccounts: [account('wsl-1', 'wsl')],
+          activeClaudeManagedAccountIdsByRuntime: { host: 'wsl-1', wsl: {} }
+        })
+      )
+    ).toBe(false)
+    expect(
+      structuredClaudeMatchesActiveManagedAccount(
+        settings({
+          claudeManagedAccounts: [account('host-1', 'host')],
+          activeClaudeManagedAccountIdsByRuntime: { host: 'gone', wsl: {} }
+        })
+      )
+    ).toBe(false)
+  })
+
+  /** Absent and empty are the same answer: this user has no managed Claude accounts, so nothing
+   *  claims an identity and the ambient path is legitimate. Only settings that cannot be READ are
+   *  unknown. Treating a missing key as unknown strands profiles that simply never wrote it — the
+   *  auth policy's own predicate takes `(accounts ?? [])` for exactly this reason. */
+  it('treats an absent account list the same as an empty one', () => {
+    expect(
+      structuredClaudeMatchesActiveManagedAccount(settings({ claudeManagedAccounts: [] }))
+    ).toBe(true)
+    expect(
+      structuredClaudeMatchesActiveManagedAccount({
+        activeClaudeManagedAccountId: null
+      } as unknown as ClaudeManagedAccountGateSettings)
+    ).toBe(true)
+  })
+
+  it('fails closed when the settings cannot be read at all', () => {
+    expect(structuredClaudeMatchesActiveManagedAccount(null)).toBe(false)
+    expect(structuredClaudeMatchesActiveManagedAccount(undefined)).toBe(false)
+  })
+
+  /** The four states this gate exists to tell apart, pinned together so a change to one is visible
+   *  against the others. */
+  it.each([
+    ['no managed accounts', [], null, true],
+    ['accounts present, none active, no WSL account', [account('host-1', 'host')], null, true],
+    ['host account selected', [account('host-1', 'host')], 'host-1', true],
+    ['WSL-only, normalized to no host selection', [account('wsl-1', 'wsl')], null, false]
+  ] as const)('resolves %s', (_name, claudeManagedAccounts, activeId, expected) => {
+    expect(
+      structuredClaudeMatchesActiveManagedAccount(
+        settings({
+          claudeManagedAccounts: [...claudeManagedAccounts],
+          activeClaudeManagedAccountIdsByRuntime: { host: activeId, wsl: {} }
+        })
+      )
+    ).toBe(expected)
+  })
+
+  /** THE discriminator, and the whole of this rule. With nothing selected for the host runtime the
+   *  settings alone cannot distinguish honest deselection from the WSL-only steady state, because
+   *  `pruneInvalidClaudeRuntimeSelection` empties the host slot in the second case and persists it.
+   *  So the presence of ANY WSL-bound account decides. Simplifying this to "none active ->
+   *  supported" re-opens the auth-identity misrepresentation this gate exists to prevent. */
+  it('splits none-active on whether a WSL-bound account exists at all', () => {
+    const noneActive = (accounts: ReturnType<typeof account>[]) =>
+      structuredClaudeMatchesActiveManagedAccount(
+        settings({
+          claudeManagedAccounts: accounts,
+          activeClaudeManagedAccountIdsByRuntime: { host: null, wsl: {} }
+        })
+      )
+
+    expect(noneActive([account('host-1', 'host')])).toBe(true)
+    expect(noneActive([account('host-1', 'host'), account('host-2', 'host')])).toBe(true)
+    expect(noneActive([account('wsl-1', 'wsl')])).toBe(false)
+    // Mixed list still refuses: the WSL account is present and nothing is selected.
+    expect(noneActive([account('host-1', 'host'), account('wsl-1', 'wsl')])).toBe(false)
+  })
+
+  /** The gate and the auth policy must resolve the SAME account. A legacy settings blob carries the
+   *  selection only in the flat `activeClaudeManagedAccountId`, which is where the accessor's
+   *  fall-through lives — reading the runtime map directly silently disagrees with the policy. */
+  it('resolves the same account as the auth policy on a legacy flat selection', () => {
+    const legacy = settings({
+      claudeManagedAccounts: [account('host-1', 'host')],
+      activeClaudeManagedAccountId: 'host-1'
+    })
+
+    expect(getSelectedClaudeAccountIdForTarget(legacy, { runtime: 'host' })).toBe('host-1')
+    expect(structuredClaudeMatchesActiveManagedAccount(legacy)).toBe(true)
+  })
+
+  it('agrees with the auth policy that a legacy flat WSL selection is refused', () => {
+    const legacy = settings({
+      claudeManagedAccounts: [account('wsl-1', 'wsl')],
+      activeClaudeManagedAccountId: 'wsl-1'
+    })
+
+    expect(getSelectedClaudeAccountIdForTarget(legacy, { runtime: 'host' })).toBe('wsl-1')
+    expect(structuredClaudeMatchesActiveManagedAccount(legacy)).toBe(false)
+  })
+})
diff --git a/src/main/native-chat/claude-structured-managed-account-support.ts b/src/main/native-chat/claude-structured-managed-account-support.ts
new file mode 100644
index 00000000000..dccf6216bda
--- /dev/null
+++ b/src/main/native-chat/claude-structured-managed-account-support.ts
@@ -0,0 +1,61 @@
+import type { GlobalSettings } from '../../shared/global-settings-types'
+import { getSelectedClaudeAccountIdForTarget } from '../claude-accounts/runtime-selection'
+
+export type ClaudeManagedAccountGateSettings = Pick<
+  GlobalSettings,
+  | 'claudeManagedAccounts'
+  | 'activeClaudeManagedAccountId'
+  | 'activeClaudeManagedAccountIdsByRuntime'
+>
+
+/**
+ * A structured Claude session launches against the ambient Claude config, which the account service
+ * keeps in sync with the selected HOST account. A WSL-bound managed account lives inside the distro
+ * and is never synced there, so such a session would authenticate as whatever the ambient identity
+ * happens to be while the UI names the WSL account — the user is told one identity and given
+ * another. Refuse the structured path there and let the terminal-backed one, which resolves the
+ * account per runtime, handle that account shape.
+ *
+ * Reads the selection through the same accessor the auth policy uses. Resolving it any other way
+ * lets the two disagree, and a session admitted by this gate would then run under a policy computed
+ * from a different account than the one approved here.
+ *
+ * Unknown answers refuse, and only genuinely unknown ones: settings that cannot be read at all, or
+ * an active selection this cannot resolve. An install with no managed accounts — the list empty or
+ * never written — claims no identity and is fine.
+ */
+export function structuredClaudeMatchesActiveManagedAccount(
+  settings: ClaudeManagedAccountGateSettings | null | undefined
+): boolean {
+  if (!settings) {
+    return false
+  }
+  // Absent is the same answer as empty — this user has no managed Claude accounts, so nothing
+  // claims an identity and ambient auth is the truth. Only settings that cannot be READ are
+  // unknown, and those refuse above. The auth policy reads the list the same way.
+  const accounts = settings.claudeManagedAccounts ?? []
+  if (accounts.length === 0) {
+    return true
+  }
+  const activeHostId = getSelectedClaudeAccountIdForTarget(settings, { runtime: 'host' })
+  if (!activeHostId) {
+    // Nothing selected for the host runtime is two different states that the settings cannot tell
+    // apart after the fact: honest deselection, where ambient auth is the truth and the UI names no
+    // identity, and the WSL-only case, where the prune emptied the host slot and persisted null
+    // while the UI still names the WSL account. The presence of any WSL-bound account decides.
+    return !accounts.some((candidate) => candidate.managedAuthRuntime === 'wsl')
+  }
+  const active = accounts.find((candidate) => candidate.id === activeHostId)
+  return active ? active.managedAuthRuntime !== 'wsl' : false
+}
+
+/** Reads the gate's settings, answering null when they cannot be read so callers refuse. */
+export function readClaudeManagedAccountGateSettings(
+  getSettings: () => ClaudeManagedAccountGateSettings
+): ClaudeManagedAccountGateSettings | null {
+  try {
+    return getSettings()
+  } catch {
+    return null
+  }
+}
diff --git a/src/main/native-chat/session-file-resolver-claude-roots.test.ts b/src/main/native-chat/session-file-resolver-claude-roots.test.ts
new file mode 100644
index 00000000000..87ebd570280
--- /dev/null
+++ b/src/main/native-chat/session-file-resolver-claude-roots.test.ts
@@ -0,0 +1,97 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const scanned = vi.hoisted(() => ({ dirs: [] as string[], hits: {} as Record<string, string> }))
+vi.mock('../ai-vault/session-scanner-discovery', () => ({
+  walkSessionFiles: async (dir: string) => {
+    scanned.dirs.push(dir)
+    const hit = scanned.hits[dir]
+    return hit ? [hit] : []
+  }
+}))
+
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+import { resolveSessionFilePath } from './session-file-resolver'
+
+const DEFAULT_ROOT = join(homedir(), '.claude', 'projects')
+const CONFIG_DIR = '/opt/claude-home'
+const CONFIG_ROOT = join(CONFIG_DIR, 'projects')
+
+let previousConfigDir: string | undefined
+
+beforeEach(() => {
+  previousConfigDir = process.env.CLAUDE_CONFIG_DIR
+  scanned.dirs = []
+  scanned.hits = {}
+})
+
+afterEach(() => {
+  if (previousConfigDir === undefined) {
+    delete process.env.CLAUDE_CONFIG_DIR
+  } else {
+    process.env.CLAUDE_CONFIG_DIR = previousConfigDir
+  }
+})
+
+/**
+ * Honouring CLAUDE_CONFIG_DIR fixed new sessions but would otherwise hide every
+ * transcript written before the user adopted the variable. The Codex resolver in this
+ * same file already searches managed-then-default and de-dupes; Claude does the same.
+ */
+describe('claude transcript roots', () => {
+  it('searches the config-dir root first, then the default home', async () => {
+    process.env.CLAUDE_CONFIG_DIR = CONFIG_DIR
+
+    await resolveSessionFilePath('claude', 'session-1')
+
+    expect(scanned.dirs).toEqual([CONFIG_ROOT, DEFAULT_ROOT])
+  })
+
+  it('still finds history written before CLAUDE_CONFIG_DIR was adopted', async () => {
+    process.env.CLAUDE_CONFIG_DIR = CONFIG_DIR
+    const legacy = join(DEFAULT_ROOT, '-repos-old', 'session-1.jsonl')
+    scanned.hits[DEFAULT_ROOT] = legacy
+
+    await expect(resolveSessionFilePath('claude', 'session-1')).resolves.toBe(legacy)
+  })
+
+  it('prefers the config-dir root when both hold the session', async () => {
+    process.env.CLAUDE_CONFIG_DIR = CONFIG_DIR
+    scanned.hits[CONFIG_ROOT] = join(CONFIG_ROOT, '-repos-new', 'session-1.jsonl')
+    scanned.hits[DEFAULT_ROOT] = join(DEFAULT_ROOT, '-repos-old', 'session-1.jsonl')
+
+    await expect(resolveSessionFilePath('claude', 'session-1')).resolves.toBe(
+      scanned.hits[CONFIG_ROOT]
+    )
+    // The default root is never reached, so the common case pays for one scan.
+    expect(scanned.dirs).toEqual([CONFIG_ROOT])
+  })
+
+  it('scans one root when the variable is unset', async () => {
+    delete process.env.CLAUDE_CONFIG_DIR
+
+    await resolveSessionFilePath('claude', 'session-1')
+
+    expect(scanned.dirs).toEqual([DEFAULT_ROOT])
+  })
+
+  it('de-dupes when CLAUDE_CONFIG_DIR names the default home', async () => {
+    process.env.CLAUDE_CONFIG_DIR = join(homedir(), '.claude')
+
+    await resolveSessionFilePath('claude', 'session-1')
+
+    expect(scanned.dirs).toEqual([DEFAULT_ROOT])
+  })
+
+  it('honours an explicit root override without adding fallbacks', async () => {
+    process.env.CLAUDE_CONFIG_DIR = CONFIG_DIR
+    // The account-home callers (structured-claude-runtime-adapter, the host handoff)
+    // know the exact tree their session pinned; a fallback there could resolve a
+    // different account's transcript.
+    await resolveSessionFilePath('claude', 'session-1', {
+      claudeProjectsDir: '/accounts/pinned/projects'
+    })
+
+    expect(scanned.dirs).toEqual(['/accounts/pinned/projects'])
+  })
+})
diff --git a/src/main/native-chat/session-file-resolver.test.ts b/src/main/native-chat/session-file-resolver.test.ts
index 584d8a25a9d..04946f5b464 100644
--- a/src/main/native-chat/session-file-resolver.test.ts
+++ b/src/main/native-chat/session-file-resolver.test.ts
@@ -1,9 +1,12 @@
 import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { dirname, join } from 'node:path'
-import { afterEach, describe, expect, it } from 'vitest'
+import { afterEach, describe, expect, it, vi } from 'vitest'
 
-import { ClaudeTranscriptTailIncompleteError } from '../claude/claude-transcript-branch-proof'
+import {
+  ClaudeTranscriptTailIncompleteError,
+  readClaudeTranscriptLeafWithReproof
+} from '../claude/claude-transcript-branch-proof'
 import { readClaudeTranscriptLeafUuid, resolveSessionFilePath } from './session-file-resolver'
 
 let tempRoots: string[] = []
@@ -139,6 +142,263 @@ describe('resolveSessionFilePath', () => {
     )
   })
 
+  it('rejects non-transcript and sidechain UUIDs as the durable leaf', async () => {
+    const root = await makeRoot('orca-native-chat-resolve-claude-leaf-filter-')
+    const transcript = join(root, 'session.jsonl')
+    await writeFile(
+      transcript,
+      [
+        { type: 'user', uuid: 'main-user', parentUuid: null, sessionId: 'session-1' },
+        {
+          type: 'assistant',
+          uuid: 'sidechain-assistant',
+          parentUuid: 'main-user',
+          sessionId: 'session-1',
+          isSidechain: true
+        },
+        { type: 'result', uuid: 'result-frame', parentUuid: 'main-user', sessionId: 'session-1' },
+        {
+          type: 'system',
+          subtype: 'init',
+          uuid: 'init-frame',
+          parentUuid: null,
+          sessionId: 'session-1'
+        },
+        { type: 'stream_event', uuid: 'stream-frame', parentUuid: null, sessionId: 'session-1' },
+        { type: 'last-prompt', leafUuid: 'sidechain-assistant', sessionId: 'session-1' }
+      ]
+        .map((record) => JSON.stringify(record))
+        .join('\n'),
+      'utf8'
+    )
+
+    await expect(readClaudeTranscriptLeafUuid(transcript, 'session-1')).rejects.toThrow(
+      'marker leaf is missing from the session graph'
+    )
+  })
+
+  it('rejects a main leaf whose ancestry crosses a subagent sidechain', async () => {
+    const root = await makeRoot('orca-native-chat-resolve-claude-sidechain-ancestry-')
+    const transcript = join(root, 'session.jsonl')
+    await writeFile(
+      transcript,
+      [
+        { type: 'user', uuid: 'main-user', parentUuid: null, sessionId: 'session-1' },
+        {
+          type: 'assistant',
+          uuid: 'sidechain-assistant',
+          parentUuid: 'main-user',
+          sessionId: 'session-1',
+          isSidechain: true
+        },
+        {
+          type: 'assistant',
+          uuid: 'main-after-sidechain',
+          parentUuid: 'sidechain-assistant',
+          sessionId: 'session-1'
+        },
+        { type: 'last-prompt', leafUuid: 'main-after-sidechain', sessionId: 'session-1' }
+      ]
+        .map((record) => JSON.stringify(record))
+        .join('\n'),
+      'utf8'
+    )
+
+    await expect(readClaudeTranscriptLeafUuid(transcript, 'session-1')).rejects.toThrow(
+      'not on the main transcript'
+    )
+  })
+
+  it('rejects a main leaf whose ancestry crosses a parent-tool-use sidechain', async () => {
+    const root = await makeRoot('orca-native-chat-resolve-claude-parent-tool-ancestry-')
+    const transcript = join(root, 'transcript.jsonl')
+    await writeFile(
+      transcript,
+      [
+        { type: 'user', uuid: 'main-user', parentUuid: null, sessionId: 'session-1' },
+        {
+          type: 'assistant',
+          uuid: 'subagent-assistant',
+          parentUuid: 'main-user',
+          sessionId: 'session-1',
+          parent_tool_use_id: 'tool-use-1'
+        },
+        {
+          type: 'assistant',
+          uuid: 'main-after-sidechain',
+          parentUuid: 'subagent-assistant',
+          sessionId: 'session-1'
+        },
+        { type: 'last-prompt', leafUuid: 'main-after-sidechain', sessionId: 'session-1' }
+      ]
+        .map((record) => JSON.stringify(record))
+        .join('\n'),
+      'utf8'
+    )
+
+    await expect(readClaudeTranscriptLeafUuid(transcript, 'session-1')).rejects.toThrow(
+      'not on the main transcript'
+    )
+  })
+
+  it('rejects a previous cursor descended from a parent-tool-use sidechain', async () => {
+    const root = await makeRoot('orca-native-chat-resolve-claude-parent-tool-cursor-')
+    const transcript = join(root, 'transcript.jsonl')
+    await writeFile(
+      transcript,
+      [
+        { type: 'user', uuid: 'main-user', parentUuid: null, sessionId: 'session-1' },
+        {
+          type: 'assistant',
+          uuid: 'subagent-assistant',
+          parentUuid: 'main-user',
+          sessionId: 'session-1',
+          parent_tool_use_id: 'tool-use-1'
+        },
+        {
+          type: 'assistant',
+          uuid: 'main-after-sidechain',
+          parentUuid: 'subagent-assistant',
+          sessionId: 'session-1'
+        },
+        { type: 'last-prompt', leafUuid: 'main-after-sidechain', sessionId: 'session-1' }
+      ]
+        .map((record) => JSON.stringify(record))
+        .join('\n'),
+      'utf8'
+    )
+
+    await expect(
+      readClaudeTranscriptLeafUuid(transcript, 'session-1', 'main-after-sidechain')
+    ).rejects.toThrow('not on the main transcript')
+  })
+
+  it('rejects a latest marker descended from a parent-tool-use cursor sidechain', async () => {
+    const root = await makeRoot('orca-native-chat-resolve-claude-parent-tool-cursor-descendant-')
+    const transcript = join(root, 'transcript.jsonl')
+    await writeFile(
+      transcript,
+      [
+        { type: 'user', uuid: 'main-user', parentUuid: null, sessionId: 'session-1' },
+        {
+          type: 'assistant',
+          uuid: 'subagent-assistant',
+          parentUuid: 'main-user',
+          sessionId: 'session-1',
+          parent_tool_use_id: 'tool-use-1'
+        },
+        {
+          type: 'assistant',
+          uuid: 'main-after-sidechain',
+          parentUuid: 'subagent-assistant',
+          sessionId: 'session-1'
+        },
+        {
+          type: 'assistant',
+          uuid: 'latest-after-sidechain',
+          parentUuid: 'main-after-sidechain',
+          sessionId: 'session-1'
+        },
+        { type: 'last-prompt', leafUuid: 'latest-after-sidechain', sessionId: 'session-1' }
+      ]
+        .map((record) => JSON.stringify(record))
+        .join('\n'),
+      'utf8'
+    )
+
+    await expect(
+      readClaudeTranscriptLeafUuid(transcript, 'session-1', 'main-after-sidechain')
+    ).rejects.toThrow('not on the main transcript')
+  })
+
+  it('rejects a post-snapshot descendant whose parent row was observed later', async () => {
+    const root = await makeRoot('orca-native-chat-resolve-claude-post-snapshot-')
+    const transcript = join(root, 'transcript.jsonl')
+    await writeFile(
+      transcript,
+      [
+        {
+          type: 'assistant',
+          uuid: 'descendant',
+          parentUuid: 'previous',
+          sessionId: 'session-1'
+        },
+        { type: 'assistant', uuid: 'previous', parentUuid: null, sessionId: 'session-1' },
+        { type: 'last-prompt', leafUuid: 'descendant', sessionId: 'session-1' }
+      ]
+        .map((record) => JSON.stringify(record))
+        .join('\n'),
+      'utf8'
+    )
+
+    await expect(readClaudeTranscriptLeafUuid(transcript, 'session-1', 'previous')).rejects.toThrow(
+      'parent row follows descendant'
+    )
+  })
+
+  it('does not re-prove a divergent sibling after the sampled cursor rejects', async () => {
+    const root = await makeRoot('orca-native-chat-resolve-claude-sibling-reproof-')
+    const transcript = join(root, 'transcript.jsonl')
+    await writeFile(
+      transcript,
+      [
+        { type: 'user', uuid: 'root', parentUuid: null, sessionId: 'session-1' },
+        { type: 'assistant', uuid: 'old', parentUuid: 'root', sessionId: 'session-1' },
+        { type: 'assistant', uuid: 'new', parentUuid: 'root', sessionId: 'session-1' },
+        { type: 'last-prompt', leafUuid: 'new', sessionId: 'session-1' }
+      ]
+        .map((record) => JSON.stringify(record))
+        .join('\n'),
+      'utf8'
+    )
+    const calls: (string | null)[] = []
+    const readTranscriptLeaf = async ({
+      previousLeafUuid
+    }: {
+      previousLeafUuid: string | null
+    }) => {
+      calls.push(previousLeafUuid)
+      return readClaudeTranscriptLeafUuid(transcript, 'session-1', previousLeafUuid)
+    }
+
+    await expect(readClaudeTranscriptLeafUuid(transcript, 'session-1', 'old')).rejects.toThrow(
+      'sibling branch'
+    )
+
+    await expect(
+      readClaudeTranscriptLeafWithReproof({
+        readTranscriptLeaf,
+        claudeConfigDir: '/accounts/claude',
+        providerSessionId: 'session-1',
+        previousLeafUuid: 'old'
+      })
+    ).rejects.toThrow('sibling branch')
+    expect(calls).toEqual(['old'])
+  })
+
+  it('does not accept a divergent sibling after a truncated-tail reproof', async () => {
+    const calls: (string | null)[] = []
+    const readTranscriptLeaf = vi.fn(
+      async ({ previousLeafUuid }: { previousLeafUuid: string | null }) => {
+        calls.push(previousLeafUuid)
+        if (calls.length === 1) {
+          throw new ClaudeTranscriptTailIncompleteError()
+        }
+        return 'divergent-sibling'
+      }
+    )
+
+    await expect(
+      readClaudeTranscriptLeafWithReproof({
+        readTranscriptLeaf,
+        claudeConfigDir: '/accounts/claude',
+        providerSessionId: 'session-1',
+        previousLeafUuid: 'old'
+      })
+    ).rejects.toBeInstanceOf(ClaudeTranscriptTailIncompleteError)
+    expect(calls).toEqual(['old'])
+  })
+
   it('globs Claude project subdirs for <sessionId>.jsonl', async () => {
     const root = await makeRoot('orca-native-chat-resolve-claude-')
     const claudeProjectsDir = join(root, 'claude-projects')
@@ -410,3 +670,42 @@ describe('resolveSessionFilePath', () => {
     expect(resolved).toBe(target)
   })
 })
+
+// Mobile native chat resolves with no root override (transcript-read-cache.ts:104),
+// while the account home a structured Claude session pins is
+// `CLAUDE_CONFIG_DIR || ~/.claude` (runtime-paths.ts:15). When the two disagree the
+// CLI writes one place and mobile reads another, and the chat goes dark with no
+// wire-level error — so the default root has to honour the same variable.
+describe('the default Claude transcript root mobile falls back to', () => {
+  it('follows CLAUDE_CONFIG_DIR, the same variable the pinned account home follows', async () => {
+    const configDir = await makeRoot('orca-native-chat-claude-config-dir-')
+    const slugDir = join(configDir, 'projects', '-repos-workspace-1')
+    await mkdir(slugDir, { recursive: true })
+    const transcript = join(slugDir, 'session-under-config-dir.jsonl')
+    await writeFile(transcript, '', 'utf8')
+    const previous = process.env.CLAUDE_CONFIG_DIR
+    process.env.CLAUDE_CONFIG_DIR = configDir
+
+    try {
+      // No `claudeProjectsDir` override: exactly the call mobile makes.
+      await expect(resolveSessionFilePath('claude', 'session-under-config-dir')).resolves.toBe(
+        transcript
+      )
+    } finally {
+      restoreEnv('CLAUDE_CONFIG_DIR', previous)
+    }
+  })
+
+  it('ignores a blank CLAUDE_CONFIG_DIR rather than resolving against the filesystem root', async () => {
+    const previous = process.env.CLAUDE_CONFIG_DIR
+    process.env.CLAUDE_CONFIG_DIR = '   '
+
+    try {
+      await expect(
+        resolveSessionFilePath('claude', 'session-that-does-not-exist')
+      ).resolves.toBeNull()
+    } finally {
+      restoreEnv('CLAUDE_CONFIG_DIR', previous)
+    }
+  })
+})
diff --git a/src/main/native-chat/session-file-resolver.ts b/src/main/native-chat/session-file-resolver.ts
index 0ee73fddc8d..12d2e615742 100644
--- a/src/main/native-chat/session-file-resolver.ts
+++ b/src/main/native-chat/session-file-resolver.ts
@@ -31,8 +31,20 @@ import { proveClaudeTranscriptBranch } from '../claude/claude-transcript-branch-
 // the remote main resolves its local home, so we never hardcode an absolute
 // user path — homedir()/CODEX_HOME resolution stays runtime-relative and is
 // computed per call (not at module load) so it tracks the live home.
-function claudeProjectsDir(): string {
-  return join(homedir(), '.claude', 'projects')
+// Why CLAUDE_CONFIG_DIR and not just homedir(): a structured Claude session pins its
+// account home to `CLAUDE_CONFIG_DIR || ~/.claude` (claude-accounts/runtime-paths.ts),
+// and the CLI writes its transcript under whatever home it was given. Mobile native chat
+// resolves with no root override, so a default that ignored the variable read a different
+// tree than the CLI wrote — a silent blackout, not an error.
+// Why both roots and not just that one: adopting the variable would otherwise hide every
+// transcript written before it was set. Same managed-then-default shape as
+// codexSessionsDirs below, de-duped so the usual case still scans once.
+function claudeProjectsDirs(): string[] {
+  const candidates = [
+    join(process.env.CLAUDE_CONFIG_DIR?.trim() || join(homedir(), '.claude'), 'projects'),
+    join(homedir(), '.claude', 'projects')
+  ]
+  return candidates.filter((dir, index) => candidates.indexOf(dir) === index)
 }
 
 // Why: Orca launches Codex with ORCA_CODEX_HOME pointing at its own managed
@@ -173,9 +185,11 @@ async function resolveSessionFileById(
   }
 
   if (transcriptAgent === 'claude') {
+    // An explicit root is the caller naming the exact account tree its session pinned;
+    // adding a fallback there could resolve a different account's transcript.
     return resolveClaudeSessionFile(
       trimmedId,
-      options.claudeProjectsDir ?? claudeProjectsDir(),
+      options.claudeProjectsDir ? [options.claudeProjectsDir] : claudeProjectsDirs(),
       signal
     )
   }
@@ -205,16 +219,22 @@ async function resolveSessionFileById(
 
 async function resolveClaudeSessionFile(
   sessionId: string,
-  projectsDir: string,
+  projectsDirs: readonly string[],
   signal?: AbortSignal
 ): Promise<string | null> {
   const targetName = `${sessionId}.jsonl`
-  const files = await walkSessionFiles(projectsDir, 'claude', [], {
-    extensions: new Set(['.jsonl']),
-    filePredicate: (path) => basename(path) === targetName,
-    signal
-  })
-  return files[0] ?? null
+  for (const projectsDir of projectsDirs) {
+    // No existence pre-check: walkSessionFiles already yields [] for a missing root.
+    const files = await walkSessionFiles(projectsDir, 'claude', [], {
+      extensions: new Set(['.jsonl']),
+      filePredicate: (path) => basename(path) === targetName,
+      signal
+    })
+    if (files[0]) {
+      return files[0]
+    }
+  }
+  return null
 }
 
 async function resolveCodexSessionFile(
diff --git a/src/main/native-chat/structured-agent-session-create-support.test.ts b/src/main/native-chat/structured-agent-session-create-support.test.ts
new file mode 100644
index 00000000000..ab19d369bac
--- /dev/null
+++ b/src/main/native-chat/structured-agent-session-create-support.test.ts
@@ -0,0 +1,83 @@
+import { describe, expect, it } from 'vitest'
+import type { AgentSessionExecutionLocation } from '../../shared/agent-session-record'
+import type { ClaudeManagedAccountGateSettings } from './claude-structured-managed-account-support'
+import { resolveStructuredAgentSessionCreateSupport } from './structured-agent-session-create-support'
+
+const LOCAL: AgentSessionExecutionLocation = {
+  executionHostId: 'local',
+  wslDistro: null,
+  workspaceId: 'workspace-1',
+  workspaceKind: 'git-worktree'
+}
+
+function managedAccount(id: string, managedAuthRuntime: 'host' | 'wsl') {
+  return {
+    id,
+    email: `${id}@example.com`,
+    managedAuthPath: `/managed/${id}`,
+    managedAuthRuntime,
+    authMethod: 'subscription-oauth' as const,
+    createdAt: 0,
+    updatedAt: 0,
+    lastAuthenticatedAt: 0
+  }
+}
+
+const HOST_SELECTED: ClaudeManagedAccountGateSettings = {
+  claudeManagedAccounts: [managedAccount('host-1', 'host')],
+  activeClaudeManagedAccountId: 'host-1',
+  activeClaudeManagedAccountIdsByRuntime: { host: 'host-1', wsl: {} }
+}
+
+const WSL_ONLY: ClaudeManagedAccountGateSettings = {
+  claudeManagedAccounts: [managedAccount('wsl-1', 'wsl')],
+  activeClaudeManagedAccountId: null,
+  activeClaudeManagedAccountIdsByRuntime: { host: null, wsl: { Ubuntu: 'wsl-1' } }
+}
+
+function support(
+  overrides: Partial<Parameters<typeof resolveStructuredAgentSessionCreateSupport>[0]> = {}
+) {
+  return resolveStructuredAgentSessionCreateSupport({
+    agent: 'claude',
+    location: LOCAL,
+    adapterSupportsCreate: true,
+    getSettings: () => HOST_SELECTED,
+    ...overrides
+  })
+}
+
+describe('resolveStructuredAgentSessionCreateSupport', () => {
+  it('supports Claude under a selected host account', () => {
+    expect(support()).toEqual({ supported: true })
+  })
+
+  it('refuses Claude under a WSL-only managed account', () => {
+    expect(support({ getSettings: () => WSL_ONLY })).toEqual({ supported: false, reason: 'wsl' })
+  })
+
+  it('fails closed for Claude when the settings throw', () => {
+    expect(
+      support({
+        getSettings: () => {
+          throw new Error('no store')
+        }
+      })
+    ).toEqual({ supported: false, reason: 'wsl' })
+  })
+
+  it('leaves Codex to the adapter answer under the same WSL-only account', () => {
+    expect(support({ agent: 'codex', getSettings: () => WSL_ONLY })).toEqual({ supported: true })
+  })
+
+  it.each([
+    ['remote', { ...LOCAL, executionHostId: 'ssh:host-a' }, 'remote'],
+    ['wsl workspace', { ...LOCAL, wslDistro: 'Ubuntu' }, 'wsl'],
+    ['unsupported agent', LOCAL, 'agent']
+  ] as const)('keeps the adapter refusal reason for %s', (_name, location, reason) => {
+    expect(support({ adapterSupportsCreate: false, location })).toEqual({
+      supported: false,
+      reason
+    })
+  })
+})
diff --git a/src/main/native-chat/structured-agent-session-create-support.ts b/src/main/native-chat/structured-agent-session-create-support.ts
new file mode 100644
index 00000000000..9b96a1af4be
--- /dev/null
+++ b/src/main/native-chat/structured-agent-session-create-support.ts
@@ -0,0 +1,48 @@
+import type { AgentSessionExecutionLocation } from '../../shared/agent-session-record'
+import { LOCAL_EXECUTION_HOST_ID } from '../../shared/execution-host'
+import {
+  readClaudeManagedAccountGateSettings,
+  structuredClaudeMatchesActiveManagedAccount,
+  type ClaudeManagedAccountGateSettings
+} from './claude-structured-managed-account-support'
+
+export type StructuredAgentSessionCreateSupport = {
+  supported: boolean
+  reason?: 'agent' | 'remote' | 'wsl'
+}
+
+/**
+ * The create-support verdict, kept out of the runtime class file because that file is `@ts-nocheck`
+ * — a call site there is not typechecked, so an auth-identity decision written inline would compile
+ * however wrong it was. The runtime hands over the two facts it owns and this decides.
+ */
+export function resolveStructuredAgentSessionCreateSupport(input: {
+  agent: 'claude' | 'codex'
+  location: AgentSessionExecutionLocation
+  adapterSupportsCreate: boolean
+  getSettings: () => ClaudeManagedAccountGateSettings
+}): StructuredAgentSessionCreateSupport {
+  if (!input.adapterSupportsCreate) {
+    return {
+      supported: false,
+      reason:
+        input.location.executionHostId !== LOCAL_EXECUTION_HOST_ID
+          ? 'remote'
+          : input.location.wslDistro
+            ? 'wsl'
+            : 'agent'
+    }
+  }
+  // Claude only: Codex resolves its account on a different path, so its answer is untouched here.
+  // `wsl` is the closest existing reason — the cause is a WSL-bound account rather than a WSL
+  // workspace — and no client reads the field, so it stays as-is.
+  if (
+    input.agent === 'claude' &&
+    !structuredClaudeMatchesActiveManagedAccount(
+      readClaudeManagedAccountGateSettings(input.getSettings)
+    )
+  ) {
+    return { supported: false, reason: 'wsl' }
+  }
+  return { supported: true }
+}
diff --git a/src/main/native-chat/transcript-line-decoders-claude.ts b/src/main/native-chat/transcript-line-decoders-claude.ts
index f819656bdb2..5202035bbc6 100644
--- a/src/main/native-chat/transcript-line-decoders-claude.ts
+++ b/src/main/native-chat/transcript-line-decoders-claude.ts
@@ -3,6 +3,8 @@
 import {
   NATIVE_CHAT_INTERRUPTED_STATUS_TEXT,
   type NativeChatBlock,
+  type NativeChatEditPatch,
+  type NativeChatEditPatchHunk,
   type NativeChatMessage
 } from '../../shared/native-chat-types'
 import {
@@ -15,6 +17,59 @@ import { imageSourcePathFromText } from '../../shared/native-chat-image-transcri
 import { claudeContentBlocks } from './transcript-record-blocks'
 import { claudeInterruptedMessageId } from './transcript-turn-markers'
 
+const MAX_EDIT_PATCH_HUNKS = 40
+const MAX_EDIT_PATCH_HUNK_LINES = 400
+
+/** Claude reports an edit as a snippet pair on the call, which cannot locate the
+ *  change in the file. The result record carries the hunks it resolved against
+ *  the real file, so keep them for the renderer's line-number gutter. */
+function claudeEditPatch(record: Record<string, unknown>): NativeChatEditPatch | null {
+  const result = asRecord(record.toolUseResult)
+  const raw = result?.structuredPatch
+  if (!Array.isArray(raw) || raw.length === 0) {
+    return null
+  }
+  const hunks: NativeChatEditPatchHunk[] = []
+  for (const entry of raw.slice(0, MAX_EDIT_PATCH_HUNKS)) {
+    const hunk = asRecord(entry)
+    const lines = hunk?.lines
+    if (
+      typeof hunk?.oldStart !== 'number' ||
+      typeof hunk.newStart !== 'number' ||
+      !Array.isArray(lines)
+    ) {
+      continue
+    }
+    hunks.push({
+      oldStart: hunk.oldStart,
+      oldLines: typeof hunk.oldLines === 'number' ? hunk.oldLines : 0,
+      newStart: hunk.newStart,
+      newLines: typeof hunk.newLines === 'number' ? hunk.newLines : 0,
+      lines: lines
+        .slice(0, MAX_EDIT_PATCH_HUNK_LINES)
+        .flatMap((line) => (typeof line === 'string' ? [line] : []))
+    })
+  }
+  if (hunks.length === 0) {
+    return null
+  }
+  const filePath = extractString(result?.filePath)
+  return { ...(filePath ? { filePath } : {}), hunks }
+}
+
+/** Attaches the resolved hunks to the record's tool result, which is the only
+ *  block in a Claude result turn. */
+function withEditPatch(blocks: NativeChatBlock[], patch: NativeChatEditPatch): NativeChatBlock[] {
+  let attached = false
+  return blocks.map((block) => {
+    if (attached || block.type !== 'tool-result') {
+      return block
+    }
+    attached = true
+    return { ...block, editPatch: patch }
+  })
+}
+
 export function decodeClaudeTranscriptLine(
   line: string,
   fallbackId: string
@@ -41,7 +96,9 @@ export function decodeClaudeTranscriptLine(
     }
   }
   const message = asRecord(record.message)
-  const decodedBlocks = claudeContentBlocks(message?.content)
+  const editPatch = claudeEditPatch(record)
+  const contentBlocks = claudeContentBlocks(message?.content)
+  const decodedBlocks = editPatch ? withEditPatch(contentBlocks, editPatch) : contentBlocks
   if (decodedBlocks.length === 0) {
     return null
   }
diff --git a/src/main/native-chat/transcript-line-decoders-codex.ts b/src/main/native-chat/transcript-line-decoders-codex.ts
index c4b0ddbf5ba..d70bd7a7c80 100644
--- a/src/main/native-chat/transcript-line-decoders-codex.ts
+++ b/src/main/native-chat/transcript-line-decoders-codex.ts
@@ -202,6 +202,10 @@ function codexTurnItemBlocks(content: unknown): NativeChatBlock[] {
   return blocks
 }
 
+/** The argument payload is passed through exactly as it arrived. Decoding it
+ *  here would change the shape every `.input` consumer sees — including the ask
+ *  surface, which reads a question shape out of any tool's input — so the one
+ *  consumer that needs structure decodes it for itself. */
 function codexCallInput(payload: Record<string, unknown>): unknown {
   if (payload.arguments !== undefined) {
     return payload.arguments
diff --git a/src/main/native-chat/transcript-reader-codex-history-mode.test.ts b/src/main/native-chat/transcript-reader-codex-history-mode.test.ts
index 5b0f3dc014f..5d18bec8c85 100644
--- a/src/main/native-chat/transcript-reader-codex-history-mode.test.ts
+++ b/src/main/native-chat/transcript-reader-codex-history-mode.test.ts
@@ -2,6 +2,7 @@ import { mkdtemp, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, describe, expect, it } from 'vitest'
+import { extractPendingAsk } from '../../shared/native-chat-ask'
 import { decodeCodexTranscriptLine } from './transcript-line-decoders-codex'
 import { readNativeChatTranscript } from './transcript-reader'
 import { readNativeChatTranscriptTail } from './transcript-tail-reader'
@@ -247,4 +248,43 @@ describe('Codex transcript history modes', () => {
       blocks: [{ type: 'tool-result', output: 'ok' }]
     })
   })
+
+  it('passes an argument payload through untouched, so no consumer changes shape', () => {
+    const call = decodeCodexTranscriptLine(
+      JSON.stringify({
+        type: 'response_item',
+        payload: {
+          type: 'function_call',
+          id: 'call-2',
+          name: 'shell',
+          arguments: '{"command":["bash","-lc","echo hi"]}'
+        }
+      }),
+      'fallback-args'
+    )
+
+    expect(call?.blocks[0]).toMatchObject({
+      type: 'tool-call',
+      name: 'shell',
+      input: '{"command":["bash","-lc","echo hi"]}'
+    })
+  })
+
+  it('does not raise a question card from an unrelated tool that carries a questions payload', () => {
+    const call = decodeCodexTranscriptLine(
+      JSON.stringify({
+        type: 'response_item',
+        payload: {
+          type: 'function_call',
+          id: 'call-3',
+          name: 'some_mcp_tool',
+          arguments: '{"questions":[{"question":"Which branch?","options":["main","dev"]}]}'
+        }
+      }),
+      'fallback-questions'
+    )
+
+    expect(call).not.toBeNull()
+    expect(extractPendingAsk(call ? [call] : [])).toBeNull()
+  })
 })
diff --git a/src/main/observability/index.ts b/src/main/observability/index.ts
index f891da51418..74728a2d81b 100644
--- a/src/main/observability/index.ts
+++ b/src/main/observability/index.ts
@@ -48,7 +48,8 @@ import {
   type UploadBundleOptions,
   type UploadBundleResult
 } from './diagnostic-bundle-upload'
-import { setActiveSink } from './tracer'
+import { setActiveSink, startSpan } from './tracer'
+import { setSecurePathHardeningReporter } from '../../shared/secure-path-hardening-report'
 
 const CI_ENV_VARS = [
   'CI',
@@ -153,10 +154,37 @@ export function initObservability(): ObservabilityConsent {
     return c
   }
   installLocalSink()
+  installSecurePathHardeningReporter()
   return c
 }
 
+/**
+ * Why route it here: Windows path hardening lives in `src/shared` and defaults to `console.warn`,
+ * which reaches nothing in a packaged build — the main process is GUI-subsystem and owns no
+ * console. A credential file left on inherited ACLs is exactly what a diagnostic bundle should
+ * show, so it becomes a span in the trace sink.
+ *
+ * `recovered` ends successfully rather than failing: a host that climbs back out of the
+ * rate-limited state has to be as visible as one that fell into it, or the degraded state is only
+ * ever half-diagnosable.
+ */
+function installSecurePathHardeningReporter(): void {
+  setSecurePathHardeningReporter((entry) => {
+    const span = startSpan('secure-path.windows-acl', {
+      attributes: { targetPath: entry.targetPath, stage: entry.stage, detail: entry.detail }
+    })
+    if (entry.stage === 'recovered') {
+      span.end()
+      console.info('[secure-path.windows-acl] path hardening recovered', entry)
+      return
+    }
+    span.fail(entry.detail)
+    console.warn('[secure-path.windows-acl] failed to restrict path', entry)
+  })
+}
+
 export async function shutdownObservability(): Promise<void> {
+  setSecurePathHardeningReporter(null)
   // Order matters: tracer first so no new pushes arrive while the local sink
   // is closing and flushing buffered lines.
   setActiveSink(null)
diff --git a/src/main/observability/redactor-environment-lines.test.ts b/src/main/observability/redactor-environment-lines.test.ts
new file mode 100644
index 00000000000..a7ab3141d69
--- /dev/null
+++ b/src/main/observability/redactor-environment-lines.test.ts
@@ -0,0 +1,64 @@
+import { describe, expect, it } from 'vitest'
+import { redactString } from './redactor'
+
+const originalEnvLine = /^\s*([A-Z_][A-Z0-9_]*)\s*=\s*\S.*/gm
+const original = (input: string): string =>
+  input.replace(originalEnvLine, (_match, key) => `${String(key)}=[redacted:env-value]`)
+
+const whitespace = [
+  ' ',
+  '\t',
+  '\n',
+  '\r',
+  '\r\n',
+  '\u2028',
+  '\u2029',
+  '\v',
+  '\f',
+  '\u00a0',
+  '\ufeff'
+]
+
+describe('environment line redaction parity', () => {
+  it.each(whitespace)('preserves cross-line greedy whitespace for %j', (space) => {
+    for (const source of [
+      `${space}${space}FOO${space}=${space}value${space}BAR=next`,
+      `FOO=${space}${space}`,
+      `${space}${space}not-a-key${space}FOO=value`,
+      `FOO${space}${space}BAR=value`,
+      `FOO=${space}BAR=next`,
+      `${space}FOO=one${space}${space}BAR=two${space}`,
+      `not a key${space}${space}FOO=one`,
+      `${space}FOO=${space}${space}lowercase`,
+      `${space}FOO=${space} BAR=next${space}tail`
+    ]) {
+      expect(redactString(source), JSON.stringify(source)).toBe(original(source))
+    }
+  })
+
+  it('matches the original across 20,000 malformed and valid sequences', () => {
+    const tokens = [...whitespace, 'FOO', '_A12', 'lowercase', '!', '=', '==', 'value', '0', 'FOO=']
+    let seed = 173
+    for (let sample = 0; sample < 20000; sample++) {
+      let source = ''
+      for (let token = 0; token < 18; token++) {
+        seed = (Math.imul(seed, 1664525) + 1013904223) >>> 0
+        source += tokens[seed % tokens.length]
+      }
+      expect(redactString(source), JSON.stringify(source)).toBe(original(source))
+    }
+  })
+
+  it('keeps rule ordering for labeled secrets within environment values', () => {
+    expect(redactString('\n\r\nFOO=token: value\nBAR=other')).toBe(
+      'FOO=[redacted:env-value]\nBAR=[redacted:env-value]'
+    )
+  })
+
+  it('does not retry every blank line before an invalid key', () => {
+    const source = `${'\r\n\u2028\u2029'.repeat(16384)}lowercase`
+    const started = performance.now()
+    expect(redactString(source)).toBe(source)
+    expect(performance.now() - started).toBeLessThan(200)
+  })
+})
diff --git a/src/main/observability/redactor.ts b/src/main/observability/redactor.ts
index da8feb0a8b0..7ddab42a0c9 100644
--- a/src/main/observability/redactor.ts
+++ b/src/main/observability/redactor.ts
@@ -39,7 +39,11 @@ const PROVIDER_PATTERNS: { tag: string; re: RegExp }[] = [
 const URL_USERINFO = /(https?:\/\/)([^/@\s]+)@/g
 
 // Per-line .env shape. `m` anchors `^` in multi-line strings; `\S.*` redacts the whole value (so `FOO=Bearer <jwt>` can't leak its tail), leading `\S` skips empty `FOO=`.
-const ENV_LINE = /^\s*([A-Z_][A-Z0-9_]*)\s*=\s*\S.*/gm
+const ENV_LINE = /^\s*([A-Z_][A-Z0-9_]*)\s*=\s*\S.*/my
+// Exact `\s*` for the non-ASCII whitespace runs the inline scan hands off (NBSP, BOM, U+2028\u2026).
+const WHITESPACE_RUN = /\s*/y
+// The terminator set `.` and `^`/m use; scanned with `indexOf` so no-match lines never enter the regex engine.
+const LINE_TERMINATORS = ['\n', '\r', '\u2028', '\u2029'] as const
 
 // Attribute keys dropped regardless of value. Matched case-insensitively since HTTP headers vary in case.
 const CLIENT_ATTR_BLOCKLIST = new Set([
@@ -110,11 +114,79 @@ export function redactString(input: string): string {
   out = out.replace(URL_USERINFO, '$1[redacted]@')
 
   // Rule 4 — .env-shape line: keep key, redact value. Last so rule 1 wins over a coincidentally .env-shaped substring.
-  out = out.replace(ENV_LINE, (_match, key) => `${String(key)}=[redacted:env-value]`)
+  out = redactEnvironmentLines(out)
 
   return out
 }
 
+/** Index of the first non-`\s` code unit at or after `index`, or `input.length`. ASCII is the spec-fixed set; anything else defers to the engine. */
+function skipWhitespace(input: string, index: number): number {
+  const length = input.length
+  while (index < length) {
+    const code = input.charCodeAt(index)
+    if (code === 0x20 || (code >= 0x09 && code <= 0x0d)) {
+      index++
+    } else if (code < 0x80) {
+      return index
+    } else {
+      WHITESPACE_RUN.lastIndex = index
+      WHITESPACE_RUN.test(input)
+      if (WHITESPACE_RUN.lastIndex === index) {
+        return index
+      }
+      index = WHITESPACE_RUN.lastIndex
+    }
+  }
+  return index
+}
+
+function redactEnvironmentLines(input: string): string {
+  const parts: string[] = []
+  let copiedThrough = 0
+  let start = 0
+  // Each terminator kind is searched at most once per occurrence; -2 marks "not searched yet", -1 "none remain".
+  const nextTerminator = [-2, -2, -2, -2]
+  while (start < input.length) {
+    const content = skipWhitespace(input, start)
+    if (content === input.length) {
+      break
+    }
+    // Only a `[A-Z_]` first content char can match; failed starts within the leading whitespace all see the same key.
+    const code = input.charCodeAt(content)
+    if ((code >= 0x41 && code <= 0x5a) || code === 0x5f) {
+      ENV_LINE.lastIndex = start
+      const match = ENV_LINE.exec(input)
+      if (match) {
+        parts.push(input.slice(copiedThrough, start), `${match[1]}=[redacted:env-value]`)
+        copiedThrough = ENV_LINE.lastIndex
+        // `.*` stops at end of input or a line terminator, so the next line starts one past it.
+        start = copiedThrough + 1
+        continue
+      }
+    }
+    let terminator = -1
+    for (let kind = 0; kind < LINE_TERMINATORS.length; kind++) {
+      let next = nextTerminator[kind]!
+      if (next !== -1 && next < content) {
+        next = input.indexOf(LINE_TERMINATORS[kind]!, content)
+        nextTerminator[kind] = next
+      }
+      if (next !== -1 && (terminator === -1 || next < terminator)) {
+        terminator = next
+      }
+    }
+    if (terminator === -1) {
+      break
+    }
+    start = terminator + 1
+  }
+  if (parts.length === 0) {
+    return input
+  }
+  parts.push(input.slice(copiedThrough))
+  return parts.join('')
+}
+
 /**
  * Recursively redact a value of unknown shape (strings get rules 1–4; containers
  * recurse; primitives pass through). The `seen` WeakSet guards against cycles,
diff --git a/src/main/orca-chromium-process-pids.ts b/src/main/orca-chromium-process-pids.ts
index f22babc6921..3282f3a4d66 100644
--- a/src/main/orca-chromium-process-pids.ts
+++ b/src/main/orca-chromium-process-pids.ts
@@ -1,4 +1,5 @@
 import { getAppEnvironment, hasAppEnvironment } from '../shared/app-environment'
+import { recordCoalescedDurableCrashBreadcrumb } from './crash-reporting/durable-crash-breadcrumb'
 
 /**
  * PIDs of Orca's own Chromium processes — browser, renderers, GPU, utilities.
@@ -11,6 +12,20 @@ import { getAppEnvironment, hasAppEnvironment } from '../shared/app-environment'
  * Empty on a Node host and empty on failure: that is "no refusal proven", never
  * "safe to kill" — callers must keep every other guard they already have.
  *
+ * The other direction is real too, and bounded by design: `getAppMetrics()` can
+ * still list a renderer Electron has not finished reaping, so on Windows a pid
+ * already recycled onto an unrelated child of ours reads as `own` and its tree
+ * walk is refused. That is why a refusal only blocks the pid-addressed walk and
+ * every gated site still kills its own root through the child handle.
+ *
+ * Why failure stays open rather than refusing everything: a refusal is not free.
+ * `terminateWindowsProcessTree` resolves without killing, and
+ * `killSourceControlAgentProcess` returns that straight to a caller that then
+ * releases the managed-home lock, so failing closed would trade one unreadable
+ * metrics table for every PTY, git, codex and notebook tree in main leaking at
+ * once. The `own_chromium_pids_unreadable` crumb is the price of that choice:
+ * without it a throw is byte-identical to "no Chromium on this host".
+ *
  * Host coverage: only Electron main installs a Chromium-backed AppEnvironment
  * (main-process-preflight). The standalone daemon installs none and `orcad`
  * installs a Node one whose `getAppMetrics()` is `[]`, so this set is empty in
@@ -30,7 +45,26 @@ export function readOrcaChromiumProcessPids(): ReadonlySet<number> {
       .map((metric) => metric.pid)
       .filter((pid) => Number.isInteger(pid) && pid > 0)
     return new Set(pids)
-  } catch {
+  } catch (error) {
+    recordUnreadableOwnChromiumMetrics(error)
     return new Set()
   }
 }
+
+// Why coalesced: the gate reads this set on every tree kill, so a persistently
+// broken metrics table would otherwise flood the 30-slot ring it shares.
+const UNREADABLE_METRICS_COALESCE_MS = 60_000
+
+function recordUnreadableOwnChromiumMetrics(error: unknown): void {
+  try {
+    recordCoalescedDurableCrashBreadcrumb({
+      name: 'own_chromium_pids_unreadable',
+      data: { cause: error instanceof Error ? error.message : String(error) },
+      coalesceKey: 'own-chromium-pids-unreadable',
+      minIntervalMs: UNREADABLE_METRICS_COALESCE_MS
+    })
+  } catch {
+    // Diagnostics must never turn an admitted kill into a thrown one: callers
+    // read this set outside their own try.
+  }
+}
diff --git a/src/main/orca-profiles/profile-cloud-auth-status.ts b/src/main/orca-profiles/profile-cloud-auth-status.ts
index 400498d223e..b0eb7da1978 100644
--- a/src/main/orca-profiles/profile-cloud-auth-status.ts
+++ b/src/main/orca-profiles/profile-cloud-auth-status.ts
@@ -29,7 +29,10 @@ export function getOrcaProfileAuthStatusFromProfile(
       state: 'unconfigured',
       persistence: session.status === 'found' ? session.persistence : 'none',
       cloud,
-      credentialError: session.status === 'decrypt-failed' ? session.error : undefined,
+      credentialError:
+        session.status === 'decrypt-failed' || session.status === 'unreadable'
+          ? session.error
+          : undefined,
       setupMessage: configState.setupMessage
     }
   }
@@ -51,6 +54,9 @@ export function getOrcaProfileAuthStatusFromProfile(
     state: 'reconnect-required',
     persistence: 'none',
     cloud,
-    credentialError: session.status === 'decrypt-failed' ? session.error : undefined
+    credentialError:
+      session.status === 'decrypt-failed' || session.status === 'unreadable'
+        ? session.error
+        : undefined
   }
 }
diff --git a/src/main/orca-profiles/profile-cloud-client.ts b/src/main/orca-profiles/profile-cloud-client.ts
index e7657bbdb87..5893c8d109a 100644
--- a/src/main/orca-profiles/profile-cloud-client.ts
+++ b/src/main/orca-profiles/profile-cloud-client.ts
@@ -159,19 +159,37 @@ function normalizeSessionResponse(value: unknown): OrcaCloudSessionExchangeRespo
 
 const CLOUD_REQUEST_TIMEOUT_MS = 30_000
 
-async function postJson<T>(url: string, body: unknown, accessToken?: string): Promise<T> {
+// Why: refresh tokens rotate, so an aborted refresh is ambiguous — the server
+// may have rotated ours before the reply was lost, and the only recovery is a
+// replay the server reads as reuse. One long attempt beats a short attempt plus
+// a replayed retry.
+const CLOUD_REFRESH_TIMEOUT_MS = 60_000
+
+type PostJsonOptions = {
+  accessToken?: string
+  timeoutMs?: number
+}
+
+// Only a status line proves the server rejected the request without consuming
+// what was in it. Everything else — an abort, a dropped socket, a 200 we could
+// not parse — leaves a rotating credential possibly already spent.
+export function isAmbiguousCloudRequestFailure(error: unknown): boolean {
+  return !(error instanceof OrcaCloudRequestError)
+}
+
+async function postJson<T>(url: string, body: unknown, options?: PostJsonOptions): Promise<T> {
   const response = await fetch(url, {
     method: 'POST',
     headers: {
       'content-type': 'application/json',
-      ...(accessToken ? { authorization: `Bearer ${accessToken}` } : {})
+      ...(options?.accessToken ? { authorization: `Bearer ${options.accessToken}` } : {})
     },
     body: JSON.stringify(body),
     // Why: these are fixed first-party token endpoints; following a redirect
     // would re-send refresh tokens/code verifiers to another origin, and a
     // stalled server must not hang the renderer's awaited IPC call forever.
     redirect: 'error',
-    signal: AbortSignal.timeout(CLOUD_REQUEST_TIMEOUT_MS)
+    signal: AbortSignal.timeout(options?.timeoutMs ?? CLOUD_REQUEST_TIMEOUT_MS)
   })
   if (!response.ok) {
     await cancelUnreadResponseBody(response)
@@ -204,7 +222,7 @@ export async function refreshOrcaCloudCapabilities(
     cloud?: unknown
     organizations?: unknown
     capabilities: unknown
-  }>(config.capabilitiesEndpoint, {}, session.accessToken)
+  }>(config.capabilitiesEndpoint, {}, { accessToken: session.accessToken })
   return {
     cloud: response.cloud === undefined ? undefined : normalizeCloudSummary(response.cloud),
     organizations: normalizeOrganizations(response.organizations),
@@ -217,9 +235,11 @@ export async function refreshOrcaCloudSession(
   session: OrcaCloudSession
 ): Promise<OrcaCloudSessionExchangeResponse> {
   return normalizeSessionResponse(
-    await postJson(config.refreshEndpoint, {
-      refreshToken: session.refreshToken
-    })
+    await postJson(
+      config.refreshEndpoint,
+      { refreshToken: session.refreshToken },
+      { timeoutMs: CLOUD_REFRESH_TIMEOUT_MS }
+    )
   )
 }
 
@@ -235,7 +255,7 @@ export async function createOrcaCloudProfile(
         orgId: args.orgId,
         name: args.name
       },
-      session.accessToken
+      { accessToken: session.accessToken }
     )
   )
 }
@@ -249,7 +269,7 @@ export async function selectOrcaCloudOrg(
     cloud: unknown
     organizations?: unknown
     capabilities: unknown
-  }>(config.orgEndpoint, { orgId }, session.accessToken)
+  }>(config.orgEndpoint, { orgId }, { accessToken: session.accessToken })
   return {
     cloud: normalizeCloudSummary(response.cloud),
     organizations: normalizeOrganizations(response.organizations),
@@ -261,5 +281,9 @@ export async function revokeOrcaCloudSession(
   config: OrcaCloudAuthConfig,
   session: OrcaCloudSession
 ): Promise<void> {
-  await postJson(config.logoutEndpoint, { refreshToken: session.refreshToken }, session.accessToken)
+  await postJson(
+    config.logoutEndpoint,
+    { refreshToken: session.refreshToken },
+    { accessToken: session.accessToken }
+  )
 }
diff --git a/src/main/orca-profiles/profile-cloud-refresh-replay-guard.ts b/src/main/orca-profiles/profile-cloud-refresh-replay-guard.ts
new file mode 100644
index 00000000000..d5c22f6b527
--- /dev/null
+++ b/src/main/orca-profiles/profile-cloud-refresh-replay-guard.ts
@@ -0,0 +1,55 @@
+// Refresh tokens whose server-side fate is unknown: the POST left the client but
+// no status came back, so the server may already have rotated the token before
+// the reply was lost. Sending it again reads as reuse and revokes the whole
+// token family — on 2026-09-04 that turned one slow refresh endpoint into 21,605
+// sign-outs, because every caller's retry loop replayed the same stored token.
+
+// A replay this soon after the ambiguous attempt is a retry loop, not a person
+// asking again; holding it back keeps one lost reply from becoming a storm.
+export const AMBIGUOUS_REFRESH_REPLAY_DELAY_MS = 30_000
+
+type AmbiguousRefreshAttempt = {
+  refreshToken: string
+  attemptedAt: number
+}
+
+const ambiguousRefreshAttempts = new Map<string, AmbiguousRefreshAttempt>()
+
+export class AmbiguousRefreshReplayBlockedError extends Error {
+  constructor() {
+    super('orca_cloud_refresh_replay_blocked')
+    this.name = 'AmbiguousRefreshReplayBlockedError'
+  }
+}
+
+export function recordAmbiguousRefreshAttempt(
+  key: string,
+  refreshToken: string,
+  now = Date.now()
+): void {
+  ambiguousRefreshAttempts.set(key, { refreshToken, attemptedAt: now })
+}
+
+// Call once the token's fate is known: it rotated, or the session it belonged to
+// is gone. Leaving the record would mislabel a later, unrelated 401.
+export function forgetAmbiguousRefreshAttempt(key: string): void {
+  ambiguousRefreshAttempts.delete(key)
+}
+
+export function wasRefreshTokenAmbiguouslyAttempted(key: string, refreshToken: string): boolean {
+  return ambiguousRefreshAttempts.get(key)?.refreshToken === refreshToken
+}
+
+export function blocksAmbiguousRefreshReplay(
+  key: string,
+  refreshToken: string,
+  now = Date.now()
+): boolean {
+  const attempt = ambiguousRefreshAttempts.get(key)
+  if (!attempt || attempt.refreshToken !== refreshToken) {
+    return false
+  }
+  // Why bounded rather than permanent: the token is only *possibly* spent. A
+  // permanent block would sign out every desktop whose refresh merely timed out.
+  return now - attempt.attemptedAt < AMBIGUOUS_REFRESH_REPLAY_DELAY_MS
+}
diff --git a/src/main/orca-profiles/profile-cloud-service-auth-retry.test.ts b/src/main/orca-profiles/profile-cloud-service-auth-retry.test.ts
index 9db1d830986..53b26a75595 100644
--- a/src/main/orca-profiles/profile-cloud-service-auth-retry.test.ts
+++ b/src/main/orca-profiles/profile-cloud-service-auth-retry.test.ts
@@ -53,6 +53,7 @@ vi.mock('./profile-cloud-pkce', () => ({
 
 vi.mock('./profile-cloud-client', () => ({
   OrcaCloudRequestError: OrcaCloudRequestErrorMock,
+  isAmbiguousCloudRequestFailure: (error: unknown) => !(error instanceof OrcaCloudRequestErrorMock),
   createOrcaCloudProfile: createOrcaCloudProfileMock,
   exchangeOrcaCloudAuthCode: exchangeOrcaCloudAuthCodeMock,
   refreshOrcaCloudCapabilities: refreshOrcaCloudCapabilitiesMock,
diff --git a/src/main/orca-profiles/profile-cloud-service-refresh.test.ts b/src/main/orca-profiles/profile-cloud-service-refresh.test.ts
index 075573eea3a..877c74c3c46 100644
--- a/src/main/orca-profiles/profile-cloud-service-refresh.test.ts
+++ b/src/main/orca-profiles/profile-cloud-service-refresh.test.ts
@@ -51,6 +51,7 @@ vi.mock('./profile-cloud-pkce', () => ({
 
 vi.mock('./profile-cloud-client', () => ({
   OrcaCloudRequestError: OrcaCloudRequestErrorMock,
+  isAmbiguousCloudRequestFailure: (error: unknown) => !(error instanceof OrcaCloudRequestErrorMock),
   createOrcaCloudProfile: createOrcaCloudProfileMock,
   exchangeOrcaCloudAuthCode: exchangeOrcaCloudAuthCodeMock,
   refreshOrcaCloudCapabilities: refreshOrcaCloudCapabilitiesMock,
diff --git a/src/main/orca-profiles/profile-cloud-session-invalidation.ts b/src/main/orca-profiles/profile-cloud-session-invalidation.ts
new file mode 100644
index 00000000000..a9415e28ac6
--- /dev/null
+++ b/src/main/orca-profiles/profile-cloud-session-invalidation.ts
@@ -0,0 +1,30 @@
+type OrcaCloudSessionInvalidationListener = () => void
+
+const listeners = new Set<OrcaCloudSessionInvalidationListener>()
+
+/**
+ * Fires when an auth failure (revoked or rotated-away refresh token) clears a
+ * stored cloud session. Never fires for an explicit user sign-out, which already
+ * hands the fresh auth status back to its caller.
+ */
+export function onOrcaCloudSessionInvalidated(
+  listener: OrcaCloudSessionInvalidationListener
+): () => void {
+  listeners.add(listener)
+  return () => {
+    listeners.delete(listener)
+  }
+}
+
+export function emitOrcaCloudSessionInvalidated(): void {
+  for (const listener of listeners) {
+    try {
+      listener()
+    } catch (error) {
+      console.warn(
+        '[orca-profiles] Cloud session invalidation listener failed:',
+        error instanceof Error ? error.message : String(error)
+      )
+    }
+  }
+}
diff --git a/src/main/orca-profiles/profile-cloud-session-refresh.test.ts b/src/main/orca-profiles/profile-cloud-session-refresh.test.ts
index 42b665d4e35..2aa3dc0266e 100644
--- a/src/main/orca-profiles/profile-cloud-session-refresh.test.ts
+++ b/src/main/orca-profiles/profile-cloud-session-refresh.test.ts
@@ -36,6 +36,9 @@ vi.mock('./profile-cloud-client', async (importOriginal) => {
 vi.mock('./profile-cloud-index', () => ({ linkOrcaProfileToCloud: linkMock }))
 
 import { readFreshOrcaCloudSession } from './profile-cloud-session-refresh'
+import { OrcaCloudRequestError } from './profile-cloud-client'
+import { onOrcaCloudSessionInvalidated } from './profile-cloud-session-invalidation'
+import { forgetAmbiguousRefreshAttempt } from './profile-cloud-refresh-replay-guard'
 
 const config = {} as OrcaCloudAuthConfig
 const active = {
@@ -59,6 +62,8 @@ const staleSession = {
 describe('profile cloud session refresh', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    vi.restoreAllMocks()
+    forgetAmbiguousRefreshAttempt('/data\0profile-1')
     saveIfCurrentMock.mockReturnValue('memory-only')
     readMock.mockReturnValue({ status: 'found', session: staleSession, persistence: 'memory-only' })
   })
@@ -110,4 +115,166 @@ describe('profile cloud session refresh', () => {
     expect(saveIfCurrentMock).toHaveBeenCalledTimes(1)
     expect(linkMock).toHaveBeenCalledTimes(1)
   })
+
+  it('notifies subscribers when an auth failure clears the stored session', async () => {
+    const invalidated = vi.fn()
+    const unsubscribe = onOrcaCloudSessionInvalidated(invalidated)
+    refreshMock.mockRejectedValue(new OrcaCloudRequestError(401))
+
+    await expect(readFreshOrcaCloudSession(config, active, '/data')).resolves.toEqual({
+      status: 'reconnect-required'
+    })
+
+    expect(clearMock).toHaveBeenCalledTimes(1)
+    expect(invalidated).toHaveBeenCalledTimes(1)
+    unsubscribe()
+  })
+
+  it('stays silent when a concurrent rotation already replaced the failed session', async () => {
+    const invalidated = vi.fn()
+    const unsubscribe = onOrcaCloudSessionInvalidated(invalidated)
+    refreshMock.mockRejectedValue(new OrcaCloudRequestError(401))
+    readMock.mockReturnValueOnce({
+      status: 'found',
+      session: staleSession,
+      persistence: 'memory-only'
+    })
+    readMock.mockReturnValueOnce({
+      status: 'found',
+      session: staleSession,
+      persistence: 'memory-only'
+    })
+    readMock.mockReturnValue({
+      status: 'found',
+      session: { ...staleSession, refreshToken: 'rotated-refresh' },
+      persistence: 'memory-only'
+    })
+
+    await expect(readFreshOrcaCloudSession(config, active, '/data')).resolves.toEqual({
+      status: 'reconnect-required'
+    })
+
+    expect(clearMock).not.toHaveBeenCalled()
+    expect(invalidated).not.toHaveBeenCalled()
+    unsubscribe()
+  })
+})
+
+describe('refresh-token replay after an ambiguous attempt', () => {
+  const timeout = (): Error =>
+    Object.assign(new Error('The operation timed out.'), { name: 'TimeoutError' })
+  const rotatedResponse = {
+    accessToken: 'new-access',
+    refreshToken: 'new-refresh',
+    expiresAt: 4_000_000,
+    organizations: [],
+    capabilities: { flags: { 'relay.use': true }, refreshedAt: 2 },
+    cloud: { userId: 'user-1', cloudProfileId: 'cloud-profile-1', activeOrgId: 'org-1' }
+  }
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+    vi.restoreAllMocks()
+    forgetAmbiguousRefreshAttempt('/data\0profile-1')
+    saveIfCurrentMock.mockReturnValue('memory-only')
+    readMock.mockReturnValue({ status: 'found', session: staleSession, persistence: 'memory-only' })
+  })
+
+  it('never resends a refresh token whose attempt timed out', async () => {
+    refreshMock.mockRejectedValue(timeout())
+
+    await expect(readFreshOrcaCloudSession(config, active, '/data')).rejects.toThrow(
+      'The operation timed out.'
+    )
+    expect(refreshMock).toHaveBeenCalledTimes(1)
+
+    // The retry loop above this module re-enters immediately; it must not turn
+    // one lost reply into a second POST of the same token.
+    await expect(readFreshOrcaCloudSession(config, active, '/data')).rejects.toThrow(
+      'orca_cloud_refresh_replay_blocked'
+    )
+    expect(refreshMock).toHaveBeenCalledTimes(1)
+    expect(clearMock).not.toHaveBeenCalled()
+  })
+
+  it('adopts the stored session when a timed-out attempt was rotated elsewhere', async () => {
+    const rotated = { ...staleSession, refreshToken: 'rotated-refresh', expiresAt: 4_000_000 }
+    refreshMock.mockRejectedValue(timeout())
+    readMock
+      .mockReturnValueOnce({ status: 'found', session: staleSession, persistence: 'memory-only' })
+      .mockReturnValueOnce({ status: 'found', session: staleSession, persistence: 'memory-only' })
+      .mockReturnValue({ status: 'found', session: rotated, persistence: 'memory-only' })
+
+    await expect(readFreshOrcaCloudSession(config, active, '/data')).resolves.toEqual({
+      status: 'found',
+      session: rotated
+    })
+    expect(refreshMock).toHaveBeenCalledTimes(1)
+    expect(saveIfCurrentMock).not.toHaveBeenCalled()
+  })
+
+  it('retries once after a definitive 5xx, which cannot have rotated the token', async () => {
+    refreshMock
+      .mockRejectedValueOnce(new OrcaCloudRequestError(503))
+      .mockResolvedValueOnce(rotatedResponse)
+
+    const result = await readFreshOrcaCloudSession(config, active, '/data')
+
+    expect(refreshMock).toHaveBeenCalledTimes(2)
+    expect(refreshMock).toHaveBeenNthCalledWith(2, config, staleSession)
+    expect(result).toEqual({
+      status: 'found',
+      session: expect.objectContaining({
+        accessToken: 'new-access',
+        refreshToken: 'new-refresh'
+      })
+    })
+  })
+
+  it('gives a definitive 5xx exactly one retry', async () => {
+    refreshMock.mockRejectedValue(new OrcaCloudRequestError(503))
+
+    await expect(readFreshOrcaCloudSession(config, active, '/data')).rejects.toThrow(
+      'orca_cloud_request_failed_503'
+    )
+    expect(refreshMock).toHaveBeenCalledTimes(2)
+    expect(clearMock).not.toHaveBeenCalled()
+  })
+
+  it('marks a 401 that follows an ambiguous attempt as a possible self-replay', async () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const now = vi.spyOn(Date, 'now').mockReturnValue(1_000_000)
+    const invalidated = vi.fn()
+    const unsubscribe = onOrcaCloudSessionInvalidated(invalidated)
+    refreshMock.mockRejectedValueOnce(timeout())
+
+    await expect(readFreshOrcaCloudSession(config, active, '/data')).rejects.toThrow(
+      'The operation timed out.'
+    )
+
+    now.mockReturnValue(1_000_000 + 31_000)
+    refreshMock.mockRejectedValueOnce(new OrcaCloudRequestError(401))
+
+    await expect(readFreshOrcaCloudSession(config, active, '/data')).resolves.toEqual({
+      status: 'reconnect-required'
+    })
+
+    expect(refreshMock).toHaveBeenCalledTimes(2)
+    expect(warn.mock.calls.flat().join(' ')).toContain('orca_cloud_refresh_possible_replay')
+    expect(clearMock).toHaveBeenCalledTimes(1)
+    expect(invalidated).toHaveBeenCalledTimes(1)
+    unsubscribe()
+  })
+
+  it('does not mark a 401 that follows no ambiguous attempt', async () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    refreshMock.mockRejectedValue(new OrcaCloudRequestError(401))
+
+    await expect(readFreshOrcaCloudSession(config, active, '/data')).resolves.toEqual({
+      status: 'reconnect-required'
+    })
+
+    expect(warn.mock.calls.flat().join(' ')).not.toContain('orca_cloud_refresh_possible_replay')
+    expect(clearMock).toHaveBeenCalledTimes(1)
+  })
 })
diff --git a/src/main/orca-profiles/profile-cloud-session-refresh.ts b/src/main/orca-profiles/profile-cloud-session-refresh.ts
index ced48a16e7b..273f71f016e 100644
--- a/src/main/orca-profiles/profile-cloud-session-refresh.ts
+++ b/src/main/orca-profiles/profile-cloud-session-refresh.ts
@@ -6,13 +6,26 @@ import {
   readOrcaCloudSession,
   saveOrcaCloudSessionIfCurrent
 } from './profile-cloud-session-store'
-import { OrcaCloudRequestError, refreshOrcaCloudSession } from './profile-cloud-client'
+import {
+  isAmbiguousCloudRequestFailure,
+  OrcaCloudRequestError,
+  refreshOrcaCloudSession
+} from './profile-cloud-client'
 import { linkOrcaProfileToCloud } from './profile-cloud-index'
+import type { OrcaCloudSessionExchangeResponse } from './profile-cloud-session-exchange'
+import {
+  AmbiguousRefreshReplayBlockedError,
+  blocksAmbiguousRefreshReplay,
+  forgetAmbiguousRefreshAttempt,
+  recordAmbiguousRefreshAttempt,
+  wasRefreshTokenAmbiguouslyAttempted
+} from './profile-cloud-refresh-replay-guard'
 import {
   captureCloudSessionMutation,
   cloudSessionIdentity,
   tombstoneCloudSession
 } from './profile-cloud-session-mutation'
+import { emitOrcaCloudSessionInvalidated } from './profile-cloud-session-invalidation'
 
 const CLOUD_SESSION_REFRESH_SKEW_MS = 60_000
 
@@ -59,6 +72,11 @@ function clearCloudSessionIfUnchanged(
   if (current.status === 'found' && current.session.refreshToken !== failed.refreshToken) {
     return
   }
+  // A session we were denied is not a session we may delete: the token we would be clearing might
+  // not even be the one that failed, and `clearOrcaCloudSession` unlinks the file outright.
+  if (current.status === 'unreadable') {
+    return
+  }
   if (active.profile.cloud) {
     tombstoneCloudSession(
       cloudSessionIdentity(active.profile.id, active.profile.cloud),
@@ -66,6 +84,76 @@ function clearCloudSessionIfUnchanged(
     )
   }
   clearOrcaCloudSession(profileId, userDataPath)
+  forgetAmbiguousRefreshAttempt(cloudSessionRefreshKey(profileId, userDataPath))
+  // Why: the renderer cached auth status at startup; without this it keeps
+  // showing "Connected" until the app restarts.
+  emitOrcaCloudSessionInvalidated()
+}
+
+// Why: support cannot otherwise tell a genuine revocation from a sign-out we
+// caused ourselves by resending a refresh token whose first attempt never
+// answered. Never log the token itself.
+function warnIfPossibleRefreshReplay(
+  profileId: string,
+  userDataPath: string,
+  failed: OrcaCloudSession,
+  error: unknown
+): void {
+  if (!(error instanceof OrcaCloudRequestError) || error.statusCode !== 401) {
+    return
+  }
+  const key = cloudSessionRefreshKey(profileId, userDataPath)
+  if (!wasRefreshTokenAmbiguouslyAttempted(key, failed.refreshToken)) {
+    return
+  }
+  console.warn(
+    '[orca-cloud] orca_cloud_refresh_possible_replay: refresh rejected 401 for a token whose earlier attempt never answered'
+  )
+}
+
+type CloudSessionRefreshAttempt =
+  | { status: 'refreshed'; response: OrcaCloudSessionExchangeResponse }
+  | { status: 'rotated-elsewhere'; session: OrcaCloudSession }
+
+function isRetryableCloudRefreshRejection(error: unknown): boolean {
+  return error instanceof OrcaCloudRequestError && error.statusCode >= 500
+}
+
+async function attemptCloudSessionRefresh(
+  key: string,
+  config: OrcaCloudAuthConfig,
+  active: ActiveOrcaProfileState,
+  userDataPath: string,
+  session: OrcaCloudSession
+): Promise<CloudSessionRefreshAttempt> {
+  for (let attempt = 0; ; attempt++) {
+    try {
+      const response = await refreshOrcaCloudSession(config, session)
+      forgetAmbiguousRefreshAttempt(key)
+      return { status: 'refreshed', response }
+    } catch (error) {
+      const ambiguous = isAmbiguousCloudRequestFailure(error)
+      if (ambiguous) {
+        recordAmbiguousRefreshAttempt(key, session.refreshToken)
+      }
+      // Only a status line proves the server rejected this token without
+      // rotating it, so a definitive 5xx is the only failure worth retrying.
+      const retryable = !ambiguous && attempt === 0 && isRetryableCloudRefreshRejection(error)
+      if (!ambiguous && !retryable) {
+        throw error
+      }
+      // Another caller may have rotated the stored session while this attempt
+      // was in flight; that result is the one to use, and the token this attempt
+      // held is no longer ours to send again.
+      const current = readOrcaCloudSession(active.profile.id, userDataPath)
+      if (current.status === 'found' && current.session.refreshToken !== session.refreshToken) {
+        return { status: 'rotated-elsewhere', session: current.session }
+      }
+      if (ambiguous) {
+        throw error
+      }
+    }
+  }
 }
 
 async function refreshStoredCloudSession(
@@ -91,9 +179,16 @@ async function refreshStoredCloudSession(
     if (!active.profile.cloud) {
       throw new StaleCloudSessionMutationError()
     }
+    if (blocksAmbiguousRefreshReplay(key, session.refreshToken)) {
+      throw new AmbiguousRefreshReplayBlockedError()
+    }
     const expectedIdentity = cloudSessionIdentity(active.profile.id, active.profile.cloud)
     const snapshot = captureCloudSessionMutation(expectedIdentity, userDataPath)
-    const refreshed = await refreshOrcaCloudSession(config, session)
+    const attempt = await attemptCloudSessionRefresh(key, config, active, userDataPath, session)
+    if (attempt.status === 'rotated-elsewhere') {
+      return attempt.session
+    }
+    const refreshed = attempt.response
     const refreshedIdentity = cloudSessionIdentity(active.profile.id, refreshed.cloud)
     if (
       refreshedIdentity.cloudUserId !== expectedIdentity.cloudUserId ||
@@ -144,6 +239,7 @@ export async function readFreshOrcaCloudSession(
     }
   } catch (error) {
     if (isOrcaCloudAuthFailure(error)) {
+      warnIfPossibleRefreshReplay(active.profile.id, userDataPath, session.session, error)
       clearCloudSessionIfUnchanged(active.profile.id, userDataPath, session.session, active)
       return { status: 'reconnect-required' }
     }
@@ -164,6 +260,7 @@ export async function forceRefreshOrcaCloudSession(
     }
   } catch (error) {
     if (isOrcaCloudAuthFailure(error)) {
+      warnIfPossibleRefreshReplay(active.profile.id, userDataPath, session, error)
       clearCloudSessionIfUnchanged(active.profile.id, userDataPath, session, active)
       return { status: 'reconnect-required' }
     }
diff --git a/src/main/orca-profiles/profile-cloud-session-store.ts b/src/main/orca-profiles/profile-cloud-session-store.ts
index 62d779772c1..d1334d96b6b 100644
--- a/src/main/orca-profiles/profile-cloud-session-store.ts
+++ b/src/main/orca-profiles/profile-cloud-session-store.ts
@@ -1,7 +1,7 @@
 import { existsSync, readFileSync, rmSync } from 'node:fs'
 import { join } from 'node:path'
 import { safeStorage } from 'electron'
-import { writeSecureJsonFile } from '../../shared/secure-file'
+import { isUnreadableError, writeSecureJsonFile } from '../../shared/secure-file'
 import type {
   OrcaCloudCapabilities,
   OrcaCloudOrgSummary,
@@ -29,6 +29,11 @@ export type OrcaCloudSessionReadResult =
   | { status: 'found'; session: OrcaCloudSession; persistence: OrcaCloudSessionPersistence }
   | { status: 'missing'; persistence: 'none' }
   | { status: 'decrypt-failed'; persistence: 'none'; error: string }
+  /**
+   * The file is there and this process may not read it. Distinct from `decrypt-failed` because
+   * that one means "read it, it was garbage" and licenses replacing it; this one licenses nothing.
+   */
+  | { status: 'unreadable'; persistence: 'none'; error: string }
 
 type PersistedEncryptedSession = {
   version: 1
@@ -215,7 +220,14 @@ export function readOrcaCloudSession(
       return { status: 'found', session: parsed.session, persistence: 'dev-plaintext' }
     }
     return { status: 'decrypt-failed', persistence: 'none', error: 'Unsafe session format.' }
-  } catch {
+  } catch (error) {
+    if (isUnreadableError(error)) {
+      return {
+        status: 'unreadable',
+        persistence: 'none',
+        error: 'Cannot read the saved Orca account session: the read failed.'
+      }
+    }
     return {
       status: 'decrypt-failed',
       persistence: 'none',
diff --git a/src/main/own-chromium-tree-kill-guard.test.ts b/src/main/own-chromium-tree-kill-guard.test.ts
index 7e98661aca6..7b9c30687bc 100644
--- a/src/main/own-chromium-tree-kill-guard.test.ts
+++ b/src/main/own-chromium-tree-kill-guard.test.ts
@@ -13,7 +13,12 @@ import {
 import { readOrcaChromiumProcessPids } from './orca-chromium-process-pids'
 import { classifyWindowsTreeKillTarget } from './windows-pty-root-identity'
 import { terminateWindowsProcessTree } from './windows-process-tree-kill'
-import { admitSelfInitiatedTreeKill } from './own-chromium-tree-kill-guard'
+import {
+  admitSelfInitiatedTreeKill,
+  installMainProcessTreeKillGate
+} from './own-chromium-tree-kill-guard'
+import { killCodexAppServerProcessTree } from './codex/codex-app-server-session'
+import { setProcessTreeKillGate } from '../shared/child-process/process-tree-kill-gate'
 import { resetSelfInitiatedTreeKillLogForTest } from './crash-reporting/self-initiated-tree-kill-log'
 import {
   clearCrashBreadcrumbsForTest,
@@ -57,6 +62,7 @@ beforeEach(() => {
   setActiveSink({ push: () => {}, flush: () => {}, close: () => {} })
   clearCrashBreadcrumbsForTest()
   resetSelfInitiatedTreeKillLogForTest()
+  installMainProcessTreeKillGate()
 })
 
 afterEach(() => {
@@ -66,6 +72,7 @@ afterEach(() => {
   vi.restoreAllMocks()
   _resetTracerForTests()
   clearCrashBreadcrumbsForTest()
+  setProcessTreeKillGate(null)
 })
 
 describe('refusing to tree-kill our own Chromium processes', () => {
@@ -143,6 +150,72 @@ describe('refusing to tree-kill our own Chromium processes', () => {
     )
   })
 
+  it('refuses the codex app-server deadline kill against one of our own pids', () => {
+    const spawnImpl = vi.fn(() => ({ on: vi.fn(), unref: vi.fn() }))
+    const child = { pid: RENDERER_PID, kill: vi.fn() }
+
+    killCodexAppServerProcessTree(child as never, {
+      platform: 'win32',
+      spawnImpl: spawnImpl as never
+    })
+
+    // The deadline timer fires on `child.pid` alone; a reaped-then-recycled pid
+    // is the stale-pid mechanism this gate exists to stop.
+    expect(spawnImpl).not.toHaveBeenCalled()
+    expect(getCrashBreadcrumbSnapshot()).toEqual([
+      expect.objectContaining({ name: 'self_tree_kill_refused_own_chromium' })
+    ])
+  })
+
+  it('still lets the codex app-server deadline kill reach a foreign pid', () => {
+    const killer = { on: vi.fn(), unref: vi.fn() }
+    const spawnImpl = vi.fn(() => killer)
+
+    killCodexAppServerProcessTree({ pid: 7777, kill: vi.fn() } as never, {
+      platform: 'win32',
+      spawnImpl: spawnImpl as never
+    })
+
+    expect(spawnImpl).toHaveBeenCalledWith('taskkill', ['/pid', '7777', '/t', '/f'], {
+      stdio: 'ignore',
+      windowsHide: true
+    })
+  })
+
+  /**
+   * Fail-open is the deliberate choice — see `orca-chromium-process-pids.ts` for
+   * why refusing everything is worse — so the crumb is the only thing that keeps
+   * an unreadable metrics table distinguishable from a host that has no Chromium.
+   */
+  it('leaves proof, and still admits the kill, when the Chromium metrics cannot be read', () => {
+    appMetricsMock.mockImplementation(() => {
+      throw new Error('getAppMetrics unavailable')
+    })
+
+    expect([...readOrcaChromiumProcessPids()]).toEqual([])
+    // Coalesced: the gate reads this set on every kill, so a broken table must
+    // not evict the ring it shares with the refusal crumb.
+    expect([...readOrcaChromiumProcessPids()]).toEqual([])
+    expect(
+      admitSelfInitiatedTreeKill({
+        pid: RENDERER_PID,
+        site: 'pty-descendant-sweep',
+        scope: 'win-taskkill-tree'
+      })
+    ).toBe(true)
+
+    expect(
+      getCrashBreadcrumbSnapshot().filter(
+        (breadcrumb) => breadcrumb.name === 'own_chromium_pids_unreadable'
+      )
+    ).toEqual([
+      expect.objectContaining({
+        name: 'own_chromium_pids_unreadable',
+        data: expect.objectContaining({ cause: 'getAppMetrics unavailable' })
+      })
+    ])
+  })
+
   it('refuses an own-Chromium pid at the gate the account teardowns share', () => {
     expect(
       admitSelfInitiatedTreeKill({
diff --git a/src/main/own-chromium-tree-kill-guard.ts b/src/main/own-chromium-tree-kill-guard.ts
index 4daedf4faa4..24b6a4b7327 100644
--- a/src/main/own-chromium-tree-kill-guard.ts
+++ b/src/main/own-chromium-tree-kill-guard.ts
@@ -4,16 +4,23 @@ import {
   type SelfInitiatedTreeKillScope
 } from './crash-reporting/self-initiated-tree-kill-log'
 import { readOrcaChromiumProcessPids } from './orca-chromium-process-pids'
+import { setProcessTreeKillGate } from '../shared/child-process/process-tree-kill-gate'
 
 /**
- * Gate every main-process tree-kill through one decision: refuse the pid when
- * Electron is currently accounting for it, otherwise put it on the record.
+ * Gate every main-process tree-kill through one decision: refuse a pid-addressed
+ * walk when Electron is currently accounting for the pid, otherwise put the
+ * kill on the record.
  *
  * Why a shared gate rather than a check inside `terminateWindowsProcessTree`:
- * the codex and claude account-login teardowns run their own `taskkill /T /F`
- * with different lifetimes (one sync, one with its own timeout ladder), so a
- * guard that only lived in the tree-kill helper would cover one of three
- * families. Returns false when the caller must not kill.
+ * five other families in main run their own `taskkill /T /F` with different
+ * lifetimes (sync, fire-and-forget, timeout ladder), and three more live in
+ * `src/shared` and reach this through `process-tree-kill-gate`, so a guard that
+ * only lived in the tree-kill helper would cover one of nine.
+ * `main-process-tree-kill-gate.test.ts` holds that set closed by counting `/pid`
+ * call sites against gate admissions per file, not by file. Returns false
+ * when the caller must not walk that pid's tree; the caller still kills its own
+ * root through the child handle (`refused-tree-kill-root-termination.test.ts`),
+ * so a refusal is never a process leak.
  *
  * Electron main only, by construction. `terminateWindowsProcessTree` also runs
  * in the standalone daemon (the `pty-descendant-sweep` site), where
@@ -30,11 +37,26 @@ export function admitSelfInitiatedTreeKill(target: {
 }): boolean {
   // Why: no PTY root, codex root or git child is ever one of our own Chromium
   // processes, so a pid that is means the caller is about to kill a renderer,
-  // the GPU or the browser itself (#10680).
-  if (readOrcaChromiumProcessPids().has(target.pid)) {
-    recordRefusedOwnChromiumTreeKill(target)
-    return false
+  // the GPU or the browser itself (#10680). Only the pid-addressed scope can
+  // land there: a POSIX group holds only what Orca put in it, so that arm is
+  // recorded and admitted like every other group kill in main, and a stale
+  // `getAppMetrics()` entry cannot orphan a macOS/Linux tree.
+  const isOwnChromiumPid =
+    target.scope === 'win-taskkill-tree' && readOrcaChromiumProcessPids().has(target.pid)
+  try {
+    if (isOwnChromiumPid) {
+      recordRefusedOwnChromiumTreeKill(target)
+    } else {
+      recordSelfInitiatedTreeKill(target)
+    }
+  } catch {
+    // Recording must never turn a successful termination into a failed one, and
+    // never flip the decision: it is taken above, before anything can throw.
   }
-  recordSelfInitiatedTreeKill(target)
-  return true
+  return !isOwnChromiumPid
+}
+
+/** Hands the gate to the shared choke points, which cannot import main. */
+export function installMainProcessTreeKillGate(): void {
+  setProcessTreeKillGate((kill) => admitSelfInitiatedTreeKill(kill))
 }
diff --git a/src/main/persistence/host-qualified-worktree-meta.ts b/src/main/persistence/host-qualified-worktree-meta.ts
index a9d1c0e8fb1..6267311f471 100644
--- a/src/main/persistence/host-qualified-worktree-meta.ts
+++ b/src/main/persistence/host-qualified-worktree-meta.ts
@@ -1,4 +1,5 @@
-import type { ExecutionHostId } from '../../shared/execution-host'
+import { getRepoExecutionHostId, type ExecutionHostId } from '../../shared/execution-host'
+import type { Repo } from '../../shared/repo-types'
 import type { WorktreeMeta } from '../../shared/worktree/meta-types'
 
 /**
@@ -52,6 +53,26 @@ export function readWorktreeMetaForHost(
   return store.getWorktreeMetaForHost?.(worktreeId, executionHostId)
 }
 
+/**
+ * The same two reads keyed off a repo row, so the resolve-then-read pair lives in one place. Four
+ * call sites had open-coded it identically, which is the shape that lets one copy drift from the
+ * rest (F7/F8).
+ */
+export function readAllWorktreeMetaForRepo(
+  store: Pick<HostQualifiedWorktreeMetaStore, 'getAllWorktreeMeta' | 'getAllWorktreeMetaForHost'>,
+  repo: Pick<Repo, 'connectionId' | 'executionHostId'>
+): Record<string, WorktreeMeta> {
+  return readAllWorktreeMetaForHost(store, getRepoExecutionHostId(repo))
+}
+
+export function readWorktreeMetaForRepo(
+  store: Pick<HostQualifiedWorktreeMetaStore, 'getWorktreeMetaForHost'>,
+  worktreeId: string,
+  repo: Pick<Repo, 'connectionId' | 'executionHostId'>
+): WorktreeMeta | undefined {
+  return readWorktreeMetaForHost(store, worktreeId, getRepoExecutionHostId(repo))
+}
+
 export function writeWorktreeMetaForHost(
   store: Pick<HostQualifiedWorktreeMetaStore, 'setWorktreeMeta' | 'setWorktreeMetaForHost'>,
   worktreeId: string,
diff --git a/src/main/persistence/restoring-sessions/pane-key-remapping.test.ts b/src/main/persistence/restoring-sessions/pane-key-remapping.test.ts
index c0359efd612..2c73045d901 100644
--- a/src/main/persistence/restoring-sessions/pane-key-remapping.test.ts
+++ b/src/main/persistence/restoring-sessions/pane-key-remapping.test.ts
@@ -1,6 +1,7 @@
 import { describe, expect, it } from 'vitest'
 import { makePaneKey } from '../../../shared/stable-pane-id'
 import {
+  remapAcknowledgedAgentPaneKeys,
   remapActivityClearedAtPaneKeys,
   remapManuallyUnreadTurnPaneKeys
 } from './pane-key-remapping'
@@ -30,4 +31,16 @@ describe('remapManuallyUnreadTurnPaneKeys', () => {
       changed: false
     })
   })
+
+  it('returns the caller map untouched when no key needs remapping', () => {
+    const remap = new Map([['tab-1', new Map([[STABLE_LEAF_ID, STABLE_LEAF_ID]])]])
+    const stable = { [makePaneKey('tab-1', STABLE_LEAF_ID)]: 1 }
+
+    const result = remapAcknowledgedAgentPaneKeys(stable, remap)
+
+    // Why identity and not just equality: this runs on every session write against a map that
+    // grows with every pane ever opened, so a rebuilt-then-discarded copy is pure garbage.
+    expect(result.acknowledgements).toBe(stable)
+    expect(result.changed).toBe(false)
+  })
 })
diff --git a/src/main/persistence/restoring-sessions/pane-key-remapping.ts b/src/main/persistence/restoring-sessions/pane-key-remapping.ts
index 4f3440f087e..8e43184b0c5 100644
--- a/src/main/persistence/restoring-sessions/pane-key-remapping.ts
+++ b/src/main/persistence/restoring-sessions/pane-key-remapping.ts
@@ -3,51 +3,50 @@ import { isTerminalLeafId, makePaneKey, parsePaneKey } from '../../../shared/sta
 
 type PaneLeafRemap = Map<string, Map<string, string>>
 
+/** Resolves the pane key a legacy entry should move to, or `null` when it stays put. */
+function resolveRemappedPaneKey(
+  paneKey: string,
+  leafIdByInputLeafIdByTabId: PaneLeafRemap
+): string | null {
+  if (parsePaneKey(paneKey)) {
+    return null
+  }
+  const delimiter = paneKey.indexOf(':')
+  if (delimiter <= 0 || delimiter === paneKey.length - 1) {
+    return null
+  }
+  const tabId = paneKey.slice(0, delimiter)
+  const remappedLeafId = leafIdByInputLeafIdByTabId.get(tabId)?.get(paneKey.slice(delimiter + 1))
+  // makePaneKey cannot throw here: tabId is non-empty and colon-free by construction.
+  return remappedLeafId && isTerminalLeafId(remappedLeafId)
+    ? makePaneKey(tabId, remappedLeafId)
+    : null
+}
+
 function remapPaneKeys<T extends number>(
   values: Record<string, T> | undefined,
   leafIdByInputLeafIdByTabId: PaneLeafRemap
 ): { values: Record<string, T> | undefined; changed: boolean } {
-  if (!values || Object.keys(values).length === 0) {
+  // Why the classify-first pass: these maps grow with every pane ever opened and this runs on
+  // every session write, but post-migration no key is ever rewritten. Rebuilding the whole
+  // object only to discard it was pure garbage; the rewrite below is unchanged.
+  if (
+    !values ||
+    !Object.keys(values).some(
+      (paneKey) => resolveRemappedPaneKey(paneKey, leafIdByInputLeafIdByTabId) !== null
+    )
+  ) {
     return { values, changed: false }
   }
 
-  let changed = false
   const next: Record<string, T> = {}
-  const setValue = (paneKey: string, value: T): void => {
-    const existing = next[paneKey]
-    next[paneKey] = existing === undefined ? value : (Math.max(existing, value) as T)
-  }
   for (const [paneKey, value] of Object.entries(values)) {
-    const parsed = parsePaneKey(paneKey)
-    if (parsed) {
-      setValue(paneKey, value)
-      continue
-    }
-
-    const delimiter = paneKey.indexOf(':')
-    if (delimiter <= 0 || delimiter === paneKey.length - 1) {
-      setValue(paneKey, value)
-      continue
-    }
-
-    const tabId = paneKey.slice(0, delimiter)
-    const legacyLeafId = paneKey.slice(delimiter + 1)
-    const remappedLeafId = leafIdByInputLeafIdByTabId.get(tabId)?.get(legacyLeafId)
-    if (!remappedLeafId || !isTerminalLeafId(remappedLeafId)) {
-      setValue(paneKey, value)
-      continue
-    }
-
-    try {
-      // Carry values over when a legacy leaf is promoted to a UUID.
-      setValue(makePaneKey(tabId, remappedLeafId), value)
-      changed = true
-    } catch {
-      setValue(paneKey, value)
-    }
+    // Carry values over when a legacy leaf is promoted to a UUID; keep the max on collision.
+    const target = resolveRemappedPaneKey(paneKey, leafIdByInputLeafIdByTabId) ?? paneKey
+    const existing = next[target]
+    next[target] = existing === undefined ? value : (Math.max(existing, value) as T)
   }
-
-  return { values: next, changed }
+  return { values: next, changed: true }
 }
 
 export function remapAcknowledgedAgentPaneKeys(
diff --git a/src/main/plugins/plugin-secrets-store.ts b/src/main/plugins/plugin-secrets-store.ts
index 7f16821cfb6..fb41aba71c8 100644
--- a/src/main/plugins/plugin-secrets-store.ts
+++ b/src/main/plugins/plugin-secrets-store.ts
@@ -1,7 +1,7 @@
 import { existsSync, readFileSync, statSync } from 'node:fs'
 import { join } from 'node:path'
 import { safeStorage } from 'electron'
-import { writeSecureFile } from '../../shared/secure-file'
+import { isUnreadableError, writeSecureFile } from '../../shared/secure-file'
 import {
   PLUGIN_STORAGE_KEY_LIMIT,
   PLUGIN_STORAGE_TOTAL_MAX_BYTES
@@ -25,6 +25,8 @@ type PersistedSecretsFile = {
 
 export type PluginSecretsResult<T> = { ok: true; value: T } | { ok: false; error: string }
 
+const UNREADABLE_VAULT_ERROR = 'secret vault exists but could not be read; refusing to overwrite it'
+
 export class PluginSecretsStore {
   private readonly filePath: string
 
@@ -32,7 +34,8 @@ export class PluginSecretsStore {
     this.filePath = join(pluginDataDir(pluginsDataDir, qualifiedKey), 'secrets.json.enc')
   }
 
-  private read(): PersistedSecretsFile {
+  /** `null` means the vault exists and this process may not read it — which is never "empty". */
+  private read(): PersistedSecretsFile | null {
     const empty: PersistedSecretsFile = {
       version: 1,
       format: 'electron-safe-storage-v1',
@@ -56,7 +59,13 @@ export class PluginSecretsStore {
       ) {
         return parsed
       }
-    } catch {
+    } catch (error) {
+      // Being denied the read is not evidence the vault is corrupt. Returning `empty` here would
+      // make the next set() write a vault containing only that one key, silently dropping every
+      // secret the file still holds — and the write would succeed.
+      if (isUnreadableError(error)) {
+        return null
+      }
       // Corrupt vaults read as empty; set() rewrites a valid file.
     }
     return empty
@@ -64,6 +73,9 @@ export class PluginSecretsStore {
 
   get(key: string): PluginSecretsResult<string | null> {
     const file = this.read()
+    if (!file) {
+      return { ok: false, error: UNREADABLE_VAULT_ERROR }
+    }
     const ciphertext = file.ciphertexts[key]
     if (typeof ciphertext !== 'string') {
       return { ok: true, value: null }
@@ -83,6 +95,9 @@ export class PluginSecretsStore {
       return { ok: false, error: 'OS-backed encryption is unavailable; secret not stored' }
     }
     const file = this.read()
+    if (!file) {
+      return { ok: false, error: UNREADABLE_VAULT_ERROR }
+    }
     if (
       !Object.hasOwn(file.ciphertexts, key) &&
       Object.keys(file.ciphertexts).length >= PLUGIN_STORAGE_KEY_LIMIT
@@ -100,6 +115,10 @@ export class PluginSecretsStore {
 
   delete(key: string): void {
     const file = this.read()
+    if (!file) {
+      // Rewriting what we could not read would drop every other secret in the vault.
+      return
+    }
     if (Object.hasOwn(file.ciphertexts, key)) {
       delete file.ciphertexts[key]
       writeSecureFile(this.filePath, JSON.stringify(file, null, 2))
diff --git a/src/main/plugins/plugin-storage-store.ts b/src/main/plugins/plugin-storage-store.ts
index b3949b8f6d4..94a74261e1e 100644
--- a/src/main/plugins/plugin-storage-store.ts
+++ b/src/main/plugins/plugin-storage-store.ts
@@ -1,6 +1,6 @@
 import { existsSync, readFileSync, statSync } from 'node:fs'
 import { join } from 'node:path'
-import { writeSecureFile } from '../../shared/secure-file'
+import { isUnreadableError, writeSecureFile } from '../../shared/secure-file'
 import { isQualifiedPluginKey } from '../../shared/plugins/plugin-manifest'
 import {
   PLUGIN_STORAGE_KEY_LIMIT,
@@ -16,6 +16,8 @@ import {
  * Adapted from community PR #5801's per-plugin settings store.
  */
 
+const UNREADABLE_STORE_ERROR = 'storage file exists but could not be read; refusing to overwrite it'
+
 export function pluginDataDir(pluginsDataDir: string, qualifiedKey: string): string {
   if (!isQualifiedPluginKey(qualifiedKey)) {
     throw new Error(`unsafe plugin key: ${qualifiedKey}`)
@@ -36,7 +38,8 @@ export class PluginKvStore {
     this.filePath = join(pluginDataDir(pluginsDataDir, qualifiedKey), fileName)
   }
 
-  private read(): Record<string, unknown> {
+  /** `null` means the file exists and this process may not read it - which is never `{}`. */
+  private read(): Record<string, unknown> | null {
     try {
       if (!existsSync(this.filePath)) {
         return {}
@@ -48,22 +51,27 @@ export class PluginKvStore {
       if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
         return parsed as Record<string, unknown>
       }
-    } catch {
+    } catch (error) {
+      // Being denied the read is not evidence of corruption. Returning `{}` here would make
+      // the next set()/delete() write a file holding only that one key, dropping the rest.
+      if (isUnreadableError(error)) {
+        return null
+      }
       // Corrupt files reset to empty rather than wedging the plugin.
     }
     return {}
   }
 
   get(key: string): unknown {
-    return this.read()[key]
+    return this.read()?.[key]
   }
 
   getAll(): Record<string, unknown> {
-    return this.read()
+    return this.read() ?? {}
   }
 
   keys(): string[] {
-    return Object.keys(this.read())
+    return Object.keys(this.read() ?? {})
   }
 
   set(key: string, value: unknown): PluginKvWriteResult {
@@ -80,6 +88,9 @@ export class PluginKvStore {
       return { ok: false, error: `value exceeds ${PLUGIN_STORAGE_VALUE_MAX_BYTES} bytes` }
     }
     const settings = this.read()
+    if (!settings) {
+      return { ok: false, error: UNREADABLE_STORE_ERROR }
+    }
     if (!Object.hasOwn(settings, key) && Object.keys(settings).length >= PLUGIN_STORAGE_KEY_LIMIT) {
       return { ok: false, error: `storage exceeds the ${PLUGIN_STORAGE_KEY_LIMIT}-key limit` }
     }
@@ -94,6 +105,10 @@ export class PluginKvStore {
 
   delete(key: string): void {
     const settings = this.read()
+    if (!settings) {
+      // Rewriting what we could not read would drop every other key in the store.
+      return
+    }
     if (Object.hasOwn(settings, key)) {
       delete settings[key]
       writeSecureFile(this.filePath, JSON.stringify(settings, null, 2))
diff --git a/src/main/ports/local-workspace-platform-port-scanner.ts b/src/main/ports/local-workspace-platform-port-scanner.ts
index 7e3b9941617..9a760870540 100644
--- a/src/main/ports/local-workspace-platform-port-scanner.ts
+++ b/src/main/ports/local-workspace-platform-port-scanner.ts
@@ -3,6 +3,7 @@ import { getProcessOutputFields } from '../../shared/process-output-field-scanne
 import { readWindowsProcessTable } from '../windows/windows-process-table'
 import { runPortScanCommand } from './port-scan-command-client'
 import {
+  partitionListenersNeedingMetadata,
   recallListenerMetadata,
   rememberListenerMetadata,
   shouldSkipMetadataCommands,
@@ -19,25 +20,27 @@ import {
 
 export function parseLsofListeningOutput(output: string): RawListeningPort[] {
   const ports: RawListeningPort[] = []
-  let currentPid: number | undefined
-  let currentProcessName: string | undefined
+  let pid: number | undefined
+  let processName: string | undefined
+  let socketId: string | undefined
 
   for (const line of output.split('\n')) {
-    if (!line) {
-      continue
-    }
     const tag = line[0]
     const value = line.slice(1)
     if (tag === 'p') {
-      const pid = Number.parseInt(value, 10)
-      currentPid = Number.isFinite(pid) ? pid : undefined
-      currentProcessName = undefined
+      const parsedPid = Number.parseInt(value, 10)
+      pid = Number.isFinite(parsedPid) ? parsedPid : undefined
+      processName = socketId = undefined
     } else if (tag === 'c') {
-      currentProcessName = value
+      processName = value
+    } else if (tag === 'f') {
+      socketId = undefined // each file record restarts; a socket without `d` must not inherit one
+    } else if (tag === 'd') {
+      socketId = value || undefined
     } else if (tag === 'n') {
       const parsed = parseAddressWithPort(value)
       if (parsed) {
-        ports.push({ pid: currentPid, processName: currentProcessName, ...parsed })
+        ports.push({ pid, processName, ...(socketId ? { socketId } : {}), ...parsed })
       }
     }
   }
@@ -118,17 +121,23 @@ async function scanDarwinLsofPorts(
     '-iTCP',
     '-sTCP:LISTEN',
     '-F',
-    'pcn'
+    // Why `d`: the socket's kernel identity is free on this command and lets the metadata cache
+    // tell a recycled pid on the same port apart from the process it remembered.
+    'pcnd'
   ])
   const ports = parseLsofListeningOutput(stdout)
   if (shouldSkipMetadataCommands(spawnMs, options)) {
     return { ports, metadataAvailable: false }
   }
-  const metadata = await loadDarwinProcessMetadata(
-    new Set(ports.flatMap((p) => (p.pid ? [p.pid] : [])))
-  )
+  // Why: on a quiet machine the same servers keep listening, so the two metadata commands — the
+  // expensive half of the scan — would re-derive answers the last scan already has.
+  const { hydrated, pidsNeedingMetadata } = partitionListenersNeedingMetadata(ports, options)
+  if (pidsNeedingMetadata.size === 0) {
+    return { ports: hydrated, metadataAvailable: true }
+  }
+  const metadata = await loadDarwinProcessMetadata(pidsNeedingMetadata)
   return {
-    ports: ports.map((port) => ({ ...metadata.get(port.pid ?? -1), ...port })),
+    ports: hydrated.map((port) => ({ ...metadata.get(port.pid ?? -1), ...port })),
     metadataAvailable: true
   }
 }
diff --git a/src/main/ports/local-workspace-port-scan-state.ts b/src/main/ports/local-workspace-port-scan-state.ts
index 582e8b9731e..e4025944c79 100644
--- a/src/main/ports/local-workspace-port-scan-state.ts
+++ b/src/main/ports/local-workspace-port-scan-state.ts
@@ -7,10 +7,14 @@ import {
 } from './workspace-port-scan-timeout-backoff'
 
 const SLOW_SPAWN_SKIP_METADATA_MS = 2_000
+/** Re-probe a remembered listener every Nth scan (~5 min at 30s) so a cwd change cannot go stale forever. */
+const METADATA_REPROBE_INTERVAL_SCANS = 10
 const commandTimeoutBackoff = new WorkspacePortScanTimeoutBackoff()
 let loggedWorkerUnavailable = false
 let skippedMetadataOnLastScan = false
-let lastListenerMetadata = new Map<string, ProcessMetadata>()
+let lastListenerMetadata = new Map<string, RememberedListenerMetadata>()
+let metadataScanSequence = 0
+let reusedListenerKeys = new Set<string>()
 
 export type WorkspacePortScanOptions = {
   requireMetadata?: boolean
@@ -21,6 +25,8 @@ export type RawListeningPort = {
   port: number
   pid?: number
   processName?: string
+  /** Kernel socket identity from `lsof -F d`; a new socket on the same pid:port gets a new one. */
+  socketId?: string
   commandLine?: string
   cwd?: string
 }
@@ -31,6 +37,11 @@ export type ProcessMetadata = {
   cwd?: string
 }
 
+type RememberedListenerMetadata = ProcessMetadata & {
+  socketId?: string
+  probedAtScan: number
+}
+
 export type NormalizedWorkspacePortProbe = {
   worktree: WorkspacePortProbe
   normalizedPath: string
@@ -58,6 +69,8 @@ export function resetWorkspacePortScanTimeoutBackoffForTests(): void {
   loggedWorkerUnavailable = false
   skippedMetadataOnLastScan = false
   lastListenerMetadata = new Map()
+  metadataScanSequence = 0
+  reusedListenerKeys = new Set()
 }
 
 export function shouldSkipMetadataCommands(
@@ -72,17 +85,98 @@ export function shouldSkipMetadataCommands(
   return skip
 }
 
+// dedupeRawPorts already collapses rows by connectHost:port:pid, so this key is unique per row.
 function listenerMetadataKey(port: RawListeningPort): string {
   return `${port.pid ?? 'unknown'}:${port.host}:${port.port}`
 }
 
+/** Call after partitionListenersNeedingMetadata: it consumes the reuse set that call recorded. */
 export function rememberListenerMetadata(ports: readonly RawListeningPort[]): void {
-  lastListenerMetadata = new Map(
-    ports.map((port) => [
-      listenerMetadataKey(port),
-      { processName: port.processName, commandLine: port.commandLine, cwd: port.cwd }
-    ])
-  )
+  const previous = lastListenerMetadata
+  lastListenerMetadata = new Map()
+  for (const port of ports) {
+    const key = listenerMetadataKey(port)
+    // Why: a reused entry keeps its original probe time so the staleness ceiling still expires it.
+    const probedAtScan = reusedListenerKeys.has(key)
+      ? (previous.get(key)?.probedAtScan ?? metadataScanSequence)
+      : metadataScanSequence
+    lastListenerMetadata.set(key, {
+      processName: port.processName,
+      socketId: port.socketId,
+      commandLine: port.commandLine,
+      cwd: port.cwd,
+      probedAtScan
+    })
+  }
+  reusedListenerKeys = new Set()
+}
+
+/**
+ * Split listeners into those a previous scan already resolved and the pids still needing a probe.
+ *
+ * Records which keys were reused; rememberListenerMetadata reads and clears that on the same scan.
+ *
+ * Why: the metadata commands are the expensive half of a macOS scan, and a listener that is still
+ * the same process on the same address has the same command line it had 30s ago. A remembered
+ * entry is only trusted when the free `lsof -F c` process name and `-F d` socket identity from
+ * this scan still match, so a recycled pid re-probes instead of inheriting the dead process's
+ * metadata; and every entry is re-probed after METADATA_REPROBE_INTERVAL_SCANS so a process that
+ * chdir'd while listening cannot keep a stale cwd forever.
+ */
+export function partitionListenersNeedingMetadata(
+  ports: readonly RawListeningPort[],
+  options: WorkspacePortScanOptions = {}
+): { hydrated: RawListeningPort[]; pidsNeedingMetadata: Set<number> } {
+  metadataScanSequence += 1
+  reusedListenerKeys = new Set()
+  // Why requireMetadata opts out: that caller is the SIGTERM authorization re-scan, so it must
+  // attribute the owner from this cycle's probe and never from a remembered cwd.
+  if (options.requireMetadata) {
+    return {
+      hydrated: [...ports],
+      pidsNeedingMetadata: new Set(ports.flatMap((port) => (port.pid ? [port.pid] : [])))
+    }
+  }
+  const hydrated: RawListeningPort[] = []
+  const pidsNeedingMetadata = new Set<number>()
+  const reusableByPort = new Map<RawListeningPort, ProcessMetadata>()
+  for (const port of ports) {
+    const remembered = lastListenerMetadata.get(listenerMetadataKey(port))
+    // Why require commandLine: a probe that returned nothing must not be cached as an answer.
+    if (
+      remembered?.commandLine !== undefined &&
+      remembered.processName === port.processName &&
+      remembered.socketId === port.socketId &&
+      metadataScanSequence - remembered.probedAtScan < METADATA_REPROBE_INTERVAL_SCANS &&
+      port.pid !== undefined
+    ) {
+      reusableByPort.set(port, remembered)
+      continue
+    }
+    if (port.pid !== undefined) {
+      pidsNeedingMetadata.add(port.pid)
+    }
+  }
+  // Why the second pass: if any of a pid's sockets needs a probe, none of its sockets may be
+  // served from cache — otherwise one process reports a fresh cwd on one row and a remembered
+  // cwd on another, i.e. two different workspace attributions.
+  for (const port of ports) {
+    const remembered =
+      port.pid !== undefined && !pidsNeedingMetadata.has(port.pid)
+        ? reusableByPort.get(port)
+        : undefined
+    if (remembered) {
+      reusedListenerKeys.add(listenerMetadataKey(port))
+      hydrated.push({
+        ...port,
+        commandLine: port.commandLine ?? remembered.commandLine,
+        cwd: port.cwd ?? remembered.cwd
+      })
+      continue
+    }
+    hydrated.push(port)
+  }
+  return { hydrated, pidsNeedingMetadata }
 }
 
 export function recallListenerMetadata(port: RawListeningPort): RawListeningPort {
diff --git a/src/main/ports/local-workspace-port-scanner.test.ts b/src/main/ports/local-workspace-port-scanner.test.ts
index be37ad60eb3..4f6820be0bd 100644
--- a/src/main/ports/local-workspace-port-scanner.test.ts
+++ b/src/main/ports/local-workspace-port-scanner.test.ts
@@ -50,6 +50,35 @@ describe('local workspace port scanner parsing', () => {
     ])
   })
 
+  it('keeps the socket identity from lsof -F d and tolerates its absence', () => {
+    const ports = parseLsofListeningOutput(
+      [
+        'p123',
+        'cnode',
+        'f18',
+        'd0x469ca588d83e7924',
+        'n127.0.0.1:5173',
+        'f19',
+        'n127.0.0.1:5174',
+        'p456',
+        'cnginx',
+        'n*:8080'
+      ].join('\n')
+    )
+
+    expect(ports).toEqual([
+      {
+        pid: 123,
+        processName: 'node',
+        socketId: '0x469ca588d83e7924',
+        host: '127.0.0.1',
+        port: 5173
+      },
+      { pid: 123, processName: 'node', host: '127.0.0.1', port: 5174 },
+      { pid: 456, processName: 'nginx', host: '*', port: 8080 }
+    ])
+  })
+
   it('parses multiple lsof listening ports for the same process', () => {
     const ports = parseLsofListeningOutput(
       ['p123', 'cnode', 'n127.0.0.1:5173', 'n127.0.0.1:55173'].join('\n')
@@ -387,7 +416,19 @@ describe('scanWorkspacePorts with delayed process creation', () => {
 
   it('does not let a required-metadata scan reset the background skip parity', async () => {
     vi.spyOn(process, 'platform', 'get').mockReturnValue('darwin')
-    mockStalledDarwinScan()
+    // Why a fresh pid each cycle: a listener the previous scan already resolved is served from the
+    // remembered metadata, so a stable pid would hide whether this scan skipped the probe or not.
+    let listenerPid = 123
+    runPortScanCommandMock.mockImplementation(async (command: string, args: string[]) => {
+      if (command === 'lsof' && args.includes('-iTCP')) {
+        listenerPid += 1
+        return { stdout: `p${listenerPid}\ncnode\nn127.0.0.1:5173`, spawnMs: 4_200 }
+      }
+      if (command === 'lsof') {
+        return { stdout: [`p${listenerPid}`, 'n/repo'].join('\n'), spawnMs: 4_200 }
+      }
+      return { stdout: `${listenerPid} node /repo/server.js`, spawnMs: 4_200 }
+    })
 
     await scanWorkspacePorts(worktrees, urlWatcherStub())
     await scanWorkspacePorts(worktrees, urlWatcherStub(), { requireMetadata: true })
@@ -397,6 +438,168 @@ describe('scanWorkspacePorts with delayed process creation', () => {
     expect(runPortScanCommandMock).toHaveBeenCalledTimes(7)
   })
 
+  it('serves an unchanged listener from remembered metadata instead of re-probing', async () => {
+    vi.spyOn(process, 'platform', 'get').mockReturnValue('darwin')
+    runPortScanCommandMock.mockImplementation(async (command: string, args: string[]) => {
+      if (command === 'lsof' && args.includes('-iTCP')) {
+        return { stdout: LSOF_LISTEN_OUTPUT, spawnMs: 5 }
+      }
+      if (command === 'lsof') {
+        return { stdout: ['p123', 'n/repo'].join('\n'), spawnMs: 5 }
+      }
+      return { stdout: '123 node /repo/server.js', spawnMs: 5 }
+    })
+
+    const first = await scanWorkspacePorts(worktrees, urlWatcherStub())
+    expect(runPortScanCommandMock).toHaveBeenCalledTimes(3)
+
+    const second = await scanWorkspacePorts(worktrees, urlWatcherStub())
+
+    // Only the listening scan itself runs; the two metadata commands are served from the cache.
+    expect(runPortScanCommandMock).toHaveBeenCalledTimes(4)
+    expect(second.ports).toEqual(first.ports)
+  })
+
+  it('re-probes every port of a pid when any one of them needs metadata', async () => {
+    vi.spyOn(process, 'platform', 'get').mockReturnValue('darwin')
+    let secondSocket = 'd0xbbbb'
+    let cwd = '/repo'
+    runPortScanCommandMock.mockImplementation(async (command: string, args: string[]) => {
+      if (command === 'lsof' && args.includes('-iTCP')) {
+        return {
+          stdout: [
+            'p123',
+            'cnode',
+            'f10',
+            'd0xaaaa',
+            'n127.0.0.1:5173',
+            'f11',
+            secondSocket,
+            'n127.0.0.1:5174'
+          ].join('\n'),
+          spawnMs: 5
+        }
+      }
+      if (command === 'lsof') {
+        return { stdout: ['p123', `n${cwd}`].join('\n'), spawnMs: 5 }
+      }
+      return { stdout: `123 node ${cwd}/server.js`, spawnMs: 5 }
+    })
+
+    await scanWorkspacePorts(worktrees, urlWatcherStub())
+    expect(runPortScanCommandMock).toHaveBeenCalledTimes(3)
+
+    // One socket is replaced and the process has since moved, so this pid must be re-derived for
+    // BOTH its rows — serving one from cache would report two different workspaces for one process.
+    secondSocket = 'd0xcccc'
+    cwd = '/elsewhere'
+    const scan = await scanWorkspacePorts(worktrees, urlWatcherStub())
+
+    expect(runPortScanCommandMock).toHaveBeenCalledTimes(6)
+    expect(new Set(scan.ports.map((entry) => entry.kind)).size).toBe(1)
+  })
+
+  it('always probes metadata for a requireMetadata scan, even when the cache is warm', async () => {
+    vi.spyOn(process, 'platform', 'get').mockReturnValue('darwin')
+    runPortScanCommandMock.mockImplementation(async (command: string, args: string[]) => {
+      if (command === 'lsof' && args.includes('-iTCP')) {
+        return { stdout: LSOF_LISTEN_OUTPUT, spawnMs: 5 }
+      }
+      if (command === 'lsof') {
+        return { stdout: ['p123', 'n/repo'].join('\n'), spawnMs: 5 }
+      }
+      return { stdout: '123 node /repo/server.js', spawnMs: 5 }
+    })
+
+    await scanWorkspacePorts(worktrees, urlWatcherStub())
+    expect(runPortScanCommandMock).toHaveBeenCalledTimes(3)
+    await scanWorkspacePorts(worktrees, urlWatcherStub())
+    // Warm cache: the background poll is served without the metadata commands.
+    expect(runPortScanCommandMock).toHaveBeenCalledTimes(4)
+
+    // Why: this is the SIGTERM authorization re-scan; a remembered cwd must never authorize a kill.
+    await scanWorkspacePorts(worktrees, urlWatcherStub(), { requireMetadata: true })
+
+    expect(runPortScanCommandMock).toHaveBeenCalledTimes(7)
+  })
+
+  it('re-probes when a recycled pid is running a different process', async () => {
+    vi.spyOn(process, 'platform', 'get').mockReturnValue('darwin')
+    let processName = 'node'
+    runPortScanCommandMock.mockImplementation(async (command: string, args: string[]) => {
+      if (command === 'lsof' && args.includes('-iTCP')) {
+        return { stdout: `p123\nc${processName}\nn127.0.0.1:5173`, spawnMs: 5 }
+      }
+      if (command === 'lsof') {
+        return { stdout: ['p123', 'n/repo'].join('\n'), spawnMs: 5 }
+      }
+      return { stdout: `123 ${processName} /repo/server.js`, spawnMs: 5 }
+    })
+
+    await scanWorkspacePorts(worktrees, urlWatcherStub())
+    expect(runPortScanCommandMock).toHaveBeenCalledTimes(3)
+
+    // Same pid and address, different process: the remembered metadata must not be reused.
+    processName = 'python3'
+    await scanWorkspacePorts(worktrees, urlWatcherStub())
+
+    expect(runPortScanCommandMock).toHaveBeenCalledTimes(6)
+  })
+
+  it('re-probes when the same pid and name listen through a different socket', async () => {
+    vi.spyOn(process, 'platform', 'get').mockReturnValue('darwin')
+    let socketId = '0x1'
+    runPortScanCommandMock.mockImplementation(async (command: string, args: string[]) => {
+      if (command === 'lsof' && args.includes('-iTCP')) {
+        return { stdout: `p123\ncnode\nf18\nd${socketId}\nn127.0.0.1:5173`, spawnMs: 5 }
+      }
+      if (command === 'lsof') {
+        return { stdout: ['p123', 'n/repo'].join('\n'), spawnMs: 5 }
+      }
+      return { stdout: '123 node /repo/server.js', spawnMs: 5 }
+    })
+
+    await scanWorkspacePorts(worktrees, urlWatcherStub())
+    await scanWorkspacePorts(worktrees, urlWatcherStub())
+    expect(runPortScanCommandMock).toHaveBeenCalledTimes(4)
+
+    // Same pid, name and address but a new kernel socket: a restarted process, not the cached one.
+    socketId = '0x2'
+    await scanWorkspacePorts(worktrees, urlWatcherStub())
+
+    expect(runPortScanCommandMock).toHaveBeenCalledTimes(7)
+  })
+
+  it('re-probes a remembered listener every tenth scan so a changed cwd cannot stay stale', async () => {
+    vi.spyOn(process, 'platform', 'get').mockReturnValue('darwin')
+    let cwd = '/repo'
+    runPortScanCommandMock.mockImplementation(async (command: string, args: string[]) => {
+      if (command === 'lsof' && args.includes('-iTCP')) {
+        return { stdout: LSOF_LISTEN_OUTPUT, spawnMs: 5 }
+      }
+      if (command === 'lsof') {
+        return { stdout: ['p123', `n${cwd}`].join('\n'), spawnMs: 5 }
+      }
+      return { stdout: '123 node server.js', spawnMs: 5 }
+    })
+
+    await scanWorkspacePorts(worktrees, urlWatcherStub())
+    cwd = '/repo/worktrees/feature'
+    for (let scan = 2; scan <= 10; scan += 1) {
+      const cached = await scanWorkspacePorts(worktrees, urlWatcherStub())
+      expect(cached.ports[0]).toMatchObject({ owner: { worktreeId: 'repo::/repo' } })
+    }
+    // 3 for the first scan, then one listening command per cached scan.
+    expect(runPortScanCommandMock).toHaveBeenCalledTimes(12)
+
+    const reprobed = await scanWorkspacePorts(worktrees, urlWatcherStub())
+
+    expect(runPortScanCommandMock).toHaveBeenCalledTimes(15)
+    expect(reprobed.ports[0]).toMatchObject({
+      owner: { worktreeId: 'repo::/repo/worktrees/feature' }
+    })
+  })
+
   // Regression for #11161 review: without carry-forward the panel moves every
   // workspace port into External on each skipped cycle.
   it('carries the previous cycle attribution through a skipped scan', async () => {
diff --git a/src/main/providers/local-pty-finalize-environment.ts b/src/main/providers/local-pty-finalize-environment.ts
index 0f7d3454a09..1b385639e94 100644
--- a/src/main/providers/local-pty-finalize-environment.ts
+++ b/src/main/providers/local-pty-finalize-environment.ts
@@ -109,6 +109,9 @@ export function finalizeLocalPtySpawnEnvironment(args: {
         codexStartupCommand !== undefined && supportsPosixShellStartupCommand(shell)
           ? codexStartupCommand
           : undefined
+      // Why no line-editor widening here (unlike the daemon and relay): a Codex
+      // startup command this provider wraps is run by the wrapper's own prompt
+      // hook, never written into the PTY, so there is no early write to double-echo.
       const waitsForShellReady =
         Boolean(spawn.command) && (!isCodexStartupCommand || codexRequiresShellReady)
       return getShellLaunchConfig(
diff --git a/src/main/providers/local-pty-foreground-inspection-cheap-tier.test.ts b/src/main/providers/local-pty-foreground-inspection-cheap-tier.test.ts
new file mode 100644
index 00000000000..37d4cf3c4d0
--- /dev/null
+++ b/src/main/providers/local-pty-foreground-inspection-cheap-tier.test.ts
@@ -0,0 +1,138 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type * as ProcessTableSnapshotReader from '../../shared/process-table-snapshot-reader'
+
+const { cheapSnapshotMock, fullSnapshotMock, resolveMock } = vi.hoisted(() => ({
+  cheapSnapshotMock: vi.fn(),
+  fullSnapshotMock: vi.fn(),
+  resolveMock: vi.fn()
+}))
+
+vi.mock('../../shared/cheap-process-table-snapshot-reader', () => ({
+  getCheapProcessTableSnapshot: cheapSnapshotMock
+}))
+vi.mock('../../shared/process-table-snapshot-reader', async (importOriginal) => ({
+  ...(await importOriginal<typeof ProcessTableSnapshotReader>()),
+  getProcessTableSnapshot: fullSnapshotMock
+}))
+vi.mock('./agent-foreground-process', () => ({
+  resolveAgentForegroundProcessWithAvailability: resolveMock,
+  confirmShellForegroundProcess: vi.fn()
+}))
+
+import { getLocalPtyForegroundProcess } from './local-pty-foreground-inspection'
+import { ptyLastRecognizedForeground, ptyProcesses, ptyShellName } from './local-pty-provider-state'
+
+const SHELL_PID = 4242
+const AGENT_PID = 4300
+const ID = 'pty-1'
+
+type Table = 'agent' | 'shell-only'
+let table: Table = 'agent'
+
+function rows(): Record<string, unknown>[] {
+  const tpgid = table === 'agent' ? AGENT_PID : SHELL_PID
+  const out: Record<string, unknown>[] = [
+    {
+      pid: SHELL_PID,
+      ppid: 1,
+      pgid: SHELL_PID,
+      tpgid,
+      stat: table === 'agent' ? 'Ss' : 'Ss+',
+      tty: 'ttys004',
+      startTime: 'Thu Sep  3 16:02:01 2026',
+      command: '-zsh'
+    }
+  ]
+  if (table === 'agent') {
+    out.push({
+      pid: AGENT_PID,
+      ppid: SHELL_PID,
+      pgid: AGENT_PID,
+      tpgid,
+      stat: 'S+',
+      tty: 'ttys004',
+      startTime: 'Thu Sep  3 16:02:05 2026',
+      command: 'node /usr/local/bin/claude'
+    })
+  }
+  return out
+}
+
+describe('local POSIX provider cheap-tier revalidation', () => {
+  let platform: PropertyDescriptor | undefined
+  const proc = { pid: SHELL_PID, process: 'node' }
+
+  beforeEach(() => {
+    platform = Object.getOwnPropertyDescriptor(process, 'platform')
+    Object.defineProperty(process, 'platform', { configurable: true, value: 'darwin' })
+    table = 'agent'
+    proc.process = 'node'
+    cheapSnapshotMock.mockReset()
+    cheapSnapshotMock.mockImplementation(async () => rows())
+    fullSnapshotMock.mockReset()
+    fullSnapshotMock.mockImplementation(async () => rows())
+    resolveMock.mockReset()
+    resolveMock.mockImplementation(async () => ({
+      available: true,
+      processName: table === 'agent' ? 'claude' : 'zsh'
+    }))
+    ptyProcesses.set(ID, proc as never)
+    ptyShellName.set(ID, 'zsh')
+    ptyLastRecognizedForeground.delete(ID)
+  })
+
+  afterEach(() => {
+    ptyProcesses.delete(ID)
+    ptyShellName.delete(ID)
+    ptyLastRecognizedForeground.delete(ID)
+    if (platform) {
+      Object.defineProperty(process, 'platform', platform)
+    }
+  })
+
+  it('a pane with NO recognized anchor never consults the cheap tier', async () => {
+    table = 'shell-only'
+    proc.process = 'zsh'
+    for (let i = 0; i < 3; i += 1) {
+      expect(await getLocalPtyForegroundProcess(ID)).toBe('zsh')
+    }
+    expect(cheapSnapshotMock).not.toHaveBeenCalled()
+    expect(resolveMock).toHaveBeenCalledTimes(3)
+    expect(ptyLastRecognizedForeground.get(ID)).toBeUndefined()
+  })
+
+  it('once recognized, an unchanged pane re-proves the agent from the cheap tier without a full scan', async () => {
+    expect(await getLocalPtyForegroundProcess(ID)).toBe('claude')
+    expect(resolveMock).toHaveBeenCalledTimes(1)
+    expect(ptyLastRecognizedForeground.get(ID)?.steady?.fingerprint).toEqual(expect.any(String))
+    for (let i = 0; i < 3; i += 1) {
+      expect(await getLocalPtyForegroundProcess(ID)).toBe('claude')
+    }
+    expect(cheapSnapshotMock).toHaveBeenCalledTimes(3)
+    expect(resolveMock).toHaveBeenCalledTimes(1)
+  })
+
+  it('an agent exit changes the fingerprint, escalates to the full scan, and clears the anchor', async () => {
+    expect(await getLocalPtyForegroundProcess(ID)).toBe('claude')
+    table = 'shell-only'
+    expect(await getLocalPtyForegroundProcess(ID)).toBe('zsh')
+    expect(resolveMock).toHaveBeenCalledTimes(2)
+    expect(ptyLastRecognizedForeground.get(ID)).toBeUndefined()
+  })
+
+  it('a changed node-pty foreground name escalates without consulting the cheap tier', async () => {
+    expect(await getLocalPtyForegroundProcess(ID)).toBe('claude')
+    proc.process = 'zsh'
+    table = 'shell-only'
+    expect(await getLocalPtyForegroundProcess(ID)).toBe('zsh')
+    expect(cheapSnapshotMock).not.toHaveBeenCalled()
+    expect(resolveMock).toHaveBeenCalledTimes(2)
+  })
+
+  it('a cheap capture failure falls through to the full scan', async () => {
+    expect(await getLocalPtyForegroundProcess(ID)).toBe('claude')
+    cheapSnapshotMock.mockRejectedValueOnce(new Error('ps died'))
+    expect(await getLocalPtyForegroundProcess(ID)).toBe('claude')
+    expect(resolveMock).toHaveBeenCalledTimes(2)
+  })
+})
diff --git a/src/main/providers/local-pty-foreground-inspection.ts b/src/main/providers/local-pty-foreground-inspection.ts
index c42c06d9121..d4a717a9de2 100644
--- a/src/main/providers/local-pty-foreground-inspection.ts
+++ b/src/main/providers/local-pty-foreground-inspection.ts
@@ -1,8 +1,11 @@
 import { recognizeAgentProcessFromCommandLine } from '../../shared/agent-process-recognition'
+import { getCheapProcessTableSnapshot } from '../../shared/cheap-process-table-snapshot-reader'
+import { getProcessTableSnapshot } from '../../shared/process-table-snapshot-reader'
 import {
   confirmShellForegroundProcess,
   resolveAgentForegroundProcessWithAvailability
 } from './agent-foreground-process'
+import { buildPaneProcessFingerprint } from './posix-pane-foreground-fingerprint'
 import { resolveForegroundFallbackProcess } from './local-pty-launch-helpers'
 import {
   ptyAgentForegroundContextPaths,
@@ -35,6 +38,34 @@ export async function hasLocalPtyChildProcesses(id: string): Promise<boolean> {
   }
 }
 
+/**
+ * POSIX twin of the Windows job-membership short-circuit below: a pane that already holds a
+ * recognized agent re-proves it from the cheap `ps` tier when the subtree fingerprint is
+ * unchanged. Panes with no anchor never get here, so start discovery is untouched.
+ */
+async function revalidateCachedPosixAgent(
+  proc: { pid: number },
+  cachedEntry: {
+    name: string
+    steady?: { fingerprint: string; fallbackProcess: string | null } | null
+  },
+  fallbackProcess: string | null
+): Promise<boolean> {
+  const steady = cachedEntry.steady
+  if (!steady || steady.fallbackProcess !== fallbackProcess) {
+    return false
+  }
+  try {
+    const observed = await buildPaneProcessFingerprint(
+      await getCheapProcessTableSnapshot(),
+      proc.pid
+    )
+    return observed !== null && observed === steady.fingerprint
+  } catch {
+    return false
+  }
+}
+
 export async function getLocalPtyForegroundProcess(id: string): Promise<string | null> {
   const proc = ptyProcesses.get(id)
   if (!proc) {
@@ -89,6 +120,18 @@ export async function getLocalPtyForegroundProcess(id: string): Promise<string |
       paneMembershipUnavailable = true
     }
   }
+  if (
+    process.platform !== 'win32' &&
+    cachedEntry &&
+    cachedAgent !== null &&
+    (await revalidateCachedPosixAgent(proc, cachedEntry, fallbackProcess))
+  ) {
+    if (ptyProcesses.get(id) !== proc) {
+      return null
+    }
+    ptyLastRecognizedForeground.set(id, { ...cachedEntry, at: Date.now() })
+    return cachedAgent
+  }
   try {
     const resolution = await resolveAgentForegroundProcessWithAvailability(
       proc.pid,
@@ -129,7 +172,8 @@ export async function getLocalPtyForegroundProcess(id: string): Promise<string |
           stable.lastRecognizedAgent === resolution.processName
             ? (resolution.processId ?? null)
             : null,
-        at: Date.now()
+        at: Date.now(),
+        steady: await readPosixSteadyState(proc.pid, fallbackProcess)
       })
     } else if (stable.lastRecognizedAgent && cachedAgentAliveInJob && !anchorContradicted) {
       // The anchor pid in the job is proof of life; restamp so the
@@ -151,6 +195,23 @@ export async function getLocalPtyForegroundProcess(id: string): Promise<string |
   }
 }
 
+/** The fingerprint of the TTL-shared capture the recognition just read; null on Windows or
+ *  when the pane is unfenced, which simply means the next read pays for the full scan. */
+async function readPosixSteadyState(
+  shellPid: number,
+  fallbackProcess: string | null
+): Promise<{ fingerprint: string; fallbackProcess: string | null } | null> {
+  if (process.platform === 'win32') {
+    return null
+  }
+  try {
+    const fingerprint = await buildPaneProcessFingerprint(await getProcessTableSnapshot(), shellPid)
+    return fingerprint === null ? null : { fingerprint, fallbackProcess }
+  } catch {
+    return null
+  }
+}
+
 export async function confirmLocalPtyForegroundProcess(id: string): Promise<string | null> {
   const proc = ptyProcesses.get(id)
   if (!proc) {
diff --git a/src/main/providers/local-pty-provider-spawn-session.test.ts b/src/main/providers/local-pty-provider-spawn-session.test.ts
index bb224009117..9dfa08d81bf 100644
--- a/src/main/providers/local-pty-provider-spawn-session.test.ts
+++ b/src/main/providers/local-pty-provider-spawn-session.test.ts
@@ -172,8 +172,12 @@ describe('LocalPtyProvider', () => {
 
       expect(second).toEqual({
         id: 'serve-session-1',
+        incarnationId: first.incarnationId,
         pid: 12345,
-        isReattach: true
+        isReattach: true,
+        // Why published: this attach really moved the PTY, unlike daemon/relay attach, so main
+        // must record 120x40 rather than preserving the size it held for the session.
+        attachedGrid: { cols: 120, rows: 40 }
       })
       expect(mockProc.resize).toHaveBeenCalledWith(120, 40)
       expect(spawnMock).not.toHaveBeenCalled()
@@ -217,7 +221,11 @@ describe('LocalPtyProvider', () => {
         attachOnly: true
       })
 
-      expect(result).toMatchObject({ id: first.id, isReattach: true })
+      expect(result).toMatchObject({
+        id: first.id,
+        incarnationId: first.incarnationId,
+        isReattach: true
+      })
       expect(spawnMock).not.toHaveBeenCalled()
     })
 
diff --git a/src/main/providers/local-pty-provider-state.ts b/src/main/providers/local-pty-provider-state.ts
index 5e87502b1f6..9e54ac859b0 100644
--- a/src/main/providers/local-pty-provider-state.ts
+++ b/src/main/providers/local-pty-provider-state.ts
@@ -43,9 +43,16 @@ export const ptyAgentForegroundContextPaths = new Map<string, string[]>()
 // Why: remember the last recognized agent foreground so a degraded scan doesn't report the shell and look like an exit.
 // `pid` anchors the identity to the row that proved it (null when ambiguous);
 // `at` is the last confirmation, so unanchored job evidence -- only a superset -- cannot hold it forever.
+// `steady` (POSIX) is the pane fingerprint the recognizing capture proved plus node-pty's name at
+// that moment; a cheap capture matching it re-proves the identity without the full table.
 export const ptyLastRecognizedForeground = new Map<
   string,
-  { name: string; pid: number | null; at: number }
+  {
+    name: string
+    pid: number | null
+    at: number
+    steady?: { fingerprint: string; fallbackProcess: string | null } | null
+  }
 >()
 export const ptyTerminalHandle = new Map<string, string>()
 export const ptyWorktreeId = new Map<string, string>()
diff --git a/src/main/providers/local-pty-spawn-state.ts b/src/main/providers/local-pty-spawn-state.ts
index 283f8b40c62..2ab145f6c39 100644
--- a/src/main/providers/local-pty-spawn-state.ts
+++ b/src/main/providers/local-pty-spawn-state.ts
@@ -1,6 +1,7 @@
 import type { PtySpawnResult } from './types'
 import {
   pendingLocalPtySpawns,
+  ptyIncarnations,
   ptyProcesses,
   ptyWslDistroById,
   type PendingLocalPtySpawn
@@ -51,15 +52,20 @@ export function reattachLocalPty(id: string, cols: number, rows: number): PtySpa
   if (!existing) {
     return null
   }
+  let resized = false
   try {
     existing.resize(cols, rows)
+    resized = true
   } catch {
     /* Existing PTY may reject resize during teardown; still return the live handle. */
   }
   return {
     id,
+    ...(ptyIncarnations.has(id) ? { incarnationId: ptyIncarnations.get(id) } : {}),
     pid: existing.pid,
     ...(ptyWslDistroById.has(id) ? { wslDistro: ptyWslDistroById.get(id) ?? null } : {}),
-    isReattach: true
+    isReattach: true,
+    // Why: unlike daemon/relay attach, this one really moved the live PTY to the caller's grid.
+    ...(resized ? { attachedGrid: { cols, rows } } : {})
   }
 }
diff --git a/src/main/providers/posix-pane-foreground-fingerprint.test.ts b/src/main/providers/posix-pane-foreground-fingerprint.test.ts
new file mode 100644
index 00000000000..76cb68f79dc
--- /dev/null
+++ b/src/main/providers/posix-pane-foreground-fingerprint.test.ts
@@ -0,0 +1,187 @@
+import { describe, expect, it } from 'vitest'
+import {
+  buildPaneProcessFingerprint,
+  type PaneFingerprintRow
+} from './posix-pane-foreground-fingerprint'
+
+const SHELL = 4242
+const AGENT = 4300
+const OTHER_PANE = 9000
+
+type Row = PaneFingerprintRow
+
+const shell = (over: Partial<Row> = {}): Row => ({
+  pid: SHELL,
+  ppid: 1,
+  pgid: SHELL,
+  tpgid: AGENT,
+  stat: 'Ss',
+  startTime: 'Thu Sep 3 16:02:01 2026',
+  ...over
+})
+const agent = (over: Partial<Row> = {}): Row => ({
+  pid: AGENT,
+  ppid: SHELL,
+  pgid: AGENT,
+  tpgid: AGENT,
+  stat: 'S+',
+  startTime: 'Thu Sep 3 16:02:05 2026',
+  ...over
+})
+const child = (pid: number, ppid: number, over: Partial<Row> = {}): Row => ({
+  pid,
+  ppid,
+  pgid: AGENT,
+  tpgid: AGENT,
+  stat: 'S+',
+  startTime: `Thu Sep 3 16:03:${String(pid % 60).padStart(2, '0')} 2026`,
+  ...over
+})
+const foreign = (): Row => ({
+  pid: OTHER_PANE,
+  ppid: 1,
+  pgid: OTHER_PANE,
+  tpgid: OTHER_PANE,
+  stat: 'Ss+',
+  startTime: 'Thu Sep 3 12:00:00 2026'
+})
+
+const fp = (rows: Row[]): Promise<string | null> =>
+  buildPaneProcessFingerprint(rows, SHELL, { platform: 'darwin' })
+
+describe('buildPaneProcessFingerprint', () => {
+  const baseline = [foreign(), shell(), agent()]
+
+  it('is stable across captures that differ only in scheduler state, row order, and foreign panes', async () => {
+    const a = await fp(baseline)
+    expect(a).not.toBeNull()
+    // R vs S: a working agent flips this every tick and it says nothing about the pane.
+    expect(await fp([agent({ stat: 'R+' }), shell({ stat: 'Ss' }), foreign()])).toBe(a)
+    // The shell going idle-vs-runnable, or a foreign pane starting/exiting, is not our business.
+    expect(await fp([shell({ stat: 'Rs' }), agent()])).toBe(a)
+    // lstart padding differs between column sets; both must stamp identically.
+    expect(await fp([shell({ startTime: 'Thu Sep  3 16:02:01 2026' }), agent()])).toBe(a)
+  })
+
+  describe('escalates (fingerprint changes) on every completion-relevant transition', () => {
+    it('agent exit: the recognized pid vanishes from the subtree', async () => {
+      const before = await fp(baseline)
+      expect(await fp([foreign(), shell({ tpgid: SHELL, stat: 'Ss+' })])).not.toBe(before)
+    })
+
+    it('exit-and-replace: the same pid is reused by a new process with a new start time', async () => {
+      const before = await fp(baseline)
+      expect(await fp([shell(), agent({ startTime: 'Thu Sep 3 16:09:00 2026' })])).not.toBe(before)
+    })
+
+    it('Ctrl-Z: the agent stops and the shell takes the terminal back', async () => {
+      const before = await fp(baseline)
+      expect(await fp([shell({ tpgid: SHELL, stat: 'Ss+' }), agent({ stat: 'T' })])).not.toBe(
+        before
+      )
+    })
+
+    it('bg: the stopped job resumes in the background, foreground stays with the shell', async () => {
+      const stopped = await fp([shell({ tpgid: SHELL, stat: 'Ss+' }), agent({ stat: 'T' })])
+      const backgrounded = await fp([shell({ tpgid: SHELL, stat: 'Ss+' }), agent({ stat: 'S' })])
+      expect(backgrounded).not.toBe(stopped)
+      expect(backgrounded).not.toBe(await fp(baseline))
+    })
+
+    it('child churn: a subprocess appearing or disappearing under the agent', async () => {
+      const before = await fp(baseline)
+      const withChild = await fp([shell(), agent(), child(4310, AGENT)])
+      expect(withChild).not.toBe(before)
+      expect(await fp([shell(), agent(), child(4310, AGENT), child(4311, 4310)])).not.toBe(
+        withChild
+      )
+      // A child exec'ing away from the group (setsid / disown) is also a change.
+      expect(await fp([shell(), agent(), child(4310, AGENT, { pgid: 4310 })])).not.toBe(withChild)
+    })
+
+    it('shell replaced: same pid, different start time', async () => {
+      const before = await fp(baseline)
+      expect(await fp([shell({ startTime: 'Thu Sep 3 17:00:00 2026' }), agent()])).not.toBe(before)
+    })
+  })
+
+  describe('refuses to fingerprint an unfenced pane (caller must take the full capture)', () => {
+    it('root shell missing from the capture', async () => {
+      expect(await fp([foreign(), agent()])).toBeNull()
+    })
+
+    it('root shell has no start marker', async () => {
+      expect(await fp([shell({ startTime: undefined }), agent()])).toBeNull()
+    })
+
+    it('root shell has no job-control columns', async () => {
+      expect(await fp([shell({ pgid: undefined, tpgid: undefined }), agent()])).toBeNull()
+    })
+  })
+
+  describe('Linux', () => {
+    it('reads /proc start times for the pane subtree only and ignores ps start markers', async () => {
+      const asked: number[] = []
+      const read = async (pid: number): Promise<string | null> => {
+        asked.push(pid)
+        return pid === SHELL ? '1000' : pid === AGENT ? '2000' : null
+      }
+      const rows = [foreign(), shell({ startTime: undefined }), agent({ startTime: undefined })]
+      const a = await buildPaneProcessFingerprint(rows, SHELL, {
+        platform: 'linux',
+        readLinuxStartTime: read
+      })
+      expect(a).toContain(`${SHELL}@1000`)
+      expect(a).toContain(`${AGENT}@2000`)
+      expect(asked.sort()).toEqual([SHELL, AGENT].sort())
+      // An exit-and-replace changes only the /proc start ticks.
+      const replaced = await buildPaneProcessFingerprint(rows, SHELL, {
+        platform: 'linux',
+        readLinuxStartTime: async (pid) => (pid === AGENT ? '2500' : read(pid))
+      })
+      expect(replaced).not.toBe(a)
+    })
+
+    it('refuses when the root /proc entry cannot be read', async () => {
+      expect(
+        await buildPaneProcessFingerprint([shell(), agent()], SHELL, {
+          platform: 'linux',
+          readLinuxStartTime: async () => null
+        })
+      ).toBeNull()
+    })
+    it('refuses when a DESCENDANT start marker cannot be read', async () => {
+      // Why: the start marker is what makes a pid comparison recycle-safe. Stamping a missing
+      // one as a placeholder let two captures that both failed to read it compare equal across
+      // a recycled pid, so a vanished agent looked unchanged and the cheap tier kept serving
+      // its name. Refusing sends the caller to the full capture.
+      const rows = [shell(), agent()]
+
+      expect(
+        await buildPaneProcessFingerprint(rows, SHELL, {
+          platform: 'linux',
+          readLinuxStartTime: async (pid) => (pid === SHELL ? '2400' : null)
+        })
+      ).toBeNull()
+    })
+
+    it('does not let a recycled descendant pid reuse a fingerprint', async () => {
+      // Both captures fail to read the descendant marker; the pid is reused by a different
+      // process in between. Equal fingerprints here would mask the agent's exit.
+      const readNoDescendant = async (pid: number): Promise<string | null> =>
+        pid === SHELL ? '2400' : null
+      const before = await buildPaneProcessFingerprint([shell(), agent()], SHELL, {
+        platform: 'linux',
+        readLinuxStartTime: readNoDescendant
+      })
+      const after = await buildPaneProcessFingerprint(
+        [shell(), agent({ stat: 'S+', pgid: AGENT })],
+        SHELL,
+        { platform: 'linux', readLinuxStartTime: readNoDescendant }
+      )
+
+      expect(before).toBeNull()
+      expect(after).toBeNull()
+    })
+  })
+})
diff --git a/src/main/providers/posix-pane-foreground-fingerprint.ts b/src/main/providers/posix-pane-foreground-fingerprint.ts
new file mode 100644
index 00000000000..ac1539300e2
--- /dev/null
+++ b/src/main/providers/posix-pane-foreground-fingerprint.ts
@@ -0,0 +1,93 @@
+import { readFile } from 'node:fs/promises'
+import { collectDescendantsFromIndex, getProcessTableIndex } from '../../shared/process-table-index'
+import { parseLinuxProcStatStartTime } from '../../shared/process-table-snapshot-reader'
+
+/** The job-control columns both `ps` tiers carry; `command`/`tty` are deliberately absent. */
+export type PaneFingerprintRow = {
+  pid: number
+  ppid: number
+  pgid?: number
+  tpgid?: number
+  stat: string
+  startTime?: string
+}
+
+export type PaneFingerprintDeps = {
+  platform?: NodeJS.Platform
+  /** Linux: `/proc/<pid>/stat` field 22, read for the pane subtree only. */
+  readLinuxStartTime?: (pid: number) => Promise<string | null>
+}
+
+/**
+ * Only the job-control bits of `stat`. The scheduler letter (R/S/D/I/U) flips every tick
+ * on a working agent and says nothing about whether the pane changed hands; stopped,
+ * zombie, and foreground-group membership do.
+ */
+function jobControlState(stat: string): string {
+  const head = stat[0] ?? ''
+  const lifecycle = head === 'T' || head === 't' ? 'T' : head === 'Z' ? 'Z' : ''
+  return lifecycle + (stat.includes('+') ? '+' : '')
+}
+
+async function readLinuxProcStartTime(pid: number): Promise<string | null> {
+  try {
+    return parseLinuxProcStatStartTime(await readFile(`/proc/${pid}/stat`, 'utf8'))
+  } catch {
+    return null
+  }
+}
+
+/**
+ * A per-pane summary of everything the cheap `ps` tier can see: the root shell's identity
+ * (pid + start marker) and terminal foreground group, and every descendant's identity, group,
+ * and job-control state. Two captures with equal fingerprints describe the same pane
+ * subtree, so the name resolved from the last full capture still holds.
+ *
+ * Null when the root is missing or unfenced (no start marker, no group columns): callers
+ * must then take the full capture rather than trust a comparison that could not be made.
+ */
+export async function buildPaneProcessFingerprint(
+  rows: readonly PaneFingerprintRow[],
+  rootPid: number,
+  deps: PaneFingerprintDeps = {}
+): Promise<string | null> {
+  const platform = deps.platform ?? process.platform
+  const index = getProcessTableIndex(rows)
+  const root = index.byPid.get(rootPid)
+  if (!root || root.pgid === undefined || root.tpgid === undefined) {
+    return null
+  }
+  const descendants = collectDescendantsFromIndex(index, rootPid)
+  const subtree = [root, ...descendants]
+  let startTimes: ReadonlyMap<number, string | null>
+  if (platform === 'linux') {
+    const read = deps.readLinuxStartTime ?? readLinuxProcStartTime
+    const entries = await Promise.all(
+      subtree.map(async (row) => [row.pid, await read(row.pid)] as const)
+    )
+    startTimes = new Map(entries)
+  } else {
+    // Collapse `lstart` padding (`Sep  3`) so both column sets stamp identically.
+    startTimes = new Map(
+      subtree.map((row) => [row.pid, row.startTime?.replace(/\s+/g, ' ') ?? null] as const)
+    )
+  }
+  const rootStart = startTimes.get(rootPid)
+  if (!rootStart) {
+    return null
+  }
+  // Why every member, not just the root: a start marker is what makes a pid comparison
+  // recycle-safe. Stamping a missing one as a placeholder would let two captures that both
+  // failed to read it compare equal across a recycled pid, so a vanished agent could look
+  // unchanged. Refusing the fingerprint sends the caller to the full capture instead.
+  const members: string[] = []
+  for (const row of descendants) {
+    const startTime = startTimes.get(row.pid)
+    if (!startTime) {
+      return null
+    }
+    members.push(`${row.pid}@${startTime}:${row.pgid ?? '?'}:${jobControlState(row.stat)}`)
+  }
+  members.sort()
+  return `${rootPid}@${rootStart}#${root.tpgid}:${jobControlState(root.stat)}|${members.join(',')}`
+}
diff --git a/src/main/providers/pty-process-inspection.ts b/src/main/providers/pty-process-inspection.ts
index 6869899de8b..2c316ae05f9 100644
--- a/src/main/providers/pty-process-inspection.ts
+++ b/src/main/providers/pty-process-inspection.ts
@@ -11,14 +11,27 @@ export type PtyProcessInspection = TerminalProcessInspection
 type CompletionSensitivePtyProvider = IPtyProvider & {
   inspectProcess?: (
     id: string,
-    options?: { expectedIncarnationId?: PtyIncarnationId }
+    options?: PtyProcessInspectionOptions
   ) => Promise<PtyProcessInspection>
 }
 
+/**
+ * `scanChildProcesses` marks a read whose answer decides something once, rather than a poll that
+ * self-corrects on its next tick. Only hosts where the child answer costs a process-table read
+ * act on it; everywhere else the answer was already captured.
+ */
+export type PtyProcessInspectionOptions = {
+  expectedIncarnationId?: PtyIncarnationId
+  scanChildProcesses?: boolean
+  /** A self-correcting cadence poll that reads only the process name: licenses a host to answer
+   *  from a cheap capture and OMIT evidence. Never set by a caller that consumes evidence. */
+  steadyState?: boolean
+}
+
 export async function inspectPtyProviderProcess(
   provider: IPtyProvider,
   ptyId: string,
-  options?: { expectedIncarnationId?: PtyIncarnationId }
+  options?: PtyProcessInspectionOptions
 ): Promise<PtyProcessInspection> {
   if (provider.hasPty?.(ptyId) === false) {
     throw new Error('terminal_gone')
@@ -37,7 +50,7 @@ export async function inspectPtyProviderProcess(
 export async function inspectPtyProviderProcessForRenderer(
   provider: IPtyProvider,
   ptyId: string,
-  options?: { expectedIncarnationId?: PtyIncarnationId }
+  options?: PtyProcessInspectionOptions
 ): Promise<PtyProcessInspection> {
   try {
     return await inspectPtyProviderProcess(provider, ptyId, options)
diff --git a/src/main/providers/pty-spawn-result.ts b/src/main/providers/pty-spawn-result.ts
index 43e9665de45..90b41d9656a 100644
--- a/src/main/providers/pty-spawn-result.ts
+++ b/src/main/providers/pty-spawn-result.ts
@@ -16,6 +16,11 @@ export type PtySpawnResult = {
   sourceActivation?: PtySourceReceivingActivation
   /** The provider observed this exact spawn exit before returning its spawn result. */
   exitedBeforeSpawnReply?: true
+  /** Whether the execution host armed the shell-ready marker for a renderer-delivered startup
+   *  command. `false` means the host looked and did not (fish, sh, Windows) so the client must
+   *  not wait; absent means the host predates the field and the client keeps its own guess.
+   *  Never collapse absent into `false`. */
+  shellReadyArmed?: boolean
   /** OS-level pid of the shell process, when available at spawn time.
    *  Why: the memory collector needs this to walk each PTY's process
    *  subtree. Daemon-backed providers return it from the RPC result;
@@ -57,6 +62,10 @@ export type PtySpawnResult = {
   snapshotTerminalOwner?: TerminalOwner
   /** True when the spawn reattached to an existing daemon session. */
   isReattach?: boolean
+  /** Grid the PTY is proven to be at once this spawn settled. Only providers whose attach
+   *  applies the requested size set it; daemon/relay attach leave the live grid alone, so main
+   *  must not read the requested dims back as a measurement (see `resolveCommittedPtySize`). */
+  attachedGrid?: { cols: number; rows: number }
   /** Last OSC title tracked by the daemon session the snapshot came from.
    *  Seeds main's terminal title records after a relaunch; never replayed
    *  into a terminal. */
diff --git a/src/main/providers/ssh-pty-provider-rpc-operations.ts b/src/main/providers/ssh-pty-provider-rpc-operations.ts
index 71ddbefce97..2e273239cd4 100644
--- a/src/main/providers/ssh-pty-provider-rpc-operations.ts
+++ b/src/main/providers/ssh-pty-provider-rpc-operations.ts
@@ -56,13 +56,15 @@ export function createSshPtyProviderRpcOperations({ mux, toRelayPtyId }: SshPtyP
     // Guarded by ssh-pty-inspect-observation-identity.test.ts; #17525 removes the poll.
     inspectProcess: async (
       id: string,
-      options?: { expectedIncarnationId?: string }
+      options?: { expectedIncarnationId?: string; scanChildProcesses?: boolean }
     ): Promise<PtyProcessInspection> => {
       return (await mux.request('pty.inspectProcess', {
         id: toRelayPtyId(id),
         ...(options?.expectedIncarnationId
           ? { expectedIncarnationId: options.expectedIncarnationId }
-          : {})
+          : {}),
+        // Additive request member: an older relay ignores it and answers as it always did.
+        ...(options?.scanChildProcesses === true ? { scanChildProcesses: true } : {})
       })) as PtyProcessInspection
     },
     serialize: async (ids: string[]): Promise<string> => {
diff --git a/src/main/providers/ssh-pty-provider.ts b/src/main/providers/ssh-pty-provider.ts
index 70c01b5a1c7..3d0c46d7a03 100644
--- a/src/main/providers/ssh-pty-provider.ts
+++ b/src/main/providers/ssh-pty-provider.ts
@@ -63,7 +63,7 @@ export class SshPtyProvider implements IPtyProvider {
     this.rpcOperations.getForegroundProcess(id)
   inspectProcess = (
     id: string,
-    options?: { expectedIncarnationId?: string }
+    options?: { expectedIncarnationId?: string; scanChildProcesses?: boolean }
   ): Promise<PtyProcessInspection> => this.rpcOperations.inspectProcess(id, options)
   serialize = (ids: string[]): Promise<string> => this.rpcOperations.serialize(ids)
   revive = (state: string): Promise<void> => this.rpcOperations.revive(state)
diff --git a/src/main/providers/windows-foreground-process-rows.test.ts b/src/main/providers/windows-foreground-process-rows.test.ts
index 924c81789ce..42330dd6fe8 100644
--- a/src/main/providers/windows-foreground-process-rows.test.ts
+++ b/src/main/providers/windows-foreground-process-rows.test.ts
@@ -12,9 +12,13 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
 const getAllProcessesMock = vi.fn()
 
-import { __setWindowsProcessTreeLoaderForTests } from '../windows/windows-process-table'
+import {
+  __setWindowsProcessTreeLoaderForTests,
+  readWindowsProcessIdentityTable
+} from '../windows/windows-process-table'
 import {
   queryWindowsProcessDescendants,
+  queryWindowsProcessLinksFresh,
   queryWindowsProcessRowsFresh,
   resetWindowsProcessRowsSnapshotForTests
 } from './windows-foreground-process-rows'
@@ -117,4 +121,25 @@ describe('windows process rows', () => {
 
     expect(scanCount()).toBe(2)
   })
+
+  it('never answers the ancestry links from the identity TTL cache either', async () => {
+    // The identity table is a second reader with its own TTL, so the freshness
+    // the ancestry walk depends on has to be pinned on its own.
+    await readWindowsProcessIdentityTable()
+    getAllProcessesMock.mockImplementation((cb: (rows: unknown) => void) => {
+      cb(withSelf([{ pid: 300, ppid: 100, name: 'node.exe' }]))
+    })
+    // Proves the cache the fresh read below ignores is live, not merely expired.
+    expect((await readWindowsProcessIdentityTable()).map((row) => row.pid)).toEqual([
+      process.pid,
+      100,
+      200
+    ])
+    expect(scanCount()).toBe(1)
+
+    const links = await queryWindowsProcessLinksFresh()
+
+    expect(scanCount()).toBe(2)
+    expect(links.map((row) => row.pid)).toEqual([process.pid, 300])
+  })
 })
diff --git a/src/main/providers/windows-foreground-process-rows.ts b/src/main/providers/windows-foreground-process-rows.ts
index 5f462649e6c..16f01d5fbe7 100644
--- a/src/main/providers/windows-foreground-process-rows.ts
+++ b/src/main/providers/windows-foreground-process-rows.ts
@@ -1,8 +1,10 @@
 import { collectDescendantsFromIndex, getProcessTableIndex } from '../../shared/process-table-index'
 import {
+  readWindowsProcessIdentityTableFresh,
   readWindowsProcessTable,
   readWindowsProcessTableFresh,
   resetWindowsProcessTableForTests,
+  type WindowsProcessIdentityRow,
   type WindowsProcessRow as NativeWindowsProcessRow
 } from '../windows/windows-process-table'
 
@@ -62,6 +64,16 @@ export async function queryWindowsProcessRowsFresh(): Promise<readonly WindowsPr
   return projectProcessRows(await readWindowsProcessTableFresh())
 }
 
+/**
+ * The same fresh scan for an ancestry walk, which reads only pid/ppid.
+ *
+ * Returns identity rows so the command line is not merely unused but absent:
+ * asking for it costs an `OpenProcess` per process on the box.
+ */
+export async function queryWindowsProcessLinksFresh(): Promise<WindowsProcessIdentityRow[]> {
+  return readWindowsProcessIdentityTableFresh()
+}
+
 export async function queryWindowsProcessDescendants(
   rootPid: number,
   options: { fresh?: boolean } = {}
@@ -108,6 +120,26 @@ export async function queryWindowsPaneProcessInventory(
   }
 }
 
+/**
+ * The descendant walk over rows the caller already read.
+ *
+ * Why exported: a caller that needs a field this module's projection drops —
+ * process creation time, for a PID-reuse-safe teardown snapshot — would
+ * otherwise read the whole table a second time to get it.
+ * Null when the root is absent, which is a stale or filtered snapshot rather
+ * than a root with no descendants.
+ */
+export function windowsDescendantsFromRows<Row extends { pid: number; ppid: number }>(
+  rows: Row[],
+  rootPid: number
+): (Row & { depth: number })[] | null {
+  const index = getProcessTableIndex(rows)
+  if (!index.byPid.has(rootPid)) {
+    return null
+  }
+  return collectDescendantsFromIndex(index, rootPid).sort((a, b) => b.depth - a.depth)
+}
+
 /** Test-only: clear the shared snapshot so one case's rows never serve the next. */
 export function resetWindowsProcessRowsSnapshotForTests(): void {
   resetWindowsProcessTableForTests()
diff --git a/src/main/pty-descendant-exit-verification.ts b/src/main/pty-descendant-exit-verification.ts
index c0ed223704a..4c8471fa955 100644
--- a/src/main/pty-descendant-exit-verification.ts
+++ b/src/main/pty-descendant-exit-verification.ts
@@ -21,50 +21,143 @@ function waitForDelay(ms: number): Promise<void> {
 
 function matchingSnapshotRows(
   snapshot: DescendantSnapshot,
-  table: readonly ProcessTableRow[]
+  table: readonly ProcessTableRow[],
+  rejectDuplicatePids = false
 ): ProcessTableRow[] {
   const expected = new Map(snapshot.descendants.map((row) => [row.pid, row]))
-  return table.filter((live) => {
-    const row = expected.get(live.pid)
-    return row?.startedAt === live.startedAt && row.pgid === live.pgid
+  const rowsByPid = new Map<number, ProcessTableRow[]>()
+  for (const live of table) {
+    const rows = rowsByPid.get(live.pid)
+    if (rows) {
+      rows.push(live)
+    } else {
+      rowsByPid.set(live.pid, [live])
+    }
+  }
+  return [...expected.entries()].flatMap(([pid, row]) => {
+    const rows = rowsByPid.get(pid)
+    if (rejectDuplicatePids && rows?.length !== 1) {
+      // Duplicate PID rows make this non-atomic process-table read ambiguous;
+      // never signal or count either identity as proof of liveness.
+      return []
+    }
+    return (rows ?? []).filter((live) => live.startedAt === row.startedAt && live.pgid === row.pgid)
   })
 }
 
+function hasDuplicateSnapshotPids(
+  snapshot: DescendantSnapshot,
+  table: readonly ProcessTableRow[]
+): boolean {
+  const expected = new Set(snapshot.descendants.map((row) => row.pid))
+  const counts = new Map<number, number>()
+  for (const live of table) {
+    if (expected.has(live.pid)) {
+      counts.set(live.pid, (counts.get(live.pid) ?? 0) + 1)
+    }
+  }
+  return [...counts.values()].some((count) => count > 1)
+}
+
 type VerificationDeps = TerminateDeps & {
   verifyMs?: number
+  /** Revalidate identities before signaling; used by Claude's close proof. */
+  requireIdentityBeforeSignal?: boolean
 }
 
+/**
+ * Orca's verdict vocabulary for a snapshotted tree, with no synonyms: `live` is
+ * an identity-matched descendant still observed at the deadline; `unverifiable`
+ * is a table that could not be read, which is never evidence either way.
+ */
+export type DescendantTreeVerdict = 'exited' | 'live' | 'unverifiable'
+
 /** An unreadable process table is never proof that a stopped descendant exited. */
 export async function terminateDescendantSnapshotAndWait(
   snapshot: DescendantSnapshot,
   deps: VerificationDeps = {}
 ): Promise<boolean> {
+  return (await terminateDescendantSnapshotWithVerdict(snapshot, deps)) === 'exited'
+}
+
+/** Signals the snapshot, then reports what the last table read observed. */
+export async function terminateDescendantSnapshotWithVerdict(
+  snapshot: DescendantSnapshot,
+  deps: VerificationDeps = {}
+): Promise<DescendantTreeVerdict> {
   const sendSignal = deps.sendSignal ?? sendDescendantSignal
   const readTable = deps.readTable ?? readProcessTable
   const graceMs = deps.graceMs ?? DESCENDANT_KILL_GRACE_MS
   const verifyMs = deps.verifyMs ?? DESCENDANT_KILL_VERIFY_MS
   const deadline = Date.now() + verifyMs
-  for (const row of snapshot.descendants) {
-    sendSignal(row.pid, 'SIGTERM')
-  }
   let forced = false
+  let signalled = !deps.requireIdentityBeforeSignal
+  let missingObservations = 0
+  if (signalled) {
+    for (const row of snapshot.descendants) {
+      sendSignal(row.pid, 'SIGTERM')
+    }
+  }
   while (Date.now() < deadline) {
     const capture = await readProcessTableBeforeDeadline(
       readTable,
       deps.timeoutMs ?? DESCENDANT_SNAPSHOT_TIMEOUT_MS
     )
-    if (!capture) {
-      return false
-    }
-    const live = matchingSnapshotRows(snapshot, capture.rows)
-    if (live.length === 0) {
-      return true
-    }
-    if (!forced && Date.now() >= deadline - verifyMs + graceMs) {
-      forced = true
-      for (const row of live) {
-        if (hasUnambiguousStartIdentity(row, snapshot.capturedAtMs)) {
-          sendSignal(row.pid, 'SIGKILL')
+    // A read that missed its own deadline is not an answer, and surrendering on
+    // the first slow one spends none of the window this verification was given:
+    // on a loaded host that reported a tree unverifiable without ever seeing it.
+    if (capture) {
+      if (deps.requireIdentityBeforeSignal && hasDuplicateSnapshotPids(snapshot, capture.rows)) {
+        // A duplicate target pid is an ambiguous non-atomic read. Do not signal
+        // either row and do not turn that uncertainty into an exited verdict.
+        await waitForDelay(50)
+        continue
+      }
+      const live = matchingSnapshotRows(snapshot, capture.rows, deps.requireIdentityBeforeSignal)
+      if (live.length === 0) {
+        // Before a signal has been sent, an empty identity match means the
+        // snapshotted descendants already exited or were replaced. Signalling
+        // those old numeric pids would be unsafe.
+        if (deps.requireIdentityBeforeSignal) {
+          // A single process-table read can race a fork or return a partial
+          // view; require two bounded absences before claiming the tree gone.
+          missingObservations += 1
+          if (missingObservations < 2) {
+            await waitForDelay(50)
+            continue
+          }
+        }
+        return 'exited'
+      }
+      missingObservations = 0
+      if (!signalled) {
+        // Revalidate every identity immediately before the first signal. A PID
+        // can be recycled between the original walk and close, so never signal
+        // from the stale snapshot alone.
+        for (const row of live) {
+          sendSignal(row.pid, 'SIGTERM')
+        }
+        signalled = true
+      }
+      if (!forced && Date.now() >= deadline - verifyMs + graceMs) {
+        forced = true
+        for (const row of live) {
+          // A row a walk re-derived from a live root is ours whatever second it
+          // was born in, which start time alone can never establish for one born
+          // in its own capture second. Rows no walk re-derived still answer to
+          // the second-resolution fence, which is all the evidence they have.
+          // Scoped to the identity-revalidating callers; the same argument holds
+          // for the rest, but widening it is a deliberate change of its own.
+          if (
+            (deps.requireIdentityBeforeSignal === true &&
+              snapshot.reDerivedPids?.has(row.pid) === true) ||
+            hasUnambiguousStartIdentity(
+              row,
+              snapshot.capturedAtMsByPid?.[String(row.pid)] ?? snapshot.capturedAtMs
+            )
+          ) {
+            sendSignal(row.pid, 'SIGKILL')
+          }
         }
       }
     }
@@ -74,5 +167,19 @@ export async function terminateDescendantSnapshotAndWait(
     readTable,
     deps.timeoutMs ?? DESCENDANT_SNAPSHOT_TIMEOUT_MS
   )
-  return finalCapture !== null && matchingSnapshotRows(snapshot, finalCapture.rows).length === 0
+  if (!finalCapture) {
+    return 'unverifiable'
+  }
+  if (deps.requireIdentityBeforeSignal && hasDuplicateSnapshotPids(snapshot, finalCapture.rows)) {
+    return 'unverifiable'
+  }
+  const finalLive = matchingSnapshotRows(
+    snapshot,
+    finalCapture.rows,
+    deps.requireIdentityBeforeSignal
+  )
+  if (finalLive.length > 0) {
+    return 'live'
+  }
+  return deps.requireIdentityBeforeSignal && missingObservations < 2 ? 'unverifiable' : 'exited'
 }
diff --git a/src/main/pty-descendant-termination.test.ts b/src/main/pty-descendant-termination.test.ts
index e1255a678d8..0c4bea81306 100644
--- a/src/main/pty-descendant-termination.test.ts
+++ b/src/main/pty-descendant-termination.test.ts
@@ -15,7 +15,10 @@ import {
   type ProcessTableCapture,
   type ProcessTableRow
 } from './pty-descendant-termination'
-import { terminateDescendantSnapshotAndWait } from './pty-descendant-exit-verification'
+import {
+  terminateDescendantSnapshotAndWait,
+  terminateDescendantSnapshotWithVerdict
+} from './pty-descendant-exit-verification'
 
 const CAPTURED_AT_MS = Date.parse('Tue Jul 14 12:00:00 2026')
 
@@ -53,7 +56,14 @@ function snapshot(
   rootPgid: number | null = 10,
   capturedAtMs = CAPTURED_AT_MS
 ) {
-  return { rootPgid, descendants, capturedAtMs }
+  return {
+    ...(rootPgid === null ? {} : { root: { pid: 10, startedAt: 'Mon Jul 13 12:54:47 2026' } }),
+    rootPgid,
+    descendants,
+    capturedAtMs,
+    // Everything a walk returns was re-derived by it.
+    ...(rootPgid === null ? {} : { reDerivedPids: new Set(descendants.map((row) => row.pid)) })
+  }
 }
 
 describe('parseProcessTable', () => {
@@ -298,6 +308,32 @@ describe('terminateDescendantSnapshot', () => {
     expect(sendSignal).not.toHaveBeenCalled()
     expect(vi.getTimerCount()).toBe(0)
   })
+
+  it("uses each row's capture boundary when escalating a merged snapshot", async () => {
+    const oldBoundary = CAPTURED_AT_MS + 900
+    const refreshBoundary = CAPTURED_AT_MS + 2_100
+    const retained = row(20, 10, 20, 'Tue Jul 14 12:00:00 2026')
+    const fresh = row(30, 10, 30, 'Tue Jul 14 12:00:01 2026')
+    const sendSignal = vi.fn()
+    terminateDescendantSnapshot(
+      {
+        ...snapshot([retained, fresh], 10, refreshBoundary),
+        capturedAtMsByPid: { '20': oldBoundary, '30': refreshBoundary }
+      },
+      {
+        sendSignal,
+        readTable: vi.fn().mockResolvedValue(tableCapture([retained, fresh]))
+      }
+    )
+    sendSignal.mockClear()
+
+    await vi.advanceTimersByTimeAsync(DESCENDANT_KILL_GRACE_MS)
+
+    // PID 20 was retained from the earlier capture and is still in its
+    // capture second; PID 30 was newly observed by the refresh and is old
+    // enough for a bounded forced cleanup.
+    expect(sendSignal.mock.calls).toEqual([[30, 'SIGKILL']])
+  })
 })
 
 describe('terminateDescendantSnapshotAndWait', () => {
@@ -333,14 +369,114 @@ describe('terminateDescendantSnapshotAndWait', () => {
 
   it('does not claim exit when the verification table is unavailable', async () => {
     const sendSignal = vi.fn()
-    const result = await terminateDescendantSnapshotAndWait(snapshot([row(20, 10, 20)]), {
+    const pending = terminateDescendantSnapshotAndWait(snapshot([row(20, 10, 20)]), {
       sendSignal,
-      readTable: vi.fn().mockRejectedValue(new Error('ps exploded'))
+      readTable: vi.fn().mockRejectedValue(new Error('ps exploded')),
+      verifyMs: 200
     })
+    await vi.advanceTimersByTimeAsync(400)
 
-    expect(result).toBe(false)
+    await expect(pending).resolves.toBe(false)
     expect(sendSignal).toHaveBeenCalledWith(20, 'SIGTERM')
   })
+
+  it('keeps polling past a read that missed its deadline rather than surrendering', async () => {
+    const survivor = row(20, 10, 20)
+    const readTable = vi
+      .fn()
+      // A loaded host can miss one read's deadline with the window still open.
+      .mockRejectedValueOnce(new Error('ps timed out'))
+      .mockResolvedValueOnce(tableCapture([survivor]))
+      .mockResolvedValueOnce(tableCapture([]))
+    const sendSignal = vi.fn()
+
+    const pending = terminateDescendantSnapshotWithVerdict(snapshot([survivor]), {
+      sendSignal,
+      readTable,
+      graceMs: 0,
+      verifyMs: 2_000
+    })
+    await vi.advanceTimersByTimeAsync(500)
+
+    await expect(pending).resolves.toBe('exited')
+    expect(sendSignal.mock.calls).toEqual([
+      [20, 'SIGTERM'],
+      [20, 'SIGKILL']
+    ])
+  })
+
+  it('names a survivor seen at the deadline live, never unverifiable', async () => {
+    const survivor = row(20, 10, 20)
+    const pending = terminateDescendantSnapshotWithVerdict(snapshot([survivor]), {
+      sendSignal: vi.fn(),
+      readTable: vi.fn().mockResolvedValue(tableCapture([survivor])),
+      graceMs: 0,
+      verifyMs: 100
+    })
+    await vi.advanceTimersByTimeAsync(200)
+
+    await expect(pending).resolves.toBe('live')
+  })
+
+  it('names an unreadable verification table unverifiable', async () => {
+    const pending = terminateDescendantSnapshotWithVerdict(snapshot([row(20, 10, 20)]), {
+      sendSignal: vi.fn(),
+      readTable: vi.fn().mockRejectedValue(new Error('ps exploded')),
+      verifyMs: 200
+    })
+    await vi.advanceTimersByTimeAsync(400)
+
+    await expect(pending).resolves.toBe('unverifiable')
+  })
+
+  it('does not signal a recycled descendant when identity validation is required', async () => {
+    const sendSignal = vi.fn()
+    const recycled = row(20, 10, 20, 'Tue Jul 14 13:00:00 2026')
+    const pending = terminateDescendantSnapshotWithVerdict(
+      snapshot([row(20, 10, 20, 'Tue Jul 14 12:00:00 2026')]),
+      {
+        sendSignal,
+        readTable: vi.fn().mockResolvedValue(tableCapture([recycled])),
+        requireIdentityBeforeSignal: true,
+        verifyMs: 100
+      }
+    )
+
+    await vi.advanceTimersByTimeAsync(200)
+    await expect(pending).resolves.toBe('exited')
+    expect(sendSignal).not.toHaveBeenCalled()
+  })
+
+  it('uses row-scoped boundaries for forced cleanup in the exit verifier', async () => {
+    const oldBoundary = CAPTURED_AT_MS + 900
+    const refreshBoundary = CAPTURED_AT_MS + 2_100
+    const retained = row(20, 10, 20, 'Tue Jul 14 12:00:00 2026')
+    const fresh = row(30, 10, 30, 'Tue Jul 14 12:00:01 2026')
+    const sendSignal = vi.fn()
+    const pending = terminateDescendantSnapshotWithVerdict(
+      {
+        ...snapshot([retained, fresh], 10, refreshBoundary),
+        capturedAtMsByPid: { '20': oldBoundary, '30': refreshBoundary },
+        // What a merge produces: only the refresh re-derived 30; 20 is retained.
+        reDerivedPids: new Set([30])
+      },
+      {
+        sendSignal,
+        readTable: vi.fn().mockResolvedValue(tableCapture([retained, fresh])),
+        requireIdentityBeforeSignal: true,
+        graceMs: 0,
+        verifyMs: 100
+      }
+    )
+    await vi.advanceTimersByTimeAsync(200)
+
+    await expect(pending).resolves.toBe('live')
+    expect(sendSignal.mock.calls).toEqual([
+      [20, 'SIGTERM'],
+      [30, 'SIGTERM'],
+      [30, 'SIGKILL']
+    ])
+  })
 })
 
 describe('createProcessTableSnapshotReader', () => {
diff --git a/src/main/pty-descendant-termination.ts b/src/main/pty-descendant-termination.ts
index bf254d03b56..4f56c3e977b 100644
--- a/src/main/pty-descendant-termination.ts
+++ b/src/main/pty-descendant-termination.ts
@@ -21,12 +21,25 @@ export type ProcessTableRow = {
   startedAt: string
 }
 
+export type PosixProcessIdentity = Pick<ProcessTableRow, 'pid' | 'startedAt'>
+
 export type DescendantSnapshot = {
+  /** Identity of the root observed in the same process-table capture. */
+  root?: PosixProcessIdentity
   rootPgid: number | null
   descendants: ProcessTableRow[]
-  /** Wall-clock boundary for deciding whether ps's second-resolution lstart
-   *  can safely distinguish this process from a later PID reuse. */
+  /** Wall-clock boundary for an unmerged snapshot (or legacy callers). */
   capturedAtMs: number
+  /** Per-PID identity boundaries for merged captures. */
+  capturedAtMsByPid?: Readonly<Record<string, number>>
+  /**
+   * PIDs this walk re-derived from a live root. A ppid walk only reaches what
+   * the root actually parents, so membership is proof of ownership that owes
+   * nothing to `lstart`'s one-second resolution: a stranger would have to have
+   * been forked into our own tree, and then it is not a stranger. Rows a merge
+   * retained from an earlier walk are absent, and still answer to start time.
+   */
+  reDerivedPids?: ReadonlySet<number>
 }
 
 export type ProcessTableCapture = {
@@ -156,9 +169,13 @@ export function collectDescendantRows(
 ): DescendantSnapshot {
   const childrenByPpid = new Map<number, ProcessTableRow[]>()
   let rootRow: ProcessTableRow | null = null
+  let duplicateRoot = false
   for (const row of table) {
     if (row.pid === rootPid) {
-      rootRow = row
+      // A non-atomic process-table read can contain both an old and a recycled
+      // root row. There is no safe identity to retain in that case.
+      duplicateRoot = rootRow !== null
+      rootRow ??= row
       continue
     }
     const siblings = childrenByPpid.get(row.ppid)
@@ -172,7 +189,7 @@ export function collectDescendantRows(
   // An absent root has already exited — its real descendants reparent to pid 1 and
   // become unreachable by ppid, so any rows still pointing at the vacated PID are a
   // PID-reuse coincidence. Sweeping them could signal an unrelated process, so bail.
-  if (!rootRow) {
+  if (!rootRow || duplicateRoot) {
     return { rootPgid: null, descendants: [], capturedAtMs }
   }
   const descendants: ProcessTableRow[] = []
@@ -191,7 +208,13 @@ export function collectDescendantRows(
       queue.push(child.pid)
     }
   }
-  return { rootPgid: rootRow.pgid, descendants, capturedAtMs }
+  return {
+    root: { pid: rootRow.pid, startedAt: rootRow.startedAt },
+    rootPgid: rootRow.pgid,
+    descendants,
+    capturedAtMs,
+    reDerivedPids: new Set(descendants.map((row) => row.pid))
+  }
 }
 
 type SnapshotDeps = {
@@ -316,7 +339,11 @@ export type TerminateDeps = {
 }
 
 export function hasUnambiguousStartIdentity(row: ProcessTableRow, capturedAtMs: number): boolean {
-  const startedAtMs = Date.parse(row.startedAt)
+  return hasUnambiguousStartTime(row.startedAt, capturedAtMs)
+}
+
+export function hasUnambiguousStartTime(startedAt: string, capturedAtMs: number): boolean {
+  const startedAtMs = Date.parse(startedAt)
   if (!Number.isFinite(startedAtMs)) {
     return false
   }
@@ -364,7 +391,10 @@ export function terminateDescendantSnapshot(
       for (const row of snapshot.descendants) {
         const live = liveTargets.get(row.pid)
         if (
-          hasUnambiguousStartIdentity(row, snapshot.capturedAtMs) &&
+          hasUnambiguousStartIdentity(
+            row,
+            snapshot.capturedAtMsByPid?.[String(row.pid)] ?? snapshot.capturedAtMs
+          ) &&
           live?.startedAt === row.startedAt &&
           live.pgid === row.pgid
         ) {
diff --git a/src/main/pty/node-pty-self-exit-pseudoconsole-close.test.ts b/src/main/pty/node-pty-self-exit-pseudoconsole-close.test.ts
new file mode 100644
index 00000000000..1f9cae275c3
--- /dev/null
+++ b/src/main/pty/node-pty-self-exit-pseudoconsole-close.test.ts
@@ -0,0 +1,180 @@
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+
+/**
+ * A shell that exits by itself must still close its pseudoconsole.
+ *
+ * `ClosePseudoConsole` is the only thing that reaps a ConPTY's console host —
+ * Orca's own job-ownership patch says so, because `CreatePseudoConsole` spawns
+ * that host before the per-pty job exists and it is therefore not a job member.
+ * Upstream node-pty calls it from exactly one place, `PtyKill`, which begins by
+ * looking the baton up by id — and the exit watcher in `SetupExitCallback`
+ * erased the baton the moment the shell died. So on the self-exit path (typing
+ * `exit`, which is how panes usually close) that lookup missed, `PtyKill` did
+ * nothing at all, and the pseudoconsole was never closed.
+ *
+ * There is a SECOND, independent defect on the same path: the `useConptyDll`
+ * branch of `WindowsPtyAgent.kill()` disposed the conout worker only from an
+ * `_outSocket.on('data')` handler, and no more data arrives once the shell has
+ * gone — so that worker leaked too. The non-DLL branch beside it already
+ * disposed unconditionally. The desktop always sets `useConptyDll`, so it hit
+ * both; the relay sets neither and hit only the first.
+ *
+ * Measured on Windows 11 / awin, 20 cycles, handles bucketed by NT object type,
+ * totals before -> after:
+ *
+ *   self-exit,     relay spawn     225 -> 285   becomes  219 -> 219  FLAT
+ *   self-exit,     desktop spawn   239 -> 439   becomes  222 -> 222  FLAT
+ *   explicit kill, relay spawn     225 -> 285   becomes  219 -> 219  FLAT
+ *   explicit kill, desktop spawn   235 -> 395   becomes  219 -> 219  FLAT
+ *
+ * Neither fix alone is enough on the desktop: the pseudoconsole close is worth
+ * +1 Process +1 File per terminal, the dispose +2 Thread +4 File.
+ *
+ * WHY THIS IS A PATCH-CONTENT PIN AND NOT A BEHAVIOURAL TEST: the defect is
+ * only observable as a per-NT-type handle count, which needs
+ * `NtQuerySystemInformation(SystemExtendedHandleInformation)`. Nothing in the
+ * repo can read that, and the cheaper Windows-observable proxies do not
+ * discriminate — the console host process is reaped either way (the leak is a
+ * handle to an already-exited object, not an orphaned process), and the
+ * `\\.\pipe\conpty-*` entries disappear either way. Both were measured and
+ * rejected as assertions rather than assumed. So this pins the mechanism
+ * instead, which is the real risk: a future resync of the vendored patch
+ * silently dropping the hunk.
+ */
+
+const PATCH = readFileSync(join(__dirname, '../../../config/patches/node-pty@1.1.0.patch'), 'utf8')
+
+/**
+ * Just the `PtyKill` hunk. Several markers below also occur in the `PtyConnect`
+ * hunk above it, and a bare `indexOf` on the whole patch silently matched the
+ * wrong one — an assertion that then held regardless of what `PtyKill` did.
+ */
+const ptyKillHunk = (() => {
+  // Anchored on the hunk header's function context rather than its line
+  // numbers, which shift whenever anything above it in the patch changes.
+  const header = /^@@ .* @@ static Napi::Value PtyKill\(.*$/m.exec(PATCH)
+  if (!header) {
+    throw new Error('no PtyKill hunk in config/patches/node-pty@1.1.0.patch')
+  }
+  const from = header.index
+  const next = PATCH.indexOf('\n@@ ', from + 1)
+  return PATCH.slice(from, next === -1 ? undefined : next)
+})()
+
+/**
+ * `indexOf` that throws instead of returning -1. A missing marker must fail the
+ * assertion that depends on it, not quietly make a slice or comparison vacuous.
+ */
+function indexIn(haystack: string, marker: string): number {
+  const at = haystack.indexOf(marker)
+  if (at === -1) {
+    throw new Error(`marker not found in the PtyKill hunk: ${marker}`)
+  }
+  return at
+}
+
+describe('node-pty patch: pseudoconsole close on the self-exit path', () => {
+  it('does not let the exit watcher free the baton while the close is still owed', () => {
+    // Pinned as one block: the erase must stay INSIDE the consoleClosed guard.
+    // Upstream ran it unconditionally, which is the line that caused the leak,
+    // and a resync that re-flattens this is the failure mode worth catching.
+    expect(PATCH).toContain(
+      [
+        '+      baton->shellExited = true;',
+        '+      if (baton->consoleClosed) {',
+        '+        const bool removed = remove_pty_baton(baton->id);',
+        '+        assert(removed);',
+        '+        (void)removed;',
+        '+      }'
+      ].join('\n')
+    )
+  })
+
+  it('closes the pseudoconsole from PtyKill even after the shell has exited', () => {
+    // hpc is copied out under the lock, so the close survives the baton's removal.
+    expect(PATCH).toContain('+      hpc = handle->hpc;')
+    expect(PATCH).toContain('+      pfnClosePseudoConsole(hpc);')
+  })
+
+  it('resolves the ConPTY DLL before it claims the close', () => {
+    // LoadConptyDll throws when conpty.dll is missing. Throwing after
+    // consoleClosed was set would strand the pseudoconsole for good: the retry
+    // finds the work claimed and does nothing.
+    //
+    // Anchored inside PtyKill, not by a bare indexOf: the identical line also
+    // appears in the PtyConnect hunk, earlier in the file, and matching that one
+    // made this assertion pass no matter where PtyKill resolved the DLL.
+    const dllResolve = indexIn(
+      ptyKillHunk,
+      '+  HANDLE hLibrary = LoadConptyDll(info, useConptyDll);'
+    )
+    const claim = indexIn(ptyKillHunk, '+      handle->consoleClosed = true;')
+    expect(dllResolve).toBeLessThan(claim)
+  })
+
+  it('reaches hShell only under the null check the watcher can trip', () => {
+    // Pinned as one block. The watcher nulls hShell on exit, and upstream
+    // dereferenced it unconditionally; every remaining use — the duplication and
+    // the failure fallback below it — must stay inside this guard.
+    const start = indexIn(ptyKillHunk, '+      if (useConptyDll && handle->hShell != nullptr) {')
+    const end = indexIn(ptyKillHunk, '+      if (handle->shellExited) {')
+    const guarded = ptyKillHunk.slice(start, end)
+    expect(guarded).toContain('DuplicateHandle(GetCurrentProcess(), handle->hShell')
+    expect(guarded).toContain('TerminateProcess(handle->hShell, 1);')
+    // No ADDED line outside that guard may terminate through hShell. Removed
+    // (`-`) lines still carry upstream's unguarded call, which is the point.
+    const strayAdds = PATCH.replace(guarded, '')
+      .split('\n')
+      .filter((line) => line.startsWith('+') && line.includes('TerminateProcess(handle->hShell'))
+    expect(strayAdds).toEqual([])
+  })
+
+  it('frees the baton from PtyKill when the shell has already exited', () => {
+    // The other half of the two-sided handshake. Without it a self-exit followed
+    // by kill() — the ordinary pane close — leaks one baton and one entry in the
+    // vector get_pty_baton scans linearly, forever.
+    expect(ptyKillHunk).toContain(
+      [
+        '+      if (handle->shellExited) {',
+        '+        const bool removed = remove_pty_baton(id);',
+        '+        assert(removed);',
+        '+        (void)removed;'
+      ].join('\n')
+    )
+  })
+
+  it('still kills the shell when DuplicateHandle fails', () => {
+    // A null hShellDup is indistinguishable from the self-exit case, so a
+    // swallowed failure would leave the shell running after its pane closed —
+    // a worse outcome than the leak this patch exists to fix.
+    expect(PATCH).toContain(
+      [
+        '+          hShellDup = nullptr;',
+        '+          TerminateProcess(handle->hShell, 1);',
+        '+        }'
+      ].join('\n')
+    )
+  })
+
+  it('keeps the close idempotent so a second kill cannot double-close', () => {
+    expect(PATCH).toContain('+    if (handle != nullptr && !handle->consoleClosed) {')
+    expect(PATCH).toContain('+      handle->consoleClosed = true;')
+  })
+})
+
+describe('node-pty patch: conout worker disposal on the self-exit path', () => {
+  // The desktop's larger half: 8 of its 10 leaked handles per terminal.
+  it('disposes the conout worker unconditionally in the useConptyDll branch', () => {
+    expect(PATCH).toContain('+                this._conoutSocketWorker.dispose();')
+    // The data handler is what never fired once the shell had gone.
+    expect(PATCH).toContain("-                this._outSocket.on('data', function () {")
+    expect(PATCH).toContain('-                    _this._conoutSocketWorker.dispose();')
+  })
+
+  it('applies the same change to the TypeScript source the patch also carries', () => {
+    expect(PATCH).toContain('+        this._conoutSocketWorker.dispose();')
+    expect(PATCH).toContain("-        this._outSocket.on('data', () => {")
+  })
+})
diff --git a/src/main/refused-tree-kill-root-termination.test.ts b/src/main/refused-tree-kill-root-termination.test.ts
new file mode 100644
index 00000000000..ada4b5942a9
--- /dev/null
+++ b/src/main/refused-tree-kill-root-termination.test.ts
@@ -0,0 +1,220 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { spawnMock, execFileMock, queryWindowsProcessDescendantsMock } = vi.hoisted(() => ({
+  spawnMock: vi.fn(),
+  execFileMock: vi.fn(),
+  queryWindowsProcessDescendantsMock: vi.fn()
+}))
+
+vi.mock('node:child_process', async (importOriginal) => ({
+  ...(await importOriginal<Record<string, unknown>>()),
+  spawn: spawnMock,
+  execFile: execFileMock
+}))
+vi.mock('electron', () => ({ ipcMain: { handle: vi.fn(), on: vi.fn() } }))
+vi.mock('./providers/windows-foreground-process-rows', () => ({
+  queryWindowsProcessDescendants: queryWindowsProcessDescendantsMock
+}))
+
+import {
+  getAppEnvironment,
+  hasAppEnvironment,
+  setAppEnvironment,
+  type AppEnvironment
+} from '../shared/app-environment'
+import { installMainProcessTreeKillGate } from './own-chromium-tree-kill-guard'
+import { setProcessTreeKillGate } from '../shared/child-process/process-tree-kill-gate'
+import { resetSelfInitiatedTreeKillLogForTest } from './crash-reporting/self-initiated-tree-kill-log'
+import {
+  clearCrashBreadcrumbsForTest,
+  getCrashBreadcrumbSnapshot
+} from './crash-reporting/crash-breadcrumb-store'
+import { _resetTracerForTests, setActiveSink } from './observability/tracer'
+import { terminateNotebookProcessTree } from './ipc/notebook'
+import { killLocalPrecheckProcessTree } from './automations/precheck-runner'
+import { killRecipeProcess } from '../shared/ephemeral-vm-recipe-process'
+import { killSpawnedCommandTree } from './git/command-runner/spawned-command-tree-kill'
+import { killCodexAppServerProcessTree } from './codex/codex-app-server-session'
+import { signalProcessTree } from '../shared/child-process/process-tree-termination'
+import { killSourceControlAgentProcess } from './text-generation/source-control-local-process'
+import { terminateCodexTurnProcesses } from './codex/codex-structured-turn-processes'
+
+/** A pid Electron reports as one of ours: every gate below must refuse it. */
+const RENDERER_PID = 1001
+
+function appEnvironment(): AppEnvironment {
+  return {
+    getPath: () => process.cwd(),
+    getAppPath: () => process.cwd(),
+    getVersion: () => '0.0.0-test',
+    isPackaged: () => false,
+    onWillQuit: () => {},
+    exit: () => {},
+    getAppMetrics: (() => [
+      { pid: RENDERER_PID, type: 'Tab' }
+    ]) as unknown as AppEnvironment['getAppMetrics']
+  }
+}
+
+let previousEnvironment: AppEnvironment | null = null
+let previousPlatform: PropertyDescriptor | undefined
+
+function setPlatform(platform: NodeJS.Platform): void {
+  Object.defineProperty(process, 'platform', { value: platform, configurable: true })
+}
+
+beforeEach(() => {
+  previousEnvironment = hasAppEnvironment() ? getAppEnvironment() : null
+  previousPlatform = Object.getOwnPropertyDescriptor(process, 'platform')
+  setAppEnvironment(appEnvironment())
+  setActiveSink(null)
+  clearCrashBreadcrumbsForTest()
+  resetSelfInitiatedTreeKillLogForTest()
+  installMainProcessTreeKillGate()
+  spawnMock.mockReset()
+  execFileMock.mockReset()
+  queryWindowsProcessDescendantsMock.mockReset()
+  spawnMock.mockReturnValue({ on: vi.fn(), once: vi.fn(), unref: vi.fn(), kill: vi.fn() })
+})
+
+afterEach(() => {
+  setProcessTreeKillGate(null)
+  if (previousPlatform) {
+    Object.defineProperty(process, 'platform', previousPlatform)
+  }
+  if (previousEnvironment) {
+    setAppEnvironment(previousEnvironment)
+  }
+  _resetTracerForTests()
+})
+
+/**
+ * A refusal must never become a process leak. The gate only blocks the
+ * pid-addressed tree walk; the root kill is addressed by the child handle, so it
+ * cannot reach the recycled pid we refused, and skipping it would report a
+ * timed-out command as stopped while its tree keeps running.
+ */
+describe('a refused tree-kill still terminates the root it owns', () => {
+  it('kills the git command root when the tree walk is refused', async () => {
+    setPlatform('win32')
+    const child = { pid: RENDERER_PID, kill: vi.fn() }
+
+    await killSpawnedCommandTree(child as never)
+
+    expect(spawnMock).not.toHaveBeenCalled()
+    expect(child.kill).toHaveBeenCalledTimes(1)
+  })
+
+  it('kills the notebook cell root when the tree walk is refused', () => {
+    setPlatform('win32')
+    const child = { pid: RENDERER_PID, kill: vi.fn() }
+
+    expect(terminateNotebookProcessTree(child as never)).toBeNull()
+
+    expect(spawnMock).not.toHaveBeenCalled()
+    expect(child.kill).toHaveBeenCalledTimes(1)
+  })
+
+  it('kills the automation precheck root when the tree walk is refused', () => {
+    setPlatform('win32')
+    const child = { pid: RENDERER_PID, kill: vi.fn() }
+
+    expect(killLocalPrecheckProcessTree(child as never)).toBeNull()
+
+    expect(spawnMock).not.toHaveBeenCalled()
+    expect(child.kill).toHaveBeenCalledTimes(1)
+  })
+
+  it('kills the ephemeral-VM recipe root when the tree walk is refused', () => {
+    setPlatform('win32')
+    const child = { pid: RENDERER_PID, kill: vi.fn() }
+
+    killRecipeProcess(child as never, true)
+
+    expect(spawnMock).not.toHaveBeenCalled()
+    expect(child.kill).toHaveBeenCalledWith('SIGKILL')
+  })
+
+  it('kills the codex app-server root when the deadline tree walk is refused', () => {
+    const child = { pid: RENDERER_PID, kill: vi.fn() }
+
+    killCodexAppServerProcessTree(child as never, {
+      platform: 'win32',
+      spawnImpl: spawnMock as never
+    })
+
+    expect(spawnMock).not.toHaveBeenCalled()
+    expect(child.kill).toHaveBeenCalledWith('SIGKILL')
+  })
+
+  it('kills the commit-message agent root when the tree walk is refused', async () => {
+    setPlatform('win32')
+    const child = { pid: RENDERER_PID, kill: vi.fn() }
+
+    await killSourceControlAgentProcess(child as never)
+
+    expect(execFileMock).not.toHaveBeenCalled()
+    expect(child.kill).toHaveBeenCalledWith('SIGKILL')
+  })
+
+  it('kills the runProcess root when the Windows arm of the shared choke point is refused', async () => {
+    setPlatform('win32')
+    const windowsChild = { pid: RENDERER_PID, kill: vi.fn(), exitCode: null, signalCode: null }
+
+    await expect(signalProcessTree(windowsChild as never, 'SIGKILL')).resolves.toBe(false)
+    expect(spawnMock).not.toHaveBeenCalled()
+    expect(windowsChild.kill).toHaveBeenCalledWith('SIGKILL')
+  })
+
+  it('still signals the POSIX process group: a group only holds what Orca put in it', async () => {
+    // Same contract as main and as the other three POSIX group arms in main
+    // (claude-login, codex teardown, PTY sweep): record, never refuse. A stale
+    // `getAppMetrics()` entry must not orphan a macOS/Linux tree.
+    setPlatform('linux')
+    const posixChild = { pid: RENDERER_PID, kill: vi.fn(), exitCode: null, signalCode: null }
+    const processKill = vi.spyOn(process, 'kill').mockImplementation(() => true)
+
+    await expect(signalProcessTree(posixChild as never, 'SIGKILL')).resolves.toBe(true)
+    expect(processKill).toHaveBeenCalledWith(-RENDERER_PID, 'SIGKILL')
+    expect(posixChild.kill).not.toHaveBeenCalled()
+    expect(getCrashBreadcrumbSnapshot()).toEqual([
+      expect.objectContaining({
+        name: 'self_tree_kill',
+        data: expect.objectContaining({ pid: RENDERER_PID, scope: 'posix-process-group' })
+      })
+    ])
+    processKill.mockRestore()
+  })
+})
+
+/**
+ * The one gated site with nothing to fall back to: the roots it kills are found
+ * by a process-table walk, not spawned here, so there is no child handle. A
+ * refusal must then be visible — the refusal crumb is written and the turn is
+ * reported as not cancelled — rather than resolving as if the tree had gone.
+ */
+describe('a refused tree-kill with no handle to fall back to', () => {
+  it('reports the codex turn as not cancelled and records the refused added root', async () => {
+    const appServerPid = 500
+    const addedRoot = {
+      pid: RENDERER_PID,
+      ppid: appServerPid,
+      name: 'node.exe',
+      command: 'node',
+      depth: 1
+    }
+    queryWindowsProcessDescendantsMock.mockResolvedValue([addedRoot])
+
+    await expect(
+      terminateCodexTurnProcesses(appServerPid, { platform: 'win32', identities: new Map() })
+    ).resolves.toBe(false)
+
+    expect(execFileMock).not.toHaveBeenCalled()
+    expect(getCrashBreadcrumbSnapshot()).toEqual([
+      expect.objectContaining({
+        name: 'self_tree_kill_refused_own_chromium',
+        data: expect.objectContaining({ pid: RENDERER_PID, site: 'codex-turn-added-roots' })
+      })
+    ])
+  })
+})
diff --git a/src/main/repo-icon-file-detection.test.ts b/src/main/repo-icon-file-detection.test.ts
index 820b2edddfc..19c895e6024 100644
--- a/src/main/repo-icon-file-detection.test.ts
+++ b/src/main/repo-icon-file-detection.test.ts
@@ -1,4 +1,6 @@
-import { readFile, stat } from 'node:fs/promises'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { mkdtemp, mkdir, readFile, rm, stat, writeFile } from 'node:fs/promises'
 import type * as FsPromisesModule from 'node:fs/promises'
 import { describe, expect, it, vi } from 'vitest'
 import type { ExecutionHostFilesystemRoute } from './providers/execution-host-provider-dispatch'
@@ -136,3 +138,55 @@ describe('detectRepoFileIcon connection boundary', () => {
     expect(stat).toHaveBeenCalled()
   })
 })
+
+describe('declared repo icons through production filesystem routes', () => {
+  it.each([
+    ['local', false],
+    ['ssh', false],
+    ['local', true],
+    ['ssh', true]
+  ] as const)('preserves declared icon detection on %s (no icon: %s)', async (kind, noIcon) => {
+    const directory = await mkdtemp(join(tmpdir(), 'orca-icon-href-'))
+    const source = noIcon
+      ? 'a'.repeat(256 * 1024)
+      : `${'a'.repeat(32768)}{ rel: "icon", href: "/first.png", href: "/chosen.png" }`
+    try {
+      await mkdir(join(directory, 'public'))
+      await writeFile(join(directory, 'index.html'), source)
+      await writeFile(join(directory, 'public', 'chosen.png'), Buffer.from(PNG_BASE64, 'base64'))
+      const provider = remoteFilesystemProvider({
+        stat: async (path) => {
+          const info = await stat(path)
+          return {
+            type: info.isFile() ? 'file' : 'directory',
+            size: info.size,
+            mtime: info.mtimeMs
+          }
+        },
+        readFile: async (path) => {
+          const buffer = await readFile(path)
+          const isBinary = path.endsWith('.png')
+          return {
+            content: buffer.toString(isBinary ? 'base64' : 'utf8'),
+            isBinary,
+            mimeType: isBinary ? 'image/png' : 'text/html'
+          }
+        }
+      })
+      const route: ExecutionHostFilesystemRoute =
+        kind === 'local' ? { kind: 'local', hostId: 'local' } : sshRoute('icon-oracle', provider)
+      await expect(detectRepoFileIcon(directory, route)).resolves.toEqual(
+        noIcon
+          ? null
+          : {
+              type: 'image',
+              src: `data:image/png;base64,${PNG_BASE64}`,
+              source: 'file',
+              label: 'public/chosen.png'
+            }
+      )
+    } finally {
+      await rm(directory, { recursive: true, force: true })
+    }
+  })
+})
diff --git a/src/main/repo-icon-file-detection.ts b/src/main/repo-icon-file-detection.ts
index f4289924b08..831248b94b3 100644
--- a/src/main/repo-icon-file-detection.ts
+++ b/src/main/repo-icon-file-detection.ts
@@ -3,6 +3,7 @@ import { buildImageDataUri } from '../shared/image-data-uri'
 import { MAX_REPO_ICON_UPLOAD_BYTES, type RepoIcon } from '../shared/repo-icon'
 import type { ExecutionHostFilesystemRoute } from './providers/execution-host-provider-dispatch'
 import type { IFilesystemProvider } from './providers/types'
+import { extractIconHref } from './repo-icon-source-href'
 import { iconHrefCandidates } from './repo-icon-href-candidates'
 import { joinWorktreeRelativePath } from './runtime/runtime-relative-paths'
 
@@ -49,11 +50,6 @@ const REPO_ICON_SOURCE_FILE_CANDIDATES = [
 // not read large app entrypoints just to find a small favicon href.
 const MAX_REPO_ICON_SOURCE_BYTES = 256 * 1024
 
-const LINK_ICON_HTML_RE =
-  /<link\b(?=[^>]*\brel=["'](?:icon|shortcut icon)["'])(?=[^>]*\bhref=["']([^"'?]+))[^>]*>/i
-const LINK_ICON_OBJECT_RE =
-  /(?=[^}]*\brel\s*:\s*["'](?:icon|shortcut icon)["'])(?=[^}]*\bhref\s*:\s*["']([^"'?]+))[^}]*/i
-
 type DetectedImageFormat = {
   mimeType: 'image/png' | 'image/webp'
 }
@@ -98,10 +94,6 @@ function detectImageFormat(buffer: Buffer): DetectedImageFormat | null {
   return null
 }
 
-function extractIconHref(source: string): string | null {
-  return source.match(LINK_ICON_HTML_RE)?.[1] ?? source.match(LINK_ICON_OBJECT_RE)?.[1] ?? null
-}
-
 function repoIconFromImageBuffer(buffer: Buffer, relativePath: string): RepoIcon | null {
   const format = detectImageFormat(buffer)
   if (!format) {
diff --git a/src/main/repo-icon-source-href.test.ts b/src/main/repo-icon-source-href.test.ts
new file mode 100644
index 00000000000..7c74511f3d6
--- /dev/null
+++ b/src/main/repo-icon-source-href.test.ts
@@ -0,0 +1,76 @@
+import { describe, expect, it } from 'vitest'
+import { extractIconHref } from './repo-icon-source-href'
+
+// Original production expressions are the compatibility oracle.
+const HTML_RE =
+  /<link\b(?=[^>]*\brel=["'](?:icon|shortcut icon)["'])(?=[^>]*\bhref=["']([^"'?]+))[^>]*>/i
+const OBJECT_RE =
+  /(?=[^}]*\brel\s*:\s*["'](?:icon|shortcut icon)["'])(?=[^}]*\bhref\s*:\s*["']([^"'?]+))[^}]*/i
+
+export function originalIconHref(source: string): string | null {
+  return source.match(HTML_RE)?.[1] ?? source.match(OBJECT_RE)?.[1] ?? null
+}
+
+describe('repo icon source href compatibility', () => {
+  it.each([
+    '<link <link <link rel="icon" href="last.png">',
+    '<link rel="icon" href="first.png" href="last.png">',
+    '<link rel="icon" href="cross>angle.png">',
+    '<LINK rel="ICON" href="upper.png">',
+    '<link href="wrong.png"><link rel="icon" href="right.png">',
+    '',
+    'plain source without icon properties',
+    '{ rel: "icon", href: "/first.png", href: "/last.png" }',
+    '{ href: "/first.png", rel: "icon", rel: "stylesheet" }',
+    '{ rel: "icon" } { href: "/unrelated.png" }',
+    '{ rel: "icon", href: "/first.png" } { rel: "icon", href: "/last.png" }',
+    '{ rel: "icon", href: "/object.png" } <link href="/html.png" rel="icon">',
+    '{ rel: "ICON", href: "/UPPER.png" }',
+    '}\n\n{href: "/line.png",\nrel : "shortcut icon"}',
+    '{ rel: "icon", href: "/unterminated}after brace',
+    '{ rel: "icon", href: "?query" }',
+    '{ rel: "icon", href: "/before?query" }',
+    '<link rel="stylesheet" href="/no.png">',
+    '<link rel="icon" href="/yes.png"',
+    '{rel:"icon",href:"/nested{brace}.png"}',
+    'xrel:"icon", xhref:"/no.png"'
+  ])('preserves original selection for %s', (source) => {
+    expect(extractIconHref(source)).toBe(originalIconHref(source))
+  })
+
+  it('matches the original across generated malformed property sequences', () => {
+    const tokens = [
+      '}',
+      '{',
+      ' ',
+      'rel:"icon"',
+      'href:"a"',
+      'href:"b"',
+      'rel:"other"',
+      'x',
+      '\n',
+      '<link ',
+      '>',
+      'rel="icon"',
+      'href="a"',
+      'href="b"'
+    ]
+    let seed = 97
+    for (let sample = 0; sample < 3000; sample++) {
+      let source = ''
+      for (let token = 0; token < 12; token++) {
+        seed = (Math.imul(seed, 1664525) + 1013904223) >>> 0
+        source += tokens[seed % tokens.length]
+      }
+      expect(extractIconHref(source), source).toBe(originalIconHref(source))
+    }
+  })
+
+  it('handles a maximum-size unterminated HTML tag region', () => {
+    expect(extractIconHref('<link '.repeat(Math.floor((256 * 1024) / 6)))).toBeNull()
+  })
+
+  it('handles a maximum-size icon-free entrypoint', () => {
+    expect(extractIconHref('a'.repeat(256 * 1024))).toBeNull()
+  })
+})
diff --git a/src/main/repo-icon-source-href.ts b/src/main/repo-icon-source-href.ts
new file mode 100644
index 00000000000..b8363da3711
--- /dev/null
+++ b/src/main/repo-icon-source-href.ts
@@ -0,0 +1,46 @@
+const LINK_START_RE = /<link\b/gi
+const LINK_ICON_HTML_RE =
+  /<link\b(?=[^>]*\brel=["'](?:icon|shortcut icon)["'])(?=[^>]*\bhref=["']([^"'?]+))[^>]*>/iy
+const LINK_ICON_OBJECT_RE =
+  /(?=[^}]*\brel\s*:\s*["'](?:icon|shortcut icon)["'])(?=[^}]*\bhref\s*:\s*["']([^"'?]+))[^}]*/iy
+
+function extractHtmlIconHref(source: string): string | null {
+  LINK_START_RE.lastIndex = 0
+  let match: RegExpExecArray | null
+  while ((match = LINK_START_RE.exec(source))) {
+    LINK_ICON_HTML_RE.lastIndex = match.index
+    const href = LINK_ICON_HTML_RE.exec(source)?.[1]
+    if (href !== undefined) {
+      return href
+    }
+    // Later link starts before the same closing angle see only a subset of these attributes.
+    const closingAngle = source.indexOf('>', LINK_START_RE.lastIndex)
+    if (closingAngle === -1) {
+      return null
+    }
+    LINK_START_RE.lastIndex = closingAngle + 1
+  }
+  return null
+}
+
+export function extractIconHref(source: string): string | null {
+  const htmlHref = extractHtmlIconHref(source)
+  if (htmlHref !== null) {
+    return htmlHref
+  }
+  let start = 0
+  while (start <= source.length) {
+    // Every suffix before the next closing brace sees the same candidate properties.
+    LINK_ICON_OBJECT_RE.lastIndex = start
+    const href = LINK_ICON_OBJECT_RE.exec(source)?.[1]
+    if (href !== undefined) {
+      return href
+    }
+    const closingBrace = source.indexOf('}', start)
+    if (closingBrace === -1) {
+      return null
+    }
+    start = closingBrace + 1
+  }
+  return null
+}
diff --git a/src/main/repo-worktrees.ts b/src/main/repo-worktrees.ts
index 228f303bfa2..f5d67523286 100644
--- a/src/main/repo-worktrees.ts
+++ b/src/main/repo-worktrees.ts
@@ -1,6 +1,11 @@
 import type { Repo } from '../shared/repo-types'
 import type { GitWorktreeInfo } from '../shared/worktree/types'
-import { listWorktreeGraph, listWorktrees, listWorktreesStrict } from './git/worktree'
+import {
+  listWorktreeGraph,
+  listWorktrees,
+  listWorktreesSharedStrictAllowingTrueEmpty,
+  listWorktreesStrict
+} from './git/worktree'
 import { isFolderRepo } from '../shared/repo-kind'
 import { getRepoExecutionHostId, LOCAL_EXECUTION_HOST_ID } from '../shared/execution-host'
 import { resolveGitRouteForHost } from './providers/execution-host-provider-dispatch'
@@ -42,6 +47,29 @@ export function createFolderWorktree(repo: Repo): GitWorktreeInfo {
 export async function listRepoWorktrees(
   repo: Repo,
   options?: LocalRepoWorktreeListOptions
+): Promise<GitWorktreeInfo[]> {
+  return listRoutedRepoWorktrees(repo, options, listWorktrees)
+}
+
+/**
+ * The detected scan's listing: a Git or host failure rejects instead of softening to `[]`, so a
+ * failed scan cannot be published as an authoritative empty listing and prune the repo's worktrees
+ * (#1158's retention guard only fires when the listing admits it failed).
+ */
+export async function listRepoWorktreesForDetectedScan(
+  repo: Repo,
+  options?: LocalRepoWorktreeListOptions
+): Promise<GitWorktreeInfo[]> {
+  return listRoutedRepoWorktrees(repo, options, listWorktreesSharedStrictAllowingTrueEmpty)
+}
+
+async function listRoutedRepoWorktrees(
+  repo: Repo,
+  options: LocalRepoWorktreeListOptions | undefined,
+  listLocal: (
+    repoPath: string,
+    options?: LocalRepoWorktreeListOptions
+  ) => Promise<GitWorktreeInfo[]>
 ): Promise<GitWorktreeInfo[]> {
   if (isFolderRepo(repo)) {
     return [createFolderWorktree(repo)]
@@ -66,8 +94,8 @@ export async function listRepoWorktrees(
     return await route.provider.listWorktrees(repo.path)
   }
   return hasLocalRepoWorktreeListOptions(options)
-    ? await listWorktrees(repo.path, options)
-    : await listWorktrees(repo.path)
+    ? await listLocal(repo.path, options)
+    : await listLocal(repo.path)
 }
 
 /**
diff --git a/src/main/runtime/agent-session-acquisition-failure-settlement.ts b/src/main/runtime/agent-session-acquisition-failure-settlement.ts
index 7ad20397813..c790a149f31 100644
--- a/src/main/runtime/agent-session-acquisition-failure-settlement.ts
+++ b/src/main/runtime/agent-session-acquisition-failure-settlement.ts
@@ -4,10 +4,28 @@ import {
   type AgentSessionOperationOutcome
 } from '../../shared/agent-session-operation-ledger'
 import { nextAgentSessionFence } from '../../shared/agent-session-next-fence'
-import type { AgentSessionRecord } from '../../shared/agent-session-record'
+import type {
+  AgentSessionDeathEvidence,
+  AgentSessionRecord
+} from '../../shared/agent-session-record'
 import { assertFence, withLease } from './agent-session-lease-transitions'
 import type { AgentSessionStoreState } from './agent-session-record-store-file'
 
+/**
+ * How the failed attempt's provider process was accounted for.
+ * - `exit-proven`: cleanup observed the whole tree gone.
+ * - `root-exit-observed`: the owner root's exit was observed first-hand, so the
+ *   identity this lease is keyed on is dead, but its descendants could not be
+ *   verified. Releases the lease and says exactly that, claiming nothing more.
+ * - `processless`: the attempt failed before a process existed.
+ * - `unproven`: nothing about the process was observed; the reservation latches.
+ */
+export type AgentSessionAcquisitionExitProof =
+  | 'exit-proven'
+  | 'root-exit-observed'
+  | 'processless'
+  | 'unproven'
+
 export type AgentSessionFailedAcquisitionSettlement = {
   sessionId: string
   fence: number
@@ -15,7 +33,7 @@ export type AgentSessionFailedAcquisitionSettlement = {
   callerKey: string
   operationId: string
   outcome: Extract<AgentSessionOperationOutcome, { status: 'failed' }>
-  exitProof: 'exit-proven' | 'processless' | 'unproven'
+  exitProof: AgentSessionAcquisitionExitProof
   now: number
 }
 
@@ -83,11 +101,18 @@ export function settleFailedAgentSessionPostAcquisitionAttachment(
           claimStatus: 'released',
           lastRenewedAt: args.now,
           handoffOperationId: null,
-          deathEvidence: {
-            kind: 'exit-observed',
-            detail: 'post-acquisition cleanup proved no provider child remains',
-            observedAt: args.now
-          }
+          deathEvidence:
+            args.exitProof === 'root-exit-observed'
+              ? {
+                  kind: 'exit-observed',
+                  detail: 'the provider process exited; its descendants were not verifiable',
+                  observedAt: args.now
+                }
+              : {
+                  kind: 'exit-observed',
+                  detail: 'post-acquisition cleanup proved no provider child remains',
+                  observedAt: args.now
+                }
         })
   state.records.set(args.sessionId, next)
   state.operations = settleAgentSessionOperation(state.operations, args)
@@ -127,18 +152,29 @@ function settleFailedLease(
     claimStatus: 'released',
     lastRenewedAt: args.now,
     handoffOperationId: null,
-    deathEvidence:
-      args.exitProof === 'processless'
-        ? {
-            kind: 'pid-absent',
-            detail: 'reservation failed before spawn',
-            observedAt: args.now
-          }
-        : {
-            // Cleanup proved no child of this attempt remains; it may never have spawned.
-            kind: 'exit-observed',
-            detail: 'acquisition cleanup proved no provider child remains',
-            observedAt: args.now
-          }
+    deathEvidence: acquisitionDeathEvidence(args.exitProof, args.now)
   })
 }
+
+/** Records only what was observed: never a tree claim the cleanup did not make. */
+function acquisitionDeathEvidence(
+  exitProof: AgentSessionAcquisitionExitProof,
+  observedAt: number
+): AgentSessionDeathEvidence {
+  if (exitProof === 'processless') {
+    return { kind: 'pid-absent', detail: 'reservation failed before spawn', observedAt }
+  }
+  if (exitProof === 'root-exit-observed') {
+    return {
+      kind: 'exit-observed',
+      detail: 'the provider process exited; its descendants were not verifiable',
+      observedAt
+    }
+  }
+  // Cleanup proved no child of this attempt remains; it may never have spawned.
+  return {
+    kind: 'exit-observed',
+    detail: 'acquisition cleanup proved no provider child remains',
+    observedAt
+  }
+}
diff --git a/src/main/runtime/agent-session-launch-env-backfill.test.ts b/src/main/runtime/agent-session-launch-env-backfill.test.ts
new file mode 100644
index 00000000000..c95705f2aa5
--- /dev/null
+++ b/src/main/runtime/agent-session-launch-env-backfill.test.ts
@@ -0,0 +1,90 @@
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { AgentSessionRecordStore } from './agent-session-record-store'
+import type { AgentSessionReserveRequest } from './agent-session-reservation-admission'
+
+const NOW = 1_800_000_000_000
+const SESSION = 'session-launch-env'
+let directory: string
+
+function request(overrides: Partial<AgentSessionReserveRequest> = {}): AgentSessionReserveRequest {
+  return {
+    sessionId: SESSION,
+    location: {
+      executionHostId: 'local',
+      wslDistro: null,
+      workspaceId: 'workspace-1',
+      workspaceKind: 'git-worktree'
+    },
+    provider: 'claude',
+    accountHome: { variable: 'CLAUDE_CONFIG_DIR', path: '/home/dev/.claude' },
+    runtimeKind: 'native',
+    expectedFence: null,
+    spawnToken: 'spawn-a',
+    claimKeyId: 'key-1',
+    handoffOperationId: null,
+    probe: { outcome: 'reservation-unused' },
+    operation: {
+      callerKey: 'client-1',
+      operationId: `${NOW}-00000000000000000000000000000001`,
+      fingerprint: 'fp-1'
+    },
+    now: NOW,
+    ...overrides
+  }
+}
+
+beforeEach(async () => {
+  directory = await mkdtemp(join(tmpdir(), 'orca-agent-session-launch-env-'))
+})
+
+afterEach(async () => {
+  await rm(directory, { recursive: true, force: true })
+})
+
+describe('legacy agent session launch environment', () => {
+  it('durably pins the first environment resolved by a current reservation', async () => {
+    const store = await AgentSessionRecordStore.open({ directory, hostId: 'local' })
+    await store.reserveOwner(request())
+    await store.reserveOwner(
+      request({
+        expectedFence: 1,
+        spawnToken: 'spawn-b',
+        launchEnv: { ANTHROPIC_AUTH_TOKEN: 'pinned-token' },
+        operation: {
+          callerKey: 'client-1',
+          operationId: `${NOW}-00000000000000000000000000000002`,
+          fingerprint: 'fp-2'
+        }
+      })
+    )
+
+    const reopened = await AgentSessionRecordStore.open({ directory, hostId: 'local' })
+    expect(
+      (reopened.getRecord(SESSION) as { launchEnv?: Record<string, string> } | null)?.launchEnv
+    ).toBeUndefined()
+  })
+
+  it('rejects an environment that could not be reloaded before writing it', async () => {
+    const store = await AgentSessionRecordStore.open({ directory, hostId: 'local' })
+    const launchEnv = Object.fromEntries(
+      Array.from({ length: 257 }, (_, index) => [`KEY_${index}`, 'value'])
+    )
+
+    await expect(store.reserveOwner(request({ launchEnv }))).rejects.toThrow(
+      'agent_session_launch_env_invalid'
+    )
+    expect(store.getRecord(SESSION)).toBeNull()
+  })
+
+  it('rejects an overlong environment key before writing it', async () => {
+    const store = await AgentSessionRecordStore.open({ directory, hostId: 'local' })
+
+    await expect(
+      store.reserveOwner(request({ launchEnv: { ['K'.repeat(513)]: 'value' } }))
+    ).rejects.toThrow('agent_session_launch_env_invalid')
+    expect(store.getRecord(SESSION)).toBeNull()
+  })
+})
diff --git a/src/main/runtime/agent-session-process-identity-probe.ts b/src/main/runtime/agent-session-process-identity-probe.ts
index 51577048d31..5d441782ca8 100644
--- a/src/main/runtime/agent-session-process-identity-probe.ts
+++ b/src/main/runtime/agent-session-process-identity-probe.ts
@@ -15,7 +15,10 @@ import type {
 } from '../../shared/agent-session-lease-adjudication'
 import type { AgentSessionProcessIdentity } from '../../shared/agent-session-record'
 import { runProcess } from '../../shared/child-process/run-process'
-import { readWindowsProcessTableFresh } from '../windows/windows-process-table'
+import {
+  isWindowsProcessStartTimeAvailable,
+  readWindowsProcessIdentityTableFresh
+} from '../windows/windows-process-table'
 
 /** Start times drift by scheduler granularity and clock reads; compare with a tolerance. */
 export const PROCESS_START_TIME_TOLERANCE_MS = 2_000
@@ -111,8 +114,17 @@ async function readDarwinProcessStartTimesMs(
 }
 
 async function readWindowsProcessStartTimeMs(pid: number): Promise<number | null> {
+  // No shipped addon build exposes the creation-time flag, so without this the
+  // whole table gets scanned to produce `null` every time.
+  if (!isWindowsProcessStartTimeAvailable()) {
+    return null
+  }
   try {
-    const row = (await readWindowsProcessTableFresh()).find((candidate) => candidate.pid === pid)
+    // Identity flag set: only the creation time is read, so no command line is
+    // worth an `OpenProcess` per process here.
+    const row = (await readWindowsProcessIdentityTableFresh()).find(
+      (candidate) => candidate.pid === pid
+    )
     return row?.creationTimeMs ?? null
   } catch {
     return null
diff --git a/src/main/runtime/agent-session-record-options.test.ts b/src/main/runtime/agent-session-record-options.test.ts
index a1dfb9ccdef..5795763d96c 100644
--- a/src/main/runtime/agent-session-record-options.test.ts
+++ b/src/main/runtime/agent-session-record-options.test.ts
@@ -31,6 +31,20 @@ it('fails option hydration before ownership can be proved', async () => {
   ).rejects.toThrow('model list unavailable')
 })
 
+it('drops provider-rejected persisted options before the next owner proof', async () => {
+  await expect(
+    readNativeSessionOptions({
+      adapter: {
+        readOptions: async () => ({ models: [], current: { model: 'provider-model' } }),
+        readOptionRestoreFailures: () => ['permissionMode']
+      },
+      sessionId: SESSION,
+      fence: 2,
+      priorOptions: { permissionMode: 'retired-mode', other: 'keep' }
+    })
+  ).resolves.toEqual({ model: 'provider-model', other: 'keep' })
+})
+
 it('persists resumed provider options atomically with owner proof', async () => {
   const store = await AgentSessionRecordStore.open({ directory, hostId: 'local' })
   const reserved = await store.reserveOwner({
diff --git a/src/main/runtime/agent-session-resume-args.test.ts b/src/main/runtime/agent-session-resume-args.test.ts
new file mode 100644
index 00000000000..db4d0b07b8d
--- /dev/null
+++ b/src/main/runtime/agent-session-resume-args.test.ts
@@ -0,0 +1,33 @@
+import { describe, expect, it } from 'vitest'
+import { resolveAgentSessionResumeArgs } from './agent-session-resume-args'
+
+describe('agent session resume arguments', () => {
+  it('keeps the session creation arguments after mutable defaults change', () => {
+    expect(
+      resolveAgentSessionResumeArgs({
+        persistedArgs: ['--model', 'claude-created'],
+        defaultArgs: '--model claude-current',
+        shell: 'posix'
+      })
+    ).toBe("'--model' 'claude-created'")
+  })
+
+  it('keeps an explicit empty snapshot when defaults are toggled off', () => {
+    expect(
+      resolveAgentSessionResumeArgs({
+        persistedArgs: [],
+        defaultArgs: '--dangerously-skip-permissions',
+        shell: 'posix'
+      })
+    ).toBe('')
+  })
+
+  it('uses current defaults for legacy records without a snapshot', () => {
+    expect(
+      resolveAgentSessionResumeArgs({
+        defaultArgs: '--dangerously-skip-permissions',
+        shell: 'posix'
+      })
+    ).toBe('--dangerously-skip-permissions')
+  })
+})
diff --git a/src/main/runtime/agent-session-resume-args.ts b/src/main/runtime/agent-session-resume-args.ts
new file mode 100644
index 00000000000..dc276726dc6
--- /dev/null
+++ b/src/main/runtime/agent-session-resume-args.ts
@@ -0,0 +1,17 @@
+import type { AgentSessionLaunchArgs } from '../../shared/agent-session-record'
+import { quoteStartupArg, type AgentStartupShell } from '../../shared/tui-agent-startup-shell'
+
+export function resolveAgentSessionResumeArgs(input: {
+  requestArgs?: string | null
+  persistedArgs?: AgentSessionLaunchArgs
+  defaultArgs?: string | null
+  shell: AgentStartupShell
+}): string | null | undefined {
+  if (input.requestArgs !== undefined) {
+    return input.requestArgs
+  }
+  if (input.persistedArgs !== undefined) {
+    return input.persistedArgs.map((arg) => quoteStartupArg(arg, input.shell)).join(' ')
+  }
+  return input.defaultArgs
+}
diff --git a/src/main/runtime/claude-structured-session-integration.test.ts b/src/main/runtime/claude-structured-session-integration.test.ts
new file mode 100644
index 00000000000..e9cba45ffa9
--- /dev/null
+++ b/src/main/runtime/claude-structured-session-integration.test.ts
@@ -0,0 +1,786 @@
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { computeAgentSessionPayloadFingerprint } from '../../shared/agent-session-mutation-envelope'
+import type { AgentJournalRenderItem } from '../../shared/agent-session-journal-types'
+import type { AgentSessionSubscribeEvent } from '../../shared/agent-session-wire'
+import { STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY } from '../../shared/protocol-version'
+import type {
+  ClaudeStreamJsonConnection,
+  ClaudeStreamJsonConnectionHandlers,
+  ClaudeStreamJsonLaunch,
+  openClaudeStreamJsonConnection
+} from '../claude/claude-stream-json-connection'
+import { claudeSessionIdForOrcaSession } from '../claude/claude-structured-launch-resolution'
+import {
+  CLAUDE_SPAWN_TOKEN_ENV,
+  claudeProviderHandleLink
+} from '../claude/claude-structured-owner-identity'
+import { attachFingerprintFields } from '../native-chat/agent-session-wire/structured-agent-session-attach'
+import { getStructuredAgentSessionHost } from '../native-chat/agent-session-wire/structured-agent-session-registry'
+import type {
+  StructuredAgentSessionHandoffTransport,
+  StructuredTuiOwner
+} from '../native-chat/agent-session-wire/structured-agent-session-handoff-types'
+import type { OrcaRuntimeService } from './orca-runtime'
+import type { RpcRequest, RpcResponse } from './rpc/core'
+import type { ClaudeStructuredAuthPolicy } from '../claude-accounts/claude-structured-auth-policy'
+import { RpcDispatcher } from './rpc/dispatcher'
+import { STRUCTURED_AGENT_SESSION_METHODS } from './rpc/methods/structured-agent-session'
+import {
+  ensureStructuredAgentSessionHost,
+  stopStructuredAgentSessionRuntime,
+  waitForStructuredAgentSessionRecovery
+} from './structured-agent-session-runtime'
+
+const SESSION = 'claude-integration-1'
+const PROVIDER_SESSION = claudeSessionIdForOrcaSession(SESSION)
+const WORKSPACE = 'workspace-claude'
+// Why 'runtime': this file exercises the Claude structured integration over agentSession.*, not the
+// mobile surface — nothing here asserts anything mobile-specific, and its sibling integration
+// suites use 'runtime' too. Mobile additionally requires the experimental structured-chat setting,
+// which structured-agent-session.test.ts pins in both its satisfied and refused states.
+const CLIENT = {
+  clientKind: 'runtime' as const,
+  clientCapabilities: [STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY]
+}
+
+const { readClaudeTranscriptLeafUuid, resolveSessionFilePath } = vi.hoisted(() => ({
+  readClaudeTranscriptLeafUuid: vi.fn(),
+  resolveSessionFilePath: vi.fn()
+}))
+
+vi.mock('../native-chat/session-file-resolver', () => ({
+  readClaudeTranscriptLeafUuid,
+  resolveSessionFilePath
+}))
+
+type FakeClaudeConnection = Omit<ClaudeStreamJsonConnection, 'closed' | 'exitVerdict'> & {
+  closed: boolean
+  exitVerdict: ClaudeStreamJsonConnection['exitVerdict']
+  launch: ClaudeStreamJsonLaunch
+  handlers: ClaudeStreamJsonConnectionHandlers
+  calls: { subtype: string; params?: Record<string, unknown> }[]
+  sent: Record<string, unknown>[]
+}
+
+function fakeClaude() {
+  const connections: FakeClaudeConnection[] = []
+  let initializeAccount: unknown
+  /** A child that dies during start, with the close verdict its ladder observed. */
+  let selfExit: { message: string; exitVerdict: ClaudeStreamJsonConnection['exitVerdict'] } | null =
+    null
+  const openConnection = (async (launch, handlers = {}) => {
+    const connection: FakeClaudeConnection = {
+      launch,
+      handlers,
+      calls: [],
+      sent: [],
+      pid: 4321 + connections.length,
+      closed: false,
+      initializationResult: async () => {
+        connection.calls.push({ subtype: 'initialize' })
+        if (selfExit) {
+          handlers.onExit?.(new Error(selfExit.message))
+          return { models: [] }
+        }
+        handlers.onMessage?.({
+          type: 'system',
+          subtype: 'init',
+          session_id: PROVIDER_SESSION,
+          ...(connections.length === 0 ? { uuid: 'init-leaf' } : {}),
+          model: 'claude-sonnet-5',
+          apiKeySource: 'none'
+        })
+        return {
+          models: [{ value: 'sonnet', displayName: 'Sonnet' }],
+          ...(initializeAccount === undefined ? {} : { account: initializeAccount })
+        }
+      },
+      getSettings: async () => {
+        connection.calls.push({ subtype: 'get_settings' })
+        return { env: {} }
+      },
+      supportedModels: async () => {
+        connection.calls.push({ subtype: 'list_models' })
+        return [{ value: 'sonnet', displayName: 'Sonnet' }]
+      },
+      setModel: async (model) => {
+        connection.calls.push({ subtype: 'set_model', params: { model } })
+      },
+      setPermissionMode: async (mode) => {
+        connection.calls.push({ subtype: 'set_permission_mode', params: { mode } })
+      },
+      applyFlagSettings: async (settings) => {
+        connection.calls.push({ subtype: 'apply_flag_settings', params: { settings } })
+      },
+      interrupt: async () => {
+        connection.calls.push({ subtype: 'interrupt', params: {} })
+        return undefined
+      },
+      cancelAsyncMessage: async () => {},
+      stopTask: async (taskId) => {
+        connection.calls.push({ subtype: 'stop_task', params: { taskId } })
+      },
+      send: async (message) => {
+        connection.sent.push(message)
+        if (message.type === 'user') {
+          handlers.onMessage?.({ ...message, uuid: 'user-1' })
+        }
+      },
+      exitVerdict: selfExit?.exitVerdict ?? { root: 'live', tree: 'unverifiable' },
+      close: async () => {
+        connection.closed = true
+        return selfExit === null
+      }
+    }
+    connections.push(connection)
+    return connection
+  }) as typeof openClaudeStreamJsonConnection
+  const live = (): FakeClaudeConnection => {
+    const connection = connections.at(-1)
+    if (!connection) {
+      throw new Error('no Claude connection')
+    }
+    return connection
+  }
+  return {
+    connections,
+    openConnection,
+    live,
+    setInitializeAccount: (account: unknown) => {
+      initializeAccount = account
+    },
+    setSelfExit: (exit: typeof selfExit) => {
+      selfExit = exit
+    }
+  }
+}
+
+let operations = 0
+// Keep IDs unique without making each assertion depend on a wall-clock tick.
+const TEST_OPERATION_TIMESTAMP = Date.now().toString()
+
+function operationId(): string {
+  operations += 1
+  return `${TEST_OPERATION_TIMESTAMP}-${operations.toString(16).padStart(32, '0')}`
+}
+
+function envelope(method: string, fields: Record<string, unknown>, fence: number | null) {
+  return {
+    sessionId: SESSION,
+    clientOperationId: operationId(),
+    expectedRuntimeFence: fence,
+    payloadFingerprint: computeAgentSessionPayloadFingerprint({
+      method,
+      sessionId: SESSION,
+      fields
+    })
+  }
+}
+
+function createIntentParams() {
+  const worktree = `id:${WORKSPACE}`
+  const fields = { worktree, agent: 'claude' }
+  return { envelope: envelope('agentSession.create', fields, null), ...fields }
+}
+
+function ensureParams(fence: number) {
+  const params = {
+    location: {
+      executionHostId: 'local',
+      wslDistro: null,
+      workspaceId: WORKSPACE,
+      workspaceKind: 'git-worktree' as const
+    },
+    provider: 'claude' as const,
+    agent: 'claude',
+    accountHome: { variable: 'CLAUDE_CONFIG_DIR' as const, path: join(root, 'claude-home') },
+    runtimeKind: 'native' as const,
+    providerHandle: {
+      kind: 'claude' as const,
+      sessionId: PROVIDER_SESSION,
+      leafUuid: 'assistant-leaf'
+    }
+  }
+  const base = {
+    sessionId: SESSION,
+    clientOperationId: operationId(),
+    expectedRuntimeFence: fence,
+    payloadFingerprint: ''
+  }
+  return {
+    ...params,
+    envelope: {
+      ...base,
+      payloadFingerprint: computeAgentSessionPayloadFingerprint({
+        method: 'agentSession.attach',
+        sessionId: SESSION,
+        fields: attachFingerprintFields({ ...params, envelope: base } as never)
+      })
+    }
+  }
+}
+
+function leaseOf(sessionId: string): {
+  claimStatus: string
+  runtimeFence: number
+  handoffStage: string | null
+  deathEvidence: { kind: string; detail: string } | null
+} {
+  const host = getStructuredAgentSessionHost() as unknown as {
+    deps: { store: { getRecord: (id: string) => { lease: ReturnType<typeof leaseOf> } } }
+  }
+  return host.deps.store.getRecord(sessionId).lease
+}
+
+function handoffParams(direction: 'to-native' | 'to-tui', fence: number) {
+  const fields = { direction, mode: 'now' as const, action: 'start' as const }
+  return {
+    envelope: envelope('agentSession.requestHandoff', fields, fence),
+    ...fields
+  }
+}
+
+let claude: ReturnType<typeof fakeClaude>
+let root: string
+let dispatcher: RpcDispatcher
+let cleanups: Map<string, () => void>
+let tuiOwner: StructuredTuiOwner | null
+let transcriptPath: string
+/** Managed-account state and configured overlay this host installs, per test. */
+let claudeAuthPolicy: ClaudeStructuredAuthPolicy
+let claudeLaunchEnv: Record<string, string>
+
+async function call(method: string, params: unknown): Promise<RpcResponse> {
+  const replies: RpcResponse[] = []
+  const request: RpcRequest = { id: `req-${operations}`, authToken: 'token', method, params }
+  await dispatcher.dispatchStreaming(request, (raw) => replies.push(JSON.parse(raw)), CLIENT)
+  if (!replies[0]) {
+    throw new Error(`no reply for ${method}`)
+  }
+  return replies[0]
+}
+
+async function ok<T>(method: string, params: unknown): Promise<T> {
+  const response = await call(method, params)
+  expect(response, JSON.stringify(response)).toMatchObject({ ok: true })
+  const result = (response as { result: { ok: boolean; value?: T } }).result
+  expect(result).toMatchObject({ ok: true })
+  return result.value as T
+}
+
+async function subscribe(): Promise<AgentSessionSubscribeEvent[]> {
+  const frames: AgentSessionSubscribeEvent[] = []
+  await dispatcher.dispatchStreaming(
+    {
+      id: 'subscribe-1',
+      authToken: 'token',
+      method: 'agentSession.subscribe',
+      params: { sessionId: SESSION }
+    },
+    (raw) => {
+      const response = JSON.parse(raw) as { ok: boolean; result?: AgentSessionSubscribeEvent }
+      if (response.ok && response.result) {
+        frames.push(response.result)
+      }
+    },
+    CLIENT
+  )
+  return frames
+}
+
+function itemsOf(frames: AgentSessionSubscribeEvent[]): AgentJournalRenderItem[] {
+  const items = new Map<string, AgentJournalRenderItem>()
+  for (const frame of frames) {
+    const rows =
+      frame.type === 'snapshot' || frame.type === 'reset'
+        ? frame.page.items
+        : frame.type === 'batch'
+          ? frame.batch.items
+          : []
+    for (const row of rows) {
+      items.set(row.itemId, row)
+    }
+  }
+  return [...items.values()]
+}
+
+function textOf(item: AgentJournalRenderItem): string {
+  return item.body?.kind === 'message'
+    ? item.body.blocks.map((block) => (block.type === 'text' ? block.text : '')).join('')
+    : ''
+}
+
+beforeEach(async () => {
+  operations = 0
+  claudeAuthPolicy = { stripAuthEnv: false }
+  claudeLaunchEnv = {
+    ANTHROPIC_AUTH_TOKEN: 'configured-token',
+    ANTHROPIC_BASE_URL: 'https://gateway.example.test'
+  }
+  root = await mkdtemp(join(tmpdir(), 'orca-claude-structured-integration-'))
+  transcriptPath = join(root, 'claude-home', 'projects', 'workspace', `${PROVIDER_SESSION}.jsonl`)
+  await mkdir(join(root, 'claude-home', 'projects', 'workspace'), { recursive: true })
+  resolveSessionFilePath.mockResolvedValue(transcriptPath)
+  // The production branch proof returns the latest descendant of the prior
+  // cursor; mirror that contract so structured close does not regress to a
+  // stale mocked head.
+  readClaudeTranscriptLeafUuid.mockImplementation(
+    async (_path: string, _providerSessionId: string, previousLeafUuid?: string | null) =>
+      previousLeafUuid ?? 'init-leaf'
+  )
+  claude = fakeClaude()
+  tuiOwner = null
+  cleanups = new Map()
+  const handoffTransport: StructuredAgentSessionHandoffTransport = {
+    hostLabel: 'Scripted Claude host',
+    launchTui: async ({ record, fence, spawnToken }) => {
+      const head = record.providerHandleChain.at(-1)?.handle
+      tuiOwner = {
+        terminal: {
+          handle: 'term-claude-tui',
+          tabId: 'tab-claude-tui',
+          paneKey: 'tab-claude-tui:leaf-claude-tui',
+          ptyId: 'pty-claude-tui'
+        },
+        process: {
+          hostId: 'local',
+          pid: 7331,
+          processStartTimeMs: 100,
+          spawnToken
+        },
+        link: claudeProviderHandleLink({
+          sessionId: PROVIDER_SESSION,
+          leafUuid: head?.provider === 'claude' ? head.leafUuid : null,
+          resumed: true,
+          fence,
+          observedAt: 1
+        }),
+        transcriptPath
+      }
+      return tuiOwner
+    },
+    reproveTuiOwner: async ({ owner }) => {
+      if (owner.link.handle.provider !== 'claude' || !owner.transcriptPath) {
+        return owner
+      }
+      return {
+        ...owner,
+        link: claudeProviderHandleLink({
+          sessionId: owner.link.handle.sessionId,
+          leafUuid: await readClaudeTranscriptLeafUuid(owner.transcriptPath),
+          resumed: true,
+          fence: owner.link.mintedAtFence,
+          observedAt: 1
+        })
+      }
+    },
+    recoverTuiOwner: async () => {
+      if (!tuiOwner) {
+        throw new Error('scripted TUI owner missing')
+      }
+      return tuiOwner
+    },
+    stopRecoveredOwner: async () => {},
+    waitForTuiExit: async (owner) => ({ transcriptPath: owner.transcriptPath }),
+    waitForTuiIdleOrExit: async () => 'idle',
+    tuiStatus: () => 'idle',
+    stopFailedTuiLaunch: async () => {}
+  }
+  const runtime = {
+    getRuntimeId: () => 'runtime-1',
+    getStructuredAgentSessionCreateSupport: async () => ({ supported: true }),
+    resolveStructuredAgentSessionCreateIntent: async (input: { envelope: unknown }) => ({
+      ...ensureParams(1),
+      envelope: input.envelope,
+      providerHandle: undefined
+    }),
+    publishStructuredAgentSessionTab: vi.fn(),
+    ensureStructuredAgentSessionHost: () =>
+      ensureStructuredAgentSessionHost({
+        stateDirectory: root,
+        hostId: 'local',
+        claimKeyId: 'key-1',
+        resolveWorkspacePath: async (workspaceId) => `/repos/${workspaceId}`,
+        resolveCodexCommand: () => '/usr/local/bin/codex',
+        resolveClaudeCommand: () => '/usr/local/bin/claude',
+        readProcessStartTime: async (pid: number) => pid * 10,
+        resolveClaudeLaunchEnv: () => claudeLaunchEnv,
+        resolveClaudeAuthPolicy: () => claudeAuthPolicy,
+        openClaudeConnection: claude.openConnection,
+        handoffTransport
+      }).then(() => undefined),
+    registerSubscriptionCleanup: (id: string, dispose: () => void) => cleanups.set(id, dispose),
+    cleanupSubscription: (id: string) => cleanups.get(id)?.(),
+    cleanupSubscriptionsByPrefix: () => {}
+  }
+  dispatcher = new RpcDispatcher({
+    runtime: runtime as unknown as OrcaRuntimeService,
+    methods: STRUCTURED_AGENT_SESSION_METHODS
+  })
+})
+
+afterEach(async () => {
+  vi.unstubAllEnvs()
+  await stopStructuredAgentSessionRuntime()
+  await rm(root, { recursive: true, force: true })
+})
+
+describe('a structured Claude session over agentSession.*', () => {
+  it('strips ambient Anthropic auth from the child once a managed account is pinned', async () => {
+    claudeAuthPolicy = { stripAuthEnv: true }
+    claudeLaunchEnv = { ANTHROPIC_BASE_URL: 'https://gateway.example.test' }
+    vi.stubEnv('ANTHROPIC_API_KEY', 'sk-ant-SHELL-LEAK')
+    vi.stubEnv('ANTHROPIC_AUTH_TOKEN', 'tok-SHELL-LEAK')
+
+    await ok<{ fence: number }>('agentSession.create', createIntentParams())
+
+    const env = claude.live().launch.env
+    expect(env).not.toHaveProperty('ANTHROPIC_API_KEY')
+    expect(env).not.toHaveProperty('ANTHROPIC_AUTH_TOKEN')
+    expect(env).toMatchObject({
+      ANTHROPIC_BASE_URL: 'https://gateway.example.test',
+      CLAUDE_CONFIG_DIR: join(root, 'claude-home')
+    })
+  })
+
+  it('refuses a create whose configured env overrides the pinned managed account auth', async () => {
+    claudeAuthPolicy = { stripAuthEnv: true }
+    // The default overlay carries ANTHROPIC_AUTH_TOKEN, which the terminal path
+    // refuses at spawn-env.ts:25 rather than letting it beat the pinned account.
+    const refused = await call('agentSession.create', createIntentParams())
+
+    expect(JSON.stringify(refused)).toContain('explicit Anthropic auth environment')
+    // Refused before spawn: no provider child was ever opened.
+    expect(claude.connections).toHaveLength(0)
+  })
+
+  it('durably returns actionable sign-in guidance when initialization has no credentials', async () => {
+    claude.setInitializeAccount({ apiProvider: 'firstParty', tokenSource: 'none' })
+    const params = createIntentParams()
+
+    const first = await call('agentSession.create', params)
+    const retry = await call('agentSession.create', params)
+
+    expect(first).toMatchObject({
+      ok: true,
+      result: {
+        ok: false,
+        refusal: {
+          code: 'agent_session_operation_invalid',
+          message: expect.stringMatching(/not signed in.*Claude CLI.*CLAUDE_CONFIG_DIR/s)
+        }
+      }
+    })
+    expect((retry as { result: unknown }).result).toEqual((first as { result: unknown }).result)
+    expect(claude.connections).toHaveLength(1)
+  })
+
+  it('releases a session whose CLI self-exited during create, with its diagnostic intact', async () => {
+    claude.setSelfExit({
+      message: 'claude stream-json exited (code 1): claude: not signed in',
+      // The root's death is first-hand; its descendants were never snapshottable.
+      exitVerdict: { root: 'exited', tree: 'unverifiable' }
+    })
+
+    const failed = await call('agentSession.create', createIntentParams())
+
+    expect(JSON.stringify(failed)).toContain('claude: not signed in')
+    const lease = leaseOf(SESSION)
+    // Latching here would refuse every later attach with agent_session_ownership_unknown,
+    // wedging a user who only needs to sign in.
+    expect(lease).toMatchObject({ claimStatus: 'released', handoffStage: null })
+    expect(lease.deathEvidence).toMatchObject({
+      kind: 'exit-observed',
+      detail: 'the provider process exited; its descendants were not verifiable'
+    })
+
+    claude.setSelfExit(null)
+    // Signing in and reopening the chat works: the reservation was not latched.
+    await ok<{ fence: number }>('agentSession.ensure', ensureParams(lease.runtimeFence))
+  })
+
+  it('keeps a session reserved when a descendant of the failed start was seen alive', async () => {
+    claude.setSelfExit({
+      message: 'claude stream-json exited (code 1): claude: not signed in',
+      exitVerdict: { root: 'exited', tree: 'live' }
+    })
+
+    await call('agentSession.create', createIntentParams())
+
+    // A live descendant still holds the provider session: releasing would hand a
+    // second writer to it.
+    expect(leaseOf(SESSION)).toMatchObject({
+      claimStatus: 'reserved',
+      handoffStage: 'manual-recovery'
+    })
+    claude.setSelfExit(null)
+  })
+
+  it('routes a published Claude first-hand exit through fenced host reconciliation', async () => {
+    await ok<{ fence: number }>('agentSession.create', createIntentParams())
+    const connection = claude.live()
+    connection.exitVerdict = { root: 'exited', tree: 'unverifiable' }
+    connection.handlers.onExit?.(new Error('claude stream-json exited (code 1): crashed'))
+
+    // Claude publishes an exit only after its close ladder and transcript write,
+    // so the recovery barrier — not a wall-clock poll — is what says it landed.
+    await waitForStructuredAgentSessionRecovery()
+    expect(leaseOf(SESSION)).toMatchObject({ claimStatus: 'released', handoffStage: null })
+  })
+
+  it('creates, sends, streams, approves, interrupts, and resumes from the chain head', async () => {
+    vi.stubEnv('ANTHROPIC_API_KEY', 'sk-ant-SHELL-LEAK')
+    const created = await ok<{ fence: number }>('agentSession.create', createIntentParams())
+    expect(claude.live().launch.options).toMatchObject({ sessionId: PROVIDER_SESSION })
+    expect(claude.live().launch.options.resume).toBeUndefined()
+    expect(claude.live().launch.env).toMatchObject({
+      ANTHROPIC_AUTH_TOKEN: 'configured-token',
+      ANTHROPIC_BASE_URL: 'https://gateway.example.test',
+      CLAUDE_CONFIG_DIR: join(root, 'claude-home'),
+      [CLAUDE_SPAWN_TOKEN_ENV]: expect.any(String)
+    })
+    // System auth: the user's own shell key is their sign-in, exactly as on the
+    // terminal path, and the configured overlay still wins over it.
+    expect(claude.live().launch.env).toMatchObject({ ANTHROPIC_API_KEY: 'sk-ant-SHELL-LEAK' })
+    expect(claude.live().launch.env?.PATH ?? claude.live().launch.env?.Path).toBeTruthy()
+    const history = await call('agentSession.history', {
+      sessionId: SESSION,
+      direction: 'tail',
+      limit: 1
+    })
+    expect(history).toMatchObject({
+      ok: true,
+      result: { providerSession: { key: 'session_id', id: PROVIDER_SESSION } }
+    })
+    const stream = await subscribe()
+
+    const body = { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'List files' }] }
+    const sent = await ok<{
+      submission: { dispatchState: string; providerItemId: string | null }
+    }>('agentSession.send', {
+      envelope: envelope('agentSession.send', { body }, created.fence),
+      body
+    })
+    expect(sent.submission).toMatchObject({
+      dispatchState: 'accepted',
+      providerItemId: `claude:${PROVIDER_SESSION}:user-1`
+    })
+
+    claude.live().handlers.onMessage?.({
+      type: 'stream_event',
+      session_id: PROVIDER_SESSION,
+      uuid: 'assistant-leaf',
+      event: { type: 'content_block_delta', delta: { type: 'text_delta', text: 'Two files.' } }
+    })
+    claude.live().handlers.onMessage?.({
+      type: 'assistant',
+      session_id: PROVIDER_SESSION,
+      uuid: 'assistant-leaf',
+      parent_tool_use_id: null,
+      message: { role: 'assistant', content: [{ type: 'text', text: 'Two files.' }] }
+    })
+    claude.live().handlers.onMessage?.({
+      type: 'result',
+      subtype: 'success',
+      session_id: PROVIDER_SESSION,
+      uuid: 'result-frame-uuid'
+    })
+    claude.live().handlers.onMessage?.({
+      type: 'stream_event',
+      session_id: PROVIDER_SESSION,
+      uuid: 'stream-event-frame-uuid',
+      event: { type: 'message_stop' }
+    })
+    await getStructuredAgentSessionHost()?.flushStreamedEvents(SESSION)
+    expect(itemsOf(stream).find((item) => textOf(item) === 'Two files.')?.itemId).toBe(
+      `claude:${PROVIDER_SESSION}:assistant-leaf`
+    )
+
+    claude.live().handlers.onMessage?.({
+      type: 'system',
+      subtype: 'background_tasks_changed',
+      session_id: PROVIDER_SESSION,
+      uuid: 'background-roster',
+      tasks: [
+        { task_id: 'task-one', task_type: 'local_agent', description: 'First task' },
+        { task_id: 'task-two', task_type: 'local_bash', description: 'Second task' }
+      ]
+    })
+    const itemsBeforeTaskStop = itemsOf(stream)
+    const targetedStopFields = {
+      turnId: 'background-tasks',
+      scope: 'background-tasks',
+      taskId: 'task-two'
+    }
+    await expect(
+      ok('agentSession.cancel', {
+        envelope: envelope('agentSession.cancel', targetedStopFields, created.fence),
+        ...targetedStopFields
+      })
+    ).resolves.toMatchObject({ turnId: 'background-tasks', cancelled: true })
+    expect(claude.live().calls.filter((entry) => entry.subtype === 'stop_task')).toEqual([
+      { subtype: 'stop_task', params: { taskId: 'task-two' } }
+    ])
+    expect(itemsOf(stream)).toEqual(itemsBeforeTaskStop)
+
+    const staleStopFields = {
+      turnId: 'background-tasks',
+      scope: 'background-tasks',
+      taskId: 'task-stale'
+    }
+    await expect(
+      ok('agentSession.cancel', {
+        envelope: envelope('agentSession.cancel', staleStopFields, created.fence),
+        ...staleStopFields
+      })
+    ).resolves.toMatchObject({ turnId: 'background-tasks', cancelled: false })
+    expect(claude.live().calls.filter((entry) => entry.subtype === 'stop_task')).toHaveLength(1)
+
+    const answeredPermission = Promise.resolve(
+      claude.live().handlers.canUseTool?.('Bash', { command: 'ls' }, {
+        requestId: 'permission-1',
+        toolUseID: 'tool-1',
+        signal: new AbortController().signal
+      } as never)
+    )
+    await getStructuredAgentSessionHost()?.flushStreamedEvents(SESSION)
+    const approval = itemsOf(stream).find((item) => item.body?.kind === 'approval')
+    expect(approval?.body).toMatchObject({ title: 'Allow Bash?', detail: '{"command":"ls"}' })
+    await ok('agentSession.respondToApproval', {
+      envelope: envelope(
+        'agentSession.respondTo:approval',
+        {
+          itemId: approval?.itemId,
+          expectedRevision: approval?.revision,
+          optionId: 'allow'
+        },
+        created.fence
+      ),
+      itemId: approval?.itemId,
+      expectedRevision: approval?.revision,
+      optionId: 'allow'
+    })
+    // Answering resolves the SDK's own canUseTool callback with the allow decision.
+    await expect(answeredPermission).resolves.toMatchObject({
+      behavior: 'allow',
+      toolUseID: 'tool-1'
+    })
+
+    await expect(
+      ok('agentSession.cancel', {
+        envelope: envelope('agentSession.cancel', { turnId: 'user-1' }, created.fence),
+        turnId: 'user-1'
+      })
+    ).resolves.toMatchObject({ turnId: 'user-1', cancelled: true })
+    expect(claude.live().calls.at(-1)).toMatchObject({ subtype: 'interrupt' })
+
+    const host = getStructuredAgentSessionHost() as unknown as {
+      deps: {
+        store: {
+          getRecord: (sessionId: string) => {
+            providerHandleChain: { handle: { provider: string; leafUuid?: string | null } }[]
+          }
+        }
+      }
+    }
+    expect(host.deps.store.getRecord(SESSION).providerHandleChain.at(-1)?.handle).toMatchObject({
+      provider: 'claude',
+      leafUuid: null
+    })
+    const old = claude.live()
+    const resumed = await ok<{ fence: number }>('agentSession.ensure', ensureParams(created.fence))
+    expect(resumed.fence).toBe(created.fence + 1)
+    expect(old.closed).toBe(true)
+    expect(resolveSessionFilePath).toHaveBeenCalledWith('claude', PROVIDER_SESSION, {
+      claudeProjectsDir: join(root, 'claude-home', 'projects')
+    })
+    expect(claude.live().launch.options).toMatchObject({
+      resume: PROVIDER_SESSION,
+      resumeSessionAt: 'assistant-leaf'
+    })
+    expect(host.deps.store.getRecord(SESSION).providerHandleChain.at(-1)).toMatchObject({
+      handle: {
+        provider: 'claude',
+        sessionId: PROVIDER_SESSION,
+        leafUuid: 'assistant-leaf'
+      },
+      origin: 'resumed'
+    })
+  })
+
+  it('completes a scripted native to TUI to native cycle with provider-history rehydration', async () => {
+    const created = await ok<{ fence: number }>('agentSession.create', createIntentParams())
+    await writeFile(
+      transcriptPath,
+      [
+        {
+          type: 'user',
+          uuid: 'native-user',
+          message: { role: 'user', content: [{ type: 'text', text: 'NATIVE_USER' }] }
+        },
+        {
+          type: 'assistant',
+          uuid: 'native-assistant',
+          message: { role: 'assistant', content: [{ type: 'text', text: 'NATIVE_ASSISTANT' }] }
+        },
+        {
+          type: 'user',
+          uuid: 'tui-user',
+          message: { role: 'user', content: [{ type: 'text', text: 'TUI_USER' }] }
+        },
+        {
+          type: 'assistant',
+          uuid: 'tui-assistant',
+          message: { role: 'assistant', content: [{ type: 'text', text: 'TUI_ASSISTANT' }] }
+        },
+        { type: 'last-prompt', leafUuid: 'tui-assistant' }
+      ]
+        .map((entry) => JSON.stringify(entry))
+        .join('\n')
+    )
+
+    await ok('agentSession.requestHandoff', handoffParams('to-tui', created.fence))
+    const host = getStructuredAgentSessionHost()!
+    // No poll: the request enqueues the flow on the session's serialized chain before it returns,
+    // so this status read is already ordered behind it. Polling only added a wall-clock deadline
+    // that a loaded runner missed, abandoning a live flow into the suite's teardown.
+    expect(await host.handoffStatus(SESSION)).toMatchObject({ owner: 'tui', phase: 'idle' })
+    expect(claude.connections[0]?.closed).toBe(true)
+
+    const tuiFence = (
+      host as unknown as {
+        deps: { store: { getRecord: (id: string) => { lease: { runtimeFence: number } } } }
+      }
+    ).deps.store.getRecord(SESSION).lease.runtimeFence
+    readClaudeTranscriptLeafUuid.mockResolvedValueOnce('tui-assistant')
+    await ok('agentSession.requestHandoff', handoffParams('to-native', tuiFence))
+    expect(await host.handoffStatus(SESSION)).toMatchObject({ owner: 'native', phase: 'idle' })
+
+    const frames = await subscribe()
+    const texts = itemsOf(frames).map(textOf).filter(Boolean)
+    expect(texts).toEqual(
+      expect.arrayContaining(['NATIVE_USER', 'NATIVE_ASSISTANT', 'TUI_USER', 'TUI_ASSISTANT'])
+    )
+    expect(new Set(texts).size).toBe(texts.length)
+    expect(claude.connections).toHaveLength(2)
+    expect(claude.live().launch.options).toMatchObject({ resume: PROVIDER_SESSION })
+    const record = (
+      host as unknown as {
+        deps: {
+          store: {
+            getRecord: (id: string) => {
+              providerHandleChain: { handle: { provider: string; leafUuid?: string | null } }[]
+            }
+          }
+        }
+      }
+    ).deps.store.getRecord(SESSION)
+    expect(record.providerHandleChain.at(-1)?.handle).toMatchObject({
+      provider: 'claude',
+      leafUuid: 'tui-assistant'
+    })
+  })
+})
diff --git a/src/main/runtime/device-registry.ts b/src/main/runtime/device-registry.ts
index b5f0c7a6c8d..b2d5de8ef41 100644
--- a/src/main/runtime/device-registry.ts
+++ b/src/main/runtime/device-registry.ts
@@ -5,7 +5,11 @@
 import { randomBytes, randomUUID } from 'node:crypto'
 import { existsSync, readFileSync } from 'node:fs'
 import { join } from 'node:path'
-import { hardenExistingSecureFile, writeSecureJsonFile } from '../../shared/secure-file'
+import {
+  hardenExistingSecureFile,
+  isUnreadableError,
+  writeSecureJsonFile
+} from '../../shared/secure-file'
 import type { DeviceScope } from '../../shared/runtime-types'
 import { DEVICE_REGISTRY_FILENAME } from './mobile-pairing-files'
 import type { RelayDeviceBinding } from './relay/relay-revoke-outbox'
@@ -54,6 +58,8 @@ const LAST_SEEN_FLUSH_DELAY_MS = 250
 export class DeviceRegistry {
   private readonly registryPath: string
   private devices: DeviceEntry[] = []
+  /** Set when the registry exists but could not be read, which makes `devices` a lie to save from. */
+  private registryUnreadable = false
   private pendingLastSeenFlush: NodeJS.Timeout | null = null
 
   constructor(userDataPath: string) {
@@ -293,12 +299,21 @@ export class DeviceRegistry {
         // LAN links), so a missing value must keep binding every interface on reconnect.
         pairingReach: device.pairingReach === 'this-computer' ? 'this-computer' : 'network'
       }))
-    } catch {
+      this.registryUnreadable = false
+    } catch (error) {
+      // "Cannot read" is not "is empty". Saving an empty list over a registry we were merely
+      // denied would erase every paired device's bearer token, and the write would succeed.
+      this.registryUnreadable = isUnreadableError(error)
       this.devices = []
     }
   }
 
   private save(devices: DeviceEntry[]): void {
+    if (this.registryUnreadable) {
+      throw new Error(
+        `Cannot read the device registry at ${this.registryPath}: the read failed. Refusing to overwrite it, which would revoke every paired device.`
+      )
+    }
     writeSecureJsonFile(this.registryPath, devices)
     // Why: every registry save includes the latest in-memory timestamps, so a later timer would rewrite it.
     this.cancelPendingLastSeenFlush()
diff --git a/src/main/runtime/e2ee-keypair.ts b/src/main/runtime/e2ee-keypair.ts
index 3e8b3e0aa0a..9ffb9844e86 100644
--- a/src/main/runtime/e2ee-keypair.ts
+++ b/src/main/runtime/e2ee-keypair.ts
@@ -4,7 +4,11 @@
 import { existsSync, readFileSync, statSync } from 'node:fs'
 import { join } from 'node:path'
 import nacl from 'tweetnacl'
-import { hardenExistingSecureFile, writeSecureJsonFile } from '../../shared/secure-file'
+import {
+  hardenExistingSecureFile,
+  isUnreadableError,
+  writeSecureJsonFile
+} from '../../shared/secure-file'
 import { E2EE_KEYPAIR_FILENAME } from './mobile-pairing-files'
 
 const KEYPAIR_FILENAME = E2EE_KEYPAIR_FILENAME
@@ -42,7 +46,17 @@ export function loadOrCreateE2EEKeypair(userDataPath: string): E2EEKeypair {
           return { publicKey, secretKey, publicKeyB64: raw.publicKeyB64 }
         }
       }
-    } catch {
+    } catch (error) {
+      // A read this process is not permitted to make says nothing about the contents. Falling
+      // through would overwrite the only copy of the secret key — and the overwrite succeeds, so
+      // nothing downstream stops it. Every paired device derives its shared secret from this key,
+      // so regenerating silently un-pairs all of them and no old message stays decryptable.
+      if (isUnreadableError(error)) {
+        throw new Error(
+          `Cannot read the E2EE keypair at ${filePath}: the read failed. Refusing to regenerate it, which would invalidate every paired device.`,
+          { cause: error }
+        )
+      }
       // Malformed file — regenerate below.
     }
   }
diff --git a/src/main/runtime/fetch-remote-cache.test.ts b/src/main/runtime/fetch-remote-cache.test.ts
index c97966c344e..5f0b8e249d6 100644
--- a/src/main/runtime/fetch-remote-cache.test.ts
+++ b/src/main/runtime/fetch-remote-cache.test.ts
@@ -176,6 +176,27 @@ describe('OrcaRuntimeService.fetchRemoteWithCache', () => {
     expect(caches.fetchLastCompletedAt.has('/repo/cache-0::origin')).toBe(false)
   })
 
+  it.each([
+    'main',
+    'a'.repeat(40),
+    'refs/remotes/main',
+    '',
+    'origin/',
+    '/main',
+    'refs/remotes/origin/',
+    'refs/remotes//main'
+  ])(
+    'does not launch Git for a base without both remote and branch components: %s',
+    async (base) => {
+      const runtime = new OrcaRuntimeService(null)
+      await expect(runtime.resolveRemoteTrackingBase('/repo/e', base)).resolves.toBeNull()
+      await expect(
+        runtime.resolveRemoteTrackingBase('/repo/e', base, { wslDistro: 'Ubuntu' })
+      ).resolves.toBeNull()
+      expect(gitExecFileAsyncMock).not.toHaveBeenCalled()
+    }
+  )
+
   it('resolves remote-tracking bases with longest configured remote matching', async () => {
     gitExecFileAsyncMock.mockResolvedValue({ stdout: 'foo\nfoo/bar\norigin\n', stderr: '' })
     const runtime = new OrcaRuntimeService(null)
diff --git a/src/main/runtime/mobile-rpc-allowlist.test.ts b/src/main/runtime/mobile-rpc-allowlist.test.ts
index 684d6699fc1..1a27de18d55 100644
--- a/src/main/runtime/mobile-rpc-allowlist.test.ts
+++ b/src/main/runtime/mobile-rpc-allowlist.test.ts
@@ -158,6 +158,7 @@ describe('mobile RPC allowlist', () => {
       'agentSession.createSupport',
       'agentSession.create',
       'agentSession.ensure',
+      'agentSession.reveal',
       'agentSession.send',
       'agentSession.cancel',
       'agentSession.close',
diff --git a/src/main/runtime/orca-runtime-create-base-prefetch.test.ts b/src/main/runtime/orca-runtime-create-base-prefetch.test.ts
index 7dcd1092625..d65209b9cc4 100644
--- a/src/main/runtime/orca-runtime-create-base-prefetch.test.ts
+++ b/src/main/runtime/orca-runtime-create-base-prefetch.test.ts
@@ -107,7 +107,10 @@ describe('prefetchManagedWorktreeCreateBase (orca-runtime-get-worktree-terminal-
   it('prepares the checkout the prefetch resolved', async () => {
     _setWslCachesForTests({ available: true, distros: ['Ubuntu'] })
     setPlatform('win32')
-    mocks.prefetchWorktreeCreateBase.mockResolvedValue('origin/main')
+    mocks.prefetchWorktreeCreateBase.mockImplementation(async ({ prepareCheckout }) => {
+      await prepareCheckout('origin/main')
+      return 'origin/main'
+    })
     const runtime = new OrcaRuntimeService(makeStore() as never)
 
     await runtime.prefetchManagedWorktreeCreateBase({ repoSelector: 'repo-1' })
diff --git a/src/main/runtime/orca-runtime-create-pty-headless-terminal-state.ts b/src/main/runtime/orca-runtime-create-pty-headless-terminal-state.ts
index 59fe493118a..da5d824ef62 100644
--- a/src/main/runtime/orca-runtime-create-pty-headless-terminal-state.ts
+++ b/src/main/runtime/orca-runtime-create-pty-headless-terminal-state.ts
@@ -163,6 +163,17 @@ export class OrcaRuntimeWithCreatePtyHeadlessTerminalState extends OrcaRuntimeWi
       })
   }
 
+  /** Public: reflow an already-created model onto a grid the PROVIDER proved — a reattach learns
+   *  the live session's real size only from its spawn reply, after live bytes may have lazily
+   *  created the model at the 80x24 default. Not onExternalPtyResize: nothing measured a pane
+   *  here, so the renderer-geometry baselines behind mobile take-back must stay untouched. */
+  reflowHeadlessTerminalToPtyGrid(ptyId: string, cols: number, rows: number): void {
+    if (cols <= 0 || rows <= 0) {
+      return
+    }
+    this.resizeHeadlessTerminal(ptyId, cols, rows)
+  }
+
   // Public: desktop-initiated clears (ipc/pty.ts) must also drop this mobile
   // mirror or a resubscribing mobile client resurrects the cleared scrollback.
   async clearHeadlessTerminalBuffer(ptyId: string): Promise<void> {
diff --git a/src/main/runtime/orca-runtime-get-agent-session-execution-namespace.ts b/src/main/runtime/orca-runtime-get-agent-session-execution-namespace.ts
index afbb70fc286..f70cf033718 100644
--- a/src/main/runtime/orca-runtime-get-agent-session-execution-namespace.ts
+++ b/src/main/runtime/orca-runtime-get-agent-session-execution-namespace.ts
@@ -17,6 +17,9 @@ import {
   resolveTuiAgentLaunchArgs,
   resolveTuiAgentLaunchEnv
 } from '../../shared/tui-agent-launch-defaults'
+import type { AgentSessionLaunchArgs } from '../../shared/agent-session-record'
+import { resolveStartupShell } from '../../shared/tui-agent-startup-shell'
+import { resolveAgentSessionResumeArgs } from './agent-session-resume-args'
 
 export class OrcaRuntimeWithGetAgentSessionExecutionNamespace extends OrcaRuntimeWithResolveWorktreeRemovalTarget {
   protected getAgentSessionExecutionNamespace(
@@ -88,7 +91,12 @@ export class OrcaRuntimeWithGetAgentSessionExecutionNamespace extends OrcaRuntim
   async ensureAgentSession(
     request: RuntimeEnsureAgentSessionRequest,
     _caller: RuntimeAgentSessionRpcCaller = {},
-    handoffAuthority?: { spawnToken: string; providerRoot: string; sessionId: string }
+    handoffAuthority?: {
+      spawnToken: string
+      providerRoot: string
+      sessionId: string
+      launchArgs?: AgentSessionLaunchArgs
+    }
   ): Promise<RuntimeEnsureAgentSessionResult> {
     if (request.kind === 'automatic') {
       // Legacy renderer sleep records are migration evidence, not host authority.
@@ -134,10 +142,12 @@ export class OrcaRuntimeWithGetAgentSessionExecutionNamespace extends OrcaRuntim
       agent: request.agent,
       providerSession: identity.providerSession,
       cmdOverrides: settings.agentCmdOverrides ?? {},
-      agentArgs:
-        request.agentArgs !== undefined
-          ? request.agentArgs
-          : resolveTuiAgentLaunchArgs(request.agent, settings.agentDefaultArgs),
+      agentArgs: resolveAgentSessionResumeArgs({
+        requestArgs: request.agentArgs,
+        persistedArgs: handoffAuthority?.launchArgs,
+        defaultArgs: resolveTuiAgentLaunchArgs(request.agent, settings.agentDefaultArgs),
+        shell: resolveStartupShell(platform, shell)
+      }),
       agentEnv: {
         ...resolveTuiAgentLaunchEnv(request.agent, settings.agentDefaultEnv),
         ...(handoffAuthority && request.agent === 'codex'
@@ -148,6 +158,7 @@ export class OrcaRuntimeWithGetAgentSessionExecutionNamespace extends OrcaRuntim
       },
       ompResumeFilePath: request.ompResumeFilePath,
       sessionOptions: this.toAgentSessionOptions(request.launchPreferences),
+      sessionOptionsOverrideAgentArgs: Boolean(request.launchPreferences),
       platform,
       shell,
       isRemote
diff --git a/src/main/runtime/orca-runtime-get-worktree-ps.ts b/src/main/runtime/orca-runtime-get-worktree-ps.ts
index 42c9c7ff6d3..06391e2ae83 100644
--- a/src/main/runtime/orca-runtime-get-worktree-ps.ts
+++ b/src/main/runtime/orca-runtime-get-worktree-ps.ts
@@ -10,6 +10,7 @@ import {
 } from './runtime-worktree-ps-activity'
 import { attachRuntimeWorktreeAgentRows } from './runtime-worktree-agent-rows'
 import { compareWorktreePs } from './runtime-worktree-status-projection'
+import type { AgentSessionRecord } from '../../shared/agent-session-record'
 import type { Repo } from '../../shared/repo-types'
 import { enrichMissingRepoGitRemoteIdentities } from '../repo-git-remote-identity-enrichment'
 import { ensureStructuredAgentSessionHost as installStructuredAgentSessionHost } from './structured-agent-session-runtime'
@@ -21,9 +22,11 @@ import {
   resolveTuiAgentLaunchEnv
 } from '../../shared/tui-agent-launch-defaults'
 import { resolveLocalWindowsAgentStartupShell } from '../../shared/windows-terminal-shell'
+import { resolveStartupShell, tokenizeStartupCommand } from '../../shared/tui-agent-startup-shell'
 import { resolveCodexStructuredAppServerArgs } from '../codex/codex-structured-app-server-args'
 import type { StructuredAgentSessionHandoffTransport } from '../native-chat/agent-session-wire/structured-agent-session-handoff-types'
 import { hostname } from 'node:os'
+import { claudeStructuredAuthPolicyForSettings } from '../claude-accounts/claude-structured-auth-policy'
 import { probeAgentSessionProcessIdentity } from './agent-session-process-identity-probe'
 import { structuredAgentSessionTabId } from '../../shared/structured-agent-session-projection'
 
@@ -144,13 +147,47 @@ export class OrcaRuntimeWithGetWorktreePs extends OrcaRuntimeWithStructuredAgent
       // in a plain folder lands in the folder rather than failing to resolve.
       resolveWorkspacePath: async (workspaceId) =>
         (await this.resolveRuntimeFileTarget(`id:${workspaceId}`)).worktree.path,
-      resolveLaunchArgs: () => this.resolveConfiguredCodexStructuredArgs(),
+      resolveLaunchArgs: (provider) => this.resolveConfiguredStructuredLaunchArgs(provider),
       resolveLaunchEnvOverlay: () =>
         resolveTuiAgentLaunchEnv('codex', this.requireStore().getSettings().agentDefaultEnv),
+      resolveClaudeLaunchEnv: () =>
+        resolveTuiAgentLaunchEnv('claude', this.requireStore().getSettings().agentDefaultEnv),
+      resolveClaudeAuthPolicy: () =>
+        claudeStructuredAuthPolicyForSettings(this.requireStore().getSettings()),
+      // Same gate and same settings as agentSession.createSupport, re-read on every acquisition.
+      getClaudeManagedAccountGateSettings: () => this.requireStore().getSettings(),
       handoffTransport: this.createStructuredAgentSessionHandoffTransport()
     })
   }
 
+  // Why the provider is honoured rather than assumed: Codex app-server flags are not
+  // Claude CLI flags, and prepending them to `claude` makes it exit on an unknown option.
+  protected resolveConfiguredStructuredLaunchArgs(
+    provider: AgentSessionRecord['provider']
+  ): string[] {
+    if (provider === 'claude') {
+      return this.resolveConfiguredClaudeStructuredArgs()
+    }
+    return this.resolveConfiguredCodexStructuredArgs()
+  }
+
+  protected resolveConfiguredClaudeStructuredArgs(): string[] {
+    const settings = this.requireStore().getSettings()
+    const shell = resolveStartupShell(
+      process.platform,
+      resolveLocalWindowsAgentStartupShell({
+        platform: process.platform,
+        isRemote: false,
+        terminalWindowsShell: settings.terminalWindowsShell
+      })
+    )
+    const tokenized = tokenizeStartupCommand(
+      resolveTuiAgentLaunchArgs('claude', settings.agentDefaultArgs),
+      shell
+    )
+    return tokenized.ok ? tokenized.tokens : []
+  }
+
   protected resolveConfiguredCodexStructuredArgs(): string[] {
     const settings = this.requireStore().getSettings()
     const shell = resolveLocalWindowsAgentStartupShell({
@@ -195,7 +232,7 @@ export class OrcaRuntimeWithGetWorktreePs extends OrcaRuntimeWithStructuredAgent
       tuiStatus: (owner) => this.structuredTuiStatus(owner),
       closeTuiOwner: (owner) => this.closeStructuredTuiOwner(owner),
       revealNativeSession: async ({ workspaceId, sessionId, agent = 'codex', adoptedTerminal }) => {
-        if (adoptedTerminal || agent !== 'codex') {
+        if (adoptedTerminal || (agent !== 'codex' && agent !== 'claude')) {
           return
         }
         await this.publishStructuredAgentSessionTab({
diff --git a/src/main/runtime/orca-runtime-get-worktree-terminal-provisioning-host.ts b/src/main/runtime/orca-runtime-get-worktree-terminal-provisioning-host.ts
index 1591f344bda..d9d6b2acfb9 100644
--- a/src/main/runtime/orca-runtime-get-worktree-terminal-provisioning-host.ts
+++ b/src/main/runtime/orca-runtime-get-worktree-terminal-provisioning-host.ts
@@ -50,18 +50,12 @@ export class OrcaRuntimeWithGetWorktreeTerminalProvisioningHost extends OrcaRunt
 
     const repo = await this.resolveRepoSelector(args.repoSelector)
     const store = this.requireStore()
-    const baseBranch = await prefetchWorktreeCreateBase({
+    await prefetchWorktreeCreateBase({
       repo,
       baseBranch: args.baseBranch,
       runtime: this,
-      gitOptions: getWorktreeCreatePrefetchGitOptions(store, repo)
+      gitOptions: getWorktreeCreatePrefetchGitOptions(store, repo),
+      prepareCheckout: (base) => prepareWorktreeCreateForRepo(store, repo, base)
     })
-    if (baseBranch) {
-      try {
-        await prepareWorktreeCreateForRepo(store, repo, baseBranch)
-      } catch {
-        // Why: speculative preparation is an optimistic warm-up; the real create path reports failures.
-      }
-    }
   }
 }
diff --git a/src/main/runtime/orca-runtime-refresh-repo-worktree-scan.ts b/src/main/runtime/orca-runtime-refresh-repo-worktree-scan.ts
index 1964b5fdd2f..2df3f7b9f17 100644
--- a/src/main/runtime/orca-runtime-refresh-repo-worktree-scan.ts
+++ b/src/main/runtime/orca-runtime-refresh-repo-worktree-scan.ts
@@ -153,6 +153,11 @@ export class OrcaRuntimeWithRefreshRepoWorktreeScan extends OrcaRuntimeWithListK
     }
   }
 
+  invalidateWorktreeCatalog(repoId: string): void {
+    this.invalidateResolvedWorktreeCache()
+    this.invalidateWorktreeScanCacheForRepo(repoId)
+  }
+
   protected invalidateSshWorktreeScanCacheInternal(targetId: string): void {
     const repos = this.store?.getRepos() ?? []
     const affectedRepos = repos.filter((repo) => getRepoSshConnectionId(repo) === targetId)
diff --git a/src/main/runtime/orca-runtime-resolve-recovered-structured-tui-transcript.ts b/src/main/runtime/orca-runtime-resolve-recovered-structured-tui-transcript.ts
index 5700b71d9a5..aef04bde6bc 100644
--- a/src/main/runtime/orca-runtime-resolve-recovered-structured-tui-transcript.ts
+++ b/src/main/runtime/orca-runtime-resolve-recovered-structured-tui-transcript.ts
@@ -3,7 +3,10 @@ import { OrcaRuntimeWithStopStructuredSessionProcess } from './orca-runtime-stop
 import type { AgentSessionOwnerBinding } from '../../shared/agent-session-host-authority'
 import { agentSessionOwnerBindingsEqual } from '../../shared/claimed-agent-pty-owner-snapshot'
 import { resolvePinnedCodexRolloutProof } from '../codex/codex-tui-rollout-proof'
+import { supportsCodexStructuredLocation } from '../codex/codex-structured-location-support'
+import { supportsClaudeStructuredLocation } from '../claude/claude-structured-location-support'
 import { getStructuredAgentSessionHost } from '../native-chat/agent-session-wire/structured-agent-session-registry'
+import { resolveStructuredAgentSessionCreateSupport } from '../native-chat/structured-agent-session-create-support'
 import { LOCAL_EXECUTION_HOST_ID } from '../../shared/execution-host'
 import type { AgentStatusIpcPayload } from '../../shared/agent-status-types'
 import { getLocalProjectWorktreeGitOptions } from '../project-runtime-git-options'
@@ -12,6 +15,8 @@ import { getSystemCodexHomePath } from '../codex/codex-home-paths'
 import { resolveTuiAgentLaunchEnv } from '../../shared/tui-agent-launch-defaults'
 import { hasPersistedStructuredAgentSessionStore as hasPersistedStructuredAgentSessionStoreOnDisk } from './structured-agent-session-runtime'
 import { getProfileUserDataPath } from '../orca-profiles/profile-storage-paths'
+import { homedir } from 'node:os'
+import { join } from 'node:path'
 
 export class OrcaRuntimeWithResolveRecoveredStructuredTuiTranscript extends OrcaRuntimeWithStopStructuredSessionProcess {
   protected async resolveRecoveredStructuredTuiTranscript(input: {
@@ -45,22 +50,18 @@ export class OrcaRuntimeWithResolveRecoveredStructuredTuiTranscript extends Orca
 
   async getStructuredAgentSessionCreateSupport(
     worktreeSelector: string,
-    agent: 'codex'
+    agent: 'claude' | 'codex'
   ): Promise<{ supported: boolean; reason?: 'agent' | 'remote' | 'wsl' }> {
     const location = await this.resolveStructuredAgentSessionLocation(worktreeSelector)
-    await this.ensureStructuredAgentSessionHost()
-    if (getStructuredAgentSessionHost()?.supportsCreate(location, agent)) {
-      return { supported: true }
-    }
-    return {
-      supported: false,
-      reason:
-        location.executionHostId !== LOCAL_EXECUTION_HOST_ID
-          ? 'remote'
-          : location.wslDistro
-            ? 'wsl'
-            : 'agent'
-    }
+    return resolveStructuredAgentSessionCreateSupport({
+      agent,
+      location,
+      adapterSupportsCreate:
+        agent === 'claude'
+          ? supportsClaudeStructuredLocation(location)
+          : supportsCodexStructuredLocation(location),
+      getSettings: () => this.requireStore().getSettings()
+    })
   }
 
   protected hasProviderSessionObservationSource(): boolean {
@@ -108,8 +109,23 @@ export class OrcaRuntimeWithResolveRecoveredStructuredTuiTranscript extends Orca
   async resolveStructuredAgentSessionCreateIntent(input: {
     envelope: { sessionId: string; clientOperationId: string }
     worktree: string
-    agent: 'codex'
+    agent: 'claude' | 'codex'
   }): Promise<AgentSessionAttachParams> {
+    if (input.agent === 'claude') {
+      return this.resolveStructuredAgentSessionIntent(input, async ({ launchEnv, location }) => {
+        return (
+          launchEnv.CLAUDE_CONFIG_DIR?.trim() ||
+          this.accounts
+            .getClaudeConfigDirectory(
+              location.wslDistro
+                ? { runtime: 'wsl', wslDistro: location.wslDistro }
+                : { runtime: 'host' }
+            )
+            ?.trim() ||
+          join(homedir(), '.claude')
+        )
+      })
+    }
     return this.resolveStructuredAgentSessionIntent(input, async ({ workspacePath, launchEnv }) => {
       // A create has no process yet, so the current selection is what it must follow.
       const preparedHome = await this.prepareCodexStructuredLaunchFn?.({ workspacePath, launchEnv })
@@ -126,11 +142,17 @@ export class OrcaRuntimeWithResolveRecoveredStructuredTuiTranscript extends Orca
     input: {
       envelope: { sessionId: string; clientOperationId: string }
       worktree: string
-      agent: 'codex'
+      agent: 'claude' | 'codex'
     },
     resolveAccountHomePath: (context: {
       workspacePath: string
       launchEnv: NodeJS.ProcessEnv
+      location: {
+        executionHostId: string
+        wslDistro: string | null
+        workspaceId: string
+        workspaceKind: 'folder' | 'git-worktree'
+      }
     }) => string | Promise<string>
   ): Promise<AgentSessionAttachParams> {
     const support = await this.getStructuredAgentSessionCreateSupport(input.worktree, input.agent)
@@ -152,8 +174,8 @@ export class OrcaRuntimeWithResolveRecoveredStructuredTuiTranscript extends Orca
       provider: input.agent,
       agent: input.agent,
       accountHome: {
-        variable: 'CODEX_HOME',
-        path: await resolveAccountHomePath({ workspacePath, launchEnv })
+        variable: input.agent === 'claude' ? 'CLAUDE_CONFIG_DIR' : 'CODEX_HOME',
+        path: await resolveAccountHomePath({ workspacePath, launchEnv, location })
       },
       runtimeKind: 'native'
     }
diff --git a/src/main/runtime/orca-runtime-restore-structured-agent-session-tabs-once.ts b/src/main/runtime/orca-runtime-restore-structured-agent-session-tabs-once.ts
index 0ed3700ba99..5b2c160f2c6 100644
--- a/src/main/runtime/orca-runtime-restore-structured-agent-session-tabs-once.ts
+++ b/src/main/runtime/orca-runtime-restore-structured-agent-session-tabs-once.ts
@@ -45,7 +45,7 @@ export class OrcaRuntimeWithRestoreStructuredAgentSessionTabsOnce extends OrcaRu
     }
     this.hydrateHeadlessMobileSessionTabsFromWorkspaceSession()
     for (const session of host?.listSessionTabs() ?? []) {
-      if (session.agent !== 'codex') {
+      if (session.agent !== 'codex' && session.agent !== 'claude') {
         continue
       }
       let sessionId = session.sessionId
@@ -54,7 +54,7 @@ export class OrcaRuntimeWithRestoreStructuredAgentSessionTabsOnce extends OrcaRu
       }
       await this.publishStructuredAgentSessionTab({
         ...session,
-        agent: 'codex',
+        agent: session.agent,
         sessionId,
         activate: false,
         notify: false
@@ -65,7 +65,7 @@ export class OrcaRuntimeWithRestoreStructuredAgentSessionTabsOnce extends OrcaRu
   async publishStructuredAgentSessionTab(input: {
     workspaceId: string
     sessionId: string
-    agent: 'codex'
+    agent: 'claude' | 'codex'
     activate: boolean
     notify?: boolean
   }): Promise<void> {
@@ -105,7 +105,7 @@ export class OrcaRuntimeWithRestoreStructuredAgentSessionTabsOnce extends OrcaRu
     const tab: RuntimeMobileSessionAgentTab = {
       type: 'agent-session',
       id,
-      title: 'Codex Chat',
+      title: input.agent === 'claude' ? 'Claude Chat' : 'Codex Chat',
       sessionId: input.sessionId,
       agent: input.agent,
       isActive: input.activate
@@ -153,7 +153,7 @@ export class OrcaRuntimeWithRestoreStructuredAgentSessionTabsOnce extends OrcaRu
 
   async inspectTerminalProcess(
     terminalSelector: string,
-    options?: { expectedIncarnationId?: string }
+    options?: { expectedIncarnationId?: string; scanChildProcesses?: boolean }
   ): Promise<PtyProcessInspection> {
     const leaf = this.resolveLiveLeafForHandle(terminalSelector)
     if (!leaf?.ptyId || !this.ptyController) {
diff --git a/src/main/runtime/orca-runtime-structured-agent-session-create-intent.test.ts b/src/main/runtime/orca-runtime-structured-agent-session-create-intent.test.ts
index 083c677e39f..af1fbc20372 100644
--- a/src/main/runtime/orca-runtime-structured-agent-session-create-intent.test.ts
+++ b/src/main/runtime/orca-runtime-structured-agent-session-create-intent.test.ts
@@ -52,4 +52,108 @@ describe('structured agent-session create intent', () => {
       path: '/accounts/selected/home'
     })
   })
+
+  it('pins the configured Claude launch home without Codex launch preparation', async () => {
+    const prepareCodexStructuredLaunch = vi.fn()
+    const runtime = new OrcaRuntimeService(
+      {
+        getSettings: () => ({
+          agentDefaultEnv: {
+            claude: { CLAUDE_CONFIG_DIR: '/configured/claude-home' }
+          }
+        })
+      } as never,
+      undefined,
+      { prepareCodexStructuredLaunch }
+    )
+    vi.spyOn(runtime, 'getStructuredAgentSessionCreateSupport').mockResolvedValue({
+      supported: true
+    })
+    const internal = runtime as unknown as {
+      resolveStructuredAgentSessionLocation: (selector: string) => Promise<{
+        executionHostId: string
+        wslDistro: null
+        workspaceId: string
+        workspaceKind: 'git-worktree'
+      }>
+      resolveRuntimeFileTarget: (selector: string) => Promise<{
+        worktree: { path: string }
+      }>
+    }
+    internal.resolveStructuredAgentSessionLocation = vi.fn(async () => ({
+      executionHostId: 'local',
+      wslDistro: null,
+      workspaceId: 'workspace-1',
+      workspaceKind: 'git-worktree' as const
+    }))
+    internal.resolveRuntimeFileTarget = vi.fn(async () => ({
+      worktree: { path: '/repos/workspace-1' }
+    }))
+
+    const intent = await runtime.resolveStructuredAgentSessionCreateIntent({
+      envelope: { sessionId: 'session-1', clientOperationId: 'operation-1' },
+      worktree: 'id:workspace-1',
+      agent: 'claude'
+    })
+
+    expect(prepareCodexStructuredLaunch).not.toHaveBeenCalled()
+    expect(intent.accountHome).toEqual({
+      variable: 'CLAUDE_CONFIG_DIR',
+      path: '/configured/claude-home'
+    })
+  })
+
+  it('uses the managed Claude launch home before falling back to ~/.claude', async () => {
+    const prepareCodexStructuredLaunch = vi.fn()
+    const getRuntimeConfigDir = vi.fn(() => '/accounts/managed/claude-home')
+    const runtime = new OrcaRuntimeService(
+      {
+        getSettings: () => ({
+          agentDefaultEnv: { claude: {} }
+        })
+      } as never,
+      undefined,
+      { prepareCodexStructuredLaunch }
+    )
+    runtime.setAccountServices({
+      claudeAccounts: { getRuntimeConfigDir } as never,
+      codexAccounts: {} as never,
+      rateLimits: {} as never
+    })
+    vi.spyOn(runtime, 'getStructuredAgentSessionCreateSupport').mockResolvedValue({
+      supported: true
+    })
+    const internal = runtime as unknown as {
+      resolveStructuredAgentSessionLocation: (selector: string) => Promise<{
+        executionHostId: string
+        wslDistro: null
+        workspaceId: string
+        workspaceKind: 'git-worktree'
+      }>
+      resolveRuntimeFileTarget: (selector: string) => Promise<{
+        worktree: { path: string }
+      }>
+    }
+    internal.resolveStructuredAgentSessionLocation = vi.fn(async () => ({
+      executionHostId: 'local',
+      wslDistro: null,
+      workspaceId: 'workspace-1',
+      workspaceKind: 'git-worktree' as const
+    }))
+    internal.resolveRuntimeFileTarget = vi.fn(async () => ({
+      worktree: { path: '/repos/workspace-1' }
+    }))
+
+    const intent = await runtime.resolveStructuredAgentSessionCreateIntent({
+      envelope: { sessionId: 'session-1', clientOperationId: 'operation-1' },
+      worktree: 'id:workspace-1',
+      agent: 'claude'
+    })
+
+    expect(getRuntimeConfigDir).toHaveBeenCalledTimes(1)
+    expect(intent.accountHome).toEqual({
+      variable: 'CLAUDE_CONFIG_DIR',
+      path: '/accounts/managed/claude-home'
+    })
+  })
 })
diff --git a/src/main/runtime/orca-runtime-structured-agent-session-launch-args.test.ts b/src/main/runtime/orca-runtime-structured-agent-session-launch-args.test.ts
new file mode 100644
index 00000000000..c4333fd0a4d
--- /dev/null
+++ b/src/main/runtime/orca-runtime-structured-agent-session-launch-args.test.ts
@@ -0,0 +1,86 @@
+import { describe, expect, it, vi } from 'vitest'
+import { OrcaRuntimeService } from './orca-runtime'
+
+type InstalledDeps = {
+  resolveLaunchArgs: (provider: 'claude' | 'codex') => Promise<string[]> | string[]
+  resolveLaunchEnvOverlay: () => Record<string, string>
+  resolveClaudeLaunchEnv?: () => Record<string, string>
+}
+
+const { installStructuredAgentSessionHost } = vi.hoisted(() => ({
+  installStructuredAgentSessionHost: vi.fn(async (_deps: unknown) => ({}) as never)
+}))
+
+vi.mock('./structured-agent-session-runtime', async (importOriginal) => ({
+  ...(await importOriginal<object>()),
+  ensureStructuredAgentSessionHost: installStructuredAgentSessionHost
+}))
+
+function runtimeWith(settings: Record<string, unknown>): OrcaRuntimeService {
+  return new OrcaRuntimeService({ getSettings: () => settings } as never)
+}
+
+async function installedDeps(settings: Record<string, unknown>): Promise<InstalledDeps> {
+  installStructuredAgentSessionHost.mockClear()
+  await runtimeWith(settings).ensureStructuredAgentSessionHost()
+  return installStructuredAgentSessionHost.mock.calls[0]?.[0] as InstalledDeps
+}
+
+describe('structured agent-session launch args wiring', () => {
+  it('resolves Claude launch args from the Claude agent defaults, not Codex flags', async () => {
+    const deps = await installedDeps({
+      agentDefaultArgs: {
+        claude: '--dangerously-skip-permissions --model opus',
+        codex: '--dangerously-bypass-approvals-and-sandbox'
+      },
+      agentDefaultEnv: {}
+    })
+
+    expect(await deps.resolveLaunchArgs('claude')).toEqual([
+      '--dangerously-skip-permissions',
+      '--model',
+      'opus'
+    ])
+  })
+
+  it('still resolves Codex app-server args for a Codex session', async () => {
+    const deps = await installedDeps({
+      agentDefaultArgs: {
+        claude: '--dangerously-skip-permissions',
+        codex: '--dangerously-bypass-approvals-and-sandbox'
+      },
+      agentDefaultEnv: {}
+    })
+
+    const codexArgs = await deps.resolveLaunchArgs('codex')
+    expect(codexArgs).not.toContain('--dangerously-skip-permissions')
+    expect(codexArgs.length).toBeGreaterThan(0)
+  })
+
+  it('never lets a broken Codex args configuration block a Claude session', async () => {
+    const deps = await installedDeps({
+      agentDefaultArgs: { claude: '--model opus', codex: '--not-a-real-codex-flag' },
+      agentDefaultEnv: {}
+    })
+
+    expect(await deps.resolveLaunchArgs('claude')).toEqual(['--model', 'opus'])
+    expect(() => deps.resolveLaunchArgs('codex')).toThrow()
+  })
+
+  it('supplies the Claude env overlay so the launch resolver does not fall back to process.env', async () => {
+    const deps = await installedDeps({
+      agentDefaultArgs: {},
+      agentDefaultEnv: {
+        claude: { ORCA_CLAUDE_OVERLAY: 'claude-value' },
+        codex: { ORCA_CODEX_OVERLAY: 'codex-value' }
+      }
+    })
+
+    expect(deps.resolveClaudeLaunchEnv).toBeTypeOf('function')
+    expect(deps.resolveClaudeLaunchEnv?.()).toMatchObject({
+      ORCA_CLAUDE_OVERLAY: 'claude-value'
+    })
+    expect(deps.resolveClaudeLaunchEnv?.()).not.toHaveProperty('ORCA_CODEX_OVERLAY')
+    expect(deps.resolveLaunchEnvOverlay()).toMatchObject({ ORCA_CODEX_OVERLAY: 'codex-value' })
+  })
+})
diff --git a/src/main/runtime/orca-runtime-structured-agent-session-launch-tui.ts b/src/main/runtime/orca-runtime-structured-agent-session-launch-tui.ts
index 9e70602f91b..89836d1e027 100644
--- a/src/main/runtime/orca-runtime-structured-agent-session-launch-tui.ts
+++ b/src/main/runtime/orca-runtime-structured-agent-session-launch-tui.ts
@@ -28,7 +28,12 @@ export class OrcaRuntimeWithStructuredAgentSessionLaunchTui extends OrcaRuntimeW
           presentation: 'background'
         },
         {},
-        { spawnToken, providerRoot: record.accountHome.path, sessionId: record.sessionId }
+        {
+          spawnToken,
+          providerRoot: record.accountHome.path,
+          sessionId: record.sessionId,
+          ...(record.launchArgs !== undefined ? { launchArgs: record.launchArgs } : {})
+        }
       )
       const terminal = launched.terminal
       let spawnedOwner: StructuredTuiOwner | null = null
diff --git a/src/main/runtime/orca-runtime-structured-claude-account-gate.test.ts b/src/main/runtime/orca-runtime-structured-claude-account-gate.test.ts
new file mode 100644
index 00000000000..64b451e9ea9
--- /dev/null
+++ b/src/main/runtime/orca-runtime-structured-claude-account-gate.test.ts
@@ -0,0 +1,112 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { OrcaRuntimeService } from './orca-runtime'
+import { setStructuredAgentSessionHost } from '../native-chat/agent-session-wire/structured-agent-session-registry'
+import type { StructuredAgentSessionHost } from '../native-chat/agent-session-wire/structured-agent-session-host'
+import type { ClaudeManagedAccountGateSettings } from '../native-chat/claude-structured-managed-account-support'
+
+vi.mock('electron', () => ({
+  BrowserWindow: { fromId: vi.fn(() => null) },
+  webContents: { fromId: vi.fn(() => null) },
+  ipcMain: { on: vi.fn(), removeListener: vi.fn() },
+  app: { getPath: vi.fn(() => '/tmp') }
+}))
+
+function managedAccount(id: string, managedAuthRuntime: 'host' | 'wsl') {
+  return {
+    id,
+    email: `${id}@example.com`,
+    managedAuthPath: `/managed/${id}`,
+    managedAuthRuntime,
+    authMethod: 'subscription-oauth' as const,
+    createdAt: 0,
+    updatedAt: 0,
+    lastAuthenticatedAt: 0
+  }
+}
+
+const WSL_ONLY: ClaudeManagedAccountGateSettings = {
+  claudeManagedAccounts: [managedAccount('wsl-1', 'wsl')],
+  activeClaudeManagedAccountId: null,
+  activeClaudeManagedAccountIdsByRuntime: { host: null, wsl: { Ubuntu: 'wsl-1' } }
+}
+
+/** Registered Claude accounts with none selected: ambient auth, and the UI names no host identity,
+ *  so this must reach structured rather than silently falling back to a terminal session. */
+const ACCOUNTS_PRESENT_NONE_ACTIVE: ClaudeManagedAccountGateSettings = {
+  claudeManagedAccounts: [managedAccount('host-1', 'host'), managedAccount('host-2', 'host')],
+  activeClaudeManagedAccountId: null,
+  activeClaudeManagedAccountIdsByRuntime: { host: null, wsl: {} }
+}
+
+const HOST_SELECTED: ClaudeManagedAccountGateSettings = {
+  claudeManagedAccounts: [managedAccount('host-1', 'host')],
+  activeClaudeManagedAccountId: 'host-1',
+  activeClaudeManagedAccountIdsByRuntime: { host: 'host-1', wsl: {} }
+}
+
+function runtimeWithAccounts(claude: ClaudeManagedAccountGateSettings | null): OrcaRuntimeService {
+  // No store at all is the unreadable-settings case the gate must fail closed on.
+  const runtime = claude
+    ? new OrcaRuntimeService({ getSettings: () => claude } as never)
+    : new OrcaRuntimeService()
+  const internal = runtime as unknown as {
+    resolveStructuredAgentSessionLocation: (selector: string) => Promise<unknown>
+    ensureStructuredAgentSessionHost: () => Promise<void>
+  }
+  internal.resolveStructuredAgentSessionLocation = vi.fn(async () => ({
+    executionHostId: 'local',
+    wslDistro: null,
+    workspaceId: 'workspace-1',
+    workspaceKind: 'git-worktree' as const
+  }))
+  // The adapter's own location answer is irrelevant here; pin it supported so only the account
+  // gate can refuse.
+  internal.ensureStructuredAgentSessionHost = vi.fn(async () => {})
+  setStructuredAgentSessionHost({
+    supportsCreate: () => true
+  } as unknown as StructuredAgentSessionHost)
+  return runtime
+}
+
+afterEach(() => {
+  setStructuredAgentSessionHost(null)
+})
+
+describe('structured Claude managed-account gate', () => {
+  it('refuses Claude under a WSL-only managed account', async () => {
+    const runtime = runtimeWithAccounts(WSL_ONLY)
+    await expect(
+      runtime.getStructuredAgentSessionCreateSupport('id:workspace-1', 'claude')
+    ).resolves.toMatchObject({ supported: false })
+  })
+
+  it('supports Claude when accounts are registered but none is selected', async () => {
+    const runtime = runtimeWithAccounts(ACCOUNTS_PRESENT_NONE_ACTIVE)
+    await expect(
+      runtime.getStructuredAgentSessionCreateSupport('id:workspace-1', 'claude')
+    ).resolves.toMatchObject({ supported: true })
+  })
+
+  it('still supports Claude under a selected host managed account', async () => {
+    const runtime = runtimeWithAccounts(HOST_SELECTED)
+    await expect(
+      runtime.getStructuredAgentSessionCreateSupport('id:workspace-1', 'claude')
+    ).resolves.toMatchObject({ supported: true })
+  })
+
+  it('fails closed for Claude when the account runtime cannot be determined', async () => {
+    const runtime = runtimeWithAccounts(null)
+    await expect(
+      runtime.getStructuredAgentSessionCreateSupport('id:workspace-1', 'claude')
+    ).resolves.toMatchObject({ supported: false })
+  })
+
+  /** The gate is Claude's alone: Codex resolves its account separately and this lane must not
+   *  change any Codex answer. */
+  it('leaves Codex supported under the same WSL-only Claude account', async () => {
+    const runtime = runtimeWithAccounts(WSL_ONLY)
+    await expect(
+      runtime.getStructuredAgentSessionCreateSupport('id:workspace-1', 'codex')
+    ).resolves.toMatchObject({ supported: true })
+  })
+})
diff --git a/src/main/runtime/orca-runtime-structured-claude-gate-wiring.test.ts b/src/main/runtime/orca-runtime-structured-claude-gate-wiring.test.ts
new file mode 100644
index 00000000000..0d9b12f7c52
--- /dev/null
+++ b/src/main/runtime/orca-runtime-structured-claude-gate-wiring.test.ts
@@ -0,0 +1,64 @@
+import { describe, expect, it, vi } from 'vitest'
+
+const installed = vi.hoisted(() => ({ deps: null as Record<string, unknown> | null }))
+
+vi.mock('electron', () => ({
+  BrowserWindow: { fromId: vi.fn(() => null) },
+  webContents: { fromId: vi.fn(() => null) },
+  ipcMain: { on: vi.fn(), removeListener: vi.fn() },
+  app: { getPath: vi.fn(() => '/tmp') }
+}))
+
+vi.mock('./structured-agent-session-runtime', () => ({
+  ensureStructuredAgentSessionHost: vi.fn(async (deps: Record<string, unknown>) => {
+    installed.deps = deps
+  })
+}))
+
+import { OrcaRuntimeService } from './orca-runtime'
+import {
+  readClaudeManagedAccountGateSettings,
+  type ClaudeManagedAccountGateSettings
+} from '../native-chat/claude-structured-managed-account-support'
+
+const SETTINGS = {
+  claudeManagedAccounts: [],
+  activeClaudeManagedAccountId: null,
+  agentDefaultEnv: {},
+  agentDefaultArgs: {}
+} as unknown as ClaudeManagedAccountGateSettings
+
+function gateSettingsGetter(): (() => ClaudeManagedAccountGateSettings) | undefined {
+  const deps: Record<string, unknown> = installed.deps ?? {}
+  const get = deps['getClaudeManagedAccountGateSettings']
+  return typeof get === 'function' ? (get as () => ClaudeManagedAccountGateSettings) : undefined
+}
+
+/** The runtime class this wiring lives on does not typecheck its own `this` calls, so a broken or
+ *  missing gate hookup compiles clean. Pin it behaviourally instead. */
+describe('structured Claude managed-account gate wiring', () => {
+  it('hands the host a gate reader that resolves the live settings', async () => {
+    installed.deps = null
+    const runtime = new OrcaRuntimeService({ getSettings: () => SETTINGS } as never)
+
+    await runtime.ensureStructuredAgentSessionHost()
+
+    const get = gateSettingsGetter()
+    expect(typeof get).toBe('function')
+    expect(get?.()).toBe(SETTINGS)
+  })
+
+  /** The installer composes this getter with the fail-closed reader, which is the shape the
+   *  resolver consumes; pin that composition end to end. */
+  it('composes into a null answer instead of throwing when settings cannot be read', async () => {
+    installed.deps = null
+    const runtime = new OrcaRuntimeService()
+
+    await runtime.ensureStructuredAgentSessionHost()
+
+    const get = gateSettingsGetter()
+    expect(typeof get).toBe('function')
+    expect(() => get?.()).toThrow()
+    expect(readClaudeManagedAccountGateSettings(get!)).toBeNull()
+  })
+})
diff --git a/src/main/runtime/orca-runtime-structured-session-restore.test.ts b/src/main/runtime/orca-runtime-structured-session-restore.test.ts
index 9e752330445..d6ec1e22782 100644
--- a/src/main/runtime/orca-runtime-structured-session-restore.test.ts
+++ b/src/main/runtime/orca-runtime-structured-session-restore.test.ts
@@ -325,6 +325,56 @@ describe('structured session cold restoration', () => {
     expect(closed.tabGroups?.[0]?.tabOrder).toEqual(['terminal-tab'])
   })
 
+  it('publishes restored Claude tabs with the Claude title', async () => {
+    const runtime = new OrcaRuntimeService()
+    const publish = vi.spyOn(runtime, 'publishStructuredAgentSessionTab')
+    const internal = runtime as unknown as {
+      hasPersistedStructuredAgentSessionStore(): boolean
+      getKnownWorkspaceSessionWorktreeIds(): Set<string>
+      hydrateHeadlessMobileSessionTabsFromWorkspaceSession(): Set<string>
+      refreshMobileSessionPtyRecords(): Promise<Set<string> | null>
+      ensureStructuredAgentSessionHost(): Promise<void>
+    }
+    internal.hasPersistedStructuredAgentSessionStore = () => true
+    internal.getKnownWorkspaceSessionWorktreeIds = () => new Set()
+    internal.hydrateHeadlessMobileSessionTabsFromWorkspaceSession = () => new Set()
+    internal.refreshMobileSessionPtyRecords = async () => new Set()
+    internal.ensureStructuredAgentSessionHost = async () => undefined
+    setStructuredAgentSessionHost({
+      reconcileRestartLeases: async () => undefined,
+      restoreReadableSessions: async () => undefined,
+      listSessionTabs: () => [
+        {
+          sessionId: 'agent-session:agent-session:restored-claude',
+          workspaceId: 'workspace-1',
+          agent: 'claude'
+        }
+      ]
+    } as never)
+
+    await runtime.restoreStructuredAgentSessionTabs()
+
+    expect(publish).toHaveBeenCalledWith({
+      workspaceId: 'workspace-1',
+      sessionId: 'restored-claude',
+      agent: 'claude',
+      activate: false,
+      notify: false
+    })
+
+    const restored = await runtime.listMobileSessionTabs('id:workspace-1')
+    expect(restored.tabs).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          type: 'agent-session',
+          id: 'agent-session:restored-claude',
+          title: 'Claude Chat',
+          agent: 'claude'
+        })
+      ])
+    )
+  })
+
   it('commits the host close when the renderer already removed the structured tab', async () => {
     const runtime = new OrcaRuntimeService()
     runtime.setNotifier({
diff --git a/src/main/runtime/orca-runtime-structured-tui-tab-binding.test.ts b/src/main/runtime/orca-runtime-structured-tui-tab-binding.test.ts
new file mode 100644
index 00000000000..d15f754b244
--- /dev/null
+++ b/src/main/runtime/orca-runtime-structured-tui-tab-binding.test.ts
@@ -0,0 +1,730 @@
+import { createHash } from 'node:crypto'
+import { describe, expect, it, vi } from 'vitest'
+import type { StructuredAgentSessionHandoffTransport } from '../native-chat/agent-session-wire/structured-agent-session-handoff-types'
+import { createEphemeralAgentSessionClaimSigner } from './agent-session-claim-identity'
+import { agentSessionPtyWriteGate } from './agent-session-pty-write-gate'
+import { OrcaRuntimeService } from './orca-runtime'
+
+const {
+  probeAgentSessionProcessIdentity,
+  proveCodexTuiRollout,
+  readClaudeTranscriptLeafUuid,
+  readStructuredTuiProcessIdentity,
+  resolveSessionFilePath,
+  resolvePinnedCodexRolloutProof
+} = vi.hoisted(() => ({
+  probeAgentSessionProcessIdentity: vi.fn(),
+  proveCodexTuiRollout: vi.fn(),
+  readClaudeTranscriptLeafUuid: vi.fn(),
+  readStructuredTuiProcessIdentity: vi.fn(),
+  resolveSessionFilePath: vi.fn(),
+  resolvePinnedCodexRolloutProof: vi.fn()
+}))
+
+vi.mock('./structured-tui-process-identity', () => ({ readStructuredTuiProcessIdentity }))
+vi.mock('../codex/codex-tui-rollout-proof', () => ({
+  proveCodexTuiRollout,
+  resolvePinnedCodexRolloutProof
+}))
+vi.mock('../native-chat/session-file-resolver', () => ({
+  readClaudeTranscriptLeafUuid,
+  resolveSessionFilePath
+}))
+vi.mock('./agent-session-process-identity-probe', async (importOriginal) => ({
+  ...(await importOriginal()),
+  probeAgentSessionProcessIdentity
+}))
+
+const WORKTREE_ID = 'repo-1::/tmp/structured-handoff'
+
+function notifier(revealTerminalSession: ReturnType<typeof vi.fn>) {
+  return {
+    worktreesChanged: vi.fn(),
+    reposChanged: vi.fn(),
+    activateWorktree: vi.fn(),
+    createTerminal: vi.fn(),
+    revealTerminalSession,
+    splitTerminal: vi.fn(),
+    renameTerminal: vi.fn(),
+    focusTerminal: vi.fn(),
+    closeTerminal: vi.fn(),
+    sleepWorktree: vi.fn(),
+    terminalFitOverrideChanged: vi.fn(),
+    terminalDriverChanged: vi.fn()
+  }
+}
+
+describe('structured TUI launch tab binding', () => {
+  it('recovers a live TUI from durable owner inventory in a fresh runtime', async () => {
+    const namespace = {
+      machine: 'native:test',
+      principal: 'uid:1',
+      container: 'native',
+      providerRoot: '/tmp/codex-home'
+    }
+    const signer = createEphemeralAgentSessionClaimSigner('profile-test')
+    const claim = signer.createClaim({
+      namespace,
+      identity: { agent: 'codex', providerSession: { key: 'session_id', id: 'thread-1' } },
+      canonicalWorktreeId: WORKTREE_ID
+    })
+    const terminalHandle = 'term_cold_owner'
+    const leafId = '23013912-13f8-44e5-818f-d40a1ff4e8c5'
+    resolvePinnedCodexRolloutProof.mockResolvedValue('/tmp/codex-home/sessions/thread-1.jsonl')
+    const writeAgentSessionProof = vi.fn(() => false)
+    const runtime = new OrcaRuntimeService(undefined, undefined, {
+      agentSessionClaimSigner: signer
+    })
+    runtime.setPtyController({
+      listProcesses: vi.fn(async () => [
+        {
+          id: 'pty-cold-owner',
+          incarnationId: 'incarnation-1',
+          cwd: '/tmp/structured-handoff',
+          title: 'codex',
+          worktreeId: WORKTREE_ID,
+          terminalHandle,
+          agentSessionOwners: [
+            {
+              claim,
+              generation: 'generation-1',
+              phase: 'live' as const,
+              ptyId: 'pty-cold-owner',
+              surface: {
+                worktreeId: WORKTREE_ID,
+                tabId: 'tab-cold-owner',
+                leafId,
+                terminalHandle
+              }
+            }
+          ]
+        }
+      ]),
+      write: () => true,
+      kill: () => true,
+      writeAgentSessionProof,
+      getForegroundProcess: async () => null
+    })
+    const internal = runtime as unknown as {
+      createStructuredAgentSessionHandoffTransport(): StructuredAgentSessionHandoffTransport
+      refreshMobileSessionPtyRecords(): Promise<Set<string> | null>
+      listResolvedWorktrees(): Promise<unknown[]>
+      resolveTerminalWorkspaceLaunchScope(): Promise<{
+        id: string
+        path: string
+        connectionId: null
+        repo: null
+        folderWorkspace: null
+      }>
+      getAgentSessionExecutionNamespace(): typeof namespace
+      ptysById: Map<
+        string,
+        {
+          launchToken: string | null
+          launchAgent: string | null
+          agentSessionOwners: unknown[]
+          tabId?: string | null
+          paneKey?: string | null
+        }
+      >
+    }
+    internal.listResolvedWorktrees = vi.fn(async () => [
+      { id: WORKTREE_ID, repoId: 'repo-1', path: '/tmp/structured-handoff' }
+    ])
+    internal.resolveTerminalWorkspaceLaunchScope = vi.fn(async () => ({
+      id: WORKTREE_ID,
+      path: '/tmp/structured-handoff',
+      connectionId: null,
+      repo: null,
+      folderWorkspace: null
+    }))
+    internal.getAgentSessionExecutionNamespace = () => namespace
+    proveCodexTuiRollout.mockResolvedValueOnce({
+      transcriptPath: '/tmp/codex-home/sessions/thread-1.jsonl'
+    })
+    probeAgentSessionProcessIdentity.mockResolvedValue({
+      outcome: 'identity-matched',
+      matchedOn: ['process-start-time']
+    })
+
+    await internal.refreshMobileSessionPtyRecords()
+    const coldPty = internal.ptysById.get('pty-cold-owner')!
+    expect(coldPty).toMatchObject({ launchToken: null, launchAgent: null })
+    expect(coldPty.agentSessionOwners).toHaveLength(1)
+    const runtimeId = (runtime as unknown as { runtimeId: string }).runtimeId
+    ;(
+      runtime as unknown as {
+        handles: Map<
+          string,
+          {
+            handle: string
+            runtimeId: string
+            rendererGraphEpoch: number
+            worktreeId: string
+            tabId: string
+            leafId: string
+            ptyId: string
+            ptyGeneration: number
+          }
+        >
+      }
+    ).handles.set(terminalHandle, {
+      handle: terminalHandle,
+      runtimeId,
+      rendererGraphEpoch: 0,
+      worktreeId: WORKTREE_ID,
+      tabId: 'pty:pty-cold-owner',
+      leafId: 'pty:pty-cold-owner',
+      ptyId: 'pty-cold-owner',
+      ptyGeneration: 0
+    })
+    coldPty.tabId = 'tab-cold-owner'
+    coldPty.paneKey = `tab-cold-owner:${leafId}`
+    coldPty.launchToken = 'spawn-token'
+    coldPty.launchAgent = 'codex'
+
+    const owner = await internal.createStructuredAgentSessionHandoffTransport().recoverTuiOwner({
+      sessionId: 'session-1',
+      location: { workspaceId: WORKTREE_ID, executionHostId: 'local' },
+      accountHome: { variable: 'CODEX_HOME', path: namespace.providerRoot },
+      providerHandleChain: [{ handle: { provider: 'codex', threadId: 'thread-1' }, observedAt: 1 }],
+      lease: {
+        ownerProcess: {
+          hostId: 'local',
+          pid: 4243,
+          processStartTimeMs: 10,
+          spawnToken: 'spawn-token'
+        },
+        runtimeFence: 3
+      }
+    } as never)
+
+    expect(owner.terminal).toEqual({
+      handle: terminalHandle,
+      tabId: 'tab-cold-owner',
+      paneKey: `tab-cold-owner:${leafId}`,
+      ptyId: 'pty-cold-owner'
+    })
+    expect(proveCodexTuiRollout).toHaveBeenCalledWith(
+      expect.objectContaining({
+        codexHome: namespace.providerRoot,
+        threadId: 'thread-1',
+        readOutput: expect.any(Function),
+        write: expect.any(Function)
+      })
+    )
+    expect(resolvePinnedCodexRolloutProof).not.toHaveBeenCalled()
+    expect(writeAgentSessionProof).not.toHaveBeenCalled()
+    expect(agentSessionPtyWriteGate.boundSessionId('pty-cold-owner')).toBe('session-1')
+    agentSessionPtyWriteGate.unbindPty('pty-cold-owner')
+  })
+
+  it('rebuilds a Claude proving link from current launch-token-bound hook evidence', async () => {
+    const paneKey = 'tab-claude:leaf-claude'
+    const spawnToken = 'claude-restart-token'
+    const sessionId = '019fd532-7c11-7a90-b6de-4e1a2c3d5f61'
+    const transcriptPath = '/tmp/claude-home/projects/worktree/session.jsonl'
+    const attestAgentHookCompatibilityAuthority = vi.fn(() => ({
+      paneKey,
+      source: 'hydrated_commitment' as const
+    }))
+    const runtime = new OrcaRuntimeService(null, undefined, {
+      attestAgentHookCompatibilityAuthority,
+      getAgentProviderSessionRowsForPane: () => [
+        {
+          paneKey,
+          connectionId: null,
+          state: 'done',
+          prompt: '',
+          agentType: 'claude',
+          receivedAt: Date.now() + 1000,
+          stateStartedAt: 10,
+          providerSession: { key: 'session_id', id: sessionId, transcriptPath }
+        }
+      ]
+    })
+    const internal = runtime as unknown as {
+      createStructuredAgentSessionHandoffTransport(): StructuredAgentSessionHandoffTransport
+      ptysById: Map<string, unknown>
+      restoredOrchestrationAuthorityByPtyId: Map<string, unknown>
+    }
+    internal.ptysById.set('pty-claude', {
+      ptyId: 'pty-claude',
+      worktreeId: WORKTREE_ID,
+      connectionId: null,
+      tabId: 'tab-claude',
+      paneKey,
+      launchToken: spawnToken,
+      launchAgent: 'claude',
+      connected: true
+    })
+    resolveSessionFilePath.mockResolvedValue('/tmp/claude-home/projects/worktree/session.jsonl')
+    readClaudeTranscriptLeafUuid.mockResolvedValue('leaf-before-resume')
+    const record = {
+      sessionId: 'session-1',
+      accountHome: { variable: 'CLAUDE_CONFIG_DIR', path: '/tmp/claude-home' },
+      providerHandleChain: [
+        {
+          linkId: 'claude-old',
+          handle: { provider: 'claude', sessionId, leafUuid: 'leaf-before-resume' },
+          origin: 'created',
+          mintedAtFence: 1,
+          observedAt: 1
+        }
+      ],
+      lease: {
+        runtimeFence: 3,
+        ownerProcess: {
+          hostId: 'local',
+          pid: 4343,
+          processStartTimeMs: 20,
+          spawnToken
+        },
+        provenHandleLinkId: null
+      }
+    } as never
+    probeAgentSessionProcessIdentity.mockResolvedValue({
+      outcome: 'identity-matched',
+      matchedOn: ['process-start-time']
+    })
+
+    const transport = internal.createStructuredAgentSessionHandoffTransport()
+    const recovered = await transport.recoverTuiOwner(record)
+    expect(recovered).toMatchObject({
+      transcriptPath,
+      link: {
+        handle: { provider: 'claude', sessionId, leafUuid: 'leaf-before-resume' },
+        origin: 'resumed',
+        mintedAtFence: 3
+      }
+    })
+    expect(recovered.link.linkId).not.toBe('claude-old')
+
+    const pty = internal.ptysById.get('pty-claude') as {
+      launchToken: string | null
+    }
+    pty.launchToken = null
+    const dispatchAuthority = runtime.getOrchestrationDispatchAuthority(recovered.terminal.handle)!
+    internal.restoredOrchestrationAuthorityByPtyId.set('pty-claude', {
+      ptyId: 'pty-claude',
+      worktreeId: WORKTREE_ID,
+      terminalHandle: recovered.terminal.handle,
+      paneKey: recovered.terminal.paneKey,
+      processIncarnation: dispatchAuthority.processIncarnation,
+      hostScope: dispatchAuthority.hostScope
+    })
+
+    expect(
+      runtime.verifyOrchestrationCompatibilityCaller({
+        terminalHandle: recovered.terminal.handle,
+        paneKey,
+        launchToken: spawnToken
+      })
+    ).toMatchObject({
+      paneKey,
+      terminalHandle: recovered.terminal.handle,
+      processIncarnation: dispatchAuthority.processIncarnation
+    })
+    expect(attestAgentHookCompatibilityAuthority).toHaveBeenCalledWith({
+      paneKey,
+      launchTokenHash: createHash('sha256').update(spawnToken).digest('hex'),
+      connectionId: null,
+      terminalProvenance: 'restored'
+    })
+    attestAgentHookCompatibilityAuthority.mockReturnValueOnce(null as never)
+    expect(
+      runtime.verifyOrchestrationCompatibilityCaller({
+        terminalHandle: recovered.terminal.handle,
+        paneKey,
+        launchToken: spawnToken
+      })
+    ).toBeNull()
+    expect(agentSessionPtyWriteGate.boundSessionId('pty-claude')).toBe('session-1')
+    agentSessionPtyWriteGate.unbindPty('pty-claude')
+  })
+
+  it('requires restored hook attestation after the runtime restarts', async () => {
+    const paneKey = 'tab-restored:leaf-restored'
+    const spawnToken = 'restored-token'
+    const sessionId = '019fd532-7c11-7a90-b6de-4e1a2c3d5f62'
+    const transcriptPath = '/tmp/claude-home/projects/worktree/restored.jsonl'
+    const attestAgentHookCompatibilityAuthority = vi.fn(() => ({
+      paneKey,
+      source: 'hydrated_commitment' as const
+    }))
+    const runtime = new OrcaRuntimeService(null, undefined, {
+      attestAgentHookCompatibilityAuthority,
+      getAgentProviderSessionRowsForPane: () => [
+        {
+          paneKey,
+          connectionId: null,
+          state: 'done',
+          prompt: '',
+          agentType: 'claude',
+          receivedAt: Date.now() + 1000,
+          stateStartedAt: 10,
+          providerSession: { key: 'session_id', id: sessionId, transcriptPath }
+        }
+      ]
+    })
+    const internal = runtime as unknown as {
+      createStructuredAgentSessionHandoffTransport(): StructuredAgentSessionHandoffTransport
+      ptysById: Map<string, unknown>
+      restoredOrchestrationAuthorityByPtyId: Map<string, unknown>
+    }
+    internal.ptysById.set('pty-restored', {
+      ptyId: 'pty-restored',
+      worktreeId: WORKTREE_ID,
+      connectionId: null,
+      tabId: 'tab-restored',
+      paneKey,
+      launchToken: spawnToken,
+      launchAgent: 'claude',
+      connected: true
+    })
+    resolveSessionFilePath.mockResolvedValue('/tmp/claude-home/projects/worktree/restored.jsonl')
+    readClaudeTranscriptLeafUuid.mockResolvedValue('leaf-restored')
+    const record = {
+      sessionId: 'session-restored',
+      accountHome: { variable: 'CLAUDE_CONFIG_DIR', path: '/tmp/claude-home' },
+      providerHandleChain: [
+        {
+          linkId: 'claude-restored',
+          handle: { provider: 'claude', sessionId, leafUuid: 'leaf-restored' },
+          origin: 'created',
+          mintedAtFence: 1,
+          observedAt: 1
+        }
+      ],
+      lease: {
+        runtimeFence: 4,
+        ownerProcess: {
+          hostId: 'local',
+          pid: 4545,
+          processStartTimeMs: 30,
+          spawnToken
+        },
+        provenHandleLinkId: null
+      }
+    } as never
+
+    const recovered = await internal
+      .createStructuredAgentSessionHandoffTransport()
+      .recoverTuiOwner(record)
+    const restoredPty = internal.ptysById.get('pty-restored') as {
+      launchToken: string | null
+    }
+    restoredPty.launchToken = null
+    const dispatchAuthority = runtime.getOrchestrationDispatchAuthority(recovered.terminal.handle)!
+    internal.restoredOrchestrationAuthorityByPtyId.set('pty-restored', {
+      ptyId: 'pty-restored',
+      worktreeId: WORKTREE_ID,
+      terminalHandle: recovered.terminal.handle,
+      paneKey: recovered.terminal.paneKey,
+      processIncarnation: dispatchAuthority.processIncarnation,
+      hostScope: dispatchAuthority.hostScope
+    })
+
+    expect(
+      runtime.verifyOrchestrationCompatibilityCaller({
+        terminalHandle: recovered.terminal.handle,
+        paneKey,
+        launchToken: spawnToken
+      })
+    ).toMatchObject({
+      paneKey,
+      terminalHandle: recovered.terminal.handle,
+      processIncarnation: dispatchAuthority.processIncarnation
+    })
+    expect(attestAgentHookCompatibilityAuthority).toHaveBeenCalledWith({
+      paneKey,
+      launchTokenHash: createHash('sha256').update(spawnToken).digest('hex'),
+      connectionId: null,
+      terminalProvenance: 'restored'
+    })
+    attestAgentHookCompatibilityAuthority.mockReturnValueOnce(null as never)
+    await expect(
+      runtime.verifyOrchestrationCompatibilityCaller({
+        terminalHandle: recovered.terminal.handle,
+        paneKey,
+        launchToken: spawnToken
+      })
+    ).toBeNull()
+    agentSessionPtyWriteGate.unbindPty('pty-restored')
+  })
+
+  it('proves the published launch tab before returning its revealed renderer binding', async () => {
+    let explicitStatus: {
+      state: 'working' | 'done'
+      prompt: string
+      receivedAt: number
+      stateStartedAt: number
+      paneKey: string
+      terminalHandle: string
+    } | null = null
+    const revealTerminalSession = vi.fn(
+      (_worktreeId: string, _options: { tabId?: string; leafId?: string; ptyId?: string }) =>
+        Promise.resolve({ tabId: 'tab-renderer' })
+    )
+    const runtime = new OrcaRuntimeService(
+      {
+        getSettings: () => ({
+          disabledTuiAgents: [],
+          agentCmdOverrides: {},
+          agentDefaultArgs: {
+            codex: '-m gpt-5.6-sol -c model_reasoning_effort=high'
+          },
+          agentDefaultEnv: {}
+        })
+      } as never,
+      undefined,
+      {
+        getAgentStatusSnapshot: () => (explicitStatus ? [explicitStatus as never] : [])
+      }
+    )
+    runtime.setNotifier(notifier(revealTerminalSession) as never)
+    const spawn = vi.fn().mockResolvedValue({ id: 'pty-structured', pid: 4242 })
+    runtime.setPtyController({
+      spawn,
+      write: () => true,
+      kill: () => true,
+      getForegroundProcess: async () => null
+    })
+
+    const internal = runtime as unknown as {
+      createStructuredAgentSessionHandoffTransport(): StructuredAgentSessionHandoffTransport
+      resolveTerminalWorkspaceLaunchScope(): Promise<{
+        id: string
+        path: string
+        connectionId: null
+        repo: null
+        folderWorkspace: null
+      }>
+      markLocalWorkspaceTrustedForAgent(): void
+      waitForTerminal(): Promise<unknown>
+      waitForAdoptedStructuredTuiProof(): Promise<{ transcriptPath?: string }>
+      waitForStructuredTuiPtyExit(): Promise<void>
+      closeTerminal(handle: string): Promise<unknown>
+      handles: Map<
+        string,
+        {
+          rendererGraphEpoch: number
+          tabId: string
+          leafId: string
+        }
+      >
+      graphStatus: 'ready'
+    }
+    internal.resolveTerminalWorkspaceLaunchScope = vi.fn(async () => ({
+      id: WORKTREE_ID,
+      path: '/tmp/structured-handoff',
+      connectionId: null,
+      repo: null,
+      folderWorkspace: null
+    }))
+    internal.markLocalWorkspaceTrustedForAgent = vi.fn()
+    const waitForTerminal = vi.fn(async () => ({}))
+    internal.waitForTerminal = waitForTerminal
+    const waitForAdoptedStructuredTuiProof = vi.fn(async () => {
+      const snapshot = await runtime.listMobileSessionTabs(`id:${WORKTREE_ID}`)
+      expect(snapshot.tabs).toContainEqual(
+        expect.objectContaining({
+          type: 'terminal',
+          parentTabId: expect.any(String),
+          leafId: expect.any(String),
+          ptyId: 'pty-structured',
+          terminal: expect.any(String)
+        })
+      )
+      expect(revealTerminalSession).not.toHaveBeenCalled()
+      return { transcriptPath: '/tmp/rollout.jsonl' }
+    })
+    internal.waitForAdoptedStructuredTuiProof = waitForAdoptedStructuredTuiProof
+    const waitForStructuredTuiPtyExit = vi.fn(async () => {})
+    internal.waitForStructuredTuiPtyExit = waitForStructuredTuiPtyExit
+    const closeTerminal = vi.fn(async () => undefined)
+    internal.closeTerminal = closeTerminal
+    readStructuredTuiProcessIdentity.mockResolvedValue({
+      hostId: 'local',
+      pid: 4243,
+      processStartTimeMs: 10,
+      spawnToken: 'spawn-token'
+    })
+    probeAgentSessionProcessIdentity.mockResolvedValue({
+      outcome: 'identity-matched',
+      matchedOn: ['process-start-time']
+    })
+
+    const transport = internal.createStructuredAgentSessionHandoffTransport()
+    const onSpawned = vi.fn(async () => {})
+    const owner = await transport.launchTui({
+      record: {
+        sessionId: 'session-1',
+        location: { workspaceId: WORKTREE_ID, executionHostId: 'local' },
+        accountHome: { variable: 'CODEX_HOME', path: '/tmp/codex-home' },
+        launchArgs: ['--search'],
+        options: { model: 'gpt-5.6-terra', effort: 'medium' },
+        providerHandleChain: [
+          { handle: { provider: 'codex', threadId: 'thread-1' }, observedAt: 1 }
+        ]
+      } as never,
+      fence: 3,
+      spawnToken: 'spawn-token',
+      onSpawned
+    })
+
+    const reveal = revealTerminalSession.mock.calls[0]?.[1] as {
+      tabId: string
+      leafId: string
+    }
+    expect(owner.terminal).toMatchObject({
+      tabId: 'tab-renderer',
+      paneKey: `${reveal.tabId}:${reveal.leafId}`,
+      ptyId: 'pty-structured'
+    })
+    expect(waitForTerminal).toHaveBeenCalledWith(
+      expect.any(String),
+      expect.objectContaining({ condition: 'tui-idle' })
+    )
+    expect(waitForAdoptedStructuredTuiProof).toHaveBeenCalledOnce()
+    expect(onSpawned).toHaveBeenCalledWith(
+      expect.objectContaining({
+        terminal: expect.objectContaining({ ptyId: 'pty-structured' }),
+        process: expect.objectContaining({ spawnToken: 'spawn-token' })
+      })
+    )
+    expect(onSpawned.mock.invocationCallOrder[0]).toBeLessThan(
+      waitForTerminal.mock.invocationCallOrder[0]!
+    )
+    expect(waitForAdoptedStructuredTuiProof.mock.invocationCallOrder[0]).toBeLessThan(
+      revealTerminalSession.mock.invocationCallOrder[0]!
+    )
+    const launchCommand = spawn.mock.calls[0]?.[0]?.command
+    expect(launchCommand).toContain("'-m' 'gpt-5.6-terra'")
+    expect(launchCommand).toContain("'-c' 'model_reasoning_effort=medium'")
+    expect(launchCommand).toContain("'--search'")
+    expect(launchCommand).not.toContain('gpt-5.6-sol')
+    expect(launchCommand).not.toContain('model_reasoning_effort=high')
+
+    Object.assign(internal.handles.get(owner.terminal.handle)!, {
+      rendererGraphEpoch: -1,
+      tabId: 'tab-retired',
+      leafId: 'leaf-retired'
+    })
+    internal.graphStatus = 'ready'
+
+    explicitStatus = {
+      state: 'working',
+      prompt: '',
+      receivedAt: Date.now(),
+      stateStartedAt: Date.now(),
+      paneKey: owner.terminal.paneKey,
+      terminalHandle: owner.terminal.handle
+    }
+    expect(transport.tuiStatus(owner)).toBe('busy')
+    await expect(
+      transport.waitForTuiIdleOrExit(owner, new AbortController().signal)
+    ).resolves.toBeNull()
+
+    explicitStatus = { ...explicitStatus, state: 'done', receivedAt: Date.now() }
+    expect(transport.tuiStatus(owner)).toBe('idle')
+    await expect(transport.waitForTuiIdleOrExit(owner, new AbortController().signal)).resolves.toBe(
+      'idle'
+    )
+
+    explicitStatus = null
+    const livePty = (
+      runtime as unknown as {
+        ptysById: Map<
+          string,
+          {
+            tailBuffer: string[]
+            tailPartialLine: string
+            preview: string
+            lastAgentStatus: null
+            lastAgentStatusObservedLive: boolean
+          }
+        >
+      }
+    ).ptysById.get('pty-structured')!
+    Object.assign(livePty, {
+      tailBuffer: [
+        'OpenAI Codex (v0.147.0)',
+        'model: gpt-5.6-terra',
+        'directory: /tmp/structured-handoff'
+      ],
+      tailPartialLine: '',
+      preview: '',
+      lastAgentStatus: null,
+      lastAgentStatusObservedLive: false
+    })
+    expect(transport.tuiStatus(owner)).toBe('idle')
+    await expect(transport.waitForTuiIdleOrExit(owner, new AbortController().signal)).resolves.toBe(
+      'idle'
+    )
+
+    const pty = (
+      runtime as unknown as {
+        ptysById: Map<string, { connected: boolean; launchToken: string | null }>
+      }
+    ).ptysById.get('pty-structured')!
+    pty.launchToken = null
+    const persistedRecord = {
+      sessionId: 'session-1',
+      providerHandleChain: [{ handle: { provider: 'codex', threadId: 'thread-1' }, observedAt: 1 }],
+      lease: { ownerProcess: owner.process, provenHandleLinkId: owner.link.linkId }
+    } as never
+
+    const rebound = await transport.reproveTuiOwner({ record: persistedRecord, owner })
+    expect(rebound.terminal).toMatchObject({
+      ptyId: 'pty-structured',
+      tabId: owner.terminal.tabId,
+      paneKey: owner.terminal.paneKey
+    })
+    expect(rebound.terminal.handle).not.toBe(owner.terminal.handle)
+    await transport.waitForTuiExit(rebound)
+    expect(waitForStructuredTuiPtyExit).toHaveBeenCalledWith('pty-structured')
+    expect(waitForAdoptedStructuredTuiProof).toHaveBeenCalledOnce()
+
+    await expect(transport.closeTuiOwner?.(rebound)).resolves.toEqual({
+      transcriptPath: '/tmp/rollout.jsonl'
+    })
+    expect(closeTerminal).toHaveBeenCalledWith(rebound.terminal.handle)
+
+    explicitStatus = null
+    pty.connected = false
+    await expect(
+      transport.waitForTuiIdleOrExit(rebound, new AbortController().signal)
+    ).resolves.toBe('exited')
+    await expect(transport.stopFailedTuiLaunch?.(rebound)).resolves.toBeUndefined()
+  })
+
+  it('reveals Claude structured native sessions into the mobile graph', async () => {
+    const runtime = new OrcaRuntimeService()
+    const publish = vi.spyOn(runtime, 'publishStructuredAgentSessionTab')
+    const focusEditorTab = vi.fn()
+    runtime.setNotifier({ focusEditorTab } as never)
+    const internal = runtime as unknown as {
+      createStructuredAgentSessionHandoffTransport(): StructuredAgentSessionHandoffTransport
+    }
+
+    await internal.createStructuredAgentSessionHandoffTransport().revealNativeSession?.({
+      workspaceId: WORKTREE_ID,
+      sessionId: 'session-claude',
+      agent: 'claude'
+    })
+
+    expect(publish).toHaveBeenCalledWith(
+      expect.objectContaining({
+        workspaceId: WORKTREE_ID,
+        sessionId: 'session-claude',
+        agent: 'claude',
+        activate: false
+      })
+    )
+    expect(focusEditorTab).toHaveBeenCalledWith(
+      'structured-agent-session-session-claude',
+      WORKTREE_ID
+    )
+  })
+})
diff --git a/src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts b/src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts
index fe6e8bfe3da..a12ffabcd61 100644
--- a/src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/local-worktree-creation-part-02.spec.ts
@@ -50,7 +50,13 @@ describe('OrcaRuntimeService', () => {
         pushTarget: { remoteName: 'origin', branchName: 'feature/fix' }
       })
 
-      expect(getBranchConflictKind).toHaveBeenCalledWith(TEST_REPO_PATH, 'feature/fix', 'abc123')
+      expect(getBranchConflictKind).toHaveBeenCalledWith(
+        TEST_REPO_PATH,
+        'feature/fix',
+        'abc123',
+        {},
+        undefined
+      )
       expect(getPRForBranchMock).toHaveBeenCalledWith(TEST_REPO_PATH, 'feature/fix')
       expect(addWorktree).toHaveBeenCalledWith(
         TEST_REPO_PATH,
@@ -165,7 +171,9 @@ describe('OrcaRuntimeService', () => {
       expect(getBranchConflictKind).toHaveBeenCalledWith(
         TEST_REPO_PATH,
         'feature/bitbucket',
-        'abc123'
+        'abc123',
+        {},
+        undefined
       )
       expect(getHostedReviewForBranchMock).toHaveBeenCalledWith(
         expect.objectContaining({
diff --git a/src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts b/src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts
index 17fe670a09c..3dcd2d0584c 100644
--- a/src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/local-worktree-creation.spec.ts
@@ -533,10 +533,14 @@ describe('OrcaRuntimeService', () => {
       branchNameOverride: 'feature/something'
     })
 
+    // Why: an explicit branch override adopts the local branch before the conflict
+    // probe, so no lazy adoption callback is handed to getBranchConflictKind.
     expect(getBranchConflictKind).toHaveBeenCalledWith(
       TEST_REPO_PATH,
       'feature/something',
-      'origin/feature/something'
+      'origin/feature/something',
+      {},
+      undefined
     )
     expect(addWorktree).toHaveBeenCalledWith(
       TEST_REPO_PATH,
diff --git a/src/main/runtime/orca-runtime-tests/reattach-headless-grid.spec.ts b/src/main/runtime/orca-runtime-tests/reattach-headless-grid.spec.ts
new file mode 100644
index 00000000000..43ba687c4bf
--- /dev/null
+++ b/src/main/runtime/orca-runtime-tests/reattach-headless-grid.spec.ts
@@ -0,0 +1,47 @@
+import { describe, expect, it } from 'vitest'
+import { createRuntime, syncSinglePty } from '../orca-runtime-test-fixtures.spec'
+
+describe('headless model grid after a reattach', () => {
+  it('reflows a model that live bytes created at the 80x24 default onto the PTY grid', async () => {
+    const runtime = createRuntime()
+    // No controller size: mirrors a reattach whose real grid main only learns from the reply.
+    runtime.setPtyController({
+      write: () => true,
+      kill: () => true,
+      getForegroundProcess: async () => null,
+      getSize: () => null
+    })
+    syncSinglePty(runtime, 'pty-1')
+
+    runtime.onPtyData('pty-1', 'user@host % claude\r\n', 100)
+    await expect(
+      runtime.serializeMainTerminalBuffer('pty-1', { scrollbackRows: 100 })
+    ).resolves.toMatchObject({ cols: 80, rows: 24 })
+
+    runtime.reflowHeadlessTerminalToPtyGrid('pty-1', 211, 57)
+
+    await expect(
+      runtime.serializeMainTerminalBuffer('pty-1', { scrollbackRows: 100 })
+    ).resolves.toMatchObject({ cols: 211, rows: 57, source: 'headless' })
+  })
+
+  it('never creates a model for a PTY that has none', async () => {
+    const runtime = createRuntime()
+    runtime.setPtyController({
+      write: () => true,
+      kill: () => true,
+      getForegroundProcess: async () => null,
+      getSize: () => null
+    })
+    syncSinglePty(runtime, 'pty-1')
+
+    runtime.reflowHeadlessTerminalToPtyGrid('pty-1', 211, 57)
+    runtime.onPtyData('pty-1', 'hello\r\n', 100)
+
+    // Why it matters: commit reflows every reattach, and pre-creating here would defeat the
+    // renderer-authority gate that deliberately leaves the model unseeded.
+    await expect(
+      runtime.serializeMainTerminalBuffer('pty-1', { scrollbackRows: 100 })
+    ).resolves.toMatchObject({ cols: 80, rows: 24 })
+  })
+})
diff --git a/src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation.spec.ts b/src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation.spec.ts
index 65da9caccde..630eaebf007 100644
--- a/src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation.spec.ts
@@ -376,7 +376,18 @@ describe('OrcaRuntimeService', () => {
         TEST_REPO_PATH,
         'runtime-wsl',
         'origin/main',
-        { wslDistro: 'Ubuntu' }
+        { wslDistro: 'Ubuntu' },
+        expect.any(Function)
+      )
+      // Why: the lazy adoption callback is only invoked when the conflict probe
+      // sees a local ref, so drive it here to prove adoption also routes via WSL.
+      const adoptLocalBranch = vi
+        .mocked(getBranchConflictKind)
+        .mock.calls.findLast((call) => call[1] === 'runtime-wsl')?.[4]
+      await expect(adoptLocalBranch?.()).resolves.toBe(false)
+      expect(gitSpy).toHaveBeenCalledWith(
+        ['rev-parse', '--verify', '--quiet', 'refs/heads/runtime-wsl^{commit}'],
+        { cwd: TEST_REPO_PATH, wslDistro: 'Ubuntu' }
       )
       expect(getPRForBranchMock).toHaveBeenCalledWith(
         TEST_REPO_PATH,
diff --git a/src/main/runtime/orca-runtime.test.ts b/src/main/runtime/orca-runtime.test.ts
index 9d223233ef2..05739f4fe39 100644
--- a/src/main/runtime/orca-runtime.test.ts
+++ b/src/main/runtime/orca-runtime.test.ts
@@ -34,6 +34,7 @@ await import('./orca-runtime-tests/terminal-side-effect-facts-part-03.spec')
 await import('./orca-runtime-tests/decorative-title-fact-throttle.spec')
 await import('./orca-runtime-tests/headless-snapshots.spec')
 await import('./orca-runtime-tests/headless-snapshots-part-02.spec')
+await import('./orca-runtime-tests/reattach-headless-grid.spec')
 await import('./orca-runtime-tests/agent-status-and-waits.spec')
 await import('./orca-runtime-tests/agent-status-and-waits-part-02.spec')
 await import('./orca-runtime-tests/agent-status-and-waits-part-03.spec')
diff --git a/src/main/runtime/orchestration/__snapshots__/preamble.test.ts.snap b/src/main/runtime/orchestration/__snapshots__/preamble.test.ts.snap
index d92228517aa..8b7ffc115a7 100644
--- a/src/main/runtime/orchestration/__snapshots__/preamble.test.ts.snap
+++ b/src/main/runtime/orchestration/__snapshots__/preamble.test.ts.snap
@@ -10,6 +10,7 @@ Slack, GitHub comments, or any other channel to reach a human during the run.
 
 === CLI COMMANDS ===
 
+\`\`\`sh
   # Report the terminal task outcome (REQUIRED exactly once).
   #
   # RULE: --body must be a 3-sentence executive summary (what you did,
@@ -71,6 +72,7 @@ Slack, GitHub comments, or any other channel to reach a human during the run.
 
   # Check for messages from the coordinator:
   orca orchestration check --terminal term_WORKER
+\`\`\`
 
 === AFTER YOU SEND worker_done ===
 
diff --git a/src/main/runtime/orchestration/coordinator-task-dispatch.ts b/src/main/runtime/orchestration/coordinator-task-dispatch.ts
index 685552cc2e9..e058d9cdc98 100644
--- a/src/main/runtime/orchestration/coordinator-task-dispatch.ts
+++ b/src/main/runtime/orchestration/coordinator-task-dispatch.ts
@@ -132,7 +132,7 @@ export async function dispatchTaskToWorker(params: {
   let gateContext = ''
   if (gates.length > 0) {
     const latest = gates.at(-1)!
-    gateContext = `\n\n--- DECISION GATE RESOLVED ---\nQuestion: ${latest.question}\nResolution: ${latest.resolution}\n---\n`
+    gateContext = `\n\n--- DECISION GATE RESOLVED ---\nQuestion: ${latest.question}\nResolution: ${latest.resolution}\n\n---\n`
   }
 
   try {
diff --git a/src/main/runtime/orchestration/db/database-file-permissions.ts b/src/main/runtime/orchestration/db/database-file-permissions.ts
index 1bbd640ba77..dd2e49e77a5 100644
--- a/src/main/runtime/orchestration/db/database-file-permissions.ts
+++ b/src/main/runtime/orchestration/db/database-file-permissions.ts
@@ -1,17 +1,5 @@
-import { chmodSync, existsSync } from 'node:fs'
+import { hardenSqliteDatabaseFiles } from '../../../sqlite/harden-database-files'
 
 export function hardenOrchestrationDatabaseFiles(dbPath: (string & {}) | ':memory:'): void {
-  if (dbPath === ':memory:' || process.platform === 'win32') {
-    // Why: Windows protects these files through Orca's current-user-only userData DACL; POSIX mode bits are inert there.
-    return
-  }
-  for (const path of [dbPath, `${dbPath}-wal`, `${dbPath}-shm`]) {
-    try {
-      if (existsSync(path)) {
-        chmodSync(path, 0o600)
-      }
-    } catch {
-      // Why: best-effort — a mount that rejects chmod (SSHFS, some network shares) must not fail DB startup.
-    }
-  }
+  hardenSqliteDatabaseFiles(dbPath)
 }
diff --git a/src/main/runtime/orchestration/db/dispatch-context/dispatch-context-store.ts b/src/main/runtime/orchestration/db/dispatch-context/dispatch-context-store.ts
index cd4083acc0a..ee78396292d 100644
--- a/src/main/runtime/orchestration/db/dispatch-context/dispatch-context-store.ts
+++ b/src/main/runtime/orchestration/db/dispatch-context/dispatch-context-store.ts
@@ -7,6 +7,7 @@ import { paneKeyMatchSuffix } from '../pane-key-match'
 import { claimDispatchContextRow } from '../dispatch-row-writer'
 import type { DispatchCreator } from '../dispatch-depth'
 import type { OrchestrationDb } from '../orchestration-db'
+import { taskNotFoundError, taskNotStartableError } from '../../task-dispatch-refusal'
 
 export function createDispatchContext(
   this: OrchestrationDb,
@@ -26,10 +27,14 @@ export function createDispatchContext(
   const depth = this.resolveChildDispatchDepth(params.creator, params.maxDepth)
   const task = this.getTask(taskId)
   if (!task) {
-    throw new Error(`Task not found: ${taskId}`)
+    throw taskNotFoundError(`Task not found: ${taskId}`, { taskId })
   }
   if (task.status !== 'ready') {
-    throw new Error(`Task ${taskId} is ${task.status}; only ready tasks can be dispatched`)
+    throw taskNotStartableError(
+      this,
+      `Task ${taskId} is ${task.status}; only ready tasks can be dispatched`,
+      task
+    )
   }
 
   // Why: lock on pane identity too, so a reminted handle can't open a second concurrent dispatch on the same pane.
@@ -72,9 +77,12 @@ export function createDispatchContext(
           `Terminal ${assigneeHandle} already has an active dispatch (${occupied.id} for task ${occupied.task_id})`
         )
       }
-      throw new Error(
-        `Task ${taskId} is ${current?.status ?? 'missing'}; only ready tasks can be dispatched`
-      )
+      // Why: the atomic claim lost to a concurrent status change; report it with the same
+      // typed receipt as the precheck so the loser can recover instead of reading runtime_error.
+      const message = `Task ${taskId} is ${current?.status ?? 'missing'}; only ready tasks can be dispatched`
+      throw current
+        ? taskNotStartableError(this, message, current)
+        : taskNotFoundError(message, { taskId })
     }
     this.db.prepare("UPDATE tasks SET status = 'dispatched' WHERE id = ?").run(taskId)
     const dispatch = this.db
diff --git a/src/main/runtime/orchestration/db/hot-path-statement-compilation.test.ts b/src/main/runtime/orchestration/db/hot-path-statement-compilation.test.ts
index 26f82410cfe..8e36605aeb5 100644
--- a/src/main/runtime/orchestration/db/hot-path-statement-compilation.test.ts
+++ b/src/main/runtime/orchestration/db/hot-path-statement-compilation.test.ts
@@ -131,6 +131,32 @@ describe('orchestration hot-path statement compilation', () => {
     }
   })
 
+  // Why: getTask sits on the dispatch/lifecycle path and listTasks runs several times per
+  // coordinator tick, so a wildcard there recompiles on every call the same way the publish did.
+  it('compiles the task lookup and listing SQL exactly once across repeated calls', () => {
+    const db = openDatabase(':memory:')
+    seedDispatchedWorker(db)
+    const seeded = db.listTasks()
+    expect(seeded.length).toBeGreaterThan(0)
+    const taskId = seeded[0].id
+
+    const compiled = trackCompiledSql(db)
+    for (let call = 0; call < 5; call += 1) {
+      db.getTask(taskId)
+      db.listTasks()
+      db.listTasks({ ready: true })
+      db.listTasks({ status: 'pending' })
+      db.listTasks({ runId: seeded[0].run_id })
+    }
+
+    const compilationsPerSql = new Map<string, number>()
+    for (const sql of compiled) {
+      compilationsPerSql.set(sql, (compilationsPerSql.get(sql) ?? 0) + 1)
+    }
+    expect([...compilationsPerSql].filter(([, count]) => count > 1)).toEqual([])
+    expect(compiled.filter((sql) => WILDCARD_PROJECTION.test(sql))).toEqual([])
+  })
+
   // Why: `SELECT *` is what made these statements uncacheable, and a retained wildcard is the only
   // way node:sqlite could build a row from stale column names after another connection's ALTER.
   // Seeds on one connection and publishes on a second so every compilation here is hot-path SQL.
diff --git a/src/main/runtime/orchestration/db/tasks/task-store.ts b/src/main/runtime/orchestration/db/tasks/task-store.ts
index 69316765a74..8bcc74ca3e5 100644
--- a/src/main/runtime/orchestration/db/tasks/task-store.ts
+++ b/src/main/runtime/orchestration/db/tasks/task-store.ts
@@ -79,9 +79,13 @@ export function createTask(
       runId,
       depsJson
     )
-  return this.db.prepare('SELECT * FROM tasks WHERE id = ?').get(id) as TaskRow
+  return this.db.prepare(`SELECT ${TASK_COLUMN_LIST} FROM tasks WHERE id = ?`).get(id) as TaskRow
 }
 
+// Why wildcard-free: SyncDatabase refuses to cache any statement containing `*`, so a `SELECT *`
+// here recompiles on every call — including the hot dispatch lookups and the coordinator poll.
+const TASK_COLUMN_LIST = selectColumns(TASK_COLUMNS)
+
 // Why: hoisted and wildcard-free so the per-publish lineage lookup hits the SyncDatabase statement cache.
 const TASK_RUNTIME_LINEAGE_SQL = `SELECT ${selectColumns(TASK_COLUMNS, 't')},
          creator.id AS creator_dispatch_id,
@@ -113,7 +117,9 @@ export function getTask(
   dispatchRunId?: string
 ): TaskRow | TaskRuntimeLineageRow | undefined {
   if (dispatchRunId === undefined) {
-    return this.db.prepare('SELECT * FROM tasks WHERE id = ?').get(id) as TaskRow | undefined
+    return this.db.prepare(`SELECT ${TASK_COLUMN_LIST} FROM tasks WHERE id = ?`).get(id) as
+      | TaskRow
+      | undefined
   }
   return this.db.prepare(TASK_RUNTIME_LINEAGE_SQL).get(dispatchRunId, id) as
     | TaskRuntimeLineageRow
@@ -128,20 +134,26 @@ export function listTasks(
   const runParams: Database.BindValue[] = filter?.runId ? [filter.runId] : []
   if (filter?.ready) {
     return this.db
-      .prepare(`SELECT * FROM tasks WHERE ${runWhere}status = 'ready' ORDER BY created_at`)
+      .prepare(
+        `SELECT ${TASK_COLUMN_LIST} FROM tasks WHERE ${runWhere}status = 'ready' ORDER BY created_at`
+      )
       .all(...runParams) as TaskRow[]
   }
   if (filter?.status) {
     return this.db
-      .prepare(`SELECT * FROM tasks WHERE ${runWhere}status = ? ORDER BY created_at`)
+      .prepare(
+        `SELECT ${TASK_COLUMN_LIST} FROM tasks WHERE ${runWhere}status = ? ORDER BY created_at`
+      )
       .all(...runParams, filter.status) as TaskRow[]
   }
   if (filter?.runId) {
     return this.db
-      .prepare('SELECT * FROM tasks WHERE run_id = ? ORDER BY created_at')
+      .prepare(`SELECT ${TASK_COLUMN_LIST} FROM tasks WHERE run_id = ? ORDER BY created_at`)
       .all(filter.runId) as TaskRow[]
   }
-  return this.db.prepare('SELECT * FROM tasks ORDER BY created_at').all() as TaskRow[]
+  return this.db
+    .prepare(`SELECT ${TASK_COLUMN_LIST} FROM tasks ORDER BY created_at`)
+    .all() as TaskRow[]
 }
 
 // Why: the correlated indexed lookup avoids materializing every retained Dispatch before filtering Tasks.
@@ -195,7 +207,7 @@ export function listTasksWithDispatch(
 // Why: runs in the status-update transaction, so a completed task never leaves its ready children unpromoted.
 export function promoteReadyTasks(this: OrchestrationDb, completedTaskId: string): void {
   const candidates = this.db
-    .prepare("SELECT * FROM tasks WHERE status = 'pending'")
+    .prepare(`SELECT ${TASK_COLUMN_LIST} FROM tasks WHERE status = 'pending'`)
     .all() as TaskRow[]
 
   for (const task of candidates) {
diff --git a/src/main/runtime/orchestration/db/worker-dispatch/worker-dispatch-start.ts b/src/main/runtime/orchestration/db/worker-dispatch/worker-dispatch-start.ts
index e26369e7fc1..e472ea1c7e8 100644
--- a/src/main/runtime/orchestration/db/worker-dispatch/worker-dispatch-start.ts
+++ b/src/main/runtime/orchestration/db/worker-dispatch/worker-dispatch-start.ts
@@ -6,6 +6,7 @@ import { generateId } from '../generated-id'
 import type { OrchestrationDb } from '../orchestration-db'
 import { insertStartingDispatchContextRow } from '../dispatch-row-writer'
 import type { DispatchCreator } from '../dispatch-depth'
+import { taskNotFoundError, taskNotStartableError } from '../../task-dispatch-refusal'
 
 export function createStartingWorkerDispatch(
   this: OrchestrationDb,
@@ -60,7 +61,7 @@ export function createStartingWorkerDispatch(
     }
     const task = this.getTask(params.taskId)
     if (!task) {
-      throw new OrchestrationError('task_not_found', `Task ${params.taskId} was not found.`)
+      throw taskNotFoundError(`Task ${params.taskId} was not found.`, { taskId: params.taskId })
     }
     if (params.retryOf) {
       const prior = this.getDispatchContextById(params.retryOf)
@@ -74,15 +75,18 @@ export function createStartingWorkerDispatch(
         !['failed', 'stopped', 'abandoned'].includes(priorWorker.state) ||
         !['failed', 'blocked'].includes(task.status)
       ) {
-        throw new OrchestrationError(
-          'task_not_startable',
-          `Task ${task.id} cannot retry from Dispatch ${params.retryOf}.`
+        throw taskNotStartableError(
+          this,
+          `Task ${task.id} cannot retry from Dispatch ${params.retryOf}.`,
+          task,
+          params.retryOf
         )
       }
     } else if (task.status !== 'ready') {
-      throw new OrchestrationError(
-        'task_not_startable',
-        `Task ${task.id} is ${task.status}; only a ready Task can start.`
+      throw taskNotStartableError(
+        this,
+        `Task ${task.id} is ${task.status}; only a ready Task can start.`,
+        task
       )
     }
 
diff --git a/src/main/runtime/orchestration/orchestration-worker-dispatch-db.test.ts b/src/main/runtime/orchestration/orchestration-worker-dispatch-db.test.ts
index 9e4a2768a1d..156d1427f01 100644
--- a/src/main/runtime/orchestration/orchestration-worker-dispatch-db.test.ts
+++ b/src/main/runtime/orchestration/orchestration-worker-dispatch-db.test.ts
@@ -168,7 +168,12 @@ describe('OrchestrationDb worker Dispatch state', () => {
           payloadHash: 'payload_hash'
         }
       })
-    ).toThrow('was not found')
+    ).toThrowError(
+      expect.objectContaining({
+        code: 'task_not_found',
+        message: 'Task task_missing was not found.'
+      })
+    )
     expect(d.getMutationReceipt('caller_fingerprint', 'invalid_worker_start')).toBeUndefined()
   })
 
diff --git a/src/main/runtime/orchestration/preamble.test.ts b/src/main/runtime/orchestration/preamble.test.ts
index 79e06f5a55a..57b8b35f266 100644
--- a/src/main/runtime/orchestration/preamble.test.ts
+++ b/src/main/runtime/orchestration/preamble.test.ts
@@ -1,4 +1,6 @@
 import { spawnSync } from 'node:child_process'
+import remarkParse from 'remark-parse'
+import { unified } from 'unified'
 import { describe, expect, it } from 'vitest'
 import { buildDispatchPreamble } from './preamble'
 
@@ -23,6 +25,22 @@ function afterWorkerDoneSection(result: string) {
   return result.slice(sectionStart, sectionEnd)
 }
 
+function cliFence(result: string): string {
+  const match = result.match(/=== CLI COMMANDS ===\n\n```sh\n([\s\S]*?)\n```/)
+  expect(match).not.toBeNull()
+  return match?.[1] ?? ''
+}
+
+function markdownBlocks(result: string) {
+  const tree = unified().use(remarkParse).parse(result)
+  return {
+    headings: tree.children.filter((node) => node.type === 'heading'),
+    codeBlocks: tree.children.filter((node) => node.type === 'code')
+  }
+}
+
+const driftParams = { base: 'origin/main', behind: 3, recentSubjects: ['fix: a', 'feat: b'] }
+
 describe('buildDispatchPreamble', () => {
   it('substitutes template variables', () => {
     const result = buildDispatchPreamble(baseParams())
@@ -58,25 +76,43 @@ describe('buildDispatchPreamble', () => {
     { timeout: 15_000 },
     () => {
       const result = buildDispatchPreamble(baseParams())
-      // Why: feeding `bash -n` the full preamble falsely fails on apostrophes
-      // in the surrounding prose. Slice between the CLI markers and strip
-      // shell-style comment lines so we only syntax-check the commands.
-      const cliStart = result.indexOf('=== CLI COMMANDS ===')
-      const cliEnd = result.indexOf('=== AFTER YOU SEND worker_done ===')
-      expect(cliStart).toBeGreaterThan(-1)
-      expect(cliEnd).toBeGreaterThan(cliStart)
-      const block = result.slice(cliStart, cliEnd)
-      const stripped = block
-        .split('\n')
-        .filter((line) => !line.trim().startsWith('#'))
-        .filter((line) => !line.trim().startsWith('==='))
-        .join('\n')
-
-      const check = spawnSync('bash', ['-n'], { input: stripped, encoding: 'utf8' })
+      const check = spawnSync('bash', ['-n'], { input: cliFence(result), encoding: 'utf8' })
       expect(check.status).toBe(0)
     }
   )
 
+  it('fences shell comments so Markdown does not promote them to headings', () => {
+    const result = buildDispatchPreamble(baseParams())
+    const { headings, codeBlocks } = markdownBlocks(result)
+
+    expect(headings).toHaveLength(0)
+    expect(codeBlocks).toHaveLength(1)
+    expect(codeBlocks[0]).toMatchObject({ lang: 'sh', value: cliFence(result) })
+  })
+
+  // Why: a `---` rule directly under a paragraph is a setext H2, so the optional
+  // sections' closing rules must not turn their last sentence into a heading.
+  it('renders no Markdown headings when the sub-dispatch and drift sections are present', () => {
+    const result = buildDispatchPreamble(
+      baseParams({ canDispatchSubWorkers: true, baseDrift: driftParams })
+    )
+    const { headings, codeBlocks } = markdownBlocks(result)
+
+    expect(headings).toHaveLength(0)
+    expect(codeBlocks).toHaveLength(2)
+    expect(codeBlocks[1]).toMatchObject({ lang: 'sh' })
+    expect(codeBlocks[1].value).toContain('orchestration worker-start --task <task_id>')
+    expect(result).toContain('able to dispatch further.\n\n---')
+    expect(result).toContain('before starting.\n\n---')
+  })
+
+  it('sub-dispatch fence passes bash -n', { timeout: 15_000 }, () => {
+    const result = buildDispatchPreamble(baseParams({ canDispatchSubWorkers: true }))
+    const { codeBlocks } = markdownBlocks(result)
+    const check = spawnSync('bash', ['-n'], { input: codeBlocks[1].value, encoding: 'utf8' })
+    expect(check.status).toBe(0)
+  })
+
   it('includes heartbeat CLI block with taskId and dispatchId and 5-minute cadence', () => {
     const result = buildDispatchPreamble(baseParams())
     expect(result).toContain('--type heartbeat')
diff --git a/src/main/runtime/orchestration/preamble.ts b/src/main/runtime/orchestration/preamble.ts
index 7d426184954..d4519f154b9 100644
--- a/src/main/runtime/orchestration/preamble.ts
+++ b/src/main/runtime/orchestration/preamble.ts
@@ -59,6 +59,7 @@ export function buildDispatchPreamble(params: PreambleParams): string {
     ? ` --dispatch-capability ${params.dispatchCapability}`
     : ''
 
+  // Why: fencing keeps shell comments executable to agents without turning them into Chat UI headings.
   const header = `You are working inside Orca, a multi-agent IDE. You are a dispatched worker.
 Your coordinator's terminal handle is: ${params.coordinatorHandle}
 Your task ID is: ${params.taskId}
@@ -68,6 +69,7 @@ Slack, GitHub comments, or any other channel to reach a human during the run.
 
 === CLI COMMANDS ===
 
+\`\`\`sh
   # Report the terminal task outcome (REQUIRED exactly once).
   #
   # RULE: --body must be a 3-sentence executive summary (what you did,
@@ -129,6 +131,7 @@ Slack, GitHub comments, or any other channel to reach a human during the run.
 
   # Check for messages from the coordinator:
   ${cli} orchestration check --terminal ${params.workerHandle}
+\`\`\`
 
 ${postDoneInstructions}`
 
@@ -193,6 +196,8 @@ work under the new Dispatch; ignore stale follow-ups from the settled task.`
 // Why the whole section is omitted rather than softened when nesting is off: a
 // worker told it "usually cannot" delegate still tries, then reports the refusal
 // as a blocker.
+// Why fenced + blank line before the closing `---`: unfenced `<placeholders>` are stripped as raw
+// HTML by the Chat UI, and a rule directly under a paragraph is a setext H2 (giant last sentence).
 function buildSubDispatchSection(cli: string): string {
   return `
 
@@ -200,13 +205,16 @@ function buildSubDispatchSection(cli: string): string {
 You may dispatch sub-workers for this task. Bind your own Run first, then create
 and start each one:
 
+\`\`\`sh
   ${cli} orchestration run-create --objective "<what the sub-workers are for>" --json
   ${cli} orchestration task-create --spec "<sub-task>" --json
   ${cli} orchestration worker-start --task <task_id> --worktree current --agent <agent> --json
+\`\`\`
 
 You own those sub-workers: wait for their worker_done, and do not report your own
 until they have settled. Nesting is capped, so a sub-worker of yours may not be
 able to dispatch further.
+
 ---`
 }
 
@@ -221,5 +229,6 @@ ${subjects}
 
 If any look relevant to your task, either pull them in (\`git pull --rebase
 ${drift.base}\` or equivalent) or escalate to the coordinator before starting.
+
 ---`
 }
diff --git a/src/main/runtime/orchestration/task-dispatch-refusal.ts b/src/main/runtime/orchestration/task-dispatch-refusal.ts
new file mode 100644
index 00000000000..f3e026d0f73
--- /dev/null
+++ b/src/main/runtime/orchestration/task-dispatch-refusal.ts
@@ -0,0 +1,61 @@
+import type { OrchestrationDb } from './db'
+import { OrchestrationError } from './orchestration-error'
+import type { TaskRow } from './types'
+import {
+  injectRejectedRefusal,
+  taskNotFoundRefusal,
+  taskNotStartableRefusal,
+  type DispatchRefusalReceipt,
+  type InjectRejectionReason
+} from '../../../shared/orchestration-dispatch-refusal-contract'
+
+// Why: each site keeps the exact message it published before; only the code and data are shared.
+
+export function taskNotFoundError(
+  message: string,
+  detail: { taskId: string; runId?: string }
+): OrchestrationError {
+  return toError(taskNotFoundRefusal(message, detail))
+}
+
+export function taskNotStartableError(
+  db: OrchestrationDb,
+  message: string,
+  task: TaskRow,
+  retryOf?: string
+): OrchestrationError {
+  return toError(
+    taskNotStartableRefusal(message, {
+      taskId: task.id,
+      status: task.status,
+      unmetDependencies: unmetTaskDependencies(db, task),
+      ...(retryOf ? { retryOf } : {})
+    })
+  )
+}
+
+export function injectRejectedError(
+  terminal: string,
+  reason: InjectRejectionReason
+): OrchestrationError {
+  return toError(injectRejectedRefusal(terminal, reason))
+}
+
+function toError(receipt: DispatchRefusalReceipt): OrchestrationError {
+  return new OrchestrationError(receipt.code, receipt.message, receipt.data)
+}
+
+function unmetTaskDependencies(db: OrchestrationDb, task: TaskRow): string[] {
+  let deps: unknown
+  try {
+    deps = JSON.parse(task.deps)
+  } catch {
+    return []
+  }
+  if (!Array.isArray(deps)) {
+    return []
+  }
+  return deps.filter(
+    (dep): dep is string => typeof dep === 'string' && db.getTask(dep)?.status !== 'completed'
+  )
+}
diff --git a/src/main/runtime/orchestration/worker-output-archive-bounding.test.ts b/src/main/runtime/orchestration/worker-output-archive-bounding.test.ts
new file mode 100644
index 00000000000..a45cc6c0531
--- /dev/null
+++ b/src/main/runtime/orchestration/worker-output-archive-bounding.test.ts
@@ -0,0 +1,41 @@
+import { describe, expect, it } from 'vitest'
+import { boundArchiveLines } from './worker-output-archive'
+
+const TERMINAL_ARCHIVE_MAX_CHARS = 262_144
+
+function totalCost(lines: string[]): number {
+  return lines.reduce((sum, line) => sum + line.length + 1, 0)
+}
+
+describe('boundArchiveLines', () => {
+  it('returns the original array untouched when the tail already fits', () => {
+    const lines = ['one', 'two', 'three']
+    const bounded = boundArchiveLines(lines)
+    expect(bounded.truncated).toBe(false)
+    expect(bounded.lines).toBe(lines)
+  })
+
+  it('keeps the newest lines in order and reports truncation', () => {
+    const lines = Array.from({ length: 40_000 }, (_, index) => `line ${index}`)
+    const bounded = boundArchiveLines(lines)
+    expect(bounded.truncated).toBe(true)
+    expect(totalCost(bounded.lines)).toBeLessThanOrEqual(TERMINAL_ARCHIVE_MAX_CHARS)
+    expect(bounded.lines.at(-1)).toBe(lines.at(-1))
+    expect(bounded.lines).toEqual(lines.slice(lines.length - bounded.lines.length))
+  })
+
+  it('truncates a single oversized line from its tail', () => {
+    const bounded = boundArchiveLines(['x'.repeat(TERMINAL_ARCHIVE_MAX_CHARS * 2)])
+    expect(bounded.truncated).toBe(true)
+    expect(bounded.lines).toHaveLength(1)
+    expect(bounded.lines[0]).toHaveLength(TERMINAL_ARCHIVE_MAX_CHARS - 1)
+  })
+
+  it('bounds a blank-line flood in linear time', () => {
+    // The char budget admits ~262k blank lines; an unshift-per-line build was ~4.3s here.
+    const startedAt = performance.now()
+    const bounded = boundArchiveLines(Array.from({ length: 300_000 }, () => ''))
+    expect(bounded.lines).toHaveLength(TERMINAL_ARCHIVE_MAX_CHARS)
+    expect(performance.now() - startedAt).toBeLessThan(500)
+  })
+})
diff --git a/src/main/runtime/orchestration/worker-output-archive.ts b/src/main/runtime/orchestration/worker-output-archive.ts
index f6f2b52ecb1..55d16467269 100644
--- a/src/main/runtime/orchestration/worker-output-archive.ts
+++ b/src/main/runtime/orchestration/worker-output-archive.ts
@@ -114,7 +114,7 @@ export async function captureWorkerOutputArchive(args: {
   }
 }
 
-function boundArchiveLines(lines: string[]): { lines: string[]; truncated: boolean } {
+export function boundArchiveLines(lines: string[]): { lines: string[]; truncated: boolean } {
   let total = 0
   for (const line of lines) {
     total += line.length + 1
@@ -122,18 +122,21 @@ function boundArchiveLines(lines: string[]): { lines: string[]; truncated: boole
   if (total <= TERMINAL_ARCHIVE_MAX_CHARS) {
     return { lines, truncated: false }
   }
-  const kept: string[] = []
+  // Collected newest-first and reversed once: unshift per line is O(n^2) and the
+  // char budget admits ~260k blank lines.
+  const keptReversed: string[] = []
   let budget = TERMINAL_ARCHIVE_MAX_CHARS
   for (let index = lines.length - 1; index >= 0; index -= 1) {
     const cost = lines[index].length + 1
     if (cost > budget) {
-      if (kept.length === 0 && budget > 1) {
-        kept.unshift(lines[index].slice(-(budget - 1)))
+      if (keptReversed.length === 0 && budget > 1) {
+        keptReversed.push(lines[index].slice(-(budget - 1)))
       }
       break
     }
-    kept.unshift(lines[index])
+    keptReversed.push(lines[index])
     budget -= cost
   }
-  return { lines: kept, truncated: true }
+  keptReversed.reverse()
+  return { lines: keptReversed, truncated: true }
 }
diff --git a/src/main/runtime/relay/desktop-relay-service.ts b/src/main/runtime/relay/desktop-relay-service.ts
index 55b993bd5a6..def786e7758 100644
--- a/src/main/runtime/relay/desktop-relay-service.ts
+++ b/src/main/runtime/relay/desktop-relay-service.ts
@@ -6,6 +6,7 @@ import type {
   PairingGetEndpointsResult,
   PairingProvisionRelayParams
 } from '../../../shared/mobile-relay-credential-contract'
+import type { RelayHostCloseReason } from '../../../shared/relay-host-close-reason'
 import { readRelayAuthContext } from './relay-auth-context'
 import { RelayAuthCoordinator } from './relay-auth-coordinator'
 import { RelaySessionBroker, type RelayBrokerStatus } from './relay-session-broker'
@@ -112,7 +113,7 @@ export class DesktopRelayService {
     this.refreshDemand()
   }
 
-  fenceAndCloseNow(): void {
+  fenceAndCloseNow(hostCloseReason?: RelayHostCloseReason): void {
     // Why: a fence must be hard — a surviving liveness tick could catch the
     // window between the pre-sign-out fence and the profile wipe and briefly
     // resurrect a broker. The next auth mutation re-arms via refreshDemand.
@@ -120,7 +121,7 @@ export class DesktopRelayService {
       clearInterval(this.livenessTimer)
       this.livenessTimer = null
     }
-    this.coordinator.fenceAndCloseNow()
+    this.coordinator.fenceAndCloseNow(hostCloseReason)
   }
 
   async createPairingRelay(
diff --git a/src/main/runtime/relay/relay-auth-coordinator.ts b/src/main/runtime/relay/relay-auth-coordinator.ts
index ae439a320d9..a7db0e3a81e 100644
--- a/src/main/runtime/relay/relay-auth-coordinator.ts
+++ b/src/main/runtime/relay/relay-auth-coordinator.ts
@@ -1,3 +1,7 @@
+import {
+  RELAY_HOST_CLOSE_REASON,
+  type RelayHostCloseReason
+} from '../../../shared/relay-host-close-reason'
 import type { RelayBrokerStatus } from './relay-session-broker'
 import { RelayHttpError, shouldRetryRelayConnectionError } from './relay-http-client'
 
@@ -14,7 +18,7 @@ export type RelayAuthContext = {
 }
 
 export type CoordinatedRelayBroker = {
-  closeNow(): void
+  closeNow(hostCloseReason?: RelayHostCloseReason): void
   isLive?(): boolean
 }
 
@@ -78,13 +82,16 @@ export class RelayAuthCoordinator {
     void reconcile
   }
 
-  fenceAndCloseNow(): void {
+  // hostCloseReason names an auth loss the phone should be told about. Quit,
+  // relaunch and every other fence pass nothing, so the control socket dies
+  // abruptly exactly as before and the cell records no cause.
+  fenceAndCloseNow(hostCloseReason?: RelayHostCloseReason): void {
     ++this.authEpoch
     this.cancelLinger()
     this.cancelRetry()
     this.retryAttempt = 0
     this.invalidatePendingOwnerships()
-    this.invalidateOwnership()
+    this.invalidateOwnership(hostCloseReason)
     this.options.onStatus('offline')
   }
 
@@ -146,7 +153,11 @@ export class RelayAuthCoordinator {
       if (!context || !context.relayEntitled) {
         this.cancelLinger()
         this.retryAttempt = 0
-        this.invalidateOwnership()
+        // Why only the null case: readContext throws on transient failures and
+        // returns null solely when the cloud session is gone (absent, or cleared
+        // by a 401). A present-but-unentitled context is still a signed-in
+        // desktop, and "sign in to reconnect" would be wrong advice for it.
+        this.invalidateOwnership(context ? undefined : RELAY_HOST_CLOSE_REASON.SIGNED_OUT)
         this.options.onStatus('offline')
         return
       }
@@ -271,12 +282,12 @@ export class RelayAuthCoordinator {
     return context.accessToken
   }
 
-  private invalidateOwnership(): void {
+  private invalidateOwnership(hostCloseReason?: RelayHostCloseReason): void {
     const ownership = this.ownership
     this.ownership = null
     if (ownership) {
       ownership.valid = false
-      ownership.broker?.closeNow()
+      ownership.broker?.closeNow(hostCloseReason)
     }
   }
 
diff --git a/src/main/runtime/relay/relay-auth-host-close-reason.test.ts b/src/main/runtime/relay/relay-auth-host-close-reason.test.ts
new file mode 100644
index 00000000000..7d10e207a33
--- /dev/null
+++ b/src/main/runtime/relay/relay-auth-host-close-reason.test.ts
@@ -0,0 +1,122 @@
+import { describe, expect, it, vi } from 'vitest'
+import { RELAY_HOST_CLOSE_REASON } from '../../../shared/relay-host-close-reason'
+import { RelayAuthCoordinator, type RelayAuthContext } from './relay-auth-coordinator'
+
+const context: RelayAuthContext = {
+  identity: { userId: 'user-1', profileId: 'profile-1', organizationId: 'org-1' },
+  accessToken: 'access-1',
+  relayEntitled: true
+}
+
+function coordinatorOver(readContext: () => Promise<RelayAuthContext | null>) {
+  const broker = { closeNow: vi.fn() }
+  const coordinator = new RelayAuthCoordinator({
+    readContext,
+    openBroker: async () => broker,
+    onStatus: vi.fn()
+  })
+  return { broker, coordinator }
+}
+
+describe('relay control close reason', () => {
+  it('names the sign-out when the cloud session is gone', async () => {
+    let current: RelayAuthContext | null = context
+    const { broker, coordinator } = coordinatorOver(async () => current)
+    coordinator.reconcile()
+    await expect(coordinator.waitForLiveBroker()).resolves.toBe(broker)
+
+    current = null
+    coordinator.reconcile()
+    await coordinator.waitForLiveBroker()
+
+    expect(broker.closeNow).toHaveBeenCalledWith(RELAY_HOST_CLOSE_REASON.SIGNED_OUT)
+  })
+
+  it('names the sign-out on the explicit pre-sign-out fence', async () => {
+    const { broker, coordinator } = coordinatorOver(async () => context)
+    coordinator.reconcile()
+    await expect(coordinator.waitForLiveBroker()).resolves.toBe(broker)
+
+    coordinator.fenceAndCloseNow(RELAY_HOST_CLOSE_REASON.SIGNED_OUT)
+
+    expect(broker.closeNow).toHaveBeenCalledWith(RELAY_HOST_CLOSE_REASON.SIGNED_OUT)
+  })
+
+  it('stays silent on quit, which fences without a reason', async () => {
+    const { broker, coordinator } = coordinatorOver(async () => context)
+    coordinator.reconcile()
+    await expect(coordinator.waitForLiveBroker()).resolves.toBe(broker)
+
+    coordinator.fenceAndCloseNow()
+
+    expect(broker.closeNow).toHaveBeenCalledWith(undefined)
+  })
+
+  it('stays silent on stop, which is teardown rather than auth loss', async () => {
+    const { broker, coordinator } = coordinatorOver(async () => context)
+    coordinator.reconcile()
+    await expect(coordinator.waitForLiveBroker()).resolves.toBe(broker)
+
+    coordinator.stop()
+
+    expect(broker.closeNow).toHaveBeenCalledWith(undefined)
+  })
+
+  // A signed-in desktop that merely lost the entitlement must not tell the
+  // phone to sign in — the copy would be wrong and the user has nothing to do.
+  it('stays silent when the session survives but the entitlement is gone', async () => {
+    let current: RelayAuthContext = context
+    const { broker, coordinator } = coordinatorOver(async () => current)
+    coordinator.reconcile()
+    await expect(coordinator.waitForLiveBroker()).resolves.toBe(broker)
+
+    current = { ...context, relayEntitled: false }
+    coordinator.reconcile()
+    await coordinator.waitForLiveBroker()
+
+    expect(broker.closeNow).toHaveBeenCalledWith(undefined)
+  })
+
+  it('stays silent when demand drops and the broker lingers out', async () => {
+    let demanded = true
+    const broker = { closeNow: vi.fn() }
+    const coordinator = new RelayAuthCoordinator({
+      readContext: async () => context,
+      hasDemand: () => demanded,
+      openBroker: async () => broker,
+      onStatus: vi.fn(),
+      lingerMs: 5
+    })
+    coordinator.reconcile()
+    await expect(coordinator.waitForLiveBroker()).resolves.toBe(broker)
+
+    demanded = false
+    coordinator.reconcile()
+    await vi.waitFor(() => expect(broker.closeNow).toHaveBeenCalled())
+
+    expect(broker.closeNow).toHaveBeenCalledWith(undefined)
+  })
+
+  // Replacing a stale broker is a reconnect, not a sign-out.
+  it('stays silent when an identity switch replaces the broker', async () => {
+    let current = context
+    const brokers: { closeNow: ReturnType<typeof vi.fn> }[] = []
+    const coordinator = new RelayAuthCoordinator({
+      readContext: async () => current,
+      openBroker: async () => {
+        const broker = { closeNow: vi.fn() }
+        brokers.push(broker)
+        return broker
+      },
+      onStatus: vi.fn()
+    })
+    coordinator.reconcile()
+    await coordinator.waitForLiveBroker()
+
+    current = { ...context, identity: { ...context.identity, organizationId: 'org-2' } }
+    coordinator.reconcile()
+    await coordinator.waitForLiveBroker()
+
+    expect(brokers[0]?.closeNow).toHaveBeenCalledWith(undefined)
+  })
+})
diff --git a/src/main/runtime/relay/relay-control-client.ts b/src/main/runtime/relay/relay-control-client.ts
index 7e742173f72..968f05795b2 100644
--- a/src/main/runtime/relay/relay-control-client.ts
+++ b/src/main/runtime/relay/relay-control-client.ts
@@ -1,6 +1,7 @@
 import { randomUUID } from 'node:crypto'
 import WebSocket, { type RawData } from 'ws'
 import { MOBILE_RELAY_CLOSE_CODE } from '../../../shared/mobile-relay-close-codes'
+import type { RelayHostCloseReason } from '../../../shared/relay-host-close-reason'
 import type { E2EEKeypair } from '../e2ee-keypair'
 import {
   RelayConnectionOpenMessageSchema,
@@ -8,6 +9,7 @@ import {
   RelayHostChallengeMessageSchema,
   RelayHostHelloAckMessageSchema,
   RelayPingMessageSchema,
+  encodeRelayHostHello,
   parseRelayControlMessage,
   type RelayConnectionOpenMessage,
   type RelayDrainMessage,
@@ -21,6 +23,7 @@ import {
   RELAY_CONTROL_SILENCE_LIMIT_MS,
   RelayControlSilenceWatchdog
 } from './relay-control-silence-watchdog'
+import { closeRelayControlSocket } from './relay-control-socket-close'
 import { controlWebSocketUrl } from './relay-control-url'
 
 type RelayControlState = 'idle' | 'opening' | 'proving' | 'active' | 'draining' | 'closed'
@@ -166,7 +169,7 @@ export class RelayControlClient {
     return this.requests.confirmResume(reqId, basisConnId, (payload) => this.sendActive(payload))
   }
 
-  closeNow(): void {
+  closeNow(hostCloseReason?: RelayHostCloseReason): void {
     const wasConnecting = this.state === 'opening' || this.state === 'proving'
     this.state = 'closed'
     this.silenceWatchdog.stop()
@@ -175,8 +178,9 @@ export class RelayControlClient {
       this.clearConnectPromise()
     }
     this.requests.rejectAll(new Error('relay_control_closed'))
-    this.socket?.terminate()
+    const socket = this.socket
     this.socket = null
+    closeRelayControlSocket(socket, hostCloseReason)
   }
 
   private sendHostHello(): void {
@@ -185,19 +189,9 @@ export class RelayControlClient {
     }
     this.state = 'proving'
     this.socket.send(
-      JSON.stringify({
-        type: 'host-hello',
-        v: 1,
-        relayHostId: this.options.relayHostId,
-        assignmentEpoch: this.options.assignmentEpoch,
-        hostPublicKeyB64: this.options.keypair.publicKeyB64,
-        appVersion: this.options.appVersion,
-        ...(this.options.previousGeneration === undefined
-          ? {}
-          : { previousGeneration: this.options.previousGeneration }),
-        ...(this.options.controlResumeSecret
-          ? { controlResumeSecret: this.options.controlResumeSecret }
-          : {})
+      encodeRelayHostHello({
+        ...this.options,
+        hostPublicKeyB64: this.options.keypair.publicKeyB64
       })
     )
   }
diff --git a/src/main/runtime/relay/relay-control-close-reason.test.ts b/src/main/runtime/relay/relay-control-close-reason.test.ts
new file mode 100644
index 00000000000..0d9aba54f88
--- /dev/null
+++ b/src/main/runtime/relay/relay-control-close-reason.test.ts
@@ -0,0 +1,92 @@
+import { createHash } from 'node:crypto'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import nacl from 'tweetnacl'
+import { WebSocketServer, type WebSocket } from 'ws'
+import { RELAY_HOST_CLOSE_REASON } from '../../../shared/relay-host-close-reason'
+import { RelayControlClient } from './relay-control-client'
+
+type ObservedClose = { code: number; reason: string }
+
+describe('RelayControlClient close reason', () => {
+  const servers: WebSocketServer[] = []
+  const clients: RelayControlClient[] = []
+
+  afterEach(async () => {
+    for (const client of clients.splice(0)) {
+      client.closeNow()
+    }
+    await Promise.all(
+      servers.splice(0).map(
+        (server) =>
+          new Promise<void>((resolve) => {
+            for (const socket of server.clients) {
+              socket.terminate()
+            }
+            server.close(() => resolve())
+          })
+      )
+    )
+  })
+
+  async function connectedClient(): Promise<{
+    client: RelayControlClient
+    closed: Promise<ObservedClose>
+  }> {
+    const server = new WebSocketServer({ host: '127.0.0.1', port: 0, perMessageDeflate: false })
+    servers.push(server)
+    await new Promise<void>((resolve) => server.once('listening', resolve))
+    const address = server.address()
+    if (!address || typeof address === 'string') {
+      throw new Error('expected TCP relay test server')
+    }
+    const accepted = new Promise<WebSocket>((resolve) => server.once('connection', resolve))
+    const keypair = nacl.box.keyPair()
+    const client = new RelayControlClient({
+      cellUrl: `http://127.0.0.1:${address.port}`,
+      relayJwt: 'scoped-token',
+      relayHostId: createHash('sha256').update(keypair.publicKey).digest('base64url').slice(0, 16),
+      assignmentEpoch: 1,
+      identity: { userId: 'user-1', profileId: 'profile-1', organizationId: 'org-1' },
+      keypair: { ...keypair, publicKeyB64: Buffer.from(keypair.publicKey).toString('base64') },
+      appVersion: '1.2.3',
+      onConnectionOpen: vi.fn(),
+      onDrain: vi.fn(),
+      onClose: vi.fn()
+    })
+    clients.push(client)
+    // The handshake never completes here; only the transport close matters.
+    void client.connect().catch(() => {})
+    const socket = await accepted
+    // A pong proves the client socket left CONNECTING; closeNow can only send a
+    // close frame from OPEN, and that is the state a real sign-out fences from.
+    await new Promise<void>((resolve) => {
+      socket.once('pong', () => resolve())
+      socket.ping()
+    })
+    const closed = new Promise<ObservedClose>((resolve) => {
+      socket.once('close', (code, reason) => resolve({ code, reason: reason.toString() }))
+    })
+    return { client, closed }
+  }
+
+  it('delivers the sign-out reason to the cell', async () => {
+    const { client, closed } = await connectedClient()
+
+    client.closeNow(RELAY_HOST_CLOSE_REASON.SIGNED_OUT)
+
+    await expect(closed).resolves.toEqual({
+      code: 1000,
+      reason: RELAY_HOST_CLOSE_REASON.SIGNED_OUT
+    })
+  })
+
+  // Every non-auth close keeps today's abrupt terminate, so a cell can never
+  // read a quit, a rotation or a sleep as a sign-out.
+  it('closes abruptly with no reason when none is given', async () => {
+    const { client, closed } = await connectedClient()
+
+    client.closeNow()
+
+    await expect(closed).resolves.toEqual({ code: 1006, reason: '' })
+  })
+})
diff --git a/src/main/runtime/relay/relay-control-origin.ts b/src/main/runtime/relay/relay-control-origin.ts
index 4d42da47977..3a33e1617e6 100644
--- a/src/main/runtime/relay/relay-control-origin.ts
+++ b/src/main/runtime/relay/relay-control-origin.ts
@@ -8,6 +8,7 @@ import type {
   RelayDrainMessage,
   RelayHostHelloAckMessage
 } from './relay-control-protocol'
+import type { RelayHostCloseReason } from '../../../shared/relay-host-close-reason'
 import type { RelayIdentity } from './relay-session-broker-contract'
 import type { RelayAssignment } from './relay-http-client'
 
@@ -144,7 +145,7 @@ export class RelayControlOrigin {
     }
   }
 
-  async close(): Promise<void> {
+  async close(hostCloseReason?: RelayHostCloseReason): Promise<void> {
     if (this.closed) {
       return
     }
@@ -154,7 +155,7 @@ export class RelayControlOrigin {
     }
     this.retiredControlTimers.clear()
     for (const control of this.controls) {
-      control.closeNow()
+      control.closeNow(hostCloseReason)
     }
     this.controls.clear()
     this.activeControl = null
@@ -166,8 +167,8 @@ export class RelayControlOrigin {
     }
   }
 
-  closeNow(): void {
-    void this.close()
+  closeNow(hostCloseReason?: RelayHostCloseReason): void {
+    void this.close(hostCloseReason)
   }
 
   private async openControl(overrides?: {
diff --git a/src/main/runtime/relay/relay-control-protocol.ts b/src/main/runtime/relay/relay-control-protocol.ts
index c94797f4815..75bf3a390e2 100644
--- a/src/main/runtime/relay/relay-control-protocol.ts
+++ b/src/main/runtime/relay/relay-control-protocol.ts
@@ -143,3 +143,29 @@ export function parseRelayControlMessage(raw: RawData): Record<string, unknown>
     return null
   }
 }
+
+export type RelayHostHello = {
+  relayHostId: string
+  assignmentEpoch: number
+  hostPublicKeyB64: string
+  appVersion: string
+  previousGeneration?: number
+  controlResumeSecret?: string
+}
+
+// Optional members are omitted rather than sent as undefined: the cell parses
+// host-hello strictly and an explicit null is not the same as absent.
+export function encodeRelayHostHello(hello: RelayHostHello): string {
+  return JSON.stringify({
+    type: 'host-hello',
+    v: 1,
+    relayHostId: hello.relayHostId,
+    assignmentEpoch: hello.assignmentEpoch,
+    hostPublicKeyB64: hello.hostPublicKeyB64,
+    appVersion: hello.appVersion,
+    ...(hello.previousGeneration === undefined
+      ? {}
+      : { previousGeneration: hello.previousGeneration }),
+    ...(hello.controlResumeSecret ? { controlResumeSecret: hello.controlResumeSecret } : {})
+  })
+}
diff --git a/src/main/runtime/relay/relay-control-socket-close.ts b/src/main/runtime/relay/relay-control-socket-close.ts
new file mode 100644
index 00000000000..2984b075425
--- /dev/null
+++ b/src/main/runtime/relay/relay-control-socket-close.ts
@@ -0,0 +1,26 @@
+import type WebSocket from 'ws'
+import type { RelayHostCloseReason } from '../../../shared/relay-host-close-reason'
+
+const NORMAL_CLOSE_CODE = 1000
+const REASONED_CLOSE_FLUSH_MS = 1_000
+
+// hostCloseReason: only auth loss names itself. Every other control close
+// (rotation, drain, quit, sleep) stays an abrupt terminate, so the cell learns
+// nothing and can never read a restart as a sign-out. A named close has to
+// reach the cell as a real close frame, but the fence must still be hard —
+// bound the handshake and then terminate.
+export function closeRelayControlSocket(
+  socket: WebSocket | null,
+  hostCloseReason?: RelayHostCloseReason
+): void {
+  if (!socket) {
+    return
+  }
+  if (hostCloseReason && socket.readyState === socket.OPEN) {
+    socket.close(NORMAL_CLOSE_CODE, hostCloseReason)
+    const timer = setTimeout(() => socket.terminate(), REASONED_CLOSE_FLUSH_MS)
+    timer.unref?.()
+    return
+  }
+  socket.terminate()
+}
diff --git a/src/main/runtime/relay/relay-origin-pool.ts b/src/main/runtime/relay/relay-origin-pool.ts
index a95d8f21340..acd2f90292e 100644
--- a/src/main/runtime/relay/relay-origin-pool.ts
+++ b/src/main/runtime/relay/relay-origin-pool.ts
@@ -4,8 +4,10 @@ import type { MobileSocketWiring } from '../rpc/mobile-socket-wiring'
 import { RelayControlOrigin } from './relay-control-origin'
 import type { RelayControlClient } from './relay-control-client'
 import type { RelayDrainMessage } from './relay-control-protocol'
+import type { RelayHostCloseReason } from '../../../shared/relay-host-close-reason'
 import { RelayDrainRetrySchedule } from './relay-drain-retry-schedule'
 import { RelayHttpError, requestRelayAssignment, type RelayAssignment } from './relay-http-client'
+import { relayRenewalDelayMs } from './relay-renewal-jitter'
 import type { RelayBrokerStatus, RelayIdentity } from './relay-session-broker-contract'
 import type { RelayRegion } from './relay-region-preference'
 
@@ -79,7 +81,7 @@ export class RelayOriginPool {
     }
   }
 
-  closeNow(): void {
+  closeNow(hostCloseReason?: RelayHostCloseReason): void {
     if (this.closed) {
       return
     }
@@ -94,7 +96,7 @@ export class RelayOriginPool {
     }
     this.drainTimers.clear()
     for (const origin of this.origins) {
-      origin.closeNow()
+      origin.closeNow(hostCloseReason)
     }
     this.origins.clear()
     this.drainingOrigins.clear()
@@ -244,8 +246,7 @@ export class RelayOriginPool {
     }
     const now = (this.options.now ?? Date.now)()
     const random = this.options.random ?? Math.random
-    const earlyMs = 60_000 + Math.floor(random() * 60_001)
-    const delay = Math.max(0, origin.controlLeaseExpiresAt - earlyMs - now)
+    const delay = relayRenewalDelayMs(origin.controlLeaseExpiresAt, now, random)
     this.rotationTimer = setTimeout(() => void this.rebindActiveControl(origin), delay)
   }
 
diff --git a/src/main/runtime/relay/relay-renewal-jitter.test.ts b/src/main/runtime/relay/relay-renewal-jitter.test.ts
new file mode 100644
index 00000000000..5bbc0994836
--- /dev/null
+++ b/src/main/runtime/relay/relay-renewal-jitter.test.ts
@@ -0,0 +1,57 @@
+import { describe, expect, it } from 'vitest'
+import {
+  RELAY_RENEWAL_JITTER_RATIO,
+  RELAY_RENEWAL_SAFETY_MARGIN_MS,
+  relayRenewalDelayMs
+} from './relay-renewal-jitter'
+
+const LEASE_MS = 55 * 60_000
+const latest = LEASE_MS - RELAY_RENEWAL_SAFETY_MARGIN_MS
+const base = latest / (1 + RELAY_RENEWAL_JITTER_RATIO)
+
+describe('relay renewal jitter', () => {
+  it('keeps every sample inside the jitter band and before the safety margin', () => {
+    let seed = 1
+    const random = (): number => {
+      seed = (seed * 1103515245 + 12345) % 2147483648
+      return seed / 2147483648
+    }
+    const samples: number[] = []
+    for (let i = 0; i < 20_000; i++) {
+      samples.push(relayRenewalDelayMs(LEASE_MS, 0, random))
+    }
+    for (const sample of samples) {
+      expect(sample).toBeGreaterThanOrEqual(Math.floor(base * (1 - RELAY_RENEWAL_JITTER_RATIO)))
+      expect(sample).toBeLessThanOrEqual(latest)
+      // The renewal never lands inside the margin, so it never races expiry.
+      expect(LEASE_MS - sample).toBeGreaterThanOrEqual(RELAY_RENEWAL_SAFETY_MARGIN_MS)
+    }
+    const mean = samples.reduce((total, sample) => total + sample, 0) / samples.length
+    expect(Math.abs(mean - base) / base).toBeLessThan(0.005)
+  })
+
+  it('spreads a same-second cohort over minutes instead of one second', () => {
+    const delays = Array.from({ length: 1000 }, (_, index) =>
+      relayRenewalDelayMs(LEASE_MS, 0, () => index / 999)
+    )
+    const spread = Math.max(...delays) - Math.min(...delays)
+    expect(spread).toBeGreaterThan(9 * 60_000)
+  })
+
+  it('pins the band ends to the base interval', () => {
+    expect(relayRenewalDelayMs(LEASE_MS, 0, () => 0)).toBe(
+      Math.floor(base * (1 - RELAY_RENEWAL_JITTER_RATIO))
+    )
+    expect(relayRenewalDelayMs(LEASE_MS, 0, () => 0.5)).toBe(Math.floor(base))
+    expect(relayRenewalDelayMs(LEASE_MS, 0, () => 1)).toBe(latest)
+  })
+
+  it('renews immediately once the lease is inside the safety margin', () => {
+    expect(relayRenewalDelayMs(RELAY_RENEWAL_SAFETY_MARGIN_MS, 0, () => 1)).toBe(0)
+    expect(relayRenewalDelayMs(0, 60_000, () => 1)).toBe(0)
+  })
+
+  it('measures the delay from now, not from the epoch', () => {
+    expect(relayRenewalDelayMs(LEASE_MS + 1_000_000, 1_000_000, () => 0.5)).toBe(Math.floor(base))
+  })
+})
diff --git a/src/main/runtime/relay/relay-renewal-jitter.ts b/src/main/runtime/relay/relay-renewal-jitter.ts
new file mode 100644
index 00000000000..8b1f1ec6412
--- /dev/null
+++ b/src/main/runtime/relay/relay-renewal-jitter.ts
@@ -0,0 +1,25 @@
+// Why: a cell recreate reconnects a whole cohort inside one second. Every host
+// in it then took its lease from the same second and, with only a 60s-wide
+// spread, renewed inside the same second ~54 minutes later — a self-sustaining
+// fleet-wide reconnect burst. Full +/-10% jitter spreads that cohort over
+// minutes instead.
+export const RELAY_RENEWAL_JITTER_RATIO = 0.1
+
+// The latest jittered renewal still lands this far before expiry.
+export const RELAY_RENEWAL_SAFETY_MARGIN_MS = 90_000
+
+// Why: the relay accepts a rebind at any point in the lease and resets the full
+// TTL from it (cloud/apps/relay/src/host-session-registry.ts:736-743), so
+// renewing early is free; only renewing late is fatal (:997 drains an expired
+// lease). That asymmetry is why the base is shrunk to fit the upward jitter
+// rather than the jittered value being clipped at the margin.
+export function relayRenewalDelayMs(expiresAt: number, now: number, random: () => number): number {
+  const remaining = expiresAt - now
+  const latest = remaining - RELAY_RENEWAL_SAFETY_MARGIN_MS
+  if (latest <= 0) {
+    return 0
+  }
+  const base = latest / (1 + RELAY_RENEWAL_JITTER_RATIO)
+  const jittered = base * (1 + (random() * 2 - 1) * RELAY_RENEWAL_JITTER_RATIO)
+  return Math.max(0, Math.min(Math.floor(jittered), latest))
+}
diff --git a/src/main/runtime/relay/relay-revoke-outbox.ts b/src/main/runtime/relay/relay-revoke-outbox.ts
index 473f619e134..5989af0c283 100644
--- a/src/main/runtime/relay/relay-revoke-outbox.ts
+++ b/src/main/runtime/relay/relay-revoke-outbox.ts
@@ -1,7 +1,11 @@
 import { randomUUID } from 'node:crypto'
 import { existsSync, readFileSync } from 'node:fs'
 import { join } from 'node:path'
-import { hardenExistingSecureFile, writeSecureJsonFile } from '../../../shared/secure-file'
+import {
+  hardenExistingSecureFile,
+  isUnreadableError,
+  writeSecureJsonFile
+} from '../../../shared/secure-file'
 
 export type RelayDeviceBinding = {
   relayHostId: string
@@ -37,6 +41,8 @@ function isItem(value: unknown): value is RelayRevokeOutboxItem {
 export class RelayRevokeOutbox {
   private readonly path: string
   private items: RelayRevokeOutboxItem[]
+  /** Set when the outbox exists but could not be read, so `items` is not what is on disk. */
+  private outboxUnreadable = false
 
   constructor(userDataPath: string) {
     this.path = join(userDataPath, OUTBOX_FILENAME)
@@ -83,12 +89,20 @@ export class RelayRevokeOutbox {
       hardenExistingSecureFile(this.path)
       const parsed: unknown = JSON.parse(readFileSync(this.path, 'utf-8'))
       return Array.isArray(parsed) ? parsed.filter(isItem) : []
-    } catch {
+    } catch (error) {
+      // An outbox we were denied is not an empty outbox. Saving [] over it would drop
+      // revocations that have not reached the relay, so a revoked device stays live.
+      this.outboxUnreadable = isUnreadableError(error)
       return []
     }
   }
 
   private save(items: readonly RelayRevokeOutboxItem[]): void {
+    if (this.outboxUnreadable) {
+      throw new Error(
+        `Cannot read the relay revoke outbox at ${this.path}: the read failed. Refusing to overwrite it, which would drop pending revocations.`
+      )
+    }
     writeSecureJsonFile(this.path, items)
   }
 }
diff --git a/src/main/runtime/relay/relay-session-broker.ts b/src/main/runtime/relay/relay-session-broker.ts
index e12e09119a0..cd83545e9ca 100644
--- a/src/main/runtime/relay/relay-session-broker.ts
+++ b/src/main/runtime/relay/relay-session-broker.ts
@@ -6,6 +6,7 @@ import type {
   MobileRelayEndpoint,
   PairingProvisionRelayParams
 } from '../../../shared/mobile-relay-credential-contract'
+import type { RelayHostCloseReason } from '../../../shared/relay-host-close-reason'
 import type { DeviceCredentialInstallAuthorization } from './relay-control-requests'
 import {
   deriveRelayHostId,
@@ -15,6 +16,7 @@ import {
   type RelayAssignment
 } from './relay-http-client'
 import { RelayOriginPool } from './relay-origin-pool'
+import { relayRenewalDelayMs } from './relay-renewal-jitter'
 import type { RelayBrokerStatus, RelaySessionBrokerOptions } from './relay-session-broker-contract'
 
 export type { RelayBrokerStatus } from './relay-session-broker-contract'
@@ -180,7 +182,7 @@ export class RelaySessionBroker {
     return result
   }
 
-  closeNow(): void {
+  closeNow(hostCloseReason?: RelayHostCloseReason): void {
     if (this.closed) {
       return
     }
@@ -190,7 +192,7 @@ export class RelaySessionBroker {
       clearTimeout(this.refreshTimer)
       this.refreshTimer = null
     }
-    this.originPool.closeNow()
+    this.originPool.closeNow(hostCloseReason)
     if (publishOffline) {
       this.options.onStatus('offline')
     }
@@ -242,8 +244,7 @@ export class RelaySessionBroker {
     }
     const now = (this.options.now ?? Date.now)()
     const random = this.options.random ?? Math.random
-    const earlyMs = 60_000 + Math.floor(random() * 60_001)
-    const delay = Math.max(0, authorization.expiresAt - earlyMs - now)
+    const delay = relayRenewalDelayMs(authorization.expiresAt, now, random)
     this.refreshTimer = setTimeout(() => void this.refreshAuthorization(), delay)
   }
 
diff --git a/src/main/runtime/rpc/e2ee-channel-v2.test.ts b/src/main/runtime/rpc/e2ee-channel-v2.test.ts
index f9e602ced41..b26b057abaf 100644
--- a/src/main/runtime/rpc/e2ee-channel-v2.test.ts
+++ b/src/main/runtime/rpc/e2ee-channel-v2.test.ts
@@ -156,6 +156,25 @@ describe('E2EEChannel v2', () => {
     })
   })
 
+  it('forwards post-auth capability-shaped frames without mutating authenticated capabilities', () => {
+    const ctx = setup()
+    const { schedule } = startV2(ctx)
+    const onMessage = vi.fn()
+    ctx.channel.onMessage(onMessage)
+    authenticate(ctx, schedule)
+
+    const capabilityFrame = JSON.stringify({
+      type: 'e2ee_client_capabilities',
+      v: 1,
+      clientCapabilities: ['agent-session.structured.v1']
+    })
+    ctx.channel.handleRawMessage(clientText(capabilityFrame, schedule, 1n))
+
+    expect(ctx.channel.clientCapabilities).toEqual([])
+    expect(onMessage).toHaveBeenCalledOnce()
+    expect(onMessage.mock.calls[0]?.[0]).toBe(capabilityFrame)
+  })
+
   it('rejects legacy downgrade and runtime-only capability metadata when mobile v2 is required', () => {
     const legacy = setup()
     legacy.channel.handleRawMessage(
diff --git a/src/main/runtime/rpc/errors.ts b/src/main/runtime/rpc/errors.ts
index f4b4768865b..1e4567f7f6f 100644
--- a/src/main/runtime/rpc/errors.ts
+++ b/src/main/runtime/rpc/errors.ts
@@ -85,6 +85,7 @@ const STRUCTURED_RUNTIME_PASSTHROUGH_CODES: ReadonlySet<string> = new Set([
   'consumer_fenced',
   'task_not_found',
   'task_not_startable',
+  'inject_rejected',
   'dispatch_not_found',
   'dispatch_run_mismatch',
   'terminal_not_found',
diff --git a/src/main/runtime/rpc/methods/clipboard.test.ts b/src/main/runtime/rpc/methods/clipboard.test.ts
index 118b21c766a..c0d224b85c6 100644
--- a/src/main/runtime/rpc/methods/clipboard.test.ts
+++ b/src/main/runtime/rpc/methods/clipboard.test.ts
@@ -1,6 +1,6 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { RpcDispatcher } from '../dispatcher'
-import type { RpcRequest } from '../core'
+import type { RpcRequest, RpcResponse } from '../core'
 import type { OrcaRuntimeService } from '../../orca-runtime'
 import {
   CLIPBOARD_IMAGE_MAX_BASE64_CHARS,
@@ -21,6 +21,10 @@ import {
   CLIPBOARD_METHODS,
   resetClipboardImageUploadsForTest
 } from './clipboard'
+import {
+  hasMobileClipboardImagePath,
+  resetMobileClipboardImageProvenanceForTest
+} from '../mobile-clipboard-image-provenance'
 
 function makeRequest(method: string, params?: unknown): RpcRequest {
   return { id: 'req-1', authToken: 'tok', method, params }
@@ -31,15 +35,36 @@ function makeDispatcher(): RpcDispatcher {
   return new RpcDispatcher({ runtime, methods: CLIPBOARD_METHODS })
 }
 
+async function callMobile(
+  dispatcher: RpcDispatcher,
+  method: string,
+  params: unknown,
+  clientId = 'device-a'
+): Promise<RpcResponse> {
+  const replies: RpcResponse[] = []
+  await dispatcher.dispatchStreaming(
+    makeRequest(method, params),
+    (raw) => replies.push(JSON.parse(raw) as RpcResponse),
+    { clientKind: 'mobile', clientId }
+  )
+  const response = replies[0]
+  if (!response) {
+    throw new Error(`no reply for ${method}`)
+  }
+  return response
+}
+
 describe('clipboard RPC methods', () => {
   beforeEach(() => {
     saveClipboardImageBufferAsTempFile.mockReset()
     resetClipboardImageUploadsForTest()
+    resetMobileClipboardImageProvenanceForTest()
   })
 
   afterEach(() => {
     vi.useRealTimers()
     resetClipboardImageUploadsForTest()
+    resetMobileClipboardImageProvenanceForTest()
   })
 
   it('saves browser-provided clipboard image bytes on the runtime host', async () => {
@@ -64,6 +89,37 @@ describe('clipboard RPC methods', () => {
     })
   })
 
+  it('records a successful direct mobile upload for only the authenticated client', async () => {
+    const path = '/tmp/orca-paste-image.png'
+    saveClipboardImageBufferAsTempFile.mockResolvedValue(path)
+    const dispatcher = makeDispatcher()
+
+    await expect(
+      callMobile(dispatcher, 'clipboard.saveImageAsTempFile', {
+        contentBase64: Buffer.from('png-bytes').toString('base64'),
+        connectionId: null
+      })
+    ).resolves.toMatchObject({ ok: true, result: path })
+
+    expect(hasMobileClipboardImagePath('device-a', path)).toBe(true)
+    expect(hasMobileClipboardImagePath('device-b', path)).toBe(false)
+  })
+
+  it('does not authorize a remote-host clipboard path for local structured delivery', async () => {
+    const path = '/tmp/orca-paste-image.png'
+    saveClipboardImageBufferAsTempFile.mockResolvedValue(path)
+    const dispatcher = makeDispatcher()
+
+    await expect(
+      callMobile(dispatcher, 'clipboard.saveImageAsTempFile', {
+        contentBase64: Buffer.from('png-bytes').toString('base64'),
+        connectionId: 'ssh-1'
+      })
+    ).resolves.toMatchObject({ ok: true, result: path })
+
+    expect(hasMobileClipboardImagePath('device-a', path)).toBe(false)
+  })
+
   it('rejects non-base64 clipboard image payloads', async () => {
     const dispatcher = makeDispatcher()
 
@@ -140,6 +196,48 @@ describe('clipboard RPC methods', () => {
     expect(saveClipboardImageBufferAsTempFile).toHaveBeenCalledWith(Buffer.from('png-bytes'), {
       connectionId: 'ssh-1'
     })
+    expect(hasMobileClipboardImagePath('device-a', '/tmp/orca-paste-image.png')).toBe(false)
+  })
+
+  it('binds chunk mutation and provenance to the mobile client that started the upload', async () => {
+    saveClipboardImageBufferAsTempFile.mockResolvedValue('/tmp/orca-paste-image.png')
+    const dispatcher = makeDispatcher()
+    const contentBase64 = Buffer.from('png-bytes').toString('base64')
+    const start = await callMobile(dispatcher, 'clipboard.startImageUpload', {
+      expectedBase64Length: contentBase64.length,
+      connectionId: null
+    })
+    const uploadId = (start.ok ? start.result : null) as { uploadId: string }
+
+    for (const method of [
+      'clipboard.appendImageUploadChunk',
+      'clipboard.commitImageUpload',
+      'clipboard.abortImageUpload'
+    ]) {
+      const params =
+        method === 'clipboard.appendImageUploadChunk'
+          ? { uploadId: uploadId.uploadId, offset: 0, contentBase64 }
+          : { uploadId: uploadId.uploadId }
+      await expect(callMobile(dispatcher, method, params, 'device-b')).resolves.toMatchObject({
+        ok: false
+      })
+    }
+
+    await expect(
+      callMobile(dispatcher, 'clipboard.appendImageUploadChunk', {
+        uploadId: uploadId.uploadId,
+        offset: 0,
+        contentBase64
+      })
+    ).resolves.toMatchObject({
+      ok: true,
+      result: { receivedBase64Length: contentBase64.length }
+    })
+    await expect(
+      callMobile(dispatcher, 'clipboard.commitImageUpload', { uploadId: uploadId.uploadId })
+    ).resolves.toMatchObject({ ok: true, result: '/tmp/orca-paste-image.png' })
+    expect(hasMobileClipboardImagePath('device-a', '/tmp/orca-paste-image.png')).toBe(true)
+    expect(hasMobileClipboardImagePath('device-b', '/tmp/orca-paste-image.png')).toBe(false)
   })
 
   it('rejects out-of-order chunk offsets', async () => {
diff --git a/src/main/runtime/rpc/methods/clipboard.ts b/src/main/runtime/rpc/methods/clipboard.ts
index 3d5212c7a52..e6b487d7761 100644
--- a/src/main/runtime/rpc/methods/clipboard.ts
+++ b/src/main/runtime/rpc/methods/clipboard.ts
@@ -1,11 +1,12 @@
 import { z } from 'zod'
-import { defineMethod, type RpcMethod } from '../core'
+import { defineMethod, type RpcContext, type RpcMethod } from '../core'
 import { saveClipboardImageBufferAsTempFile } from '../../../window/clipboard-image-temp-file'
 import { randomUUID } from 'node:crypto'
 import {
   CLIPBOARD_IMAGE_MAX_BASE64_CHARS,
   CLIPBOARD_IMAGE_TOO_LARGE_ERROR
 } from '../../../../shared/clipboard-image'
+import { recordMobileClipboardImagePath } from '../mobile-clipboard-image-provenance'
 
 const MAX_CLIPBOARD_IMAGE_BASE64_CHARS = CLIPBOARD_IMAGE_MAX_BASE64_CHARS
 export const CLIPBOARD_IMAGE_UPLOAD_CHUNK_BASE64_CHARS = 512 * 1024
@@ -16,6 +17,7 @@ const BASE64_PATTERN = /^[A-Za-z0-9+/]*={0,2}$/
 type ClipboardImageUpload = {
   expectedBase64Length: number
   connectionId?: string | null
+  mobileClientId?: string
   chunks: string[]
   receivedBase64Length: number
   expiresAt: number
@@ -69,6 +71,28 @@ function getUpload(uploadId: string): ClipboardImageUpload {
   return upload
 }
 
+function mobileClientId(ctx: RpcContext): string | undefined {
+  if (ctx.clientKind !== 'mobile') {
+    return undefined
+  }
+  const clientId = ctx.clientId?.trim()
+  if (!clientId) {
+    throw new Error('Clipboard image upload requires an authenticated mobile client')
+  }
+  return clientId
+}
+
+function assertMobileUploadOwner(
+  upload: ClipboardImageUpload,
+  ctx: RpcContext
+): string | undefined {
+  const clientId = mobileClientId(ctx)
+  if (clientId && upload.mobileClientId !== clientId) {
+    throw new Error('Clipboard image upload was not found')
+  }
+  return clientId
+}
+
 function assertValidBase64Content(value: string): void {
   if (!isValidBase64(value)) {
     throw new Error('Clipboard image content must be base64')
@@ -131,15 +155,24 @@ export const CLIPBOARD_METHODS: RpcMethod[] = [
   defineMethod({
     name: 'clipboard.saveImageAsTempFile',
     params: SaveImageAsTempFile,
-    handler: async (params) =>
-      saveClipboardImageBufferAsTempFile(Buffer.from(params.contentBase64, 'base64'), {
-        connectionId: params.connectionId
-      })
+    handler: async (params, ctx) => {
+      const clientId = mobileClientId(ctx)
+      const path = await saveClipboardImageBufferAsTempFile(
+        Buffer.from(params.contentBase64, 'base64'),
+        {
+          connectionId: params.connectionId
+        }
+      )
+      if (clientId && !params.connectionId) {
+        recordMobileClipboardImagePath(clientId, path)
+      }
+      return path
+    }
   }),
   defineMethod({
     name: 'clipboard.startImageUpload',
     params: StartImageUpload,
-    handler: (params) => {
+    handler: (params, ctx) => {
       pruneExpiredUploads()
       if (clipboardImageUploads.size >= CLIPBOARD_IMAGE_UPLOAD_MAX_CONCURRENT) {
         throw new Error('Too many clipboard image uploads are in progress')
@@ -148,6 +181,7 @@ export const CLIPBOARD_METHODS: RpcMethod[] = [
       clipboardImageUploads.set(uploadId, {
         expectedBase64Length: params.expectedBase64Length,
         connectionId: params.connectionId,
+        mobileClientId: mobileClientId(ctx),
         chunks: [],
         receivedBase64Length: 0,
         expiresAt: Date.now() + CLIPBOARD_IMAGE_UPLOAD_TTL_MS,
@@ -159,8 +193,9 @@ export const CLIPBOARD_METHODS: RpcMethod[] = [
   defineMethod({
     name: 'clipboard.appendImageUploadChunk',
     params: AppendImageUploadChunk,
-    handler: (params) => {
+    handler: (params, ctx) => {
       const upload = getUpload(params.uploadId)
+      assertMobileUploadOwner(upload, ctx)
       if (params.offset !== upload.receivedBase64Length) {
         throw new Error('Clipboard image chunk offset is out of order')
       }
@@ -177,17 +212,25 @@ export const CLIPBOARD_METHODS: RpcMethod[] = [
   defineMethod({
     name: 'clipboard.commitImageUpload',
     params: CommitImageUpload,
-    handler: async (params) => {
+    handler: async (params, ctx) => {
       const upload = getUpload(params.uploadId)
+      const clientId = assertMobileUploadOwner(upload, ctx)
       try {
         if (upload.receivedBase64Length !== upload.expectedBase64Length) {
           throw new Error('Clipboard image upload is incomplete')
         }
         const contentBase64 = upload.chunks.join('')
         assertValidBase64Content(contentBase64)
-        return await saveClipboardImageBufferAsTempFile(Buffer.from(contentBase64, 'base64'), {
-          connectionId: upload.connectionId
-        })
+        const path = await saveClipboardImageBufferAsTempFile(
+          Buffer.from(contentBase64, 'base64'),
+          {
+            connectionId: upload.connectionId
+          }
+        )
+        if (clientId && !upload.connectionId) {
+          recordMobileClipboardImagePath(clientId, path)
+        }
+        return path
       } finally {
         // Why: failed SSH or filesystem commits must not leave bounded upload
         // memory pinned until TTL cleanup.
@@ -198,7 +241,12 @@ export const CLIPBOARD_METHODS: RpcMethod[] = [
   defineMethod({
     name: 'clipboard.abortImageUpload',
     params: AbortImageUpload,
-    handler: (params) => {
+    handler: (params, ctx) => {
+      pruneExpiredUploads()
+      const upload = clipboardImageUploads.get(params.uploadId)
+      if (upload) {
+        assertMobileUploadOwner(upload, ctx)
+      }
       deleteUpload(params.uploadId)
       return { aborted: true }
     }
diff --git a/src/main/runtime/rpc/methods/mobile-markdown-tab-methods.ts b/src/main/runtime/rpc/methods/mobile-markdown-tab-methods.ts
new file mode 100644
index 00000000000..dcba8b7b64e
--- /dev/null
+++ b/src/main/runtime/rpc/methods/mobile-markdown-tab-methods.ts
@@ -0,0 +1,22 @@
+import { defineMethod, type RpcAnyMethod } from '../core'
+import { ActivateTab, SaveMarkdownTab } from './session-tabs-schemas'
+
+export const MOBILE_MARKDOWN_TAB_METHODS: RpcAnyMethod[] = [
+  defineMethod({
+    name: 'markdown.readTab',
+    params: ActivateTab,
+    handler: async (params, { runtime }) =>
+      runtime.readMobileMarkdownTab(params.worktree, params.tabId)
+  }),
+  defineMethod({
+    name: 'markdown.saveTab',
+    params: SaveMarkdownTab,
+    handler: async (params, { runtime }) =>
+      runtime.saveMobileMarkdownTab(
+        params.worktree,
+        params.tabId,
+        params.baseVersion,
+        params.content
+      )
+  })
+]
diff --git a/src/main/runtime/rpc/methods/orchestration-dispatch-error-codes.test.ts b/src/main/runtime/rpc/methods/orchestration-dispatch-error-codes.test.ts
new file mode 100644
index 00000000000..918724e6aaf
--- /dev/null
+++ b/src/main/runtime/rpc/methods/orchestration-dispatch-error-codes.test.ts
@@ -0,0 +1,242 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { ORCHESTRATION_CONTRACT_VERSION } from '../../../../shared/protocol-version'
+import {
+  buildInjectRejectionMessage,
+  injectRejectedRefusal,
+  taskNotFoundRefusal,
+  taskNotStartableRefusal
+} from '../../../../shared/orchestration-dispatch-refusal-contract'
+import { OrcaRuntimeService } from '../../orca-runtime'
+import { OrchestrationDb } from '../../orchestration/db'
+import type { RpcFailure, RpcRequest, RpcResponse } from '../core'
+import { RpcDispatcher } from '../dispatcher'
+import { ORCHESTRATION_METHODS } from './orchestration'
+
+const COORDINATOR_HANDLE = 'term_codes_coordinator'
+const COORDINATOR_PANE = 'tab_coord:cccccccc-cccc-4ccc-8ccc-cccccccccccc'
+const WORKER_HANDLE = 'term_codes_worker'
+const WORKER_PANE = 'tab_worker:dddddddd-dddd-4ddd-8ddd-dddddddddddd'
+
+type Harness = { db: OrchestrationDb; runtime: OrcaRuntimeService; dispatcher: RpcDispatcher }
+
+const harnesses: Harness[] = []
+let requestSequence = 0
+
+afterEach(() => {
+  for (const harness of harnesses.splice(0)) {
+    harness.db.close()
+  }
+  vi.restoreAllMocks()
+})
+
+// Why: an agent reads the receipt code to pick a recovery; every case is driven from the real
+// RPC dispatcher and checked against the shared contract the CLI-side test formats.
+describe('orchestration dispatch failure codes through RpcDispatcher', () => {
+  it('reports task_not_found for a task id that does not exist', async () => {
+    const harness = createHarness()
+
+    const response = await dispatch(harness, { task: 'task_missing', to: WORKER_HANDLE })
+
+    expect(expectFailure(response).error).toEqual(
+      taskNotFoundRefusal('Task not found: task_missing', { taskId: 'task_missing' })
+    )
+  })
+
+  it('reports task_not_startable with the unmet dependencies for a pending task', async () => {
+    const harness = createHarness()
+    const parent = harness.db.createTask({ spec: 'parent' })
+    const child = harness.db.createTask({ spec: 'child', deps: [parent.id] })
+
+    const response = await dispatch(harness, { task: child.id, to: WORKER_HANDLE })
+
+    expect(expectFailure(response).error).toEqual(
+      taskNotStartableRefusal(`Task ${child.id} is pending; only ready tasks can be dispatched`, {
+        taskId: child.id,
+        status: 'pending',
+        unmetDependencies: [parent.id]
+      })
+    )
+    expect(harness.db.getTask(child.id)?.status).toBe('pending')
+  })
+
+  it('reports task_not_startable with the status for a completed task', async () => {
+    const harness = createHarness()
+    const task = harness.db.createTask({ spec: 'done' })
+    harness.db.updateTaskStatus(task.id, 'completed')
+
+    const response = await dispatch(harness, { task: task.id, to: WORKER_HANDLE })
+
+    expect(expectFailure(response).error).toEqual(
+      taskNotStartableRefusal(`Task ${task.id} is completed; only ready tasks can be dispatched`, {
+        taskId: task.id,
+        status: 'completed',
+        unmetDependencies: []
+      })
+    )
+  })
+
+  it('reports inject_rejected when the target terminal runs no recognized agent', async () => {
+    const harness = createHarness()
+    const task = harness.db.createTask({ spec: 'work' })
+    vi.spyOn(harness.runtime, 'isTerminalRunningAgent').mockResolvedValue(false)
+
+    const response = await dispatch(harness, { task: task.id, to: WORKER_HANDLE, inject: true })
+
+    expect(expectFailure(response).error).toEqual(
+      injectRejectedRefusal(WORKER_HANDLE, 'no_agent_detected')
+    )
+    expect(expectFailure(response).error.message).toBe(buildInjectRejectionMessage(WORKER_HANDLE))
+    expect(harness.db.getTask(task.id)?.status).toBe('ready')
+    expect(harness.db.getDispatchContext(task.id)).toBeUndefined()
+  })
+
+  it('reports task_not_startable with dependency detail from worker-start', async () => {
+    const harness = createHarness()
+    const parent = harness.db.createTask({ spec: 'parent' })
+    const child = harness.db.createTask({ spec: 'child', deps: [parent.id] })
+    mockWorkerStartTopology(harness.runtime)
+
+    const response = await harness.dispatcher.dispatch(
+      request('orchestration.workerStart', {
+        task: child.id,
+        from: COORDINATOR_HANDLE,
+        agent: 'claude'
+      })
+    )
+
+    expect(expectFailure(response).error).toEqual(
+      taskNotStartableRefusal(`Task ${child.id} is pending; only a ready Task can start.`, {
+        taskId: child.id,
+        status: 'pending',
+        unmetDependencies: [parent.id]
+      })
+    )
+    expect(harness.db.getTask(child.id)?.status).toBe('pending')
+  })
+
+  it('reports task_not_startable with retry detail for an invalid --retry-of', async () => {
+    const harness = createHarness()
+    const task = harness.db.createTask({ spec: 'work' })
+    mockWorkerStartTopology(harness.runtime)
+
+    const response = await harness.dispatcher.dispatch(
+      request('orchestration.workerStart', {
+        task: task.id,
+        from: COORDINATOR_HANDLE,
+        agent: 'claude',
+        retryOf: 'ctx_missing'
+      })
+    )
+
+    expect(expectFailure(response).error).toEqual(
+      taskNotStartableRefusal(`Task ${task.id} cannot retry from Dispatch ctx_missing.`, {
+        taskId: task.id,
+        status: 'ready',
+        unmetDependencies: [],
+        retryOf: 'ctx_missing'
+      })
+    )
+  })
+
+  it('types the atomic claim loser when the task changes after the ready precheck', async () => {
+    const harness = createHarness()
+    const task = harness.db.createTask({ spec: 'raced' })
+    // Why: the pane lookup runs after the ready precheck and before the DB claim, so failing the
+    // task there is the interleaving a concurrent status change produces. The loser's DB refusal
+    // must carry the same typed receipt instead of the bare Error it used to throw.
+    vi.mocked(harness.runtime.getTerminalPaneKey).mockImplementation((handle) => {
+      if (handle === WORKER_HANDLE) {
+        harness.db.updateTaskStatus(task.id, 'failed', 'raced out')
+        return WORKER_PANE
+      }
+      return handle === COORDINATOR_HANDLE ? COORDINATOR_PANE : null
+    })
+
+    const response = await dispatch(harness, { task: task.id, to: WORKER_HANDLE })
+
+    expect(expectFailure(response).error).toEqual(
+      taskNotStartableRefusal(`Task ${task.id} is failed; only ready tasks can be dispatched`, {
+        taskId: task.id,
+        status: 'failed',
+        unmetDependencies: []
+      })
+    )
+    expect(harness.db.getDispatchContext(task.id)).toBeUndefined()
+  })
+
+  it('keeps runtime_error for a genuinely unexpected dispatch failure', async () => {
+    const harness = createHarness()
+    const task = harness.db.createTask({ spec: 'work' })
+    vi.spyOn(harness.runtime, 'isTerminalRunningAgent').mockRejectedValue(
+      new Error('probe exploded')
+    )
+
+    const response = await dispatch(harness, { task: task.id, to: WORKER_HANDLE, inject: true })
+
+    expect(expectFailure(response).error).toMatchObject({
+      code: 'runtime_error',
+      message: 'probe exploded'
+    })
+  })
+})
+
+function expectFailure(response: RpcResponse): RpcFailure {
+  if (response.ok) {
+    throw new Error(`Expected a failure, got ${JSON.stringify(response.result)}`)
+  }
+  return response
+}
+
+function createHarness(): Harness {
+  const db = new OrchestrationDb(':memory:')
+  const runtime = new OrcaRuntimeService()
+  runtime.setOrchestrationDb(db)
+  vi.spyOn(runtime, 'getTerminalPaneKey').mockImplementation((handle) =>
+    handle === COORDINATOR_HANDLE ? COORDINATOR_PANE : handle === WORKER_HANDLE ? WORKER_PANE : null
+  )
+  vi.spyOn(runtime, 'getTerminalProcessIncarnation').mockImplementation((handle) =>
+    handle === WORKER_HANDLE ? 'pty-worker:incarnation-1' : null
+  )
+  const runId = db.createRun({
+    objective: 'Typed dispatch failures',
+    coordinatorHandle: COORDINATOR_HANDLE,
+    coordinatorPaneKey: COORDINATOR_PANE
+  }).id
+  const createTask = db.createTask.bind(db)
+  db.createTask = (task) => createTask({ ...task, runId: task.runId ?? runId })
+  const harness = {
+    db,
+    runtime,
+    dispatcher: new RpcDispatcher({ runtime, methods: ORCHESTRATION_METHODS })
+  }
+  harnesses.push(harness)
+  return harness
+}
+
+function mockWorkerStartTopology(runtime: OrcaRuntimeService): void {
+  vi.spyOn(runtime, 'validateOrchestrationAgentLauncher').mockImplementation(() => {})
+  vi.spyOn(runtime, 'showTerminal').mockImplementation(
+    async (handle) => ({ handle, worktreeId: 'repo::worktree', status: 'running' }) as never
+  )
+  vi.spyOn(runtime, 'showManagedTerminalWorkspace').mockResolvedValue({
+    id: 'repo::worktree'
+  } as never)
+}
+
+function dispatch(harness: Harness, params: Record<string, unknown>): Promise<RpcResponse> {
+  return harness.dispatcher.dispatch(
+    request('orchestration.dispatch', { from: COORDINATOR_HANDLE, ...params })
+  )
+}
+
+function request(method: string, params: Record<string, unknown>): RpcRequest {
+  requestSequence += 1
+  return {
+    id: `rpc_dispatch_error_codes_${requestSequence}`,
+    authToken: 'test-token',
+    method,
+    params,
+    orchestrationContractVersion: ORCHESTRATION_CONTRACT_VERSION,
+    orchestrationRequestId: `dispatch_error_codes_${requestSequence}`
+  }
+}
diff --git a/src/main/runtime/rpc/methods/orchestration-dispatch-methods.ts b/src/main/runtime/rpc/methods/orchestration-dispatch-methods.ts
index ae21a4e5a46..d573d944b2d 100644
--- a/src/main/runtime/rpc/methods/orchestration-dispatch-methods.ts
+++ b/src/main/runtime/rpc/methods/orchestration-dispatch-methods.ts
@@ -2,7 +2,11 @@ import { defineMethod, type RpcMethod } from '../core'
 import { OrchestrationError } from '../../orchestration/orchestration-error'
 import { buildDispatchPreamble } from '../../orchestration/preamble'
 import { resolveDispatchCreator } from './orchestration-dispatch-creator'
-import { buildInjectRejectionMessage } from './orchestration-inject-rejection-message'
+import {
+  injectRejectedError,
+  taskNotFoundError,
+  taskNotStartableError
+} from '../../orchestration/task-dispatch-refusal'
 import { resolveRunScope } from './orchestration-run-scope'
 import { DispatchParams, DispatchShowParams } from './orchestration-schemas'
 
@@ -22,7 +26,7 @@ export const ORCHESTRATION_DISPATCH_METHODS: RpcMethod[] = [
       const db = runtime.getOrchestrationDb()
       const task = db.getTask(params.task)
       if (!task) {
-        throw new Error(`Task not found: ${params.task}`)
+        throw taskNotFoundError(`Task not found: ${params.task}`, { taskId: params.task })
       }
       const run = resolveRunScope(runtime, {
         runId: params.run,
@@ -32,10 +36,10 @@ export const ORCHESTRATION_DISPATCH_METHODS: RpcMethod[] = [
         callerEvidence: orchestrationCompatibilityEvidence
       })
       if (task.run_id !== run.id) {
-        throw new OrchestrationError(
-          'task_not_found',
-          `Task ${task.id} was not found in Run ${run.id}.`
-        )
+        throw taskNotFoundError(`Task ${task.id} was not found in Run ${run.id}.`, {
+          taskId: task.id,
+          runId: run.id
+        })
       }
 
       // Why: dry-run previews the preamble without mutating state, so it skips the ready-status check and uses a placeholder dispatchId.
@@ -66,14 +70,18 @@ export const ORCHESTRATION_DISPATCH_METHODS: RpcMethod[] = [
       const to = params.to
 
       if (task.status !== 'ready') {
-        throw new Error(`Task ${params.task} is ${task.status}; only ready tasks can be dispatched`)
+        throw taskNotStartableError(
+          db,
+          `Task ${params.task} is ${task.status}; only ready tasks can be dispatched`,
+          task
+        )
       }
 
       // Why: injecting the preamble into a bare shell dumps it as shell commands (gibberish), so require a detected agent first.
       if (params.inject) {
         const hasAgent = await runtime.isTerminalRunningAgent(to)
         if (!hasAgent) {
-          throw new Error(buildInjectRejectionMessage(to))
+          throw injectRejectedError(to, 'no_agent_detected')
         }
       }
 
diff --git a/src/main/runtime/rpc/methods/orchestration-inject-rejection-message.test.ts b/src/main/runtime/rpc/methods/orchestration-inject-rejection-message.test.ts
deleted file mode 100644
index a7ae03b00a8..00000000000
--- a/src/main/runtime/rpc/methods/orchestration-inject-rejection-message.test.ts
+++ /dev/null
@@ -1,31 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import { buildInjectRejectionMessage } from './orchestration-inject-rejection-message'
-import { TUI_AGENT_CONFIG } from '../../../../shared/tui-agent-config'
-import { recognizeAgentProcess } from '../../../../shared/agent-process-recognition'
-
-describe('buildInjectRejectionMessage', () => {
-  const message = buildInjectRejectionMessage('term_a')
-
-  it('keeps the substring callers and scripts match on', () => {
-    expect(message).toContain('Cannot dispatch --inject to terminal term_a')
-    expect(message).toContain('no recognized agent detected')
-  })
-
-  it('names every agent Orca recognizes, including agy', () => {
-    expect(message).toMatch(/\bagy\b/)
-    for (const config of Object.values(TUI_AGENT_CONFIG)) {
-      expect(message).toContain(config.expectedProcess)
-    }
-  })
-
-  it('lists only names detection actually resolves, deduped and sorted', () => {
-    const listed = (/\(([^)]+)\)/.exec(message)?.[1] ?? '').split(', ')
-
-    expect(listed.length).toBeGreaterThan(0)
-    expect(new Set(listed).size).toBe(listed.length)
-    expect([...listed].sort()).toEqual(listed)
-    for (const name of listed) {
-      expect(recognizeAgentProcess(name)).not.toBeNull()
-    }
-  })
-})
diff --git a/src/main/runtime/rpc/methods/orchestration-inject-rejection-message.ts b/src/main/runtime/rpc/methods/orchestration-inject-rejection-message.ts
deleted file mode 100644
index 33d622ca80e..00000000000
--- a/src/main/runtime/rpc/methods/orchestration-inject-rejection-message.ts
+++ /dev/null
@@ -1,16 +0,0 @@
-import { TUI_AGENT_CONFIG } from '../../../../shared/tui-agent-config'
-
-// Why: the old five-name example read as an allowlist (#15125); derive from the field detection keys on so it cannot drift.
-// Not filtered by `disabledTuiAgents` — that gates Orca's launchers, not detection, so a hand-started disabled agent still injects.
-const RECOGNIZED_AGENT_PROCESS_NAMES = [
-  ...new Set(Object.values(TUI_AGENT_CONFIG).map((config) => config.expectedProcess))
-].sort()
-
-export function buildInjectRejectionMessage(terminal: string): string {
-  return (
-    `Cannot dispatch --inject to terminal ${terminal}: no recognized agent detected. ` +
-    `Orca detects these agent CLIs (${RECOGNIZED_AGENT_PROCESS_NAMES.join(', ')}). ` +
-    'Start one in the terminal and let it finish launching, ' +
-    'or dispatch without --inject and send the prompt manually.'
-  )
-}
diff --git a/src/main/runtime/rpc/methods/orchestration-tasks-dispatch.test.ts b/src/main/runtime/rpc/methods/orchestration-tasks-dispatch.test.ts
index a216b4c7a4d..cd6d79c9fd5 100644
--- a/src/main/runtime/rpc/methods/orchestration-tasks-dispatch.test.ts
+++ b/src/main/runtime/rpc/methods/orchestration-tasks-dispatch.test.ts
@@ -3,7 +3,7 @@ import type { RpcContext } from '../core'
 import { createOrchestrationRpcHarness } from './orchestration-rpc-test-harness'
 import type { OrchestrationDb } from '../../orchestration/db'
 import type { OrcaRuntimeService } from '../../orca-runtime'
-import { buildInjectRejectionMessage } from './orchestration-inject-rejection-message'
+import { buildInjectRejectionMessage } from '../../../../shared/orchestration-dispatch-refusal-contract'
 import { createRootDispatch } from '../../orchestration/db/root-dispatch-test-fixture'
 
 describe('orchestration RPC methods', () => {
diff --git a/src/main/runtime/rpc/methods/orchestration-workers.ts b/src/main/runtime/rpc/methods/orchestration-workers.ts
index 61271525939..632b34cc1b7 100644
--- a/src/main/runtime/rpc/methods/orchestration-workers.ts
+++ b/src/main/runtime/rpc/methods/orchestration-workers.ts
@@ -21,6 +21,7 @@ import {
 import { failWorkerStartWithReceipt } from './orchestration-worker-start-receipt'
 import { prepareLocalWorkerStart } from './orchestration-worker-start-validation'
 import { resolveDispatchCreator } from './orchestration-dispatch-creator'
+import { taskNotFoundError } from '../../orchestration/task-dispatch-refusal'
 import { resolveOrchestrationCaller } from './orchestration-run-scope'
 import {
   isWorkerStartTimeoutWithinTimerLimit,
@@ -58,10 +59,10 @@ export const ORCHESTRATION_WORKER_START_METHODS: RpcMethod[] = [
       }
       const task = db.getTask(params.task)
       if (!task || task.run_id !== run.id) {
-        throw new OrchestrationError(
-          'task_not_found',
-          `Task ${params.task} was not found in Run ${run.id}.`
-        )
+        throw taskNotFoundError(`Task ${params.task} was not found in Run ${run.id}.`, {
+          taskId: params.task,
+          runId: run.id
+        })
       }
 
       if (params.on) {
diff --git a/src/main/runtime/rpc/methods/session-tab-agent-capability-mutations.test.ts b/src/main/runtime/rpc/methods/session-tab-agent-capability-mutations.test.ts
index 226277f6ebd..183f981ccee 100644
--- a/src/main/runtime/rpc/methods/session-tab-agent-capability-mutations.test.ts
+++ b/src/main/runtime/rpc/methods/session-tab-agent-capability-mutations.test.ts
@@ -1,5 +1,6 @@
 import { describe, expect, it, vi } from 'vitest'
 import {
+  CLAUDE_STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY,
   STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY,
   type RuntimeCapability
 } from '../../../../shared/protocol-version'
@@ -49,6 +50,8 @@ const METHODS = [
   }
 ] as const
 
+const DESTRUCTIVE_METHOD_NAMES = new Set(['session.tabs.close', 'session.tabs.closeLifecycle'])
+
 describe('session tab structured capability mutations', () => {
   for (const method of METHODS) {
     it(`rejects ${method.name} when the structured row is hidden`, async () => {
@@ -67,13 +70,56 @@ describe('session tab structured capability mutations', () => {
       expect(fixture.calls[method.runtimeMethod]).toHaveBeenCalledOnce()
     })
 
-    it(`rejects ${method.name} for a legacy Claude row`, async () => {
+    it(`rejects ${method.name} on a Claude row the client never negotiated`, async () => {
       const fixture = createFixture([STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY])
       const response = await fixture.dispatch(method.name, method.params('claude-session'))
 
       expect(response.ok).toBe(false)
       expect(fixture.calls[method.runtimeMethod]).not.toHaveBeenCalled()
     })
+
+    it(`allows ${method.name} for a client that negotiated Claude rows`, async () => {
+      const fixture = createFixture([
+        STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY,
+        CLAUDE_STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY
+      ])
+      const response = await fixture.dispatch(method.name, method.params('claude-session'))
+
+      expect(response.ok).toBe(true)
+      expect(fixture.calls[method.runtimeMethod]).toHaveBeenCalledOnce()
+    })
+  }
+
+  for (const method of METHODS) {
+    const expectedToAllowPromptedRow = !DESTRUCTIVE_METHOD_NAMES.has(method.name)
+
+    it(`${expectedToAllowPromptedRow ? 'allows' : 'rejects'} ${method.name} on a row an old mobile client was prompted to update`, async () => {
+      const { calls, dispatch } = createFixture([], {
+        clientKind: 'mobile',
+        structuredNativeChatEnabled: true
+      })
+
+      const response = await dispatch(method.name, method.params('codex-session'))
+
+      expect(response.ok).toBe(expectedToAllowPromptedRow)
+      expect(calls[method.runtimeMethod as keyof typeof calls]).toHaveBeenCalledTimes(
+        expectedToAllowPromptedRow ? 1 : 0
+      )
+    })
+
+    it(`${expectedToAllowPromptedRow ? 'allows' : 'rejects'} ${method.name} on a prompted Claude row for a mobile client without the Claude capability`, async () => {
+      const { calls, dispatch } = createFixture([STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY], {
+        clientKind: 'mobile',
+        structuredNativeChatEnabled: true
+      })
+
+      const response = await dispatch(method.name, method.params('claude-session'))
+
+      expect(response.ok).toBe(expectedToAllowPromptedRow)
+      expect(calls[method.runtimeMethod as keyof typeof calls]).toHaveBeenCalledTimes(
+        expectedToAllowPromptedRow ? 1 : 0
+      )
+    })
   }
 
   it.each(['session.tabs.close', 'session.tabs.closeLifecycle'] as const)(
@@ -119,7 +165,10 @@ describe('session tab structured capability mutations', () => {
   )
 })
 
-function createFixture(capabilities: RuntimeCapability[]) {
+function createFixture(
+  capabilities: RuntimeCapability[],
+  options: { clientKind?: 'mobile' | 'runtime'; structuredNativeChatEnabled?: boolean } = {}
+) {
   const snapshot = agentSnapshot()
   const calls = {
     closeMobileSessionTab: vi.fn().mockResolvedValue({ closed: true }),
@@ -130,11 +179,14 @@ function createFixture(capabilities: RuntimeCapability[]) {
   const runtime = {
     getRuntimeId: () => 'test-runtime',
     listMobileSessionTabs: vi.fn().mockResolvedValue(snapshot),
+    getClientSettings: () => ({
+      experimentalStructuredNativeChat: options.structuredNativeChatEnabled === true
+    }),
     ...calls
   } as unknown as OrcaRuntimeService
   const dispatcher = new RpcDispatcher({ runtime, methods: SESSION_TAB_METHODS })
   const context: RpcDispatchStreamingOptions = {
-    clientKind: 'runtime',
+    clientKind: options.clientKind ?? 'runtime',
     pairedDeviceId: 'paired-client',
     clientCapabilities: capabilities
   }
diff --git a/src/main/runtime/rpc/methods/session-tab-agent-status-projection.test.ts b/src/main/runtime/rpc/methods/session-tab-agent-status-projection.test.ts
index 4a61a99bc20..cf68f7739c0 100644
--- a/src/main/runtime/rpc/methods/session-tab-agent-status-projection.test.ts
+++ b/src/main/runtime/rpc/methods/session-tab-agent-status-projection.test.ts
@@ -1,10 +1,15 @@
 import { describe, expect, it } from 'vitest'
 import {
   AGENT_SESSION_BOUNDARY_RUNTIME_CAPABILITY,
+  CLAUDE_STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY,
   STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY
 } from '../../../../shared/protocol-version'
 import type { RuntimeMobileSessionTabsSnapshot } from '../../../../shared/runtime-types'
-import { projectSessionTabAgentStatus } from './session-tab-agent-status-projection'
+import {
+  CLAUDE_STRUCTURED_CHAT_DESKTOP_ONLY_TAB_TITLE,
+  STRUCTURED_CHAT_UPDATE_REQUIRED_TAB_TITLE,
+  projectSessionTabAgentStatus
+} from './session-tab-agent-status-projection'
 
 function makeSnapshot(sessionBoundary: boolean): RuntimeMobileSessionTabsSnapshot {
   return {
@@ -119,44 +124,178 @@ describe('projectSessionTabAgentStatus', () => {
     expect(capable).toBe(snapshot)
   })
 
-  it('withholds legacy Claude rows from paired structured clients', () => {
-    const snapshot = {
-      ...makeSnapshot(false),
-      tabs: [
-        {
-          type: 'agent-session',
-          id: 'agent-session:codex',
-          title: 'Codex Chat',
-          sessionId: 'codex',
-          agent: 'codex',
-          isActive: true
-        },
-        {
-          type: 'agent-session',
-          id: 'agent-session:claude',
-          title: 'Claude Chat',
-          sessionId: 'claude',
-          agent: 'claude',
-          isActive: false
-        }
-      ],
-      activeTabId: 'agent-session:codex',
-      activeTabType: 'agent-session'
+  const claudeSnapshot = {
+    ...makeSnapshot(false),
+    tabs: [
+      {
+        type: 'agent-session',
+        id: 'agent-session:codex',
+        title: 'Codex Chat',
+        sessionId: 'codex',
+        agent: 'codex',
+        isActive: true
+      },
+      {
+        type: 'agent-session',
+        id: 'agent-session:claude',
+        title: 'Claude Chat',
+        sessionId: 'claude',
+        agent: 'claude',
+        isActive: false
+      }
+    ],
+    activeGroupId: 'group-a',
+    activeTabId: 'agent-session:codex',
+    activeTabType: 'agent-session',
+    tabGroups: [
+      { id: 'group-a', activeTabId: 'agent-session:codex', tabOrder: ['agent-session:codex'] },
+      { id: 'group-b', activeTabId: 'agent-session:claude', tabOrder: ['agent-session:claude'] }
+    ],
+    tabGroupLayout: {
+      type: 'split',
+      direction: 'horizontal',
+      first: { type: 'leaf', groupId: 'group-a' },
+      second: { type: 'leaf', groupId: 'group-b' }
+    }
+  } as unknown as RuntimeMobileSessionTabsSnapshot
+
+  const structuredMobile = [
+    STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY,
+    CLAUDE_STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY
+  ]
+
+  it('withholds Claude rows from a paired runtime client that never negotiated them', () => {
+    const projected = projectSessionTabAgentStatus(
+      claudeSnapshot,
+      'runtime',
+      [STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY],
+      true
+    )
+
+    expect(projected.tabs.map((tab) => tab.id)).toEqual(['agent-session:codex'])
+    // A row pruned from `tabs` but left in the layout is its own dead tab.
+    expect(projected.tabGroups?.map((group) => group.id)).toEqual(['group-a'])
+    expect(projected.tabGroupLayout).toEqual({ type: 'leaf', groupId: 'group-a' })
+    expect(projected.activeGroupId).toBe('group-a')
+    expect(projected.activeTabId).toBe('agent-session:codex')
+    expect(projected.activeTabType).toBe('agent-session')
+  })
+
+  it('uses a desktop fallback for an unsupported Claude row instead of withholding it', () => {
+    const projected = projectSessionTabAgentStatus(
+      claudeSnapshot,
+      'mobile',
+      [STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY],
+      true
+    )
+
+    // The row survives so the chat the desktop shows is not simply absent on the phone.
+    expect(projected.tabs.map((tab) => tab.id)).toEqual([
+      'agent-session:codex',
+      'agent-session:claude'
+    ])
+    expect(projected.tabs.map((tab) => tab.title)).toEqual([
+      'Codex Chat',
+      CLAUDE_STRUCTURED_CHAT_DESKTOP_ONLY_TAB_TITLE
+    ])
+    // Nothing is removed, so the layout it belonged to is untouched.
+    expect(projected.tabGroups?.map((group) => group.id)).toEqual(['group-a', 'group-b'])
+    expect(projected.tabGroupLayout).toEqual(claudeSnapshot.tabGroupLayout)
+    expect(projected.activeTabId).toBe('agent-session:codex')
+  })
+
+  it('projects agent-specific fallback titles for a mobile client with no capabilities', () => {
+    const projected = projectSessionTabAgentStatus(claudeSnapshot, 'mobile', [], true)
+
+    expect(projected.tabs.map((tab) => tab.title)).toEqual([
+      STRUCTURED_CHAT_UPDATE_REQUIRED_TAB_TITLE,
+      CLAUDE_STRUCTURED_CHAT_DESKTOP_ONLY_TAB_TITLE
+    ])
+    expect(projected.tabGroupLayout).toEqual(claudeSnapshot.tabGroupLayout)
+  })
+
+  it('does not treat the Claude capability as a substitute for the base structured capability', () => {
+    const projected = projectSessionTabAgentStatus(
+      claudeSnapshot,
+      'mobile',
+      [CLAUDE_STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY],
+      true
+    )
+
+    expect(projected.tabs.map((tab) => tab.title)).toEqual([
+      STRUCTURED_CHAT_UPDATE_REQUIRED_TAB_TITLE,
+      CLAUDE_STRUCTURED_CHAT_DESKTOP_ONLY_TAB_TITLE
+    ])
+  })
+
+  it('shows both real titles once mobile negotiates Claude', () => {
+    expect(projectSessionTabAgentStatus(claudeSnapshot, 'mobile', structuredMobile, true)).toBe(
+      claudeSnapshot
+    )
+  })
+
+  // Why: updating cannot reveal a chat the desktop is not serving, so the prompt would lie.
+  it('withholds rather than prompts when the desktop experiment is off', () => {
+    for (const capabilities of [
+      [],
+      [STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY],
+      structuredMobile
+    ]) {
+      const projected = projectSessionTabAgentStatus(claudeSnapshot, 'mobile', capabilities, false)
+      expect(projected.tabs).toEqual([])
+    }
+  })
+
+  it('never emits an empty structured tab title', () => {
+    for (const capabilities of [[], [STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY]]) {
+      const projected = projectSessionTabAgentStatus(claudeSnapshot, 'mobile', capabilities, true)
+      for (const tab of projected.tabs) {
+        expect(tab.title.length).toBeGreaterThan(0)
+      }
+    }
+  })
+
+  it.each([
+    ['mobile', 'mobile' as const, structuredMobile],
+    [
+      'runtime',
+      'runtime' as const,
+      [
+        STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY,
+        CLAUDE_STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY
+      ]
+    ]
+  ])(
+    'publishes Claude rows to a paired %s client that negotiated them',
+    (_name, clientKind, capabilities) => {
+      const projected = projectSessionTabAgentStatus(claudeSnapshot, clientKind, capabilities, true)
+
+      expect(projected).toBe(claudeSnapshot)
+      expect(projected.tabGroupLayout).toEqual(claudeSnapshot.tabGroupLayout)
+    }
+  )
+
+  it('keeps Claude rows on the local renderer, which negotiates nothing', () => {
+    expect(projectSessionTabAgentStatus(claudeSnapshot, undefined, undefined)).toBe(claudeSnapshot)
+    expect(projectSessionTabAgentStatus(claudeSnapshot, undefined, [])).toBe(claudeSnapshot)
+  })
+
+  it('leaves Codex rows untouched whether or not the Claude capability is present', () => {
+    const codexOnly = {
+      ...claudeSnapshot,
+      tabs: claudeSnapshot.tabs.filter((tab) => tab.id !== 'agent-session:claude'),
+      tabGroups: claudeSnapshot.tabGroups?.filter((group) => group.id !== 'group-b'),
+      tabGroupLayout: { type: 'leaf', groupId: 'group-a' }
     } as unknown as RuntimeMobileSessionTabsSnapshot
 
-    expect(
-      projectSessionTabAgentStatus(snapshot, 'runtime', [
-        STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY
-      ]).tabs.map((tab) => tab.id)
-    ).toEqual(['agent-session:codex'])
-    expect(
-      projectSessionTabAgentStatus(
-        snapshot,
-        'mobile',
-        [STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY],
-        true
-      ).tabs.map((tab) => tab.id)
-    ).toEqual(['agent-session:codex'])
+    for (const capabilities of [[STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY], structuredMobile]) {
+      for (const clientKind of ['mobile', 'runtime'] as const) {
+        expect(projectSessionTabAgentStatus(codexOnly, clientKind, capabilities, true)).toBe(
+          codexOnly
+        )
+      }
+    }
+    expect(projectSessionTabAgentStatus(codexOnly, undefined, undefined)).toBe(codexOnly)
   })
 
   it('withholds session boundaries from legacy paired clients', () => {
diff --git a/src/main/runtime/rpc/methods/session-tab-agent-status-projection.ts b/src/main/runtime/rpc/methods/session-tab-agent-status-projection.ts
index 375b3b499d5..4496fdc5435 100644
--- a/src/main/runtime/rpc/methods/session-tab-agent-status-projection.ts
+++ b/src/main/runtime/rpc/methods/session-tab-agent-status-projection.ts
@@ -1,5 +1,7 @@
 import {
   AGENT_SESSION_BOUNDARY_RUNTIME_CAPABILITY,
+  CLAUDE_STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY,
+  STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY,
   type RuntimeCapability
 } from '../../../../shared/protocol-version'
 import type {
@@ -12,6 +14,43 @@ import { structuredNativeChatProjectionEnabled } from './structured-agent-sessio
 
 type SessionTabsPayload = RuntimeMobileSessionTabsResult | RuntimeMobileSessionTabsSnapshot
 
+/** Capped at 128px / one line in every shipped mobile build, so ~15-18 characters render. */
+export const STRUCTURED_CHAT_UPDATE_REQUIRED_TAB_TITLE = 'Update to view'
+export const CLAUDE_STRUCTURED_CHAT_DESKTOP_ONLY_TAB_TITLE = 'Open on desktop'
+
+function clientCanRenderStructuredAgentSessionTab(
+  tab: RuntimeMobileSessionAgentTab,
+  clientCapabilities: readonly RuntimeCapability[] | undefined
+): boolean {
+  if (!clientCapabilities?.includes(STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY)) {
+    return false
+  }
+  return (
+    tab.agent === 'codex' ||
+    clientCapabilities.includes(CLAUDE_STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY)
+  )
+}
+
+function resolveMobileStructuredChatFallbackTitle(
+  tab: RuntimeMobileSessionAgentTab,
+  args: {
+    clientKind: 'mobile' | 'runtime' | undefined
+    clientCapabilities: readonly RuntimeCapability[] | undefined
+    structuredNativeChatEnabled?: boolean
+  }
+): string | null {
+  if (
+    args.clientKind !== 'mobile' ||
+    args.structuredNativeChatEnabled !== true ||
+    clientCanRenderStructuredAgentSessionTab(tab, args.clientCapabilities)
+  ) {
+    return null
+  }
+  return tab.agent === 'claude'
+    ? CLAUDE_STRUCTURED_CHAT_DESKTOP_ONLY_TAB_TITLE
+    : STRUCTURED_CHAT_UPDATE_REQUIRED_TAB_TITLE
+}
+
 export function projectSessionTabAgentStatus<TPayload extends SessionTabsPayload>(
   payload: TPayload,
   clientKind: 'mobile' | 'runtime' | undefined,
@@ -23,9 +62,27 @@ export function projectSessionTabAgentStatus<TPayload extends SessionTabsPayload
     clientCapabilities,
     structuredNativeChatEnabled
   })
-  let projected = structuredVisible ? payload : projectAgentSessionTabsOut(payload, () => true)
-  if (structuredVisible && clientKind !== undefined) {
-    projected = projectAgentSessionTabsOut(projected, (tab) => tab.agent !== 'codex')
+  let projected: TPayload
+  if (clientKind === 'mobile' && structuredNativeChatEnabled === true) {
+    // Why: deleting the row left the user hunting for a chat the desktop says exists; the row
+    // survives with a title naming the fix. Nothing is removed, so no group/layout repair applies.
+    projected = projectUnsupportedAgentSessionTabTitles(payload, {
+      clientKind,
+      clientCapabilities,
+      structuredNativeChatEnabled
+    })
+  } else {
+    projected = structuredVisible ? payload : projectAgentSessionTabsOut(payload, () => true)
+    // Why: a paired client renders only codex structured tabs unless it says otherwise
+    // (mobile's resolveMobileNativeChat returns null for every other agent), so an
+    // ungated row would list and select into a pane that shows neither chat nor terminal.
+    if (
+      structuredVisible &&
+      clientKind !== undefined &&
+      !clientCapabilities?.includes(CLAUDE_STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY)
+    ) {
+      projected = projectAgentSessionTabsOut(projected, (tab) => tab.agent !== 'codex')
+    }
   }
   // Why: only paired runtimes have legacy `done` completion side effects; mobile must keep its row without changing the exact v2 auth shape.
   if (
@@ -47,6 +104,47 @@ export function projectSessionTabAgentStatus<TPayload extends SessionTabsPayload
   return changed ? ({ ...projected, tabs } as TPayload) : projected
 }
 
+function projectUnsupportedAgentSessionTabTitles<TPayload extends SessionTabsPayload>(
+  payload: TPayload,
+  args: {
+    clientKind: 'mobile'
+    clientCapabilities: readonly RuntimeCapability[] | undefined
+    structuredNativeChatEnabled: true
+  }
+): TPayload {
+  let changed = false
+  const tabs = payload.tabs.map((tab) => {
+    if (tab.type !== 'agent-session') {
+      return tab
+    }
+    const title = resolveMobileStructuredChatFallbackTitle(tab, args)
+    if (title === null) {
+      return tab
+    }
+    changed = true
+    return { ...tab, title }
+  })
+  return changed ? ({ ...payload, tabs } as TPayload) : payload
+}
+
+export function assertAgentSessionTabDestructiveMutationSupported(
+  payload: SessionTabsPayload,
+  tabId: string,
+  clientKind: 'mobile' | 'runtime' | undefined,
+  clientCapabilities: readonly RuntimeCapability[] | undefined
+): void {
+  if (clientKind === undefined) {
+    return
+  }
+  const tab = payload.tabs.find((candidate) => candidate.id === tabId)
+  if (
+    tab?.type === 'agent-session' &&
+    !clientCanRenderStructuredAgentSessionTab(tab, clientCapabilities)
+  ) {
+    throw new Error('structured_agent_session_unsupported')
+  }
+}
+
 function projectAgentSessionTabsOut<TPayload extends SessionTabsPayload>(
   payload: TPayload,
   shouldHide: (tab: RuntimeMobileSessionAgentTab) => boolean
diff --git a/src/main/runtime/rpc/methods/session-tab-close-methods.ts b/src/main/runtime/rpc/methods/session-tab-close-methods.ts
index bd60ecd6ddf..361ba8e4c51 100644
--- a/src/main/runtime/rpc/methods/session-tab-close-methods.ts
+++ b/src/main/runtime/rpc/methods/session-tab-close-methods.ts
@@ -3,6 +3,7 @@ import { SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY } from '../../../../shared/
 import { defineMethod, type RpcAnyMethod } from '../core'
 import { CloseLifecycleTab, CloseTab } from './session-tabs-schemas'
 import { assertProjectedSessionTabVisible } from './session-tab-browser-placement-projection'
+import { assertAgentSessionTabDestructiveMutationSupported } from './session-tab-agent-status-projection'
 import { projectSessionTabsForClient } from './session-tabs-inventory'
 import { isStructuredNativeChatEnabled } from './structured-agent-session-policy'
 
@@ -12,8 +13,12 @@ export const SESSION_TAB_CLOSE_METHODS: RpcAnyMethod[] = [
     params: CloseTab,
     handler: async (params, context) => {
       if (context.clientKind) {
+        const raw = await context.runtime.listMobileSessionTabs(
+          params.worktree,
+          context.pairedDeviceId
+        )
         const visible = projectSessionTabsForClient(
-          await context.runtime.listMobileSessionTabs(params.worktree, context.pairedDeviceId),
+          raw,
           context.clientKind,
           context.clientCapabilities,
           context.clientKind === 'mobile'
@@ -21,6 +26,12 @@ export const SESSION_TAB_CLOSE_METHODS: RpcAnyMethod[] = [
             : undefined
         )
         assertProjectedSessionTabVisible(visible, params.tabId)
+        assertAgentSessionTabDestructiveMutationSupported(
+          raw,
+          params.tabId,
+          context.clientKind,
+          context.clientCapabilities
+        )
       }
       const requiresIntent =
         context.clientKind === undefined ||
@@ -81,8 +92,12 @@ export const SESSION_TAB_CLOSE_METHODS: RpcAnyMethod[] = [
     params: CloseLifecycleTab,
     handler: async (params, context) => {
       if (context.clientKind) {
+        const raw = await context.runtime.listMobileSessionTabs(
+          params.worktree,
+          context.pairedDeviceId
+        )
         const visible = projectSessionTabsForClient(
-          await context.runtime.listMobileSessionTabs(params.worktree, context.pairedDeviceId),
+          raw,
           context.clientKind,
           context.clientCapabilities,
           context.clientKind === 'mobile'
@@ -90,6 +105,12 @@ export const SESSION_TAB_CLOSE_METHODS: RpcAnyMethod[] = [
             : undefined
         )
         assertProjectedSessionTabVisible(visible, params.tabId)
+        assertAgentSessionTabDestructiveMutationSupported(
+          raw,
+          params.tabId,
+          context.clientKind,
+          context.clientCapabilities
+        )
       }
       return withSpan(
         'runtime.session-tabs.close-lifecycle',
diff --git a/src/main/runtime/rpc/methods/session-tabs-structured-restore.test.ts b/src/main/runtime/rpc/methods/session-tabs-structured-restore.test.ts
new file mode 100644
index 00000000000..083f334285e
--- /dev/null
+++ b/src/main/runtime/rpc/methods/session-tabs-structured-restore.test.ts
@@ -0,0 +1,98 @@
+import { describe, expect, it, vi } from 'vitest'
+import { RpcDispatcher } from '../dispatcher'
+import type { RpcRequest } from '../core'
+import type { OrcaRuntimeService } from '../../orca-runtime'
+import { STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY } from '../../../../shared/protocol-version'
+import { SESSION_TAB_METHODS } from './session-tabs'
+
+function makeRequest(method: string, params?: unknown): RpcRequest {
+  return { id: 'req-1', authToken: 'tok', method, params }
+}
+
+describe('session tab structured restore gating', () => {
+  it('does not restore structured tabs for mobile while the host setting is off', async () => {
+    const runtime = {
+      getRuntimeId: () => 'test-runtime',
+      getClientSettings: vi.fn(() => ({ experimentalStructuredNativeChat: false })),
+      restoreStructuredAgentSessionTabs: vi.fn(),
+      listMobileSessionTabs: vi.fn().mockResolvedValue(visibleSnapshot())
+    } as unknown as OrcaRuntimeService
+    const dispatcher = new RpcDispatcher({ runtime, methods: SESSION_TAB_METHODS })
+
+    const response = await dispatcher.dispatch(
+      makeRequest('session.tabs.list', { worktree: 'id:wt-1' }),
+      {
+        clientKind: 'mobile',
+        clientCapabilities: [STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY]
+      }
+    )
+
+    expect(response.ok).toBe(true)
+    expect(runtime.restoreStructuredAgentSessionTabs).not.toHaveBeenCalled()
+  })
+
+  // Why: an old build has no capability to advertise, and skipping the restore left it with
+  // nothing to project after a desktop restart — neither the chat nor its fallback row.
+  it('restores structured tabs for a mobile client that advertises no capability', async () => {
+    const runtime = {
+      getRuntimeId: () => 'test-runtime',
+      getClientSettings: vi.fn(() => ({ experimentalStructuredNativeChat: true })),
+      restoreStructuredAgentSessionTabs: vi.fn(),
+      listMobileSessionTabs: vi.fn().mockResolvedValue(visibleSnapshot())
+    } as unknown as OrcaRuntimeService
+    const dispatcher = new RpcDispatcher({ runtime, methods: SESSION_TAB_METHODS })
+
+    const response = await dispatcher.dispatch(
+      makeRequest('session.tabs.list', { worktree: 'id:wt-1' }),
+      { clientKind: 'mobile', clientCapabilities: [] }
+    )
+
+    expect(response.ok).toBe(true)
+    expect(runtime.restoreStructuredAgentSessionTabs).toHaveBeenCalledTimes(1)
+  })
+
+  it('restores structured tabs for mobile once the setting is present', async () => {
+    const runtime = {
+      getRuntimeId: () => 'test-runtime',
+      getClientSettings: vi.fn(() => ({ experimentalStructuredNativeChat: true })),
+      restoreStructuredAgentSessionTabs: vi.fn(),
+      listMobileSessionTabs: vi.fn().mockResolvedValue(visibleSnapshot())
+    } as unknown as OrcaRuntimeService
+    const dispatcher = new RpcDispatcher({ runtime, methods: SESSION_TAB_METHODS })
+
+    const response = await dispatcher.dispatch(
+      makeRequest('session.tabs.list', { worktree: 'id:wt-1' }),
+      {
+        clientKind: 'mobile',
+        clientCapabilities: [STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY]
+      }
+    )
+
+    expect(response.ok).toBe(true)
+    expect(runtime.restoreStructuredAgentSessionTabs).toHaveBeenCalledTimes(1)
+  })
+})
+
+function visibleSnapshot() {
+  return {
+    worktree: 'wt-1',
+    publicationEpoch: 'epoch-1',
+    snapshotVersion: 1,
+    activeGroupId: 'group-1',
+    activeTabId: 'tab-1::leaf-1',
+    activeTabType: 'terminal' as const,
+    tabGroups: [{ id: 'group-1', activeTabId: 'tab-1', tabOrder: ['tab-1'] }],
+    tabs: [
+      {
+        type: 'terminal' as const,
+        id: 'tab-1::leaf-1',
+        parentTabId: 'tab-1',
+        leafId: 'leaf-1',
+        title: 'Terminal',
+        status: 'ready' as const,
+        terminal: 'pty-1',
+        isActive: true
+      }
+    ]
+  }
+}
diff --git a/src/main/runtime/rpc/methods/session-tabs.test.ts b/src/main/runtime/rpc/methods/session-tabs.test.ts
index 29131869fa0..be61fc55edf 100644
--- a/src/main/runtime/rpc/methods/session-tabs.test.ts
+++ b/src/main/runtime/rpc/methods/session-tabs.test.ts
@@ -2,10 +2,7 @@ import { describe, expect, it, vi } from 'vitest'
 import { RpcDispatcher } from '../dispatcher'
 import type { RpcRequest } from '../core'
 import type { OrcaRuntimeService } from '../../orca-runtime'
-import {
-  SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY,
-  STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY
-} from '../../../../shared/protocol-version'
+import { SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY } from '../../../../shared/protocol-version'
 import { SESSION_TAB_METHODS } from './session-tabs'
 
 function makeRequest(method: string, params?: unknown): RpcRequest {
@@ -13,48 +10,6 @@ function makeRequest(method: string, params?: unknown): RpcRequest {
 }
 
 describe('session tab RPC methods', () => {
-  it('does not restore structured tabs for mobile while the host setting is off', async () => {
-    const runtime = {
-      getRuntimeId: () => 'test-runtime',
-      getClientSettings: vi.fn(() => ({ experimentalStructuredNativeChat: false })),
-      restoreStructuredAgentSessionTabs: vi.fn(),
-      listMobileSessionTabs: vi.fn().mockResolvedValue(visibleSnapshot())
-    } as unknown as OrcaRuntimeService
-    const dispatcher = new RpcDispatcher({ runtime, methods: SESSION_TAB_METHODS })
-
-    const response = await dispatcher.dispatch(
-      makeRequest('session.tabs.list', { worktree: 'id:wt-1' }),
-      {
-        clientKind: 'mobile',
-        clientCapabilities: [STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY]
-      }
-    )
-
-    expect(response.ok).toBe(true)
-    expect(runtime.restoreStructuredAgentSessionTabs).not.toHaveBeenCalled()
-  })
-
-  it('restores structured tabs for mobile only after capability and setting are present', async () => {
-    const runtime = {
-      getRuntimeId: () => 'test-runtime',
-      getClientSettings: vi.fn(() => ({ experimentalStructuredNativeChat: true })),
-      restoreStructuredAgentSessionTabs: vi.fn(),
-      listMobileSessionTabs: vi.fn().mockResolvedValue(visibleSnapshot())
-    } as unknown as OrcaRuntimeService
-    const dispatcher = new RpcDispatcher({ runtime, methods: SESSION_TAB_METHODS })
-
-    const response = await dispatcher.dispatch(
-      makeRequest('session.tabs.list', { worktree: 'id:wt-1' }),
-      {
-        clientKind: 'mobile',
-        clientCapabilities: [STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY]
-      }
-    )
-
-    expect(response.ok).toBe(true)
-    expect(runtime.restoreStructuredAgentSessionTabs).toHaveBeenCalledTimes(1)
-  })
-
   it('routes mobile-only activation without notifying desktop clients', async () => {
     const runtime = {
       getRuntimeId: () => 'test-runtime',
diff --git a/src/main/runtime/rpc/methods/ssh.test.ts b/src/main/runtime/rpc/methods/ssh.test.ts
index 450375e48f8..04293d3cca4 100644
--- a/src/main/runtime/rpc/methods/ssh.test.ts
+++ b/src/main/runtime/rpc/methods/ssh.test.ts
@@ -116,6 +116,34 @@ describe('ssh RPC methods', () => {
       }
     ]
     listRegisteredSshTargetsMock.mockReturnValueOnce(targets)
+    getRegisteredSshStateMock.mockReturnValueOnce({ status: 'connected', remotePlatform: 'win32' })
+    const runtime = { getRuntimeId: () => 'test-runtime' } as unknown as OrcaRuntimeService
+    const dispatcher = new RpcDispatcher({ runtime, methods: SSH_METHODS })
+
+    const response = await dispatcher.dispatch(makeRequest('ssh.listTargetSummaries'))
+
+    expect(response).toMatchObject({
+      ok: true,
+      result: {
+        targets: [
+          {
+            id: 'ssh-1',
+            label: 'Dev box',
+            connected: true,
+            connectionStatus: 'connected',
+            remotePlatform: 'win32'
+          }
+        ]
+      }
+    })
+    expect(JSON.stringify(response)).not.toContain('dev.internal')
+    expect(JSON.stringify(response)).not.toContain('/secret/key')
+    expect(JSON.stringify(response)).not.toContain('bastion')
+  })
+
+  it('does not invent a platform before the SSH host has been detected', async () => {
+    listRegisteredSshTargetsMock.mockReturnValueOnce([{ id: 'ssh-1', label: 'Dev box' }])
+    getRegisteredSshStateMock.mockReturnValueOnce(undefined)
     const runtime = { getRuntimeId: () => 'test-runtime' } as unknown as OrcaRuntimeService
     const dispatcher = new RpcDispatcher({ runtime, methods: SSH_METHODS })
 
@@ -125,9 +153,23 @@ describe('ssh RPC methods', () => {
       ok: true,
       result: { targets: [{ id: 'ssh-1', label: 'Dev box' }] }
     })
-    expect(JSON.stringify(response)).not.toContain('dev.internal')
-    expect(JSON.stringify(response)).not.toContain('/secret/key')
-    expect(JSON.stringify(response)).not.toContain('bastion')
+    expect(JSON.stringify(response)).not.toContain('remotePlatform')
+  })
+
+  it('reports disconnected lifecycle states without calling them connected', async () => {
+    listRegisteredSshTargetsMock.mockReturnValueOnce([{ id: 'ssh-1', label: 'Dev box' }])
+    getRegisteredSshStateMock.mockReturnValueOnce({ status: 'reconnecting' })
+    const runtime = { getRuntimeId: () => 'test-runtime' } as unknown as OrcaRuntimeService
+    const dispatcher = new RpcDispatcher({ runtime, methods: SSH_METHODS })
+
+    const response = await dispatcher.dispatch(makeRequest('ssh.listTargetSummaries'))
+
+    expect(response).toMatchObject({
+      ok: true,
+      result: {
+        targets: [{ id: 'ssh-1', connected: false, connectionStatus: 'reconnecting' }]
+      }
+    })
   })
 
   it('redacts the legacy target response for older clients', async () => {
diff --git a/src/main/runtime/rpc/methods/ssh.ts b/src/main/runtime/rpc/methods/ssh.ts
index 2e0a4e4f4ab..e6cb6b47b50 100644
--- a/src/main/runtime/rpc/methods/ssh.ts
+++ b/src/main/runtime/rpc/methods/ssh.ts
@@ -15,11 +15,18 @@ const SshTarget = z.object({
 
 // Why: `generation` stays optional on the wire — an old server simply omits it and its rows key on target id alone.
 function listRegisteredSshTargetSummaries(): SshTargetSummary[] {
-  return listRegisteredSshTargets().map(({ id, label, generation }) => ({
-    id,
-    label,
-    ...(generation === undefined ? {} : { generation })
-  }))
+  return listRegisteredSshTargets().map(({ id, label, generation }) => {
+    const state = getRegisteredSshState(id)
+    const remotePlatform = state?.remotePlatform
+    return {
+      id,
+      label,
+      ...(generation === undefined ? {} : { generation }),
+      connected: state?.status === 'connected',
+      ...(state?.status === undefined ? {} : { connectionStatus: state.status }),
+      ...(remotePlatform === undefined ? {} : { remotePlatform })
+    }
+  })
 }
 
 export const SSH_METHODS: RpcMethod[] = [
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-gate.ts b/src/main/runtime/rpc/methods/structured-agent-session-gate.ts
index 33018c21f4d..d918614ed47 100644
--- a/src/main/runtime/rpc/methods/structured-agent-session-gate.ts
+++ b/src/main/runtime/rpc/methods/structured-agent-session-gate.ts
@@ -2,8 +2,11 @@
 //
 // Shared by every structured method file so one gate governs the whole surface: a client that does
 // not advertise `agent-session.structured.v1` is told the surface does not exist rather than being
-// handed a session it cannot render or drive — and, just as importantly, cannot make the host EXIST
-// by calling into it, which is an observable side effect.
+// handed the session journal or mutation surface.
+//
+// This gate no longer implies such a client cannot make the host exist: session-tab restore runs
+// for old mobile clients while structured chat is enabled so they receive a fallback row, and that
+// path constructs the host. `agentSession.*` stays refused either way, which is what this gate is for.
 
 import { getStructuredAgentSessionHost } from '../../../native-chat/agent-session-wire/structured-agent-session-registry'
 import type { StructuredAgentSessionHost } from '../../../native-chat/agent-session-wire/structured-agent-session-host'
@@ -34,9 +37,10 @@ export function requireStructuredHost(ctx: RpcContext): StructuredAgentSessionHo
   return host
 }
 
-/** Attach is the only way a session comes into being, so it is the only call
- *  that builds the host. Every other method addresses a session that must
- *  already be attached, and correctly reports absent when none is. */
+/** Builds the host for the calls that address a session by durable record rather than by live
+ *  state: attach, which is the only way a session comes into being, plus hold and reveal, which
+ *  each reach for a record on disk this process may not have opened yet. Every other method
+ *  addresses a session that must already be attached, and correctly reports absent when none is. */
 export async function ensureStructuredHostInstalled(ctx: RpcContext): Promise<void> {
   // Gated first: a client that cannot read structured sessions must not be able
   // to make the host exist, which is an observable side effect of the surface.
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-precommit-refusal.test.ts b/src/main/runtime/rpc/methods/structured-agent-session-precommit-refusal.test.ts
new file mode 100644
index 00000000000..1a62045c85b
--- /dev/null
+++ b/src/main/runtime/rpc/methods/structured-agent-session-precommit-refusal.test.ts
@@ -0,0 +1,239 @@
+// The create route's pre-commit boundary: a failure before `attach` must reach the client as a
+// refusal it can classify, and a failure at or after `attach` must not.
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { StructuredAgentSessionHost } from '../../../native-chat/agent-session-wire/structured-agent-session-host'
+import { setStructuredAgentSessionHost } from '../../../native-chat/agent-session-wire/structured-agent-session-registry'
+import { computeAgentSessionPayloadFingerprint } from '../../../../shared/agent-session-mutation-envelope'
+import { isDefinitiveAgentSessionCreateRefusal } from '../../../../shared/agent-session-definitive-refusal'
+import { STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY } from '../../../../shared/protocol-version'
+import type { OrcaRuntimeService } from '../../orca-runtime'
+import type { RpcResponse } from '../core'
+import { RpcDispatcher } from '../dispatcher'
+import { STRUCTURED_AGENT_SESSION_METHODS } from './structured-agent-session'
+
+const SESSION = 'session-alpha'
+const OPERATION = '1800000000000-00000000000000000000000000000001'
+const WORKTREE = 'id:workspace-1'
+
+const STRUCTURED_CLIENT = {
+  clientKind: 'runtime' as const,
+  clientCapabilities: [STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY]
+}
+
+function createParams(overrides: Record<string, unknown> = {}) {
+  return {
+    envelope: {
+      sessionId: SESSION,
+      clientOperationId: OPERATION,
+      expectedRuntimeFence: null,
+      payloadFingerprint: computeAgentSessionPayloadFingerprint({
+        method: 'agentSession.create',
+        sessionId: SESSION,
+        fields: { worktree: WORKTREE, agent: 'codex' }
+      }),
+      ...(overrides.envelope as Record<string, unknown> | undefined)
+    },
+    worktree: WORKTREE,
+    agent: 'codex'
+  }
+}
+
+let attach: ReturnType<typeof vi.fn>
+
+function hostStub(): StructuredAgentSessionHost {
+  attach = vi.fn(async () => ({
+    ok: true,
+    replayed: false,
+    fence: 1,
+    cursor: { epoch: 'epoch-a', sequence: 0 },
+    value: { sessionId: SESSION, fence: 1, page: {}, unconfirmedClientMessageIds: [] }
+  }))
+  return { attach } as unknown as StructuredAgentSessionHost
+}
+
+const resolvedIntent = {
+  location: {
+    executionHostId: 'local',
+    wslDistro: null,
+    workspaceId: 'workspace-1',
+    workspaceKind: 'git-worktree'
+  },
+  provider: 'codex',
+  agent: 'codex',
+  accountHome: { variable: 'CODEX_HOME', path: '/host/.codex' },
+  runtimeKind: 'native'
+}
+
+async function create(
+  runtimeOverrides: Record<string, unknown> = {},
+  params: unknown = createParams()
+): Promise<RpcResponse> {
+  const runtime = {
+    getRuntimeId: () => 'runtime-1',
+    registerSubscriptionCleanup: vi.fn(),
+    cleanupSubscription: vi.fn(),
+    cleanupSubscriptionsByPrefix: vi.fn(),
+    ensureStructuredAgentSessionHost: vi.fn(async () => undefined),
+    resolveStructuredAgentSessionCreateIntent: vi.fn(async (input: { envelope: unknown }) => ({
+      envelope: input.envelope,
+      ...resolvedIntent
+    })),
+    publishStructuredAgentSessionTab: vi.fn(async () => undefined),
+    ...runtimeOverrides
+  }
+  const replies: RpcResponse[] = []
+  await new RpcDispatcher({
+    runtime: runtime as unknown as OrcaRuntimeService,
+    methods: STRUCTURED_AGENT_SESSION_METHODS
+  }).dispatchStreaming(
+    { id: 'request-1', authToken: 'token', method: 'agentSession.create', params },
+    (raw) => replies.push(JSON.parse(raw) as RpcResponse),
+    STRUCTURED_CLIENT
+  )
+  const first = replies[0]
+  if (!first) {
+    throw new Error('no reply for agentSession.create')
+  }
+  return first
+}
+
+/** The refusal a client can act on, or null when the reply was not one. */
+function refusalOf(response: RpcResponse): { code: string; message: string } | null {
+  if (!response.ok) {
+    return null
+  }
+  const result = response.result as { ok: boolean; refusal?: { code: string; message: string } }
+  return result.ok ? null : (result.refusal ?? null)
+}
+
+beforeEach(() => {
+  setStructuredAgentSessionHost(hostStub())
+  vi.spyOn(console, 'warn').mockImplementation(() => undefined)
+})
+
+afterEach(() => {
+  setStructuredAgentSessionHost(null)
+  vi.restoreAllMocks()
+})
+
+describe('a create refused before it commits', () => {
+  it('answers a code-carrying refusal as a definitive envelope', async () => {
+    const response = await create({
+      resolveStructuredAgentSessionCreateIntent: vi.fn(async () => {
+        throw new Error('structured_agent_session_unsupported')
+      })
+    })
+
+    const refusal = refusalOf(response)
+    expect(refusal?.code).toBe('structured_agent_session_unsupported')
+    expect(refusal?.message).toContain('structured agent chat')
+    expect(refusal?.message).not.toContain('Codex')
+    expect(isDefinitiveAgentSessionCreateRefusal(refusal?.code)).toBe(true)
+    expect(attach).not.toHaveBeenCalled()
+  })
+
+  it('answers a code-less failure as a definitive envelope too, keeping the cause in the message', async () => {
+    // The class no per-site conversion catches: an unresolvable worktree throws prose, not a code.
+    const response = await create({
+      resolveStructuredAgentSessionCreateIntent: vi.fn(async () => {
+        throw new Error('No worktree matches id:workspace-1')
+      })
+    })
+
+    const refusal = refusalOf(response)
+    expect(isDefinitiveAgentSessionCreateRefusal(refusal?.code)).toBe(true)
+    expect(refusal?.message).toContain('structured agent chat')
+    expect(refusal?.message).not.toContain('Codex')
+    expect(refusal?.message).toContain('No worktree matches id:workspace-1')
+    expect(attach).not.toHaveBeenCalled()
+  })
+
+  it('answers a host that will not install as a definitive envelope', async () => {
+    setStructuredAgentSessionHost(null)
+
+    const response = await create({
+      ensureStructuredAgentSessionHost: vi.fn(async () => {
+        throw new Error('EACCES: could not open the session store')
+      })
+    })
+
+    const refusal = refusalOf(response)
+    expect(isDefinitiveAgentSessionCreateRefusal(refusal?.code)).toBe(true)
+    expect(refusal?.message).toContain('could not open the session store')
+  })
+
+  it('answers a missing host as a definitive envelope rather than a thrown code', async () => {
+    setStructuredAgentSessionHost(null)
+
+    const response = await create()
+
+    const refusal = refusalOf(response)
+    expect(refusal?.code).toBe('structured_agent_session_unsupported')
+    expect(isDefinitiveAgentSessionCreateRefusal(refusal?.code)).toBe(true)
+  })
+
+  it('still refuses a fingerprint conflict with its own code, not a pre-commit one', async () => {
+    const response = await create(
+      {},
+      createParams({ envelope: { payloadFingerprint: 'a'.repeat(64) } })
+    )
+
+    expect(refusalOf(response)?.code).toBe('agent_session_operation_conflict')
+    expect(attach).not.toHaveBeenCalled()
+  })
+})
+
+describe('the boundary the envelope stops at', () => {
+  it('leaves a failure at attach unknown, because it may have committed', async () => {
+    attach.mockRejectedValueOnce(new Error('attach exploded'))
+
+    const response = await create()
+
+    expect(response).toMatchObject({ ok: false, error: { code: 'runtime_error' } })
+    expect(refusalOf(response)).toBeNull()
+  })
+
+  it('leaves a committed create whose tab could not be published unknown', async () => {
+    const response = await create({
+      publishStructuredAgentSessionTab: vi.fn(async () => {
+        throw new Error('publish failed')
+      })
+    })
+
+    const refusal = refusalOf(response)
+    expect(refusal?.code).toBe('agent_session_operation_unknown')
+    expect(isDefinitiveAgentSessionCreateRefusal(refusal?.code)).toBe(false)
+  })
+
+  it('keeps hiding the surface from a client that never advertised it', async () => {
+    const replies: RpcResponse[] = []
+    await new RpcDispatcher({
+      runtime: { getRuntimeId: () => 'runtime-1' } as unknown as OrcaRuntimeService,
+      methods: STRUCTURED_AGENT_SESSION_METHODS
+    }).dispatchStreaming(
+      {
+        id: 'request-1',
+        authToken: 'token',
+        method: 'agentSession.create',
+        params: createParams()
+      },
+      (raw) => replies.push(JSON.parse(raw) as RpcResponse),
+      { clientKind: 'runtime', clientCapabilities: [] }
+    )
+
+    expect(replies[0]).toMatchObject({
+      ok: false,
+      error: { message: expect.stringContaining('structured_agent_session_unsupported') }
+    })
+  })
+
+  it('keeps a client-declared fence a programming error, not a refusal', async () => {
+    const response = await create({}, createParams({ envelope: { expectedRuntimeFence: 1 } }))
+
+    expect(response).toMatchObject({
+      ok: false,
+      error: { code: 'agent_session_operation_invalid' }
+    })
+  })
+})
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-precommit-refusal.ts b/src/main/runtime/rpc/methods/structured-agent-session-precommit-refusal.ts
new file mode 100644
index 00000000000..24d9fa2aec4
--- /dev/null
+++ b/src/main/runtime/rpc/methods/structured-agent-session-precommit-refusal.ts
@@ -0,0 +1,71 @@
+// Nothing before `attach` commits a session, so every failure in that span definitively created
+// nothing. Thrown, it reaches a remote client as a generic transport error, indistinguishable from
+// an answer that was lost on the way back — and a client that cannot tell those apart either
+// strands the user with no chat and no terminal, or spawns a sibling beside a session that may
+// already exist. So the whole span answers with a refusal envelope carrying a code, whatever it
+// failed on.
+//
+// Converting the span rather than each throw site is deliberate: alongside the throws that carry a
+// code there is a code-less class — an unresolvable worktree, a store that will not open, a host
+// that will not install — that no per-site list catches, and it is exactly the class that reaches
+// the user as nothing at all.
+
+import {
+  AGENT_SESSION_WIRE_REFUSAL_CODES,
+  type AgentSessionWireRefusal,
+  type AgentSessionWireRefusalCode
+} from '../../../../shared/agent-session-wire'
+
+export type StructuredCreateRefused = { refusal: AgentSessionWireRefusal }
+
+/** A pre-commit failure with no code of its own still proves the host could not serve a structured
+ *  session for this request and did not create one, which is what `unsupported` says on the wire.
+ *  A new code would say it more precisely, but only to clients new enough to know it. */
+const UNCODED_PRECOMMIT_REFUSAL_CODE: AgentSessionWireRefusalCode =
+  'structured_agent_session_unsupported'
+
+function wireRefusalCode(error: unknown): AgentSessionWireRefusalCode | null {
+  const candidates = [
+    error instanceof Error && 'code' in error ? (error as { code: unknown }).code : undefined,
+    error instanceof Error ? error.message : String(error)
+  ]
+  for (const candidate of candidates) {
+    if (
+      typeof candidate === 'string' &&
+      (AGENT_SESSION_WIRE_REFUSAL_CODES as readonly string[]).includes(candidate)
+    ) {
+      return candidate as AgentSessionWireRefusalCode
+    }
+  }
+  return null
+}
+
+function precommitRefusal(error: unknown): AgentSessionWireRefusal {
+  const code = wireRefusalCode(error)
+  if (code) {
+    return { code, message: 'Orca cannot open a structured agent chat for this workspace.' }
+  }
+  const message = error instanceof Error ? error.message : String(error)
+  // A code-less failure here is often a defect, not a policy answer; the refusal keeps the user
+  // moving, the log keeps the cause findable.
+  console.warn('[agent-session] create refused before it committed anything', error)
+  return {
+    code: UNCODED_PRECOMMIT_REFUSAL_CODE,
+    message: `Orca could not prepare a structured agent chat for this workspace: ${message}`
+  }
+}
+
+/**
+ * Runs the pre-commit half of a create. Anything it throws becomes a refusal; a refusal it returns
+ * itself passes through. Must not wrap `attach` or anything after it — past that point a failure no
+ * longer proves the session does not exist.
+ */
+export async function resolveUncommittedStructuredCreate<TPrepared>(
+  prepare: () => Promise<TPrepared | StructuredCreateRefused>
+): Promise<TPrepared | StructuredCreateRefused> {
+  try {
+    return await prepare()
+  } catch (error) {
+    return { refusal: precommitRefusal(error) }
+  }
+}
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-reveal.ts b/src/main/runtime/rpc/methods/structured-agent-session-reveal.ts
new file mode 100644
index 00000000000..5f2ab0e8cac
--- /dev/null
+++ b/src/main/runtime/rpc/methods/structured-agent-session-reveal.ts
@@ -0,0 +1,57 @@
+// `agentSession.reveal` — republishing the tab for a chat that still exists on disk.
+//
+// A surface can hold nothing but a session id: an Agent Session History row names a chat this
+// process may never have published, because `close` keeps the record and the journal but not the
+// tab, and a client drops every unpublished `agent-session` tab on each session-tabs sync. Without
+// this the row is unreachable, and the client's "retry in a moment" is advice that never comes true.
+//
+// Distinct from `agentSession.ensure`, which attaches a location the CLIENT supplies. Here the host
+// reads its own record and answers with that record's workspace and provider, so a client knowing
+// only a session id cannot aim the publication somewhere else.
+
+import { isAgentSessionWireRefusalCode } from '../../../../shared/agent-session-wire'
+import type { StructuredAgentSessionReveal } from '../../../native-chat/agent-session-wire/structured-agent-session-host-types'
+import { refuseAgentSessionMutation } from '../../../native-chat/agent-session-wire/structured-agent-session-mutation-admission'
+import { defineMethod, type RpcAnyMethod } from '../core'
+import {
+  ensureStructuredHostInstalled,
+  requireStructuredCapability,
+  requireStructuredHost
+} from './structured-agent-session-gate'
+import { OptionsParams } from './structured-agent-session-schemas'
+
+export const STRUCTURED_AGENT_SESSION_REVEAL_METHODS: RpcAnyMethod[] = [
+  defineMethod({
+    name: 'agentSession.reveal',
+    params: OptionsParams,
+    handler: async (params, ctx) => {
+      requireStructuredCapability(ctx)
+      await ensureStructuredHostInstalled(ctx)
+      let revealed: StructuredAgentSessionReveal
+      try {
+        revealed = await requireStructuredHost(ctx).revealSession(params.sessionId)
+      } catch (error) {
+        // The host raises its refusal as the code itself; anything else is a genuine fault and
+        // must not be laundered into a tidy "no such chat".
+        const code = error instanceof Error ? error.message : ''
+        if (!isAgentSessionWireRefusalCode(code)) {
+          throw error
+        }
+        return refuseAgentSessionMutation({
+          code,
+          message:
+            code === 'structured_agent_session_unsupported'
+              ? 'This host cannot open that chat.'
+              : 'This chat is no longer on this host.'
+        })
+      }
+      await ctx.runtime.publishStructuredAgentSessionTab({
+        workspaceId: revealed.workspaceId,
+        sessionId: revealed.sessionId,
+        agent: revealed.agent,
+        activate: true
+      })
+      return { ok: true as const, ...revealed }
+    }
+  })
+]
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-schemas.ts b/src/main/runtime/rpc/methods/structured-agent-session-schemas.ts
index 6a9372ed2c1..58dece2256c 100644
--- a/src/main/runtime/rpc/methods/structured-agent-session-schemas.ts
+++ b/src/main/runtime/rpc/methods/structured-agent-session-schemas.ts
@@ -98,7 +98,7 @@ export const CreateIntentParams = z
   .object({
     envelope: MutationEnvelope,
     worktree: Identifier('Invalid worktree selector'),
-    agent: z.literal('codex')
+    agent: z.enum(['claude', 'codex'])
   })
   .strict()
 
@@ -107,7 +107,7 @@ export const CreateParams = z.union([AttachParams, CreateIntentParams])
 export const CreateSupportParams = z
   .object({
     worktree: Identifier('Invalid worktree selector'),
-    agent: z.literal('codex')
+    agent: z.enum(['claude', 'codex'])
   })
   .strict()
 
@@ -149,8 +149,16 @@ export const SendParams = z
   .strict()
 
 export const CancelParams = z
-  .object({ envelope: MutationEnvelope, turnId: Identifier('Invalid turn id') })
+  .object({
+    envelope: MutationEnvelope,
+    turnId: Identifier('Invalid turn id'),
+    scope: z.literal('background-tasks').optional(),
+    taskId: Identifier('Invalid task id').optional()
+  })
   .strict()
+  .refine((value) => value.taskId === undefined || value.scope === 'background-tasks', {
+    message: 'A task id requires background-task scope'
+  })
 
 export const RespondParams = z
   .object({
@@ -170,6 +178,15 @@ export const SetOptionParams = z
   })
   .strict()
 
+export const HandoffParams = z
+  .object({
+    envelope: MutationEnvelope,
+    direction: z.enum(['to-tui', 'to-native']),
+    mode: z.enum(['now', 'after-turn', 'stop-turn']),
+    action: z.enum(['start', 'cancel-queued', 'retry', 'recover']).optional()
+  })
+  .strict()
+
 export const OptionsParams = z.object({ sessionId: SessionId }).strict()
 
 /** One surface's claim on one session. The id names the surface, not the client: two chat views
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-status-stream.ts b/src/main/runtime/rpc/methods/structured-agent-session-status-stream.ts
new file mode 100644
index 00000000000..8637089c254
--- /dev/null
+++ b/src/main/runtime/rpc/methods/structured-agent-session-status-stream.ts
@@ -0,0 +1,62 @@
+// `agentSession.subscribeStatus` — every structured session's projected status on one stream.
+//
+// Session lists read turn state from here instead of replaying transcripts: one stream per client
+// covers every session, and unlike a transcript subscription it retains none of them.
+
+import { defineStreamingMethod, type RpcAnyMethod, type RpcContext } from '../core'
+import { requireStructuredHost as requireHost } from './structured-agent-session-gate'
+import { structuredAgentSessionStatusSubscriptionId } from './structured-agent-session-subscription-id'
+
+/** Ties a stream to both ends that can close it — the runtime's subscription registry and the
+ *  transport abort — so either one runs `onClose` exactly once. */
+export function bindStructuredAgentSessionStream(
+  ctx: RpcContext,
+  subscriptionId: string,
+  onClose: () => void
+): { isClosed: () => boolean } {
+  let closed = false
+  let releaseTransportSubscription = (): void => {}
+  const onTransportAbort = (): void => releaseTransportSubscription()
+  const cleanup = (): void => {
+    closed = true
+    ctx.signal?.removeEventListener('abort', onTransportAbort)
+    onClose()
+  }
+  let registration: { releaseIfCurrent: () => void }
+  if (typeof ctx.runtime.registerOwnedSubscriptionCleanup === 'function') {
+    registration = ctx.runtime.registerOwnedSubscriptionCleanup(
+      subscriptionId,
+      cleanup,
+      ctx.connectionId
+    )
+  } else {
+    ctx.runtime.registerSubscriptionCleanup(subscriptionId, cleanup, ctx.connectionId)
+    registration = { releaseIfCurrent: () => ctx.runtime.cleanupSubscription(subscriptionId) }
+  }
+  releaseTransportSubscription = registration.releaseIfCurrent
+  ctx.signal?.addEventListener('abort', onTransportAbort, { once: true })
+  if (ctx.signal?.aborted) {
+    onTransportAbort()
+  }
+  return { isClosed: () => closed }
+}
+
+export const STRUCTURED_AGENT_SESSION_STATUS_METHODS: RpcAnyMethod[] = [
+  defineStreamingMethod({
+    name: 'agentSession.subscribeStatus',
+    params: null,
+    handler: async (_params, ctx, emit) => {
+      const host = requireHost(ctx)
+      const subscriptionId = structuredAgentSessionStatusSubscriptionId(ctx)
+      let dispose = (): void => {}
+      const stream = bindStructuredAgentSessionStream(ctx, subscriptionId, () => dispose())
+      if (stream.isClosed()) {
+        return
+      }
+      dispose = host.subscribeStatus({ id: subscriptionId, emit })
+      if (stream.isClosed()) {
+        dispose()
+      }
+    }
+  })
+]
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-subscription-id.ts b/src/main/runtime/rpc/methods/structured-agent-session-subscription-id.ts
new file mode 100644
index 00000000000..f3d00232359
--- /dev/null
+++ b/src/main/runtime/rpc/methods/structured-agent-session-subscription-id.ts
@@ -0,0 +1,29 @@
+// Subscription ids for the streaming `agentSession.*` methods.
+//
+// Shared control multiplexes several streams over one socket, so the frame id keeps one
+// subscriber from evicting another. It is appended only when present: collapsing a missing
+// frame id to a constant is the collision the rule exists to prevent.
+
+import type { RpcContext } from '../core'
+
+const SUBSCRIPTION_PREFIX = 'agentSession'
+
+function withFrameId(ctx: RpcContext, base: string): string {
+  return ctx.requestId ? `${base}:${ctx.requestId}` : base
+}
+
+/** The id a session's streams share before the frame id. `unsubscribe` addresses this
+ *  directly and sweeps `${base}:` to reach every frame under it. */
+export function structuredAgentSessionSubscriptionBase(ctx: RpcContext, sessionId: string): string {
+  return `${SUBSCRIPTION_PREFIX}:${ctx.connectionId ?? 'local'}:${sessionId}`
+}
+
+/** One session's transcript stream. */
+export function structuredAgentSessionSubscriptionId(ctx: RpcContext, sessionId: string): string {
+  return withFrameId(ctx, structuredAgentSessionSubscriptionBase(ctx, sessionId))
+}
+
+/** The status feed, which is per connection rather than per session. */
+export function structuredAgentSessionStatusSubscriptionId(ctx: RpcContext): string {
+  return withFrameId(ctx, `${SUBSCRIPTION_PREFIX}.status:${ctx.connectionId ?? 'local'}`)
+}
diff --git a/src/main/runtime/rpc/methods/structured-agent-session.test.ts b/src/main/runtime/rpc/methods/structured-agent-session.test.ts
index b65e6eff825..4af7f165d0f 100644
--- a/src/main/runtime/rpc/methods/structured-agent-session.test.ts
+++ b/src/main/runtime/rpc/methods/structured-agent-session.test.ts
@@ -2,12 +2,19 @@
 // accepts once they can.
 
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { AgentJournalRenderItem } from '../../../../shared/agent-session-journal-types'
+import type { AgentSessionJournal } from '../../../native-chat/agent-session-journal/journal-store'
 import type { StructuredAgentSessionHost } from '../../../native-chat/agent-session-wire/structured-agent-session-host'
 import { setStructuredAgentSessionHost } from '../../../native-chat/agent-session-wire/structured-agent-session-registry'
+import {
+  StructuredAgentSessionStatusFeed,
+  type StructuredAgentSessionStatusSubscriber
+} from '../../../native-chat/agent-session-wire/structured-agent-session-status-feed'
 import {
   RUNTIME_CAPABILITIES,
   RUNTIME_PROTOCOL_VERSION,
   STRUCTURED_AGENT_SESSION_HOLD_RUNTIME_CAPABILITY,
+  STRUCTURED_AGENT_SESSION_REVEAL_RUNTIME_CAPABILITY,
   STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY
 } from '../../../../shared/protocol-version'
 import type { OrcaRuntimeService } from '../../orca-runtime'
@@ -64,6 +71,44 @@ function request(method: string, params: unknown): RpcRequest {
 let hostCalls: Record<string, ReturnType<typeof vi.fn>>
 let runtimeCalls: Record<string, ReturnType<typeof vi.fn>>
 
+const STATUS_SESSION = 'session-status'
+const STATUS_ITEMS: AgentJournalRenderItem[] = [
+  {
+    itemId: 'user-1',
+    sequence: 1,
+    revision: 1,
+    observedAt: 1,
+    body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'write a poem' }] }
+  },
+  {
+    itemId: 'turn-1',
+    sequence: 2,
+    revision: 1,
+    observedAt: 2,
+    body: { kind: 'status', text: 'Working', turnLifecycle: { turnId: 'turn-1', state: 'running' } }
+  }
+]
+
+/** One indexed session over a journal that reads back fixed items; the projection is real. */
+function statusFeed(): StructuredAgentSessionStatusFeed {
+  return new StructuredAgentSessionStatusFeed({
+    sessions: new Map([
+      [
+        STATUS_SESSION,
+        {
+          journal: {
+            isReadOnly: false,
+            snapshot: () => ({ items: STATUS_ITEMS })
+          } as unknown as AgentSessionJournal,
+          params: { location: { workspaceId: 'workspace-1' }, provider: 'codex' as const }
+        }
+      ]
+    ]),
+    getRecord: () => null,
+    now: () => 1_000
+  })
+}
+
 function hostStub(): StructuredAgentSessionHost {
   hostCalls = {
     attach: vi.fn(async () => ({
@@ -96,9 +141,31 @@ function hostStub(): StructuredAgentSessionHost {
     send: vi.fn(async () => ({ ok: true, replayed: false })),
     cancel: vi.fn(async () => ({ ok: true, replayed: false })),
     close: vi.fn(async () => undefined),
+    revealSession: vi.fn(async () => ({
+      sessionId: SESSION,
+      workspaceId: 'workspace-1',
+      agent: 'codex' as const,
+      readable: true
+    })),
     setSessionTabVisibility: vi.fn(async () => undefined),
     respondToPrompt: vi.fn(async () => ({ ok: true, replayed: false })),
     setOption: vi.fn(async () => ({ ok: true, replayed: false })),
+    requestHandoff: vi.fn(async () => ({
+      ok: true,
+      replayed: false,
+      fence: 1,
+      cursor: { epoch: 'epoch-a', sequence: 0 },
+      value: {
+        status: {
+          owner: 'native',
+          direction: null,
+          phase: 'idle',
+          stage: null,
+          operationId: null
+        }
+      }
+    })),
+    supportsCreate: vi.fn(() => true),
     handoffStatus: vi.fn(async () => ({ owner: 'native' })),
     readOptions: vi.fn(async () => ({
       models: [{ id: 'gpt-live', label: 'GPT Live', isDefault: true, efforts: [] }],
@@ -106,6 +173,11 @@ function hostStub(): StructuredAgentSessionHost {
     })),
     history: vi.fn(() => ({ ok: true, page: { items: [] } })),
     subscribe: vi.fn(() => () => undefined),
+    // A real feed, so the snapshot this method hands back is a genuine projection rather
+    // than a shape the stub restated.
+    subscribeStatus: vi.fn((subscriber: StructuredAgentSessionStatusSubscriber) =>
+      statusFeed().subscribe(subscriber)
+    ),
     unsubscribe: vi.fn()
   }
   return hostCalls as unknown as StructuredAgentSessionHost
@@ -122,9 +194,12 @@ function dispatcher(runtimeOverrides: Record<string, unknown> = {}): RpcDispatch
         workspaceId: 'workspace-1',
         workspaceKind: 'git-worktree'
       },
-      provider: 'codex',
-      agent: 'codex',
-      accountHome: { variable: 'CODEX_HOME', path: '/host/.codex' },
+      provider: params.agent,
+      agent: params.agent,
+      accountHome: {
+        variable: params.agent === 'claude' ? 'CLAUDE_CONFIG_DIR' : 'CODEX_HOME',
+        path: params.agent === 'claude' ? '/host/.claude' : '/host/.codex'
+      },
       runtimeKind: 'native'
     })),
     publishStructuredAgentSessionTab: vi.fn()
@@ -185,6 +260,92 @@ afterEach(() => {
   setStructuredAgentSessionHost(null)
 })
 
+describe('agentSession.reveal', () => {
+  it.each(['codex', 'claude'] as const)('republishes a persisted %s chat tab', async (agent) => {
+    hostCalls.revealSession.mockResolvedValueOnce({
+      sessionId: SESSION,
+      workspaceId: 'workspace-1',
+      agent,
+      readable: true
+    })
+
+    const response = await call('agentSession.reveal', { sessionId: SESSION }, STRUCTURED_CLIENT)
+
+    expect(hostCalls.revealSession).toHaveBeenCalledWith(SESSION)
+    expect(response).toMatchObject({ ok: true, result: { ok: true, agent } })
+    expect(runtimeCalls.publishStructuredAgentSessionTab).toHaveBeenCalledWith(
+      expect.objectContaining({ agent, activate: true })
+    )
+  })
+
+  it('publishes the workspace the host reported, not one the client could assert', async () => {
+    // The client sends only a session id, so a stale or forged one cannot aim the publish at
+    // another workspace.
+    hostCalls.revealSession.mockResolvedValueOnce({
+      sessionId: SESSION,
+      workspaceId: 'workspace-from-record',
+      agent: 'claude',
+      readable: true
+    })
+
+    await call('agentSession.reveal', { sessionId: SESSION }, STRUCTURED_CLIENT)
+
+    expect(runtimeCalls.publishStructuredAgentSessionTab).toHaveBeenCalledWith({
+      workspaceId: 'workspace-from-record',
+      sessionId: SESSION,
+      agent: 'claude',
+      activate: true
+    })
+  })
+
+  it('publishes the tab even when the journal could not be read', async () => {
+    // A pre-SQLite chat restores to nothing, but attach still recovers it, so the tab is worth
+    // publishing and the pane's hold finishes the job. Refusing here would strand it forever.
+    hostCalls.revealSession.mockResolvedValueOnce({
+      sessionId: SESSION,
+      workspaceId: 'workspace-1',
+      agent: 'codex',
+      readable: false
+    })
+
+    const response = await call('agentSession.reveal', { sessionId: SESSION }, STRUCTURED_CLIENT)
+
+    expect(response).toMatchObject({ ok: true, result: { ok: true, readable: false } })
+    expect(runtimeCalls.publishStructuredAgentSessionTab).toHaveBeenCalledOnce()
+  })
+
+  it('refuses rather than throws when the host holds no such record', async () => {
+    hostCalls.revealSession.mockRejectedValueOnce(new Error('agent_session_identity_required'))
+
+    const response = await call('agentSession.reveal', { sessionId: SESSION }, STRUCTURED_CLIENT)
+
+    expect(response).toMatchObject({
+      ok: true,
+      result: { ok: false, refusal: { code: 'agent_session_identity_required' } }
+    })
+    expect(runtimeCalls.publishStructuredAgentSessionTab).not.toHaveBeenCalled()
+  })
+
+  it('does not launder an unrelated fault into a refusal', async () => {
+    hostCalls.revealSession.mockRejectedValueOnce(new Error('EACCES: journal directory'))
+
+    const response = await call('agentSession.reveal', { sessionId: SESSION }, STRUCTURED_CLIENT)
+
+    expect(response).toMatchObject({ ok: false })
+  })
+
+  it('is refused for a client that cannot read structured sessions', async () => {
+    const response = await call(
+      'agentSession.reveal',
+      { sessionId: SESSION },
+      { clientKind: 'runtime', clientCapabilities: [] }
+    )
+
+    expect(response).toMatchObject({ ok: false })
+    expect(hostCalls.revealSession).not.toHaveBeenCalled()
+  })
+})
+
 describe('capability gating', () => {
   it('clears durable tab visibility when closing through the agent-session RPC', async () => {
     const response = await call('agentSession.close', { sessionId: SESSION }, STRUCTURED_CLIENT)
@@ -209,6 +370,7 @@ describe('capability gating', () => {
   it('advertises the capability without bumping the protocol version', () => {
     expect(RUNTIME_CAPABILITIES).toContain(STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY)
     expect(RUNTIME_CAPABILITIES).toContain(STRUCTURED_AGENT_SESSION_HOLD_RUNTIME_CAPABILITY)
+    expect(RUNTIME_CAPABILITIES).toContain(STRUCTURED_AGENT_SESSION_REVEAL_RUNTIME_CAPABILITY)
     // Additive methods do not break an old client; bumping would strand every
     // paired device that has not updated.
     expect(RUNTIME_PROTOCOL_VERSION).toBe(3)
@@ -221,7 +383,7 @@ describe('capability gating', () => {
     }
     // Bump deliberately: the whole agentSession.* surface is behind the structured capability,
     // so an additive method is invisible to old clients and needs no protocol bump.
-    expect(STRUCTURED_AGENT_SESSION_METHODS).toHaveLength(16)
+    expect(STRUCTURED_AGENT_SESSION_METHODS).toHaveLength(19)
   })
 
   it('hides the surface from a declared client that did not advertise it', async () => {
@@ -329,6 +491,49 @@ describe('method routing', () => {
     )
   })
 
+  it('routes Claude create support and create through the provider-aware runtime', async () => {
+    const worktree = 'id:workspace-1'
+    const support = await call(
+      'agentSession.createSupport',
+      { worktree, agent: 'claude' },
+      STRUCTURED_CLIENT
+    )
+    expect(support).toMatchObject({ ok: true, result: { supported: true } })
+    expect(runtimeCalls.getStructuredAgentSessionCreateSupport).toHaveBeenCalledWith(
+      worktree,
+      'claude'
+    )
+
+    const params = {
+      envelope: envelope({
+        expectedRuntimeFence: null,
+        payloadFingerprint: computeAgentSessionPayloadFingerprint({
+          method: 'agentSession.create',
+          sessionId: SESSION,
+          fields: { worktree, agent: 'claude' }
+        })
+      }),
+      worktree,
+      agent: 'claude'
+    }
+    const created = await call('agentSession.create', params, STRUCTURED_CLIENT)
+    expect(created).toMatchObject({ ok: true, result: { ok: true } })
+    expect(runtimeCalls.resolveStructuredAgentSessionCreateIntent).toHaveBeenCalledWith(params)
+    expect(hostCalls.attach).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({
+        accountHome: { variable: 'CLAUDE_CONFIG_DIR', path: '/host/.claude' }
+      })
+    )
+    expect(runtimeCalls.publishStructuredAgentSessionTab).toHaveBeenCalledWith(
+      expect.objectContaining({
+        sessionId: SESSION,
+        activate: true,
+        agent: 'claude'
+      })
+    )
+  })
+
   it('reports an unknown create outcome when attach commits before tab publication fails', async () => {
     const worktree = 'id:workspace-1'
     const params = {
@@ -371,6 +576,38 @@ describe('method routing', () => {
     expect(ensured).toMatchObject({ ok: true })
   })
 
+  /** A client-supplied location skips the worktree-resolving support check, so both attach-shaped
+   *  entries must ask the executing host directly or a host that cannot fence a provider child
+   *  would create one anyway. */
+  it('returns a refusal envelope when create cannot support a client-supplied location', async () => {
+    hostCalls.supportsCreate.mockReturnValue(false)
+
+    const refused = await call('agentSession.create', attachParams())
+
+    expect(refused).toMatchObject({
+      ok: true,
+      result: {
+        ok: false,
+        refusal: { code: 'structured_agent_session_unsupported' }
+      }
+    })
+    expect(hostCalls.attach).not.toHaveBeenCalled()
+    expect(hostCalls.supportsCreate).toHaveBeenCalledWith(attachParams().location, 'codex')
+  })
+
+  it('keeps ensure failures as top-level errors for an unsupported client location', async () => {
+    hostCalls.supportsCreate.mockReturnValue(false)
+
+    const refused = await call('agentSession.ensure', attachParams())
+
+    expect(refused).toMatchObject({
+      ok: false,
+      error: { message: expect.stringContaining('structured_agent_session_unsupported') }
+    })
+    expect(hostCalls.attach).not.toHaveBeenCalled()
+    expect(hostCalls.supportsCreate).toHaveBeenCalledWith(attachParams().location, 'codex')
+  })
+
   it('tags the prompt kind from the method name, not from the client', async () => {
     const params = {
       envelope: envelope(),
@@ -386,7 +623,21 @@ describe('method routing', () => {
     ])
   })
 
-  it('does not register the structured handoff mutation', async () => {
+  it('routes an optional background task id through cancellation', async () => {
+    const params = {
+      envelope: envelope(),
+      turnId: 'background-tasks',
+      scope: 'background-tasks' as const,
+      taskId: 'task-2'
+    }
+
+    const response = await call('agentSession.cancel', params, STRUCTURED_CLIENT)
+
+    expect(response).toMatchObject({ ok: true })
+    expect(hostCalls.cancel).toHaveBeenCalledWith(expect.anything(), params)
+  })
+
+  it('routes the structured handoff mutation through the host', async () => {
     const response = await call('agentSession.requestHandoff', {
       envelope: envelope(),
       direction: 'to-tui',
@@ -394,7 +645,11 @@ describe('method routing', () => {
       action: 'start'
     })
 
-    expect(response).toMatchObject({ ok: false, error: { code: 'method_not_found' } })
+    expect(response).toMatchObject({ ok: true })
+    expect(hostCalls.requestHandoff).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({ direction: 'to-tui', mode: 'now', action: 'start' })
+    )
   })
 })
 
@@ -412,6 +667,21 @@ describe('parameter validation', () => {
     })
   })
 
+  it('rejects invalid or unscoped background task ids', async () => {
+    await rejects('agentSession.cancel', {
+      envelope: envelope(),
+      turnId: 'background-tasks',
+      scope: 'background-tasks',
+      taskId: ' task-2'
+    })
+    await rejects('agentSession.cancel', {
+      envelope: envelope(),
+      turnId: 'turn-1',
+      taskId: 'task-2'
+    })
+    expect(hostCalls.cancel).not.toHaveBeenCalled()
+  })
+
   it('refuses to let a client author anything but a user turn', async () => {
     await rejects(
       'agentSession.send',
@@ -434,25 +704,6 @@ describe('parameter validation', () => {
     )
   })
 
-  it('rejects Claude structured create shapes', async () => {
-    await rejects('agentSession.createSupport', {
-      worktree: 'id:workspace-1',
-      agent: 'claude'
-    })
-    const fields = { worktree: 'id:workspace-1', agent: 'claude' }
-    await rejects('agentSession.create', {
-      envelope: envelope({
-        expectedRuntimeFence: null,
-        payloadFingerprint: computeAgentSessionPayloadFingerprint({
-          method: 'agentSession.create',
-          sessionId: SESSION,
-          fields
-        })
-      }),
-      ...fields
-    })
-  })
-
   it('requires a sha256 fingerprint and a positive fence', async () => {
     await rejects(
       'agentSession.send',
@@ -504,3 +755,31 @@ describe('parameter validation', () => {
     expect(response).toMatchObject({ ok: true })
   })
 })
+
+describe('agentSession.subscribeStatus', () => {
+  it('is invisible to a client without the structured capability', async () => {
+    const reply = await call('agentSession.subscribeStatus', null, { clientKind: 'runtime' })
+    expect(reply.ok).toBe(false)
+    expect(hostCalls.subscribeStatus).not.toHaveBeenCalled()
+  })
+
+  it('opens the host status feed with a projected snapshot as its first reply', async () => {
+    const reply = await call('agentSession.subscribeStatus', null, STRUCTURED_CLIENT)
+    expect(reply).toMatchObject({
+      ok: true,
+      result: {
+        type: 'snapshot',
+        sessions: [
+          {
+            sessionId: STATUS_SESSION,
+            workspaceId: 'workspace-1',
+            agent: 'codex',
+            status: 'working',
+            latestPrompt: 'write a poem'
+          }
+        ]
+      }
+    })
+    expect(hostCalls.subscribeStatus).toHaveBeenCalledOnce()
+  })
+})
diff --git a/src/main/runtime/rpc/methods/structured-agent-session.ts b/src/main/runtime/rpc/methods/structured-agent-session.ts
index ffd23499a3e..d524c2185df 100644
--- a/src/main/runtime/rpc/methods/structured-agent-session.ts
+++ b/src/main/runtime/rpc/methods/structured-agent-session.ts
@@ -2,14 +2,14 @@
 //
 // Every method here is gated on the client advertising
 // `agent-session.structured.v1`. A client that does not is told the surface does
-// not exist rather than being handed a session it cannot render or drive; that
-// is the whole visibility rule, because nothing else on the runtime publishes a
-// structured session.
+// not exist rather than receiving the journal or mutation surface. Session-tab
+// inventory may expose only a metadata placeholder for an incapable mobile client.
 
 import {
   agentSessionFingerprintConflict,
   computeAgentSessionPayloadFingerprint
 } from '../../../../shared/agent-session-mutation-envelope'
+import type { z } from 'zod'
 import { defineMethod, defineStreamingMethod, type RpcAnyMethod, type RpcContext } from '../core'
 import {
   ensureStructuredHostInstalled as ensureHostInstalled,
@@ -18,13 +18,25 @@ import {
   structuredCallerFor as callerFor,
   supportsStructuredSessions
 } from './structured-agent-session-gate'
+import type { AgentSessionAttachParams } from '../../../native-chat/agent-session-wire/structured-agent-session-attach'
 import { STRUCTURED_AGENT_SESSION_HOLD_METHODS } from './structured-agent-session-hold'
+import { STRUCTURED_AGENT_SESSION_REVEAL_METHODS } from './structured-agent-session-reveal'
+import { resolveUncommittedStructuredCreate } from './structured-agent-session-precommit-refusal'
+import {
+  bindStructuredAgentSessionStream,
+  STRUCTURED_AGENT_SESSION_STATUS_METHODS
+} from './structured-agent-session-status-stream'
+import {
+  structuredAgentSessionSubscriptionBase as subscriptionBaseFor,
+  structuredAgentSessionSubscriptionId as subscriptionIdFor
+} from './structured-agent-session-subscription-id'
 import {
   AttachParams,
   CancelParams,
   CreateParams,
   CreateSupportParams,
   HistoryParams,
+  HandoffParams,
   HandoffStatusParams,
   OptionsParams,
   RespondParams,
@@ -34,13 +46,33 @@ import {
   UnsubscribeParams
 } from './structured-agent-session-schemas'
 
-const SUBSCRIPTION_PREFIX = 'agentSession'
+/**
+ * The attach-shaped entries take the location from the client instead of resolving it from a
+ * worktree, so they never reach the worktree-resolving create-support check. Ask the executing
+ * host the same question directly: the answer includes host-measured facts the client cannot see
+ * or forge, such as whether this machine can read a provider child's process start time.
+ */
+async function resolveClientSuppliedAttach(params: z.infer<typeof AttachParams>, ctx: RpcContext) {
+  await ensureHostInstalled(ctx)
+  const host = requireHost(ctx)
+  if (!host.supportsCreate(params.location, params.agent)) {
+    throw new Error('structured_agent_session_unsupported')
+  }
+  const { agent: _attachAgent, provider: _attachProvider, ...attachWithoutAgent } = params
+  const attachParams = {
+    ...attachWithoutAgent,
+    provider: params.provider as 'claude' | 'codex',
+    agent: params.agent as 'claude' | 'codex'
+  } as AgentSessionAttachParams
+  return { host, attachParams }
+}
 
-function subscriptionIdFor(ctx: RpcContext, sessionId: string): string {
-  const base = `${SUBSCRIPTION_PREFIX}:${ctx.connectionId ?? 'local'}:${sessionId}`
-  // Shared control multiplexes several streams over one socket; the frame id
-  // keeps one subscriber from evicting another on the same session.
-  return ctx.requestId ? `${base}:${ctx.requestId}` : base
+async function attachClientSuppliedLocation(
+  params: z.infer<typeof AttachParams>,
+  ctx: RpcContext
+): Promise<unknown> {
+  const { host, attachParams } = await resolveClientSuppliedAttach(params, ctx)
+  return host.attach(callerFor(ctx), attachParams)
 }
 
 export const STRUCTURED_AGENT_SESSION_METHODS: RpcAnyMethod[] = [
@@ -62,66 +94,82 @@ export const STRUCTURED_AGENT_SESSION_METHODS: RpcAnyMethod[] = [
       if (params.envelope.expectedRuntimeFence !== null) {
         throw new Error('agent_session_operation_invalid')
       }
-      if ('worktree' in params) {
-        const intentFingerprint = computeAgentSessionPayloadFingerprint({
-          method: 'agentSession.create',
-          sessionId: params.envelope.sessionId,
-          fields: { worktree: params.worktree, agent: params.agent }
-        })
-        const conflict = agentSessionFingerprintConflict(params.envelope, intentFingerprint)
-        if (conflict) {
-          return { ok: false, refusal: conflict }
-        }
-        const resolved = await ctx.runtime.resolveStructuredAgentSessionCreateIntent(params)
-        const hostFingerprint = computeAgentSessionPayloadFingerprint({
-          method: 'agentSession.attach',
-          sessionId: params.envelope.sessionId,
-          fields: {
-            location: resolved.location,
-            provider: resolved.provider,
-            agent: resolved.agent,
-            accountHome: resolved.accountHome,
-            runtimeKind: resolved.runtimeKind,
-            expectedRuntimeFence: null
+      // Everything up to `attach` is pre-commit, and answers with a refusal rather than a throw so
+      // a client can tell "nothing was created" from "the outcome is unknown".
+      const prepared = await resolveUncommittedStructuredCreate(async () => {
+        if ('worktree' in params) {
+          const intentFingerprint = computeAgentSessionPayloadFingerprint({
+            method: 'agentSession.create',
+            sessionId: params.envelope.sessionId,
+            fields: { worktree: params.worktree, agent: params.agent }
+          })
+          const conflict = agentSessionFingerprintConflict(params.envelope, intentFingerprint)
+          if (conflict) {
+            return { refusal: conflict }
           }
-        })
-        await ensureHostInstalled(ctx)
-        const result = await requireHost(ctx).attach(callerFor(ctx), {
-          ...resolved,
-          envelope: { ...params.envelope, payloadFingerprint: hostFingerprint }
-        })
-        if (result.ok && resolved.agent === 'codex') {
-          try {
-            await ctx.runtime.publishStructuredAgentSessionTab({
+          const resolved = await ctx.runtime.resolveStructuredAgentSessionCreateIntent(params)
+          const hostFingerprint = computeAgentSessionPayloadFingerprint({
+            method: 'agentSession.attach',
+            sessionId: params.envelope.sessionId,
+            fields: {
+              location: resolved.location,
+              provider: resolved.provider,
+              agent: resolved.agent,
+              accountHome: resolved.accountHome,
+              runtimeKind: resolved.runtimeKind,
+              expectedRuntimeFence: null
+            }
+          })
+          await ensureHostInstalled(ctx)
+          const { agent: _resolvedAgent, provider: _resolvedProvider, ...resolvedAttach } = resolved
+          const attachParams: AgentSessionAttachParams = {
+            ...resolvedAttach,
+            provider: resolved.provider as 'claude' | 'codex',
+            agent: resolved.agent as 'claude' | 'codex',
+            envelope: { ...params.envelope, payloadFingerprint: hostFingerprint }
+          }
+          return {
+            host: requireHost(ctx),
+            attachParams,
+            tab: {
               workspaceId: resolved.location.workspaceId,
-              sessionId: result.value.sessionId,
-              agent: 'codex',
-              activate: true
-            })
-          } catch (error) {
-            console.warn('[agent-session] create committed before tab publication failed', error)
-            return {
-              ok: false,
-              refusal: {
-                code: 'agent_session_operation_unknown',
-                message: 'The Codex chat may have been created, but its tab could not be confirmed.'
-              }
+              agent: resolved.agent as 'claude' | 'codex'
             }
           }
         }
-        return result
+        const { host, attachParams } = await resolveClientSuppliedAttach(params, ctx)
+        return { host, attachParams, tab: null }
+      })
+      if ('refusal' in prepared) {
+        return { ok: false, refusal: prepared.refusal }
       }
-      await ensureHostInstalled(ctx)
-      return requireHost(ctx).attach(callerFor(ctx), params)
+      const result = await prepared.host.attach(callerFor(ctx), prepared.attachParams)
+      if (result.ok && prepared.tab) {
+        try {
+          await ctx.runtime.publishStructuredAgentSessionTab({
+            workspaceId: prepared.tab.workspaceId,
+            sessionId: result.value.sessionId,
+            agent: prepared.tab.agent,
+            activate: true
+          })
+        } catch (error) {
+          console.warn('[agent-session] create committed before tab publication failed', error)
+          return {
+            ok: false,
+            refusal: {
+              code: 'agent_session_operation_unknown',
+              message: 'The chat may have been created, but its tab could not be confirmed.'
+            }
+          }
+        }
+      }
+      return result
     }
   }),
   defineMethod({
     name: 'agentSession.ensure',
     params: AttachParams,
-    handler: async (params, ctx) => {
-      await ensureHostInstalled(ctx)
-      return requireHost(ctx).attach(callerFor(ctx), params)
-    }
+    handler: async (params, ctx) => attachClientSuppliedLocation(params, ctx)
   }),
   defineMethod({
     name: 'agentSession.send',
@@ -165,6 +213,11 @@ export const STRUCTURED_AGENT_SESSION_METHODS: RpcAnyMethod[] = [
     params: SetOptionParams,
     handler: async (params, ctx) => requireHost(ctx).setOption(callerFor(ctx), params)
   }),
+  defineMethod({
+    name: 'agentSession.requestHandoff',
+    params: HandoffParams,
+    handler: async (params, ctx) => requireHost(ctx).requestHandoff(callerFor(ctx), params)
+  }),
   defineMethod({
     name: 'agentSession.handoffStatus',
     params: HandoffStatusParams,
@@ -192,33 +245,12 @@ export const STRUCTURED_AGENT_SESSION_METHODS: RpcAnyMethod[] = [
       // Retain-only: reading history must never be what starts a provider process. Current clients
       // explicitly hold every open surface before subscribing.
       const streamHolder = `subscription:${subscriptionId}`
-      let closed = false
       let dispose = (): void => {}
-      let releaseTransportSubscription = (): void => {}
-      const onTransportAbort = (): void => releaseTransportSubscription()
-      const cleanup = () => {
-        closed = true
-        ctx.signal?.removeEventListener('abort', onTransportAbort)
+      const stream = bindStructuredAgentSessionStream(ctx, subscriptionId, () => {
         dispose()
         host.release(params.sessionId, streamHolder)
-      }
-      let registration: { releaseIfCurrent: () => void }
-      if (typeof ctx.runtime.registerOwnedSubscriptionCleanup === 'function') {
-        registration = ctx.runtime.registerOwnedSubscriptionCleanup(
-          subscriptionId,
-          cleanup,
-          ctx.connectionId
-        )
-      } else {
-        ctx.runtime.registerSubscriptionCleanup(subscriptionId, cleanup, ctx.connectionId)
-        registration = { releaseIfCurrent: () => ctx.runtime.cleanupSubscription(subscriptionId) }
-      }
-      releaseTransportSubscription = registration.releaseIfCurrent
-      ctx.signal?.addEventListener('abort', onTransportAbort, { once: true })
-      if (ctx.signal?.aborted) {
-        onTransportAbort()
-      }
-      if (closed) {
+      })
+      if (stream.isClosed()) {
         return
       }
       // The host emits the opening snapshot (or the missed batch) synchronously
@@ -229,7 +261,7 @@ export const STRUCTURED_AGENT_SESSION_METHODS: RpcAnyMethod[] = [
         emit,
         ...(params.cursor ? { cursor: params.cursor } : {})
       })
-      if (closed) {
+      if (stream.isClosed()) {
         dispose()
       } else {
         // Fire-and-forget, but never unhandled: a resume that refuses leaves the stream holding a
@@ -247,8 +279,7 @@ export const STRUCTURED_AGENT_SESSION_METHODS: RpcAnyMethod[] = [
     params: UnsubscribeParams,
     handler: async (params, ctx) => {
       requireHost(ctx)
-      const connection = ctx.connectionId ?? 'local'
-      const base = `${SUBSCRIPTION_PREFIX}:${connection}:${params.sessionId}`
+      const base = subscriptionBaseFor(ctx, params.sessionId)
       if (params.subscriptionId) {
         ctx.runtime.cleanupSubscription(`${base}:${params.subscriptionId}`)
         return { unsubscribed: true }
@@ -258,5 +289,7 @@ export const STRUCTURED_AGENT_SESSION_METHODS: RpcAnyMethod[] = [
       return { unsubscribed: true }
     }
   }),
-  ...STRUCTURED_AGENT_SESSION_HOLD_METHODS
+  ...STRUCTURED_AGENT_SESSION_HOLD_METHODS,
+  ...STRUCTURED_AGENT_SESSION_REVEAL_METHODS,
+  ...STRUCTURED_AGENT_SESSION_STATUS_METHODS
 ]
diff --git a/src/main/runtime/rpc/methods/structured-session-tab-restore.ts b/src/main/runtime/rpc/methods/structured-session-tab-restore.ts
index 4333713a445..f9efa46d16d 100644
--- a/src/main/runtime/rpc/methods/structured-session-tab-restore.ts
+++ b/src/main/runtime/rpc/methods/structured-session-tab-restore.ts
@@ -1,13 +1,24 @@
 import type { RpcContext } from '../core'
-import { supportsStructuredAgentSessions } from './structured-agent-session-policy'
+import {
+  isStructuredNativeChatEnabled,
+  supportsStructuredAgentSessions
+} from './structured-agent-session-policy'
 
+/** Republishes structured tabs into the host's own snapshot map.
+ *
+ *  Mobile is gated on the host setting alone, NOT on the client's capability: an old build is
+ *  shown a fallback prompt in place of each chat, and gating on capability left it with nothing to
+ *  project after a desktop restart — no chat and no prompt. The setting still gates it, because
+ *  with structured chat off there is nothing for any mobile client to reach. Restoring spawns no
+ *  provider child for a cleanly closed session. */
 export async function restoreStructuredTabsIfSupported(
   context: Pick<RpcContext, 'runtime' | 'clientKind' | 'clientCapabilities'>
 ): Promise<void> {
-  if (
-    supportsStructuredAgentSessions(context) &&
-    typeof context.runtime.restoreStructuredAgentSessionTabs === 'function'
-  ) {
+  const shouldRestore =
+    context.clientKind === 'mobile'
+      ? isStructuredNativeChatEnabled(context.runtime)
+      : supportsStructuredAgentSessions(context)
+  if (shouldRestore && typeof context.runtime.restoreStructuredAgentSessionTabs === 'function') {
     await context.runtime.restoreStructuredAgentSessionTabs()
   }
 }
diff --git a/src/main/runtime/rpc/methods/terminal/terminal-inspect-process-params.test.ts b/src/main/runtime/rpc/methods/terminal/terminal-inspect-process-params.test.ts
new file mode 100644
index 00000000000..48649bc372c
--- /dev/null
+++ b/src/main/runtime/rpc/methods/terminal/terminal-inspect-process-params.test.ts
@@ -0,0 +1,92 @@
+// The host half of the same contract: an RPC schema silently strips keys it does not declare, which
+// is exactly what forward compatibility needs and exactly how a caller's option can vanish inside
+// one version. `scanChildProcesses` has to be declared here, and only here -- the sibling handle
+// methods have no use for it and must keep refusing it.
+import { describe, expect, it, vi } from 'vitest'
+import type { ZodType } from 'zod'
+import { TERMINAL_QUERY_METHODS } from './terminal-query-methods'
+import { TerminalHandle, TerminalInspectProcess } from './unary-schemas'
+
+/** The method as registered, so a schema swap on the definition cannot pass unseen. */
+function inspectProcessMethod() {
+  const method = TERMINAL_QUERY_METHODS.find((entry) => entry.name === 'terminal.inspectProcess')
+  if (!method) {
+    throw new Error('terminal.inspectProcess is not registered')
+  }
+  return method
+}
+
+async function callRegisteredHandler(
+  params: Record<string, unknown>
+): Promise<{ terminal: string; options: unknown }> {
+  const method = inspectProcessMethod()
+  const parsed = (method.params as ZodType).parse(params)
+  const inspectTerminalProcess = vi.fn(async () => ({
+    foregroundProcess: null,
+    hasChildProcesses: false
+  }))
+  await method.handler(parsed, { runtime: { inspectTerminalProcess } } as never, undefined as never)
+  const [terminal, options] = inspectTerminalProcess.mock.calls[0] as unknown as [string, unknown]
+  return { terminal, options }
+}
+
+describe('terminal.inspectProcess registration', () => {
+  // The half the schema test alone cannot see: pointing the method back at the shared handle schema
+  // compiles, parses, and silently drops the option. This exercises the registered definition.
+  it('carries scanChildProcesses from the wire into the runtime call', async () => {
+    await expect(
+      callRegisteredHandler({ terminal: 'term_1', scanChildProcesses: true })
+    ).resolves.toEqual({ terminal: 'term_1', options: { scanChildProcesses: true } })
+  })
+
+  it('carries it alongside the incarnation fence', async () => {
+    await expect(
+      callRegisteredHandler({
+        terminal: 'term_1',
+        expectedIncarnationId: 'inc-1',
+        scanChildProcesses: true
+      })
+    ).resolves.toEqual({
+      terminal: 'term_1',
+      options: { expectedIncarnationId: 'inc-1', scanChildProcesses: true }
+    })
+  })
+
+  it('keeps the legacy one-argument shape for a bare poll', async () => {
+    await expect(callRegisteredHandler({ terminal: 'term_1' })).resolves.toEqual({
+      terminal: 'term_1',
+      options: undefined
+    })
+  })
+})
+
+describe('terminal.inspectProcess params', () => {
+  it('preserves scanChildProcesses', () => {
+    expect(TerminalInspectProcess.parse({ terminal: 'term_1', scanChildProcesses: true })).toEqual({
+      terminal: 'term_1',
+      scanChildProcesses: true
+    })
+  })
+
+  it('preserves it alongside the incarnation fence', () => {
+    expect(
+      TerminalInspectProcess.parse({
+        terminal: 'term_1',
+        expectedIncarnationId: 'inc-1',
+        scanChildProcesses: true
+      })
+    ).toEqual({ terminal: 'term_1', expectedIncarnationId: 'inc-1', scanChildProcesses: true })
+  })
+
+  it('leaves it absent for a polling caller', () => {
+    expect(TerminalInspectProcess.parse({ terminal: 'term_1' })).toEqual({ terminal: 'term_1' })
+  })
+
+  // The shape that produced the bug, pinned so nobody "simplifies" the method back onto the shared
+  // handle schema: TerminalHandle drops the option on the floor without complaining.
+  it('shows why the shared handle schema could not carry it', () => {
+    expect(TerminalHandle.parse({ terminal: 'term_1', scanChildProcesses: true })).toEqual({
+      terminal: 'term_1'
+    })
+  })
+})
diff --git a/src/main/runtime/rpc/methods/terminal/terminal-query-methods.ts b/src/main/runtime/rpc/methods/terminal/terminal-query-methods.ts
index a8aec9ff573..bf7b4a5bd87 100644
--- a/src/main/runtime/rpc/methods/terminal/terminal-query-methods.ts
+++ b/src/main/runtime/rpc/methods/terminal/terminal-query-methods.ts
@@ -1,6 +1,7 @@
 import { defineMethod, type RpcAnyMethod } from '../../core'
 import {
   TerminalHandle,
+  TerminalInspectProcess,
   TerminalListParams,
   TerminalRead,
   TerminalRecoverPane,
@@ -65,15 +66,21 @@ export const TERMINAL_QUERY_METHODS: RpcAnyMethod[] = [
   }),
   defineMethod({
     name: 'terminal.inspectProcess',
-    params: TerminalHandle,
-    handler: async (params, { runtime }) => ({
-      process: await runtime.inspectTerminalProcess(
-        params.terminal,
-        params.expectedIncarnationId
+    params: TerminalInspectProcess,
+    handler: async (params, { runtime }) => {
+      const options = {
+        ...(params.expectedIncarnationId
           ? { expectedIncarnationId: params.expectedIncarnationId }
-          : undefined
-      )
-    })
+          : {}),
+        ...(params.scanChildProcesses === true ? { scanChildProcesses: true } : {})
+      }
+      return {
+        process: await runtime.inspectTerminalProcess(
+          params.terminal,
+          Object.keys(options).length > 0 ? options : undefined
+        )
+      }
+    }
   }),
   defineMethod({
     name: 'terminal.isRunningAgent',
diff --git a/src/main/runtime/rpc/methods/terminal/unary-schemas.ts b/src/main/runtime/rpc/methods/terminal/unary-schemas.ts
index 323b34a7544..afe0a3bb486 100644
--- a/src/main/runtime/rpc/methods/terminal/unary-schemas.ts
+++ b/src/main/runtime/rpc/methods/terminal/unary-schemas.ts
@@ -13,6 +13,17 @@ export const TerminalFocus = TerminalHandle.extend({
   navigation: z.enum(['caller', 'host']).optional()
 })
 
+/**
+ * `terminal.inspectProcess` carries one member the sibling handle methods must not: whether the
+ * caller's answer decides something once, which is what licenses the host to pay for a process-table
+ * read. Extended rather than added to `TerminalHandle` so `clearBuffer`/`agentStatus`/`isRunningAgent`
+ * keep refusing an option they have no use for.
+ */
+export const TerminalInspectProcess = TerminalHandle.extend({
+  // Additive request member understood by newer hosts; legacy hosts safely ignore it.
+  scanChildProcesses: z.boolean().optional()
+})
+
 export const TerminalListParams = z.object({
   worktree: OptionalString,
   limit: OptionalFiniteNumber,
diff --git a/src/main/runtime/rpc/mobile-auth-acl-critical-path.test.ts b/src/main/runtime/rpc/mobile-auth-acl-critical-path.test.ts
index 35225f72f9c..b5589aa7724 100644
--- a/src/main/runtime/rpc/mobile-auth-acl-critical-path.test.ts
+++ b/src/main/runtime/rpc/mobile-auth-acl-critical-path.test.ts
@@ -1,26 +1,71 @@
 // Why: the E2EE auth handshake used to persist `lastSeenAt` inline, and on Windows every secure-file
-// write blocks the main thread on two synchronous PowerShell ACL spawns (~1-1.5s cold each). These tests
+// write blocks the main thread on synchronous icacls ACL spawns (~1-1.5s cold each). These tests
 // pin the spawn count on the auth critical path, not wall-clock, so they are deterministic under load.
-import { execFile, execFileSync } from 'node:child_process'
-import { mkdtempSync, readFileSync, rmSync } from 'node:fs'
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type { WebSocket } from 'ws'
+import type { ProcessResult, ProcessSpec } from '../../../shared/child-process/run-process'
+import { runProcess, runProcessSync } from '../../../shared/child-process/run-process'
 import { DEVICE_REGISTRY_FILENAME } from '../mobile-pairing-files'
 import { DeviceRegistry, type DeviceEntry } from '../device-registry'
 import { decrypt, deriveSharedKey, encrypt, generateKeyPair } from './e2ee-crypto'
 import { MobileSocketWiring, type MobileSocketTransport } from './mobile-socket-wiring'
 
-vi.mock('node:child_process', () => ({
-  execFileSync: vi.fn(),
-  execFile: vi.fn()
+// Why this module and not `node:child_process`: hardening reaches the OS only through
+// runProcess/runProcessSync, and a hand-written child_process factory silently omitted the one
+// function they call — so every spawn threw, hardening no-opped, and the test double hid it.
+vi.mock('../../../shared/child-process/run-process', () => ({
+  runProcess: vi.fn(),
+  runProcessSync: vi.fn()
 }))
 
-// Why: stands in for the PowerShell cold start; long enough that a gated response would be obvious,
+// Why: stands in for the icacls cold start; long enough that a gated response would be obvious,
 // short enough that the suite stays fast. Assertions use the recorded ordering, never this number.
 const INJECTED_SPAWN_LATENCY_MS = 5
-const POWERSHELL = 'C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'
+const USER_SID = 'S-1-5-21-1000'
+const OK: ProcessResult = { code: 0, signal: null, stdout: '', stderr: '', timedOut: false }
+/**
+ * One secure write hardens two paths: the staged temp file, fresh and still on the inherited DACL,
+ * costs the full verify/reset/grant/verify pass; the published file, whose protected DACL came
+ * along with the rename, costs only its verify.
+ */
+const BLOCKING_SPAWNS_PER_WRITE = 5
+
+/** Paths the fake icacls has granted a protected DACL, keyed to the ACE flags the grant used. */
+const hardenedByFake = new Map<string, string>()
+
+/**
+ * Stands in for icacls. `/save` really writes a UTF-16LE SDDL file, because the code under test
+ * reads that file back off disk to decide whether a rewrite is needed at all — which is what makes
+ * the spawn count per write a property of the real ACL path rather than of this double.
+ */
+function fakeIcacls(spec: ProcessSpec): ProcessResult {
+  const args = spec.args ?? []
+  const path = args[0] ?? ''
+  const grantIndex = args.indexOf('/grant:r')
+  if (grantIndex !== -1) {
+    hardenedByFake.set(path, args[grantIndex + 1]!.includes('(OI)(CI)') ? 'OICI' : '')
+    return OK
+  }
+  const saveIndex = args.indexOf('/save')
+  if (saveIndex === -1) {
+    return OK // /reset
+  }
+  writeFileSync(args[saveIndex + 1]!, fakeSddl(path), 'utf16le')
+  return OK
+}
+
+function fakeSddl(path: string): string {
+  const aceFlags = hardenedByFake.get(path)
+  if (aceFlags === undefined) {
+    // Never hardened: the inherited DACL a fresh file carries, so the first verify must fail.
+    return `name\r\nD:(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;FA;;;${USER_SID})\r\n`
+  }
+  const ace = (sid: string): string => `(A;${aceFlags};FA;;;${sid})`
+  return `name\r\nD:PAI${ace('BA')}${ace('SY')}${ace(USER_SID)}\r\n`
+}
 
 type TimelineEntry = 'acl-spawn' | 'e2ee_ready' | 'e2ee_authenticated' | 'other-frame'
 
@@ -62,24 +107,23 @@ describe('mobile auth critical path', () => {
     process.env.SystemRoot = 'C:\\Windows'
     Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
     userDataPath = mkdtempSync(join(tmpdir(), 'orca-auth-acl-'))
-    vi.mocked(execFileSync).mockReset()
-    vi.mocked(execFile).mockReset()
-    vi.mocked(execFileSync).mockImplementation((file) => {
-      if (String(file).endsWith('whoami.exe')) {
-        return '"USER","S-1-5-21-1000"'
+    hardenedByFake.clear()
+    vi.mocked(runProcessSync).mockReset()
+    vi.mocked(runProcess).mockReset()
+    vi.mocked(runProcessSync).mockImplementation((spec) => {
+      // Matched by suffix, not by the whole path: `windowsSystem32Binary` joins with the host
+      // separator, so the literal only matches when the tests happen to run on Windows.
+      if (spec.program.endsWith('whoami.exe')) {
+        return { ...OK, stdout: `"USER","${USER_SID}"` }
       }
       timeline.push('acl-spawn')
       // Why: the real spawn blocks the main thread, so the fake must too — and via Atomics, not a
       // Date.now() spin, which would never terminate under fake timers.
       Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, INJECTED_SPAWN_LATENCY_MS)
-      return ''
-    })
-    vi.mocked(execFile).mockImplementation((_file, _args, _options, callback) => {
-      if (typeof callback === 'function') {
-        callback(null, '', '')
-      }
-      return {} as ReturnType<typeof execFile>
+      return fakeIcacls(spec)
     })
+    // The directory harden stays on the async lane, so it never lands on the timeline.
+    vi.mocked(runProcess).mockImplementation((spec) => Promise.resolve(fakeIcacls(spec)))
   })
 
   afterEach(() => {
@@ -157,8 +201,11 @@ describe('mobile auth critical path', () => {
 
     registry.flushPendingLastSeen()
     // Hardening is deferred, never dropped: tmp file + published file, exactly as the inline path did.
-    expect(timeline.filter((entry) => entry === 'acl-spawn')).toHaveLength(2)
-    expect(vi.mocked(execFileSync).mock.lastCall?.[0]).toBe(POWERSHELL)
+    expect(timeline.filter((entry) => entry === 'acl-spawn')).toHaveLength(
+      BLOCKING_SPAWNS_PER_WRITE
+    )
+    // The blocking work is the ACL tool itself, not some other spawn on the same lane.
+    expect(vi.mocked(runProcessSync).mock.lastCall?.[0].program).toMatch(/icacls\.exe$/)
     expect(readPersistedDevices()[0]?.lastSeenAt).toBe(
       registry.getDevice(device.deviceId)?.lastSeenAt
     )
@@ -172,7 +219,11 @@ describe('mobile auth critical path', () => {
     authenticate(registry, device)
 
     // Why: rotatePendingDevice drops entries disk says were never scanned, so this write stays inline.
-    expect(timeline).toEqual(['e2ee_ready', 'acl-spawn', 'acl-spawn', 'e2ee_authenticated'])
+    expect(timeline).toEqual([
+      'e2ee_ready',
+      ...Array<TimelineEntry>(BLOCKING_SPAWNS_PER_WRITE).fill('acl-spawn'),
+      'e2ee_authenticated'
+    ])
     expect(readPersistedDevices()[0]?.lastSeenAt).toBeGreaterThan(0)
   })
 
@@ -189,7 +240,9 @@ describe('mobile auth critical path', () => {
 
     expect(timeline.filter((entry) => entry === 'acl-spawn')).toHaveLength(0)
     vi.advanceTimersByTime(250)
-    expect(timeline.filter((entry) => entry === 'acl-spawn')).toHaveLength(2)
+    expect(timeline.filter((entry) => entry === 'acl-spawn')).toHaveLength(
+      BLOCKING_SPAWNS_PER_WRITE
+    )
   })
 
   it('cancels the deferred rewrite when another registry save persists the timestamp', () => {
@@ -201,9 +254,13 @@ describe('mobile auth critical path', () => {
 
     registry.updateLastSeenDeferred(device.deviceId)
     registry.addDevice('Other client', 'runtime')
-    expect(timeline.filter((entry) => entry === 'acl-spawn')).toHaveLength(2)
+    expect(timeline.filter((entry) => entry === 'acl-spawn')).toHaveLength(
+      BLOCKING_SPAWNS_PER_WRITE
+    )
 
     vi.advanceTimersByTime(250)
-    expect(timeline.filter((entry) => entry === 'acl-spawn')).toHaveLength(2)
+    expect(timeline.filter((entry) => entry === 'acl-spawn')).toHaveLength(
+      BLOCKING_SPAWNS_PER_WRITE
+    )
   })
 })
diff --git a/src/main/runtime/rpc/mobile-clipboard-image-provenance.test.ts b/src/main/runtime/rpc/mobile-clipboard-image-provenance.test.ts
new file mode 100644
index 00000000000..aa1709fcecb
--- /dev/null
+++ b/src/main/runtime/rpc/mobile-clipboard-image-provenance.test.ts
@@ -0,0 +1,53 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  hasMobileClipboardImagePath,
+  MOBILE_CLIPBOARD_IMAGE_PROVENANCE_MAX_ENTRIES,
+  MOBILE_CLIPBOARD_IMAGE_PROVENANCE_TTL_MS,
+  mobileClipboardImageProvenanceSizeForTest,
+  recordMobileClipboardImagePath,
+  resetMobileClipboardImageProvenanceForTest
+} from './mobile-clipboard-image-provenance'
+
+describe('mobile clipboard image provenance', () => {
+  beforeEach(() => {
+    vi.useFakeTimers()
+    vi.setSystemTime(new Date('2026-01-01T00:00:00Z'))
+    resetMobileClipboardImageProvenanceForTest()
+  })
+
+  afterEach(() => {
+    resetMobileClipboardImageProvenanceForTest()
+    vi.useRealTimers()
+  })
+
+  it('expires records without consuming them on repeated checks', () => {
+    recordMobileClipboardImagePath('device-a', '/tmp/image.png')
+
+    expect(hasMobileClipboardImagePath('device-a', '/tmp/image.png')).toBe(true)
+    expect(hasMobileClipboardImagePath('device-a', '/tmp/image.png')).toBe(true)
+    vi.advanceTimersByTime(MOBILE_CLIPBOARD_IMAGE_PROVENANCE_TTL_MS + 1)
+    expect(hasMobileClipboardImagePath('device-a', '/tmp/image.png')).toBe(false)
+    expect(mobileClipboardImageProvenanceSizeForTest()).toBe(0)
+  })
+
+  it('evicts the oldest record at the global bound and supports test cleanup', () => {
+    for (let index = 0; index <= MOBILE_CLIPBOARD_IMAGE_PROVENANCE_MAX_ENTRIES; index++) {
+      recordMobileClipboardImagePath(`device-${index}`, `/tmp/image-${index}.png`)
+      vi.advanceTimersByTime(1)
+    }
+
+    expect(mobileClipboardImageProvenanceSizeForTest()).toBe(
+      MOBILE_CLIPBOARD_IMAGE_PROVENANCE_MAX_ENTRIES
+    )
+    expect(hasMobileClipboardImagePath('device-0', '/tmp/image-0.png')).toBe(false)
+    expect(
+      hasMobileClipboardImagePath(
+        `device-${MOBILE_CLIPBOARD_IMAGE_PROVENANCE_MAX_ENTRIES}`,
+        `/tmp/image-${MOBILE_CLIPBOARD_IMAGE_PROVENANCE_MAX_ENTRIES}.png`
+      )
+    ).toBe(true)
+
+    resetMobileClipboardImageProvenanceForTest()
+    expect(mobileClipboardImageProvenanceSizeForTest()).toBe(0)
+  })
+})
diff --git a/src/main/runtime/rpc/mobile-clipboard-image-provenance.ts b/src/main/runtime/rpc/mobile-clipboard-image-provenance.ts
new file mode 100644
index 00000000000..117455593c9
--- /dev/null
+++ b/src/main/runtime/rpc/mobile-clipboard-image-provenance.ts
@@ -0,0 +1,90 @@
+export const MOBILE_CLIPBOARD_IMAGE_PROVENANCE_TTL_MS = 60 * 60 * 1000
+export const MOBILE_CLIPBOARD_IMAGE_PROVENANCE_MAX_ENTRIES = 256
+const MOBILE_CLIPBOARD_IMAGE_PROVENANCE_MAX_PER_CLIENT = 64
+
+const pathsByClient = new Map<string, Map<string, number>>()
+let entryCount = 0
+
+function deletePath(clientId: string, path: string): void {
+  const paths = pathsByClient.get(clientId)
+  if (!paths?.delete(path)) {
+    return
+  }
+  entryCount--
+  if (paths.size === 0) {
+    pathsByClient.delete(clientId)
+  }
+}
+
+function pruneExpired(now: number): void {
+  for (const [clientId, paths] of pathsByClient) {
+    for (const [path, expiresAt] of paths) {
+      if (expiresAt <= now) {
+        deletePath(clientId, path)
+      }
+    }
+  }
+}
+
+function deleteOldestEntry(): void {
+  let oldest: { clientId: string; path: string; expiresAt: number } | null = null
+  for (const [clientId, paths] of pathsByClient) {
+    for (const [path, expiresAt] of paths) {
+      if (!oldest || expiresAt < oldest.expiresAt) {
+        oldest = { clientId, path, expiresAt }
+      }
+    }
+  }
+  if (oldest) {
+    deletePath(oldest.clientId, oldest.path)
+  }
+}
+
+export function recordMobileClipboardImagePath(clientId: string | undefined, path: string): void {
+  const owner = clientId?.trim()
+  if (!owner) {
+    return
+  }
+  const now = Date.now()
+  pruneExpired(now)
+  let paths = pathsByClient.get(owner)
+  if (!paths) {
+    paths = new Map()
+    pathsByClient.set(owner, paths)
+  }
+  if (paths.delete(path)) {
+    entryCount--
+  }
+  while (paths.size >= MOBILE_CLIPBOARD_IMAGE_PROVENANCE_MAX_PER_CLIENT) {
+    const oldestPath = paths.keys().next().value
+    if (typeof oldestPath !== 'string') {
+      break
+    }
+    deletePath(owner, oldestPath)
+  }
+  while (entryCount >= MOBILE_CLIPBOARD_IMAGE_PROVENANCE_MAX_ENTRIES) {
+    deleteOldestEntry()
+  }
+  paths = pathsByClient.get(owner) ?? new Map<string, number>()
+  pathsByClient.set(owner, paths)
+  paths.set(path, now + MOBILE_CLIPBOARD_IMAGE_PROVENANCE_TTL_MS)
+  entryCount++
+}
+
+export function hasMobileClipboardImagePath(clientId: string | undefined, path: string): boolean {
+  const owner = clientId?.trim()
+  if (!owner) {
+    return false
+  }
+  pruneExpired(Date.now())
+  return pathsByClient.get(owner)?.has(path) ?? false
+}
+
+export function resetMobileClipboardImageProvenanceForTest(): void {
+  pathsByClient.clear()
+  entryCount = 0
+}
+
+export function mobileClipboardImageProvenanceSizeForTest(): number {
+  return entryCount
+}
diff --git a/src/main/runtime/rpc/mobile-e2ee-v2-client-capabilities.ts b/src/main/runtime/rpc/mobile-e2ee-v2-client-capabilities.ts
new file mode 100644
index 00000000000..3834a417ddb
--- /dev/null
+++ b/src/main/runtime/rpc/mobile-e2ee-v2-client-capabilities.ts
@@ -0,0 +1,21 @@
+import type { RuntimeCapability } from '../../../shared/protocol-version'
+import { parseRemoteRuntimeJsonText } from '../../../shared/remote-runtime-request-frames'
+import { parseRuntimeClientCapabilities } from './runtime-client-capabilities'
+
+export function parseMobileE2EEV2ClientCapabilities(
+  plaintext: string
+): readonly RuntimeCapability[] | null {
+  try {
+    const message = parseRemoteRuntimeJsonText(plaintext) as Record<string, unknown>
+    if (
+      Object.keys(message).sort().join(',') !== 'clientCapabilities,type,v' ||
+      message.type !== 'e2ee_client_capabilities' ||
+      message.v !== 1
+    ) {
+      return null
+    }
+    return parseRuntimeClientCapabilities(message.clientCapabilities)
+  } catch {
+    return null
+  }
+}
diff --git a/src/main/runtime/rpc/mobile-socket-wiring.test.ts b/src/main/runtime/rpc/mobile-socket-wiring.test.ts
index 505cf63feb6..5ce3325083c 100644
--- a/src/main/runtime/rpc/mobile-socket-wiring.test.ts
+++ b/src/main/runtime/rpc/mobile-socket-wiring.test.ts
@@ -190,6 +190,58 @@ describe('MobileSocketWiring', () => {
     expect(wiring.connectionCount).toBe(0)
   })
 
+  it('lets the capability RPC write capabilities back onto the socket', () => {
+    // `runtime.clientCapabilities.update` stores the advertised set by assigning
+    // `authenticatedSocket.clientCapabilities`. A read-only socket makes that a
+    // TypeError, the RPC answers `runtime_error`, and every structured
+    // agent-session tab is then projected away from a capable phone.
+    const desktop = generateKeyPair()
+    const phone = generateKeyPair()
+    const ws = new FakeSocket()
+    const transport = new FakeTransport()
+    const onText = vi.fn()
+    const wiring = new MobileSocketWiring({
+      deviceRegistry: registryFor('device-1', 'valid-token', 'mobile'),
+      e2eeKeypair: {
+        publicKey: desktop.publicKey,
+        secretKey: desktop.secretKey,
+        publicKeyB64: Buffer.from(desktop.publicKey).toString('base64')
+      },
+      onText,
+      onBinary: vi.fn(),
+      onClose: vi.fn()
+    })
+    wiring.attachTransport(transport)
+
+    transport.receive(
+      ws,
+      JSON.stringify({
+        type: 'e2ee_hello',
+        publicKeyB64: Buffer.from(phone.publicKey).toString('base64')
+      })
+    )
+    const sharedKey = deriveSharedKey(phone.secretKey, desktop.publicKey)
+    transport.receive(
+      ws,
+      encrypt(JSON.stringify({ type: 'e2ee_auth', deviceToken: 'valid-token' }), sharedKey)
+    )
+    transport.receive(ws, encrypt('{"id":"rpc-1","method":"status.get"}', sharedKey))
+
+    const socket = onText.mock.calls[0]?.[0]
+    expect(socket).toBeDefined()
+    expect(socket.clientCapabilities).toEqual([])
+
+    expect(() => {
+      socket.clientCapabilities = ['agent-session.structured.v1']
+    }).not.toThrow()
+    expect(socket.clientCapabilities).toEqual(['agent-session.structured.v1'])
+
+    // Later requests on the same connection must see the updated set, so the
+    // channel is the single source of truth rather than a detached copy.
+    transport.receive(ws, encrypt('{"id":"rpc-2","method":"status.get"}', sharedKey))
+    expect(onText.mock.calls[1]?.[0].clientCapabilities).toEqual(['agent-session.structured.v1'])
+  })
+
   it('closes an unknown-token socket even when reporting the failure throws', () => {
     const desktop = generateKeyPair()
     const phone = generateKeyPair()
@@ -348,4 +400,86 @@ describe('MobileSocketWiring', () => {
     expect(transport.setClientId).not.toHaveBeenCalled()
     expect(ws.close).toHaveBeenCalledWith(4001, 'Unauthorized')
   })
+
+  it('keeps post-auth v2 capability-shaped frames on the RPC path', () => {
+    const desktop = nacl.box.keyPair.fromSecretKey(new Uint8Array(32).fill(1))
+    const phone = nacl.box.keyPair.fromSecretKey(new Uint8Array(32).fill(2))
+    const ws = new FakeSocket()
+    const transport = new FakeTransport()
+    const onText = vi.fn()
+    const metadata: MobileSocketTransportMetadata = {
+      transport: 'relay',
+      relayHostId: 'AbCdEf0123_-xyZ9',
+      relayDeviceId: 'device-1',
+      basisConnId: 'connection-1',
+      credentialKind: 'resume'
+    }
+    const wiring = new MobileSocketWiring({
+      deviceRegistry: registryFor('device-1', 'valid-token'),
+      e2eeKeypair: {
+        publicKey: desktop.publicKey,
+        secretKey: desktop.secretKey,
+        publicKeyB64: Buffer.from(desktop.publicKey).toString('base64')
+      },
+      onText,
+      onBinary: vi.fn(),
+      onClose: vi.fn()
+    })
+    wiring.attachTransport(transport, () => metadata)
+    const hello: MobileE2EEV2Hello = {
+      type: 'e2ee_hello',
+      v: 2,
+      clientPublicKeyB64: Buffer.from(phone.publicKey).toString('base64'),
+      clientNonceB64: Buffer.from(new Uint8Array(32).fill(3)).toString('base64'),
+      capabilities: { framing: [2], payloadKinds: ['text', 'binary'] },
+      context: {
+        protocol: 'orca-mobile-e2ee',
+        initiator: 'mobile',
+        responder: 'desktop',
+        transport: 'relay',
+        relayHostId: metadata.relayHostId
+      }
+    }
+    transport.receive(ws, JSON.stringify(hello))
+    const ready = JSON.parse(ws.sent[0]!.toString()) as MobileE2EEV2Ready
+    const handshake = validateMobileE2EEV2Handshake(hello, ready)!
+    const schedule = deriveMobileE2EEV2KeySchedule({
+      sharedSecret: deriveSharedKey(phone.secretKey, desktop.publicKey),
+      transcript: encodeMobileE2EEV2Transcript(handshake),
+      clientNonce: handshake.clientNonce,
+      desktopNonce: handshake.desktopNonce
+    })
+    const send = (value: unknown, counter: bigint): void => {
+      const frame = sealMobileE2EEV2Frame({
+        payload: new TextEncoder().encode(JSON.stringify(value)),
+        key: schedule.mobileToDesktopKey,
+        sessionId: schedule.sessionId,
+        direction: 'mobile-to-desktop',
+        payloadKind: 'text',
+        counter
+      })
+      transport.receive(ws, Buffer.from(frame).toString('base64'))
+    }
+    send(
+      {
+        type: 'e2ee_auth',
+        v: 2,
+        transcriptHashB64: Buffer.from(schedule.transcriptHash).toString('base64'),
+        deviceToken: 'valid-token'
+      },
+      0n
+    )
+    const capabilityFrame = {
+      type: 'e2ee_client_capabilities',
+      v: 1,
+      clientCapabilities: ['agent-session.structured.v1']
+    }
+    send(capabilityFrame, 1n)
+    send({ id: 'rpc-1', method: 'agentSession.history', params: {} }, 2n)
+
+    expect(onText).toHaveBeenCalledTimes(2)
+    expect(onText.mock.calls[0]?.[0].clientCapabilities).toEqual([])
+    expect(JSON.parse(onText.mock.calls[0]?.[1] ?? '')).toEqual(capabilityFrame)
+    expect(onText.mock.calls[1]?.[0].clientCapabilities).toEqual([])
+  })
 })
diff --git a/src/main/runtime/rpc/mobile-socket-wiring.ts b/src/main/runtime/rpc/mobile-socket-wiring.ts
index 43004be4582..2d536b15038 100644
--- a/src/main/runtime/rpc/mobile-socket-wiring.ts
+++ b/src/main/runtime/rpc/mobile-socket-wiring.ts
@@ -165,7 +165,16 @@ export class MobileSocketWiring {
             ws,
             connectionId,
             device,
-            clientCapabilities: channel.clientCapabilities,
+            // Why: the channel owns the set for the whole connection, so this reads
+            // through rather than snapshotting. It must also WRITE through — the
+            // capability RPC updates the socket, and a getter-only property makes
+            // that a TypeError, which strands a capable phone with no capabilities.
+            get clientCapabilities() {
+              return channel.clientCapabilities
+            },
+            set clientCapabilities(next: readonly RuntimeCapability[]) {
+              channel.clientCapabilities = next
+            },
             transport: metadata
           }
           this.authenticatedSockets.set(ws, socket)
diff --git a/src/main/runtime/runtime-file-commands-search-local-runtime-files.ts b/src/main/runtime/runtime-file-commands-search-local-runtime-files.ts
index 6e0ec4896c8..e7f3172f753 100644
--- a/src/main/runtime/runtime-file-commands-search-local-runtime-files.ts
+++ b/src/main/runtime/runtime-file-commands-search-local-runtime-files.ts
@@ -1,4 +1,5 @@
 // @ts-nocheck -- mechanically split class members.
+import { SearchSubprocessLineAccumulator } from '../../shared/search-subprocess-lines'
 import { RuntimeFileCommandsWithSearchRuntimeFiles } from './runtime-file-commands-search-runtime-files'
 import type { SearchOptions, SearchResult } from '../../shared/code-search-types'
 import { resolveAuthorizedPath } from '../ipc/filesystem-auth'
@@ -58,7 +59,7 @@ export class RuntimeFileCommandsWithSearchLocalRuntimeFiles extends RuntimeFileC
       }
 
       const acc = createAccumulator()
-      let stdoutBuffer = ''
+      const lines = new SearchSubprocessLineAccumulator(Number.MAX_SAFE_INTEGER)
       let resolved = false
       let processErrorObserved = false
       let unavailableExitObserved = false
@@ -84,6 +85,7 @@ export class RuntimeFileCommandsWithSearchLocalRuntimeFiles extends RuntimeFileC
 
       let killTimeout: ReturnType<typeof setTimeout> | null = null
       const cleanupListeners = (): void => {
+        lines.clear()
         if (killTimeout) {
           clearTimeout(killTimeout)
           killTimeout = null
@@ -123,12 +125,7 @@ export class RuntimeFileCommandsWithSearchLocalRuntimeFiles extends RuntimeFileC
 
       nextChild.stdout!.setEncoding('utf-8')
       const onStdoutData = (chunk: string): void => {
-        stdoutBuffer += chunk
-        const lines = stdoutBuffer.split('\n')
-        stdoutBuffer = lines.pop() ?? ''
-        for (const line of lines) {
-          processLine(line)
-        }
+        lines.push(chunk, processLine)
       }
       const onStderrData = (): void => {
         // Drain stderr so rg cannot block on a full pipe.
@@ -152,8 +149,9 @@ export class RuntimeFileCommandsWithSearchLocalRuntimeFiles extends RuntimeFileC
           resolveWithoutRipgrep()
           return
         }
-        if (stdoutBuffer) {
-          processLine(stdoutBuffer)
+        const tail = lines.finish()
+        if (tail !== null) {
+          processLine(tail)
         }
         resolveOnce()
       }
diff --git a/src/main/runtime/runtime-local-worktree-create-candidate.ts b/src/main/runtime/runtime-local-worktree-create-candidate.ts
index 6c454666148..9de955c5cd1 100644
--- a/src/main/runtime/runtime-local-worktree-create-candidate.ts
+++ b/src/main/runtime/runtime-local-worktree-create-candidate.ts
@@ -110,23 +110,31 @@ export async function resolveRuntimeLocalWorktreeCreateCandidate(args: {
       args.username,
       args.localWorktreeGitOptions
     )
-    checkoutExistingBranch = await canCheckoutExistingLocalBranch(
-      args.repo.path,
-      branchName,
-      args.baseBranch,
-      ...args.localWorktreeGitOptionArgs
-    )
-    if (checkoutExistingBranch && !selectedExistingLocalBranchName) {
-      selectedExistingLocalBranchName = branchName
+    const tryExistingBranch = async (): Promise<boolean> => {
+      checkoutExistingBranch = await canCheckoutExistingLocalBranch(
+        args.repo.path,
+        branchName,
+        args.baseBranch,
+        ...args.localWorktreeGitOptionArgs
+      )
+      return checkoutExistingBranch
     }
+    const preferExistingBranch = Boolean(
+      args.request.branchNameOverride || selectedExistingLocalBranchName
+    )
+    checkoutExistingBranch = preferExistingBranch && (await tryExistingBranch())
     branchConflictKind = checkoutExistingBranch
       ? null
       : await getBranchConflictKind(
           args.repo.path,
           branchName,
           args.baseBranch,
-          ...args.localWorktreeGitOptionArgs
+          args.localWorktreeGitOptions,
+          preferExistingBranch ? undefined : tryExistingBranch
         )
+    if (checkoutExistingBranch && !selectedExistingLocalBranchName) {
+      selectedExistingLocalBranchName = branchName
+    }
     const allowedPushTargetRemoteConflict =
       branchConflictKind &&
       isAllowedPushTargetRemoteConflict(branchConflictKind, branchName, args.request)
diff --git a/src/main/runtime/runtime-managed-worktree-queries.test.ts b/src/main/runtime/runtime-managed-worktree-queries.test.ts
index 01df53cbd1d..3fb792fcc7c 100644
--- a/src/main/runtime/runtime-managed-worktree-queries.test.ts
+++ b/src/main/runtime/runtime-managed-worktree-queries.test.ts
@@ -40,14 +40,18 @@ function metadata(overrides: Partial<WorktreeMeta> = {}): WorktreeMeta {
   }
 }
 
-function queries(store: RuntimeStore): RuntimeManagedWorktreeQueries {
+function queries(
+  store: RuntimeStore,
+  overrides: Partial<ConstructorParameters<typeof RuntimeManagedWorktreeQueries>[0]> = {}
+): RuntimeManagedWorktreeQueries {
   return new RuntimeManagedWorktreeQueries({
     getStore: () => store,
     listResolved: async () => [],
     resolveRepo: async () => store.getRepos()[0]!,
     selectRepos: () => store.getRepos(),
     scanRepo: async () => ({ ok: true, worktrees: [] }),
-    listKnownHostIds: () => []
+    listKnownHostIds: () => [],
+    ...overrides
   })
 }
 
@@ -105,3 +109,115 @@ describe('RuntimeManagedWorktreeQueries.listDetected', () => {
     expect(legacy.worktrees[0]).not.toHaveProperty('visibilitySource')
   })
 })
+
+describe('RuntimeManagedWorktreeQueries.list host scope', () => {
+  // Measured on hardware before this fix, same runtime and same refusing SSH host in the same
+  // second: the UNSCOPED listing reported `omittedHostIds: ["local","ssh:ssh-scope-refused"]` with
+  // `--host` selectors, while the SCOPED listing reported `{"hostIds":[],"omittedHostIds":[]}`.
+  // A listing that covered nothing, reporting no gaps, is indistinguishable from a repo that
+  // genuinely has no worktrees -- the thing docs/reference/ssh-execution-boundary.md forbids.
+  function sshStore(): RuntimeStore {
+    const repo = folderRepo({
+      id: 'repo-ssh',
+      kind: 'git',
+      connectionId: 'conn-1',
+      path: '/home/dev/app'
+    })
+    return {
+      getRepos: () => [repo],
+      getRepo: () => repo,
+      getAllWorktreeMeta: () => ({}),
+      getWorktreeMeta: () => undefined,
+      setWorktreeMeta: vi.fn(),
+      getAllWorktreeLineage: () => ({}),
+      getSettings: () => settings
+    } as unknown as RuntimeStore
+  }
+
+  it('names the scoped repo host as omitted when the listing covered nothing', async () => {
+    const result = await queries(sshStore()).list('repo-ssh', 50)
+
+    expect(result.totalCount).toBe(0)
+    expect(result.hostScope).toEqual({
+      hostIds: [],
+      omittedHostIds: ['ssh:conn-1']
+    })
+  })
+
+  it('does not report the scoped host as omitted once it contributes rows', async () => {
+    const store = sshStore()
+    const result = await queries(store, {
+      listResolved: async () =>
+        [
+          {
+            id: 'repo-ssh::/home/dev/app',
+            repoId: 'repo-ssh',
+            path: '/home/dev/app',
+            hostId: 'ssh:conn-1'
+          }
+        ] as never
+    }).list('repo-ssh', 50)
+
+    expect(result.hostScope?.hostIds).toEqual(['ssh:conn-1'])
+    expect(result.hostScope?.omittedHostIds).toEqual([])
+  })
+
+  // The caller scoped the listing, so the hosts they excluded must not come back as gaps.
+  it('never names a host the caller scoped out', async () => {
+    const scoped = await queries(sshStore(), {
+      listKnownHostIds: () => ['local', 'ssh:other', 'runtime:elsewhere'] as never
+    }).list('repo-ssh', 50)
+
+    expect(scoped.hostScope?.omittedHostIds).toEqual(['ssh:conn-1'])
+  })
+
+  // `getRepoExecutionHostId` derives the host from two spellings, and a scoped listing that named
+  // the wrong one would be worse than naming none. These pin both.
+  it('names the local host for a scoped local repo', async () => {
+    const repo = folderRepo({ id: 'repo-local', kind: 'git', path: '/workspace/local' })
+    const store = {
+      getRepos: () => [repo],
+      getRepo: () => repo,
+      getAllWorktreeMeta: () => ({}),
+      getWorktreeMeta: () => undefined,
+      setWorktreeMeta: vi.fn(),
+      getAllWorktreeLineage: () => ({}),
+      getSettings: () => settings
+    } as unknown as RuntimeStore
+
+    const result = await queries(store).list('repo-local', 50)
+
+    expect(result.hostScope?.omittedHostIds).toEqual(['local'])
+  })
+
+  it('prefers executionHostId over connectionId for the scoped host', async () => {
+    const repo = folderRepo({
+      id: 'repo-runtime',
+      kind: 'git',
+      connectionId: 'conn-legacy',
+      executionHostId: 'runtime:env-1',
+      path: '/workspace/runtime'
+    })
+    const store = {
+      getRepos: () => [repo],
+      getRepo: () => repo,
+      getAllWorktreeMeta: () => ({}),
+      getWorktreeMeta: () => undefined,
+      setWorktreeMeta: vi.fn(),
+      getAllWorktreeLineage: () => ({}),
+      getSettings: () => settings
+    } as unknown as RuntimeStore
+
+    const result = await queries(store).list('repo-runtime', 50)
+
+    expect(result.hostScope?.omittedHostIds).toEqual(['runtime:env-1'])
+  })
+
+  it('still reports every configured host when the listing is unscoped', async () => {
+    const unscoped = await queries(sshStore(), {
+      listKnownHostIds: () => ['local', 'ssh:conn-1'] as never
+    }).list(undefined, 50)
+
+    expect(unscoped.hostScope?.omittedHostIds).toEqual(['local', 'ssh:conn-1'])
+  })
+})
diff --git a/src/main/runtime/runtime-managed-worktree-queries.ts b/src/main/runtime/runtime-managed-worktree-queries.ts
index 5a5812236af..158ab77cdd0 100644
--- a/src/main/runtime/runtime-managed-worktree-queries.ts
+++ b/src/main/runtime/runtime-managed-worktree-queries.ts
@@ -2,7 +2,7 @@ import type { DetectedWorktreeListResult, Worktree } from '../../shared/worktree
 import type { Repo } from '../../shared/repo-types'
 import type { RuntimeWorktreeListResult } from '../../shared/runtime-types'
 import { getRepoExecutionHostId, type ExecutionHostId } from '../../shared/execution-host'
-import { buildWorktreeListingPage } from './worktree-listing-host-scope'
+import { buildWorktreeListingPage, listingKnownHostIds } from './worktree-listing-host-scope'
 import { readWorktreeMetaForHost } from '../persistence/host-qualified-worktree-meta'
 import { getRepoOwnedWorktreeMeta } from '../worktree-metadata-ownership'
 import type { WorktreeMeta } from '../../shared/worktree/meta-types'
@@ -80,7 +80,7 @@ export class RuntimeManagedWorktreeQueries {
       throw new Error('invalid_limit')
     }
     const resolved = await this.deps.listResolved()
-    const repoId = repoSelector ? (await this.deps.resolveRepo(repoSelector)).id : null
+    const scopedRepo = repoSelector ? await this.deps.resolveRepo(repoSelector) : null
     const pathsByRepo = new Map<string, string[]>()
     for (const worktree of resolved) {
       const paths = pathsByRepo.get(worktree.repoId) ?? []
@@ -100,12 +100,12 @@ export class RuntimeManagedWorktreeQueries {
     )
     const worktrees = resolved.filter(
       (worktree) =>
-        (!repoId || worktree.repoId === repoId) &&
+        (!scopedRepo || worktree.repoId === scopedRepo.id) &&
         this.isVisible(worktree, matchers.get(worktree.repoId), sourceDefaultsSupported)
     )
-    // Why: a `--repo` listing was scoped by the caller, so naming every configured host as
-    // omitted would report a gap the caller deliberately excluded.
-    return buildWorktreeListingPage(worktrees, limit, repoId ? [] : this.deps.listKnownHostIds())
+    // See `listingKnownHostIds`: a scoped listing must still name the host it was asked about.
+    const knownHostIds = listingKnownHostIds(scopedRepo, () => this.deps.listKnownHostIds())
+    return buildWorktreeListingPage(worktrees, limit, knownHostIds)
   }
 
   resolveRepoForConnection(selector: string, connectionId?: string | null): Promise<Repo> {
diff --git a/src/main/runtime/runtime-mobile-file-path-search.test.ts b/src/main/runtime/runtime-mobile-file-path-search.test.ts
index 495a7933842..0be5ecad50e 100644
--- a/src/main/runtime/runtime-mobile-file-path-search.test.ts
+++ b/src/main/runtime/runtime-mobile-file-path-search.test.ts
@@ -6,6 +6,37 @@ import {
 } from './runtime-mobile-file-path-search'
 
 describe('rankRuntimeMobileFilePaths', () => {
+  it('preserves basename matching, ordering and total counts for unusual paths', () => {
+    const paths = [
+      '',
+      '/',
+      'a/',
+      'a//b.ts',
+      'b.ts',
+      'B.TS',
+      'a\\b.ts',
+      '界/😀.ts',
+      '.hidden',
+      'a/./b.ts'
+    ]
+    for (const query of ['', ' ', 'b', '.ts', '😀', '/', 'a\\', 'missing']) {
+      for (const limit of [0, 1, 3, 100]) {
+        const q = query.trim().toLowerCase()
+        const prefix = paths.filter((path) => {
+          const lower = path.toLowerCase()
+          return lower.startsWith(q) || (lower.split('/').pop() ?? lower).startsWith(q)
+        })
+        const other = paths.filter(
+          (path) => !prefix.includes(path) && path.toLowerCase().includes(q)
+        )
+        expect(rankRuntimeMobileFilePaths(paths, query, limit)).toEqual({
+          paths: [...prefix, ...other].slice(0, limit),
+          totalCount: prefix.length + other.length
+        })
+      }
+    }
+  })
+
   it('ranks path and basename prefixes before substrings and caps output', () => {
     expect(
       rankRuntimeMobileFilePaths(
diff --git a/src/main/runtime/runtime-mobile-file-path-search.ts b/src/main/runtime/runtime-mobile-file-path-search.ts
index 13213d6dfcf..1455028c798 100644
--- a/src/main/runtime/runtime-mobile-file-path-search.ts
+++ b/src/main/runtime/runtime-mobile-file-path-search.ts
@@ -76,7 +76,7 @@ export function rankRuntimeMobileFilePaths(
   let totalCount = 0
   for (const path of paths) {
     const lower = path.toLowerCase()
-    const basename = lower.split('/').pop() ?? lower
+    const basename = lower.slice(lower.lastIndexOf('/') + 1)
     if (lower.startsWith(normalizedQuery) || basename.startsWith(normalizedQuery)) {
       totalCount++
       if (prefix.length < limit) {
diff --git a/src/main/runtime/runtime-pty-controller-contract.ts b/src/main/runtime/runtime-pty-controller-contract.ts
index 194d0bb665c..665c6fdb609 100644
--- a/src/main/runtime/runtime-pty-controller-contract.ts
+++ b/src/main/runtime/runtime-pty-controller-contract.ts
@@ -109,7 +109,7 @@ export type RuntimePtyController = {
   getForegroundProcess(ptyId: string): Promise<string | null>
   inspectProcess?(
     ptyId: string,
-    options?: { expectedIncarnationId?: PtyIncarnationId }
+    options?: { expectedIncarnationId?: PtyIncarnationId; scanChildProcesses?: boolean }
   ): Promise<PtyProcessInspection>
   confirmForegroundProcess?(ptyId: string): Promise<string | null>
   confirmShellForeground?(ptyId: string): Promise<boolean>
diff --git a/src/main/runtime/runtime-remote-fetch-controller.ts b/src/main/runtime/runtime-remote-fetch-controller.ts
index b3b9df5dcba..dbcc240525b 100644
--- a/src/main/runtime/runtime-remote-fetch-controller.ts
+++ b/src/main/runtime/runtime-remote-fetch-controller.ts
@@ -226,6 +226,14 @@ export class RuntimeRemoteFetchController {
     baseBranch: string,
     gitOptions: GitOptions = {}
   ): Promise<RemoteTrackingBase | null> {
+    const remoteRefPrefix = 'refs/remotes/'
+    const shortBaseBranch = baseBranch.startsWith(remoteRefPrefix)
+      ? baseBranch.slice(remoteRefPrefix.length)
+      : baseBranch
+    // A remote-tracking base needs both a configured remote and a branch component.
+    if (shortBaseBranch.indexOf('/') <= 0 || shortBaseBranch.endsWith('/')) {
+      return null
+    }
     let remotes: string[]
     try {
       const { stdout } = await gitExecFileAsync(['remote'], { cwd: repoPath, ...gitOptions })
@@ -236,10 +244,6 @@ export class RuntimeRemoteFetchController {
     } catch {
       return null
     }
-    const remoteRefPrefix = 'refs/remotes/'
-    const shortBaseBranch = baseBranch.startsWith(remoteRefPrefix)
-      ? baseBranch.slice(remoteRefPrefix.length)
-      : baseBranch
     const remote = remotes
       .filter((candidate) => shortBaseBranch.startsWith(`${candidate}/`))
       .sort((a, b) => b.length - a.length)[0]
diff --git a/src/main/runtime/runtime-rpc/runtime-rpc-mobile-method-allowlist.ts b/src/main/runtime/runtime-rpc/runtime-rpc-mobile-method-allowlist.ts
index 767ca885234..05666add0bc 100644
--- a/src/main/runtime/runtime-rpc/runtime-rpc-mobile-method-allowlist.ts
+++ b/src/main/runtime/runtime-rpc/runtime-rpc-mobile-method-allowlist.ts
@@ -205,6 +205,7 @@ export const MOBILE_RPC_METHOD_ALLOWLIST = new Set([
   'agentSession.createSupport',
   'agentSession.create',
   'agentSession.ensure',
+  'agentSession.reveal',
   'agentSession.send',
   'agentSession.cancel',
   'agentSession.close',
diff --git a/src/main/runtime/runtime-search-line-fragments.test.ts b/src/main/runtime/runtime-search-line-fragments.test.ts
new file mode 100644
index 00000000000..17c873efdd8
--- /dev/null
+++ b/src/main/runtime/runtime-search-line-fragments.test.ts
@@ -0,0 +1,120 @@
+import { describe, expect, it, vi } from 'vitest'
+import { EventEmitter } from 'node:events'
+import {
+  checkRgAvailableMock,
+  resolveAuthorizedPathMock,
+  wslAwareSpawnMock
+} from './orca-runtime-files-mock-registry'
+import {
+  createRuntimeFileCommands,
+  useRuntimeFileCommandsLifecycle
+} from './orca-runtime-files-test-harness'
+
+vi.mock('fs', async () => (await import('./orca-runtime-files-mock-registry')).fsModuleMock())
+vi.mock('fs/promises', async () =>
+  (await import('./orca-runtime-files-mock-registry')).fsPromisesModuleMock()
+)
+vi.mock(
+  './file-watcher-host',
+  async () => (await import('./orca-runtime-files-mock-registry')).fileWatcherHostMock
+)
+vi.mock('../ipc/filesystem-auth', async () =>
+  (await import('./orca-runtime-files-mock-registry')).filesystemAuthModuleMock()
+)
+vi.mock('../git/runner', async () =>
+  (await import('./orca-runtime-files-mock-registry')).gitRunnerModuleMock()
+)
+vi.mock(
+  '../ipc/rg-availability',
+  async () => (await import('./orca-runtime-files-mock-registry')).rgAvailabilityMock
+)
+vi.mock(
+  '../ipc/local-worktree-runtime-options',
+  async () => (await import('./orca-runtime-files-mock-registry')).localWorktreeRuntimeOptionsMock
+)
+vi.mock(
+  '../ipc/filesystem-search-git',
+  async () => (await import('./orca-runtime-files-mock-registry')).filesystemSearchGitMock
+)
+vi.mock(
+  '../providers/ssh-filesystem-dispatch',
+  async () => (await import('./orca-runtime-files-mock-registry')).sshFilesystemDispatchMock
+)
+
+type MockRuntimeSearchChild = EventEmitter & {
+  stdout: EventEmitter & { setEncoding: ReturnType<typeof vi.fn> }
+  stderr: EventEmitter
+  kill: ReturnType<typeof vi.fn>
+}
+
+function createRuntimeSearchChild(): MockRuntimeSearchChild {
+  const child = new EventEmitter() as MockRuntimeSearchChild
+  child.stdout = new EventEmitter() as MockRuntimeSearchChild['stdout']
+  child.stdout.setEncoding = vi.fn()
+  child.stderr = new EventEmitter()
+  child.kill = vi.fn()
+  return child
+}
+
+async function flushRuntimeSearchMicrotasks(): Promise<void> {
+  for (let index = 0; index < 8; index++) {
+    await Promise.resolve()
+  }
+}
+
+describe('RuntimeFileCommands', () => {
+  useRuntimeFileCommandsLifecycle()
+
+  it('assembles a fragmented runtime search record without rescanning the carry', async () => {
+    const { commands } = createRuntimeFileCommands({
+      resolveRuntimeFileTarget: vi.fn(async () => ({
+        worktree: { id: 'wt-1', repoId: 'repo-1', path: '/repo' },
+        executionHostId: 'local'
+      }))
+    })
+    const child = createRuntimeSearchChild()
+    resolveAuthorizedPathMock.mockResolvedValue('/repo')
+    checkRgAvailableMock.mockResolvedValue(true)
+    wslAwareSpawnMock.mockReturnValue(child)
+    const resultPromise = commands.searchRuntimeFiles('id:wt-1', {
+      query: 'needle',
+      maxResults: 10
+    })
+    await flushRuntimeSearchMicrotasks()
+    const line = JSON.stringify({
+      type: 'match',
+      data: {
+        path: { text: '/repo/file.ts' },
+        line_number: 1,
+        lines: { text: `needle🐋${'x'.repeat(128 * 1024)}` },
+        submatches: [{ start: 0, end: 6 }]
+      }
+    })
+    const originalSplit = String.prototype.split
+    let scanned = 0
+    const spy = vi.spyOn(String.prototype, 'split').mockImplementation(function (
+      this: string,
+      separator: unknown,
+      limit?: number
+    ) {
+      if (separator === '\n') {
+        scanned += this.length
+      }
+      return Reflect.apply(originalSplit, this, [separator, limit])
+    })
+    try {
+      for (let offset = 0; offset < line.length; offset += 1024) {
+        child.stdout.emit('data', line.slice(offset, offset + 1024))
+      }
+      child.emit('close', 0, null)
+    } finally {
+      spy.mockRestore()
+    }
+    const result = await resultPromise
+    expect(result.totalMatches).toBe(1)
+    expect(result.files[0].filePath).toBe('/repo/file.ts')
+    expect(result.files[0].matches[0].lineContent).toContain('needle🐋')
+    expect(scanned).toBeLessThanOrEqual(line.length * 2)
+    expect(child.stdout.listenerCount('data')).toBe(0)
+  })
+})
diff --git a/src/main/runtime/structured-agent-session-integration-replay.test.ts b/src/main/runtime/structured-agent-session-integration-replay.test.ts
index 7bc5e66dc45..e5baa032341 100644
--- a/src/main/runtime/structured-agent-session-integration-replay.test.ts
+++ b/src/main/runtime/structured-agent-session-integration-replay.test.ts
@@ -21,7 +21,7 @@ import { STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY } from '../../shared/protoc
 import type { AgentJournalRenderItem } from '../../shared/agent-session-journal-types'
 import { attachFingerprintFields } from '../native-chat/agent-session-wire/structured-agent-session-attach'
 import { journalDirectoryFor } from '../native-chat/agent-session-journal/journal-paths'
-import { openAgentSessionJournal } from '../native-chat/agent-session-journal/journal-store-factory'
+import { createTrackedJournalOpener } from '../native-chat/agent-session-journal/journal-store-test-open'
 import type { OrcaRuntimeService } from './orca-runtime'
 import type { RpcRequest, RpcResponse } from './rpc/core'
 import { RpcDispatcher } from './rpc/dispatcher'
@@ -31,6 +31,8 @@ import {
   stopStructuredAgentSessionRuntime
 } from './structured-agent-session-runtime'
 
+const journals = createTrackedJournalOpener()
+
 const SESSION = 'session-integration-1'
 const THREAD = 'thread-integration'
 const TURN = 'turn-1'
@@ -257,6 +259,7 @@ beforeEach(async () => {
         claimKeyId: 'key-1',
         resolveWorkspacePath: async (workspaceId) => `/repos/${workspaceId}`,
         resolveCodexCommand: () => '/usr/local/bin/codex',
+        resolveClaudeAuthPolicy: () => ({ stripAuthEnv: true }),
         resolveEnvironment: async () => {
           bootEnvironmentReads += 1
           return {
@@ -285,6 +288,7 @@ beforeEach(async () => {
 })
 
 afterEach(async () => {
+  await journals.closeAll()
   await stopStructuredAgentSessionRuntime()
   await rm(root, { recursive: true, force: true })
 })
@@ -317,6 +321,7 @@ describe('a structured codex session over agentSession.*', () => {
       claimKeyId: 'key-1',
       resolveWorkspacePath: async (workspaceId) => `/repos/${workspaceId}`,
       resolveCodexCommand: () => '/usr/local/bin/codex',
+      resolveClaudeAuthPolicy: () => ({ stripAuthEnv: true }),
       openCodexConnection: codex.openConnection,
       readProcessStartTime: async () => 1_700_000_000_000
     })
@@ -364,7 +369,7 @@ describe('a structured codex session over agentSession.*', () => {
       agent: 'codex' as const,
       providerHandle: { kind: 'codex' as const, threadId: THREAD }
     }
-    const reopened = await openAgentSessionJournal({
+    const reopened = await journals.open({
       identity,
       journalDir: journalDirectoryFor(root, identity)
     })
diff --git a/src/main/runtime/structured-agent-session-integration.test.ts b/src/main/runtime/structured-agent-session-integration.test.ts
index 582bd225b40..2982a6530b2 100644
--- a/src/main/runtime/structured-agent-session-integration.test.ts
+++ b/src/main/runtime/structured-agent-session-integration.test.ts
@@ -25,10 +25,9 @@ import type {
 import { attachFingerprintFields } from '../native-chat/agent-session-wire/structured-agent-session-attach'
 import { getStructuredAgentSessionHost } from '../native-chat/agent-session-wire/structured-agent-session-registry'
 import { journalDirectoryFor } from '../native-chat/agent-session-journal/journal-paths'
-import { readJournalBlob } from '../native-chat/agent-session-journal/journal-blob-store'
 import { appendLegacyTranscriptMessages } from '../native-chat/agent-session-journal/journal-legacy-import'
 import type { AgentSessionJournal } from '../native-chat/agent-session-journal/journal-store'
-import { openAgentSessionJournal } from '../native-chat/agent-session-journal/journal-store-factory'
+import { createTrackedJournalOpener } from '../native-chat/agent-session-journal/journal-store-test-open'
 import type { OrcaRuntimeService } from './orca-runtime'
 import type { RpcRequest, RpcResponse } from './rpc/core'
 import { RpcDispatcher } from './rpc/dispatcher'
@@ -38,6 +37,8 @@ import {
   stopStructuredAgentSessionRuntime
 } from './structured-agent-session-runtime'
 
+const journals = createTrackedJournalOpener()
+
 const SESSION = 'session-integration-1'
 const THREAD = 'thread-integration'
 const TURN = 'turn-1'
@@ -306,6 +307,7 @@ beforeEach(async () => {
         claimKeyId: 'key-1',
         resolveWorkspacePath: async (workspaceId) => `/repos/${workspaceId}`,
         resolveCodexCommand: () => '/usr/local/bin/codex',
+        resolveClaudeAuthPolicy: () => ({ stripAuthEnv: true }),
         resolveEnvironment: async () => {
           bootEnvironmentReads += 1
           return {
@@ -363,6 +365,7 @@ function cursorOf(frames: AgentSessionSubscribeEvent[]): { epoch: string; sequen
 }
 
 afterEach(async () => {
+  await journals.closeAll()
   await stopStructuredAgentSessionRuntime()
   await rm(root, { recursive: true, force: true })
 })
@@ -376,7 +379,7 @@ describe('a structured codex session over agentSession.*', () => {
       agent: 'codex' as const,
       providerHandle: { kind: 'codex' as const, threadId: THREAD }
     }
-    const journal = await openAgentSessionJournal({
+    const journal = await journals.open({
       identity,
       journalDir: journalDirectoryFor(root, identity)
     })
@@ -761,7 +764,7 @@ describe('a structured codex session over agentSession.*', () => {
       agent: 'codex' as const,
       providerHandle: { kind: 'codex' as const, threadId: THREAD }
     }
-    const reopened = await openAgentSessionJournal({
+    const reopened = await journals.open({
       identity,
       journalDir: journalDirectoryFor(root, identity)
     })
@@ -800,7 +803,6 @@ describe('a structured codex session over agentSession.*', () => {
     const item = journal.snapshot().items.find((candidate) => candidate.body?.kind === 'tool-call')
     const bounded = item?.body?.kind === 'tool-call' ? item.body.output : undefined
     expect(bounded).toMatchObject({ truncated: true, byteLength: Buffer.byteLength(output) })
-    expect(await readJournalBlob(journal.directory, bounded?.digest ?? '')).toBe(output)
   })
 
   it('keeps an answered prompt resolved after the provider exits', async () => {
diff --git a/src/main/runtime/structured-agent-session-owner-probe.ts b/src/main/runtime/structured-agent-session-owner-probe.ts
new file mode 100644
index 00000000000..47f92a08ca6
--- /dev/null
+++ b/src/main/runtime/structured-agent-session-owner-probe.ts
@@ -0,0 +1,108 @@
+import type { AgentSessionOwnerProbe } from '../../shared/agent-session-lease-adjudication'
+import type { AgentSessionRecord } from '../../shared/agent-session-record'
+import {
+  probeAgentSessionProcessIdentities,
+  probeAgentSessionProcessIdentity,
+  probeAgentSessionReservation
+} from './agent-session-process-identity-probe'
+import { findAgentSessionSpawnTokenProcesses } from './agent-session-spawn-token-process-scan'
+import { readEchoedAgentSessionSpawnToken } from './agent-session-spawn-token-readback'
+
+/**
+ * The lease's only source of truth about a previous owner. Everything it cannot
+ * answer PID-reuse-safely reports `indeterminate`. An exact owner stays fenced in `recovering`;
+ * an ownerless, unattributable reservation enters `manual-recovery`.
+ */
+export function createStructuredAgentSessionOwnerProbe(
+  hostId: string,
+  probe = probeAgentSessionProcessIdentity,
+  findSpawnTokenProcesses = findAgentSessionSpawnTokenProcesses
+): (record: AgentSessionRecord) => Promise<AgentSessionOwnerProbe> {
+  return async (record) => {
+    const owner = record.lease.ownerProcess
+    if (!owner) {
+      if (record.lease.processlessAt !== undefined && record.lease.processlessAt !== null) {
+        return { outcome: 'reservation-unused' }
+      }
+      const spawnToken = record.lease.reservedSpawnToken
+      if (spawnToken === null) {
+        if (record.lease.claimStatus === 'reserved') {
+          return {
+            outcome: 'indeterminate',
+            reason: 'reservation recorded no spawn token to scan for'
+          }
+        }
+        // The token is minted before the child and is the only thing a child could be carrying.
+        // No owner and no token means nothing on any host can be holding this lease — answering
+        // `indeterminate` here is what latches an already-free record into recovery forever.
+        return { outcome: 'reservation-unused' }
+      }
+      // Freeing a reservation needs positive proof that nothing spawned under its token. The scan
+      // answers null where the platform cannot read another process's environment.
+      return probeAgentSessionReservation({
+        spawnToken,
+        findProcessesWithSpawnToken: (token) => findSpawnTokenProcesses(token),
+        hasProviderActivitySinceReservation: async () =>
+          agentSessionReservationTouchedProvider(record)
+      })
+    }
+    if (owner.hostId !== hostId) {
+      // Checking a remote host's pid against this machine's process table is
+      // exactly how a live owner gets declared dead.
+      return {
+        outcome: 'indeterminate',
+        reason: `owner runs on ${owner.hostId}, which this host cannot probe`
+      }
+    }
+    // The env read-back answers on hosts that expose it and null elsewhere, giving the
+    // probe a PID-reuse-safe element even when no start time was recorded.
+    return probe({
+      identity: owner,
+      deps: { readEchoedSpawnToken: readEchoedAgentSessionSpawnToken }
+    })
+  }
+}
+
+export function createStructuredAgentSessionOwnerProbes(
+  hostId: string,
+  probeMany: typeof probeAgentSessionProcessIdentities = probeAgentSessionProcessIdentities,
+  probeOne = createStructuredAgentSessionOwnerProbe(hostId)
+): (records: readonly AgentSessionRecord[]) => Promise<Map<string, AgentSessionOwnerProbe>> {
+  return async (records) => {
+    const results = new Map<string, AgentSessionOwnerProbe>()
+    const localOwners: {
+      record: AgentSessionRecord
+      owner: NonNullable<AgentSessionRecord['lease']['ownerProcess']>
+    }[] = []
+    for (const record of records) {
+      const owner = record.lease.ownerProcess
+      if (owner?.hostId === hostId) {
+        localOwners.push({ record, owner })
+      } else {
+        results.set(record.sessionId, await probeOne(record))
+      }
+    }
+    const probes = await probeMany({
+      identities: localOwners.map(({ owner }) => owner),
+      deps: { readEchoedSpawnToken: readEchoedAgentSessionSpawnToken }
+    })
+    for (const [index, { record }] of localOwners.entries()) {
+      results.set(
+        record.sessionId,
+        probes[index] ?? { outcome: 'indeterminate', reason: 'owner probe returned no result' }
+      )
+    }
+    return results
+  }
+}
+
+/**
+ * The only provider-side trace a reservation can leave in its own record: a handle link minted at
+ * this fence. `proveAgentSessionOwner` refuses to append one before an identity is committed, so a
+ * link at the reservation's fence means a child got far enough to resume the provider thread. It
+ * cannot see activity the child produced without proving a handle, which is why it is paired with
+ * the token scan rather than trusted alone.
+ */
+function agentSessionReservationTouchedProvider(record: AgentSessionRecord): boolean {
+  return record.providerHandleChain.at(-1)?.mintedAtFence === record.lease.runtimeFence
+}
diff --git a/src/main/runtime/structured-agent-session-runtime-exit.test.ts b/src/main/runtime/structured-agent-session-runtime-exit.test.ts
index a8419176357..5c6e43c2bc0 100644
--- a/src/main/runtime/structured-agent-session-runtime-exit.test.ts
+++ b/src/main/runtime/structured-agent-session-runtime-exit.test.ts
@@ -84,6 +84,7 @@ describe('structured session runtime provider-exit wiring', () => {
       hostId: 'local',
       claimKeyId: 'key-1',
       resolveWorkspacePath: async () => root!,
+      resolveClaudeAuthPolicy: () => ({ stripAuthEnv: true }),
       resolveCodexCommand: () => 'codex',
       resolveEnvironment: async () => ({ PATH: process.env.PATH }),
       openCodexConnection: openConnection,
@@ -180,6 +181,7 @@ describe('structured session runtime provider-exit wiring', () => {
       hostId: 'local',
       claimKeyId: 'key-1',
       resolveWorkspacePath: async () => root!,
+      resolveClaudeAuthPolicy: () => ({ stripAuthEnv: true }),
       resolveCodexCommand: () => 'codex',
       resolveEnvironment: async () => ({ PATH: process.env.PATH }),
       openCodexConnection: openConnection,
@@ -260,6 +262,7 @@ describe('structured session runtime provider-exit wiring', () => {
       hostId: 'local',
       claimKeyId: 'key-1',
       resolveWorkspacePath: async () => root!,
+      resolveClaudeAuthPolicy: () => ({ stripAuthEnv: true }),
       resolveCodexCommand: () => 'codex',
       resolveEnvironment: async () => ({ PATH: process.env.PATH }),
       openCodexConnection: openConnection,
diff --git a/src/main/runtime/structured-agent-session-runtime.test.ts b/src/main/runtime/structured-agent-session-runtime.test.ts
index 6adf5d368fd..3b69a0a4be3 100644
--- a/src/main/runtime/structured-agent-session-runtime.test.ts
+++ b/src/main/runtime/structured-agent-session-runtime.test.ts
@@ -2,6 +2,10 @@ import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { AgentSessionJournalIdentity } from '../../shared/agent-session-journal-types'
+import { agentSessionJournalCloseRetries } from '../native-chat/agent-session-journal/journal-close-retry'
+import { createTrackedJournalOpener } from '../native-chat/agent-session-journal/journal-store-test-open'
+import type { AgentSessionJournal } from '../native-chat/agent-session-journal/journal-store'
 import type {
   AgentSessionClaimStatus,
   AgentSessionProcessIdentity,
@@ -9,7 +13,9 @@ import type {
 } from '../../shared/agent-session-record'
 import {
   createStructuredAgentSessionOwnerProbe,
-  createStructuredAgentSessionOwnerProbes,
+  createStructuredAgentSessionOwnerProbes
+} from './structured-agent-session-owner-probe'
+import {
   ensureStructuredAgentSessionHost,
   hasPersistedStructuredAgentSessionStore,
   stopStructuredAgentSessionRuntime
@@ -222,6 +228,7 @@ describe('structured agent-session runtime install', () => {
         hostId: HOST_ID,
         claimKeyId: 'key-1',
         resolveWorkspacePath: async () => stateDirectory!,
+        resolveClaudeAuthPolicy: () => ({ stripAuthEnv: true }),
         resolveEnvironment: async () => ({}),
         reapOrphanChildren,
         onError
@@ -248,6 +255,7 @@ describe('structured agent-session runtime install', () => {
         hostId: HOST_ID,
         claimKeyId: 'key-1',
         resolveWorkspacePath: async () => stateDirectory!,
+        resolveClaudeAuthPolicy: () => ({ stripAuthEnv: true }),
         resolveEnvironment: async () => ({}),
         reapOrphanChildren: async () => {
           throw failure
@@ -263,3 +271,69 @@ describe('structured agent-session runtime install', () => {
     )
   })
 })
+
+// A stop whose teardown fails must not forget the runtime it was tearing down.
+// `installing` is cleared either way so nothing new attaches, but the host keeps
+// every journal whose close rejected, and this module slot is the only handle
+// onto that host once it is gone.
+describe('a teardown that fails is retried by the next stop', () => {
+  const JOURNAL_IDENTITY: AgentSessionJournalIdentity = {
+    sessionId: 'session-teardown-retry',
+    workspaceId: 'ws-1',
+    hostId: HOST_ID,
+    agent: 'codex',
+    providerHandle: { kind: 'codex', threadId: 'thread-1' }
+  }
+  const journals = createTrackedJournalOpener()
+  let directory: string | null = null
+
+  afterEach(async () => {
+    await agentSessionJournalCloseRetries.retryAll()
+    await journals.closeAll()
+    await stopStructuredAgentSessionRuntime().catch(() => undefined)
+    if (directory) {
+      await rm(directory, { recursive: true, force: true })
+      directory = null
+    }
+  })
+
+  it('reports the failure, then releases the handle on the following stop', async () => {
+    directory = await mkdtemp(join(tmpdir(), 'orca-structured-runtime-'))
+    await ensureStructuredAgentSessionHost({
+      stateDirectory: directory,
+      hostId: HOST_ID,
+      claimKeyId: 'key-1',
+      resolveWorkspacePath: async () => directory!,
+      resolveEnvironment: async () => ({}),
+      reapOrphanChildren: async () => [],
+      resolveClaudeAuthPolicy: () => ({ stripAuthEnv: true })
+    })
+
+    const journalDir = join(directory, 'stubborn-journal')
+    const real = await journals.open({ identity: JOURNAL_IDENTITY, journalDir })
+    let closeFailures = 2
+    const flaky = new Proxy(real, {
+      get(target, property, receiver) {
+        if (property !== 'close') {
+          return Reflect.get(target, property, receiver)
+        }
+        return async () => {
+          if (closeFailures > 0) {
+            closeFailures -= 1
+            throw new Error('close rejected')
+          }
+          await target.close()
+        }
+      }
+    }) as AgentSessionJournal
+    await agentSessionJournalCloseRetries.closeOrRetain(flaky)
+
+    // The host's teardown runs the registry retry, so this stop surfaces it.
+    await expect(stopStructuredAgentSessionRuntime()).rejects.toThrow()
+    expect(agentSessionJournalCloseRetries.pendingDirectories).toEqual([journalDir])
+
+    // The retained runtime is what makes this a retry rather than a no-op.
+    await stopStructuredAgentSessionRuntime()
+    expect(agentSessionJournalCloseRetries.pendingDirectories).toEqual([])
+  })
+})
diff --git a/src/main/runtime/structured-agent-session-runtime.ts b/src/main/runtime/structured-agent-session-runtime.ts
index ce916bc6769..d670c16f47d 100644
--- a/src/main/runtime/structured-agent-session-runtime.ts
+++ b/src/main/runtime/structured-agent-session-runtime.ts
@@ -9,29 +9,33 @@
 
 import { existsSync } from 'node:fs'
 import { join } from 'node:path'
-import type { AgentSessionOwnerProbe } from '../../shared/agent-session-lease-adjudication'
 import type { AgentSessionRecord } from '../../shared/agent-session-record'
 import { createCodexStructuredLaunchResolver } from '../codex/codex-structured-launch-resolution'
 import {
   CodexStructuredSessionAdapter,
   type CodexStructuredSessionAdapterDeps
 } from '../codex/codex-structured-session-adapter'
+import type { ClaudeStructuredSessionAdapterDeps } from '../claude/claude-structured-session-adapter'
 import { StructuredAgentSessionHost } from '../native-chat/agent-session-wire/structured-agent-session-host'
+import { StructuredAgentSessionAdapterRouter } from '../native-chat/agent-session-wire/structured-agent-session-adapter-router'
 import type { StructuredAgentSessionHandoffTransport } from '../native-chat/agent-session-wire/structured-agent-session-handoff-types'
 import { setStructuredAgentSessionHost } from '../native-chat/agent-session-wire/structured-agent-session-registry'
+import {
+  readClaudeManagedAccountGateSettings,
+  type ClaudeManagedAccountGateSettings
+} from '../native-chat/claude-structured-managed-account-support'
 import { AgentSessionRecordStore } from './agent-session-record-store'
 import { agentSessionStorePath } from './agent-session-record-store-file'
 import { stopOrphanAgentSessionChildren } from './agent-session-orphan-child-reaper'
 import {
-  probeAgentSessionProcessIdentities,
-  probeAgentSessionProcessIdentity,
-  probeAgentSessionReservation
-} from './agent-session-process-identity-probe'
-import { findAgentSessionSpawnTokenProcesses } from './agent-session-spawn-token-process-scan'
-import { readEchoedAgentSessionSpawnToken } from './agent-session-spawn-token-readback'
+  createStructuredAgentSessionOwnerProbe,
+  createStructuredAgentSessionOwnerProbes
+} from './structured-agent-session-owner-probe'
 import { agentSessionPtyWriteGate } from './agent-session-pty-write-gate'
 import { resolveLoginShellEnvironment } from '../startup/login-shell-environment'
 import { recordAgentSessionProviderHandle } from './agent-session-provider-handle-transition'
+import type { ClaudeStructuredAuthPolicy } from '../claude-accounts/claude-structured-auth-policy'
+import { createStructuredClaudeRuntimeAdapter } from './structured-claude-runtime-adapter'
 
 /** Sibling of the journal tree rather than inside it: one file adjudicates every
  *  session's lease, while a journal is per session. */
@@ -55,13 +59,20 @@ export type StructuredAgentSessionRuntimeDeps = {
   claimKeyId: string
   resolveWorkspacePath: (workspaceId: string) => Promise<string>
   resolveCodexCommand?: (options?: { pathEnv?: string | null; homePath?: string }) => string
+  resolveClaudeCommand?: () => string
   /** Provider transports are overridden only to drive the runtime against scripted children. */
   openCodexConnection?: CodexStructuredSessionAdapterDeps['openConnection']
+  openClaudeConnection?: ClaudeStructuredSessionAdapterDeps['openConnection']
   /** Scripted app-servers carry fake pids the real start-time read cannot answer for. */
   readProcessStartTime?: CodexStructuredSessionAdapterDeps['readProcessStartTime']
   resolveLaunchArgs?: (provider: AgentSessionRecord['provider']) => Promise<string[]> | string[]
   resolveLaunchEnv?: () => Promise<NodeJS.ProcessEnv>
   resolveLaunchEnvOverlay?: () => Promise<Record<string, string>> | Record<string, string>
+  resolveClaudeLaunchEnv?: () => Promise<Record<string, string>> | Record<string, string>
+  /** Required, and asserted at install time — an absent policy must not degrade to a guess. */
+  resolveClaudeAuthPolicy: () => Promise<ClaudeStructuredAuthPolicy> | ClaudeStructuredAuthPolicy
+  /** Raw settings getter; the reader that fails closed around it is built here, in checked code. */
+  getClaudeManagedAccountGateSettings?: () => ClaudeManagedAccountGateSettings
   resolveEnvironment?: () => Promise<NodeJS.ProcessEnv>
   resolveCodexOverrides?: () => NodeJS.ProcessEnv
   onError?: (input: { scope: string; error: unknown }) => void
@@ -71,13 +82,27 @@ export type StructuredAgentSessionRuntimeDeps = {
 
 type InstalledRuntime = {
   host: StructuredAgentSessionHost
-  adapter: CodexStructuredSessionAdapter
-  /** Resolves after every adapter-exit recovery callback has settled. */
+  adapter: { closeAll(): Promise<void> }
+  /** Resolves after every observed adapter exit has published, and every
+   *  recovery callback it raised has settled. */
   waitForRecovery: () => Promise<void>
 }
 
 let installing: Promise<InstalledRuntime> | null = null
 
+/** Thrown when the host is installed without a Claude auth policy resolver. */
+export const CLAUDE_STRUCTURED_AUTH_POLICY_REQUIRED =
+  'structured agent-session host requires a Claude auth policy resolver'
+
+/**
+ * Runtimes whose teardown did not finish. `installing` is cleared regardless so
+ * nothing new attaches, but dropping the runtime as well would strand every
+ * journal the host retained for a retry: `tearDownStructuredAgentSessionHost`
+ * deliberately keeps a failed close indexed, and only a later stop through this
+ * same runtime can reach those entries again.
+ */
+const pendingTeardown = new Set<InstalledRuntime>()
+
 export function ensureStructuredAgentSessionHost(
   deps: StructuredAgentSessionRuntimeDeps
 ): Promise<StructuredAgentSessionHost> {
@@ -89,20 +114,52 @@ export function ensureStructuredAgentSessionHost(
   return installing.then((installed) => installed.host)
 }
 
+/** Resolves once every provider exit observed so far has been published by its
+ *  adapter and reconciled by the host. Nothing is installed, nothing to wait on.
+ *
+ *  This is the only handle onto that barrier: reconciliation is driven by exit
+ *  callbacks, so a caller that needs the settled lease — rather than the one the
+ *  exit is still being reconciled out of — has no other way to know it landed. */
+export async function waitForStructuredAgentSessionRecovery(): Promise<void> {
+  const installed = await installing?.catch(() => null)
+  await installed?.waitForRecovery()
+}
+
 /** Drops the host and reaps every Codex child under it. Runtime teardown and
- *  test isolation take the same path, so neither can leave a live app-server. */
+ *  test isolation take the same path, so neither can leave a live app-server.
+ *
+ *  A teardown that fails is RETRIED by the next stop rather than forgotten: the
+ *  host keeps every journal whose close rejected, and this is the only handle
+ *  onto that host once the module slot is cleared. */
 export async function stopStructuredAgentSessionRuntime(): Promise<void> {
   const pending = installing
   installing = null
   setStructuredAgentSessionHost(null)
   agentSessionPtyWriteGate.detachRecordLookup()
-  if (!pending) {
-    return
+  const outstanding = [...pendingTeardown]
+  pendingTeardown.clear()
+  const installed = pending ? await pending.catch(() => null) : null
+  if (installed) {
+    outstanding.push(installed)
   }
-  const installed = await pending.catch(() => null)
-  if (!installed) {
-    return
+  const failures: unknown[] = []
+  for (const runtime of outstanding) {
+    try {
+      await tearDownRuntime(runtime)
+    } catch (error) {
+      pendingTeardown.add(runtime)
+      failures.push(error)
+    }
   }
+  if (failures.length === 1) {
+    throw failures[0]
+  }
+  if (failures.length > 1) {
+    throw new AggregateError(failures, 'structured agent-session runtime teardown failed')
+  }
+}
+
+async function tearDownRuntime(installed: InstalledRuntime): Promise<void> {
   // Drain an in-flight recovery before stopping children; recovery may still
   // be writing lifecycle rows or acquiring a replacement child.
   await installed.waitForRecovery()
@@ -117,8 +174,14 @@ export async function stopStructuredAgentSessionRuntime(): Promise<void> {
 }
 
 async function install(deps: StructuredAgentSessionRuntimeDeps): Promise<InstalledRuntime> {
+  // Why thrown rather than defaulted: the caller is `@ts-nocheck`, so a dropped
+  // field arrives here as `undefined`. Refusing to install is loud; guessing a
+  // policy is the silent under-strip this assertion exists to prevent.
+  if (typeof deps.resolveClaudeAuthPolicy !== 'function') {
+    throw new Error(CLAUDE_STRUCTURED_AUTH_POLICY_REQUIRED)
+  }
   const bootEnvironment = (deps.resolveEnvironment ?? resolveLoginShellEnvironment)()
-  const resolveEnvironment = async (): Promise<NodeJS.ProcessEnv> => ({
+  const resolveCodexEnvironment = async (): Promise<NodeJS.ProcessEnv> => ({
     ...(await bootEnvironment),
     ...(await deps.resolveLaunchEnv?.()),
     ...(await deps.resolveLaunchEnvOverlay?.()),
@@ -151,7 +214,7 @@ async function install(deps: StructuredAgentSessionRuntimeDeps): Promise<Install
       resolveLaunch: createCodexStructuredLaunchResolver({
         store,
         resolveWorkspacePath: deps.resolveWorkspacePath,
-        resolveEnvironment,
+        resolveEnvironment: resolveCodexEnvironment,
         ...(deps.resolveCodexCommand ? { resolveCommand: deps.resolveCodexCommand } : {})
       }),
       ...(deps.openCodexConnection ? { openConnection: deps.openCodexConnection } : {}),
@@ -172,7 +235,37 @@ async function install(deps: StructuredAgentSessionRuntimeDeps): Promise<Install
         })
       }
     })
-    const adapter = codex
+    const claude = createStructuredClaudeRuntimeAdapter({
+      store,
+      resolveWorkspacePath: deps.resolveWorkspacePath,
+      ...(deps.resolveClaudeCommand ? { resolveClaudeCommand: deps.resolveClaudeCommand } : {}),
+      ...(deps.resolveClaudeLaunchEnv
+        ? { resolveClaudeLaunchEnv: deps.resolveClaudeLaunchEnv }
+        : {}),
+      resolveClaudeAuthPolicy: deps.resolveClaudeAuthPolicy,
+      ...(deps.getClaudeManagedAccountGateSettings
+        ? {
+            readClaudeManagedAccountGate: () =>
+              readClaudeManagedAccountGateSettings(deps.getClaudeManagedAccountGateSettings!)
+          }
+        : {}),
+      onUnexpectedExit: (event) => {
+        recoveryChain = recoveryChain.then(async () => {
+          try {
+            await host?.handleAdapterEvent(event)
+          } catch (error) {
+            deps.onError?.({ scope: `structured-agent-session-exit:${event.sessionId}`, error })
+          }
+        })
+      },
+      onBackgroundTasksChanged: (sessionId, state) =>
+        host?.publishBackgroundTaskState(sessionId, state),
+      ...(deps.openClaudeConnection ? { openClaudeConnection: deps.openClaudeConnection } : {}),
+      ...(deps.readProcessStartTime ? { readProcessStartTime: deps.readProcessStartTime } : {})
+    })
+    const adapter = new StructuredAgentSessionAdapterRouter({ codex, claude }, async () => {
+      await Promise.all([codex.closeAll(), claude.closeAll()])
+    })
     host = new StructuredAgentSessionHost({
       store,
       adapter,
@@ -203,6 +296,10 @@ async function install(deps: StructuredAgentSessionRuntimeDeps): Promise<Install
         // A recovery may synchronously trigger another exit while it is
         // reacquiring. Observe until the chain stops growing.
         for (;;) {
+          // Claude reaches the chain only once its close ladder and transcript
+          // write publish the exit, so an observed death is not yet a chained
+          // one. Codex publishes inside its own exit callback and needs nothing.
+          await claude.drainObservedExits()
           const observed = recoveryChain
           await observed
           if (observed === recoveryChain) {
@@ -216,102 +313,3 @@ async function install(deps: StructuredAgentSessionRuntimeDeps): Promise<Install
     throw error
   }
 }
-
-/**
- * The lease's only source of truth about a previous owner. Everything it cannot
- * answer PID-reuse-safely reports `indeterminate`. An exact owner stays fenced in `recovering`;
- * an ownerless, unattributable reservation enters `manual-recovery`.
- */
-export function createStructuredAgentSessionOwnerProbe(
-  hostId: string,
-  probe = probeAgentSessionProcessIdentity,
-  findSpawnTokenProcesses = findAgentSessionSpawnTokenProcesses
-): (record: AgentSessionRecord) => Promise<AgentSessionOwnerProbe> {
-  return async (record) => {
-    const owner = record.lease.ownerProcess
-    if (!owner) {
-      if (record.lease.processlessAt !== undefined && record.lease.processlessAt !== null) {
-        return { outcome: 'reservation-unused' }
-      }
-      const spawnToken = record.lease.reservedSpawnToken
-      if (spawnToken === null) {
-        if (record.lease.claimStatus === 'reserved') {
-          return {
-            outcome: 'indeterminate',
-            reason: 'reservation recorded no spawn token to scan for'
-          }
-        }
-        // The token is minted before the child and is the only thing a child could be carrying.
-        // No owner and no token means nothing on any host can be holding this lease — answering
-        // `indeterminate` here is what latches an already-free record into recovery forever.
-        return { outcome: 'reservation-unused' }
-      }
-      // Freeing a reservation needs positive proof that nothing spawned under its token. The scan
-      // answers null where the platform cannot read another process's environment.
-      return probeAgentSessionReservation({
-        spawnToken,
-        findProcessesWithSpawnToken: (token) => findSpawnTokenProcesses(token),
-        hasProviderActivitySinceReservation: async () =>
-          agentSessionReservationTouchedProvider(record)
-      })
-    }
-    if (owner.hostId !== hostId) {
-      // Checking a remote host's pid against this machine's process table is
-      // exactly how a live owner gets declared dead.
-      return {
-        outcome: 'indeterminate',
-        reason: `owner runs on ${owner.hostId}, which this host cannot probe`
-      }
-    }
-    // The env read-back answers on hosts that expose it and null elsewhere, giving the
-    // probe a PID-reuse-safe element even when no start time was recorded.
-    return probe({
-      identity: owner,
-      deps: { readEchoedSpawnToken: readEchoedAgentSessionSpawnToken }
-    })
-  }
-}
-
-export function createStructuredAgentSessionOwnerProbes(
-  hostId: string,
-  probeMany: typeof probeAgentSessionProcessIdentities = probeAgentSessionProcessIdentities,
-  probeOne = createStructuredAgentSessionOwnerProbe(hostId)
-): (records: readonly AgentSessionRecord[]) => Promise<Map<string, AgentSessionOwnerProbe>> {
-  return async (records) => {
-    const results = new Map<string, AgentSessionOwnerProbe>()
-    const localOwners: {
-      record: AgentSessionRecord
-      owner: NonNullable<AgentSessionRecord['lease']['ownerProcess']>
-    }[] = []
-    for (const record of records) {
-      const owner = record.lease.ownerProcess
-      if (owner?.hostId === hostId) {
-        localOwners.push({ record, owner })
-      } else {
-        results.set(record.sessionId, await probeOne(record))
-      }
-    }
-    const probes = await probeMany({
-      identities: localOwners.map(({ owner }) => owner),
-      deps: { readEchoedSpawnToken: readEchoedAgentSessionSpawnToken }
-    })
-    for (const [index, { record }] of localOwners.entries()) {
-      results.set(
-        record.sessionId,
-        probes[index] ?? { outcome: 'indeterminate', reason: 'owner probe returned no result' }
-      )
-    }
-    return results
-  }
-}
-
-/**
- * The only provider-side trace a reservation can leave in its own record: a handle link minted at
- * this fence. `proveAgentSessionOwner` refuses to append one before an identity is committed, so a
- * link at the reservation's fence means a child got far enough to resume the provider thread. It
- * cannot see activity the child produced without proving a handle, which is why it is paired with
- * the token scan rather than trusted alone.
- */
-function agentSessionReservationTouchedProvider(record: AgentSessionRecord): boolean {
-  return record.providerHandleChain.at(-1)?.mintedAtFence === record.lease.runtimeFence
-}
diff --git a/src/main/runtime/structured-agent-session-support-probe.test.ts b/src/main/runtime/structured-agent-session-support-probe.test.ts
new file mode 100644
index 00000000000..e393e41f3a4
--- /dev/null
+++ b/src/main/runtime/structured-agent-session-support-probe.test.ts
@@ -0,0 +1,174 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { OrcaRuntimeService } from './orca-runtime'
+import {
+  getStructuredAgentSessionHost,
+  setStructuredAgentSessionHost
+} from '../native-chat/agent-session-wire/structured-agent-session-registry'
+import { agentSessionPtyWriteGate } from './agent-session-pty-write-gate'
+
+type InstallEffects = {
+  storeOpened: boolean
+  writeGateAttached: boolean
+  reaperStarted: boolean
+}
+
+/** Stands in for `install()` by performing the three effects it performs, so a probe that
+ *  reinstalls the host is caught by what the install *does*, not by a call count alone. */
+function stubStructuredHostInstall(runtime: OrcaRuntimeService): {
+  effects: InstallEffects
+  ensure: ReturnType<typeof vi.fn>
+} {
+  const effects: InstallEffects = {
+    storeOpened: false,
+    writeGateAttached: false,
+    reaperStarted: false
+  }
+  // `supportsCreate` answers as the real Codex adapter would, so a probe that reinstalls the host
+  // still returns the right answer and fails on the install effects alone.
+  const host = {
+    reconcileRestartLeases: vi.fn(async () => {}),
+    supportsCreate: (location: { executionHostId: string; wslDistro: string | null }) =>
+      location.executionHostId === 'local' && location.wslDistro === null
+  }
+  const ensure = vi.fn(async () => {
+    effects.storeOpened = true
+    effects.reaperStarted = true
+    agentSessionPtyWriteGate.attachRecordLookup(() => null)
+    effects.writeGateAttached = true
+    setStructuredAgentSessionHost(host as never)
+  })
+  vi.spyOn(runtime, 'ensureStructuredAgentSessionHost').mockImplementation(ensure)
+  return { effects, ensure }
+}
+
+type TestLocation = {
+  executionHostId: string
+  wslDistro: string | null
+  workspaceKind?: 'folder' | 'git-worktree'
+}
+
+type SupportResult = {
+  supported: boolean
+  reason?: 'agent' | 'remote' | 'wsl'
+}
+
+function createRuntime(location: TestLocation): OrcaRuntimeService {
+  const runtime = new OrcaRuntimeService({ getSettings: () => ({}) } as never)
+  const internal = runtime as unknown as {
+    resolveStructuredAgentSessionLocation: () => Promise<unknown>
+  }
+  internal.resolveStructuredAgentSessionLocation = vi.fn(async () => ({
+    executionHostId: location.executionHostId,
+    wslDistro: location.wslDistro,
+    workspaceId: 'workspace-1',
+    workspaceKind: location.workspaceKind ?? 'git-worktree'
+  }))
+  return runtime
+}
+
+async function expectSupportWithoutInstall(input: {
+  agent: 'claude' | 'codex'
+  location: TestLocation
+  expected: SupportResult
+  repetitions?: number
+}): Promise<void> {
+  const runtime = createRuntime(input.location)
+  const { effects, ensure } = stubStructuredHostInstall(runtime)
+
+  const answers: SupportResult[] = []
+  for (let index = 0; index < (input.repetitions ?? 1); index += 1) {
+    answers.push(
+      await runtime.getStructuredAgentSessionCreateSupport('id:workspace-1', input.agent)
+    )
+  }
+
+  expect(answers).toEqual(Array(input.repetitions ?? 1).fill(input.expected))
+  expect(ensure).not.toHaveBeenCalled()
+  expect(effects).toEqual({
+    storeOpened: false,
+    writeGateAttached: false,
+    reaperStarted: false
+  })
+  expect(getStructuredAgentSessionHost()).toBeNull()
+}
+
+describe('structured agent-session create-support probe', () => {
+  afterEach(() => {
+    setStructuredAgentSessionHost(null)
+    agentSessionPtyWriteGate.detachRecordLookup()
+    vi.restoreAllMocks()
+  })
+
+  it.each(['codex', 'claude'] as const)(
+    'answers %s support repeatedly without installing the host',
+    async (agent) => {
+      await expectSupportWithoutInstall({
+        agent,
+        location: { executionHostId: 'local', wslDistro: null },
+        expected: { supported: true },
+        repetitions: 3
+      })
+    }
+  )
+
+  it.each(['codex', 'claude'] as const)(
+    'still reports an unsupported remote %s location without installing the host',
+    async (agent) => {
+      await expectSupportWithoutInstall({
+        agent,
+        location: { executionHostId: 'ssh-host-1', wslDistro: null },
+        expected: { supported: false, reason: 'remote' }
+      })
+    }
+  )
+
+  it.each(['codex', 'claude'] as const)(
+    'still reports an unsupported WSL %s location without installing the host',
+    async (agent) => {
+      await expectSupportWithoutInstall({
+        agent,
+        location: { executionHostId: 'local', wslDistro: 'Ubuntu' },
+        expected: { supported: false, reason: 'wsl' }
+      })
+    }
+  )
+
+  it.each(['codex', 'claude'] as const)(
+    'supports a local folder workspace for %s without installing the host',
+    async (agent) => {
+      await expectSupportWithoutInstall({
+        agent,
+        location: {
+          executionHostId: 'local',
+          wslDistro: null,
+          workspaceKind: 'folder'
+        },
+        expected: { supported: true }
+      })
+    }
+  )
+
+  it('still installs and reconciles on startup when a store is already persisted', async () => {
+    const runtime = createRuntime({ executionHostId: 'local', wslDistro: null })
+    const { effects, ensure } = stubStructuredHostInstall(runtime)
+    const internal = runtime as unknown as {
+      hasPersistedStructuredAgentSessionStore: () => boolean
+      refreshMobileSessionPtyRecords: () => Promise<void>
+    }
+    internal.hasPersistedStructuredAgentSessionStore = () => true
+    internal.refreshMobileSessionPtyRecords = vi.fn(async () => {})
+
+    await runtime.prepareStructuredAgentSessionStartupRestoration()
+
+    expect(ensure).toHaveBeenCalledTimes(1)
+    expect(effects).toEqual({
+      storeOpened: true,
+      writeGateAttached: true,
+      reaperStarted: true
+    })
+    expect(
+      (getStructuredAgentSessionHost() as unknown as { reconcileRestartLeases: () => void })
+        .reconcileRestartLeases
+    ).toHaveBeenCalledTimes(1)
+  })
+})
diff --git a/src/main/runtime/structured-claude-auth-policy-wiring.test.ts b/src/main/runtime/structured-claude-auth-policy-wiring.test.ts
new file mode 100644
index 00000000000..f018dfd30da
--- /dev/null
+++ b/src/main/runtime/structured-claude-auth-policy-wiring.test.ts
@@ -0,0 +1,59 @@
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { afterEach, describe, expect, it } from 'vitest'
+import {
+  CLAUDE_STRUCTURED_AUTH_POLICY_REQUIRED,
+  ensureStructuredAgentSessionHost,
+  stopStructuredAgentSessionRuntime
+} from './structured-agent-session-runtime'
+
+/**
+ * The structured host's Claude auth policy has exactly one production wiring, and it
+ * lives in `orca-runtime-get-worktree-ps.ts` — a `@ts-nocheck` file, so neither the
+ * compiler nor a type test can see the field disappear. Deleting that wiring used to
+ * leave ~1000 tests green while every `ANTHROPIC_*` variable in the shell reached the
+ * child, because `stripAuthEnv` silently fell back to `false`.
+ *
+ * Two independent guards replace that silence, and this file pins both.
+ */
+describe('structured Claude auth policy wiring', () => {
+  // The behavioural version of this assertion — importing the runtime class and
+  // capturing the installed deps — costs 35s of module transform for the whole
+  // OrcaRuntime chain (measured), so the wiring itself is pinned by source and the
+  // policy's meaning by claude-structured-auth-policy.test.ts.
+  it('passes a settings-derived Claude auth policy to the host installer', () => {
+    const source = readFileSync(join(__dirname, 'orca-runtime-get-worktree-ps.ts'), 'utf8')
+
+    expect(source).toContain('claudeStructuredAuthPolicyForSettings')
+    expect(source).toMatch(
+      /resolveClaudeAuthPolicy:\s*\(\)\s*=>\s*\n?\s*claudeStructuredAuthPolicyForSettings\(/
+    )
+  })
+
+  describe('installing without one', () => {
+    let stateDirectory: string | null = null
+
+    afterEach(async () => {
+      await stopStructuredAgentSessionRuntime()
+      if (stateDirectory) {
+        await rm(stateDirectory, { recursive: true, force: true })
+        stateDirectory = null
+      }
+    })
+
+    it('refuses loudly rather than defaulting to a guess', async () => {
+      stateDirectory = await mkdtemp(join(tmpdir(), 'orca-auth-policy-wiring-'))
+
+      await expect(
+        ensureStructuredAgentSessionHost({
+          stateDirectory,
+          hostId: 'local',
+          claimKeyId: 'key-1',
+          resolveWorkspacePath: async () => stateDirectory as string
+        } as unknown as Parameters<typeof ensureStructuredAgentSessionHost>[0])
+      ).rejects.toThrow(CLAUDE_STRUCTURED_AUTH_POLICY_REQUIRED)
+    })
+  })
+})
diff --git a/src/main/runtime/structured-claude-runtime-adapter.ts b/src/main/runtime/structured-claude-runtime-adapter.ts
new file mode 100644
index 00000000000..95151f1dae9
--- /dev/null
+++ b/src/main/runtime/structured-claude-runtime-adapter.ts
@@ -0,0 +1,106 @@
+import type { AgentSessionRecord } from '../../shared/agent-session-record'
+import type { AgentSessionBackgroundTaskState } from '../../shared/agent-session-wire'
+import { join } from 'node:path'
+import { resolveClaudeCommand } from '../codex-cli/command'
+import type { ClaudeStructuredAuthPolicy } from '../claude-accounts/claude-structured-auth-policy'
+import { createClaudeStructuredLaunchResolver } from '../claude/claude-structured-launch-resolution'
+import {
+  ClaudeStructuredSessionAdapter,
+  type ClaudeStructuredSessionAdapterDeps
+} from '../claude/claude-structured-session-adapter'
+import { claudeProviderHandleLink } from '../claude/claude-structured-owner-identity'
+import type { StructuredAgentSessionLifecycleEvent } from '../native-chat/agent-session-wire/structured-agent-session-adapter'
+import {
+  readClaudeTranscriptLeafUuid,
+  resolveSessionFilePath
+} from '../native-chat/session-file-resolver'
+import { recordAgentSessionProviderHandle } from './agent-session-provider-handle-transition'
+import type { ClaudeManagedAccountGateSettings } from '../native-chat/claude-structured-managed-account-support'
+import type { AgentSessionRecordStore } from './agent-session-record-store'
+
+export type StructuredClaudeRuntimeAdapterDeps = {
+  store: AgentSessionRecordStore
+  resolveWorkspacePath: (workspaceId: string) => Promise<string>
+  resolveClaudeCommand?: () => string
+  resolveClaudeLaunchEnv?: () => Promise<Record<string, string>> | Record<string, string>
+  /** Managed-account auth state for a Claude launch, mirroring the terminal preflight.
+   *  Required: an absent policy is what silently under-strips. */
+  resolveClaudeAuthPolicy: () => Promise<ClaudeStructuredAuthPolicy> | ClaudeStructuredAuthPolicy
+  readClaudeManagedAccountGate?: () => ClaudeManagedAccountGateSettings | null
+  openClaudeConnection?: ClaudeStructuredSessionAdapterDeps['openConnection']
+  readProcessStartTime?: ClaudeStructuredSessionAdapterDeps['readProcessStartTime']
+  onUnexpectedExit: (event: StructuredAgentSessionLifecycleEvent) => void
+  onBackgroundTasksChanged?: (
+    sessionId: string,
+    state: AgentSessionBackgroundTaskState | null
+  ) => void
+}
+
+export function createStructuredClaudeRuntimeAdapter(
+  deps: StructuredClaudeRuntimeAdapterDeps
+): ClaudeStructuredSessionAdapter {
+  const { store } = deps
+  return new ClaudeStructuredSessionAdapter({
+    resolveLaunch: createClaudeStructuredLaunchResolver({
+      store,
+      resolveWorkspacePath: deps.resolveWorkspacePath,
+      resolveCommand: deps.resolveClaudeCommand ?? resolveClaudeCommand,
+      ...(deps.resolveClaudeLaunchEnv ? { resolveEnv: deps.resolveClaudeLaunchEnv } : {}),
+      resolveAuthPolicy: deps.resolveClaudeAuthPolicy,
+      ...(deps.readClaudeManagedAccountGate
+        ? { readManagedAccountGate: deps.readClaudeManagedAccountGate }
+        : {})
+    }),
+    persistHandle: async ({ sessionId, providerSessionId, leafUuid, fence }) => {
+      const currentFence = store.getRecord(sessionId)?.lease.runtimeFence ?? fence
+      const observedAt = Date.now()
+      await store.transitionHandoff(sessionId, (record: AgentSessionRecord) =>
+        recordAgentSessionProviderHandle({
+          record,
+          fence: currentFence,
+          link: claudeProviderHandleLink({
+            sessionId: providerSessionId,
+            leafUuid,
+            resumed: true,
+            fence: currentFence,
+            observedAt
+          }),
+          now: observedAt
+        })
+      )
+    },
+    readTranscriptLeaf: async ({ providerSessionId, previousLeafUuid, claudeConfigDir }) => {
+      const transcriptPath = await resolveSessionFilePath('claude', providerSessionId, {
+        claudeProjectsDir: join(claudeConfigDir, 'projects')
+      })
+      return transcriptPath
+        ? await readClaudeTranscriptLeafUuid(transcriptPath, providerSessionId, previousLeafUuid)
+        : null
+    },
+    onEvent: (event) => {
+      if (
+        event.type === 'ended' &&
+        event.cause === 'unexpected-exit' &&
+        event.fence !== undefined &&
+        event.acquisitionGeneration
+      ) {
+        deps.onUnexpectedExit({
+          type: 'ended',
+          sessionId: event.sessionId,
+          reason: event.reason,
+          cause: event.cause,
+          fence: event.fence,
+          acquisitionGeneration: event.acquisitionGeneration,
+          ...(event.settlementRetryRequired
+            ? { settlementRetryRequired: event.settlementRetryRequired }
+            : {})
+        })
+      }
+    },
+    ...(deps.onBackgroundTasksChanged
+      ? { onBackgroundTasksChanged: deps.onBackgroundTasksChanged }
+      : {}),
+    ...(deps.openClaudeConnection ? { openConnection: deps.openClaudeConnection } : {}),
+    ...(deps.readProcessStartTime ? { readProcessStartTime: deps.readProcessStartTime } : {})
+  })
+}
diff --git a/src/main/runtime/structured-tui-process-identity.test.ts b/src/main/runtime/structured-tui-process-identity.test.ts
index 4324f8c5a26..fb5919824e5 100644
--- a/src/main/runtime/structured-tui-process-identity.test.ts
+++ b/src/main/runtime/structured-tui-process-identity.test.ts
@@ -238,6 +238,41 @@ describe('structured TUI process identity', () => {
     }
   })
 
+  it('does not call a child absent after a single look that outlasted the budget', async () => {
+    // Measured on a 2,085-process host under load: one whole-machine `ps` took 6.2s while the
+    // shell-delivered child landed at ~3.5s. `ps` reads the table when it STARTS, so that one
+    // capture reported a t=0 machine and returned with the 5s budget already spent -- the loop
+    // answered "no exact child" without ever looking again.
+    let clockMs = 0
+    let captures = 0
+    await expect(
+      readStructuredTuiProcessIdentity({
+        hostId: 'local',
+        rootPid: 100,
+        spawnToken: 'spawn-slow-ps',
+        agent: 'claude',
+        platform: 'darwin',
+        readPosixRows: async () => {
+          captures += 1
+          const observedAtMs = clockMs
+          clockMs += 6_200
+          return [
+            { pid: 100, ppid: 1, stat: 'Ss', command: '/bin/zsh' },
+            ...(observedAtMs >= 3_500
+              ? [{ pid: 101, ppid: 100, stat: 'S+', command: 'claude --resume session-1' }]
+              : [])
+          ]
+        },
+        readStartTime: async () => 1_700_000_000_000,
+        now: () => clockMs,
+        sleep: async (delayMs) => {
+          clockMs += delayMs
+        }
+      })
+    ).resolves.toMatchObject({ pid: 101, spawnToken: 'spawn-slow-ps' })
+    expect(captures).toBe(2)
+  })
+
   it('fails closed when the process snapshot omitted the PTY root', async () => {
     await expect(
       readStructuredTuiProcessIdentity({
diff --git a/src/main/runtime/structured-tui-process-identity.ts b/src/main/runtime/structured-tui-process-identity.ts
index 0014351d781..f5ee019882b 100644
--- a/src/main/runtime/structured-tui-process-identity.ts
+++ b/src/main/runtime/structured-tui-process-identity.ts
@@ -20,6 +20,12 @@ const STRUCTURED_TUI_PROCESS_POLL_MS = 50
 // window the added latency is bounded by one interval.
 const STRUCTURED_TUI_PROCESS_FAST_POLL_WINDOW_MS = 1_000
 const STRUCTURED_TUI_PROCESS_MAX_POLL_MS = 500
+// Why a floor and not just the deadline: the first capture races the spawn it is looking for,
+// so a null from it is absence of the child's arrival, not evidence the child is missing. The
+// budget above assumes a look is nearly free, but one whole-machine `ps` measured 6.2s on a
+// 2,085-process host under load -- long enough to spend the entire budget before the child
+// (observed landing at ~3.5s) could exist, and answer "no exact child" after a single look.
+const STRUCTURED_TUI_PROCESS_MIN_CAPTURES = 2
 
 function descendants(rows: ProcessRow[], rootPid: number): (ProcessRow & { depth: number })[] {
   const children = new Map<number, ProcessRow[]>()
@@ -175,6 +181,7 @@ export async function readStructuredTuiProcessIdentity(input: {
   const startedAtMs = now()
   const deadline = startedAtMs + (input.timeoutMs ?? STRUCTURED_TUI_PROCESS_WAIT_MS)
   let pollDelayMs = input.pollIntervalMs ?? STRUCTURED_TUI_PROCESS_POLL_MS
+  let captures = 0
 
   while (true) {
     const rows: ProcessRow[] =
@@ -186,6 +193,7 @@ export async function readStructuredTuiProcessIdentity(input: {
             foreground: false
           }))
         : posixRows(await (input.readPosixRows ?? getFreshProcessTableSnapshot)())
+    captures += 1
     let rootPresent = false
     for (const row of rows) {
       if (row.pid === input.rootPid) {
@@ -218,11 +226,11 @@ export async function readStructuredTuiProcessIdentity(input: {
       }
     }
     const remainingMs = deadline - now()
-    if (remainingMs <= 0) {
+    if (remainingMs <= 0 && captures >= STRUCTURED_TUI_PROCESS_MIN_CAPTURES) {
       const label = input.agent === 'codex' ? 'Codex' : 'Claude'
       throw new Error(`The resumed terminal did not expose one exact ${label} child process.`)
     }
-    await sleep(Math.min(pollDelayMs, remainingMs))
+    await sleep(Math.max(0, Math.min(pollDelayMs, remainingMs)))
     if (now() - startedAtMs >= STRUCTURED_TUI_PROCESS_FAST_POLL_WINDOW_MS) {
       // Never below the caller's interval, so an explicitly slow poll stays slow.
       pollDelayMs = Math.max(
diff --git a/src/main/runtime/terminal-wait-detection.test.ts b/src/main/runtime/terminal-wait-detection.test.ts
new file mode 100644
index 00000000000..eda02e60bbb
--- /dev/null
+++ b/src/main/runtime/terminal-wait-detection.test.ts
@@ -0,0 +1,200 @@
+import { describe, expect, it } from 'vitest'
+import {
+  detectTerminalWaitBlockedReason,
+  isKnownReadyPromptPreview
+} from './terminal-wait-detection'
+import { buildTerminalWaitText } from './terminal-wait-tail-state'
+
+// Why these shapes: Codex agents working on Orca print `rg` hits from this very detector and its
+// specs, so quoted prompt wording lands in scrollback while the terminal sits at its input box.
+const QUOTED_DETECTOR_SOURCE_LINE =
+  "└   if (hooksindex !== -1 && normalized.includes('press enter to confirm', hooksindex)) {"
+const QUOTED_PERMISSION_FIXTURE_LINE =
+  "  └ 236:      'Permission required\\nThis command requires permission\\nAllow once\\nAllow always\\nReject\\n',"
+
+function codexIdleScreen(): string[] {
+  return [
+    '• Done. The detector bounding is in place and the suite passes.',
+    '',
+    '› Ask Codex to do anything',
+    '',
+    '  gpt-6-astra medium · ~/orca/workspaces/orca/fix-wait-detector-scrollback'
+  ]
+}
+
+function codexScrollback(quotedLines: string[], trailingLineCount: number): string[] {
+  const lines: string[] = [
+    '• Explored',
+    '  └ Search press enter to confirm in src/main/runtime',
+    '    Read terminal-wait-detection.ts',
+    '',
+    '• Ran rg -n "press enter to confirm" src/main/runtime/terminal-wait-detection.ts src/main/runtime/orca-runtime-tests/agent-status-and-waits.spec.ts',
+    '  └ src/main/runtime/terminal-wait-detection.ts',
+    '    src/main/runtime/orca-runtime-tests/agent-status-and-waits.spec.ts',
+    '    src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts',
+    ...quotedLines
+  ]
+  for (let index = 0; index < trailingLineCount; index += 1) {
+    lines.push(`    ${index}: unrelated codex narration about hook wiring and sandbox policy`)
+  }
+  return lines
+}
+
+function waitTextFor(lines: string[]): string {
+  return buildTerminalWaitText(lines, '', '')
+}
+
+describe('detectTerminalWaitBlockedReason scrollback bounding', () => {
+  it('ignores detector source quoted by rg output far above an idle Codex input box', () => {
+    const waitText = waitTextFor([
+      ...codexScrollback([QUOTED_DETECTOR_SOURCE_LINE], 300),
+      ...codexIdleScreen()
+    ])
+
+    expect(waitText).toContain('press enter to confirm')
+    expect(detectTerminalWaitBlockedReason(waitText)).toBeNull()
+  })
+
+  it('ignores a quoted permission fixture in scrollback above an idle Codex input box', () => {
+    const waitText = waitTextFor([
+      ...codexScrollback([QUOTED_PERMISSION_FIXTURE_LINE], 300),
+      ...codexIdleScreen()
+    ])
+
+    expect(waitText.toLowerCase()).toContain('allow once')
+    expect(detectTerminalWaitBlockedReason(waitText)).toBeNull()
+  })
+
+  it('ignores quoted prompt wording just above the live-dialog window', () => {
+    // Why 10: with the 3-line idle screen the quoted lines sit 13-14 non-blank lines from the bottom.
+    const waitText = waitTextFor([
+      ...codexScrollback([QUOTED_DETECTOR_SOURCE_LINE, QUOTED_PERMISSION_FIXTURE_LINE], 10),
+      ...codexIdleScreen()
+    ])
+
+    expect(detectTerminalWaitBlockedReason(waitText)).toBeNull()
+  })
+
+  it('does not let quoted scrollback wording veto a Codex ready header', () => {
+    const waitText = waitTextFor([
+      ...codexScrollback([QUOTED_PERMISSION_FIXTURE_LINE], 40),
+      ' >_ OpenAI Codex (v0.153.3)',
+      ' model:       gpt-6-astra medium   /model to change',
+      ' directory:   ~/orca/workspaces/orca/fix-wait-detector-scrollback'
+    ])
+
+    expect(isKnownReadyPromptPreview(waitText)).toBe(true)
+  })
+})
+
+// Real dialog text: terminal-creation-and-readiness-part-07.spec.ts and agent-status-and-waits.spec.ts.
+const LIVE_CODEX_PROMPTS: { name: string; lines: string[]; reason: string }[] = [
+  {
+    name: 'hooks review',
+    lines: [
+      'Hooks need review',
+      '2 hooks are new or changed.',
+      '1. Review hooks',
+      '2. Trust all and continue',
+      'Press enter to confirm or esc to go back'
+    ],
+    reason: 'codex-hooks-review-prompt'
+  },
+  {
+    name: 'trust workspace',
+    lines: ['Do you trust this workspace directory?', '1. Yes', '2. No'],
+    reason: 'codex-trust-workspace'
+  },
+  {
+    name: 'update',
+    lines: [
+      'Update available! 0.131.0 -> 0.132.0',
+      '1. Update now',
+      '2. Skip',
+      'Press enter to continue'
+    ],
+    reason: 'codex-update-prompt'
+  },
+  {
+    name: 'cwd selection',
+    lines: [
+      'Choose working directory to resume this session',
+      '  Session = latest cwd recorded in the resumed session',
+      '  Current = your current working directory',
+      '  Press enter to continue'
+    ],
+    reason: 'codex-cwd-prompt'
+  },
+  {
+    name: 'model migration',
+    lines: [
+      'Codex just got an upgrade. Introducing gpt-5.1-codex-max.',
+      'We recommend switching from gpt-5-codex to gpt-5.1-codex-max.',
+      'Press enter to continue'
+    ],
+    reason: 'codex-model-migration-prompt'
+  },
+  {
+    name: 'grant permissions',
+    lines: [
+      'Would you like to grant these permissions?',
+      '1. Yes, grant these permissions for this turn',
+      '2. No, continue without permissions',
+      'Press enter to confirm or esc to cancel'
+    ],
+    reason: 'codex-interactive-prompt'
+  },
+  {
+    name: 'permission required',
+    lines: [
+      'Permission required',
+      'This command requires permission',
+      'Allow once',
+      'Allow always',
+      'Reject'
+    ],
+    reason: 'codex-interactive-prompt'
+  }
+]
+
+describe('detectTerminalWaitBlockedReason live prompts', () => {
+  for (const prompt of LIVE_CODEX_PROMPTS) {
+    it(`still blocks on a live ${prompt.name} prompt after long scrollback`, () => {
+      const waitText = waitTextFor([
+        ...codexScrollback([QUOTED_DETECTOR_SOURCE_LINE, QUOTED_PERMISSION_FIXTURE_LINE], 300),
+        ...prompt.lines
+      ])
+
+      expect(detectTerminalWaitBlockedReason(waitText)).toBe(prompt.reason)
+    })
+
+    it(`blocks on a live ${prompt.name} prompt rendered with blank spacer rows`, () => {
+      // Why: the visible-screen probe joins raw rows, so blank rows between dialog lines must not eat the window.
+      const spaced = prompt.lines.flatMap((line) => [line, '', ''])
+      const screen = [
+        ' >_ OpenAI Codex (v0.153.3)',
+        '',
+        ...spaced,
+        '',
+        '  gpt-6-astra medium · ~/orca/workspaces/orca/fix-wait-detector-scrollback',
+        ''
+      ].join('\n')
+
+      expect(detectTerminalWaitBlockedReason(screen)).toBe(prompt.reason)
+    })
+  }
+
+  it('reports the newest prompt when a live dialog follows a stale one at the bottom', () => {
+    const waitText = waitTextFor([
+      'Update available! 0.131.0 -> 0.132.0',
+      'Press enter to continue',
+      ' >_ OpenAI Codex (v0.132.0)',
+      ' model:       gpt-5.5 high   /model to change',
+      ' directory:   ~/orca/workspaces/orca/cli-debug',
+      'Hooks need review',
+      'Press enter to confirm'
+    ])
+
+    expect(detectTerminalWaitBlockedReason(waitText)).toBe('codex-hooks-review-prompt')
+  })
+})
diff --git a/src/main/runtime/terminal-wait-detection.ts b/src/main/runtime/terminal-wait-detection.ts
index 85f05f8e699..ed957d1fe2d 100644
--- a/src/main/runtime/terminal-wait-detection.ts
+++ b/src/main/runtime/terminal-wait-detection.ts
@@ -4,6 +4,11 @@ import {
   type AgentStatus
 } from '../../shared/agent-detection'
 import type { RuntimeTerminalWaitBlockedReason } from '../../shared/runtime-types'
+import {
+  isTerminalWaitWhitespace,
+  startOfLastLines,
+  startOfLastNonBlankLines
+} from './terminal-wait-tail-window'
 
 const EXPLICIT_IDLE_TITLE_RE = /(^|\s)(ready|idle|done)(\s|$|[.!?])/i
 const CLAUDE_IDLE_PREFIX = '\u2733'
@@ -153,11 +158,6 @@ function findAntigravityReadyPromptIndex(normalized: string): number | null {
   return modelIndex !== null && promptIndex !== null ? Math.max(modelIndex, promptIndex) : null
 }
 
-function isTerminalWaitWhitespace(value: string, index: number): boolean {
-  const code = value.charCodeAt(index)
-  return code === 32 || (code >= 9 && code <= 13)
-}
-
 export const TERMINAL_WAIT_BLOCKED_SENTINEL_RE =
   /update available|choose working directory to|codex just got an upgrade|hooks need review|do you trust|trust this|trusted workspace|press enter to (?:confirm|continue|view|insert)|press t to trust|permission required|requires permission|allow once|allow always|run this command\?/i
 
@@ -206,25 +206,28 @@ function isCursorApprovalChoiceLine(line: string): boolean {
   )
 }
 
-function startOfLastLines(value: string, count: number): number {
-  let cursor = value.length
-  for (let seen = 0; seen < count; seen += 1) {
-    const previous = value.lastIndexOf('\n', cursor - 1)
-    if (previous === -1) {
-      return 0
-    }
-    cursor = previous
-  }
-  return cursor + 1
-}
+// Why bounded: answered dialogs and quoted prompt wording (agents grep this file and its specs) stay in the
+// retained tail; only a dialog owning the screen bottom is live. Real Codex dialogs (trust, hooks review,
+// update, exec approval) are 4-8 lines; the slack covers a wrapped command or a longer hook list.
+const LIVE_PROMPT_TAIL_LINES = 12
 
 function findTerminalWaitBlockedSignal(
-  normalized: string
+  fullTail: string
 ): { reason: RuntimeTerminalWaitBlockedReason; index: number } | null {
-  // Why: one combined negative scan over the up-to-256 KiB tail avoids a dozen full-tail searches when no prompt can match.
+  const windowStart = startOfLastNonBlankLines(fullTail, LIVE_PROMPT_TAIL_LINES)
+  const normalized = windowStart === 0 ? fullTail : fullTail.slice(windowStart)
+  // Why: one combined negative scan avoids a dozen searches when no prompt can match.
   if (!TERMINAL_WAIT_BLOCKED_SENTINEL_RE.test(normalized)) {
     return null
   }
+  const signal = findBlockedSignalInLiveWindow(normalized)
+  // Why: callers compare this index against ready-header indexes found over the full tail.
+  return signal === null ? null : { reason: signal.reason, index: signal.index + windowStart }
+}
+
+function findBlockedSignalInLiveWindow(
+  normalized: string
+): { reason: RuntimeTerminalWaitBlockedReason; index: number } | null {
   const candidates: { reason: RuntimeTerminalWaitBlockedReason; index: number }[] = []
   const updateIndex = normalized.lastIndexOf('update available')
   if (updateIndex !== -1 && normalized.includes('press enter to continue', updateIndex)) {
diff --git a/src/main/runtime/terminal-wait-tail-window.ts b/src/main/runtime/terminal-wait-tail-window.ts
new file mode 100644
index 00000000000..788000328f1
--- /dev/null
+++ b/src/main/runtime/terminal-wait-tail-window.ts
@@ -0,0 +1,48 @@
+// Line-window primitives over a newline-joined terminal tail, shared by the wait-blocked prompt rules.
+
+export function isTerminalWaitWhitespace(value: string, index: number): boolean {
+  const code = value.charCodeAt(index)
+  return code === 32 || (code >= 9 && code <= 13)
+}
+
+/** Offset where the last `count` lines begin (0 when the tail is shorter). */
+export function startOfLastLines(value: string, count: number): number {
+  let cursor = value.length
+  for (let seen = 0; seen < count; seen += 1) {
+    const previous = value.lastIndexOf('\n', cursor - 1)
+    if (previous === -1) {
+      return 0
+    }
+    cursor = previous
+  }
+  return cursor + 1
+}
+
+/** Like `startOfLastLines`, but blank rows don't count toward the window. */
+// Why: the visible-screen probe joins raw rows, so blank spacer rows must not eat a dialog's window.
+export function startOfLastNonBlankLines(value: string, count: number): number {
+  let seen = 0
+  let lineEnd = value.length
+  for (;;) {
+    const lineStart = value.lastIndexOf('\n', lineEnd - 1) + 1
+    if (hasNonWhitespaceBetween(value, lineStart, lineEnd)) {
+      seen += 1
+      if (seen >= count) {
+        return lineStart
+      }
+    }
+    if (lineStart === 0) {
+      return 0
+    }
+    lineEnd = lineStart - 1
+  }
+}
+
+function hasNonWhitespaceBetween(value: string, start: number, end: number): boolean {
+  for (let index = start; index < end; index += 1) {
+    if (!isTerminalWaitWhitespace(value, index)) {
+      return true
+    }
+  }
+  return false
+}
diff --git a/src/main/runtime/unreadable-secret-store-preservation.win32.test.ts b/src/main/runtime/unreadable-secret-store-preservation.win32.test.ts
new file mode 100644
index 00000000000..d92deccfa9a
--- /dev/null
+++ b/src/main/runtime/unreadable-secret-store-preservation.win32.test.ts
@@ -0,0 +1,262 @@
+import { mkdirSync, mkdtempSync, readFileSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
+import { runProcessSync } from '../../shared/child-process/run-process'
+import { windowsSystem32Binary } from '../../shared/child-process/windows-system-binary'
+import { removeTreeSync } from '../../shared/windows-transient-lock-removal'
+
+/**
+ * What a *successful* harden does to a reader that cannot read.
+ *
+ * Path hardening writes a protected DACL granting only the SIDs the running process holds. Where
+ * the data root came from somewhere else — a relocated `ORCA_USER_DATA_PATH`, a share, a roaming
+ * profile, a backup restored under a recreated local account, or a harden whose `/reset` landed
+ * and whose `/grant` did not — the file ends up granting a SID this process does not have. It then
+ * reads as `EPERM` while its *directory* stays writable, because file hardening is synchronous on
+ * the write path and directory hardening is fire-and-forget.
+ *
+ * Every store below used to treat any read failure as "malformed — regenerate", and the
+ * regeneration succeeds: `renameSync` over an unreadable file needs `FILE_DELETE_CHILD` on the
+ * parent, not `DELETE` on the file. So the healing path destroyed the thing it could not read.
+ * Before hardening actually applied, this failed open — the file was simply readable.
+ *
+ * These assert the file still holds its original bytes afterwards. Runs only on win32, where a
+ * DACL is the mechanism; skipped elsewhere.
+ */
+
+/** Whether a DACL that omits this token actually denies it a read. */
+function readDenied(filePath: string): boolean {
+  try {
+    readFileSync(filePath, 'utf8')
+    return false
+  } catch (error) {
+    return /^(?:EPERM|EACCES)$/.test((error as NodeJS.ErrnoException).code ?? '')
+  }
+}
+
+/**
+ * An elevated token logged in as the built-in Administrator reads straight through a DACL that
+ * grants it nothing, so on such a host every assertion here would pass while proving nothing.
+ * Probe once and skip rather than assert vacuously -- the same trade the ACL suite makes for its
+ * unelevated-only case. `isUnreadableError` has its own unit tests on every platform; this suite
+ * carries the stores' refusal wherever a denial is actually reproducible.
+ */
+function canDenyReads(): boolean {
+  if (process.platform !== 'win32') {
+    return false
+  }
+  const probeRoot = mkdtempSync(join(tmpdir(), 'orca-deny-probe-'))
+  const probe = join(probeRoot, 'probe.json')
+  try {
+    writeFileSync(probe, '{}')
+    icacls(probe, '/inheritance:r', '/q')
+    icacls(probe, '/grant:r', `*${FOREIGN_SID}:(F)`, '/q')
+    return readDenied(probe)
+  } finally {
+    icacls(probe, '/reset', '/q')
+    icacls(probeRoot, '/reset', '/t', '/q')
+    removeTreeSync(probeRoot)
+  }
+}
+
+/**
+ * BUILTIN\Guests: a real, always-resolvable group that no interactive token is a member of.
+ * `S-1-5-32-544` looks foreign only until the suite meets a host that is elevated AND logged
+ * in as the built-in Administrator -- a CI runner -- where it grants the reader full control
+ * and every assertion below goes vacuous. An unresolvable SID is not an option: icacls
+ * rejects one with ERROR_NONE_MAPPED (1332).
+ */
+const FOREIGN_SID = 'S-1-5-32-546'
+
+function icacls(...args: string[]): number | null {
+  return runProcessSync({
+    program: windowsSystem32Binary('icacls.exe'),
+    args,
+    timeoutMs: 10_000
+  }).code
+}
+
+/** The on-disk state a successful harden leaves for a SID this process does not hold. */
+function makeUnreadable(filePath: string): void {
+  // Two invocations: the combined `/inheritance:r /grant:r` form keeps %TEMP%'s inherited
+  // [SYSTEM, Administrators, user] as *explicit* ACEs on Windows Server, which left the file
+  // readable and every assertion below vacuous. Remove inheritance first, then grant.
+  expect(icacls(filePath, '/inheritance:r', '/q')).toBe(0)
+  expect(icacls(filePath, '/grant:r', `*${FOREIGN_SID}:(F)`, '/q')).toBe(0)
+  expect(readDenied(filePath), 'fixture should be unreadable').toBe(true)
+}
+
+const describeOnWindows = process.platform === 'win32' && canDenyReads() ? describe : describe.skip
+
+describeOnWindows('a secure store that exists but cannot be read', () => {
+  let root: string
+
+  beforeAll(() => {
+    root = mkdtempSync(join(tmpdir(), 'orca-unreadable-'))
+  })
+
+  afterAll(() => {
+    // Reset first: the tree is not removable while its files grant only Administrators.
+    icacls(root, '/reset', '/t', '/q')
+    removeTreeSync(root)
+  })
+
+  it('does not regenerate the E2EE keypair, which would un-pair every device', async () => {
+    const { loadOrCreateE2EEKeypair } = await import('./e2ee-keypair')
+    const { E2EE_KEYPAIR_FILENAME } = await import('./mobile-pairing-files')
+    const dir = join(root, 'e2ee')
+    mkdirSync(dir, { recursive: true })
+    const filePath = join(dir, E2EE_KEYPAIR_FILENAME)
+    const original = JSON.stringify({
+      v: 1,
+      publicKeyB64: Buffer.alloc(32, 7).toString('base64'),
+      secretKeyB64: Buffer.alloc(32, 9).toString('base64')
+    })
+    writeFileSync(filePath, original)
+    makeUnreadable(filePath)
+
+    expect(() => loadOrCreateE2EEKeypair(dir)).toThrow(/Refusing to (regenerate|overwrite)/)
+
+    // The point: the secret key is still the one every paired phone derived its shared secret from.
+    icacls(filePath, '/reset', '/q')
+    expect(readFileSync(filePath, 'utf8')).toBe(original)
+  })
+
+  it('does not erase the device registry, which would revoke every paired token', async () => {
+    const { DeviceRegistry } = await import('./device-registry')
+    const { DEVICE_REGISTRY_FILENAME } = await import('./mobile-pairing-files')
+    const dir = join(root, 'devices')
+    mkdirSync(dir, { recursive: true })
+    const filePath = join(dir, DEVICE_REGISTRY_FILENAME)
+    const original = JSON.stringify([
+      {
+        deviceId: 'device-1',
+        name: 'Phone',
+        token: 'bearer-token-that-must-survive',
+        scope: 'mobile',
+        pairedAt: 1,
+        lastSeenAt: 2
+      }
+    ])
+    writeFileSync(filePath, original)
+    makeUnreadable(filePath)
+
+    const registry = new DeviceRegistry(dir)
+    // Any mutator reaches save(); it must refuse rather than write the empty list it loaded.
+    expect(() => registry.addDevice('Another phone', 'mobile')).toThrow(
+      /Refusing to (regenerate|overwrite)/
+    )
+
+    icacls(filePath, '/reset', '/q')
+    expect(readFileSync(filePath, 'utf8')).toBe(original)
+  })
+
+  it('does not blank the plugin secret vault on write', async () => {
+    vi.doMock('electron', () => ({
+      safeStorage: {
+        isEncryptionAvailable: () => true,
+        encryptString: (value: string) => Buffer.from(`enc:${value}`),
+        decryptString: (buffer: Buffer) => buffer.toString().replace(/^enc:/, '')
+      }
+    }))
+    const { PluginSecretsStore } = await import('./../plugins/plugin-secrets-store')
+    const dir = join(root, 'plugin-secrets')
+    mkdirSync(dir, { recursive: true })
+    const store = new PluginSecretsStore(dir, 'publisher.plugin')
+    // Reach the path the store computes rather than restating its layout here.
+    const filePath = (store as unknown as { filePath: string }).filePath
+    mkdirSync(join(filePath, '..'), { recursive: true })
+    const original = JSON.stringify({
+      version: 1,
+      format: 'electron-safe-storage-v1',
+      ciphertexts: { existing: Buffer.from('enc:keep-me').toString('base64') }
+    })
+    writeFileSync(filePath, original)
+    makeUnreadable(filePath)
+
+    expect(store.set('added', 'value')).toEqual({ ok: false, error: expect.any(String) })
+    store.delete('existing')
+
+    icacls(filePath, '/reset', '/q')
+    expect(readFileSync(filePath, 'utf8')).toBe(original)
+    vi.doUnmock('electron')
+  })
+  it('does not blank the plugin KV store on write', async () => {
+    const { PluginKvStore } = await import('./../plugins/plugin-storage-store')
+    const dir = join(root, 'plugin-kv')
+    mkdirSync(dir, { recursive: true })
+    const store = new PluginKvStore(dir, 'publisher.plugin', 'storage.json')
+    const filePath = (store as unknown as { filePath: string }).filePath
+    mkdirSync(join(filePath, '..'), { recursive: true })
+    const original = JSON.stringify({ keep: 'me' })
+    writeFileSync(filePath, original)
+    makeUnreadable(filePath)
+
+    expect(store.set('added', 'value')).toEqual({ ok: false, error: expect.any(String) })
+    store.delete('keep')
+
+    icacls(filePath, '/reset', '/q')
+    expect(readFileSync(filePath, 'utf8')).toBe(original)
+  })
+
+  it('does not drop pending relay revocations', async () => {
+    const { RelayRevokeOutbox } = await import('./relay/relay-revoke-outbox')
+    const dir = join(root, 'relay')
+    mkdirSync(dir, { recursive: true })
+    const filePath = join(dir, 'mobile-relay-revoke-outbox.json')
+    const original = JSON.stringify([
+      {
+        relayHostId: 'host-1',
+        relayDeviceId: 'device-1',
+        ownerIdentityKey: 'owner-1',
+        reqId: 'req-1',
+        createdAt: 1
+      }
+    ])
+    writeFileSync(filePath, original)
+    makeUnreadable(filePath)
+
+    const outbox = new RelayRevokeOutbox(dir)
+    expect(() =>
+      outbox.enqueue({
+        relayHostId: 'host-2',
+        relayDeviceId: 'device-2',
+        ownerIdentityKey: 'owner-2'
+      })
+    ).toThrow(/Refusing to (regenerate|overwrite)/)
+
+    icacls(filePath, '/reset', '/q')
+    expect(readFileSync(filePath, 'utf8')).toBe(original)
+  })
+
+  /**
+   * The one site that *deletes* rather than overwrites: a refresh failure plus an unreadable
+   * session used to fall past the `status === 'found'` guard into `clearOrcaCloudSession`.
+   */
+  it('does not delete the account session it could not read', async () => {
+    vi.doMock('electron', () => ({
+      safeStorage: {
+        isEncryptionAvailable: () => true,
+        encryptString: (value: string) => Buffer.from(value),
+        decryptString: (buffer: Buffer) => buffer.toString()
+      }
+    }))
+    const { readOrcaCloudSession, getOrcaCloudSessionPath } =
+      await import('./../orca-profiles/profile-cloud-session-store')
+    const dir = join(root, 'profiles')
+    mkdirSync(dir, { recursive: true })
+    const filePath = getOrcaCloudSessionPath('profile-1', dir)
+    mkdirSync(join(filePath, '..'), { recursive: true })
+    const original = JSON.stringify({ version: 1, format: 'dev-plaintext-v1', savedAt: 1 })
+    writeFileSync(filePath, original)
+    makeUnreadable(filePath)
+
+    // The status the delete path keys off: `unreadable`, never `decrypt-failed`.
+    expect(readOrcaCloudSession('profile-1', dir).status).toBe('unreadable')
+
+    icacls(filePath, '/reset', '/q')
+    expect(readFileSync(filePath, 'utf8')).toBe(original)
+    vi.doUnmock('electron')
+  })
+})
diff --git a/src/main/runtime/windows-mobile-firewall.test.ts b/src/main/runtime/windows-mobile-firewall.test.ts
index 19109a444b8..d561878a538 100644
--- a/src/main/runtime/windows-mobile-firewall.test.ts
+++ b/src/main/runtime/windows-mobile-firewall.test.ts
@@ -1,4 +1,5 @@
 import { describe, expect, it, vi } from 'vitest'
+import { execFile } from 'node:child_process'
 import {
   getWebSocketPort,
   inspectWindowsMobileFirewall,
@@ -6,6 +7,9 @@ import {
   type WindowsMobileFirewallEnvironment
 } from './windows-mobile-firewall'
 
+// Why: every other case injects `runPowerShell`, so only the argv case below reaches execFile.
+vi.mock('node:child_process', () => ({ execFile: vi.fn() }))
+
 function environment(
   runPowerShell: WindowsMobileFirewallEnvironment['runPowerShell'],
   overrides: Partial<WindowsMobileFirewallEnvironment> = {}
@@ -179,6 +183,56 @@ describe('windows mobile firewall', () => {
     expect(repairScript).toContain('-EdgeTraversalPolicy Block')
   })
 
+  it('keeps the elevated child encoded because Start-Process re-splits its ArgumentList', async () => {
+    // Why: `Start-Process -ArgumentList` joins the array into one ShellExecuteEx parameter
+    // string without quoting and PowerShell re-splits it on whitespace, which collapses runs
+    // of spaces. Measured on Windows 11: a `-Command` payload turned `C:\My  App\Orca.exe`
+    // into `C:\My App\Orca.exe`, i.e. a firewall rule for the wrong program. Base64 is the
+    // only form that survives that hop, so this site must not follow the local runner.
+    const runPowerShell = vi.fn().mockResolvedValue('{"launched":true,"exitCode":0}')
+    await repairWindowsMobileFirewall(
+      6769,
+      environment(runPowerShell, { executablePath: 'C:\\My  App\\Orca.exe' })
+    )
+
+    const outerScript = runPowerShell.mock.calls[0]![0] as string
+    expect(outerScript).toContain("'-EncodedCommand'")
+    expect(outerScript).not.toContain("'-Command'")
+    expect(outerScript).toContain('-Verb RunAs')
+
+    const encoded = outerScript.match(/'-EncodedCommand', '([^']+)'/)?.[1]
+    const repairScript = Buffer.from(encoded!, 'base64').toString('utf16le')
+    expect(repairScript).toContain("-Program 'C:\\My  App\\Orca.exe'")
+  })
+
+  it('runs the local PowerShell over argv with a plain -Command script', async () => {
+    // Why: execFile reaches CreateProcess with no shell in between, so the script needs no
+    // base64 armouring, and argv preserves runs of spaces that the elevated hop cannot.
+    // `-EncodedCommand` here was pure EDR signal.
+    const execFileMock = vi.mocked(execFile)
+    execFileMock.mockImplementation(((_file, _args, _options, callback) => {
+      callback(null, '{"privateFirewallEnabled":true,"networkCategory":"Private"}', '')
+      return {}
+    }) as unknown as typeof execFile)
+
+    await inspectWindowsMobileFirewall(6768, undefined, {
+      platform: 'win32',
+      isPackaged: true,
+      executablePath: 'C:\\My  App\\Orca.exe',
+      systemRoot: 'C:\\Windows'
+    })
+
+    const [file, args] = execFileMock.mock.calls[0]!
+    expect(file).toMatch(/WindowsPowerShell\\v1\.0\\powershell\.exe$/i)
+    expect(args!.slice(0, 3)).toEqual(['-NoProfile', '-NonInteractive', '-Command'])
+    expect(args).not.toContain('-EncodedCommand')
+    expect(args).not.toContain('-ExecutionPolicy')
+    // The script travels as ONE argv element, so its spaces and newlines survive verbatim.
+    expect(args).toHaveLength(4)
+    expect(args![3]).toContain("-Program 'C:\\My  App\\Orca.exe'")
+    expect(args![3]).toContain('\n')
+  })
+
   it('distinguishes a cancelled UAC prompt from repair failure', async () => {
     await expect(
       repairWindowsMobileFirewall(
diff --git a/src/main/runtime/windows-mobile-firewall.ts b/src/main/runtime/windows-mobile-firewall.ts
index 88b885ab5f0..c90a025cb14 100644
--- a/src/main/runtime/windows-mobile-firewall.ts
+++ b/src/main/runtime/windows-mobile-firewall.ts
@@ -229,6 +229,11 @@ Get-NetFirewallRule -Name ${quotePowerShell(FIREWALL_RULE_NAME)} -ErrorAction Si
 New-NetFirewallRule -Name ${quotePowerShell(FIREWALL_RULE_NAME)} -DisplayName ${quotePowerShell(FIREWALL_RULE_DISPLAY_NAME)} -Description 'Allows Orca Mobile to connect to this Orca desktop on private networks.' -Direction Inbound -Action Allow -Enabled True -Profile Private -Protocol TCP -LocalPort ${port} -Program ${quotePowerShell(executablePath)} -EdgeTraversalPolicy Block | Out-Null`
 }
 
+// Why the elevated child keeps `-EncodedCommand` while the local runner does not: `Start-Process
+// -ArgumentList` joins its array into one ShellExecuteEx parameter string without quoting, and
+// PowerShell then re-splits it on whitespace — measured to collapse `C:\My  App\...` to
+// `C:\My App\...`, which would silently write the firewall rule for the wrong program. Node's
+// argv path (createPowerShellRunner) preserves runs of spaces, so only this hop needs base64.
 function buildElevationScript(powershellPath: string, encodedRepairScript: string): string {
   return `$ErrorActionPreference = 'Stop'
 try {
@@ -257,7 +262,9 @@ function createPowerShellRunner(systemRoot?: string): PowerShellRunner {
     new Promise((resolve, reject) => {
       execFile(
         powershellPath,
-        ['-NoProfile', '-NonInteractive', '-EncodedCommand', encodePowerShell(script)],
+        // Why: argv reaches CreateProcess with no shell in between, so the script needs no base64
+        // armouring — and plain `-Command` keeps this off EDR's encoded-PowerShell heuristics.
+        ['-NoProfile', '-NonInteractive', '-Command', script],
         { encoding: 'utf8', timeout: timeoutMs, windowsHide: true, maxBuffer: 1024 * 1024 },
         (error, stdout) => {
           if (error) {
diff --git a/src/main/runtime/worktree-launch-host-repo.ts b/src/main/runtime/worktree-launch-host-repo.ts
index 4decb7acb56..7db9f4dae18 100644
--- a/src/main/runtime/worktree-launch-host-repo.ts
+++ b/src/main/runtime/worktree-launch-host-repo.ts
@@ -17,7 +17,10 @@ export type WorktreeHostRouting<T extends LaunchHostRepo> =
   | { kind: 'resolved'; hostId: ExecutionHostId; repo: T | null }
   /** No row carries this repo id and the worktree names no host — nothing ever named a host. */
   | { kind: 'unowned' }
-  /** Rival rows disagree about the host; guessing one is the cross-host leak. */
+  /**
+   * No single trustworthy host: rival rows disagree, or the resolved row named one that cannot be
+   * parsed. Guessing is the cross-host leak in both cases.
+   */
   | { kind: 'ambiguous' }
 
 /**
@@ -33,7 +36,10 @@ export function resolveWorktreeHostRouting<T extends LaunchHostRepo & ExecutionH
 ): WorktreeHostRouting<T> {
   const resolution = resolveWorktreeExecutionHost(createRepoRowExecutionHostLookup(repos), worktree)
   if (resolution.kind === 'unresolved') {
-    return resolution.reason === 'ambiguous' ? { kind: 'ambiguous' } : { kind: 'unowned' }
+    // Only `unknown` — nothing anywhere carries the id — becomes `unowned`, which callers dispose of
+    // as a plain local folder. `malformed` is a row that declared a host and named an unparseable
+    // one, so it joins `ambiguous`: guessing is the cross-host leak either way.
+    return resolution.reason === 'unknown' ? { kind: 'unowned' } : { kind: 'ambiguous' }
   }
   return { kind: 'resolved', hostId: resolution.hostId, repo: resolution.owner }
 }
diff --git a/src/main/runtime/worktree-listing-host-scope.ts b/src/main/runtime/worktree-listing-host-scope.ts
index 99650882670..e499d7faaf3 100644
--- a/src/main/runtime/worktree-listing-host-scope.ts
+++ b/src/main/runtime/worktree-listing-host-scope.ts
@@ -1,4 +1,5 @@
-import type { ExecutionHostId } from '../../shared/execution-host'
+import type { Repo } from '../../shared/repo-types'
+import { getRepoExecutionHostId, type ExecutionHostId } from '../../shared/execution-host'
 import { selectHostBalancedPage } from '../../shared/host-balanced-listing-page'
 import type { RuntimeListingHostScope } from '../../shared/runtime-listing-host-scope'
 
@@ -62,3 +63,28 @@ export function buildWorktreeListingHostScope(args: {
   }
   return { hostIds: [...covered].sort(), omittedHostIds: [...omitted].sort() }
 }
+
+/**
+ * Which hosts a listing claims to have been looking at.
+ *
+ * A `--repo` listing was scoped by the caller, so naming every configured host would report gaps
+ * the caller deliberately excluded. Naming NONE — which is what a scoped listing did before — means
+ * the scope can never report a gap at all, for any host kind, because `covered` and `omitted` are
+ * both derived from the returned rows plus this list. A scoped listing whose scan did not succeed
+ * then answers `{hostIds: [], omittedHostIds: []}`: byte-identical to a repo that genuinely has no
+ * worktrees, which is the one thing docs/reference/ssh-execution-boundary.md forbids a listing from
+ * implying.
+ *
+ * Measured before the fix, on one runtime with one refusing SSH host, in the same second: the
+ * unscoped listing reported `omittedHostIds: ["local", "ssh:<target>"]` while the scoped listing
+ * reported `[]`.
+ *
+ * Naming the single host the caller asked about costs nothing when rows come back — it lands in
+ * `covered`, so it is never reported omitted — and is the whole answer when they do not.
+ */
+export function listingKnownHostIds(
+  scopedRepo: Repo | null,
+  listKnownHostIds: () => Iterable<ExecutionHostId>
+): Iterable<ExecutionHostId> {
+  return scopedRepo ? [getRepoExecutionHostId(scopedRepo)] : listKnownHostIds()
+}
diff --git a/src/main/runtime/worktree-scan-admin-fingerprint-gate.test.ts b/src/main/runtime/worktree-scan-admin-fingerprint-gate.test.ts
index 3750884f84f..7dfe0144406 100644
--- a/src/main/runtime/worktree-scan-admin-fingerprint-gate.test.ts
+++ b/src/main/runtime/worktree-scan-admin-fingerprint-gate.test.ts
@@ -273,6 +273,22 @@ describe('worktree scan admin-fingerprint gate', () => {
     }
   })
 
+  it('resolves a just-created id after invalidation even within both cache TTLs', async () => {
+    const { runtime, list } = makeRuntime()
+    listWorktreesStrictMock.mockResolvedValueOnce([
+      { path: REPO_PATH, head: 'abc', branch: 'main', isBare: false, isMainWorktree: true }
+    ])
+    await list()
+    await expect(runtime.showManagedWorktree(`id:${WORKTREE_ID}`)).rejects.toThrow(
+      'selector_not_found'
+    )
+    runtime.invalidateWorktreeCatalog(REPO_ID)
+    await expect(runtime.showManagedWorktree(`id:${WORKTREE_ID}`)).resolves.toMatchObject({
+      id: WORKTREE_ID
+    })
+    expect(scanCount()).toBe(2)
+  })
+
   it('scans when the probe cannot describe the repo', async () => {
     vi.useFakeTimers()
     try {
diff --git a/src/main/shell-prompt-readiness-probe.test.ts b/src/main/shell-prompt-readiness-probe.test.ts
index c2c783953ac..56d4b35a06c 100644
--- a/src/main/shell-prompt-readiness-probe.test.ts
+++ b/src/main/shell-prompt-readiness-probe.test.ts
@@ -3,12 +3,16 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 const lineEditorProbe = vi.hoisted(() => vi.fn())
 const processReadinessProbe = vi.hoisted(() => vi.fn())
 const resolveExecutablePath = vi.hoisted(() => vi.fn((value: string) => Promise.resolve(value)))
+const resolveInstalledExecutablePaths = vi.hoisted(() =>
+  vi.fn((): Promise<string[]> => Promise.resolve([]))
+)
 vi.mock('../shared/pty-slave-line-discipline-echo', () => ({
   createPtySlaveLineEditorProbe: () => lineEditorProbe
 }))
 vi.mock('../shared/shell-process-readiness', () => ({
   readShellProcessReadiness: processReadinessProbe,
-  resolveShellExecutablePath: resolveExecutablePath
+  resolveShellExecutablePath: resolveExecutablePath,
+  resolveInstalledShellExecutablePaths: resolveInstalledExecutablePaths
 }))
 
 import { createShellPromptReadinessProbe } from './shell-prompt-readiness-probe'
@@ -19,6 +23,8 @@ describe('shell prompt readiness probe', () => {
     lineEditorProbe.mockReset()
     processReadinessProbe.mockReset()
     resolveExecutablePath.mockClear()
+    resolveInstalledExecutablePaths.mockClear()
+    resolveInstalledExecutablePaths.mockResolvedValue([])
   })
 
   afterEach(() => {
@@ -95,6 +101,99 @@ describe('shell prompt readiness probe', () => {
     }
   })
 
+  it('accepts a second installation of the same shell that the pane PATH resolves', async () => {
+    lineEditorProbe.mockResolvedValue('line-editor')
+    processReadinessProbe.mockResolvedValue({
+      executablePath: '/opt/homebrew/bin/bash',
+      foreground: true
+    })
+    resolveInstalledExecutablePaths.mockResolvedValue(['/bin/bash', '/opt/homebrew/bin/bash'])
+    const onPromptReady = vi.fn()
+    const probe = createShellPromptReadinessProbe({
+      slavePath: '/dev/ttys048',
+      shellPath: '/bin/bash',
+      shellCwd: '/work',
+      shellPathEnv: '/opt/homebrew/bin:/usr/bin:/bin',
+      getShellPid: () => 42,
+      onPromptReady,
+      settleMs: 10
+    })
+
+    probe?.notifyOutput('\x1b[?2004h')
+    await vi.advanceTimersByTimeAsync(10)
+
+    expect(resolveInstalledExecutablePaths).toHaveBeenCalledWith(
+      'bash',
+      '/work',
+      '/opt/homebrew/bin:/usr/bin:/bin'
+    )
+    expect(onPromptReady).toHaveBeenCalledOnce()
+  })
+
+  it('rejects a replacement with the shell basename that the pane PATH cannot reach', async () => {
+    lineEditorProbe.mockResolvedValue('line-editor')
+    processReadinessProbe.mockResolvedValue({ executablePath: '/tmp/bash', foreground: true })
+    resolveInstalledExecutablePaths.mockResolvedValue(['/bin/bash', '/opt/homebrew/bin/bash'])
+    const onPromptReady = vi.fn()
+    const probe = createShellPromptReadinessProbe({
+      slavePath: '/dev/ttys048',
+      shellPath: '/bin/bash',
+      getShellPid: () => 42,
+      onPromptReady,
+      settleMs: 10
+    })
+
+    probe?.notifyOutput('\x1b[?2004h')
+    await vi.advanceTimersByTimeAsync(10)
+
+    expect(onPromptReady).not.toHaveBeenCalled()
+  })
+
+  it('does not widen identity when the launched shell path resolves exactly', async () => {
+    lineEditorProbe.mockResolvedValue('line-editor')
+    processReadinessProbe.mockResolvedValue({ executablePath: '/bin/zsh', foreground: true })
+    const probe = createShellPromptReadinessProbe({
+      slavePath: '/dev/ttys048',
+      shellPath: '/bin/zsh',
+      getShellPid: () => 42,
+      onPromptReady: vi.fn(),
+      settleMs: 10
+    })
+
+    probe?.notifyOutput('\x1b[?2004h')
+    await vi.advanceTimersByTimeAsync(10)
+
+    expect(resolveInstalledExecutablePaths).not.toHaveBeenCalled()
+  })
+
+  it('invalidates an alternate-installation result that resolves after disposal', async () => {
+    const pending: { resolve?: (value: string[]) => void } = {}
+    lineEditorProbe.mockResolvedValue('line-editor')
+    processReadinessProbe.mockResolvedValue({
+      executablePath: '/opt/homebrew/bin/bash',
+      foreground: true
+    })
+    resolveInstalledExecutablePaths.mockImplementation(
+      () => new Promise((resolve) => (pending.resolve = resolve))
+    )
+    const onPromptReady = vi.fn()
+    const probe = createShellPromptReadinessProbe({
+      slavePath: '/dev/ttys048',
+      shellPath: '/bin/bash',
+      getShellPid: () => 42,
+      onPromptReady,
+      settleMs: 10
+    })
+
+    probe?.notifyOutput('\x1b[?2004h')
+    await vi.advanceTimersByTimeAsync(10)
+    probe?.dispose()
+    pending.resolve?.(['/opt/homebrew/bin/bash'])
+    await vi.advanceTimersByTimeAsync(0)
+
+    expect(onPromptReady).not.toHaveBeenCalled()
+  })
+
   it('does no external work when the ready marker cancels the settle window', async () => {
     const probe = createShellPromptReadinessProbe({
       slavePath: '/dev/ttys048',
diff --git a/src/main/shell-prompt-readiness-probe.ts b/src/main/shell-prompt-readiness-probe.ts
index 11583fd2de7..3309ac91108 100644
--- a/src/main/shell-prompt-readiness-probe.ts
+++ b/src/main/shell-prompt-readiness-probe.ts
@@ -1,6 +1,7 @@
 import { createPtySlaveLineEditorProbe } from '../shared/pty-slave-line-discipline-echo'
 import {
   readShellProcessReadiness,
+  resolveInstalledShellExecutablePaths,
   resolveShellExecutablePath
 } from '../shared/shell-process-readiness'
 import {
@@ -32,6 +33,7 @@ export function createShellPromptReadinessProbe(options: {
   }
   const settleMs = options.settleMs ?? SHELL_PROMPT_PROBE_SETTLE_MS
   const expectedShellName = options.shellPath ? basename(options.shellPath).toLowerCase() : null
+  const shellCwd = options.shellCwd ?? process.cwd()
   const outputScanState = createLineEditorReadyOutputScanState()
   let disposed = false
   let timer: ReturnType<typeof setTimeout> | null = null
@@ -52,11 +54,7 @@ export function createShellPromptReadinessProbe(options: {
     const [shell, expectedPath] = await Promise.all([
       readShellProcessReadiness(shellPid),
       options.shellPath
-        ? resolveShellExecutablePath(
-            options.shellPath,
-            options.shellCwd ?? process.cwd(),
-            options.shellPathEnv
-          )
+        ? resolveShellExecutablePath(options.shellPath, shellCwd, options.shellPathEnv)
         : Promise.resolve(null)
     ])
     if (disposed || scheduledGeneration !== generation) {
@@ -66,11 +64,28 @@ export function createShellPromptReadinessProbe(options: {
       !shell?.foreground ||
       !expectedShellName ||
       !expectedPath ||
-      basename(shell.executablePath).toLowerCase() !== expectedShellName ||
-      shell.executablePath !== expectedPath
+      basename(shell.executablePath).toLowerCase() !== expectedShellName
     ) {
       return
     }
+    if (shell.executablePath !== expectedPath) {
+      // Why widen past the launched path: a startup profile that `exec`s a second
+      // install of the same shell (Homebrew Bash over /bin/bash) keeps the pid but
+      // loses the wrapper's marker. Only installs this pane's own PATH resolves
+      // count, so a binary merely *named* bash/zsh outside it stays rejected.
+      const installedPaths = await resolveInstalledShellExecutablePaths(
+        expectedShellName,
+        shellCwd,
+        options.shellPathEnv
+      )
+      if (
+        disposed ||
+        scheduledGeneration !== generation ||
+        !installedPaths.includes(shell.executablePath)
+      ) {
+        return
+      }
+    }
     disposed = true
     options.onPromptReady()
   }
diff --git a/src/main/shell-wrapper-generated-file-snapshot.test.ts b/src/main/shell-wrapper-generated-file-snapshot.test.ts
index ddbf1537984..36cd837e4fd 100644
--- a/src/main/shell-wrapper-generated-file-snapshot.test.ts
+++ b/src/main/shell-wrapper-generated-file-snapshot.test.ts
@@ -73,6 +73,7 @@ const CONTRACT_GLOBALS = new Set([
   'OPENCODE_CONFIG_DIR',
   'PATH',
   'PROMPT_COMMAND',
+  'PS1', // Bash appends its non-printing Readline readiness marker.
   'CURSOR',
   'ZDOTDIR',
   'precmd_functions',
diff --git a/src/main/skills/skill-root-file-walk.test.ts b/src/main/skills/skill-root-file-walk.test.ts
index 3ca80bdb495..ad84eced6b6 100644
--- a/src/main/skills/skill-root-file-walk.test.ts
+++ b/src/main/skills/skill-root-file-walk.test.ts
@@ -45,6 +45,34 @@ describe('findSkillFiles', () => {
     expect(found).toEqual([join(root, 'near', 'SKILL.md')])
   })
 
+  it('does not stat directory links beyond the depth bound but still follows in-bound links', async () => {
+    const base = await makeTree()
+    const root = join(base, 'skills')
+    const edge = join(root, 'a', 'b', 'c', 'd')
+    const target = join(base, 'linked')
+    await writeFileAt(join(edge, 'SKILL.md'))
+    await writeFileAt(join(target, 'SKILL.md'))
+    for (let index = 0; index < 32; index += 1) {
+      await symlink(
+        target,
+        join(edge, `link${index.toString().padStart(2, '0')}`),
+        process.platform === 'win32' ? 'junction' : 'dir'
+      )
+    }
+    const statPaths: string[] = []
+    onStat = async (path) => {
+      statPaths.push(path)
+    }
+
+    expect(await findSkillFiles(root, 4)).toEqual([join(edge, 'SKILL.md')])
+    expect(statPaths).toEqual([])
+    expect(await findSkillFiles(root, 5)).toEqual([
+      join(edge, 'SKILL.md'),
+      join(edge, 'link00', 'SKILL.md')
+    ])
+    expect(statPaths).toHaveLength(32)
+  })
+
   it('returns nothing for a missing root rather than throwing', async () => {
     expect(await findSkillFiles(join(await makeTree(), 'absent'), 4)).toEqual([])
   })
diff --git a/src/main/skills/skill-root-file-walk.ts b/src/main/skills/skill-root-file-walk.ts
index 261a650a967..4be1843f602 100644
--- a/src/main/skills/skill-root-file-walk.ts
+++ b/src/main/skills/skill-root-file-walk.ts
@@ -43,9 +43,6 @@ export async function findSkillFiles(
     // indistinguishable from a genuinely small root, and a caller that cached it
     // would publish "these skills no longer exist".
     signal?.throwIfAborted()
-    if (!isWithinDepth(rootPath, dirPath, maxDepth)) {
-      return
-    }
     let resolvedDirPath: string
     try {
       resolvedDirPath = await realpath(dirPath)
@@ -61,6 +58,8 @@ export async function findSkillFiles(
     if (!entries) {
       return
     }
+    // Directory entry names add one segment, so siblings share the depth verdict.
+    let childrenWithinDepth: boolean | undefined
     for (const entry of entries) {
       signal?.throwIfAborted()
       // Why: a staged sibling sits directly in a scanned root, so without this a
@@ -86,10 +85,15 @@ export async function findSkillFiles(
         continue
       }
       if (entry.isDirectory()) {
-        await visit(entryPath)
+        if ((childrenWithinDepth ??= isWithinDepth(rootPath, entryPath, maxDepth))) {
+          await visit(entryPath)
+        }
         continue
       }
-      if (entry.isSymbolicLink()) {
+      if (
+        entry.isSymbolicLink() &&
+        (childrenWithinDepth ??= isWithinDepth(rootPath, entryPath, maxDepth))
+      ) {
         // Why: users commonly symlink agent skill dirs across providers; follow
         // directory links but guard by realpath so recursive links cannot loop.
         let linksToDirectory = false
diff --git a/src/main/speech/model-manager-stream-cleanup.test.ts b/src/main/speech/model-manager-stream-cleanup.test.ts
index dcebaca37a3..34b7aa893d8 100644
--- a/src/main/speech/model-manager-stream-cleanup.test.ts
+++ b/src/main/speech/model-manager-stream-cleanup.test.ts
@@ -1,4 +1,4 @@
-import { mkdtempSync, rmSync } from 'node:fs'
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { PassThrough } from 'node:stream'
@@ -34,15 +34,17 @@ describe('ModelManager stream cleanup', () => {
     netRequestMock.mockReset()
   })
 
-  it('removes response progress listeners after a model download finishes', async () => {
+  it('reuses the idle timer and removes progress listeners after a fragmented download', async () => {
     const dir = mkdtempSync(join(tmpdir(), 'orca-model-manager-'))
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+    const timeoutSpy = vi.spyOn(globalThis, 'setTimeout')
     try {
       const response = new PassThrough() as PassThrough & {
         statusCode: number
         headers: Record<string, string>
       }
       response.statusCode = 200
-      response.headers = { 'content-length': '4' }
+      response.headers = { 'content-length': '1000' }
       const responseHandlers: ((response: unknown) => void)[] = []
       const request = {
         abort: vi.fn(() => request),
@@ -66,16 +68,26 @@ describe('ModelManager stream cleanup', () => {
       const download = manager.downloadFile(
         'https://example.com/model.bin',
         join(dir, 'model.bin'),
-        4,
+        1000,
         'm',
         () => false
       )
-      response.write(Buffer.from('ab'))
-      response.end(Buffer.from('cd'))
+      await vi.advanceTimersByTimeAsync(60_000)
+      for (let index = 0; index < 1000; index += 1) {
+        response.write(Buffer.from('a'))
+      }
+      await vi.advanceTimersByTimeAsync(119_999)
+      expect(request.abort).not.toHaveBeenCalled()
+      response.end()
 
       await expect(download).resolves.toBeUndefined()
       expect(response.listenerCount('data')).toBe(0)
+      expect(vi.getTimerCount()).toBe(0)
+      expect(readFileSync(join(dir, 'model.bin'), 'utf8')).toBe('a'.repeat(1000))
+      expect(timeoutSpy.mock.calls.filter(([, delay]) => delay === 120_000)).toHaveLength(1)
     } finally {
+      timeoutSpy.mockRestore()
+      vi.useRealTimers()
       rmSync(dir, { recursive: true, force: true })
     }
   })
diff --git a/src/main/speech/speech-model-http-download.ts b/src/main/speech/speech-model-http-download.ts
index ae2bae9648e..3bd2f24ab97 100644
--- a/src/main/speech/speech-model-http-download.ts
+++ b/src/main/speech/speech-model-http-download.ts
@@ -71,8 +71,11 @@ export abstract class SpeechModelHttpDownload {
         request = null
       }
       const resetIdleTimeout = (): void => {
-        clearIdleTimeout()
-        idleTimeout = setTimeout(onRequestTimeout, DOWNLOAD_IDLE_TIMEOUT_MS)
+        if (idleTimeout) {
+          idleTimeout.refresh()
+        } else {
+          idleTimeout = setTimeout(onRequestTimeout, DOWNLOAD_IDLE_TIMEOUT_MS)
+        }
       }
       const resolveOnce = (): void => {
         if (settled) {
diff --git a/src/main/sqlite/harden-database-files.ts b/src/main/sqlite/harden-database-files.ts
new file mode 100644
index 00000000000..2183f87700e
--- /dev/null
+++ b/src/main/sqlite/harden-database-files.ts
@@ -0,0 +1,18 @@
+import { chmodSync, existsSync } from 'node:fs'
+
+/** Restrict a SQLite database and its sidecars to the owning user. */
+export function hardenSqliteDatabaseFiles(dbPath: (string & {}) | ':memory:'): void {
+  if (dbPath === ':memory:' || process.platform === 'win32') {
+    // Why: Windows protects these files through Orca's current-user-only userData DACL; POSIX mode bits are inert there.
+    return
+  }
+  for (const path of [dbPath, `${dbPath}-wal`, `${dbPath}-shm`]) {
+    try {
+      if (existsSync(path)) {
+        chmodSync(path, 0o600)
+      }
+    } catch {
+      // Why: best-effort — a mount that rejects chmod (SSHFS, some network shares) must not fail DB startup.
+    }
+  }
+}
diff --git a/src/main/sqlite/sync-database.test.ts b/src/main/sqlite/sync-database.test.ts
index fe3ba7e388d..5a028e68fd9 100644
--- a/src/main/sqlite/sync-database.test.ts
+++ b/src/main/sqlite/sync-database.test.ts
@@ -194,9 +194,11 @@ describe('SyncDatabase read-only opens under contention', () => {
     const contended = await contendedDatabase(10_000)
     const startedAt = Date.now()
 
+    const reader = new SyncDatabase(contended.path, { readonly: true })
+    openDatabases.push(reader)
     let thrown: unknown
     try {
-      new SyncDatabase(contended.path, { readonly: true }).prepare('SELECT id FROM items').all()
+      reader.prepare('SELECT id FROM items').all()
     } catch (error) {
       thrown = error
     }
@@ -210,11 +212,9 @@ describe('SyncDatabase read-only opens under contention', () => {
     const contended = await contendedDatabase(10_000)
     const startedAt = Date.now()
 
-    expect(() =>
-      new SyncDatabase(contended.path, { readonly: true, timeout: 400 })
-        .prepare('SELECT id FROM items')
-        .all()
-    ).toThrow(/database is locked/)
+    const reader = new SyncDatabase(contended.path, { readonly: true, timeout: 400 })
+    openDatabases.push(reader)
+    expect(() => reader.prepare('SELECT id FROM items').all()).toThrow(/database is locked/)
 
     expect(Date.now() - startedAt).toBeGreaterThanOrEqual(350)
   })
diff --git a/src/main/ssh/build-toolchain-diagnosis.ts b/src/main/ssh/build-toolchain-diagnosis.ts
index c64a41ead51..77d20ce475a 100644
--- a/src/main/ssh/build-toolchain-diagnosis.ts
+++ b/src/main/ssh/build-toolchain-diagnosis.ts
@@ -163,3 +163,66 @@ export function formatMissingToolchainError(
   ]
   return lines.join('\n')
 }
+
+const NODE_HEADERS_TARBALL_RE = /node-v[0-9.]+-headers\.tar\.gz/i
+
+/**
+ * Whether a native-deps failure is node-gyp failing to download Node headers from nodejs.org.
+ *
+ * Why it needs naming: the raw output is forty lines of `gyp http` and stack frames around one
+ * `ECONNREFUSED`, and it reads as a broken host or a broken Orca. Which of two things it is
+ * depends on what the local-headers export found first, so the formatter takes that answer.
+ */
+export function isNodeHeadersDownloadFailure(message: string): boolean {
+  // Why `configure error` is required: node-gyp's fetch client logs `attempt N failed with <code>`
+  // on retries it then recovers from, so a network token alone also matches a build that got its
+  // headers and died later for an unrelated reason. Only the configure step downloads headers.
+  return (
+    /gyp ERR! configure error/i.test(message) &&
+    NODE_HEADERS_TARBALL_RE.test(message) &&
+    /\b(ECONNREFUSED|ENOTFOUND|ETIMEDOUT|EHOSTUNREACH|ENETUNREACH|EAI_AGAIN|ECONNRESET)\b/.test(
+      message
+    )
+  )
+}
+
+const NODE_HEADERS_CONTEXT =
+  'node-pty has no prebuilt binary for Linux, so it must be compiled on the remote host, and ' +
+  'node-gyp fetches the Node.js headers from nodejs.org unless the Node install provides them ' +
+  'at <prefix>/include/node.'
+
+/**
+ * @param localHeadersDir what the local-headers export found: a dir it exported, `null` when
+ *   the host's Node ships no matching headers, `undefined` when the answer never came back.
+ *
+ * Why the exported-dir case is its own message: the export is the fix, so node-gyp downloading
+ * anyway means its `nodedir` env keys were not honoured (a future npm dropping the passthrough,
+ * a wrapper scrubbing the env). That is an Orca defect, not a host problem, and must not be
+ * reported as one -- it names the dir so the report is checkable.
+ */
+export function formatNodeHeadersDownloadError(
+  underlyingError: string,
+  localHeadersDir: string | null | undefined
+): string {
+  const lines = localHeadersDir
+    ? [
+        `The remote host could not download the Node.js headers needed to compile node-pty, even ` +
+          `though its Node install ships matching headers at ${localHeadersDir}/include/node and ` +
+          `Orca pointed node-gyp at them. node-gyp ignored that setting; this is an Orca defect, ` +
+          `please report it with the log below.`,
+        '',
+        'Workaround on the remote host until then: allow outbound HTTPS to nodejs.org, or point ' +
+          'npm at a mirror: npm config set disturl https://<mirror>/dist'
+      ]
+    : [
+        'The remote host could not download the Node.js headers needed to compile node-pty, and ' +
+          `its Node install has no local headers matching its own version. ${NODE_HEADERS_CONTEXT}`,
+        '',
+        'Fix one of the following on the remote host, then reconnect:',
+        '  - Install Node.js from an official build or a version manager (nvm, fnm, volta, n), ' +
+          'which ship headers for exactly the Node they run; or',
+        '  - Allow outbound HTTPS to nodejs.org, or point npm at a mirror: ' +
+          'npm config set disturl https://<mirror>/dist'
+      ]
+  return [...lines, '', `Underlying install error: ${underlyingError}`].join('\n')
+}
diff --git a/src/main/ssh/relay-daemon-service-children.ts b/src/main/ssh/relay-daemon-service-children.ts
new file mode 100644
index 00000000000..35e755ea518
--- /dev/null
+++ b/src/main/ssh/relay-daemon-service-children.ts
@@ -0,0 +1,62 @@
+/**
+ * Telling a relay daemon's own service processes apart from the work it holds.
+ *
+ * The reap gate used to ask `pgrep -P <relay> | grep -c .` and demand zero. But the daemon
+ * forks service children of its own — `relay-ai-vault-service.js` is spawned lazily and then
+ * never exits — so that count is permanently non-zero on any relay that has touched the AI
+ * Vault, whether or not it holds a single PTY. A superseded, disconnected relay holding
+ * nothing therefore reported `retained-live-work` forever, its version directory stayed
+ * pinned against GC by its own live socket, and the population grew without bound (#13614).
+ *
+ * The asymmetry below is the whole safety argument, and it follows
+ * docs/reference/ssh-execution-boundary.md: *subtracting a child we can positively identify
+ * as relay infrastructure is sound; assuming anything about a child we cannot identify is
+ * not.* An argv that does not match, an argv `ps` would not print, and a host without
+ * `pgrep` all count against the relay and keep it unreapable. Losing sight of a child is
+ * never evidence that it holds nothing.
+ */
+import { RELAY_DAEMON_SERVICE_ENTRY_FILENAMES } from '../../shared/relay-artifacts'
+import { shellEscape } from './ssh-connection-utils'
+
+/** Shell variable set to the daemon's direct-child count, or `unknown`. */
+export const RELAY_CHILD_COUNT_VAR = 'kids'
+
+/** Shell variable set to the count of children not identified as relay services, or `unknown`. */
+export const RELAY_UNRECOGNIZED_CHILD_COUNT_VAR = 'unrecognized_kids'
+
+/**
+ * `case` patterns matching a service child's argv. Suffix-anchored on purpose: both entries
+ * are forked with no script arguments, so the argv ends at the filename, and the leading `/`
+ * requires the absolute path the daemon forks rather than a bare mention of the name. A
+ * future arg would stop matching and the relay would go back to being retained — the safe
+ * direction to fail in.
+ */
+function serviceChildArgvPatterns(): string {
+  return RELAY_DAEMON_SERVICE_ENTRY_FILENAMES.map(
+    (filename) => `*${shellEscape(`/${filename}`)}`
+  ).join('|')
+}
+
+/**
+ * POSIX shell that censuses the direct children of `$pid`, setting `kids` and
+ * `unrecognized_kids`. Both stay `unknown` when the host cannot enumerate children at all.
+ */
+export function relayDaemonChildCensusShell(): string[] {
+  return [
+    `${RELAY_CHILD_COUNT_VAR}=unknown`,
+    `${RELAY_UNRECOGNIZED_CHILD_COUNT_VAR}=unknown`,
+    'if command -v pgrep >/dev/null 2>&1; then',
+    `  ${RELAY_CHILD_COUNT_VAR}=0`,
+    `  ${RELAY_UNRECOGNIZED_CHILD_COUNT_VAR}=0`,
+    '  for kid in $(pgrep -P "$pid" 2>/dev/null); do',
+    `    ${RELAY_CHILD_COUNT_VAR}=$((${RELAY_CHILD_COUNT_VAR}+1))`,
+    '    kid_args=$(ps -o args= -p "$kid" 2>/dev/null | tr -d "\\n")',
+    '    case "$kid_args" in',
+    `      ${serviceChildArgvPatterns()}) ;;`,
+    // An unreadable or unrecognised argv lands here, which is what keeps the relay retained.
+    `      *) ${RELAY_UNRECOGNIZED_CHILD_COUNT_VAR}=$((${RELAY_UNRECOGNIZED_CHILD_COUNT_VAR}+1)) ;;`,
+    '    esac',
+    '  done',
+    'fi'
+  ]
+}
diff --git a/src/main/ssh/ssh-file-stream-inactivity-deadline.test.ts b/src/main/ssh/ssh-file-stream-inactivity-deadline.test.ts
new file mode 100644
index 00000000000..f87d1e6f778
--- /dev/null
+++ b/src/main/ssh/ssh-file-stream-inactivity-deadline.test.ts
@@ -0,0 +1,87 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { createSshFileStreamInactivityDeadline } from './ssh-file-stream-inactivity-deadline'
+import type { SystemPowerLifecycleListener } from '../system-power-lifecycle'
+
+afterEach(() => {
+  vi.restoreAllMocks()
+  vi.useRealTimers()
+})
+
+describe('SSH file stream inactivity timer', () => {
+  it('reuses one timer while retaining the deadline of the latest chunk', () => {
+    vi.useFakeTimers()
+    const allocate = vi.spyOn(globalThis, 'setTimeout')
+    const onTimeout = vi.fn()
+    const unsubscribe = vi.fn()
+    const deadline = createSshFileStreamInactivityDeadline(onTimeout, (listener) => {
+      listener.onResume()
+      return unsubscribe
+    })
+    deadline.reset()
+    vi.advanceTimersByTime(30_000)
+    for (let chunk = 0; chunk < 1000; chunk += 1) {
+      deadline.reset()
+    }
+    expect(allocate).toHaveBeenCalledTimes(1)
+    vi.advanceTimersByTime(59_999)
+    expect(onTimeout).not.toHaveBeenCalled()
+    vi.advanceTimersByTime(1)
+    expect(onTimeout).toHaveBeenCalledTimes(1)
+    deadline.clear()
+    expect(unsubscribe).toHaveBeenCalledTimes(1)
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('releases on suspend and creates a fresh timer on resume', () => {
+    vi.useFakeTimers()
+    const allocate = vi.spyOn(globalThis, 'setTimeout')
+    const onTimeout = vi.fn()
+    let power!: SystemPowerLifecycleListener
+    const deadline = createSshFileStreamInactivityDeadline(onTimeout, (listener) => {
+      power = listener
+      listener.onResume()
+      return vi.fn()
+    })
+    deadline.reset()
+    vi.advanceTimersByTime(30_000)
+    power.onSuspend()
+    for (let chunk = 0; chunk < 1000; chunk += 1) {
+      deadline.reset()
+    }
+    expect(vi.getTimerCount()).toBe(0)
+    vi.advanceTimersByTime(120_000)
+    expect(onTimeout).not.toHaveBeenCalled()
+    power.onResume()
+    expect(allocate).toHaveBeenCalledTimes(2)
+    vi.advanceTimersByTime(59_999)
+    expect(onTimeout).not.toHaveBeenCalled()
+    vi.advanceTimersByTime(1)
+    expect(onTimeout).toHaveBeenCalledTimes(1)
+    deadline.clear()
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('clears the timer and subscription and supports a later reset', () => {
+    vi.useFakeTimers()
+    const onTimeout = vi.fn()
+    const unsubscribe = vi.fn()
+    const subscribe = vi.fn((listener: SystemPowerLifecycleListener) => {
+      listener.onResume()
+      return unsubscribe
+    })
+    const deadline = createSshFileStreamInactivityDeadline(onTimeout, subscribe)
+    deadline.reset()
+    deadline.clear()
+    deadline.clear()
+    expect(unsubscribe).toHaveBeenCalledTimes(1)
+    expect(vi.getTimerCount()).toBe(0)
+    vi.advanceTimersByTime(120_000)
+    expect(onTimeout).not.toHaveBeenCalled()
+    deadline.reset()
+    expect(subscribe).toHaveBeenCalledTimes(2)
+    expect(vi.getTimerCount()).toBe(1)
+    deadline.clear()
+    expect(unsubscribe).toHaveBeenCalledTimes(2)
+    expect(vi.getTimerCount()).toBe(0)
+  })
+})
diff --git a/src/main/ssh/ssh-file-stream-inactivity-deadline.ts b/src/main/ssh/ssh-file-stream-inactivity-deadline.ts
index 5470e8121fe..cbb9839f9b3 100644
--- a/src/main/ssh/ssh-file-stream-inactivity-deadline.ts
+++ b/src/main/ssh/ssh-file-stream-inactivity-deadline.ts
@@ -24,10 +24,13 @@ export function createSshFileStreamInactivityDeadline(
     }
   }
   const arm = (): void => {
-    clearTimer()
     if (suspended) {
       return
     }
+    if (timer) {
+      timer.refresh()
+      return
+    }
     timer = setTimeout(onTimeout, SSH_FILE_STREAM_INACTIVITY_TIMEOUT_MS)
     timer.unref?.()
   }
diff --git a/src/main/ssh/ssh-git-response-stream-reader.ts b/src/main/ssh/ssh-git-response-stream-reader.ts
index 6a50dc28a72..0a8b26aa779 100644
--- a/src/main/ssh/ssh-git-response-stream-reader.ts
+++ b/src/main/ssh/ssh-git-response-stream-reader.ts
@@ -90,7 +90,10 @@ export function requestGitStreamable(
     // killed, but a wedged stream (no frames arriving) rejects instead of
     // hanging the caller forever.
     const armInactivity = (): void => {
-      clearInactivity()
+      if (inactivityTimer) {
+        inactivityTimer.refresh()
+        return
+      }
       inactivityTimer = setTimeout(() => {
         fail(
           new GitResponseStreamError(
diff --git a/src/main/ssh/ssh-git-stream-idle-timer.test.ts b/src/main/ssh/ssh-git-stream-idle-timer.test.ts
new file mode 100644
index 00000000000..7cd5207c63a
--- /dev/null
+++ b/src/main/ssh/ssh-git-stream-idle-timer.test.ts
@@ -0,0 +1,80 @@
+import { expect, it, vi } from 'vitest'
+import type { SshChannelMultiplexer } from './ssh-channel-multiplexer'
+import { requestGitStreamable } from './ssh-git-response-stream-reader'
+
+it.each(['end', 'abort', 'timeout'] as const)(
+  'reuses the idle deadline across 1000 chunks and cleans up on %s',
+  async (finish) => {
+    vi.useFakeTimers()
+    const setTimer = vi.spyOn(globalThis, 'setTimeout')
+    try {
+      const listeners = new Map<string, (params: Record<string, unknown>) => void>()
+      const controller = new AbortController()
+      const content = 'x'.repeat(998)
+      const encoded = Buffer.from(JSON.stringify(content))
+      const notify = vi.fn()
+      const mux = {
+        request: vi.fn(async () => ({
+          __orcaGitResponseStream: { streamId: 7, totalBytes: encoded.length, chunkCount: 1000 }
+        })),
+        isDisposed: () => false,
+        notify,
+        onDispose: () => () => {},
+        onNotificationByMethod: (
+          method: string,
+          callback: (params: Record<string, unknown>) => void
+        ) => {
+          listeners.set(method, callback)
+          return () => listeners.delete(method)
+        }
+      }
+      const promise = requestGitStreamable(
+        mux as unknown as SshChannelMultiplexer,
+        'git.diff',
+        {},
+        {
+          signal: controller.signal
+        }
+      )
+      const outcome = promise.then(
+        (value) => ({ value }),
+        (error: Error) => ({ error: error.message })
+      )
+      await vi.advanceTimersByTimeAsync(15_000)
+      for (let seq = 0; seq < encoded.length; seq++) {
+        listeners.get('git.responseChunk')!({
+          streamId: 7,
+          seq,
+          data: encoded.subarray(seq, seq + 1).toString('base64')
+        })
+      }
+      await vi.advanceTimersByTimeAsync(29_999)
+      expect(listeners.size).toBe(3)
+      expect(notify.mock.calls.filter(([method]) => method === 'git.responseAck')).toHaveLength(
+        1000
+      )
+      const allocations = setTimer.mock.calls.filter(([, delay]) => delay === 30_000).length
+      if (finish === 'end') {
+        listeners.get('git.responseEnd')!({ streamId: 7 })
+        expect(await outcome).toEqual({ value: content })
+      } else if (finish === 'abort') {
+        controller.abort()
+        expect(await outcome).toEqual({ error: 'Request was cancelled' })
+      } else {
+        await vi.advanceTimersByTimeAsync(1)
+        expect(await outcome).toEqual({
+          error: 'Git response stream stalled (>30000ms without data)'
+        })
+      }
+      expect(allocations).toBe(1)
+      expect(vi.getTimerCount()).toBe(0)
+      expect(listeners.size).toBe(0)
+      expect(
+        notify.mock.calls.filter(([method]) => method === 'git.cancelResponseStream')
+      ).toHaveLength(finish === 'end' ? 0 : 1)
+    } finally {
+      setTimer.mockRestore()
+      vi.useRealTimers()
+    }
+  }
+)
diff --git a/src/main/ssh/ssh-relay-build-toolchain.test.ts b/src/main/ssh/ssh-relay-build-toolchain.test.ts
index b216b599f5a..6fcc4f5321d 100644
--- a/src/main/ssh/ssh-relay-build-toolchain.test.ts
+++ b/src/main/ssh/ssh-relay-build-toolchain.test.ts
@@ -3,7 +3,9 @@ import {
   buildToolchainProbeCommand,
   parseBuildToolchainProbe,
   formatMissingToolchainError,
+  formatNodeHeadersDownloadError,
   formatSkippedNodePtyWarning,
+  isNodeHeadersDownloadFailure,
   shouldProbeBuildToolchainAfterNativeDepsFailure
 } from './ssh-relay-build-toolchain'
 
@@ -125,3 +127,71 @@ describe('formatSkippedNodePtyWarning', () => {
     expect(warning).toContain('install a C/C++ toolchain')
   })
 })
+
+// Verbatim shape of the STA-6674 failure: node-gyp on a host whose nodejs.org is refused.
+const HEADERS_REFUSED =
+  'npm error gyp http GET https://nodejs.org/download/release/v24.12.0/node-v24.12.0-headers.tar.gz\n' +
+  'npm error gyp http fetch GET https://nodejs.org/download/release/v24.12.0/node-v24.12.0-headers.tar.gz attempt 1 failed with ECONNREFUSED\n' +
+  'npm error gyp ERR! configure error\n' +
+  'npm error gyp ERR! stack FetchError: request to https://nodejs.org/download/release/v24.12.0/node-v24.12.0-headers.tar.gz failed, reason: connect ECONNREFUSED 127.0.0.1:443'
+
+describe('isNodeHeadersDownloadFailure', () => {
+  it('matches node-gyp failing to fetch the Node headers tarball', () => {
+    expect(isNodeHeadersDownloadFailure(HEADERS_REFUSED)).toBe(true)
+    expect(
+      isNodeHeadersDownloadFailure(
+        'gyp http fetch GET https://nodejs.org/download/release/v20.19.0/node-v20.19.0-headers.tar.gz attempt 1 failed with ENOTFOUND\ngyp ERR! configure error'
+      )
+    ).toBe(true)
+  })
+
+  it('is not the toolchain diagnosis, and does not fire on other network failures', () => {
+    expect(shouldProbeBuildToolchainAfterNativeDepsFailure(HEADERS_REFUSED)).toBe(false)
+    // The registry, not nodejs.org: a different remedy.
+    expect(
+      isNodeHeadersDownloadFailure(
+        'npm error network request to https://registry.npmjs.org/node-pty failed, reason: connect ECONNREFUSED'
+      )
+    ).toBe(false)
+    // Headers named but the build failed for another reason.
+    expect(
+      isNodeHeadersDownloadFailure(
+        'gyp info using node-v24.12.0-headers.tar.gz\ngyp ERR! build error make failed with exit code: 2'
+      )
+    ).toBe(false)
+    // A retried attempt that recovered, then a compile failure: not a download failure.
+    expect(
+      isNodeHeadersDownloadFailure(
+        'gyp http fetch GET https://nodejs.org/download/release/v24.12.0/node-v24.12.0-headers.tar.gz attempt 1 failed with ECONNRESET\n' +
+          'gyp http 200 https://nodejs.org/download/release/v24.12.0/node-v24.12.0-headers.tar.gz\n' +
+          'gyp ERR! build error\ngyp ERR! stack Error: `make` failed with exit code: 2'
+      )
+    ).toBe(false)
+    // A mirror answering non-2xx is a FetchError without a network code: a different remedy.
+    expect(
+      isNodeHeadersDownloadFailure(
+        'gyp ERR! configure error\ngyp ERR! stack FetchError: 404 Not Found https://mirror/dist/v24.12.0/node-v24.12.0-headers.tar.gz'
+      )
+    ).toBe(false)
+  })
+})
+
+describe('formatNodeHeadersDownloadError', () => {
+  it('names both host remedies when the host ships no headers', () => {
+    const msg = formatNodeHeadersDownloadError(HEADERS_REFUSED, null)
+    expect(msg).toContain('no local headers matching its own version')
+    expect(msg).toContain('<prefix>/include/node')
+    expect(msg).toContain('nvm, fnm, volta, n')
+    expect(msg).toContain('disturl')
+    expect(msg).toContain('ECONNREFUSED')
+  })
+
+  it('reports an Orca defect, not a host problem, when headers were exported and ignored', () => {
+    const msg = formatNodeHeadersDownloadError(HEADERS_REFUSED, '/usr/local')
+    expect(msg).toContain('/usr/local/include/node')
+    expect(msg).toContain('Orca defect')
+    expect(msg).not.toContain('no local headers matching its own version')
+    expect(msg).not.toContain('nvm, fnm, volta, n')
+    expect(msg).toContain('ECONNREFUSED')
+  })
+})
diff --git a/src/main/ssh/ssh-relay-build-toolchain.ts b/src/main/ssh/ssh-relay-build-toolchain.ts
index bcb64d3bdf9..db7b6353697 100644
--- a/src/main/ssh/ssh-relay-build-toolchain.ts
+++ b/src/main/ssh/ssh-relay-build-toolchain.ts
@@ -16,7 +16,9 @@ export {
   shouldProbeBuildToolchainAfterNativeDepsFailure,
   toolchainInstallHintLines,
   formatSkippedNodePtyWarning,
-  formatMissingToolchainError
+  formatMissingToolchainError,
+  formatNodeHeadersDownloadError,
+  isNodeHeadersDownloadFailure
 } from './build-toolchain-diagnosis'
 export type { BuildToolchainStatus } from './build-toolchain-diagnosis'
 
diff --git a/src/main/ssh/ssh-relay-deploy-helpers.ts b/src/main/ssh/ssh-relay-deploy-helpers.ts
index a035133ddc5..f9a8f167752 100644
--- a/src/main/ssh/ssh-relay-deploy-helpers.ts
+++ b/src/main/ssh/ssh-relay-deploy-helpers.ts
@@ -209,6 +209,7 @@ export function waitForSentinel(
         const afterSentinelOffset =
           sentinelIdx + RELAY_SENTINEL_BUFFER.length - bufferedStdout.length
         const afterSentinel = data.subarray(Math.max(0, afterSentinelOffset))
+        bufferedStdout = Buffer.alloc(0)
 
         if (afterSentinel.length > 0) {
           pendingAfterSentinel = afterSentinel
@@ -258,7 +259,7 @@ export function waitForSentinel(
         return
       }
 
-      bufferedStdout = bufferedStdout.length === 0 ? data : Buffer.concat([bufferedStdout, data])
+      bufferedStdout = startupStdout
     })
   })
 }
diff --git a/src/main/ssh/ssh-relay-deploy.ts b/src/main/ssh/ssh-relay-deploy.ts
index 257eb984caa..5d8101361c6 100644
--- a/src/main/ssh/ssh-relay-deploy.ts
+++ b/src/main/ssh/ssh-relay-deploy.ts
@@ -53,11 +53,14 @@ import {
 } from './ssh-relay-deploy-timing'
 import { createSshOperationAbortError, shellEscape } from './ssh-connection-utils'
 import { isWindowsRelayPlatform } from '../../shared/relay-artifacts'
+import { exportLocalNodeHeadersPrefix, localNodeHeadersFromOutput } from './ssh-relay-node-headers'
 import {
   probeBuildToolchain,
   formatMissingToolchainError,
   formatSkippedNodePtyWarning,
-  shouldProbeBuildToolchainAfterNativeDepsFailure
+  shouldProbeBuildToolchainAfterNativeDepsFailure,
+  formatNodeHeadersDownloadError,
+  isNodeHeadersDownloadFailure
 } from './ssh-relay-build-toolchain'
 import {
   commandWithNodePath,
@@ -743,6 +746,7 @@ function uploadStageNamespaceIfSupported(
 
 const NODE_PTY_VERSION = '1.1.0'
 const NODE_PTY_CONSOLE_LIST_PATCH_FILENAME = 'node-pty-1.1.0-console-list-agent-patch.cjs'
+const NODE_PTY_WINDOWS_TEARDOWN_PATCH_FILENAME = 'node-pty-1.1.0-windows-pty-teardown-patch.cjs'
 const NODE_PTY_MASTER_CLOEXEC_PATCH_FILENAME = 'node-pty-1.1.0-master-cloexec-patch.cjs'
 const NODE_PTY_CLOEXEC_STATUS_PREFIX = 'ORCA-NPTY-CLOEXEC:'
 /**
@@ -791,7 +795,8 @@ function nativeDepsProbeJs(successToken: string): string {
   // Why: node-pty's Windows wrapper defers conpty.node until first spawn, so require("node-pty") alone can't prove the binding is healthy.
   const loadNodePty =
     'require("node-pty"); require("node-pty/lib/utils").loadNativeModule(process.platform==="win32"&&Number(require("os").release().split(".")[2])>=18309?"conpty":"pty");' +
-    `if(process.platform==="win32"){require("./${NODE_PTY_CONSOLE_LIST_PATCH_FILENAME}").assertPatchedNodePtyConsoleListAgent(process.cwd())}`
+    `if(process.platform==="win32"){require("./${NODE_PTY_CONSOLE_LIST_PATCH_FILENAME}").assertPatchedNodePtyConsoleListAgent(process.cwd());` +
+    `require("./${NODE_PTY_WINDOWS_TEARDOWN_PATCH_FILENAME}").assertPatchedNodePtyWindowsTeardown(process.cwd())}`
   return `(()=>{const missing=[];try{${loadNodePty}}catch{missing.push("node-pty")}try{require("@parcel/watcher")}catch{missing.push("@parcel/watcher")}if(missing.length){console.log("${NATIVE_DEPS_MISSING_PREFIX}"+missing.join(","));process.exitCode=1}else{console.log(${JSON.stringify(successToken)})}})()`
 }
 
@@ -1172,7 +1177,7 @@ async function installNativeDeps(
           hostPlatform,
           nodePath,
           remoteDir,
-          `${resetPrefix}npm install --ignore-scripts=false --omit=dev --no-audit --no-fund ${installArgs} 2>&1`
+          `${exportLocalNodeHeadersPrefix(nodePath)}${resetPrefix}npm install --ignore-scripts=false --omit=dev --no-audit --no-fund ${installArgs} 2>&1`
         )
     await execHostCommand(conn, hostPlatform, command, {
       timeoutMs: NATIVE_DEPS_COMMAND_TIMEOUT_MS,
@@ -1234,6 +1239,14 @@ async function installNativeDeps(
         return
       }
     }
+    // Why: either the local-headers export found nothing (a host both header-less and offline) or
+    // it did and node-gyp downloaded anyway (the export is broken) -- name which, or the log reads
+    // as a broken relay either way.
+    if (platform.startsWith('linux') && isNodeHeadersDownloadFailure(msg)) {
+      throw new Error(formatNodeHeadersDownloadError(msg, localNodeHeadersFromOutput(msg)), {
+        cause: err
+      })
+    }
     throw err
   }
 
@@ -1252,8 +1265,15 @@ async function installNativeDeps(
         throw err
       }
       signal?.throwIfAborted()
+      // Same diagnosis as the install catch: this fallback is non-fatal, so the log is the only
+      // place the offline-headers cause can reach anyone.
+      const rebuildMsg = (err as Error).message
       console.warn(
-        `[ssh-relay][NATIVE-DEPS-REBUILD-FAIL] npm rebuild native deps failed at ${remoteDir} (${platform}): ${(err as Error).message}`
+        `[ssh-relay][NATIVE-DEPS-REBUILD-FAIL] npm rebuild native deps failed at ${remoteDir} (${platform}): ${
+          platform.startsWith('linux') && isNodeHeadersDownloadFailure(rebuildMsg)
+            ? formatNodeHeadersDownloadError(rebuildMsg, localNodeHeadersFromOutput(rebuildMsg))
+            : rebuildMsg
+        }`
       )
     }
     signal?.throwIfAborted()
@@ -1327,10 +1347,16 @@ async function applyNodePtyMasterCloexecPatch(
   nodePath: string,
   signal?: AbortSignal
 ): Promise<NodePtyMasterCloexecOutcome> {
-  // Both Unix relay platforms leak, by different bugs: Linux inherits the master through forkpty()'s
-  // no-O_CLOEXEC path, macOS orphans one throwaway /dev/ptmx fd per spawn in pty_posix_spawn. Only
-  // Windows, which has no fds, is short-circuited -- and answering 'fixed' from a gate that ran
-  // nothing is exactly how a leaking darwin tree got published to the shared cache.
+  // Both Unix relay platforms leak the pty master, by different bugs: Linux inherits it through
+  // forkpty()'s no-O_CLOEXEC path, macOS orphans one throwaway /dev/ptmx fd per spawn in
+  // pty_posix_spawn. Windows is short-circuited because it has no fds for a master to leak into --
+  // and answering 'fixed' from a gate that ran nothing is exactly how a leaking darwin tree got
+  // published to the shared cache.
+  //
+  // What 'fixed' means here is exactly "this tree does not leak the pty MASTER", which is the only
+  // thing the shared native-deps cache keys on. It is NOT a statement that a Windows relay leaks
+  // nothing: it leaked one Windows File handle per terminal until the ConPTY teardown patch above,
+  // by a mechanism that has nothing to do with fds. Read this gate as scoped to its own question.
   if (isWindowsRemoteHost(hostPlatform) || isWindowsRelayPlatform(platform)) {
     return 'fixed'
   }
@@ -1339,7 +1365,7 @@ async function applyNodePtyMasterCloexecPatch(
       hostPlatform,
       nodePath,
       remoteDir,
-      `${shellEscape(nodePath)} ${shellEscape(NODE_PTY_MASTER_CLOEXEC_PATCH_FILENAME)} 2>&1`
+      `${exportLocalNodeHeadersPrefix(nodePath)}${shellEscape(nodePath)} ${shellEscape(NODE_PTY_MASTER_CLOEXEC_PATCH_FILENAME)} 2>&1`
     )
     const output = await execHostCommand(conn, hostPlatform, command, {
       timeoutMs: NATIVE_DEPS_COMMAND_TIMEOUT_MS,
@@ -1521,7 +1547,7 @@ async function rebuildNativeDeps(
         hostPlatform,
         nodePath,
         remoteDir,
-        `npm rebuild --ignore-scripts=false ${depNames.map(shellEscape).join(' ')} 2>&1`
+        `${exportLocalNodeHeadersPrefix(nodePath)}npm rebuild --ignore-scripts=false ${depNames.map(shellEscape).join(' ')} 2>&1`
       )
   await execHostCommand(conn, hostPlatform, command, {
     timeoutMs: NATIVE_DEPS_COMMAND_TIMEOUT_MS,
@@ -1530,8 +1556,11 @@ async function rebuildNativeDeps(
 }
 
 function windowsNodePtyPatchCommand(nodePath: string): string {
-  // Why: pnpm patches do not cross the SSH boundary; apply the version-checked fallback to the remote npm package.
-  return `& ${powerShellLiteral(nodePath)} ${powerShellLiteral(NODE_PTY_CONSOLE_LIST_PATCH_FILENAME)}; if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }`
+  // Why: pnpm patches do not cross the SSH boundary; apply the version-checked fallbacks to the remote npm package.
+  return [
+    `& ${powerShellLiteral(nodePath)} ${powerShellLiteral(NODE_PTY_CONSOLE_LIST_PATCH_FILENAME)}; if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }`,
+    `& ${powerShellLiteral(nodePath)} ${powerShellLiteral(NODE_PTY_WINDOWS_TEARDOWN_PATCH_FILENAME)}; if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }`
+  ].join('; ')
 }
 
 async function makeNodePtySpawnHelperExecutable(
diff --git a/src/main/ssh/ssh-relay-endpoint-incumbent-shell.integration.test.ts b/src/main/ssh/ssh-relay-endpoint-incumbent-shell.integration.test.ts
index 7ece0b6532e..a8975d0520b 100644
--- a/src/main/ssh/ssh-relay-endpoint-incumbent-shell.integration.test.ts
+++ b/src/main/ssh/ssh-relay-endpoint-incumbent-shell.integration.test.ts
@@ -4,7 +4,7 @@
  * generated scripts through /bin/sh against real unix sockets and real processes.
  */
 import { execFile, spawn, type ChildProcess } from 'node:child_process'
-import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { mkdirSync, mkdtempSync, rmSync, symlinkSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterAll, afterEach, beforeAll, describe, expect, it } from 'vitest'
@@ -15,21 +15,32 @@ import {
   type RelayEndpointIncumbent
 } from './ssh-relay-endpoint-incumbent'
 import { reapEmptyRelayHuskCommand } from './ssh-relay-endpoint-takeover'
+import { RELAY_DAEMON_SERVICE_ENTRY_FILENAMES } from '../../shared/relay-artifacts'
 
 const posixOnly = process.platform === 'win32' ? describe.skip : describe
 
 const FAKE_RELAY_SOURCE = `
 const net = require('net')
+const path = require('path')
 const sock = process.argv[process.argv.indexOf('--sock-path') + 1]
+function spawnChild(args) {
+  require('child_process').spawn(process.execPath, args, { stdio: 'ignore' })
+}
 if (process.argv.includes('--with-child')) {
-  require('child_process').spawn(process.execPath, ['-e', 'setInterval(() => {}, 1000)'], {
-    stdio: 'ignore'
-  })
+  spawnChild(['-e', 'setTimeout(() => {}, 60000)'])
+}
+// Why forked the same way production does: the exclusion is argv-shaped, so a hand-written
+// stand-in would test the test rather than the shell that runs on someone's host.
+for (const name of process.argv.filter((arg) => arg.startsWith('--service-child='))) {
+  spawnChild([path.join(__dirname, name.slice('--service-child='.length))])
 }
 net.createServer(() => {}).listen(sock, () => process.stdout.write('READY\\n'))
 process.on('SIGTERM', () => process.exit(0))
 `
 
+// Self-limiting: these are orphaned when the relay under test is reaped.
+const IDLE_SERVICE_SOURCE = 'setTimeout(() => {}, 60000)\n'
+
 function sh(script: string): Promise<string> {
   return new Promise((resolve, reject) => {
     execFile('/bin/sh', ['-c', script], { timeout: 20_000 }, (error, stdout) => {
@@ -43,14 +54,21 @@ function sh(script: string): Promise<string> {
 }
 
 let workDir: string
+let pgreplessBinDir: string
 let hasLsof = false
 const running: ChildProcess[] = []
 
-function startFakeRelay(sockPath: string, withChild = false): Promise<ChildProcess> {
+function startFakeRelay(
+  sockPath: string,
+  options: { withChild?: boolean; serviceChildren?: readonly string[] } = {}
+): Promise<ChildProcess> {
   const args = [join(workDir, 'relay.js'), '--sock-path', sockPath]
-  if (withChild) {
+  if (options.withChild) {
     args.push('--with-child')
   }
+  for (const name of options.serviceChildren ?? []) {
+    args.push(`--service-child=${name}`)
+  }
   const child = spawn(process.execPath, args, { stdio: ['ignore', 'pipe', 'ignore'] })
   running.push(child)
   return new Promise((resolve, reject) => {
@@ -68,9 +86,31 @@ async function probe(sockPath: string): Promise<RelayEndpointIncumbent> {
   return parseRelayEndpointIncumbentProbe(sockPath, output)
 }
 
+/** The relay forks its children after it starts listening, so the probe can race them. */
+async function waitForChildCount(
+  sockPath: string,
+  expected: number
+): Promise<RelayEndpointIncumbent> {
+  let incumbent = await probe(sockPath)
+  for (let attempt = 0; attempt < 50 && incumbent.holders[0]?.childCount !== expected; attempt++) {
+    await new Promise((resolve) => setTimeout(resolve, 100))
+    incumbent = await probe(sockPath)
+  }
+  return incumbent
+}
+
 beforeAll(async () => {
   workDir = mkdtempSync(join(tmpdir(), 'orca-relay-incumbent-'))
   writeFileSync(join(workDir, 'relay.js'), FAKE_RELAY_SOURCE)
+  for (const filename of RELAY_DAEMON_SERVICE_ENTRY_FILENAMES) {
+    writeFileSync(join(workDir, filename), IDLE_SERVICE_SOURCE)
+  }
+  writeFileSync(join(workDir, 'looks-like-relay-watcher.js'), IDLE_SERVICE_SOURCE)
+  pgreplessBinDir = join(workDir, 'pgrepless-bin')
+  mkdirSync(pgreplessBinDir)
+  for (const tool of ['ps', 'tr']) {
+    symlinkSync((await sh(`command -v ${tool}`)).trim(), join(pgreplessBinDir, tool))
+  }
   hasLsof = await sh('command -v lsof >/dev/null 2>&1 && echo yes || echo no').then(
     (out) => out.trim() === 'yes'
   )
@@ -105,13 +145,51 @@ posixOnly('relay endpoint probe against a real socket', () => {
       return
     }
     expect(incumbent.holders.map((holder) => holder.pid)).toEqual([relay.pid])
-    expect(incumbent.holders[0]).toMatchObject({ matchesRelayArgv: true, childCount: 0 })
+    expect(incumbent.holders[0]).toMatchObject({
+      matchesRelayArgv: true,
+      childCount: 0,
+      unrecognizedChildCount: 0
+    })
     expect(isReapableRelayHusk(incumbent)).toBe(true)
   })
 
+  it("counts the daemon's own service children but does not hold them against it", async () => {
+    const sockPath = join(workDir, 'services.sock')
+    await startFakeRelay(sockPath, { serviceChildren: RELAY_DAEMON_SERVICE_ENTRY_FILENAMES })
+    const incumbent = await waitForChildCount(sockPath, RELAY_DAEMON_SERVICE_ENTRY_FILENAMES.length)
+
+    expect(incumbent.holders[0].childCount).toBe(RELAY_DAEMON_SERVICE_ENTRY_FILENAMES.length)
+    expect(incumbent.holders[0].unrecognizedChildCount).toBe(0)
+    expect(isReapableRelayHusk(incumbent)).toBe(true)
+  })
+
+  it('still retains a relay holding work alongside its service children', async () => {
+    const sockPath = join(workDir, 'services-and-work.sock')
+    await startFakeRelay(sockPath, {
+      withChild: true,
+      serviceChildren: RELAY_DAEMON_SERVICE_ENTRY_FILENAMES
+    })
+    const incumbent = await waitForChildCount(
+      sockPath,
+      RELAY_DAEMON_SERVICE_ENTRY_FILENAMES.length + 1
+    )
+
+    expect(incumbent.holders[0].unrecognizedChildCount).toBe(1)
+    expect(isReapableRelayHusk(incumbent)).toBe(false)
+  })
+
+  it('does not excuse a child that merely mentions a service entry name', async () => {
+    const sockPath = join(workDir, 'lookalike.sock')
+    await startFakeRelay(sockPath, { serviceChildren: ['looks-like-relay-watcher.js'] })
+    const incumbent = await waitForChildCount(sockPath, 1)
+
+    expect(incumbent.holders[0].unrecognizedChildCount).toBe(1)
+    expect(isReapableRelayHusk(incumbent)).toBe(false)
+  })
+
   it('refuses to call a relay with a live child an empty husk', async () => {
     const sockPath = join(workDir, 'busy.sock')
-    await startFakeRelay(sockPath, true)
+    await startFakeRelay(sockPath, { withChild: true })
     const incumbent = await probe(sockPath)
 
     expect(incumbent.verdict).toBe('live')
@@ -150,12 +228,34 @@ posixOnly('empty relay husk reap against a real process', () => {
 
   it('refuses to signal a relay that acquired a child after it was probed', async () => {
     const sockPath = join(workDir, 'raced.sock')
-    const relay = await startFakeRelay(sockPath, true)
+    const relay = await startFakeRelay(sockPath, { withChild: true })
     const output = await sh(reapEmptyRelayHuskCommand(relay.pid!, sockPath))
     expect(output.trim()).toBe('BUSY')
     expect(relay.killed).toBe(false)
   })
 
+  it('terminates a relay whose only children are its own service processes (#13614)', async () => {
+    const sockPath = join(workDir, 'service-husk.sock')
+    const relay = await startFakeRelay(sockPath, {
+      serviceChildren: RELAY_DAEMON_SERVICE_ENTRY_FILENAMES
+    })
+    await waitForChildCount(sockPath, RELAY_DAEMON_SERVICE_ENTRY_FILENAMES.length)
+    const output = await sh(reapEmptyRelayHuskCommand(relay.pid!, sockPath))
+    expect(output.trim()).toBe('GONE')
+  })
+
+  it('refuses to signal when the host cannot enumerate children at all', async () => {
+    const sockPath = join(workDir, 'no-pgrep.sock')
+    const relay = await startFakeRelay(sockPath)
+    // A PATH carrying every tool the script needs except `pgrep`: the census answers
+    // `unknown`, which must reach BUSY rather than the zero a missing tool would imply.
+    const output = await sh(
+      `PATH=${pgreplessBinDir}\n${reapEmptyRelayHuskCommand(relay.pid!, sockPath)}`
+    )
+    expect(output.trim()).toBe('BUSY')
+    expect(relay.killed).toBe(false)
+  })
+
   it('refuses to signal a pid whose argv is not this relay at this socket', async () => {
     const sockPath = join(workDir, 'mismatch.sock')
     await startFakeRelay(sockPath)
diff --git a/src/main/ssh/ssh-relay-endpoint-incumbent.test.ts b/src/main/ssh/ssh-relay-endpoint-incumbent.test.ts
index a65cb33fc57..de4cc28d170 100644
--- a/src/main/ssh/ssh-relay-endpoint-incumbent.test.ts
+++ b/src/main/ssh/ssh-relay-endpoint-incumbent.test.ts
@@ -32,17 +32,24 @@ describe('parseRelayEndpointIncumbentProbe', () => {
   it('reports live when the socket accepted a connection', () => {
     const incumbent = parseRelayEndpointIncumbentProbe(
       SOCK,
-      probeOutput(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=4242 yes 13'])
+      probeOutput([
+        'PRESENT=yes',
+        'LISTEN=accepted',
+        'HOLDERS_SOURCE=lsof',
+        'HOLDER=4242 yes 13 11'
+      ])
     )
     expect(incumbent.verdict).toBe('live')
     expect(incumbent.evidence).toBe('accepted-connection')
-    expect(incumbent.holders).toEqual([{ pid: 4242, matchesRelayArgv: true, childCount: 13 }])
+    expect(incumbent.holders).toEqual([
+      { pid: 4242, matchesRelayArgv: true, childCount: 13, unrecognizedChildCount: 11 }
+    ])
   })
 
   it('reports live when a process still holds an inode that refuses connections', () => {
     const incumbent = parseRelayEndpointIncumbentProbe(
       SOCK,
-      probeOutput(['PRESENT=yes', 'LISTEN=refused', 'HOLDERS_SOURCE=lsof', 'HOLDER=91 yes 2'])
+      probeOutput(['PRESENT=yes', 'LISTEN=refused', 'HOLDERS_SOURCE=lsof', 'HOLDER=91 yes 2 2'])
     )
     expect(incumbent.verdict).toBe('live')
     expect(incumbent.evidence).toBe('holder-process')
@@ -85,7 +92,12 @@ describe('parseRelayEndpointIncumbentProbe', () => {
   it('drops holder lines that do not carry a usable pid', () => {
     const incumbent = parseRelayEndpointIncumbentProbe(
       SOCK,
-      probeOutput(['PRESENT=yes', 'LISTEN=refused', 'HOLDERS_SOURCE=lsof', 'HOLDER=- no unknown'])
+      probeOutput([
+        'PRESENT=yes',
+        'LISTEN=refused',
+        'HOLDERS_SOURCE=lsof',
+        'HOLDER=- no unknown unknown'
+      ])
     )
     expect(incumbent.holders).toEqual([])
     expect(incumbent.verdict).toBe('exited')
@@ -94,9 +106,24 @@ describe('parseRelayEndpointIncumbentProbe', () => {
   it('keeps an unreadable child count as null rather than zero', () => {
     const [holder] = parseRelayEndpointIncumbentProbe(
       SOCK,
-      probeOutput(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=7 yes unknown'])
+      probeOutput([
+        'PRESENT=yes',
+        'LISTEN=accepted',
+        'HOLDERS_SOURCE=lsof',
+        'HOLDER=7 yes unknown unknown'
+      ])
     ).holders
     expect(holder.childCount).toBeNull()
+    expect(holder.unrecognizedChildCount).toBeNull()
+  })
+
+  it('keeps a holder line with no unrecognized-child field unreapable', () => {
+    const incumbent = parseRelayEndpointIncumbentProbe(
+      SOCK,
+      probeOutput(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=7 yes 0'])
+    )
+    expect(incumbent.holders[0].unrecognizedChildCount).toBeNull()
+    expect(isReapableRelayHusk(incumbent)).toBe(false)
   })
 })
 
@@ -172,27 +199,36 @@ describe('mayLaunchOverRelayEndpoint', () => {
 describe('isReapableRelayHusk', () => {
   const husk = parseRelayEndpointIncumbentProbe(
     SOCK,
-    probeOutput(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=500 yes 0'])
+    probeOutput(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=500 yes 0 0'])
   )
 
-  it('accepts a single proven relay holder with zero children', () => {
+  it('accepts a single proven relay holder with no unaccounted-for children', () => {
     expect(isReapableRelayHusk(husk)).toBe(true)
   })
 
-  it('refuses a relay that still holds children', () => {
+  it('accepts a relay whose only children are its own service processes (#13614)', () => {
+    const withServices = parseRelayEndpointIncumbentProbe(
+      SOCK,
+      probeOutput(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=500 yes 2 0'])
+    )
+    expect(withServices.holders[0].childCount).toBe(2)
+    expect(isReapableRelayHusk(withServices)).toBe(true)
+  })
+
+  it('refuses a relay that still holds children it could not account for', () => {
     expect(
       isReapableRelayHusk({
         ...husk,
-        holders: [{ pid: 500, matchesRelayArgv: true, childCount: 1 }]
+        holders: [{ pid: 500, matchesRelayArgv: true, childCount: 3, unrecognizedChildCount: 1 }]
       })
     ).toBe(false)
   })
 
-  it('refuses a holder whose child count could not be read', () => {
+  it('refuses a holder whose unrecognized-child count could not be read', () => {
     expect(
       isReapableRelayHusk({
         ...husk,
-        holders: [{ pid: 500, matchesRelayArgv: true, childCount: null }]
+        holders: [{ pid: 500, matchesRelayArgv: true, childCount: 0, unrecognizedChildCount: null }]
       })
     ).toBe(false)
   })
@@ -201,7 +237,7 @@ describe('isReapableRelayHusk', () => {
     expect(
       isReapableRelayHusk({
         ...husk,
-        holders: [{ pid: 500, matchesRelayArgv: false, childCount: 0 }]
+        holders: [{ pid: 500, matchesRelayArgv: false, childCount: 0, unrecognizedChildCount: 0 }]
       })
     ).toBe(false)
   })
@@ -211,8 +247,8 @@ describe('isReapableRelayHusk', () => {
       isReapableRelayHusk({
         ...husk,
         holders: [
-          { pid: 500, matchesRelayArgv: true, childCount: 0 },
-          { pid: 501, matchesRelayArgv: true, childCount: 0 }
+          { pid: 500, matchesRelayArgv: true, childCount: 0, unrecognizedChildCount: 0 },
+          { pid: 501, matchesRelayArgv: true, childCount: 0, unrecognizedChildCount: 0 }
         ]
       })
     ).toBe(false)
diff --git a/src/main/ssh/ssh-relay-endpoint-incumbent.ts b/src/main/ssh/ssh-relay-endpoint-incumbent.ts
index 2688267f4c7..628a9558793 100644
--- a/src/main/ssh/ssh-relay-endpoint-incumbent.ts
+++ b/src/main/ssh/ssh-relay-endpoint-incumbent.ts
@@ -20,6 +20,11 @@
  */
 import type { SshConnection } from './ssh-connection'
 import { shellEscape } from './ssh-connection-utils'
+import {
+  RELAY_CHILD_COUNT_VAR,
+  RELAY_UNRECOGNIZED_CHILD_COUNT_VAR,
+  relayDaemonChildCensusShell
+} from './relay-daemon-service-children'
 import { execCommand, isUnconfirmedSshCommandTermination } from './ssh-relay-deploy-helpers'
 import { isWindowsRemoteHost, type RemoteHostPlatform } from './ssh-remote-platform'
 
@@ -38,6 +43,12 @@ export type RelayEndpointHolder = {
   matchesRelayArgv: boolean
   /** Direct children, or null when `pgrep` could not answer. Never guessed. */
   childCount: number | null
+  /**
+   * Direct children *not* positively identified as the daemon's own service processes, or
+   * null when the host could not enumerate them. This — not `childCount` — is what says
+   * whether the relay holds anything; see relay-daemon-service-children.ts.
+   */
+  unrecognizedChildCount: number | null
 }
 
 export type RelayEndpointIncumbent = {
@@ -95,11 +106,9 @@ export function relayEndpointIncumbentProbeCommand(nodePath: string, sockPath: s
     '    args=$(ps -o args= -p "$pid" 2>/dev/null | tr "\\n" " ")',
     '    match=no',
     '    case "$args" in *relay.js*"$sock"*) match=yes ;; esac',
-    '    kids=unknown',
-    '    if command -v pgrep >/dev/null 2>&1; then',
-    '      kids=$(pgrep -P "$pid" 2>/dev/null | grep -c .)',
-    '    fi',
-    '    printf \'HOLDER=%s %s %s\\n\' "$pid" "$match" "$kids"',
+    ...relayDaemonChildCensusShell().map((line) => `    ${line}`),
+    '    printf \'HOLDER=%s %s %s %s\\n\' "$pid" "$match" ' +
+      `"$${RELAY_CHILD_COUNT_VAR}" "$${RELAY_UNRECOGNIZED_CHILD_COUNT_VAR}"`,
     '  done',
     'else',
     "  printf 'HOLDERS_SOURCE=unavailable\\n'",
@@ -159,19 +168,25 @@ export function parseRelayEndpointIncumbentProbe(
 }
 
 function parseHolder(value: string): RelayEndpointHolder | null {
-  const [rawPid, rawMatch, rawKids] = value.split(/\s+/)
+  const [rawPid, rawMatch, rawKids, rawUnrecognized] = value.split(/\s+/)
   const pid = Number.parseInt(rawPid ?? '', 10)
   if (!Number.isInteger(pid) || pid <= 0) {
     return null
   }
-  const childCount = Number.parseInt(rawKids ?? '', 10)
   return {
     pid,
     matchesRelayArgv: rawMatch === 'yes',
-    childCount: Number.isInteger(childCount) && childCount >= 0 ? childCount : null
+    childCount: parseChildCount(rawKids),
+    unrecognizedChildCount: parseChildCount(rawUnrecognized)
   }
 }
 
+/** `unknown`, a missing field, and anything unparseable are all "could not tell" — never 0. */
+function parseChildCount(raw: string | undefined): number | null {
+  const count = Number.parseInt(raw ?? '', 10)
+  return Number.isInteger(count) && count >= 0 ? count : null
+}
+
 function unverifiableEndpoint(sockPath: string): RelayEndpointIncumbent {
   return {
     sockPath,
@@ -239,8 +254,12 @@ export function mayLaunchOverRelayEndpoint(incumbent: RelayEndpointIncumbent): b
 
 /**
  * A live relay that provably holds nothing: identity confirmed against its argv, exactly one
- * holder, and zero children. Reaping it destroys no user work. Anything less is retained —
- * killing the wrong pid on someone's remote host is the worst outcome available here.
+ * holder, and no child the host could not account for as one of the daemon's own service
+ * processes. Reaping it destroys no user work. Anything less is retained — killing the wrong
+ * pid on someone's remote host is the worst outcome available here.
+ *
+ * Why not `childCount === 0`: the daemon's AI Vault sidecar never exits once spawned, so that
+ * gate was unreachable for any relay that had ever served a vault request (#13614).
  */
 export function isReapableRelayHusk(incumbent: RelayEndpointIncumbent): boolean {
   if (incumbent.verdict !== 'live' || !incumbent.holdersEnumerable) {
@@ -250,12 +269,16 @@ export function isReapableRelayHusk(incumbent: RelayEndpointIncumbent): boolean
     return false
   }
   const [holder] = incumbent.holders
-  return holder.matchesRelayArgv && holder.childCount === 0
+  return holder.matchesRelayArgv && holder.unrecognizedChildCount === 0
 }
 
 export function describeRelayEndpointIncumbent(incumbent: RelayEndpointIncumbent): string {
   const holders = incumbent.holders
-    .map((holder) => `${holder.pid}(children=${holder.childCount ?? 'unknown'})`)
+    .map(
+      (holder) =>
+        `${holder.pid}(children=${holder.childCount ?? 'unknown'},` +
+        `unrecognized=${holder.unrecognizedChildCount ?? 'unknown'})`
+    )
     .join(',')
   return (
     `${incumbent.sockPath} verdict=${incumbent.verdict} evidence=${incumbent.evidence} ` +
diff --git a/src/main/ssh/ssh-relay-endpoint-takeover.test.ts b/src/main/ssh/ssh-relay-endpoint-takeover.test.ts
index 687d633b92b..d23f065f478 100644
--- a/src/main/ssh/ssh-relay-endpoint-takeover.test.ts
+++ b/src/main/ssh/ssh-relay-endpoint-takeover.test.ts
@@ -14,6 +14,7 @@ import {
   resolveRelayEndpointBeforeRelaunch
 } from './ssh-relay-endpoint-takeover'
 import { RelayVersionMismatchError } from './ssh-relay-version-mismatch-error'
+import { RELAY_DAEMON_SERVICE_ENTRY_FILENAMES } from '../../shared/relay-artifacts'
 import type { SshConnection } from './ssh-connection'
 import { getRemoteHostPlatform } from './ssh-remote-platform'
 
@@ -42,7 +43,7 @@ beforeEach(() => {
 describe('incumbent alive and refusing', () => {
   it('refuses to rebind a live relay holding PTYs, and signals nothing', async () => {
     execCommand.mockResolvedValueOnce(
-      probe(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=3669803 yes 13'])
+      probe(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=3669803 yes 13 11'])
     )
     await expect(resolve()).rejects.toSatisfy(isRelayEndpointHeldError)
     // The whole point of #8585: the incumbent's socket must survive so it is not orphaned.
@@ -52,9 +53,9 @@ describe('incumbent alive and refusing', () => {
 
   it('names the incumbent pid and the Reset Relay escape hatch in the error', async () => {
     execCommand.mockResolvedValue(
-      probe(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=3669803 yes 13'])
+      probe(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=3669803 yes 13 11'])
     )
-    await expect(resolve()).rejects.toThrow(/3669803\(children=13\)/)
+    await expect(resolve()).rejects.toThrow(/3669803\(children=13,unrecognized=11\)/)
     await expect(resolve()).rejects.toThrow(/Reset Relay/)
   })
 
@@ -70,7 +71,7 @@ describe('incumbent alive and refusing', () => {
   it('reaps a live relay only when it provably holds nothing, and confirms it is gone', async () => {
     execCommand
       .mockResolvedValueOnce(
-        probe(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=80583 yes 0'])
+        probe(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=80583 yes 2 0'])
       )
       .mockResolvedValueOnce('GONE\n')
     await expect(resolve()).resolves.toMatchObject({ verdict: 'live' })
@@ -80,7 +81,7 @@ describe('incumbent alive and refusing', () => {
   it('does not launch over an empty relay whose death could not be confirmed', async () => {
     execCommand
       .mockResolvedValueOnce(
-        probe(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=80583 yes 0'])
+        probe(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=80583 yes 2 0'])
       )
       .mockResolvedValueOnce('LIVE\n')
     await expect(resolve()).rejects.toSatisfy(isRelayEndpointHeldError)
@@ -89,7 +90,7 @@ describe('incumbent alive and refusing', () => {
   it('does not launch over a relay the host refused to signal on its own re-check', async () => {
     execCommand
       .mockResolvedValueOnce(
-        probe(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=80583 yes 0'])
+        probe(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=80583 yes 2 0'])
       )
       .mockResolvedValueOnce('BUSY\n')
     await expect(resolve()).rejects.toSatisfy(isRelayEndpointHeldError)
@@ -138,9 +139,19 @@ describe('reapEmptyRelayHuskCommand', () => {
   })
 
   it('aborts without signalling when the host cannot count children', () => {
-    expect(reapEmptyRelayHuskCommand(4242, SOCK)).toContain(
-      "command -v pgrep >/dev/null 2>&1 || { printf 'BUSY\\n'; exit 0; }"
-    )
+    const command = reapEmptyRelayHuskCommand(4242, SOCK)
+    // The census leaves both counters at `unknown` without pgrep, and the gate demands "0".
+    expect(command).toContain('unrecognized_kids=unknown')
+    expect(command).toContain('command -v pgrep >/dev/null 2>&1')
+    expect(command).toContain('[ "$unrecognized_kids" = "0" ] ||')
+  })
+
+  it('subtracts only the daemon service children it can name from the reap gate', () => {
+    const command = reapEmptyRelayHuskCommand(4242, SOCK)
+    for (const filename of RELAY_DAEMON_SERVICE_ENTRY_FILENAMES) {
+      expect(command).toContain(`*'/${filename}'`)
+    }
+    expect(command).toContain('unrecognized_kids=$((unrecognized_kids+1))')
   })
 })
 
diff --git a/src/main/ssh/ssh-relay-endpoint-takeover.ts b/src/main/ssh/ssh-relay-endpoint-takeover.ts
index f104aab5256..8f6130620cb 100644
--- a/src/main/ssh/ssh-relay-endpoint-takeover.ts
+++ b/src/main/ssh/ssh-relay-endpoint-takeover.ts
@@ -2,13 +2,17 @@
  * Deciding whether a relay socket path is ours to take, and acting on the answer.
  *
  * The only destructive action available here is a SIGTERM to a relay that has been proven —
- * by argv, by socket-holder enumeration, and by a zero child count re-checked on the host
- * immediately before the signal — to hold nothing at all. Everything else is left running.
+ * by argv, by socket-holder enumeration, and by a child census re-run on the host immediately
+ * before the signal — to hold nothing at all. Everything else is left running.
  * Per docs/reference/ssh-execution-boundary.md, a relay we merely failed to reach is
  * `unverifiable`, and `unverifiable` never authorizes a kill or a rebind.
  */
 import type { SshConnection } from './ssh-connection'
 import { shellEscape } from './ssh-connection-utils'
+import {
+  RELAY_UNRECOGNIZED_CHILD_COUNT_VAR,
+  relayDaemonChildCensusShell
+} from './relay-daemon-service-children'
 import { execCommand, isUnconfirmedSshCommandTermination } from './ssh-relay-deploy-helpers'
 import {
   describeRelayEndpointIncumbent,
@@ -39,9 +43,10 @@ export function reapEmptyRelayHuskCommand(pid: number, sockPath: string): string
     `sock=${shellEscape(sockPath)}`,
     'args=$(ps -o args= -p "$pid" 2>/dev/null | tr "\\n" " ")',
     'case "$args" in *relay.js*"$sock"*) ;; *) printf \'MISMATCH\\n\'; exit 0 ;; esac',
-    "command -v pgrep >/dev/null 2>&1 || { printf 'BUSY\\n'; exit 0; }",
-    'kids=$(pgrep -P "$pid" 2>/dev/null | grep -c .)',
-    '[ "$kids" = "0" ] || { printf \'BUSY\\n\'; exit 0; }',
+    // Why the same census as the probe: `unknown` (no pgrep) and any child this host could
+    // not account for as a relay service both land on BUSY, so nothing is signalled.
+    ...relayDaemonChildCensusShell(),
+    `[ "$${RELAY_UNRECOGNIZED_CHILD_COUNT_VAR}" = "0" ] || { printf 'BUSY\\n'; exit 0; }`,
     // SIGTERM only: the relay's own handler disposes and unlinks. SIGKILL would leave the
     // socket inode behind and skip that shutdown path for no gain on an empty daemon.
     'kill -TERM "$pid" 2>/dev/null || true',
diff --git a/src/main/ssh/ssh-relay-native-deps-install-staged-upload.test.ts b/src/main/ssh/ssh-relay-native-deps-install-staged-upload.test.ts
index 4d90a7c8289..e8616e7c230 100644
--- a/src/main/ssh/ssh-relay-native-deps-install-staged-upload.test.ts
+++ b/src/main/ssh/ssh-relay-native-deps-install-staged-upload.test.ts
@@ -154,6 +154,69 @@ describe('installNativeDeps staged uploads', () => {
     expect(writeObservedAt).toBeLessThanOrEqual(npmInstallIdx)
   })
 
+  it('exports the host Node headers dir to node-gyp on every command that can compile node-pty (STA-6674)', async () => {
+    const conn = makeMockConnection(sftpCapture)
+    // Install succeeds, the probe fails, the rebuild repairs it, then the cloexec patch rebuilds again.
+    feed(makeExecResponses({ npmInstall: 'ok', probe: 'missing', repairProbe: 'ok' }))
+
+    await deployAndLaunchRelay(conn)
+
+    const commands = vi.mocked(execCommand).mock.calls.map(([, command]) => command)
+    const compiling = ['npm install', 'npm rebuild', 'node-pty-1.1.0-master-cloexec-patch.cjs']
+    for (const compileStep of compiling) {
+      const command = commands.find((candidate) => candidate.includes(compileStep))
+      expect(command, compileStep).toBeDefined()
+      // Both spellings: node-gyp 10 (Node 20) reads only npm_config_, node-gyp >= 11.4 prefers the other.
+      expect(command).toContain('export npm_config_nodedir=')
+      expect(command).toContain('npm_package_config_node_gyp_nodedir=')
+      // The export precedes the compile on the same command line, and only when the probe found headers.
+      expect(command!.indexOf('npm_config_nodedir')).toBeLessThan(command!.indexOf(compileStep))
+      expect(command).toContain('node_version.h')
+      // The marker lands in the captured output, so a failure after it can say what was exported.
+      expect(command).toContain('echo "ORCA-NODE-HEADERS:${ORCA_NODE_HEADERS_DIR:-none}"')
+    }
+  })
+
+  // What execCommand actually rejects with: the whole command line (marker echo included) quoted
+  // ahead of the host's output. A fixture that omits the command hides the marker-parsing bug.
+  function rejectNpmInstallLikeExecCommand(hostOutput: string): void {
+    vi.mocked(execCommand).mockImplementationOnce(async (_conn, command) => {
+      throw new Error(`Command "${command}" failed (exit 1): ${hostOutput}`)
+    })
+  }
+  const HEADERS_REFUSED =
+    'npm error gyp http fetch GET https://nodejs.org/download/release/v24.12.0/node-v24.12.0-headers.tar.gz attempt 1 failed with ECONNREFUSED\nnpm error gyp ERR! configure error'
+
+  it('names the fix when node-gyp cannot download headers and the host ships none (STA-6674)', async () => {
+    const conn = makeMockConnection(sftpCapture)
+    feed(makeStagedFirstInstallExecPrefix())
+    rejectNpmInstallLikeExecCommand(`ORCA-NODE-HEADERS:none\n${HEADERS_REFUSED}`)
+    feed(['']) // clean stage root
+
+    const error = await deployAndLaunchRelay(conn).catch((e: Error) => e)
+    expect((error as Error).message).toContain('could not download the Node.js headers')
+    expect((error as Error).message).toContain('no local headers matching its own version')
+    expect((error as Error).message).not.toContain('Orca defect')
+    expect((error as Error).message).toContain('ECONNREFUSED')
+    // A full toolchain: the toolchain probe must not run, and this is not a "build tools" error.
+    expect((error as Error).message).not.toContain('build tools')
+    const commands = vi.mocked(execCommand).mock.calls.map(([, command]) => command)
+    expect(commands.some((command) => command.includes('command -v "$t"'))).toBe(false)
+  })
+
+  it('reports an Orca defect when headers were exported but node-gyp downloaded anyway', async () => {
+    // The marker says the export happened; a download after it means node-gyp never read the env.
+    const conn = makeMockConnection(sftpCapture)
+    feed(makeStagedFirstInstallExecPrefix())
+    rejectNpmInstallLikeExecCommand(`ORCA-NODE-HEADERS:/usr/local\n${HEADERS_REFUSED}`)
+    feed(['']) // clean stage root
+
+    const error = await deployAndLaunchRelay(conn).catch((e: Error) => e)
+    expect((error as Error).message).toContain('/usr/local/include/node')
+    expect((error as Error).message).toContain('Orca defect')
+    expect((error as Error).message).not.toContain('no local headers matching its own version')
+  })
+
   it('promotes only after the first-install lock is acquired', async () => {
     const conn = makeMockConnection(sftpCapture)
     feed(makeExecResponses({ npmInstall: 'ok', probe: 'ok' }))
diff --git a/src/main/ssh/ssh-relay-node-headers.test.ts b/src/main/ssh/ssh-relay-node-headers.test.ts
new file mode 100644
index 00000000000..84e9016738b
--- /dev/null
+++ b/src/main/ssh/ssh-relay-node-headers.test.ts
@@ -0,0 +1,164 @@
+import { spawnSync } from 'node:child_process'
+import {
+  chmodSync,
+  copyFileSync,
+  mkdtempSync,
+  mkdirSync,
+  rmSync,
+  symlinkSync,
+  writeFileSync
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { dirname, join } from 'node:path'
+import process from 'node:process'
+import { afterEach, describe, expect, it } from 'vitest'
+import { exportLocalNodeHeadersPrefix, localNodeHeadersFromOutput } from './ssh-relay-node-headers'
+
+const POSIX = process.platform !== 'win32'
+
+/** Runs the prefix under /bin/sh exactly as the relay does, then prints what node-gyp would see. */
+function runPrefix(nodePath: string): {
+  nodedir: string
+  pkgNodedir: string
+  marker: string | null | undefined
+} {
+  const script = `${exportLocalNodeHeadersPrefix(nodePath)}printf '%s\\n%s\\n' "$npm_config_nodedir" "$npm_package_config_node_gyp_nodedir"`
+  const result = spawnSync('/bin/sh', ['-c', script], { encoding: 'utf8' })
+  expect(result.status).toBe(0)
+  const marker = localNodeHeadersFromOutput(result.stdout)
+  const [nodedir = '', pkgNodedir = ''] = result.stdout
+    .split('\n')
+    .filter((line) => !line.startsWith('ORCA-NODE-HEADERS:'))
+  return { nodedir, pkgNodedir, marker }
+}
+
+/** A fake `<prefix>/bin/node` whose `include/node/node_version.h` claims `version`. */
+function fakeNodePrefix(root: string, version: string): string {
+  const prefix = join(root, 'prefix')
+  mkdirSync(join(prefix, 'bin'), { recursive: true })
+  mkdirSync(join(prefix, 'include', 'node'), { recursive: true })
+  const [major, minor, patch] = version.split('.')
+  writeFileSync(
+    join(prefix, 'include', 'node', 'node_version.h'),
+    `#define NODE_MAJOR_VERSION ${major}\n#define NODE_MINOR_VERSION ${minor}\n#define NODE_PATCH_VERSION ${patch}\n`
+  )
+  // Why a symlink to the real binary: the probe reads process.execPath, which Node resolves
+  // through symlinks -- so this stands in for `/usr/bin/node -> /opt/node/bin/node` shims too.
+  symlinkSync(process.execPath, join(prefix, 'bin', 'node'))
+  return join(prefix, 'bin', 'node')
+}
+
+describe.skipIf(!POSIX)('exportLocalNodeHeadersPrefix', () => {
+  const roots: string[] = []
+  afterEach(() => {
+    for (const root of roots.splice(0)) {
+      rmSync(root, { recursive: true, force: true })
+    }
+  })
+
+  it('exports nodedir when the running Node ships headers for its own version', () => {
+    // The test runner's Node is an official build, so its prefix has include/node.
+    const prefix = dirname(dirname(process.execPath))
+    const { nodedir, pkgNodedir, marker } = runPrefix(process.execPath)
+    expect(nodedir).toBe(prefix)
+    expect(pkgNodedir).toBe(prefix)
+    expect(marker).toBe(prefix)
+  })
+
+  it('leaves nodedir unset when the shipped headers are for another Node version', () => {
+    // A symlinked node resolves execPath to the real binary, whose prefix is the real one; so
+    // to stage a mismatch the probe must run a node whose execPath lands in the fake prefix.
+    // A copy does that.
+    const root = mkdtempSync(join(tmpdir(), 'orca-node-headers-'))
+    roots.push(root)
+    const prefix = join(root, 'prefix')
+    mkdirSync(join(prefix, 'bin'), { recursive: true })
+    mkdirSync(join(prefix, 'include', 'node'), { recursive: true })
+    writeFileSync(
+      join(prefix, 'include', 'node', 'node_version.h'),
+      '#define NODE_MAJOR_VERSION 1\n#define NODE_MINOR_VERSION 0\n#define NODE_PATCH_VERSION 0\n'
+    )
+    const copied = join(prefix, 'bin', 'node')
+    copyFileSync(process.execPath, copied)
+    chmodSync(copied, 0o755)
+    const { nodedir, pkgNodedir, marker } = runPrefix(copied)
+    expect(nodedir).toBe('')
+    expect(pkgNodedir).toBe('')
+    expect(marker).toBeNull()
+  })
+
+  it('leaves nodedir unset when the prefix has no headers at all', () => {
+    const root = mkdtempSync(join(tmpdir(), 'orca-node-headers-'))
+    roots.push(root)
+    const copied = join(root, 'bin', 'node')
+    mkdirSync(dirname(copied), { recursive: true })
+    copyFileSync(process.execPath, copied)
+    chmodSync(copied, 0o755)
+    const { nodedir } = runPrefix(copied)
+    expect(nodedir).toBe('')
+  })
+
+  it('follows a symlinked node to the install that owns the headers', () => {
+    const root = mkdtempSync(join(tmpdir(), 'orca-node-headers-'))
+    roots.push(root)
+    const shim = fakeNodePrefix(root, '0.0.0')
+    // The shim's own fake headers are ignored: execPath resolves to the real binary, and the
+    // real prefix's headers are the ones that match.
+    const { nodedir } = runPrefix(shim)
+    expect(nodedir).toBe(dirname(dirname(process.execPath)))
+  })
+
+  it('clears an inherited nodedir when the probe finds no matching headers', () => {
+    // A remote profile's stale nodedir must not survive past the version check.
+    const root = mkdtempSync(join(tmpdir(), 'orca-node-headers-'))
+    roots.push(root)
+    const copied = join(root, 'bin', 'node')
+    mkdirSync(dirname(copied), { recursive: true })
+    copyFileSync(process.execPath, copied)
+    chmodSync(copied, 0o755)
+    const script = `${exportLocalNodeHeadersPrefix(copied)}printf '%s|%s|%s' "$npm_config_nodedir" "$NPM_CONFIG_NODEDIR" "$npm_package_config_node_gyp_nodedir"`
+    const result = spawnSync('/bin/sh', ['-c', script], {
+      encoding: 'utf8',
+      env: {
+        ...process.env,
+        npm_config_nodedir: '/usr/stale-headers',
+        NPM_CONFIG_NODEDIR: '/usr/stale-headers',
+        npm_package_config_node_gyp_nodedir: '/usr/stale-headers'
+      }
+    })
+    expect(result.status).toBe(0)
+    expect(result.stdout.split('\n').at(-1)).toBe('||')
+  })
+
+  it('does not fail the command line when node itself cannot run', () => {
+    const script = `${exportLocalNodeHeadersPrefix('/nonexistent/node')}echo "after:$npm_config_nodedir"`
+    const result = spawnSync('/bin/sh', ['-c', script], { encoding: 'utf8' })
+    expect(result.status).toBe(0)
+    expect(result.stdout.trim()).toBe('ORCA-NODE-HEADERS:none\nafter:')
+  })
+})
+
+describe('localNodeHeadersFromOutput', () => {
+  it('reads the host answer, not the copy of the marker echo quoted in an exec-failure head', () => {
+    // The real shape: execCommand quotes the whole command line, prefix included, before the output.
+    const command = `export PATH='/usr/local/bin':$PATH && cd '/root/.orca-remote/relay-x' && ${exportLocalNodeHeadersPrefix('/usr/local/bin/node')}npm install node-pty 2>&1`
+    const failed = (hostOutput: string): string =>
+      `Command "${command}" failed (exit 1): ${hostOutput}`
+    expect(
+      localNodeHeadersFromOutput(failed('ORCA-NODE-HEADERS:none\ngyp ERR! configure error'))
+    ).toBeNull()
+    expect(
+      localNodeHeadersFromOutput(failed('ORCA-NODE-HEADERS:/usr/local\ngyp ERR! configure error'))
+    ).toBe('/usr/local')
+    // No host output at all after the head: the command copy alone must not count as a marker.
+    expect(localNodeHeadersFromOutput(failed(''))).toBeUndefined()
+  })
+
+  it('distinguishes an exported dir, an explicit none, and no marker at all', () => {
+    expect(localNodeHeadersFromOutput('x\nORCA-NODE-HEADERS:/usr/local\ngyp ERR!')).toBe(
+      '/usr/local'
+    )
+    expect(localNodeHeadersFromOutput('ORCA-NODE-HEADERS:none\ngyp ERR!')).toBeNull()
+    expect(localNodeHeadersFromOutput('gyp ERR! only')).toBeUndefined()
+  })
+})
diff --git a/src/main/ssh/ssh-relay-node-headers.ts b/src/main/ssh/ssh-relay-node-headers.ts
new file mode 100644
index 00000000000..a590bd40fca
--- /dev/null
+++ b/src/main/ssh/ssh-relay-node-headers.ts
@@ -0,0 +1,97 @@
+/**
+ * Point node-gyp at the headers the host's Node install already ships, so compiling node-pty
+ * needs nothing from nodejs.org.
+ *
+ * Why: node-pty has no Linux prebuild, so every Linux relay compiles it, and node-gyp's default
+ * is to download `node-v<ver>-headers.tar.gz` before configuring. Every official Node build, and
+ * every version manager that unpacks one (nvm, fnm, volta, mise, n), already has those exact
+ * headers at `<prefix>/include/node`. The download was the only step that needed the internet,
+ * so a firewalled host failed with ECONNREFUSED on work that never had to happen (STA-6674).
+ *
+ * Why both variables: node-gyp >= 11.4 prefers `npm_package_config_node_gyp_<key>` and npm 11+
+ * warns that arbitrary `npm_config_<key>` is deprecated, but node-gyp 10 (bundled with Node 20)
+ * reads only `npm_config_<key>`. Both together cover every Node the relay runs on.
+ *
+ * Why the version check: node-gyp trusts `nodedir` blindly, so a distro `/usr/include/node` left
+ * by an older headers package would be compiled against as-is. Whether that binding then misbehaves
+ * is not established (one measured run loaded a node-20-header build under node 24); refusing is
+ * the conservative default. A mismatch leaves the variables unset, which is today's path.
+ */
+import { shellEscape } from './ssh-connection-utils'
+
+/** Shell variable the probe answers into; namespaced so it cannot collide with npm's own. */
+const NODEDIR_SHELL_VAR = 'ORCA_NODE_HEADERS_DIR'
+
+/**
+ * Prints the running Node's install prefix when `<prefix>/include/node/node_version.h` matches
+ * `process.versions.node`, and nothing otherwise. `process.execPath` is symlink-resolved, so a
+ * `/usr/bin/node` -> `/opt/node/bin/node` shim still finds `/opt/node/include`.
+ */
+export const LOCAL_NODE_HEADERS_PROBE_JS = [
+  'const p=require("path"),f=require("fs");',
+  'const d=p.dirname(p.dirname(process.execPath));',
+  'try{',
+  'const h=f.readFileSync(p.join(d,"include","node","node_version.h"),"utf8");',
+  'const v=["MAJOR","MINOR","PATCH"].map(k=>(h.match(new RegExp("#define NODE_"+k+"_VERSION ([0-9]+)"))||[])[1]).join(".");',
+  'if(v===process.versions.node)process.stdout.write(d)',
+  '}catch{}'
+].join('')
+
+/**
+ * Stdout marker naming what the probe found, printed before the compile so the answer is in the
+ * captured output of any failure that follows. `none` means no matching local headers.
+ */
+export const LOCAL_NODE_HEADERS_MARKER_PREFIX = 'ORCA-NODE-HEADERS:'
+
+/**
+ * POSIX-sh prefix (`...; `) that exports node-gyp's `nodedir` for the rest of the command line
+ * when the host's Node ships matching headers. Prepend to any command that may compile node-pty:
+ * `npm install`, `npm rebuild`, and the cloexec patch (its `npm rebuild` inherits the env).
+ */
+export function exportLocalNodeHeadersPrefix(nodePath: string): string {
+  const probe = `${shellEscape(nodePath)} -e ${shellEscape(LOCAL_NODE_HEADERS_PROBE_JS)} 2>/dev/null`
+  // Why the unset: a remote profile can already export a nodedir (a stale distro header dir), in
+  // either case npm accepts. Left alone it would bypass the version check above and compile
+  // against those headers. Deliberately env only: a `nodedir=` in ~/.npmrc is not reachable from here
+  // -- npm ignores an empty env override, and a CLI `--nodedir=` would also override the good
+  // export -- so an npmrc setting stays the operator's, as it was before this prefix existed.
+  return (
+    `${NODEDIR_SHELL_VAR}=$(${probe}); ` +
+    `unset npm_config_nodedir NPM_CONFIG_NODEDIR npm_package_config_node_gyp_nodedir; ` +
+    `if [ -n "$${NODEDIR_SHELL_VAR}" ]; then ` +
+    `export npm_config_nodedir="$${NODEDIR_SHELL_VAR}" npm_package_config_node_gyp_nodedir="$${NODEDIR_SHELL_VAR}"; ` +
+    `fi; ` +
+    `echo "${LOCAL_NODE_HEADERS_MARKER_PREFIX}\${${NODEDIR_SHELL_VAR}:-none}"; `
+  )
+}
+
+/**
+ * The headers dir the prefix exported, `null` when it found none, or `undefined` when the
+ * marker is absent (output truncated, or the command never reached the prefix).
+ */
+export function localNodeHeadersFromOutput(output: string): string | null | undefined {
+  // Why the head is stripped first: a failed exec's message is `Command "<command>" failed
+  // (exit N): <output>`, and <command> quotes this prefix verbatim -- including the marker's
+  // `echo`. Scanning from the start would match that copy and return `${ORCA_NODE_HEADERS_DIR:-
+  // none}"...` as a "dir". Only what follows the head is the host's answer.
+  const head = output.match(EXEC_FAILURE_HEAD_RE)
+  const hostOutput = head ? output.slice(head[0].length) : output
+  // First match, not last: the host's own line comes first, and later lines are npm/gyp output
+  // that must not be able to spoof it.
+  for (const line of hostOutput.split(/\r?\n/)) {
+    const at = line.indexOf(LOCAL_NODE_HEADERS_MARKER_PREFIX)
+    if (at === -1) {
+      continue
+    }
+    const dir = line.slice(at + LOCAL_NODE_HEADERS_MARKER_PREFIX.length).trim()
+    return dir === 'none' || dir === '' ? null : dir
+  }
+  return undefined
+}
+
+/**
+ * `Command "<anything, quotes included>" failed (exit N): ` -- see ssh-relay-exec-command.ts.
+ * Lazy `[\s\S]*?` is safe: it stops at the first `" failed (exit N): `, and no command this
+ * module builds contains that literal, so the match cannot end early inside the command.
+ */
+const EXEC_FAILURE_HEAD_RE = /^Command "[\s\S]*?" failed \(exit -?\d+\): /
diff --git a/src/main/ssh/ssh-relay-offline-node-headers.docker.test.ts b/src/main/ssh/ssh-relay-offline-node-headers.docker.test.ts
new file mode 100644
index 00000000000..c5700c991c1
--- /dev/null
+++ b/src/main/ssh/ssh-relay-offline-node-headers.docker.test.ts
@@ -0,0 +1,204 @@
+// Why this exists (STA-6674): a Linux host whose only unreachable endpoint is nodejs.org could
+// not run a relay. node-pty ships no Linux prebuild, so npm hands it to node-gyp, and node-gyp
+// downloads `node-v<ver>-headers.tar.gz` unless told the host already has the headers -- which
+// every official Node install does, at `<prefix>/include/node`. This drives the real deploy at a
+// Docker sshd whose nodejs.org resolves to 127.0.0.1 (ECONNREFUSED, exactly what the user saw).
+//
+// Run: ORCA_REVIEW_SSH_OFFLINE_HEADERS=1 pnpm test src/main/ssh/ssh-relay-offline-node-headers.docker.test.ts
+// Needs Docker and `pnpm build:relay`. ORCA_REVIEW_SSH_NODE_IMAGE picks the Node image
+// (default node:24.12.0-bookworm, the user's version); ORCA_REVIEW_SSH_TARGET_HOST overrides
+// the address the app connects to (default 127.0.0.1).
+import { execFileSync, spawnSync } from 'node:child_process'
+import { randomUUID } from 'node:crypto'
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs'
+import { connect } from 'node:net'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
+
+vi.mock('electron', () => ({ app: { getAppPath: () => process.cwd() } }))
+
+import { SshConnection } from './ssh-connection'
+import { deployAndLaunchRelay } from './ssh-relay-deploy'
+import type { SshTarget } from '../../shared/ssh-types'
+
+const RUN_REVIEW_ORACLE = process.env.ORCA_REVIEW_SSH_OFFLINE_HEADERS === '1'
+const NODE_IMAGE = process.env.ORCA_REVIEW_SSH_NODE_IMAGE ?? 'node:24.12.0-bookworm'
+const TARGET_HOST = process.env.ORCA_REVIEW_SSH_TARGET_HOST ?? '127.0.0.1'
+
+type TargetFixture = {
+  containerName: string
+  identityFile: string
+  port: number
+  tempDir: string
+}
+
+function run(command: string, args: string[], timeout = 30_000, input?: string): string {
+  return execFileSync(command, args, {
+    encoding: 'utf8',
+    stdio: [input === undefined ? 'ignore' : 'pipe', 'pipe', 'pipe'],
+    timeout,
+    input
+  }).trim()
+}
+
+function dockerExec(fixture: TargetFixture, command: string): string {
+  return run('docker', ['exec', fixture.containerName, 'bash', '-lc', command], 60_000)
+}
+
+async function startTarget(): Promise<TargetFixture> {
+  const image = `orca-review-offline-headers:${NODE_IMAGE.replace(/[^A-Za-z0-9_.-]/g, '-')}`
+  run(
+    'docker',
+    ['build', '-q', '-t', image, '-'],
+    600_000,
+    [
+      `FROM ${NODE_IMAGE}`,
+      'RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends openssh-server git && rm -rf /var/lib/apt/lists/* && mkdir -p /run/sshd /root/.ssh && chmod 700 /root/.ssh',
+      ''
+    ].join('\n')
+  )
+  const tempDir = mkdtempSync(join(tmpdir(), 'orca-offline-headers-ssh-'))
+  const identityFile = join(tempDir, 'id_ed25519')
+  run('ssh-keygen', ['-t', 'ed25519', '-N', '', '-f', identityFile, '-q'])
+  const publicKey = readFileSync(`${identityFile}.pub`, 'utf8').trim()
+  const containerName = `orca-offline-headers-${randomUUID().slice(0, 12)}`
+  // Why a refused connection and not a dropped one: a timeout takes node-gyp's retry path and
+  // burns the deploy budget; the user's host refused, and that is the path under test.
+  run(
+    'docker',
+    [
+      'run',
+      '-d',
+      '--name',
+      containerName,
+      '--add-host',
+      'nodejs.org:127.0.0.1',
+      '-p',
+      '0.0.0.0::22',
+      '-e',
+      `AUTHORIZED_KEY=${publicKey}`,
+      image,
+      'bash',
+      '-lc',
+      'printf "%s\\n" "$AUTHORIZED_KEY" > /root/.ssh/authorized_keys && chmod 600 /root/.ssh/authorized_keys && exec /usr/sbin/sshd -D -e'
+    ],
+    120_000
+  )
+  const port = Number(run('docker', ['port', containerName, '22/tcp']).split(':').at(-1))
+  // `docker run -d` returns before sshd binds; connect() against a closed port is a flake.
+  await waitForSshBanner(port)
+  return { containerName, identityFile, port, tempDir }
+}
+
+/** Resolves once sshd answers with its banner on the mapped port, or throws after the deadline. */
+async function waitForSshBanner(port: number, deadlineMs = 60_000): Promise<void> {
+  const deadline = Date.now() + deadlineMs
+  for (;;) {
+    const gotBanner = await new Promise<boolean>((resolve) => {
+      const socket = connect({ host: TARGET_HOST, port })
+      const done = (value: boolean): void => {
+        socket.destroy()
+        resolve(value)
+      }
+      socket.setTimeout(2_000, () => done(false))
+      socket.once('data', (chunk) => done(chunk.toString('utf8').startsWith('SSH-')))
+      socket.once('error', () => done(false))
+    })
+    if (gotBanner) {
+      return
+    }
+    if (Date.now() > deadline) {
+      throw new Error(`sshd on port ${port} did not answer within ${deadlineMs / 1000}s`)
+    }
+    await new Promise((resolve) => setTimeout(resolve, 500))
+  }
+}
+
+function stopTarget(fixture: TargetFixture | null): void {
+  if (!fixture) {
+    return
+  }
+  spawnSync('docker', ['rm', '-f', fixture.containerName], { stdio: 'ignore', timeout: 30_000 })
+  rmSync(fixture.tempDir, { recursive: true, force: true })
+}
+
+function createConnection(fixture: TargetFixture): SshConnection {
+  const target: SshTarget = {
+    id: `offline-headers-${randomUUID()}`,
+    label: 'Offline node headers Docker SSH target',
+    source: 'manual',
+    host: TARGET_HOST,
+    port: fixture.port,
+    username: 'root',
+    identityFile: fixture.identityFile,
+    identitiesOnly: true
+  }
+  return new SshConnection(target, { onStateChange: vi.fn() })
+}
+
+describe.skipIf(!RUN_REVIEW_ORACLE)(
+  'SSH relay deploy on a host that cannot reach nodejs.org',
+  () => {
+    let fixture: TargetFixture | null = null
+
+    beforeAll(async () => {
+      fixture = await startTarget()
+    }, 900_000)
+
+    afterAll(() => {
+      stopTarget(fixture)
+    })
+
+    it('compiles node-pty from the host Node install headers instead of downloading them', async () => {
+      const activeFixture = fixture as TargetFixture
+      expect(dockerExec(activeFixture, 'getent hosts nodejs.org')).toContain('127.0.0.1')
+      const connection = createConnection(activeFixture)
+      await connection.connect()
+      try {
+        const result = await deployAndLaunchRelay(connection, undefined, 60)
+        expect(result.remoteRelayDir).toBeTruthy()
+
+        const evidence = dockerExec(
+          activeFixture,
+          [
+            `cd '${result.remoteRelayDir}'`,
+            'test -f node_modules/node-pty/build/Release/pty.node && echo PTY_NODE=built',
+            'test -d /root/.cache/node-gyp && echo HEADERS=downloaded || echo HEADERS=local',
+            `node -e "require('node-pty'); require('@parcel/watcher'); console.log('NATIVE=loadable')"`
+          ].join('; ')
+        )
+        console.log(`[offline-node-headers] ${NODE_IMAGE}: ${evidence.replace(/\n/g, ' ')}`)
+        expect(evidence).toContain('PTY_NODE=built')
+        expect(evidence).toContain('HEADERS=local')
+        expect(evidence).toContain('NATIVE=loadable')
+      } finally {
+        await connection.disconnect()
+      }
+    }, 600_000)
+
+    it('names the missing-local-headers cause, not an Orca defect, when the host ships no headers', async () => {
+      // Same offline host, headers removed and the relay uninstalled so the deploy compiles again.
+      // This is the shape a review found misreported: the exec-failure message quotes the whole
+      // command (marker echo included) ahead of the output, and the parser must not read that copy.
+      const activeFixture = fixture as TargetFixture
+      dockerExec(
+        activeFixture,
+        'rm -rf /usr/local/include/node /root/.orca-remote /root/.cache/node-gyp'
+      )
+      const connection = createConnection(activeFixture)
+      await connection.connect()
+      try {
+        const error = await deployAndLaunchRelay(connection, undefined, 60).catch((e: Error) => e)
+        expect(error).toBeInstanceOf(Error)
+        const message = (error as Error).message
+        console.log(`[offline-node-headers] ${NODE_IMAGE} no-headers: ${message.split('\n')[0]}`)
+        expect(message).toContain('no local headers matching its own version')
+        expect(message).not.toContain('Orca defect')
+        expect(message).toContain('ECONNREFUSED')
+      } finally {
+        await connection.disconnect()
+      }
+    }, 600_000)
+  }
+)
diff --git a/src/main/ssh/ssh-relay-sentinel-copy-budget.test.ts b/src/main/ssh/ssh-relay-sentinel-copy-budget.test.ts
new file mode 100644
index 00000000000..b05c8a71d92
--- /dev/null
+++ b/src/main/ssh/ssh-relay-sentinel-copy-budget.test.ts
@@ -0,0 +1,62 @@
+import { EventEmitter } from 'node:events'
+import type { ClientChannel } from 'ssh2'
+import { expect, it, vi } from 'vitest'
+import { RELAY_SENTINEL } from './relay-protocol'
+import { waitForSentinel } from './ssh-relay-deploy-helpers'
+
+it.each([1, 256])('copies each startup prefix once across %i chunks', async (chunks) => {
+  const channel = Object.assign(new EventEmitter(), {
+    stderr: new EventEmitter(),
+    stdin: { write: vi.fn(() => true) },
+    close: vi.fn(),
+    pause: vi.fn(),
+    resume: vi.fn()
+  })
+  const pending = waitForSentinel(channel as unknown as ClientChannel)
+  const chunk = Buffer.alloc((64 * 1024) / chunks, 120)
+  const concat = vi.spyOn(Buffer, 'concat')
+  let calls = 0
+  let copied = 0
+  try {
+    for (let i = 0; i < chunks; i++) {
+      channel.emit('data', chunk)
+    }
+    calls = concat.mock.calls.length
+    copied = concat.mock.calls.reduce(
+      (sum, [buffers]) => sum + buffers.reduce((bytes, buffer) => bytes + buffer.length, 0),
+      0
+    )
+  } finally {
+    concat.mockRestore()
+  }
+  channel.emit('data', Buffer.from(`${RELAY_SENTINEL}first-frame`))
+  const transport = await pending
+  const received: string[] = []
+  transport.onData((bytes) => received.push(bytes.toString()))
+  expect(received).toEqual(['first-frame'])
+  expect(channel.close).not.toHaveBeenCalled()
+  expect(calls).toBe(chunks - 1)
+  expect(copied).toBe(chunk.length * ((chunks * (chunks + 1)) / 2 - 1))
+})
+
+it.each(Array.from({ length: RELAY_SENTINEL.length + 1 }, (_, i) => i))(
+  'preserves the marker and binary payload when split at byte %i',
+  async (split) => {
+    const channel = Object.assign(new EventEmitter(), {
+      stderr: new EventEmitter(),
+      stdin: { write: vi.fn(() => true) },
+      close: vi.fn()
+    })
+    const pending = waitForSentinel(channel as unknown as ClientChannel)
+    const marker = Buffer.from(RELAY_SENTINEL)
+    const payload = Buffer.from([0, 255, 128, 10, 13, 1])
+    channel.emit('data', Buffer.alloc(63 * 1024, 120))
+    channel.emit('data', marker.subarray(0, split))
+    channel.emit('data', Buffer.concat([marker.subarray(split), payload]))
+    const transport = await pending
+    const received: Buffer[] = []
+    transport.onData((bytes) => received.push(bytes))
+    expect(Buffer.concat(received)).toEqual(payload)
+    expect(channel.close).not.toHaveBeenCalled()
+  }
+)
diff --git a/src/main/ssh/ssh-relay-superseded-endpoints.test.ts b/src/main/ssh/ssh-relay-superseded-endpoints.test.ts
index 874d9aae3fe..9168f4688bd 100644
--- a/src/main/ssh/ssh-relay-superseded-endpoints.test.ts
+++ b/src/main/ssh/ssh-relay-superseded-endpoints.test.ts
@@ -67,7 +67,7 @@ describe('classifySupersededRelay', () => {
           'PRESENT=yes',
           'LISTEN=accepted',
           'HOLDERS_SOURCE=lsof',
-          'HOLDER=3669803 yes 13'
+          'HOLDER=3669803 yes 13 11'
         ])
       )
     ).toBe('retained-live-work')
@@ -76,7 +76,7 @@ describe('classifySupersededRelay', () => {
   it('nominates only a proven empty relay for reaping', () => {
     expect(
       classifySupersededRelay(
-        incumbent(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=80583 yes 0'])
+        incumbent(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=80583 yes 2 0'])
       )
     ).toBe('reap-candidate')
   })
@@ -101,7 +101,7 @@ describe('sweepSupersededRelayEndpoints', () => {
     execCommand
       .mockResolvedValueOnce(`${OLD_SOCK}\n`)
       .mockResolvedValueOnce(
-        probe(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=3669803 yes 13'])
+        probe(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=3669803 yes 13 11'])
       )
     const findings = await sweepSupersededRelayEndpoints(CONN, HOST, SWEEP)
     expect(findings).toHaveLength(1)
@@ -114,7 +114,7 @@ describe('sweepSupersededRelayEndpoints', () => {
     execCommand
       .mockResolvedValueOnce(`${OLD_SOCK}\n`)
       .mockResolvedValueOnce(
-        probe(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=80583 yes 0'])
+        probe(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=80583 yes 2 0'])
       )
       .mockResolvedValueOnce('GONE\n')
     const findings = await sweepSupersededRelayEndpoints(CONN, HOST, SWEEP)
@@ -126,7 +126,7 @@ describe('sweepSupersededRelayEndpoints', () => {
     execCommand
       .mockResolvedValueOnce(`${OLD_SOCK}\n`)
       .mockResolvedValueOnce(
-        probe(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=80583 yes 0'])
+        probe(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=80583 yes 2 0'])
       )
       .mockResolvedValueOnce('LIVE\n')
     const findings = await sweepSupersededRelayEndpoints(CONN, HOST, SWEEP)
diff --git a/src/main/ssh/ssh-remote-cli-dispatch-refusal-passthrough.test.ts b/src/main/ssh/ssh-remote-cli-dispatch-refusal-passthrough.test.ts
new file mode 100644
index 00000000000..cd0503348d0
--- /dev/null
+++ b/src/main/ssh/ssh-remote-cli-dispatch-refusal-passthrough.test.ts
@@ -0,0 +1,64 @@
+import { EventEmitter } from 'node:events'
+import { expect, it, vi } from 'vitest'
+
+vi.mock('electron', () => ({
+  app: {
+    isPackaged: false,
+    getAppPath: () => '/host/app'
+  }
+}))
+vi.mock('../persistence', () => ({
+  getCanonicalUserDataPath: () => '/host/user-data'
+}))
+
+import { OrcaRuntimeService } from '../runtime/orca-runtime'
+import { runRemoteOrcaCli } from './ssh-remote-orca-cli'
+
+// Why: the SSH bridge captures the host CLI child's stdout and exit code without reparsing; this
+// pins that a typed refusal envelope and its nonzero exit reach the remote agent unchanged.
+it('relays typed dispatch refusal codes from the host CLI unchanged', async () => {
+  const child = new EventEmitter() as EventEmitter & {
+    stdout: EventEmitter
+    stderr: EventEmitter
+    stdin: { end: ReturnType<typeof vi.fn>; on: ReturnType<typeof vi.fn> }
+    kill: ReturnType<typeof vi.fn>
+  }
+  child.stdout = new EventEmitter()
+  child.stderr = new EventEmitter()
+  child.stdin = { end: vi.fn(), on: vi.fn() }
+  child.kill = vi.fn()
+  const spawn = vi.fn(() => child)
+  const refusal = {
+    id: 'rpc_1',
+    ok: false,
+    error: {
+      code: 'task_not_startable',
+      message: 'Task task_1 is pending; only ready tasks can be dispatched',
+      data: { taskId: 'task_1', status: 'pending', unmetDependencies: ['task_0'] }
+    },
+    _meta: { runtimeId: 'runtime_1' }
+  }
+
+  const resultPromise = runRemoteOrcaCli(
+    new OrcaRuntimeService(),
+    {
+      argv: ['orchestration', 'dispatch', '--task', 'task_1', '--to', 'term_w', '--json'],
+      cwd: '/home/alice/repo',
+      env: { ORCA_TERMINAL_HANDLE: 'term_ssh' }
+    },
+    {
+      execPath: '/host/electron',
+      cliEntryPath: '/host/app/out/cli/index.js',
+      userDataPath: '/host/user-data',
+      entryExists: () => true,
+      spawn: spawn as never
+    }
+  )
+
+  const stdout = `${JSON.stringify(refusal, null, 2)}\n`
+  await Promise.resolve()
+  child.stdout.emit('data', Buffer.from(stdout))
+  child.emit('close', 1)
+
+  expect(await resultPromise).toEqual({ stdout, stderr: '', exitCode: 1 })
+})
diff --git a/src/main/ssh/ssh-remote-powershell.test.ts b/src/main/ssh/ssh-remote-powershell.test.ts
new file mode 100644
index 00000000000..1cfb2afa1a8
--- /dev/null
+++ b/src/main/ssh/ssh-remote-powershell.test.ts
@@ -0,0 +1,163 @@
+import { describe, expect, it } from 'vitest'
+import { join } from 'node:path'
+import { scanSourceTree, stripComments } from '../../shared/source-scan/source-tree-scan'
+import { powerShellCommand } from './ssh-remote-powershell'
+
+function decodePayload(command: string): string {
+  const encoded = command.match(/ -EncodedCommand (\S+)$/)?.[1]
+  if (!encoded) {
+    throw new Error(`no -EncodedCommand payload in: ${command}`)
+  }
+  return Buffer.from(encoded, 'base64').toString('utf16le')
+}
+
+/**
+ * This one helper builds the command line for every remote-Windows SSH call site
+ * (relay deploy, install locks, upload staging, GC claim, browse, CLI launch), so
+ * its switches are worth pinning.
+ */
+describe('powerShellCommand', () => {
+  it('spells no -ExecutionPolicy switch', () => {
+    const command = powerShellCommand('exit 0')
+    const switches = command.replace(/ -EncodedCommand \S+$/, '')
+
+    // Why: `-EncodedCommand` is not execution-policy gated — only `-File` is — so the switch
+    // was a no-op, and `-ExecutionPolicy Bypass` beside base64 is among the most heavily
+    // EDR-flagged PowerShell command lines there is.
+    expect(switches).not.toMatch(/-ExecutionPolicy/i)
+    expect(switches).not.toMatch(/Bypass/i)
+    expect(switches).toBe('powershell.exe -NoProfile -NonInteractive')
+  })
+
+  it('keeps the base64 payload the remote shell cannot rewrite', () => {
+    // Why: this string is re-parsed by the remote host's sshd DefaultShell, which is
+    // cmd.exe on a stock Windows OpenSSH install. Base64 is load-bearing here.
+    const command = powerShellCommand("Write-Output 'a & b' | Out-String")
+
+    expect(command).toMatch(
+      /^powershell\.exe -NoProfile -NonInteractive -EncodedCommand [A-Za-z0-9+/=]+$/
+    )
+    expect(decodePayload(command)).toBe("Write-Output 'a & b' | Out-String")
+  })
+})
+
+const MAIN_DIR = join(import.meta.dirname, '..')
+
+// Why: execution policy gates loading script FILES and nothing else, so dropping
+// `-ExecutionPolicy Bypass` is a no-op exactly while no remote payload loads one. That
+// invariant is what makes the switch safe to omit, and it was previously guarded by nothing:
+// a future payload that dot-sourced or used `-File` would fail only on a remote host whose
+// LocalMachine policy is Restricted/AllSigned. See the invariant note on `powerShellCommand`.
+// Every pattern is case-insensitive: PowerShell switches and cmdlet names are, and Windows
+// paths are, so `-file`, `import-module` and `DEPLOY.PS1` are all legitimate spellings that a
+// case-sensitive pattern would wave through. Verified to add no false positive across the real
+// importers. Each entry carries the fixtures it must catch AND the near-misses it must not, so
+// a future tightening cannot quietly trade one for the other.
+//
+// Limit: this is a source-text scan, so a script file reached only through a variable
+// (`& $scriptPath`) never appears in source and no pattern here can catch it — this narrows
+// the hole rather than sealing it. The invariant note on `powerShellCommand` covers the rest.
+//
+// Matched against `stripComments`, the shared quote-tracking stripper, so a construct named in
+// prose is not counted as code. A line-anchored regex pair cannot do this job: it either eats
+// live code by pairing a `/*` inside a glob string with a later comment close, or — anchoring
+// to avoid that — skips every trailing comment. Quote state is the only fix.
+const POLICY_GATED_CONSTRUCTS = [
+  {
+    label: 'a PowerShell script file (.ps1/.psm1)',
+    pattern: /\.psm?1\b/i,
+    catches: [
+      `powerShellCommand("$script = 'C:\\tools\\deploy.ps1'")`,
+      `powerShellCommand("Import-Module '$dir\\orca.psm1'")`,
+      `powerShellCommand("& '$root\\DEPLOY.PS1'")`
+    ],
+    ignores: [`const build = 'artifact.ps10'`]
+  },
+  {
+    label: 'Import-Module',
+    pattern: /\bImport-Module\b/i,
+    catches: [
+      `powerShellCommand("Import-Module 'NetSecurity'")`,
+      `powerShellCommand("import-module $modulePath")`
+    ],
+    ignores: [`const name = 'Import-ModuleList'`]
+  },
+  {
+    // Anchored to a token boundary: a bare /-File\b/i also matches `--credential-file`,
+    // `--log-file` and `--body-file`, which are real arguments in three of these importers.
+    label: 'the -File switch',
+    pattern: /(^|[\s'"`([{,])-File\b/i,
+    catches: [
+      `runRemote("powershell.exe -NoProfile -File 'C:\\x.ps1'")`,
+      `runRemote("powershell.exe  -file   $scriptVar")`,
+      `runRemote(["-NoProfile", "-File", scriptVar])`
+    ],
+    ignores: [`fetchWith("--credential-file", path)`, `run("--log-file $p --body-file $b")`]
+  },
+  {
+    // The quote/backtick prefixes matter: a dot-source in a generated payload usually sits at
+    // the very start of a TS string literal — `powerShellCommand(". '$x'")` — not after a `;`.
+    label: 'dot-sourcing',
+    pattern: /(^|[;{'"`]|\n)[ \t]*\.[ \t]+['"$]/,
+    catches: [
+      `powerShellCommand(". '$profileScript'")`,
+      `powerShellCommand("$ErrorActionPreference = 'Stop'; . '$profile'")`,
+      `powerShellCommand(". $profileScript")`
+    ],
+    ignores: [
+      `cp -a $sourcePath/. $destinationPath/`,
+      `Host key verification failed for $displayHost. $detail`
+    ]
+  }
+] as const
+
+describe('remote PowerShell payload invariant', () => {
+  // `scanSourceTree` is the shared walk: it skips node_modules/dist/out/build/.git,
+  // dot-directories and `__fixtures__`, and excludes tests by the shared `isTestFile` (which
+  // also covers `.spec.ts`, `__tests__/` and `-test-harness.ts`). A hand-rolled walk that got
+  // any of those wrong would move the floor below, which is this guard's own goalpost.
+  const importers = scanSourceTree(MAIN_DIR).filter((file) =>
+    file.source.includes('ssh-remote-powershell')
+  )
+
+  it('finds the modules that build remote payloads', () => {
+    // Guards the scan itself: a resolution change that emptied this list would make every
+    // assertion below vacuously pass. 15 importers today, re-derived against the shared walk.
+    expect(importers.length).toBeGreaterThan(10)
+  })
+
+  it.each(POLICY_GATED_CONSTRUCTS)(
+    'loads no remote payload through $label',
+    ({ label, pattern }) => {
+      const offenders = importers
+        .filter((file) => pattern.test(stripComments(file.source)))
+        .map((file) => file.relativePath)
+
+      expect(
+        offenders,
+        `${offenders.join(', ')} uses ${label}, which IS execution-policy gated on the remote ` +
+          'host. Do not restore `-ExecutionPolicy Bypass` to the command line (a GPO scope ' +
+          'beats it). Set the policy in-payload at process scope instead — see the note on ' +
+          'powerShellCommand.'
+      ).toEqual([])
+    }
+  )
+
+  // Why: these patterns only earn trust if they fire on a real violation spelled the way a
+  // generated payload spells it — inside a TS string literal — and stay quiet on the near
+  // misses. Both halves are load-bearing: an earlier dot-source pattern passed a `;`-prefixed
+  // sample but missed `powerShellCommand(". '$x'")`, and the obvious case-insensitive fix for
+  // `-File` matches `--credential-file` in three real importers. A fixture written from the
+  // pattern confirms the pattern; these are written from the requirement.
+  it.each(POLICY_GATED_CONSTRUCTS)(
+    'detects $label wherever it is spelled',
+    ({ pattern, catches, ignores }) => {
+      for (const sample of catches) {
+        expect(pattern.test(sample), `should catch: ${sample}`).toBe(true)
+      }
+      for (const sample of ignores) {
+        expect(pattern.test(sample), `should ignore: ${sample}`).toBe(false)
+      }
+    }
+  )
+})
diff --git a/src/main/ssh/ssh-remote-powershell.ts b/src/main/ssh/ssh-remote-powershell.ts
index 8c94fd3c483..31587bcc668 100644
--- a/src/main/ssh/ssh-remote-powershell.ts
+++ b/src/main/ssh/ssh-remote-powershell.ts
@@ -11,14 +11,45 @@ export {
 // to leave room for the `/c` wrapper sshd adds before cmd.exe counts the line.
 const WINDOWS_REMOTE_COMMAND_LINE_BUDGET_CHARS = 8_000
 
-export function powerShellCommand(script: string): string {
-  const inline = encodedPowerShellCommand(script)
+/**
+ * `pwsh.exe` is PowerShell 7. It is not present on a stock Windows install, so it is only ever
+ * chosen after a probe — but where it exists it reads a redirected stdin correctly, which Windows
+ * PowerShell 5.1 does not (see `system-ssh-file-binary-transfer.ts`).
+ */
+export type WindowsPowerShellExecutable = 'powershell.exe' | 'pwsh.exe'
+
+// Why: `-EncodedCommand` is not execution-policy gated (only `-File` is), so `-ExecutionPolicy
+// Bypass` was a no-op here — and it is one of the most heavily EDR-flagged PowerShell tokens.
+// The base64 stays: this string is re-parsed by the remote host's default SSH shell, which may
+// be cmd.exe, PowerShell, or bash.
+//
+// INVARIANT — no remote payload may load a PowerShell *script file*.
+//
+// Execution policy has only ever gated loading script files (2.0 through 7.x). Inline
+// statements, `& some.exe` and `Add-Type -TypeDefinition` are never gated, which is what makes
+// dropping the switch a no-op for every payload we send today — the compressed path below stays
+// inline too, since `Invoke-Expression` on a decompressed string loads no file. Loading a script
+// file is the one thing the dropped switch actually covered, so a payload that dot-sources, runs
+// `& '<x>.ps1'`, calls `Import-Module '<x>.psm1'`, or passes `-File` would silently fail on a
+// remote host whose LocalMachine policy is Restricted/AllSigned with no GPO — a break that
+// surfaces on someone else's machine, not ours.
+//
+// If you ever need one, do NOT restore the command-line switch (it loses to a GPO scope anyway,
+// so it never covered the locked-down case): set the policy in-payload at process scope, the way
+// `buildWindowsStartupCommand` in src/shared/setup-agent-sequencing.ts does.
+//
+// Enforced by the ratchet in ssh-remote-powershell.test.ts, which scans every importer.
+export function powerShellCommand(
+  script: string,
+  executable: WindowsPowerShellExecutable = 'powershell.exe'
+): string {
+  const inline = encodedPowerShellCommand(script, executable)
   if (inline.length <= WINDOWS_REMOTE_COMMAND_LINE_BUDGET_CHARS) {
     return inline
   }
   // Why: these scripts are repetitive enough that gzip beats the UTF-16LE tax by
   // ~4x, which is the difference between a line cmd.exe runs and one it refuses.
-  const compressed = encodedPowerShellCommand(selfExtractingPowerShellScript(script))
+  const compressed = encodedPowerShellCommand(selfExtractingPowerShellScript(script), executable)
   if (compressed.length > WINDOWS_REMOTE_COMMAND_LINE_BUDGET_CHARS) {
     throw new Error(
       `Remote Windows command needs ${compressed.length} characters; Orca budgets ${WINDOWS_REMOTE_COMMAND_LINE_BUDGET_CHARS} for a line sshd hands to cmd.exe, which itself refuses more than ${CMD_EXE_COMMAND_LINE_MAX_CHARS}.`
@@ -27,8 +58,8 @@ export function powerShellCommand(script: string): string {
   return compressed
 }
 
-function encodedPowerShellCommand(script: string): string {
-  return `powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand ${encodePowerShellCommand(script)}`
+function encodedPowerShellCommand(script: string, executable: WindowsPowerShellExecutable): string {
+  return `${executable} -NoProfile -NonInteractive -EncodedCommand ${encodePowerShellCommand(script)}`
 }
 
 /** Orca-prefixed names so the payload can never shadow the bootstrap's own state. */
diff --git a/src/main/ssh/ssh-remote-windows-command-line-limit.test.ts b/src/main/ssh/ssh-remote-windows-command-line-limit.test.ts
index c104078238e..fa34a8fbda7 100644
--- a/src/main/ssh/ssh-remote-windows-command-line-limit.test.ts
+++ b/src/main/ssh/ssh-remote-windows-command-line-limit.test.ts
@@ -4,6 +4,10 @@ import { CMD_EXE_COMMAND_LINE_MAX_CHARS } from '../providers/windows-shell-args'
 import { getRemoteHostPlatform } from './ssh-remote-platform'
 import { tryStealInstallLockCommand } from './ssh-relay-install-lock-commands'
 import { decodeRemotePowerShellScript, powerShellCommand } from './ssh-remote-powershell'
+import {
+  makeWindowsPublishStagedFileCommand,
+  makeWindowsWriteFileCommand
+} from './system-ssh-windows-file-write'
 import {
   cleanupOwnedRelayUploadStageCommand,
   promoteOwnedRelayUploadStageCommand,
@@ -38,6 +42,17 @@ describe('Windows remote command line limit', () => {
     [
       'steal stale install lock',
       tryStealInstallLockCommand(windows, 'C:\\Users\\orca\\.orca-remote\\relay', 1_200)
+    ],
+    // F11 flagged these two as uncovered. They carry one path literal each, so they are the file
+    // commands whose length a caller can actually move.
+    ['write file', makeWindowsWriteFileCommand('C:\\Users\\orca\\.orca-remote\\relay.js')],
+    [
+      'publish staged file',
+      makeWindowsPublishStagedFileCommand(
+        'C:\\Users\\orca\\.orca-remote\\relay.js.orca-partial-0123456789ab',
+        'C:\\Users\\orca\\.orca-remote\\relay.js',
+        'create'
+      )
     ]
   ])('keeps the %s command inside what sshd\u2019s cmd.exe accepts', (_name, command) => {
     expect(command.length).toBeLessThanOrEqual(CMD_EXE_COMMAND_LINE_MAX_CHARS)
@@ -76,3 +91,32 @@ describe('Windows remote command line limit', () => {
     )
   })
 })
+
+/**
+ * F11 asked whether a pathological path could reach the budget, and what happens if it does.
+ * Measured: the inline encoding crosses 8000 at roughly 2500 high-entropy path characters — an
+ * order of magnitude past what Windows itself accepts — and the failure is a throw before any ssh
+ * is spawned, never a hang.
+ */
+describe('Windows file command budget headroom', () => {
+  it('absorbs a path far longer than Windows will accept', () => {
+    const deep = `C:\\Users\\orca\\${'segment\\'.repeat(30)}relay.js`
+
+    expect(deep.length).toBeGreaterThan(260)
+    expect(makeWindowsWriteFileCommand(deep).length).toBeLessThanOrEqual(
+      CMD_EXE_COMMAND_LINE_MAX_CHARS
+    )
+  })
+
+  it('throws rather than spawning a line cmd.exe would refuse', () => {
+    // Random segments so gzip cannot rescue it, which is the only way to reach the ceiling at all.
+    const incompressible = Array.from(
+      { length: 400 },
+      (_unused, index) => `${index}-${Math.random().toString(36).slice(2)}`
+    ).join('\\')
+
+    expect(() => makeWindowsWriteFileCommand(`C:\\${incompressible}\\f.bin`)).toThrow(
+      /Orca budgets 8000/
+    )
+  })
+})
diff --git a/src/main/ssh/ssh-system-fallback.test.ts b/src/main/ssh/ssh-system-fallback.test.ts
index c366e899bf6..b477ad682ef 100644
--- a/src/main/ssh/ssh-system-fallback.test.ts
+++ b/src/main/ssh/ssh-system-fallback.test.ts
@@ -709,9 +709,13 @@ describe('spawnSystemSsh', () => {
     expect(args[standaloneControlIdx + 1]).toBe('none')
   })
 
-  it('writes files to Windows system SSH targets with PowerShell stdin bytes', async () => {
-    const proc = createEventedProcess()
-    spawnMock.mockImplementation(() => closeOnceSpawned(proc))
+  it('sends Windows file writes over sftp, not through a remote PowerShell stdin', async () => {
+    const spawned: EventedProcess[] = []
+    spawnMock.mockImplementation(() => {
+      const proc = createEventedProcess()
+      spawned.push(proc)
+      return closeOnceSpawned(proc)
+    })
     const hostPlatform = getRemoteHostPlatform('win32-x64')
 
     const promise = writeFileViaSystemSsh(
@@ -722,16 +726,24 @@ describe('spawnSystemSsh', () => {
     )
 
     await expect(promise).resolves.toBeUndefined()
-    const args = spawnMock.mock.calls[0][1] as string[]
-    const remoteCommand = args.at(-1) ?? ''
-    expect(remoteCommand).toContain('powershell.exe')
-    expect(remoteCommand).not.toContain('/bin/sh')
-    expect(proc.stdin.end).toHaveBeenCalledWith(Buffer.from('0.1.0', 'utf-8'))
+    // #16432, re-measured: Windows PowerShell 5.1 can lose a redirected stdin for good when a read
+    // finds it momentarily empty, so the bytes must not travel that way at all.
+    const batch = String(spawned[0]!.stdin.end.mock.calls[0]?.[0] ?? '')
+    expect(batch).toContain('put ')
+    expect(batch).toContain('/C:/Users/me/.orca-remote/relay/.version.orca-partial-')
+    const sftpArgs = spawnMock.mock.calls[0][1] as string[]
+    expect(sftpArgs).toContain('-b')
+    // The rename that publishes it reads the staged file, never a pipe.
+    const publish = (spawnMock.mock.calls[1][1] as string[]).at(-1) ?? ''
+    expect(publish).toContain('powershell.exe')
+    expect(decodePowerShellCommand(publish)).toContain(
+      '[System.IO.File]::Replace($staging, $path, [NullString]::Value)'
+    )
+    expect(publish).not.toContain('/bin/sh')
   })
 
-  it('writes binary buffers to Windows system SSH targets with CreateNew mode', async () => {
-    const proc = createEventedProcess()
-    spawnMock.mockImplementation(() => closeOnceSpawned(proc))
+  it('enforces an exclusive Windows buffer write at the rename, where it is atomic', async () => {
+    spawnMock.mockImplementation(() => closeOnceSpawned(createEventedProcess()))
     const hostPlatform = getRemoteHostPlatform('win32-x64')
 
     const promise = writeBufferViaSystemSsh(
@@ -742,12 +754,11 @@ describe('spawnSystemSsh', () => {
     )
 
     await expect(promise).resolves.toBeUndefined()
-    const args = spawnMock.mock.calls[0][1] as string[]
-    const remoteCommand = args.at(-1) ?? ''
-    expect(remoteCommand).toContain('powershell.exe')
-    expect(decodePowerShellCommand(remoteCommand)).toContain('CreateNew')
-    expect(remoteCommand).not.toContain('/bin/sh')
-    expect(proc.stdin.end).toHaveBeenCalledWith(Buffer.from('png'))
+    const publish = decodePowerShellCommand((spawnMock.mock.calls[1][1] as string[]).at(-1) ?? '')
+    // `File::Move` raising on an existing destination is what carries the exclusive contract now;
+    // a `CreateNew` on the staged file would only refuse a leftover of our own.
+    expect(publish).toContain('[System.IO.File]::Move($staging, $path)')
+    expect(publish).not.toContain('[System.IO.File]::Delete($path)')
   })
 
   it('downloads files from Windows system SSH targets with PowerShell stdout bytes', async () => {
@@ -779,8 +790,7 @@ describe('spawnSystemSsh', () => {
   })
 
   it('forces standalone SSH for Windows file writes when requested', async () => {
-    const proc = createEventedProcess()
-    spawnMock.mockImplementation(() => closeOnceSpawned(proc))
+    spawnMock.mockImplementation(() => closeOnceSpawned(createEventedProcess()))
     const hostPlatform = getRemoteHostPlatform('win32-x64')
 
     const promise = writeFileViaSystemSsh(
@@ -791,10 +801,14 @@ describe('spawnSystemSsh', () => {
     )
 
     await expect(promise).resolves.toBeUndefined()
-    const args = spawnMock.mock.calls[0][1] as string[]
-    const standaloneControlIdx = args.indexOf('-S')
+    const sftpArgs = spawnMock.mock.calls[0][1] as string[]
+    // sftp's own `-S` names a program to run, so the same request has to be spelled as an option.
+    expect(sftpArgs).not.toContain('-S')
+    expect(sftpArgs).toContain('ControlPath=none')
+    const publishArgs = spawnMock.mock.calls[1][1] as string[]
+    const standaloneControlIdx = publishArgs.indexOf('-S')
     expect(standaloneControlIdx).toBeGreaterThan(-1)
-    expect(args[standaloneControlIdx + 1]).toBe('none')
+    expect(publishArgs[standaloneControlIdx + 1]).toBe('none')
   })
 
   it('uploads a Windows directory as a mkdir batch plus per-file writes, never one blob', async () => {
@@ -819,19 +833,20 @@ describe('spawnSystemSsh', () => {
       rmSync(localDir, { recursive: true, force: true })
     }
 
+    // #16432: directories first, then the file — but both over sftp now, so the only PowerShell
+    // left is the rename that publishes the staged file, which reads a file rather than a pipe.
+    const mkdirBatch = String(spawned[0]!.stdin.end.mock.calls[0]?.[0] ?? '')
+    expect(mkdirBatch).toBe('-mkdir "/C:/Users/me/.orca-remote/relay"\n')
+    const putBatch = String(spawned[1]!.stdin.end.mock.calls[0]?.[0] ?? '')
+    expect(putBatch).toContain('put ')
+    expect(putBatch).toContain('/C:/Users/me/.orca-remote/relay/relay.js.orca-partial-')
     const commands = spawnMock.mock.calls.map((call) => (call[1] as string[]).at(-1) ?? '')
-    // #16432: directories first (metadata only), then the file bytes on their own stdin. One batch
-    // meant base64-ing the whole bundle into a single PowerShell string, which the remote never read.
-    expect(commands).toHaveLength(2)
-    expect(commands.every((command) => command.includes('powershell.exe'))).toBe(true)
     expect(commands.every((command) => !command.includes('/bin/sh'))).toBe(true)
     expect(commands.join('\n')).not.toContain('tar -xzf')
-    expect(JSON.parse(spawned[0].stdin.end.mock.calls[0]?.[0] as string)).toEqual([
-      'C:/Users/me/.orca-remote/relay'
-    ])
-    expect(Buffer.from(spawned[1].stdin.end.mock.calls[0]?.[0] as Buffer).toString('utf-8')).toBe(
-      'console.log("relay")'
-    )
+    // Nothing base64s the bundle into one PowerShell string any more, and nothing reads one.
+    expect(
+      commands.some((command) => decodePowerShellCommand(command).includes('OpenStandardInput'))
+    ).toBe(false)
   })
 
   it('forces standalone SSH for Windows upload packages when requested', async () => {
@@ -855,9 +870,9 @@ describe('spawnSystemSsh', () => {
     }
 
     const args = spawnMock.mock.calls[0][1] as string[]
-    const standaloneControlIdx = args.indexOf('-S')
-    expect(standaloneControlIdx).toBeGreaterThan(-1)
-    expect(args[standaloneControlIdx + 1]).toBe('none')
+    // The first spawn is the sftp client, whose own `-S` names a program to run.
+    expect(args).not.toContain('-S')
+    expect(args).toContain('ControlPath=none')
   })
 
   it('throws when no system ssh is found', () => {
diff --git a/src/main/ssh/system-ssh-file-binary-transfer.ts b/src/main/ssh/system-ssh-file-binary-transfer.ts
index b0c5b662ed1..149d10dfbd3 100644
--- a/src/main/ssh/system-ssh-file-binary-transfer.ts
+++ b/src/main/ssh/system-ssh-file-binary-transfer.ts
@@ -1,5 +1,7 @@
 import { constants, createWriteStream } from 'node:fs'
-import { lstat, open } from 'node:fs/promises'
+import { lstat, mkdtemp, open, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
 import type { Writable } from 'node:stream'
 import { pipeline } from 'node:stream/promises'
 import type { SshTarget } from '../../shared/ssh-types'
@@ -16,6 +18,16 @@ import {
   throwIfAborted,
   waitForChannelClose
 } from './system-ssh-operation-lifecycle'
+import {
+  writeWindowsRemoteFile,
+  type WindowsWriteSource
+} from './system-ssh-windows-write-strategy'
+
+export {
+  WINDOWS_STDIN_WRITE_CHUNK_BYTES,
+  WINDOWS_STDIN_WRITE_TIMEOUT_MS
+} from './system-ssh-windows-write-strategy'
+export { WINDOWS_STAGED_WRITE_SUFFIX } from './system-ssh-windows-file-write'
 
 type SystemSshOperationOptions = SystemSshBuildArgsOptions & {
   signal?: AbortSignal
@@ -74,13 +86,16 @@ export async function writeBufferViaSystemSsh(
 ): Promise<void> {
   throwIfAborted(options?.signal)
   if (options?.hostPlatform && isWindowsRemoteHost(options.hostPlatform)) {
-    await writeWindowsBytesViaSystemSsh(
+    await writeWindowsRemoteFile(
       target,
       remotePath,
-      contents.length,
-      (offset, maxBytes) =>
-        Promise.resolve(contents.subarray(offset, Math.min(offset + maxBytes, contents.length))),
-      options
+      {
+        totalBytes: contents.length,
+        readChunk: (offset, maxBytes) =>
+          Promise.resolve(contents.subarray(offset, Math.min(offset + maxBytes, contents.length))),
+        withLocalFile: (send) => withTemporaryLocalFile(contents, send)
+      },
+      options ?? {}
     )
     return
   }
@@ -127,20 +142,19 @@ export async function uploadFileViaSystemSsh(
     throwIfAborted(options?.signal)
 
     if (options?.hostPlatform && isWindowsRemoteHost(options.hostPlatform)) {
-      // #16432: a Windows host cannot take a whole file through one stdin, however the local side
-      // paces it — see WINDOWS_STDIN_WRITE_CHUNK_BYTES. This is the path that carries the large
-      // files, so it is the one that has to be chunked and bounded.
-      await writeWindowsBytesViaSystemSsh(
-        target,
-        remotePath,
-        openedStat.size,
-        async (offset, maxBytes) => {
+      // This is the path that carries the large files, so it is the one the transport choice is
+      // made for; see the #16432 note below.
+      const source: WindowsWriteSource = {
+        totalBytes: openedStat.size,
+        readChunk: async (offset, maxBytes) => {
           const buffer = Buffer.allocUnsafe(Math.min(maxBytes, openedStat.size - offset))
           const { bytesRead } = await handle.read(buffer, 0, buffer.length, offset)
           return buffer.subarray(0, bytesRead)
         },
-        options
-      )
+        // The verified local file is already exactly the payload, so sftp sends it as is.
+        withLocalFile: (send) => send(localPath)
+      }
+      await writeWindowsRemoteFile(target, remotePath, source, options ?? {})
       return
     }
 
@@ -173,158 +187,56 @@ export async function uploadFileViaSystemSsh(
 }
 
 /**
- * #16432: Windows PowerShell 5.1 stops draining a redirected stdin over a non-pty ssh exec
- * somewhere between 50KB and 1MB, depending on the host's `DefaultShell`, and it hangs rather than
- * failing. The reporter measured that on both constructs he tried — `[Console]::In.ReadToEnd()` and
- * `new IO.StreamReader([Console]::OpenStandardInput())`, the latter reading incrementally, which is
- * why the limit cannot be attributed to materializing the payload. `Stream.CopyTo` reads the same
- * `[Console]::OpenStandardInput()` object with the same incremental `Read` loop, so nothing in it
- * escapes that limit either: no single write may exceed what one stdin is known to carry.
+ * #16432, re-measured: the constraint is not a size limit, and it is not cmd.exe's.
  *
- * 32KB is an order of magnitude under the low end of the measured range, and under 50KB, which the
- * reporter measured succeeding against a stream reader on the worse of the two `DefaultShell`
- * settings.
- */
-export const WINDOWS_STDIN_WRITE_CHUNK_BYTES = 32 * 1024
-
-/** No Windows stdin write should ever outlive this; a wedged PowerShell never closes on its own. */
-export const WINDOWS_STDIN_WRITE_TIMEOUT_MS = 60_000
-
-/** Suffix for the path a multi-exec Windows write lands on before it is published by rename. */
-export const WINDOWS_STAGED_WRITE_SUFFIX = '.orca-partial'
-
-/**
- * Splits one logical Windows write into stdin-sized execs.
+ * A read on Windows PowerShell 5.1's redirected-stdin handle over a non-pty ssh exec can die
+ * permanently when it finds the stream momentarily empty: no further bytes arrive, and no EOF ever
+ * does. It is probabilistic per such read — not a size threshold, and not certain on the first one.
+ * Measured on Windows 11 26200.9168 / OpenSSH_for_Windows_10.0p2 with `DefaultShell = cmd.exe`, by
+ * replacing the copy loop with a counting reader:
  *
- * A write that needs more than one exec cannot land on the destination directly: a chunk failing
- * mid-file would leave a truncated artifact under the real name with nothing marking it incomplete,
- * and the retry would then meet its own leftovers — under `exclusive` the retry's `CreateNew` fails
- * on them. Multi-exec creates therefore land on a staging path and are published by a rename, which
- * is also where `exclusive` is enforced: once, at the destination, instead of smeared across the
- * first chunk. A caller-requested append cannot be staged without reading the remote file back, so
- * it keeps writing straight through, as its own protocol already implies.
+ *   - a 1.5s gap before any byte, which forces the first read to find nothing -> 0 bytes, 6 of 6
+ *   - one byte, a 1.5s gap, then 32767 more  -> exactly 1 byte, then nothing
+ *   - 32768, a 1.5s gap, then 32768 more     -> exactly 32768, then nothing
+ *   - a continuous 2MB                       -> 167936 / 270336 / 372736, then nothing
+ *
+ * Those three 2MB death points are one payload run three times under the same conditions, which is
+ * what rules out a threshold: a stream that died at a fixed point would not vary by 2x. Independently reproduced by
+ * a second harness, where one 1.9MB counted read survived 39 reads to completion and another died
+ * after 11 — same construct, same payload.
+ *
+ * A payload small enough to arrive in one burst usually presents only one read that can find the
+ * stream empty (the one waiting for EOF), which is why 32KB mostly works: it still failed 15 times
+ * in 120 with the host under load, and 1 in 40 on a quiet one. Neither rate is survivable across
+ * the 62 execs a 1.9MB file needs — even 2.5% compounds to roughly four uploads in five failing —
+ * and no chunk size helps, because the client does not control whether its bytes arrive together.
+ *
+ * The same host, same `DefaultShell`, same connection pattern contradicts every size-limit reading:
+ * `findstr` took 2,016,000 bytes through one exec's stdin, and PowerShell 7 took 2MB. So cmd.exe is
+ * not the ceiling and neither is ~50KB. Writes now go over sftp, which moves the whole payload
+ * without any remote process reading a pipe; see `system-ssh-windows-write-strategy.ts` for the
+ * fallback order.
+ *
+ * Successes are never partial. Across every run in both harnesses a failed write hung; not one
+ * produced a short file, so this defect cannot silently truncate an upload.
  */
-async function writeWindowsBytesViaSystemSsh(
-  target: SshTarget,
-  remotePath: string,
-  totalBytes: number,
-  readChunk: (offset: number, maxBytes: number) => Promise<Buffer>,
-  options: SystemSshWriteBufferOptions
-): Promise<void> {
-  throwIfAborted(options.signal)
-  const staged = !options.append && totalBytes > WINDOWS_STDIN_WRITE_CHUNK_BYTES
-  const writePath = staged ? `${remotePath}${WINDOWS_STAGED_WRITE_SUFFIX}` : remotePath
-  let offset = 0
-  // An empty write still has to run: it is what creates (or truncates) the file.
-  do {
-    const chunk = await readChunk(offset, WINDOWS_STDIN_WRITE_CHUNK_BYTES)
-    if (chunk.length === 0 && offset < totalBytes) {
-      throw new Error(`Source ran short during upload of ${remotePath}`)
-    }
-    await writeWindowsChunkViaSystemSsh(
-      target,
-      writePath,
-      chunk,
-      {
-        ...options,
-        append: staged ? offset > 0 : options.append === true || offset > 0,
-        exclusive: staged ? false : options.exclusive === true && offset === 0
-      },
-      offset
-    )
-    offset += chunk.length
-  } while (offset < totalBytes)
-  if (staged) {
-    await publishWindowsStagedWrite(target, writePath, remotePath, options)
+
+/** A staged write is materialized locally first when the source is a buffer rather than a file. */
+async function withTemporaryLocalFile<T>(
+  contents: Buffer,
+  send: (localPath: string) => Promise<T>
+): Promise<T> {
+  const directory = await mkdtemp(join(tmpdir(), 'orca-win-upload-'))
+  const localPath = join(directory, 'payload.bin')
+  try {
+    // 0600: the payload can be repository content, and tmpdir is shared on every platform.
+    await writeFile(localPath, contents, { mode: 0o600 })
+    return await send(localPath)
+  } finally {
+    await rm(directory, { recursive: true, force: true }).catch(() => {})
   }
 }
 
-async function writeWindowsChunkViaSystemSsh(
-  target: SshTarget,
-  remotePath: string,
-  chunk: Buffer,
-  options: SystemSshWriteBufferOptions,
-  offset: number
-): Promise<void> {
-  throwIfAborted(options.signal)
-  const channel = spawnSystemSshCommand(target, makeWindowsWriteFileCommand(remotePath, options), {
-    wrapCommand: false,
-    ...getSystemSshBuildArgsFromOperationOptions(options)
-  })
-  const closePromise = awaitWithSystemSshAbort(
-    options.signal,
-    () => channel.close(),
-    waitForChannelClose(
-      channel,
-      `write ${remotePath} at offset ${offset}`,
-      WINDOWS_STDIN_WRITE_TIMEOUT_MS
-    )
-  )
-  if (!options.signal?.aborted) {
-    channel.stdin.end(chunk)
-  }
-  await closePromise
-}
-
-async function publishWindowsStagedWrite(
-  target: SshTarget,
-  stagingPath: string,
-  remotePath: string,
-  options: SystemSshWriteBufferOptions
-): Promise<void> {
-  throwIfAborted(options.signal)
-  const channel = spawnSystemSshCommand(
-    target,
-    makeWindowsPublishStagedFileCommand(stagingPath, remotePath, options.exclusive === true),
-    { wrapCommand: false, ...getSystemSshBuildArgsFromOperationOptions(options) }
-  )
-  const closePromise = awaitWithSystemSshAbort(
-    options.signal,
-    () => channel.close(),
-    waitForChannelClose(channel, `publish ${remotePath}`, WINDOWS_STDIN_WRITE_TIMEOUT_MS)
-  )
-  if (!options.signal?.aborted) {
-    channel.stdin.end()
-  }
-  await closePromise
-}
-
-function makeWindowsWriteFileCommand(
-  remotePath: string,
-  options?: { append?: boolean; exclusive?: boolean }
-): string {
-  const fileMode = options?.append ? 'Append' : options?.exclusive ? 'CreateNew' : 'Create'
-  return powerShellCommand(
-    [
-      '$ErrorActionPreference = "Stop"',
-      `$path = ${powerShellLiteral(remotePath)}`,
-      '$parent = [System.IO.Path]::GetDirectoryName($path)',
-      'if ($parent) { $null = [System.IO.Directory]::CreateDirectory($parent) }',
-      '$inputStream = [Console]::OpenStandardInput()',
-      `$outputStream = [System.IO.File]::Open($path, [System.IO.FileMode]::${fileMode}, [System.IO.FileAccess]::Write, [System.IO.FileShare]::None)`,
-      'try { $inputStream.CopyTo($outputStream) } finally { $outputStream.Dispose() }'
-    ].join('; ')
-  )
-}
-
-// `File::Move` throws when the destination exists, which is exactly the exclusive contract; the
-// non-exclusive caller asked to replace, so it deletes first (a no-op on an absent path).
-function makeWindowsPublishStagedFileCommand(
-  stagingPath: string,
-  remotePath: string,
-  exclusive: boolean
-): string {
-  return powerShellCommand(
-    [
-      '$ErrorActionPreference = "Stop"',
-      `$staging = ${powerShellLiteral(stagingPath)}`,
-      `$path = ${powerShellLiteral(remotePath)}`,
-      ...(exclusive ? [] : ['[System.IO.File]::Delete($path)']),
-      '[System.IO.File]::Move($staging, $path)'
-    ].join('; ')
-  )
-}
-
 function makePosixWriteFileCommand(
   remotePath: string,
   options?: { append?: boolean; exclusive?: boolean }
diff --git a/src/main/ssh/system-ssh-file-transfer.ts b/src/main/ssh/system-ssh-file-transfer.ts
index f728c0eab02..d5757904356 100644
--- a/src/main/ssh/system-ssh-file-transfer.ts
+++ b/src/main/ssh/system-ssh-file-transfer.ts
@@ -27,6 +27,12 @@ import {
   WINDOWS_STDIN_WRITE_TIMEOUT_MS,
   writeBufferViaSystemSsh
 } from './system-ssh-file-binary-transfer'
+import {
+  isSftpPathUnsupportedError,
+  isSftpUnavailableError,
+  makeDirectoriesViaSftp
+} from './system-ssh-sftp-transfer'
+import { getWindowsRemoteWriteCapabilities } from './system-ssh-windows-write-capabilities'
 
 type SystemSshOperationOptions = SystemSshBuildArgsOptions & {
   signal?: AbortSignal
@@ -161,9 +167,14 @@ async function collectWindowsUploadPlan(
   return plan
 }
 
-// Why the JSON envelope survives here: a path list is metadata, so this payload stays in the
-// hundreds of bytes even for a deep tree. Batched anyway, so a pathological tree cannot walk back
-// into the same stdin size that wedges PowerShell.
+/**
+ * Creates the upload's directories, preferring sftp's own `mkdir`.
+ *
+ * The PowerShell fallback keeps the JSON envelope, batched under one stdin's worth: a path list is
+ * metadata, so it stays in the hundreds of bytes even for a deep tree. It is still a redirected
+ * stdin read though, so on Windows PowerShell 5.1 it carries the same defect as any other — which
+ * is why sftp is tried first even for a payload this small.
+ */
 async function createWindowsUploadDirectories(
   target: SshTarget,
   directories: readonly string[],
@@ -175,23 +186,27 @@ async function createWindowsUploadDirectories(
     if (batch.length === 0) {
       return
     }
+    const pending = batch
     const payload = JSON.stringify(batch)
     batch = []
     batchBytes = 0
     throwIfAborted(options.signal)
-    const channel = spawnSystemSshCommand(target, makeWindowsCreateDirectoriesCommand(), {
-      wrapCommand: false,
-      ...getSystemSshBuildArgsFromOperationOptions(options)
-    })
-    const closePromise = awaitWithSystemSshAbort(
-      options.signal,
-      () => channel.close(),
-      waitForChannelClose(channel, 'windows relay upload mkdir', WINDOWS_STDIN_WRITE_TIMEOUT_MS)
+    await getWindowsRemoteWriteCapabilities(target).runWithFallback(
+      'sftp-subsystem',
+      async () => {
+        try {
+          await makeDirectoriesViaSftp(target, pending, options)
+        } catch (error) {
+          // A directory sftp cannot address is this batch's problem, not the host's verdict.
+          if (!isSftpPathUnsupportedError(error)) {
+            throw error
+          }
+          await createWindowsUploadDirectoriesViaPowerShell(target, payload, options)
+        }
+      },
+      () => createWindowsUploadDirectoriesViaPowerShell(target, payload, options),
+      isSftpUnavailableError
     )
-    if (!options.signal?.aborted) {
-      channel.stdin.end(payload)
-    }
-    await closePromise
   }
   for (const directory of directories) {
     const entryBytes = Buffer.byteLength(directory) + 4
@@ -204,17 +219,44 @@ async function createWindowsUploadDirectories(
   await flush()
 }
 
+async function createWindowsUploadDirectoriesViaPowerShell(
+  target: SshTarget,
+  payload: string,
+  options: SystemSshOperationOptions
+): Promise<void> {
+  const channel = spawnSystemSshCommand(target, makeWindowsCreateDirectoriesCommand(), {
+    wrapCommand: false,
+    ...getSystemSshBuildArgsFromOperationOptions(options)
+  })
+  const closePromise = awaitWithSystemSshAbort(
+    options.signal,
+    () => channel.close(),
+    waitForChannelClose(channel, 'windows relay upload mkdir', WINDOWS_STDIN_WRITE_TIMEOUT_MS)
+  )
+  if (!options.signal?.aborted) {
+    channel.stdin.end(payload)
+  }
+  await closePromise
+}
+
 function makeWindowsCreateDirectoriesCommand(): string {
   return powerShellCommand(
     [
       '$ErrorActionPreference = "Stop"',
-      // The reporter measured this reader surviving 50KB where `[Console]::In` wedged at the same
-      // size (#16432); the batch above stays under that.
+      // Reached only where the host has no sftp subsystem. Windows PowerShell 5.1 can lose a
+      // redirected stdin for good when a read finds it empty (#16432); a batch this small usually
+      // arrives in one piece, and "usually" is exactly why sftp is preferred.
       '$reader = New-Object System.IO.StreamReader([Console]::OpenStandardInput())',
       'try { $json = $reader.ReadToEnd() } finally { $reader.Dispose() }',
       'if ([string]::IsNullOrWhiteSpace($json)) { return }',
-      'foreach ($path in @($json | ConvertFrom-Json)) {',
-      '  $null = [System.IO.Directory]::CreateDirectory([string]$path)',
+      // `[string[]]`, not `@(...)`: ConvertFrom-Json emits the parsed array as a single pipeline
+      // object, so `@(...)` wraps it in *another* array and the loop variable binds to the whole
+      // thing. `[string]` of that is the paths joined by spaces, which CreateDirectory rejects with
+      // "The given path's format is not supported". It only ever worked for a one-element batch,
+      // where stringifying a single-element array happens to yield the element. Measured on
+      // WindowsPowerShell 5.1.26100 against a three-directory tree.
+      'foreach ($path in [string[]]($json | ConvertFrom-Json)) {',
+      '  $null = [System.IO.Directory]::CreateDirectory($path)',
       '}'
     ].join('; ')
   )
diff --git a/src/main/ssh/system-ssh-sftp-args.test.ts b/src/main/ssh/system-ssh-sftp-args.test.ts
new file mode 100644
index 00000000000..d971390f8dd
--- /dev/null
+++ b/src/main/ssh/system-ssh-sftp-args.test.ts
@@ -0,0 +1,141 @@
+/**
+ * `buildSshArgs` is shared with the sftp client, and three of its flags mean something else there.
+ * Every case below is a silent wrong-target rather than an error if the translation is skipped,
+ * which is why the fallback is "refuse and use another transport", never "pass it through".
+ */
+import { describe, expect, it } from 'vitest'
+import {
+  SftpArgTranslationError,
+  translateSshArgsToSftpArgs,
+  withSftpKeepalive
+} from './system-ssh-sftp-args'
+
+describe('translateSshArgsToSftpArgs', () => {
+  it('sends the port as an option, since sftp -p preserves mtimes instead', () => {
+    const args = translateSshArgsToSftpArgs(['-p', '2222', '--', 'dev@win.example'])
+
+    expect(args).toEqual(['-o', 'Port=2222', '--', 'dev@win.example'])
+  })
+
+  it('sends the login name as an option, since sftp has no -l', () => {
+    // `buildSshArgs` emits `-l` for a config alias no Host block claims. Throwing here would send
+    // exactly those hosts to the transport this PR exists to stop using, silently.
+    const args = translateSshArgsToSftpArgs(['-l', 'neil', '--', 'awin'])
+
+    expect(args).toEqual(['-o', 'User=neil', '--', 'awin'])
+  })
+
+  it('translates the whole unclaimed-alias shape buildSshArgs emits', () => {
+    const args = translateSshArgsToSftpArgs([
+      '-o',
+      'BatchMode=no',
+      '-T',
+      '-S',
+      'none',
+      '-o',
+      'Hostname=192.168.0.186',
+      '-p',
+      '2222',
+      '-l',
+      'neil',
+      '--',
+      'awin'
+    ])
+
+    expect(args).toEqual([
+      '-o',
+      'BatchMode=no',
+      '-o',
+      'ControlPath=none',
+      '-o',
+      'Hostname=192.168.0.186',
+      '-o',
+      'Port=2222',
+      '-o',
+      'User=neil',
+      '--',
+      'awin'
+    ])
+  })
+
+  it('spells ControlPath=none out, since sftp -S names a program to run', () => {
+    // `sftp -S none` would try to exec a binary called `none`.
+    const args = translateSshArgsToSftpArgs(['-S', 'none', '--', 'dev@win.example'])
+
+    expect(args).toEqual(['-o', 'ControlPath=none', '--', 'dev@win.example'])
+  })
+
+  it('refuses any other -S, which would hand sftp an ssh binary Orca did not choose', () => {
+    expect(() => translateSshArgsToSftpArgs(['-S', '/tmp/ctl.sock'])).toThrow(
+      SftpArgTranslationError
+    )
+  })
+
+  it('drops -T, which sftp does not have', () => {
+    expect(translateSshArgsToSftpArgs(['-T', '--', 'host'])).toEqual(['--', 'host'])
+  })
+
+  it('passes through the flags both clients spell the same way', () => {
+    const args = translateSshArgsToSftpArgs([
+      '-F',
+      '/tmp/config',
+      '-o',
+      'BatchMode=yes',
+      '-i',
+      '/tmp/key',
+      '-J',
+      'jump.example',
+      '--',
+      'dev@win.example'
+    ])
+
+    expect(args).toEqual([
+      '-F',
+      '/tmp/config',
+      '-o',
+      'BatchMode=yes',
+      '-i',
+      '/tmp/key',
+      '-J',
+      'jump.example',
+      '--',
+      'dev@win.example'
+    ])
+  })
+
+  it('takes everything after -- as the destination without reinterpreting it', () => {
+    // A host literally named `-p` is not a flag once `--` has been seen.
+    expect(translateSshArgsToSftpArgs(['--', '-p'])).toEqual(['--', '-p'])
+  })
+
+  it('refuses an unknown flag rather than guessing what sftp would do with it', () => {
+    // The point of the throw: a flag added to buildSshArgs later must degrade to another
+    // transport, not reach sftp carrying a different meaning.
+    expect(() => translateSshArgsToSftpArgs(['-A', '--', 'host'])).toThrow(SftpArgTranslationError)
+  })
+
+  it('refuses a value flag with no value', () => {
+    expect(() => translateSshArgsToSftpArgs(['-o'])).toThrow(SftpArgTranslationError)
+  })
+})
+
+describe('withSftpKeepalive', () => {
+  it('asks OpenSSH to notice a dead peer, since the transfer itself has no wall-clock bound', () => {
+    expect(withSftpKeepalive(['--', 'host'])).toEqual([
+      '-o',
+      'ServerAliveInterval=15',
+      '-o',
+      'ServerAliveCountMax=3',
+      '--',
+      'host'
+    ])
+  })
+
+  it('leaves a caller-stated keepalive policy alone', () => {
+    const args = withSftpKeepalive(['-o', 'ServerAliveInterval=60', '--', 'host'])
+
+    expect(args.filter((arg) => arg.startsWith('ServerAliveInterval'))).toEqual([
+      'ServerAliveInterval=60'
+    ])
+  })
+})
diff --git a/src/main/ssh/system-ssh-sftp-args.ts b/src/main/ssh/system-ssh-sftp-args.ts
new file mode 100644
index 00000000000..17fa37e78bb
--- /dev/null
+++ b/src/main/ssh/system-ssh-sftp-args.ts
@@ -0,0 +1,95 @@
+/**
+ * Rewrites `buildSshArgs` output for the sftp(1) client.
+ *
+ * Three flags ssh and sftp share spell different things: sftp's `-p` is "preserve mtime", its `-S`
+ * names the ssh binary to run, and it has no `-T` at all. Passing ssh's list through unchanged
+ * would silently connect to the wrong port and try to exec a program called `none`.
+ *
+ * Anything this table does not recognize throws. A flag added to `buildSshArgs` later must degrade
+ * to the non-sftp transfer path, never reach sftp carrying a different meaning.
+ */
+
+/** `buildSshArgs` emitted a flag with no sftp equivalent; the caller should use another transport. */
+export class SftpArgTranslationError extends Error {
+  constructor(flag: string) {
+    super(`No sftp equivalent for system ssh argument ${JSON.stringify(flag)}`)
+    this.name = 'SftpArgTranslationError'
+  }
+}
+
+/** Flags whose spelling and meaning are identical in both clients. */
+const PASSTHROUGH_VALUE_FLAGS = new Set(['-F', '-o', '-i', '-J'])
+
+export function translateSshArgsToSftpArgs(sshArgs: readonly string[]): string[] {
+  const sftpArgs: string[] = []
+  let index = 0
+  while (index < sshArgs.length) {
+    const flag = sshArgs[index]!
+    if (flag === '--') {
+      // Everything after `--` is the destination, which both clients spell the same way.
+      sftpArgs.push(...sshArgs.slice(index))
+      return sftpArgs
+    }
+    const value = sshArgs[index + 1]
+    if (PASSTHROUGH_VALUE_FLAGS.has(flag)) {
+      if (value === undefined) {
+        throw new SftpArgTranslationError(flag)
+      }
+      sftpArgs.push(flag, value)
+      index += 2
+      continue
+    }
+    if (flag === '-T') {
+      // sftp never allocates a tty, so ssh's "no tty" request has nothing to translate to.
+      index += 1
+      continue
+    }
+    if (flag === '-p') {
+      if (value === undefined) {
+        throw new SftpArgTranslationError(flag)
+      }
+      sftpArgs.push('-o', `Port=${value}`)
+      index += 2
+      continue
+    }
+    if (flag === '-l') {
+      // sftp has no `-l`; the login name is an option there. `buildSshArgs` emits this for an
+      // unclaimed config alias, so throwing would route those hosts down the defective path and
+      // then cache the refusal against them for half an hour.
+      if (value === undefined) {
+        throw new SftpArgTranslationError(flag)
+      }
+      sftpArgs.push('-o', `User=${value}`)
+      index += 2
+      continue
+    }
+    if (flag === '-S') {
+      // ssh's `-S none` is ControlPath=none; sftp's `-S` would run a binary called `none`.
+      if (value !== 'none') {
+        throw new SftpArgTranslationError(flag)
+      }
+      sftpArgs.push('-o', 'ControlPath=none')
+      index += 2
+      continue
+    }
+    throw new SftpArgTranslationError(flag)
+  }
+  return sftpArgs
+}
+
+/**
+ * A transfer that stalls mid-stream has no per-write bound to catch it, so ask OpenSSH to notice a
+ * dead peer itself. Only added when the caller has not already stated a keepalive policy.
+ */
+export function withSftpKeepalive(sftpArgs: readonly string[]): string[] {
+  const hasOption = (name: string): boolean =>
+    sftpArgs.some((arg, position) => sftpArgs[position - 1] === '-o' && arg.startsWith(`${name}=`))
+  const keepalive: string[] = []
+  if (!hasOption('ServerAliveInterval')) {
+    keepalive.push('-o', 'ServerAliveInterval=15')
+  }
+  if (!hasOption('ServerAliveCountMax')) {
+    keepalive.push('-o', 'ServerAliveCountMax=3')
+  }
+  return [...keepalive, ...sftpArgs]
+}
diff --git a/src/main/ssh/system-ssh-sftp-path.test.ts b/src/main/ssh/system-ssh-sftp-path.test.ts
new file mode 100644
index 00000000000..e196c2e3e8f
--- /dev/null
+++ b/src/main/ssh/system-ssh-sftp-path.test.ts
@@ -0,0 +1,59 @@
+/**
+ * Both functions here guard against the same measured failure: sftp's batch lexer treats `\` as an
+ * escape, so a Windows path handed over raw is silently mis-targeted *and the client still exits
+ * 0*. On Windows 11 / OpenSSH 10.0p2, `put src C:\Users\neil\qt\a.bin` created a file literally
+ * named `C` in the start directory and reported success.
+ */
+import { describe, expect, it } from 'vitest'
+import {
+  quoteSftpBatchArgument,
+  toSftpRemotePath,
+  UnsupportedSftpPathError
+} from './system-ssh-sftp-path'
+
+describe('toSftpRemotePath', () => {
+  it('roots a drive path under /, which is the namespace the Windows sftp-server exposes', () => {
+    // `pwd` in that session reports `/C:/Users/dev`.
+    expect(toSftpRemotePath('C:/Users/dev/f.bin')).toBe('/C:/Users/dev/f.bin')
+  })
+
+  it('accepts a path already in that namespace unchanged', () => {
+    expect(toSftpRemotePath('/C:/Users/dev/f.bin')).toBe('/C:/Users/dev/f.bin')
+  })
+
+  it('converts the separators Orca stores paths with', () => {
+    expect(toSftpRemotePath('C:\\Users\\dev\\f.bin')).toBe('/C:/Users/dev/f.bin')
+  })
+
+  it('declines a UNC path rather than guessing where it lands', () => {
+    // A guess here writes real bytes to the wrong place; declining falls back to another transport.
+    expect(() => toSftpRemotePath('//server/share/f.bin')).toThrow(UnsupportedSftpPathError)
+  })
+
+  it('declines a relative path, which would resolve against the session start directory', () => {
+    expect(() => toSftpRemotePath('Users/dev/f.bin')).toThrow(UnsupportedSftpPathError)
+  })
+})
+
+describe('quoteSftpBatchArgument', () => {
+  it('escapes the backslashes in a Windows client local path', () => {
+    // Unescaped, sftp reads this as C:srcf.bin and fails to find the source.
+    expect(quoteSftpBatchArgument('C:\\src\\f.bin')).toBe('"C:\\\\src\\\\f.bin"')
+  })
+
+  it('keeps a path with spaces as one argument', () => {
+    expect(quoteSftpBatchArgument('/tmp/two words.bin')).toBe('"/tmp/two words.bin"')
+  })
+
+  it('escapes an embedded quote, which would otherwise end the argument early', () => {
+    expect(quoteSftpBatchArgument('/tmp/dq".bin')).toBe('"/tmp/dq\\".bin"')
+  })
+
+  it('refuses a line break, which would split one batch command into two', () => {
+    expect(() => quoteSftpBatchArgument('/tmp/a\nrm -rf b')).toThrow(UnsupportedSftpPathError)
+  })
+
+  it('refuses a NUL, which truncates the argument', () => {
+    expect(() => quoteSftpBatchArgument('/tmp/a\0b')).toThrow(UnsupportedSftpPathError)
+  })
+})
diff --git a/src/main/ssh/system-ssh-sftp-path.ts b/src/main/ssh/system-ssh-sftp-path.ts
new file mode 100644
index 00000000000..2b5bfe53f02
--- /dev/null
+++ b/src/main/ssh/system-ssh-sftp-path.ts
@@ -0,0 +1,46 @@
+import { normalizeWindowsRemotePath } from './ssh-remote-platform'
+
+/**
+ * A path this transfer cannot express to sftp. Callers treat it as "use another transport", never
+ * as a transfer failure.
+ */
+export class UnsupportedSftpPathError extends Error {
+  constructor(path: string) {
+    super(`Path cannot be addressed over sftp: ${JSON.stringify(path)}`)
+    this.name = 'UnsupportedSftpPathError'
+  }
+}
+
+/**
+ * Converts a Windows remote path to the namespace OpenSSH's Windows sftp-server exposes, which
+ * roots every drive under `/`: `C:/Users/dev/f` is `/C:/Users/dev/f`, and `pwd` there reports
+ * `/C:/Users/dev`.
+ */
+export function toSftpRemotePath(remotePath: string): string {
+  const normalized = normalizeWindowsRemotePath(remotePath)
+  if (/^\/[a-zA-Z]:\//.test(normalized)) {
+    return normalized
+  }
+  if (/^[a-zA-Z]:\//.test(normalized)) {
+    return `/${normalized}`
+  }
+  // UNC (`//server/share`) and relative paths have no settled mapping in this namespace, and a
+  // guess here writes real bytes to the wrong place. Decline instead.
+  throw new UnsupportedSftpPathError(remotePath)
+}
+
+/**
+ * Quotes one argument of an sftp batch line.
+ *
+ * Escaping is load-bearing, not cosmetic: sftp's batch lexer treats `\` as an escape even inside
+ * double quotes, so an unescaped Windows local path `C:\src\f.bin` is read as `C:srcf.bin`, and an
+ * unescaped destination `C:\Users\dev\f.bin` writes a file literally named `C` in the start
+ * directory — while sftp still exits 0. Both measured on Windows 11 / OpenSSH 10.0p2.
+ */
+export function quoteSftpBatchArgument(value: string): string {
+  if (/[\n\r\0]/.test(value)) {
+    // A line break would split one batch command into two; NUL truncates the argument.
+    throw new UnsupportedSftpPathError(value)
+  }
+  return `"${value.replace(/([\\"])/g, '\\$1')}"`
+}
diff --git a/src/main/ssh/system-ssh-sftp-transfer.ts b/src/main/ssh/system-ssh-sftp-transfer.ts
new file mode 100644
index 00000000000..c50375fa8eb
--- /dev/null
+++ b/src/main/ssh/system-ssh-sftp-transfer.ts
@@ -0,0 +1,191 @@
+import { accessSync, constants, existsSync, statSync } from 'node:fs'
+import { posix, win32 } from 'node:path'
+import type { SshTarget } from '../../shared/ssh-types'
+import { buildSshArgs, type SystemSshBuildArgsOptions } from './system-ssh-args'
+import { findSystemSsh } from './system-ssh-binary'
+import {
+  SftpArgTranslationError,
+  translateSshArgsToSftpArgs,
+  withSftpKeepalive
+} from './system-ssh-sftp-args'
+import {
+  quoteSftpBatchArgument,
+  toSftpRemotePath,
+  UnsupportedSftpPathError
+} from './system-ssh-sftp-path'
+import { throwIfAborted } from './system-ssh-operation-lifecycle'
+import { runProcess } from '../../shared/child-process/run-process'
+
+/** The host answered, but not with an sftp subsystem. The caller must fall back, not fail. */
+export class SftpSubsystemUnavailableError extends Error {
+  constructor(detail: string) {
+    super(`Remote host has no usable sftp subsystem: ${detail}`)
+    this.name = 'SftpSubsystemUnavailableError'
+  }
+}
+
+/**
+ * True for the errors that mean "this host cannot serve sftp at all".
+ *
+ * Host-scoped, and therefore the only errors safe to remember: a capability cache keyed by host
+ * turns anything it accepts into a verdict about every later write to that host. Deliberately
+ * narrow — a permission denial or a missing directory is a real failure that must surface, not a
+ * reason to retry the whole upload down a slower path.
+ */
+export function isSftpUnavailableError(error: unknown): boolean {
+  return error instanceof SftpSubsystemUnavailableError || error instanceof SftpArgTranslationError
+}
+
+/**
+ * True when *this path* cannot be spelled for sftp, which says nothing about the host.
+ *
+ * Kept apart from the host verdict on purpose. A UNC destination, or a local file whose name
+ * contains a newline, is a property of one operation; caching it would degrade every subsequent
+ * write to that host for the cache's whole retry window on the strength of one odd filename.
+ */
+export function isSftpPathUnsupportedError(error: unknown): boolean {
+  return error instanceof UnsupportedSftpPathError
+}
+
+/** Neither kind of refusal moves a byte, so a staged file cannot exist to sweep. */
+export function isSftpRefusalBeforeStaging(error: unknown): boolean {
+  return isSftpUnavailableError(error) || isSftpPathUnsupportedError(error)
+}
+
+function systemSftpCandidates(sshPath: string | null, platform: NodeJS.Platform): string[] {
+  const pathApi = platform === 'win32' ? win32 : posix
+  const executable = platform === 'win32' ? 'sftp.exe' : 'sftp'
+  const candidates: string[] = []
+  // Why the ssh binary's own directory first: a host with two OpenSSH installs must pair the sftp
+  // client with the ssh that `buildSshArgs` was built for, not whichever one PATH happens to reach.
+  if (sshPath) {
+    candidates.push(pathApi.join(pathApi.dirname(sshPath), executable))
+  }
+  if (platform === 'win32') {
+    const systemRoot = process.env.SystemRoot || process.env.WINDIR
+    if (systemRoot) {
+      candidates.push(win32.join(systemRoot, 'System32', 'OpenSSH', executable))
+    }
+  } else {
+    candidates.push('/usr/bin/sftp', '/usr/local/bin/sftp', '/opt/homebrew/bin/sftp')
+  }
+  return candidates
+}
+
+/** Locate the sftp client paired with the system ssh binary. Returns null when there is none. */
+export function findSystemSftp(): string | null {
+  if (process.env.ORCA_SYSTEM_SFTP_PATH) {
+    return process.env.ORCA_SYSTEM_SFTP_PATH
+  }
+  const sshPath = findSystemSsh()
+  for (const candidate of systemSftpCandidates(sshPath, process.platform)) {
+    try {
+      if (!statSync(candidate).isFile()) {
+        continue
+      }
+      if (process.platform !== 'win32') {
+        accessSync(candidate, constants.X_OK)
+      }
+      return candidate
+    } catch {
+      continue
+    }
+  }
+  return findSftpOnPath()
+}
+
+function findSftpOnPath(): string | null {
+  const pathValue = process.env.PATH
+  if (!pathValue) {
+    return null
+  }
+  const pathApi = process.platform === 'win32' ? win32 : posix
+  const executable = process.platform === 'win32' ? 'sftp.exe' : 'sftp'
+  for (const entry of pathValue.split(pathApi.delimiter)) {
+    const directory = entry.trim().replace(/^"|"$/g, '')
+    if (!directory) {
+      continue
+    }
+    const candidate = pathApi.join(directory, executable)
+    if (existsSync(candidate)) {
+      return candidate
+    }
+  }
+  return null
+}
+
+/**
+ * OpenSSH prints this when the server refuses the subsystem — a host with `Subsystem sftp`
+ * commented out, or an internal-sftp block that does not apply to this user.
+ */
+const SUBSYSTEM_REFUSED_PATTERN = /subsystem request failed|no such file or directory.*sftp-server/i
+
+export type SftpBatchOptions = SystemSshBuildArgsOptions & { signal?: AbortSignal }
+
+/**
+ * Runs one sftp batch script.
+ *
+ * The script goes to the *local* sftp client's stdin, which is the point: no remote process ever
+ * reads a redirected stdin, so none of this rides the Windows PowerShell stdin defect.
+ */
+export async function runSftpBatch(
+  target: SshTarget,
+  commands: readonly string[],
+  options?: SftpBatchOptions
+): Promise<void> {
+  throwIfAborted(options?.signal)
+  const sftpPath = findSystemSftp()
+  if (!sftpPath) {
+    throw new SftpSubsystemUnavailableError('no sftp client binary found alongside ssh')
+  }
+  const args = withSftpKeepalive(translateSshArgsToSftpArgs(buildSshArgs(target, options)))
+  let result
+  try {
+    result = await runProcess({
+      program: sftpPath,
+      args: ['-b', '-', ...args],
+      // `-b -` takes the script on stdin, and that stdin is the *local* client's — no remote
+      // process reads a pipe anywhere in this transfer, which is the whole point of preferring it.
+      input: `${commands.join('\n')}\n`,
+      // Why no timeout: a large upload is legitimately slow, and a wall-clock cap would fail a
+      // healthy transfer on a slow link. A dead peer is caught by the ServerAlive options instead.
+      timeoutMs: null,
+      signal: options?.signal
+    })
+  } catch (error) {
+    // A client that will not start is "this host cannot do sftp" from the caller's side, not a
+    // transfer failure: the payload never left. Falling back is the only useful answer.
+    throw new SftpSubsystemUnavailableError(
+      `sftp client at ${sftpPath} could not be started: ${error instanceof Error ? error.message : String(error)}`
+    )
+  }
+  if (result.code === 0) {
+    return
+  }
+  throwIfAborted(options?.signal)
+  const detail = result.stderr.trim()
+  if (SUBSYSTEM_REFUSED_PATTERN.test(detail)) {
+    throw new SftpSubsystemUnavailableError(detail)
+  }
+  throw new Error(`sftp batch failed (exit ${result.code}): ${detail}`)
+}
+
+/**
+ * Creates remote directories, parents first.
+ *
+ * `-mkdir` keeps sftp going when a directory is already there; batch mode otherwise aborts the
+ * whole script on the first non-zero status, which for an idempotent tree walk is not a failure.
+ */
+export function makeDirectoriesViaSftp(
+  target: SshTarget,
+  remoteDirectories: readonly string[],
+  options?: SftpBatchOptions
+): Promise<void> {
+  const commands = remoteDirectories.map(
+    (directory) => `-mkdir ${quoteSftpBatchArgument(toSftpRemotePath(directory))}`
+  )
+  if (commands.length === 0) {
+    return Promise.resolve()
+  }
+  return runSftpBatch(target, commands, options)
+}
diff --git a/src/main/ssh/system-ssh-windows-file-write.ts b/src/main/ssh/system-ssh-windows-file-write.ts
new file mode 100644
index 00000000000..8b98d4aec50
--- /dev/null
+++ b/src/main/ssh/system-ssh-windows-file-write.ts
@@ -0,0 +1,138 @@
+import { randomBytes } from 'node:crypto'
+import { powerShellCommand, powerShellLiteral } from './ssh-remote-powershell'
+import { normalizeWindowsRemotePath } from './ssh-remote-platform'
+
+/**
+ * Suffix marking the path a Windows write lands on before it is published by rename.
+ *
+ * The random tail is the fix for a measured harm, not decoration. A write that loses contact with
+ * the host leaves a remote process that may still hold the staging file open exclusively, and
+ * `docs/reference/ssh-execution-boundary.md` is explicit that losing contact is not evidence that
+ * process died — so the retry must not reuse the name it may still own. A fresh name per attempt
+ * means a retry never meets its predecessor's lock; the abandoned file is cleaned up best-effort
+ * and never treated as proof of anything.
+ */
+export const WINDOWS_STAGED_WRITE_SUFFIX = '.orca-partial'
+
+export function makeWindowsStagingPath(remotePath: string): string {
+  return `${remotePath}${WINDOWS_STAGED_WRITE_SUFFIX}-${randomBytes(6).toString('hex')}`
+}
+
+export type WindowsPublishMode = 'create' | 'exclusive' | 'append'
+
+/**
+ * Publishes a staged upload onto its real name.
+ *
+ * Every branch reads the staged *file*, never a redirected stdin, which is what makes this safe on
+ * a host whose Windows PowerShell 5.1 cannot drain a piped stdin.
+ *
+ * The replacing branch must never delete the destination first. Deleting and then moving loses the
+ * user's existing file outright if the move fails, and exposes a window where a reader sees no file
+ * at all — a worse outcome than the truncated-partial this staging discipline exists to prevent.
+ * `File.Replace` is the atomic swap (Win32 `ReplaceFile`), and it requires the destination to
+ * exist, so an absent one falls back to a plain `Move`. That fallback is raced deliberately: if the
+ * destination appears in between, `Move` throws, the staged file survives, and the destination is
+ * left exactly as whoever created it left it.
+ *
+ * `File::Move` throwing on an existing destination is also precisely the exclusive contract, which
+ * is why that branch needs nothing else.
+ */
+export function makeWindowsPublishStagedFileCommand(
+  stagingPath: string,
+  remotePath: string,
+  mode: WindowsPublishMode
+): string {
+  const preamble = [
+    '$ErrorActionPreference = "Stop"',
+    `$staging = ${powerShellLiteral(stagingPath)}`,
+    `$path = ${powerShellLiteral(remotePath)}`,
+    '$parent = [System.IO.Path]::GetDirectoryName($path)',
+    'if ($parent) { $null = [System.IO.Directory]::CreateDirectory($parent) }'
+  ]
+  if (mode === 'append') {
+    return powerShellCommand(
+      [
+        ...preamble,
+        // Not atomic, and cannot cheaply be: appending is defined as extending the destination, so
+        // a failure part-way leaves it longer than it was rather than destroyed. The caller's
+        // chunked-append protocol already restarts from its own offset.
+        '$in = [System.IO.File]::OpenRead($staging)',
+        '$out = [System.IO.File]::Open($path, [System.IO.FileMode]::Append, [System.IO.FileAccess]::Write, [System.IO.FileShare]::None)',
+        'try { $in.CopyTo($out) } finally { $out.Dispose(); $in.Dispose() }',
+        '[System.IO.File]::Delete($staging)'
+      ].join('; ')
+    )
+  }
+  if (mode === 'exclusive') {
+    return powerShellCommand([...preamble, '[System.IO.File]::Move($staging, $path)'].join('; '))
+  }
+  return powerShellCommand(
+    [
+      ...preamble,
+      // `[NullString]::Value`, not `$null`: PowerShell coerces a bare `$null` to an empty string
+      // when binding a .NET `string` parameter, and `Replace` rejects that with "The path is not
+      // of a legal form" — so every publish would fail. Measured on WindowsPowerShell 5.1.26100.
+      'try { [System.IO.File]::Replace($staging, $path, [NullString]::Value) } catch [System.IO.FileNotFoundException] { [System.IO.File]::Move($staging, $path) }'
+    ].join('; ')
+  )
+}
+
+/** Best-effort removal of a staged file whose write was abandoned. Never asserts the writer died. */
+export function makeWindowsDiscardStagedFileCommand(stagingPath: string): string {
+  return powerShellCommand(
+    [
+      // Deliberately not `Stop`: the previous writer may still hold this file, and that is a
+      // possibility to tolerate, not an error to report. The unique staging name means a leftover
+      // blocks nothing; sweeping it is housekeeping.
+      '$ErrorActionPreference = "SilentlyContinue"',
+      `$staging = ${powerShellLiteral(stagingPath)}`,
+      '[System.IO.File]::Delete($staging)'
+    ].join('; ')
+  )
+}
+
+/**
+ * The ancestor directories of a Windows remote path, drive root first.
+ *
+ * sftp's `mkdir` creates one level, so a batch has to name each level itself. The drive root is
+ * excluded: `-mkdir "/C:/"` is not a directory anyone creates.
+ */
+export function windowsRemoteAncestorDirectories(remotePath: string): string[] {
+  const normalized = normalizeWindowsRemotePath(remotePath)
+  const segments = normalized.split('/')
+  segments.pop()
+  const ancestors: string[] = []
+  // Start past the drive (`C:`) or the UNC host, which are never created.
+  for (let depth = 2; depth <= segments.length; depth += 1) {
+    const directory = segments.slice(0, depth).join('/')
+    if (directory) {
+      ancestors.push(directory)
+    }
+  }
+  return ancestors
+}
+
+/**
+ * `[Console]::OpenStandardInput()` into a `FileStream`, used only by the two stdin fallbacks.
+ *
+ * On Windows PowerShell 5.1 this is the defective read; see the strategy comment in
+ * `system-ssh-file-binary-transfer.ts`. It is correct under PowerShell 7.
+ */
+export function makeWindowsWriteFileCommand(
+  remotePath: string,
+  options?: { append?: boolean; exclusive?: boolean; executable?: 'powershell.exe' | 'pwsh.exe' }
+): string {
+  const fileMode = options?.append ? 'Append' : options?.exclusive ? 'CreateNew' : 'Create'
+  return powerShellCommand(
+    [
+      '$ErrorActionPreference = "Stop"',
+      `$path = ${powerShellLiteral(remotePath)}`,
+      '$parent = [System.IO.Path]::GetDirectoryName($path)',
+      'if ($parent) { $null = [System.IO.Directory]::CreateDirectory($parent) }',
+      '$inputStream = [Console]::OpenStandardInput()',
+      `$outputStream = [System.IO.File]::Open($path, [System.IO.FileMode]::${fileMode}, [System.IO.FileAccess]::Write, [System.IO.FileShare]::None)`,
+      'try { $inputStream.CopyTo($outputStream) } finally { $outputStream.Dispose() }'
+    ].join('; '),
+    options?.executable ?? 'powershell.exe'
+  )
+}
diff --git a/src/main/ssh/system-ssh-windows-upload.test.ts b/src/main/ssh/system-ssh-windows-upload.test.ts
index 207c3e2df8e..c3a5ff80276 100644
--- a/src/main/ssh/system-ssh-windows-upload.test.ts
+++ b/src/main/ssh/system-ssh-windows-upload.test.ts
@@ -1,29 +1,40 @@
 /**
- * #16432: the Windows relay upload pushed the whole bundle into one PowerShell stdin, which
- * Windows PowerShell 5.1 cannot drain over a non-pty ssh exec — the remote blocks forever, and
- * `waitForChannelClose()` had no timeout, so the UI sat at "Connecting…" with no error. Covered
- * here: no write exceeds one stdin's worth on any Windows path (bundle upload *and* single-file
- * upload, which is the one that carries large files), a partial write never lands under the real
- * name, and a remote that never closes fails instead of hanging.
+ * #16432. The original fix chunked the payload because the constraint was believed to be a ~50KB
+ * cmd.exe stdin ceiling. Re-measured on Windows 11 26200.9168 / OpenSSH_for_Windows_10.0p2, it is
+ * not a size limit and not cmd.exe's: a read on Windows PowerShell 5.1's redirected-stdin handle
+ * over a non-pty ssh exec can die permanently when it finds the stream momentarily empty, taking
+ * both the remaining data and the EOF with it. It is probabilistic per such read — identical 2MB
+ * payloads died at 167936, 270336 and 372736 — so a 32KB chunk still failed 15 times in 120 under
+ * load, while `findstr` took 2,016,000 bytes through one exec on the same host.
+ *
+ * So the covering property is no longer "every write is small". It is "the bytes do not cross a
+ * remote process's stdin at all": sftp first, PowerShell 7 next, and Windows PowerShell 5.1 last,
+ * bounded and loud. The staging-and-rename discipline is kept on every path, with a unique staging
+ * name per attempt so a retry never meets a predecessor's lock.
  */
 import { EventEmitter } from 'node:events'
 import { mkdirSync, mkdtempSync, writeFileSync } from 'node:fs'
-import { rm } from 'node:fs/promises'
+import { readFile, rm, stat } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { PassThrough, Writable } from 'node:stream'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type * as SystemSshOperationLifecycle from './system-ssh-operation-lifecycle'
 
-const { spawnSystemSshCommandMock, waitForChannelCloseSpy } = vi.hoisted(() => ({
+const { spawnSystemSshCommandMock, waitForChannelCloseSpy, runProcessMock } = vi.hoisted(() => ({
   spawnSystemSshCommandMock: vi.fn(),
-  waitForChannelCloseSpy: vi.fn()
+  waitForChannelCloseSpy: vi.fn(),
+  runProcessMock: vi.fn()
 }))
 
 vi.mock('./system-ssh-command', () => ({
   spawnSystemSshCommand: spawnSystemSshCommandMock
 }))
 
+vi.mock('../../shared/child-process/run-process', () => ({
+  runProcess: runProcessMock
+}))
+
 // Delegates to the real implementation; the spy only records whether each wait was given a bound.
 vi.mock('./system-ssh-operation-lifecycle', async (importActual) => {
   const actual = (await importActual()) as typeof SystemSshOperationLifecycle
@@ -41,6 +52,11 @@ import {
 } from './system-ssh-file-binary-transfer'
 import { waitForChannelClose } from './system-ssh-operation-lifecycle'
 import { getRemoteHostPlatform } from './ssh-remote-platform'
+import {
+  clearWindowsRemoteWriteCapabilitiesForTests,
+  getWindowsRemoteWriteCapabilities
+} from './system-ssh-windows-write-capabilities'
+import { explainWindowsPowerShellStdinFailure } from './system-ssh-windows-write-strategy'
 import type { SshTarget } from '../../shared/ssh-types'
 
 type FakeChannel = EventEmitter & {
@@ -50,7 +66,12 @@ type FakeChannel = EventEmitter & {
   written: Buffer
 }
 
-const target = { id: 'win-1', host: 'win.example', username: 'dev' } as unknown as SshTarget
+const target = {
+  id: 'win-1',
+  host: 'win.example',
+  username: 'dev',
+  port: 22
+} as unknown as SshTarget
 const hostPlatform = getRemoteHostPlatform('win32-x64')
 const remoteRoot = 'C:/Users/dev/.orca-remote'
 
@@ -78,96 +99,238 @@ function createFakeChannel(onEnd: (channel: FakeChannel) => void): FakeChannel {
   return channel
 }
 
-type RecordedCommand = { script: string; stdin: Buffer }
+type RecordedCommand = { script: string; executable: string; stdin: Buffer }
+type RecordedSftpBatch = { args: string[]; script: string }
 
-describe('Windows upload stdin framing', () => {
-  let localDir: string
-  const commands: RecordedCommand[] = []
-  /** Index of the spawn that should report a non-zero exit, to model a chunk failing mid-file. */
-  let failAtSpawn = -1
+const sftpBatches: RecordedSftpBatch[] = []
+const commands: RecordedCommand[] = []
+/** Index of the exec that should report a non-zero exit, to model a chunk failing mid-file. */
+let failAtSpawn = -1
+let localDir: string
 
-  const fileWrites = (): RecordedCommand[] =>
-    commands.filter((command) => command.script.includes('FileMode]::'))
-  const writtenPath = (command: RecordedCommand): string =>
-    /\$path = '((?:[^']|'')*)'/.exec(command.script)?.[1].replace(/''/g, "'") ?? ''
-  const fileMode = (command: RecordedCommand): string | undefined =>
-    /FileMode\]::(\w+)/.exec(command.script)?.[1]
+const fileWrites = (): RecordedCommand[] =>
+  commands.filter((command) => command.script.includes('OpenStandardInput'))
+const writtenPath = (command: RecordedCommand): string =>
+  /\$path = '((?:[^']|'')*)'/.exec(command.script)?.[1]?.replace(/''/g, "'") ?? ''
+const fileMode = (command: RecordedCommand): string | undefined =>
+  /FileMode\]::(\w+)/.exec(command.script)?.[1]
+const putLines = (): string[] =>
+  sftpBatches.flatMap((batch) => batch.script.split('\n').filter((line) => line.startsWith('put ')))
+const putDestination = (line: string): string => /put "(?:[^"]*)" "([^"]*)"/.exec(line)?.[1] ?? ''
+const putSource = (line: string): string => /put "([^"]*)"/.exec(line)?.[1] ?? ''
 
-  beforeEach(() => {
-    commands.length = 0
-    failAtSpawn = -1
-    waitForChannelCloseSpy.mockClear()
-    localDir = mkdtempSync(join(tmpdir(), 'orca-win-upload-'))
-    spawnSystemSshCommandMock.mockReset()
-    spawnSystemSshCommandMock.mockImplementation((_target: SshTarget, command: string) => {
-      const spawnIndex = spawnSystemSshCommandMock.mock.calls.length - 1
-      return createFakeChannel((channel) => {
-        commands.push({ script: decodePowerShellCommand(command), stdin: channel.written })
-        setImmediate(() =>
-          spawnIndex === failAtSpawn
-            ? channel.emit('close', 1, null)
-            : channel.emit('close', 0, null)
-        )
+/** Makes every sftp batch succeed, recording what it was asked to do. */
+function acceptSftp(): void {
+  runProcessMock.mockImplementation(
+    async (spec: { args: string[]; input: string; program: string }) => {
+      const script = spec.input
+      sftpBatches.push({ args: spec.args, script })
+      // Model the real client: `put` copies the local file, so read it while it still exists.
+      for (const line of script.split('\n').filter((entry) => entry.startsWith('put '))) {
+        await readFile(putSource(line))
+      }
+      return { code: 0, signal: null, stdout: '', stderr: '', timedOut: false }
+    }
+  )
+}
+
+/** Models a host whose sshd has no `Subsystem sftp` line. */
+function refuseSftp(): void {
+  runProcessMock.mockImplementation(async (spec: { args: string[]; input: string }) => {
+    sftpBatches.push({ args: spec.args, script: spec.input })
+    return {
+      code: 255,
+      signal: null,
+      stdout: '',
+      stderr: 'subsystem request failed on channel 0\nConnection closed',
+      timedOut: false
+    }
+  })
+}
+
+/** Models a host with no PowerShell 7, which cmd.exe reports as an unrecognized command. */
+function refusePwsh(): void {
+  spawnSystemSshCommandMock.mockImplementation((_target: SshTarget, command: string) => {
+    const spawnIndex = spawnSystemSshCommandMock.mock.calls.length - 1
+    const executable = command.split(' ')[0] ?? ''
+    return createFakeChannel((channel) => {
+      commands.push({
+        script: decodePowerShellCommand(command),
+        executable,
+        stdin: channel.written
+      })
+      setImmediate(() => {
+        if (executable === 'pwsh.exe') {
+          channel.stderr.write(
+            "'pwsh.exe' is not recognized as an internal or external command,\noperable program or batch file."
+          )
+          channel.emit('close', 9009, null)
+          return
+        }
+        channel.emit('close', spawnIndex === failAtSpawn ? 1 : 0, null)
       })
     })
   })
+}
 
-  afterEach(async () => {
-    await rm(localDir, { recursive: true, force: true })
+beforeEach(() => {
+  commands.length = 0
+  sftpBatches.length = 0
+  failAtSpawn = -1
+  clearWindowsRemoteWriteCapabilitiesForTests()
+  waitForChannelCloseSpy.mockClear()
+  localDir = mkdtempSync(join(tmpdir(), 'orca-win-upload-'))
+  process.env.ORCA_SYSTEM_SFTP_PATH = '/usr/bin/sftp'
+  runProcessMock.mockReset()
+  acceptSftp()
+  spawnSystemSshCommandMock.mockReset()
+  spawnSystemSshCommandMock.mockImplementation((_target: SshTarget, command: string) => {
+    const spawnIndex = spawnSystemSshCommandMock.mock.calls.length - 1
+    return createFakeChannel((channel) => {
+      commands.push({
+        script: decodePowerShellCommand(command),
+        executable: command.split(' ')[0] ?? '',
+        stdin: channel.written
+      })
+      setImmediate(() =>
+        spawnIndex === failAtSpawn ? channel.emit('close', 1, null) : channel.emit('close', 0, null)
+      )
+    })
   })
+})
 
-  it('never pushes a whole artifact bundle into one PowerShell stdin', async () => {
-    mkdirSync(join(localDir, 'node'), { recursive: true })
-    // Comfortably past the ~50KB point at which the reporter measured PowerShell 5.1 wedging.
-    writeFileSync(join(localDir, 'node', 'relay.js'), Buffer.alloc(600 * 1024, 0x61))
-    writeFileSync(join(localDir, 'index.js'), Buffer.alloc(300 * 1024, 0x62))
+afterEach(async () => {
+  delete process.env.ORCA_SYSTEM_SFTP_PATH
+  await rm(localDir, { recursive: true, force: true })
+})
 
-    await uploadDirectoryViaSystemSsh(target, localDir, remoteRoot, { hostPlatform })
-
-    const largest = Math.max(...commands.map((command) => command.stdin.length))
-    expect(largest).toBeLessThanOrEqual(WINDOWS_STDIN_WRITE_CHUNK_BYTES)
-    // The base64 + JSON envelope is gone entirely: nothing reads the bundle as one string.
-    expect(commands.some((command) => command.script.includes('FromBase64String'))).toBe(false)
-    // `[Console]::In` wedged at 50KB where the stream reader did not, so the mkdir batch — the one
-    // payload still read as a string — must use the reader the reporter measured surviving.
-    expect(commands.some((command) => command.script.includes('[Console]::In.ReadToEnd()'))).toBe(
-      false
-    )
-    expect(
-      commands.filter((command) => command.script.includes('StreamReader([Console]::'))
-    ).toHaveLength(1)
-  })
-
-  it('bounds the single-file upload too, which is the path large files take', async () => {
-    const contents = Buffer.alloc(WINDOWS_STDIN_WRITE_CHUNK_BYTES * 3 + 11, 0x64)
+describe('Windows upload over sftp', () => {
+  it('moves the payload without any remote process reading a stdin', async () => {
+    const contents = Buffer.alloc(WINDOWS_STDIN_WRITE_CHUNK_BYTES * 60 + 11, 0x64)
     const localPath = join(localDir, 'big.node')
     writeFileSync(localPath, contents)
 
     await uploadFileViaSystemSsh(target, localPath, `${remoteRoot}/big.node`, { hostPlatform })
 
-    const writes = fileWrites()
-    expect(writes).toHaveLength(4)
-    expect(Math.max(...writes.map((write) => write.stdin.length))).toBe(
-      WINDOWS_STDIN_WRITE_CHUNK_BYTES
-    )
-    expect(Buffer.concat(writes.map((write) => write.stdin)).equals(contents)).toBe(true)
-    // A wedged PowerShell never closes on its own, so no wait on this path may be unbounded.
-    expect(
-      waitForChannelCloseSpy.mock.calls.every((call) => call[2] === WINDOWS_STDIN_WRITE_TIMEOUT_MS)
-    ).toBe(true)
+    // The defect is a remote stdin read; the fix is that there is not one.
+    expect(fileWrites()).toHaveLength(0)
+    expect(putLines()).toHaveLength(1)
+    // One transfer, not 61 execs: the whole point of the change.
+    expect(sftpBatches).toHaveLength(1)
   })
 
-  it('writes every byte of every artifact across the chunked writes', async () => {
-    const contents = Buffer.alloc(WINDOWS_STDIN_WRITE_CHUNK_BYTES * 2 + 17, 0x63)
-    writeFileSync(join(localDir, 'relay.js'), contents)
+  it('creates the parent chain and sends the payload in one round trip', async () => {
+    writeFileSync(join(localDir, 'relay.js'), 'x')
 
-    await uploadDirectoryViaSystemSsh(target, localDir, remoteRoot, { hostPlatform })
+    await uploadFileViaSystemSsh(target, join(localDir, 'relay.js'), `${remoteRoot}/a/b/relay.js`, {
+      hostPlatform
+    })
 
-    const writes = fileWrites()
-    expect(writes).toHaveLength(3)
-    expect(Buffer.concat(writes.map((write) => write.stdin)).equals(contents)).toBe(true)
-    // Only the first write creates the staging file; the rest must extend it or it is truncated.
-    expect(writes.map(fileMode)).toEqual(['Create', 'Append', 'Append'])
+    expect(sftpBatches).toHaveLength(1)
+    expect(sftpBatches[0]!.script.split('\n').filter(Boolean)).toEqual([
+      '-mkdir "/C:/Users"',
+      '-mkdir "/C:/Users/dev"',
+      '-mkdir "/C:/Users/dev/.orca-remote"',
+      '-mkdir "/C:/Users/dev/.orca-remote/a"',
+      '-mkdir "/C:/Users/dev/.orca-remote/a/b"',
+      expect.stringContaining('put ') as unknown as string
+    ])
+  })
+
+  it('addresses the destination in the drive-rooted namespace sftp exposes', async () => {
+    writeFileSync(join(localDir, 'relay.js'), 'x')
+
+    await uploadFileViaSystemSsh(target, join(localDir, 'relay.js'), `${remoteRoot}/relay.js`, {
+      hostPlatform
+    })
+
+    // A backslash destination silently writes a file named `C` and still exits 0, so the leading
+    // slash and forward separators are correctness, not style.
+    expect(putDestination(putLines()[0]!)).toMatch(
+      /^\/C:\/Users\/dev\/\.orca-remote\/relay\.js\.orca-partial-[0-9a-f]{12}$/
+    )
+  })
+
+  it('never lands a partial under the real name, and publishes by rename', async () => {
+    writeFileSync(join(localDir, 'relay.js'), 'x')
+    const remotePath = `${remoteRoot}/relay.js`
+
+    await uploadFileViaSystemSsh(target, join(localDir, 'relay.js'), remotePath, { hostPlatform })
+
+    const destination = putDestination(putLines()[0]!)
+    // Assert the positive first: an unmatched regex yields '', which would satisfy the `not.toBe`
+    // below without this test ever having seen a destination.
+    expect(destination).toContain(WINDOWS_STAGED_WRITE_SUFFIX)
+    expect(destination).not.toBe(`/C:${remotePath.slice(2)}`)
+    const publish = commands.at(-1)!
+    expect(publish.script).toContain(
+      '[System.IO.File]::Replace($staging, $path, [NullString]::Value)'
+    )
+    // The publish reads the staged file, never a pipe, so it is safe on PowerShell 5.1.
+    expect(publish.script).not.toContain('OpenStandardInput')
+  })
+
+  it('never deletes the destination it is replacing', async () => {
+    writeFileSync(join(localDir, 'relay.js'), 'x')
+
+    await uploadFileViaSystemSsh(target, join(localDir, 'relay.js'), `${remoteRoot}/relay.js`, {
+      hostPlatform
+    })
+
+    const publish = commands.at(-1)!
+    // Delete-then-move destroys the user's existing file outright if the move then fails, and
+    // exposes a window where a reader sees no file at all — worse than the truncated partial the
+    // staging discipline exists to prevent. `File.Replace` is the atomic swap.
+    expect(publish.script).not.toContain('[System.IO.File]::Delete($path)')
+    expect(publish.script).toContain(
+      '[System.IO.File]::Replace($staging, $path, [NullString]::Value)'
+    )
+    // An absent destination cannot be Replaced, so that case falls back to a plain Move.
+    expect(publish.script).toContain(
+      'catch [System.IO.FileNotFoundException] { [System.IO.File]::Move($staging, $path) }'
+    )
+  })
+
+  it('gives every attempt its own staging name, so a retry cannot meet a predecessor lock', async () => {
+    writeFileSync(join(localDir, 'relay.js'), 'x')
+
+    await uploadFileViaSystemSsh(target, join(localDir, 'relay.js'), `${remoteRoot}/relay.js`, {
+      hostPlatform
+    })
+    await uploadFileViaSystemSsh(target, join(localDir, 'relay.js'), `${remoteRoot}/relay.js`, {
+      hostPlatform
+    })
+
+    const [first, second] = putLines().map(putDestination)
+    expect(first).toContain(WINDOWS_STAGED_WRITE_SUFFIX)
+    // Losing contact is not evidence the previous writer died, so the name must not be reused.
+    expect(second).not.toBe(first)
+  })
+
+  it('enforces exclusive at the rename, where it is atomic', async () => {
+    writeFileSync(join(localDir, 'import.bin'), 'x')
+
+    await uploadFileViaSystemSsh(target, join(localDir, 'import.bin'), `${remoteRoot}/import.bin`, {
+      hostPlatform,
+      exclusive: true
+    })
+
+    const publish = commands.at(-1)!
+    expect(publish.script).toContain('[System.IO.File]::Move($staging, $path)')
+    expect(publish.script).not.toContain('[System.IO.File]::Delete($path)')
+  })
+
+  it('appends by concatenating the staged file, not by piping bytes to the remote', async () => {
+    await writeBufferViaSystemSsh(target, `${remoteRoot}/log.bin`, Buffer.from('tail'), {
+      hostPlatform,
+      append: true
+    })
+
+    expect(fileWrites()).toHaveLength(0)
+    const publish = commands.at(-1)!
+    expect(publish.script).toContain('FileMode]::Append')
+    expect(publish.script).toContain('$in.CopyTo($out)')
+    expect(publish.script).toContain('[System.IO.File]::Delete($staging)')
   })
 
   it('still creates an empty artifact on the host', async () => {
@@ -175,80 +338,310 @@ describe('Windows upload stdin framing', () => {
 
     await uploadDirectoryViaSystemSsh(target, localDir, remoteRoot, { hostPlatform })
 
-    expect(fileWrites().map(writtenPath)).toEqual([`${remoteRoot}/empty.txt`])
-    expect(fileWrites()[0].stdin).toHaveLength(0)
-    expect(fileMode(fileWrites()[0])).toBe('Create')
+    expect(putLines()).toHaveLength(1)
+    expect(commands.at(-1)!.script).toContain('[System.IO.File]::Move($staging, $path)')
   })
 
-  it('lands a multi-chunk write on a staging path and publishes it by rename', async () => {
-    const remotePath = `${remoteRoot}/relay.js`
-    writeFileSync(join(localDir, 'relay.js'), Buffer.alloc(WINDOWS_STDIN_WRITE_CHUNK_BYTES + 1))
+  it('writes a buffer through a 0600 temp file that does not outlive the transfer', async () => {
+    const seen: { path: string; contents: Buffer; mode: number }[] = []
+    runProcessMock.mockImplementation(async (spec: { args: string[]; input: string }) => {
+      sftpBatches.push({ args: spec.args, script: spec.input })
+      for (const line of spec.input.split('\n').filter((entry) => entry.startsWith('put '))) {
+        const path = putSource(line)
+        seen.push({
+          path,
+          contents: await readFile(path),
+          mode: (await stat(path)).mode & 0o777
+        })
+      }
+      return { code: 0, signal: null, stdout: '', stderr: '', timedOut: false }
+    })
+
+    await writeBufferViaSystemSsh(target, `${remoteRoot}/version`, Buffer.from('1.2.3'), {
+      hostPlatform
+    })
+
+    expect(seen).toHaveLength(1)
+    expect(seen[0]!.contents.toString()).toBe('1.2.3')
+    // The payload can be repository content and tmpdir is world-readable on every platform, so the
+    // window between write and upload must not be group- or world-readable.
+    expect(seen[0]!.mode).toBe(0o600)
+    await expect(readFile(seen[0]!.path)).rejects.toThrow()
+  })
+
+  it('creates upload directories over sftp rather than a PowerShell stdin batch', async () => {
+    mkdirSync(join(localDir, 'node'), { recursive: true })
+    writeFileSync(join(localDir, 'node', 'relay.js'), 'x')
 
     await uploadDirectoryViaSystemSsh(target, localDir, remoteRoot, { hostPlatform })
 
-    // Nothing touches the real name until every byte is on the host.
-    expect(fileWrites().map(writtenPath)).toEqual([
-      `${remotePath}${WINDOWS_STAGED_WRITE_SUFFIX}`,
-      `${remotePath}${WINDOWS_STAGED_WRITE_SUFFIX}`
-    ])
-    const publish = commands.at(-1)!
-    expect(publish.script).toContain('[System.IO.File]::Move($staging, $path)')
-    expect(publish.script).toContain('[System.IO.File]::Delete($path)')
+    // Anchor on a non-empty observation: `some` is false of an empty list, so this would pass even
+    // if no command had been recorded at all.
+    expect(commands.length).toBeGreaterThan(0)
+    expect(commands.some((command) => command.script.includes('StreamReader([Console]::'))).toBe(
+      false
+    )
+    expect(sftpBatches[0]!.script).toContain('-mkdir "/C:/Users/dev/.orca-remote"')
+  })
+
+  it('sweeps the staged bytes when the publish is the thing that fails', async () => {
+    writeFileSync(join(localDir, 'import.bin'), 'x')
+    // An exclusive conflict is the ordinary way to get here: the payload is on the host, and the
+    // rename that would have given it a name refuses.
+    spawnSystemSshCommandMock.mockImplementation((_target: SshTarget, command: string) => {
+      const script = decodePowerShellCommand(command)
+      return createFakeChannel((channel) => {
+        commands.push({ script, executable: command.split(' ')[0] ?? '', stdin: channel.written })
+        const failed = script.includes('::Move($staging, $path)')
+        setImmediate(() => channel.emit('close', failed ? 1 : 0, null))
+      })
+    })
+
+    await expect(
+      uploadFileViaSystemSsh(target, join(localDir, 'import.bin'), `${remoteRoot}/import.bin`, {
+        hostPlatform,
+        exclusive: true
+      })
+    ).rejects.toThrow()
+
+    const sweep = commands.at(-1)!
+    expect(sweep.script).toContain('[System.IO.File]::Delete($staging)')
+    // Tolerated, not asserted: the previous writer may still hold the file, and losing contact is
+    // not evidence it died.
+    expect(sweep.script).toContain('$ErrorActionPreference = "SilentlyContinue"')
+  })
+
+  it('reports a cancelled transfer as an abort, not as a failed one', async () => {
+    writeFileSync(join(localDir, 'relay.js'), 'x')
+    const controller = new AbortController()
+    // runProcess reports the kill as a non-zero exit rather than throwing, so without checking the
+    // signal first a user pressing cancel is indistinguishable from the transfer genuinely failing.
+    runProcessMock.mockImplementation(async (spec: { args: string[]; input: string }) => {
+      sftpBatches.push({ args: spec.args, script: spec.input })
+      controller.abort()
+      return { code: 255, signal: 'SIGTERM', stdout: '', stderr: '', timedOut: false }
+    })
+
+    let error: Error | undefined
+    try {
+      await uploadFileViaSystemSsh(target, join(localDir, 'relay.js'), `${remoteRoot}/relay.js`, {
+        hostPlatform,
+        signal: controller.signal
+      })
+    } catch (thrown) {
+      error = thrown as Error
+    }
+
+    expect(error?.name).toBe('AbortError')
+    expect(error?.message).not.toContain('sftp batch failed')
+    // A cancel is also not evidence about the host, so it must not send later writes to the slow
+    // path, and must not fall through to the defective reader now.
+    expect(getWindowsRemoteWriteCapabilities(target).shouldTry('sftp-subsystem')).toBe(true)
+    expect(fileWrites()).toHaveLength(0)
+  })
+
+  it('does not let one unaddressable path become a verdict about the host', async () => {
+    writeFileSync(join(localDir, 'relay.js'), 'x')
+
+    // A UNC destination has no settled mapping in sftp's drive-rooted namespace, so this write
+    // falls back — but the host still serves sftp perfectly well for every other path.
+    await uploadFileViaSystemSsh(
+      target,
+      join(localDir, 'relay.js'),
+      '//fileserver/share/relay.js',
+      { hostPlatform }
+    )
+
+    expect(fileWrites().length).toBeGreaterThan(0)
+    expect(sftpBatches).toHaveLength(0)
+    // The 30-minute capability cache is keyed by host; caching this would send every later write
+    // to the same machine down the defective path on the strength of one odd destination.
+    expect(getWindowsRemoteWriteCapabilities(target).shouldTry('sftp-subsystem')).toBe(true)
+  })
+
+  it('keeps using sftp for the next file after one path it could not spell', async () => {
+    writeFileSync(join(localDir, 'relay.js'), 'x')
+
+    await uploadFileViaSystemSsh(target, join(localDir, 'relay.js'), '//fileserver/share/a.js', {
+      hostPlatform
+    })
+    await uploadFileViaSystemSsh(target, join(localDir, 'relay.js'), `${remoteRoot}/b.js`, {
+      hostPlatform
+    })
+
+    expect(putLines()).toHaveLength(1)
+    expect(putDestination(putLines()[0]!)).toContain('/C:/Users/dev/.orca-remote/b.js')
+  })
+
+  it('does not let a local filename sftp cannot quote become a verdict either', async () => {
+    // POSIX clients allow a newline in a filename, and sftp's batch lexer would read it as the end
+    // of one command and the start of another.
+    const awkward = join(localDir, 'two\nlines.js')
+    writeFileSync(awkward, 'x')
+
+    await uploadFileViaSystemSsh(target, awkward, `${remoteRoot}/relay.js`, { hostPlatform })
+
+    expect(fileWrites().length).toBeGreaterThan(0)
+    expect(getWindowsRemoteWriteCapabilities(target).shouldTry('sftp-subsystem')).toBe(true)
+  })
+
+  it('translates the ssh argument list rather than passing it to a client that reads it differently', async () => {
+    writeFileSync(join(localDir, 'relay.js'), 'x')
+
+    await uploadFileViaSystemSsh(target, join(localDir, 'relay.js'), `${remoteRoot}/relay.js`, {
+      hostPlatform,
+      disableControlMaster: true
+    })
+
+    const args = sftpBatches[0]!.args
+    // sftp's `-T` does not exist, its `-p` preserves mtime, and its `-S` names a program to run.
+    expect(args).not.toContain('-T')
+    expect(args).not.toContain('-p')
+    expect(args).not.toContain('-S')
+    expect(args).toContain('ControlPath=none')
+    expect(args).toContain('ServerAliveInterval=15')
+  })
+})
+
+describe('Windows upload on a host with no sftp subsystem', () => {
+  beforeEach(() => {
+    refuseSftp()
+  })
+
+  it('creates a multi-directory tree, which the one-element case never exercised', async () => {
+    mkdirSync(join(localDir, 'node', 'deep'), { recursive: true })
+    writeFileSync(join(localDir, 'index.js'), 'a')
+    writeFileSync(join(localDir, 'node', 'deep', 'x.js'), 'b')
+
+    await uploadDirectoryViaSystemSsh(target, localDir, remoteRoot, { hostPlatform })
+
+    const mkdir = commands.find((command) => command.script.includes('ConvertFrom-Json'))!
+    // `@($json | ConvertFrom-Json)` wraps the parsed array in another array, so the loop variable
+    // binds to the whole thing and `[string]` of it is the paths joined by spaces — which
+    // CreateDirectory rejects. It only ever worked for a single directory, where stringifying a
+    // one-element array happens to yield the element, so no batch of one can catch this.
+    expect(mkdir.script).toContain('[string[]]($json | ConvertFrom-Json)')
+    expect(mkdir.script).not.toContain('@($json | ConvertFrom-Json)')
+    const batch = JSON.parse(mkdir.stdin.toString('utf-8')) as string[]
+    expect(batch.length).toBeGreaterThan(1)
+  })
+
+  it('falls back rather than failing the transfer', async () => {
+    const contents = Buffer.alloc(WINDOWS_STDIN_WRITE_CHUNK_BYTES + 5, 0x61)
+    writeFileSync(join(localDir, 'relay.js'), contents)
+
+    await uploadFileViaSystemSsh(target, join(localDir, 'relay.js'), `${remoteRoot}/relay.js`, {
+      hostPlatform
+    })
+
+    expect(Buffer.concat(fileWrites().map((write) => write.stdin)).equals(contents)).toBe(true)
+  })
+
+  it('remembers the refusal, so a multi-file upload probes once', async () => {
+    writeFileSync(join(localDir, 'a.js'), 'a')
+    writeFileSync(join(localDir, 'b.js'), 'b')
+    writeFileSync(join(localDir, 'c.js'), 'c')
+
+    await uploadDirectoryViaSystemSsh(target, localDir, remoteRoot, { hostPlatform })
+
+    // One refusal is enough; re-probing per file is a wasted round trip on every file.
+    expect(sftpBatches).toHaveLength(1)
+  })
+
+  it('does not spend a sweep round trip when sftp declined before moving any bytes', async () => {
+    writeFileSync(join(localDir, 'relay.js'), 'x')
+
+    await uploadFileViaSystemSsh(target, join(localDir, 'relay.js'), `${remoteRoot}/relay.js`, {
+      hostPlatform
+    })
+
+    // A refused subsystem staged nothing, so there is nothing to delete — and on a host without
+    // sftp that sweep would otherwise be paid on every single write.
+    expect(commands.length).toBeGreaterThan(0)
+    expect(commands.some((command) => command.script.includes('Delete($staging)'))).toBe(false)
+  })
+
+  it('prefers PowerShell 7, which reads a redirected stdin correctly', async () => {
+    writeFileSync(join(localDir, 'relay.js'), Buffer.alloc(WINDOWS_STDIN_WRITE_CHUNK_BYTES * 3))
+
+    await uploadFileViaSystemSsh(target, join(localDir, 'relay.js'), `${remoteRoot}/relay.js`, {
+      hostPlatform
+    })
+
+    expect(fileWrites().map((write) => write.executable)).toEqual(['pwsh.exe'])
+    // PowerShell 7 took 2MB through one exec when measured, so chunking it buys nothing.
+    expect(fileWrites()[0]!.stdin).toHaveLength(WINDOWS_STDIN_WRITE_CHUNK_BYTES * 3)
+  })
+
+  it('bounds every write when only Windows PowerShell 5.1 is available', async () => {
+    refusePwsh()
+    const contents = Buffer.alloc(WINDOWS_STDIN_WRITE_CHUNK_BYTES * 3 + 11, 0x64)
+    writeFileSync(join(localDir, 'big.node'), contents)
+
+    await uploadFileViaSystemSsh(target, join(localDir, 'big.node'), `${remoteRoot}/big.node`, {
+      hostPlatform
+    })
+
+    const writes = fileWrites().filter((write) => write.executable === 'powershell.exe')
+    expect(writes).toHaveLength(4)
+    expect(Math.max(...writes.map((write) => write.stdin.length))).toBe(
+      WINDOWS_STDIN_WRITE_CHUNK_BYTES
+    )
+    expect(Buffer.concat(writes.map((write) => write.stdin)).equals(contents)).toBe(true)
+    expect(writes.map(fileMode)).toEqual(['Create', 'Append', 'Append', 'Append'])
+    // A wedged PowerShell never closes on its own, so no wait on this path may be unbounded.
+    // Count first: `every` is true of zero calls, so a wait that moved to a different helper would
+    // pass this silently.
+    expect(waitForChannelCloseSpy.mock.calls.length).toBeGreaterThan(0)
+    expect(
+      waitForChannelCloseSpy.mock.calls.every((call) => call[2] === WINDOWS_STDIN_WRITE_TIMEOUT_MS)
+    ).toBe(true)
+  })
+
+  it('remembers that PowerShell 7 is absent instead of re-probing per chunk', async () => {
+    refusePwsh()
+    writeFileSync(join(localDir, 'big.node'), Buffer.alloc(WINDOWS_STDIN_WRITE_CHUNK_BYTES * 3))
+
+    await uploadFileViaSystemSsh(target, join(localDir, 'big.node'), `${remoteRoot}/big.node`, {
+      hostPlatform
+    })
+
+    expect(fileWrites().filter((write) => write.executable === 'pwsh.exe')).toHaveLength(1)
   })
 
   it('leaves no truncated file under the real name when a chunk fails mid-file', async () => {
     writeFileSync(join(localDir, 'relay.js'), Buffer.alloc(WINDOWS_STDIN_WRITE_CHUNK_BYTES * 3))
-    // Spawns: 0 = mkdir batch, 1..3 = chunk writes. Fail the second chunk.
-    failAtSpawn = 2
+    // Spawn 0 is the pwsh write; fail it and every retry beneath it.
+    failAtSpawn = 0
 
     await expect(
-      uploadDirectoryViaSystemSsh(target, localDir, remoteRoot, { hostPlatform })
+      uploadFileViaSystemSsh(target, join(localDir, 'relay.js'), `${remoteRoot}/relay.js`, {
+        hostPlatform
+      })
     ).rejects.toThrow()
 
+    expect(fileWrites().length).toBeGreaterThan(0)
     expect(fileWrites().map(writtenPath)).not.toContain(`${remoteRoot}/relay.js`)
     expect(commands.some((command) => command.script.includes('::Move('))).toBe(false)
   })
+})
 
-  it('enforces exclusive once at the rename, so a retry is not blocked by its own leftovers', async () => {
-    const localPath = join(localDir, 'import.bin')
-    writeFileSync(localPath, Buffer.alloc(WINDOWS_STDIN_WRITE_CHUNK_BYTES + 1))
+describe('last-resort Windows PowerShell failure reporting', () => {
+  it('names the host limitation and its remedy, not just the timeout', () => {
+    const timeout = new Error('write C:/x at offset 0 timed out after 60000ms with no response')
 
-    await uploadFileViaSystemSsh(target, localPath, `${remoteRoot}/import.bin`, {
-      hostPlatform,
-      exclusive: true
-    })
+    const explained = explainWindowsPowerShellStdinFailure(timeout) as Error
 
-    // CreateNew on chunk one would fail against a leftover staging file from a failed attempt;
-    // `File::Move` raising on an existing destination is what carries the exclusive contract.
-    expect(fileWrites().map(fileMode)).toEqual(['Create', 'Append'])
-    const publish = commands.at(-1)!
-    expect(publish.script).toContain('[System.IO.File]::Move($staging, $path)')
-    expect(publish.script).not.toContain('[System.IO.File]::Delete($path)')
+    // "timed out" alone sends the user to retry a network they cannot fix; the fix is host-side.
+    expect(explained.message).toContain('Windows PowerShell 5.1')
+    expect(explained.message).toContain('Subsystem sftp sftp-server.exe')
+    expect(explained.cause).toBe(timeout)
   })
 
-  it('keeps a single-chunk write on the destination, with the caller mode intact', async () => {
-    await writeBufferViaSystemSsh(target, `${remoteRoot}/version`, Buffer.from('1.2.3'), {
-      hostPlatform,
-      exclusive: true
-    })
+  it('leaves a real failure alone, so a permission error is not reported as a host limitation', () => {
+    const denied = new Error('write C:/x at offset 0 failed (exit 1): Access to the path is denied')
 
-    expect(fileWrites()).toHaveLength(1)
-    expect(writtenPath(fileWrites()[0])).toBe(`${remoteRoot}/version`)
-    expect(fileMode(fileWrites()[0])).toBe('CreateNew')
-    expect(commands.some((command) => command.script.includes('::Move('))).toBe(false)
-  })
-
-  it('appends onto the destination rather than staging, since append cannot be staged', async () => {
-    const remotePath = `${remoteRoot}/log.bin`
-    await writeBufferViaSystemSsh(
-      target,
-      remotePath,
-      Buffer.alloc(WINDOWS_STDIN_WRITE_CHUNK_BYTES + 1),
-      { hostPlatform, append: true }
-    )
-
-    expect(fileWrites().map(writtenPath)).toEqual([remotePath, remotePath])
-    expect(fileWrites().map(fileMode)).toEqual(['Append', 'Append'])
+    expect(explainWindowsPowerShellStdinFailure(denied)).toBe(denied)
   })
 })
 
diff --git a/src/main/ssh/system-ssh-windows-write-capabilities.test.ts b/src/main/ssh/system-ssh-windows-write-capabilities.test.ts
new file mode 100644
index 00000000000..ad723d592b0
--- /dev/null
+++ b/src/main/ssh/system-ssh-windows-write-capabilities.test.ts
@@ -0,0 +1,79 @@
+/**
+ * Whether a Windows host has an sftp subsystem is a fact about that host, so the cache is keyed by
+ * the endpoint that executes rather than by Orca's target id — otherwise a hardened host is
+ * re-probed once per file, and two targets pointing at one machine learn the same fact twice.
+ */
+import { afterEach, describe, expect, it } from 'vitest'
+import type { SshTarget } from '../../shared/ssh-types'
+import {
+  clearWindowsRemoteWriteCapabilitiesForTests,
+  getWindowsRemoteWriteCapabilities,
+  getWindowsRemoteWriteExecutionHostKey
+} from './system-ssh-windows-write-capabilities'
+
+const asTarget = (fields: Partial<SshTarget>): SshTarget => fields as SshTarget
+
+afterEach(() => {
+  clearWindowsRemoteWriteCapabilitiesForTests()
+})
+
+describe('getWindowsRemoteWriteExecutionHostKey', () => {
+  it('gives two targets on one endpoint the same key', () => {
+    const first = asTarget({ id: 'a', host: 'win.example', username: 'dev', port: 22 })
+    const second = asTarget({ id: 'b', host: 'win.example', username: 'dev', port: 22 })
+
+    // A target re-created under a new id has not changed what the host supports.
+    expect(getWindowsRemoteWriteExecutionHostKey(first)).toBe(
+      getWindowsRemoteWriteExecutionHostKey(second)
+    )
+  })
+
+  it('separates hosts, ports and users', () => {
+    const base = { id: 'a', host: 'win.example', username: 'dev', port: 22 }
+    const keys = [
+      asTarget(base),
+      asTarget({ ...base, host: 'other.example' }),
+      asTarget({ ...base, port: 2222 }),
+      asTarget({ ...base, username: 'ops' })
+    ].map(getWindowsRemoteWriteExecutionHostKey)
+
+    expect(new Set(keys).size).toBe(4)
+  })
+
+  it('keys a config alias by the alias, since ssh_config decides where it lands', () => {
+    const alias = asTarget({ id: 'a', host: 'stale.example', configHost: 'winbox' })
+
+    expect(getWindowsRemoteWriteExecutionHostKey(alias)).toBe('config:winbox')
+  })
+})
+
+describe('getWindowsRemoteWriteCapabilities', () => {
+  it('shares one cache across targets that reach the same host', () => {
+    const first = asTarget({ id: 'a', host: 'win.example', username: 'dev', port: 22 })
+    const second = asTarget({ id: 'b', host: 'win.example', username: 'dev', port: 22 })
+
+    getWindowsRemoteWriteCapabilities(first).rememberUnsupported('sftp-subsystem')
+
+    expect(getWindowsRemoteWriteCapabilities(second).shouldTry('sftp-subsystem')).toBe(false)
+  })
+
+  it('does not let one host answer for another', () => {
+    const hardened = asTarget({ id: 'a', host: 'hardened.example', username: 'dev', port: 22 })
+    const ordinary = asTarget({ id: 'b', host: 'ordinary.example', username: 'dev', port: 22 })
+
+    getWindowsRemoteWriteCapabilities(hardened).rememberUnsupported('sftp-subsystem')
+
+    expect(getWindowsRemoteWriteCapabilities(ordinary).shouldTry('sftp-subsystem')).toBe(true)
+  })
+
+  it('keeps the two capabilities independent', () => {
+    const target = asTarget({ id: 'a', host: 'win.example', username: 'dev', port: 22 })
+    const capabilities = getWindowsRemoteWriteCapabilities(target)
+
+    capabilities.rememberUnsupported('pwsh')
+
+    // No PowerShell 7 says nothing about whether the host will serve sftp.
+    expect(capabilities.shouldTry('sftp-subsystem')).toBe(true)
+    expect(capabilities.shouldTry('pwsh')).toBe(false)
+  })
+})
diff --git a/src/main/ssh/system-ssh-windows-write-capabilities.ts b/src/main/ssh/system-ssh-windows-write-capabilities.ts
new file mode 100644
index 00000000000..dcd03f19807
--- /dev/null
+++ b/src/main/ssh/system-ssh-windows-write-capabilities.ts
@@ -0,0 +1,52 @@
+import type { SshTarget } from '../../shared/ssh-types'
+import { CapabilityProbeCache } from '../../shared/capability-probe-cache'
+
+/**
+ * Whether a Windows host can take a file write over the sftp subsystem, and whether it has a
+ * PowerShell 7 to fall back to. Both are host facts, so they are cached per execution host rather
+ * than per transfer — a hardened host with `Subsystem sftp` removed must not be re-probed on every
+ * file of a multi-file upload.
+ */
+export type WindowsRemoteWriteCapability = 'sftp-subsystem' | 'pwsh'
+
+// Why re-probe at all: an admin can enable the subsystem, or install PowerShell 7, without the
+// user restarting Orca. Long enough that a hardened host costs one failed probe per half hour.
+export const WINDOWS_WRITE_CAPABILITY_RETRY_INTERVAL_MS = 30 * 60_000
+
+const capabilitiesByExecutionHost = new Map<
+  string,
+  CapabilityProbeCache<WindowsRemoteWriteCapability>
+>()
+
+/**
+ * Keyed by the endpoint that executes, not by target id: two Orca targets pointing at one host
+ * describe the same sshd, and a target re-created under a new id has not changed what that host
+ * supports. A config alias is its own key because ssh_config, not Orca, resolves where it lands.
+ */
+export function getWindowsRemoteWriteExecutionHostKey(target: SshTarget): string {
+  if (target.configHost) {
+    return `config:${target.configHost}`
+  }
+  const port = target.port ?? 22
+  return target.username
+    ? `host:${target.username}@${target.host}:${port}`
+    : `host:${target.host}:${port}`
+}
+
+export function getWindowsRemoteWriteCapabilities(
+  target: SshTarget
+): CapabilityProbeCache<WindowsRemoteWriteCapability> {
+  const key = getWindowsRemoteWriteExecutionHostKey(target)
+  let cache = capabilitiesByExecutionHost.get(key)
+  if (!cache) {
+    cache = new CapabilityProbeCache<WindowsRemoteWriteCapability>(
+      WINDOWS_WRITE_CAPABILITY_RETRY_INTERVAL_MS
+    )
+    capabilitiesByExecutionHost.set(key, cache)
+  }
+  return cache
+}
+
+export function clearWindowsRemoteWriteCapabilitiesForTests(): void {
+  capabilitiesByExecutionHost.clear()
+}
diff --git a/src/main/ssh/system-ssh-windows-write-strategy.ts b/src/main/ssh/system-ssh-windows-write-strategy.ts
new file mode 100644
index 00000000000..f2cdca12516
--- /dev/null
+++ b/src/main/ssh/system-ssh-windows-write-strategy.ts
@@ -0,0 +1,329 @@
+import type { SshTarget } from '../../shared/ssh-types'
+import { getSystemSshBuildArgsFromOperationOptions } from './system-ssh-args'
+import { spawnSystemSshCommand } from './system-ssh-command'
+import {
+  awaitWithSystemSshAbort,
+  throwIfAborted,
+  waitForChannelClose
+} from './system-ssh-operation-lifecycle'
+import {
+  isSftpPathUnsupportedError,
+  isSftpRefusalBeforeStaging,
+  isSftpUnavailableError,
+  runSftpBatch
+} from './system-ssh-sftp-transfer'
+import { quoteSftpBatchArgument, toSftpRemotePath } from './system-ssh-sftp-path'
+import { getWindowsRemoteWriteCapabilities } from './system-ssh-windows-write-capabilities'
+import {
+  makeWindowsDiscardStagedFileCommand,
+  makeWindowsPublishStagedFileCommand,
+  makeWindowsStagingPath,
+  makeWindowsWriteFileCommand,
+  windowsRemoteAncestorDirectories,
+  type WindowsPublishMode
+} from './system-ssh-windows-file-write'
+
+/** No Windows stdin write should ever outlive this; a wedged PowerShell never closes on its own. */
+export const WINDOWS_STDIN_WRITE_TIMEOUT_MS = 60_000
+
+/**
+ * Bound on one stdin write for the last-resort Windows PowerShell 5.1 path.
+ *
+ * Measured on Windows 11 26200 / OpenSSH 10.0p2: a 32KB write still hangs 15 times in 120 under
+ * load, and no smaller value removes the risk. The defect is per blocking read, not per byte, so
+ * shrinking the chunk trades one risky read for more execs that each carry their own. This is a
+ * damage bound on a path known to be unreliable, not a safe size.
+ */
+export const WINDOWS_STDIN_WRITE_CHUNK_BYTES = 32 * 1024
+
+export type WindowsWriteOptions = Parameters<
+  typeof getSystemSshBuildArgsFromOperationOptions
+>[0] & {
+  signal?: AbortSignal
+  append?: boolean
+  exclusive?: boolean
+}
+
+/** Bytes to write, plus a way to present them to sftp, which can only send a local file. */
+export type WindowsWriteSource = {
+  totalBytes: number
+  readChunk: (offset: number, maxBytes: number) => Promise<Buffer>
+  withLocalFile: <T>(send: (localPath: string) => Promise<T>) => Promise<T>
+}
+
+function publishMode(options: WindowsWriteOptions): WindowsPublishMode {
+  return options.append ? 'append' : options.exclusive === true ? 'exclusive' : 'create'
+}
+
+/**
+ * Writes one file to a Windows host, preferring transports that do not push bytes through a remote
+ * PowerShell's stdin.
+ *
+ * Order, and why: sftp carries the whole payload in one transfer and never has a remote process
+ * read a pipe. Measured on Windows 11 / OpenSSH 10.0p2: 1.9MB in a median 315ms over sftp against
+ * 0 of 6 completions on the chunked path, whose best case was ~62 execs at ~350ms each. PowerShell
+ * 7 reads a redirected stdin correctly but is not installed by default. Windows PowerShell 5.1 is
+ * always present and is the defective reader, so it is last and it is bounded.
+ *
+ * Every transport stages under a unique name and publishes by rename, so no partial write is ever
+ * visible under the real name and no retry inherits a predecessor's lock.
+ */
+export async function writeWindowsRemoteFile(
+  target: SshTarget,
+  remotePath: string,
+  source: WindowsWriteSource,
+  options: WindowsWriteOptions
+): Promise<void> {
+  throwIfAborted(options.signal)
+  const capabilities = getWindowsRemoteWriteCapabilities(target)
+  await capabilities.runWithFallback(
+    'sftp-subsystem',
+    () => writeViaSftp(target, remotePath, source, options),
+    () => writeViaRemoteStdin(target, remotePath, source, options),
+    isSftpUnavailableError
+  )
+}
+
+/**
+ * Stages under a name nothing else can own, publishes it, and sweeps the staging file if either
+ * step fails.
+ *
+ * Shared by both transports so the cleanup contract cannot drift between them: a failed publish —
+ * an exclusive conflict is the ordinary case — leaves bytes on the host that no longer have a
+ * purpose, and the sweep is what stops them accumulating.
+ */
+async function stageThenPublish(
+  target: SshTarget,
+  remotePath: string,
+  options: WindowsWriteOptions,
+  stage: (stagingPath: string) => Promise<void>,
+  nothingStaged: (error: unknown) => boolean = () => false
+): Promise<void> {
+  const stagingPath = makeWindowsStagingPath(remotePath)
+  try {
+    await stage(stagingPath)
+    await publishStagedWrite(target, stagingPath, remotePath, options)
+  } catch (error) {
+    // A transport that declined before it moved any bytes has nothing to sweep, and sweeping
+    // anyway would spend a round trip on every write to a host that has no sftp subsystem.
+    if (!nothingStaged(error)) {
+      await discardStagedWrite(target, stagingPath, options)
+    }
+    throw error
+  }
+}
+
+/**
+ * A path sftp cannot address falls back for this write alone, without touching the host verdict.
+ *
+ * The distinction matters because the capability cache is keyed by host and holds for half an hour:
+ * routing one UNC destination, or one local filename containing a newline, into
+ * `rememberUnsupported` would send every later write to that host down the defective path too.
+ */
+async function writeViaSftp(
+  target: SshTarget,
+  remotePath: string,
+  source: WindowsWriteSource,
+  options: WindowsWriteOptions
+): Promise<void> {
+  try {
+    await attemptSftpWrite(target, remotePath, source, options)
+  } catch (error) {
+    if (!isSftpPathUnsupportedError(error)) {
+      throw error
+    }
+    await writeViaRemoteStdin(target, remotePath, source, options)
+  }
+}
+
+function attemptSftpWrite(
+  target: SshTarget,
+  remotePath: string,
+  source: WindowsWriteSource,
+  options: WindowsWriteOptions
+): Promise<void> {
+  const mkdirs = windowsRemoteAncestorDirectories(remotePath).map(
+    (directory) => `-mkdir ${quoteSftpBatchArgument(toSftpRemotePath(directory))}`
+  )
+  return stageThenPublish(
+    target,
+    remotePath,
+    options,
+    (stagingPath) =>
+      source.withLocalFile((localPath) =>
+        // One round trip: the parent chain and the payload travel in the same batch.
+        runSftpBatch(
+          target,
+          [
+            ...mkdirs,
+            `put ${quoteSftpBatchArgument(localPath)} ${quoteSftpBatchArgument(toSftpRemotePath(stagingPath))}`
+          ],
+          options
+        )
+      ),
+    isSftpRefusalBeforeStaging
+  )
+}
+
+function writeViaRemoteStdin(
+  target: SshTarget,
+  remotePath: string,
+  source: WindowsWriteSource,
+  options: WindowsWriteOptions
+): Promise<void> {
+  const capabilities = getWindowsRemoteWriteCapabilities(target)
+  return stageThenPublish(target, remotePath, options, (stagingPath) =>
+    capabilities.runWithFallback(
+      'pwsh',
+      () => writeStdinChunks(target, stagingPath, source, options, 'pwsh.exe'),
+      () => writeStdinChunks(target, stagingPath, source, options, 'powershell.exe'),
+      isPwshUnavailableError
+    )
+  )
+}
+
+/**
+ * PowerShell 7 takes the whole payload in one exec — measured at 2MB — so only the 5.1 path pays
+ * for chunking, and only because a bounded write is the most that path can be trusted with.
+ */
+async function writeStdinChunks(
+  target: SshTarget,
+  stagingPath: string,
+  source: WindowsWriteSource,
+  options: WindowsWriteOptions,
+  executable: 'powershell.exe' | 'pwsh.exe'
+): Promise<void> {
+  const chunkBytes =
+    executable === 'pwsh.exe' ? Math.max(source.totalBytes, 1) : WINDOWS_STDIN_WRITE_CHUNK_BYTES
+  let offset = 0
+  // An empty write still has to run: it is what creates the staged file.
+  do {
+    const chunk = await source.readChunk(offset, chunkBytes)
+    if (chunk.length === 0 && offset < source.totalBytes) {
+      throw new Error(`Source ran short during upload of ${stagingPath}`)
+    }
+    await writeOneStdinChunk(
+      target,
+      stagingPath,
+      chunk,
+      { ...options, append: offset > 0, exclusive: false },
+      offset,
+      executable
+    )
+    offset += chunk.length
+  } while (offset < source.totalBytes)
+}
+
+async function writeOneStdinChunk(
+  target: SshTarget,
+  stagingPath: string,
+  chunk: Buffer,
+  options: WindowsWriteOptions,
+  offset: number,
+  executable: 'powershell.exe' | 'pwsh.exe'
+): Promise<void> {
+  throwIfAborted(options.signal)
+  const channel = spawnSystemSshCommand(
+    target,
+    makeWindowsWriteFileCommand(stagingPath, {
+      append: options.append,
+      exclusive: options.exclusive,
+      executable
+    }),
+    { wrapCommand: false, ...getSystemSshBuildArgsFromOperationOptions(options) }
+  )
+  const closePromise = awaitWithSystemSshAbort(
+    options.signal,
+    () => channel.close(),
+    waitForChannelClose(
+      channel,
+      `write ${stagingPath} at offset ${offset}`,
+      WINDOWS_STDIN_WRITE_TIMEOUT_MS
+    )
+  ).catch((error: unknown) => {
+    throw executable === 'powershell.exe' ? explainWindowsPowerShellStdinFailure(error) : error
+  })
+  if (!options.signal?.aborted) {
+    channel.stdin.end(chunk)
+  }
+  await closePromise
+}
+
+/**
+ * Names the cause on the one path that can hang, so the failure is not just "timed out".
+ *
+ * A user seeing this needs to know it is a host limitation with a host-side remedy, not a network
+ * fault they should retry into.
+ */
+export function explainWindowsPowerShellStdinFailure(error: unknown): unknown {
+  const message = error instanceof Error ? error.message : String(error)
+  if (!/timed out/i.test(message)) {
+    return error
+  }
+  return new Error(
+    `${message}\nWindows PowerShell 5.1 can lose a redirected stdin permanently when a read finds it momentarily empty, so this write cannot be made reliable from the client. Enable the sftp subsystem on the host (sshd_config: "Subsystem sftp sftp-server.exe"), or install PowerShell 7, and Orca will use it automatically.`,
+    { cause: error instanceof Error ? error : undefined }
+  )
+}
+
+function isPwshUnavailableError(error: unknown): boolean {
+  const message = error instanceof Error ? error.message : String(error)
+  // cmd.exe's "not recognized" and sshd's exit 9009 both mean "no pwsh here". A timeout does not:
+  // that is the stdin defect, and PowerShell 7 does not have it, so it must not be cached as absent.
+  return /is not recognized as an internal or external command|9009|CommandNotFoundException/i.test(
+    message
+  )
+}
+
+async function publishStagedWrite(
+  target: SshTarget,
+  stagingPath: string,
+  remotePath: string,
+  options: WindowsWriteOptions
+): Promise<void> {
+  await runWindowsCommandWithoutStdin(
+    target,
+    makeWindowsPublishStagedFileCommand(stagingPath, remotePath, publishMode(options)),
+    `publish ${remotePath}`,
+    options
+  )
+}
+
+async function discardStagedWrite(
+  target: SshTarget,
+  stagingPath: string,
+  options: WindowsWriteOptions
+): Promise<void> {
+  try {
+    await runWindowsCommandWithoutStdin(
+      target,
+      makeWindowsDiscardStagedFileCommand(stagingPath),
+      `discard ${stagingPath}`,
+      { ...options, signal: undefined }
+    )
+  } catch {
+    // Housekeeping only. The staging name is unique, so a leftover blocks nothing, and a failure
+    // here says nothing about whether the abandoned writer is still alive.
+  }
+}
+
+function runWindowsCommandWithoutStdin(
+  target: SshTarget,
+  command: string,
+  label: string,
+  options: WindowsWriteOptions
+): Promise<void> {
+  const channel = spawnSystemSshCommand(target, command, {
+    wrapCommand: false,
+    ...getSystemSshBuildArgsFromOperationOptions(options)
+  })
+  const closePromise = awaitWithSystemSshAbort(
+    options.signal,
+    () => channel.close(),
+    waitForChannelClose(channel, label, WINDOWS_STDIN_WRITE_TIMEOUT_MS)
+  )
+  if (!options.signal?.aborted) {
+    channel.stdin.end()
+  }
+  return closePromise
+}
diff --git a/src/main/startup/configure-process.test.ts b/src/main/startup/configure-process.test.ts
index ef7ec6a9b69..7d7e2b0cc1a 100644
--- a/src/main/startup/configure-process.test.ts
+++ b/src/main/startup/configure-process.test.ts
@@ -1,4 +1,4 @@
-import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
 import { homedir, tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, describe, expect, it, vi } from 'vitest'
@@ -137,6 +137,29 @@ describe('patchPackagedProcessPath', () => {
     expect(segments).toContain('/usr/local/bin')
   })
 
+  // Why derived, not a second literal: system-cli-install-dirs.ts documents its
+  // order as matching this seed's system block, and hardcoding the order in the
+  // fallback's own test lets a reorder here break that parity while both stay green.
+  it('seeds the system block in the order the install-dir fallback expects', async () => {
+    const { app } = await import('electron')
+    const { patchPackagedProcessPath } = await import('./configure-process')
+    const { getSystemCliInstallDirectories } = await import('../../shared/system-cli-install-dirs')
+
+    setPlatform('linux')
+    Object.defineProperty(app, 'isPackaged', { configurable: true, value: true })
+    process.env.HOME = '/home/tester'
+    process.env.PATH = '/usr/bin:/bin'
+
+    patchPackagedProcessPath()
+
+    const segments = (process.env.PATH ?? '').split(':')
+    const offsets = getSystemCliInstallDirectories('linux', '/home/tester').map((directory) =>
+      segments.indexOf(directory)
+    )
+    expect(offsets.every((offset) => offset >= 0)).toBe(true)
+    expect([...offsets].sort((a, b) => a - b)).toEqual(offsets)
+  })
+
   // Why this ordering is load-bearing (#18234): a seed exists so a GUI-launched
   // Electron can *find* a tool, not to re-rank tools the user already has.
   // `~/.local/bin` is user-writable and can hold a wrapper for any system tool.
@@ -444,6 +467,43 @@ describe('configureElectronNetworkCompatibility', () => {
     ).toBe(false)
   })
 
+  it('answers from the marker without reading the settings file', async () => {
+    const { shouldDisableHttp2ForElectronNetworking } = await import('./configure-process')
+    const { writeHttp1CompatibilityMarker } = await import('./http1-compatibility-marker')
+    const userDataPath = createUserDataDir({ electronHttp1CompatibilityMode: false })
+    writeHttp1CompatibilityMarker(userDataPath, true)
+    rmSync(join(userDataPath, 'orca-data.json'), { force: true })
+
+    expect(shouldDisableHttp2ForElectronNetworking({ env: {}, userDataPath })).toBe(true)
+  })
+
+  it('falls back to the settings file when no marker has been written yet', async () => {
+    const { shouldDisableHttp2ForElectronNetworking } = await import('./configure-process')
+    const userDataPath = createUserDataDir({ electronHttp1CompatibilityMode: true })
+
+    expect(existsSync(join(userDataPath, 'http1-compatibility.json'))).toBe(false)
+    expect(shouldDisableHttp2ForElectronNetworking({ env: {}, userDataPath })).toBe(true)
+  })
+
+  it('falls back to the settings file when the marker is corrupt', async () => {
+    const { shouldDisableHttp2ForElectronNetworking } = await import('./configure-process')
+    const userDataPath = createUserDataDir({ electronHttp1CompatibilityMode: true })
+    writeFileSync(join(userDataPath, 'http1-compatibility.json'), '{ not json', 'utf-8')
+
+    expect(shouldDisableHttp2ForElectronNetworking({ env: {}, userDataPath })).toBe(true)
+  })
+
+  it('lets the environment override the marker', async () => {
+    const { shouldDisableHttp2ForElectronNetworking } = await import('./configure-process')
+    const { writeHttp1CompatibilityMarker } = await import('./http1-compatibility-marker')
+    const userDataPath = createUserDataDir({})
+    writeHttp1CompatibilityMarker(userDataPath, true)
+
+    expect(
+      shouldDisableHttp2ForElectronNetworking({ env: { ORCA_DISABLE_HTTP2: '0' }, userDataPath })
+    ).toBe(false)
+  })
+
   it('appends Electron disable-http2 before sessions are created', async () => {
     const { app } = await import('electron')
     const { configureElectronNetworkCompatibility } = await import('./configure-process')
diff --git a/src/main/startup/configure-process.ts b/src/main/startup/configure-process.ts
index 6b167d7fe14..13dbd70c2c3 100644
--- a/src/main/startup/configure-process.ts
+++ b/src/main/startup/configure-process.ts
@@ -5,6 +5,7 @@ import { join, resolve } from 'node:path'
 import { getVersionManagerBinPaths } from '../codex-cli/command'
 import { getMainE2EConfig } from '../e2e-config'
 import { DISABLED_CHROMIUM_FEATURES } from './disabled-chromium-features'
+import { readHttp1CompatibilityMarker } from './http1-compatibility-marker'
 
 const DEV_PARENT_SHUTDOWN_GRACE_MS = 3000
 const HTTP1_COMPATIBILITY_ENV_VAR = 'ORCA_DISABLE_HTTP2'
@@ -54,7 +55,13 @@ export function shouldDisableHttp2ForElectronNetworking(
   if (envValue !== null) {
     return envValue
   }
-  return readPersistedHttp1CompatibilityMode(options.userDataPath ?? app.getPath('userData'))
+  const userDataPath = options.userDataPath ?? app.getPath('userData')
+  // Why the marker first: this runs before app.whenReady(), and the settings file is the multi-MB
+  // orca-data.json the Store parses again moments later. The marker is refreshed whenever settings
+  // change, so the full read only happens on a profile that has never written one.
+  return (
+    readHttp1CompatibilityMarker(userDataPath) ?? readPersistedHttp1CompatibilityMode(userDataPath)
+  )
 }
 
 export function configureElectronNetworkCompatibility(
diff --git a/src/main/startup/http1-compatibility-marker.ts b/src/main/startup/http1-compatibility-marker.ts
new file mode 100644
index 00000000000..9e85a83be66
--- /dev/null
+++ b/src/main/startup/http1-compatibility-marker.ts
@@ -0,0 +1,51 @@
+import { readFileSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+
+/**
+ * Cached copy of `settings.electronHttp1CompatibilityMode` for pre-`ready` startup.
+ *
+ * Why a standalone file (not the Store): app.commandLine.appendSwitch('disable-http2') must run
+ * before the first Electron session exists, which is before the settings Store is constructed.
+ * Reading it from the settings file meant a synchronous read + JSON.parse of the whole multi-MB
+ * orca-data.json on the critical path of every cold start, duplicating the parse the Store does a
+ * moment later. This marker is a few bytes, mirroring gpu-fallback-marker.ts.
+ */
+
+export const HTTP1_COMPATIBILITY_MARKER_FILE = 'http1-compatibility.json'
+const MARKER_SCHEME_VERSION = 1
+
+type Http1CompatibilityMarker = {
+  schemeVersion: number
+  enabled: boolean
+}
+
+function markerPath(userDataPath: string): string {
+  return join(userDataPath, HTTP1_COMPATIBILITY_MARKER_FILE)
+}
+
+/** Returns null when the marker is missing or unreadable, so callers fall back to the settings file. */
+export function readHttp1CompatibilityMarker(userDataPath: string): boolean | null {
+  try {
+    const parsed = JSON.parse(
+      readFileSync(markerPath(userDataPath), 'utf-8')
+    ) as Partial<Http1CompatibilityMarker>
+    if (parsed.schemeVersion !== MARKER_SCHEME_VERSION || typeof parsed.enabled !== 'boolean') {
+      return null
+    }
+    return parsed.enabled
+  } catch {
+    return null
+  }
+}
+
+export function writeHttp1CompatibilityMarker(userDataPath: string, enabled: boolean): void {
+  if (readHttp1CompatibilityMarker(userDataPath) === enabled) {
+    return
+  }
+  const marker: Http1CompatibilityMarker = { schemeVersion: MARKER_SCHEME_VERSION, enabled }
+  try {
+    writeFileSync(markerPath(userDataPath), JSON.stringify(marker))
+  } catch {
+    // Best effort: a missing marker just costs the next launch the settings-file fallback.
+  }
+}
diff --git a/src/main/startup/main-process-preflight.ts b/src/main/startup/main-process-preflight.ts
index 269eb2212e7..177a2357441 100644
--- a/src/main/startup/main-process-preflight.ts
+++ b/src/main/startup/main-process-preflight.ts
@@ -48,7 +48,7 @@ import {
 } from './single-instance-lock'
 import { setAppEnvironment } from '../../shared/app-environment'
 import { ElectronAppEnvironment } from '../host/electron-app-environment'
-import { installProcessTreeKillBreadcrumbObserver } from '../crash-reporting/self-initiated-tree-kill-log'
+import { installMainProcessTreeKillGate } from '../own-chromium-tree-kill-guard'
 import { setSecretStore } from '../../shared/secret-store'
 import { ElectronSecretStore } from '../host/electron-secret-store'
 import { setPtyHostBindings } from '../ipc/pty-host-bindings'
@@ -163,8 +163,8 @@ export function runMainProcessPreflight(options: MainProcessPreflightOptions): b
     })
   }
   // Why before any spawn: `signalProcessTree` is shared with the CLI and relay, so
-  // it can only reach the main-process breadcrumb store through a registered observer.
-  installProcessTreeKillBreadcrumbObserver()
+  // it can only reach the main-process guard and breadcrumb store once this is registered.
+  installMainProcessTreeKillGate()
   const isDev = is.dev
   configureDevUserDataPath(isDev)
   configureOrcaUserDataPathEnv()
diff --git a/src/main/startup/main-process-ready-foundation.ts b/src/main/startup/main-process-ready-foundation.ts
index 171aaf50421..3c0e01fe09e 100644
--- a/src/main/startup/main-process-ready-foundation.ts
+++ b/src/main/startup/main-process-ready-foundation.ts
@@ -41,6 +41,7 @@ import { registerDocPreviewGrantHandlers } from '../ipc/doc-preview-grant-ipc'
 import { initializeBrowserSessionsForApp } from '../browser/browser-session-startup'
 import { browserSessionRegistry } from '../browser/browser-session-registry'
 import { logStartupMilestone } from './startup-diagnostics'
+import { writeHttp1CompatibilityMarker } from './http1-compatibility-marker'
 import { mainProcessState as state } from './main-process-state'
 import { recordDurableCrashBreadcrumb } from '../crash-reporting/durable-crash-breadcrumb'
 import { syncMacMenuBarIcon } from './main-window-actions'
@@ -193,9 +194,20 @@ export async function initializeReadyFoundation(): Promise<void> {
   }
   wslHookRelayManager.setManagedHookSettingsResolver(() => state.store?.getSettings() ?? null)
   logStartupMilestone('store-loaded')
+  // Why: pre-`ready` startup reads this flag from a marker so it never has to parse orca-data.json.
+  writeHttp1CompatibilityMarker(
+    canonicalUserDataPath,
+    store.getSettings().electronHttp1CompatibilityMode === true
+  )
   // Why: apply initial fallback WSL distro from store settings for global git/CLI calls.
   setDefaultWslDistroOverride(store.getSettings().terminalWindowsWslDistro ?? null)
   store.onSettingsChanged((updates, settings) => {
+    if ('electronHttp1CompatibilityMode' in updates) {
+      writeHttp1CompatibilityMarker(
+        canonicalUserDataPath,
+        settings.electronHttp1CompatibilityMode === true
+      )
+    }
     if ('terminalWindowsWslDistro' in updates) {
       // Why: synchronize fallback WSL distro updates to runner.
       setDefaultWslDistroOverride(settings.terminalWindowsWslDistro ?? null)
diff --git a/src/main/startup/main-process-ready-runtime.ts b/src/main/startup/main-process-ready-runtime.ts
index 75784a4c196..26b920652df 100644
--- a/src/main/startup/main-process-ready-runtime.ts
+++ b/src/main/startup/main-process-ready-runtime.ts
@@ -9,7 +9,7 @@ import { RpcDispatcher } from '../runtime/rpc/dispatcher'
 import { browserManager } from '../browser/browser-manager'
 import { configureBrowserClientPageAutomationRuntime } from '../browser/browser-client-page-automation-runtime'
 import { BrowserClientPageCommandError } from '../browser/browser-client-page-command-failure'
-import { startPreGoneProcessMetricsSampling } from '../crash-reporting/process-gone-diagnostics'
+import { startPreGoneCrashSampling } from '../crash-reporting/process-gone-diagnostics'
 import { recordProcessGoneCrash } from './main-window-lifecycle-flags'
 import { handleGpuChildCrash } from './gpu-lifecycle'
 import { isGpuFallbackCrashCandidate } from '../crash-reporting/gpu-crash-fallback-decision'
@@ -130,9 +130,10 @@ export async function initializeReadyRuntimeServices(): Promise<void> {
         console.warn('[agent-hooks] failed to reconcile managed hooks on startup:', error)
       )
   }
-  // Why: process-gone metrics only see survivors; retain a recent whole-app
-  // snapshot for comparison in crash reports.
-  startPreGoneProcessMetricsSampling()
+  // Why: process-gone metrics only see survivors, and the gone-time host memory
+  // read lands after the corpse released its pages; both need a live pre-gone
+  // sample to compare against in crash reports.
+  startPreGoneCrashSampling()
   app.on('child-process-gone', (_event, details) => {
     recordProcessGoneCrash('child', details.type, details.reason, details.exitCode ?? null, {
       name: details.name,
diff --git a/src/main/startup/main-window-actions.ts b/src/main/startup/main-window-actions.ts
index 585fa0a754e..0acc8d1a074 100644
--- a/src/main/startup/main-window-actions.ts
+++ b/src/main/startup/main-window-actions.ts
@@ -16,7 +16,10 @@ import {
   describeInstallDirAclPoison,
   isBlockingInstallDirAclRepairInFlight
 } from './windows-install-dir-acl-recovery'
-import { presentRendererRecoveryPrompt } from '../window/renderer-recovery-prompt'
+import {
+  presentRendererRecoveryPrompt,
+  type RendererRecoveryPromptFailure
+} from '../window/renderer-recovery-prompt'
 
 // The window module injects this callback to avoid a cycle between actions and lifecycle code.
 let openWindow: (options?: { revealOnDidFinishLoad?: boolean }) => BrowserWindow
@@ -147,9 +150,14 @@ export function sendOpenCrashReport(targetWindow?: BrowserWindow | null): void {
 }
 
 // Why: on renderer crash-loop the breaker stops auto-reloading and the window goes blank, so a main-process dialog is the only retry/quit surface.
-export async function showRendererRecoveryPrompt(recentRecoveryCount: number): Promise<void> {
+export async function showRendererRecoveryPrompt(
+  recentRecoveryCount: number,
+  failure?: RendererRecoveryPromptFailure,
+  retry?: () => void
+): Promise<void> {
   await presentRendererRecoveryPrompt({
     recentRecoveryCount,
+    ...(failure ? { failure } : {}),
     isQuitting: () => state.isQuitting,
     diagnose: describeInstallDirAclPoison,
     showMessageBox: (options) => {
@@ -164,6 +172,12 @@ export async function showRendererRecoveryPrompt(recentRecoveryCount: number): P
       }
       recordDurableCrashBreadcrumb('renderer_recovery_manual_retry')
       // Why: leave the breaker open so a re-crash re-raises this prompt instead of resuming the auto-reload loop.
+      // Why watched: Reload is the dialog's default button, and an unwatched retry that stalls returns the user to
+      // the same silent hang with no further prompt — the watchdog re-raises this dialog instead.
+      if (retry) {
+        retry()
+        return
+      }
       loadMainWindow(state.mainWindow)
     },
     quit: () => {
diff --git a/src/main/startup/main-window-controller.ts b/src/main/startup/main-window-controller.ts
index 63d84df763c..8ea245fc256 100644
--- a/src/main/startup/main-window-controller.ts
+++ b/src/main/startup/main-window-controller.ts
@@ -113,13 +113,19 @@ export function openMainWindow(options: { revealOnDidFinishLoad?: boolean } = {}
         reason: details.reason,
         expectedTeardown: getExpectedTeardownScope(webContentsId, false)
       }),
-    onRendererRecoveryExhausted: ({ details, recentRecoveryCount }) => {
-      recordDurableCrashBreadcrumb('renderer_recovery_circuit_breaker_open', {
-        reason: details.reason,
-        exitCode: details.exitCode ?? null,
-        recentRecoveryCount
-      })
-      void showRendererRecoveryPrompt(recentRecoveryCount)
+    onRendererRecoveryExhausted: ({ details, recentRecoveryCount, cause, retry }) => {
+      // Why two names: a stalled reload never opened the breaker, and a bundle that says it did misreads the failure.
+      recordDurableCrashBreadcrumb(
+        cause === 'reload-stalled'
+          ? 'renderer_recovery_reload_exhausted'
+          : 'renderer_recovery_circuit_breaker_open',
+        {
+          reason: details.reason,
+          exitCode: details.exitCode ?? null,
+          recentRecoveryCount
+        }
+      )
+      void showRendererRecoveryPrompt(recentRecoveryCount, cause, retry)
     },
     deferLoad: true,
     ...(options.revealOnDidFinishLoad === true ? { revealOnDidFinishLoad: true } : {}),
@@ -131,9 +137,16 @@ export function openMainWindow(options: { revealOnDidFinishLoad?: boolean } = {}
       }
       recordCrashBreadcrumb('manual_reload_requested', { ignoreCache })
     },
-    onBeforeRecoveryReload: (webContentsId) => {
+    // Manual retries also preserve PTYs, but have their own intent breadcrumb.
+    onBeforeRecoveryReload: (webContentsId, trigger) => {
       markRecoveryReloadInFlight(webContentsId)
-      recordDurableCrashBreadcrumb('renderer_recovery_reload')
+      if (trigger === 'automatic') {
+        recordDurableCrashBreadcrumb('renderer_recovery_reload')
+      }
+    },
+    // Pair the intent breadcrumb with its path-free outcome.
+    onRecoveryReloadOutcome: ({ status, ...outcome }) => {
+      recordDurableCrashBreadcrumb(`renderer_recovery_reload_${status}`, outcome)
     }
   })
   recordCrashBreadcrumb('main_window_created')
diff --git a/src/main/startup/main-window-core-services.ts b/src/main/startup/main-window-core-services.ts
index 759a4b2b100..d3ece383ee3 100644
--- a/src/main/startup/main-window-core-services.ts
+++ b/src/main/startup/main-window-core-services.ts
@@ -15,6 +15,7 @@ import {
 import { prepareCodexRuntimeHomeForLaunch } from './codex-launch-preparation'
 import { prepareCodexSessionResumeForLaunch } from './codex-session-resume-launch'
 import { isRecoveryReloadInFlight } from './main-window-lifecycle-flags'
+import { RELAY_HOST_CLOSE_REASON } from '../../shared/relay-host-close-reason'
 
 export function attachMainWindowCoreServices(
   window: BrowserWindow,
@@ -90,7 +91,10 @@ export function attachMainWindowCoreServices(
         })
       },
       onOrcaProfileAuthMutation: () => state.desktopRelayService?.authMutated(),
-      onBeforeOrcaProfileSignOut: () => state.desktopRelayService?.fenceAndCloseNow()
+      // Sign-out is the one fence a paired phone can be told about; quit and
+      // relaunch above stay reasonless so a restart never reads as signed out.
+      onBeforeOrcaProfileSignOut: () =>
+        state.desktopRelayService?.fenceAndCloseNow(RELAY_HOST_CLOSE_REASON.SIGNED_OUT)
     },
     state.pluginService ?? undefined,
     state.pluginMarketplaceService && state.pluginMarketplaceInstaller
diff --git a/src/main/startup/pre-gone-crash-sampling-wiring.test.ts b/src/main/startup/pre-gone-crash-sampling-wiring.test.ts
new file mode 100644
index 00000000000..2a8e008c0b3
--- /dev/null
+++ b/src/main/startup/pre-gone-crash-sampling-wiring.test.ts
@@ -0,0 +1,49 @@
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+
+/**
+ * Guards the one line that arms pre-gone crash sampling.
+ *
+ * That branch is pure instrumentation, so this line is the whole of its value in
+ * the shipped app: deleting it left all 691 tests across `src/main/crash-reporting/`
+ * and `src/main/startup/` green while every crash report silently lost its only
+ * host reading taken before the dying process returned its pages.
+ *
+ * Source-level because that is the property: the sampler is armed once inside the
+ * ready-phase composition, which has no runtime seam to assert against.
+ */
+describe('pre-gone crash sampling startup wiring', () => {
+  // Why normalize: the indent anchors below are `\n`-prefixed, and nothing pins
+  // src/**/*.ts to LF, so a CRLF Windows checkout would fail them spuriously.
+  const readSource = (name: string): string =>
+    readFileSync(join(process.cwd(), 'src/main/startup', name), 'utf8').replace(/\r\n/g, '\n')
+
+  const readyRuntimeSource = readSource('main-process-ready-runtime.ts')
+  const readySource = readSource('main-process-ready.ts')
+
+  const READY_ENTRY = 'export async function initializeReadyRuntimeServices('
+  // Why the entry's body and not the file: the call satisfies a whole-file grep
+  // just as well from a sibling export nothing calls, which arms nothing.
+  const readyRuntimeEntryBody = readyRuntimeSource
+    .slice(readyRuntimeSource.indexOf(READY_ENTRY) + READY_ENTRY.length)
+    .split('\nexport ')[0]
+
+  it('arms the sampler unconditionally inside the function app readiness runs', () => {
+    expect(readyRuntimeSource).toContain(
+      "import { startPreGoneCrashSampling } from '../crash-reporting/process-gone-diagnostics'"
+    )
+    expect(readyRuntimeSource).toContain(READY_ENTRY)
+    expect(readyRuntimeEntryBody.split('startPreGoneCrashSampling()').length - 1).toBe(1)
+    // Why pin the indent: the call also matches as the body of an added
+    // `if (...)` guard, which keeps every other assertion here true while the
+    // sampler silently stops arming on most startups.
+    expect(readyRuntimeEntryBody).toContain('\n  startPreGoneCrashSampling()')
+
+    // ...and that this really is the function app readiness runs.
+    expect(readySource).toContain(
+      "import { initializeReadyRuntimeServices } from './main-process-ready-runtime'"
+    )
+    expect(readySource).toContain('\n  await initializeReadyRuntimeServices()')
+  })
+})
diff --git a/src/main/system-fonts.test.ts b/src/main/system-fonts.test.ts
index 106129feb8f..548fabf5a73 100644
--- a/src/main/system-fonts.test.ts
+++ b/src/main/system-fonts.test.ts
@@ -70,6 +70,22 @@ describe('listSystemFontFamilies', () => {
     })
   })
 
+  it('spawns the Windows font script without an -ExecutionPolicy switch', async () => {
+    // Why: execution policy gates script *files*, never -Command, so the switch
+    // was a no-op -- and it is the highest-weighted token on the command lines
+    // Defender flags (#17858).
+    await withPlatform('win32', async () => {
+      runProcessMock.mockResolvedValue(ok('Consolas\n'))
+      const { listSystemFontFamilies } = await import('./system-fonts')
+      await listSystemFontFamilies()
+
+      const args = runProcessMock.mock.calls[0]?.[0].args ?? []
+      expect(args).toContain('-Command')
+      expect(args).not.toContain('-ExecutionPolicy')
+      expect(args).not.toContain('Bypass')
+    })
+  })
+
   it('runs PowerShell by absolute path on Windows', async () => {
     // Why: a bare `powershell.exe` resolves against the child's PATH, which is
     // not the user's under Electron. Where policy has pruned the System32 entry
diff --git a/src/main/system-fonts.ts b/src/main/system-fonts.ts
index f841e22a579..73d5ef9f993 100644
--- a/src/main/system-fonts.ts
+++ b/src/main/system-fonts.ts
@@ -89,7 +89,8 @@ $fonts.Families | ForEach-Object { $_.Name }
 
   return execFileText(
     windowsPowerShellPath(),
-    ['-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-Command', script],
+    // Why: policy gates script *files*, not -Command, so the switch was a Defender-weighted no-op.
+    ['-NoProfile', '-NonInteractive', '-Command', script],
     8 * 1024 * 1024
   ).then((output) =>
     uniqueSorted(
diff --git a/src/main/text-generation/commit-message-text-generation-cancellation.test.ts b/src/main/text-generation/commit-message-text-generation-cancellation.test.ts
index 9cfde774384..820af710fb9 100644
--- a/src/main/text-generation/commit-message-text-generation-cancellation.test.ts
+++ b/src/main/text-generation/commit-message-text-generation-cancellation.test.ts
@@ -101,7 +101,7 @@ describe('generateCommitMessageFromContext', () => {
 
     cancelGenerateCommitMessageLocal('/repo')
 
-    expectChildTerminated(children[0]!)
+    await expectChildTerminated(children[0]!)
     expect(children[1]?.kill).not.toHaveBeenCalled()
 
     children[0]?.listeners.get('close')?.(null)
@@ -192,7 +192,7 @@ describe('generateCommitMessageFromContext', () => {
     cancelGeneratePullRequestFieldsLocal('/repo')
 
     expect(children[0]?.kill).not.toHaveBeenCalled()
-    expectChildTerminated(children[1]!)
+    await expectChildTerminated(children[1]!)
 
     const commitStdout = children[0]?.listeners.get('stdout:data')
     commitStdout?.(Buffer.from('Update README\n'))
@@ -250,7 +250,7 @@ describe('generateCommitMessageFromContext', () => {
     cancelGeneratePullRequestFieldsLocal('/repo')
     listeners.get('close')?.(null)
 
-    expectChildTerminated(child)
+    await expectChildTerminated(child)
     await expect(pullRequest).resolves.toEqual({
       success: false,
       error: 'Generation canceled.',
@@ -306,7 +306,7 @@ describe('generateCommitMessageFromContext', () => {
       )
 
       cancelGenerateCommitMessageLocal('/repo')
-      expectChildTerminated(child)
+      await expectChildTerminated(child)
       await Promise.resolve()
       await Promise.resolve()
       await Promise.resolve()
@@ -344,7 +344,7 @@ describe('generateCommitMessageFromContext', () => {
       error: 'Generation canceled.',
       canceled: true
     })
-    expectChildTerminated(firstChild)
+    await expectChildTerminated(firstChild)
 
     const second = generateCommitMessageFromContext(context, params, {
       kind: 'local',
@@ -377,7 +377,7 @@ describe('generateCommitMessageFromContext', () => {
     await vi.waitFor(() => expect(spawnMock).toHaveBeenCalledTimes(1))
     cancelGenerateCommitMessageLocal('/descendant-repo')
     await expect(first).resolves.toMatchObject({ canceled: true })
-    expectChildTerminated(firstChild)
+    await expectChildTerminated(firstChild)
 
     // SIGKILL reaches the codex process but not a grandchild that inherited its
     // stdout, so 'exit' arrives and 'close' never does.
diff --git a/src/main/text-generation/commit-message-text-generation-local-subprocess.test.ts b/src/main/text-generation/commit-message-text-generation-local-subprocess.test.ts
index c124cb85779..f73152255da 100644
--- a/src/main/text-generation/commit-message-text-generation-local-subprocess.test.ts
+++ b/src/main/text-generation/commit-message-text-generation-local-subprocess.test.ts
@@ -71,7 +71,7 @@ describe('generateCommitMessageFromContext', () => {
       error:
         'agent CLI command produced too much output. Check the agent CLI configuration and try again.'
     })
-    expectChildTerminated(child)
+    await expectChildTerminated(child)
   })
 
   it('passes prepared provider environment to local agent subprocesses', async () => {
diff --git a/src/main/text-generation/commit-message-text-generation-model-discovery.test.ts b/src/main/text-generation/commit-message-text-generation-model-discovery.test.ts
index 4bc1a720f05..9a1f932f0a0 100644
--- a/src/main/text-generation/commit-message-text-generation-model-discovery.test.ts
+++ b/src/main/text-generation/commit-message-text-generation-model-discovery.test.ts
@@ -325,7 +325,7 @@ describe('discoverCommitMessageModelsLocal', () => {
       await vi.advanceTimersByTimeAsync(60_000)
 
       await assertion
-      expectChildTerminated(child)
+      await expectChildTerminated(child)
       expect(child.stdout.listenerCount('data')).toBe(0)
       expect(child.stderr.listenerCount('data')).toBe(0)
       expect(child.listenerCount('error')).toBe(0)
@@ -352,7 +352,7 @@ describe('discoverCommitMessageModelsLocal', () => {
         success: false,
         error: 'Codex model discovery timed out after 60s.'
       })
-      expectChildTerminated(firstChild)
+      await expectChildTerminated(firstChild)
       expect(spawnMock).toHaveBeenCalledTimes(1)
 
       firstChild.emit('close', null)
@@ -413,7 +413,7 @@ describe('discoverCommitMessageModelsLocal', () => {
       success: false,
       error: 'Cursor returned too much model data.'
     })
-    expectChildTerminated(child)
+    await expectChildTerminated(child)
     expect(child.stdout.listenerCount('data')).toBe(0)
     expect(child.stderr.listenerCount('data')).toBe(0)
     expect(child.listenerCount('error')).toBe(0)
diff --git a/src/main/text-generation/commit-message-text-generation-test-harness.ts b/src/main/text-generation/commit-message-text-generation-test-harness.ts
index 21103d71f40..8ba925ef087 100644
--- a/src/main/text-generation/commit-message-text-generation-test-harness.ts
+++ b/src/main/text-generation/commit-message-text-generation-test-harness.ts
@@ -33,15 +33,17 @@ export function withPlatform<T>(platform: NodeJS.Platform, fn: () => T): T {
 // expectChildTerminated(child) with no extra argument.
 export function createChildTerminationExpectation(
   terminateWindowsProcessTreeMock: ReturnType<typeof vi.fn>
-): (child: { pid: number; kill: ReturnType<typeof vi.fn> }) => void {
-  return (child) => {
+): (child: { pid: number; kill: ReturnType<typeof vi.fn> }) => Promise<void> {
+  return async (child) => {
     if (process.platform === 'win32') {
       expect(terminateWindowsProcessTreeMock).toHaveBeenCalledWith(child.pid, {
         site: 'source-control-text-generation'
       })
-      expect(child.kill).not.toHaveBeenCalled()
-      return
     }
-    expect(child.kill).toHaveBeenCalledWith('SIGKILL')
+    // Every platform kills the root by its own handle. On win32 that is not a
+    // duplicate of the tree walk: it is what keeps a refused walk from resolving
+    // having killed nothing while the caller releases the managed-home lock. It
+    // runs after the walk there, so it can be a tick behind the caller.
+    await vi.waitFor(() => expect(child.kill).toHaveBeenCalledWith('SIGKILL'))
   }
 }
diff --git a/src/main/text-generation/source-control-local-process.ts b/src/main/text-generation/source-control-local-process.ts
index 170dead6b52..3f046494f0f 100644
--- a/src/main/text-generation/source-control-local-process.ts
+++ b/src/main/text-generation/source-control-local-process.ts
@@ -22,22 +22,25 @@ import type {
   TextGenerationOperation
 } from './source-control-text-generation-types'
 
-export function killSourceControlAgentProcess(
+export async function killSourceControlAgentProcess(
   child: SpawnedSourceControlAgentProcess
 ): Promise<void> {
   const pid = child.pid
   if (!pid) {
-    return Promise.resolve()
+    return
   }
   if (process.platform === 'win32') {
-    return terminateWindowsProcessTree(pid, { site: 'source-control-text-generation' })
+    // taskkill owns the tree, but the own-Chromium gate can refuse the
+    // pid-addressed walk; the handle-addressed root kill below cannot reach the
+    // recycled pid it refused, and callers release the managed-home lock on this
+    // promise, so it must not resolve having killed nothing.
+    await terminateWindowsProcessTree(pid, { site: 'source-control-text-generation' })
   }
   try {
     child.kill('SIGKILL')
   } catch {
     // The process may exit between the PID check and kill.
   }
-  return Promise.resolve()
 }
 
 export function runLocalSourceControlPlan(input: {
diff --git a/src/main/window/createMainWindow-close-confirmation.test.ts b/src/main/window/createMainWindow-close-confirmation.test.ts
index a8c9f70c503..6f91dd4add8 100644
--- a/src/main/window/createMainWindow-close-confirmation.test.ts
+++ b/src/main/window/createMainWindow-close-confirmation.test.ts
@@ -73,8 +73,8 @@ describe('createMainWindow', () => {
       setSize: vi.fn(),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn()
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve())
     }
     const onQuitAborted = vi.fn()
     browserWindowMock.mockImplementation(function () {
@@ -122,8 +122,8 @@ describe('createMainWindow', () => {
       setSize: vi.fn(),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn()
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve())
     }
     const consoleError = vi.spyOn(console, 'error').mockImplementation(() => {})
     browserWindowMock.mockImplementation(function () {
@@ -178,8 +178,8 @@ describe('createMainWindow', () => {
       setSize: vi.fn(),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn(),
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve()),
       close: vi.fn(() => {
         windowHandlers.close({} as never)
       })
@@ -238,8 +238,8 @@ describe('createMainWindow', () => {
       setSize: vi.fn(),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn()
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve())
     }
     const updateUI = vi.fn()
     const consoleError = vi.spyOn(console, 'error').mockImplementation(() => {})
@@ -296,8 +296,8 @@ describe('createMainWindow', () => {
       setSize: vi.fn(),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn()
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve())
     }
     const consoleError = vi.spyOn(console, 'error').mockImplementation(() => {})
     browserWindowMock.mockImplementation(function () {
@@ -353,8 +353,8 @@ describe('createMainWindow', () => {
       setSize: vi.fn(),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn()
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve())
     }
     browserWindowMock.mockImplementation(function () {
       return browserWindowInstance
@@ -401,8 +401,8 @@ describe('createMainWindow', () => {
       setSize: vi.fn(),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn()
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve())
     }
     browserWindowMock.mockImplementation(function () {
       return browserWindowInstance
@@ -451,8 +451,8 @@ describe('createMainWindow', () => {
         maximize: vi.fn(),
         show: vi.fn(),
         destroy,
-        loadFile: vi.fn(),
-        loadURL: vi.fn()
+        loadFile: vi.fn(() => Promise.resolve()),
+        loadURL: vi.fn(() => Promise.resolve())
       }
     })
     createMainWindow(null, { getIsQuitting: () => true })
@@ -500,8 +500,8 @@ describe('createMainWindow', () => {
         maximize: vi.fn(),
         show: vi.fn(),
         destroy,
-        loadFile: vi.fn(),
-        loadURL: vi.fn()
+        loadFile: vi.fn(() => Promise.resolve()),
+        loadURL: vi.fn(() => Promise.resolve())
       }
     })
     createMainWindow(null, { getIsQuitting: () => true })
diff --git a/src/main/window/createMainWindow-markdown-editor-focus.test.ts b/src/main/window/createMainWindow-markdown-editor-focus.test.ts
index 3189019f837..ef6fca229d3 100644
--- a/src/main/window/createMainWindow-markdown-editor-focus.test.ts
+++ b/src/main/window/createMainWindow-markdown-editor-focus.test.ts
@@ -54,8 +54,8 @@ describe('createMainWindow', () => {
       setWindowButtonPosition: vi.fn(),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn()
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve())
     }
     browserWindowMock.mockImplementation(function () {
       return browserWindowInstance
@@ -104,8 +104,8 @@ describe('createMainWindow', () => {
       setSize: vi.fn(),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn()
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve())
     }
     browserWindowMock.mockImplementation(function () {
       return browserWindowInstance
@@ -157,8 +157,8 @@ describe('createMainWindow', () => {
       setSize: vi.fn(),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn()
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve())
     }
     browserWindowMock.mockImplementation(function () {
       return browserWindowInstance
@@ -216,8 +216,8 @@ describe('createMainWindow', () => {
       setSize: vi.fn(),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn()
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve())
     }
     browserWindowMock.mockImplementation(function () {
       return browserWindowInstance
@@ -275,8 +275,8 @@ describe('createMainWindow', () => {
       setSize: vi.fn(),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn()
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve())
     }
     browserWindowMock.mockImplementation(function () {
       return browserWindowInstance
@@ -355,8 +355,8 @@ describe('createMainWindow', () => {
       setSize: vi.fn(),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn()
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve())
     }
     browserWindowMock.mockImplementation(function () {
       return browserWindowInstance
@@ -432,8 +432,8 @@ describe('createMainWindow', () => {
       setSize: vi.fn(),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn()
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve())
     }
     browserWindowMock.mockImplementation(function () {
       return browserWindowInstance
@@ -496,8 +496,8 @@ describe('createMainWindow', () => {
       setSize: vi.fn(),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn()
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve())
     }
     browserWindowMock.mockImplementation(function () {
       return browserWindowInstance
diff --git a/src/main/window/createMainWindow-recovery-reload-watchdog.test.ts b/src/main/window/createMainWindow-recovery-reload-watchdog.test.ts
new file mode 100644
index 00000000000..e551579a7ab
--- /dev/null
+++ b/src/main/window/createMainWindow-recovery-reload-watchdog.test.ts
@@ -0,0 +1,671 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type * as DurableCrashBreadcrumbModule from '../crash-reporting/durable-crash-breadcrumb'
+
+const { recordDurableCrashBreadcrumbMock } = vi.hoisted(() => ({
+  recordDurableCrashBreadcrumbMock: vi.fn()
+}))
+vi.mock('../crash-reporting/durable-crash-breadcrumb', async (importOriginal) => ({
+  ...(await importOriginal<typeof DurableCrashBreadcrumbModule>()),
+  recordDurableCrashBreadcrumb: recordDurableCrashBreadcrumbMock
+}))
+
+vi.mock('electron', async () =>
+  (await import('./createMainWindow-test-harness')).electronModuleMock()
+)
+vi.mock('@electron-toolkit/utils', async () =>
+  (await import('./createMainWindow-test-harness')).electronToolkitUtilsMock()
+)
+vi.mock('./macos-tahoe-release', async () =>
+  (await import('./createMainWindow-test-harness')).macosTahoeReleaseMock()
+)
+vi.mock('../app-icon', async () => (await import('./createMainWindow-test-harness')).appIconMock())
+vi.mock('../browser/browser-manager', async () =>
+  (await import('./createMainWindow-test-harness')).browserManagerMock()
+)
+vi.mock('../browser/browser-client-page-renderer-runtime', async () => {
+  const harness = await import('./createMainWindow-test-harness')
+  return {
+    attachBrowserClientPageRenderer: harness.attachClientPageRendererMock,
+    retireBrowserClientPageRenderer: harness.retireClientPageRendererMock
+  }
+})
+
+import { createMainWindow } from './createMainWindow'
+import {
+  browserWindowMock,
+  isMock,
+  powerMonitorOnMock,
+  resetMainWindowMocks
+} from './createMainWindow-test-harness'
+import {
+  RENDERER_RECOVERY_DEV_LOAD_TIMEOUT_MS,
+  RENDERER_RECOVERY_LOAD_TIMEOUT_MS
+} from './renderer-recovery-reload-watchdog'
+
+const DOCUMENT_URL = 'file:///opt/orca/renderer/index.html'
+// A real macOS install URL: the crash-report redactor's PATH_PATTERNS provably leave this one intact.
+const INSTALL_PATH_LOAD_ERROR =
+  "ERR_FILE_NOT_FOUND (-6) loading 'file:///Users/jane.doe/Applications/Orca.app/Contents/Resources/app.asar/out/renderer/index.html'"
+const CRASH = { reason: 'crashed', exitCode: 5 } as Electron.RenderProcessGoneDetails
+
+/**
+ * Regression cover for the field failure: the recovery reload is issued, never produces a document, and nothing
+ * notices — no did-fail-load, no breaker (it counts renderer deaths only), no retry, no prompt.
+ */
+describe('renderer recovery reload watchdog', () => {
+  beforeEach(() => {
+    resetMainWindowMocks()
+    recordDurableCrashBreadcrumbMock.mockClear()
+    vi.useFakeTimers()
+  })
+
+  const createHarness = () => {
+    // Why fan-out: dom-ready and did-finish-load have several real registrants on this one webContents, so
+    // last-writer-wins would silently drop the watchdog's listener if registration order ever changed.
+    const registered: Record<string, ((...args: any[]) => void)[]> = {}
+    const windowHandlers: Record<string, (...args: any[]) => void> = {}
+    const register = (event: string, handler: (...args: any[]) => void): void => {
+      const handlers = (registered[event] ??= [])
+      handlers.push(handler)
+      windowHandlers[event] ??= (...args: any[]) => {
+        for (const listener of handlers.slice()) {
+          listener(...args)
+        }
+      }
+    }
+    // Loads stay pending unless a test settles one: that is exactly the stall being reproduced.
+    const settleLoad: { resolve: () => void; reject: (error: Error) => void }[] = []
+    const pendingLoad = (): Promise<void> =>
+      new Promise<void>((resolve, reject) => settleLoad.push({ resolve, reject }))
+    const webContents = {
+      id: 143,
+      getURL: vi.fn(() => DOCUMENT_URL),
+      isDestroyed: vi.fn(() => false),
+      on: vi.fn(register),
+      setZoomLevel: vi.fn(),
+      setBackgroundThrottling: vi.fn(),
+      invalidate: vi.fn(),
+      setWindowOpenHandler: vi.fn(),
+      send: vi.fn()
+    }
+    const browserWindowInstance = {
+      webContents,
+      on: vi.fn(register),
+      isDestroyed: vi.fn(() => false),
+      isMaximized: vi.fn(() => true),
+      isFullScreen: vi.fn(() => false),
+      getSize: vi.fn(() => [1200, 800]),
+      setSize: vi.fn(),
+      maximize: vi.fn(),
+      show: vi.fn(),
+      setWindowButtonPosition: vi.fn(),
+      loadFile: vi.fn(pendingLoad),
+      loadURL: vi.fn(pendingLoad)
+    }
+    browserWindowMock.mockImplementation(function () {
+      return browserWindowInstance
+    })
+    const consoleError = vi.spyOn(console, 'error').mockImplementation(() => {})
+    const crashRenderer = (): void => {
+      windowHandlers['render-process-gone']?.({} as never, CRASH)
+      vi.advanceTimersByTime(250)
+    }
+    const reachMilestone = (milestone: 'committed' | 'dom-ready'): void =>
+      windowHandlers[milestone === 'committed' ? 'did-navigate' : 'dom-ready']?.()
+    return {
+      browserWindowInstance,
+      consoleError,
+      crashRenderer,
+      reachMilestone,
+      settleLoad,
+      windowHandlers
+    }
+  }
+
+  it('retries once when the recovery reload never produces a document, then hands the user the prompt', () => {
+    const onRecoveryReloadOutcome = vi.fn()
+    const onRendererRecoveryExhausted = vi.fn()
+    const { browserWindowInstance, consoleError, crashRenderer } = createHarness()
+
+    createMainWindow(null, { onRecoveryReloadOutcome, onRendererRecoveryExhausted })
+    crashRenderer()
+    // 1 initial load + 1 recovery reload, which now stalls forever.
+    expect(browserWindowInstance.loadFile).toHaveBeenCalledTimes(2)
+
+    vi.advanceTimersByTime(RENDERER_RECOVERY_LOAD_TIMEOUT_MS - 1)
+    expect(onRecoveryReloadOutcome).not.toHaveBeenCalled()
+    expect(browserWindowInstance.loadFile).toHaveBeenCalledTimes(2)
+
+    vi.advanceTimersByTime(1)
+    expect(onRecoveryReloadOutcome).toHaveBeenCalledWith({
+      status: 'timeout',
+      attempt: 1,
+      elapsedMs: RENDERER_RECOVERY_LOAD_TIMEOUT_MS,
+      progress: 'none'
+    })
+    expect(browserWindowInstance.loadFile).toHaveBeenCalledTimes(3)
+    expect(onRendererRecoveryExhausted).not.toHaveBeenCalled()
+
+    vi.advanceTimersByTime(RENDERER_RECOVERY_LOAD_TIMEOUT_MS)
+    expect(onRecoveryReloadOutcome).toHaveBeenLastCalledWith(
+      expect.objectContaining({ status: 'timeout', attempt: 2 })
+    )
+    // Retry budget spent: stop reloading and surface the only retry/quit surface the user has.
+    expect(browserWindowInstance.loadFile).toHaveBeenCalledTimes(3)
+    expect(onRendererRecoveryExhausted).toHaveBeenCalledWith({
+      details: CRASH,
+      webContentsId: 143,
+      recentRecoveryCount: 1,
+      cause: 'reload-stalled',
+      retry: expect.any(Function)
+    })
+
+    consoleError.mockRestore()
+  })
+
+  it('clears the watchdog when the recovery reload finishes loading', async () => {
+    const onRecoveryReloadOutcome = vi.fn()
+    const onRendererRecoveryExhausted = vi.fn()
+    const { browserWindowInstance, consoleError, crashRenderer, settleLoad } = createHarness()
+
+    createMainWindow(null, { onRecoveryReloadOutcome, onRendererRecoveryExhausted })
+    crashRenderer()
+    vi.advanceTimersByTime(2_000)
+    settleLoad[1]?.resolve()
+    await vi.advanceTimersByTimeAsync(0)
+
+    expect(onRecoveryReloadOutcome).toHaveBeenCalledWith({
+      status: 'loaded',
+      attempt: 1,
+      elapsedMs: 2_000
+    })
+
+    vi.advanceTimersByTime(RENDERER_RECOVERY_LOAD_TIMEOUT_MS * 3)
+    expect(onRecoveryReloadOutcome).toHaveBeenCalledTimes(1)
+    expect(browserWindowInstance.loadFile).toHaveBeenCalledTimes(2)
+    expect(onRendererRecoveryExhausted).not.toHaveBeenCalled()
+
+    consoleError.mockRestore()
+  })
+
+  it('keeps watching the retry when a stale did-finish-load arrives after it was issued', () => {
+    const onRecoveryReloadOutcome = vi.fn()
+    const onRendererRecoveryExhausted = vi.fn()
+    const { browserWindowInstance, consoleError, crashRenderer, windowHandlers } = createHarness()
+
+    createMainWindow(null, { onRecoveryReloadOutcome, onRendererRecoveryExhausted })
+    crashRenderer()
+    vi.advanceTimersByTime(RENDERER_RECOVERY_LOAD_TIMEOUT_MS)
+    expect(browserWindowInstance.loadFile).toHaveBeenCalledTimes(3)
+
+    // did-finish-load carries no attempt token: this one belongs to the load the timer just abandoned. Crediting
+    // the retry with it disarms the watchdog over a load still in flight — the exact hole this watchdog closes.
+    windowHandlers['did-finish-load']?.()
+    expect(onRecoveryReloadOutcome).not.toHaveBeenCalledWith(
+      expect.objectContaining({ status: 'loaded' })
+    )
+
+    vi.advanceTimersByTime(RENDERER_RECOVERY_LOAD_TIMEOUT_MS)
+    expect(onRecoveryReloadOutcome).toHaveBeenLastCalledWith(
+      expect.objectContaining({ status: 'timeout', attempt: 2 })
+    )
+    expect(onRendererRecoveryExhausted).toHaveBeenCalledTimes(1)
+
+    consoleError.mockRestore()
+  })
+
+  it('does not take an error page as the retry landing', async () => {
+    const onRecoveryReloadOutcome = vi.fn()
+    const onRendererRecoveryExhausted = vi.fn()
+    const { consoleError, crashRenderer, settleLoad, windowHandlers } = createHarness()
+
+    createMainWindow(null, { onRecoveryReloadOutcome, onRendererRecoveryExhausted })
+    crashRenderer()
+    settleLoad[1]?.reject(new Error('ERR_FILE_NOT_FOUND (-6)'))
+    await vi.advanceTimersByTimeAsync(0)
+    // Chromium commits an error document for the failed load, and that document emits did-finish-load too.
+    windowHandlers['did-finish-load']?.()
+
+    expect(onRecoveryReloadOutcome).not.toHaveBeenCalledWith(
+      expect.objectContaining({ status: 'loaded' })
+    )
+    vi.advanceTimersByTime(RENDERER_RECOVERY_LOAD_TIMEOUT_MS)
+    expect(onRendererRecoveryExhausted).toHaveBeenCalledTimes(1)
+
+    consoleError.mockRestore()
+  })
+
+  it('raises one prompt, however many times recovery gives up underneath it', () => {
+    const onRecoveryReloadOutcome = vi.fn()
+    const onRendererRecoveryExhausted = vi.fn()
+    const { browserWindowInstance, consoleError, crashRenderer } = createHarness()
+
+    createMainWindow(null, { onRecoveryReloadOutcome, onRendererRecoveryExhausted })
+    crashRenderer()
+    vi.advanceTimersByTime(RENDERER_RECOVERY_LOAD_TIMEOUT_MS * 2)
+    expect(onRendererRecoveryExhausted).toHaveBeenCalledTimes(1)
+    expect(browserWindowInstance.loadFile).toHaveBeenCalledTimes(3)
+
+    // The renderer dies again while the box is up; the breaker never counted stalls, so it lets the reload go.
+    crashRenderer()
+    expect(browserWindowInstance.loadFile).toHaveBeenCalledTimes(4)
+    vi.advanceTimersByTime(RENDERER_RECOVERY_LOAD_TIMEOUT_MS * 2)
+
+    // Nothing dismisses a native message box: a retry the user never asked for, or a second box, stacks on it.
+    expect(browserWindowInstance.loadFile).toHaveBeenCalledTimes(4)
+    expect(onRendererRecoveryExhausted).toHaveBeenCalledTimes(1)
+    // The stall is still on the record, so the bundle does not read as a recovery that quietly worked.
+    expect(onRecoveryReloadOutcome).toHaveBeenLastCalledWith(
+      expect.objectContaining({ status: 'timeout', attempt: 1 })
+    )
+
+    // Answering the box with Reload hands the next verdict back to the user.
+    onRendererRecoveryExhausted.mock.calls[0]?.[0].retry()
+    vi.advanceTimersByTime(RENDERER_RECOVERY_LOAD_TIMEOUT_MS * 2)
+    expect(onRendererRecoveryExhausted).toHaveBeenCalledTimes(2)
+
+    consoleError.mockRestore()
+  })
+
+  it('still reloads from a crash-loop prompt raised after an earlier recovery had landed', async () => {
+    const onRendererRecoveryExhausted = vi.fn()
+    const { browserWindowInstance, consoleError, crashRenderer, settleLoad } = createHarness()
+
+    createMainWindow(null, { onRendererRecoveryExhausted })
+    // Every recovery reload lands, and every landed document then dies with its renderer.
+    for (let attempt = 1; attempt <= 3; attempt += 1) {
+      crashRenderer()
+      settleLoad[attempt]?.resolve()
+      await vi.advanceTimersByTimeAsync(0)
+    }
+    crashRenderer()
+    expect(onRendererRecoveryExhausted).toHaveBeenCalledTimes(1)
+    const loads = browserWindowInstance.loadFile.mock.calls.length
+
+    // The last document landed, but the renderer took it down: declining Reload here strands the user.
+
+    onRendererRecoveryExhausted.mock.calls[0]?.[0].retry()
+    expect(browserWindowInstance.loadFile).toHaveBeenCalledTimes(loads + 1)
+
+    consoleError.mockRestore()
+  })
+
+  it('does not stack a crash-loop prompt on one that is already up', () => {
+    const onRendererRecoveryExhausted = vi.fn()
+    const { consoleError, crashRenderer } = createHarness()
+
+    createMainWindow(null, { onRendererRecoveryExhausted })
+    for (let attempt = 0; attempt < 5; attempt += 1) {
+      crashRenderer()
+    }
+
+    expect(onRendererRecoveryExhausted).toHaveBeenCalledTimes(1)
+
+    consoleError.mockRestore()
+  })
+
+  it('escalates a rejected recovery load immediately instead of waiting out the watchdog', async () => {
+    const onRecoveryReloadOutcome = vi.fn()
+    const { browserWindowInstance, consoleError, crashRenderer, settleLoad } = createHarness()
+
+    createMainWindow(null, { onRecoveryReloadOutcome })
+    crashRenderer()
+    settleLoad[1]?.reject(new Error("ERR_FILE_NOT_FOUND (-6) loading 'file:///opt/orca'"))
+    await vi.advanceTimersByTimeAsync(0)
+
+    expect(onRecoveryReloadOutcome).toHaveBeenCalledWith(
+      expect.objectContaining({
+        status: 'failed',
+        attempt: 1,
+        errorCode: 'ERR_FILE_NOT_FOUND'
+      })
+    )
+    expect(browserWindowInstance.loadFile).toHaveBeenCalledTimes(3)
+
+    consoleError.mockRestore()
+  })
+
+  it('ignores a superseded load rejection so ERR_ABORTED never escalates', async () => {
+    const onRecoveryReloadOutcome = vi.fn()
+    const onRendererRecoveryExhausted = vi.fn()
+    const { browserWindowInstance, consoleError, crashRenderer, settleLoad } = createHarness()
+
+    createMainWindow(null, { onRecoveryReloadOutcome, onRendererRecoveryExhausted })
+    crashRenderer()
+    // A second renderer death supersedes the first reload; Chromium rejects the abandoned load with ERR_ABORTED.
+    crashRenderer()
+    expect(browserWindowInstance.loadFile).toHaveBeenCalledTimes(3)
+    settleLoad[1]?.reject(new Error('ERR_ABORTED (-3)'))
+    await vi.advanceTimersByTimeAsync(0)
+
+    expect(onRecoveryReloadOutcome).not.toHaveBeenCalled()
+    expect(onRendererRecoveryExhausted).not.toHaveBeenCalled()
+    expect(browserWindowInstance.loadFile).toHaveBeenCalledTimes(3)
+
+    consoleError.mockRestore()
+  })
+
+  it('does not escalate when another navigation aborts the live recovery load', async () => {
+    const onRecoveryReloadOutcome = vi.fn()
+    const onRendererRecoveryExhausted = vi.fn()
+    const { browserWindowInstance, consoleError, crashRenderer, settleLoad, windowHandlers } =
+      createHarness()
+
+    createMainWindow(null, { onRecoveryReloadOutcome, onRendererRecoveryExhausted })
+    crashRenderer()
+    expect(browserWindowInstance.loadFile).toHaveBeenCalledTimes(2)
+    // Chromium aborts the recovery load because something else replaced it — a user navigation, a close race,
+    // another loadURL caller. The attempt token still says this reload is live, so nothing else filters it.
+    settleLoad[1]?.reject(new Error(`ERR_ABORTED (-3) loading '${DOCUMENT_URL}'`))
+    await vi.advanceTimersByTimeAsync(0)
+
+    // A cold retry here would stomp the load that superseded this one.
+    expect(browserWindowInstance.loadFile).toHaveBeenCalledTimes(2)
+    expect(onRecoveryReloadOutcome).not.toHaveBeenCalled()
+    expect(onRendererRecoveryExhausted).not.toHaveBeenCalled()
+
+    // The replacement load lands, and the window the user sees was never worth a Reload/Quit prompt. The crumb
+    // says so: elapsedMs measures the replacement, and the budget analysis has to be able to leave it out.
+    windowHandlers['did-finish-load']?.()
+    expect(onRecoveryReloadOutcome).toHaveBeenCalledWith(
+      expect.objectContaining({ status: 'loaded', attempt: 1, superseded: true })
+    )
+    expect(onRendererRecoveryExhausted).not.toHaveBeenCalled()
+
+    vi.advanceTimersByTime(RENDERER_RECOVERY_LOAD_TIMEOUT_MS * 2)
+    windowHandlers['did-finish-load']?.()
+    expect(onRecoveryReloadOutcome).toHaveBeenCalledTimes(1)
+
+    consoleError.mockRestore()
+  })
+
+  it('still escalates on silence when an aborted recovery load has nothing behind it', async () => {
+    const onRecoveryReloadOutcome = vi.fn()
+    const onRendererRecoveryExhausted = vi.fn()
+    const { consoleError, crashRenderer, settleLoad } = createHarness()
+
+    createMainWindow(null, { onRecoveryReloadOutcome, onRendererRecoveryExhausted })
+    crashRenderer()
+    settleLoad[1]?.reject(new Error('ERR_ABORTED (-3)'))
+    await vi.advanceTimersByTimeAsync(0)
+
+    // Ignoring the abort must not disarm the watchdog: the cap still bounds a load that goes nowhere.
+    await vi.advanceTimersByTimeAsync(RENDERER_RECOVERY_LOAD_TIMEOUT_MS * 2)
+    expect(onRecoveryReloadOutcome).toHaveBeenCalledWith(
+      expect.objectContaining({ status: 'timeout', attempt: 1 })
+    )
+    expect(onRendererRecoveryExhausted).toHaveBeenCalledWith(
+      expect.objectContaining({ cause: 'reload-stalled' })
+    )
+
+    consoleError.mockRestore()
+  })
+
+  it('gives the dev server a longer budget than a packaged load', () => {
+    const onRecoveryReloadOutcome = vi.fn()
+    const { browserWindowInstance, consoleError, crashRenderer } = createHarness()
+    isMock.dev = true
+    vi.stubEnv('ELECTRON_RENDERER_URL', 'http://localhost:5173/')
+
+    try {
+      createMainWindow(null, { onRecoveryReloadOutcome })
+      crashRenderer()
+      expect(browserWindowInstance.loadURL).toHaveBeenCalledTimes(2)
+
+      vi.advanceTimersByTime(RENDERER_RECOVERY_DEV_LOAD_TIMEOUT_MS - 1)
+      expect(onRecoveryReloadOutcome).not.toHaveBeenCalled()
+      vi.advanceTimersByTime(1)
+      expect(onRecoveryReloadOutcome).toHaveBeenCalledWith(
+        expect.objectContaining({ status: 'timeout', attempt: 1 })
+      )
+    } finally {
+      vi.unstubAllEnvs()
+      consoleError.mockRestore()
+    }
+  })
+
+  it('stays silent when the stalled window is already closing', () => {
+    const onRecoveryReloadOutcome = vi.fn()
+    const onRendererRecoveryExhausted = vi.fn()
+    const { browserWindowInstance, consoleError, crashRenderer, windowHandlers } = createHarness()
+
+    createMainWindow(null, { onRecoveryReloadOutcome, onRendererRecoveryExhausted })
+    crashRenderer()
+    windowHandlers.close?.({ preventDefault: vi.fn() } as never)
+    vi.advanceTimersByTime(RENDERER_RECOVERY_LOAD_TIMEOUT_MS * 2)
+
+    expect(onRecoveryReloadOutcome).not.toHaveBeenCalled()
+    expect(onRendererRecoveryExhausted).not.toHaveBeenCalled()
+    expect(browserWindowInstance.loadFile).toHaveBeenCalledTimes(2)
+
+    consoleError.mockRestore()
+  })
+  it('keeps the install path out of the outcome breadcrumb', async () => {
+    const onRecoveryReloadOutcome = vi.fn()
+    const { consoleError, crashRenderer, settleLoad } = createHarness()
+
+    createMainWindow(null, { onRecoveryReloadOutcome })
+    crashRenderer()
+    settleLoad[1]?.reject(new Error(INSTALL_PATH_LOAD_ERROR))
+    await vi.advanceTimersByTimeAsync(0)
+
+    const outcome = onRecoveryReloadOutcome.mock.calls[0]?.[0]
+    expect(outcome).toEqual({
+      status: 'failed',
+      attempt: 1,
+      elapsedMs: 0,
+      progress: 'none',
+      errorCode: 'ERR_FILE_NOT_FOUND'
+    })
+    // sanitizeCrashReportString cannot redact a file:///Users/... URL, so nothing path-shaped may reach the crumb.
+    expect(JSON.stringify(outcome)).not.toContain('/')
+
+    consoleError.mockRestore()
+  })
+
+  it('records a durable breadcrumb for a rejected load, since console output never reaches the bundle', async () => {
+    const { consoleError, settleLoad } = createHarness()
+
+    createMainWindow(null, {})
+    settleLoad[0]?.reject(new Error(INSTALL_PATH_LOAD_ERROR))
+    await vi.advanceTimersByTimeAsync(0)
+
+    // Catching the rejection retired the main_unhandled_rejection crumb this used to produce.
+    expect(recordDurableCrashBreadcrumbMock).toHaveBeenCalledWith('main_window_load_failed', {
+      errorCode: 'ERR_FILE_NOT_FOUND'
+    })
+
+    consoleError.mockRestore()
+  })
+
+  it('escalates to the prompt when both attempts are rejected outright', async () => {
+    const onRecoveryReloadOutcome = vi.fn()
+    const onRendererRecoveryExhausted = vi.fn()
+    const { consoleError, crashRenderer, settleLoad } = createHarness()
+
+    createMainWindow(null, { onRecoveryReloadOutcome, onRendererRecoveryExhausted })
+    crashRenderer()
+    settleLoad[1]?.reject(new Error('ERR_CONNECTION_REFUSED (-102)'))
+    await vi.advanceTimersByTimeAsync(0)
+    settleLoad[2]?.reject(new Error('ERR_CONNECTION_REFUSED (-102)'))
+    await vi.advanceTimersByTimeAsync(0)
+
+    expect(onRecoveryReloadOutcome).toHaveBeenLastCalledWith(
+      expect.objectContaining({ status: 'failed', attempt: 2, errorCode: 'ERR_CONNECTION_REFUSED' })
+    )
+    expect(onRendererRecoveryExhausted).toHaveBeenCalledWith(
+      expect.objectContaining({ cause: 'reload-stalled', recentRecoveryCount: 1 })
+    )
+
+    consoleError.mockRestore()
+  })
+
+  it('hands the prompt a watched retry so a stalled manual reload re-raises it', () => {
+    const onRendererRecoveryExhausted = vi.fn()
+    const { browserWindowInstance, consoleError, crashRenderer } = createHarness()
+
+    createMainWindow(null, { onRendererRecoveryExhausted })
+    crashRenderer()
+    vi.advanceTimersByTime(RENDERER_RECOVERY_LOAD_TIMEOUT_MS * 2)
+    expect(onRendererRecoveryExhausted).toHaveBeenCalledTimes(1)
+    expect(browserWindowInstance.loadFile).toHaveBeenCalledTimes(3)
+
+    // Reload is the dialog's default button; unwatched it returned the user to the same unbounded silent hang.
+    onRendererRecoveryExhausted.mock.calls[0]?.[0].retry()
+    expect(browserWindowInstance.loadFile).toHaveBeenCalledTimes(4)
+
+    vi.advanceTimersByTime(RENDERER_RECOVERY_LOAD_TIMEOUT_MS * 2)
+    expect(browserWindowInstance.loadFile).toHaveBeenCalledTimes(5)
+    expect(onRendererRecoveryExhausted).toHaveBeenCalledTimes(2)
+
+    consoleError.mockRestore()
+  })
+
+  it('names the crash-loop cause and gives that prompt a watched retry too', () => {
+    const onRendererRecoveryExhausted = vi.fn()
+    const { consoleError, crashRenderer } = createHarness()
+
+    createMainWindow(null, { onRendererRecoveryExhausted })
+    for (let attempt = 0; attempt < 4; attempt += 1) {
+      crashRenderer()
+    }
+
+    expect(onRendererRecoveryExhausted).toHaveBeenCalledWith(
+      expect.objectContaining({ cause: 'crash-loop' })
+    )
+    expect(typeof onRendererRecoveryExhausted.mock.calls[0]?.[0].retry).toBe('function')
+
+    consoleError.mockRestore()
+  })
+
+  it('restarts the stall budget when the machine resumes mid-load', () => {
+    const onRecoveryReloadOutcome = vi.fn()
+    const { browserWindowInstance, consoleError, crashRenderer } = createHarness()
+
+    createMainWindow(null, { onRecoveryReloadOutcome })
+    crashRenderer()
+    // Sleep freezes the timer; on wake it would otherwise fire against a load that never got its budget.
+    vi.advanceTimersByTime(RENDERER_RECOVERY_LOAD_TIMEOUT_MS - 1)
+    const resume = powerMonitorOnMock.mock.calls.find(([event]) => event === 'resume')?.[1] as (
+      ...args: unknown[]
+    ) => void
+    resume()
+
+    vi.advanceTimersByTime(RENDERER_RECOVERY_LOAD_TIMEOUT_MS - 1)
+    expect(onRecoveryReloadOutcome).not.toHaveBeenCalled()
+    expect(browserWindowInstance.loadFile).toHaveBeenCalledTimes(2)
+
+    vi.advanceTimersByTime(1)
+    // Why the full span: rewriting the issue time on resume publishes time-since-wake into the bundle, which is
+    // silently wrong on any laptop — the outcome crumb exists to be honest about how long the load actually ran.
+    expect(onRecoveryReloadOutcome).toHaveBeenCalledWith(
+      expect.objectContaining({
+        status: 'timeout',
+        attempt: 1,
+        elapsedMs: RENDERER_RECOVERY_LOAD_TIMEOUT_MS * 2 - 1
+      })
+    )
+
+    consoleError.mockRestore()
+  })
+
+  it('never restarts a load that reached a document, and gives it the rest of the cap', () => {
+    const onRecoveryReloadOutcome = vi.fn()
+    const onRendererRecoveryExhausted = vi.fn()
+    const { browserWindowInstance, consoleError, crashRenderer, reachMilestone } = createHarness()
+
+    createMainWindow(null, { onRecoveryReloadOutcome, onRendererRecoveryExhausted })
+    crashRenderer()
+    vi.advanceTimersByTime(10_000)
+    reachMilestone('committed')
+
+    // 'no did-finish-load yet' is not a stall: a cold restart here throws away a load that already committed, and
+    // a machine that would have landed at ~60s misses the budget entirely.
+    vi.advanceTimersByTime(RENDERER_RECOVERY_LOAD_TIMEOUT_MS)
+    expect(browserWindowInstance.loadFile).toHaveBeenCalledTimes(2)
+    expect(onRecoveryReloadOutcome).not.toHaveBeenCalled()
+
+    reachMilestone('dom-ready')
+    vi.advanceTimersByTime(RENDERER_RECOVERY_LOAD_TIMEOUT_MS)
+    expect(onRecoveryReloadOutcome).toHaveBeenCalledWith({
+      status: 'timeout',
+      attempt: 1,
+      elapsedMs: RENDERER_RECOVERY_LOAD_TIMEOUT_MS * 2,
+      progress: 'dom-ready'
+    })
+    // Still never restarted, and the cap keeps the ~90s worst case the no-document path already had.
+    expect(browserWindowInstance.loadFile).toHaveBeenCalledTimes(2)
+    expect(onRendererRecoveryExhausted).toHaveBeenCalledTimes(1)
+
+    consoleError.mockRestore()
+  })
+
+  it('records a reload that lands after the prompt, and leaves the recovered window alone', async () => {
+    const onRecoveryReloadOutcome = vi.fn()
+    const onRendererRecoveryExhausted = vi.fn()
+    const { browserWindowInstance, consoleError, crashRenderer, settleLoad } = createHarness()
+
+    createMainWindow(null, { onRecoveryReloadOutcome, onRendererRecoveryExhausted })
+    crashRenderer()
+    vi.advanceTimersByTime(RENDERER_RECOVERY_LOAD_TIMEOUT_MS * 2)
+    expect(onRendererRecoveryExhausted).toHaveBeenCalledTimes(1)
+
+    onRecoveryReloadOutcome.mockClear()
+    vi.advanceTimersByTime(30_000)
+    settleLoad[2]?.resolve()
+    await vi.advanceTimersByTimeAsync(0)
+
+    // Nothing cancels a pending Chromium load, so escalation must keep watching: a bundle that reads
+    // `exhausted` for a recovery that actually worked misleads the next triage round.
+    expect(onRecoveryReloadOutcome).toHaveBeenCalledWith({
+      status: 'loaded',
+      attempt: 2,
+      elapsedMs: RENDERER_RECOVERY_LOAD_TIMEOUT_MS + 30_000,
+      afterPrompt: true
+    })
+
+    // No API dismisses a native message box, so Reload is still aimed at a window that came back; taking it
+    // would destroy the session the recovery just restored.
+    onRendererRecoveryExhausted.mock.calls[0]?.[0].retry()
+    expect(browserWindowInstance.loadFile).toHaveBeenCalledTimes(3)
+
+    consoleError.mockRestore()
+  })
+
+  it('separates the automatic recovery reload from the prompt-driven retry', () => {
+    const onBeforeRecoveryReload = vi.fn()
+    const onRendererRecoveryExhausted = vi.fn()
+    const { consoleError, crashRenderer } = createHarness()
+
+    createMainWindow(null, { onBeforeRecoveryReload, onRendererRecoveryExhausted })
+    crashRenderer()
+    vi.advanceTimersByTime(RENDERER_RECOVERY_LOAD_TIMEOUT_MS * 2)
+    onRendererRecoveryExhausted.mock.calls[0]?.[0].retry()
+
+    // The field counts keyed on renderer_recovery_reload mean 'automatic recovery'; a manual retry recorded
+    // under the same name silently redefines them.
+    expect(onBeforeRecoveryReload.mock.calls.map(([, trigger]) => trigger)).toEqual([
+      'automatic',
+      'automatic',
+      'manual-retry'
+    ])
+
+    consoleError.mockRestore()
+  })
+
+  it('keeps a shutdown-aborted load out of the crash breadcrumb stream', async () => {
+    const { consoleError, settleLoad } = createHarness()
+
+    createMainWindow(null, {})
+    settleLoad[0]?.reject(new Error(`ERR_ABORTED (-3) loading '${DOCUMENT_URL}'`))
+    await vi.advanceTimersByTimeAsync(0)
+
+    // A quit or close aborts the in-flight startup load; a healthy shutdown must not look like a launch failure.
+    expect(recordDurableCrashBreadcrumbMock).not.toHaveBeenCalledWith(
+      'main_window_load_failed',
+      expect.anything()
+    )
+
+    consoleError.mockRestore()
+  })
+})
diff --git a/src/main/window/createMainWindow-renderer-crash-recovery.test.ts b/src/main/window/createMainWindow-renderer-crash-recovery.test.ts
index 43dac231130..b3fc210be2c 100644
--- a/src/main/window/createMainWindow-renderer-crash-recovery.test.ts
+++ b/src/main/window/createMainWindow-renderer-crash-recovery.test.ts
@@ -21,7 +21,7 @@ vi.mock('../browser/browser-client-page-renderer-runtime', async () => {
   }
 })
 
-import { createMainWindow, loadMainWindow } from './createMainWindow'
+import { createMainWindow } from './createMainWindow'
 import { ipcMain } from 'electron'
 import { shouldRecoverRendererAfterProcessGone } from '../crash-reporting/process-gone-classification'
 import {
@@ -74,8 +74,8 @@ describe('createMainWindow', () => {
       setSize: vi.fn(),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn()
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve())
     }
     browserWindowMock.mockImplementation(function () {
       return browserWindowInstance
@@ -120,8 +120,8 @@ describe('createMainWindow', () => {
       setSize: vi.fn(),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn()
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve())
     }
     browserWindowMock.mockImplementation(function () {
       return browserWindowInstance
@@ -231,8 +231,8 @@ describe('createMainWindow', () => {
       setSize: vi.fn(),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn()
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve())
     }
     browserWindowMock.mockImplementation(function () {
       return browserWindowInstance
@@ -272,8 +272,8 @@ describe('createMainWindow', () => {
       setSize: vi.fn(),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn()
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve())
     }
     const consoleError = vi.spyOn(console, 'error').mockImplementation(() => {})
     browserWindowMock.mockImplementation(function () {
@@ -322,8 +322,8 @@ describe('createMainWindow', () => {
       setSize: vi.fn(),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn()
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve())
     }
     const consoleError = vi.spyOn(console, 'error').mockImplementation(() => {})
     browserWindowMock.mockImplementation(function () {
@@ -353,6 +353,8 @@ describe('createMainWindow', () => {
     const windowHandlers: Record<string, (...args: any[]) => void> = {}
     const webContents = {
       id: 143,
+      getURL: vi.fn(() => 'file:///opt/orca/renderer/index.html'),
+      isDestroyed: vi.fn(() => false),
       on: vi.fn((event, handler) => {
         windowHandlers[event] = handler
       }),
@@ -374,8 +376,8 @@ describe('createMainWindow', () => {
       setSize: vi.fn(),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn()
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve())
     }
     browserWindowMock.mockImplementation(function () {
       return browserWindowInstance
@@ -415,10 +417,12 @@ describe('createMainWindow', () => {
     const consoleError = vi.spyOn(console, 'error').mockImplementation(() => {})
     const { browserWindowInstance, windowHandlers } = createRendererRecoveryWindowHarness()
     const onBeforeRecoveryReload = vi.fn()
+    const onRendererRecoveryExhausted = vi.fn()
 
     withPlatform('win32', () => {
       createMainWindow(null, {
         onBeforeRecoveryReload,
+        onRendererRecoveryExhausted,
         shouldRecoverRenderer: (details) =>
           shouldRecoverRendererAfterProcessGone({
             reason: details.reason,
@@ -436,10 +440,14 @@ describe('createMainWindow', () => {
       {} as never,
       { reason: 'killed', exitCode: 1 } as Electron.RenderProcessGoneDetails
     )
-    vi.runAllTimers()
+    vi.advanceTimersByTime(250)
 
-    expect(onBeforeRecoveryReload).toHaveBeenCalledWith(143)
+    expect(onBeforeRecoveryReload).toHaveBeenCalledWith(143, 'automatic')
     expect(browserWindowInstance.loadFile).toHaveBeenCalledTimes(2)
+    // Why the watchdog must stay quiet here: this reload is deliberate during logoff, and a process that
+    // outlives the session-end signal must not put a native modal on screen mid-teardown.
+    vi.runAllTimers()
+    expect(onRendererRecoveryExhausted).not.toHaveBeenCalled()
     consoleError.mockRestore()
   })
 
@@ -615,8 +623,8 @@ describe('createMainWindow', () => {
     // 1 initial load + 3 recoveries; the 4th crash was refused.
     expect(browserWindowInstance.loadFile).toHaveBeenCalledTimes(4)
 
-    // The recovery prompt's Reload button goes straight to loadMainWindow, which the breaker never gates.
-    loadMainWindow(browserWindowInstance as unknown as Electron.BrowserWindow)
+    // The recovery prompt's Reload button takes the watched retry, which the breaker never gates.
+    onRendererRecoveryExhausted.mock.calls[0]?.[0].retry()
     expect(browserWindowInstance.loadFile).toHaveBeenCalledTimes(5)
 
     // Still-poisoned machine: the next crash re-raises the prompt immediately instead of re-arming auto-reloads.
diff --git a/src/main/window/createMainWindow-startup-reveal.test.ts b/src/main/window/createMainWindow-startup-reveal.test.ts
index 1a623ab20e3..bd7eeadc6b2 100644
--- a/src/main/window/createMainWindow-startup-reveal.test.ts
+++ b/src/main/window/createMainWindow-startup-reveal.test.ts
@@ -1,4 +1,4 @@
-import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
 vi.mock('electron', async () =>
   (await import('./createMainWindow-test-harness')).electronModuleMock()
@@ -22,6 +22,14 @@ import {
   withPlatform
 } from './createMainWindow-test-harness'
 
+// These cases exercise foreground behavior against Electron mocks.
+beforeEach(() => {
+  vi.stubEnv('ORCA_BACKGROUND_LAUNCH', undefined)
+  vi.stubEnv('ORCA_E2E_HEADLESS', undefined)
+  vi.stubEnv('ORCA_E2E_HEADFUL', undefined)
+})
+afterEach(() => vi.unstubAllEnvs())
+
 describe('createMainWindow', () => {
   beforeEach(() => {
     resetMainWindowMocks()
@@ -57,8 +65,8 @@ describe('createMainWindow', () => {
       setWindowButtonPosition: vi.fn(),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn()
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve())
     }
     browserWindowMock.mockImplementation(function () {
       return browserWindowInstance
@@ -78,6 +86,34 @@ describe('createMainWindow', () => {
     }
   }
 
+  it.each(['darwin', 'linux', 'win32'] as const)(
+    'keeps explicit background startup hidden through ready/load/fallback on %s',
+    (platform) => {
+      vi.useFakeTimers()
+      vi.stubEnv('ORCA_BACKGROUND_LAUNCH', '1')
+      const { browserWindowInstance, windowHandlers } = createStartupRevealWindowFixture()
+      const showInactive = vi.fn()
+      Object.assign(browserWindowInstance, { showInactive })
+      try {
+        withPlatform(platform, () => {
+          createMainWindow(createStartupRevealStore(true) as never, { revealOnDidFinishLoad: true })
+          const revealAfterLoad = browserWindowInstance.webContents.on.mock.calls.find(
+            ([event]) => event === 'did-finish-load'
+          )?.[1]
+          expect(revealAfterLoad).toBeTypeOf('function')
+          revealAfterLoad?.()
+          windowHandlers['ready-to-show']()
+          vi.advanceTimersByTime(10_000)
+          expect(browserWindowInstance.show).not.toHaveBeenCalled()
+          expect(showInactive).not.toHaveBeenCalled()
+          expect(browserWindowInstance.maximize).not.toHaveBeenCalled()
+        })
+      } finally {
+        vi.unstubAllEnvs()
+      }
+    }
+  )
+
   it('ignores duplicate ready-to-show events after startup maximize has already run', () => {
     const { browserWindowInstance, windowHandlers } = createStartupRevealWindowFixture()
 
diff --git a/src/main/window/createMainWindow-system-resume-relay.test.ts b/src/main/window/createMainWindow-system-resume-relay.test.ts
index e51f1be0f07..71bf0cd7381 100644
--- a/src/main/window/createMainWindow-system-resume-relay.test.ts
+++ b/src/main/window/createMainWindow-system-resume-relay.test.ts
@@ -56,8 +56,8 @@ describe('createMainWindow', () => {
         setSize: vi.fn(),
         maximize: vi.fn(),
         show: vi.fn(),
-        loadFile: vi.fn(),
-        loadURL: vi.fn()
+        loadFile: vi.fn(() => Promise.resolve()),
+        loadURL: vi.fn(() => Promise.resolve())
       }
       browserWindowMock.mockImplementation(function () {
         return instance
diff --git a/src/main/window/createMainWindow-terminal-focus-shortcuts.test.ts b/src/main/window/createMainWindow-terminal-focus-shortcuts.test.ts
index 9b88c60800c..8287b9bcecb 100644
--- a/src/main/window/createMainWindow-terminal-focus-shortcuts.test.ts
+++ b/src/main/window/createMainWindow-terminal-focus-shortcuts.test.ts
@@ -51,8 +51,8 @@ describe('createMainWindow', () => {
       setSize: vi.fn(),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn()
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve())
     }
     browserWindowMock.mockImplementation(function () {
       return browserWindowInstance
@@ -143,8 +143,8 @@ describe('createMainWindow', () => {
       setSize: vi.fn(),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn()
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve())
     }
     browserWindowMock.mockImplementation(function () {
       return browserWindowInstance
@@ -237,8 +237,8 @@ describe('createMainWindow', () => {
       setSize: vi.fn(),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn()
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve())
     }
     browserWindowMock.mockImplementation(function () {
       return browserWindowInstance
@@ -302,8 +302,8 @@ describe('createMainWindow', () => {
       setSize: vi.fn(),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn()
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve())
     }
     browserWindowMock.mockImplementation(function () {
       return browserWindowInstance
@@ -366,8 +366,8 @@ describe('createMainWindow', () => {
       setSize: vi.fn(),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn()
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve())
     }
     browserWindowMock.mockImplementation(function () {
       return browserWindowInstance
@@ -424,8 +424,8 @@ describe('createMainWindow', () => {
       setSize: vi.fn(),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn()
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve())
     }
     browserWindowMock.mockImplementation(function () {
       return browserWindowInstance
@@ -486,8 +486,8 @@ describe('createMainWindow', () => {
       setSize: vi.fn(),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn()
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve())
     }
     browserWindowMock.mockImplementation(function () {
       return browserWindowInstance
@@ -565,8 +565,8 @@ describe('createMainWindow', () => {
       setSize: vi.fn(),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn()
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve())
     }
     browserWindowMock.mockImplementation(function () {
       return browserWindowInstance
@@ -630,8 +630,8 @@ describe('createMainWindow', () => {
       setSize: vi.fn(),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn()
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve())
     }
     browserWindowMock.mockImplementation(function () {
       return browserWindowInstance
@@ -707,8 +707,8 @@ describe('createMainWindow', () => {
       setSize: vi.fn(),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn()
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve())
     }
     browserWindowMock.mockImplementation(function () {
       return browserWindowInstance
@@ -777,8 +777,8 @@ describe('createMainWindow', () => {
       setSize: vi.fn(),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn()
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve())
     }
     browserWindowMock.mockImplementation(function () {
       return browserWindowInstance
diff --git a/src/main/window/createMainWindow-tray-minimize-close.test.ts b/src/main/window/createMainWindow-tray-minimize-close.test.ts
index 14f829b63d9..469d8313830 100644
--- a/src/main/window/createMainWindow-tray-minimize-close.test.ts
+++ b/src/main/window/createMainWindow-tray-minimize-close.test.ts
@@ -81,8 +81,8 @@ describe('createMainWindow', () => {
         maximize: vi.fn(),
         show: vi.fn(),
         hide: vi.fn(),
-        loadFile: vi.fn(),
-        loadURL: vi.fn()
+        loadFile: vi.fn(() => Promise.resolve()),
+        loadURL: vi.fn(() => Promise.resolve())
       }
       browserWindowMock.mockImplementation(function () {
         return instance
diff --git a/src/main/window/createMainWindow-zoom-and-tab-switch-shortcuts.test.ts b/src/main/window/createMainWindow-zoom-and-tab-switch-shortcuts.test.ts
index d80349a52df..9d0c3cc9048 100644
--- a/src/main/window/createMainWindow-zoom-and-tab-switch-shortcuts.test.ts
+++ b/src/main/window/createMainWindow-zoom-and-tab-switch-shortcuts.test.ts
@@ -51,8 +51,8 @@ describe('createMainWindow', () => {
       setSize: vi.fn(),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn()
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve())
     }
     browserWindowMock.mockImplementation(function () {
       return browserWindowInstance
@@ -116,8 +116,8 @@ describe('createMainWindow', () => {
       setSize: vi.fn(),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn()
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve())
     }
     browserWindowMock.mockImplementation(function () {
       return browserWindowInstance
@@ -158,8 +158,8 @@ describe('createMainWindow', () => {
       setSize: vi.fn(),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn()
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve())
     }
     browserWindowMock.mockImplementation(function () {
       return browserWindowInstance
@@ -206,8 +206,8 @@ describe('createMainWindow', () => {
       setSize: vi.fn(),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn()
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve())
     }
     browserWindowMock.mockImplementation(function () {
       return browserWindowInstance
@@ -252,8 +252,8 @@ describe('createMainWindow', () => {
       setSize: vi.fn(),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn()
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve())
     }
     browserWindowMock.mockImplementation(function () {
       return browserWindowInstance
@@ -300,8 +300,8 @@ describe('createMainWindow', () => {
       setSize: vi.fn(),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn()
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve())
     }
     browserWindowMock.mockImplementation(function () {
       return browserWindowInstance
@@ -375,8 +375,8 @@ describe('createMainWindow', () => {
       setSize: vi.fn(),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn()
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve())
     }
     browserWindowMock.mockImplementation(function () {
       return browserWindowInstance
@@ -423,8 +423,8 @@ describe('createMainWindow', () => {
       setSize: vi.fn(),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn()
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve())
     }
     browserWindowMock.mockImplementation(function () {
       return browserWindowInstance
@@ -484,8 +484,8 @@ describe('createMainWindow', () => {
       setSize: vi.fn(),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn()
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve())
     }
     browserWindowMock.mockImplementation(function () {
       return browserWindowInstance
diff --git a/src/main/window/createMainWindow.test.ts b/src/main/window/createMainWindow.test.ts
index 18f4dbf5592..79b9a742533 100644
--- a/src/main/window/createMainWindow.test.ts
+++ b/src/main/window/createMainWindow.test.ts
@@ -78,8 +78,8 @@ describe('createMainWindow', () => {
       setSize: vi.fn(),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn()
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve())
     }
     browserWindowMock.mockImplementation(function () {
       return browserWindowInstance
@@ -140,8 +140,8 @@ describe('createMainWindow', () => {
       setSize: vi.fn(),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn()
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve())
     }
     browserWindowMock.mockImplementation(function () {
       return browserWindowInstance
@@ -320,8 +320,8 @@ describe('createMainWindow', () => {
         setSize: vi.fn(),
         maximize: vi.fn(),
         show: vi.fn(),
-        loadFile: vi.fn(),
-        loadURL: vi.fn()
+        loadFile: vi.fn(() => Promise.resolve()),
+        loadURL: vi.fn(() => Promise.resolve())
       }
     })
 
@@ -379,8 +379,8 @@ describe('createMainWindow', () => {
         setWindowButtonPosition: vi.fn(),
         maximize: vi.fn(),
         show: vi.fn(),
-        loadFile: vi.fn(),
-        loadURL: vi.fn()
+        loadFile: vi.fn(() => Promise.resolve()),
+        loadURL: vi.fn(() => Promise.resolve())
       }
       browserWindowMock.mockImplementation(function () {
         return browserWindowInstance
@@ -424,8 +424,8 @@ describe('createMainWindow', () => {
         setWindowButtonPosition: vi.fn(),
         maximize: vi.fn(),
         show: vi.fn(),
-        loadFile: vi.fn(),
-        loadURL: vi.fn()
+        loadFile: vi.fn(() => Promise.resolve()),
+        loadURL: vi.fn(() => Promise.resolve())
       }
       browserWindowMock.mockImplementation(function () {
         return browserWindowInstance
@@ -479,8 +479,8 @@ describe('createMainWindow', () => {
       }),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn()
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve())
     }
     browserWindowMock.mockImplementation(function () {
       return browserWindowInstance
@@ -554,8 +554,8 @@ describe('createMainWindow', () => {
       }),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn()
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve())
     }
     browserWindowMock.mockImplementation(function () {
       return browserWindowInstance
@@ -630,8 +630,8 @@ describe('createMainWindow', () => {
       setSize: vi.fn(),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn()
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve())
     }
     browserWindowMock.mockImplementation(function () {
       return browserWindowInstance
@@ -678,8 +678,8 @@ describe('createMainWindow', () => {
       setSize: vi.fn(),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn()
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve())
     }
     browserWindowMock.mockImplementation(function () {
       return browserWindowInstance
@@ -726,8 +726,8 @@ describe('createMainWindow', () => {
       setSize: vi.fn(),
       maximize: vi.fn(),
       show: vi.fn(),
-      loadFile: vi.fn(),
-      loadURL: vi.fn()
+      loadFile: vi.fn(() => Promise.resolve()),
+      loadURL: vi.fn(() => Promise.resolve())
     }
     browserWindowMock.mockImplementation(function () {
       return browserWindowInstance
diff --git a/src/main/window/createMainWindow.ts b/src/main/window/createMainWindow.ts
index 085cc475d49..41d84d1ab93 100644
--- a/src/main/window/createMainWindow.ts
+++ b/src/main/window/createMainWindow.ts
@@ -14,7 +14,8 @@ import {
   installMainWindowCloseLifecycle,
   WINDOW_QUIT_RENDERER_ACK_TIMEOUT_MS
 } from './main-window-close-lifecycle'
-import type { CreateMainWindowOptions } from './main-window-contracts'
+import type { CreateMainWindowOptions, MainWindowLoadObserver } from './main-window-contracts'
+import { mainWindowLoadErrorCode } from './main-window-load-error-code'
 import { installMainWindowFocusLifecycle } from './main-window-focus-lifecycle'
 import { installMainWindowShortcutRouting } from './main-window-shortcut-routing'
 import { installMainWindowStateLifecycle } from './main-window-state-lifecycle'
@@ -33,12 +34,25 @@ import { installWindowsPathRegistryChangeListener } from '../pty/windows-path-re
 
 export { WINDOW_QUIT_RENDERER_ACK_TIMEOUT_MS }
 
-export function loadMainWindow(mainWindow: BrowserWindow): void {
-  if (is.dev && process.env.ELECTRON_RENDERER_URL) {
-    void mainWindow.loadURL(process.env.ELECTRON_RENDERER_URL)
-  } else {
-    void mainWindow.loadFile(join(__dirname, '../renderer/index.html'))
-  }
+export function loadMainWindow(mainWindow: BrowserWindow, observer?: MainWindowLoadObserver): void {
+  const load =
+    is.dev && process.env.ELECTRON_RENDERER_URL
+      ? mainWindow.loadURL(process.env.ELECTRON_RENDERER_URL)
+      : mainWindow.loadFile(join(__dirname, '../renderer/index.html'))
+  // Observe each load promise so failures cannot leave recovery waiting silently.
+  load.then(
+    () => observer?.onLoaded?.(),
+    (cause: unknown) => {
+      const error = cause instanceof Error ? cause : new Error(String(cause))
+      const errorCode = mainWindowLoadErrorCode(error)
+      // Keep durable diagnostics path-free and exclude shutdown/navigation aborts.
+      if (!mainWindow.isDestroyed() && errorCode !== 'ERR_ABORTED') {
+        recordDurableCrashBreadcrumb('main_window_load_failed', { errorCode })
+      }
+      console.error('[window] Main window load failed', error)
+      observer?.onError?.(error)
+    }
+  )
 }
 
 export function createMainWindow(
@@ -158,8 +172,9 @@ export function createMainWindow(
     }
     forceRepaint(mainWindow)
     mainWindow.webContents.send('system:resumed')
+    // Give a suspended recovery load its full budget on wake.
+    focus.notifySystemResume()
   }
-  powerMonitor.on('resume', onSystemResume)
 
   const state = installMainWindowStateLifecycle({
     mainWindow,
@@ -172,9 +187,11 @@ export function createMainWindow(
     isWindowClosing: state.isWindowClosing,
     mainWindow,
     opts,
-    reloadMainWindow: () => loadMainWindow(mainWindow),
+    reloadMainWindow: (observer) => loadMainWindow(mainWindow, observer),
     rendererWebContentsId
   })
+  // Register after focus is initialized because the resume callback uses it.
+  powerMonitor.on('resume', onSystemResume)
   installMainWindowShortcutRouting({ focus, mainWindow, opts, store })
   const closeLifecycle = installMainWindowCloseLifecycle({
     focus,
diff --git a/src/main/window/dashboard-popout-window.test.ts b/src/main/window/dashboard-popout-window.test.ts
index 86735811bb8..0e64d573f76 100644
--- a/src/main/window/dashboard-popout-window.test.ts
+++ b/src/main/window/dashboard-popout-window.test.ts
@@ -171,6 +171,14 @@ function makeStore(ui: Record<string, unknown> = {}): {
 
 const RENDERER_URL = 'http://localhost:5173'
 
+// These cases exercise foreground behavior against Electron mocks.
+beforeEach(() => {
+  vi.stubEnv('ORCA_BACKGROUND_LAUNCH', undefined)
+  vi.stubEnv('ORCA_E2E_HEADLESS', undefined)
+  vi.stubEnv('ORCA_E2E_HEADFUL', undefined)
+})
+afterEach(() => vi.unstubAllEnvs())
+
 describe('createOrFocusDashboardPopout', () => {
   beforeEach(() => {
     instances.length = 0
diff --git a/src/main/window/focus-existing-window.test.ts b/src/main/window/focus-existing-window.test.ts
index babb9a15490..697b423ab37 100644
--- a/src/main/window/focus-existing-window.test.ts
+++ b/src/main/window/focus-existing-window.test.ts
@@ -1,5 +1,5 @@
 import type { App, BrowserWindow } from 'electron'
-import { describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { focusExistingMainWindow } from './focus-existing-window'
 
 type FakeWindowOptions = {
@@ -78,7 +78,38 @@ function makeTimer(): {
   }
 }
 
+// These cases exercise foreground behavior against Electron mocks.
+beforeEach(() => {
+  vi.stubEnv('ORCA_BACKGROUND_LAUNCH', undefined)
+  vi.stubEnv('ORCA_E2E_HEADLESS', undefined)
+  vi.stubEnv('ORCA_E2E_HEADFUL', undefined)
+})
+afterEach(() => vi.unstubAllEnvs())
+
 describe('focusExistingMainWindow', () => {
+  it.each(['darwin', 'linux', 'win32'] as const)(
+    'never restores or activates a background window on %s',
+    (platform) => {
+      vi.stubEnv('ORCA_BACKGROUND_LAUNCH', '1')
+      vi.stubEnv('ORCA_E2E_FOREGROUND', '1')
+      const app = makeFakeApp()
+      const window = makeFakeWindow({ minimized: true })
+      const timer = makeTimer()
+      focusExistingMainWindow({
+        app,
+        getWindow: () => window,
+        openWindow: vi.fn(),
+        platform,
+        setTimeout: timer.setTimeout
+      })
+      expect(app.focus).not.toHaveBeenCalled()
+      for (const call of Object.values(window.calls)) {
+        expect(call).not.toHaveBeenCalled()
+      }
+      expect(timer.scheduledMs()).toEqual([])
+    }
+  )
+
   it('aggressively foregrounds an existing Windows window on second launch', () => {
     const app = makeFakeApp()
     const window = makeFakeWindow()
diff --git a/src/main/window/focus-existing-window.ts b/src/main/window/focus-existing-window.ts
index 4cadb49a743..903e6a8b321 100644
--- a/src/main/window/focus-existing-window.ts
+++ b/src/main/window/focus-existing-window.ts
@@ -1,5 +1,9 @@
 import type { App, BrowserWindow } from 'electron'
-import { isBackgroundLaunch, showWindowWithoutStealingFocus } from './foreground-activation-policy'
+import {
+  isBackgroundLaunch,
+  isWindowlessLaunch,
+  showWindowWithoutStealingFocus
+} from './foreground-activation-policy'
 
 type FocusTimer = (callback: () => void, ms: number) => unknown
 
@@ -34,7 +38,7 @@ function safelyFocusApp(app: Pick<App, 'focus'>): void {
 }
 
 export function safelyRevealWindow(window: BrowserWindow): void {
-  if (window.isDestroyed()) {
+  if (window.isDestroyed() || isWindowlessLaunch()) {
     return
   }
   if (window.isMinimized()) {
diff --git a/src/main/window/foreground-activation-policy.test.ts b/src/main/window/foreground-activation-policy.test.ts
index 0a45f00387e..3b33c9be881 100644
--- a/src/main/window/foreground-activation-policy.test.ts
+++ b/src/main/window/foreground-activation-policy.test.ts
@@ -32,6 +32,10 @@ describe('isBackgroundLaunch', () => {
     expect(isBackgroundLaunch({})).toBe(false)
   })
 
+  it('keeps an explicit background request despite inherited foreground flags', () => {
+    expect(isBackgroundLaunch({ ORCA_BACKGROUND_LAUNCH: '1', ORCA_E2E_FOREGROUND: '1' })).toBe(true)
+  })
+
   it('lets native-focus specs opt back into the foreground', () => {
     expect(isBackgroundLaunch({ ORCA_E2E_HEADFUL: '1', ORCA_E2E_FOREGROUND: '1' })).toBe(false)
     expect(isWindowlessLaunch({ ORCA_E2E_HEADLESS: '1', ORCA_E2E_FOREGROUND: '1' })).toBe(false)
@@ -39,10 +43,17 @@ describe('isBackgroundLaunch', () => {
 })
 
 describe('isWindowlessLaunch', () => {
-  it('is headless-only; a headful run still paints', () => {
+  it('keeps explicit background launches hidden while headful E2E can paint', () => {
     expect(isWindowlessLaunch({ ORCA_E2E_HEADLESS: '1' })).toBe(true)
     expect(isWindowlessLaunch({ ORCA_E2E_HEADLESS: '1', ORCA_E2E_HEADFUL: '1' })).toBe(false)
-    expect(isWindowlessLaunch({ ORCA_BACKGROUND_LAUNCH: '1' })).toBe(false)
+    expect(isWindowlessLaunch({ ORCA_BACKGROUND_LAUNCH: '1' })).toBe(true)
+    expect(
+      isWindowlessLaunch({
+        ORCA_BACKGROUND_LAUNCH: '1',
+        ORCA_E2E_HEADFUL: '1',
+        ORCA_E2E_FOREGROUND: '1'
+      })
+    ).toBe(true)
   })
 })
 
@@ -54,9 +65,16 @@ describe('showWindowWithoutStealingFocus', () => {
     expect(window.showInactive).not.toHaveBeenCalled()
   })
 
-  it('shows a background window without activating it', () => {
+  it('never reveals an explicitly background window', () => {
     const window = makeWindow()
     showWindowWithoutStealingFocus(window, { ORCA_BACKGROUND_LAUNCH: '1' })
+    expect(window.showInactive).not.toHaveBeenCalled()
+    expect(window.show).not.toHaveBeenCalled()
+  })
+
+  it('still reveals explicitly headful E2E without activation', () => {
+    const window = makeWindow()
+    showWindowWithoutStealingFocus(window, { ORCA_E2E_HEADFUL: '1' })
     expect(window.showInactive).toHaveBeenCalledOnce()
     expect(window.show).not.toHaveBeenCalled()
   })
@@ -83,18 +101,21 @@ describe('applyBackgroundActivationPolicy', () => {
     }
   }
 
-  it('drops the macOS Dock tile and menu bar for headless runs', () => {
-    const app = makeApp()
-    expect(
-      applyBackgroundActivationPolicy({
-        app,
-        env: { ORCA_E2E_HEADLESS: '1' },
-        platform: 'darwin'
-      })
-    ).toBe(true)
-    expect(app.dock.hide).toHaveBeenCalledOnce()
-    expect(app.setActivationPolicy).toHaveBeenCalledWith('accessory')
-  })
+  it.each(['ORCA_E2E_HEADLESS', 'ORCA_BACKGROUND_LAUNCH'])(
+    'drops the macOS Dock tile and menu bar for %s',
+    (flag) => {
+      const app = makeApp()
+      expect(
+        applyBackgroundActivationPolicy({
+          app,
+          env: { [flag]: '1' },
+          platform: 'darwin'
+        })
+      ).toBe(true)
+      expect(app.dock.hide).toHaveBeenCalledOnce()
+      expect(app.setActivationPolicy).toHaveBeenCalledWith('accessory')
+    }
+  )
 
   it('leaves a headful or user launch with its normal Dock presence', () => {
     const headful = makeApp()
diff --git a/src/main/window/foreground-activation-policy.ts b/src/main/window/foreground-activation-policy.ts
index c2ee6b19e73..5d51f50e487 100644
--- a/src/main/window/foreground-activation-policy.ts
+++ b/src/main/window/foreground-activation-policy.ts
@@ -5,8 +5,8 @@ import { app as electronApp, type BrowserWindow } from 'electron'
  * validation). These runs may use the machine, but must never take the OS
  * foreground away from whatever the developer is doing.
  *
- * ORCA_BACKGROUND_LAUNCH=1 opts a normal launch in; ORCA_E2E_FOREGROUND=1 opts
- * back out for the few specs whose subject *is* native focus (IME, key events).
+ * ORCA_BACKGROUND_LAUNCH=1 keeps automation off screen. Native-focus specs
+ * can use ORCA_E2E_FOREGROUND=1 only without an explicit background request.
  */
 
 type ActivationPolicyApp = {
@@ -19,19 +19,21 @@ type PolicyEnv = Readonly<Record<string, string | undefined>>
 
 /** True when this process must not steal focus, raise windows, or activate the app. */
 export function isBackgroundLaunch(env: PolicyEnv = process.env): boolean {
+  if (env.ORCA_BACKGROUND_LAUNCH === '1') {
+    return true
+  }
   if (env.ORCA_E2E_FOREGROUND === '1') {
     return false
   }
-  return (
-    env.ORCA_BACKGROUND_LAUNCH === '1' ||
-    env.ORCA_E2E_HEADLESS === '1' ||
-    env.ORCA_E2E_HEADFUL === '1'
-  )
+  return env.ORCA_E2E_HEADLESS === '1' || env.ORCA_E2E_HEADFUL === '1'
 }
 
-/** True when no window should reach the screen at all (headless E2E; Playwright drives via CDP). */
+/** True when no window should reach the screen at all (background or headless E2E; Playwright drives via CDP). */
 export function isWindowlessLaunch(env: PolicyEnv = process.env): boolean {
-  return isBackgroundLaunch(env) && env.ORCA_E2E_HEADLESS === '1' && env.ORCA_E2E_HEADFUL !== '1'
+  return (
+    env.ORCA_BACKGROUND_LAUNCH === '1' ||
+    (isBackgroundLaunch(env) && env.ORCA_E2E_HEADLESS === '1' && env.ORCA_E2E_HEADFUL !== '1')
+  )
 }
 
 /**
@@ -63,7 +65,7 @@ export function applyBackgroundActivationPolicy(
 
 /**
  * Reveal a window without taking the foreground: hidden entirely when windowless,
- * `showInactive()` (visible, not raised over the active app) in background launches.
+ * `showInactive()` for explicitly headful E2E runs.
  */
 export function showWindowWithoutStealingFocus(
   window: BrowserWindow,
diff --git a/src/main/window/main-window-contracts.ts b/src/main/window/main-window-contracts.ts
index ce5c6cfe0b2..5135be0fbe6 100644
--- a/src/main/window/main-window-contracts.ts
+++ b/src/main/window/main-window-contracts.ts
@@ -1,4 +1,15 @@
 import type { KeybindingOverrides } from '../../shared/keybindings'
+import type {
+  RecoveryExhaustionCause,
+  RecoveryReloadMilestone,
+  RecoveryReloadTrigger
+} from './renderer-recovery-reload-watchdog'
+
+/** Per-load outcome from Electron's load promise, which is scoped to that one load unlike `did-finish-load`. */
+export type MainWindowLoadObserver = {
+  onLoaded?: () => void
+  onError?: (error: Error) => void
+}
 
 export type CreateMainWindowOptions = {
   /** Returns true when a manual app.quit() (Cmd+Q) is in progress, so the renderer skips the running-process confirm dialog. */
@@ -14,11 +25,14 @@ export type CreateMainWindowOptions = {
     details: Electron.RenderProcessGoneDetails,
     webContentsId: number
   ) => boolean
-  /** Called when consecutive auto-recoveries hit the circuit-breaker limit so the host can prompt instead of crash-looping. */
+  /** Called when auto-recovery gives up — the breaker opened, or the recovery reload never produced a document. */
   onRendererRecoveryExhausted?: (info: {
     details: Electron.RenderProcessGoneDetails
     webContentsId: number
     recentRecoveryCount: number
+    cause?: RecoveryExhaustionCause
+    /** Watched manual retry for the recovery prompt; an unwatched one cannot re-raise the prompt when it stalls too. */
+    retry?: () => void
   }) => void
   /** Defer renderer load until IPC handlers are registered, or eager renderer calls race into missing channels. */
   deferLoad?: boolean
@@ -27,6 +41,24 @@ export type CreateMainWindowOptions = {
   title?: string
   getKeybindings?: () => KeybindingOverrides | undefined
   onBeforeReload?: (options: { ignoreCache: boolean; webContentsId: number }) => void
-  /** Marks the in-place recovery reload so did-finish-load's PTY orphan sweep spares live sessions until restore re-attaches (#5787). */
-  onBeforeRecoveryReload?: (webContentsId: number) => void
+  /**
+   * Marks the in-place recovery reload so did-finish-load's PTY orphan sweep spares live sessions until restore
+   * re-attaches (#5787). The prompt's manual Reload is one too, so `trigger` keeps the automatic-recovery
+   * breadcrumb counting only automatic recoveries.
+   */
+  onBeforeRecoveryReload?: (webContentsId: number, trigger: RecoveryReloadTrigger) => void
+  /** Pairs an outcome with the recovery-reload intent crumb: bundles could not tell a landed reload from a stalled one. */
+  onRecoveryReloadOutcome?: (outcome: {
+    status: 'loaded' | 'timeout' | 'failed'
+    attempt: number
+    elapsedMs: number
+    /** How far the load got: 'none' is the blank-window field failure, anything else a document that then hung. */
+    progress?: RecoveryReloadMilestone
+    /** True when the load landed after the recovery prompt was already raised — the recovery worked. */
+    afterPrompt?: boolean
+    /** True when a later navigation replaced this load: elapsedMs then measures the replacement, not the reload. */
+    superseded?: boolean
+    /** `ERR_*` code only, for the same reason — Electron's load-error message embeds the URL. */
+    errorCode?: string
+  }) => void
 }
diff --git a/src/main/window/main-window-focus-lifecycle.ts b/src/main/window/main-window-focus-lifecycle.ts
index a021d464d15..d494992e692 100644
--- a/src/main/window/main-window-focus-lifecycle.ts
+++ b/src/main/window/main-window-focus-lifecycle.ts
@@ -14,13 +14,14 @@ import {
   matchingRichMarkdownContextMenuTableTarget,
   parseRichMarkdownContextMenuTableTarget
 } from './editable-context-menu'
-import type { CreateMainWindowOptions } from './main-window-contracts'
+import type { CreateMainWindowOptions, MainWindowLoadObserver } from './main-window-contracts'
 import { browserRouteWebContentsRegistry } from '../browser/browser-route-session-runtime'
 import {
   attachBrowserClientPageRenderer,
   retireBrowserClientPageRenderer
 } from '../browser/browser-client-page-renderer-runtime'
 import { registerRendererDocumentNavigation } from './renderer-document-navigation'
+import { createRendererRecoveryReloadWatchdog } from './renderer-recovery-reload-watchdog'
 
 export type MainWindowFocusLifecycle = {
   dispose: () => void
@@ -30,13 +31,15 @@ export type MainWindowFocusLifecycle = {
   isRendererProcessGone: () => boolean
   isShortcutRecorderFocused: () => boolean
   isTerminalInputFocused: () => boolean
+  /** Relays powerMonitor 'resume' so a suspend-frozen recovery-reload timer does not fire against an unbudgeted load. */
+  notifySystemResume: () => void
 }
 
 export function installMainWindowFocusLifecycle(args: {
   isWindowClosing: () => boolean
   mainWindow: BrowserWindow
   opts?: CreateMainWindowOptions
-  reloadMainWindow: () => void
+  reloadMainWindow: (observer: MainWindowLoadObserver) => void
   rendererWebContentsId: number
 }): MainWindowFocusLifecycle {
   const { isWindowClosing, mainWindow, opts, reloadMainWindow, rendererWebContentsId } = args
@@ -162,6 +165,16 @@ export function installMainWindowFocusLifecycle(args: {
       rendererRecoveryTimer = null
     }
   }
+  // Why: the reload can stall with a live window and no document — no did-fail-load fires, and the breaker counts
+  // renderer deaths, so a load that never lands is invisible to every other observer on this path.
+  const recoveryReloadWatchdog = createRendererRecoveryReloadWatchdog({
+    isRecoveryPending: () => rendererRecoveryTimer !== null,
+    isWindowClosing,
+    mainWindow,
+    opts,
+    reloadMainWindow,
+    rendererWebContentsId
+  })
   const scheduleRendererRecovery = (details: Electron.RenderProcessGoneDetails): void => {
     if (
       rendererRecoveryTimer ||
@@ -187,17 +200,16 @@ export function installMainWindowFocusLifecycle(args: {
       const recovery = rendererRecoveryCircuitBreaker.registerRecoveryAttempt(Date.now())
       if (!recovery.allowed) {
         // Why: too many reloads means it will just crash again; stop and let the host surface a recovery prompt.
-        opts?.onRendererRecoveryExhausted?.({
-          details,
-          webContentsId: rendererWebContentsId,
-          recentRecoveryCount: recovery.recentRecoveryCount
-        })
+        // Why through the watchdog: it owns the one-prompt-at-a-time guard, and the prompt's manual retry is a
+        // recovery reload too — unwatched, one that stalls leaves a blank window and no further prompt.
+        recoveryReloadWatchdog.escalate(
+          { details, recentRecoveryCount: recovery.recentRecoveryCount },
+          'crash-loop'
+        )
         return
       }
       // Why: a transient renderer/Network Service loss can blank Chromium; reload the app document once to recover.
-      // Why: mark this in-place reload so the did-finish-load orphan sweep spares live PTYs until session restore (#5787).
-      opts?.onBeforeRecoveryReload?.(mainWindow.webContents.id)
-      reloadMainWindow()
+      recoveryReloadWatchdog.issue(details, recovery.recentRecoveryCount)
     }, 250)
   }
   mainWindow.webContents.on('render-process-gone', (_event, details) => {
@@ -229,6 +241,7 @@ export function installMainWindowFocusLifecycle(args: {
     rendererProcessGone = false
     attachBrowserClientPageRenderer(rendererWebContents)
     clearRendererRecoveryTimer()
+    recoveryReloadWatchdog.notifyDocumentLoaded()
   })
 
   const dispose = (): void => {
@@ -237,6 +250,7 @@ export function installMainWindowFocusLifecycle(args: {
     resetFloatingTerminalInputFocus()
     resetShortcutRecorderFocus()
     clearRendererRecoveryTimer()
+    recoveryReloadWatchdog.clear()
     ipcMain.removeListener(markdownFocusChannel, onMarkdownEditorFocused)
     ipcMain.removeListener(terminalInputFocusChannel, onTerminalInputFocused)
     ipcMain.removeListener(floatingFocusChannel, onFloatingFocus)
@@ -250,6 +264,7 @@ export function installMainWindowFocusLifecycle(args: {
     isMarkdownEditorFocused: () => markdownEditorFocused,
     isRendererProcessGone: () => rendererProcessGone,
     isShortcutRecorderFocused: () => shortcutRecorderFocused,
-    isTerminalInputFocused: () => terminalInputFocused
+    isTerminalInputFocused: () => terminalInputFocused,
+    notifySystemResume: recoveryReloadWatchdog.notifySystemResume
   }
 }
diff --git a/src/main/window/main-window-load-error-code.ts b/src/main/window/main-window-load-error-code.ts
new file mode 100644
index 00000000000..6dd9a79e6d8
--- /dev/null
+++ b/src/main/window/main-window-load-error-code.ts
@@ -0,0 +1,12 @@
+// Record only the ERR_* code: Electron error messages embed private install URLs.
+export function mainWindowLoadErrorCode(error: unknown): string {
+  const code =
+    typeof error === 'object' && error !== null && 'code' in error && typeof error.code === 'string'
+      ? error.code
+      : undefined
+  if (code && /^ERR_[A-Z0-9_]+$/.test(code)) {
+    return code
+  }
+  const message = error instanceof Error ? error.message : String(error)
+  return /\bERR_[A-Z0-9_]+/.exec(message)?.[0] ?? 'unknown'
+}
diff --git a/src/main/window/main-window-webview-security.ts b/src/main/window/main-window-webview-security.ts
index da6e4159a58..a662449eb58 100644
--- a/src/main/window/main-window-webview-security.ts
+++ b/src/main/window/main-window-webview-security.ts
@@ -111,7 +111,7 @@ export function installMainWindowWebviewSecurity(mainWindow: BrowserWindow): voi
 
   mainWindow.webContents.on('did-attach-webview', (_event, guest) => {
     if (isDocPreviewSession(guest.session)) {
-      // Why: preview guests never join browser-tab routing, popups or anti-detection; the
+      // Why: preview guests never join browser-tab routing, popups or auth-identity tracking; the
       // workspace-doc profile is what refuses all three. The attach is also the point a live window
       // exists to receive read failures for that guest.
       setDocPreviewFailureSink(mainWindow.webContents)
diff --git a/src/main/window/renderer-recovery-prompt.test.ts b/src/main/window/renderer-recovery-prompt.test.ts
index d5bd7ce11c1..a26700720eb 100644
--- a/src/main/window/renderer-recovery-prompt.test.ts
+++ b/src/main/window/renderer-recovery-prompt.test.ts
@@ -1,11 +1,14 @@
 import type { MessageBoxOptions, MessageBoxReturnValue } from 'electron'
-import { describe, expect, it, vi } from 'vitest'
+import { beforeEach, afterEach, describe, expect, it, vi } from 'vitest'
+import { ensureMainI18n, mainI18n } from '../i18n/main-i18n'
 import type { InstallDirAclPoisonDiagnosis } from '../startup/windows-install-dir-acl-recovery'
 import {
   presentRendererRecoveryPrompt,
   type RendererRecoveryPromptDeps
 } from './renderer-recovery-prompt'
 
+vi.mock('electron', () => ({ app: { getLocale: () => 'en-US' } }))
+
 const POISON: InstallDirAclPoisonDiagnosis = {
   detail: "Windows permissions on Orca's install folder are blocking its own sandboxed processes.",
   commands: ['icacls "C:\\Orca" /grant "*S-1-15-2-2:(OI)(CI)(RX)"', 'icacls "C:\\Orca" /grant b']
@@ -43,17 +46,60 @@ function harness(overrides: Partial<RendererRecoveryPromptDeps> & { responses?:
 }
 
 describe('presentRendererRecoveryPrompt', () => {
+  beforeEach(async () => {
+    await ensureMainI18n()
+    await mainI18n.changeLanguage('en')
+  })
+
+  afterEach(() => {
+    mainI18n.removeResourceBundle('en', 'translation')
+  })
+
+  it('interpolates the recovery count', async () => {
+    const { run, shown } = harness({ recentRecoveryCount: 7 })
+    await run()
+    expect(shown[0].detail).toContain('Orca tried to recover 7 times in a row')
+    expect(shown[0].detail).not.toContain('{{')
+  })
+
+  it.each([
+    { responses: [1, 0], reloads: 1, quits: 0 },
+    { responses: [1, 2], reloads: 0, quits: 1 }
+  ])(
+    'dispatches translated buttons by response index: $responses',
+    async ({ responses, reloads, quits }) => {
+      mainI18n.addResourceBundle('en', 'translation', {
+        rendererRecovery: { reload: 'Recharger', copyCommands: 'Copier', quit: 'Quitter' }
+      })
+      const { run, shown, copied, reload, quit } = harness({ diagnose: () => POISON, responses })
+      await run()
+      expect(shown[0].buttons).toEqual(['Recharger', 'Copier', 'Quitter'])
+      expect(copied).toEqual([POISON.commands.join('\r\n')])
+      expect(reload).toHaveBeenCalledTimes(reloads)
+      expect(quit).toHaveBeenCalledTimes(quits)
+    }
+  )
+
   it('offers reload and quit with the generic cause when nothing is diagnosed', async () => {
     const { run, shown, reload, quit } = harness({ responses: [0] })
     await run()
     expect(shown).toHaveLength(1)
     expect(shown[0].buttons).toEqual(['Reload', 'Quit'])
-    expect(shown[0].cancelId).toBe(1)
+    // Escape lands on cancelId, and this box is window-modal over the window it is about: it must not quit.
+    expect(shown[0].cancelId).toBe(0)
     expect(shown[0].detail).toContain('graphics-driver or installation problem')
     expect(reload).toHaveBeenCalledOnce()
     expect(quit).not.toHaveBeenCalled()
   })
 
+  it('names the stalled reload instead of claiming a repeated crash', async () => {
+    const { run, shown } = harness({ failure: 'reload-stalled', responses: [1] })
+    await run()
+    expect(shown[0].message).toContain('stopped responding while reloading')
+    expect(shown[0].detail).toContain('never finished loading')
+    expect(shown[0].detail).not.toContain('times in a row')
+  })
+
   it('quits on the last button', async () => {
     const { run, reload, quit } = harness({ responses: [1] })
     await run()
@@ -65,7 +111,7 @@ describe('presentRendererRecoveryPrompt', () => {
     const { run, shown } = harness({ diagnose: () => POISON, responses: [0] })
     await run()
     expect(shown[0].buttons).toEqual(['Reload', 'Copy Commands', 'Quit'])
-    expect(shown[0].cancelId).toBe(2)
+    expect(shown[0].cancelId).toBe(0)
     expect(shown[0].detail).toContain(POISON.detail)
     expect(shown[0].detail).toContain('graphics driver')
   })
diff --git a/src/main/window/renderer-recovery-prompt.ts b/src/main/window/renderer-recovery-prompt.ts
index 2026d1f10b5..18ab02a8eca 100644
--- a/src/main/window/renderer-recovery-prompt.ts
+++ b/src/main/window/renderer-recovery-prompt.ts
@@ -1,19 +1,13 @@
 import type { MessageBoxOptions, MessageBoxReturnValue } from 'electron'
+import { translateMain } from '../i18n/main-i18n'
 import type { InstallDirAclPoisonDiagnosis } from '../startup/windows-install-dir-acl-recovery'
+import type { RecoveryExhaustionCause } from './renderer-recovery-reload-watchdog'
 
-/**
- * The dialog shown when the renderer crash-loop breaker opens: the window is
- * blank by then, so this is the only retry/quit surface the user has.
- */
-
-const GENERIC_DETAIL =
-  'This is often a graphics-driver or installation problem. Reload to try again, or quit and relaunch Orca.'
-// Why keep it alongside the ACL diagnosis: the probe cannot name-check every
-// locale, so a driver crash on a healthy install must not lose its only hint.
-const DRIVER_FALLBACK = 'If that does not help, the cause is usually a graphics driver.'
+export type RendererRecoveryPromptFailure = RecoveryExhaustionCause
 
 export type RendererRecoveryPromptDeps = {
   recentRecoveryCount: number
+  failure?: RendererRecoveryPromptFailure
   isQuitting: () => boolean
   diagnose: () => InstallDirAclPoisonDiagnosis | null
   showMessageBox: (options: MessageBoxOptions) => Promise<MessageBoxReturnValue>
@@ -25,29 +19,59 @@ export type RendererRecoveryPromptDeps = {
 export async function presentRendererRecoveryPrompt(
   deps: RendererRecoveryPromptDeps
 ): Promise<void> {
-  // Why a loop: copying the commands must not dismiss the only surface offering them.
+  const stalled = deps.failure === 'reload-stalled'
+  // Copying must preserve the only available recovery surface.
   while (!deps.isQuitting()) {
     const diagnosis = deps.diagnose()
-    const buttons = diagnosis ? ['Reload', 'Copy Commands', 'Quit'] : ['Reload', 'Quit']
+    const buttons = [translateMain('rendererRecovery.reload', 'Reload')]
+    if (diagnosis) {
+      buttons.push(translateMain('rendererRecovery.copyCommands', 'Copy Commands'))
+    }
+    buttons.push(translateMain('rendererRecovery.quit', 'Quit'))
+    const recoveryDetail = stalled
+      ? translateMain(
+          'rendererRecovery.stalledDetail',
+          'Orca reloaded the window after a crash, but it never finished loading.'
+        )
+      : translateMain(
+          'rendererRecovery.crashLoopDetail',
+          'Orca tried to recover {{recoveryCount}} times in a row without success.',
+          { recoveryCount: deps.recentRecoveryCount }
+        )
+    const causeDetail = diagnosis
+      ? `${diagnosis.detail}\n\n${translateMain(
+          'rendererRecovery.driverFallback',
+          'If that does not help, the cause is usually a graphics driver.'
+        )}`
+      : translateMain(
+          'rendererRecovery.genericDetail',
+          'This is often a graphics-driver or installation problem. Reload to try again, or quit and relaunch Orca.'
+        )
     const { response } = await deps.showMessageBox({
       type: 'error',
       buttons,
       defaultId: 0,
-      cancelId: buttons.length - 1,
-      title: 'Orca keeps failing to load',
-      message: 'The app window crashed repeatedly and stopped reloading automatically.',
-      detail: `Orca tried to recover ${deps.recentRecoveryCount} times in a row without success.\n\n${
-        diagnosis ? `${diagnosis.detail}\n\n${DRIVER_FALLBACK}` : GENERIC_DETAIL
-      }`
+      // Escape retries instead of destroying the session.
+      cancelId: 0,
+      title: translateMain('rendererRecovery.title', 'Orca keeps failing to load'),
+      message: stalled
+        ? translateMain(
+            'rendererRecovery.stalledMessage',
+            'The app window stopped responding while reloading after a crash.'
+          )
+        : translateMain(
+            'rendererRecovery.crashLoopMessage',
+            'The app window crashed repeatedly and stopped reloading automatically.'
+          ),
+      detail: `${recoveryDetail}\n\n${causeDetail}`
     })
-    const choice = buttons[response]
-    if (choice === 'Copy Commands' && diagnosis) {
+    if (response === 1 && diagnosis) {
       deps.copyToClipboard(diagnosis.commands.join('\r\n'))
       continue
     }
-    if (choice === 'Reload') {
+    if (response === 0) {
       deps.reload()
-    } else if (choice === 'Quit') {
+    } else if (response === buttons.length - 1) {
       deps.quit()
     }
     return
diff --git a/src/main/window/renderer-recovery-reload-watchdog.test.ts b/src/main/window/renderer-recovery-reload-watchdog.test.ts
new file mode 100644
index 00000000000..b6e854bbbf1
--- /dev/null
+++ b/src/main/window/renderer-recovery-reload-watchdog.test.ts
@@ -0,0 +1,136 @@
+import { EventEmitter } from 'node:events'
+import type { BrowserWindow } from 'electron'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { MainWindowLoadObserver } from './main-window-contracts'
+import {
+  createRendererRecoveryReloadWatchdog,
+  RENDERER_RECOVERY_LOAD_TIMEOUT_MS
+} from './renderer-recovery-reload-watchdog'
+
+vi.mock('@electron-toolkit/utils', () => ({ is: { dev: false } }))
+
+function createHarness() {
+  const webContents = Object.assign(new EventEmitter(), { id: 143 })
+  const mainWindow = { webContents, isDestroyed: () => false } as unknown as BrowserWindow
+  const loads: MainWindowLoadObserver[] = []
+  const onRecoveryReloadOutcome = vi.fn()
+  const onRendererRecoveryExhausted = vi.fn()
+  const watchdog = createRendererRecoveryReloadWatchdog({
+    mainWindow,
+    rendererWebContentsId: webContents.id,
+    isRecoveryPending: () => false,
+    isWindowClosing: () => false,
+    reloadMainWindow: (observer) => loads.push(observer),
+    opts: { onRecoveryReloadOutcome, onRendererRecoveryExhausted }
+  })
+  const abortLatestLoad = () => loads.at(-1)?.onError?.(new Error('ERR_ABORTED (-3)'))
+  watchdog.issue({ reason: 'crashed', exitCode: 5 }, 1)
+  return {
+    watchdog,
+    webContents,
+    loads,
+    abortLatestLoad,
+    onRecoveryReloadOutcome,
+    onRendererRecoveryExhausted
+  }
+}
+
+describe('superseding recovery navigations', () => {
+  beforeEach(() => vi.useFakeTimers())
+  afterEach(() => vi.useRealTimers())
+
+  it('removes listeners and the pending stall timer during teardown', () => {
+    const { watchdog, webContents, loads, onRecoveryReloadOutcome } = createHarness()
+    expect(webContents.eventNames().sort()).toEqual(['did-fail-load', 'did-navigate', 'dom-ready'])
+    expect(vi.getTimerCount()).toBe(1)
+    watchdog.clear()
+    expect(webContents.eventNames()).toEqual([])
+    expect(vi.getTimerCount()).toBe(0)
+    loads[0]?.onLoaded?.()
+    loads[0]?.onError?.(new Error('ERR_FILE_NOT_FOUND'))
+    watchdog.notifySystemResume()
+    expect(onRecoveryReloadOutcome).not.toHaveBeenCalled()
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('does not mistake a replacement error page for recovery', () => {
+    const {
+      watchdog,
+      webContents,
+      abortLatestLoad,
+      onRecoveryReloadOutcome,
+      onRendererRecoveryExhausted
+    } = createHarness()
+    abortLatestLoad()
+    webContents.emit('did-navigate')
+    webContents.emit('did-fail-load', {}, -6, 'ERR_FILE_NOT_FOUND', 'file:///missing', true)
+    watchdog.notifyDocumentLoaded()
+
+    expect(onRecoveryReloadOutcome).not.toHaveBeenCalledWith(
+      expect.objectContaining({ status: 'loaded' })
+    )
+    expect(onRendererRecoveryExhausted).toHaveBeenCalledOnce()
+    expect(onRecoveryReloadOutcome).toHaveBeenCalledWith(
+      expect.objectContaining({ status: 'failed', errorCode: 'ERR_FILE_NOT_FOUND' })
+    )
+    watchdog.clear()
+  })
+
+  it('ignores subframe failures and aborted replacement navigations', () => {
+    const { watchdog, webContents, abortLatestLoad, onRecoveryReloadOutcome } = createHarness()
+    abortLatestLoad()
+    webContents.emit('did-fail-load', {}, -6, 'ERR_FILE_NOT_FOUND', 'file:///missing', false)
+    webContents.emit('did-fail-load', {}, -3, 'ERR_ABORTED', 'file:///previous', true)
+    watchdog.notifyDocumentLoaded()
+    expect(onRecoveryReloadOutcome).toHaveBeenCalledWith(
+      expect.objectContaining({ status: 'loaded', superseded: true })
+    )
+    watchdog.clear()
+  })
+
+  it('keeps Reload available if the replacement fails beneath an existing prompt', () => {
+    const {
+      watchdog,
+      webContents,
+      loads,
+      abortLatestLoad,
+      onRecoveryReloadOutcome,
+      onRendererRecoveryExhausted
+    } = createHarness()
+    abortLatestLoad()
+    webContents.emit('did-navigate')
+    vi.advanceTimersByTime(RENDERER_RECOVERY_LOAD_TIMEOUT_MS * 2)
+    expect(onRendererRecoveryExhausted).toHaveBeenCalledOnce()
+    webContents.emit('did-fail-load', {}, -6, 'ERR_FILE_NOT_FOUND', 'file:///missing', true)
+    watchdog.notifyDocumentLoaded()
+    expect(onRecoveryReloadOutcome).not.toHaveBeenCalledWith(
+      expect.objectContaining({ status: 'loaded' })
+    )
+    onRendererRecoveryExhausted.mock.calls[0]?.[0].retry()
+    expect(loads).toHaveLength(2)
+    expect(onRendererRecoveryExhausted).toHaveBeenCalledOnce()
+    watchdog.clear()
+  })
+
+  it('recognizes a successful replacement started after the stall prompt', () => {
+    const {
+      watchdog,
+      loads,
+      abortLatestLoad,
+      onRecoveryReloadOutcome,
+      onRendererRecoveryExhausted
+    } = createHarness()
+    vi.advanceTimersByTime(RENDERER_RECOVERY_LOAD_TIMEOUT_MS * 2)
+    expect(onRendererRecoveryExhausted).toHaveBeenCalledOnce()
+    abortLatestLoad()
+    watchdog.notifyDocumentLoaded()
+    expect(onRecoveryReloadOutcome).toHaveBeenCalledWith(
+      expect.objectContaining({ status: 'loaded', superseded: true, afterPrompt: true })
+    )
+    onRendererRecoveryExhausted.mock.calls[0]?.[0].retry()
+    expect(loads).toHaveLength(2)
+    vi.advanceTimersByTime(RENDERER_RECOVERY_LOAD_TIMEOUT_MS * 2)
+    expect(onRendererRecoveryExhausted).toHaveBeenCalledOnce()
+    watchdog.clear()
+  })
+})
diff --git a/src/main/window/renderer-recovery-reload-watchdog.ts b/src/main/window/renderer-recovery-reload-watchdog.ts
new file mode 100644
index 00000000000..1295ca13ac4
--- /dev/null
+++ b/src/main/window/renderer-recovery-reload-watchdog.ts
@@ -0,0 +1,310 @@
+import { is } from '@electron-toolkit/utils'
+import type { BrowserWindow } from 'electron'
+import { isSystemSessionEnding } from '../crash-reporting/expected-teardown-state'
+import type { CreateMainWindowOptions, MainWindowLoadObserver } from './main-window-contracts'
+import { mainWindowLoadErrorCode } from './main-window-load-error-code'
+
+// Field recoveries took up to 30.4s; allow 45s before retrying a load with no document.
+export const RENDERER_RECOVERY_LOAD_TIMEOUT_MS = 45_000
+// Vite cold starts need a longer budget than packaged files.
+export const RENDERER_RECOVERY_DEV_LOAD_TIMEOUT_MS = 180_000
+// Retry once before handing recovery back to the user.
+const RENDERER_RECOVERY_LOAD_ATTEMPTS = 2
+// Milestones may extend the budget, but cannot postpone the prompt indefinitely.
+const RENDERER_RECOVERY_LOAD_CAP_FACTOR = 2
+
+/** Automatic recovery vs the prompt's manual Reload; they must not share one breadcrumb name. */
+export type RecoveryReloadTrigger = 'automatic' | 'manual-retry'
+
+/** How far a load got. Ranked, so an attempt's milestone only ever moves forward. */
+export type RecoveryReloadMilestone = 'none' | 'committed' | 'dom-ready'
+const MILESTONE_RANK: Record<RecoveryReloadMilestone, number> = {
+  none: 0,
+  committed: 1,
+  'dom-ready': 2
+}
+
+export type RecoveryExhaustionCause = 'crash-loop' | 'reload-stalled'
+
+export type RendererRecoveryReloadWatchdog = {
+  /** Issues a recovery reload and arms the stall watchdog. */
+  issue: (
+    details: Electron.RenderProcessGoneDetails,
+    recentRecoveryCount: number,
+    trigger?: RecoveryReloadTrigger
+  ) => void
+  /** Raises the recovery prompt at most once: a native message box cannot be dismissed, so a second one stacks. */
+  escalate: (subject: RecoveryPromptSubject, cause: RecoveryExhaustionCause) => void
+  /**
+   * A main-frame document finished loading. Only an attempt whose load was superseded takes this as its outcome;
+   * every other attempt settles through its own load promise, which an error page or a later navigation cannot fool.
+   */
+  notifyDocumentLoaded: () => void
+  /** Restarts the stall budget after a suspend froze the timer mid-load. */
+  notifySystemResume: () => void
+  clear: () => void
+}
+
+type RecoveryReload = {
+  attempt: number
+  details: Electron.RenderProcessGoneDetails
+  recentRecoveryCount: number
+  /** Never rewritten: the elapsedMs a crash bundle reads has to stay time-since-issue. */
+  issuedAt: number
+  /** Absolute deadline. A suspend pushes it out; a milestone cannot. */
+  capAt: number
+  milestone: RecoveryReloadMilestone
+  progressedSinceArm: boolean
+  /** Chromium aborted this load for a later navigation, which now owns the outcome. */
+  superseded: boolean
+}
+
+type RecoveryReloadSeed = Pick<RecoveryReload, 'attempt' | 'details' | 'recentRecoveryCount'>
+/** What a raised prompt is about; the crash-loop breaker has no attempt to hand over, only the crash. */
+export type RecoveryPromptSubject = Pick<RecoveryReload, 'details' | 'recentRecoveryCount'>
+
+/** Bounds stalled recovery reloads while still observing success after escalation. */
+export function createRendererRecoveryReloadWatchdog(args: {
+  /** True when a renderer death has already queued its own recovery, which then owns the next load. */
+  isRecoveryPending: () => boolean
+  isWindowClosing: () => boolean
+  mainWindow: BrowserWindow
+  opts?: CreateMainWindowOptions
+  reloadMainWindow: (observer: MainWindowLoadObserver) => void
+  rendererWebContentsId: number
+}): RendererRecoveryReloadWatchdog {
+  const {
+    isRecoveryPending,
+    isWindowClosing,
+    mainWindow,
+    opts,
+    reloadMainWindow,
+    rendererWebContentsId
+  } = args
+  // Cache before teardown: accessing a destroyed window's webContents throws.
+  const rendererWebContents = mainWindow.webContents
+  let inFlight: RecoveryReload | null = null
+  // Retain timed-out loads so a late success can disarm the prompt's Reload.
+  let latest: RecoveryReload | null = null
+  // Keep one prompt until answered; native message boxes cannot be dismissed programmatically.
+  let prompt: RecoveryPromptSubject | null = null
+  let documentLanded = false
+  let timer: ReturnType<typeof setTimeout> | null = null
+
+  const clearTimer = (): void => {
+    if (timer) {
+      clearTimeout(timer)
+      timer = null
+    }
+  }
+  // Match loadMainWindow's dev/prod branch.
+  const timeoutMs = (): number =>
+    is.dev && process.env.ELECTRON_RENDERER_URL
+      ? RENDERER_RECOVERY_DEV_LOAD_TIMEOUT_MS
+      : RENDERER_RECOVERY_LOAD_TIMEOUT_MS
+
+  const armTimer = (reload: RecoveryReload): void => {
+    clearTimer()
+    reload.progressedSinceArm = false
+    timer = setTimeout(
+      () => onBudgetExpired(reload),
+      Math.max(0, Math.min(timeoutMs(), reload.capAt - Date.now()))
+    )
+    timer.unref?.()
+  }
+
+  const onBudgetExpired = (reload: RecoveryReload): void => {
+    if (inFlight !== reload) {
+      return
+    }
+    // Give a progressing load the remaining budget instead of restarting it cold.
+    if (reload.progressedSinceArm && Date.now() < reload.capAt) {
+      armTimer(reload)
+      return
+    }
+    fail(reload)
+  }
+
+  const start = (seed: RecoveryReloadSeed, trigger: RecoveryReloadTrigger): void => {
+    const issuedAt = Date.now()
+    const reload: RecoveryReload = {
+      ...seed,
+      issuedAt,
+      capAt: issuedAt + timeoutMs() * RENDERER_RECOVERY_LOAD_CAP_FACTOR,
+      milestone: 'none',
+      progressedSinceArm: false,
+      superseded: false
+    }
+    inFlight = reload
+    latest = reload
+    documentLanded = false
+    // Preserve live PTYs until renderer session restore (#5787).
+    opts?.onBeforeRecoveryReload?.(mainWindow.webContents.id, trigger)
+    // Only this load's promise distinguishes success from stale events and error pages.
+    reloadMainWindow({
+      onLoaded: () => settleLoaded(reload),
+      onError: (error) => onLoadRejected(reload, mainWindowLoadErrorCode(error))
+    })
+    armTimer(reload)
+  }
+
+  const settleLoaded = (reload: RecoveryReload): void => {
+    // A replaced attempt's promise may resolve on the replacement document.
+    if (reload !== latest) {
+      return
+    }
+    latest = null
+    documentLanded = true
+    if (reload === inFlight) {
+      inFlight = null
+      clearTimer()
+    }
+    opts?.onRecoveryReloadOutcome?.({
+      status: 'loaded',
+      attempt: reload.attempt,
+      elapsedMs: Math.max(0, Date.now() - reload.issuedAt),
+      // Record late recovery even if the prompt has already appeared.
+      ...(prompt ? { afterPrompt: true } : {}),
+      // Replacement timings must be excluded from recovery-load budget analysis.
+      ...(reload.superseded ? { superseded: true } : {})
+    })
+  }
+
+  // ERR_ABORTED transfers ownership to a replacement; the cap still bounds a silent replacement.
+  const onLoadRejected = (reload: RecoveryReload, errorCode: string): void => {
+    if (errorCode !== 'ERR_ABORTED') {
+      fail(reload, errorCode)
+      return
+    }
+    if (latest !== reload) {
+      return
+    }
+    reload.superseded = true
+    if (inFlight === reload) {
+      armTimer(reload)
+    }
+  }
+
+  const retryFrom = (subject: RecoveryPromptSubject): void => {
+    prompt = null
+    // A late recovery makes the prompt's Reload unnecessary.
+    if (documentLanded) {
+      return
+    }
+    start(
+      { attempt: 1, details: subject.details, recentRecoveryCount: subject.recentRecoveryCount },
+      'manual-retry'
+    )
+  }
+
+  const escalate = (subject: RecoveryPromptSubject, cause: RecoveryExhaustionCause): void => {
+    // A new crash invalidates any document that landed while the prompt was open.
+    documentLanded = false
+    if (prompt) {
+      return
+    }
+    prompt = subject
+    opts?.onRendererRecoveryExhausted?.({
+      details: subject.details,
+      webContentsId: rendererWebContentsId,
+      recentRecoveryCount: subject.recentRecoveryCount,
+      cause,
+      // Watch manual retries too, so another stall can offer recovery again.
+      retry: () => retryFrom(subject)
+    })
+  }
+
+  const fail = (reload: RecoveryReload, errorCode?: string): void => {
+    // Only the live attempt owns a failure verdict.
+    if (inFlight !== reload) {
+      return
+    }
+    // Suppress shutdown verdicts; resume may re-arm the retained attempt.
+    if (
+      isWindowClosing() ||
+      opts?.getIsQuitting?.() ||
+      mainWindow.isDestroyed() ||
+      isSystemSessionEnding()
+    ) {
+      return
+    }
+    inFlight = null
+    clearTimer()
+    opts?.onRecoveryReloadOutcome?.({
+      status: errorCode === undefined ? 'timeout' : 'failed',
+      attempt: reload.attempt,
+      // Wall-clock changes must not produce negative diagnostic durations.
+      elapsedMs: Math.max(0, Date.now() - reload.issuedAt),
+      progress: reload.milestone,
+      ...(errorCode === undefined ? {} : { errorCode })
+    })
+    // A pending prompt or crash recovery owns the next reload.
+    if (prompt || isRecoveryPending()) {
+      return
+    }
+    // Restart only loads with no document; preserve progress until the user chooses Reload.
+    if (reload.attempt < RENDERER_RECOVERY_LOAD_ATTEMPTS && reload.milestone === 'none') {
+      start({ ...reload, attempt: reload.attempt + 1 }, 'automatic')
+      return
+    }
+    escalate(reload, 'reload-stalled')
+  }
+
+  // Commit and DOM-ready distinguish a blank load from a document still loading.
+  const observeMilestone = (milestone: RecoveryReloadMilestone) => (): void => {
+    if (!inFlight || MILESTONE_RANK[milestone] <= MILESTONE_RANK[inFlight.milestone]) {
+      return
+    }
+    inFlight.milestone = milestone
+    inFlight.progressedSinceArm = true
+  }
+  const onDidNavigate = observeMilestone('committed')
+  const onDomReady = observeMilestone('dom-ready')
+  const onDidFailLoad = (
+    _event: Electron.Event,
+    errorCode: number,
+    errorDescription: string,
+    _validatedURL: string,
+    isMainFrame: boolean
+  ): void => {
+    if (!isMainFrame || errorCode === -3 || !latest?.superseded) {
+      return
+    }
+    // Error documents also finish loading; only a successful replacement may settle an aborted attempt.
+    latest.superseded = false
+    documentLanded = false
+    fail(latest, mainWindowLoadErrorCode(new Error(errorDescription)))
+  }
+  rendererWebContents.on('did-navigate', onDidNavigate)
+  rendererWebContents.on('dom-ready', onDomReady)
+  rendererWebContents.on('did-fail-load', onDidFailLoad)
+
+  return {
+    issue: (details, recentRecoveryCount, trigger = 'automatic') =>
+      start({ attempt: 1, details, recentRecoveryCount }, trigger),
+    escalate,
+    notifyDocumentLoaded: () => {
+      // Timed-out replacements can still recover beneath the prompt.
+      if (latest?.superseded) {
+        settleLoaded(latest)
+      }
+    },
+    // Restore the budget after sleep without rewriting the diagnostic issue time.
+    notifySystemResume: () => {
+      if (!inFlight) {
+        return
+      }
+      inFlight.capAt = Date.now() + timeoutMs() * RENDERER_RECOVERY_LOAD_CAP_FACTOR
+      armTimer(inFlight)
+    },
+    clear: () => {
+      inFlight = null
+      latest = null
+      prompt = null
+      clearTimer()
+      rendererWebContents.off?.('did-navigate', onDidNavigate)
+      rendererWebContents.off?.('dom-ready', onDomReady)
+      rendererWebContents.off?.('did-fail-load', onDidFailLoad)
+    }
+  }
+}
diff --git a/src/main/windows-descendant-exit-verification.test.ts b/src/main/windows-descendant-exit-verification.test.ts
new file mode 100644
index 00000000000..392c44399e7
--- /dev/null
+++ b/src/main/windows-descendant-exit-verification.test.ts
@@ -0,0 +1,175 @@
+import { describe, expect, it, vi } from 'vitest'
+import {
+  captureWindowsDescendantSnapshot,
+  terminateIdentifiedWindowsProcessTree,
+  verifyWindowsDescendantSnapshotExit,
+  type WindowsDescendantSnapshot
+} from './windows-descendant-exit-verification'
+
+function snapshot(
+  descendants: { pid: number; creationTimeMs: number }[],
+  unidentifiedCount = 0
+): WindowsDescendantSnapshot {
+  return {
+    root: { pid: 100, creationTimeMs: 5 },
+    descendants,
+    unidentifiedCount,
+    capturedAtMs: 1_700_000_000_000
+  }
+}
+
+describe('captureWindowsDescendantSnapshot', () => {
+  it('walks the whole subtree and keeps only rows a later read can re-identify', async () => {
+    const captured = await captureWindowsDescendantSnapshot(100, {
+      // 400 is a grandchild; 300 denied a creation-time query, so no later read
+      // could tell it from a recycled pid and signalling it would risk a stranger.
+      readTable: vi.fn(async () => [
+        { pid: 100, ppid: 1, creationTimeMs: 5 },
+        { pid: 200, ppid: 100, creationTimeMs: 7 },
+        { pid: 300, ppid: 100 },
+        { pid: 400, ppid: 200, creationTimeMs: 9 },
+        { pid: 500, ppid: 1, creationTimeMs: 11 }
+      ]),
+      now: () => 42
+    })
+
+    expect(captured).toEqual({
+      root: { pid: 100, creationTimeMs: 5 },
+      descendants: [
+        { pid: 400, creationTimeMs: 9 },
+        { pid: 200, creationTimeMs: 7 }
+      ],
+      // Seen but not re-identifiable: counted, so no later read can prove it gone.
+      unidentifiedCount: 1,
+      capturedAtMs: 42
+    })
+  })
+
+  it('reports an unreadable or rootless table as no snapshot rather than an empty one', async () => {
+    await expect(
+      captureWindowsDescendantSnapshot(100, {
+        readTable: vi.fn(async () => {
+          throw new Error('table unavailable')
+        })
+      })
+    ).resolves.toBeNull()
+    // A snapshot without the root is stale or filtered; only an observed root
+    // can authoritatively have no descendants.
+    await expect(
+      captureWindowsDescendantSnapshot(100, {
+        readTable: vi.fn(async () => [{ pid: 999, ppid: 1, creationTimeMs: 5 }])
+      })
+    ).resolves.toBeNull()
+  })
+
+  it('refuses an invalid root pid', async () => {
+    const readTable = vi.fn()
+    await expect(captureWindowsDescendantSnapshot(0, { readTable })).resolves.toBeNull()
+    expect(readTable).not.toHaveBeenCalled()
+  })
+})
+
+describe('verifyWindowsDescendantSnapshotExit', () => {
+  it('proves an empty tree without reading the table', async () => {
+    const readTable = vi.fn()
+    await expect(verifyWindowsDescendantSnapshotExit(snapshot([]), { readTable })).resolves.toBe(
+      'exited'
+    )
+    expect(readTable).not.toHaveBeenCalled()
+  })
+
+  it('never proves a tree that held a descendant it could not identify', async () => {
+    // A descendant that denied the creation-time query was seen in the table;
+    // being unable to re-identify it is "could not look", never "it is gone".
+    const readTable = vi.fn()
+    await expect(verifyWindowsDescendantSnapshotExit(snapshot([], 1), { readTable })).resolves.toBe(
+      'unverifiable'
+    )
+    expect(readTable).not.toHaveBeenCalled()
+
+    // The identified sibling leaving proves nothing about the unidentified one.
+    await expect(
+      verifyWindowsDescendantSnapshotExit(snapshot([{ pid: 200, creationTimeMs: 7 }], 1), {
+        readTable: vi.fn(async () => []),
+        wait: async () => {},
+        now: vi.fn().mockReturnValueOnce(0).mockReturnValue(1)
+      })
+    ).resolves.toBe('unverifiable')
+  })
+
+  it('reports exited once no identity-matched row remains', async () => {
+    const readTable = vi
+      .fn()
+      .mockResolvedValueOnce([{ pid: 200, ppid: 100, creationTimeMs: 7 }])
+      // The pid came back on a different process; that is a recycle, not a survivor.
+      .mockResolvedValueOnce([{ pid: 200, ppid: 100, creationTimeMs: 99 }])
+
+    await expect(
+      verifyWindowsDescendantSnapshotExit(snapshot([{ pid: 200, creationTimeMs: 7 }]), {
+        readTable,
+        wait: async () => {},
+        now: vi.fn().mockReturnValueOnce(0).mockReturnValue(1)
+      })
+    ).resolves.toBe('exited')
+    expect(readTable).toHaveBeenCalledTimes(2)
+  })
+
+  it('reports live for a descendant still matched at the deadline', async () => {
+    let clock = 0
+    await expect(
+      verifyWindowsDescendantSnapshotExit(snapshot([{ pid: 200, creationTimeMs: 7 }]), {
+        readTable: vi.fn(async () => [{ pid: 200, ppid: 100, creationTimeMs: 7 }]),
+        wait: async () => {
+          clock += 100
+        },
+        now: () => clock,
+        verifyMs: 250
+      })
+    ).resolves.toBe('live')
+  })
+
+  it('reports unverifiable when the table cannot be read at the deadline', async () => {
+    await expect(
+      verifyWindowsDescendantSnapshotExit(snapshot([{ pid: 200, creationTimeMs: 7 }]), {
+        readTable: vi.fn(async () => {
+          throw new Error('table unavailable')
+        }),
+        wait: async () => {},
+        now: vi.fn().mockReturnValueOnce(0).mockReturnValue(9_999)
+      })
+    ).resolves.toBe('unverifiable')
+  })
+})
+
+describe('terminateIdentifiedWindowsProcessTree', () => {
+  it('never taskkills a replacement that reused the captured root pid', async () => {
+    const terminateTree = vi.fn(async () => {})
+
+    await expect(
+      terminateIdentifiedWindowsProcessTree(
+        { pid: 100, creationTimeMs: 5 },
+        {
+          readTable: vi.fn(async () => [{ pid: 100, ppid: 1, creationTimeMs: 99 }]),
+          terminateTree
+        }
+      )
+    ).resolves.toBe(false)
+    expect(terminateTree).not.toHaveBeenCalled()
+  })
+
+  it('rechecks retained-child ownership after the identity read settles', async () => {
+    const terminateTree = vi.fn(async () => {})
+
+    await expect(
+      terminateIdentifiedWindowsProcessTree(
+        { pid: 100, creationTimeMs: 5 },
+        {
+          readTable: vi.fn(async () => [{ pid: 100, ppid: 1, creationTimeMs: 5 }]),
+          ownsRoot: () => false,
+          terminateTree
+        }
+      )
+    ).resolves.toBe(false)
+    expect(terminateTree).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/windows-descendant-exit-verification.ts b/src/main/windows-descendant-exit-verification.ts
new file mode 100644
index 00000000000..079833a2bd6
--- /dev/null
+++ b/src/main/windows-descendant-exit-verification.ts
@@ -0,0 +1,156 @@
+import type { DescendantTreeVerdict } from './pty-descendant-exit-verification'
+import { windowsDescendantsFromRows } from './providers/windows-foreground-process-rows'
+import { readWindowsProcessTableFresh } from './windows/windows-process-table'
+import { terminateWindowsProcessTree } from './windows-process-tree-kill'
+
+export const WINDOWS_DESCENDANT_KILL_VERIFY_MS = 3_500
+const WINDOWS_DESCENDANT_POLL_MS = 100
+
+/**
+ * A Windows descendant tree captured while its root was alive, with the
+ * PID-reuse guard the POSIX snapshot gets from ps lstart: a row only counts as
+ * the same process when its creation time still matches. Rows without a
+ * creation time are never signalled, because a bare pid cannot be re-identified,
+ * but they are counted: a descendant that was seen and denied identification
+ * is one no later read can prove gone.
+ */
+export type WindowsProcessIdentity = { pid: number; creationTimeMs: number }
+
+export type WindowsDescendantSnapshot = {
+  root: WindowsProcessIdentity
+  descendants: WindowsProcessIdentity[]
+  /** Descendants seen in the walk that denied the creation-time query. */
+  unidentifiedCount: number
+  capturedAtMs: number
+  /** Per-PID boundaries retained when close refreshes merge snapshots. */
+  capturedAtMsByPid?: Readonly<Record<string, number>>
+}
+
+export type WindowsDescendantVerificationDeps = {
+  readTable?: () => Promise<{ pid: number; ppid: number; creationTimeMs?: number }[]>
+  now?: () => number
+  wait?: (ms: number) => Promise<void>
+  verifyMs?: number
+}
+
+/** Revalidate a Windows PID/creation-time identity immediately before a kill. */
+export async function verifyWindowsProcessIdentity(
+  target: WindowsProcessIdentity,
+  deps: Pick<WindowsDescendantVerificationDeps, 'readTable'> = {}
+): Promise<boolean> {
+  if (!Number.isInteger(target.pid) || target.pid <= 0 || !Number.isFinite(target.creationTimeMs)) {
+    return false
+  }
+  const table = await (deps.readTable ?? readWindowsProcessTableFresh)().catch(() => null)
+  const current = table?.filter((row) => row.pid === target.pid) ?? []
+  return current.length === 1 && current[0]?.creationTimeMs === target.creationTimeMs
+}
+
+function delay(ms: number): Promise<void> {
+  return new Promise((resolve) => {
+    const timer = setTimeout(resolve, ms)
+    timer.unref?.()
+  })
+}
+
+/**
+ * Snapshot a Windows root's descendants while it is still alive. Resolves null
+ * (never rejects) when the table is unreadable or the root is absent — the same
+ * contract as the POSIX walk, because "cannot see" is never "nothing is there".
+ */
+export async function captureWindowsDescendantSnapshot(
+  rootPid: number,
+  deps: WindowsDescendantVerificationDeps = {}
+): Promise<WindowsDescendantSnapshot | null> {
+  if (!Number.isInteger(rootPid) || rootPid <= 0) {
+    return null
+  }
+  const capturedAtMs = (deps.now ?? Date.now)()
+  // One table read, not a walk plus an identity read: each is bounded in
+  // seconds, and this runs inside the close ladder's budget.
+  const table = await (deps.readTable ?? readWindowsProcessTableFresh)().catch(() => null)
+  const descendants = table && windowsDescendantsFromRows(table, rootPid)
+  const root = table?.find((row) => row.pid === rootPid)
+  if (!descendants || typeof root?.creationTimeMs !== 'number') {
+    return null
+  }
+  return {
+    root: { pid: root.pid, creationTimeMs: root.creationTimeMs },
+    descendants: descendants.flatMap((row) =>
+      // A descendant that denied a creation-time query cannot be told from a
+      // recycled pid later, so it is never signalled on a bare pid.
+      typeof row.creationTimeMs === 'number'
+        ? [{ pid: row.pid, creationTimeMs: row.creationTimeMs }]
+        : []
+    ),
+    unidentifiedCount: descendants.filter((row) => typeof row.creationTimeMs !== 'number').length,
+    capturedAtMs
+  }
+}
+
+export type IdentifiedWindowsTreeTerminationDeps = {
+  readTable?: WindowsDescendantVerificationDeps['readTable']
+  terminateTree?: (target: WindowsProcessIdentity) => Promise<void>
+  ownsRoot?: () => boolean
+}
+
+/** Revalidate the captured root at the last async boundary before taskkill. */
+export async function terminateIdentifiedWindowsProcessTree(
+  target: WindowsProcessIdentity,
+  deps: IdentifiedWindowsTreeTerminationDeps = {}
+): Promise<boolean> {
+  if (!(await verifyWindowsProcessIdentity(target, { readTable: deps.readTable }))) {
+    return false
+  }
+  if (deps.ownsRoot?.() === false) {
+    return false
+  }
+  await (
+    deps.terminateTree ??
+    ((identified: WindowsProcessIdentity) => terminateWindowsProcessTree(identified.pid))
+  )(target)
+  return true
+}
+
+/**
+ * Whether a snapshotted Windows tree is gone, polled to a bounded deadline.
+ *
+ * Why a verification pass at all: `taskkill /T /F` resolves the same way on a
+ * timeout, an access denial and a recycled root as it does on a successful
+ * kill, so its completion is never evidence. Only a table read that no longer
+ * shows an identity-matched row is.
+ */
+export async function verifyWindowsDescendantSnapshotExit(
+  snapshot: WindowsDescendantSnapshot,
+  deps: WindowsDescendantVerificationDeps = {}
+): Promise<DescendantTreeVerdict> {
+  // The most a read can prove: a descendant that denied identification was seen
+  // and can never be matched gone, so "could not look" caps the verdict.
+  const proven: DescendantTreeVerdict = snapshot.unidentifiedCount > 0 ? 'unverifiable' : 'exited'
+  if (snapshot.descendants.length === 0) {
+    return proven
+  }
+  const now = deps.now ?? Date.now
+  const readTable = deps.readTable ?? readWindowsProcessTableFresh
+  const deadline = now() + (deps.verifyMs ?? WINDOWS_DESCENDANT_KILL_VERIFY_MS)
+  let verdict: DescendantTreeVerdict = 'unverifiable'
+  do {
+    const table = await readTable().catch(() => null)
+    if (!table) {
+      verdict = 'unverifiable'
+    } else {
+      const live = new Map(table.map((row) => [row.pid, row.creationTimeMs]))
+      verdict = snapshot.descendants.some((row) => live.get(row.pid) === row.creationTimeMs)
+        ? 'live'
+        : proven
+      if (verdict === proven) {
+        return verdict
+      }
+    }
+    if (now() >= deadline) {
+      return verdict
+    }
+    await (deps.wait ?? delay)(WINDOWS_DESCENDANT_POLL_MS)
+  } while (now() < deadline)
+  return verdict
+}
diff --git a/src/main/windows-live-tree-kill.win32.test.ts b/src/main/windows-live-tree-kill.win32.test.ts
new file mode 100644
index 00000000000..45563e82c89
--- /dev/null
+++ b/src/main/windows-live-tree-kill.win32.test.ts
@@ -0,0 +1,197 @@
+import { existsSync, mkdtempSync, readFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { spawn, ChildProcess } from 'node:child_process'
+import { subscribe, unsubscribe } from 'node:diagnostics_channel'
+import { afterAll, afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { setAppEnvironment, type AppEnvironment } from '../shared/app-environment'
+import { setProcessTreeKillGate } from '../shared/child-process/process-tree-kill-gate'
+import { signalProcessTree } from '../shared/child-process/process-tree-termination'
+import { removeTreeSync } from '../shared/windows-transient-lock-removal'
+import {
+  findSelfInitiatedTreeKills,
+  resetSelfInitiatedTreeKillLogForTest
+} from './crash-reporting/self-initiated-tree-kill-log'
+import { installMainProcessTreeKillGate } from './own-chromium-tree-kill-guard'
+import { terminateWindowsProcessTree } from './windows-process-tree-kill'
+
+/**
+ * The unit tests pin the gate's decision against a mocked `taskkill`; this pins
+ * what that decision does to real Windows processes.
+ *
+ * Both are needed. Every claim the gate makes is about a mechanism the mocks
+ * cannot show: that `taskkill /T /F` actually reaps a detached grandchild, that
+ * a refusal actually leaves that tree standing, and that the handle-addressed
+ * root kill the refusal path falls back to actually reaps the root while
+ * orphaning its descendants — the asymmetry the PR discloses rather than fixes.
+ *
+ * Runs only on win32; skipped elsewhere.
+ */
+const describeOnWindows = process.platform === 'win32' ? describe : describe.skip
+
+/** Read live by the guard on every kill, so a case can flip it mid-test. */
+let orcaChromiumPids: number[] = []
+
+function appEnvironment(): AppEnvironment {
+  return {
+    getPath: () => process.cwd(),
+    getAppPath: () => process.cwd(),
+    getVersion: () => '0.0.0-live',
+    isPackaged: () => false,
+    onWillQuit: () => {},
+    exit: () => {},
+    getAppMetrics: (() =>
+      orcaChromiumPids.map((pid) => ({
+        pid,
+        type: 'Tab'
+      }))) as unknown as AppEnvironment['getAppMetrics']
+  }
+}
+
+function isAlive(pid: number): boolean {
+  try {
+    process.kill(pid, 0)
+    return true
+  } catch {
+    return false
+  }
+}
+
+const sleep = (ms: number): Promise<void> => new Promise((resolve) => setTimeout(resolve, ms))
+
+async function waitFor(predicate: () => boolean, timeoutMs = 10_000): Promise<boolean> {
+  const deadline = Date.now() + timeoutMs
+  while (Date.now() < deadline && !predicate()) {
+    await sleep(100)
+  }
+  return predicate()
+}
+
+let markerDirectory = ''
+let markerSequence = 0
+const spawnedRoots: ChildProcess[] = []
+const spawnedLeaves: number[] = []
+const observedSpawns: ChildProcess[] = []
+
+function observeSpawn(message: unknown): void {
+  if (
+    typeof message === 'object' &&
+    message !== null &&
+    'process' in message &&
+    message.process instanceof ChildProcess
+  ) {
+    observedSpawns.push(message.process)
+  }
+}
+
+/** A real root with a real grandchild; the grandchild reports its pid on disk. */
+async function spawnLiveTree(): Promise<{
+  child: ChildProcess
+  rootPid: number
+  leafPid: number
+}> {
+  const marker = join(markerDirectory, `leaf-${markerSequence++}.pid`)
+  const leafSource = `require('node:fs').writeFileSync(${JSON.stringify(marker)}, String(process.pid)); setTimeout(() => {}, 600000)`
+  // Non-detached Windows children can die with the root's libuv Job Object.
+  const rootSource = `require('node:child_process').spawn(process.execPath, ['-e', ${JSON.stringify(leafSource)}], { stdio: 'ignore', detached: true, windowsHide: true }); setTimeout(() => {}, 600000)`
+  const child = spawn(process.execPath, ['-e', rootSource], {
+    stdio: 'ignore',
+    windowsHide: true
+  })
+  spawnedRoots.push(child)
+  const rootPid = child.pid as number
+  expect(rootPid).toBeGreaterThan(0)
+  expect(await waitFor(() => existsSync(marker))).toBe(true)
+  const leafPid = Number(readFileSync(marker, 'utf8'))
+  spawnedLeaves.push(leafPid)
+  expect(await waitFor(() => isAlive(leafPid))).toBe(true)
+  return { child, rootPid, leafPid }
+}
+
+describeOnWindows('own-Chromium gate against real Windows process trees', () => {
+  beforeEach(() => {
+    markerDirectory ||= mkdtempSync(join(tmpdir(), 'orca-live-tree-kill-'))
+    resetSelfInitiatedTreeKillLogForTest()
+    orcaChromiumPids = []
+    setAppEnvironment(appEnvironment())
+    installMainProcessTreeKillGate()
+    observedSpawns.length = 0
+    subscribe('child_process', observeSpawn)
+  })
+
+  afterEach(async () => {
+    unsubscribe('child_process', observeSpawn)
+    orcaChromiumPids = []
+    for (const leafPid of spawnedLeaves.splice(0)) {
+      await terminateWindowsProcessTree(leafPid, { site: 'live-tree-kill-cleanup' })
+    }
+    for (const root of spawnedRoots.splice(0)) {
+      root.kill('SIGKILL')
+    }
+    setProcessTreeKillGate(null)
+  })
+
+  afterAll(() => {
+    if (markerDirectory) {
+      removeTreeSync(markerDirectory)
+    }
+  })
+
+  it('admitted: taskkill reaps the root and its detached grandchild, and the kill is recorded', async () => {
+    const { rootPid, leafPid } = await spawnLiveTree()
+
+    await terminateWindowsProcessTree(rootPid, { site: 'live-tree-kill-admit' })
+
+    expect(await waitFor(() => !isAlive(rootPid))).toBe(true)
+    expect(await waitFor(() => !isAlive(leafPid))).toBe(true)
+    expect(
+      findSelfInitiatedTreeKills(Date.now()).some(
+        (kill) => kill.pid === rootPid && kill.site === 'live-tree-kill-admit'
+      )
+    ).toBe(true)
+  })
+
+  it('refused: the tree survives, nothing is recorded, and the handle kill still reaps the root', async () => {
+    const { child, rootPid, leafPid } = await spawnLiveTree()
+    orcaChromiumPids = [rootPid]
+
+    await terminateWindowsProcessTree(rootPid, { site: 'live-tree-kill-refuse' })
+
+    await sleep(1_000)
+    expect(isAlive(rootPid)).toBe(true)
+    expect(isAlive(leafPid)).toBe(true)
+    expect(findSelfInitiatedTreeKills(Date.now())).toEqual([])
+
+    // The fallback every gated site runs after a refusal.
+    child.kill('SIGKILL')
+    expect(await waitFor(() => !isAlive(rootPid))).toBe(true)
+    // Let root-owned job cleanup finish before asserting independent survival.
+    await sleep(250)
+    // Disclosed asymmetry: a refusal orphans descendants rather than reaping them.
+    expect(isAlive(leafPid)).toBe(true)
+  })
+
+  it('signalProcessTree refused: the root goes by handle and the barrier reports unverified', async () => {
+    const { child, rootPid, leafPid } = await spawnLiveTree()
+    orcaChromiumPids = [rootPid]
+    observedSpawns.length = 0
+
+    await expect(signalProcessTree(child, 'SIGKILL')).resolves.toBe(false)
+
+    expect(observedSpawns).toHaveLength(0)
+    expect(await waitFor(() => !isAlive(rootPid))).toBe(true)
+    await sleep(250)
+    expect(isAlive(leafPid)).toBe(true)
+  })
+
+  it('signalProcessTree admitted: the whole tree goes and the barrier reports verified', async () => {
+    const { child, rootPid, leafPid } = await spawnLiveTree()
+    observedSpawns.length = 0
+
+    await expect(signalProcessTree(child, 'SIGKILL')).resolves.toBe(true)
+
+    expect(observedSpawns.map((child) => child.spawnfile)).toEqual(['taskkill'])
+    expect(await waitFor(() => !isAlive(rootPid))).toBe(true)
+    expect(await waitFor(() => !isAlive(leafPid))).toBe(true)
+  })
+})
diff --git a/src/main/windows-process-tree-kill.ts b/src/main/windows-process-tree-kill.ts
index ea7b756ada4..31e6b18da2a 100644
--- a/src/main/windows-process-tree-kill.ts
+++ b/src/main/windows-process-tree-kill.ts
@@ -11,8 +11,9 @@ export const WINDOWS_PROCESS_TREE_KILL_TIMEOUT_MS = 5_000
  * Best-effort: missing/already-dead roots still resolve so callers can finish
  * their own handle cleanup via killRoot.
  *
- * Nearly every main-process taskkill runs through here; the two account-login
- * teardowns keep their own spawn but share the same gate, so the refusal and the
+ * Most main-process taskkills run through here; the families that keep their own
+ * spawn (account-login teardowns, codex app-server deadline, git-command abort,
+ * notebook and precheck timeouts) share the same gate, so the refusal and the
  * breadcrumb live in `admitSelfInitiatedTreeKill` rather than in this function.
  */
 export function terminateWindowsProcessTree(
diff --git a/src/main/windows-pty-root-identity.ts b/src/main/windows-pty-root-identity.ts
index c99224cb72a..28c632682d8 100644
--- a/src/main/windows-pty-root-identity.ts
+++ b/src/main/windows-pty-root-identity.ts
@@ -1,4 +1,4 @@
-import { queryWindowsProcessRowsFresh } from './providers/windows-foreground-process-rows'
+import { queryWindowsProcessLinksFresh } from './providers/windows-foreground-process-rows'
 import { readOrcaChromiumProcessPids } from './orca-chromium-process-pids'
 
 /**
@@ -138,7 +138,7 @@ export async function verifyWindowsTreeKillTarget(
     return 'unknown'
   }
   const rows = await readLinksBeforeDeadline(
-    deps.readRows ?? queryWindowsProcessRowsFresh,
+    deps.readRows ?? queryWindowsProcessLinksFresh,
     deps.timeoutMs ?? WINDOWS_ROOT_IDENTITY_TIMEOUT_MS
   )
   if (!rows) {
diff --git a/src/main/windows/windows-command-line-recovery-health.test.ts b/src/main/windows/windows-command-line-recovery-health.test.ts
new file mode 100644
index 00000000000..3791acf6c93
--- /dev/null
+++ b/src/main/windows/windows-command-line-recovery-health.test.ts
@@ -0,0 +1,59 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  reportWindowsCommandLineRecoveryHealth,
+  resetWindowsCommandLineRecoveryHealthForTests
+} from './windows-command-line-recovery-health'
+
+describe('windows command line recovery health', () => {
+  let warn: ReturnType<typeof vi.spyOn>
+
+  beforeEach(() => {
+    resetWindowsCommandLineRecoveryHealthForTests()
+    warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+  })
+  afterEach(() => {
+    warn.mockRestore()
+  })
+
+  const selfRow = (commandLine: string): { pid: number; commandLine: string } => ({
+    pid: process.pid,
+    commandLine
+  })
+
+  it('warns when the querying process has no command line of its own', () => {
+    // We can always open ourselves with PROCESS_QUERY_LIMITED_INFORMATION, so
+    // an empty self command line means the query is refused host-wide.
+    reportWindowsCommandLineRecoveryHealth([selfRow(''), { pid: 4, commandLine: '' }])
+
+    expect(warn).toHaveBeenCalledTimes(1)
+    expect(warn.mock.calls[0][0]).toContain('ProcessCommandLineInformation')
+    expect(warn.mock.calls[0][1]).toEqual({ processes: 2, withCommandLine: 0 })
+  })
+
+  it('warns once per session, not once per scan', () => {
+    for (let i = 0; i < 5; i++) {
+      reportWindowsCommandLineRecoveryHealth([selfRow('')])
+    }
+    expect(warn).toHaveBeenCalledTimes(1)
+  })
+
+  it('stays quiet when only other processes denied a handle', () => {
+    // Roughly a quarter of a real table denies access; that is not a fault.
+    const denied = Array.from({ length: 40 }, (_, index) => ({
+      pid: index + 1,
+      commandLine: ''
+    }))
+    reportWindowsCommandLineRecoveryHealth([selfRow('node.exe --run'), ...denied])
+    expect(warn).not.toHaveBeenCalled()
+  })
+
+  it('stays quiet when our own row is absent, which the caller rejects separately', () => {
+    reportWindowsCommandLineRecoveryHealth([{ pid: process.pid + 1, commandLine: '' }])
+    expect(warn).not.toHaveBeenCalled()
+  })
+
+  it('treats a missing commandLine field the same as an empty one', () => {
+    reportWindowsCommandLineRecoveryHealth([{ pid: process.pid }])
+    expect(warn).toHaveBeenCalledTimes(1)
+  })
+})
diff --git a/src/main/windows/windows-command-line-recovery-health.ts b/src/main/windows/windows-command-line-recovery-health.ts
new file mode 100644
index 00000000000..173e8f5a969
--- /dev/null
+++ b/src/main/windows/windows-command-line-recovery-health.ts
@@ -0,0 +1,47 @@
+/**
+ * One warning, once per session, when command-line recovery has stopped working.
+ *
+ * The reader has no PEB fallback by design: falling back was a total-defeat
+ * vector, because any single anomalous NTSTATUS reinstated address-space reads
+ * for the life of the process. The cost of removing it is a cliff -- if
+ * `NtQueryInformationProcess(ProcessCommandLineInformation)` is refused, every
+ * command line comes back empty and agent identity matching silently degrades
+ * to image names, while the addon still loads and still enumerates, so every
+ * health check stays green. A cliff nobody can see is the failure mode this
+ * area keeps producing, so it gets a signal.
+ *
+ * The querying process is the unambiguous probe. A process can always open
+ * itself with `PROCESS_QUERY_LIMITED_INFORMATION`, so its own command line
+ * coming back empty means the query is refused host-wide -- not that some
+ * target denied a handle, which is normal for roughly a quarter of the table.
+ * That is why this keys on our own row rather than a fraction: no threshold to
+ * tune, and no false positive on a hardened box where most processes deny.
+ */
+type CommandLineRow = { pid: number; commandLine?: string }
+
+let warned = false
+
+export function reportWindowsCommandLineRecoveryHealth(rows: CommandLineRow[]): void {
+  if (warned) {
+    return
+  }
+  const self = rows.find((row) => row.pid === process.pid)
+  // No self row is a different failure, and the caller's own guard rejects it.
+  if (!self || (self.commandLine ?? '') !== '') {
+    return
+  }
+  warned = true
+  const recovered = rows.filter((row) => (row.commandLine ?? '') !== '').length
+  console.warn(
+    '[windows-process-table] command-line recovery is refused on this host: the querying ' +
+      'process has no command line of its own, so NtQueryInformationProcess' +
+      '(ProcessCommandLineInformation) is failing for every process. Agent identity matching ' +
+      'falls back to image names. A hooked ntdll that does not know class 60 is the usual cause.',
+    { processes: rows.length, withCommandLine: recovered }
+  )
+}
+
+/** Test-only: the warning is once per session, so cases must not inherit it. */
+export function resetWindowsCommandLineRecoveryHealthForTests(): void {
+  warned = false
+}
diff --git a/src/main/windows/windows-process-table-cim-scan.ts b/src/main/windows/windows-process-table-cim-scan.ts
index 213f157f63b..b8d654ce238 100644
--- a/src/main/windows/windows-process-table-cim-scan.ts
+++ b/src/main/windows/windows-process-table-cim-scan.ts
@@ -75,6 +75,8 @@ export function parseWindowsCimProcessRows(stdout: string): WindowsProcessRow[]
       return []
     }
     const name = fieldAsString(row.Name)
+    // No working set: Win32_Process reports one, but nothing reads memory off
+    // this table and asking widens an already costly scan.
     return [{ pid, ppid, name, command: fieldAsString(row.CommandLine) || name }]
   })
 }
diff --git a/src/main/windows/windows-process-table.test.ts b/src/main/windows/windows-process-table.test.ts
index 360dae4ec14..f4fd514d319 100644
--- a/src/main/windows/windows-process-table.test.ts
+++ b/src/main/windows/windows-process-table.test.ts
@@ -1,3 +1,6 @@
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import {
   __setWindowsProcessTableCimScanForTests,
@@ -5,33 +8,141 @@ import {
   __setWindowsProcessTreeRequireForTests,
   isWindowsProcessTableAvailable,
   isWindowsProcessStartTimeAvailable,
+  readWindowsProcessIdentityTable,
+  readWindowsProcessIdentityTableFresh,
   readWindowsProcessTable,
   readWindowsProcessTableFresh,
-  resetWindowsProcessTableForTests
+  resetWindowsProcessTableForTests,
+  type WindowsProcessIdentityRow,
+  type WindowsProcessRow
 } from './windows-process-table'
+import { resetWindowsCommandLineRecoveryHealthForTests } from './windows-command-line-recovery-health'
+
+/** None | CreationTime, and CommandLine on top of it. Memory (1) is never asked for. */
+const IDENTITY_FLAGS = 4
+const DETAILED_FLAGS = 6
 
 const getAllProcesses = vi.fn()
 
 // A real snapshot always contains the querying process; the reader rejects a
 // table without it, because that is what a blocked CreateToolhelp32Snapshot
-// returns -- an empty list rather than an error.
-const SELF = { pid: process.pid, ppid: 0, name: 'vitest.exe' }
-const NATIVE = [
+// returns -- an empty list rather than an error. It also always carries our own
+// command line, since a process can always open itself -- an empty one there is
+// the host-wide-refusal signal, not a fixture detail.
+type NativeRow = {
+  pid: number
+  ppid: number
+  name: string
+  commandLine?: string
+  creationTimeMs?: number
+}
+
+const SELF: NativeRow = {
+  pid: process.pid,
+  ppid: 0,
+  name: 'vitest.exe',
+  commandLine: 'vitest.exe --run'
+}
+const NATIVE: NativeRow[] = [
   SELF,
   {
     pid: 100,
     ppid: 4,
     name: 'orca.exe',
     commandLine: '"C:/a b/orca.exe" --x',
-    memory: 4096,
     creationTimeMs: 1_700_000_000_000
   }
 ]
 
+/**
+ * The vendored wrapper, faithfully: one `requestInProgress` latch over a shared
+ * callback queue, resolved asynchronously. A second caller that arrives while a
+ * request is in flight has its `flags` DISCARDED and is served the first
+ * caller's rows -- the defect this module's read gate has to exclude. A
+ * synchronous mock cannot express it, because nothing ever overlaps.
+ */
+let coalescingCalls: { flags: number }[] = []
+let maxConcurrentNativeCalls = 0
+
+function coalescingModule(): {
+  ProcessDataFlag: { None: number; Memory: number; CommandLine: number; CreationTime: number }
+  getAllProcesses: (cb: (rows: NativeRow[] | undefined) => void, flags?: number) => void
+} {
+  let requestInProgress = false
+  const queue: ((rows: NativeRow[]) => void)[] = []
+  return {
+    ProcessDataFlag: { None: 0, Memory: 1, CommandLine: 2, CreationTime: 4 },
+    getAllProcesses: (cb, flags) => {
+      queue.push(cb)
+      if (requestInProgress) {
+        return
+      }
+      requestInProgress = true
+      coalescingCalls.push({ flags: flags ?? 0 })
+      // The rows the addon would produce for exactly these flags. Each field is
+      // gated on its OWN bit: reusing the CommandLine bit for both would strip
+      // creationTimeMs from an identity read that did request CreationTime, and
+      // no case could then tell a served-someone-else's-rows bug from a
+      // correctly-shaped cheap read.
+      const requested = flags ?? 0
+      const rows: NativeRow[] = NATIVE.map((row) => ({
+        pid: row.pid,
+        ppid: row.ppid,
+        name: row.name,
+        ...(requested & 2 && row.commandLine !== undefined ? { commandLine: row.commandLine } : {}),
+        ...(requested & 4 && row.creationTimeMs !== undefined
+          ? { creationTimeMs: row.creationTimeMs }
+          : {})
+      }))
+      setTimeout(() => {
+        while (queue.length) {
+          queue.splice(0).forEach((callback) => callback(rows))
+        }
+        requestInProgress = false
+      }, 0)
+    }
+  }
+}
+
+/** One instance for the whole test: the latch it models is module-global. */
+function installCoalescingModule(): void {
+  const native = coalescingModule()
+  __setWindowsProcessTreeLoaderForTests(() => native)
+}
+
+/**
+ * The relay's bare addon: `adaptAddon` over `getProcessList`, with no queue of
+ * any kind. Two simultaneous `CreateToolhelp32Snapshot` calls are the crash the
+ * vendor's queue exists to prevent, so here re-entry is observable rather than
+ * silently absorbed.
+ *
+ * Concurrency has to be measured against this and never against the coalescing
+ * mock, whose own latch means it can only ever report one call in flight -- an
+ * assertion that holds whether or not this module excludes anything.
+ */
+function installBareAddonModule(): void {
+  let inFlight = 0
+  const native = {
+    ProcessDataFlag: { None: 0, Memory: 1, CommandLine: 2, CreationTime: 4 },
+    getAllProcesses: (cb: (rows: NativeRow[] | undefined) => void, flags?: number) => {
+      coalescingCalls.push({ flags: flags ?? 0 })
+      inFlight += 1
+      maxConcurrentNativeCalls = Math.max(maxConcurrentNativeCalls, inFlight)
+      setTimeout(() => {
+        inFlight -= 1
+        cb(NATIVE)
+      }, 0)
+    }
+  }
+  __setWindowsProcessTreeLoaderForTests(() => native)
+}
+
 describe('windows process table', () => {
   let platform: PropertyDescriptor | undefined
 
   beforeEach(() => {
+    coalescingCalls = []
+    maxConcurrentNativeCalls = 0
     getAllProcesses.mockReset()
     getAllProcesses.mockImplementation((cb: (rows: unknown) => void) => cb(NATIVE))
     platform = Object.getOwnPropertyDescriptor(process, 'platform')
@@ -52,7 +163,7 @@ describe('windows process table', () => {
   it('maps native rows, defaulting an unreadable command line to empty', async () => {
     const rows = await readWindowsProcessTableFresh()
     expect(rows).toEqual([
-      { pid: process.pid, ppid: 0, name: 'vitest.exe', command: '' },
+      { pid: process.pid, ppid: 0, name: 'vitest.exe', command: 'vitest.exe --run' },
       {
         pid: 100,
         ppid: 4,
@@ -63,13 +174,157 @@ describe('windows process table', () => {
     ])
   })
 
-  it('requests the command line and creation time, never memory', async () => {
+  it('asks for the command line but never for memory', async () => {
+    // Memory costs a second OpenProcess(PROCESS_VM_READ) per process and no
+    // caller reads a working set off this table.
     await readWindowsProcessTableFresh()
-    // CommandLine (2) | CreationTime (4). The Memory bit (1) stays clear: the
-    // addon opens a second PROCESS_VM_READ handle per process to serve it and
-    // nothing reads a working set off this table.
-    expect(getAllProcesses.mock.calls[0]?.[1]).toBe(6)
-    expect((getAllProcesses.mock.calls[0]?.[1] as number) & 1).toBe(0)
+    expect(getAllProcesses.mock.calls[0]?.[1]).toBe(DETAILED_FLAGS)
+  })
+
+  it('reads the identity table with no per-process handle flag at all', async () => {
+    await readWindowsProcessIdentityTableFresh()
+    expect(getAllProcesses.mock.calls[0]?.[1]).toBe(IDENTITY_FLAGS)
+  })
+
+  it('drops the command line from identity rows rather than leaving it empty', async () => {
+    const rows = await readWindowsProcessIdentityTableFresh()
+    expect(rows).toEqual([
+      { pid: process.pid, ppid: 0, name: 'vitest.exe' },
+      { pid: 100, ppid: 4, name: 'orca.exe', creationTimeMs: 1_700_000_000_000 }
+    ])
+    expect(rows.every((row) => !('command' in row))).toBe(true)
+  })
+
+  it('collapses a 32-wide burst into one scan per flag set', async () => {
+    installCoalescingModule()
+    const [identity, detailed] = await Promise.all([
+      Promise.all(Array.from({ length: 16 }, () => readWindowsProcessIdentityTable())),
+      Promise.all(Array.from({ length: 16 }, () => readWindowsProcessTable()))
+    ])
+    expect(coalescingCalls.map((call) => call.flags).sort()).toEqual([
+      IDENTITY_FLAGS,
+      DETAILED_FLAGS
+    ])
+    expect(identity).toHaveLength(16)
+    expect(detailed).toHaveLength(16)
+  })
+
+  // The npm wrapper coalesces rather than queues: a second concurrent caller's
+  // flags are discarded and it is served the first caller's rows. Overlapping an
+  // identity read with a detailed one therefore used to hand agent recognition a
+  // table with every command line empty.
+  async function expectEachViewGotItsOwnFlags(
+    identity: Promise<WindowsProcessIdentityRow[]>,
+    detailed: Promise<WindowsProcessRow[]>
+  ): Promise<void> {
+    const [identityRows, detailedRows] = await Promise.all([identity, detailed])
+    expect(detailedRows.some((row) => row.command === '"C:/a b/orca.exe" --x')).toBe(true)
+    expect(identityRows.every((row) => !('command' in row))).toBe(true)
+    // Both sets carry what their own flags asked for. Not redundant with the
+    // flags check below: that one catches a read served the OTHER set's rows,
+    // this one catches field shaping -- identity dropping CreationTime from its
+    // flags, or toIdentityRow failing to forward it. Neither sees the other's
+    // failure, so keep both.
+    expect(identityRows.map((row) => row.creationTimeMs)).toEqual([undefined, 1_700_000_000_000])
+    expect(detailedRows.map((row) => row.creationTimeMs)).toEqual([undefined, 1_700_000_000_000])
+    // Two calls, each with its own flags. Concurrency is asserted separately,
+    // against the bare addon: this mock's own latch means it could never report
+    // more than one call in flight, whatever this module did.
+    expect(coalescingCalls.map((call) => call.flags).sort()).toEqual([
+      IDENTITY_FLAGS,
+      DETAILED_FLAGS
+    ])
+  }
+
+  it('gives each flag set its own data when the identity read is issued first', async () => {
+    installCoalescingModule()
+    const identity = readWindowsProcessIdentityTableFresh()
+    const detailed = readWindowsProcessTableFresh()
+    await expectEachViewGotItsOwnFlags(identity, detailed)
+  })
+
+  it('gives each flag set its own data when the detailed read is issued first', async () => {
+    installCoalescingModule()
+    const detailed = readWindowsProcessTableFresh()
+    const identity = readWindowsProcessIdentityTableFresh()
+    await expectEachViewGotItsOwnFlags(identity, detailed)
+  })
+
+  /** Microtasks only: the mocks call back on a timer, so nothing completes. */
+  async function parkPendingReadsOnTheGate(): Promise<void> {
+    for (let tick = 0; tick < 20; tick += 1) {
+      await Promise.resolve()
+    }
+  }
+
+  it('never re-enters the bare relay addon when both flag sets overlap', async () => {
+    installBareAddonModule()
+    const detailed = readWindowsProcessTableFresh()
+    const identity = readWindowsProcessIdentityTableFresh()
+    await Promise.all([detailed, identity])
+    expect(coalescingCalls.map((call) => call.flags).sort()).toEqual([
+      IDENTITY_FLAGS,
+      DETAILED_FLAGS
+    ])
+    expect(maxConcurrentNativeCalls).toBe(1)
+  })
+
+  it('keeps one read in flight across a test reset', async () => {
+    // Replacing the gate rather than chaining onto it lets a waiter still
+    // holding the old chain run beside a read queued on the new one. Reachable
+    // only from the test hooks -- which is the problem: it hands a suite two
+    // concurrent calls into its own mock, the exact condition the cases above
+    // exist to detect.
+    installBareAddonModule()
+    const inFlight = readWindowsProcessTableFresh()
+    const waiter = readWindowsProcessIdentityTableFresh()
+    await parkPendingReadsOnTheGate()
+    resetWindowsProcessTableForTests()
+    const afterReset = readWindowsProcessTableFresh()
+
+    await Promise.allSettled([inFlight, waiter, afterReset])
+    expect(maxConcurrentNativeCalls).toBe(1)
+  })
+
+  it('does not serve one flag set from the other cache', async () => {
+    await readWindowsProcessTable()
+    await readWindowsProcessIdentityTable()
+    expect(getAllProcesses).toHaveBeenCalledTimes(2)
+  })
+
+  it('rejects an empty identity snapshot rather than reporting an idle machine', async () => {
+    getAllProcesses.mockImplementation((cb: (rows: unknown) => void) => cb([]))
+    resetWindowsProcessTableForTests()
+    await expect(readWindowsProcessIdentityTableFresh()).rejects.toThrow(/unreadable/)
+  })
+
+  it('applies the deadline to the identity read too', async () => {
+    vi.useFakeTimers()
+    getAllProcesses.mockImplementation(() => {})
+    resetWindowsProcessTableForTests()
+    const pending = readWindowsProcessIdentityTableFresh()
+    const assertion = expect(pending).rejects.toThrow(/timed out/)
+    await vi.advanceTimersByTimeAsync(3_000)
+    await assertion
+    vi.useRealTimers()
+  })
+
+  it('shares the wedge gate across flag sets, because they share one addon', async () => {
+    // One wedged read latches the vendored `requestInProgress` and pins the one
+    // libuv slot whichever flags asked for it, so a per-flag-set gate would let
+    // the other reader keep parking callbacks behind it.
+    vi.useFakeTimers()
+    getAllProcesses.mockImplementation(() => {})
+    resetWindowsProcessTableForTests()
+    const wedge = readWindowsProcessIdentityTableFresh()
+    const wedgeAssertion = expect(wedge).rejects.toThrow(/timed out/)
+    await vi.advanceTimersByTimeAsync(3_000)
+    await wedgeAssertion
+
+    await expect(readWindowsProcessTableFresh()).rejects.toThrow(/wedged/)
+    await expect(readWindowsProcessIdentityTableFresh()).rejects.toThrow(/wedged/)
+    expect(getAllProcesses).toHaveBeenCalledTimes(1)
+    vi.useRealTimers()
   })
 
   it('only advertises PID-safe ownership when the native creation-time field exists', () => {
@@ -167,6 +422,27 @@ describe('PowerShell fallback when the native binding is absent', () => {
     expect(cimScan).toHaveBeenCalledTimes(1)
   })
 
+  it('serves the identity view from the one scan a relay can afford', async () => {
+    // With no binding there is only one scan to run and it costs ~1.4s and a
+    // powershell.exe, so the cheap view must ride it rather than fork a second.
+    __setWindowsProcessTreeLoaderForTests(() => null)
+    // Projected, not merely widened: an identity row carries no command line on
+    // any host, so nothing can come to depend on the fallback happening to have
+    // one.
+    await expect(readWindowsProcessIdentityTableFresh()).resolves.toEqual([
+      { pid: process.pid, ppid: 0, name: 'node.exe' },
+      { pid: 200, ppid: process.pid, name: 'claude.exe' }
+    ])
+    await readWindowsProcessTable()
+    expect(cimScan).toHaveBeenCalledTimes(1)
+  })
+
+  it('rejects an identity read that omits our own pid', async () => {
+    __setWindowsProcessTreeLoaderForTests(() => null)
+    cimScan.mockResolvedValue([{ pid: 200, ppid: 4, name: 'claude.exe', command: 'claude' }])
+    await expect(readWindowsProcessIdentityTableFresh()).rejects.toThrow(/unreadable/)
+  })
+
   it('does not engage when the native binding is present', async () => {
     const getAllProcesses = vi.fn()
     getAllProcesses.mockImplementation((cb: (rows: unknown) => void) => cb(NATIVE))
@@ -360,6 +636,7 @@ describe('resolving the native reader', () => {
   let platform: PropertyDescriptor | undefined
   const PACKAGE_SPECIFIER = '@vscode/windows-process-tree'
   const ADDON_SPECIFIER = './windows-process-tree.node'
+  const stagedAddonDirs: string[] = []
 
   beforeEach(() => {
     platform = Object.getOwnPropertyDescriptor(process, 'platform')
@@ -369,6 +646,9 @@ describe('resolving the native reader', () => {
   afterEach(() => {
     __setWindowsProcessTreeRequireForTests()
     __setWindowsProcessTableCimScanForTests()
+    for (const dir of stagedAddonDirs.splice(0)) {
+      rmSync(dir, { recursive: true, force: true })
+    }
     if (platform) {
       Object.defineProperty(process, 'platform', platform)
     }
@@ -403,7 +683,7 @@ describe('resolving the native reader', () => {
     })
     const rows = await readWindowsProcessTableFresh()
     expect(rows).toEqual([
-      { pid: process.pid, ppid: 0, name: 'vitest.exe', command: '' },
+      { pid: process.pid, ppid: 0, name: 'vitest.exe', command: 'vitest.exe --run' },
       {
         pid: 100,
         ppid: 4,
@@ -415,7 +695,7 @@ describe('resolving the native reader', () => {
     expect(isWindowsProcessTableAvailable()).toBe(true)
   })
 
-  it('asks the addon for the command line but not memory, as the package path does', async () => {
+  it('asks the addon for the command line, as the package path does', async () => {
     const addon = addonReturning(NATIVE)
     __setWindowsProcessTreeRequireForTests((specifier: string) => {
       if (specifier === ADDON_SPECIFIER) {
@@ -424,12 +704,26 @@ describe('resolving the native reader', () => {
       throw new Error('MODULE_NOT_FOUND')
     })
     await readWindowsProcessTableFresh()
-    // CommandLine only: a bare snapshot would silently drop the command line
-    // every agent-recognition caller matches on first, and the relay addon
-    // exposes no CreationTime bit to add.
+    // CommandLine alone: a bare snapshot would silently drop the command line
+    // every agent-recognition caller matches on first, and Memory would add a
+    // second per-process handle nothing reads.
     expect(addon.getProcessList).toHaveBeenCalledWith(expect.any(Function), 2)
   })
 
+  it('asks the addon for nothing per-process on the identity path', async () => {
+    const addon = addonReturning(NATIVE)
+    __setWindowsProcessTreeRequireForTests((specifier: string) => {
+      if (specifier === ADDON_SPECIFIER) {
+        return addon
+      }
+      throw new Error('MODULE_NOT_FOUND')
+    })
+    await readWindowsProcessIdentityTableFresh()
+    // The relay addon exposes no CreationTime bit, so this is a bare Toolhelp32
+    // walk: zero OpenProcess calls.
+    expect(addon.getProcessList).toHaveBeenCalledWith(expect.any(Function), 0)
+  })
+
   it('reaches the CIM scan when neither the package nor the addon is present', async () => {
     const cimScan = vi
       .fn()
@@ -464,6 +758,64 @@ describe('resolving the native reader', () => {
     expect(cimScan).toHaveBeenCalledTimes(1)
   })
 
+  // A relay bundle and the addon staged beside it redeploy independently, so a
+  // host that never took a new bundle can still be loading the published
+  // prebuilt -- which binds fine and then walks every process's address space.
+  // The relay build asserts the symbol is absent; nothing did at load.
+  function withStagedAddonBinary(
+    bytes: string,
+    addon: unknown
+  ): ((specifier: string) => unknown) & { resolve: (specifier: string) => string } {
+    const dir = mkdtempSync(join(tmpdir(), 'orca-relay-addon-'))
+    const addonPath = join(dir, 'windows-process-tree.node')
+    writeFileSync(addonPath, bytes)
+    stagedAddonDirs.push(dir)
+    const resolve = (specifier: string): unknown => {
+      if (specifier === ADDON_SPECIFIER) {
+        return addon
+      }
+      throw new Error('MODULE_NOT_FOUND')
+    }
+    resolve.resolve = (specifier: string): string => {
+      if (specifier === ADDON_SPECIFIER) {
+        return addonPath
+      }
+      throw new Error('MODULE_NOT_FOUND')
+    }
+    return resolve
+  }
+
+  it('refuses a staged relay addon still built from unpatched source', async () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const cimScan = vi
+      .fn()
+      .mockResolvedValue([
+        { pid: process.pid, ppid: 0, name: 'node.exe', command: 'node relay.js' }
+      ])
+    __setWindowsProcessTableCimScanForTests(cimScan)
+    const addon = addonReturning(NATIVE)
+    __setWindowsProcessTreeRequireForTests(
+      withStagedAddonBinary('MZ\0KERNEL32.dll\0ReadProcessMemory\0', addon)
+    )
+
+    await expect(readWindowsProcessTableFresh()).resolves.toHaveLength(1)
+    expect(addon.getProcessList).not.toHaveBeenCalled()
+    expect(cimScan).toHaveBeenCalledTimes(1)
+    expect(isWindowsProcessTableAvailable()).toBe(false)
+    expect(warn.mock.calls[0]?.[0]).toContain('ReadProcessMemory')
+    warn.mockRestore()
+  })
+
+  it('binds a staged relay addon whose binary carries no such import', async () => {
+    const addon = addonReturning(NATIVE)
+    __setWindowsProcessTreeRequireForTests(
+      withStagedAddonBinary('MZ\0ntdll.dll\0NtQueryInformationProcess\0', addon)
+    )
+
+    await expect(readWindowsProcessTableFresh()).resolves.toHaveLength(2)
+    expect(addon.getProcessList).toHaveBeenCalledTimes(1)
+  })
+
   it('never probes either specifier off Windows', async () => {
     Object.defineProperty(process, 'platform', { configurable: true, value: 'darwin' })
     const resolve = vi.fn()
@@ -472,3 +824,56 @@ describe('resolving the native reader', () => {
     expect(resolve).not.toHaveBeenCalled()
   })
 })
+
+// The cliff the removed PEB fallback leaves behind: a hooked ntdll that refuses
+// class 60 empties every command line, and the addon still loads and still
+// enumerates, so every health check the app has stays green.
+describe('warning when command-line recovery is refused host-wide', () => {
+  let platform: PropertyDescriptor | undefined
+  let warn: ReturnType<typeof vi.spyOn>
+
+  beforeEach(() => {
+    platform = Object.getOwnPropertyDescriptor(process, 'platform')
+    Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+    resetWindowsCommandLineRecoveryHealthForTests()
+    warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+  })
+
+  afterEach(() => {
+    __setWindowsProcessTreeLoaderForTests()
+    warn.mockRestore()
+    if (platform) {
+      Object.defineProperty(process, 'platform', platform)
+    }
+  })
+
+  type NativeRow = { pid: number; ppid: number; name: string; commandLine?: string }
+
+  function loaderReturning(rows: NativeRow[], commandLineFlag: number): void {
+    __setWindowsProcessTreeLoaderForTests(() => ({
+      ProcessDataFlag: { None: 0, Memory: 1, CommandLine: commandLineFlag, CreationTime: 4 },
+      getAllProcesses: (cb: (r: NativeRow[] | undefined) => void) => cb(rows)
+    }))
+  }
+
+  it('warns once when our own row comes back with no command line', async () => {
+    loaderReturning([{ pid: process.pid, ppid: 0, name: 'vitest.exe' }], 2)
+    await readWindowsProcessTableFresh()
+    await readWindowsProcessTableFresh()
+    expect(warn).toHaveBeenCalledTimes(1)
+    expect(warn.mock.calls[0][0]).toContain('ProcessCommandLineInformation')
+  })
+
+  it('stays quiet when our own command line came back', async () => {
+    loaderReturning(NATIVE, 2)
+    await readWindowsProcessTableFresh()
+    expect(warn).not.toHaveBeenCalled()
+  })
+
+  it('stays quiet when the read never asked for a command line', async () => {
+    // A reader that requests identity fields only must not read as a refusal.
+    loaderReturning([{ pid: process.pid, ppid: 0, name: 'vitest.exe' }], 0)
+    await readWindowsProcessTableFresh()
+    expect(warn).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/windows/windows-process-table.ts b/src/main/windows/windows-process-table.ts
index 2bd63ccce9c..0a1acd7ae1c 100644
--- a/src/main/windows/windows-process-table.ts
+++ b/src/main/windows/windows-process-table.ts
@@ -1,5 +1,7 @@
+import { readFileSync } from 'node:fs'
 import { createRequire } from 'node:module'
 import { createProcessTableSnapshotReader } from '../../shared/process-table-snapshot-reader'
+import { reportWindowsCommandLineRecoveryHealth } from './windows-command-line-recovery-health'
 import { readWindowsProcessRowsWithCim } from './windows-process-table-cim-scan'
 
 /**
@@ -19,26 +21,41 @@ import { readWindowsProcessRowsWithCim } from './windows-process-table-cim-scan'
  * A Toolhelp32 snapshot answers the same question in ~16 ms with no child
  * process at all, so none of those failure modes have anywhere to live.
  *
- * Measured on Windows 11 (1050 processes), p50 / p95:
- *   pid+ppid+name        15.9 / 17.5 ms
- *   +memory +commandLine 30.6 / 33.7 ms
- *   PowerShell CIM        706 / 723  ms
+ * Two flag sets, because only some callers need a command line, and exactly one
+ * native read in flight at a time, because the vendored wrapper coalesces
+ * differing flags -- see docs/reference/windows-process-enumeration.md.
  *
- * Those are the module's published figures for both extra fields together; the
- * only flag set this module asks for is `CommandLine` (+ `CreationTime`, free),
- * which sits between the two rows and has not been separately measured.
+ * Measured on Windows 11 (492 processes), p50 / p95:
+ *   identity  pid+ppid+name         6.3 / 7.0  ms   0 OpenProcess
+ *   detailed  +commandLine         12.3 / 13.4 ms   1 OpenProcess/process
+ *   (retired) +memory +commandLine 13.1 / 14.1 ms   2 OpenProcess/process
+ *   PowerShell CIM                  706 / 723  ms
+ *
+ * Dropping Memory removed the second per-process handle: it took an
+ * OpenProcess(...|VM_READ) it never read through. CommandLine's own read is no
+ * longer a PEB walk either -- the patched addon asks the kernel, so identity is
+ * now the only flag set that opens nothing at all.
+ *
+ * All Toolhelp32 rows assume the optional `windows-process-tree.node` addon.
+ * The desktop bundles it; no released relay carries it, so on an SSH host the
+ * CIM row is the operative number and the child process is not avoided at all.
  */
 
-export type WindowsProcessRow = {
+/** Everything a Toolhelp32 walk alone can answer. */
+export type WindowsProcessIdentityRow = {
   pid: number
   ppid: number
   name: string
-  /** Full command line. Empty when the process denied a query handle. */
-  command: string
   /** Process creation time in Unix milliseconds, when the native snapshot provides it. */
   creationTimeMs?: number
 }
 
+/** Adds the kernel-supplied command line. Only ask for this if you read it. */
+export type WindowsProcessRow = WindowsProcessIdentityRow & {
+  /** Full command line. Empty when the process denied a query handle. */
+  command: string
+}
+
 type NativeProcessInfo = {
   pid: number
   ppid: number
@@ -61,19 +78,26 @@ type WindowsProcessTreeModule = {
 
 const requireFromMain = createRequire(__filename)
 
+/** `resolve` is optional so a test can inject a bare function for the require alone. */
+type NativeRequire = ((specifier: string) => unknown) & {
+  resolve?: (specifier: string) => string
+}
+
 // Why injectable: `createRequire` bypasses the module mocker, and the two
 // resolution steps below are the exact thing #15749 shipped untested -- the
 // relay suites replaced the loader wholesale, so nothing exercised the require.
-let requireNative: (specifier: string) => unknown = requireFromMain
+let requireNative: NativeRequire = requireFromMain
 
 /**
  * The bare addon a relay host receives, with no npm package around it.
  *
  * The published package's `lib/index.js` adds only a queue over this call, and
  * that queue is the wedge this module already defends against: it latches a
- * module-global `requestInProgress` with no try/catch. We hold our own
- * single-flight and deadline, so binding straight to the addon drops the
- * duplicate queue rather than nesting inside it.
+ * module-global `requestInProgress` with no try/catch. `nativeReadGate` holds
+ * the mutual exclusion instead -- and must, because this addon has no queue of
+ * its own and two simultaneous `CreateToolhelp32Snapshot` calls are the crash
+ * the vendor's queue exists to prevent. With one native call ever outstanding,
+ * binding straight to the addon drops a duplicate rather than losing a guard.
  */
 type WindowsProcessTreeAddon = {
   getProcessList: (
@@ -84,13 +108,50 @@ type WindowsProcessTreeAddon = {
 
 /**
  * Mirrors the package's enum; the addon takes the raw bit field. `Memory` (1)
- * is listed for completeness and is deliberately never set — see `flags` below.
+ * is listed for completeness and is deliberately never set — see the projections
+ * below.
  */
 const PROCESS_DATA_FLAG = { None: 0, Memory: 1, CommandLine: 2 } as const
 
 /** Staged beside the relay bundle by build-relay; see RELAY_ARTIFACTS. */
 const RELAY_ADDON_FILENAME = './windows-process-tree.node'
 
+/** The import whose absence tells the patched binary from the published prebuilt. */
+const FLAGGED_ADDON_IMPORT = 'ReadProcessMemory'
+
+/**
+ * Refuse a staged relay addon built from unpatched source.
+ *
+ * The build asserts this on the artifact it produces, but a relay bundle and the
+ * addon beside it are redeployed independently: a host that has not taken a new
+ * bundle keeps whatever `.node` is already there, and the published prebuilt is
+ * node-addon-api, so it binds cleanly and then opens every process with
+ * `PROCESS_VM_READ` to walk its PEB -- the primitive MDE scores as credential
+ * dumping. Nothing checked that at load until here.
+ *
+ * Same predicate as `inspectWindowsProcessTreeAddon` in
+ * `config/scripts/windows-process-tree-gyp-rebuild.mjs`, which cannot be
+ * imported here: it is install-time tooling that pulls in node-gyp and
+ * `child_process`, and this module is bundled into the app and the relay.
+ *
+ * Falling back to the CIM scan is the correct loss: it is slower, and it is not
+ * the thing an EDR quarantines the host for.
+ */
+function stagedRelayAddonIsUnpatched(): boolean {
+  // No resolver means an injected test double, so there is no file to inspect.
+  // Production always has one, and a require that just succeeded proves the
+  // path is readable -- "cannot tell" here is never a real deployment.
+  const addonPath = requireNative.resolve?.(RELAY_ADDON_FILENAME)
+  if (!addonPath) {
+    return false
+  }
+  try {
+    return readFileSync(addonPath).includes(FLAGGED_ADDON_IMPORT)
+  } catch {
+    return false
+  }
+}
+
 let cachedModule: WindowsProcessTreeModule | null | undefined
 let moduleLoader: () => WindowsProcessTreeModule | null = loadWindowsProcessTree
 let cimScan: () => Promise<WindowsProcessRow[]> = readWindowsProcessRowsWithCim
@@ -135,8 +196,22 @@ function loadWindowsProcessTree(): WindowsProcessTreeModule | null {
     // Why check the shape: a truncated upload or an addon built for another
     // arch can load and still not answer. Binding to it would then reject every
     // read forever, where falling through reaches a scan that works.
-    cachedModule =
-      typeof addon?.getProcessList === 'function' ? adaptAddon(addon) : /* v8 ignore next */ null
+    if (typeof addon?.getProcessList !== 'function') {
+      /* v8 ignore next 2 */
+      cachedModule = null
+      return cachedModule
+    }
+    if (stagedRelayAddonIsUnpatched()) {
+      console.warn(
+        `[windows-process-table] the addon staged beside the relay bundle still imports ` +
+          `${FLAGGED_ADDON_IMPORT}, so it was built from unpatched source and reads every ` +
+          'process address space. Refusing it and falling back to the CIM scan; redeploy the ' +
+          'relay so the staged addon is rebuilt.'
+      )
+      cachedModule = null
+      return cachedModule
+    }
+    cachedModule = adaptAddon(addon)
   } catch {
     cachedModule = null
   }
@@ -160,26 +235,122 @@ const WINDOWS_PROCESS_QUERY_TIMEOUT_MS = 3_000
  * Reads that missed their deadline and have not called back yet.
  * Refusing re-entry bounds both vendored callbacks and relay addon workers to
  * one; read ids keep a late callback from clearing a newer wedge.
+ *
+ * One gate for both flag sets, not one each: they call the same addon, so a
+ * wedged read latches the one `requestInProgress` and pins the one libuv slot
+ * whichever flags asked for it. Retention stays at exactly one callback rather
+ * than one per reader because `nativeReadGate` below already admits only one
+ * native call at a time; read ids are module-global and monotonic, so a late
+ * callback can only clear its own wedge.
  */
 const unreturnedReads = new Set<number>()
 let readSequence = 0
 let nativeReaderEpoch = 0
 
+/**
+ * Admits one native read at a time, across both flag sets. Nothing else does.
+ *
+ * The npm wrapper coalesces rather than queues: `getRawProcessList` pushes the
+ * callback onto one list and only calls the addon when no request is in
+ * progress, so a second concurrent caller's `flags` are DISCARDED and it is
+ * handed the first caller's rows. An identity read racing a detailed read
+ * therefore returns a table with every command line EMPTY, which agent
+ * recognition reads as "no agent" -- silently, and only under concurrency.
+ * Measured against the real addon: identity issued first, both callers got the
+ * same array, 0 of 541 rows with a command line.
+ *
+ * Nothing above stops that. Each cache single-flights only within itself
+ * (`inFlight` is a closure per reader) and the wedge set latches only after a
+ * read misses its 3s deadline, so through the healthy ~12ms of a scan neither
+ * excludes the other. Overlap is the normal state, not an edge case: panes poll
+ * detailed every 750ms while a teardown takes identity snapshots.
+ *
+ * It also has to be here for the relay's bare addon, which has no queue at all:
+ * two simultaneous `CreateToolhelp32Snapshot` calls are the crash the vendor's
+ * queue exists to prevent.
+ *
+ * Every link settles -- a wedged read still rejects on its deadline -- so a
+ * waiter is never stranded; it re-checks the wedge and rejects instead.
+ */
+let nativeReadGate: Promise<unknown> = Promise.resolve()
+
 function resetNativeReaderState(): void {
   nativeReaderEpoch += 1
   unreturnedReads.clear()
+  // Chain, never replace. Dropping the old chain lets a waiter still holding it
+  // run against a read queued on the new one -- two concurrent calls into one
+  // mock addon, which is precisely the coalescing these suites exist to catch.
+  // Every link settles within the deadline, so the wait this costs is bounded.
+  nativeReadGate = nativeReadGate.then(ignoreSettlement, ignoreSettlement)
 }
 
-function readNativeRows(): Promise<WindowsProcessRow[]> {
+/** A flag set and the row shape it can honestly produce. */
+type ProcessRowProjection<Row> = {
+  flags: (native: WindowsProcessTreeModule) => number
+  fromNative: (row: NativeProcessInfo) => Row
+  /**
+   * The no-binding scan, on the one flag set it can serve. Absent on the other,
+   * because a relay must never run two `Get-CimInstance` scans at ~1.4s each --
+   * `readWindowsProcessIdentityTable` projects the detailed snapshot instead.
+   */
+  cimFallback?: () => Promise<Row[]>
+}
+
+function toIdentityRow(row: {
+  pid: number
+  ppid: number
+  name: string
+  creationTimeMs?: number
+}): WindowsProcessIdentityRow {
+  return {
+    pid: row.pid,
+    ppid: row.ppid,
+    name: row.name,
+    ...(typeof row.creationTimeMs === 'number' ? { creationTimeMs: row.creationTimeMs } : {})
+  }
+}
+
+/**
+ * Toolhelp32 and nothing else: no `OpenProcess` per process, so this read has
+ * none of the shape an EDR scores as walking another process's memory.
+ */
+const IDENTITY_PROJECTION: ProcessRowProjection<WindowsProcessIdentityRow> = {
+  flags: (native) => native.ProcessDataFlag.None | (native.ProcessDataFlag.CreationTime ?? 0),
+  fromNative: toIdentityRow
+}
+
+/**
+ * Adds, per process, one `OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION)` and an
+ * `NtQueryInformationProcess(ProcessCommandLineInformation)` -- which is what
+ * agent recognition and port attribution match on. `Memory` is deliberately
+ * absent: it took a second handle carrying `PROCESS_VM_READ` and then never read
+ * through it, and no caller reads a working set off this table (the Resource
+ * Manager runs its own sweep, and the native field wraps above 4 GB anyway).
+ */
+const DETAILED_PROJECTION: ProcessRowProjection<WindowsProcessRow> = {
+  flags: (native) => IDENTITY_PROJECTION.flags(native) | native.ProcessDataFlag.CommandLine,
+  fromNative: (row) => ({ ...toIdentityRow(row), command: row.commandLine ?? '' }),
+  cimFallback: readCimRows
+}
+
+function ignoreSettlement(): void {}
+
+function readNativeRows<Row>(projection: ProcessRowProjection<Row>): Promise<Row[]> {
+  const attempt = nativeReadGate.then(() => readOneSnapshot(projection))
+  nativeReadGate = attempt.then(ignoreSettlement, ignoreSettlement)
+  return attempt
+}
+
+function readOneSnapshot<Row>(projection: ProcessRowProjection<Row>): Promise<Row[]> {
   const native = moduleLoader()
   if (!native) {
-    if (process.platform === 'win32') {
+    if (process.platform === 'win32' && projection.cimFallback) {
       // Why only when the module is absent: a binding that loads is the fast
       // path even when a read fails or wedges, so a failing native reader must
       // never silently start forking shells at the caller's poll rate. Absence
       // is the one condition that can never resolve itself — see
       // docs/reference/windows-process-enumeration.md.
-      return readCimRows()
+      return projection.cimFallback()
     }
     // Reject rather than resolve empty: an empty table is a claim that nothing
     // is running, and callers act on that by force-killing or by declaring a
@@ -193,16 +364,7 @@ function readNativeRows(): Promise<WindowsProcessRow[]> {
   }
   const readId = ++readSequence
   const readerEpoch = nativeReaderEpoch
-  // Why CommandLine but not Memory: each flag costs one OpenProcess per process
-  // inside the addon (process.cc), and every caller of this table matches on
-  // `command`, while nothing reads a working set off it -- the Resource Manager
-  // runs its own CIM sweep because it needs commit and CPU time in one pass, and
-  // `process.cc` truncates the working set into a DWORD anyway. Dropping Memory
-  // halves the per-snapshot handle count; the remaining flags stay in ONE flag
-  // set because every read shares one snapshot, so a 32-wide teardown collapses
-  // into a single scan. Splitting the cache per field set would restore exactly
-  // the fan-out it exists to prevent.
-  const flags = native.ProcessDataFlag.CommandLine | (native.ProcessDataFlag.CreationTime ?? 0)
+  const flags = projection.flags(native)
   return new Promise((resolve, reject) => {
     // Hoisted so a synchronous throw from getAllProcesses can clear it. An
     // orphaned timer would otherwise fire later and wedge a reader that had
@@ -238,17 +400,11 @@ function readNativeRows(): Promise<WindowsProcessRow[]> {
           reject(new Error('windows process table is unreadable'))
           return
         }
-        resolve(
-          processes.map((row) => ({
-            pid: row.pid,
-            ppid: row.ppid,
-            name: row.name,
-            command: row.commandLine ?? '',
-            ...(typeof row.creationTimeMs === 'number'
-              ? { creationTimeMs: row.creationTimeMs }
-              : {})
-          }))
-        )
+        // Only meaningful when a command line was actually asked for.
+        if ((flags & native.ProcessDataFlag.CommandLine) !== 0) {
+          reportWindowsCommandLineRecoveryHealth(processes)
+        }
+        resolve(processes.map(projection.fromNative))
       }, flags)
     } catch (error) {
       clearTimeout(deadline)
@@ -275,14 +431,38 @@ async function readCimRows(): Promise<WindowsProcessRow[]> {
 // Why still cache: the snapshot is cheap but not free, and a worktree delete
 // tears down PTYs 32-wide. The shared TTL + single-in-flight reader collapses
 // that burst into one scan, exactly as the PowerShell path had to.
-const snapshotReader = createProcessTableSnapshotReader<WindowsProcessRow[]>({
-  runPs: readNativeRows,
+//
+// Why two caches are safe where N would not be: the fan-out this prevents is
+// one scan per *caller*, and each reader below still serves every caller that
+// wants its flag set, so a 32-wide teardown collapses into one scan per flag
+// set. Two is the number of distinct native calls that exist -- a third cache
+// would need a third flag set, never a third caller.
+const identityReader = createProcessTableSnapshotReader<WindowsProcessIdentityRow[]>({
+  runPs: () => readNativeRows(IDENTITY_PROJECTION),
+  now: () => Date.now()
+})
+const detailedReader = createProcessTableSnapshotReader<WindowsProcessRow[]>({
+  runPs: () => readNativeRows(DETAILED_PROJECTION),
   now: () => Date.now()
 })
 
-/** Cached snapshot, refreshed on the shared TTL. */
+/**
+ * With no binding there is only one scan to run and it is the expensive one, so
+ * the identity view rides the detailed snapshot rather than forking a second
+ * `powershell.exe` at ~1.4 s a scan. Projected, not merely widened: an identity
+ * row must not carry a command line on any host.
+ */
+async function readIdentityRows(fresh: boolean): Promise<WindowsProcessIdentityRow[]> {
+  if (moduleLoader() === null) {
+    const rows = await (fresh ? detailedReader.getFreshSnapshot() : detailedReader.getSnapshot())
+    return rows.map(toIdentityRow)
+  }
+  return fresh ? identityReader.getFreshSnapshot() : identityReader.getSnapshot()
+}
+
+/** Cached command-line snapshot, refreshed on the shared TTL. */
 export function readWindowsProcessTable(): Promise<WindowsProcessRow[]> {
-  return snapshotReader.getSnapshot()
+  return detailedReader.getSnapshot()
 }
 
 /**
@@ -292,7 +472,17 @@ export function readWindowsProcessTable(): Promise<WindowsProcessRow[]> {
  * the very process exit it is being asked about.
  */
 export function readWindowsProcessTableFresh(): Promise<WindowsProcessRow[]> {
-  return snapshotReader.getFreshSnapshot()
+  return detailedReader.getFreshSnapshot()
+}
+
+/** Cached pid/ppid/name snapshot. Prefer this whenever no command line is read. */
+export function readWindowsProcessIdentityTable(): Promise<WindowsProcessIdentityRow[]> {
+  return readIdentityRows(false)
+}
+
+/** The identity snapshot, from a scan that starts after this call. */
+export function readWindowsProcessIdentityTableFresh(): Promise<WindowsProcessIdentityRow[]> {
+  return readIdentityRows(true)
 }
 
 /** Whether the native table can be read at all on this host. */
@@ -311,6 +501,11 @@ export function isWindowsProcessStartTimeAvailable(): boolean {
   return native !== null && typeof native.ProcessDataFlag.CreationTime === 'number'
 }
 
+function resetSnapshotReaders(): void {
+  identityReader.reset()
+  detailedReader.reset()
+}
+
 /**
  * Test-only: substitute the native module.
  *
@@ -324,18 +519,21 @@ export function __setWindowsProcessTreeLoaderForTests(
   moduleLoader = loader ?? loadWindowsProcessTree
   cachedModule = undefined
   resetNativeReaderState()
-  snapshotReader.reset()
+  resetSnapshotReaders()
 }
 
-/** Test-only: substitute the require that resolves the package and the addon. */
-export function __setWindowsProcessTreeRequireForTests(
-  resolve?: (specifier: string) => unknown
-): void {
+/**
+ * Test-only: substitute the require that resolves the package and the addon.
+ *
+ * Attach a `resolve` to the injected function to also exercise the staged-addon
+ * binary check; without one, the loader has no path to inspect.
+ */
+export function __setWindowsProcessTreeRequireForTests(resolve?: NativeRequire): void {
   requireNative = resolve ?? requireFromMain
   moduleLoader = loadWindowsProcessTree
   cachedModule = undefined
   resetNativeReaderState()
-  snapshotReader.reset()
+  resetSnapshotReaders()
 }
 
 /** Test-only: substitute the no-binding PowerShell scan, which spawns a child. */
@@ -343,12 +541,12 @@ export function __setWindowsProcessTableCimScanForTests(
   scan?: () => Promise<WindowsProcessRow[]>
 ): void {
   cimScan = scan ?? readWindowsProcessRowsWithCim
-  snapshotReader.reset()
+  resetSnapshotReaders()
 }
 
-/** Test-only: drop the shared snapshot so suites cannot serve each other's rows. */
+/** Test-only: drop the shared snapshots so suites cannot serve each other's rows. */
 export function resetWindowsProcessTableForTests(): void {
-  snapshotReader.reset()
+  resetSnapshotReaders()
   cachedModule = undefined
   resetNativeReaderState()
 }
diff --git a/src/main/windows/windows-process-tree-command-line-patch.test.ts b/src/main/windows/windows-process-tree-command-line-patch.test.ts
new file mode 100644
index 00000000000..1eaa4459c9e
--- /dev/null
+++ b/src/main/windows/windows-process-tree-command-line-patch.test.ts
@@ -0,0 +1,188 @@
+import { spawn } from 'node:child_process'
+import { readFileSync } from 'node:fs'
+import { createRequire } from 'node:module'
+import { join, resolve } from 'node:path'
+import { afterAll, beforeAll, describe, expect, it } from 'vitest'
+
+/**
+ * The command-line reader is a patch, not repo source, so its contract is
+ * asserted against the patch's post-image. MDE scored the addon for
+ * `OpenProcess(PROCESS_VM_READ)` + `ReadProcessMemory` over the whole process
+ * table on a timer; these cases exist so a patch refresh cannot quietly restore
+ * that primitive.
+ */
+const PATCH_PATH = resolve(
+  import.meta.dirname,
+  '../../../config/patches/@vscode__windows-process-tree@0.8.0.patch'
+)
+
+/** Reconstruct a file as the patch leaves it: context plus added lines. */
+function patchedFile(patch: string, path: string): string {
+  const lines = patch.split('\n')
+  const start = lines.findIndex((line) => line.startsWith(`diff --git a/${path} `))
+  if (start === -1) {
+    throw new Error(`${path} is not in the patch`)
+  }
+  const rest = lines.slice(start + 1)
+  const end = rest.findIndex((line) => line.startsWith('diff --git '))
+  return (
+    (end === -1 ? rest : rest.slice(0, end))
+      // A context line for an empty source line is a bare space, and unified
+      // diffs may drop even that, so an empty string is context too.
+      .filter((line) => line === '' || line.startsWith(' ') || line.startsWith('+'))
+      .filter((line) => !line.startsWith('+++') && !line.startsWith('@@'))
+      .map((line) => line.slice(1))
+      .join('\n')
+  )
+}
+
+const patch = readFileSync(PATCH_PATH, 'utf8')
+const commandLineSource = patchedFile(patch, 'src/process_commandline.cc')
+const processSource = patchedFile(patch, 'src/process.cc')
+
+describe('windows-process-tree command line patch', () => {
+  it('reads the command line through ProcessCommandLineInformation', () => {
+    // Class 60 is Windows 8.1+; Electron's floor is Windows 10, so every OS
+    // Orca supports has it.
+    expect(commandLineSource).toContain('kProcessCommandLineInformation = 60')
+    expect(commandLineSource).toContain('OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION')
+  })
+
+  it('resolves NtQueryInformationProcess dynamically rather than linking it', () => {
+    expect(commandLineSource).toContain('GetModuleHandleW(L"ntdll.dll")')
+    expect(commandLineSource).toContain('GetProcAddress(ntdll, "NtQueryInformationProcess")')
+  })
+
+  it('probes the buffer size before allocating, and caps it', () => {
+    // STATUS_INFO_LENGTH_MISMATCH / STATUS_BUFFER_TOO_SMALL carry the size.
+    expect(commandLineSource).toContain(
+      'kStatusInfoLengthMismatch = static_cast<NTSTATUS>(0xC0000004L)'
+    )
+    expect(commandLineSource).toContain(
+      'kStatusBufferTooSmall = static_cast<NTSTATUS>(0xC0000023L)'
+    )
+    expect(commandLineSource).toMatch(
+      /query\(process, kProcessCommandLineInformation, nullptr, 0, &size\)/
+    )
+    // UNICODE_STRING::Length is a USHORT, so a bogus size must not become a
+    // bad_alloc that fails the whole scan.
+    expect(commandLineSource).toContain('size > kMaxCommandLineBytes')
+  })
+
+  it('treats the returned UNICODE_STRING as untrusted', () => {
+    // A hooked ntdll is the environment this reader targets, so an unchecked
+    // Buffer/Length would be an over-read encoded straight into JS. The bound
+    // must be buffer.size(), not `size`, which the second query overwrites.
+    expect(commandLineSource).toContain('const unsigned char* end = begin + buffer.size()')
+    expect(commandLineSource).toMatch(/chars == nullptr \|\|/)
+    expect(commandLineSource).toMatch(/command_line->Length > static_cast<ULONG>\(end - chars\)/)
+  })
+
+  it('has no PEB fallback and no latch that could reinstate one', () => {
+    // The fallback used to be reachable from any single anomalous NTSTATUS,
+    // which on an EDR-hooked ntdll is the realistic case -- one stray status
+    // would have silently restored the primitive for the process lifetime.
+    expect(commandLineSource).not.toContain('ReadCommandLineFromPeb')
+    expect(commandLineSource).not.toContain('PROCESS_BASIC_INFORMATION')
+    expect(commandLineSource).not.toContain('InterlockedExchange')
+    expect(commandLineSource).not.toMatch(/ReadProcessMemory\(/)
+  })
+
+  it('acquires PROCESS_VM_READ nowhere in the addon', () => {
+    for (const source of [commandLineSource, processSource]) {
+      expect(source).not.toMatch(/OpenProcess\([^)]*PROCESS_VM_READ/)
+      expect(source).not.toMatch(/ReadProcessMemory\(/)
+    }
+    // Memory and CPU counters kept VM_READ and never read an address space.
+    expect(processSource.match(/OpenProcess\(PROCESS_QUERY_LIMITED_INFORMATION/g)).toHaveLength(2)
+  })
+
+  it('value-initializes ProcessInfo so memory is not stack garbage', () => {
+    // Measured before: 82 processes reported the same bogus working set.
+    expect(processSource).toContain('ProcessInfo pinfo{};')
+  })
+})
+
+type Addon = {
+  getProcessList: (
+    callback: (rows: { pid: number; commandLine?: string }[] | undefined) => void,
+    flags: number
+  ) => void
+}
+
+const addonRequire = createRequire(import.meta.url)
+
+function loadAddon(): Addon {
+  const packageEntry = addonRequire.resolve('@vscode/windows-process-tree')
+  return addonRequire(
+    join(packageEntry, '..', '..', 'build', 'Release', 'windows_process_tree.node')
+  ) as Addon
+}
+
+// Why fail rather than skip on win32: the published tarball ships a loadable
+// prebuilt built from unpatched source, and both readers emit byte-identical
+// strings, so a skipping suite would pass against the very binary this patch
+// exists to keep out. On win32 the addon must be present, and it must be ours.
+describe.runIf(process.platform === 'win32')('windows-process-tree command line addon', () => {
+  // Why not at collection time: a require that throws there fails the whole
+  // file, and the patch-text cases above need no binary at all -- a Windows
+  // checkout without a built addon would lose them to an unrelated failure.
+  let addon: Addon
+  beforeAll(() => {
+    addon = loadAddon()
+  })
+  const children: { kill: () => void }[] = []
+  afterAll(() => {
+    for (const child of children) {
+      try {
+        child.kill()
+      } catch {
+        // already gone
+      }
+    }
+  })
+
+  const scan = async (): Promise<Map<number, string>> =>
+    new Promise((resolveScan) => {
+      addon.getProcessList((rows) => {
+        resolveScan(new Map((rows ?? []).map((row) => [row.pid, row.commandLine ?? ''])))
+      }, 2 /* ProcessDataFlag.CommandLine */)
+    })
+
+  it('was built from the patched source, not the published prebuild', () => {
+    // The patched reader never calls ReadProcessMemory, so the symbol is
+    // absent from its import table. This is the only check that tells the two
+    // binaries apart -- a bare require() cannot.
+    const packageEntry = addonRequire.resolve('@vscode/windows-process-tree')
+    const binary = readFileSync(
+      join(packageEntry, '..', '..', 'build', 'Release', 'windows_process_tree.node')
+    )
+    expect(binary.includes('ReadProcessMemory')).toBe(false)
+  })
+
+  it('recovers command lines byte-for-byte, quoting and trailing spaces included', async () => {
+    const marker = `orca-cmdline-${Date.now()}`
+    // Quotes and trailing whitespace are exactly what a re-quoting bug eats.
+    const child = spawn(process.execPath, ['-e', 'setTimeout(() => {}, 20000)', `"${marker}"  `], {
+      windowsHide: true,
+      stdio: 'ignore'
+    })
+    children.push(child)
+    await new Promise((r) => setTimeout(r, 400))
+
+    const rows = await scan()
+    const command = rows.get(child.pid!)
+    expect(command).toBeDefined()
+    expect(command).toContain(marker)
+    expect(command!.endsWith('  "') || command!.endsWith('  ')).toBe(true)
+  })
+
+  it('reports the querying process and most of the table', async () => {
+    const rows = await scan()
+    expect(rows.has(process.pid)).toBe(true)
+    const recovered = [...rows.values()].filter((command) => command.length > 0)
+    // Protected and cross-session processes legitimately deny a handle; a
+    // wholesale regression would show up as almost nothing recovered.
+    expect(recovered.length).toBeGreaterThan(rows.size * 0.25)
+  })
+})
diff --git a/src/main/windows/windows-pty-job.ts b/src/main/windows/windows-pty-job.ts
index 193b1d8825a..169db375f3b 100644
--- a/src/main/windows/windows-pty-job.ts
+++ b/src/main/windows/windows-pty-job.ts
@@ -118,8 +118,10 @@ export function terminatePtyJob(proc: IPty): JobTerminationOutcome {
 /**
  * Pids still alive in a PTY's tree, or null when there is no answer.
  *
- * Measured on Windows 11: once the shell exits, node-pty drops its handle
- * record and closes the job, so a terminated tree reports **null**, not `[]`.
+ * Measured on Windows 11: once the shell exits, node-pty closes the job, so a
+ * terminated tree reports **null**, not `[]`. (Its handle record now outlives
+ * the shell until `kill()` runs — see config/patches/node-pty@1.1.0.patch — but
+ * the nulled job handle is what makes the answer null either way.)
  * Null therefore means "unverifiable" in the sense of
  * docs/reference/ssh-execution-boundary.md — this build has no job support,
  * the terminal is not a ConPTY, or it is no longer tracked. It is never
diff --git a/src/main/worktree-create-base-prefetch.test.ts b/src/main/worktree-create-base-prefetch.test.ts
index cfe8a76799a..af80afe4b41 100644
--- a/src/main/worktree-create-base-prefetch.test.ts
+++ b/src/main/worktree-create-base-prefetch.test.ts
@@ -160,12 +160,14 @@ describe('prefetchWorktreeCreateBase local git routing', () => {
   })
 
   it('does not resolve a local base for SSH repos', async () => {
+    const prepareCheckout = vi.fn()
     const provider = { exec: vi.fn() }
     mocks.getSshGitProvider.mockReturnValue(provider)
 
     await expect(
       prefetchWorktreeCreateBase({
         repo: { ...repo, connectionId: 'conn-1' },
+        prepareCheckout,
         baseBranch: 'origin/main',
         runtime: runtime(),
         gitOptions: WSL
@@ -178,5 +180,145 @@ describe('prefetchWorktreeCreateBase local git routing', () => {
       { baseBranch: 'origin/main' }
     )
     expect(mocks.gitExecFileAsync).not.toHaveBeenCalled()
+    expect(prepareCheckout).not.toHaveBeenCalled()
   })
 })
+
+describe('checkout and refresh overlap', () => {
+  it.each([{}, WSL])(
+    'starts one checkout before a blocked refresh finishes on %j',
+    async (gitOptions) => {
+      const base = {
+        remote: 'origin',
+        branch: 'main',
+        ref: 'refs/remotes/origin/main',
+        base: 'origin/main'
+      }
+      mocks.resolveRemoteTrackingBase.mockResolvedValue(base)
+      mocks.hasRemoteTrackingRef.mockResolvedValue(true)
+      let release!: () => void
+      mocks.getOrStartRemoteTrackingBaseRefresh.mockImplementation(
+        () =>
+          new Promise<void>((resolve) => {
+            release = resolve
+          })
+      )
+      const prepareCheckout = vi.fn().mockResolvedValue(undefined)
+      let settled = false
+      const result = prefetchWorktreeCreateBase({
+        repo,
+        baseBranch: 'origin/main',
+        runtime: runtime(),
+        gitOptions,
+        prepareCheckout
+      }).finally(() => {
+        settled = true
+      })
+      await vi.waitFor(() => expect(prepareCheckout).toHaveBeenCalledWith('origin/main'))
+      expect(settled).toBe(false)
+      release()
+      await expect(result).resolves.toBe('origin/main')
+      expect(prepareCheckout).toHaveBeenCalledTimes(1)
+    }
+  )
+
+  it('waits for refresh when the selected base is not local', async () => {
+    mocks.resolveRemoteTrackingBase.mockResolvedValue({
+      remote: 'origin',
+      branch: 'main',
+      ref: 'refs/remotes/origin/main',
+      base: 'origin/main'
+    })
+    let release!: () => void
+    mocks.getOrStartRemoteTrackingBaseRefresh.mockImplementation(
+      () =>
+        new Promise<void>((resolve) => {
+          release = resolve
+        })
+    )
+    const prepareCheckout = vi.fn().mockResolvedValue(undefined)
+    const result = prefetchWorktreeCreateBase({
+      repo,
+      baseBranch: 'origin/main',
+      runtime: runtime(),
+      gitOptions: {},
+      prepareCheckout
+    })
+    await vi.waitFor(() =>
+      expect(mocks.getOrStartRemoteTrackingBaseRefresh).toHaveBeenCalledTimes(1)
+    )
+    expect(prepareCheckout).not.toHaveBeenCalled()
+    release()
+    await result
+    expect(prepareCheckout).toHaveBeenCalledTimes(1)
+  })
+
+  it('does not fail a successful refresh because preparation fails', async () => {
+    mocks.resolveRemoteTrackingBase.mockResolvedValue({
+      remote: 'origin',
+      branch: 'main',
+      ref: 'refs/remotes/origin/main',
+      base: 'origin/main'
+    })
+    mocks.hasRemoteTrackingRef.mockResolvedValue(true)
+    const prepareCheckout = vi.fn().mockRejectedValue(new Error('checkout failed'))
+    await expect(
+      prefetchWorktreeCreateBase({
+        repo,
+        baseBranch: 'origin/main',
+        runtime: runtime(),
+        gitOptions: {},
+        prepareCheckout
+      })
+    ).resolves.toBe('origin/main')
+    expect(prepareCheckout).toHaveBeenCalledTimes(1)
+  })
+
+  it('settles preparation before propagating refresh failure', async () => {
+    mocks.resolveRemoteTrackingBase.mockResolvedValue({
+      remote: 'origin',
+      branch: 'main',
+      ref: 'refs/remotes/origin/main',
+      base: 'origin/main'
+    })
+    mocks.hasRemoteTrackingRef.mockResolvedValue(true)
+    const error = new Error('refresh failed')
+    mocks.getOrStartRemoteTrackingBaseRefresh.mockRejectedValue(error)
+    let release!: () => void
+    const prepareCheckout = vi.fn(
+      () =>
+        new Promise<void>((resolve) => {
+          release = resolve
+        })
+    )
+    let settled = false
+    const result = prefetchWorktreeCreateBase({
+      repo,
+      baseBranch: 'origin/main',
+      runtime: runtime(),
+      gitOptions: {},
+      prepareCheckout
+    }).finally(() => {
+      settled = true
+    })
+    const assertion = expect(result).rejects.toBe(error)
+    await vi.waitFor(() => expect(prepareCheckout).toHaveBeenCalledTimes(1))
+    expect(settled).toBe(false)
+    release()
+    await assertion
+  })
+})
+
+it('does not prepare folder repositories', async () => {
+  const prepareCheckout = vi.fn()
+  await expect(
+    prefetchWorktreeCreateBase({
+      repo: { ...repo, kind: 'folder' },
+      runtime: runtime(),
+      gitOptions: {},
+      prepareCheckout
+    })
+  ).resolves.toBeUndefined()
+  expect(prepareCheckout).not.toHaveBeenCalled()
+  expect(mocks.gitExecFileAsync).not.toHaveBeenCalled()
+})
diff --git a/src/main/worktree-create-base-prefetch.ts b/src/main/worktree-create-base-prefetch.ts
index a0ce1822d9c..8db177a3e9c 100644
--- a/src/main/worktree-create-base-prefetch.ts
+++ b/src/main/worktree-create-base-prefetch.ts
@@ -45,7 +45,8 @@ async function prefetchLocalWorktreeCreateBase(
   repo: Repo,
   baseBranch: string | undefined,
   runtime: WorktreeCreateBasePrefetchRuntime,
-  options: WorktreeCreateBaseGitOptions
+  options: WorktreeCreateBaseGitOptions,
+  prepareLocalCheckout: (base: string) => void
 ): Promise<string | undefined> {
   // Keep host-routed calls at their original arity so they stay on the runtime's default options.
   const optionArgs: [] | [WorktreeCreateBaseGitOptions] = options.wslDistro ? [options] : []
@@ -83,8 +84,17 @@ async function prefetchLocalWorktreeCreateBase(
     ...optionArgs
   )
   if (remoteTrackingBase) {
+    const hasTrackingRef = await runtime.hasRemoteTrackingRef(
+      repo.path,
+      remoteTrackingBase,
+      ...optionArgs
+    )
+    if (hasTrackingRef) {
+      // Finalization revalidates the refreshed commit before exposing the checkout.
+      prepareLocalCheckout(resolvedBaseBranch)
+    }
     if (
-      (await runtime.hasRemoteTrackingRef(repo.path, remoteTrackingBase, ...optionArgs)) ||
+      hasTrackingRef ||
       !(await hasLocalWorktreeBaseRef(repo.path, resolvedBaseBranch, options))
     ) {
       await runtime.getOrStartRemoteTrackingBaseRefresh(
@@ -114,6 +124,7 @@ export async function prefetchWorktreeCreateBase(args: {
   /** Routing for the project's Git host; required so a caller cannot silently
    *  warm up the wrong ref store — pass `{}` for host Git. */
   gitOptions: WorktreeCreateBaseGitOptions
+  prepareCheckout?: (base: string) => Promise<void>
 }): Promise<string | undefined> {
   if (isFolderRepo(args.repo)) {
     return undefined
@@ -126,5 +137,29 @@ export async function prefetchWorktreeCreateBase(args: {
     await prefetchRemoteWorktreeCreateBase(provider, args.repo, { baseBranch: args.baseBranch })
     return undefined
   }
-  return prefetchLocalWorktreeCreateBase(args.repo, args.baseBranch, args.runtime, args.gitOptions)
+  const prepareCheckout = args.prepareCheckout
+  let preparation: Promise<void> | undefined
+  const prepare = (base: string): void => {
+    if (!preparation && prepareCheckout) {
+      preparation = Promise.resolve()
+        .then(() => prepareCheckout(base))
+        .catch(() => {})
+    }
+  }
+  try {
+    const base = await prefetchLocalWorktreeCreateBase(
+      args.repo,
+      args.baseBranch,
+      args.runtime,
+      args.gitOptions,
+      prepare
+    )
+    if (base) {
+      prepare(base)
+    }
+    return base
+  } finally {
+    // Settle speculative work even if refresh fails; Create owns error reporting.
+    await preparation
+  }
 }
diff --git a/src/main/worktree-create-preparation-cancellation.test.ts b/src/main/worktree-create-preparation-cancellation.test.ts
new file mode 100644
index 00000000000..7974dcb7e3d
--- /dev/null
+++ b/src/main/worktree-create-preparation-cancellation.test.ts
@@ -0,0 +1,259 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type * as WorktreeLogic from './ipc/worktree-logic'
+import type { Store } from './persistence'
+import { WORKTREE_CREATE_PREPARATION_TTL_MS } from './worktree-create-preparation-pool'
+import type { Repo } from '../shared/repo-types'
+import { resolveWorktreeAddBaseRef } from '../shared/worktree/base-ref'
+
+const mocks = vi.hoisted(() => ({
+  mkdir: vi.fn(),
+  listWorktreeGraph: vi.fn(),
+  prepareCheckout: vi.fn(),
+  finalize: vi.fn(),
+  discard: vi.fn(),
+  unlock: vi.fn(),
+  getWorktreeOptions: vi.fn(),
+  computeWorkspaceRoot: vi.fn(),
+  computeWorkspaceRootAsync: vi.fn(),
+  resolveBaseRef: vi.fn(),
+  measureDivergence: vi.fn()
+}))
+
+vi.mock('node:fs/promises', () => ({ mkdir: mocks.mkdir }))
+vi.mock('./git/worktree', () => ({ listWorktreeGraph: mocks.listWorktreeGraph }))
+vi.mock('./git/worktree-create-preparation', () => ({
+  prepareWorktreeCreateCheckout: mocks.prepareCheckout,
+  finalizePreparedWorktree: mocks.finalize,
+  discardPreparedWorktree: mocks.discard,
+  unlockPreparedWorktree: mocks.unlock
+}))
+vi.mock('./git/worktree-base-ref-probe', () => ({
+  resolveLocalWorktreeBaseRef: mocks.resolveBaseRef
+}))
+vi.mock('./git/worktree-base-divergence', () => ({
+  measureRetargetDivergence: mocks.measureDivergence
+}))
+vi.mock('./project-runtime-git-options', () => ({
+  getLocalProjectWorktreeGitOptions: mocks.getWorktreeOptions,
+  getWorktreeMirrorDistro: () => undefined
+}))
+vi.mock('./ipc/worktree-logic', async (importOriginal) => ({
+  isOrphanedWorktreeError: (await importOriginal<typeof WorktreeLogic>()).isOrphanedWorktreeError,
+  computeWorkspaceRoot: mocks.computeWorkspaceRoot,
+  computeWorkspaceRootAsync: mocks.computeWorkspaceRootAsync,
+  getWorktreePathSettings: () => ({
+    workspaceDir: process.platform === 'win32' ? 'C:\\workspace' : '/workspace',
+    nestWorkspaces: false
+  })
+}))
+
+import {
+  _resetWorktreeCreatePreparationsForTests,
+  consumePreparedWorktreeCreate,
+  prepareWorktreeCreateForRepo
+} from './worktree-create-preparation'
+
+// Evictions and retries are fire-and-forget, so let them settle before asserting.
+function flushBackgroundWork(ms = 0): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms))
+}
+
+const EXISTING_REFS = new Set([
+  'refs/heads/main',
+  'refs/remotes/origin/main',
+  'refs/remotes/origin/release'
+])
+const repo = { id: 'repo-1', path: '/repo' } as Repo
+const store = { getSettings: () => ({}) } as unknown as Store
+
+beforeEach(() => {
+  mocks.mkdir.mockReset().mockResolvedValue(undefined)
+  mocks.listWorktreeGraph.mockReset().mockResolvedValue([])
+  mocks.prepareCheckout.mockReset().mockResolvedValue(undefined)
+  mocks.finalize.mockReset().mockResolvedValue({})
+  mocks.discard.mockReset().mockResolvedValue(undefined)
+  mocks.unlock.mockReset().mockResolvedValue(undefined)
+  mocks.getWorktreeOptions.mockReset().mockReturnValue({})
+  mocks.measureDivergence.mockReset().mockResolvedValue('within')
+  mocks.resolveBaseRef
+    .mockReset()
+    .mockImplementation((_repoPath: string, baseRef: string) =>
+      resolveWorktreeAddBaseRef(baseRef, async (candidate) => EXISTING_REFS.has(candidate))
+    )
+  mocks.computeWorkspaceRoot.mockReset().mockImplementation(() => {
+    throw new Error('synchronous workspace-root lookup must not run on the main thread')
+  })
+  mocks.computeWorkspaceRootAsync
+    .mockReset()
+    .mockImplementation(async (repoPath: string) =>
+      process.platform === 'win32' && /^[A-Za-z]:[\\/]/.test(repoPath)
+        ? 'C:\\workspace'
+        : '/workspace'
+    )
+})
+
+afterEach(async () => {
+  await _resetWorktreeCreatePreparationsForTests()
+})
+
+// Why this file exists separately from worktree-create-preparation.test.ts: it holds the
+// in-flight checkout cancellation paths (eviction, expiry, caller abort) and the discard that
+// follows, keeping both suites under the test-file line limit.
+describe('worktree create preparation cancellation', () => {
+  it('cancels an evicted checkout and cleans up with the original options', async () => {
+    let signal: AbortSignal | undefined
+    mocks.prepareCheckout.mockImplementationOnce((_repo, _path, _base, _lock, options) => {
+      signal = options.signal
+      return new Promise<void>((_resolve, reject) => {
+        signal!.addEventListener('abort', () => reject(signal!.reason), { once: true })
+      })
+    })
+    const obsolete = prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    const settled = Promise.allSettled([obsolete])
+    await flushBackgroundWork()
+    const obsoletePath = mocks.prepareCheckout.mock.calls[0][1]
+    for (const base of ['origin/one', 'origin/two', 'origin/three']) {
+      await prepareWorktreeCreateForRepo(store, repo, base)
+    }
+    expect(signal?.aborted).toBe(true)
+    expect((await settled)[0].status).toBe('rejected')
+    await flushBackgroundWork()
+    expect(mocks.discard).toHaveBeenCalledWith(repo.path, obsoletePath, {})
+  })
+
+  it('does not retry a discard whose registration the aborted checkout already removed', async () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    mocks.prepareCheckout.mockImplementationOnce((_repo, _path, _base, _lock, options) => {
+      const signal = options.signal!
+      return new Promise<void>((_resolve, reject) => {
+        signal.addEventListener('abort', () => reject(signal.reason), { once: true })
+      })
+    })
+    try {
+      const obsolete = prepareWorktreeCreateForRepo(store, repo, 'origin/main').catch(() => {})
+      await flushBackgroundWork()
+      const obsoletePath = mocks.prepareCheckout.mock.calls[0][1] as string
+      mocks.discard.mockImplementation(async (_repoPath: string, path: string) => {
+        if (path === obsoletePath) {
+          throw Object.assign(new Error(`fatal: '${path}' is not a working tree`), {
+            stderr: `fatal: '${path}' is not a working tree`
+          })
+        }
+      })
+      for (const base of ['origin/one', 'origin/two', 'origin/three']) {
+        await prepareWorktreeCreateForRepo(store, repo, base)
+      }
+      await obsolete
+      await flushBackgroundWork()
+      const obsoleteDiscards = (): number =>
+        mocks.discard.mock.calls.filter((call) => call[1] === obsoletePath).length
+      expect(obsoleteDiscards()).toBe(1)
+
+      for (const base of ['origin/four', 'origin/five']) {
+        await prepareWorktreeCreateForRepo(store, repo, base)
+        await flushBackgroundWork()
+      }
+      expect(obsoleteDiscards()).toBe(1)
+      expect(warn).not.toHaveBeenCalled()
+    } finally {
+      warn.mockRestore()
+    }
+  })
+
+  it('does not start obsolete checkout work after shared cleanup finishes', async () => {
+    let releaseCleanup!: () => void
+    mocks.listWorktreeGraph.mockImplementationOnce(
+      () =>
+        new Promise<[]>((resolve) => {
+          releaseCleanup = () => resolve([])
+        })
+    )
+    const requests = ['main', 'one', 'two', 'three'].map((base) =>
+      prepareWorktreeCreateForRepo(store, repo, `origin/${base}`)
+    )
+    const settled = Promise.allSettled(requests)
+    await flushBackgroundWork()
+    expect(mocks.prepareCheckout).not.toHaveBeenCalled()
+    releaseCleanup()
+    const results = await settled
+    expect(results.map((result) => result.status)).toEqual([
+      'rejected',
+      'fulfilled',
+      'fulfilled',
+      'fulfilled'
+    ])
+    expect(mocks.prepareCheckout).toHaveBeenCalledTimes(3)
+    await flushBackgroundWork()
+    expect(mocks.discard).not.toHaveBeenCalled()
+  })
+
+  it('keeps a claimed in-flight checkout alive when new preparations fill the pool', async () => {
+    let signal: AbortSignal | undefined
+    let finishCheckout!: () => void
+    mocks.prepareCheckout.mockImplementationOnce((_repo, _path, _base, _lock, options) => {
+      signal = options.signal
+      return new Promise<void>((resolve) => {
+        finishCheckout = resolve
+      })
+    })
+    const preparation = prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    await flushBackgroundWork()
+    const create = consumePreparedWorktreeCreate({
+      repoPath: repo.path,
+      workspaceRoot: '/workspace',
+      worktreePath: '/workspace/claimed',
+      branch: 'claimed',
+      baseBranch: 'origin/main'
+    })
+    await flushBackgroundWork()
+    for (const base of ['origin/one', 'origin/two', 'origin/three', 'origin/four']) {
+      await prepareWorktreeCreateForRepo(store, repo, base)
+    }
+    expect(signal?.aborted).toBe(false)
+    finishCheckout()
+    await preparation
+    expect(await create).toMatchObject({ status: 'hit' })
+  })
+
+  it('cancels an expired in-flight checkout', async () => {
+    vi.useFakeTimers()
+    let signal: AbortSignal | undefined
+    mocks.prepareCheckout.mockImplementationOnce((_repo, _path, _base, _lock, options) => {
+      signal = options.signal
+      return new Promise<void>((_resolve, reject) => {
+        signal!.addEventListener('abort', () => reject(signal!.reason), { once: true })
+      })
+    })
+    try {
+      const settled = Promise.allSettled([prepareWorktreeCreateForRepo(store, repo, 'origin/main')])
+      await vi.advanceTimersByTimeAsync(0)
+      expect(signal?.aborted).toBe(false)
+      await vi.advanceTimersByTimeAsync(WORKTREE_CREATE_PREPARATION_TTL_MS)
+      expect(signal?.aborted).toBe(true)
+      expect((await settled)[0].status).toBe('rejected')
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('preserves caller cancellation without mutating its options', async () => {
+    const controller = new AbortController()
+    const options = { signal: controller.signal }
+    mocks.getWorktreeOptions.mockReturnValue(options)
+    let signal: AbortSignal | undefined
+    mocks.prepareCheckout.mockImplementationOnce((_repo, _path, _base, _lock, executionOptions) => {
+      signal = executionOptions.signal
+      return new Promise<void>((_resolve, reject) => {
+        signal!.addEventListener('abort', () => reject(signal!.reason), { once: true })
+      })
+    })
+    const preparation = prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    const settled = Promise.allSettled([preparation])
+    await flushBackgroundWork()
+    controller.abort()
+    expect(signal?.aborted).toBe(true)
+    expect((await settled)[0].status).toBe('rejected')
+    expect(options.signal).toBe(controller.signal)
+    expect(signal).not.toBe(controller.signal)
+  })
+})
diff --git a/src/main/worktree-create-preparation-pool.ts b/src/main/worktree-create-preparation-pool.ts
index 7539c6076e4..8251e59a94b 100644
--- a/src/main/worktree-create-preparation-pool.ts
+++ b/src/main/worktree-create-preparation-pool.ts
@@ -11,7 +11,7 @@ import { prepareWorktreeCreateCheckout } from './git/worktree-create-preparation
 import { toHostFilesystemPath } from './host-tree-removal'
 import { preparationEntryKey, preparationPathKey } from './worktree-create-preparation-claim'
 import {
-  cleanupStalePreparations,
+  startStalePreparationCleanup,
   hasPendingStalePreparationCleanup,
   resetStalePreparationCleanupForTests
 } from './worktree-create-preparation-stale-cleanup'
@@ -38,6 +38,8 @@ export type PreparationEntry = {
   createdAt: number
   ready: Promise<void>
   expiration: NodeJS.Timeout
+  controller: AbortController
+  checkoutStarted: boolean
 }
 
 export type StartPreparationArgs = {
@@ -68,6 +70,9 @@ async function discardEntry(entry: PreparationEntry): Promise<void> {
   // A failed checkout self-discards, but that self-discard is best-effort too, so it can strand the
   // registration for the same reason the discard here can. Enrol either way.
   await entry.ready.catch(() => {})
+  if (!entry.checkoutStarted) {
+    return
+  }
   await discardPreparationWithRetry({
     hostKey: preparationHostKey(entry.repoPathKey, entry.wslDistro),
     repoPath: entry.repoPath,
@@ -86,6 +91,7 @@ function expireEntry(entry: PreparationEntry): void {
     return
   }
   preparations.delete(entry.key)
+  entry.controller.abort()
   discardEntryInBackground(entry)
 }
 
@@ -118,6 +124,7 @@ function enforcePreparationLimit(
     }
     preparations.delete(victim.key)
     clearTimeout(victim.expiration)
+    victim.controller.abort()
     discardEntryInBackground(victim)
   }
 }
@@ -163,6 +170,10 @@ export function startPreparation({
     WORKTREE_CREATE_PREPARATION_DIRECTORY
   )
   const preparedPath = pathOps(workspaceRoot).join(preparationRoot, preparationId)
+  const controller = new AbortController()
+  const signal = options.signal
+    ? AbortSignal.any([options.signal, controller.signal])
+    : controller.signal
   const entry = {} as PreparationEntry
   const expiration = setTimeout(() => expireEntry(entry), WORKTREE_CREATE_PREPARATION_TTL_MS)
   expiration.unref()
@@ -179,17 +190,23 @@ export function startPreparation({
     options,
     createdAt: Date.now(),
     expiration,
+    controller,
+    checkoutStarted: false,
     ready: (async () => {
-      await cleanupStalePreparations(preparationHostKey(repoPathKey, wslDistro), repoPath, options)
-      await mkdir(toHostFilesystemPath(preparationRoot), { recursive: true })
-      // Already canonical, so the add re-resolves nothing.
-      await prepareWorktreeCreateCheckout(
+      await startStalePreparationCleanup(
+        preparationHostKey(repoPathKey, wslDistro),
         repoPath,
-        preparedPath,
-        canonicalBase,
-        lockReason,
         options
       )
+      signal.throwIfAborted()
+      await mkdir(toHostFilesystemPath(preparationRoot), { recursive: true })
+      signal.throwIfAborted()
+      // Already canonical, so the add re-resolves nothing.
+      entry.checkoutStarted = true
+      await prepareWorktreeCreateCheckout(repoPath, preparedPath, canonicalBase, lockReason, {
+        ...options,
+        signal
+      })
     })()
   } satisfies PreparationEntry)
   preparations.set(key, entry)
@@ -205,7 +222,7 @@ export function startPreparation({
 export async function _resetPreparationPoolForTests(): Promise<void> {
   const entries = [...preparations.values()]
   preparations.clear()
-  resetStalePreparationCleanupForTests()
+  await resetStalePreparationCleanupForTests()
   await Promise.all(
     entries.map(async (entry) => {
       clearTimeout(entry.expiration)
diff --git a/src/main/worktree-create-preparation-stale-cleanup.ts b/src/main/worktree-create-preparation-stale-cleanup.ts
index fd02b7cc0d1..1606e62ed8f 100644
--- a/src/main/worktree-create-preparation-stale-cleanup.ts
+++ b/src/main/worktree-create-preparation-stale-cleanup.ts
@@ -10,7 +10,7 @@ import { retryPendingPreparationDiscards } from './worktree-preparation-discard-
 
 const STALE_PREPARATION_CLEANUP_CONCURRENCY = 4
 
-const staleCleanupInFlight = new Map<string, Promise<void>>()
+const staleCleanupInFlight = new Map<string, { scanned: Promise<void>; settled: Promise<void> }>()
 
 function isProcessAlive(pid: number): boolean {
   try {
@@ -21,26 +21,24 @@ function isProcessAlive(pid: number): boolean {
   }
 }
 
-/** Reclaims preparations a crashed process left registered. Single-flighted per host key so a burst
- *  of arming calls shares one worktree listing. */
-export async function cleanupStalePreparations(
+/** Returns after the shared host scan; file reclamation stays tracked in the background. */
+export async function startStalePreparationCleanup(
   cleanupKey: string,
   repoPath: string,
   options: AddWorktreeOptions
 ): Promise<void> {
   const existing = staleCleanupInFlight.get(cleanupKey)
   if (existing) {
-    await existing.catch(() => {})
+    await existing.scanned.catch(() => {})
     return
   }
-  const cleanup = (async () => {
-    // Not awaited: the create path awaits this cleanup, and one stranded discard costs an unlock plus
-    // a `worktree remove --force` bounded at 30s each. Reclaiming leaked scratch must not delay create.
-    void retryPendingPreparationDiscards(cleanupKey)
-    const worktrees = await listWorktreeGraph(repoPath, {
-      ...options,
-      includeCreatePreparations: true
-    })
+  void retryPendingPreparationDiscards(cleanupKey)
+  const scan = listWorktreeGraph(repoPath, {
+    ...options,
+    includeCreatePreparations: true
+  })
+  const scanned = scan.then(() => {})
+  const cleanup = scan.then(async (worktrees) => {
     const staleWorktrees = worktrees.filter(isWorktreeCreatePreparation)
     let nextIndex = 0
     async function discardNextStalePreparation(): Promise<void> {
@@ -63,22 +61,27 @@ export async function cleanupStalePreparations(
     }
     const workerCount = Math.min(STALE_PREPARATION_CLEANUP_CONCURRENCY, staleWorktrees.length)
     await Promise.all(Array.from({ length: workerCount }, () => discardNextStalePreparation()))
-  })()
-  staleCleanupInFlight.set(cleanupKey, cleanup)
-  try {
-    await cleanup.catch(() => {})
-  } finally {
-    if (staleCleanupInFlight.get(cleanupKey) === cleanup) {
-      staleCleanupInFlight.delete(cleanupKey)
-    }
-  }
+  })
+  // Keep reclamation single-flighted, but do not make a new checkout wait for old file removal.
+  const entry = { scanned, settled: cleanup }
+  staleCleanupInFlight.set(cleanupKey, entry)
+  void cleanup
+    .catch(() => {})
+    .finally(() => {
+      if (staleCleanupInFlight.get(cleanupKey) === entry) {
+        staleCleanupInFlight.delete(cleanupKey)
+      }
+    })
+  await scanned.catch(() => {})
 }
 
-/** True while a crash-recovery scan is running, which means a create is in flight or imminent. */
+/** Keeps repo maintenance paused through crash-recovery scanning and reclamation. */
 export function hasPendingStalePreparationCleanup(): boolean {
   return staleCleanupInFlight.size > 0
 }
 
-export function resetStalePreparationCleanupForTests(): void {
+export async function resetStalePreparationCleanupForTests(): Promise<void> {
+  const cleanups = [...staleCleanupInFlight.values()].map((entry) => entry.settled)
   staleCleanupInFlight.clear()
+  await Promise.allSettled(cleanups)
 }
diff --git a/src/main/worktree-create-preparation.test.ts b/src/main/worktree-create-preparation.test.ts
index 06818fec422..785ed094b33 100644
--- a/src/main/worktree-create-preparation.test.ts
+++ b/src/main/worktree-create-preparation.test.ts
@@ -1,5 +1,7 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type * as WorktreeLogic from './ipc/worktree-logic'
 import type { Store } from './persistence'
+import { hasPendingStalePreparationCleanup } from './worktree-create-preparation-stale-cleanup'
 import type { Repo } from '../shared/repo-types'
 import { WORKTREE_CREATE_PREPARATION_DIRECTORY } from '../shared/worktree/create-preparation'
 import { resolveWorktreeAddBaseRef } from '../shared/worktree/base-ref'
@@ -36,7 +38,8 @@ vi.mock('./project-runtime-git-options', () => ({
   getLocalProjectWorktreeGitOptions: mocks.getWorktreeOptions,
   getWorktreeMirrorDistro: () => undefined
 }))
-vi.mock('./ipc/worktree-logic', () => ({
+vi.mock('./ipc/worktree-logic', async (importOriginal) => ({
+  isOrphanedWorktreeError: (await importOriginal<typeof WorktreeLogic>()).isOrphanedWorktreeError,
   computeWorkspaceRoot: mocks.computeWorkspaceRoot,
   computeWorkspaceRootAsync: mocks.computeWorkspaceRootAsync,
   getWorktreePathSettings: () => ({
@@ -364,7 +367,7 @@ describe('worktree create preparation registry', () => {
       expect.any(String),
       'refs/remotes/origin/main',
       expect.any(String),
-      options
+      { ...options, signal: expect.any(AbortSignal) }
     )
     expect(mocks.finalize).toHaveBeenCalledWith(
       repo.path,
@@ -385,6 +388,60 @@ describe('worktree create preparation registry', () => {
     expect(mocks.listWorktreeGraph).toHaveBeenCalledTimes(2)
   })
 
+  it('prepares while stale removal is stalled, shares its scan, and settles removal on reset', async () => {
+    const stalePath = '/workspace/.orca-preparing/999999999-11111111-1111-4111-8111-111111111111'
+    let releaseRemoval!: () => void
+    const removal = new Promise<void>((resolve) => {
+      releaseRemoval = resolve
+    })
+    mocks.listWorktreeGraph.mockResolvedValueOnce([
+      {
+        path: stalePath,
+        branch: undefined,
+        lockReason: 'orca-create-preparation:v1:999999999:stale',
+        head: 'deadbeef',
+        isBare: false,
+        isMainWorktree: false
+      }
+    ])
+    mocks.discard.mockImplementation((_repo, path) =>
+      path === stalePath ? removal : Promise.resolve()
+    )
+    let ready = false
+    let reset: Promise<void> | undefined
+    const preparation = prepareWorktreeCreateForRepo(store, repo, 'origin/main').then(() => {
+      ready = true
+    })
+    try {
+      await flushBackgroundWork()
+      expect(mocks.discard).toHaveBeenCalledWith(repo.path, stalePath, {})
+      expect(ready).toBe(true)
+      await prepareWorktreeCreateForRepo(store, repo, 'origin/release')
+      expect(mocks.prepareCheckout).toHaveBeenCalledTimes(2)
+      expect(mocks.listWorktreeGraph).toHaveBeenCalledTimes(1)
+      expect(hasPendingStalePreparationCleanup()).toBe(true)
+      mocks.getWorktreeOptions.mockReturnValue({ wslDistro: 'Ubuntu' })
+      await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+      expect(mocks.prepareCheckout).toHaveBeenCalledTimes(3)
+      expect(mocks.listWorktreeGraph).toHaveBeenCalledTimes(2)
+      expect(mocks.listWorktreeGraph).toHaveBeenLastCalledWith(repo.path, {
+        wslDistro: 'Ubuntu',
+        includeCreatePreparations: true
+      })
+      let resetFinished = false
+      reset = _resetWorktreeCreatePreparationsForTests().then(() => {
+        resetFinished = true
+      })
+      await flushBackgroundWork()
+      expect(resetFinished).toBe(false)
+    } finally {
+      releaseRemoval()
+      await preparation
+      await reset
+    }
+    expect(hasPendingStalePreparationCleanup()).toBe(false)
+  })
+
   it('unlocks a stale branch-attached final path instead of deleting user work', async () => {
     mocks.listWorktreeGraph.mockResolvedValueOnce([
       {
diff --git a/src/main/worktree-preparation-discard-retry.ts b/src/main/worktree-preparation-discard-retry.ts
index e18f890084c..8602bebb39a 100644
--- a/src/main/worktree-preparation-discard-retry.ts
+++ b/src/main/worktree-preparation-discard-retry.ts
@@ -1,5 +1,6 @@
 import type { AddWorktreeOptions } from './git/worktree'
 import { discardPreparedWorktree } from './git/worktree-create-preparation'
+import { isOrphanedWorktreeError } from './ipc/worktree-logic'
 
 // Stale cleanup only reclaims preparations whose owner pid is dead, so a discard that fails inside
 // the live process would strand its scratch checkout until the app restarts. Remember the failure
@@ -31,6 +32,11 @@ async function runDiscard(target: PreparationDiscardTarget, attempts: number): P
   try {
     await discardPreparedWorktree(target.repoPath, target.preparedPath, target.options)
   } catch (error) {
+    // An aborted or failed checkout self-discards first, so the registration is usually already
+    // gone by the time the pool discards; retrying that would only spawn Git to fail again.
+    if (isOrphanedWorktreeError(error)) {
+      return
+    }
     // Bounded: a path that never becomes removable must not tax every later preparation.
     if (attempts >= PREPARATION_DISCARD_ATTEMPT_LIMIT) {
       console.warn(
diff --git a/src/preload/api/browser-api.ts b/src/preload/api/browser-api.ts
index fc128e14bfb..d541c32dfd8 100644
--- a/src/preload/api/browser-api.ts
+++ b/src/preload/api/browser-api.ts
@@ -119,7 +119,7 @@ export type BrowserApi = {
     callback: (data: { worktreeId: string | null; browserPageId: string }) => void
   ) => () => void
   onOpenLinkInOrcaTab: (
-    callback: (event: { browserPageId: string; url: string }) => void
+    callback: (event: { browserPageId: string; url: string; activate?: boolean }) => void
   ) => () => void
   cancelDownload: (args: { downloadId: string }) => Promise<boolean>
   setGrabMode: (args: BrowserSetGrabModeArgs) => Promise<BrowserSetGrabModeResult>
diff --git a/src/preload/api/browser-bridge-page-interaction-and-sessions.ts b/src/preload/api/browser-bridge-page-interaction-and-sessions.ts
index 93d6001e61c..c2f72ff7cb6 100644
--- a/src/preload/api/browser-bridge-page-interaction-and-sessions.ts
+++ b/src/preload/api/browser-bridge-page-interaction-and-sessions.ts
@@ -71,11 +71,11 @@ export const browserPageInteractionAndSessionsApi = {
     return () => ipcRenderer.removeListener('browser:pane-focus', listener)
   },
   onOpenLinkInOrcaTab: (
-    callback: (event: { browserPageId: string; url: string }) => void
+    callback: (event: { browserPageId: string; url: string; activate?: boolean }) => void
   ): (() => void) => {
     const listener = (
       _event: Electron.IpcRendererEvent,
-      data: { browserPageId: string; url: string }
+      data: { browserPageId: string; url: string; activate?: boolean }
     ) => callback(data)
     ipcRenderer.on('browser:open-link-in-orca-tab', listener)
     return () => ipcRenderer.removeListener('browser:open-link-in-orca-tab', listener)
diff --git a/src/preload/api/orca-profile-api.ts b/src/preload/api/orca-profile-api.ts
index 16c2a575078..80e9f08fc8d 100644
--- a/src/preload/api/orca-profile-api.ts
+++ b/src/preload/api/orca-profile-api.ts
@@ -28,6 +28,8 @@ import type {
 export type OrcaProfileApi = {
   list: () => Promise<OrcaProfileListResult>
   authStatus: () => Promise<OrcaProfileAuthStatus>
+  /** Fires when main changed the stored auth status on its own (e.g. a revoked session). */
+  onAuthStatusChanged: (callback: () => void) => () => void
   createLocal: (args?: CreateLocalOrcaProfileArgs) => Promise<CreateLocalOrcaProfileResult>
   createCloudLinked: (
     args?: CreateCloudLinkedOrcaProfileArgs
diff --git a/src/preload/api/orca-profiles-bridge.ts b/src/preload/api/orca-profiles-bridge.ts
index 0b2897f8ab1..da58b2d9def 100644
--- a/src/preload/api/orca-profiles-bridge.ts
+++ b/src/preload/api/orca-profiles-bridge.ts
@@ -1,9 +1,15 @@
 import { ipcRenderer } from 'electron'
 import type { PreloadApi } from '../api-types'
+import { ORCA_PROFILE_AUTH_STATUS_CHANGED_CHANNEL } from '../../shared/orca-profiles'
 
 export const orcaProfilesApi = {
   list: () => ipcRenderer.invoke('orcaProfiles:list'),
   authStatus: () => ipcRenderer.invoke('orcaProfiles:authStatus'),
+  onAuthStatusChanged: (callback: () => void): (() => void) => {
+    const listener = (): void => callback()
+    ipcRenderer.on(ORCA_PROFILE_AUTH_STATUS_CHANGED_CHANNEL, listener)
+    return () => ipcRenderer.removeListener(ORCA_PROFILE_AUTH_STATUS_CHANGED_CHANNEL, listener)
+  },
   createLocal: (args) => ipcRenderer.invoke('orcaProfiles:createLocal', args),
   createCloudLinked: (args) => ipcRenderer.invoke('orcaProfiles:createCloudLinked', args),
   switchProfile: (args) => ipcRenderer.invoke('orcaProfiles:switch', args),
diff --git a/src/preload/api/pty-api.ts b/src/preload/api/pty-api.ts
index bf012306675..d2d547d98cb 100644
--- a/src/preload/api/pty-api.ts
+++ b/src/preload/api/pty-api.ts
@@ -69,6 +69,8 @@ export type PtyApi = {
     coldRestore?: { scrollback: string; cwd: string; cols?: number; rows?: number }
     startupCwdFallback?: { kind: 'worktree'; cwd: string }
     agentResumeUnavailable?: true
+    /** Host verdict on the shell-ready marker; absent when the execution host predates the field. */
+    shellReadyArmed?: boolean
   }>
   write: (id: string, data: string) => void
   writeAccepted: (id: string, data: string) => Promise<boolean>
@@ -112,7 +114,11 @@ export type PtyApi = {
   getForegroundProcess: (id: string) => Promise<string | null>
   inspectProcess: (
     id: string,
-    options?: { expectedIncarnationId?: string }
+    options?: {
+      expectedIncarnationId?: string
+      scanChildProcesses?: boolean
+      steadyState?: boolean
+    }
   ) => Promise<TerminalProcessInspection>
   confirmForegroundProcess: (id: string) => Promise<string | null>
   getCwd: (id: string) => Promise<string>
diff --git a/src/preload/api/pty-bridge-session-control.ts b/src/preload/api/pty-bridge-session-control.ts
index ef6002e11c8..2854278c20b 100644
--- a/src/preload/api/pty-bridge-session-control.ts
+++ b/src/preload/api/pty-bridge-session-control.ts
@@ -66,6 +66,8 @@ export const ptySessionControlApi = {
     coldRestore?: { scrollback: string; cwd: string; cols?: number; rows?: number }
     startupCwdFallback?: { kind: 'worktree'; cwd: string }
     agentResumeUnavailable?: true
+    /** Host verdict on the shell-ready marker; absent when the execution host predates the field. */
+    shellReadyArmed?: boolean
   }> => ipcRenderer.invoke('pty:spawn', opts),
   write: (id: string, data: string): void => {
     ipcRenderer.send('pty:write', { id, data })
diff --git a/src/preload/api/pty-bridge-stream-and-serialization.ts b/src/preload/api/pty-bridge-stream-and-serialization.ts
index 7e2d7bbe4ff..0847291ba7e 100644
--- a/src/preload/api/pty-bridge-stream-and-serialization.ts
+++ b/src/preload/api/pty-bridge-stream-and-serialization.ts
@@ -7,7 +7,11 @@ import type { TerminalProcessInspection } from '../../shared/terminal-process-in
 export const ptyStreamAndSerializationApi = {
   inspectProcess: (
     id: string,
-    options?: { expectedIncarnationId?: string }
+    options?: {
+      expectedIncarnationId?: string
+      scanChildProcesses?: boolean
+      steadyState?: boolean
+    }
   ): Promise<TerminalProcessInspection> =>
     ipcRenderer.invoke('pty:inspectProcess', { id, ...options }),
   confirmForegroundProcess: (id: string): Promise<string | null> =>
diff --git a/src/relay/fs-handler-git-fallback.ts b/src/relay/fs-handler-git-fallback.ts
index 8de2ad3394c..6e1144cdf4f 100644
--- a/src/relay/fs-handler-git-fallback.ts
+++ b/src/relay/fs-handler-git-fallback.ts
@@ -6,6 +6,7 @@
  * and git grep as universal fallbacks — git is always available since this is
  * a git-focused app.
  */
+import { SearchSubprocessLineAccumulator } from '../shared/search-subprocess-lines'
 import { spawn } from 'node:child_process'
 import { fileListingCancellationError } from '../shared/file-listing-cancellation'
 import type { SearchOptions, SearchResult } from './fs-handler-utils'
@@ -277,7 +278,7 @@ export function searchWithGitGrep(
     const gitArgs = buildGitGrepArgs(query, opts)
     const matchRegex = buildSubmatchRegex(query, opts)
     const acc = createAccumulator()
-    let stdoutBuffer = ''
+    const lines = new SearchSubprocessLineAccumulator(Number.MAX_SAFE_INTEGER)
     let done = false
 
     const child = spawn('git', gitArgs, {
@@ -292,6 +293,7 @@ export function searchWithGitGrep(
         return
       }
       done = true
+      lines.clear()
       clearTimeout(killTimeout)
       // Why: child.kill() is advisory. If git ignores it, detach our
       // closures so repeated relay searches do not retain old scans.
@@ -310,12 +312,7 @@ export function searchWithGitGrep(
     }
 
     function handleStdoutData(chunk: string): void {
-      stdoutBuffer += chunk
-      const lines = stdoutBuffer.split('\n')
-      stdoutBuffer = lines.pop() ?? ''
-      for (const l of lines) {
-        processLine(l)
-      }
+      lines.push(chunk, processLine)
     }
 
     function handleStderrData(): void {
@@ -327,8 +324,9 @@ export function searchWithGitGrep(
     }
 
     function handleClose(): void {
-      if (stdoutBuffer) {
-        processLine(stdoutBuffer)
+      const tail = lines.finish()
+      if (tail !== null) {
+        processLine(tail)
       }
       resolveOnce()
     }
diff --git a/src/relay/fs-handler-utils.ts b/src/relay/fs-handler-utils.ts
index a9df29dd2f2..7d501e56d66 100644
--- a/src/relay/fs-handler-utils.ts
+++ b/src/relay/fs-handler-utils.ts
@@ -5,6 +5,7 @@
  * These functions depend only on their arguments (plus `rg` being on PATH),
  * so they are straightforward to test independently.
  */
+import { SearchSubprocessLineAccumulator } from '../shared/search-subprocess-lines'
 import { spawn } from 'node:child_process'
 import { open } from 'node:fs/promises'
 import {
@@ -99,7 +100,7 @@ export function searchWithRg(
   return new Promise((resolve, reject) => {
     const rgArgs = buildRgArgs(query, rootPath, opts)
     const acc = createAccumulator()
-    let buffer = ''
+    const lines = new SearchSubprocessLineAccumulator(Number.MAX_SAFE_INTEGER)
     let resolved = false
     let processErrorObserved = false
     let unavailableExitObserved = false
@@ -127,6 +128,7 @@ export function searchWithRg(
         return
       }
       resolved = true
+      lines.clear()
       clearTimeout(killTimeout)
       // Why: child.kill() is advisory over SSH; detach listeners if the
       // process ignores timeout kill so old searches cannot retain closures.
@@ -146,6 +148,7 @@ export function searchWithRg(
         return
       }
       resolved = true
+      lines.clear()
       clearTimeout(killTimeout)
       child.stdout!.off('data', handleStdoutData)
       child.stderr!.off('data', handleStderrData)
@@ -179,12 +182,7 @@ export function searchWithRg(
     }
 
     function handleStdoutData(chunk: string): void {
-      buffer += chunk
-      const lines = buffer.split('\n')
-      buffer = lines.pop() ?? ''
-      for (const line of lines) {
-        processLine(line)
-      }
+      lines.push(chunk, processLine)
     }
 
     function handleStderrData(): void {
@@ -210,8 +208,9 @@ export function searchWithRg(
         settleLaunchFailure()
         return
       }
-      if (buffer) {
-        processLine(buffer)
+      const tail = lines.finish()
+      if (tail !== null) {
+        processLine(tail)
       }
       resolveOnce()
     }
diff --git a/src/relay/fs-path-metadata-requests.ts b/src/relay/fs-path-metadata-requests.ts
index 2a9717a6484..b0fa2347d95 100644
--- a/src/relay/fs-path-metadata-requests.ts
+++ b/src/relay/fs-path-metadata-requests.ts
@@ -1,6 +1,8 @@
 import { readdir, stat, lstat, realpath } from 'node:fs/promises'
+import type { Dirent } from 'node:fs'
 import { join } from 'node:path'
 import { sortDirEntries } from '../shared/file-name-sort'
+import { forEachWithConcurrency } from '../shared/map-with-concurrency'
 import { expandTilde } from './context'
 
 async function resolveSymlinkDirectoryEntry(
@@ -34,11 +36,18 @@ function fileStatFromLstat(stats: Awaited<ReturnType<typeof lstat>>) {
   }
 }
 
+// Why bounded: a pnpm `node_modules` is hundreds-to-thousands of package symlinks, and one
+// unbounded `Promise.all` of stats from a single readDir saturates libuv's four-thread pool —
+// delaying every other relay filesystem operation, including the interactive reads the
+// list-files scan coordinator exists to protect. Matches the cap every other bounded probe in
+// this codebase uses.
+const SYMLINK_DIRECTORY_PROBE_CONCURRENCY = 8
+
 export async function readRelayDir(params: Record<string, unknown>) {
   const dirPath = expandTilde(params.dirPath as string)
   const entries = await readdir(dirPath, { withFileTypes: true })
   const mapped: { name: string; isDirectory: boolean; isSymlink: boolean }[] = []
-  const symlinkProbes: Promise<void>[] = []
+  const symlinkEntries: { entry: Dirent; mappedEntry: (typeof mapped)[number] }[] = []
   for (const entry of entries) {
     const mappedEntry = {
       name: entry.name,
@@ -47,15 +56,17 @@ export async function readRelayDir(params: Record<string, unknown>) {
     }
     mapped.push(mappedEntry)
     if (!mappedEntry.isDirectory && mappedEntry.isSymlink) {
-      symlinkProbes.push(
-        resolveSymlinkDirectoryEntry(dirPath, entry).then((isDirectory) => {
-          mappedEntry.isDirectory = isDirectory
-        })
-      )
+      symlinkEntries.push({ entry, mappedEntry })
     }
   }
-  if (symlinkProbes.length > 0) {
-    await Promise.all(symlinkProbes)
+  if (symlinkEntries.length > 0) {
+    await forEachWithConcurrency(
+      symlinkEntries,
+      SYMLINK_DIRECTORY_PROBE_CONCURRENCY,
+      async ({ entry, mappedEntry }) => {
+        mappedEntry.isDirectory = await resolveSymlinkDirectoryEntry(dirPath, entry)
+      }
+    )
   }
   return sortDirEntries(mapped)
 }
diff --git a/src/relay/fs-path-metadata-symlink-concurrency.test.ts b/src/relay/fs-path-metadata-symlink-concurrency.test.ts
new file mode 100644
index 00000000000..3a342a79e7c
--- /dev/null
+++ b/src/relay/fs-path-metadata-symlink-concurrency.test.ts
@@ -0,0 +1,70 @@
+import { mkdirSync, mkdtempSync, rmSync, symlinkSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type * as FsPromisesModule from 'node:fs/promises'
+
+const statCalls = vi.hoisted(() => ({ inFlight: 0, peak: 0, total: 0 }))
+
+vi.mock('node:fs/promises', async (importOriginal) => {
+  const actual = await importOriginal<typeof FsPromisesModule>()
+  return {
+    ...actual,
+    stat: async (...args: Parameters<typeof actual.stat>) => {
+      statCalls.inFlight += 1
+      statCalls.total += 1
+      statCalls.peak = Math.max(statCalls.peak, statCalls.inFlight)
+      try {
+        return await actual.stat(...args)
+      } finally {
+        statCalls.inFlight -= 1
+      }
+    }
+  }
+})
+
+const { readRelayDir } = await import('./fs-path-metadata-requests')
+
+describe('relay readDir symlink probes', () => {
+  let root: string
+  let targetRoot: string
+
+  beforeEach(() => {
+    statCalls.inFlight = 0
+    statCalls.peak = 0
+    statCalls.total = 0
+    root = mkdtempSync(join(tmpdir(), 'orca-relay-readdir-'))
+    // Kept outside `root` so the listing contains only the symlinks under test.
+    targetRoot = mkdtempSync(join(tmpdir(), 'orca-relay-readdir-target-'))
+    const target = join(targetRoot, 'target')
+    mkdirSync(target)
+    writeFileSync(join(target, 'index.js'), '')
+    // A pnpm-shaped node_modules: many package symlinks in one directory. Junctions on
+    // Windows: plain symlinks need Developer Mode there.
+    for (let index = 0; index < 60; index += 1) {
+      symlinkSync(
+        target,
+        join(root, `pkg-${index}`),
+        process.platform === 'win32' ? 'junction' : 'dir'
+      )
+    }
+  })
+
+  afterEach(() => {
+    rmSync(root, { recursive: true, force: true })
+    rmSync(targetRoot, { recursive: true, force: true })
+  })
+
+  it('bounds concurrent symlink stats instead of issuing one per entry at once', async () => {
+    const entries = await readRelayDir({ dirPath: root })
+
+    expect(statCalls.total).toBe(60)
+    // Exactly the cap: every worker enters `stat` before any resolves, so the peak proves the
+    // probes overlap and that no more than 8 ever do. Unbounded, all 60 would be in flight,
+    // saturating libuv's four-thread pool and stalling every other relay filesystem read.
+    expect(statCalls.peak).toBe(8)
+    // Behaviour is unchanged: every symlink still resolves to its target's kind.
+    expect(entries).toHaveLength(60)
+    expect(entries.every((entry) => entry.isDirectory && entry.isSymlink)).toBe(true)
+  })
+})
diff --git a/src/relay/fs-search-line-fragments.test.ts b/src/relay/fs-search-line-fragments.test.ts
new file mode 100644
index 00000000000..53b8902ddfd
--- /dev/null
+++ b/src/relay/fs-search-line-fragments.test.ts
@@ -0,0 +1,129 @@
+import { EventEmitter } from 'node:events'
+import type { ChildProcess } from 'node:child_process'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+
+const { spawnMock } = vi.hoisted(() => ({ spawnMock: vi.fn() }))
+vi.mock('node:child_process', () => ({ spawn: spawnMock }))
+
+import { searchWithGitGrep } from './fs-handler-git-fallback'
+import { searchWithRg } from './fs-handler-utils'
+
+function createProcess(): ChildProcess {
+  return Object.assign(new EventEmitter(), {
+    stdout: Object.assign(new EventEmitter(), { setEncoding: vi.fn() }),
+    stderr: new EventEmitter(),
+    kill: vi.fn()
+  }) as unknown as ChildProcess
+}
+
+const searchCases = [
+  {
+    name: 'ripgrep',
+    search: searchWithRg,
+    encode: (text: string, line: number) =>
+      JSON.stringify({
+        type: 'match',
+        data: {
+          path: { text: '/remote/root/unicode.ts' },
+          lines: { text: `${text}\n` },
+          line_number: line,
+          submatches: [{ start: 0, end: 3 }]
+        }
+      })
+  },
+  {
+    name: 'git grep',
+    search: searchWithGitGrep,
+    encode: (text: string, line: number) => `unicode.ts\0${line}\0${text}`
+  }
+]
+
+afterEach(() => {
+  vi.restoreAllMocks()
+  vi.useRealTimers()
+  spawnMock.mockReset()
+})
+
+describe.each(searchCases)('relay $name line fragments', ({ search, encode }) => {
+  async function run(chunks: string[]) {
+    const child = createProcess()
+    spawnMock.mockReturnValueOnce(child)
+    const result = search('/remote/root', 'hit', { maxResults: 100 })
+    expect(child.stdout!.setEncoding).toHaveBeenCalledWith('utf-8')
+    for (const chunk of chunks) {
+      child.stdout!.emit('data', chunk)
+    }
+    child.emit('close', 0, null)
+    const value = await result
+    expect(child.stdout!.listenerCount('data')).toBe(0)
+    expect(child.stderr!.listenerCount('data')).toBe(0)
+    expect(child.listenerCount('close')).toBe(0)
+    expect(child.listenerCount('error')).toBe(0)
+    expect(child.kill).not.toHaveBeenCalled()
+    return value
+  }
+
+  it('preserves decoded Unicode, batched lines, empty lines and the final unterminated match', async () => {
+    const text = 'hit café 漢字 🐋'
+    const wire = `${encode(text, 1)}\n\n${encode('hit second', 2)}\n${encode(text, 3)}`
+    const complete = await run([wire])
+    const fragmented = await run(Array.from(wire))
+    expect(fragmented).toEqual(complete)
+    expect(fragmented.totalMatches).toBe(3)
+    expect(fragmented.truncated).toBe(false)
+    expect(fragmented.files[0].matches.map((match) => match.line)).toEqual([1, 2, 3])
+    expect(fragmented.files[0].matches[0].lineContent).toBe(text)
+    expect(fragmented.files[0].matches[2].lineContent).toBe(text)
+  })
+
+  it('does not repeatedly split the growing partial output of a large matching line', async () => {
+    const wire = `${encode(`hit ${'x'.repeat(1024 * 1024)}`, 7)}\n`
+    const complete = await run([wire])
+    const chunks: string[] = []
+    for (let offset = 0; offset < wire.length; offset += 4096) {
+      chunks.push(wire.slice(offset, offset + 4096))
+    }
+    const originalSplit = String.prototype.split
+    let scannedCharacters = 0
+    const spy = vi.spyOn(String.prototype, 'split').mockImplementation(function (
+      this: string,
+      separator: unknown,
+      limit?: number
+    ) {
+      if (separator === '\n') {
+        scannedCharacters += this.length
+      }
+      return Reflect.apply(originalSplit, this, [separator, limit])
+    })
+    let fragmented
+    try {
+      fragmented = await run(chunks)
+    } finally {
+      spy.mockRestore()
+    }
+    expect(fragmented).toEqual(complete)
+    expect(fragmented.totalMatches).toBe(1)
+    expect(fragmented.files[0].matches[0].line).toBe(7)
+    expect(scannedCharacters).toBe(0)
+  })
+
+  it('discards an unfinished line on timeout and detaches the output listeners', async () => {
+    vi.useFakeTimers()
+    const child = createProcess()
+    spawnMock.mockReturnValueOnce(child)
+    const result = search('/remote/root', 'hit', { maxResults: 100 })
+    child.stdout!.emit('data', `${encode('hit complete', 1)}\n${encode('hit partial', 2)}`)
+    await vi.runOnlyPendingTimersAsync()
+    const value = await result
+    expect(value.totalMatches).toBe(1)
+    expect(value.truncated).toBe(true)
+    expect(child.kill).toHaveBeenCalled()
+    expect(child.stdout!.listenerCount('data')).toBe(0)
+    expect(child.stderr!.listenerCount('data')).toBe(0)
+    expect(child.listenerCount('close')).toBe(0)
+    expect(vi.getTimerCount()).toBe(0)
+    child.stdout!.emit('data', '\n')
+    child.emit('close', 0, null)
+    expect(value.totalMatches).toBe(1)
+  })
+})
diff --git a/src/relay/pty-child-process-inspection.ts b/src/relay/pty-child-process-inspection.ts
new file mode 100644
index 00000000000..6d246817053
--- /dev/null
+++ b/src/relay/pty-child-process-inspection.ts
@@ -0,0 +1,81 @@
+/**
+ * Whether anything is running under a pane's shell.
+ *
+ * Split out of `pty-shell-utils` because it is a distinct question from "what is in front" and
+ * carries its own platform reasoning, its own cost budget, and the verdict vocabulary from
+ * docs/reference/ssh-execution-boundary.md.
+ */
+import { queryWindowsPaneProcessInventory } from '../main/providers/windows-foreground-process-rows'
+import { getProcessTableIndex } from '../shared/process-table-index'
+import {
+  getFreshProcessTableSnapshot,
+  getProcessTableSnapshot
+} from '../shared/process-table-snapshot-reader'
+import type { PtyChildProcessVerdict } from '../shared/terminal-process-inspection'
+import { isProcessAlive } from './pty-shell-utils'
+
+/**
+ * Check whether a process has child processes.
+ *
+ * Why the shared snapshot and not `pgrep -P`: this answers one field of
+ * `pty.inspectProcess`, which every tracked pane polls on a 750ms/2000ms
+ * cadence, and the fork was neither cached nor coalesced. procps-ng opens six
+ * procfs files per process to resolve a ppid — including a `/proc/<pid>/ctty`
+ * that never exists on Linux — so one call cost O(host process count) syscalls,
+ * ~4k opens per pgrep on a 690-process host, at up to 8 forks/sec (#13537).
+ * `getForegroundProcessName` in the same RPC already captured the TTL-cached
+ * `ps` table, whose index carries the parent/child map, so the answer is free.
+ *
+ * `fresh` opts out of that TTL. A poll can read a 500ms-old table because its
+ * next tick corrects it, but a close or cleanup decision acts on the answer
+ * once and destructively — a child that started inside the TTL would be killed
+ * with no confirmation. `pgrep` scanned per call, so anything that decides
+ * has to keep scanning per call.
+ */
+export async function inspectPtyChildProcesses(
+  pid: number,
+  options?: { fresh?: boolean }
+): Promise<PtyChildProcessVerdict> {
+  if (process.platform === 'win32') {
+    // Windows has no `ps`, but it does have a process table, and the pane walk over it already
+    // exists for the foreground reader. Answering `false` from nothing was the older shape: a
+    // hardcoded negative is indistinguishable from a measurement, and every close guard reads it
+    // as "nothing is running here".
+    //
+    // Deliberately the TTL-cached table even when `fresh` is asked for: on a relay without the
+    // native binding this falls back to the CIM scan, whose own 1.36s runtime is longer than the
+    // 500ms TTL a fresh read would be refreshing, so a "fresh" answer is not meaningfully fresher
+    // while N sequential ones are an N x 1.36s stall.
+    const inventory = await queryWindowsPaneProcessInventory(pid)
+    if (inventory) {
+      return inventory.candidates.length > 0 ? 'children' : 'no-children'
+    }
+    // A null inventory is an unreadable table OR a snapshot that never showed the root, and
+    // neither of those looked at the pane. The one answer available without the table is a root
+    // the kernel says is gone: nothing runs under a shell that does not exist.
+    return isProcessAlive(pid) ? 'unverifiable' : 'no-children'
+  }
+  try {
+    const rows = options?.fresh
+      ? await getFreshProcessTableSnapshot()
+      : await getProcessTableSnapshot()
+    return (getProcessTableIndex(rows).childrenByPpid.get(pid)?.length ?? 0) > 0
+      ? 'children'
+      : 'no-children'
+  } catch {
+    return 'unverifiable'
+  }
+}
+
+/**
+ * The boolean the wire has always carried. `unverifiable` keeps spelling itself `false` here on
+ * purpose: this value reaches clients too old to know the third answer, and it is read both as
+ * "busy, do not close" and as "the agent has taken over, safe to type into", so no single mapping
+ * of `unverifiable` is safe for both. Callers that can act on the distinction read the verdict.
+ */
+export async function processHasChildren(
+  pid: number,
+  options?: { fresh?: boolean }
+): Promise<boolean> {
+  return (await inspectPtyChildProcesses(pid, options)) === 'children'
+}
diff --git a/src/relay/pty-handler-ownership-attestation.test.ts b/src/relay/pty-handler-ownership-attestation.test.ts
index 94f462c46d2..ee1c144df09 100644
--- a/src/relay/pty-handler-ownership-attestation.test.ts
+++ b/src/relay/pty-handler-ownership-attestation.test.ts
@@ -33,7 +33,8 @@ import {
   endPtyHandlerTest,
   type MockDispatcher
 } from './pty-handler-test-harness'
-import { PROCESS_TABLE_SNAPSHOT_MAX_STALENESS_MS } from '../shared/process-table-snapshot-reader'
+import * as processTableSnapshotReader from '../shared/process-table-snapshot-reader'
+import { RELAY_PTY_SWEEP_MAX_EVIDENCE_AGE_MS } from '../shared/ssh-relay-pty-ownership-proof'
 
 const PANE_KEY = 'tab-agent:22222222-2222-4222-8222-222222222222'
 
@@ -139,16 +140,41 @@ describe('PtyHandler publishes host-attested PTY ownership', () => {
     expect(entry?.ownerClientInstanceId).toBe('client-A')
   })
 
-  it('dates the foreground observation instead of stamping it fresh', async () => {
-    // `capturedAgeMs` used to be a hardcoded 0 with no reader anywhere, so the one field that
-    // exists to bound staleness asserted the evidence was never stale. It now carries the
-    // actual age of the TTL-shared capture the record was derived from.
-    const { id } = await spawnFrom(7, { env: { ORCA_PANE_KEY: PANE_KEY } })
+  it('publishes the age the capture reported, rather than restamping it fresh', async () => {
+    // This assertion used to read `capturedAgeMs <= PROCESS_TABLE_SNAPSHOT_MAX_STALENESS_MS`, which
+    // could not fail: `beginPtyHandlerTest` installs fake timers, so `Date.now()` is frozen, the
+    // real reader reports exactly +0, and `0 <= 500` held identically for a hardcoded zero, for
+    // completion-stamping and for start-stamping. The one test guarding this field was blind to
+    // every change to it, while the real reader on a 2,002-process host returns thousands of ms.
+    //
+    // So drive a real age in from the reader. That the reader MEASURES the age correctly is
+    // pinned separately, against a controllable clock, by process-table-snapshot.test.ts; what
+    // belongs here is that the handler publishes what it was given instead of restamping.
+    const capturedAgeMs = 6_140
+    const snapshot = vi
+      .spyOn(processTableSnapshotReader, 'getStrictProcessTableSnapshotWithAge')
+      .mockResolvedValue({ rows: [], capturedAgeMs })
 
+    const { id } = await spawnFrom(7, { env: { ORCA_PANE_KEY: PANE_KEY } })
     const entry = (await listProcesses()).find((process) => process.id === id)
 
-    expect(entry?.foregroundProcessEvidence?.capturedAgeMs).toBeLessThanOrEqual(
-      PROCESS_TABLE_SNAPSHOT_MAX_STALENESS_MS
+    expect(snapshot).toHaveBeenCalled()
+    expect(entry?.foregroundProcessEvidence?.capturedAgeMs).toBe(capturedAgeMs)
+  })
+
+  it('publishes an age a destructive consumer will refuse, rather than one it will trust', async () => {
+    // The point of the field, stated as the consumer sees it: an observation this old cannot
+    // authorize a stop, and the whole bug was that it used to arrive claiming it could.
+    const snapshot = vi
+      .spyOn(processTableSnapshotReader, 'getStrictProcessTableSnapshotWithAge')
+      .mockResolvedValue({ rows: [], capturedAgeMs: 6_140 })
+
+    const { id } = await spawnFrom(7, { env: { ORCA_PANE_KEY: PANE_KEY } })
+    const entry = (await listProcesses()).find((process) => process.id === id)
+
+    expect(snapshot).toHaveBeenCalled()
+    expect(entry?.foregroundProcessEvidence?.capturedAgeMs).toBeGreaterThan(
+      RELAY_PTY_SWEEP_MAX_EVIDENCE_AGE_MS
     )
   })
 })
diff --git a/src/relay/pty-handler-spawn-admission.test.ts b/src/relay/pty-handler-spawn-admission.test.ts
index c25a623f406..6fef02a9cc0 100644
--- a/src/relay/pty-handler-spawn-admission.test.ts
+++ b/src/relay/pty-handler-spawn-admission.test.ts
@@ -2,6 +2,7 @@ import { describe, expect, it, vi, beforeEach, afterEach } from 'vitest'
 import { mkdtempSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
+import * as ptyChildProcessInspection from './pty-child-process-inspection'
 import * as ptyShellUtils from './pty-shell-utils'
 import * as processTableSnapshotReader from '../shared/process-table-snapshot-reader'
 
@@ -92,7 +93,7 @@ describe('PtyHandler', () => {
   })
 
   it('rescans the process table for a close decision but not for a poll', async () => {
-    const hasChildren = vi.mocked(ptyShellUtils.processHasChildren)
+    const hasChildren = vi.mocked(ptyChildProcessInspection.processHasChildren)
     const snapshot = vi
       .spyOn(processTableSnapshotReader, 'getStrictProcessTableSnapshotWithAge')
       .mockResolvedValue({
@@ -125,6 +126,46 @@ describe('PtyHandler', () => {
     expect(hasChildren).toHaveBeenLastCalledWith(mockPtyInstance.pid, { fresh: true })
   })
 
+  it('does not re-enter the shared capture after the evidence read gave up on it', async () => {
+    // The budget is worthless if the compatibility fields answer by joining the very capture the
+    // evidence read just abandoned: `inspectPtyChildProcesses` and `getForegroundProcessName`
+    // read the same TTL-shared table with no budget of their own, so on a slow host this call
+    // would still block for the whole capture -- once, then once per managed PTY in the listing.
+    const snapshot = vi
+      .spyOn(processTableSnapshotReader, 'getStrictProcessTableSnapshotWithAge')
+      .mockRejectedValue(new Error('process table unreadable: capture_over_budget'))
+    const hasChildren = vi.spyOn(ptyChildProcessInspection, 'inspectPtyChildProcesses')
+    const foregroundName = vi.spyOn(ptyShellUtils, 'getForegroundProcessName')
+
+    const { id } = (await spawnPty({ cols: 80, rows: 24 })) as { id: string }
+    hasChildren.mockClear()
+    foregroundName.mockClear()
+
+    const inspection = (await dispatcher.callRequest('pty.inspectProcess', { id })) as {
+      hasChildProcesses: boolean
+      childProcessEvidence?: string
+      foregroundProcessEvidence?: { verdict: string; reason?: string }
+    }
+
+    expect(snapshot).toHaveBeenCalled()
+    expect(hasChildren).not.toHaveBeenCalled()
+    // The verdict the gates already handle, reached promptly instead of late.
+    expect(inspection.foregroundProcessEvidence?.verdict).toBe('unverifiable')
+    expect(inspection.foregroundProcessEvidence?.reason).toBe('process_table_unreadable')
+    // The honest verdict rather than a fabricated negative, reached without the wait. The
+    // compatibility boolean still spells `unverifiable` as `false` for older clients.
+    expect(inspection.childProcessEvidence).toBe('unverifiable')
+    expect(inspection.hasChildProcesses).toBe(false)
+
+    const listing = (await dispatcher.callRequest('pty.listProcesses', {})) as {
+      id: string
+      title: string
+    }[]
+
+    expect(foregroundName).not.toHaveBeenCalled()
+    expect(listing.find((entry) => entry.id === id)?.title).toBeTruthy()
+  })
+
   it('rejects strict process inspection for a missing relay PTY', async () => {
     await expect(dispatcher.callRequest('pty.inspectProcess', { id: 'missing' })).rejects.toThrow(
       'terminal_gone'
@@ -133,7 +174,13 @@ describe('PtyHandler', () => {
 
   it('spawns a PTY and returns an id', async () => {
     const result = await spawnPty({ cols: 80, rows: 24 })
-    expect(result).toEqual({ id: testPtyId(1), incarnationId: expect.any(String) })
+    // shellReadyArmed rides every spawn reply, false included: absent has to keep
+    // meaning "host predates the field", not "host did not arm".
+    expect(result).toEqual({
+      id: testPtyId(1),
+      incarnationId: expect.any(String),
+      shellReadyArmed: false
+    })
     expect(mockPtySpawn).toHaveBeenCalled()
     expect(handler.activePtyCount).toBe(1)
   })
@@ -152,7 +199,11 @@ describe('PtyHandler', () => {
       agentSessionCreateOperationId: operationId
     })
 
-    expect(replayed).toEqual({ id: testPtyId(1), incarnationId: expect.any(String) })
+    expect(replayed).toEqual({
+      id: testPtyId(1),
+      incarnationId: expect.any(String),
+      shellReadyArmed: false
+    })
     expect(mockPtySpawn).toHaveBeenCalledOnce()
     expect(mockPtyInstance.kill).not.toHaveBeenCalled()
     expect(handler.activePtyCount).toBe(1)
diff --git a/src/relay/pty-handler-startup-command-delivery.test.ts b/src/relay/pty-handler-startup-command-delivery.test.ts
index 817ca756385..9e7c29202c7 100644
--- a/src/relay/pty-handler-startup-command-delivery.test.ts
+++ b/src/relay/pty-handler-startup-command-delivery.test.ts
@@ -133,6 +133,77 @@ describe('PtyHandler', () => {
     }
   )
 
+  it.skipIf(process.platform === 'win32')(
+    'emits shell-ready markers for plain Codex on a line-editor shell',
+    async () => {
+      const oldShell = process.env.SHELL
+      const oldHome = process.env.HOME
+      const homeDir = mkdtempSync(join(tmpdir(), 'relay-plain-codex-spawn-'))
+
+      process.env.SHELL = '/bin/bash'
+      process.env.HOME = homeDir
+      try {
+        // No prefill flag and no shell-ready hint: the host decides from its own
+        // shell, because the client cannot see it (#18767).
+        const reply = await dispatcher.callRequest('pty.spawn', {
+          env: { HOME: homeDir },
+          command: 'codex'
+        })
+        expect(reply).toMatchObject({ shellReadyArmed: true })
+      } finally {
+        if (oldShell === undefined) {
+          delete process.env.SHELL
+        } else {
+          process.env.SHELL = oldShell
+        }
+        if (oldHome === undefined) {
+          delete process.env.HOME
+        } else {
+          process.env.HOME = oldHome
+        }
+        rmSync(homeDir, { recursive: true, force: true })
+      }
+
+      const spawnOptions = mockPtySpawn.mock.calls[0]?.[2] as
+        | { env?: Record<string, string> }
+        | undefined
+      expect(spawnOptions?.env?.ORCA_SHELL_FEATURES).toContain('ready')
+      vi.advanceTimersByTime(15_000)
+      expect(handler.retainedStartupCommandCount).toBe(0)
+    }
+  )
+
+  it.skipIf(process.platform === 'win32')(
+    'leaves plain Codex unwaited on a shell that emits the marker before its reader',
+    async () => {
+      const oldHome = process.env.HOME
+      const homeDir = mkdtempSync(join(tmpdir(), 'relay-plain-codex-fish-spawn-'))
+
+      process.env.HOME = homeDir
+      try {
+        const reply = await dispatcher.callRequest('pty.spawn', {
+          env: { HOME: homeDir, SHELL: '/usr/bin/fish' },
+          command: 'codex'
+        })
+        // Why the reply carries it: the client cannot see this shell, and without
+        // the verdict it waits the full fallback for a marker fish never emits.
+        expect(reply).toMatchObject({ shellReadyArmed: false })
+      } finally {
+        if (oldHome === undefined) {
+          delete process.env.HOME
+        } else {
+          process.env.HOME = oldHome
+        }
+        rmSync(homeDir, { recursive: true, force: true })
+      }
+
+      const spawnOptions = mockPtySpawn.mock.calls[0]?.[2] as
+        | { env?: Record<string, string> }
+        | undefined
+      expect(spawnOptions?.env?.ORCA_SHELL_FEATURES ?? '').not.toContain('ready')
+    }
+  )
+
   it.skipIf(process.platform === 'win32')(
     'emits shell-ready markers for renderer-delivered Codex native prefill commands',
     async () => {
diff --git a/src/relay/pty-handler-test-harness.ts b/src/relay/pty-handler-test-harness.ts
index e3d99213ea5..fe6e17c5d9c 100644
--- a/src/relay/pty-handler-test-harness.ts
+++ b/src/relay/pty-handler-test-harness.ts
@@ -1,6 +1,6 @@
 import { vi } from 'vitest'
 import type { Mock } from 'vitest'
-import * as ptyShellUtils from './pty-shell-utils'
+import * as ptyChildProcessInspection from './pty-child-process-inspection'
 import { PtyHandler } from './pty-handler'
 import type { RelayDispatcher } from './dispatcher'
 
@@ -115,7 +115,7 @@ export function beginPtyHandlerTest(mocks: PtyHandlerTestMocks): {
     notifyOutput: vi.fn(),
     dispose: vi.fn()
   })
-  vi.spyOn(ptyShellUtils, 'processHasChildren').mockResolvedValue(false)
+  vi.spyOn(ptyChildProcessInspection, 'processHasChildren').mockResolvedValue(false)
 
   mockPtySpawn.mockReturnValue({ ...mockPtyInstance })
 
diff --git a/src/relay/pty-handler-windows-child-process-evidence.test.ts b/src/relay/pty-handler-windows-child-process-evidence.test.ts
new file mode 100644
index 00000000000..6d723824a04
--- /dev/null
+++ b/src/relay/pty-handler-windows-child-process-evidence.test.ts
@@ -0,0 +1,132 @@
+// Regression guard for the Windows SSH child-process answer. The relay used to return a hardcoded
+// `false` here, which every close guard reads as "nothing is running in this pane" -- so a Windows
+// SSH pane running a build closed with no prompt. The answer now comes from the process table, and
+// the one thing it may never do again is fabricate a negative.
+//
+// The second contract is cost. `pty.inspectProcess` is the polled path (750ms/2000ms per tracked
+// pane) and a relay host has no `@vscode/windows-process-tree`, so its table read falls back to a
+// 1.36s CIM scan. Polling that would reinstate the fork storm the shared table exists to prevent,
+// so only a caller whose answer decides something asks for the scan.
+import { describe, expect, it, vi, beforeEach, afterEach } from 'vitest'
+
+const { mockPtySpawn, mockPtyInstance, mockCreateShellPromptReadinessProbe } = vi.hoisted(() => ({
+  mockPtySpawn: vi.fn(),
+  mockCreateShellPromptReadinessProbe: vi.fn(),
+  mockPtyInstance: {
+    pid: process.pid,
+    process: 'xterm-256color',
+    onData: vi.fn(),
+    onExit: vi.fn(),
+    write: vi.fn(),
+    resize: vi.fn(),
+    kill: vi.fn(),
+    clear: vi.fn(),
+    pause: vi.fn(),
+    resume: vi.fn()
+  }
+}))
+
+vi.mock('node-pty', () => ({ spawn: mockPtySpawn }))
+
+vi.mock('../main/pty/posix-pty-process-groups', () => ({
+  forceKillPosixPtyProcessGroups: vi.fn((_pid: number, fallback: () => void) => fallback())
+}))
+
+vi.mock('../main/shell-prompt-readiness-probe', () => ({
+  createShellPromptReadinessProbe: mockCreateShellPromptReadinessProbe
+}))
+
+import * as ptyChildProcessInspection from './pty-child-process-inspection'
+import type { PtyHandler } from './pty-handler'
+import {
+  beginPtyHandlerTest,
+  createPtyRequestHelpers,
+  endPtyHandlerTest
+} from './pty-handler-test-harness'
+import type { MockDispatcher } from './pty-handler-test-harness'
+
+type Inspection = {
+  foregroundProcess: string | null
+  hasChildProcesses: boolean
+  childProcessEvidence?: string
+}
+
+describe('PtyHandler Windows child-process evidence', () => {
+  let dispatcher: MockDispatcher
+  let handler: PtyHandler
+  let originalPlatform: PropertyDescriptor | undefined
+  let inspectChildren: ReturnType<typeof vi.spyOn>
+
+  const { spawnPty } = createPtyRequestHelpers(() => dispatcher)
+
+  /** Spawn under the harness's POSIX platform, then answer as the Windows relay would. */
+  async function spawnThenBecomeWindows(): Promise<string> {
+    const { id } = await spawnPty()
+    Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+    return id
+  }
+
+  async function inspect(params: Record<string, unknown>): Promise<Inspection> {
+    return (await dispatcher.callRequest('pty.inspectProcess', params)) as Inspection
+  }
+
+  beforeEach(() => {
+    ;({ dispatcher, handler, originalPlatform } = beginPtyHandlerTest({
+      mockPtySpawn,
+      mockPtyInstance,
+      mockCreateShellPromptReadinessProbe
+    }))
+    inspectChildren = vi
+      .spyOn(ptyChildProcessInspection, 'inspectPtyChildProcesses')
+      .mockResolvedValue('no-children')
+  })
+
+  afterEach(async () => {
+    await endPtyHandlerTest(handler, originalPlatform)
+  })
+
+  it('publishes what the host observed when the caller pays for the scan', async () => {
+    const id = await spawnThenBecomeWindows()
+    inspectChildren.mockResolvedValue('children')
+
+    const result = await inspect({ id, scanChildProcesses: true })
+
+    expect(inspectChildren).toHaveBeenCalledWith(mockPtyInstance.pid)
+    expect(result.childProcessEvidence).toBe('children')
+    expect(result.hasChildProcesses).toBe(true)
+  })
+
+  it('reports an observed-empty pane as no-children, not merely false', async () => {
+    const id = await spawnThenBecomeWindows()
+    inspectChildren.mockResolvedValue('no-children')
+
+    const result = await inspect({ id, scanChildProcesses: true })
+
+    // Asserted alongside the value so the case fails if the answer stops coming from a real read.
+    expect(inspectChildren).toHaveBeenCalledWith(mockPtyInstance.pid)
+    expect(result.childProcessEvidence).toBe('no-children')
+    expect(result.hasChildProcesses).toBe(false)
+  })
+
+  it('keeps the compatibility boolean false when the host could not observe the pane', async () => {
+    const id = await spawnThenBecomeWindows()
+    inspectChildren.mockResolvedValue('unverifiable')
+
+    const result = await inspect({ id, scanChildProcesses: true })
+
+    expect(result.childProcessEvidence).toBe('unverifiable')
+    // Clients too old to read the verdict also read `true` as "an agent took the PTY, safe to
+    // type into it", so `unverifiable` must not be promoted to `true` on the shared boolean.
+    expect(result.hasChildProcesses).toBe(false)
+  })
+
+  it('never reads the process table for a poll, and says so instead of guessing', async () => {
+    const id = await spawnThenBecomeWindows()
+
+    const result = await inspect({ id })
+
+    expect(inspectChildren).not.toHaveBeenCalled()
+    expect(result.childProcessEvidence).toBe('unverifiable')
+    expect(result.hasChildProcesses).toBe(false)
+  })
+})
diff --git a/src/relay/pty-handler.ts b/src/relay/pty-handler.ts
index 42f8bdc0a77..cdf436bca2a 100644
--- a/src/relay/pty-handler.ts
+++ b/src/relay/pty-handler.ts
@@ -10,11 +10,11 @@ import type { RelayDispatcher, RequestContext } from './dispatcher'
 import {
   resolveDefaultShell,
   resolveProcessCwd,
-  processHasChildren,
   getForegroundProcessName,
   isProcessAlive,
   listShellProfiles
 } from './pty-shell-utils'
+import { inspectPtyChildProcesses, processHasChildren } from './pty-child-process-inspection'
 import { getRelayShellLaunchConfig, isRelayWslShell } from './pty-shell-launch'
 import { RetiredPaneSurfaceRegistry } from './retired-pane-surfaces'
 import { addWslEnvKeys } from '../shared/wsl-env'
@@ -55,6 +55,7 @@ import {
 import { isTuiAgent } from '../shared/tui-agent-config'
 import type { TuiAgent } from '../shared/tui-agent'
 import { forceKillPosixPtyProcessGroups } from '../main/pty/posix-pty-process-groups'
+import type { PtyChildProcessVerdict } from '../shared/terminal-process-inspection'
 import { terminatePtyJob } from '../main/windows/windows-pty-job'
 import { stripInheritedBuildModeEnv } from '../main/pty/build-mode-env'
 import { stripLegacyTerminalShimEnv } from '../main/pty/legacy-terminal-shim-dir'
@@ -230,6 +231,10 @@ type ManagedPty = {
   gitCredentialPromptGuarded: boolean
   historyIsolationEnabled?: boolean
   startupCommand?: ManagedStartupCommand
+  /** Whether this host armed the shell-ready marker for a renderer-delivered startup command.
+   *  Kept off `startupCommand`, which is dropped once delivered; the client reads it from the
+   *  spawn reply to skip waiting for a marker that will never come (fish, sh, Windows). */
+  shellReadyArmed?: boolean
   physicalExit?: PhysicalExitTracker
   forceKillSent?: boolean
   gracefulKillSent?: boolean
@@ -252,6 +257,7 @@ type RelayAgentSessionCreateResult = {
   replay?: string
   agentSessionEnsure?: unknown
   sourceActivation?: PtySourceReceivingActivation
+  shellReadyArmed?: boolean
 }
 
 const AGENT_SESSION_CREATE_OPERATION_ID_PATTERN = /^[A-Za-z0-9_-]{43}$/
@@ -1803,7 +1809,10 @@ export class PtyHandler {
         incarnationId: managed.incarnationId,
         agentSessionEnsure: result,
         ...(sourceActivation ? { sourceActivation } : {}),
-        ...(adoptedReplay ? { replay: adoptedReplay } : {})
+        ...(adoptedReplay ? { replay: adoptedReplay } : {}),
+        ...(managed.shellReadyArmed !== undefined
+          ? { shellReadyArmed: managed.shellReadyArmed }
+          : {})
       }
     } catch (error) {
       if (!physicalSpawnCommitted) {
@@ -1826,6 +1835,7 @@ export class PtyHandler {
     id: string
     incarnationId: string
     sourceActivation?: PtySourceReceivingActivation
+    shellReadyArmed?: boolean
   }> {
     const pty = await this.loadPty()
     if (!pty) {
@@ -1895,12 +1905,16 @@ export class PtyHandler {
       isUnattended: launchAgent !== undefined,
       platform: process.platform
     })
+    // Why the shell is part of the decision here and not on the client: the client
+    // cannot see which shell this host runs, and plain Codex must still wait where
+    // the marker rides the line editor rather than double-echoing an early write.
     const shouldEmitShellReadyMarker =
       launchCommandHint !== undefined &&
       shouldUseShellReadyStartupDelivery({
         command: launchCommandHint,
         startupCommandDelivery:
-          params.startupCommandDelivery === 'shell-ready' ? 'shell-ready' : undefined
+          params.startupCommandDelivery === 'shell-ready' ? 'shell-ready' : undefined,
+        shellPath: shell
       })
     const managedStartupCommand = shouldProviderDeliverCommand ? command : launchCommandHint
     // Why: both renderer- and provider-delivered startup commands use this marker; the delivering side strips it from output.
@@ -1993,6 +2007,7 @@ export class PtyHandler {
       }),
       ...(startupIngressIntent ? { startupIngressIntent } : {}),
       ...(terminalHandle ? { terminalHandle } : {}),
+      shellReadyArmed: rendererShellReadySupported,
       ...(managedStartupCommand && (shouldProviderDeliverCommand || rendererShellReadySupported)
         ? {
             startupCommand: {
@@ -2034,7 +2049,8 @@ export class PtyHandler {
     return {
       id,
       incarnationId: managed.incarnationId,
-      ...(sourceActivation ? { sourceActivation } : {})
+      ...(sourceActivation ? { sourceActivation } : {}),
+      shellReadyArmed: rendererShellReadySupported
     }
   }
 
@@ -2610,6 +2626,7 @@ export class PtyHandler {
   private async inspectProcess(params: Record<string, unknown>): Promise<{
     foregroundProcess: string | null
     hasChildProcesses: boolean
+    childProcessEvidence?: PtyChildProcessVerdict
     foregroundProcessEvidence?: RemoteForegroundEvidence
   }> {
     pruneRetiredPtyIncarnations(this.retiredIncarnations)
@@ -2661,6 +2678,9 @@ export class PtyHandler {
       }
     }
     let rows: readonly ProcessTableRow[] | null = null
+    // Set only when the budgeted evidence read gave up, so the compatibility fields below do not
+    // turn around and ask the same unreadable table again with no budget at all.
+    let tableUnavailable = false
     let evidence: RemoteForegroundEvidence | undefined
     if (process.platform === 'win32') {
       // Why SSH-to-Windows is always unverifiable: POSIX has a real foreground primitive
@@ -2699,6 +2719,7 @@ export class PtyHandler {
           rows
         )
       } catch {
+        tableUnavailable = true
         evidence = {
           authorityGeneration: this.ptyIdMintEpoch,
           observationEpoch: ++this.foregroundEvidenceEpoch,
@@ -2716,14 +2737,34 @@ export class PtyHandler {
       evidence?.verdict === 'live'
         ? (evidence.processName ?? managed.pty.process) || null
         : managed.pty.process || null
+    // Derive child liveness from the same capture; do not fork a second process-table probe for
+    // each field/pane in an event burst.
+    //
+    // Why Windows is gated on the caller asking: this is the one field whose Windows answer costs
+    // a process-table read, and `inspectProcess` is the polled path (750ms/2000ms per tracked
+    // pane). A relay host has no `@vscode/windows-process-tree`, so the read falls back to the
+    // 1.36s CIM scan, and polling that would reinstate exactly the fork storm the shared table
+    // exists to prevent (#15209, #15036). Close and cleanup decisions ask for the scan by name;
+    // a poll gets the honest `unverifiable` instead of a fabricated negative.
+    // Why `tableUnavailable` first: it means the budgeted evidence read already gave up. Without
+    // this arm `inspectPtyChildProcesses` re-enters `getProcessTableSnapshot()` and joins the very
+    // capture this call just abandoned, blocking for all of it and spending the whole latency the
+    // budget exists to avoid. The destructive `pty.hasChildProcesses` RPC keeps its fresh probe.
+    const childProcessEvidence: PtyChildProcessVerdict = rows
+      ? rows.some((row) => row.ppid === managed.pty.pid)
+        ? 'children'
+        : 'no-children'
+      : tableUnavailable
+        ? 'unverifiable'
+        : process.platform === 'win32' && params.scanChildProcesses !== true
+          ? 'unverifiable'
+          : await inspectPtyChildProcesses(managed.pty.pid)
     return {
       foregroundProcess,
-      // Derive child liveness from the same capture; do not fork a second
-      // process-table probe for each field/pane in an event burst. Windows
-      // has no evidence capture, so preserve the compatibility child probe.
-      hasChildProcesses: rows
-        ? rows.some((row) => row.ppid === managed.pty.pid)
-        : await processHasChildren(managed.pty.pid),
+      // `unverifiable` keeps spelling itself `false` on the compatibility field, which is what
+      // every client too old to read the verdict receives.
+      hasChildProcesses: childProcessEvidence === 'children',
+      childProcessEvidence,
       ...(evidence ? { foregroundProcessEvidence: evidence } : {})
     }
   }
@@ -2742,6 +2783,10 @@ export class PtyHandler {
     // process-table work on the host.
     const includeForegroundProcessEvidence = params.includeForegroundProcessEvidence !== false
     let evidenceRows: readonly ProcessTableRow[] | null = null
+    // Same reason as `inspectProcess`: once the budgeted read has given up, the per-PTY title
+    // fallback below must not re-enter the same capture without a budget -- and here it would do
+    // so once per managed PTY.
+    let evidenceTableUnavailable = false
     let evidenceResults: BatchedForegroundProcessResult[] = []
     const evidenceEpoch = ++this.foregroundEvidenceEpoch
     // Worst-case capture time for the snapshot below, not the instant its await settled: the
@@ -2767,6 +2812,7 @@ export class PtyHandler {
       } catch {
         // An unreadable capture is represented as unverifiable evidence below;
         // existing inventory fields remain available for old clients.
+        evidenceTableUnavailable = true
       }
     }
     for (const [entryIndex, [id, managed]] of managedEntries.entries()) {
@@ -2781,7 +2827,7 @@ export class PtyHandler {
       const title =
         (evidenceRows
           ? (evidenceResults[entryIndex]?.processName ?? managed.pty.process ?? null)
-          : includeForegroundProcessEvidence
+          : includeForegroundProcessEvidence && !evidenceTableUnavailable
             ? await getForegroundProcessName(managed.pty.pid, managed.pty.process || null)
             : managed.pty.process || null) || 'shell'
       const foregroundProcessEvidence =
diff --git a/src/relay/pty-shell-utils.test.ts b/src/relay/pty-shell-utils.test.ts
index 95d6a8e050f..94953aae1bc 100644
--- a/src/relay/pty-shell-utils.test.ts
+++ b/src/relay/pty-shell-utils.test.ts
@@ -14,10 +14,10 @@ vi.mock('child_process', () => ({
 import { resetWindowsProcessRowsSnapshotForTests } from '../main/providers/windows-foreground-process-rows'
 import { __setWindowsProcessTreeLoaderForTests } from '../main/windows/windows-process-table'
 import { resetProcessTableSnapshotForTests } from '../shared/process-table-snapshot-reader'
+import { inspectPtyChildProcesses, processHasChildren } from './pty-child-process-inspection'
 import {
   getForegroundProcessName,
   isProcessAlive,
-  processHasChildren,
   resolveDefaultCwd,
   resolveWindowsDefaultShell
 } from './pty-shell-utils'
@@ -42,6 +42,14 @@ function mockExecFile(
  * Feed the native Windows snapshot. A real snapshot always contains the
  * querying process, and the reader rejects a table without it.
  */
+/** A native reader that answers, but with no snapshot -- an unreadable table, not an empty one. */
+function mockUnreadableWindowsProcessTable(): void {
+  __setWindowsProcessTreeLoaderForTests(() => ({
+    ProcessDataFlag: { None: 0, Memory: 1, CommandLine: 2 },
+    getAllProcesses: (cb: (value: undefined) => void) => cb(undefined)
+  }))
+}
+
 function mockWindowsProcessTable(
   rows: { pid: number; ppid: number; name: string; commandLine?: string }[]
 ): void {
@@ -594,19 +602,79 @@ describe('processHasChildren', () => {
     })
   })
 
-  it('reports no children when the process table is unreadable', async () => {
+  it('reports an unreadable POSIX table as unverifiable, and still spells it false on the wire', async () => {
     await withProcessPlatform('linux', async () => {
       mockExecFile(() => new Error('ps table unavailable'))
 
+      await expect(inspectPtyChildProcesses(100)).resolves.toBe('unverifiable')
       await expect(processHasChildren(100)).resolves.toBe(false)
     })
   })
+})
 
-  it('spawns nothing on Windows, where the answer was always false', async () => {
+describe('inspectPtyChildProcesses on Windows', () => {
+  // Why this describe exists: the relay used to `return false` here unconditionally, and a
+  // hardcoded negative is indistinguishable from a measurement. Every close guard reads it as
+  // "nothing is running here", so a Windows SSH pane running a build closed with no prompt.
+  it('walks the process table rather than answering from nothing', async () => {
     await withProcessPlatform('win32', async () => {
-      await expect(processHasChildren(100)).resolves.toBe(false)
+      mockWindowsProcessTable([
+        { pid: 100, ppid: 99, name: 'cmd.exe', commandLine: 'cmd.exe' },
+        { pid: 101, ppid: 100, name: 'PING.EXE', commandLine: 'ping -n 40 127.0.0.1' }
+      ])
 
-      expect(execFileMock).not.toHaveBeenCalled()
+      await expect(inspectPtyChildProcesses(100)).resolves.toBe('children')
+      await expect(processHasChildren(100)).resolves.toBe(true)
+    })
+  })
+
+  it('finds a grandchild the shell backgrounded, not just direct children', async () => {
+    await withProcessPlatform('win32', async () => {
+      mockWindowsProcessTable([
+        { pid: 100, ppid: 99, name: 'cmd.exe', commandLine: 'cmd.exe' },
+        { pid: 101, ppid: 100, name: 'node.exe', commandLine: 'node build.js' },
+        { pid: 102, ppid: 101, name: 'tsc.exe', commandLine: 'tsc --watch' }
+      ])
+
+      await expect(inspectPtyChildProcesses(102)).resolves.toBe('no-children')
+      await expect(inspectPtyChildProcesses(101)).resolves.toBe('children')
+    })
+  })
+
+  it('separates an observed-empty shell from a table it could not read', async () => {
+    await withProcessPlatform('win32', async () => {
+      mockWindowsProcessTable([{ pid: 100, ppid: 99, name: 'cmd.exe', commandLine: 'cmd.exe' }])
+      await expect(inspectPtyChildProcesses(100)).resolves.toBe('no-children')
+
+      resetWindowsProcessRowsSnapshotForTests()
+      mockUnreadableWindowsProcessTable()
+      const alive = vi.spyOn(process, 'kill').mockReturnValue(true as never)
+      try {
+        await expect(inspectPtyChildProcesses(100)).resolves.toBe('unverifiable')
+        // The compatibility boolean keeps spelling unverifiable `false`: it reaches clients that
+        // cannot read the verdict, and they read `true` as "an agent took the PTY, safe to type".
+        await expect(processHasChildren(100)).resolves.toBe(false)
+      } finally {
+        alive.mockRestore()
+      }
+    })
+  })
+
+  it('does not read a missing shell as unverifiable when the kernel says it is gone', async () => {
+    await withProcessPlatform('win32', async () => {
+      // The root is absent from the snapshot, which on its own cannot distinguish a filtered
+      // table from an exited shell. Only ESRCH settles it.
+      mockWindowsProcessTable([{ pid: 900, ppid: 1, name: 'explorer.exe' }])
+      const gone = vi.spyOn(process, 'kill').mockImplementation(() => {
+        const error = new Error('no such process') as NodeJS.ErrnoException
+        error.code = 'ESRCH'
+        throw error
+      })
+      try {
+        await expect(inspectPtyChildProcesses(100)).resolves.toBe('no-children')
+      } finally {
+        gone.mockRestore()
+      }
     })
   })
 })
diff --git a/src/relay/pty-shell-utils.ts b/src/relay/pty-shell-utils.ts
index d84faad6ae9..9c8585933a1 100644
--- a/src/relay/pty-shell-utils.ts
+++ b/src/relay/pty-shell-utils.ts
@@ -11,10 +11,7 @@ import {
 import { getFirstCommandToken } from '../shared/command-token-scanner'
 import { getProcessTableIndex, type ProcessTableIndex } from '../shared/process-table-index'
 import { PS_MAX_BUFFER_BYTES, type ProcessTableRow } from '../shared/process-table-snapshot'
-import {
-  getFreshProcessTableSnapshot,
-  getProcessTableSnapshot
-} from '../shared/process-table-snapshot-reader'
+import { getProcessTableSnapshot } from '../shared/process-table-snapshot-reader'
 import { selectForegroundProcessCandidate } from '../shared/foreground-process-selection'
 import {
   resolveOuterWrapperForegroundProcess,
@@ -169,43 +166,6 @@ export async function resolveProcessCwd(pid: number, fallbackCwd: string): Promi
   return fallbackCwd
 }
 
-/**
- * Check whether a process has child processes.
- *
- * Why the shared snapshot and not `pgrep -P`: this answers one field of
- * `pty.inspectProcess`, which every tracked pane polls on a 750ms/2000ms
- * cadence, and the fork was neither cached nor coalesced. procps-ng opens six
- * procfs files per process to resolve a ppid — including a `/proc/<pid>/ctty`
- * that never exists on Linux — so one call cost O(host process count) syscalls,
- * ~4k opens per pgrep on a 690-process host, at up to 8 forks/sec (#13537).
- * `getForegroundProcessName` in the same RPC already captured the TTL-cached
- * `ps` table, whose index carries the parent/child map, so the answer is free.
- *
- * `fresh` opts out of that TTL. A poll can read a 500ms-old table because its
- * next tick corrects it, but a close or cleanup decision acts on the answer
- * once and destructively — a child that started inside the TTL would be killed
- * with no confirmation. `pgrep` scanned per call, so anything that decides
- * has to keep scanning per call.
- */
-export async function processHasChildren(
-  pid: number,
-  options?: { fresh?: boolean }
-): Promise<boolean> {
-  // Windows has no `ps`; the previous `pgrep` fork always failed here too, so
-  // this keeps the same answer without spawning anything to reach it.
-  if (process.platform === 'win32') {
-    return false
-  }
-  try {
-    const rows = options?.fresh
-      ? await getFreshProcessTableSnapshot()
-      : await getProcessTableSnapshot()
-    return (getProcessTableIndex(rows).childrenByPpid.get(pid)?.length ?? 0) > 0
-  } catch {
-    return false
-  }
-}
-
 // Why: signal 0 probes existence without delivering a signal. Only ESRCH ("no
 // such process") proves the pid is gone; EPERM means it exists but is
 // unsignalable, so treat every non-ESRCH outcome as alive. Kept conservative so
diff --git a/src/relay/windows-port-scan.test.ts b/src/relay/windows-port-scan.test.ts
index 139d3ede6be..9fb074180b9 100644
--- a/src/relay/windows-port-scan.test.ts
+++ b/src/relay/windows-port-scan.test.ts
@@ -1,22 +1,30 @@
-import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { execFileAsyncMock, execFileMock, promisifyCustom } = vi.hoisted(() => ({
-  execFileAsyncMock: vi.fn(),
-  execFileMock: vi.fn(),
-  promisifyCustom: Symbol.for('nodejs.util.promisify.custom')
-}))
-
-vi.mock('child_process', () => ({
-  execFile: Object.assign(execFileMock, {
-    [promisifyCustom]: execFileAsyncMock
-  })
+const runProcessMock = vi.fn()
+vi.mock('../shared/child-process/run-process', () => ({
+  runProcess: (spec: unknown) => runProcessMock(spec)
 }))
 
 vi.mock('./relay-command-env', () => ({
   buildRelayCommandEnv: () => ({ PATH: 'C:\\Windows\\System32' })
 }))
 
-const { scanWindowsListeningPorts } = await import('./windows-port-scan')
+import {
+  __setWindowsProcessTableCimScanForTests,
+  __setWindowsProcessTreeLoaderForTests,
+  resetWindowsProcessTableForTests
+} from '../main/windows/windows-process-table'
+import {
+  resetWindowsPortScanDiagnosticsForTests,
+  scanWindowsListeningPorts
+} from './windows-port-scan'
+
+type Spec = {
+  program: string
+  args?: readonly string[]
+  timeoutMs?: number | null
+  signal?: AbortSignal
+}
 
 // The scanner drops any row whose pid is the relay process or its parent, so a fixture pid
 // that happens to match the vitest worker's own pid silently empties the result and the
@@ -32,78 +40,365 @@ function pidUnlikeSelf(seed: number): number {
   return pid
 }
 
-const POWERSHELL_PID = pidUnlikeSelf(1234)
 const NETSTAT_PID = pidUnlikeSelf(2468)
+const SSHD_PID = pidUnlikeSelf(4321)
+const POWERSHELL_PID = pidUnlikeSelf(1234)
+
+const NETSTAT_STDOUT = [
+  '  Proto  Local Address          Foreign Address        State           PID',
+  `  TCP    0.0.0.0:3000           0.0.0.0:0              LISTENING       ${NETSTAT_PID}`,
+  `  TCP    [::]:3000              [::]:0                 LISTENING       ${NETSTAT_PID}`,
+  `  TCP    0.0.0.0:4000           93.184.216.34:443      ESTABLISHED     ${NETSTAT_PID}`,
+  `  UDP    0.0.0.0:5353           *:*                                    ${NETSTAT_PID}`,
+  `  TCP    0.0.0.0:2222           0.0.0.0:0              LISTENING       ${SSHD_PID}`
+].join('\r\n')
+
+function ok(stdout: string): {
+  code: number
+  signal: null
+  stdout: string
+  stderr: string
+  timedOut: boolean
+} {
+  return { code: 0, signal: null, stdout, stderr: '', timedOut: false }
+}
+
+type NativeRow = {
+  pid: number
+  ppid: number
+  name: string
+  memory?: number
+  commandLine?: string
+  creationTimeMs?: number
+}
+
+/** A native snapshot must contain the reader's own pid or the table rejects. */
+function nativeTable(rows: NativeRow[]) {
+  return () => ({
+    ProcessDataFlag: { None: 0, Memory: 1, CommandLine: 2 },
+    getAllProcesses: (callback: (processes: NativeRow[] | undefined) => void) =>
+      callback([{ pid: process.pid, ppid: 0, name: 'vitest.exe' }, ...rows])
+  })
+}
+
+function specs(): Spec[] {
+  return runProcessMock.mock.calls.map((call) => call[0] as Spec)
+}
 
 describe('scanWindowsListeningPorts', () => {
   beforeEach(() => {
-    execFileAsyncMock.mockReset()
+    runProcessMock.mockReset()
+    resetWindowsPortScanDiagnosticsForTests()
+    resetWindowsProcessTableForTests()
+    __setWindowsProcessTreeLoaderForTests(
+      nativeTable([
+        { pid: NETSTAT_PID, ppid: 4, name: 'node.exe' },
+        { pid: SSHD_PID, ppid: 4, name: 'sshd.exe' }
+      ])
+    )
   })
 
-  it('bounds the PowerShell scan with the caller abort signal and timeout', async () => {
+  afterEach(() => {
+    __setWindowsProcessTreeLoaderForTests()
+    __setWindowsProcessTableCimScanForTests()
+    resetWindowsProcessTableForTests()
+  })
+
+  it('reads netstat first and never starts PowerShell', async () => {
     const controller = new AbortController()
-    execFileAsyncMock.mockResolvedValueOnce({
-      stdout: JSON.stringify({
+    runProcessMock.mockResolvedValueOnce(ok(NETSTAT_STDOUT))
+
+    await expect(scanWindowsListeningPorts(controller.signal)).resolves.toEqual([
+      { host: '::', port: 3000, pid: NETSTAT_PID, processName: 'node' },
+      { host: '0.0.0.0', port: 3000, pid: NETSTAT_PID, processName: 'node' }
+    ])
+
+    expect(specs()).toHaveLength(1)
+    expect(specs()[0].program).toMatch(/netstat\.exe$/)
+    // `-p tcp` is absent on purpose: on Windows it means IPv4-only and would
+    // hide every `[::]` listener.
+    expect(specs()[0].args).toEqual(['-ano'])
+    expect(specs()[0].signal).toBe(controller.signal)
+    expect(specs()[0].timeoutMs).toBe(5000)
+  })
+
+  it('keeps the sshd and self-pid filters working off native process names', async () => {
+    runProcessMock.mockResolvedValueOnce(
+      ok(
+        [
+          NETSTAT_STDOUT,
+          `  TCP    0.0.0.0:9999           0.0.0.0:0              LISTENING       ${process.pid}`
+        ].join('\r\n')
+      )
+    )
+
+    const ports = await scanWindowsListeningPorts()
+
+    // sshd.exe is matched despite the table's `.exe` spelling, and the relay's
+    // own listener never reaches a client.
+    expect(ports.map((port) => `${port.host}:${port.port}`)).toEqual([':::3000', '0.0.0.0:3000'])
+  })
+
+  it('still reports host/port/pid when no process table is readable', async () => {
+    runProcessMock.mockResolvedValueOnce(ok(NETSTAT_STDOUT))
+    __setWindowsProcessTreeLoaderForTests(() => null)
+    __setWindowsProcessTableCimScanForTests(() =>
+      Promise.reject(new Error('windows process table unavailable'))
+    )
+    resetWindowsProcessTableForTests()
+
+    await expect(scanWindowsListeningPorts()).resolves.toEqual([
+      { host: '0.0.0.0', port: 2222, pid: SSHD_PID },
+      { host: '::', port: 3000, pid: NETSTAT_PID },
+      { host: '0.0.0.0', port: 3000, pid: NETSTAT_PID }
+    ])
+    // Names were unavailable, so nothing else was spawned to go get them.
+    expect(specs()).toHaveLength(1)
+  })
+
+  it('falls back to PowerShell without an execution-policy override', async () => {
+    const controller = new AbortController()
+    runProcessMock
+      .mockResolvedValueOnce({
+        code: 1,
+        signal: null,
+        stdout: '',
+        stderr: 'blocked',
+        timedOut: false
+      })
+      .mockResolvedValueOnce(
+        ok(
+          JSON.stringify({
+            host: '127.0.0.1',
+            port: 5173,
+            pid: POWERSHELL_PID,
+            processName: 'node'
+          })
+        )
+      )
+
+    await expect(scanWindowsListeningPorts(controller.signal)).resolves.toEqual([
+      {
         host: '127.0.0.1',
         port: 5173,
         pid: POWERSHELL_PID,
         processName: 'node'
-      }),
-      stderr: ''
-    })
-
-    await expect(scanWindowsListeningPorts(controller.signal)).resolves.toEqual([
-      { host: '127.0.0.1', port: 5173, pid: POWERSHELL_PID, processName: 'node' }
+      }
     ])
 
-    expect(execFileAsyncMock).toHaveBeenCalledWith(
-      'powershell.exe',
-      expect.arrayContaining(['-EncodedCommand', expect.any(String)]),
-      expect.objectContaining({
-        signal: controller.signal,
-        timeout: 5000,
-        windowsHide: true
-      })
-    )
+    const powershell = specs()[1]
+    expect(powershell.program).toMatch(/powershell\.exe$/i)
+    expect(powershell.args?.slice(0, 3)).toEqual(['-NoProfile', '-NonInteractive', '-Command'])
+    expect(powershell.args).not.toContain('-ExecutionPolicy')
+    expect(powershell.args).not.toContain('-EncodedCommand')
+    expect(powershell.args).toHaveLength(4)
+    expect(powershell.args?.[3]).toContain('Get-NetTCPConnection')
+    expect(powershell.signal).toBe(controller.signal)
+    expect(powershell.timeoutMs).toBe(5000)
   })
 
-  it('bounds the netstat fallback with the same abort signal and timeout', async () => {
-    const controller = new AbortController()
-    execFileAsyncMock
+  it('tries pwsh when Windows PowerShell cannot answer, then gives up empty', async () => {
+    runProcessMock
+      .mockResolvedValueOnce(ok(''))
       .mockRejectedValueOnce(new Error('powershell unavailable'))
       .mockRejectedValueOnce(new Error('pwsh unavailable'))
-      .mockResolvedValueOnce({
-        stdout: [
-          '  Proto  Local Address          Foreign Address        State           PID',
-          `  TCP    0.0.0.0:3000           0.0.0.0:0              LISTENING       ${NETSTAT_PID}`
-        ].join('\r\n'),
-        stderr: ''
-      })
 
-    await expect(scanWindowsListeningPorts(controller.signal)).resolves.toEqual([
-      { host: '0.0.0.0', port: 3000, pid: NETSTAT_PID }
+    await expect(scanWindowsListeningPorts()).resolves.toEqual([])
+
+    expect(specs().map((spec) => spec.program)).toEqual([
+      expect.stringMatching(/netstat\.exe$/),
+      expect.stringMatching(/powershell\.exe$/i),
+      'pwsh.exe'
     ])
-
-    expect(execFileAsyncMock).toHaveBeenLastCalledWith(
-      'netstat.exe',
-      ['-ano', '-p', 'tcp'],
-      expect.objectContaining({
-        signal: controller.signal,
-        timeout: 5000,
-        windowsHide: true
-      })
-    )
   })
 
-  it('does not start the netstat fallback after the scan is cancelled', async () => {
+  it('gives up rather than falling back once the scan is cancelled', async () => {
     const controller = new AbortController()
     controller.abort()
-    execFileAsyncMock.mockRejectedValueOnce(
-      Object.assign(new Error('cancelled'), { name: 'AbortError' })
-    )
+    runProcessMock.mockResolvedValueOnce({
+      code: null,
+      signal: null,
+      stdout: '',
+      stderr: '',
+      timedOut: false
+    })
 
     await expect(scanWindowsListeningPorts(controller.signal)).resolves.toEqual([])
 
-    expect(execFileAsyncMock).toHaveBeenCalledTimes(1)
+    expect(runProcessMock).toHaveBeenCalledTimes(1)
+  })
+
+  // `LISTENING` ships in netstat.exe.mui, picked by UI language, so no env can
+  // pin it. Without the shape-based re-read a German host parses zero rows,
+  // reads that as a blocked reader, and runs the flagged payload every 12-30s.
+  it('reads a localized host by socket shape rather than the state word', async () => {
+    runProcessMock.mockResolvedValueOnce(
+      ok(
+        [
+          'Aktive Verbindungen',
+          '',
+          '  Proto  Lokale Adresse         Remoteadresse          Status           PID',
+          '  TCP    0.0.0.0:135            0.0.0.0:0              ABHÖREN          1116',
+          `  TCP    0.0.0.0:3000           0.0.0.0:0              ABHÖREN          ${NETSTAT_PID}`,
+          `  TCP    [::]:3000              [::]:0                 ABHÖREN          ${NETSTAT_PID}`,
+          `  TCP    192.168.0.5:52000      93.184.216.34:443      HERGESTELLT      ${NETSTAT_PID}`
+        ].join('\r\n')
+      )
+    )
+
+    await expect(scanWindowsListeningPorts()).resolves.toEqual([
+      { host: '0.0.0.0', port: 135, pid: 1116 },
+      { host: '::', port: 3000, pid: NETSTAT_PID, processName: 'node' },
+      { host: '0.0.0.0', port: 3000, pid: NETSTAT_PID, processName: 'node' }
+    ])
+    expect(specs()).toHaveLength(1)
+  })
+
+  // The gap the state-word cases cannot cover: on a localized host BOUND is as
+  // unreadable as ABHÖREN, so shape alone would publish 8080 as a listener.
+  // Listeners dominate, and that is what separates them.
+  it('drops a BOUND socket that shape alone would promote on a localized host', async () => {
+    runProcessMock.mockResolvedValueOnce(
+      ok(
+        [
+          `  TCP    0.0.0.0:3000           0.0.0.0:0              ABHÖREN          ${NETSTAT_PID}`,
+          `  TCP    [::]:3000              [::]:0                 ABHÖREN          ${NETSTAT_PID}`,
+          `  TCP    0.0.0.0:8080           0.0.0.0:0              GEBUNDEN         ${NETSTAT_PID}`,
+          `  TCP    192.168.0.5:52000      93.184.216.34:443      HERGESTELLT      ${NETSTAT_PID}`
+        ].join('\r\n')
+      )
+    )
+
+    await expect(scanWindowsListeningPorts()).resolves.toEqual([
+      { host: '::', port: 3000, pid: NETSTAT_PID, processName: 'node' },
+      { host: '0.0.0.0', port: 3000, pid: NETSTAT_PID, processName: 'node' }
+    ])
+  })
+
+  // Only on an exact tie does shape have nothing left to go on, and then it
+  // keeps both rather than guessing — no worse than reading shape alone.
+  it('keeps every tied zero-peer state when none dominates', async () => {
+    runProcessMock.mockResolvedValueOnce(
+      ok(
+        [
+          `  TCP    0.0.0.0:3000           0.0.0.0:0              ABHÖREN          ${NETSTAT_PID}`,
+          `  TCP    0.0.0.0:8080           0.0.0.0:0              GEBUNDEN         ${NETSTAT_PID}`
+        ].join('\r\n')
+      )
+    )
+
+    await expect(scanWindowsListeningPorts()).resolves.toEqual([
+      { host: '0.0.0.0', port: 3000, pid: NETSTAT_PID, processName: 'node' },
+      { host: '0.0.0.0', port: 8080, pid: NETSTAT_PID, processName: 'node' }
+    ])
+  })
+
+  // Windows prints BOUND with a zero peer too, so the shape test must stay the
+  // fallback: a host with at least one readable LISTENING row never reaches it.
+  it('does not promote a BOUND socket on a host whose state word parsed', async () => {
+    runProcessMock.mockResolvedValueOnce(
+      ok(
+        [
+          `  TCP    0.0.0.0:3000           0.0.0.0:0              LISTENING       ${NETSTAT_PID}`,
+          `  TCP    0.0.0.0:8080           0.0.0.0:0              BOUND           ${NETSTAT_PID}`
+        ].join('\r\n')
+      )
+    )
+
+    await expect(scanWindowsListeningPorts()).resolves.toEqual([
+      { host: '0.0.0.0', port: 3000, pid: NETSTAT_PID, processName: 'node' }
+    ])
+  })
+
+  // A capped read exits 0 and its head parses, and netstat orders IPv4 TCP
+  // before IPv6 TCP, so publishing the head would drop every `[::]` listener.
+  it('refuses a netstat table that hit the capture cap', async () => {
+    const filler = Array.from(
+      { length: 60_000 },
+      (_, index) =>
+        `  TCP    10.0.0.1:${1000 + (index % 5000)}      10.0.0.2:443           TIME_WAIT       4`
+    ).join('\r\n')
+    runProcessMock
+      .mockResolvedValueOnce(ok(`${NETSTAT_STDOUT}\r\n${filler}`.slice(0, 4 * 1024 * 1024)))
+      .mockResolvedValueOnce(ok('[]'))
+
+    await expect(scanWindowsListeningPorts()).resolves.toEqual([])
+
+    // Fell through instead of publishing the IPv4 head it could still parse.
+    expect(specs()).toHaveLength(2)
+    expect(specs()[1].args).toContain('-Command')
+  })
+
+  it('does not wait on the shared process table once the scan is cancelled', async () => {
+    const controller = new AbortController()
+    const getAllProcesses = vi.fn()
+    __setWindowsProcessTreeLoaderForTests(() => ({
+      ProcessDataFlag: { None: 0, Memory: 1, CommandLine: 2 },
+      getAllProcesses
+    }))
+    resetWindowsProcessTableForTests()
+    // netstat answered, then the request was abandoned before names were needed.
+    runProcessMock.mockImplementationOnce(() => {
+      controller.abort()
+      return Promise.resolve(ok(NETSTAT_STDOUT))
+    })
+
+    await expect(scanWindowsListeningPorts(controller.signal)).resolves.toEqual([
+      // Unnamed, so the sshd row survives its own filter — the cost of not
+      // waiting, and strictly better than blocking an abandoned request.
+      { host: '0.0.0.0', port: 2222, pid: SSHD_PID },
+      { host: '::', port: 3000, pid: NETSTAT_PID },
+      { host: '0.0.0.0', port: 3000, pid: NETSTAT_PID }
+    ])
+    expect(getAllProcesses).not.toHaveBeenCalled()
+  })
+
+  // The relay daemon's stderr is what installRelayLogRotation routes into
+  // relay.log, so a fall-through logged anywhere else is a fall-through nobody
+  // can diagnose. Pin the stream, not just the fact that something was called.
+  it('reports leaving the native path on the relay diagnostic stream, once', async () => {
+    const lines: string[] = []
+    const stderr = vi
+      .spyOn(process.stderr, 'write')
+      .mockImplementation((chunk: string | Uint8Array) => {
+        lines.push(String(chunk))
+        return true
+      })
+    try {
+      runProcessMock.mockResolvedValue(ok(''))
+      await scanWindowsListeningPorts()
+      await scanWindowsListeningPorts()
+      // A second, different fault on the same host must still be heard: one
+      // flag for the whole module would have swallowed it.
+      runProcessMock.mockResolvedValue(ok('x'.repeat(4 * 1024 * 1024)))
+      await scanWindowsListeningPorts()
+      await scanWindowsListeningPorts()
+    } finally {
+      stderr.mockRestore()
+    }
+
+    const reported = lines.filter((line) => line.includes('[ports] netstat unusable'))
+    expect(reported).toHaveLength(2)
+    expect(reported[0]).toContain('no listening row parsed')
+    expect(reported[1]).toContain('truncated')
+    // relayLogLine's ISO stamp: an unplaceable line cannot be read against the
+    // reconnect flaps around it.
+    expect(reported[0]).toMatch(/^\d{4}-\d{2}-\d{2}T[\d:.]+Z /)
+  })
+
+  it('treats a netstat timeout as unanswered and falls through', async () => {
+    runProcessMock
+      .mockResolvedValueOnce({
+        code: null,
+        signal: 'SIGKILL',
+        stdout: '',
+        stderr: '',
+        timedOut: true
+      })
+      .mockResolvedValueOnce(ok('[]'))
+
+    await expect(scanWindowsListeningPorts()).resolves.toEqual([])
+
+    expect(specs()).toHaveLength(2)
   })
 })
diff --git a/src/relay/windows-port-scan.ts b/src/relay/windows-port-scan.ts
index f26a2bb172a..f99fce4a087 100644
--- a/src/relay/windows-port-scan.ts
+++ b/src/relay/windows-port-scan.ts
@@ -1,84 +1,231 @@
-import { execFile } from 'node:child_process'
-import { promisify } from 'node:util'
+import { readWindowsProcessTable } from '../main/windows/windows-process-table'
+import { runProcess } from '../shared/child-process/run-process'
+import {
+  windowsPowerShellPath,
+  windowsSystem32Binary
+} from '../shared/child-process/windows-system-binary'
 import { getProcessOutputFields } from '../shared/process-output-field-scanner'
-import { encodePowerShellCommand } from '../shared/powershell-command-encoding'
 import type { DetectedPort } from './port-scan-handler'
 import { buildRelayCommandEnv } from './relay-command-env'
+import { relayLogLine } from './relay-diagnostic-log'
 
 const SYSTEM_PORTS_TO_EXCLUDE = new Set([22])
 const MAX_DETECTED_PORTS = 50
 const WINDOWS_PORT_SCAN_TIMEOUT_MS = 5_000
-const execFileAsync = promisify(execFile)
+// Wide enough for `netstat -ano` on a busy host: it prints every connection, not
+// just the listeners, and a truncated table silently drops the tail.
+const WINDOWS_PORT_SCAN_MAX_OUTPUT_BYTES = 4 * 1024 * 1024
 
+/**
+ * Listening TCP ports, attributed to their owning process.
+ *
+ * `netstat.exe -ano` answers all of it except the process name, which comes
+ * from the shared process table -- so this scan starts no PowerShell of its
+ * own. One still runs on a released relay: without the optional
+ * `windows-process-tree.node` addon (built only by dev-channel-win-build.yml,
+ * so no release carries it) that table falls back to a CIM scan that forks one
+ * `powershell.exe`. That scan is TTL-shared with pane naming, so a relay with a
+ * live pane pays nothing extra for it.
+ *
+ * The EDR win is therefore the shape, not the absence of PowerShell. The
+ * retired payload ran `-ExecutionPolicy Bypass -EncodedCommand <base64>`
+ * wrapping `Get-NetTCPConnection` joined to `Get-Process`: base64 beside a
+ * policy override is the highest-weighted token pair Defender for Endpoint
+ * scores on a PowerShell command line, and listing listeners with their owners
+ * reads as network discovery (T1049) on top of it. The shared CIM scan carries
+ * neither token. That payload survives only as the last resort below, without
+ * the override.
+ */
 export async function scanWindowsListeningPorts(signal?: AbortSignal): Promise<DetectedPort[]> {
+  const netstatPorts = await readWindowsNetstatPorts(signal)
+  if (netstatPorts) {
+    return normalizeWindowsDetectedPorts(await attachWindowsProcessNames(netstatPorts, signal))
+  }
+  if (signal?.aborted) {
+    return []
+  }
   try {
     const json = await runWindowsPortScanPowerShell(signal)
     return normalizeWindowsDetectedPorts(parseWindowsPowerShellPortRows(json))
   } catch {
-    if (signal?.aborted) {
-      return []
-    }
-    try {
-      const { stdout } = await execFileAsync('netstat.exe', ['-ano', '-p', 'tcp'], {
-        env: buildRelayCommandEnv(),
-        encoding: 'utf-8',
-        signal,
-        timeout: WINDOWS_PORT_SCAN_TIMEOUT_MS,
-        windowsHide: true
-      })
-      return normalizeWindowsDetectedPorts(parseWindowsNetstatOutput(stdout))
-    } catch {
-      return []
-    }
+    return []
   }
 }
 
-async function runWindowsPortScanPowerShell(signal?: AbortSignal): Promise<string> {
-  const script = [
-    "$ErrorActionPreference = 'Stop'",
-    '$connections = Get-NetTCPConnection -State Listen -ErrorAction Stop',
-    '$items = foreach ($connection in $connections) {',
-    '  $name = $null',
-    '  try {',
-    '    $process = Get-Process -Id $connection.OwningProcess -ErrorAction Stop',
-    '    $name = $process.ProcessName',
-    '  } catch {}',
-    '  [pscustomobject]@{',
-    '    host = [string]$connection.LocalAddress',
-    '    port = [int]$connection.LocalPort',
-    '    pid = [int]$connection.OwningProcess',
-    '    processName = $name',
-    '  }',
-    '}',
-    '$items | ConvertTo-Json -Compress -Depth 3'
-  ].join('\n')
-  const encoded = encodePowerShellCommand(script)
-  const lastError: unknown[] = []
+/** Rows, or null when netstat could not answer and the fallback should run. */
+async function readWindowsNetstatPorts(signal?: AbortSignal): Promise<DetectedPort[] | null> {
+  let stdout: string
+  try {
+    const result = await runProcess({
+      program: windowsSystem32Binary('netstat.exe'),
+      // No `-p tcp`: on Windows that protocol name means TCP over IPv4 only, so
+      // it hides every `[::]` listener the retired PowerShell payload reported.
+      args: ['-ano'],
+      env: buildRelayCommandEnv(),
+      timeoutMs: WINDOWS_PORT_SCAN_TIMEOUT_MS,
+      maxOutputBytes: WINDOWS_PORT_SCAN_MAX_OUTPUT_BYTES,
+      signal
+    })
+    if (result.timedOut || result.code !== 0) {
+      return null
+    }
+    // A capped read still exits 0 and its head still parses, so nothing
+    // downstream can tell a partial table from a whole one. netstat prints IPv4
+    // TCP, then IPv6 TCP, then UDP, so the rows lost first are exactly the
+    // `[::]` listeners that dropping `-p tcp` above exists to keep. Refuse the
+    // whole read rather than publish its head.
+    if (Buffer.byteLength(result.stdout) >= WINDOWS_PORT_SCAN_MAX_OUTPUT_BYTES) {
+      reportWindowsNetstatUnusable('output hit the capture cap and was truncated')
+      return null
+    }
+    stdout = result.stdout
+  } catch {
+    return null
+  }
+  const ports = parseWindowsNetstatOutput(stdout)
+  // Windows always has a listener (RPC endpoint mapper, SMB), so an exit-0 scan
+  // that parses to nothing is a reader that was blocked, not an idle host.
+  if (ports.length === 0) {
+    reportWindowsNetstatUnusable('exited 0 but no listening row parsed')
+    return null
+  }
+  return ports
+}
 
-  for (const binary of ['powershell.exe', 'pwsh.exe']) {
-    try {
-      const { stdout } = await execFileAsync(
-        binary,
-        ['-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-EncodedCommand', encoded],
-        {
-          env: buildRelayCommandEnv(),
-          encoding: 'utf-8',
-          maxBuffer: 1024 * 1024,
-          signal,
-          timeout: WINDOWS_PORT_SCAN_TIMEOUT_MS,
-          windowsHide: true
-        }
+/** Reasons already reported. A fixed two-value vocabulary, so it cannot grow. */
+const reportedNetstatFailures = new Set<string>()
+
+/**
+ * Say once why the scan left the native path.
+ *
+ * Both fall-throughs are permanent when they are wrong — the host stays on the
+ * PowerShell payload, or on nothing, for the life of the relay — and the scan
+ * repeats every 12-30s, so this logs one line rather than a stream.
+ *
+ * Through relayLogLine, not console.warn: this only ever runs in the detached
+ * daemon, whose stderr installRelayLogRotation routes into the relay.log that
+ * the remote-diagnostics tail reads. An untimestamped line in that file cannot
+ * be placed against the reconnect flaps around it (#7773), and "since when" is
+ * most of what this line is for.
+ */
+function reportWindowsNetstatUnusable(reason: string): void {
+  // Per reason, not per module: a host that parses nothing today and truncates
+  // tomorrow has two different faults, and one flag would hide the second.
+  if (reportedNetstatFailures.has(reason)) {
+    return
+  }
+  reportedNetstatFailures.add(reason)
+  relayLogLine(`[ports] netstat unusable on this host (${reason}); falling back to PowerShell`)
+}
+
+/** Test-only: re-arm the one-shot so each case can observe its own line. */
+export function resetWindowsPortScanDiagnosticsForTests(): void {
+  reportedNetstatFailures.clear()
+}
+
+/**
+ * Fill in owning-process names from the shared process-table snapshot.
+ *
+ * Names are optional data — the panel renders host/port/pid without them — so a
+ * host that cannot read the table keeps its rows. This shares whatever scan the
+ * table already runs rather than avoiding one, and on a relay that scan is a
+ * `powershell.exe` CIM query -- no released relay carries the native addon, so
+ * that is the path every SSH host takes, not a fallback.
+ * See docs/reference/windows-process-enumeration.md.
+ *
+ * Only `name` is read here, so this wants `readWindowsProcessIdentityTable`
+ * once #17866 lands -- on the detailed reader it would pay per-process handles
+ * for a field it discards.
+ *
+ * Best-effort by design: the snapshot is shared and TTL-cached, so it can
+ * predate netstat and hand a recycled PID its previous owner's name. Only
+ * labels read this field, and a fresh read would cost every caller a scan.
+ */
+async function attachWindowsProcessNames(
+  ports: DetectedPort[],
+  signal?: AbortSignal
+): Promise<DetectedPort[]> {
+  const pids = new Set(ports.flatMap((port) => (port.pid == null ? [] : [port.pid])))
+  // The shared snapshot takes no signal and must not be cancelled on one
+  // caller's behalf, so an abandoned scan declines to wait for it instead.
+  if (pids.size === 0 || signal?.aborted) {
+    return ports
+  }
+  let names: Map<number, string>
+  try {
+    const rows = await readWindowsProcessTable()
+    names = new Map(
+      rows.flatMap((row) =>
+        pids.has(row.pid) && row.name ? [[row.pid, stripExecutableSuffix(row.name)] as const] : []
       )
-      return stdout
+    )
+  } catch {
+    return ports
+  }
+  return ports.map((port) => {
+    const processName = port.pid == null ? undefined : names.get(port.pid)
+    return processName ? { ...port, processName } : port
+  })
+}
+
+// The process table reports `sshd.exe`; the retired `Get-Process` payload
+// reported `sshd`. The sshd filter below and every client that already renders
+// these rows read the bare name, so keep publishing that spelling.
+function stripExecutableSuffix(name: string): string {
+  return name.replace(/\.exe$/i, '')
+}
+
+/**
+ * Single line so it survives as one argv element regardless of how the
+ * shell-less spawn hands it to PowerShell's `-Command` parser. Exported so
+ * windows-port-scan.win32.test.ts can run it: a missing `;` between statements
+ * is a parse error the mocked tests cannot see.
+ */
+export const WINDOWS_PORT_SCAN_SCRIPT = [
+  "$ErrorActionPreference = 'Stop';",
+  'Get-NetTCPConnection -State Listen | ForEach-Object {',
+  '$connection = $_; $name = $null;',
+  'try { $name = (Get-Process -Id $connection.OwningProcess -ErrorAction Stop).ProcessName } catch { };',
+  '[pscustomobject]@{ host = [string]$connection.LocalAddress; port = [int]$connection.LocalPort;',
+  'pid = [int]$connection.OwningProcess; processName = $name }',
+  '} | ConvertTo-Json -Compress -Depth 3'
+].join(' ')
+
+async function runWindowsPortScanPowerShell(signal?: AbortSignal): Promise<string> {
+  let lastError: unknown
+
+  for (const program of [windowsPowerShellPath(), 'pwsh.exe']) {
+    try {
+      const result = await runProcess({
+        program,
+        // No `-ExecutionPolicy` override: the policy gates script *files*, never
+        // `-Command`. Verified on Windows 11 — `-ExecutionPolicy Restricted
+        // -Command` still runs, while `-File` against an unsigned .ps1 does not.
+        args: ['-NoProfile', '-NonInteractive', '-Command', WINDOWS_PORT_SCAN_SCRIPT],
+        env: buildRelayCommandEnv(),
+        timeoutMs: WINDOWS_PORT_SCAN_TIMEOUT_MS,
+        maxOutputBytes: WINDOWS_PORT_SCAN_MAX_OUTPUT_BYTES,
+        signal
+      })
+      if (signal?.aborted) {
+        throw new Error('windows port scan aborted')
+      }
+      if (result.timedOut || result.code !== 0) {
+        lastError ??= new Error(
+          `windows port scan PowerShell failed (code=${result.code} timedOut=${result.timedOut})`
+        )
+        continue
+      }
+      return result.stdout
     } catch (error) {
       if (signal?.aborted) {
         throw error
       }
-      lastError.push(error)
+      lastError ??= error
     }
   }
 
-  throw lastError[0] ?? new Error('PowerShell unavailable')
+  throw lastError ?? new Error('PowerShell unavailable')
 }
 
 export function parseWindowsPowerShellPortRows(json: string): DetectedPort[] {
@@ -98,26 +245,85 @@ export function parseWindowsPowerShellPortRows(json: string): DetectedPort[] {
   return rows.flatMap((row) => parseWindowsPortRow(row))
 }
 
+/**
+ * Listening rows, on a host in any UI language.
+ *
+ * `LISTENING` is not in `netstat.exe` — it lives in
+ * `System32\<locale>\netstat.exe.mui` beside `ESTABLISHED` and `Proto`, and MUI
+ * selection follows the UI language, so the pinned-locale env in
+ * relay-command-env.ts cannot reach it. A German host prints `ABHÖREN` and the
+ * word test finds nothing at all.
+ *
+ * The shape is language-independent: a listening socket has no peer, so its
+ * foreign address is `0.0.0.0:0` / `[::]:0`, and on every state Windows prints
+ * with a real peer that port is non-zero. Shape stays the fallback because the
+ * converse does not hold — `BOUND` and `CLOSED` print a zero peer too, and on a
+ * localized host their words are just as unreadable as the listening one.
+ */
 export function parseWindowsNetstatOutput(output: string): DetectedPort[] {
-  const rows: DetectedPort[] = []
+  const { rows, tcpRows } = scanWindowsNetstatTcpRows(output)
+  const byStateWord = rows.filter((row) => row.state === 'LISTENING')
+  if (byStateWord.length > 0 || tcpRows === 0) {
+    return byStateWord.map((row) => row.port)
+  }
+  return readDominantZeroPeerState(rows)
+}
+
+/**
+ * Of the zero-peer states, keep only the one that dominates.
+ *
+ * Shape alone would publish a phantom listener: one `BOUND` socket among real
+ * listeners looks identical to them once the state word is unreadable. But it
+ * cannot dominate — listeners outnumber those transients by roughly 50:1 on a
+ * real host (51 against 0 here), so the largest zero-peer group is the
+ * listening one. An exact tie keeps every tied group rather than guessing,
+ * which is no worse than reading shape alone.
+ *
+ * A majority rule inverts if the majority is wrong: enough transient zero-peer
+ * sockets and the phantoms win, publishing those and dropping the real
+ * listeners. The hatch is to return [] here and defer to the PowerShell reader,
+ * which reads the state word instead of inferring it.
+ */
+function readDominantZeroPeerState(rows: NetstatTcpRow[]): DetectedPort[] {
+  const countByState = new Map<string, number>()
+  for (const row of rows) {
+    if (row.zeroPeer) {
+      countByState.set(row.state, (countByState.get(row.state) ?? 0) + 1)
+    }
+  }
+  const largest = Math.max(0, ...countByState.values())
+  const dominant = new Set(
+    [...countByState].filter(([, count]) => count === largest).map(([state]) => state)
+  )
+  return rows.flatMap((row) => (row.zeroPeer && dominant.has(row.state) ? [row.port] : []))
+}
+
+type NetstatTcpRow = { state: string; zeroPeer: boolean; port: DetectedPort }
+
+/** `tcpRows` separates a localized host from one with genuinely no TCP output. */
+function scanWindowsNetstatTcpRows(output: string): { rows: NetstatTcpRow[]; tcpRows: number } {
+  const rows: NetstatTcpRow[] = []
+  let tcpRows = 0
 
   for (const line of output.split(/\r?\n/)) {
     const fields = getProcessOutputFields(line, 5)
     if (fields.length < 5 || fields[0].toUpperCase() !== 'TCP') {
       continue
     }
-    if (fields[3].toUpperCase() !== 'LISTENING') {
-      continue
-    }
+    tcpRows += 1
     const hostPort = parseWindowsNetstatAddress(fields[1])
     const pid = Number.parseInt(fields[4], 10)
     if (!hostPort || !Number.isSafeInteger(pid) || pid <= 0) {
       continue
     }
-    rows.push({ ...hostPort, pid })
+    rows.push({
+      state: fields[3].toUpperCase(),
+      zeroPeer: readWindowsNetstatPort(fields[2]) === 0,
+      port: { ...hostPort, pid }
+    })
   }
 
-  return rows
+  return { rows, tcpRows }
 }
 
 function parseWindowsPortRow(row: unknown): DetectedPort[] {
@@ -165,13 +371,20 @@ function readInteger(value: unknown): number | undefined {
   return Number.isSafeInteger(parsed) ? parsed : undefined
 }
 
-function parseWindowsNetstatAddress(value: string): { host: string; port: number } | null {
-  const ipv6Match = /^\[(.*)\]:(\d+)$/.exec(value)
-  const portText = ipv6Match?.[2] ?? value.slice(value.lastIndexOf(':') + 1)
+/** Port alone, keeping 0 — the foreign-address test above turns on that value. */
+function readWindowsNetstatPort(value: string): number | null {
+  const ipv6Match = /^\[.*\]:(\d+)$/.exec(value)
+  const portText = ipv6Match?.[1] ?? value.slice(value.lastIndexOf(':') + 1)
   const port = Number.parseInt(portText, 10)
-  if (!Number.isSafeInteger(port) || port <= 0) {
+  return Number.isSafeInteger(port) ? port : null
+}
+
+function parseWindowsNetstatAddress(value: string): { host: string; port: number } | null {
+  const port = readWindowsNetstatPort(value)
+  if (port == null || port <= 0) {
     return null
   }
+  const ipv6Match = /^\[(.*)\]:\d+$/.exec(value)
   if (ipv6Match) {
     return { host: ipv6Match[1], port }
   }
diff --git a/src/relay/windows-port-scan.win32.test.ts b/src/relay/windows-port-scan.win32.test.ts
new file mode 100644
index 00000000000..976f477cd9c
--- /dev/null
+++ b/src/relay/windows-port-scan.win32.test.ts
@@ -0,0 +1,52 @@
+import { describe, expect, it } from 'vitest'
+import { runProcess } from '../shared/child-process/run-process'
+import { windowsPowerShellPath } from '../shared/child-process/windows-system-binary'
+import {
+  WINDOWS_PORT_SCAN_SCRIPT,
+  parseWindowsPowerShellPortRows,
+  scanWindowsListeningPorts
+} from './windows-port-scan'
+
+/**
+ * The mocked suite pins the argv; this pins that the argv works.
+ *
+ * Both halves are things a mock cannot see: netstat's real column layout (a
+ * `-p tcp` here silently drops every `[::]` listener), and whether the joined
+ * one-line PowerShell script even parses — a missing `;` between statements is
+ * a ParserError, and the fallback would then be dead on the day it is needed.
+ *
+ * Runs only on win32; skipped elsewhere.
+ */
+const describeOnWindows = process.platform === 'win32' ? describe : describe.skip
+
+describeOnWindows('windows port scan against the real host', () => {
+  it('finds listeners over both address families through netstat', async () => {
+    const ports = await scanWindowsListeningPorts()
+
+    expect(ports.length).toBeGreaterThan(0)
+    for (const port of ports) {
+      expect(port.port).toBeGreaterThan(0)
+      expect(port.host.length).toBeGreaterThan(0)
+    }
+    // Windows binds RPC/SMB dual-stack, so both families must be represented.
+    expect(ports.some((port) => port.host.includes(':'))).toBe(true)
+    expect(ports.some((port) => !port.host.includes(':'))).toBe(true)
+    // Names come from the shared process table, never from a shell of our own.
+    expect(ports.some((port) => port.processName)).toBe(true)
+    // The table spells them `svchost.exe`; clients have always seen `svchost`.
+    expect(ports.every((port) => !port.processName?.endsWith('.exe'))).toBe(true)
+  }, 30_000)
+
+  it('runs the de-escalated PowerShell fallback command line', async () => {
+    const result = await runProcess({
+      program: windowsPowerShellPath(),
+      args: ['-NoProfile', '-NonInteractive', '-Command', WINDOWS_PORT_SCAN_SCRIPT],
+      timeoutMs: 20_000
+    })
+
+    // No stderr assertion: an autoload or first-run banner writes there without
+    // the scan having failed.
+    expect(result.code).toBe(0)
+    expect(parseWindowsPowerShellPortRows(result.stdout).length).toBeGreaterThan(0)
+  }, 30_000)
+})
diff --git a/src/renderer/src/assets/main.css b/src/renderer/src/assets/main.css
index 8187fe496c7..3527f11c44e 100644
--- a/src/renderer/src/assets/main.css
+++ b/src/renderer/src/assets/main.css
@@ -229,6 +229,10 @@
   --git-decoration-untracked: #007100;
   --git-decoration-copied: #007acc;
   --git-decoration-ignored: #8c8c8c;
+  --diff-added-ground: color-mix(in srgb, var(--git-decoration-added) 13%, transparent);
+  --diff-added-gutter: color-mix(in srgb, var(--git-decoration-added) 26%, transparent);
+  --diff-removed-ground: color-mix(in srgb, var(--git-decoration-deleted) 11%, transparent);
+  --diff-removed-gutter: color-mix(in srgb, var(--git-decoration-deleted) 22%, transparent);
   --git-graph-ref: #007acc;
   --git-graph-remote-ref: #b66dff;
   --git-graph-base-ref: #ea5c00;
@@ -341,6 +345,10 @@
   --git-decoration-untracked: #73c991;
   --git-decoration-copied: #73c991;
   --git-decoration-ignored: #6e6e6e;
+  --diff-added-ground: color-mix(in srgb, var(--git-decoration-added) 16%, transparent);
+  --diff-added-gutter: color-mix(in srgb, var(--git-decoration-added) 30%, transparent);
+  --diff-removed-ground: color-mix(in srgb, var(--git-decoration-deleted) 18%, transparent);
+  --diff-removed-gutter: color-mix(in srgb, var(--git-decoration-deleted) 32%, transparent);
   --git-graph-ref: #3794ff;
   --git-graph-remote-ref: #b66dff;
   --git-graph-base-ref: #ea5c00;
@@ -392,9 +400,9 @@
   z-index: 40 !important;
 }
 
-/* Keep interruption controls above unrelated updater/onboarding chrome. */
+/* Above the z-40 updater/onboarding chrome, below the floating workspace panel's z-45. */
 .native-chat-pane-shell:has([data-native-chat-working='true']) {
-  z-index: 50;
+  z-index: 44;
 }
 
 [data-sonner-toaster] [data-sonner-toast][data-styled='true'] {
diff --git a/src/renderer/src/components/TerminalWorkspaceDialogs.tsx b/src/renderer/src/components/TerminalWorkspaceDialogs.tsx
index 52ddbf1ba5d..bb3ffbfd621 100644
--- a/src/renderer/src/components/TerminalWorkspaceDialogs.tsx
+++ b/src/renderer/src/components/TerminalWorkspaceDialogs.tsx
@@ -24,6 +24,7 @@ export function TerminalWorkspaceDialogs({
     saveDialogFile,
     saveDialogFileId,
     setWindowCloseDialogOpen,
+    windowCloseDialogKind,
     windowCloseDialogOpen
   } = controller
   return (
@@ -82,10 +83,15 @@ export function TerminalWorkspaceDialogs({
               {translate('auto.components.Terminal.2fa9c69ff3', 'Close Window?')}
             </DialogTitle>
             <DialogDescription className="text-xs">
-              {translate(
-                'auto.components.Terminal.7958465754',
-                'There are local terminals with running processes. Close the window anyway?'
-              )}
+              {windowCloseDialogKind === 'unverifiable'
+                ? translate(
+                    'auto.components.Terminal.b7c1f0a934',
+                    'A remote host could not be reached, so Orca cannot tell whether work is still running there. Close the window anyway?'
+                  )
+                : translate(
+                    'auto.components.Terminal.7958465754',
+                    'There are terminals with running processes. Close the window anyway?'
+                  )}
             </DialogDescription>
           </DialogHeader>
           <DialogFooter className="gap-2">
diff --git a/src/renderer/src/components/activity/ActivityPrototypePage.tsx b/src/renderer/src/components/activity/ActivityPrototypePage.tsx
index 44c1f398122..32b0af8662c 100644
--- a/src/renderer/src/components/activity/ActivityPrototypePage.tsx
+++ b/src/renderer/src/components/activity/ActivityPrototypePage.tsx
@@ -1,7 +1,6 @@
 import React, { useCallback, useEffect, useLayoutEffect, useMemo, useRef, useState } from 'react'
 import { useAppStore } from '@/store'
 import { useSidebarResize } from '@/hooks/useSidebarResize'
-import { ActivityScopeFilterChips } from './activity-scope-filter-controls'
 import {
   setActivityTerminalPortals,
   type ActivityTerminalPortalTarget
@@ -341,7 +340,6 @@ export default function ActivityPrototypePage(): React.JSX.Element {
           canJumpToWorkspace={canJumpToWorkspace}
           isThreadListResizing={isThreadListResizing}
           onResizeStart={onResizeStart}
-          scopeFilterRow={<ActivityScopeFilterChips />}
         />
         <ActivityThreadDetailPane
           selectedThread={selectedThread}
diff --git a/src/renderer/src/components/activity/ActivityThreadOptionsMenu.test.tsx b/src/renderer/src/components/activity/ActivityThreadOptionsMenu.test.tsx
index 7d4eb5e87b9..7af7913398b 100644
--- a/src/renderer/src/components/activity/ActivityThreadOptionsMenu.test.tsx
+++ b/src/renderer/src/components/activity/ActivityThreadOptionsMenu.test.tsx
@@ -5,8 +5,10 @@ import { createRoot, type Root } from 'react-dom/client'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
 import { TooltipProvider } from '@/components/ui/tooltip'
+import { useAppStore } from '@/store'
 import { ActivityThreadOptionsMenu } from './ActivityPrototypePage'
 import type { ActivityGroupBy } from './activity-thread-types'
+import { makeRepo } from './ActivityPrototypePage-test-fixtures'
 
 globalThis.IS_REACT_ACT_ENVIRONMENT = true
 
@@ -46,6 +48,7 @@ describe('ActivityThreadOptionsMenu', () => {
   let root: Root
 
   beforeEach(() => {
+    useAppStore.setState({ agentsVisibleHostIds: null, agentsFilterRepoIds: [] })
     container = document.createElement('div')
     document.body.appendChild(container)
     root = createRoot(container)
@@ -57,6 +60,20 @@ describe('ActivityThreadOptionsMenu', () => {
     document.body.replaceChildren()
   })
 
+  it('exposes an active persisted scope visually and in the trigger label', async () => {
+    useAppStore.setState({ agentsVisibleHostIds: ['local'] })
+
+    await act(async () => {
+      root.render(<Harness />)
+    })
+
+    const trigger = container.querySelector<HTMLButtonElement>(
+      'button[aria-label="Thread list options, filters active"]'
+    )
+    expect(trigger).not.toBeNull()
+    expect(trigger?.querySelector('[data-scope-filter-dot]')).not.toBeNull()
+  })
+
   it('opens without recursively updating composed Radix trigger refs', async () => {
     await act(async () => {
       root.render(<Harness />)
@@ -76,6 +93,49 @@ describe('ActivityThreadOptionsMenu', () => {
     expect(document.body.textContent).toContain('Compact mode')
   })
 
+  it.each(['removed host', 'single project', 'stale project'] as const)(
+    'resets a %s scope even when its filter menu is hidden',
+    async (scenario) => {
+      const originalState = useAppStore.getState()
+      const persist = vi.fn().mockResolvedValue(undefined)
+      vi.stubGlobal('api', { ui: { set: persist } })
+      useAppStore.setState({
+        repos: scenario === 'single project' ? [makeRepo()] : [],
+        agentsVisibleHostIds: scenario === 'removed host' ? ['ssh:removed-host'] : null,
+        agentsFilterRepoIds: scenario === 'removed host' ? [] : ['repo-1'],
+        filterRepoIds: ['workspace-nav-filter']
+      })
+      try {
+        await act(async () => root.render(<Harness />))
+        const trigger = container.querySelector<HTMLButtonElement>(
+          'button[aria-label="Thread list options, filters active"]'
+        )
+        expect(trigger).not.toBeNull()
+        await act(async () => {
+          trigger?.dispatchEvent(new KeyboardEvent('keydown', { bubbles: true, key: 'Enter' }))
+        })
+        expect(document.querySelector('[data-slot="dropdown-menu-sub-trigger"]')).toBeNull()
+        const reset = Array.from(document.querySelectorAll<HTMLElement>('[role="menuitem"]')).find(
+          (item) => item.textContent === 'Show all hosts and projects'
+        )
+        expect(reset).toBeDefined()
+        await act(async () => {
+          reset?.focus()
+          reset?.dispatchEvent(new KeyboardEvent('keydown', { bubbles: true, key: 'Enter' }))
+        })
+        expect(useAppStore.getState().agentsVisibleHostIds).toBeNull()
+        expect(useAppStore.getState().agentsFilterRepoIds).toEqual([])
+        expect(useAppStore.getState().filterRepoIds).toEqual(['workspace-nav-filter'])
+        expect(persist).toHaveBeenCalledWith({ agentsVisibleHostIds: null })
+        expect(persist).toHaveBeenCalledWith({ agentsFilterRepoIds: [] })
+        expect(container.querySelector('[data-scope-filter-dot]')).toBeNull()
+      } finally {
+        act(() => useAppStore.setState(originalState))
+        vi.unstubAllGlobals()
+      }
+    }
+  )
+
   it('renders group by options when provided', async () => {
     const onGroupByChange = vi.fn()
     await act(async () => {
@@ -159,7 +219,7 @@ describe('ActivityThreadOptionsMenu', () => {
     expect(document.body.textContent).toContain('Show unread only')
   })
 
-  it('explains show unread threads only on hover and shows unread dot when hasUnreadThreads is true', async () => {
+  it('explains show unread threads only on hover without a second unread state marker', async () => {
     const onToggleUnread = vi.fn()
     await act(async () => {
       root.render(
@@ -191,7 +251,7 @@ describe('ActivityThreadOptionsMenu', () => {
     expect(document.body.textContent).toContain(
       'Filters the activity list to show only threads with unread updates.'
     )
-    expect(document.querySelector('[data-unread-dot]')).not.toBeNull()
+    expect(document.querySelector('[data-unread-dot]')).toBeNull()
   })
 
   it('renders show child agents checkbox when onShowChildAgentsChange is provided', async () => {
diff --git a/src/renderer/src/components/activity/activity-clear-completed.test.ts b/src/renderer/src/components/activity/activity-clear-completed.test.ts
index 3723563d143..65152720567 100644
--- a/src/renderer/src/components/activity/activity-clear-completed.test.ts
+++ b/src/renderer/src/components/activity/activity-clear-completed.test.ts
@@ -55,6 +55,7 @@ vi.mock('sonner', () => ({ toast: toastSpy }))
 
 import {
   CLEAR_COMPLETED_EVICTION_FALLBACK_MS,
+  clearActivityThread,
   clearCompletedActivity,
   flushPendingClearCompletedEvictions,
   isClearableActivityThread,
@@ -191,6 +192,28 @@ describe('clearCompletedActivity', () => {
     expect(drop).toHaveBeenCalledTimes(1)
   })
 
+  it('clears one thread immediately without bulk-clear feedback', () => {
+    expect(clearActivityThread(doneThread)).toBe(true)
+    expect(mockStore.activityClearedAtByPaneKey).toEqual({ 't-done:1': 5_000 })
+    expect(mockStore.dismissRetainedAgents).toHaveBeenCalledWith(['t-done:1'])
+    expect(
+      (
+        window as unknown as {
+          api: { agentStatus: { dropPersistedBatch: ReturnType<typeof vi.fn> } }
+        }
+      ).api.agentStatus.dropPersistedBatch
+    ).toHaveBeenCalledWith([
+      expect.objectContaining({ paneKey: 't-done:1', receivedAt: 5_000, stateStartedAt: 5_000 })
+    ])
+    expect(toastSpy).not.toHaveBeenCalled()
+  })
+
+  it('does not clear one active thread', () => {
+    expect(clearActivityThread(workingThread)).toBe(false)
+    expect(mockStore.applyActivityClearedAt).not.toHaveBeenCalled()
+    expect(mockStore.dismissRetainedAgents).not.toHaveBeenCalled()
+  })
+
   it('undo restores prior cutoffs and re-retains snapshots, and skips the disk drop', () => {
     mockStore.activityClearedAtByPaneKey = { 't-done:1': 1_111 }
     clearCompletedActivity([doneThread, interruptedThread])
diff --git a/src/renderer/src/components/activity/activity-clear-completed.ts b/src/renderer/src/components/activity/activity-clear-completed.ts
index 72eee3ea4af..79b69e96ea9 100644
--- a/src/renderer/src/components/activity/activity-clear-completed.ts
+++ b/src/renderer/src/components/activity/activity-clear-completed.ts
@@ -96,6 +96,19 @@ function evictPersistedStatuses(identities: readonly AgentStatusCacheIdentity[])
   }
 }
 
+/** Clear one completed thread immediately; bulk clearing owns the undo toast. */
+export function clearActivityThread(thread: AgentPaneThread): boolean {
+  const state = useAppStore.getState()
+  const plan = planClearCompletedActivity([thread], state)
+  if (plan.clearedThreadCount === 0) {
+    return false
+  }
+  state.applyActivityClearedAt(plan.cutoffPatch)
+  state.dismissRetainedAgents(plan.retainedSnapshots.map((retained) => retained.entry.paneKey))
+  evictPersistedStatuses(plan.cacheIdentities)
+  return true
+}
+
 /**
  * Clear completed/interrupted activity threads with an undo window.
  *
diff --git a/src/renderer/src/components/activity/activity-scope-filter-controls.tsx b/src/renderer/src/components/activity/activity-scope-filter-controls.tsx
index 7da07182062..a9e75e10483 100644
--- a/src/renderer/src/components/activity/activity-scope-filter-controls.tsx
+++ b/src/renderer/src/components/activity/activity-scope-filter-controls.tsx
@@ -1,7 +1,7 @@
-import React, { useMemo } from 'react'
-import { X } from 'lucide-react'
+import React from 'react'
 import { useAppStore } from '@/store'
-import { DropdownMenuSeparator } from '@/components/ui/dropdown-menu'
+import { DropdownMenuItem, DropdownMenuSeparator } from '@/components/ui/dropdown-menu'
+import { translate } from '@/i18n/i18n'
 import SidebarRepositoryFilterSection from '@/components/sidebar/SidebarRepositoryFilterSection'
 import { SidebarHostScopeMenuSection } from '@/components/sidebar/SidebarHostScopeMenuSection'
 import {
@@ -9,9 +9,6 @@ import {
   shouldShowHostScopeControls
 } from '@/components/sidebar/sidebar-host-options'
 import { useSidebarHostScopeOptions } from '@/components/sidebar/use-sidebar-host-scope-options'
-import type { SidebarHostOption } from '@/components/sidebar/sidebar-host-options'
-import { getExecutionHostLabel, type ExecutionHostId } from '../../../../shared/execution-host'
-import { translate } from '@/i18n/i18n'
 
 /**
  * Host/project scope controls for the Agents activity surfaces. State is the
@@ -26,12 +23,26 @@ export function ActivityScopeFilterMenuSections(): React.JSX.Element | null {
   const setAgentsFilterRepoIds = useAppStore((s) => s.setAgentsFilterRepoIds)
   const { hostOptions } = useSidebarHostScopeOptions()
   const showHostScopeControls = shouldShowHostScopeControls(hostOptions)
+  const hasScopeFilter = agentsVisibleHostIds !== null || agentsFilterRepoIds.length > 0
 
-  if (!showHostScopeControls && repos.length <= 1) {
+  if (!hasScopeFilter && !showHostScopeControls && repos.length <= 1) {
     return null
   }
   return (
     <>
+      {hasScopeFilter ? (
+        <DropdownMenuItem
+          onSelect={() => {
+            setAgentsVisibleHostIds(null)
+            setAgentsFilterRepoIds([])
+          }}
+        >
+          {translate(
+            'auto.components.activity.ActivityScopeFilterControls.resetScope',
+            'Show all hosts and projects'
+          )}
+        </DropdownMenuItem>
+      ) : null}
       {showHostScopeControls ? (
         <SidebarHostScopeMenuSection
           hostVisibilityLabel={getSidebarHostVisibilityLabel(agentsVisibleHostIds, hostOptions)}
@@ -52,116 +63,13 @@ export function ActivityScopeFilterMenuSections(): React.JSX.Element | null {
   )
 }
 
-// Why not getSidebarHostVisibilityLabel: it collapses a full selection to "All
-// hosts", but a chip only renders while a filter is set — name the selection,
-// falling back to the raw host label for hosts no longer in the options list.
-function getScopeHostChipLabel(
-  visibleHostIds: readonly ExecutionHostId[],
-  hostOptions: readonly SidebarHostOption[]
-): string {
-  if (visibleHostIds.length === 1) {
-    const id = visibleHostIds[0]
-    return hostOptions.find((host) => host.id === id)?.label ?? getExecutionHostLabel(id)
-  }
-  return translate(
-    'auto.components.sidebar.sidebarHostOptions.visibleHostsCount',
-    '{{value0}} hosts',
-    { value0: visibleHostIds.length }
-  )
-}
-
-function ScopeFilterChip({
-  label,
-  clearLabel,
-  onClear
-}: {
-  label: string
-  clearLabel: string
-  onClear: () => void
-}): React.JSX.Element {
-  return (
-    <span className="inline-flex min-w-0 items-center gap-1 rounded-full border border-border/80 bg-muted/80 py-0.5 pl-2 pr-1 text-[11px] font-medium leading-none text-foreground/80 shadow-xs">
-      <span className="min-w-0 truncate">{label}</span>
-      <button
-        type="button"
-        aria-label={clearLabel}
-        onClick={onClear}
-        className="rounded-full p-0.5 text-muted-foreground hover:bg-accent hover:text-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring"
-      >
-        <X className="size-2.5" />
-      </button>
-    </span>
-  )
-}
-
 /**
- * Dismissible chips naming the active persisted scope.
- * Why always shown while a scope is active: the filter survives restarts, so an
- * invisible one would silently hide running agents from a monitoring surface.
- *
- * Why the outer/inner split: this stays mounted on every activity surface, so
- * while no scope is set it must subscribe only to the two filter fields — the
- * host-registry derivation (settings, SSH/runtime status churn) lives in the
- * inner row and mounts only for an active filter.
+ * Whether the persisted agents-view scope narrows the list.
+ * Why exported: the options-menu trigger shows a dot for an active scope, so a
+ * filter that survives restarts can't silently hide running agents.
  */
-export function ActivityScopeFilterChips(): React.JSX.Element | null {
-  const agentsVisibleHostIds = useAppStore((s) => s.agentsVisibleHostIds)
-  const agentsFilterRepoIds = useAppStore((s) => s.agentsFilterRepoIds)
-  if (agentsVisibleHostIds === null && agentsFilterRepoIds.length === 0) {
-    return null
-  }
-  return <ActiveScopeFilterChipsRow />
-}
-
-function ActiveScopeFilterChipsRow(): React.JSX.Element | null {
-  const repos = useAppStore((s) => s.repos)
-  const agentsVisibleHostIds = useAppStore((s) => s.agentsVisibleHostIds)
-  const setAgentsVisibleHostIds = useAppStore((s) => s.setAgentsVisibleHostIds)
-  const agentsFilterRepoIds = useAppStore((s) => s.agentsFilterRepoIds)
-  const setAgentsFilterRepoIds = useAppStore((s) => s.setAgentsFilterRepoIds)
-  const { hostOptions } = useSidebarHostScopeOptions()
-
-  const selectedRepoNames = useMemo(
-    () =>
-      repos.filter((repo) => agentsFilterRepoIds.includes(repo.id)).map((repo) => repo.displayName),
-    [repos, agentsFilterRepoIds]
-  )
-  const hasHostFilter = agentsVisibleHostIds !== null
-  const hasRepoFilter = selectedRepoNames.length > 0
-  // Why: a repo filter of only-stale ids renders nothing; the outer gate is a fast path, not the authority.
-  if (!hasHostFilter && !hasRepoFilter) {
-    return null
-  }
-  const repoLabel =
-    selectedRepoNames.length === 1
-      ? selectedRepoNames[0]
-      : translate(
-          'auto.components.sidebar.SidebarRepositoryFilterSection.selectedProjectsCount',
-          '{{value0}} projects',
-          { value0: selectedRepoNames.length }
-        )
-  return (
-    <div className="flex shrink-0 flex-wrap items-center gap-1 border-b border-border px-2 py-1.5">
-      {agentsVisibleHostIds ? (
-        <ScopeFilterChip
-          label={getScopeHostChipLabel(agentsVisibleHostIds, hostOptions)}
-          clearLabel={translate(
-            'auto.components.activity.ActivityScopeFilterControls.clearHostFilter',
-            'Show all hosts'
-          )}
-          onClear={() => setAgentsVisibleHostIds(null)}
-        />
-      ) : null}
-      {hasRepoFilter ? (
-        <ScopeFilterChip
-          label={repoLabel}
-          clearLabel={translate(
-            'auto.components.activity.ActivityScopeFilterControls.clearProjectFilter',
-            'Show all projects'
-          )}
-          onClear={() => setAgentsFilterRepoIds([])}
-        />
-      ) : null}
-    </div>
+export function useActivityScopeFilterActive(): boolean {
+  return useAppStore(
+    (state) => state.agentsVisibleHostIds !== null || state.agentsFilterRepoIds.length > 0
   )
 }
diff --git a/src/renderer/src/components/activity/activity-thread-actions.test.ts b/src/renderer/src/components/activity/activity-thread-actions.test.ts
index 91375ec974b..07f50bce92d 100644
--- a/src/renderer/src/components/activity/activity-thread-actions.test.ts
+++ b/src/renderer/src/components/activity/activity-thread-actions.test.ts
@@ -98,7 +98,9 @@ describe('activity thread host routing', () => {
     // Bare setActiveWorktree skips setActiveView('terminal'), initial-terminal seeding and
     // sleeping-session resume — the workspace dispatcher is the only path that runs them.
     expect(mocks.activateAndRevealWorkspace).toHaveBeenCalledWith(thread.worktree.id, {
-      executionHostId: REMOTE_HOST
+      executionHostId: REMOTE_HOST,
+      revealInSidebar: false,
+      clearSidebarFilters: false
     })
     expect(setActiveWorktree).not.toHaveBeenCalled()
     expect(mocks.activateTabAndFocusPane).toHaveBeenCalledWith(
@@ -121,7 +123,9 @@ describe('activity thread host routing', () => {
 
     expect(setSelectedPaneKey).toHaveBeenCalledWith(thread.paneKey)
     expect(mocks.activateAndRevealWorkspace).toHaveBeenCalledWith(thread.worktree.id, {
-      executionHostId: REMOTE_HOST
+      executionHostId: REMOTE_HOST,
+      revealInSidebar: false,
+      clearSidebarFilters: false
     })
     expect(mocks.activateTabAndFocusPane).toHaveBeenCalledWith(
       thread.tab.id,
@@ -136,7 +140,9 @@ describe('activity thread host routing', () => {
     makeActions().selectThread(thread)
 
     expect(mocks.activateAndRevealWorkspace).toHaveBeenCalledWith(thread.worktree.id, {
-      executionHostId: REMOTE_HOST
+      executionHostId: REMOTE_HOST,
+      revealInSidebar: false,
+      clearSidebarFilters: false
     })
     expect(mocks.activateTabAndFocusPane).not.toHaveBeenCalled()
   })
diff --git a/src/renderer/src/components/activity/activity-thread-actions.ts b/src/renderer/src/components/activity/activity-thread-actions.ts
index f9f77587a1e..a940129f19c 100644
--- a/src/renderer/src/components/activity/activity-thread-actions.ts
+++ b/src/renderer/src/components/activity/activity-thread-actions.ts
@@ -83,7 +83,13 @@ export function createActivityThreadActions({
     // state of an SSH session that was never revived — has no resident tab until
     // resumeSleepingAgentSessionsForWorktree/ensureWorktreeHasInitialTerminal run inside here.
     // Probing tab residency first is what made a remote row click a silent no-op (#16731).
-    if (activateAndRevealWorkspace(thread.worktree.id, { executionHostId }) === false) {
+    if (
+      activateAndRevealWorkspace(thread.worktree.id, {
+        executionHostId,
+        revealInSidebar: false,
+        clearSidebarFilters: false
+      }) === false
+    ) {
       return
     }
     if (
diff --git a/src/renderer/src/components/activity/activity-thread-hover-card.test.tsx b/src/renderer/src/components/activity/activity-thread-hover-card.test.tsx
index 0e604a16098..ef1f109d50a 100644
--- a/src/renderer/src/components/activity/activity-thread-hover-card.test.tsx
+++ b/src/renderer/src/components/activity/activity-thread-hover-card.test.tsx
@@ -68,7 +68,8 @@ function Harness({
   onSelect = vi.fn(),
   onJump = vi.fn(),
   onMarkRead = vi.fn(),
-  onMarkUnread = vi.fn()
+  onMarkUnread = vi.fn(),
+  onClear
 }: {
   thread: AgentPaneThread
   selected?: boolean
@@ -76,6 +77,7 @@ function Harness({
   onJump?: () => void
   onMarkRead?: () => void
   onMarkUnread?: () => void
+  onClear?: (thread: AgentPaneThread) => void
 }): ReactElement {
   return (
     <TooltipProvider>
@@ -86,6 +88,7 @@ function Harness({
         onJump={onJump}
         onMarkRead={onMarkRead}
         onMarkUnread={onMarkUnread}
+        onClear={onClear}
         canJump={true}
         compactMode={false}
       />
@@ -148,6 +151,30 @@ describe('ActivityThreadHoverCard and ActivityThreadRow', () => {
     expect(onSelect).not.toHaveBeenCalled()
   })
 
+  it('clears from a keyboard-reachable row action without selecting the row', async () => {
+    const thread = createTestThread()
+    const onClear = vi.fn()
+    const onSelect = vi.fn()
+
+    await act(async () => {
+      root.render(<Harness thread={thread} onClear={onClear} onSelect={onSelect} />)
+    })
+
+    const clearButton = container.querySelector<HTMLButtonElement>(
+      'button[aria-label="Clear notification"]'
+    )
+    expect(clearButton).not.toBeNull()
+    expect(clearButton?.className).toContain('focus-visible:opacity-100')
+    expect(clearButton?.className).toContain('can-hover:pointer-events-none')
+    expect(clearButton?.className).toContain('can-hover:group-hover:pointer-events-auto')
+    expect(clearButton?.className).not.toContain('invisible')
+
+    act(() => clearButton?.click())
+
+    expect(onClear).toHaveBeenCalledWith(thread)
+    expect(onSelect).not.toHaveBeenCalled()
+  })
+
   it('renders hover card content with workspace info, host, task details, and notes', async () => {
     const thread = createTestThread({
       worktree: {
diff --git a/src/renderer/src/components/activity/activity-thread-list-pane.tsx b/src/renderer/src/components/activity/activity-thread-list-pane.tsx
index 7879b486633..a5503e58562 100644
--- a/src/renderer/src/components/activity/activity-thread-list-pane.tsx
+++ b/src/renderer/src/components/activity/activity-thread-list-pane.tsx
@@ -74,7 +74,6 @@ export function ActivityThreadListPane({
   showFilterControls = true,
   showOptionsMenu = true,
   showInlineActions = true,
-  scopeFilterRow,
   collapsedGroupKeys,
   onToggleGroupCollapse,
   scrollTopRef
@@ -111,8 +110,6 @@ export function ActivityThreadListPane({
   showFilterControls?: boolean
   showOptionsMenu?: boolean
   showInlineActions?: boolean
-  /** Rendered between the toolbar and the list; carries the active-scope chips row. */
-  scopeFilterRow?: React.ReactNode
   collapsedGroupKeys?: ReadonlySet<string>
   onToggleGroupCollapse?: (groupKey: string) => void
   /** Optional view-local scroll memory; updated without triggering React renders. */
@@ -318,7 +315,6 @@ export function ActivityThreadListPane({
         showOptionsMenu={showOptionsMenu}
         showInlineActions={showInlineActions}
       />
-      {scopeFilterRow}
       <div className="relative min-h-0 flex-1">
         <div
           ref={scrollContainerRef}
diff --git a/src/renderer/src/components/activity/activity-thread-options-menu.tsx b/src/renderer/src/components/activity/activity-thread-options-menu.tsx
index 46638319f2a..f9273d15678 100644
--- a/src/renderer/src/components/activity/activity-thread-options-menu.tsx
+++ b/src/renderer/src/components/activity/activity-thread-options-menu.tsx
@@ -26,7 +26,10 @@ import {
 } from '@/components/ui/dropdown-menu'
 import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip'
 import { translate } from '@/i18n/i18n'
-import { ActivityScopeFilterMenuSections } from './activity-scope-filter-controls'
+import {
+  ActivityScopeFilterMenuSections,
+  useActivityScopeFilterActive
+} from './activity-scope-filter-controls'
 import type { ActivityGroupBy } from './activity-thread-types'
 
 const ALIGNED_CHECKBOX_ITEM_CLASS = 'pl-2 [&>span.absolute]:hidden'
@@ -76,6 +79,13 @@ export function ActivityThreadOptionsMenu({
   onToggleUnread?: () => void
 }): React.JSX.Element {
   const skipCloseAutoFocusRef = React.useRef(false)
+  const scopeFilterActive = useActivityScopeFilterActive()
+  const optionsLabel = scopeFilterActive
+    ? translate(
+        'auto.components.activity.ActivityPrototypePage.threadListOptionsFiltered',
+        'Thread list options, filters active'
+      )
+    : translate('auto.components.activity.ActivityPrototypePage.db8a1878b5', 'Thread list options')
 
   return (
     <DropdownMenu>
@@ -88,13 +98,17 @@ export function ActivityThreadOptionsMenu({
                 type="button"
                 variant="ghost"
                 size="icon-xs"
-                className="text-muted-foreground"
-                aria-label={translate(
-                  'auto.components.activity.ActivityPrototypePage.db8a1878b5',
-                  'Thread list options'
-                )}
+                className="relative text-muted-foreground"
+                aria-label={optionsLabel}
               >
                 <ListFilter className="size-3.5" strokeWidth={2.25} />
+                {scopeFilterActive ? (
+                  <span
+                    className="absolute right-0.5 top-0.5 size-1.5 rounded-full bg-foreground"
+                    aria-hidden="true"
+                    data-scope-filter-dot=""
+                  />
+                ) : null}
               </Button>
             </DropdownMenuTrigger>
           </span>
@@ -149,13 +163,6 @@ export function ActivityThreadOptionsMenu({
                         'Show unread only'
                       )}
                     </span>
-                    {hasUnreadThreads ? (
-                      <span
-                        className="size-1.5 shrink-0 rounded-full bg-primary"
-                        aria-hidden="true"
-                        data-unread-dot=""
-                      />
-                    ) : null}
                     {unreadOnly ? <Check className="size-3.5" /> : null}
                   </DropdownMenuCheckboxItem>
                 </TooltipTrigger>
diff --git a/src/renderer/src/components/activity/activity-thread-row.tsx b/src/renderer/src/components/activity/activity-thread-row.tsx
index 93d4d5ec18f..fef63bda46e 100644
--- a/src/renderer/src/components/activity/activity-thread-row.tsx
+++ b/src/renderer/src/components/activity/activity-thread-row.tsx
@@ -1,5 +1,5 @@
 import React from 'react'
-import { Bell, ExternalLink } from 'lucide-react'
+import { Bell, ExternalLink, X } from 'lucide-react'
 import { AgentIcon } from '@/lib/agent-catalog'
 import { agentTypeToIconAgent, formatAgentTypeLabel } from '@/lib/agent-status'
 import { Button } from '@/components/ui/button'
@@ -13,6 +13,44 @@ import { ActivityThreadHoverCard } from './activity-thread-hover-card'
 import { activityThreadRowCopy } from './activity-thread-presentation'
 import type { AgentPaneThread } from './activity-thread-types'
 
+function ActivityThreadRowAction({
+  label,
+  onClick,
+  keyboardReachable = false,
+  children
+}: {
+  label: string
+  onClick: () => void
+  // Hover-only actions stay `invisible` so long lists don't gain a tab stop per row.
+  keyboardReachable?: boolean
+  children: React.ReactNode
+}): React.JSX.Element {
+  return (
+    <Tooltip>
+      <TooltipTrigger asChild>
+        <Button
+          type="button"
+          variant="ghost"
+          size="icon-xs"
+          className={cn(
+            'size-4 p-0 text-muted-foreground transition-opacity hover:text-foreground can-hover:pointer-events-none can-hover:opacity-0 can-hover:group-hover:pointer-events-auto can-hover:group-hover:opacity-100 focus-visible:opacity-100',
+            !keyboardReachable && 'can-hover:invisible can-hover:group-hover:visible'
+          )}
+          aria-label={label}
+          onClick={(event) => {
+            event.stopPropagation()
+            onClick()
+          }}
+          onMouseDown={(event) => event.stopPropagation()}
+        >
+          {children}
+        </Button>
+      </TooltipTrigger>
+      <TooltipContent side="left">{label}</TooltipContent>
+    </Tooltip>
+  )
+}
+
 // Why React.memo: rows are pure functions of these props; thread identity is stable across
 // query/selection/group re-renders, so memo keeps a keystroke or selection change from
 // re-rendering every mounted row. Callbacks take the thread so parents can pass stable handlers.
@@ -23,6 +61,7 @@ export const ActivityThreadRow = React.memo(function ActivityThreadRow({
   onJump,
   onMarkRead,
   onMarkUnread,
+  onClear,
   canJump,
   compactMode,
   disableMarkUnread = false,
@@ -34,6 +73,7 @@ export const ActivityThreadRow = React.memo(function ActivityThreadRow({
   onJump: (thread: AgentPaneThread) => void
   onMarkRead: (thread: AgentPaneThread) => void
   onMarkUnread: (thread: AgentPaneThread) => void
+  onClear?: (thread: AgentPaneThread) => void
   canJump: boolean
   compactMode: boolean
   disableMarkUnread?: boolean
@@ -59,7 +99,7 @@ export const ActivityThreadRow = React.memo(function ActivityThreadRow({
         aria-label={taskTitle}
         aria-current={selected ? 'true' : undefined}
         className={cn(
-          'group relative flex w-full cursor-pointer flex-col gap-1.5 rounded-lg border border-transparent px-1.5 py-2.5 text-left transition-[background-color,border-color,opacity,box-shadow] duration-200 outline-none select-none worktree-sidebar-card-hover focus-visible:ring-1 focus-visible:ring-ring',
+          'group relative flex w-full cursor-pointer flex-col gap-1 rounded-lg border border-transparent px-1.5 py-1.5 text-left transition-[background-color,border-color,opacity,box-shadow] duration-200 outline-none select-none worktree-sidebar-card-hover focus-visible:ring-1 focus-visible:ring-ring',
           selected && 'border-transparent'
         )}
       >
@@ -67,7 +107,7 @@ export const ActivityThreadRow = React.memo(function ActivityThreadRow({
           <span className="mt-0.5 inline-flex shrink-0">
             <ThreadAgentStateIndicator thread={thread} />
           </span>
-          <div className="flex min-w-0 flex-1 flex-col gap-1">
+          <div className="flex min-w-0 flex-1 flex-col gap-0.5">
             {/* Keep the activation target separate from markdown links and row actions. */}
             <button
               type="button"
@@ -82,7 +122,6 @@ export const ActivityThreadRow = React.memo(function ActivityThreadRow({
                 compactMode ? 'truncate' : 'line-clamp-2 break-words',
                 thread.unread ? 'font-semibold text-foreground' : 'font-medium text-foreground'
               )}
-              title={taskTitle}
             >
               {taskTitle}
             </button>
@@ -96,7 +135,6 @@ export const ActivityThreadRow = React.memo(function ActivityThreadRow({
                     compactMode ? 'line-clamp-2' : 'line-clamp-3',
                     '[&_*]:!m-0 [&_*]:!p-0 [&_br]:hidden [&_ol]:list-none [&_ul]:list-none'
                   )}
-                  title={thread.responsePreview}
                 />
               ) : (
                 <div
@@ -105,7 +143,6 @@ export const ActivityThreadRow = React.memo(function ActivityThreadRow({
                     compactMode ? 'line-clamp-2' : 'line-clamp-3',
                     needsAttention ? 'text-agent-question-text' : 'text-foreground/80'
                   )}
-                  title={statusLine}
                 >
                   {statusLine}
                 </div>
@@ -120,41 +157,27 @@ export const ActivityThreadRow = React.memo(function ActivityThreadRow({
                 {workspaceLabel}
               </span>
               {canJump && showJumpAction ? (
-                <span
-                  className={cn(
-                    'inline-flex shrink-0 items-center transition-opacity',
-                    'can-hover:pointer-events-none can-hover:invisible can-hover:opacity-0',
-                    'group-hover:pointer-events-auto group-hover:visible group-hover:opacity-100'
+                <ActivityThreadRowAction
+                  label={translate(
+                    'auto.components.activity.ActivityPrototypePage.4616ea39fd',
+                    'Jump to workspace'
                   )}
+                  onClick={() => onJump(thread)}
                 >
-                  <Tooltip>
-                    <TooltipTrigger asChild>
-                      <Button
-                        type="button"
-                        variant="ghost"
-                        size="icon-xs"
-                        className="size-4 p-0 text-muted-foreground hover:text-foreground"
-                        aria-label={translate(
-                          'auto.components.activity.ActivityPrototypePage.4616ea39fd',
-                          'Jump to workspace'
-                        )}
-                        onClick={(event) => {
-                          event.stopPropagation()
-                          onJump(thread)
-                        }}
-                        onMouseDown={(event) => event.stopPropagation()}
-                      >
-                        <ExternalLink className="size-2.5" />
-                      </Button>
-                    </TooltipTrigger>
-                    <TooltipContent side="left">
-                      {translate(
-                        'auto.components.activity.ActivityPrototypePage.4616ea39fd',
-                        'Jump to workspace'
-                      )}
-                    </TooltipContent>
-                  </Tooltip>
-                </span>
+                  <ExternalLink className="size-2.5" />
+                </ActivityThreadRowAction>
+              ) : null}
+              {onClear ? (
+                <ActivityThreadRowAction
+                  label={translate(
+                    'auto.components.activity.ActivityThreadRow.clearNotification',
+                    'Clear notification'
+                  )}
+                  keyboardReachable
+                  onClick={() => onClear(thread)}
+                >
+                  <X className="size-2.5" />
+                </ActivityThreadRowAction>
               ) : null}
               <span className="inline-flex size-3.5 shrink-0 items-center justify-center">
                 {thread.unread ? (
diff --git a/src/renderer/src/components/activity/activity-thread-virtual-row.tsx b/src/renderer/src/components/activity/activity-thread-virtual-row.tsx
index 4b6d7ac7d48..c8dab2e0fd2 100644
--- a/src/renderer/src/components/activity/activity-thread-virtual-row.tsx
+++ b/src/renderer/src/components/activity/activity-thread-virtual-row.tsx
@@ -1,5 +1,6 @@
 import type React from 'react'
 import { translate } from '@/i18n/i18n'
+import { clearActivityThread, isClearableActivityThread } from './activity-clear-completed'
 import { ActivityStatusGroupHeader } from './activity-thread-controls'
 import { ActivityThreadRow } from './activity-thread-row'
 import type { ActivityVirtualItemDescriptor } from './activity-thread-virtual-items'
@@ -53,7 +54,7 @@ export function ActivityThreadVirtualRow({
     )
   }
   return (
-    <div className="pb-1">
+    <div className="pb-0.5">
       <ActivityThreadRow
         thread={item.thread}
         selected={item.thread.paneKey === selectedPaneKey}
@@ -61,6 +62,7 @@ export function ActivityThreadVirtualRow({
         onJump={onJumpToWorkspace}
         onMarkRead={onMarkThreadRead}
         onMarkUnread={onMarkThreadUnread}
+        onClear={isClearableActivityThread(item.thread) ? clearActivityThread : undefined}
         canJump={canJumpToWorkspace(item.thread)}
         compactMode={compactMode}
         disableMarkUnread={item.thread.paneKey === selectedPaneKey && !allowMarkUnreadWhenSelected}
diff --git a/src/renderer/src/components/automations/AutomationListExternalRow.tsx b/src/renderer/src/components/automations/AutomationListExternalRow.tsx
new file mode 100644
index 00000000000..b26173467ab
--- /dev/null
+++ b/src/renderer/src/components/automations/AutomationListExternalRow.tsx
@@ -0,0 +1,260 @@
+import React from 'react'
+import { MoreHorizontal, Pause, Pencil, Play, Trash2 } from 'lucide-react'
+import {
+  ContextMenu,
+  ContextMenuContent,
+  ContextMenuItem,
+  ContextMenuSeparator,
+  ContextMenuTrigger
+} from '@/components/ui/context-menu'
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuSeparator,
+  DropdownMenuTrigger
+} from '@/components/ui/dropdown-menu'
+import { Button } from '@/components/ui/button'
+import { cn } from '@/lib/utils'
+import type {
+  ExternalAutomationAction,
+  ExternalAutomationJob,
+  ExternalAutomationManager
+} from '../../../../shared/automations-types'
+import type { SshConnectionState } from '../../../../shared/ssh-types'
+import type { ExternalAutomationListEntry } from './external-automation-list-entries'
+import type { ExternalAutomationScope } from './external-automation-scope-client'
+import {
+  formatExternalDate,
+  getExternalProviderLabel,
+  getExternalTargetKindLabel
+} from './external-automation-display'
+import { getExternalAutomationScheduleDisplay } from './external-automation-schedule-display'
+import { getExternalAutomationActionDisabledMessage } from './external-automation-source-availability'
+import { AUTOMATIONS_TABLE_GRID_CLASS } from './automations-table-layout'
+import {
+  LIST_TABLE_ROW_CLASS,
+  LIST_TABLE_ROW_SELECTED_CLASS,
+  LIST_TABLE_STICKY_ROW_CELL_CLASS
+} from '@/lib/list-table-layout'
+import { isPortaledRowMenuClick, isRowActivationKey } from '@/lib/list-row-interaction'
+import { getExternalAutomationLastRunSnapshot } from './automation-list-last-run'
+import { AutomationListLastRunCell } from './AutomationListLastRunCell'
+import { AutomationListStatusCell } from './AutomationListStatusCell'
+import { translate } from '@/i18n/i18n'
+
+export type AutomationListExternalRowProps = {
+  entry: ExternalAutomationListEntry
+  selectedExternalKey: string | null | undefined
+  relativeNow: number
+  sshConnectionStates: ReadonlyMap<string, Pick<SshConnectionState, 'status'>>
+  externalActionKey: string | null
+  onSelect: (entryKey: string) => void
+  onRequestAction: (
+    manager: ExternalAutomationManager,
+    job: ExternalAutomationJob,
+    action: ExternalAutomationAction,
+    scope: ExternalAutomationScope
+  ) => void
+  onEdit: (
+    manager: ExternalAutomationManager,
+    job: ExternalAutomationJob,
+    scope: ExternalAutomationScope
+  ) => void
+}
+
+export function AutomationListExternalRow({
+  entry,
+  selectedExternalKey,
+  relativeNow,
+  sshConnectionStates,
+  externalActionKey,
+  onSelect,
+  onRequestAction,
+  onEdit
+}: AutomationListExternalRowProps): React.JSX.Element {
+  const providerLabel = getExternalProviderLabel(entry.manager)
+  const targetKindLabel = getExternalTargetKindLabel(entry.manager)
+  const isSelected = selectedExternalKey === entry.key
+  const sshStatus =
+    entry.manager.target.type === 'ssh'
+      ? sshConnectionStates.get(entry.manager.target.connectionId)?.status
+      : undefined
+  const disabledMessage = getExternalAutomationActionDisabledMessage({
+    manager: entry.manager,
+    providerLabel,
+    targetKindLabel,
+    sshStatus,
+    actionInProgress: externalActionKey !== null
+  })
+  const actionDisabled = disabledMessage !== null
+  const scheduleLabel = getExternalAutomationScheduleDisplay(entry.manager, entry.job).label
+  const hostLabel = entry.manager.targetLabel || entry.manager.label || 'Local'
+  const projectLabel = entry.job.workdir ?? providerLabel
+  const nextRunLabel = entry.job.enabled
+    ? formatExternalDate(entry.job.nextRunAt, relativeNow)
+    : translate('auto.components.automations.AutomationsPage.paused', 'Paused')
+  const lastRunSnapshot = getExternalAutomationLastRunSnapshot(entry.job)
+
+  return (
+    <ContextMenu>
+      <ContextMenuTrigger asChild>
+        <div
+          role="button"
+          tabIndex={0}
+          data-current={isSelected ? 'true' : undefined}
+          onClick={(event) => {
+            // Why: Radix portals menus out of the row DOM, but React still
+            // bubbles those clicks here — ignore so menu actions don't open detail.
+            if (isPortaledRowMenuClick(event)) {
+              return
+            }
+            onSelect(entry.key)
+          }}
+          onKeyDown={(event) => {
+            if (!isRowActivationKey(event)) {
+              return
+            }
+            event.preventDefault()
+            onSelect(entry.key)
+          }}
+          className={cn(
+            AUTOMATIONS_TABLE_GRID_CLASS,
+            LIST_TABLE_ROW_CLASS,
+            isSelected && LIST_TABLE_ROW_SELECTED_CLASS
+          )}
+        >
+          <span className={LIST_TABLE_STICKY_ROW_CELL_CLASS}>
+            <span className="min-w-0 truncate font-medium">{entry.job.name}</span>
+          </span>
+          <span className="min-w-0 truncate text-muted-foreground" title={scheduleLabel}>
+            {scheduleLabel}
+          </span>
+          <span className="min-w-0 truncate text-muted-foreground" title={projectLabel}>
+            {projectLabel}
+          </span>
+          <span className="min-w-0 truncate text-muted-foreground" title={hostLabel}>
+            {hostLabel}
+          </span>
+          <span className="min-w-0 truncate text-muted-foreground" title={nextRunLabel}>
+            {nextRunLabel}
+          </span>
+          <AutomationListLastRunCell snapshot={lastRunSnapshot} now={relativeNow} />
+          <AutomationListStatusCell enabled={entry.job.enabled} />
+          <span className="truncate text-center text-xs text-muted-foreground">
+            {providerLabel}
+          </span>
+          <DropdownMenu>
+            <DropdownMenuTrigger asChild>
+              <Button
+                type="button"
+                variant="ghost"
+                size="icon-xs"
+                className="size-7 text-muted-foreground"
+                aria-label={translate(
+                  'auto.components.automations.AutomationsPage.rowActions',
+                  'Automation actions'
+                )}
+                onClick={(event) => event.stopPropagation()}
+              >
+                <MoreHorizontal className="size-4" />
+              </Button>
+            </DropdownMenuTrigger>
+            <DropdownMenuContent align="end" className="w-48">
+              <DropdownMenuItem
+                disabled={actionDisabled}
+                onSelect={() => onRequestAction(entry.manager, entry.job, 'run', entry.scope)}
+              >
+                <Play className="size-3.5" />
+                <span className="min-w-0 truncate">
+                  {disabledMessage ??
+                    translate('auto.components.automations.AutomationsPage.2faecab10b', 'Run Now')}
+                </span>
+              </DropdownMenuItem>
+              {entry.manager.provider === 'hermes' ? (
+                <DropdownMenuItem
+                  disabled={!entry.manager.canManage || externalActionKey !== null}
+                  onSelect={() => onEdit(entry.manager, entry.job, entry.scope)}
+                >
+                  <Pencil className="size-3.5" />
+                  {translate('auto.components.automations.AutomationsPage.f4612e3f78', 'Edit')}
+                </DropdownMenuItem>
+              ) : null}
+              <DropdownMenuItem
+                disabled={actionDisabled}
+                onSelect={() =>
+                  onRequestAction(
+                    entry.manager,
+                    entry.job,
+                    entry.job.enabled ? 'pause' : 'resume',
+                    entry.scope
+                  )
+                }
+              >
+                {entry.job.enabled ? <Pause className="size-3.5" /> : <Play className="size-3.5" />}
+                {entry.job.enabled
+                  ? translate('auto.components.automations.AutomationsPage.b457436d6a', 'Pause')
+                  : translate('auto.components.automations.AutomationsPage.376631ef2b', 'Resume')}
+              </DropdownMenuItem>
+              <DropdownMenuSeparator />
+              <DropdownMenuItem
+                variant="destructive"
+                disabled={actionDisabled}
+                onSelect={() => onRequestAction(entry.manager, entry.job, 'delete', entry.scope)}
+              >
+                <Trash2 className="size-3.5" />
+                {translate('auto.components.automations.AutomationsPage.15e0bfb13b', 'Delete')}
+              </DropdownMenuItem>
+            </DropdownMenuContent>
+          </DropdownMenu>
+        </div>
+      </ContextMenuTrigger>
+      <ContextMenuContent className="w-48">
+        <ContextMenuItem
+          disabled={actionDisabled}
+          onSelect={() => onRequestAction(entry.manager, entry.job, 'run', entry.scope)}
+        >
+          <Play className="size-3.5" />
+          <span className="min-w-0 truncate">
+            {disabledMessage ??
+              translate('auto.components.automations.AutomationsPage.2faecab10b', 'Run Now')}
+          </span>
+        </ContextMenuItem>
+        {entry.manager.provider === 'hermes' ? (
+          <ContextMenuItem
+            disabled={!entry.manager.canManage || externalActionKey !== null}
+            onSelect={() => onEdit(entry.manager, entry.job, entry.scope)}
+          >
+            <Pencil className="size-3.5" />
+            {translate('auto.components.automations.AutomationsPage.f4612e3f78', 'Edit')}
+          </ContextMenuItem>
+        ) : null}
+        <ContextMenuItem
+          disabled={actionDisabled}
+          onSelect={() =>
+            onRequestAction(
+              entry.manager,
+              entry.job,
+              entry.job.enabled ? 'pause' : 'resume',
+              entry.scope
+            )
+          }
+        >
+          {entry.job.enabled ? <Pause className="size-3.5" /> : <Play className="size-3.5" />}
+          {entry.job.enabled
+            ? translate('auto.components.automations.AutomationsPage.b457436d6a', 'Pause')
+            : translate('auto.components.automations.AutomationsPage.376631ef2b', 'Resume')}
+        </ContextMenuItem>
+        <ContextMenuSeparator />
+        <ContextMenuItem
+          variant="destructive"
+          disabled={actionDisabled}
+          onSelect={() => onRequestAction(entry.manager, entry.job, 'delete', entry.scope)}
+        >
+          <Trash2 className="size-3.5" />
+          {translate('auto.components.automations.AutomationsPage.15e0bfb13b', 'Delete')}
+        </ContextMenuItem>
+      </ContextMenuContent>
+    </ContextMenu>
+  )
+}
diff --git a/src/renderer/src/components/automations/AutomationListExternalRows.tsx b/src/renderer/src/components/automations/AutomationListExternalRows.tsx
index 976a93b2433..3ed78fc2a69 100644
--- a/src/renderer/src/components/automations/AutomationListExternalRows.tsx
+++ b/src/renderer/src/components/automations/AutomationListExternalRows.tsx
@@ -1,285 +1,23 @@
 import React from 'react'
-import { MoreHorizontal, Pause, Pencil, Play, Trash2 } from 'lucide-react'
-import {
-  ContextMenu,
-  ContextMenuContent,
-  ContextMenuItem,
-  ContextMenuSeparator,
-  ContextMenuTrigger
-} from '@/components/ui/context-menu'
-import {
-  DropdownMenu,
-  DropdownMenuContent,
-  DropdownMenuItem,
-  DropdownMenuSeparator,
-  DropdownMenuTrigger
-} from '@/components/ui/dropdown-menu'
-import { Button } from '@/components/ui/button'
-import { cn } from '@/lib/utils'
-import type {
-  ExternalAutomationAction,
-  ExternalAutomationJob,
-  ExternalAutomationManager
-} from '../../../../shared/automations-types'
-import type { SshConnectionState } from '../../../../shared/ssh-types'
 import type { ExternalAutomationListEntry } from './external-automation-list-entries'
-import type { ExternalAutomationScope } from './external-automation-scope-client'
 import {
-  formatExternalDate,
-  getExternalProviderLabel,
-  getExternalTargetKindLabel
-} from './external-automation-display'
-import { getExternalAutomationScheduleDisplay } from './external-automation-schedule-display'
-import { getExternalAutomationActionDisabledMessage } from './external-automation-source-availability'
-import { AUTOMATIONS_TABLE_GRID_CLASS } from './automations-table-layout'
-import {
-  LIST_TABLE_ROW_CLASS,
-  LIST_TABLE_ROW_SELECTED_CLASS,
-  LIST_TABLE_STICKY_ROW_CELL_CLASS
-} from '@/lib/list-table-layout'
-import { isPortaledRowMenuClick, isRowActivationKey } from '@/lib/list-row-interaction'
-import { getExternalAutomationLastRunSnapshot } from './automation-list-last-run'
-import { AutomationListLastRunCell } from './AutomationListLastRunCell'
-import { AutomationListStatusCell } from './AutomationListStatusCell'
-import { translate } from '@/i18n/i18n'
+  AutomationListExternalRow,
+  type AutomationListExternalRowProps
+} from './AutomationListExternalRow'
+
+export type AutomationListExternalRowsProps = Omit<AutomationListExternalRowProps, 'entry'> & {
+  entries: readonly ExternalAutomationListEntry[]
+}
 
 export function AutomationListExternalRows({
   entries,
-  selectedExternalKey,
-  relativeNow,
-  sshConnectionStates,
-  externalActionKey,
-  onSelect,
-  onRequestAction,
-  onEdit
-}: {
-  entries: readonly ExternalAutomationListEntry[]
-  selectedExternalKey: string | null | undefined
-  relativeNow: number
-  sshConnectionStates: ReadonlyMap<string, Pick<SshConnectionState, 'status'>>
-  externalActionKey: string | null
-  onSelect: (entryKey: string) => void
-  onRequestAction: (
-    manager: ExternalAutomationManager,
-    job: ExternalAutomationJob,
-    action: ExternalAutomationAction,
-    scope: ExternalAutomationScope
-  ) => void
-  onEdit: (
-    manager: ExternalAutomationManager,
-    job: ExternalAutomationJob,
-    scope: ExternalAutomationScope
-  ) => void
-}): React.JSX.Element {
+  ...rowProps
+}: AutomationListExternalRowsProps): React.JSX.Element {
   return (
     <>
-      {entries.map((entry) => {
-        const providerLabel = getExternalProviderLabel(entry.manager)
-        const targetKindLabel = getExternalTargetKindLabel(entry.manager)
-        const isSelected = selectedExternalKey === entry.key
-        const sshStatus =
-          entry.manager.target.type === 'ssh'
-            ? sshConnectionStates.get(entry.manager.target.connectionId)?.status
-            : undefined
-        const disabledMessage = getExternalAutomationActionDisabledMessage({
-          manager: entry.manager,
-          providerLabel,
-          targetKindLabel,
-          sshStatus,
-          actionInProgress: externalActionKey !== null
-        })
-        const actionDisabled = disabledMessage !== null
-        const scheduleLabel = getExternalAutomationScheduleDisplay(entry.manager, entry.job).label
-        const hostLabel = entry.manager.targetLabel || entry.manager.label || 'Local'
-        const projectLabel = entry.job.workdir ?? providerLabel
-        const nextRunLabel = entry.job.enabled
-          ? formatExternalDate(entry.job.nextRunAt, relativeNow)
-          : translate('auto.components.automations.AutomationsPage.paused', 'Paused')
-        const lastRunSnapshot = getExternalAutomationLastRunSnapshot(entry.job)
-
-        return (
-          <ContextMenu key={entry.key}>
-            <ContextMenuTrigger asChild>
-              <div
-                role="button"
-                tabIndex={0}
-                data-current={isSelected ? 'true' : undefined}
-                onClick={(event) => {
-                  // Why: Radix portals menus out of the row DOM, but React still
-                  // bubbles those clicks here — ignore so menu actions don't open detail.
-                  if (isPortaledRowMenuClick(event)) {
-                    return
-                  }
-                  onSelect(entry.key)
-                }}
-                onKeyDown={(event) => {
-                  if (!isRowActivationKey(event)) {
-                    return
-                  }
-                  event.preventDefault()
-                  onSelect(entry.key)
-                }}
-                className={cn(
-                  AUTOMATIONS_TABLE_GRID_CLASS,
-                  LIST_TABLE_ROW_CLASS,
-                  isSelected && LIST_TABLE_ROW_SELECTED_CLASS
-                )}
-              >
-                <span className={LIST_TABLE_STICKY_ROW_CELL_CLASS}>
-                  <span className="min-w-0 truncate font-medium">{entry.job.name}</span>
-                </span>
-                <span className="min-w-0 truncate text-muted-foreground" title={scheduleLabel}>
-                  {scheduleLabel}
-                </span>
-                <span className="min-w-0 truncate text-muted-foreground" title={projectLabel}>
-                  {projectLabel}
-                </span>
-                <span className="min-w-0 truncate text-muted-foreground" title={hostLabel}>
-                  {hostLabel}
-                </span>
-                <span className="min-w-0 truncate text-muted-foreground" title={nextRunLabel}>
-                  {nextRunLabel}
-                </span>
-                <AutomationListLastRunCell snapshot={lastRunSnapshot} now={relativeNow} />
-                <AutomationListStatusCell enabled={entry.job.enabled} />
-                <span className="truncate text-center text-xs text-muted-foreground">
-                  {providerLabel}
-                </span>
-                <DropdownMenu>
-                  <DropdownMenuTrigger asChild>
-                    <Button
-                      type="button"
-                      variant="ghost"
-                      size="icon-xs"
-                      className="size-7 text-muted-foreground"
-                      aria-label={translate(
-                        'auto.components.automations.AutomationsPage.rowActions',
-                        'Automation actions'
-                      )}
-                      onClick={(event) => event.stopPropagation()}
-                    >
-                      <MoreHorizontal className="size-4" />
-                    </Button>
-                  </DropdownMenuTrigger>
-                  <DropdownMenuContent align="end" className="w-48">
-                    <DropdownMenuItem
-                      disabled={actionDisabled}
-                      onSelect={() => onRequestAction(entry.manager, entry.job, 'run', entry.scope)}
-                    >
-                      <Play className="size-3.5" />
-                      <span className="min-w-0 truncate">
-                        {disabledMessage ??
-                          translate(
-                            'auto.components.automations.AutomationsPage.2faecab10b',
-                            'Run Now'
-                          )}
-                      </span>
-                    </DropdownMenuItem>
-                    {entry.manager.provider === 'hermes' ? (
-                      <DropdownMenuItem
-                        disabled={!entry.manager.canManage || externalActionKey !== null}
-                        onSelect={() => onEdit(entry.manager, entry.job, entry.scope)}
-                      >
-                        <Pencil className="size-3.5" />
-                        {translate(
-                          'auto.components.automations.AutomationsPage.f4612e3f78',
-                          'Edit'
-                        )}
-                      </DropdownMenuItem>
-                    ) : null}
-                    <DropdownMenuItem
-                      disabled={actionDisabled}
-                      onSelect={() =>
-                        onRequestAction(
-                          entry.manager,
-                          entry.job,
-                          entry.job.enabled ? 'pause' : 'resume',
-                          entry.scope
-                        )
-                      }
-                    >
-                      {entry.job.enabled ? (
-                        <Pause className="size-3.5" />
-                      ) : (
-                        <Play className="size-3.5" />
-                      )}
-                      {entry.job.enabled
-                        ? translate(
-                            'auto.components.automations.AutomationsPage.b457436d6a',
-                            'Pause'
-                          )
-                        : translate(
-                            'auto.components.automations.AutomationsPage.376631ef2b',
-                            'Resume'
-                          )}
-                    </DropdownMenuItem>
-                    <DropdownMenuSeparator />
-                    <DropdownMenuItem
-                      variant="destructive"
-                      disabled={actionDisabled}
-                      onSelect={() =>
-                        onRequestAction(entry.manager, entry.job, 'delete', entry.scope)
-                      }
-                    >
-                      <Trash2 className="size-3.5" />
-                      {translate(
-                        'auto.components.automations.AutomationsPage.15e0bfb13b',
-                        'Delete'
-                      )}
-                    </DropdownMenuItem>
-                  </DropdownMenuContent>
-                </DropdownMenu>
-              </div>
-            </ContextMenuTrigger>
-            <ContextMenuContent className="w-48">
-              <ContextMenuItem
-                disabled={actionDisabled}
-                onSelect={() => onRequestAction(entry.manager, entry.job, 'run', entry.scope)}
-              >
-                <Play className="size-3.5" />
-                <span className="min-w-0 truncate">
-                  {disabledMessage ??
-                    translate('auto.components.automations.AutomationsPage.2faecab10b', 'Run Now')}
-                </span>
-              </ContextMenuItem>
-              {entry.manager.provider === 'hermes' ? (
-                <ContextMenuItem
-                  disabled={!entry.manager.canManage || externalActionKey !== null}
-                  onSelect={() => onEdit(entry.manager, entry.job, entry.scope)}
-                >
-                  <Pencil className="size-3.5" />
-                  {translate('auto.components.automations.AutomationsPage.f4612e3f78', 'Edit')}
-                </ContextMenuItem>
-              ) : null}
-              <ContextMenuItem
-                disabled={actionDisabled}
-                onSelect={() =>
-                  onRequestAction(
-                    entry.manager,
-                    entry.job,
-                    entry.job.enabled ? 'pause' : 'resume',
-                    entry.scope
-                  )
-                }
-              >
-                {entry.job.enabled ? <Pause className="size-3.5" /> : <Play className="size-3.5" />}
-                {entry.job.enabled
-                  ? translate('auto.components.automations.AutomationsPage.b457436d6a', 'Pause')
-                  : translate('auto.components.automations.AutomationsPage.376631ef2b', 'Resume')}
-              </ContextMenuItem>
-              <ContextMenuSeparator />
-              <ContextMenuItem
-                variant="destructive"
-                disabled={actionDisabled}
-                onSelect={() => onRequestAction(entry.manager, entry.job, 'delete', entry.scope)}
-              >
-                <Trash2 className="size-3.5" />
-                {translate('auto.components.automations.AutomationsPage.15e0bfb13b', 'Delete')}
-              </ContextMenuItem>
-            </ContextMenuContent>
-          </ContextMenu>
-        )
-      })}
+      {entries.map((entry) => (
+        <AutomationListExternalRow key={entry.key} entry={entry} {...rowProps} />
+      ))}
     </>
   )
 }
diff --git a/src/renderer/src/components/automations/AutomationListLocalRow.tsx b/src/renderer/src/components/automations/AutomationListLocalRow.tsx
new file mode 100644
index 00000000000..a9c1a5bc8b6
--- /dev/null
+++ b/src/renderer/src/components/automations/AutomationListLocalRow.tsx
@@ -0,0 +1,391 @@
+import React from 'react'
+import { MoreHorizontal, Pause, Pencil, Play, Trash2 } from 'lucide-react'
+import {
+  ContextMenu,
+  ContextMenuContent,
+  ContextMenuItem,
+  ContextMenuSeparator,
+  ContextMenuTrigger
+} from '@/components/ui/context-menu'
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuSeparator,
+  DropdownMenuTrigger
+} from '@/components/ui/dropdown-menu'
+import { Button } from '@/components/ui/button'
+import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip'
+import { AgentIcon } from '@/lib/agent-catalog'
+import { cn } from '@/lib/utils'
+import type { AutomationRun } from '../../../../shared/automations-types'
+import { getAutomationRunRepoId } from '../../../../shared/automation-run-identity'
+import { formatUiAutomationSchedule } from './automation-schedule-label'
+import {
+  getExecutionHostLabel,
+  getLocalExecutionHostLabel,
+  getRepoExecutionHostId
+} from '../../../../shared/execution-host'
+import type { SshConnectionState } from '../../../../shared/ssh-types'
+import type { ProjectHostSetup } from '../../../../shared/project-types'
+import type { Repo } from '../../../../shared/repo-types'
+import type { Worktree } from '../../../../shared/worktree/types'
+import type { RuntimeStatus } from '../../../../shared/runtime-types'
+import type { TaskSourceHostAvailability } from '../task-source-context-summary'
+import type { AutomationRowAction } from './automation-captured-owner'
+import type { AutomationHostTarget } from './automation-host-client'
+import {
+  getAutomationRowLastRunSnapshot,
+  getLocalAutomationLastRunSnapshot
+} from './automation-list-last-run'
+import { AutomationListLastRunCell } from './AutomationListLastRunCell'
+import { formatAutomationDateTimeWithRelative } from './automation-page-parts'
+import { getAutomationTargetAvailability } from './automation-target-availability'
+import { getAgentLabel } from './automation-draft-model'
+import type { AutomationListRow } from './automation-list-row-identity'
+import {
+  formatAutomationCost,
+  formatAutomationTokens,
+  type AutomationUsageSummary
+} from './automation-usage-model'
+import { AUTOMATIONS_TABLE_GRID_CLASS } from './automations-table-layout'
+import {
+  LIST_TABLE_ROW_CLASS,
+  LIST_TABLE_ROW_SELECTED_CLASS,
+  LIST_TABLE_STICKY_ROW_CELL_CLASS
+} from '@/lib/list-table-layout'
+import { isPortaledRowMenuClick, isRowActivationKey } from '@/lib/list-row-interaction'
+import { AutomationListStatusCell } from './AutomationListStatusCell'
+import { translate } from '@/i18n/i18n'
+
+export type AutomationListLocalRowProps = {
+  row: AutomationListRow
+  selectedRowKey: string | null | undefined
+  isSelectedLocal: boolean
+  lastRunByAutomationId: ReadonlyMap<string, AutomationRun>
+  relativeNow: number
+  repoMap: ReadonlyMap<string, Repo>
+  worktreeMap: ReadonlyMap<string, Worktree>
+  repoForRow?: (row: AutomationListRow) => Repo | undefined
+  worktreeForRow?: (row: AutomationListRow, repo: Repo | undefined) => Worktree | undefined
+  projectHostSetups: readonly ProjectHostSetup[]
+  sshConnectionStates: ReadonlyMap<string, Pick<SshConnectionState, 'status'>>
+  runtimeStatusByEnvironmentId: ReadonlyMap<
+    string,
+    { status: RuntimeStatus | null; checkedAt: number }
+  >
+  hostTargetFor: (row: AutomationListRow) => AutomationHostTarget | null
+  automationSourceHostAvailabilityByRowKey: ReadonlyMap<string, TaskSourceHostAvailability[]>
+  hostLabelById?: ReadonlyMap<string, string>
+  isActionEnabled?: (row: AutomationListRow, action: AutomationRowAction) => boolean
+  onSelect: (rowKey: string) => void
+  onRunNow: (row: AutomationListRow) => void
+  onEdit: (row: AutomationListRow) => void
+  onToggle: (row: AutomationListRow) => void
+  onDelete: (row: AutomationListRow) => void
+}
+
+const EMPTY_HOST_LABELS: ReadonlyMap<string, string> = new Map()
+
+function automationUsageText(summary: AutomationUsageSummary | undefined): string {
+  if (!summary || summary.unavailableRuns > 0) {
+    return summary?.knownRuns
+      ? usageAmountText(summary)
+      : translate(
+          'auto.components.automations.AutomationsPage.usageUnavailable',
+          'Usage unavailable'
+        )
+  }
+  return summary.knownRuns > 0
+    ? usageAmountText(summary)
+    : translate('auto.components.automations.AutomationsPage.noRunUsageYet', 'No run usage yet')
+}
+
+function usageAmountText(summary: AutomationUsageSummary): string {
+  return translate(
+    'auto.components.automations.AutomationsPage.runUsageSummary',
+    '{{cost}} est. · {{tokens}} tokens',
+    {
+      cost: formatAutomationCost(summary.estimatedCostUsd),
+      tokens: formatAutomationTokens(summary.totalTokens)
+    }
+  )
+}
+
+export function AutomationListLocalRow({
+  row,
+  selectedRowKey,
+  isSelectedLocal,
+  lastRunByAutomationId,
+  relativeNow,
+  repoMap,
+  worktreeMap,
+  repoForRow,
+  worktreeForRow,
+  projectHostSetups,
+  sshConnectionStates,
+  runtimeStatusByEnvironmentId,
+  hostTargetFor,
+  automationSourceHostAvailabilityByRowKey,
+  hostLabelById = EMPTY_HOST_LABELS,
+  isActionEnabled,
+  onSelect,
+  onRunNow,
+  onEdit,
+  onToggle,
+  onDelete
+}: AutomationListLocalRowProps): React.JSX.Element {
+  const allows = (row: AutomationListRow, action: AutomationRowAction): boolean =>
+    isActionEnabled?.(row, action) ?? true
+  const { automation } = row
+  const automationRepo = repoForRow?.(row) ?? repoMap.get(getAutomationRunRepoId(automation))
+  const automationWorktree = automation.workspaceId
+    ? (worktreeForRow?.(row, automationRepo) ?? worktreeMap.get(automation.workspaceId))
+    : null
+  const automationRunAvailability = getAutomationTargetAvailability({
+    automation,
+    repo: automationRepo,
+    workspace: automationWorktree,
+    projectHostSetups,
+    sshConnectionStates,
+    runtimeStatusByEnvironmentId,
+    automationHostTarget: hostTargetFor(row),
+    sourceHostAvailability: automationSourceHostAvailabilityByRowKey.get(row.key)
+  })
+  const projectLabel =
+    automationRepo?.displayName ??
+    translate('auto.components.automations.AutomationsPage.13118faadf', 'Unknown project')
+  const scheduleLabel = formatUiAutomationSchedule(automation.rrule)
+  const nextRunLabel = automation.enabled
+    ? formatAutomationDateTimeWithRelative(automation.nextRunAt, relativeNow)
+    : translate('auto.components.automations.enablement.paused', 'Paused')
+  const isSelected = isSelectedLocal && selectedRowKey === row.key
+  const agentLabel = getAgentLabel(automation.agentId)
+  const hostId =
+    automation.runContext?.hostId ??
+    (automationRepo ? getRepoExecutionHostId(automationRepo) : null)
+  const hostLabel =
+    row.hostLabel ||
+    (hostId
+      ? (hostLabelById.get(hostId) ?? getExecutionHostLabel(hostId))
+      : getLocalExecutionHostLabel())
+  const agentTooltipLabel = `${agentLabel} · ${hostLabel} · ${automationUsageText(row.usageSummary ?? undefined)}`
+  const canRunNow = automationRunAvailability.canRunNow && allows(row, 'run')
+  const lastRun = lastRunByAutomationId.get(automation.id)
+  // Without a fetched run, the row's projected summary carries the newest
+  // retained run's status — the list never downloads run history for this.
+  const lastRunSnapshot = lastRun
+    ? getLocalAutomationLastRunSnapshot(automation, lastRun)
+    : getAutomationRowLastRunSnapshot(row)
+
+  const actionItems = (
+    <>
+      <MenuRunItem
+        disabled={!canRunNow}
+        label={
+          automationRunAvailability.canRunNow
+            ? translate('auto.components.automations.AutomationsPage.2faecab10b', 'Run Now')
+            : automationRunAvailability.message
+        }
+        onSelect={() => onRunNow(row)}
+      />
+      <MenuItem
+        disabled={!allows(row, 'edit')}
+        icon={<Pencil className="size-3.5" />}
+        label={translate('auto.components.automations.AutomationsPage.f4612e3f78', 'Edit')}
+        onSelect={() => onEdit(row)}
+      />
+      <MenuItem
+        disabled={!allows(row, 'toggle')}
+        icon={automation.enabled ? <Pause className="size-3.5" /> : <Play className="size-3.5" />}
+        label={
+          automation.enabled
+            ? translate('auto.components.automations.AutomationsPage.b457436d6a', 'Pause')
+            : translate('auto.components.automations.AutomationsPage.376631ef2b', 'Resume')
+        }
+        onSelect={() => onToggle(row)}
+      />
+      <MenuSeparator />
+      <MenuItem
+        disabled={!allows(row, 'delete')}
+        icon={<Trash2 className="size-3.5" />}
+        label={translate('auto.components.automations.AutomationsPage.15e0bfb13b', 'Delete')}
+        variant="destructive"
+        onSelect={() => onDelete(row)}
+      />
+    </>
+  )
+
+  return (
+    <ContextMenu>
+      <ContextMenuTrigger asChild>
+        <div
+          role="button"
+          tabIndex={0}
+          data-automation-row-id={row.key}
+          data-current={isSelected ? 'true' : undefined}
+          onClick={(event) => {
+            // Why: Radix portals menus out of the row DOM, but React still
+            // bubbles those clicks here — ignore so menu actions don't open detail.
+            if (isPortaledRowMenuClick(event)) {
+              return
+            }
+            onSelect(row.key)
+          }}
+          onKeyDown={(event) => {
+            if (!isRowActivationKey(event)) {
+              return
+            }
+            event.preventDefault()
+            onSelect(row.key)
+          }}
+          className={cn(
+            AUTOMATIONS_TABLE_GRID_CLASS,
+            LIST_TABLE_ROW_CLASS,
+            isSelected && LIST_TABLE_ROW_SELECTED_CLASS
+          )}
+        >
+          <span className={LIST_TABLE_STICKY_ROW_CELL_CLASS}>
+            <span className="min-w-0 truncate font-medium">{automation.name}</span>
+          </span>
+          <span className="min-w-0 truncate text-muted-foreground" title={scheduleLabel}>
+            {scheduleLabel}
+          </span>
+          <span className="min-w-0 truncate text-muted-foreground" title={projectLabel}>
+            {projectLabel}
+          </span>
+          <span className="min-w-0 truncate text-muted-foreground" title={hostLabel}>
+            {hostLabel}
+          </span>
+          <span className="min-w-0 truncate text-muted-foreground" title={nextRunLabel}>
+            {nextRunLabel}
+          </span>
+          <AutomationListLastRunCell snapshot={lastRunSnapshot} now={relativeNow} />
+          <AutomationListStatusCell enabled={automation.enabled} />
+          <Tooltip>
+            <TooltipTrigger asChild>
+              <span
+                className="flex items-center justify-center text-muted-foreground"
+                aria-label={agentTooltipLabel}
+              >
+                <AgentIcon agent={automation.agentId} size={16} />
+              </span>
+            </TooltipTrigger>
+            <TooltipContent side="top" sideOffset={4}>
+              {agentTooltipLabel}
+            </TooltipContent>
+          </Tooltip>
+          <DropdownMenu>
+            <DropdownMenuTrigger asChild>
+              <Button
+                type="button"
+                variant="ghost"
+                size="icon-xs"
+                className="size-7 text-muted-foreground"
+                aria-label={translate(
+                  'auto.components.automations.AutomationListLocalRows.c92c9463c6',
+                  'Automation actions'
+                )}
+                onClick={(event) => event.stopPropagation()}
+              >
+                <MoreHorizontal className="size-4" />
+              </Button>
+            </DropdownMenuTrigger>
+            <DropdownMenuContent align="end" className="w-48">
+              <DropdownMenuItem
+                disabled={!canRunNow}
+                onSelect={() => {
+                  if (canRunNow) {
+                    onRunNow(row)
+                  }
+                }}
+              >
+                <Play className="size-3.5" />
+                <span className="min-w-0 truncate">
+                  {automationRunAvailability.canRunNow
+                    ? translate('auto.components.automations.AutomationsPage.2faecab10b', 'Run Now')
+                    : automationRunAvailability.message}
+                </span>
+              </DropdownMenuItem>
+              <DropdownMenuItem disabled={!allows(row, 'edit')} onSelect={() => onEdit(row)}>
+                <Pencil className="size-3.5" />
+                {translate('auto.components.automations.AutomationsPage.f4612e3f78', 'Edit')}
+              </DropdownMenuItem>
+              <DropdownMenuItem disabled={!allows(row, 'toggle')} onSelect={() => onToggle(row)}>
+                {automation.enabled ? (
+                  <Pause className="size-3.5" />
+                ) : (
+                  <Play className="size-3.5" />
+                )}
+                {automation.enabled
+                  ? translate('auto.components.automations.AutomationsPage.b457436d6a', 'Pause')
+                  : translate('auto.components.automations.AutomationsPage.376631ef2b', 'Resume')}
+              </DropdownMenuItem>
+              <DropdownMenuSeparator />
+              <DropdownMenuItem
+                variant="destructive"
+                disabled={!allows(row, 'delete')}
+                onSelect={() => onDelete(row)}
+              >
+                <Trash2 className="size-3.5" />
+                {translate('auto.components.automations.AutomationsPage.15e0bfb13b', 'Delete')}
+              </DropdownMenuItem>
+            </DropdownMenuContent>
+          </DropdownMenu>
+        </div>
+      </ContextMenuTrigger>
+      <ContextMenuContent className="w-48">{actionItems}</ContextMenuContent>
+    </ContextMenu>
+  )
+}
+
+function MenuRunItem({
+  disabled,
+  label,
+  onSelect
+}: {
+  disabled: boolean
+  label: string
+  onSelect: () => void
+}): React.JSX.Element {
+  return (
+    <ContextMenuItem
+      disabled={disabled}
+      onSelect={(event) => {
+        if (disabled) {
+          event.preventDefault()
+          return
+        }
+        onSelect()
+      }}
+    >
+      <Play className="size-3.5" />
+      <span className="min-w-0 truncate">{label}</span>
+    </ContextMenuItem>
+  )
+}
+
+function MenuItem({
+  disabled,
+  icon,
+  label,
+  onSelect,
+  variant
+}: {
+  disabled?: boolean
+  icon: React.ReactNode
+  label: string
+  onSelect: () => void
+  variant?: 'destructive'
+}): React.JSX.Element {
+  return (
+    <ContextMenuItem disabled={disabled} variant={variant} onSelect={onSelect}>
+      {icon}
+      {label}
+    </ContextMenuItem>
+  )
+}
+
+function MenuSeparator(): React.JSX.Element {
+  return <ContextMenuSeparator />
+}
diff --git a/src/renderer/src/components/automations/AutomationListLocalRows.tsx b/src/renderer/src/components/automations/AutomationListLocalRows.tsx
index 292eb545b4d..3fa02cc1884 100644
--- a/src/renderer/src/components/automations/AutomationListLocalRows.tsx
+++ b/src/renderer/src/components/automations/AutomationListLocalRows.tsx
@@ -1,414 +1,20 @@
 import React from 'react'
-import { MoreHorizontal, Pause, Pencil, Play, Trash2 } from 'lucide-react'
-import {
-  ContextMenu,
-  ContextMenuContent,
-  ContextMenuItem,
-  ContextMenuSeparator,
-  ContextMenuTrigger
-} from '@/components/ui/context-menu'
-import {
-  DropdownMenu,
-  DropdownMenuContent,
-  DropdownMenuItem,
-  DropdownMenuSeparator,
-  DropdownMenuTrigger
-} from '@/components/ui/dropdown-menu'
-import { Button } from '@/components/ui/button'
-import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip'
-import { AgentIcon } from '@/lib/agent-catalog'
-import { cn } from '@/lib/utils'
-import type { AutomationRun } from '../../../../shared/automations-types'
-import { getAutomationRunRepoId } from '../../../../shared/automation-run-identity'
-import { formatUiAutomationSchedule } from './automation-schedule-label'
-import {
-  getExecutionHostLabel,
-  getLocalExecutionHostLabel,
-  getRepoExecutionHostId
-} from '../../../../shared/execution-host'
-import type { SshConnectionState } from '../../../../shared/ssh-types'
-import type { ProjectHostSetup } from '../../../../shared/project-types'
-import type { Repo } from '../../../../shared/repo-types'
-import type { Worktree } from '../../../../shared/worktree/types'
-import type { RuntimeStatus } from '../../../../shared/runtime-types'
-import type { TaskSourceHostAvailability } from '../task-source-context-summary'
-import type { AutomationRowAction } from './automation-captured-owner'
-import type { AutomationHostTarget } from './automation-host-client'
-import {
-  getAutomationRowLastRunSnapshot,
-  getLocalAutomationLastRunSnapshot
-} from './automation-list-last-run'
-import { AutomationListLastRunCell } from './AutomationListLastRunCell'
-import { formatAutomationDateTimeWithRelative } from './automation-page-parts'
-import { getAutomationTargetAvailability } from './automation-target-availability'
-import { getAgentLabel } from './automation-draft-model'
 import type { AutomationListRow } from './automation-list-row-identity'
-import {
-  formatAutomationCost,
-  formatAutomationTokens,
-  type AutomationUsageSummary
-} from './automation-usage-model'
-import { AUTOMATIONS_TABLE_GRID_CLASS } from './automations-table-layout'
-import {
-  LIST_TABLE_ROW_CLASS,
-  LIST_TABLE_ROW_SELECTED_CLASS,
-  LIST_TABLE_STICKY_ROW_CELL_CLASS
-} from '@/lib/list-table-layout'
-import { isPortaledRowMenuClick, isRowActivationKey } from '@/lib/list-row-interaction'
-import { AutomationListStatusCell } from './AutomationListStatusCell'
-import { translate } from '@/i18n/i18n'
+import { AutomationListLocalRow, type AutomationListLocalRowProps } from './AutomationListLocalRow'
 
-export type AutomationListLocalRowsProps = {
+export type AutomationListLocalRowsProps = Omit<AutomationListLocalRowProps, 'row'> & {
   rows: readonly AutomationListRow[]
-  selectedRowKey: string | null | undefined
-  isSelectedLocal: boolean
-  lastRunByAutomationId: ReadonlyMap<string, AutomationRun>
-  relativeNow: number
-  repoMap: ReadonlyMap<string, Repo>
-  worktreeMap: ReadonlyMap<string, Worktree>
-  repoForRow?: (row: AutomationListRow) => Repo | undefined
-  worktreeForRow?: (row: AutomationListRow, repo: Repo | undefined) => Worktree | undefined
-  projectHostSetups: readonly ProjectHostSetup[]
-  sshConnectionStates: ReadonlyMap<string, Pick<SshConnectionState, 'status'>>
-  runtimeStatusByEnvironmentId: ReadonlyMap<
-    string,
-    { status: RuntimeStatus | null; checkedAt: number }
-  >
-  hostTargetFor: (row: AutomationListRow) => AutomationHostTarget | null
-  automationSourceHostAvailabilityByRowKey: ReadonlyMap<string, TaskSourceHostAvailability[]>
-  hostLabelById?: ReadonlyMap<string, string>
-  isActionEnabled?: (row: AutomationListRow, action: AutomationRowAction) => boolean
-  onSelect: (rowKey: string) => void
-  onRunNow: (row: AutomationListRow) => void
-  onEdit: (row: AutomationListRow) => void
-  onToggle: (row: AutomationListRow) => void
-  onDelete: (row: AutomationListRow) => void
-}
-
-const EMPTY_HOST_LABELS: ReadonlyMap<string, string> = new Map()
-
-function automationUsageText(summary: AutomationUsageSummary | undefined): string {
-  if (!summary || summary.unavailableRuns > 0) {
-    return summary?.knownRuns
-      ? usageAmountText(summary)
-      : translate(
-          'auto.components.automations.AutomationsPage.usageUnavailable',
-          'Usage unavailable'
-        )
-  }
-  return summary.knownRuns > 0
-    ? usageAmountText(summary)
-    : translate('auto.components.automations.AutomationsPage.noRunUsageYet', 'No run usage yet')
-}
-
-function usageAmountText(summary: AutomationUsageSummary): string {
-  return translate(
-    'auto.components.automations.AutomationsPage.runUsageSummary',
-    '{{cost}} est. · {{tokens}} tokens',
-    {
-      cost: formatAutomationCost(summary.estimatedCostUsd),
-      tokens: formatAutomationTokens(summary.totalTokens)
-    }
-  )
 }
 
 export function AutomationListLocalRows({
   rows,
-  selectedRowKey,
-  isSelectedLocal,
-  lastRunByAutomationId,
-  relativeNow,
-  repoMap,
-  worktreeMap,
-  repoForRow,
-  worktreeForRow,
-  projectHostSetups,
-  sshConnectionStates,
-  runtimeStatusByEnvironmentId,
-  hostTargetFor,
-  automationSourceHostAvailabilityByRowKey,
-  hostLabelById = EMPTY_HOST_LABELS,
-  isActionEnabled,
-  onSelect,
-  onRunNow,
-  onEdit,
-  onToggle,
-  onDelete
+  ...rowProps
 }: AutomationListLocalRowsProps): React.JSX.Element {
-  const allows = (row: AutomationListRow, action: AutomationRowAction): boolean =>
-    isActionEnabled?.(row, action) ?? true
   return (
     <>
-      {rows.map((row) => {
-        const { automation } = row
-        const automationRepo = repoForRow?.(row) ?? repoMap.get(getAutomationRunRepoId(automation))
-        const automationWorktree = automation.workspaceId
-          ? (worktreeForRow?.(row, automationRepo) ?? worktreeMap.get(automation.workspaceId))
-          : null
-        const automationRunAvailability = getAutomationTargetAvailability({
-          automation,
-          repo: automationRepo,
-          workspace: automationWorktree,
-          projectHostSetups,
-          sshConnectionStates,
-          runtimeStatusByEnvironmentId,
-          automationHostTarget: hostTargetFor(row),
-          sourceHostAvailability: automationSourceHostAvailabilityByRowKey.get(row.key)
-        })
-        const projectLabel =
-          automationRepo?.displayName ??
-          translate('auto.components.automations.AutomationsPage.13118faadf', 'Unknown project')
-        const scheduleLabel = formatUiAutomationSchedule(automation.rrule)
-        const nextRunLabel = automation.enabled
-          ? formatAutomationDateTimeWithRelative(automation.nextRunAt, relativeNow)
-          : translate('auto.components.automations.enablement.paused', 'Paused')
-        const isSelected = isSelectedLocal && selectedRowKey === row.key
-        const agentLabel = getAgentLabel(automation.agentId)
-        const hostId =
-          automation.runContext?.hostId ??
-          (automationRepo ? getRepoExecutionHostId(automationRepo) : null)
-        const hostLabel =
-          row.hostLabel ||
-          (hostId
-            ? (hostLabelById.get(hostId) ?? getExecutionHostLabel(hostId))
-            : getLocalExecutionHostLabel())
-        const agentTooltipLabel = `${agentLabel} · ${hostLabel} · ${automationUsageText(row.usageSummary ?? undefined)}`
-        const canRunNow = automationRunAvailability.canRunNow && allows(row, 'run')
-        const lastRun = lastRunByAutomationId.get(automation.id)
-        // Without a fetched run, the row's projected summary carries the newest
-        // retained run's status — the list never downloads run history for this.
-        const lastRunSnapshot = lastRun
-          ? getLocalAutomationLastRunSnapshot(automation, lastRun)
-          : getAutomationRowLastRunSnapshot(row)
-
-        const actionItems = (
-          <>
-            <MenuRunItem
-              disabled={!canRunNow}
-              label={
-                automationRunAvailability.canRunNow
-                  ? translate('auto.components.automations.AutomationsPage.2faecab10b', 'Run Now')
-                  : automationRunAvailability.message
-              }
-              onSelect={() => onRunNow(row)}
-            />
-            <MenuItem
-              disabled={!allows(row, 'edit')}
-              icon={<Pencil className="size-3.5" />}
-              label={translate('auto.components.automations.AutomationsPage.f4612e3f78', 'Edit')}
-              onSelect={() => onEdit(row)}
-            />
-            <MenuItem
-              disabled={!allows(row, 'toggle')}
-              icon={
-                automation.enabled ? <Pause className="size-3.5" /> : <Play className="size-3.5" />
-              }
-              label={
-                automation.enabled
-                  ? translate('auto.components.automations.AutomationsPage.b457436d6a', 'Pause')
-                  : translate('auto.components.automations.AutomationsPage.376631ef2b', 'Resume')
-              }
-              onSelect={() => onToggle(row)}
-            />
-            <MenuSeparator />
-            <MenuItem
-              disabled={!allows(row, 'delete')}
-              icon={<Trash2 className="size-3.5" />}
-              label={translate('auto.components.automations.AutomationsPage.15e0bfb13b', 'Delete')}
-              variant="destructive"
-              onSelect={() => onDelete(row)}
-            />
-          </>
-        )
-
-        return (
-          <ContextMenu key={row.key}>
-            <ContextMenuTrigger asChild>
-              <div
-                role="button"
-                tabIndex={0}
-                data-automation-row-id={row.key}
-                data-current={isSelected ? 'true' : undefined}
-                onClick={(event) => {
-                  // Why: Radix portals menus out of the row DOM, but React still
-                  // bubbles those clicks here — ignore so menu actions don't open detail.
-                  if (isPortaledRowMenuClick(event)) {
-                    return
-                  }
-                  onSelect(row.key)
-                }}
-                onKeyDown={(event) => {
-                  if (!isRowActivationKey(event)) {
-                    return
-                  }
-                  event.preventDefault()
-                  onSelect(row.key)
-                }}
-                className={cn(
-                  AUTOMATIONS_TABLE_GRID_CLASS,
-                  LIST_TABLE_ROW_CLASS,
-                  isSelected && LIST_TABLE_ROW_SELECTED_CLASS
-                )}
-              >
-                <span className={LIST_TABLE_STICKY_ROW_CELL_CLASS}>
-                  <span className="min-w-0 truncate font-medium">{automation.name}</span>
-                </span>
-                <span className="min-w-0 truncate text-muted-foreground" title={scheduleLabel}>
-                  {scheduleLabel}
-                </span>
-                <span className="min-w-0 truncate text-muted-foreground" title={projectLabel}>
-                  {projectLabel}
-                </span>
-                <span className="min-w-0 truncate text-muted-foreground" title={hostLabel}>
-                  {hostLabel}
-                </span>
-                <span className="min-w-0 truncate text-muted-foreground" title={nextRunLabel}>
-                  {nextRunLabel}
-                </span>
-                <AutomationListLastRunCell snapshot={lastRunSnapshot} now={relativeNow} />
-                <AutomationListStatusCell enabled={automation.enabled} />
-                <Tooltip>
-                  <TooltipTrigger asChild>
-                    <span
-                      className="flex items-center justify-center text-muted-foreground"
-                      aria-label={agentTooltipLabel}
-                    >
-                      <AgentIcon agent={automation.agentId} size={16} />
-                    </span>
-                  </TooltipTrigger>
-                  <TooltipContent side="top" sideOffset={4}>
-                    {agentTooltipLabel}
-                  </TooltipContent>
-                </Tooltip>
-                <DropdownMenu>
-                  <DropdownMenuTrigger asChild>
-                    <Button
-                      type="button"
-                      variant="ghost"
-                      size="icon-xs"
-                      className="size-7 text-muted-foreground"
-                      aria-label={translate(
-                        'auto.components.automations.AutomationListLocalRows.c92c9463c6',
-                        'Automation actions'
-                      )}
-                      onClick={(event) => event.stopPropagation()}
-                    >
-                      <MoreHorizontal className="size-4" />
-                    </Button>
-                  </DropdownMenuTrigger>
-                  <DropdownMenuContent align="end" className="w-48">
-                    <DropdownMenuItem
-                      disabled={!canRunNow}
-                      onSelect={() => {
-                        if (canRunNow) {
-                          onRunNow(row)
-                        }
-                      }}
-                    >
-                      <Play className="size-3.5" />
-                      <span className="min-w-0 truncate">
-                        {automationRunAvailability.canRunNow
-                          ? translate(
-                              'auto.components.automations.AutomationsPage.2faecab10b',
-                              'Run Now'
-                            )
-                          : automationRunAvailability.message}
-                      </span>
-                    </DropdownMenuItem>
-                    <DropdownMenuItem disabled={!allows(row, 'edit')} onSelect={() => onEdit(row)}>
-                      <Pencil className="size-3.5" />
-                      {translate('auto.components.automations.AutomationsPage.f4612e3f78', 'Edit')}
-                    </DropdownMenuItem>
-                    <DropdownMenuItem
-                      disabled={!allows(row, 'toggle')}
-                      onSelect={() => onToggle(row)}
-                    >
-                      {automation.enabled ? (
-                        <Pause className="size-3.5" />
-                      ) : (
-                        <Play className="size-3.5" />
-                      )}
-                      {automation.enabled
-                        ? translate(
-                            'auto.components.automations.AutomationsPage.b457436d6a',
-                            'Pause'
-                          )
-                        : translate(
-                            'auto.components.automations.AutomationsPage.376631ef2b',
-                            'Resume'
-                          )}
-                    </DropdownMenuItem>
-                    <DropdownMenuSeparator />
-                    <DropdownMenuItem
-                      variant="destructive"
-                      disabled={!allows(row, 'delete')}
-                      onSelect={() => onDelete(row)}
-                    >
-                      <Trash2 className="size-3.5" />
-                      {translate(
-                        'auto.components.automations.AutomationsPage.15e0bfb13b',
-                        'Delete'
-                      )}
-                    </DropdownMenuItem>
-                  </DropdownMenuContent>
-                </DropdownMenu>
-              </div>
-            </ContextMenuTrigger>
-            <ContextMenuContent className="w-48">{actionItems}</ContextMenuContent>
-          </ContextMenu>
-        )
-      })}
+      {rows.map((row) => (
+        <AutomationListLocalRow key={row.key} row={row} {...rowProps} />
+      ))}
     </>
   )
 }
-
-function MenuRunItem({
-  disabled,
-  label,
-  onSelect
-}: {
-  disabled: boolean
-  label: string
-  onSelect: () => void
-}): React.JSX.Element {
-  return (
-    <ContextMenuItem
-      disabled={disabled}
-      onSelect={(event) => {
-        if (disabled) {
-          event.preventDefault()
-          return
-        }
-        onSelect()
-      }}
-    >
-      <Play className="size-3.5" />
-      <span className="min-w-0 truncate">{label}</span>
-    </ContextMenuItem>
-  )
-}
-
-function MenuItem({
-  disabled,
-  icon,
-  label,
-  onSelect,
-  variant
-}: {
-  disabled?: boolean
-  icon: React.ReactNode
-  label: string
-  onSelect: () => void
-  variant?: 'destructive'
-}): React.JSX.Element {
-  return (
-    <ContextMenuItem disabled={disabled} variant={variant} onSelect={onSelect}>
-      {icon}
-      {label}
-    </ContextMenuItem>
-  )
-}
-
-function MenuSeparator(): React.JSX.Element {
-  return <ContextMenuSeparator />
-}
diff --git a/src/renderer/src/components/automations/AutomationListSortHeader.tsx b/src/renderer/src/components/automations/AutomationListSortHeader.tsx
new file mode 100644
index 00000000000..2c24a344328
--- /dev/null
+++ b/src/renderer/src/components/automations/AutomationListSortHeader.tsx
@@ -0,0 +1,51 @@
+import React from 'react'
+import { ArrowDown, ArrowUp } from 'lucide-react'
+import { cn } from '@/lib/utils'
+import { translate } from '@/i18n/i18n'
+import type { AutomationListSort, AutomationListSortField } from './automation-list-view'
+
+export function AutomationListSortHeader({
+  field,
+  label,
+  sort,
+  onSort
+}: {
+  field: AutomationListSortField
+  label: string
+  sort: AutomationListSort | null
+  onSort: (field: AutomationListSortField) => void
+}): React.JSX.Element {
+  const active = sort?.field === field
+  const direction = active ? sort.direction : null
+  // Why: one interpolated key per direction — word order and punctuation around
+  // the column name differ per language.
+  const sortedLabel =
+    direction === 'asc'
+      ? translate(
+          'auto.components.automations.AutomationListSortHeader.sortedAscending',
+          '{{value0}}, sorted ascending',
+          { value0: label }
+        )
+      : direction === 'desc'
+        ? translate(
+            'auto.components.automations.AutomationListSortHeader.sortedDescending',
+            '{{value0}}, sorted descending',
+            { value0: label }
+          )
+        : null
+  return (
+    <button
+      type="button"
+      onClick={() => onSort(field)}
+      aria-label={sortedLabel ?? label}
+      className={cn(
+        'flex min-w-0 items-center gap-1 rounded-sm text-left text-[11px] font-medium tracking-[0.08em] uppercase select-none hover:text-foreground focus-visible:ring-2 focus-visible:ring-ring/50 focus-visible:outline-none',
+        active && 'text-foreground'
+      )}
+    >
+      <span className="truncate">{label}</span>
+      {direction === 'asc' ? <ArrowUp aria-hidden="true" className="size-3 shrink-0" /> : null}
+      {direction === 'desc' ? <ArrowDown aria-hidden="true" className="size-3 shrink-0" /> : null}
+    </button>
+  )
+}
diff --git a/src/renderer/src/components/automations/AutomationListTableHeader.test.tsx b/src/renderer/src/components/automations/AutomationListTableHeader.test.tsx
index 5c5bbe8e568..638e96a23bc 100644
--- a/src/renderer/src/components/automations/AutomationListTableHeader.test.tsx
+++ b/src/renderer/src/components/automations/AutomationListTableHeader.test.tsx
@@ -1,7 +1,8 @@
 // @vitest-environment happy-dom
 
 import { cleanup, render, screen } from '@testing-library/react'
-import { afterEach, describe, expect, it } from 'vitest'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import userEvent from '@testing-library/user-event'
 import { AutomationListTableHeader } from './AutomationListTableHeader'
 import {
   LIST_TABLE_HEADER_CLASS,
@@ -43,3 +44,45 @@ describe('AutomationListTableHeader', () => {
     expect(nameCell.className).toBe(LIST_TABLE_STICKY_HEADER_CELL_CLASS)
   })
 })
+
+describe('AutomationListTableHeader sorting', () => {
+  afterEach(cleanup)
+
+  it('exposes only the orderable columns as buttons', () => {
+    render(<AutomationListTableHeader sort={null} onSort={() => {}} />)
+
+    expect(screen.getAllByRole('button').map((button) => button.textContent)).toEqual([
+      'Name',
+      'Last run'
+    ])
+  })
+
+  it('reports the sorted column and direction in the accessible name', () => {
+    const { rerender } = render(
+      <AutomationListTableHeader sort={{ field: 'name', direction: 'asc' }} onSort={() => {}} />
+    )
+    expect(screen.getByRole('button', { name: 'Name, sorted ascending' })).toBeDefined()
+    expect(screen.getByRole('button', { name: 'Last run' })).toBeDefined()
+
+    rerender(
+      <AutomationListTableHeader sort={{ field: 'lastRun', direction: 'desc' }} onSort={() => {}} />
+    )
+    expect(screen.getByRole('button', { name: 'Last run, sorted descending' })).toBeDefined()
+    expect(screen.getByRole('button', { name: 'Name' })).toBeDefined()
+  })
+
+  it('requests a sort for the clicked column', async () => {
+    const onSort = vi.fn()
+    render(<AutomationListTableHeader sort={null} onSort={onSort} />)
+
+    await userEvent.click(screen.getByRole('button', { name: 'Last run' }))
+
+    expect(onSort.mock.calls).toEqual([['lastRun']])
+  })
+
+  it('stays non-interactive when the list cannot be sorted', () => {
+    render(<AutomationListTableHeader />)
+
+    expect(screen.queryAllByRole('button')).toEqual([])
+  })
+})
diff --git a/src/renderer/src/components/automations/AutomationListTableHeader.tsx b/src/renderer/src/components/automations/AutomationListTableHeader.tsx
index dcbd107fcbc..605baf8a945 100644
--- a/src/renderer/src/components/automations/AutomationListTableHeader.tsx
+++ b/src/renderer/src/components/automations/AutomationListTableHeader.tsx
@@ -5,34 +5,85 @@ import {
   LIST_TABLE_HEADER_CLASS,
   LIST_TABLE_STICKY_HEADER_CELL_CLASS
 } from '@/lib/list-table-layout'
+import { AutomationListSortHeader } from './AutomationListSortHeader'
+import type { AutomationListSort, AutomationListSortField } from './automation-list-view'
 
-export function AutomationListTableHeader(): React.JSX.Element {
-  const labels = [
-    ['auto.components.automations.AutomationsPage.tableName', 'Name'],
-    ['auto.components.automations.AutomationDetail.18763ded26', 'Schedule'],
-    ['auto.components.automations.AutomationsPage.tableProject', 'Project'],
-    ['auto.components.automations.AutomationsPage.tableHost', 'Host'],
-    ['auto.components.automations.AutomationDetail.578ff46987', 'Next run'],
-    ['auto.components.automations.AutomationsPage.tableLastRun', 'Last run'],
-    ['auto.components.automations.AutomationsPage.tableStatus', 'Status'],
-    ['auto.components.automations.AutomationDetail.2df8970cd5', 'Agent']
-  ] as const
+type HeaderColumn = {
+  key: string
+  fallback: string
+  /** Absent for columns the list cannot order by. */
+  sortField?: AutomationListSortField
+}
+
+const COLUMNS: readonly HeaderColumn[] = [
+  {
+    key: 'auto.components.automations.AutomationsPage.tableName',
+    fallback: 'Name',
+    sortField: 'name'
+  },
+  {
+    key: 'auto.components.automations.AutomationDetail.18763ded26',
+    fallback: 'Schedule'
+  },
+  {
+    key: 'auto.components.automations.AutomationsPage.tableProject',
+    fallback: 'Project'
+  },
+  {
+    key: 'auto.components.automations.AutomationsPage.tableHost',
+    fallback: 'Host'
+  },
+  {
+    key: 'auto.components.automations.AutomationDetail.578ff46987',
+    fallback: 'Next run'
+  },
+  {
+    key: 'auto.components.automations.AutomationsPage.tableLastRun',
+    fallback: 'Last run',
+    sortField: 'lastRun'
+  },
+  {
+    key: 'auto.components.automations.AutomationsPage.tableStatus',
+    fallback: 'Status'
+  },
+  {
+    key: 'auto.components.automations.AutomationDetail.2df8970cd5',
+    fallback: 'Agent'
+  }
+]
+
+export function AutomationListTableHeader({
+  sort = null,
+  onSort
+}: {
+  sort?: AutomationListSort | null
+  onSort?: (field: AutomationListSortField) => void
+} = {}): React.JSX.Element {
   return (
     <div className={`${AUTOMATIONS_TABLE_GRID_CLASS} ${LIST_TABLE_HEADER_CLASS}`}>
-      {labels.map(([key, fallback], index) => (
-        <span
-          key={key}
-          className={
-            index === 0
-              ? LIST_TABLE_STICKY_HEADER_CELL_CLASS
-              : index === labels.length - 1
-                ? 'text-center'
-                : undefined
-          }
-        >
-          {translate(key, fallback)}
-        </span>
-      ))}
+      {COLUMNS.map((column, index) => {
+        const label = translate(column.key, column.fallback)
+        const className =
+          index === 0
+            ? LIST_TABLE_STICKY_HEADER_CELL_CLASS
+            : index === COLUMNS.length - 1
+              ? 'text-center'
+              : undefined
+        return (
+          <span key={column.key} className={className}>
+            {column.sortField && onSort ? (
+              <AutomationListSortHeader
+                field={column.sortField}
+                label={label}
+                sort={sort}
+                onSort={onSort}
+              />
+            ) : (
+              label
+            )}
+          </span>
+        )
+      })}
       <span className="sr-only">
         {translate('auto.components.automations.AutomationsPage.tableActions', 'Actions')}
       </span>
diff --git a/src/renderer/src/components/automations/AutomationsListPanel.test.tsx b/src/renderer/src/components/automations/AutomationsListPanel.test.tsx
index 2f772d2a7ed..f2362b83d0f 100644
--- a/src/renderer/src/components/automations/AutomationsListPanel.test.tsx
+++ b/src/renderer/src/components/automations/AutomationsListPanel.test.tsx
@@ -11,7 +11,12 @@ import { createRoot, type Root } from 'react-dom/client'
 import { afterEach, beforeEach, describe, expect, it } from 'vitest'
 import { TooltipProvider } from '@/components/ui/tooltip'
 import { AutomationsListPanel } from './AutomationsListPanel'
-import { EMPTY_AUTOMATION_LIST_FILTER } from './automation-list-view'
+import {
+  buildAutomationListViewItems,
+  EMPTY_AUTOMATION_LIST_FILTER,
+  type AutomationListSort,
+  type AutomationListSortField
+} from './automation-list-view'
 import type { AutomationHostCatalogView } from './use-automation-host-catalog'
 import {
   makeAutomation,
@@ -49,7 +54,13 @@ const HOST_CATALOG = {
     status: 'all',
     announceFallback: false
   },
-  rows: { rows: [], automations: [], capturedOwners: new Map(), groups: [], answered: true },
+  rows: {
+    rows: [],
+    automations: [],
+    capturedOwners: new Map(),
+    groups: [],
+    answered: true
+  },
   loadCounts: { failedHostCount: 0, totalHostCount: 1 },
   selectHost: () => undefined,
   recover: () => undefined,
@@ -70,6 +81,8 @@ function renderPanel(
     selectExternalKey?: (key: string | null) => void
     externalEntries?: readonly ExternalAutomationListEntry[]
     setActivePaneTab?: (tab: AutomationPaneTab) => void
+    listSort?: AutomationListSort | null
+    onListSortChange?: (field: AutomationListSortField) => void
   } = {}
 ): void {
   const externalEntries = options.externalEntries ?? []
@@ -95,8 +108,12 @@ function renderPanel(
           externalManagersUncheckedNotice={uncheckedNotice}
           onSelectHost={() => undefined}
           onRecoverHost={() => undefined}
-          filteredRows={rows}
-          filteredExternalAutomationEntries={externalEntries}
+          sortedListItems={buildAutomationListViewItems({
+            rows,
+            externalEntries
+          })}
+          listSort={options.listSort ?? null}
+          onListSortChange={options.onListSortChange ?? (() => undefined)}
           selectedRowKey={options.selectedRowKey ?? null}
           selectedExternalKey={options.selectedExternalKey ?? null}
           relativeNow={0}
@@ -221,7 +238,11 @@ describe('AutomationsListPanel enter key navigation', () => {
     const input = searchField()
     expect(input).not.toBeNull()
 
-    const enter = new KeyboardEvent('keydown', { key: 'Enter', bubbles: true, cancelable: true })
+    const enter = new KeyboardEvent('keydown', {
+      key: 'Enter',
+      bubbles: true,
+      cancelable: true
+    })
     input?.dispatchEvent(enter)
 
     expect(enter.defaultPrevented).toBe(true)
@@ -252,7 +273,11 @@ describe('AutomationsListPanel enter key navigation', () => {
     const input = searchField()
     expect(input).not.toBeNull()
 
-    const enter = new KeyboardEvent('keydown', { key: 'Enter', bubbles: true, cancelable: true })
+    const enter = new KeyboardEvent('keydown', {
+      key: 'Enter',
+      bubbles: true,
+      cancelable: true
+    })
     input?.dispatchEvent(enter)
 
     expect(enter.defaultPrevented).toBe(true)
@@ -272,7 +297,11 @@ describe('AutomationsListPanel enter key navigation', () => {
     const input = searchField()
     expect(input).not.toBeNull()
 
-    const enter = new KeyboardEvent('keydown', { key: 'Enter', bubbles: true, cancelable: true })
+    const enter = new KeyboardEvent('keydown', {
+      key: 'Enter',
+      bubbles: true,
+      cancelable: true
+    })
     input?.dispatchEvent(enter)
 
     expect(detailOpened).toBe(false)
diff --git a/src/renderer/src/components/automations/AutomationsListPanel.tsx b/src/renderer/src/components/automations/AutomationsListPanel.tsx
index 5943096756a..783eee57da6 100644
--- a/src/renderer/src/components/automations/AutomationsListPanel.tsx
+++ b/src/renderer/src/components/automations/AutomationsListPanel.tsx
@@ -23,13 +23,19 @@ import {
 import type { AutomationListRow } from './automation-list-row-identity'
 import type { AutomationPaneTab } from './automation-page-state'
 import { AutomationListFilterPills } from './AutomationListFilterMenu'
-import { isAutomationListFilterActive, type AutomationListFilter } from './automation-list-view'
+import {
+  isAutomationListFilterActive,
+  type AutomationListFilter,
+  type AutomationListSort,
+  type AutomationListSortField,
+  type AutomationListViewItem
+} from './automation-list-view'
 import { automationHostFilterStableKey } from '../../../../shared/automation-host-filter'
 import type { AutomationTemplate } from './automation-templates'
 import type { ExternalAutomationListEntry } from './external-automation-list-entries'
 import type { ExternalAutomationScope } from './external-automation-scope-client'
-import { AutomationListLocalRows } from './AutomationListLocalRows'
-import { AutomationListExternalRows } from './AutomationListExternalRows'
+import { AutomationListLocalRow } from './AutomationListLocalRow'
+import { AutomationListExternalRow } from './AutomationListExternalRow'
 import { AutomationHostFilterNotice, AutomationHostLoadSummary } from './AutomationHostFilterNotice'
 import { AutomationListEmptyView } from './AutomationListEmptyView'
 import { resolveAutomationListEmptyState } from './automation-list-empty-state'
@@ -63,8 +69,10 @@ type AutomationsListPanelProps = {
     action: AutomationHostRecoveryAction,
     entry?: AutomationHostCatalogEntry | null
   ) => void
-  filteredRows: readonly AutomationListRow[]
-  filteredExternalAutomationEntries: readonly ExternalAutomationListEntry[]
+  /** Both collections as one list in render order; the sort spans local and external rows. */
+  sortedListItems: readonly AutomationListViewItem[]
+  listSort: AutomationListSort | null
+  onListSortChange: (field: AutomationListSortField) => void
   selectedRowKey: string | null
   selectedExternalKey: string | null
   selectedExternal?: ExternalAutomationListEntry | null
@@ -124,8 +132,9 @@ export function AutomationsListPanel(props: AutomationsListPanelProps): React.JS
     externalManagersUncheckedNotice,
     onSelectHost,
     onRecoverHost,
-    filteredRows,
-    filteredExternalAutomationEntries,
+    sortedListItems,
+    listSort,
+    onListSortChange,
     selectedRowKey,
     selectedExternalKey,
     relativeNow,
@@ -161,18 +170,20 @@ export function AutomationsListPanel(props: AutomationsListPanelProps): React.JS
   // Hosts moved into the Filters menu, so its toolbar row is the focus fallback now.
   const toolbarRef = useRef<HTMLDivElement>(null)
   const pendingKeyboardScrollRef = useRef(false)
-  const rowKeys = React.useMemo(() => filteredRows.map((row) => row.key), [filteredRows])
-  const visibleItems = React.useMemo(
-    () => [
-      ...filteredRows.map((row) => ({ kind: 'local' as const, id: row.key })),
-      ...filteredExternalAutomationEntries.map((entry) => ({
-        kind: 'external' as const,
-        id: entry.key
-      }))
-    ],
-    [filteredExternalAutomationEntries, filteredRows]
+  // Why: keyboard traversal and focus recovery read render order, which the sort owns.
+  const rowKeys = React.useMemo(
+    () => sortedListItems.filter((item) => item.kind === 'local').map((item) => item.id),
+    [sortedListItems]
   )
-  useAutomationListFocusRecovery({ rowKeys, containerRef: listRef, fallbackRef: toolbarRef })
+  const visibleItems = React.useMemo(
+    () => sortedListItems.map((item) => ({ kind: item.kind, id: item.id })),
+    [sortedListItems]
+  )
+  useAutomationListFocusRecovery({
+    rowKeys,
+    containerRef: listRef,
+    fallbackRef: toolbarRef
+  })
   const handleSearchArrowNavigate = React.useCallback(
     (key: AutomationListArrowKey) => {
       const next = getAutomationListArrowNavigationTarget({
@@ -331,24 +342,30 @@ export function AutomationsListPanel(props: AutomationsListPanelProps): React.JS
       >
         {hasFilteredListItems ? (
           <div className="min-w-full w-fit">
-            <AutomationListTableHeader />
+            <AutomationListTableHeader sort={listSort} onSort={onListSortChange} />
             <div className="divide-y divide-border/50">
-              <AutomationListLocalRows {...rowProps} rows={filteredRows} />
-              <AutomationListExternalRows
-                entries={filteredExternalAutomationEntries}
-                selectedExternalKey={selectedExternalKey}
-                relativeNow={relativeNow}
-                sshConnectionStates={sshConnectionStates}
-                externalActionKey={externalActionKey}
-                onSelect={(entryKey) => {
-                  selectAutomationRow(null)
-                  selectExternalKey(entryKey)
-                  setActivePaneTab('overview')
-                  onOpenDetail()
-                }}
-                onRequestAction={requestExternalAction}
-                onEdit={openEditExternalDialog}
-              />
+              {sortedListItems.map((item) =>
+                item.kind === 'local' ? (
+                  <AutomationListLocalRow key={item.id} {...rowProps} row={item.row} />
+                ) : (
+                  <AutomationListExternalRow
+                    key={item.id}
+                    entry={item.entry}
+                    selectedExternalKey={selectedExternalKey}
+                    relativeNow={relativeNow}
+                    sshConnectionStates={sshConnectionStates}
+                    externalActionKey={externalActionKey}
+                    onSelect={(entryKey) => {
+                      selectAutomationRow(null)
+                      selectExternalKey(entryKey)
+                      setActivePaneTab('overview')
+                      onOpenDetail()
+                    }}
+                    onRequestAction={requestExternalAction}
+                    onEdit={openEditExternalDialog}
+                  />
+                )
+              )}
             </div>
           </div>
         ) : (
diff --git a/src/renderer/src/components/automations/AutomationsPage.create-destination.test.tsx b/src/renderer/src/components/automations/AutomationsPage.create-destination.test.tsx
index a0778029ef9..0635ecdb6ff 100644
--- a/src/renderer/src/components/automations/AutomationsPage.create-destination.test.tsx
+++ b/src/renderer/src/components/automations/AutomationsPage.create-destination.test.tsx
@@ -19,7 +19,6 @@ import {
   addRuntimeProject,
   api,
   installAutomationsPageHarness,
-  listedRow,
   mocks,
   renderPage,
   runtimeHost,
@@ -30,6 +29,7 @@ import {
   scopedList,
   settleHostQueries
 } from './automations-page-test-harness'
+import { listedRow } from './automations-page-listed-items'
 import { makeAutomation, REPO_ID, WORKSPACE_ID } from './automations-page-fixtures'
 import type { Repo } from '../../../../shared/repo-types'
 import type { ProjectHostSetup } from '../../../../shared/project-types'
diff --git a/src/renderer/src/components/automations/AutomationsPage.cross-authority-actions.test.tsx b/src/renderer/src/components/automations/AutomationsPage.cross-authority-actions.test.tsx
index 618c092b45a..8193502cb36 100644
--- a/src/renderer/src/components/automations/AutomationsPage.cross-authority-actions.test.tsx
+++ b/src/renderer/src/components/automations/AutomationsPage.cross-authority-actions.test.tsx
@@ -22,6 +22,7 @@ import {
   SELF_PRECONDITION,
   settleHostQueries
 } from './automations-page-test-harness'
+import { listedRows } from './automations-page-listed-items'
 import { makeAutomation } from './automations-page-fixtures'
 
 installAutomationsPageHarness()
@@ -36,9 +37,7 @@ async function collidingHosts(): Promise<void> {
 }
 
 function selectDesktopRow(): string {
-  const row = mocks.listPanel?.filteredRows.find(
-    (candidate) => candidate.automation.name === 'Desktop nightly'
-  )
+  const row = listedRows().find((candidate) => candidate.automation.name === 'Desktop nightly')
   expect(row).toBeDefined()
   return row?.key ?? ''
 }
@@ -58,9 +57,7 @@ describe('AutomationsPage row actions under a colliding automation id', () => {
     await renderPage()
     await settleHostQueries()
 
-    const remote = mocks.listPanel?.filteredRows.find(
-      (candidate) => candidate.automation.name === 'Remote nightly'
-    )
+    const remote = listedRows().find((candidate) => candidate.automation.name === 'Remote nightly')
     await act(async () => {
       mocks.listPanel?.selectAutomationRow(remote?.key ?? '')
     })
diff --git a/src/renderer/src/components/automations/AutomationsPage.external-scope.test.tsx b/src/renderer/src/components/automations/AutomationsPage.external-scope.test.tsx
index cd966dcbcd7..b4ea3413cb3 100644
--- a/src/renderer/src/components/automations/AutomationsPage.external-scope.test.tsx
+++ b/src/renderer/src/components/automations/AutomationsPage.external-scope.test.tsx
@@ -20,6 +20,7 @@ import {
   RUNTIME_SELF_FILTER,
   settleHostQueries
 } from './automations-page-test-harness'
+import { listedExternalEntries } from './automations-page-listed-items'
 import { makeExternalManager } from './automations-page-fixtures'
 
 installAutomationsPageHarness()
@@ -117,7 +118,7 @@ describe('AutomationsPage external manager probes', () => {
     await renderPage()
     await settleHostQueries()
 
-    expect(mocks.listPanel?.filteredExternalAutomationEntries).toEqual([])
+    expect(listedExternalEntries()).toEqual([])
   })
 
   it('drops the previous host rows when the selection moves, not when the new probe lands', async () => {
@@ -127,7 +128,7 @@ describe('AutomationsPage external manager probes', () => {
 
     const { rerender } = await renderPage()
     await settleHostQueries()
-    expect(mocks.listPanel?.filteredExternalAutomationEntries.length).toBeGreaterThan(0)
+    expect(listedExternalEntries().length).toBeGreaterThan(0)
 
     // The new host never answers, so anything still listed belongs to the old one.
     api.automations.listExternalManagerForOwner.mockImplementation(
@@ -137,7 +138,7 @@ describe('AutomationsPage external manager probes', () => {
     await rerender()
     await settleHostQueries()
 
-    expect(mocks.listPanel?.filteredExternalAutomationEntries).toEqual([])
+    expect(listedExternalEntries()).toEqual([])
   })
 
   it('reports a host it could not check rather than showing it as clean', async () => {
diff --git a/src/renderer/src/components/automations/AutomationsPage.notice-recovery.test.tsx b/src/renderer/src/components/automations/AutomationsPage.notice-recovery.test.tsx
index d99cfb91dac..69c27640be1 100644
--- a/src/renderer/src/components/automations/AutomationsPage.notice-recovery.test.tsx
+++ b/src/renderer/src/components/automations/AutomationsPage.notice-recovery.test.tsx
@@ -15,7 +15,6 @@ import {
   addRuntimeProject,
   api,
   installAutomationsPageHarness,
-  listedRow,
   mocks,
   renderPage,
   runtimeHost,
@@ -26,6 +25,7 @@ import {
   scopedList,
   settleHostQueries
 } from './automations-page-test-harness'
+import { listedRow } from './automations-page-listed-items'
 import { makeAutomation } from './automations-page-fixtures'
 
 installAutomationsPageHarness()
diff --git a/src/renderer/src/components/automations/AutomationsPage.refresh-selection.test.tsx b/src/renderer/src/components/automations/AutomationsPage.refresh-selection.test.tsx
index 523cc50df7d..f33c4d09d6c 100644
--- a/src/renderer/src/components/automations/AutomationsPage.refresh-selection.test.tsx
+++ b/src/renderer/src/components/automations/AutomationsPage.refresh-selection.test.tsx
@@ -22,6 +22,7 @@ import {
   SELF_PRECONDITION,
   settleHostQueries
 } from './automations-page-test-harness'
+import { listedRows } from './automations-page-listed-items'
 import { makeAutomation, makeRun } from './automations-page-fixtures'
 
 installAutomationsPageHarness()
@@ -69,7 +70,7 @@ describe('AutomationsPage refresh', () => {
 
     await renderPage()
 
-    expect(mocks.listPanel?.filteredRows[0]?.usageSummary).toEqual(usageSummary)
+    expect(listedRows()[0]?.usageSummary).toEqual(usageSummary)
   })
 
   it('does not re-list through the active runtime just because one is selected', async () => {
@@ -231,9 +232,7 @@ describe('AutomationsPage multi-host selection', () => {
       )
     ).toEqual(['Desktop nightly', 'Remote nightly'])
 
-    const remote = mocks.listPanel?.filteredRows.find(
-      (row) => row.automation.name === 'Remote nightly'
-    )
+    const remote = listedRows().find((row) => row.automation.name === 'Remote nightly')
     await act(async () => {
       mocks.listPanel?.selectAutomationRow(remote?.key ?? '')
     })
diff --git a/src/renderer/src/components/automations/AutomationsPage.run-visibility.test.tsx b/src/renderer/src/components/automations/AutomationsPage.run-visibility.test.tsx
index f7ad0be65a7..5e605a4487a 100644
--- a/src/renderer/src/components/automations/AutomationsPage.run-visibility.test.tsx
+++ b/src/renderer/src/components/automations/AutomationsPage.run-visibility.test.tsx
@@ -16,12 +16,12 @@ import type { Automation } from '../../../../shared/automations-types'
 import {
   api,
   installAutomationsPageHarness,
-  listedRow,
   mocks,
   renderPage,
   scopedList,
   settleHostQueries
 } from './automations-page-test-harness'
+import { listedRow, listedRows } from './automations-page-listed-items'
 import { makeAutomation } from './automations-page-fixtures'
 
 installAutomationsPageHarness()
@@ -42,7 +42,7 @@ function desktopStoreHolds(automations: Automation[]): void {
 
 /** The next-run column reads this; the mocked list panel renders only names. */
 function listedNextRunAt(): number | null | undefined {
-  return mocks.listPanel?.filteredRows[0]?.automation.nextRunAt
+  return listedRows()[0]?.automation.nextRunAt
 }
 
 describe('AutomationsPage run visibility', () => {
diff --git a/src/renderer/src/components/automations/AutomationsPage.test.tsx b/src/renderer/src/components/automations/AutomationsPage.test.tsx
index 768d3250d80..a62a433a4d1 100644
--- a/src/renderer/src/components/automations/AutomationsPage.test.tsx
+++ b/src/renderer/src/components/automations/AutomationsPage.test.tsx
@@ -24,13 +24,13 @@ import {
   api,
   DESKTOP_SELF_OWNER,
   installAutomationsPageHarness,
-  listedRow,
   mocks,
   renderPage,
   rows,
   scopedList,
   SELF_PRECONDITION
 } from './automations-page-test-harness'
+import { listedRow, listedExternalEntries } from './automations-page-listed-items'
 import {
   makeAutomation,
   makeExternalManager,
@@ -147,7 +147,7 @@ describe('AutomationsPage list rendering', () => {
     api.automations.updateExternalForOwner.mockResolvedValue(undefined)
 
     await renderPage()
-    const entry = mocks.listPanel?.filteredExternalAutomationEntries[0]
+    const entry = listedExternalEntries()[0]
     if (!entry) {
       throw new Error('no external entry to edit')
     }
@@ -177,7 +177,7 @@ describe('AutomationsPage list rendering', () => {
     api.automations.runExternalActionForOwner.mockResolvedValue(undefined)
 
     await renderPage()
-    const entry = mocks.listPanel?.filteredExternalAutomationEntries[0]
+    const entry = listedExternalEntries()[0]
     if (!entry) {
       throw new Error('no external entry to act on')
     }
@@ -217,7 +217,7 @@ describe('AutomationsPage list rendering', () => {
     api.automations.listExternalRunsForOwner.mockResolvedValue({ runs: [], total: 0 })
 
     const { container } = await renderPage()
-    const entry = mocks.listPanel?.filteredExternalAutomationEntries[0]
+    const entry = listedExternalEntries()[0]
     if (!entry) {
       throw new Error('no external entry to read runs for')
     }
diff --git a/src/renderer/src/components/automations/AutomationsPageListPanel.tsx b/src/renderer/src/components/automations/AutomationsPageListPanel.tsx
index 25c7ff7b88c..7adea56c608 100644
--- a/src/renderer/src/components/automations/AutomationsPageListPanel.tsx
+++ b/src/renderer/src/components/automations/AutomationsPageListPanel.tsx
@@ -1,6 +1,7 @@
 import React from 'react'
 import type { AutomationsPageController } from './use-automations-page-controller'
 import { AutomationsListPanel } from './AutomationsListPanel'
+import { nextAutomationListSort } from './automation-list-view'
 
 export function AutomationsPageListPanel({
   controller,
@@ -45,8 +46,6 @@ export function AutomationsPageListPanel({
     hasListItems,
     hasFilteredListItems,
     isListSearchQueryTooLarge,
-    filteredRows,
-    filteredExternalAutomationEntries,
     selectedRow,
     selectedExternal,
     searchCounts
@@ -79,8 +78,9 @@ export function AutomationsPageListPanel({
           void pageRefresh.refresh()
         }
       }}
-      filteredRows={filteredRows}
-      filteredExternalAutomationEntries={filteredExternalAutomationEntries}
+      sortedListItems={list.sortedListItems}
+      listSort={local.listSort}
+      onListSortChange={(field) => local.setListSort(nextAutomationListSort(local.listSort, field))}
       selectedRowKey={selectedRow?.key ?? null}
       selectedExternalKey={local.selectedExternalKey}
       selectedExternal={selectedExternal}
diff --git a/src/renderer/src/components/automations/automation-list-view-sort.test.ts b/src/renderer/src/components/automations/automation-list-view-sort.test.ts
new file mode 100644
index 00000000000..8fbef8a0590
--- /dev/null
+++ b/src/renderer/src/components/automations/automation-list-view-sort.test.ts
@@ -0,0 +1,114 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import {
+  buildAutomationListViewItems,
+  sortAutomationListViewItems,
+  type AutomationListSort,
+  type AutomationListViewItem
+} from './automation-list-view'
+import { unscopedAutomationListRows } from './automation-list-row-identity'
+import { makeAutomation } from './automations-page-fixtures'
+
+afterEach(() => {
+  vi.restoreAllMocks()
+})
+
+function items(count = 512): AutomationListViewItem[] {
+  const names = ['Alpha', 'álpha', 'Ångström', 'Zebra', 'Örebro', 'I', 'ı', 'İ', 'job 10', 'job 2']
+  return buildAutomationListViewItems({
+    rows: unscopedAutomationListRows(
+      Array.from({ length: count }, (_, index) =>
+        makeAutomation({
+          id: `job-${index}`,
+          name: names[(index * 7) % names.length]
+        })
+      )
+    ),
+    externalEntries: []
+  })
+}
+
+/** The pre-collator comparator, resolving options on every comparison. */
+function previousOrder(list: AutomationListViewItem[], sort: AutomationListSort, locale: string) {
+  function compare(left: AutomationListViewItem, right: AutomationListViewItem) {
+    const value =
+      sort.field === 'name'
+        ? left.name.localeCompare(right.name, locale, { sensitivity: 'base' })
+        : (left.lastRunAt ?? 0) - (right.lastRunAt ?? 0)
+    return value !== 0
+      ? sort.direction === 'asc'
+        ? value
+        : -value
+      : left.id.localeCompare(right.id)
+  }
+  return [...list].sort(compare)
+}
+
+describe('automation list collation', () => {
+  it.each(['en', 'sv', 'tr', 'ja'])(
+    'preserves %s ordering, tie-breaks and input identity',
+    (locale) => {
+      const list = items()
+      const original = [...list]
+      for (const direction of ['asc', 'desc'] as const) {
+        const sort = { field: 'name', direction } as const
+        const expected = previousOrder(list, sort, locale)
+        const result = sortAutomationListViewItems(list, sort, locale)
+        expect(result).toEqual(expected)
+        expect(result.every((row, index) => row === expected[index])).toBe(true)
+      }
+      expect(list).toEqual(original)
+    }
+  )
+
+  it('resolves collation once per name sort and follows the locale it is given', () => {
+    const list = items()
+    const OriginalCollator = Intl.Collator
+    const construct = vi.spyOn(Intl, 'Collator').mockImplementation(function (locales, options) {
+      return new OriginalCollator(locales, options)
+    })
+    const compare = vi.spyOn(String.prototype, 'localeCompare')
+    sortAutomationListViewItems(list, { field: 'name', direction: 'asc' }, 'en')
+    sortAutomationListViewItems(list, { field: 'name', direction: 'desc' }, 'sv')
+    expect(construct.mock.calls).toEqual([
+      ['en', { sensitivity: 'base' }],
+      ['sv', { sensitivity: 'base' }]
+    ])
+    expect(compare.mock.calls.filter((args) => args.length >= 3)).toHaveLength(0)
+  })
+
+  it('orders by row key, not the bare automation ID, so hosts cannot collapse', () => {
+    const duplicate = makeAutomation({ id: 'shared', name: 'Same' })
+    const list = buildAutomationListViewItems({
+      rows: [
+        {
+          key: 'row|host-b|shared',
+          automation: duplicate,
+          hostLabel: 'b',
+          usageSummary: null
+        },
+        {
+          key: 'row|host-a|shared',
+          automation: duplicate,
+          hostLabel: 'a',
+          usageSummary: null
+        }
+      ],
+      externalEntries: []
+    })
+    const sorted = sortAutomationListViewItems(list, { field: 'name', direction: 'asc' }, 'en')
+    expect(sorted.map((item) => item.id)).toEqual(['row|host-a|shared', 'row|host-b|shared'])
+  })
+
+  it('does not construct collation for unsorted, time-sorted or trivial lists', () => {
+    const list = items()
+    const construct = vi.spyOn(Intl, 'Collator')
+    expect(sortAutomationListViewItems(list, null, 'en')).toEqual(list)
+    const sort = { field: 'lastRun', direction: 'desc' } as const
+    expect(sortAutomationListViewItems(list, sort, 'en')).toEqual(previousOrder(list, sort, 'en'))
+    expect(sortAutomationListViewItems([], { field: 'name', direction: 'asc' }, 'en')).toEqual([])
+    expect(
+      sortAutomationListViewItems(list.slice(0, 1), { field: 'name', direction: 'asc' }, 'en')
+    ).toEqual(list.slice(0, 1))
+    expect(construct).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/renderer/src/components/automations/automation-list-view.test.ts b/src/renderer/src/components/automations/automation-list-view.test.ts
index 188c94f3db7..169fbdd360a 100644
--- a/src/renderer/src/components/automations/automation-list-view.test.ts
+++ b/src/renderer/src/components/automations/automation-list-view.test.ts
@@ -1,7 +1,6 @@
 import { describe, expect, it } from 'vitest'
 import type {
   Automation,
-  AutomationRun,
   AutomationRunStatus,
   ExternalAutomationJob,
   ExternalAutomationManager
@@ -48,31 +47,6 @@ function makeAutomation(overrides: Partial<Automation> = {}): Automation {
   }
 }
 
-function makeRun(overrides: Partial<AutomationRun> = {}): AutomationRun {
-  return {
-    id: 'run-1',
-    automationId: 'automation-1',
-    title: 'Zebra job',
-    scheduledFor: 10,
-    status: 'completed',
-    trigger: 'scheduled',
-    workspaceId: 'worktree-1',
-    sessionKind: 'terminal',
-    chatSessionId: null,
-    terminalSessionId: null,
-    terminalPaneKey: null,
-    terminalPtyId: null,
-    outputSnapshot: null,
-    precheckResult: null,
-    usage: null,
-    error: null,
-    startedAt: 20,
-    dispatchedAt: 30,
-    createdAt: 10,
-    ...overrides
-  }
-}
-
 function makeExternalEntry(
   overrides: Partial<ExternalAutomationJob> = {}
 ): ExternalAutomationListEntry {
@@ -118,22 +92,69 @@ function makeExternalEntry(
   }
 }
 
+/** A catalog row with an optional projected last-run status, keyed like a real host row. */
+function makeCatalogRow(
+  id: string,
+  overrides: Partial<Automation> = {},
+  lastRunStatus?: AutomationRunStatus
+): AutomationListRow {
+  return {
+    key: `row|host|${id}`,
+    automation: makeAutomation({ id, ...overrides }),
+    hostLabel: 'This computer',
+    usageSummary: lastRunStatus
+      ? {
+          knownRuns: 1,
+          unavailableRuns: 0,
+          inputTokens: 0,
+          outputTokens: 0,
+          cacheTokens: 0,
+          reasoningOutputTokens: 0,
+          totalTokens: 0,
+          estimatedCostUsd: null,
+          lastRunStatus,
+          lastRunAt: 111
+        }
+      : null
+  }
+}
+
+const rowKey = (id: string): string => `row|host|${id}`
+
 describe('automation-list-view', () => {
   it('counts and detects active filters', () => {
-    expect(isAutomationListFilterActive({ status: 'all', lastRun: 'all', agentIds: [] })).toBe(
-      false
-    )
-    expect(isAutomationListFilterActive({ status: 'paused', lastRun: 'all', agentIds: [] })).toBe(
-      true
-    )
-    expect(countAutomationListFilters({ status: 'paused', lastRun: 'failed', agentIds: [] })).toBe(
-      2
-    )
+    expect(
+      isAutomationListFilterActive({
+        status: 'all',
+        lastRun: 'all',
+        agentIds: []
+      })
+    ).toBe(false)
+    expect(
+      isAutomationListFilterActive({
+        status: 'paused',
+        lastRun: 'all',
+        agentIds: []
+      })
+    ).toBe(true)
+    expect(
+      countAutomationListFilters({
+        status: 'paused',
+        lastRun: 'failed',
+        agentIds: []
+      })
+    ).toBe(2)
   })
 
   it('toggles sort direction and defaults last run to newest first', () => {
-    expect(nextAutomationListSort(null, 'name')).toEqual({ field: 'name', direction: 'asc' })
-    expect(nextAutomationListSort(null, 'lastRun')).toEqual({ field: 'lastRun', direction: 'desc' })
+    expect(nextAutomationListSort(null, 'name')).toEqual({
+      field: 'name',
+      direction: 'asc'
+    })
+    expect(nextAutomationListSort(null, 'lastRun')).toEqual({
+      field: 'lastRun',
+      direction: 'desc'
+    })
     expect(nextAutomationListSort({ field: 'name', direction: 'asc' }, 'name')).toEqual({
       field: 'name',
       direction: 'desc'
@@ -146,82 +167,62 @@ describe('automation-list-view', () => {
 
   it('filters by enabled state and last-run outcome', () => {
     const items = applyAutomationListView({
-      automations: [
-        makeAutomation({ id: 'paused', name: 'Paused', enabled: false }),
-        makeAutomation({ id: 'ok', name: 'Healthy' })
+      rows: [
+        makeCatalogRow('paused', { name: 'Paused', enabled: false }, 'completed'),
+        makeCatalogRow('ok', { name: 'Healthy' }, 'dispatch_failed')
       ],
       externalEntries: [makeExternalEntry()],
-      runs: [
-        makeRun({ automationId: 'paused', status: 'completed' }),
-        makeRun({ automationId: 'ok', status: 'dispatch_failed' })
-      ],
       filter: { status: 'enabled', lastRun: 'failed', agentIds: [] },
-      sort: null
+      sort: null,
+      locale: 'en'
     })
-    expect(items.map((item) => item.id)).toEqual(['ok', 'manager-1:job-1'])
+    expect(items.map((item) => item.id)).toEqual([rowKey('ok'), 'manager-1:job-1'])
   })
 
   it('filters local rows by multiple agents and leaves external rows out of agent scopes', () => {
     const items = applyAutomationListView({
-      automations: [
-        makeAutomation({ id: 'codex-job', agentId: 'codex' }),
-        makeAutomation({ id: 'claude-job', agentId: 'claude' })
+      rows: [
+        makeCatalogRow('codex-job', { agentId: 'codex' }),
+        makeCatalogRow('claude-job', { agentId: 'claude' })
       ],
       externalEntries: [makeExternalEntry()],
-      runs: [],
       filter: { status: 'all', lastRun: 'all', agentIds: ['codex', 'claude'] },
-      sort: null
+      sort: null,
+      locale: 'en'
     })
 
-    expect(items.map((item) => item.id)).toEqual(['codex-job', 'claude-job'])
+    expect(items.map((item) => item.id)).toEqual([rowKey('codex-job'), rowKey('claude-job')])
   })
 
   it('counts an agent filter alongside status and last-run filters', () => {
-    expect(isAutomationListFilterActive({ status: 'all', lastRun: 'all', agentIds: [] })).toBe(
-      false
-    )
     expect(
-      countAutomationListFilters({ status: 'paused', lastRun: 'failed', agentIds: ['codex'] })
+      isAutomationListFilterActive({
+        status: 'all',
+        lastRun: 'all',
+        agentIds: []
+      })
+    ).toBe(false)
+    expect(
+      countAutomationListFilters({
+        status: 'paused',
+        lastRun: 'failed',
+        agentIds: ['codex']
+      })
     ).toBe(3)
   })
 
   it('sorts by name across local and external rows', () => {
     const items = applyAutomationListView({
-      automations: [makeAutomation({ name: 'Zebra job' })],
+      rows: [makeCatalogRow('zebra', { name: 'Zebra job' })],
       externalEntries: [makeExternalEntry({ name: 'Alpha digest' })],
-      runs: [],
       filter: { status: 'all', lastRun: 'all', agentIds: [] },
-      sort: { field: 'name', direction: 'asc' }
+      sort: { field: 'name', direction: 'asc' },
+      locale: 'en'
     })
     expect(items.map((item) => item.name)).toEqual(['Alpha digest', 'Zebra job'])
   })
 
   it('filters catalog rows by status, agent, and the projected last-run status', () => {
-    function makeCatalogRow(
-      id: string,
-      overrides: Partial<Automation>,
-      lastRunStatus?: AutomationRunStatus
-    ): AutomationListRow {
-      return {
-        key: `row|host|${id}`,
-        automation: makeAutomation({ id, ...overrides }),
-        hostLabel: 'This computer',
-        usageSummary: lastRunStatus
-          ? {
-              knownRuns: 1,
-              unavailableRuns: 0,
-              inputTokens: 0,
-              outputTokens: 0,
-              cacheTokens: 0,
-              reasoningOutputTokens: 0,
-              totalTokens: 0,
-              estimatedCostUsd: null,
-              lastRunStatus,
-              lastRunAt: 111
-            }
-          : null
-      }
-    }
     const rows = [
       makeCatalogRow('paused-codex', { enabled: false, agentId: 'codex' }),
       makeCatalogRow('failed-claude', { agentId: 'claude' }, 'dispatch_failed'),
@@ -229,9 +230,10 @@ describe('automation-list-view', () => {
       makeCatalogRow('never-codex', { agentId: 'codex' })
     ]
     const ids = (filter: Partial<AutomationListFilter>) =>
-      filterAutomationListRows(rows, { ...EMPTY_AUTOMATION_LIST_FILTER, ...filter }).map(
-        (row) => row.automation.id
-      )
+      filterAutomationListRows(rows, {
+        ...EMPTY_AUTOMATION_LIST_FILTER,
+        ...filter
+      }).map((row) => row.automation.id)
 
     expect(ids({ status: 'paused' })).toEqual(['paused-codex'])
     expect(ids({ agentIds: ['claude'] })).toEqual(['failed-claude'])
@@ -249,7 +251,10 @@ describe('automation-list-view', () => {
       catalogRef:
         targetId === null
           ? null
-          : { authority: { kind: 'desktop' }, selector: { kind: 'ssh', targetId } },
+          : {
+              authority: { kind: 'desktop' },
+              selector: { kind: 'ssh', targetId }
+            },
       hostLabel: targetId ?? '',
       usageSummary: null
     })
@@ -257,9 +262,10 @@ describe('automation-list-view', () => {
     const keyOf = (row: AutomationListRow): string =>
       row.catalogRef ? hostStableKey(row.catalogRef) : ''
     const ids = (hostStableKeys: readonly string[]) =>
-      filterAutomationListRows(rows, { ...EMPTY_AUTOMATION_LIST_FILTER, hostStableKeys }).map(
-        (row) => row.automation.id
-      )
+      filterAutomationListRows(rows, {
+        ...EMPTY_AUTOMATION_LIST_FILTER,
+        hostStableKeys
+      }).map((row) => row.automation.id)
 
     // Multi-select is any-of; a pre-catalog row names no host and is excluded.
     expect(ids([keyOf(rows[0]), keyOf(rows[1])])).toEqual(['on-a', 'on-b'])
@@ -290,15 +296,22 @@ describe('automation-list-view', () => {
 
   it('sorts by last run newest first and keeps never-run rows last', () => {
     const items = applyAutomationListView({
-      automations: [
-        makeAutomation({ id: 'old', name: 'Old' }),
-        makeAutomation({ id: 'never', name: 'Never' })
+      rows: [
+        makeCatalogRow('old', {
+          name: 'Old',
+          lastRunAt: Date.parse('2026-08-11T09:00:00Z')
+        }),
+        makeCatalogRow('never', { name: 'Never' })
       ],
       externalEntries: [makeExternalEntry({ lastRunAt: '2026-08-12T09:00:00Z' })],
-      runs: [makeRun({ automationId: 'old', dispatchedAt: Date.parse('2026-08-11T09:00:00Z') })],
       filter: { status: 'all', lastRun: 'all', agentIds: [] },
-      sort: { field: 'lastRun', direction: 'desc' }
+      sort: { field: 'lastRun', direction: 'desc' },
+      locale: 'en'
     })
-    expect(items.map((item) => item.id)).toEqual(['manager-1:job-1', 'old', 'never'])
+    expect(items.map((item) => item.id)).toEqual([
+      'manager-1:job-1',
+      rowKey('old'),
+      rowKey('never')
+    ])
   })
 })
diff --git a/src/renderer/src/components/automations/automation-list-view.ts b/src/renderer/src/components/automations/automation-list-view.ts
index 7ccff6a4cb4..cedd394ed23 100644
--- a/src/renderer/src/components/automations/automation-list-view.ts
+++ b/src/renderer/src/components/automations/automation-list-view.ts
@@ -1,5 +1,3 @@
-import { getIntlLocale } from '@/i18n/i18n'
-import type { Automation, AutomationRun } from '../../../../shared/automations-types'
 import type { TuiAgent } from '../../../../shared/tui-agent'
 import { hostStableKey } from '../../../../shared/automation-owner-key'
 import type { AutomationListRow } from './automation-list-row-identity'
@@ -7,8 +5,6 @@ import type { ExternalAutomationListEntry } from './external-automation-list-ent
 import {
   getAutomationRowLastRunSnapshot,
   getExternalAutomationLastRunSnapshot,
-  getLocalAutomationLastRunSnapshot,
-  indexLatestAutomationRuns,
   type AutomationLastRunSnapshot
 } from './automation-list-last-run'
 
@@ -22,6 +18,13 @@ export type AutomationListSort = {
   direction: AutomationListSortDirection
 }
 
+/**
+ * A row and an external job flattened to what the shared list renders and sorts.
+ *
+ * `id` is the row's own key, never the bare automation ID: under All hosts two
+ * authorities can return the same ID, and the sort tie-break decides render
+ * order, so a bare ID would collapse them. See `automation-list-row-identity`.
+ */
 export type AutomationListViewItem =
   | {
       kind: 'local'
@@ -31,7 +34,7 @@ export type AutomationListViewItem =
       lastRunAt: number | null
       lastRun: AutomationLastRunSnapshot
       agentId: TuiAgent
-      automation: Automation
+      row: AutomationListRow
     }
   | {
       kind: 'external'
@@ -117,30 +120,26 @@ function matchesLastRunFilter(
   return snapshot.tone === filter
 }
 
+/** Flattens the two rendered collections into one sortable list, preserving row identity. */
 export function buildAutomationListViewItems({
-  automations,
-  externalEntries,
-  runs
+  rows,
+  externalEntries
 }: {
-  automations: readonly Automation[]
+  rows: readonly AutomationListRow[]
   externalEntries: readonly ExternalAutomationListEntry[]
-  runs: readonly AutomationRun[]
 }): AutomationListViewItem[] {
-  const lastRunByAutomationId = indexLatestAutomationRuns(runs)
-  const locals: AutomationListViewItem[] = automations.map((automation) => {
-    const lastRun = getLocalAutomationLastRunSnapshot(
-      automation,
-      lastRunByAutomationId.get(automation.id)
-    )
+  const locals: AutomationListViewItem[] = rows.map((row) => {
+    // Why: the same snapshot the row cell renders, so the sort matches the column.
+    const lastRun = getAutomationRowLastRunSnapshot(row)
     return {
       kind: 'local',
-      id: automation.id,
-      name: automation.name,
-      enabled: automation.enabled,
+      id: row.key,
+      name: row.automation.name,
+      enabled: row.automation.enabled,
       lastRunAt: lastRun.at,
       lastRun,
-      agentId: automation.agentId,
-      automation
+      agentId: row.automation.agentId,
+      row
     }
   })
   const externals: AutomationListViewItem[] = externalEntries.map((entry) => {
@@ -217,36 +216,25 @@ export function filterExternalAutomationListEntries(
   )
 }
 
-export function filterAutomationListViewItems(
-  items: readonly AutomationListViewItem[],
-  filter: AutomationListFilter
-): AutomationListViewItem[] {
-  if (!isAutomationListFilterActive(filter)) {
-    return [...items]
-  }
-  return items.filter(
-    (item) =>
-      matchesStatusFilter(item.enabled, filter.status) &&
-      matchesLastRunFilter(item.lastRun, filter.lastRun) &&
-      (filter.agentIds.length === 0 ||
-        (item.agentId !== null && filter.agentIds.includes(item.agentId)))
-  )
-}
-
+/**
+ * `locale` is a parameter, not a `getIntlLocale()` read, so callers memoizing this
+ * can declare it — a hidden read is invisible to a dependency array.
+ */
 export function sortAutomationListViewItems(
   items: readonly AutomationListViewItem[],
-  sort: AutomationListSort | null
+  sort: AutomationListSort | null,
+  locale: string
 ): AutomationListViewItem[] {
-  if (!sort) {
+  if (!sort || items.length < 2) {
     return [...items]
   }
   const next = [...items]
-  const locale = getIntlLocale()
+  const compareNames =
+    sort.field === 'name' ? new Intl.Collator(locale, { sensitivity: 'base' }).compare : null
   next.sort((left, right) => {
-    const compared =
-      sort.field === 'name'
-        ? left.name.localeCompare(right.name, locale, { sensitivity: 'base' })
-        : (left.lastRunAt ?? 0) - (right.lastRunAt ?? 0)
+    const compared = compareNames
+      ? compareNames(left.name, right.name)
+      : (left.lastRunAt ?? 0) - (right.lastRunAt ?? 0)
     if (compared !== 0) {
       return sort.direction === 'asc' ? compared : -compared
     }
@@ -255,24 +243,26 @@ export function sortAutomationListViewItems(
   return next
 }
 
+/** The rendered list: filter each collection with its own rules, then sort as one. */
 export function applyAutomationListView({
-  automations,
+  rows,
   externalEntries,
-  runs,
   filter,
-  sort
+  sort,
+  locale
 }: {
-  automations: readonly Automation[]
+  rows: readonly AutomationListRow[]
   externalEntries: readonly ExternalAutomationListEntry[]
-  runs: readonly AutomationRun[]
   filter: AutomationListFilter
   sort: AutomationListSort | null
+  locale: string
 }): AutomationListViewItem[] {
   return sortAutomationListViewItems(
-    filterAutomationListViewItems(
-      buildAutomationListViewItems({ automations, externalEntries, runs }),
-      filter
-    ),
-    sort
+    buildAutomationListViewItems({
+      rows: filterAutomationListRows(rows, filter),
+      externalEntries: filterExternalAutomationListEntries(externalEntries, filter)
+    }),
+    sort,
+    locale
   )
 }
diff --git a/src/renderer/src/components/automations/automations-page-listed-items.ts b/src/renderer/src/components/automations/automations-page-listed-items.ts
new file mode 100644
index 00000000000..d87ae62b4a8
--- /dev/null
+++ b/src/renderer/src/components/automations/automations-page-listed-items.ts
@@ -0,0 +1,32 @@
+/**
+ * What the page actually listed, read back from the mocked list panel.
+ *
+ * Tests act through the same authority-qualified keys and render order the
+ * user's click carries, rather than synthesizing either.
+ */
+
+import type { AutomationListRow } from './automation-list-row-identity'
+import type { ExternalAutomationListEntry } from './external-automation-list-entries'
+import { mocks } from './automations-page-test-harness'
+
+function listedItems() {
+  return mocks.listPanel?.sortedListItems ?? []
+}
+
+/** Local rows the page listed, in render order. */
+export function listedRows(): readonly AutomationListRow[] {
+  return listedItems().flatMap((item) => (item.kind === 'local' ? [item.row] : []))
+}
+
+/** External entries the page listed, in render order. */
+export function listedExternalEntries(): readonly ExternalAutomationListEntry[] {
+  return listedItems().flatMap((item) => (item.kind === 'external' ? [item.entry] : []))
+}
+
+export function listedRow(automationId: string): AutomationListRow {
+  const row = listedRows().find((entry) => entry.automation.id === automationId)
+  if (!row) {
+    throw new Error(`no listed row for ${automationId}`)
+  }
+  return row
+}
diff --git a/src/renderer/src/components/automations/automations-page-test-harness.tsx b/src/renderer/src/components/automations/automations-page-test-harness.tsx
index d9fd1088bf7..e34ae0640bc 100644
--- a/src/renderer/src/components/automations/automations-page-test-harness.tsx
+++ b/src/renderer/src/components/automations/automations-page-test-harness.tsx
@@ -27,6 +27,7 @@ import type { AutomationHostCatalogView } from './use-automation-host-catalog'
 import type { AutomationCreateDestinationControl } from './use-automation-create-destination'
 import type { ExternalAutomationListEntry } from './external-automation-list-entries'
 import type { AutomationListRow } from './automation-list-row-identity'
+import type { AutomationListViewItem } from './automation-list-view'
 import { resetAutomationCapabilityProbes } from './automation-scoped-list-client'
 import {
   addRuntimeProject as addRuntimeProjectFixture,
@@ -39,7 +40,7 @@ export const RUNTIME_REPO_ID = RUNTIME_REPO_ID_FIXTURE
 export const RUNTIME_WORKSPACE_ID = RUNTIME_WORKSPACE_ID_FIXTURE
 
 export type ListPanelProps = {
-  filteredExternalAutomationEntries: ExternalAutomationListEntry[]
+  sortedListItems: readonly AutomationListViewItem[]
   selectedExternal: ExternalAutomationListEntry | null
   openEditExternalDialog: (
     manager: ExternalAutomationListEntry['manager'],
@@ -55,7 +56,6 @@ export type ListPanelProps = {
   ) => void
   hasListItems: boolean
   hasFilteredListItems: boolean
-  filteredRows: readonly AutomationListRow[]
   selectedRowKey: string | null
   selectedExternalKey: string | null
   hostCatalog: AutomationHostCatalogView
@@ -211,30 +211,31 @@ vi.mock('./AutomationsListPanel', () => ({
     return (
       <div data-testid="list-panel">
         <button aria-label="Refresh automations" onClick={props.onRefresh} />
-        {props.filteredRows.map((row) => (
-          <button
-            type="button"
-            data-testid="automation-row"
-            key={row.key}
-            onClick={() => selectAutomationRow(row.key)}
-          >
-            {row.automation.name}
-          </button>
-        ))}
-        {props.filteredExternalAutomationEntries.map((entry) => (
-          <button
-            type="button"
-            data-testid="external-row"
-            key={entry.key}
-            onClick={() => {
-              props.selectAutomationRow(null)
-              props.selectExternalKey(entry.key)
-              props.onOpenDetail()
-            }}
-          >
-            {entry.job.name}
-          </button>
-        ))}
+        {props.sortedListItems.map((item) =>
+          item.kind === 'local' ? (
+            <button
+              type="button"
+              data-testid="automation-row"
+              key={item.id}
+              onClick={() => selectAutomationRow(item.id)}
+            >
+              {item.row.automation.name}
+            </button>
+          ) : (
+            <button
+              type="button"
+              data-testid="external-row"
+              key={item.id}
+              onClick={() => {
+                props.selectAutomationRow(null)
+                props.selectExternalKey(item.id)
+                props.onOpenDetail()
+              }}
+            >
+              {item.entry.job.name}
+            </button>
+          )
+        )}
         {props.hasListItems ? null : <div data-testid="empty-state" />}
       </div>
     )
@@ -407,18 +408,6 @@ export async function refreshOnFocus(): Promise<void> {
   })
 }
 
-/**
- * The row the page actually listed for an ID, so tests act through the same
- * authority-qualified key the user's click carries rather than a synthesized one.
- */
-export function listedRow(automationId: string): AutomationListRow {
-  const row = mocks.listPanel?.filteredRows.find((entry) => entry.automation.id === automationId)
-  if (!row) {
-    throw new Error(`no listed row for ${automationId}`)
-  }
-  return row
-}
-
 export function rows(container: HTMLElement, testId: string): string[] {
   return [...container.querySelectorAll(`[data-testid="${testId}"]`)].map(
     (node) => node.textContent ?? ''
diff --git a/src/renderer/src/components/automations/use-automations-page-list-state.ts b/src/renderer/src/components/automations/use-automations-page-list-state.ts
index 65cce90ffc2..b13c8a689ec 100644
--- a/src/renderer/src/components/automations/use-automations-page-list-state.ts
+++ b/src/renderer/src/components/automations/use-automations-page-list-state.ts
@@ -4,9 +4,12 @@ import { buildExternalAutomationListEntries } from './external-automation-list-e
 import { externalAutomationScopeEntries } from './external-automation-scope-gating'
 import { externalAutomationUncheckedNotice } from './external-automation-unchecked-hosts'
 import {
+  buildAutomationListViewItems,
   filterAutomationListRows,
-  filterExternalAutomationListEntries
+  filterExternalAutomationListEntries,
+  sortAutomationListViewItems
 } from './automation-list-view'
+import { getIntlLocale } from '@/i18n/i18n'
 import { unscopedAutomationListRows } from './automation-list-row-identity'
 import { useAutomationHostCatalog } from './use-automation-host-catalog'
 import { useAutomationListSearch } from './use-automation-list-search'
@@ -28,6 +31,7 @@ export function useAutomationsPageListState({
     failedAuthorityKeys,
     listSearchQuery,
     listFilter,
+    listSort,
     selectedRowKey,
     selectedExternalKey,
     selectedAutomationRuns,
@@ -129,6 +133,21 @@ export function useAutomationsPageListState({
     () => externalAutomationUncheckedNotice(scopedExternal.failures, hostCatalog.entries),
     [hostCatalog.entries, scopedExternal.failures]
   )
+  // Why: a language switch changes collation without touching rows, so the locale
+  // has to reach the memo as a value.
+  const sortLocale = getIntlLocale()
+  const sortedListItems = useMemo(
+    () =>
+      sortAutomationListViewItems(
+        buildAutomationListViewItems({
+          rows: filteredRows,
+          externalEntries: filteredExternalAutomationEntries
+        }),
+        listSort,
+        sortLocale
+      ),
+    [filteredExternalAutomationEntries, filteredRows, listSort, sortLocale]
+  )
 
   return {
     hostCatalog,
@@ -146,6 +165,7 @@ export function useAutomationsPageListState({
     isListSearchQueryTooLarge,
     filteredRows,
     filteredExternalAutomationEntries,
+    sortedListItems,
     hasListItems,
     hasFilteredListItems,
     searchCounts,
diff --git a/src/renderer/src/components/automations/use-automations-page-local-state.ts b/src/renderer/src/components/automations/use-automations-page-local-state.ts
index e92f666cb22..7a097b144c3 100644
--- a/src/renderer/src/components/automations/use-automations-page-local-state.ts
+++ b/src/renderer/src/components/automations/use-automations-page-local-state.ts
@@ -12,7 +12,11 @@ import type { AutomationActionNotice } from './automation-row-action-dispatch'
 import type { AutomationHostCatalogEntry } from './automation-host-catalog-types'
 import type { AutomationCreateDestination } from './automation-create-destination'
 import type { AutomationListRow } from './automation-list-row-identity'
-import { EMPTY_AUTOMATION_LIST_FILTER, type AutomationListFilter } from './automation-list-view'
+import {
+  EMPTY_AUTOMATION_LIST_FILTER,
+  type AutomationListFilter,
+  type AutomationListSort
+} from './automation-list-view'
 import type {
   AutomationPaneTab,
   AutomationRunPageOrigin,
@@ -54,6 +58,7 @@ export function useAutomationsPageLocalState(store: AutomationsPageStoreState) {
   const [isSaving, setIsSaving] = useState(false)
   const [listSearchQuery, setListSearchQuery] = useState('')
   const [listFilter, setListFilter] = useState<AutomationListFilter>(EMPTY_AUTOMATION_LIST_FILTER)
+  const [listSort, setListSort] = useState<AutomationListSort | null>(null)
   const [createOpen, setCreateOpen] = useState(false)
   const [createTarget, setCreateTarget] = useState<AutomationCreateTarget>('orca')
   const [editingAutomationId, setEditingAutomationId] = useState<string | null>(null)
@@ -178,6 +183,8 @@ export function useAutomationsPageLocalState(store: AutomationsPageStoreState) {
     setListSearchQuery,
     listFilter,
     setListFilter,
+    listSort,
+    setListSort,
     createOpen,
     setCreateOpen,
     createTarget,
diff --git a/src/renderer/src/components/browser-favicon.test.tsx b/src/renderer/src/components/browser-favicon.test.tsx
new file mode 100644
index 00000000000..991f71807d7
--- /dev/null
+++ b/src/renderer/src/components/browser-favicon.test.tsx
@@ -0,0 +1,59 @@
+// @vitest-environment happy-dom
+import { createElement } from 'react'
+import { cleanup, fireEvent, render } from '@testing-library/react'
+import { afterEach, expect, it } from 'vitest'
+import { BrowserFavicon } from './browser-favicon'
+
+afterEach(cleanup)
+
+const faviconUrl = 'https://example.test/favicon.ico'
+const icon = (loading = false, url: string | null = faviconUrl) =>
+  createElement(BrowserFavicon, { faviconUrl: url, loading })
+
+it('retries a failed icon after a same-origin reload completes', () => {
+  const view = render(icon())
+  fireEvent.error(view.container.querySelector('img')!)
+  expect(view.container.querySelector('img')).toBeNull()
+  view.rerender(icon(true))
+  expect(view.container.querySelector('img')).toBeNull()
+  view.rerender(icon(false))
+  expect(view.container.querySelector('img')?.getAttribute('src')).toBe(faviconUrl)
+
+  fireEvent.error(view.container.querySelector('img')!)
+  view.rerender(icon(false))
+  expect(view.container.querySelector('img')).toBeNull()
+  view.rerender(icon(true))
+  view.rerender(icon(false))
+  expect(view.container.querySelector('img')).not.toBeNull()
+})
+
+it('shows a loading spinner throughout a reload', () => {
+  const view = render(icon())
+  view.rerender(icon(true))
+  expect(view.container.querySelector('img')).toBeNull()
+  expect(view.container.firstElementChild?.getAttribute('class')).toContain(
+    'motion-safe:animate-spin'
+  )
+  view.rerender(icon(false))
+  expect(view.container.querySelector('img')?.getAttribute('src')).toBe(faviconUrl)
+})
+
+it('shows the favicon when initial loading finishes', () => {
+  const view = render(icon(true))
+  expect(view.container.querySelector('img')).toBeNull()
+  view.rerender(icon(false))
+  expect(view.container.querySelector('img')).not.toBeNull()
+})
+
+it('still resets failures when the favicon URL changes or clears', () => {
+  const view = render(icon())
+  fireEvent.error(view.container.querySelector('img')!)
+  view.rerender(icon(false, null))
+  view.rerender(icon())
+  expect(view.container.querySelector('img')).not.toBeNull()
+  fireEvent.error(view.container.querySelector('img')!)
+  view.rerender(icon(false, 'https://other.test/favicon.ico'))
+  expect(view.container.querySelector('img')?.getAttribute('src')).toBe(
+    'https://other.test/favicon.ico'
+  )
+})
diff --git a/src/renderer/src/components/browser-favicon.tsx b/src/renderer/src/components/browser-favicon.tsx
index ecde4065f03..b2e8b43b7a0 100644
--- a/src/renderer/src/components/browser-favicon.tsx
+++ b/src/renderer/src/components/browser-favicon.tsx
@@ -1,34 +1,30 @@
 import { useState } from 'react'
-import { Globe } from 'lucide-react'
+import { Globe, Loader2 } from 'lucide-react'
 import { cn } from '@/lib/utils'
-
-function displayableFaviconUrl(faviconUrl: string | null | undefined): string | null {
-  const trimmed = faviconUrl?.trim()
-  if (!trimmed) {
-    return null
-  }
-  if (trimmed.startsWith('data:image/')) {
-    return trimmed
-  }
-  try {
-    const url = new URL(trimmed)
-    return url.protocol === 'http:' || url.protocol === 'https:' ? trimmed : null
-  } catch {
-    return null
-  }
-}
+import { displayableFaviconUrl } from './browser-pane/describe-page/browser-favicon-url'
 
 export function BrowserFavicon({
   faviconUrl,
+  loading = false,
   className,
   fallbackClassName
 }: {
   faviconUrl: string | null | undefined
+  loading?: boolean
   className?: string
   fallbackClassName?: string
 }): React.JSX.Element {
   const displayUrl = displayableFaviconUrl(faviconUrl)
   const [failedUrl, setFailedUrl] = useState<string | null>(null)
+  const [previousLoading, setPreviousLoading] = useState(loading)
+
+  // Retry after navigation settles, when cookies and connectivity may have recovered.
+  if (previousLoading !== loading) {
+    setPreviousLoading(loading)
+    if (!loading) {
+      setFailedUrl(null)
+    }
+  }
 
   // Why: reset during render on any favicon identity change — including a clear to null while
   // a page loads — so navigating back to the same url retries instead of keeping the fallback.
@@ -36,6 +32,15 @@ export function BrowserFavicon({
     setFailedUrl(null)
   }
 
+  if (loading) {
+    return (
+      <Loader2
+        className={cn('shrink-0 motion-safe:animate-spin', className, fallbackClassName)}
+        aria-hidden="true"
+      />
+    )
+  }
+
   if (displayUrl && failedUrl !== displayUrl) {
     return (
       <img
diff --git a/src/renderer/src/components/browser-pane/ClientHostedBrowserPagePane.dead-guest.test.tsx b/src/renderer/src/components/browser-pane/ClientHostedBrowserPagePane.dead-guest.test.tsx
new file mode 100644
index 00000000000..f2fd2ad533b
--- /dev/null
+++ b/src/renderer/src/components/browser-pane/ClientHostedBrowserPagePane.dead-guest.test.tsx
@@ -0,0 +1,310 @@
+// @vitest-environment happy-dom
+import { act, cleanup, render, screen } from '@testing-library/react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { BrowserPage } from '../../../../shared/browser-workspace-types'
+
+const mocks = vi.hoisted(() => ({
+  attach: vi.fn(),
+  detach: vi.fn(),
+  recordBreadcrumb: vi.fn()
+}))
+
+vi.mock('./browser-client-page-renderer-installation', () => ({
+  attachBrowserClientPageToViewport: mocks.attach
+}))
+vi.mock('@/lib/crash-breadcrumb-recorder', () => ({
+  recordRendererCrashBreadcrumb: mocks.recordBreadcrumb
+}))
+vi.mock('sonner', () => ({
+  toast: { error: vi.fn(), success: vi.fn(), loading: vi.fn(), message: vi.fn() }
+}))
+
+import { TooltipProvider } from '@/components/ui/tooltip'
+import { installClientHostedPaneApi } from './client-hosted-browser-pane-test-rig'
+import { ClientHostedBrowserPagePane } from './ClientHostedBrowserPagePane'
+
+const PLACEMENT = {
+  kind: 'client' as const,
+  browserHostClientId: 'host-a',
+  browserHostGeneration: 3,
+  pageHostGeneration: 7
+}
+
+/** Verbatim from Electron 43.4.1: main destroyed the guest, the tag still holds its id. */
+function invalidGuestInstanceId(): Error {
+  return new Error('Invalid guestInstanceId: 7')
+}
+
+/** Verbatim from Electron 43.4.1: focus() after the retained tag left the DOM. */
+function nullContentWindowFocus(): TypeError {
+  return new TypeError("Cannot read properties of null (reading 'focus')")
+}
+
+function page(overrides?: Partial<BrowserPage>): BrowserPage {
+  return {
+    id: 'page-a',
+    workspaceId: 'workspace-a',
+    worktreeId: 'worktree-a',
+    url: 'https://example.internal/',
+    title: 'Example',
+    loading: false,
+    faviconUrl: null,
+    canGoBack: false,
+    canGoForward: false,
+    loadError: null,
+    createdAt: 1,
+    ...overrides
+  }
+}
+
+function createGuest(): Electron.WebviewTag & {
+  getURL: ReturnType<typeof vi.fn>
+  reload: ReturnType<typeof vi.fn>
+} {
+  const webview = document.createElement('webview') as Electron.WebviewTag & {
+    getURL: ReturnType<typeof vi.fn>
+    reload: ReturnType<typeof vi.fn>
+  }
+  Object.assign(webview, {
+    getURL: vi.fn(() => 'https://example.internal/'),
+    getTitle: vi.fn(() => 'Example'),
+    isLoading: vi.fn(() => false),
+    canGoBack: vi.fn(() => false),
+    canGoForward: vi.fn(() => false),
+    focus: vi.fn(),
+    blur: vi.fn(),
+    goBack: vi.fn(),
+    goForward: vi.fn(),
+    reload: vi.fn(),
+    loadURL: vi.fn(async () => {})
+  })
+  mocks.attach.mockReturnValue({
+    webview,
+    detach: mocks.detach,
+    nextMetadataRevision: vi.fn(() => 1)
+  })
+  return webview
+}
+
+function paneElement(
+  isActive: boolean,
+  options?: { browserTab?: BrowserPage; onUpdatePageState?: (id: string, state: unknown) => void }
+): React.JSX.Element {
+  return (
+    <TooltipProvider>
+      <ClientHostedBrowserPagePane
+        browserTab={options?.browserTab ?? page()}
+        workspaceId="workspace-a"
+        chromeShortcutScope="focused"
+        runtimeEnvironmentId="environment-a"
+        worktreeId="worktree-a"
+        placement={PLACEMENT}
+        isActive={isActive}
+        onUpdatePageState={options?.onUpdatePageState ?? vi.fn()}
+        onSetUrl={vi.fn()}
+      />
+    </TooltipProvider>
+  )
+}
+
+let webview: ReturnType<typeof createGuest>
+
+beforeEach(() => {
+  mocks.attach.mockReset()
+  mocks.detach.mockReset()
+  mocks.recordBreadcrumb.mockReset()
+  installClientHostedPaneApi()
+  webview = createGuest()
+})
+
+afterEach(() => {
+  cleanup()
+  vi.clearAllMocks()
+})
+
+describe('client-hosted browser pane over a dead guest', () => {
+  it('degrades to the unavailable notice when the guest was destroyed in main', () => {
+    webview.getURL.mockImplementation(() => {
+      throw invalidGuestInstanceId()
+    })
+
+    expect(() => render(paneElement(true))).not.toThrow()
+    expect(screen.getByText('Client-hosted browser unavailable')).toBeTruthy()
+    expect(mocks.detach).toHaveBeenCalled()
+    expect(mocks.recordBreadcrumb).toHaveBeenCalledWith('browser_client_page_guest_unavailable', {
+      browserPageId: 'page-a',
+      pageHostGeneration: PLACEMENT.pageHostGeneration,
+      reason: 'unreadable',
+      tagConnected: false
+    })
+    // Why: the catch is total, so the swallowed error must stay visible to diagnostics.
+    expect(mocks.recordBreadcrumb).toHaveBeenCalledWith('browser_client_page_guest_read_failed', {
+      errorName: 'Error',
+      errorMessage: 'Invalid guestInstanceId: 7'
+    })
+  })
+
+  it('stops the spinner it inherited from a page that died mid-load', () => {
+    webview.getURL.mockImplementation(() => {
+      throw invalidGuestInstanceId()
+    })
+    const onUpdatePageState = vi.fn()
+
+    render(paneElement(true, { browserTab: page({ loading: true }), onUpdatePageState }))
+
+    expect(onUpdatePageState).toHaveBeenCalledWith('page-a', { loading: false })
+  })
+
+  it('flips to the unavailable notice when the guest renderer goes away after attach', () => {
+    const onUpdatePageState = vi.fn()
+    render(paneElement(true, { browserTab: page({ loading: true }), onUpdatePageState }))
+    expect(screen.queryByText('Client-hosted browser unavailable')).toBeNull()
+    onUpdatePageState.mockClear()
+
+    // The registry pulls the tag out of the DOM on this event without telling the pane.
+    webview.remove()
+    act(() => {
+      webview.dispatchEvent(new Event('render-process-gone'))
+    })
+
+    expect(screen.getByText('Client-hosted browser unavailable')).toBeTruthy()
+    expect(mocks.detach).toHaveBeenCalled()
+    expect(onUpdatePageState).toHaveBeenCalledWith('page-a', { loading: false })
+    expect(mocks.recordBreadcrumb).toHaveBeenCalledWith('browser_client_page_guest_unavailable', {
+      browserPageId: 'page-a',
+      pageHostGeneration: PLACEMENT.pageHostGeneration,
+      reason: 'render-process-gone',
+      tagConnected: false
+    })
+  })
+
+  it('flips to the unavailable notice when main destroys the guest after attach', () => {
+    render(paneElement(true))
+
+    act(() => {
+      webview.dispatchEvent(new Event('destroyed'))
+    })
+
+    expect(screen.getByText('Client-hosted browser unavailable')).toBeTruthy()
+    expect(mocks.recordBreadcrumb).toHaveBeenCalledWith(
+      'browser_client_page_guest_unavailable',
+      expect.objectContaining({ reason: 'destroyed' })
+    )
+    // The chrome must not keep driving the dead tag: Reload routes to the notice, not a throw.
+    webview.reload.mockImplementation(() => {
+      throw invalidGuestInstanceId()
+    })
+    expect(() => act(() => screen.getByRole('button', { name: 'Reload' }).click())).not.toThrow()
+    expect(webview.reload).not.toHaveBeenCalled()
+  })
+
+  it('does not freeze silently when a navigation event finds the guest gone', () => {
+    const onUpdatePageState = vi.fn()
+    render(paneElement(true, { onUpdatePageState }))
+    onUpdatePageState.mockClear()
+    webview.getURL.mockImplementation(() => {
+      throw invalidGuestInstanceId()
+    })
+
+    act(() => {
+      webview.dispatchEvent(new Event('did-navigate'))
+    })
+
+    expect(screen.getByText('Client-hosted browser unavailable')).toBeTruthy()
+    expect(onUpdatePageState).toHaveBeenCalledWith('page-a', { loading: false })
+  })
+
+  it('stops the spinner when the guest dies as a load starts', () => {
+    const onUpdatePageState = vi.fn()
+    render(paneElement(true, { onUpdatePageState }))
+    onUpdatePageState.mockClear()
+    webview.getURL.mockImplementation(() => {
+      throw invalidGuestInstanceId()
+    })
+
+    act(() => {
+      webview.dispatchEvent(new Event('did-start-loading'))
+    })
+
+    expect(screen.getByText('Client-hosted browser unavailable')).toBeTruthy()
+    // did-start-loading writes loading:true first; the loss must be the last word.
+    expect(onUpdatePageState.mock.calls.at(-1)).toEqual(['page-a', { loading: false }])
+  })
+
+  it('ignores queued load events after guest loss', () => {
+    const onUpdatePageState = vi.fn()
+    render(paneElement(true, { onUpdatePageState }))
+    act(() => webview.dispatchEvent(new Event('destroyed')))
+    onUpdatePageState.mockClear()
+
+    act(() => webview.dispatchEvent(new Event('did-start-loading')))
+
+    expect(onUpdatePageState).not.toHaveBeenCalled()
+    expect(screen.getByText('Client-hosted browser unavailable')).toBeTruthy()
+  })
+
+  it('uses the guarded title snapshot if the guest dies immediately afterward', () => {
+    render(paneElement(true))
+    webview.getTitle = vi.fn(() => {
+      webview.getTitle = vi.fn(() => {
+        throw invalidGuestInstanceId()
+      })
+      return 'Last live title'
+    })
+
+    expect(() => act(() => webview.dispatchEvent(new Event('did-navigate')))).not.toThrow()
+    expect(webview.getTitle).not.toHaveBeenCalled()
+  })
+
+  it('shows unavailability when a load-failure fallback finds the guest gone', () => {
+    const onUpdatePageState = vi.fn()
+    render(paneElement(true, { onUpdatePageState }))
+    webview.getURL.mockImplementation(() => {
+      throw invalidGuestInstanceId()
+    })
+
+    act(() => webview.dispatchEvent(new Event('did-fail-load')))
+
+    expect(screen.getByText('Client-hosted browser unavailable')).toBeTruthy()
+    expect(onUpdatePageState.mock.calls.at(-1)).toEqual(['page-a', { loading: false }])
+  })
+
+  it('removes loss listeners when the initial guest read fails', () => {
+    const removeListener = vi.spyOn(webview, 'removeEventListener')
+    webview.getURL.mockImplementation(() => {
+      throw invalidGuestInstanceId()
+    })
+
+    render(paneElement(true))
+
+    expect(removeListener).toHaveBeenCalledWith('destroyed', expect.any(Function))
+    expect(removeListener).toHaveBeenCalledWith('render-process-gone', expect.any(Function))
+  })
+
+  it('stops listening for guest loss once the pane lets go of the tag', () => {
+    const onUpdatePageState = vi.fn()
+    const view = render(paneElement(true, { onUpdatePageState }))
+    view.unmount()
+    onUpdatePageState.mockClear()
+    mocks.recordBreadcrumb.mockClear()
+
+    webview.dispatchEvent(new Event('destroyed'))
+
+    expect(onUpdatePageState).not.toHaveBeenCalled()
+    expect(mocks.recordBreadcrumb).not.toHaveBeenCalled()
+  })
+
+  it('survives activation focus after the retained tag left the DOM', () => {
+    const view = render(paneElement(false))
+    webview.focus = vi.fn(() => {
+      throw nullContentWindowFocus()
+    })
+
+    expect(() =>
+      act(() => {
+        view.rerender(paneElement(true))
+      })
+    ).not.toThrow()
+    expect(webview.focus).toHaveBeenCalled()
+  })
+})
diff --git a/src/renderer/src/components/browser-pane/ClientHostedBrowserPagePane.popup-notices.test.tsx b/src/renderer/src/components/browser-pane/ClientHostedBrowserPagePane.popup-notices.test.tsx
index 779c33a751a..80762dcb87f 100644
--- a/src/renderer/src/components/browser-pane/ClientHostedBrowserPagePane.popup-notices.test.tsx
+++ b/src/renderer/src/components/browser-pane/ClientHostedBrowserPagePane.popup-notices.test.tsx
@@ -99,21 +99,13 @@ describe('ClientHostedBrowserPagePane popup notices', () => {
     expect(new Set(ids).size).toBe(1)
   })
 
-  // Why: the local pane reports all three outcomes; only "blocked" reaching this pane left a page
-  // that silently opened somewhere else looking like it did nothing.
-  it('reports where a popup Orca did open actually went', () => {
+  it('silences in-Orca opens but reports external opens', () => {
     renderPane()
 
     emitPopup({ action: 'opened-in-orca' })
+    expect(toastMocks.message).not.toHaveBeenCalled()
     emitPopup({ action: 'opened-external' })
-
-    expect(toastMocks.message).toHaveBeenNthCalledWith(
-      1,
-      'https://accounts.example.com opened a new page in Orca.',
-      { id: 'browser-popup:page-a:opened-in-orca:https://accounts.example.com' }
-    )
-    expect(toastMocks.message).toHaveBeenNthCalledWith(
-      2,
+    expect(toastMocks.message).toHaveBeenCalledExactlyOnceWith(
       'https://accounts.example.com opened a new window in your default browser.',
       { id: 'browser-popup:page-a:opened-external:https://accounts.example.com' }
     )
diff --git a/src/renderer/src/components/browser-pane/ClientHostedBrowserPagePane.tsx b/src/renderer/src/components/browser-pane/ClientHostedBrowserPagePane.tsx
index f4f698f516b..349886a570f 100644
--- a/src/renderer/src/components/browser-pane/ClientHostedBrowserPagePane.tsx
+++ b/src/renderer/src/components/browser-pane/ClientHostedBrowserPagePane.tsx
@@ -7,7 +7,10 @@ import type {
 } from '../../../../shared/browser-workspace-types'
 import { toHttpsRecoveryUrl } from '../../../../shared/browser-url'
 import type { RuntimeBrowserClientPlacement } from '../../../../shared/runtime-browser-placement'
-import { readBrowserClientPageGuestMetadata } from './browser-client-page-guest-metadata'
+import {
+  readBrowserClientPageGuestMetadataIfLive,
+  createBrowserClientPageLoadFailureHandler
+} from './browser-client-page-guest-metadata'
 import {
   forgetBrowserClientPageMetadataReports,
   startBrowserClientPageMetadataPublisher
@@ -18,6 +21,7 @@ import { useBrowserClientHostedPopupNotices } from './browser-client-hosted-popu
 import { useBrowserClientHostedPermissionNotices } from './browser-client-hosted-permission-notices'
 import { useClientHostedBrowserIntroTour } from './use-client-hosted-browser-intro-tour'
 import { ClientHostedBrowserUnavailableNotice } from './client-hosted-browser-unavailable-notice'
+import { watchBrowserClientPageGuestLoss } from './host-guest/browser-client-page-guest-loss'
 import { useRestoredClientHostedRecoveryWindow } from './restored-client-hosted-recovery-window'
 import BrowserFind from './assemble-chrome/BrowserFind'
 import { BrowserNavigationControlRow } from './assemble-chrome/browser-navigation-control-row'
@@ -36,7 +40,6 @@ import { BrowserLoadFailureOverlay } from './navigate/browser-load-failure-overl
 import { useClientHostedPageUrlSubmission } from './navigate/use-client-hosted-page-url-submission'
 import { convertBrowserPageToWorkspaceDoc } from '@/lib/file-preview'
 import { useBrowserPageReloadActions } from './navigate/use-browser-page-reload-actions'
-import { resolveBrowserWebviewLoadFailure } from './navigate/browser-webview-load-failure'
 import { resolveActiveBrowserLoadFailure } from './navigate/browser-load-failure-for-url'
 import { consumeBrowserPageDeferredNavigation } from './navigate/browser-page-deferred-navigation'
 import {
@@ -46,7 +49,6 @@ import {
 } from './describe-page/browser-page-url-display'
 import type {
   BrowserChromeShortcutScope,
-  BrowserPageFailLoadEvent,
   BrowserPageUrlSetter,
   BrowserTabPageState
 } from './describe-page/browser-page-types'
@@ -174,9 +176,7 @@ export function ClientHostedBrowserPagePane({
 
   useLayoutEffect(() => {
     const viewport = viewportRef.current
-    // Why: no placement means the host has not minted this page yet. Attaching would throw for an
-    // id the retained registry has never seen and strand the pane on the unavailable notice, whose
-    // only exit is reopening on the server — so mount quiet and wait for adoption to supply it.
+    // Wait for host adoption before attaching an optimistic page the registry has not seen.
     if (
       !viewport ||
       pageHostGeneration === null ||
@@ -200,6 +200,24 @@ export function ClientHostedBrowserPagePane({
       return
     }
     const webview = attachment.webview
+    // Guest loss uses the existing recovery notice and clears pending loading state.
+    let releaseGuest = (): void => attachment.detach()
+    const guestLoss = watchBrowserClientPageGuestLoss({
+      webview,
+      webviewRef,
+      browserPageId: browserTab.id,
+      pageHostGeneration,
+      onLost: () => {
+        releaseGuest()
+        retryGuestRecoveryRef.current()
+      }
+    })
+    // Main can destroy the guest while its tag still holds the stale id.
+    const attachedMetadata = readBrowserClientPageGuestMetadataIfLive(webview)
+    if (!attachedMetadata) {
+      guestLoss.lose('unreadable')
+      return guestLoss.dispose()
+    }
     const publisher = startBrowserClientPageMetadataPublisher({
       browserPageId: browserTab.id,
       environmentId: runtimeEnvironmentId,
@@ -213,23 +231,21 @@ export function ClientHostedBrowserPagePane({
     })
     webviewRef.current = webview
     setAttachmentError(null)
-    // Why: the failure carried in from the store is hearsay — this pane may be remounting over a
-    // guest that navigated on while nothing was listening — so it is checked once against where
-    // the guest actually is. Failures this session observes are trusted as they arrive, because a
-    // navigation that fails outright often never commits and leaves the guest on the old URL.
+    // Reconcile restored failures once; failed navigations this session may never commit a URL.
     activeLoadFailureRef.current = resolveActiveBrowserLoadFailure(
       activeLoadFailureRef.current,
-      readBrowserClientPageGuestMetadata(webview).url
+      attachedMetadata.url
     )
     const syncNavigation = (event?: Event): void => {
       const eventUrl = (event as (Event & { url?: string }) | undefined)?.url
-      const metadata = readBrowserClientPageGuestMetadata(webview, eventUrl)
-      // Why: did-stop-loading fires after did-fail-load, so an unconditional null here would
-      // wipe the failure the overlay is about to show.
+      const metadata = readBrowserClientPageGuestMetadataIfLive(webview, eventUrl)
+      if (!metadata) {
+        guestLoss.lose('unreadable')
+        return
+      }
+      // did-stop-loading must preserve the preceding did-fail-load overlay.
       const activeLoadFailure = activeLoadFailureRef.current
-      // Why: a URL write drops the page's certificate challenge by design (challenges are
-      // transient across navigation), so a standing failure must not run through one — the
-      // local pane returns before its own setUrl for the same reason.
+      // URL writes clear certificate challenges, so preserve them while a failure stands.
       if (!activeLoadFailure) {
         setUrlFromGuest(browserTab.id, metadata.url, {
           preserveLoadError: true
@@ -243,26 +259,41 @@ export function ClientHostedBrowserPagePane({
         loadError: activeLoadFailure
       })
       publisher.publish(metadata)
-      // Why: the address bar's suggestions read the client's shared URL history, so a page
-      // hosted here has to file its navigations there like a local guest does.
-      recordHistoryFromGuest(metadata.url, getBrowserDisplayTitle(webview.getTitle(), metadata.url))
+      // Address-bar suggestions use the client's URL history, including client-hosted pages.
+      recordHistoryFromGuest(metadata.url, getBrowserDisplayTitle(metadata.title, metadata.url))
       setAddressBarValueFromPage(toDisplayUrl(metadata.url))
     }
     const onStart = (): void => {
       activeLoadFailureRef.current = null
       updatePageStateFromGuest(browserTab.id, { loading: true, loadError: null })
-      publisher.publish(readBrowserClientPageGuestMetadata(webview, undefined, true))
-    }
-    const onFailLoad = (event: Event): void => {
-      const loadError = resolveBrowserWebviewLoadFailure(event as BrowserPageFailLoadEvent, {
-        fallbackUrl: webview.getURL()
-      })
-      if (!loadError) {
+      const startMetadata = readBrowserClientPageGuestMetadataIfLive(webview, undefined, true)
+      if (!startMetadata) {
+        guestLoss.lose('unreadable')
         return
       }
-      activeLoadFailureRef.current = loadError
-      updatePageStateFromGuest(browserTab.id, { loading: false, loadError })
+      publisher.publish(startMetadata)
     }
+    const onFailLoad = createBrowserClientPageLoadFailureHandler(
+      webview,
+      () => guestLoss.lose('unreadable'),
+      (loadError) => {
+        activeLoadFailureRef.current = loadError
+        updatePageStateFromGuest(browserTab.id, { loading: false, loadError })
+      }
+    )
+    const cleanupGuest = (): void => {
+      webview.removeEventListener('did-start-loading', onStart)
+      webview.removeEventListener('did-stop-loading', syncNavigation)
+      webview.removeEventListener('did-navigate', syncNavigation)
+      webview.removeEventListener('did-navigate-in-page', syncNavigation)
+      webview.removeEventListener('page-title-updated', syncNavigation)
+      webview.removeEventListener('did-fail-load', onFailLoad)
+      guestLoss.dispose()
+      publisher.dispose()
+      forgetBrowserClientPageMetadataReports(browserTab.id)
+      attachment.detach()
+    }
+    releaseGuest = cleanupGuest
     webview.addEventListener('did-start-loading', onStart)
     webview.addEventListener('did-stop-loading', syncNavigation)
     webview.addEventListener('did-navigate', syncNavigation)
@@ -270,26 +301,12 @@ export function ClientHostedBrowserPagePane({
     webview.addEventListener('page-title-updated', syncNavigation)
     webview.addEventListener('did-fail-load', onFailLoad)
     syncNavigation()
-    // Why: the user pressed Enter while this page was still an optimistic stage, so the navigation
-    // was parked rather than sent to a host page that did not exist yet. The guest exists now.
+    // Resume navigation submitted before host adoption.
     const deferredUrl = consumeBrowserPageDeferredNavigation(browserTab.id)
     if (deferredUrl) {
       runDeferredNavigation(deferredUrl)
     }
-    return () => {
-      webview.removeEventListener('did-start-loading', onStart)
-      webview.removeEventListener('did-stop-loading', syncNavigation)
-      webview.removeEventListener('did-navigate', syncNavigation)
-      webview.removeEventListener('did-navigate-in-page', syncNavigation)
-      webview.removeEventListener('page-title-updated', syncNavigation)
-      webview.removeEventListener('did-fail-load', onFailLoad)
-      if (webviewRef.current === webview) {
-        webviewRef.current = null
-      }
-      publisher.dispose()
-      forgetBrowserClientPageMetadataReports(browserTab.id)
-      attachment.detach()
-    }
+    return cleanupGuest
   }, [
     browserTab.id,
     browserHostClientId,
@@ -299,7 +316,7 @@ export function ClientHostedBrowserPagePane({
     setAddressBarValueFromPage
   ])
 
-  useClientHostedGuestActivationFocus({ isActive, webviewRef, keepAddressBarFocusRef })
+  useClientHostedGuestActivationFocus({ isActive, guestFocus, keepAddressBarFocusRef })
 
   const showFailureOverlay = !attachmentError && Boolean(browserTab.loadError)
   // Why: the failure is about the URL that failed, not whatever page is still loaded — feeding
diff --git a/src/renderer/src/components/browser-pane/assemble-chrome/BrowserPane.webview-preferences.test.ts b/src/renderer/src/components/browser-pane/assemble-chrome/BrowserPane.webview-preferences.test.ts
index 5e6dc77f67d..aff65e4eb3e 100644
--- a/src/renderer/src/components/browser-pane/assemble-chrome/BrowserPane.webview-preferences.test.ts
+++ b/src/renderer/src/components/browser-pane/assemble-chrome/BrowserPane.webview-preferences.test.ts
@@ -56,7 +56,7 @@ describe('BrowserPane webview preferences', () => {
       'persist:orca-browser-session-profile-1'
     )
     expect(ensuredWebview?.webview.getAttribute('webpreferences')).toBe(
-      ORCA_BROWSER_GUEST_WEB_PREFERENCES_ATTRIBUTE
+      `${ORCA_BROWSER_GUEST_WEB_PREFERENCES_ATTRIBUTE},transparent=false`
     )
     expect(registryMocks.registerPersistentWebview).toHaveBeenCalledWith(
       'browser-page-1',
diff --git a/src/renderer/src/components/browser-pane/assemble-chrome/browser-page-context-menu.tsx b/src/renderer/src/components/browser-pane/assemble-chrome/browser-page-context-menu.tsx
index e05ec8a62e8..345e77957c4 100644
--- a/src/renderer/src/components/browser-pane/assemble-chrome/browser-page-context-menu.tsx
+++ b/src/renderer/src/components/browser-pane/assemble-chrome/browser-page-context-menu.tsx
@@ -187,7 +187,8 @@ export function BrowserPageContextMenu({
               className={MENU_ITEM_CLASS}
               onClick={() => {
                 createBrowserTab(worktreeId, contextMenu.linkUrl!, {
-                  title: contextMenu.linkUrl!
+                  title: contextMenu.linkUrl!,
+                  activate: false
                 })
                 closeMenu()
               }}
diff --git a/src/renderer/src/components/browser-pane/browser-client-hosted-popup-notices.ts b/src/renderer/src/components/browser-pane/browser-client-hosted-popup-notices.ts
index 1894cae892f..510bbeec03e 100644
--- a/src/renderer/src/components/browser-pane/browser-client-hosted-popup-notices.ts
+++ b/src/renderer/src/components/browser-pane/browser-client-hosted-popup-notices.ts
@@ -2,18 +2,18 @@ import { useEffect } from 'react'
 import { toast } from 'sonner'
 import { formatPopupNotice } from './navigate/browser-notices'
 
-/**
- * A client-hosted page's popups are gesture-gated and capped, and every outcome — blocked, opened
- * in an Orca tab, or handed to the default browser — leaves no other trace on this pane. One quiet
- * toast per page and origin says what happened, without spamming a site that retries.
- */
+// Deduplicate blocked and external-popup notices per page and origin.
 export function useBrowserClientHostedPopupNotices(browserPageId: string): void {
   useEffect(() => {
     return window.api.browser.onPopup((event) => {
       if (event.browserPageId !== browserPageId) {
         return
       }
-      toast.message(formatPopupNotice(event), {
+      const notice = formatPopupNotice(event)
+      if (!notice) {
+        return
+      }
+      toast.message(notice, {
         id: `browser-popup:${browserPageId}:${event.action}:${event.origin}`
       })
     })
diff --git a/src/renderer/src/components/browser-pane/browser-client-page-guest-metadata.ts b/src/renderer/src/components/browser-pane/browser-client-page-guest-metadata.ts
index 5e4446f978a..93e62de4dd7 100644
--- a/src/renderer/src/components/browser-pane/browser-client-page-guest-metadata.ts
+++ b/src/renderer/src/components/browser-pane/browser-client-page-guest-metadata.ts
@@ -1,24 +1,67 @@
+import type { BrowserLoadError } from '../../../../shared/browser-workspace-types'
+import type { BrowserPageFailLoadEvent } from './describe-page/browser-page-types'
+import { resolveBrowserWebviewLoadFailure } from './navigate/browser-webview-load-failure'
+import { recordRendererCrashBreadcrumb } from '@/lib/crash-breadcrumb-recorder'
 import { redactKagiSessionToken } from '../../../../shared/browser-url'
 import type { BrowserClientPageMetadataSnapshot } from './browser-client-page-metadata-publisher'
 
 /**
- * What a client-hosted guest currently is, read straight off the webview.
+ * What a client-hosted guest currently is, read straight off the webview, or null once the tag
+ * can no longer reach its guest.
  *
  * `eventUrl` wins when a navigation event carries one: the tag's own getURL() can still report the
  * previous page while the event is being delivered. `loading` is forced for did-start-loading,
  * which fires before isLoading() flips.
+ *
+ * Why total rather than throwing: a guest destroyed in main leaves the tag holding its id, so
+ * every method on it throws `Invalid guestInstanceId` from then on — and every caller reads from
+ * a React effect, where that unwinds the whole workbench error boundary.
  */
-export function readBrowserClientPageGuestMetadata(
+export function readBrowserClientPageGuestMetadataIfLive(
   webview: Electron.WebviewTag,
   eventUrl?: string,
   loading?: boolean
-): BrowserClientPageMetadataSnapshot {
-  const url = redactKagiSessionToken(eventUrl || webview.getURL() || 'about:blank')
-  return {
-    url,
-    title: webview.getTitle() || url || 'Browser',
-    loading: loading ?? webview.isLoading(),
-    canGoBack: webview.canGoBack(),
-    canGoForward: webview.canGoForward()
+): BrowserClientPageMetadataSnapshot | null {
+  try {
+    const url = redactKagiSessionToken(eventUrl || webview.getURL() || 'about:blank')
+    return {
+      url,
+      title: webview.getTitle() || url || 'Browser',
+      loading: loading ?? webview.isLoading(),
+      canGoBack: webview.canGoBack(),
+      canGoForward: webview.canGoForward()
+    }
+  } catch (error) {
+    // Why recorded: the catch is total, so a read failure that is NOT guest death would otherwise
+    // be indistinguishable from one — the breadcrumb carries the error text the console cannot.
+    console.warn('[browser-client-page] guest read failed, treating the page as gone:', error)
+    recordRendererCrashBreadcrumb('browser_client_page_guest_read_failed', {
+      errorName: error instanceof Error ? error.name : typeof error,
+      errorMessage: error instanceof Error ? error.message : String(error)
+    })
+    return null
+  }
+}
+
+export function createBrowserClientPageLoadFailureHandler(
+  webview: Electron.WebviewTag,
+  onUnavailable: () => void,
+  onFailure: (error: BrowserLoadError) => void
+): (event: Event) => void {
+  return (event) => {
+    let guestUnavailable = false
+    const loadError = resolveBrowserWebviewLoadFailure(event as BrowserPageFailLoadEvent, {
+      // Discarded ERR_ABORTED/subframe events must not read the guest.
+      fallbackUrl: () => {
+        const metadata = readBrowserClientPageGuestMetadataIfLive(webview)
+        guestUnavailable = metadata === null
+        return metadata?.url ?? null
+      }
+    })
+    if (guestUnavailable) {
+      onUnavailable()
+    } else if (loadError) {
+      onFailure(loadError)
+    }
   }
 }
diff --git a/src/renderer/src/components/browser-pane/describe-page/browser-favicon-url.test.ts b/src/renderer/src/components/browser-pane/describe-page/browser-favicon-url.test.ts
new file mode 100644
index 00000000000..4c295309174
--- /dev/null
+++ b/src/renderer/src/components/browser-pane/describe-page/browser-favicon-url.test.ts
@@ -0,0 +1,90 @@
+import { describe, expect, it } from 'vitest'
+import {
+  browserNavigationLeavesFaviconOrigin,
+  displayableFaviconUrl,
+  pickDisplayableFaviconUrl
+} from './browser-favicon-url'
+
+describe('displayableFaviconUrl', () => {
+  it('accepts http, https and image data urls', () => {
+    expect(displayableFaviconUrl('https://github.com/favicon.ico')).toBe(
+      'https://github.com/favicon.ico'
+    )
+    expect(displayableFaviconUrl('http://127.0.0.1:8765/favicon.ico')).toBe(
+      'http://127.0.0.1:8765/favicon.ico'
+    )
+    expect(displayableFaviconUrl('  data:image/png;base64,AAAA  ')).toBe(
+      'data:image/png;base64,AAAA'
+    )
+  })
+
+  it('rejects the empty-icon sentinel and non-web schemes', () => {
+    expect(displayableFaviconUrl('data:,')).toBeNull()
+    expect(displayableFaviconUrl('chrome-extension://abc/icon.png')).toBeNull()
+    expect(displayableFaviconUrl('file:///tmp/icon.png')).toBeNull()
+    expect(displayableFaviconUrl('not a url')).toBeNull()
+    expect(displayableFaviconUrl(null)).toBeNull()
+    expect(displayableFaviconUrl('   ')).toBeNull()
+  })
+})
+
+describe('pickDisplayableFaviconUrl', () => {
+  it('skips leading entries that cannot render', () => {
+    expect(pickDisplayableFaviconUrl(['data:,', 'https://example.com/icon.png'])).toBe(
+      'https://example.com/icon.png'
+    )
+  })
+
+  it('keeps the declaration order among usable entries', () => {
+    expect(
+      pickDisplayableFaviconUrl([
+        'https://github.githubassets.com/favicons/favicon.png',
+        'https://github.githubassets.com/favicons/favicon.svg'
+      ])
+    ).toBe('https://github.githubassets.com/favicons/favicon.png')
+  })
+
+  it('reports nothing for an absent or unusable list', () => {
+    expect(pickDisplayableFaviconUrl(undefined)).toBeNull()
+    expect(pickDisplayableFaviconUrl([])).toBeNull()
+    expect(pickDisplayableFaviconUrl(['data:,'])).toBeNull()
+  })
+})
+
+describe('browserNavigationLeavesFaviconOrigin', () => {
+  it('keeps the icon across a same-origin navigation', () => {
+    expect(
+      browserNavigationLeavesFaviconOrigin(
+        'https://github.com/alibaba/jvm-sandbox',
+        'https://github.com/btraceio/btrace'
+      )
+    ).toBe(false)
+  })
+
+  it('drops the icon when the origin changes', () => {
+    expect(
+      browserNavigationLeavesFaviconOrigin('https://github.com/nodejs/node', 'https://x.com/home')
+    ).toBe(true)
+  })
+
+  it('treats scheme and port as part of the origin', () => {
+    expect(
+      browserNavigationLeavesFaviconOrigin('http://localhost:3000/', 'http://localhost:4000/')
+    ).toBe(true)
+    expect(
+      browserNavigationLeavesFaviconOrigin('http://example.com/', 'https://example.com/')
+    ).toBe(true)
+  })
+
+  it('drops the icon when the destination cannot carry one', () => {
+    expect(browserNavigationLeavesFaviconOrigin('https://github.com/', 'about:blank')).toBe(true)
+    expect(
+      browserNavigationLeavesFaviconOrigin('https://github.com/', 'file:///tmp/report.html')
+    ).toBe(true)
+  })
+
+  it('keeps the icon when the document being left is unknown', () => {
+    expect(browserNavigationLeavesFaviconOrigin(null, 'https://github.com/nodejs/node')).toBe(false)
+    expect(browserNavigationLeavesFaviconOrigin('about:blank', 'https://github.com/')).toBe(false)
+  })
+})
diff --git a/src/renderer/src/components/browser-pane/describe-page/browser-favicon-url.ts b/src/renderer/src/components/browser-pane/describe-page/browser-favicon-url.ts
new file mode 100644
index 00000000000..8e1c442068d
--- /dev/null
+++ b/src/renderer/src/components/browser-pane/describe-page/browser-favicon-url.ts
@@ -0,0 +1,63 @@
+// Why this lives apart from the <img>: Chromium only emits `page-favicon-updated` when a document's
+// icon URL list *changes*, so both the chrome that renders an icon and the guest listeners that
+// decide when to drop one have to agree on what counts as a usable icon and as a new site.
+
+export function displayableFaviconUrl(faviconUrl: string | null | undefined): string | null {
+  const trimmed = faviconUrl?.trim()
+  if (!trimmed) {
+    return null
+  }
+  // Why not a plain `data:` check: Chromium reports `data:,` for a page that declares no icon.
+  if (trimmed.startsWith('data:image/')) {
+    return trimmed
+  }
+  try {
+    const url = new URL(trimmed)
+    return url.protocol === 'http:' || url.protocol === 'https:' ? trimmed : null
+  } catch {
+    return null
+  }
+}
+
+export function pickDisplayableFaviconUrl(favicons: readonly string[] | undefined): string | null {
+  // Why not favicons[0]: the first entry can be a `data:,` sentinel or a non-web scheme while a
+  // later entry is a real icon.
+  for (const candidate of favicons ?? []) {
+    const displayable = displayableFaviconUrl(candidate)
+    if (displayable) {
+      return displayable
+    }
+  }
+  return null
+}
+
+function faviconOrigin(rawUrl: string | null | undefined): string | null {
+  if (!rawUrl) {
+    return null
+  }
+  try {
+    const url = new URL(rawUrl)
+    return url.protocol === 'http:' || url.protocol === 'https:' ? url.origin : null
+  } catch {
+    return null
+  }
+}
+
+// Why the two sides are treated asymmetrically: a destination with no icon of its own (about:blank,
+// file://, a doc preview) must drop the previous site's icon, but an unknown *origin* — a freshly
+// attached guest that hasn't committed a document yet — is not evidence the icon is stale, and
+// clearing there would strand a restored tab on the globe until its first paint.
+export function browserNavigationLeavesFaviconOrigin(
+  fromUrl: string | null | undefined,
+  toUrl: string | null | undefined
+): boolean {
+  const to = faviconOrigin(toUrl)
+  if (to === null) {
+    return true
+  }
+  const from = faviconOrigin(fromUrl)
+  if (from === null) {
+    return false
+  }
+  return from !== to
+}
diff --git a/src/renderer/src/components/browser-pane/host-guest/bind-browser-page-webview-listeners.ts b/src/renderer/src/components/browser-pane/host-guest/bind-browser-page-webview-listeners.ts
index e80409fa821..f8699324889 100644
--- a/src/renderer/src/components/browser-pane/host-guest/bind-browser-page-webview-listeners.ts
+++ b/src/renderer/src/components/browser-pane/host-guest/bind-browser-page-webview-listeners.ts
@@ -116,6 +116,7 @@ export function bindBrowserPageWebviewListeners({
 
   const {
     handleDidStartNavigation,
+    handleDidRedirectNavigation,
     handleFullDidNavigate,
     handleDidNavigateInPage,
     handleTitleUpdate,
@@ -149,6 +150,7 @@ export function bindBrowserPageWebviewListeners({
   webview.addEventListener('focus', dismissAddressBarSuggestions)
   webview.addEventListener('did-start-loading', handleDidStartLoading)
   webview.addEventListener('did-start-navigation', handleDidStartNavigation)
+  webview.addEventListener('did-redirect-navigation', handleDidRedirectNavigation)
   webview.addEventListener('did-stop-loading', handleDidStopLoading)
   // Why: close find only on full 'did-navigate', not the shared handler, which also fires on SPA in-page hash/pushState changes.
   const handleFindCloseOnNavigate = (): void => {
@@ -186,6 +188,7 @@ export function bindBrowserPageWebviewListeners({
     webview.removeEventListener('focus', dismissAddressBarSuggestions)
     webview.removeEventListener('did-start-loading', handleDidStartLoading)
     webview.removeEventListener('did-start-navigation', handleDidStartNavigation)
+    webview.removeEventListener('did-redirect-navigation', handleDidRedirectNavigation)
     webview.removeEventListener('did-stop-loading', handleDidStopLoading)
     webview.removeEventListener('did-navigate', handleFullDidNavigate)
     webview.removeEventListener('did-navigate', handleFindCloseOnNavigate)
diff --git a/src/renderer/src/components/browser-pane/host-guest/browser-client-page-guest-loss.ts b/src/renderer/src/components/browser-pane/host-guest/browser-client-page-guest-loss.ts
new file mode 100644
index 00000000000..b9e2f6a21f6
--- /dev/null
+++ b/src/renderer/src/components/browser-pane/host-guest/browser-client-page-guest-loss.ts
@@ -0,0 +1,54 @@
+import type { MutableRefObject } from 'react'
+import { recordRendererCrashBreadcrumb } from '@/lib/crash-breadcrumb-recorder'
+
+export type BrowserClientPageGuestLossReason = 'unreadable' | 'destroyed' | 'render-process-gone'
+
+/**
+ * Tells a client-hosted pane, once, that its guest is gone. The retained registry fences the tag on
+ * `destroyed` / `render-process-gone` without telling the pane, which would otherwise sit mute or
+ * spinning over a tag whose every method throws; a failed guest read is the same verdict.
+ */
+export function watchBrowserClientPageGuestLoss(options: {
+  webview: Electron.WebviewTag
+  /** Released on loss and dispose: every chrome action null-checks it, so a dead tag is never driven. */
+  webviewRef: MutableRefObject<Electron.WebviewTag | null>
+  browserPageId: string
+  pageHostGeneration: number
+  onLost: () => void
+}): { lose(reason: BrowserClientPageGuestLossReason): void; dispose(): void } {
+  const { webview } = options
+  const releaseWebviewRef = (): void => {
+    if (options.webviewRef.current === webview) {
+      options.webviewRef.current = null
+    }
+  }
+  let lost = false
+  const lose = (reason: BrowserClientPageGuestLossReason): void => {
+    if (lost) {
+      return
+    }
+    lost = true
+    // Why the breadcrumb: the crash report this replaces was the only field signal for guest death.
+    recordRendererCrashBreadcrumb('browser_client_page_guest_unavailable', {
+      browserPageId: options.browserPageId,
+      pageHostGeneration: options.pageHostGeneration,
+      reason,
+      tagConnected: webview.isConnected
+    })
+    releaseWebviewRef()
+    options.onLost()
+  }
+  const onDestroyed = (): void => lose('destroyed')
+  const onRendererGone = (): void => lose('render-process-gone')
+  webview.addEventListener('destroyed', onDestroyed)
+  webview.addEventListener('render-process-gone', onRendererGone)
+  return {
+    lose,
+    dispose: () => {
+      lost = true
+      releaseWebviewRef()
+      webview.removeEventListener('destroyed', onDestroyed)
+      webview.removeEventListener('render-process-gone', onRendererGone)
+    }
+  }
+}
diff --git a/src/renderer/src/components/browser-pane/host-guest/browser-page-favicon-retention.test.ts b/src/renderer/src/components/browser-pane/host-guest/browser-page-favicon-retention.test.ts
new file mode 100644
index 00000000000..924e7834319
--- /dev/null
+++ b/src/renderer/src/components/browser-pane/host-guest/browser-page-favicon-retention.test.ts
@@ -0,0 +1,149 @@
+import { describe, expect, it, vi } from 'vitest'
+import { createBrowserPageWebviewNavigationHandlers } from './browser-page-webview-navigation-handlers'
+import { createBrowserPageWebviewLoadingHandlers } from './browser-page-webview-loading-handlers'
+import type { BrowserTabPageState } from '../describe-page/browser-page-types'
+
+const TAB_ID = 'tab-1'
+const GITHUB_ICON = 'https://github.githubassets.com/favicons/favicon.png'
+
+function createHarness(startUrl: string) {
+  const updates: BrowserTabPageState[] = []
+  const committedUrl = { current: startUrl }
+  const webview = {
+    getURL: () => committedUrl.current,
+    getTitle: () => 'title',
+    canGoBack: () => false,
+    canGoForward: () => false,
+    src: startUrl
+  } as unknown as Electron.WebviewTag
+  const faviconUrlRef = { current: null as string | null }
+  const onUpdatePageStateRef = {
+    current: (_tabId: string, next: BrowserTabPageState) => {
+      updates.push(next)
+    }
+  }
+  const ref = <T>(value: T) => ({ current: value })
+  const navigation = createBrowserPageWebviewNavigationHandlers({
+    webview,
+    browserTabId: TAB_ID,
+    browserTabUrl: startUrl,
+    recoveryNavigationValidationRef: ref(null),
+    activeLoadFailureRef: ref(null),
+    // Why the destination, not the current document: Orca-driven navigations set this ref before
+    // assigning src, which is exactly the case the origin check must not read it for.
+    lastKnownWebviewUrlRef: ref<string | null>(startUrl),
+    addressBarInputRef: ref(null),
+    onSetUrlRef: ref(vi.fn()),
+    onUpdatePageStateRef,
+    addBrowserHistoryEntryRef: ref(vi.fn()),
+    faviconUrlRef,
+    setAddressBarValue: vi.fn(),
+    annotationViewportBridgeTokenRef: ref('token'),
+    setBrowserOverlayViewport: vi.fn()
+  })
+  const loading = createBrowserPageWebviewLoadingHandlers({
+    webview,
+    browserTabId: TAB_ID,
+    faviconUrlRef,
+    browserTabUrlRef: ref(startUrl),
+    addressBarValueRef: ref(startUrl),
+    addressBarInputRef: ref(null),
+    activeLoadFailureRef: ref(null),
+    lastKnownWebviewUrlRef: ref<string | null>(startUrl),
+    trackNextLoadingEventRef: ref(true),
+    keepAddressBarFocusRef: ref(false),
+    recoveryNavigationValidationRef: ref(null),
+    clearBrowserPageAnnotationsRef: ref(vi.fn()),
+    onUpdatePageStateRef,
+    onSetUrlRef: ref(vi.fn()),
+    setPendingAnnotationPayload: vi.fn(),
+    setBrowserOverlayViewport: vi.fn(),
+    setAddressBarValue: vi.fn(),
+    focusAddressBarNow: () => false
+  })
+
+  const navigateTo = (url: string): void => {
+    loading.handleDidStartLoading()
+    navigation.handleDidStartNavigation({
+      isMainFrame: true,
+      isInPlace: false,
+      url
+    } as Electron.DidStartNavigationEvent)
+    committedUrl.current = url
+  }
+
+  return { faviconUrlRef, updates, navigation, navigateTo, committedUrl }
+}
+
+describe('favicon retention across navigations', () => {
+  it('keeps the icon when Chromium will not re-announce it for a same-origin load', () => {
+    const harness = createHarness('https://github.com/alibaba/jvm-sandbox')
+    harness.navigation.handleFaviconUpdate({ favicons: [GITHUB_ICON] })
+    expect(harness.faviconUrlRef.current).toBe(GITHUB_ICON)
+
+    // Chromium emits no page-favicon-updated here: the icon URL list is unchanged.
+    harness.navigateTo('https://github.com/btraceio/btrace')
+
+    expect(harness.faviconUrlRef.current).toBe(GITHUB_ICON)
+    expect(harness.updates.some((update) => update.faviconUrl === null)).toBe(false)
+  })
+
+  it('drops the icon when the navigation leaves the origin', () => {
+    const harness = createHarness('https://github.com/nodejs/node')
+    harness.navigation.handleFaviconUpdate({ favicons: [GITHUB_ICON] })
+
+    harness.navigateTo('https://x.com/home')
+
+    expect(harness.faviconUrlRef.current).toBeNull()
+    expect(harness.updates.at(-1)).toEqual({ faviconUrl: null })
+  })
+
+  it('drops the icon when a same-origin navigation redirects to another origin', () => {
+    const harness = createHarness('https://github.com/nodejs/node')
+    harness.navigation.handleFaviconUpdate({ favicons: [GITHUB_ICON] })
+    harness.navigateTo('https://github.com/login')
+
+    harness.navigation.handleDidRedirectNavigation({
+      isMainFrame: true,
+      isInPlace: false,
+      url: 'https://example.com/after-login'
+    } as Electron.DidRedirectNavigationEvent)
+
+    expect(harness.faviconUrlRef.current).toBeNull()
+    expect(harness.updates.at(-1)).toEqual({ faviconUrl: null })
+  })
+
+  it('does not clear on a same-document navigation', () => {
+    const harness = createHarness('https://github.com/nodejs/node')
+    harness.navigation.handleFaviconUpdate({ favicons: [GITHUB_ICON] })
+
+    harness.navigation.handleDidStartNavigation({
+      isMainFrame: true,
+      isInPlace: true,
+      url: 'https://example.com/'
+    } as Electron.DidStartNavigationEvent)
+
+    expect(harness.faviconUrlRef.current).toBe(GITHUB_ICON)
+  })
+
+  it('reports loading without touching the icon on did-start-loading', () => {
+    const harness = createHarness('https://github.com/nodejs/node')
+    harness.navigation.handleFaviconUpdate({ favicons: [GITHUB_ICON] })
+    harness.updates.length = 0
+
+    harness.navigateTo('https://github.com/nodejs/undici')
+
+    expect(harness.updates).toEqual([{ loading: true }])
+  })
+
+  it('takes the first renderable icon rather than the first declared one', () => {
+    const harness = createHarness('https://example.com/')
+    harness.navigation.handleFaviconUpdate({
+      favicons: ['data:,', 'https://example.com/icon.png']
+    })
+    expect(harness.faviconUrlRef.current).toBe('https://example.com/icon.png')
+
+    harness.navigation.handleFaviconUpdate({ favicons: ['data:,'] })
+    expect(harness.faviconUrlRef.current).toBeNull()
+  })
+})
diff --git a/src/renderer/src/components/browser-pane/host-guest/browser-page-webview-loading-handlers.ts b/src/renderer/src/components/browser-pane/host-guest/browser-page-webview-loading-handlers.ts
index f263354e8c5..b6887f119eb 100644
--- a/src/renderer/src/components/browser-pane/host-guest/browser-page-webview-loading-handlers.ts
+++ b/src/renderer/src/components/browser-pane/host-guest/browser-page-webview-loading-handlers.ts
@@ -78,10 +78,10 @@ export function createBrowserPageWebviewLoadingHandlers({
     if (!trackNextLoadingEventRef.current) {
       return
     }
-    faviconUrlRef.current = null
+    // Why the favicon isn't cleared here: it is dropped on the cross-origin did-start-navigation
+    // instead, because Chromium won't re-announce an unchanged icon for a same-origin load.
     onUpdatePageStateRef.current(browserTabId, {
-      loading: true,
-      faviconUrl: null
+      loading: true
     })
   }
 
diff --git a/src/renderer/src/components/browser-pane/host-guest/browser-page-webview-navigation-handlers.ts b/src/renderer/src/components/browser-pane/host-guest/browser-page-webview-navigation-handlers.ts
index dbb47ae4acb..240e763cf63 100644
--- a/src/renderer/src/components/browser-pane/host-guest/browser-page-webview-navigation-handlers.ts
+++ b/src/renderer/src/components/browser-pane/host-guest/browser-page-webview-navigation-handlers.ts
@@ -13,6 +13,10 @@ import {
   isChromiumErrorPage,
   toDisplayUrl
 } from '../describe-page/browser-page-url-display'
+import {
+  browserNavigationLeavesFaviconOrigin,
+  pickDisplayableFaviconUrl
+} from '../describe-page/browser-favicon-url'
 import type {
   BrowserPageNavigateEvent,
   BrowserPageRecoveryNavigationValidation,
@@ -41,6 +45,7 @@ export type BrowserPageWebviewNavigationHandlersArgs = {
 
 export type BrowserPageWebviewNavigationHandlers = {
   handleDidStartNavigation: (event: Electron.DidStartNavigationEvent) => void
+  handleDidRedirectNavigation: (event: Electron.DidRedirectNavigationEvent) => void
   handleFullDidNavigate: (event: BrowserPageNavigateEvent) => void
   handleDidNavigateInPage: (event: BrowserPageNavigateEvent) => void
   handleTitleUpdate: (event: { title?: string }) => void
@@ -64,6 +69,28 @@ export function createBrowserPageWebviewNavigationHandlers({
   annotationViewportBridgeTokenRef,
   setBrowserOverlayViewport
 }: BrowserPageWebviewNavigationHandlersArgs): BrowserPageWebviewNavigationHandlers {
+  const clearFaviconIfOriginChanges = (
+    event: Electron.DidStartNavigationEvent | Electron.DidRedirectNavigationEvent
+  ): void => {
+    if (!event.isMainFrame || event.isInPlace || !event.url) {
+      return
+    }
+    const browserStartedUrl = redactKagiSessionToken(event.url)
+    const startedUrl = normalizeBrowserNavigationUrl(browserStartedUrl) ?? browserStartedUrl
+    // Why getURL() and not lastKnownWebviewUrlRef: Orca-driven navigations point that ref at the
+    // destination before assigning src, so it can't identify the document being left.
+    let committedUrl: string | null = null
+    try {
+      committedUrl = webview.getURL() || null
+    } catch {
+      // Why: a guest that hasn't attached yet rejects getURL(); an unknown origin keeps the icon.
+    }
+    if (browserNavigationLeavesFaviconOrigin(committedUrl, startedUrl)) {
+      faviconUrlRef.current = null
+      onUpdatePageStateRef.current(browserTabId, { faviconUrl: null })
+    }
+  }
+
   const handleDidStartNavigation = (event: Electron.DidStartNavigationEvent): void => {
     if (!event.isMainFrame || event.isInPlace || !event.url) {
       return
@@ -74,6 +101,14 @@ export function createBrowserPageWebviewNavigationHandlers({
     if (pendingRecoveryNavigation?.targetUrl === startedUrl) {
       pendingRecoveryNavigation.started = true
     }
+    // Why here and not on did-start-loading: Chromium re-announces a favicon only when the icon URL
+    // list changes, so clearing on every load strands same-origin navigations with no icon and no
+    // event that would ever restore one.
+    clearFaviconIfOriginChanges(event)
+  }
+
+  const handleDidRedirectNavigation = (event: Electron.DidRedirectNavigationEvent): void => {
+    clearFaviconIfOriginChanges(event)
   }
 
   const handleDidNavigate = (
@@ -136,14 +171,7 @@ export function createBrowserPageWebviewNavigationHandlers({
   }
 
   const handleFaviconUpdate = (event: { favicons?: string[] }): void => {
-    const faviconUrl = event.favicons?.[0] ?? null
-    faviconUrlRef.current =
-      faviconUrl &&
-      (faviconUrl.startsWith('https://') ||
-        faviconUrl.startsWith('http://') ||
-        faviconUrl.startsWith('data:image/'))
-        ? faviconUrl
-        : null
+    faviconUrlRef.current = pickDisplayableFaviconUrl(event.favicons)
     onUpdatePageStateRef.current(browserTabId, { faviconUrl: faviconUrlRef.current })
   }
 
@@ -175,6 +203,7 @@ export function createBrowserPageWebviewNavigationHandlers({
 
   return {
     handleDidStartNavigation,
+    handleDidRedirectNavigation,
     handleFullDidNavigate,
     handleDidNavigateInPage,
     handleTitleUpdate,
diff --git a/src/renderer/src/components/browser-pane/host-guest/browser-page-webview-surface.test.ts b/src/renderer/src/components/browser-pane/host-guest/browser-page-webview-surface.test.ts
new file mode 100644
index 00000000000..2d156ed926c
--- /dev/null
+++ b/src/renderer/src/components/browser-pane/host-guest/browser-page-webview-surface.test.ts
@@ -0,0 +1,93 @@
+// @vitest-environment happy-dom
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { ORCA_BROWSER_BLANK_URL } from '../../../../../shared/constants'
+import { ensureBrowserPageWebview } from './browser-page-webview'
+import { webviewRegistry } from './webview-registry'
+
+vi.mock('./webview-registry', () => {
+  const webviewRegistry = new Map()
+  return {
+    webviewRegistry,
+    registerPersistentWebview: vi.fn((id, guest) => webviewRegistry.set(id, guest)),
+    replacePersistentWebview: vi.fn(),
+    destroyPersistentWebview: vi.fn()
+  }
+})
+
+afterEach(() => {
+  document.body.replaceChildren()
+  webviewRegistry.clear()
+})
+
+function createGuest(): Electron.WebviewTag {
+  const container = document.createElement('div')
+  document.body.appendChild(container)
+  return ensureBrowserPageWebview({
+    browserTabId: 'surface-test',
+    container,
+    inputLocked: false,
+    webviewPartition: 'persist:browser-test',
+    resolveContainer: () => container
+  })!.webview
+}
+
+function commit(guest: Electron.WebviewTag, url: string, isMainFrame = true): void {
+  guest.dispatchEvent(Object.assign(new Event('load-commit'), { url, isMainFrame }))
+}
+
+describe('browser page surface ownership', () => {
+  it('themes the host before attach and uses an opaque native canvas for real pages', () => {
+    const guest = createGuest()
+    expect(guest.style.background).toBe('var(--background)')
+    expect(guest.getAttribute('webpreferences')).toContain('transparent=false')
+    expect(guest.getAttribute('webpreferences')).toContain('disableHtmlFullscreenWindowResize=true')
+  })
+
+  it.each(['about:blank', ORCA_BROWSER_BLANK_URL])(
+    'keeps %s unavailable through first navigation, then reveals the committed page',
+    (url) => {
+      const guest = createGuest()
+      commit(guest, url)
+      expect(guest.style.visibility).toBe('hidden')
+      guest.dispatchEvent(new Event('did-start-loading'))
+      expect(guest.style.visibility).toBe('hidden')
+      commit(guest, 'https://example.test')
+      expect(guest.style.visibility).toBe('visible')
+      guest.dispatchEvent(new Event('did-start-loading'))
+      expect(guest.style.visibility).toBe('visible')
+      commit(guest, 'about:blank', false)
+      expect(guest.style.visibility).toBe('visible')
+    }
+  )
+
+  it('preserves a reused guest and initializes the same surface after a container remount', () => {
+    const guest = createGuest()
+    commit(guest, 'https://example.test')
+    const container = guest.parentElement as HTMLDivElement
+    const reused = ensureBrowserPageWebview({
+      browserTabId: 'surface-test',
+      container,
+      inputLocked: false,
+      webviewPartition: 'persist:browser-test',
+      resolveContainer: () => container
+    })!
+    expect(reused.created).toBe(false)
+    expect(reused.webview).toBe(guest)
+    expect(reused.webview.style.visibility).toBe('visible')
+    const replacement = createGuest()
+    expect(replacement).not.toBe(guest)
+    expect(replacement.style.background).toBe('var(--background)')
+    expect(replacement.getAttribute('webpreferences')).toContain('transparent=false')
+    commit(replacement, ORCA_BROWSER_BLANK_URL)
+    expect(replacement.style.visibility).toBe('hidden')
+  })
+
+  it('exposes the themed host after renderer loss until a recovered document commits', () => {
+    const guest = createGuest()
+    commit(guest, 'https://example.test')
+    guest.dispatchEvent(new Event('render-process-gone'))
+    expect(guest.style.visibility).toBe('hidden')
+    commit(guest, 'https://example.test')
+    expect(guest.style.visibility).toBe('visible')
+  })
+})
diff --git a/src/renderer/src/components/browser-pane/host-guest/browser-page-webview.ts b/src/renderer/src/components/browser-pane/host-guest/browser-page-webview.ts
index 30e1cc18442..3c959751051 100644
--- a/src/renderer/src/components/browser-pane/host-guest/browser-page-webview.ts
+++ b/src/renderer/src/components/browser-pane/host-guest/browser-page-webview.ts
@@ -1,3 +1,4 @@
+import { ORCA_BROWSER_BLANK_URL } from '../../../../../shared/constants'
 import { ORCA_BROWSER_GUEST_WEB_PREFERENCES_ATTRIBUTE } from '../../../../../shared/browser-guest-web-preferences'
 import {
   destroyPersistentWebview,
@@ -59,16 +60,29 @@ export function ensureBrowserPageWebview({
   webview.setAttribute('allowpopups', '')
   // Why: Electron spreads the webpreferences keys verbatim, so the shared
   // camelCase attribute must stay intact for fullscreen containment to work.
-  webview.setAttribute('webpreferences', ORCA_BROWSER_GUEST_WEB_PREFERENCES_ATTRIBUTE)
+  // Keep Chromium's normal page canvas opaque while the host underneath follows Orca's theme.
+  webview.setAttribute(
+    'webpreferences',
+    `${ORCA_BROWSER_GUEST_WEB_PREFERENCES_ATTRIBUTE},transparent=false`
+  )
   webview.style.display = 'flex'
   webview.style.flex = '1'
   webview.style.width = '100%'
   webview.style.height = '100%'
   webview.style.border = 'none'
   setBrowserPageWebviewInputLock(webview, inputLocked)
-  // Why: some pages never paint a background, and a white viewport matches
-  // normal browser behavior instead of leaking Orca chrome through the guest.
-  webview.style.background = '#ffffff'
+  webview.style.background = 'var(--background)'
+  const guest = webview
+  // A committed synthetic blank document belongs to New Tab, including while its first URL waits.
+  guest.addEventListener('load-commit', (event) => {
+    if (event.isMainFrame) {
+      guest.style.visibility =
+        event.url === 'about:blank' || event.url === ORCA_BROWSER_BLANK_URL ? 'hidden' : 'visible'
+    }
+  })
+  guest.addEventListener('render-process-gone', () => {
+    guest.style.visibility = 'hidden'
+  })
   registerPersistentWebview(browserTabId, webview)
   activeContainer.appendChild(webview)
   created = true
diff --git a/src/renderer/src/components/browser-pane/host-guest/use-client-hosted-guest-activation-focus.ts b/src/renderer/src/components/browser-pane/host-guest/use-client-hosted-guest-activation-focus.ts
index 95494fb043e..ac9fcf87d8b 100644
--- a/src/renderer/src/components/browser-pane/host-guest/use-client-hosted-guest-activation-focus.ts
+++ b/src/renderer/src/components/browser-pane/host-guest/use-client-hosted-guest-activation-focus.ts
@@ -1,4 +1,5 @@
 import { useEffect, useRef, type RefObject } from 'react'
+import type { BrowserPageGuestFocus } from '../assemble-chrome/browser-page-guest-focus'
 import { useWebviewDragPassthroughActive } from './use-webview-drag-passthrough-active'
 
 /**
@@ -11,11 +12,12 @@ import { useWebviewDragPassthroughActive } from './use-webview-drag-passthrough-
  */
 export function useClientHostedGuestActivationFocus({
   isActive,
-  webviewRef,
+  guestFocus,
   keepAddressBarFocusRef
 }: {
   isActive: boolean
-  webviewRef: RefObject<Electron.WebviewTag | null>
+  /** Not the raw tag: a retired page's <webview> is out of the DOM, where focus() throws (STA-3448). */
+  guestFocus: BrowserPageGuestFocus
   keepAddressBarFocusRef: RefObject<boolean>
 }): void {
   const dragPassthroughActive = useWebviewDragPassthroughActive()
@@ -41,6 +43,6 @@ export function useClientHostedGuestActivationFocus({
     if (keepAddressBarFocusRef.current) {
       return
     }
-    webviewRef.current?.focus()
-  }, [dragPassthroughActive, isActive, keepAddressBarFocusRef, webviewRef])
+    guestFocus.focus()
+  }, [dragPassthroughActive, guestFocus, isActive, keepAddressBarFocusRef])
 }
diff --git a/src/renderer/src/components/browser-pane/navigate/browser-notices.test.ts b/src/renderer/src/components/browser-pane/navigate/browser-notices.test.ts
index f812d5fe02f..b54b70055d1 100644
--- a/src/renderer/src/components/browser-pane/navigate/browser-notices.test.ts
+++ b/src/renderer/src/components/browser-pane/navigate/browser-notices.test.ts
@@ -83,7 +83,7 @@ describe('browser notice formatting', () => {
         origin: 'https://example.com',
         action: 'opened-in-orca'
       })
-    ).toBe('https://example.com opened a new page in Orca.')
+    ).toBeNull()
 
     expect(
       formatPopupNotice({
diff --git a/src/renderer/src/components/browser-pane/navigate/browser-notices.ts b/src/renderer/src/components/browser-pane/navigate/browser-notices.ts
index ca5e6aa209a..445e92d278a 100644
--- a/src/renderer/src/components/browser-pane/navigate/browser-notices.ts
+++ b/src/renderer/src/components/browser-pane/navigate/browser-notices.ts
@@ -64,10 +64,10 @@ export function formatPermissionNotice(event: BrowserPermissionDeniedEvent): str
   return `${target} asked for ${humanizePermission(event.permission)}, and Orca denied it.`
 }
 
-export function formatPopupNotice(event: BrowserPopupEvent): string {
+export function formatPopupNotice(event: BrowserPopupEvent): string | null {
   const target = event.origin === 'unknown' ? 'A site' : event.origin
   if (event.action === 'opened-in-orca') {
-    return `${target} opened a new page in Orca.`
+    return null
   }
   if (event.action === 'opened-external') {
     return `${target} opened a new window in your default browser.`
diff --git a/src/renderer/src/components/browser-pane/navigate/browser-webview-load-failure.test.ts b/src/renderer/src/components/browser-pane/navigate/browser-webview-load-failure.test.ts
index 44e59fdbedd..1595b69f6aa 100644
--- a/src/renderer/src/components/browser-pane/navigate/browser-webview-load-failure.test.ts
+++ b/src/renderer/src/components/browser-pane/navigate/browser-webview-load-failure.test.ts
@@ -1,4 +1,4 @@
-import { describe, expect, it } from 'vitest'
+import { describe, expect, it, vi } from 'vitest'
 import { resolveBrowserWebviewLoadFailure } from './browser-webview-load-failure'
 
 describe('resolveBrowserWebviewLoadFailure', () => {
@@ -49,6 +49,18 @@ describe('resolveBrowserWebviewLoadFailure', () => {
     ).toMatchObject({ validatedUrl: 'https://example.com/current' })
   })
 
+  it('never reads a lazy fallback URL for an event it discards', () => {
+    const fallbackUrl = vi.fn(() => 'https://example.com/current')
+    expect(resolveBrowserWebviewLoadFailure({ errorCode: -3 }, { fallbackUrl })).toBeNull()
+    expect(fallbackUrl).not.toHaveBeenCalled()
+    expect(
+      resolveBrowserWebviewLoadFailure(
+        { errorCode: -105, errorDescription: 'ERR_NAME_NOT_RESOLVED', validatedURL: '' },
+        { fallbackUrl }
+      )
+    ).toMatchObject({ validatedUrl: 'https://example.com/current' })
+  })
+
   it('keeps a usable description when Chromium reports an empty one', () => {
     expect(
       resolveBrowserWebviewLoadFailure({ errorCode: -105, errorDescription: '' })
diff --git a/src/renderer/src/components/browser-pane/navigate/browser-webview-load-failure.ts b/src/renderer/src/components/browser-pane/navigate/browser-webview-load-failure.ts
index c39c5afe53b..03228c3e1d6 100644
--- a/src/renderer/src/components/browser-pane/navigate/browser-webview-load-failure.ts
+++ b/src/renderer/src/components/browser-pane/navigate/browser-webview-load-failure.ts
@@ -8,20 +8,23 @@ import type { BrowserPageFailLoadEvent } from '../describe-page/browser-page-typ
  * cannot forget the ignore rules or build a differently-shaped BrowserLoadError.
  *
  * `fallbackUrl` covers failures that arrive without a validatedURL — pass the webview's
- * current URL so the overlay names the page instead of about:blank.
+ * current URL so the overlay names the page instead of about:blank. Pass it as a function when
+ * reading it costs anything: discarded events never ask for it.
  */
 export function resolveBrowserWebviewLoadFailure(
   event: BrowserPageFailLoadEvent,
-  options: { fallbackUrl?: string | null } = {}
+  options: { fallbackUrl?: string | null | (() => string | null) } = {}
 ): BrowserLoadError | null {
   // Why: Chromium reports redirect/cancel races as ERR_ABORTED (-3) even when the
   // replacement navigation succeeds; subframe failures never blank the page.
   if (event.isMainFrame === false || event.errorCode === -3) {
     return null
   }
+  const fallbackUrl =
+    typeof options.fallbackUrl === 'function' ? options.fallbackUrl() : options.fallbackUrl
   return {
     code: event.errorCode ?? -1,
     description: event.errorDescription || 'Unknown load failure',
-    validatedUrl: redactKagiSessionToken(event.validatedURL || options.fallbackUrl || 'about:blank')
+    validatedUrl: redactKagiSessionToken(event.validatedURL || fallbackUrl || 'about:blank')
   }
 }
diff --git a/src/renderer/src/components/browser-pane/navigate/use-browser-page-resource-notices.ts b/src/renderer/src/components/browser-pane/navigate/use-browser-page-resource-notices.ts
index e3be43f4aac..9fad1200742 100644
--- a/src/renderer/src/components/browser-pane/navigate/use-browser-page-resource-notices.ts
+++ b/src/renderer/src/components/browser-pane/navigate/use-browser-page-resource-notices.ts
@@ -50,7 +50,10 @@ export function useBrowserPageResourceNotices(browserTabId: string): {
       if (event.browserPageId !== browserTabId) {
         return
       }
-      setResourceNotice(formatPopupNotice(event))
+      const notice = formatPopupNotice(event)
+      if (notice) {
+        setResourceNotice(notice)
+      }
     })
   }, [browserTabId])
 
diff --git a/src/renderer/src/components/browser-pane/stream-remote/remote-browser-page-pane.tsx b/src/renderer/src/components/browser-pane/stream-remote/remote-browser-page-pane.tsx
index 91995117b16..80845dd5404 100644
--- a/src/renderer/src/components/browser-pane/stream-remote/remote-browser-page-pane.tsx
+++ b/src/renderer/src/components/browser-pane/stream-remote/remote-browser-page-pane.tsx
@@ -358,6 +358,7 @@ export function RemoteBrowserPagePane({
             void openWorkspaceBrowserTab({
               workspaceId: worktreeId,
               url: linkUrl,
+              focusOnCreate: false,
               intent: { kind: 'url' },
               expectedRuntimeEnvironmentId: runtimeEnvironmentId,
               placementPreference: 'server'
diff --git a/src/renderer/src/components/cmd-j/native-chat-split-quick-actions.ts b/src/renderer/src/components/cmd-j/native-chat-split-quick-actions.ts
new file mode 100644
index 00000000000..d2019fb429a
--- /dev/null
+++ b/src/renderer/src/components/cmd-j/native-chat-split-quick-actions.ts
@@ -0,0 +1,61 @@
+import { PanelBottomClose, PanelRightClose } from 'lucide-react'
+import { translate } from '@/i18n/i18n'
+import type { CmdJQuickAction } from './quick-actions'
+import type { CmdJQuickActionContext } from './quick-action-context'
+import type { NativeChatSplitDirection } from '@/components/native-chat/native-chat-split-shortcut'
+
+function availability(ctx: CmdJQuickActionContext) {
+  return ctx.canSplitActiveChat
+    ? ({ available: true } as const)
+    : ({ available: false, reason: 'no-active-chat' } as const)
+}
+
+function splitAction(
+  direction: NativeChatSplitDirection,
+  action: Pick<CmdJQuickAction, 'id' | 'title' | 'description' | 'icon' | 'verbKeywords'>
+): CmdJQuickAction {
+  return {
+    ...action,
+    kind: 'action',
+    isAvailable: availability,
+    run: async (ctx) => {
+      if (!availability(ctx).available || !ctx.splitActiveChat?.(direction)) {
+        return { status: 'unavailable', reason: 'no-active-chat' }
+      }
+      return { status: 'ok' }
+    }
+  }
+}
+
+export function getNativeChatSplitQuickActions(): CmdJQuickAction[] {
+  return [
+    splitAction('right', {
+      id: 'split-chat-right',
+      title: translate('auto.components.cmd.j.quick.actions.splitChatRight', 'Split Chat Right'),
+      description: translate(
+        'auto.components.cmd.j.quick.actions.splitChatRightDescription',
+        'Open the active chat in a split pane to the right.'
+      ),
+      icon: PanelRightClose,
+      verbKeywords: [
+        translate('auto.components.cmd.j.quick.actions.verbs.splitChatRight', 'split chat right'),
+        translate('auto.components.cmd.j.quick.actions.verbs.moveChatRight', 'move chat right'),
+        translate('auto.components.cmd.j.quick.actions.verbs.chatPaneRight', 'chat pane right')
+      ]
+    }),
+    splitAction('down', {
+      id: 'split-chat-down',
+      title: translate('auto.components.cmd.j.quick.actions.splitChatDown', 'Split Chat Down'),
+      description: translate(
+        'auto.components.cmd.j.quick.actions.splitChatDownDescription',
+        'Open the active chat in a split pane below.'
+      ),
+      icon: PanelBottomClose,
+      verbKeywords: [
+        translate('auto.components.cmd.j.quick.actions.verbs.splitChatDown', 'split chat down'),
+        translate('auto.components.cmd.j.quick.actions.verbs.moveChatDown', 'move chat down'),
+        translate('auto.components.cmd.j.quick.actions.verbs.chatPaneBelow', 'chat pane below')
+      ]
+    })
+  ]
+}
diff --git a/src/renderer/src/components/cmd-j/palette-live-status.test.tsx b/src/renderer/src/components/cmd-j/palette-live-status.test.tsx
index a2656104d87..3cc6a9077dd 100644
--- a/src/renderer/src/components/cmd-j/palette-live-status.test.tsx
+++ b/src/renderer/src/components/cmd-j/palette-live-status.test.tsx
@@ -451,7 +451,7 @@ describe('palette live status', () => {
     expect(dotLabels()).toEqual(['Needs permission'])
   })
 
-  it('cuts the pip out of the dialog surface, and out of accent when selected', async () => {
+  it('keeps the attention glyph knockout popover-colored when its row is selected', async () => {
     setAgentState('working')
     await act(async () => {
       testRoot.render(
@@ -469,18 +469,11 @@ describe('palette live status', () => {
         </PaletteLiveStatusProvider>
       )
     })
-    const pip = testContainer.querySelector<HTMLElement>('[aria-hidden="true"].rounded-full')
+    const pip = testContainer.querySelector<HTMLElement>('[aria-hidden="true"]')
     expect(pip).not.toBeNull()
-    // Why popover and not background: the CommandDialog surface is --popover (#171717 dark), while
-    // --background is the app canvas (#0a0a0a) — the mismatch punched a dark halo through each row.
     expect(pip?.className).toContain('bg-popover')
     expect(pip?.className).toContain('ring-popover')
-    expect(pip?.className).not.toContain('bg-background')
-    expect(pip?.className).toContain(
-      'group-data-[selected=true]:bg-[var(--jump-palette-selection-surface)]'
-    )
-    expect(pip?.className).toContain(
-      'group-data-[selected=true]:ring-[var(--jump-palette-selection-surface)]'
-    )
+    expect(pip?.className).toContain('rounded-full')
+    expect(pip?.className).not.toContain('group-data-[selected=true]')
   })
 })
diff --git a/src/renderer/src/components/cmd-j/palette-live-status.tsx b/src/renderer/src/components/cmd-j/palette-live-status.tsx
index 432b6c35210..da59663490f 100644
--- a/src/renderer/src/components/cmd-j/palette-live-status.tsx
+++ b/src/renderer/src/components/cmd-j/palette-live-status.tsx
@@ -9,7 +9,6 @@ import {
   buildExplicitEntriesByTabId,
   type TabPaneInputSources
 } from '@/components/sidebar/smart-attention'
-import { cn } from '@/lib/utils'
 import { isExplicitAgentStatusFresh } from '@/lib/agent-status'
 import { getLiveAgentStatusByWorktreeId } from '@/lib/worktree-activity-state'
 import {
@@ -255,15 +254,8 @@ export function PaletteRecentTabStatusDot({
       <span className="relative inline-flex size-3.5 shrink-0 items-center justify-center">
         {fallback}
         <span
-          className={cn(
-            // Why popover, not background: the dialog surface is --popover (#171717 in dark), while
-            // --background is the app canvas (#0a0a0a) — using it punched a dark halo through every
-            // dark-mode row. Selected rows use --jump-palette-selection-surface so the cutout tracks
-            // the stronger keyboard highlight from main.css.
-            'pointer-events-none absolute -right-0.5 -bottom-0.5 flex items-center justify-center rounded-full',
-            'bg-popover ring-2 ring-popover',
-            'group-data-[selected=true]:bg-[var(--jump-palette-selection-surface)] group-data-[selected=true]:ring-[var(--jump-palette-selection-surface)]'
-          )}
+          // The popover-colored knockout separates the glyph from its icon without inheriting row selection.
+          className="pointer-events-none absolute -right-0.5 -bottom-0.5 flex items-center justify-center rounded-full bg-popover ring-2 ring-popover"
           aria-hidden="true"
         >
           <RecentTabAttentionBadgeGlyph badge={badge} />
diff --git a/src/renderer/src/components/cmd-j/quick-action-context.test.ts b/src/renderer/src/components/cmd-j/quick-action-context.test.ts
index 325252c4dc2..843634309df 100644
--- a/src/renderer/src/components/cmd-j/quick-action-context.test.ts
+++ b/src/renderer/src/components/cmd-j/quick-action-context.test.ts
@@ -254,6 +254,62 @@ describe('Cmd+J quick action context', () => {
     expect(context.isLoading).toBe(true)
   })
 
+  it('exposes chat split actions only on the workspace surface', () => {
+    const worktree = {
+      id: 'wt-1',
+      repoId: 'repo-1',
+      path: '/repo/wt',
+      displayName: 'Workspace',
+      branch: 'main',
+      createdAt: 0
+    } as Worktree
+    const state = {
+      activeWorktreeId: 'wt-1',
+      worktreesByRepo: { 'repo-1': [worktree] },
+      repos: [{ id: 'repo-1', path: '/repo', displayName: 'Repo', addedAt: 0 }],
+      sshConnectionStates: new Map(),
+      activeGroupIdByWorktree: { 'wt-1': 'group-1' },
+      groupsByWorktree: {
+        'wt-1': [
+          {
+            id: 'group-1',
+            worktreeId: 'wt-1',
+            activeTabId: 'chat-1',
+            tabOrder: ['chat-1', 'other-1']
+          }
+        ]
+      },
+      unifiedTabsByWorktree: {
+        'wt-1': [
+          {
+            id: 'chat-1',
+            entityId: 'session-1',
+            groupId: 'group-1',
+            worktreeId: 'wt-1',
+            contentType: 'agent-session'
+          }
+        ]
+      },
+      activeView: 'settings',
+      settings: null
+    } as unknown as AppState
+
+    const buildContext = (activeView: AppState['activeView']) =>
+      buildCmdJQuickActionContext({
+        state: { ...state, activeView },
+        activeGroupSnapshot: null,
+        openNewBrowserTab: async () => {},
+        openNewMarkdownFile: async () => {},
+        openNewTerminalTab: async () => {},
+        openCreateWorkspace: () => {},
+        deleteActiveWorkspace: () => {},
+        openAddQuickCommand: () => {}
+      })
+
+    expect(buildContext('terminal').canSplitActiveChat).toBe(true)
+    expect(buildContext('settings').canSplitActiveChat).toBe(false)
+  })
+
   it('runtime re-check returns unavailable without invoking the action helper', async () => {
     const calls: string[] = []
     const action = getCmdJQuickActions().find((entry) => entry.id === 'new-terminal-tab')
@@ -335,4 +391,33 @@ describe('Cmd+J quick action context', () => {
     await expect(action?.run(context)).resolves.toEqual({ status: 'ok' })
     expect(calls).toEqual(['delete'])
   })
+
+  it('offers and runs split actions only for an active movable chat', async () => {
+    const calls: string[] = []
+    const action = getCmdJQuickActions().find((entry) => entry.id === 'split-chat-right')
+    const context = {
+      ...ctx({}),
+      activeWorktree: null,
+      runtimeMode: 'local-desktop' as const,
+      openNewBrowserTab: async () => {},
+      openNewMarkdownFile: async () => {},
+      openNewTerminalTab: async () => {},
+      openCreateWorkspace: () => {},
+      deleteActiveWorkspace: () => {},
+      openAddQuickCommand: () => {},
+      canSplitActiveChat: true,
+      splitActiveChat: (direction: string) => {
+        calls.push(direction)
+        return true
+      }
+    } satisfies CmdJQuickActionContext
+
+    expect(action?.isAvailable(context)).toEqual({ available: true })
+    await expect(action?.run(context)).resolves.toEqual({ status: 'ok' })
+    expect(calls).toEqual(['right'])
+    expect(action?.isAvailable({ ...context, canSplitActiveChat: false })).toEqual({
+      available: false,
+      reason: 'no-active-chat'
+    })
+  })
 })
diff --git a/src/renderer/src/components/cmd-j/quick-action-context.ts b/src/renderer/src/components/cmd-j/quick-action-context.ts
index 88a8cfad533..bbed9671a4e 100644
--- a/src/renderer/src/components/cmd-j/quick-action-context.ts
+++ b/src/renderer/src/components/cmd-j/quick-action-context.ts
@@ -3,12 +3,19 @@ import { findWorktreeById } from '@/store/slices/worktree-helpers'
 import type { Worktree } from '../../../../shared/worktree/types'
 import type { SshConnectionStatus } from '../../../../shared/ssh-types'
 import { getClientCreationActionPolicy } from '@/lib/client-creation-action-policy'
+import {
+  canRunNativeChatSplitTarget,
+  resolveActiveNativeChatSplitTarget,
+  runActiveNativeChatSplit
+} from '@/components/native-chat/native-chat-layout-actions'
+import type { NativeChatSplitDirection } from '@/components/native-chat/native-chat-split-shortcut'
 
 export type CmdJUnavailableReason =
   | 'loading'
   | 'no-active-workspace'
   | 'ssh-disconnected'
   | 'no-active-group'
+  | 'no-active-chat'
   | 'client-action-unsupported'
 
 export type CmdJQuickActionAvailability =
@@ -35,6 +42,8 @@ export type CmdJQuickActionContext = {
   openCreateWorkspace: () => void
   deleteActiveWorkspace: () => void
   openAddQuickCommand: () => void
+  canSplitActiveChat?: boolean
+  splitActiveChat?: (direction: NativeChatSplitDirection) => boolean
 }
 
 export function resolveCmdJActiveGroupId(
@@ -166,6 +175,10 @@ export function buildCmdJQuickActionContext(args: {
   const managedBrowserCreationEnabled =
     getClientCreationActionPolicy(args.state, activeWorktreeId)['managed-browser'].state ===
     'enabled'
+  const activeChatTarget =
+    args.state.activeView === 'terminal'
+      ? resolveActiveNativeChatSplitTarget(args.state, activeWorktreeId, activeGroupId)
+      : null
 
   return {
     activeView: args.state.activeView,
@@ -181,7 +194,10 @@ export function buildCmdJQuickActionContext(args: {
     openNewTerminalTab: args.openNewTerminalTab,
     openCreateWorkspace: args.openCreateWorkspace,
     deleteActiveWorkspace: args.deleteActiveWorkspace,
-    openAddQuickCommand: args.openAddQuickCommand
+    openAddQuickCommand: args.openAddQuickCommand,
+    canSplitActiveChat: canRunNativeChatSplitTarget(args.state, activeChatTarget),
+    splitActiveChat: (direction) =>
+      runActiveNativeChatSplit(activeWorktreeId, activeGroupId, direction)
   }
 }
 
@@ -198,6 +214,8 @@ export function getUnavailableQuickActionMessage(
       return `Can't ${actionTitle.toLowerCase()} — workspace is disconnected.`
     case 'no-active-group':
       return `Can't ${actionTitle.toLowerCase()} — no tab group is available.`
+    case 'no-active-chat':
+      return `Can't ${actionTitle.toLowerCase()} — no movable chat is active.`
     case 'client-action-unsupported':
       return `Can't ${actionTitle.toLowerCase()} — this client and runtime do not support it.`
   }
diff --git a/src/renderer/src/components/cmd-j/quick-actions.ts b/src/renderer/src/components/cmd-j/quick-actions.ts
index 70f0e5f6859..00ccf127bad 100644
--- a/src/renderer/src/components/cmd-j/quick-actions.ts
+++ b/src/renderer/src/components/cmd-j/quick-actions.ts
@@ -8,6 +8,7 @@ import {
 } from './quick-action-context'
 import { translate } from '@/i18n/i18n'
 import { createLocalizedCatalog } from '@/i18n/localized-catalog'
+import { getNativeChatSplitQuickActions } from './native-chat-split-quick-actions'
 
 export type CmdJQuickActionRunResult =
   | { status: 'ok' }
@@ -125,6 +126,7 @@ export const getCmdJQuickActions = createLocalizedCatalog((): CmdJQuickAction[]
     isAvailable: workspaceActionAvailability,
     run: (ctx) => runWorkspaceAction(ctx, ctx.openNewTerminalTab)
   },
+  ...getNativeChatSplitQuickActions(),
   {
     id: CREATE_WORKSPACE_QUICK_ACTION_ID,
     kind: 'action',
diff --git a/src/renderer/src/components/confirmation-dialog-context.ts b/src/renderer/src/components/confirmation-dialog-context.ts
index 4675c181fb7..b112191a4e6 100644
--- a/src/renderer/src/components/confirmation-dialog-context.ts
+++ b/src/renderer/src/components/confirmation-dialog-context.ts
@@ -1,4 +1,5 @@
 import { createContext, useContext } from 'react'
+import type { LucideIcon } from 'lucide-react'
 
 // Keep the context component-free so Fast Refresh preserves its identity.
 
@@ -9,6 +10,9 @@ export type ConfirmationDialogOptions = {
   confirmLabel?: string
   cancelLabel?: string
   confirmVariant?: 'default' | 'destructive'
+  icon?: LucideIcon
+  cancelVariant?: 'outline' | 'ghost'
+  initialFocus?: 'confirm'
   /** Renders a "Don't ask again" checkbox. `onConfirmed` runs only when the user confirms with it checked. */
   dontAskAgain?: { label?: string; onConfirmed: () => void }
 }
diff --git a/src/renderer/src/components/confirmation-dialog.test.tsx b/src/renderer/src/components/confirmation-dialog.test.tsx
index 25738ee4c17..5097a5d7786 100644
--- a/src/renderer/src/components/confirmation-dialog.test.tsx
+++ b/src/renderer/src/components/confirmation-dialog.test.tsx
@@ -44,6 +44,37 @@ function renderDialog(options: ConfirmationDialogOptions): { onSettled: ReturnTy
 describe('ConfirmationDialogProvider', () => {
   afterEach(cleanup)
 
+  it('focuses the primary action when requested and confirms with Enter', async () => {
+    const { onSettled } = renderDialog({
+      title: 'Reveal hidden workspace?',
+      confirmLabel: 'Clear filters and reveal',
+      initialFocus: 'confirm'
+    })
+    await userEvent.click(screen.getByRole('button', { name: 'ask' }))
+    await waitFor(() =>
+      expect(screen.getByRole('button', { name: 'Clear filters and reveal' })).toHaveFocus()
+    )
+    await userEvent.keyboard('{Enter}')
+    await waitFor(() => expect(onSettled).toHaveBeenCalledWith(true))
+  })
+
+  it('still cancels with Escape when the primary action has focus', async () => {
+    const { onSettled } = renderDialog({
+      title: 'Reveal hidden workspace?',
+      initialFocus: 'confirm'
+    })
+    await userEvent.click(screen.getByRole('button', { name: 'ask' }))
+    await waitFor(() => expect(screen.getByRole('button', { name: 'Confirm' })).toHaveFocus())
+    await userEvent.keyboard('{Escape}')
+    await waitFor(() => expect(onSettled).toHaveBeenCalledWith(false))
+  })
+
+  it('keeps the default cancel focus for callers that do not opt in', async () => {
+    renderDialog({ title: 'Delete artifact?', confirmVariant: 'destructive' })
+    await userEvent.click(screen.getByRole('button', { name: 'ask' }))
+    await waitFor(() => expect(screen.getByRole('button', { name: 'Cancel' })).toHaveFocus())
+  })
+
   it('omits the checkbox unless the caller opts in', async () => {
     renderDialog({ title: 'Delete artifact?' })
 
diff --git a/src/renderer/src/components/confirmation-dialog.tsx b/src/renderer/src/components/confirmation-dialog.tsx
index a1670b9bb22..615a2400bc6 100644
--- a/src/renderer/src/components/confirmation-dialog.tsx
+++ b/src/renderer/src/components/confirmation-dialog.tsx
@@ -32,6 +32,7 @@ export function ConfirmationDialogProvider({
   children: React.ReactNode
 }): React.JSX.Element {
   const nextIdRef = useRef(0)
+  const confirmButtonRef = useRef<HTMLButtonElement>(null)
   const [queue, setQueue] = useState<ConfirmationDialogRequest[]>([])
   const [dontAskAgain, setDontAskAgain] = useState(false)
   const activeRequest = queue[0] ?? null
@@ -46,6 +47,7 @@ export function ConfirmationDialogProvider({
   }
   // Why: Radix keeps dialog content mounted while closing; keep labels stable without a post-render Effect.
   const displayedRequest = activeRequest ?? lastDisplayedRequestRef.current
+  const Icon = displayedRequest?.options.icon
 
   useEffect(() => {
     // Why: this provider's dialog is not represented by activeModal. Block
@@ -96,18 +98,37 @@ export function ConfirmationDialogProvider({
         open={activeRequest !== null}
         onOpenChange={(open) => !open && settleActiveRequest(false)}
       >
-        <DialogContent showCloseButton={false} className="sm:max-w-md">
-          <DialogHeader>
-            <DialogTitle>{displayedRequest?.options.title}</DialogTitle>
-            {displayedRequest?.options.description ? (
-              // Callers pass multi-line descriptions (e.g. one path per line).
-              <DialogDescription
-                className={cn('whitespace-pre-line', displayedRequest.options.descriptionClassName)}
-              >
-                {displayedRequest.options.description}
-              </DialogDescription>
-            ) : null}
-          </DialogHeader>
+        <DialogContent
+          showCloseButton={false}
+          className={cn('sm:max-w-md', Icon && 'gap-6')}
+          onOpenAutoFocus={(event) => {
+            if (activeRequest?.options.initialFocus === 'confirm') {
+              event.preventDefault()
+              confirmButtonRef.current?.focus()
+            }
+          }}
+        >
+          <div className={cn(Icon && 'flex items-start gap-4')}>
+            {Icon && (
+              <div className="flex size-10 shrink-0 items-center justify-center rounded-lg border border-border bg-muted text-muted-foreground">
+                <Icon className="size-5" aria-hidden="true" />
+              </div>
+            )}
+            <DialogHeader className={cn(Icon && 'min-w-0 gap-2 text-left')}>
+              <DialogTitle>{displayedRequest?.options.title}</DialogTitle>
+              {displayedRequest?.options.description ? (
+                // Callers pass multi-line descriptions (e.g. one path per line).
+                <DialogDescription
+                  className={cn(
+                    'whitespace-pre-line',
+                    displayedRequest.options.descriptionClassName
+                  )}
+                >
+                  {displayedRequest.options.description}
+                </DialogDescription>
+              ) : null}
+            </DialogHeader>
+          </div>
           {displayedRequest?.options.dontAskAgain ? (
             <div className="flex items-center gap-2">
               <Checkbox
@@ -124,12 +145,21 @@ export function ConfirmationDialogProvider({
               </Label>
             </div>
           ) : null}
-          <DialogFooter>
-            <Button type="button" variant="outline" onClick={() => settleActiveRequest(false)}>
+          <DialogFooter
+            className={cn(
+              Icon && '-mx-6 -mb-6 rounded-b-lg border-t border-border bg-muted/30 px-6 py-4'
+            )}
+          >
+            <Button
+              type="button"
+              variant={displayedRequest?.options.cancelVariant ?? 'outline'}
+              onClick={() => settleActiveRequest(false)}
+            >
               {displayedRequest?.options.cancelLabel ??
                 translate('auto.components.confirmation.dialog.56f5c60e0c', 'Cancel')}
             </Button>
             <Button
+              ref={confirmButtonRef}
               type="button"
               variant={displayedRequest?.options.confirmVariant ?? 'default'}
               onClick={() => settleActiveRequest(true)}
diff --git a/src/renderer/src/components/dashboard-popout/AgentMapWorkspaceContextMenu.test.tsx b/src/renderer/src/components/dashboard-popout/AgentMapWorkspaceContextMenu.test.tsx
index c5477a997e9..bc4958408a2 100644
--- a/src/renderer/src/components/dashboard-popout/AgentMapWorkspaceContextMenu.test.tsx
+++ b/src/renderer/src/components/dashboard-popout/AgentMapWorkspaceContextMenu.test.tsx
@@ -314,7 +314,19 @@ describe('Agent Map workspace context menu', () => {
       clientX: 100,
       clientY: 110
     })
-    fireEvent.click(await screen.findByText('Create new worktree for Orca', {}, { timeout: 5_000 }))
+    const createWorktree = await screen.findByText(
+      'Create new worktree for Orca',
+      {},
+      { timeout: 5_000 }
+    )
+    // Radix restores focus after unmount; drain it before the next test opens a menu.
+    const focusRestored = new Promise<void>((resolve) => {
+      screen
+        .getByRole('menu')
+        .addEventListener('focusScope.autoFocusOnUnmount', () => resolve(), { once: true })
+    })
+    fireEvent.click(createWorktree)
+    await act(async () => focusRestored)
 
     expect(useAppStore.getState().activeModal).toBe('new-workspace-composer')
     expect(useAppStore.getState().modalData).toEqual({
diff --git a/src/renderer/src/components/editor/details-markdown-html.ts b/src/renderer/src/components/editor/details-markdown-html.ts
index 109005460dc..964c08f35d6 100644
--- a/src/renderer/src/components/editor/details-markdown-html.ts
+++ b/src/renderer/src/components/editor/details-markdown-html.ts
@@ -94,7 +94,7 @@ export function renderDetailsAttributes(attrs: Record<string, unknown> | undefin
 function markdownFenceRanges(content: string): MarkdownFenceRanges {
   const ranges: [number, number][] = []
   let offset = 0
-  let openFence: { marker: '`' | '~'; length: number; start: number } | null = null
+  let openFence: { closingPattern: RegExp; start: number } | null = null
 
   for (const lineMatch of content.matchAll(/[^\r\n]*(?:\r\n|\n|\r|$)/g)) {
     const line = lineMatch[0]
@@ -104,11 +104,8 @@ function markdownFenceRanges(content: string): MarkdownFenceRanges {
 
     const lineText = line.replace(/(?:\r\n|\n|\r)$/u, '')
     if (openFence) {
-      const closingFencePattern =
-        openFence.marker === '`'
-          ? new RegExp(`^ {0,3}\`{${openFence.length},}\\s*$`)
-          : new RegExp(`^ {0,3}~{${openFence.length},}\\s*$`)
-      if (closingFencePattern.test(lineText)) {
+      // Built once per fence: rebuilding it per line recompiled the same regex for every fenced line.
+      if (openFence.closingPattern.test(lineText)) {
         ranges.push([openFence.start, offset + line.length])
         openFence = null
       }
@@ -116,8 +113,9 @@ function markdownFenceRanges(content: string): MarkdownFenceRanges {
       const openingFenceMatch = lineText.match(/^ {0,3}(`{3,}|~{3,})/u)
       if (openingFenceMatch?.[1]) {
         openFence = {
-          marker: openingFenceMatch[1][0] as '`' | '~',
-          length: openingFenceMatch[1].length,
+          closingPattern: new RegExp(
+            `^ {0,3}${openingFenceMatch[1][0]}{${openingFenceMatch[1].length},}\\s*$`
+          ),
           start: offset
         }
       }
diff --git a/src/renderer/src/components/editor/rich-markdown-review-annotations.ts b/src/renderer/src/components/editor/rich-markdown-review-annotations.ts
index 619d128bb65..90bd170a5c1 100644
--- a/src/renderer/src/components/editor/rich-markdown-review-annotations.ts
+++ b/src/renderer/src/components/editor/rich-markdown-review-annotations.ts
@@ -139,7 +139,7 @@ export function getRichMarkdownAnnotationHighlightRangesForComment(
   comment: DiffComment,
   markdownSourceLineOffset: number,
   // Why optional: callers looping over comments pass one shared build.
-  prebuiltBlocks?: RichMarkdownCommentBlock[]
+  prebuiltBlocks?: readonly RichMarkdownCommentBlock[]
 ): RichMarkdownAnnotationHighlightRange[] {
   const blocks = prebuiltBlocks ?? buildRichMarkdownCommentBlocks(editor)
   const selectedText = comment.selectedText?.trim()
@@ -192,13 +192,15 @@ export function getRichMarkdownCommentAnchorTop(
   block: RichMarkdownCommentBlock,
   containerRect: DOMRect,
   containerScrollTop: number,
-  markdownSourceLineOffset: number
+  markdownSourceLineOffset: number,
+  prebuiltBlocks?: readonly RichMarkdownCommentBlock[]
 ): number | null {
   try {
     const ranges = getRichMarkdownAnnotationHighlightRangesForComment(
       editor,
       comment,
-      markdownSourceLineOffset
+      markdownSourceLineOffset,
+      prebuiltBlocks
     )
     // Why: range notes should sort by the start of the selected text. Anchoring
     // to the end puts overlapping ranges with the same final line in creation
diff --git a/src/renderer/src/components/editor/rich-markdown-review-note-positioning.ts b/src/renderer/src/components/editor/rich-markdown-review-note-positioning.ts
index c54996d0ffa..4fdc12a51b9 100644
--- a/src/renderer/src/components/editor/rich-markdown-review-note-positioning.ts
+++ b/src/renderer/src/components/editor/rich-markdown-review-note-positioning.ts
@@ -1,9 +1,7 @@
 import type { Editor } from '@tiptap/react'
 import type { DiffComment } from '../../../../shared/diff-comment-types'
-import {
-  buildRichMarkdownCommentBlocks,
-  getRichMarkdownCommentAnchorTop
-} from './rich-markdown-review-annotations'
+import { getRichMarkdownCommentAnchorTop } from './rich-markdown-review-annotations'
+import { getRichMarkdownReviewRailBlocks } from './rich-markdown-review-rail-blocks'
 import {
   stackRichMarkdownReviewNotePositions,
   type RichMarkdownReviewNotePosition
@@ -23,7 +21,7 @@ export function measureRichMarkdownReviewNotePositions({
   markdownSourceLineOffset
 }: MeasureRichMarkdownReviewNotePositionsOptions): RichMarkdownReviewNotePosition[] {
   const containerRect = container.getBoundingClientRect()
-  const blocks = buildRichMarkdownCommentBlocks(editor)
+  const blocks = getRichMarkdownReviewRailBlocks(editor)
   const nextPositions = markdownComments
     .map((comment): RichMarkdownReviewNotePosition | null => {
       const bodyLineNumber = Math.max(1, comment.lineNumber - markdownSourceLineOffset)
@@ -39,7 +37,8 @@ export function measureRichMarkdownReviewNotePositions({
         block,
         containerRect,
         container.scrollTop,
-        markdownSourceLineOffset
+        markdownSourceLineOffset,
+        blocks
       )
       return top === null ? null : { comment, top }
     })
diff --git a/src/renderer/src/components/editor/rich-markdown-review-rail-benchmark.test.ts b/src/renderer/src/components/editor/rich-markdown-review-rail-benchmark.test.ts
new file mode 100644
index 00000000000..7090769f71f
--- /dev/null
+++ b/src/renderer/src/components/editor/rich-markdown-review-rail-benchmark.test.ts
@@ -0,0 +1,154 @@
+// @vitest-environment happy-dom
+// Run: ORCA_REVIEW_RAIL_BENCH=1 pnpm test src/renderer/src/components/editor/rich-markdown-review-rail-benchmark.test.ts
+import { expect, it, vi } from 'vitest'
+import { Editor as TiptapEditor } from '@tiptap/core'
+import { createRichMarkdownExtensions } from './rich-markdown-extensions'
+import { createRichMarkdownEditorCodec } from './rich-markdown-source-transport'
+import { measureRichMarkdownReviewNotePositions } from './rich-markdown-review-note-positioning'
+
+// Baseline measurement body from the parent revision, before sharing source blocks.
+import type { Editor } from '@tiptap/react'
+import type { DiffComment } from '../../../../shared/diff-comment-types'
+import {
+  buildRichMarkdownCommentBlocks,
+  getRichMarkdownCommentAnchorTop
+} from './rich-markdown-review-annotations'
+import {
+  stackRichMarkdownReviewNotePositions,
+  type RichMarkdownReviewNotePosition
+} from './rich-markdown-review-note-layout'
+
+type MeasureRichMarkdownReviewNotePositionsOptions = {
+  container: HTMLDivElement
+  editor: Editor
+  markdownComments: DiffComment[]
+  markdownSourceLineOffset: number
+}
+
+function measureBaseline({
+  container,
+  editor,
+  markdownComments,
+  markdownSourceLineOffset
+}: MeasureRichMarkdownReviewNotePositionsOptions): RichMarkdownReviewNotePosition[] {
+  const containerRect = container.getBoundingClientRect()
+  const blocks = buildRichMarkdownCommentBlocks(editor)
+  const nextPositions = markdownComments
+    .map((comment): RichMarkdownReviewNotePosition | null => {
+      const bodyLineNumber = Math.max(1, comment.lineNumber - markdownSourceLineOffset)
+      const block = blocks.find(
+        (candidate) => candidate.startLine <= bodyLineNumber && bodyLineNumber <= candidate.endLine
+      )
+      if (!block) {
+        return null
+      }
+      const top = getRichMarkdownCommentAnchorTop(
+        editor,
+        comment,
+        block,
+        containerRect,
+        container.scrollTop,
+        markdownSourceLineOffset
+      )
+      return top === null ? null : { comment, top }
+    })
+    .filter((position): position is RichMarkdownReviewNotePosition => position !== null)
+  return stackRichMarkdownReviewNotePositions(
+    nextPositions,
+    measureReviewNoteHeights(container, nextPositions)
+  )
+}
+
+function measureReviewNoteHeights(
+  container: HTMLDivElement,
+  positions: RichMarkdownReviewNotePosition[]
+): Map<string, number> {
+  const measuredHeights = new Map<string, number>()
+  for (const pos of positions) {
+    const el = container.querySelector(`[data-rich-markdown-review-note-id="${pos.comment.id}"]`)
+    if (el) {
+      measuredHeights.set(pos.comment.id, el.getBoundingClientRect().height)
+    }
+  }
+  return measuredHeights
+}
+
+it.skipIf(process.env.ORCA_REVIEW_RAIL_BENCH !== '1')(
+  'benchmarks full review rail measurements',
+  () => {
+    for (const blockCount of [250, 1000]) {
+      const editor = new TiptapEditor({
+        element: document.createElement('div'),
+        extensions: createRichMarkdownExtensions({ codec: createRichMarkdownEditorCodec() }),
+        content: {
+          type: 'doc',
+          content: Array.from({ length: blockCount }, (_, index) => ({
+            type: 'paragraph',
+            content: [{ type: 'text', text: `Paragraph ${index} with reviewable content.` }]
+          }))
+        }
+      })
+      try {
+        vi.spyOn(editor.view, 'coordsAtPos').mockReturnValue({
+          top: 100,
+          bottom: 120,
+          left: 0,
+          right: 10
+        })
+        const container = document.createElement('div')
+        const markdownComments: DiffComment[] = Array.from({ length: 5 }, (_, index) => ({
+          id: `note-${index}`,
+          worktreeId: 'workspace',
+          filePath: 'notes.md',
+          source: 'markdown',
+          lineNumber: 1 + index * 40,
+          body: 'Review',
+          createdAt: index,
+          side: 'modified'
+        }))
+        const args = { editor, container, markdownComments, markdownSourceLineOffset: 0 }
+        const serialize = vi.spyOn(editor.markdown!, 'serialize')
+        const baseline = measureBaseline(args)
+        const baselineCalls = serialize.mock.calls.length
+        serialize.mockClear()
+        expect(measureRichMarkdownReviewNotePositions(args)).toEqual(baseline)
+        const coldCalls = serialize.mock.calls.length
+        serialize.mockClear()
+        expect(measureRichMarkdownReviewNotePositions(args)).toEqual(baseline)
+        const warmCalls = serialize.mock.calls.length
+        serialize.mockRestore()
+        const time = (run: () => unknown) => {
+          const start = performance.now()
+          for (let index = 0; index < 20; index++) {
+            run()
+          }
+          return (performance.now() - start) / 20
+        }
+        const before: number[] = []
+        const after: number[] = []
+        for (let round = 0; round < 5; round++) {
+          before.push(time(() => measureBaseline(args)))
+          after.push(time(() => measureRichMarkdownReviewNotePositions(args)))
+        }
+        const median = (values: number[]) => values.sort((a, b) => a - b)[2]!
+        const result = {
+          blockCount,
+          comments: markdownComments.length,
+          beforeMs: median(before),
+          afterMs: median(after),
+          baselineCalls,
+          coldCalls,
+          warmCalls
+        }
+        process.stdout.write(`${JSON.stringify(result)}\n`)
+        expect(baselineCalls).toBe((2 * blockCount - 1) * 6)
+        expect(coldCalls).toBe(2 * blockCount - 1)
+        expect(warmCalls).toBe(0)
+      } finally {
+        editor.destroy()
+        vi.restoreAllMocks()
+      }
+    }
+  },
+  120_000
+)
diff --git a/src/renderer/src/components/editor/rich-markdown-review-rail-blocks.test.ts b/src/renderer/src/components/editor/rich-markdown-review-rail-blocks.test.ts
new file mode 100644
index 00000000000..18c00a47fb5
--- /dev/null
+++ b/src/renderer/src/components/editor/rich-markdown-review-rail-blocks.test.ts
@@ -0,0 +1,139 @@
+// @vitest-environment happy-dom
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { Editor, type JSONContent } from '@tiptap/core'
+import type { DiffComment } from '../../../../shared/diff-comment-types'
+import { createRichMarkdownExtensions } from './rich-markdown-extensions'
+import { createRichMarkdownEditorCodec } from './rich-markdown-source-transport'
+import { buildRichMarkdownCommentBlocks } from './rich-markdown-review-annotations'
+import { getRichMarkdownReviewRailBlocks } from './rich-markdown-review-rail-blocks'
+import { measureRichMarkdownReviewNotePositions } from './rich-markdown-review-note-positioning'
+
+const editors: Editor[] = []
+
+function createEditor(
+  content: string | JSONContent = '# Heading\n\nFirst paragraph\n\n- One\n- Two'
+) {
+  const editor = new Editor({
+    element: document.createElement('div'),
+    extensions: createRichMarkdownExtensions({ codec: createRichMarkdownEditorCodec() }),
+    content,
+    ...(typeof content === 'string' ? { contentType: 'markdown' as const } : {})
+  })
+  editors.push(editor)
+  // Settle the trailing-node plugin before measuring selection-only transactions.
+  editor.view.dispatch(editor.state.tr.setMeta('addToHistory', false))
+  return editor
+}
+
+afterEach(() => {
+  for (const editor of editors.splice(0)) {
+    editor.destroy()
+  }
+  vi.restoreAllMocks()
+})
+
+describe('review rail source block reuse', () => {
+  it.each([
+    '```ts\nconst value = 1\n\nvalue++\n```\n\nAfter code',
+    '| First | Second |\n| --- | --- |\n| one | two |\n\nAfter table',
+    '<details><summary>Toggle</summary>\n\nInside\n\n</details>\n\nAfter toggle'
+  ])('preserves multiline block boundaries for %s', (source) => {
+    const editor = createEditor(source)
+    expect(getRichMarkdownReviewRailBlocks(editor)).toEqual(buildRichMarkdownCommentBlocks(editor))
+  })
+
+  it('preserves block lines and reuses them after selection-only transactions', () => {
+    const editor = createEditor()
+    const expected = buildRichMarkdownCommentBlocks(editor)
+    const serialize = vi.spyOn(editor.markdown!, 'serialize')
+    const blocks = getRichMarkdownReviewRailBlocks(editor)
+    expect(blocks).toEqual(expected)
+    expect(serialize).toHaveBeenCalledTimes(2 * editor.state.doc.childCount - 1)
+    serialize.mockClear()
+    editor.commands.setTextSelection(3)
+    expect(getRichMarkdownReviewRailBlocks(editor)).toBe(blocks)
+    expect(serialize).not.toHaveBeenCalled()
+  })
+
+  it('rebuilds after edits and undo while keeping editors isolated', () => {
+    const editor = createEditor()
+    const original = getRichMarkdownReviewRailBlocks(editor)
+    editor.commands.insertContentAt(1, 'changed\ntext')
+    const changed = getRichMarkdownReviewRailBlocks(editor)
+    expect(changed).not.toBe(original)
+    expect(changed).toEqual(buildRichMarkdownCommentBlocks(editor))
+    editor.commands.undo()
+    expect(getRichMarkdownReviewRailBlocks(editor)).toEqual(original)
+    expect(getRichMarkdownReviewRailBlocks(createEditor())).not.toBe(original)
+  })
+
+  it('invalidates an in-place serializer replacement and a manager replacement', () => {
+    const editor = createEditor()
+    const original = getRichMarkdownReviewRailBlocks(editor)
+    const serialize = editor.markdown!.serialize.bind(editor.markdown)
+    vi.spyOn(editor.markdown!, 'serialize').mockImplementation(
+      (content) => `${serialize(content)}\nextra line`
+    )
+    const changed = getRichMarkdownReviewRailBlocks(editor)
+    expect(changed).not.toEqual(original)
+    expect(changed).toEqual(buildRichMarkdownCommentBlocks(editor))
+    editor.markdown = createEditor().markdown
+    expect(getRichMarkdownReviewRailBlocks(editor)).toEqual(original)
+  })
+
+  it('does not reuse fallback lines after a missing serializer becomes available', () => {
+    const editor = createEditor()
+    const markdown = editor.markdown
+    editor.markdown = undefined
+    const fallback = getRichMarkdownReviewRailBlocks(editor)
+    expect(fallback).toEqual(buildRichMarkdownCommentBlocks(editor))
+    editor.markdown = markdown
+    expect(getRichMarkdownReviewRailBlocks(editor)).not.toEqual(fallback)
+    expect(getRichMarkdownReviewRailBlocks(editor)).toEqual(buildRichMarkdownCommentBlocks(editor))
+  })
+
+  it('avoids serialization for every comment and repeated scroll while refreshing geometry', () => {
+    const editor = createEditor()
+    let sourceTop = 100
+    const coords = vi.spyOn(editor.view, 'coordsAtPos').mockImplementation(() => ({
+      top: sourceTop,
+      bottom: sourceTop + 20,
+      left: 0,
+      right: 10
+    }))
+    const container = document.createElement('div')
+    const comment: DiffComment = {
+      id: 'note',
+      worktreeId: 'workspace',
+      filePath: 'notes.md',
+      source: 'markdown',
+      lineNumber: 1,
+      body: 'Review',
+      createdAt: 1,
+      side: 'modified'
+    }
+    const markdownComments = Array.from({ length: 5 }, (_, index) => ({
+      ...comment,
+      id: `note-${index}`,
+      selectedText: index === 0 ? 'Heading' : undefined
+    }))
+    const serialize = vi.spyOn(editor.markdown!, 'serialize')
+    const measure = () =>
+      measureRichMarkdownReviewNotePositions({
+        editor,
+        container,
+        markdownComments,
+        markdownSourceLineOffset: 0
+      })
+    expect(measure()[0]?.top).toBe(100)
+    expect(serialize).toHaveBeenCalledTimes(2 * editor.state.doc.childCount - 1)
+    serialize.mockClear()
+    sourceTop = 200
+    container.scrollTop = 30
+    for (let index = 0; index < 60; index++) {
+      expect(measure()[0]?.top).toBe(230)
+    }
+    expect(serialize).not.toHaveBeenCalled()
+    expect(coords).toHaveBeenCalledTimes(61 * markdownComments.length)
+  })
+})
diff --git a/src/renderer/src/components/editor/rich-markdown-review-rail-blocks.ts b/src/renderer/src/components/editor/rich-markdown-review-rail-blocks.ts
new file mode 100644
index 00000000000..35dd1bb9eb5
--- /dev/null
+++ b/src/renderer/src/components/editor/rich-markdown-review-rail-blocks.ts
@@ -0,0 +1,31 @@
+import type { Editor } from '@tiptap/core'
+import {
+  buildRichMarkdownCommentBlocks,
+  type RichMarkdownCommentBlock
+} from './rich-markdown-review-annotations'
+
+type ReviewRailBlocks = {
+  doc: Editor['state']['doc']
+  markdown: Editor['markdown']
+  serialize: NonNullable<Editor['markdown']>['serialize'] | undefined
+  blocks: readonly RichMarkdownCommentBlock[]
+}
+
+// Keep only the current document per editor; scrolling changes geometry, not source lines.
+const blocksByEditor = new WeakMap<Editor, ReviewRailBlocks>()
+
+export function getRichMarkdownReviewRailBlocks(
+  editor: Editor
+): readonly RichMarkdownCommentBlock[] {
+  const doc = editor.state.doc
+  const markdown = editor.markdown
+  const serialize = markdown?.serialize
+  const cached = blocksByEditor.get(editor)
+  if (cached?.doc === doc && cached.markdown === markdown && cached.serialize === serialize) {
+    return cached.blocks
+  }
+
+  const blocks = buildRichMarkdownCommentBlocks(editor)
+  blocksByEditor.set(editor, { doc, markdown, serialize, blocks })
+  return blocks
+}
diff --git a/src/renderer/src/components/editor/rich-markdown-search-matches-cache.test.ts b/src/renderer/src/components/editor/rich-markdown-search-matches-cache.test.ts
new file mode 100644
index 00000000000..8859d8c4b2e
--- /dev/null
+++ b/src/renderer/src/components/editor/rich-markdown-search-matches-cache.test.ts
@@ -0,0 +1,93 @@
+import { Schema } from '@tiptap/pm/model'
+import { describe, expect, it, vi } from 'vitest'
+import { findRichMarkdownSearchMatches } from './rich-markdown-search'
+import { createRichMarkdownSearchMatchesCache } from './rich-markdown-search-matches-cache'
+
+const schema = new Schema({
+  nodes: {
+    doc: { content: 'paragraph+' },
+    paragraph: { content: 'text*' },
+    text: {}
+  }
+})
+
+function createDoc(text = 'Beta beta betas', count = 1) {
+  return schema.node(
+    'doc',
+    null,
+    Array.from({ length: count }, () => schema.node('paragraph', null, schema.text(text)))
+  )
+}
+
+describe('rich markdown search match reuse', () => {
+  it('keeps separate live and debounced results without rewalking the document', () => {
+    const doc = createDoc()
+    const find = createRichMarkdownSearchMatchesCache()
+    const walk = vi.spyOn(doc, 'nodesBetween')
+    const highlighted = find(doc, 'beta')
+    const live = find(doc, 'betas')
+    for (let index = 0; index < 100; index++) {
+      expect(find(doc, 'beta')).toBe(highlighted)
+      expect(find(doc, 'betas')).toBe(live)
+    }
+    expect(walk).toHaveBeenCalledTimes(2)
+  })
+
+  it('keys by document and both matching options', () => {
+    const find = createRichMarkdownSearchMatchesCache()
+    const doc = createDoc()
+    const anyCase = find(doc, 'beta')
+    expect(find(doc, 'beta', { matchCase: false, wholeWord: false })).toBe(anyCase)
+    for (const options of [
+      { matchCase: true },
+      { wholeWord: true },
+      { matchCase: true, wholeWord: true }
+    ]) {
+      expect(find(doc, 'beta', options)).toEqual(
+        findRichMarkdownSearchMatches(doc, 'beta', options)
+      )
+    }
+    const changedDoc = createDoc('A different beta')
+    expect(find(changedDoc, 'beta')).toEqual(findRichMarkdownSearchMatches(changedDoc, 'beta'))
+    expect(find(doc, 'beta')).not.toBe(anyCase)
+  })
+
+  it('bounds retained results to two queries for one document', () => {
+    const find = createRichMarkdownSearchMatchesCache()
+    const doc = createDoc()
+    const first = find(doc, 'beta')
+    find(doc, 'Beta')
+    find(doc, 'betas')
+    expect(find(doc, 'beta')).not.toBe(first)
+  })
+})
+
+it.skipIf(process.env.ORCA_SEARCH_CACHE_BENCH !== '1')(
+  'benchmarks repeated live-match checks',
+  () => {
+    for (const blockCount of [250, 1000]) {
+      const doc = createDoc('Beta beta betas with searchable content', blockCount)
+      const find = createRichMarkdownSearchMatchesCache()
+      const expected = findRichMarkdownSearchMatches(doc, 'beta')
+      expect(find(doc, 'beta')).toEqual(expected)
+      const measure = (run: () => unknown) => {
+        const samples: number[] = []
+        for (let round = 0; round < 5; round++) {
+          const start = performance.now()
+          for (let index = 0; index < 100; index++) {
+            run()
+          }
+          samples.push((performance.now() - start) / 100)
+        }
+        return samples.sort((a, b) => a - b)[2]!
+      }
+      const beforeMs = measure(() =>
+        findRichMarkdownSearchMatches(doc, 'beta').some((match) => match.touchesReadOnlyAtom)
+      )
+      const afterMs = measure(() => find(doc, 'beta').some((match) => match.touchesReadOnlyAtom))
+      process.stdout.write(
+        `${JSON.stringify({ blockCount, matchCount: expected.length, beforeMs, afterMs })}\n`
+      )
+    }
+  }
+)
diff --git a/src/renderer/src/components/editor/rich-markdown-search-matches-cache.ts b/src/renderer/src/components/editor/rich-markdown-search-matches-cache.ts
new file mode 100644
index 00000000000..1b057881356
--- /dev/null
+++ b/src/renderer/src/components/editor/rich-markdown-search-matches-cache.ts
@@ -0,0 +1,36 @@
+import type { Node as ProseMirrorNode } from '@tiptap/pm/model'
+import type { TextMatchOptions } from './markdown-preview-search'
+import { findRichMarkdownSearchMatches, type RichMarkdownSearchMatch } from './rich-markdown-search'
+
+type CachedMatches = {
+  query: string
+  matchCase: boolean
+  wholeWord: boolean
+  matches: RichMarkdownSearchMatch[]
+}
+
+export function createRichMarkdownSearchMatchesCache(): typeof findRichMarkdownSearchMatches {
+  let previousDoc: ProseMirrorNode | undefined
+  let entries: CachedMatches[] = []
+
+  return (doc, query, options: TextMatchOptions = {}, stats) => {
+    if (doc !== previousDoc) {
+      previousDoc = doc
+      entries = []
+    }
+    const matchCase = options.matchCase ?? false
+    const wholeWord = options.wholeWord ?? false
+    const existing = entries.find(
+      (entry) =>
+        entry.query === query && entry.matchCase === matchCase && entry.wholeWord === wholeWord
+    )
+    if (existing) {
+      return existing.matches
+    }
+
+    const matches = findRichMarkdownSearchMatches(doc, query, options, stats)
+    // The live replacement guard and debounced highlights can have different queries.
+    entries = [...entries.slice(-1), { query, matchCase, wholeWord, matches }]
+    return matches
+  }
+}
diff --git a/src/renderer/src/components/editor/useRichMarkdownSearch.reuse.test.tsx b/src/renderer/src/components/editor/useRichMarkdownSearch.reuse.test.tsx
new file mode 100644
index 00000000000..3aa0cea32dd
--- /dev/null
+++ b/src/renderer/src/components/editor/useRichMarkdownSearch.reuse.test.tsx
@@ -0,0 +1,135 @@
+// @vitest-environment happy-dom
+import { act, renderHook } from '@testing-library/react'
+import { Schema, type Node as ProseMirrorNode } from '@tiptap/pm/model'
+import { EditorState } from '@tiptap/pm/state'
+import type { Editor } from '@tiptap/react'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import * as visibleText from './rich-markdown-visible-text-map'
+import { useRichMarkdownSearch } from './useRichMarkdownSearch'
+
+vi.mock('@/store', () => ({
+  useAppStore: (select: (state: unknown) => unknown) => select({ keybindings: {} })
+}))
+
+const schema = new Schema({
+  nodes: {
+    doc: { content: 'paragraph+' },
+    paragraph: { content: 'inline*' },
+    text: { group: 'inline' },
+    atom: {
+      group: 'inline',
+      inline: true,
+      atom: true,
+      attrs: { label: {} },
+      leafText: (node) => node.attrs.label
+    }
+  }
+})
+
+function createDoc(atomLabel = 'locked') {
+  return schema.node(
+    'doc',
+    null,
+    schema.node('paragraph', null, [
+      schema.text('beta beta '),
+      schema.node('atom', { label: atomLabel })
+    ])
+  )
+}
+
+function mountSearch() {
+  let state = EditorState.create({ doc: createDoc() })
+  const listeners = new Set<() => void>()
+  const editor = {
+    get state() {
+      return state
+    },
+    commands: { focus: vi.fn() },
+    on: (_event: string, listener: () => void) => listeners.add(listener),
+    off: (_event: string, listener: () => void) => listeners.delete(listener),
+    registerPlugin: vi.fn(),
+    unregisterPlugin: vi.fn(),
+    view: {
+      dispatch: (tr: EditorState['tr']) => {
+        state = state.apply(tr)
+        if (tr.docChanged) {
+          listeners.forEach((listener) => listener())
+        }
+      }
+    }
+  } as unknown as Editor
+  const hook = renderHook(() =>
+    useRichMarkdownSearch({
+      editor,
+      rootRef: { current: null },
+      scrollContainerRef: { current: null }
+    })
+  )
+  return {
+    hook,
+    editor,
+    replaceDocSilently: (doc: ProseMirrorNode) => {
+      state = EditorState.create({ doc })
+    }
+  }
+}
+
+afterEach(() => {
+  vi.useRealTimers()
+  vi.restoreAllMocks()
+})
+
+describe('live rich markdown search reuse', () => {
+  it('does not rescan while typing replacement text, navigating, or publishing debounced highlights', () => {
+    vi.useFakeTimers()
+    const walk = vi.spyOn(visibleText, 'createRichMarkdownVisibleTextMap')
+    const { hook } = mountSearch()
+    act(() => hook.result.current.openSearch())
+    act(() => hook.result.current.searchActions.setSearchQuery('beta'))
+    expect(walk).toHaveBeenCalledTimes(1)
+    act(() => vi.advanceTimersByTime(150))
+    expect(hook.result.current.searchState.matchCount).toBe(2)
+    for (let index = 0; index < 20; index++) {
+      act(() => hook.result.current.searchActions.setReplaceQuery(`replacement ${index}`))
+      act(() => hook.result.current.searchActions.moveToMatch(1))
+    }
+    expect(walk).toHaveBeenCalledTimes(1)
+    act(() => hook.result.current.searchActions.closeSearch())
+    act(() => hook.result.current.openSearch())
+    act(() => hook.result.current.searchActions.setSearchQuery('beta'))
+    expect(walk).toHaveBeenCalledTimes(2)
+    hook.unmount()
+  })
+
+  it('uses the immediate query for atom guards and replacements during the debounce window', () => {
+    vi.useFakeTimers()
+    const { hook, editor } = mountSearch()
+    act(() => hook.result.current.openSearch())
+    act(() => hook.result.current.searchActions.setSearchQuery('beta'))
+    act(() => vi.advanceTimersByTime(150))
+    act(() => hook.result.current.searchActions.setSearchQuery('locked'))
+    expect(hook.result.current.searchState.matchCount).toBe(2)
+    expect(hook.result.current.searchState.replaceDisabled).toBe(true)
+    const doc = editor.state.doc
+    act(() => hook.result.current.searchActions.replaceAllMatches())
+    expect(editor.state.doc).toBe(doc)
+    act(() => hook.result.current.searchActions.setSearchQuery('beta'))
+    act(() => hook.result.current.searchActions.setReplaceQuery('changed'))
+    act(() => hook.result.current.searchActions.replaceAllMatches())
+    expect(editor.state.doc.textContent).toBe('changed changed locked')
+    hook.unmount()
+  })
+
+  it('checks the latest document even before an editor update reaches React', () => {
+    vi.useFakeTimers()
+    const { hook, editor, replaceDocSilently } = mountSearch()
+    act(() => hook.result.current.openSearch())
+    act(() => hook.result.current.searchActions.setSearchQuery('beta'))
+    act(() => vi.advanceTimersByTime(150))
+    replaceDocSilently(createDoc('beta'))
+    const doc = editor.state.doc
+    act(() => hook.result.current.searchActions.replaceCurrentMatch())
+    expect(editor.state.doc).toBe(doc)
+    hook.unmount()
+  })
+})
diff --git a/src/renderer/src/components/editor/useRichMarkdownSearch.ts b/src/renderer/src/components/editor/useRichMarkdownSearch.ts
index 2508505b85b..1a0f132e67c 100644
--- a/src/renderer/src/components/editor/useRichMarkdownSearch.ts
+++ b/src/renderer/src/components/editor/useRichMarkdownSearch.ts
@@ -1,5 +1,4 @@
-import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
-import type { RefObject } from 'react'
+import { useCallback, useEffect, useMemo, useRef, useState, type RefObject } from 'react'
 import type { Editor } from '@tiptap/react'
 import { TextSelection } from '@tiptap/pm/state'
 import { getShortcutPlatform } from '@/lib/shortcut-platform'
@@ -14,6 +13,7 @@ import {
   findRichMarkdownSearchMatches,
   richMarkdownSearchPluginKey
 } from './rich-markdown-search'
+import { createRichMarkdownSearchMatchesCache } from './rich-markdown-search-matches-cache'
 
 export function useRichMarkdownSearch({
   editor,
@@ -27,6 +27,13 @@ export function useRichMarkdownSearch({
   const searchInputRef = useRef<HTMLInputElement | null>(null)
   const keybindings = useAppStore((state) => state.keybindings)
   const [isSearchOpen, setIsSearchOpen] = useState(false)
+  const findMatches = useMemo(
+    () =>
+      editor && isSearchOpen
+        ? createRichMarkdownSearchMatchesCache()
+        : findRichMarkdownSearchMatches,
+    [editor, isSearchOpen]
+  )
   const [isReplaceMode, setIsReplaceMode] = useState(false)
   const [searchQuery, setSearchQuery] = useState('')
   const [replaceQuery, setReplaceQuery] = useState('')
@@ -57,13 +64,13 @@ export function useRichMarkdownSearch({
     if (!editor || !isSearchOpen || !searchRequestQuery) {
       return []
     }
-    return findRichMarkdownSearchMatches(editor.state.doc, searchRequestQuery, {
+    return findMatches(editor.state.doc, searchRequestQuery, {
       matchCase,
       wholeWord
     })
     // searchRevision is bumped on ProseMirror doc edits to trigger recomputation
     // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [editor, isSearchOpen, searchRequestQuery, searchRevision, matchCase, wholeWord])
+  }, [editor, findMatches, isSearchOpen, searchRequestQuery, searchRevision, matchCase, wholeWord])
 
   const matchCount = matches.length
 
@@ -78,11 +85,11 @@ export function useRichMarkdownSearch({
     }
     // Why: replace mutates document ranges immediately, so it must use the
     // current input value instead of the debounced highlight match set.
-    return findRichMarkdownSearchMatches(editor.state.doc, searchQuery, {
+    return findMatches(editor.state.doc, searchQuery, {
       matchCase,
       wholeWord
     })
-  }, [editor, isSearchOpen, matchCase, searchQuery, wholeWord])
+  }, [editor, findMatches, isSearchOpen, matchCase, searchQuery, wholeWord])
 
   // Why: mirror the guard used by replaceCurrentMatch/replaceAllMatches so the
   // disabled state never disagrees with what a click will actually do during the
diff --git a/src/renderer/src/components/github-project/ProjectGroupHeader.tsx b/src/renderer/src/components/github-project/ProjectGroupHeader.tsx
index add12fb4e99..7eb26d51fde 100644
--- a/src/renderer/src/components/github-project/ProjectGroupHeader.tsx
+++ b/src/renderer/src/components/github-project/ProjectGroupHeader.tsx
@@ -8,12 +8,16 @@ type Props = {
   group: ProjectGroup
   expanded: boolean
   onToggle: () => void
+  /** Total band width for horizontally scrolling surfaces (the roadmap). The
+   *  label pins to the viewport so it stays readable when scrolled off. */
+  bandWidth?: number
 }
 
 export default function ProjectGroupHeader({
   group,
   expanded,
-  onToggle
+  onToggle,
+  bandWidth
 }: Props): React.JSX.Element {
   const isCurrent = group.iteration ? isIterationCurrent(group.iteration) : false
   const dateRange = group.iteration
@@ -24,24 +28,30 @@ export default function ProjectGroupHeader({
       type="button"
       onClick={onToggle}
       className={cn(
-        'flex w-full items-center gap-2 border-b border-border/50 bg-muted/40 px-3 py-1.5 text-left text-xs',
-        'hover:bg-muted/60'
+        'flex items-center border-b border-border/50 bg-muted/40 px-3 py-1.5 text-left text-xs',
+        'hover:bg-muted/60',
+        // Why: min-w-full lets the band keep painting to the pane's right
+        // edge when the pane is wider than the timeline grid.
+        bandWidth == null ? 'w-full' : 'min-w-full'
       )}
+      style={bandWidth == null ? undefined : { width: bandWidth }}
     >
-      {expanded ? <ChevronDown className="size-3.5" /> : <ChevronRight className="size-3.5" />}
-      <span className="font-medium">
-        {group.label ||
-          translate('auto.components.github.project.ProjectGroupHeader.244c9e7d06', 'All')}
-      </span>
-      <span className="rounded-full border border-border/50 bg-background px-1.5 text-[10px] text-muted-foreground">
-        {group.rows.length}
-      </span>
-      {dateRange ? <span className="text-[10px] text-muted-foreground">{dateRange}</span> : null}
-      {isCurrent ? (
-        <span className="rounded-full border border-emerald-500/30 bg-emerald-500/10 px-1.5 text-[10px] text-emerald-700 dark:text-emerald-300">
-          {translate('auto.components.github.project.ProjectGroupHeader.82a22d2079', 'Current')}
+      <span className={cn('flex items-center gap-2', bandWidth != null && 'sticky left-3')}>
+        {expanded ? <ChevronDown className="size-3.5" /> : <ChevronRight className="size-3.5" />}
+        <span className="font-medium">
+          {group.label ||
+            translate('auto.components.github.project.ProjectGroupHeader.244c9e7d06', 'All')}
         </span>
-      ) : null}
+        <span className="rounded-full border border-border/50 bg-background px-1.5 text-[10px] text-muted-foreground">
+          {group.rows.length}
+        </span>
+        {dateRange ? <span className="text-[10px] text-muted-foreground">{dateRange}</span> : null}
+        {isCurrent ? (
+          <span className="rounded-full border border-emerald-500/30 bg-emerald-500/10 px-1.5 text-[10px] text-emerald-700 dark:text-emerald-300">
+            {translate('auto.components.github.project.ProjectGroupHeader.82a22d2079', 'Current')}
+          </span>
+        ) : null}
+      </span>
     </button>
   )
 }
diff --git a/src/renderer/src/components/github-project/ProjectPickerPanels.tsx b/src/renderer/src/components/github-project/ProjectPickerPanels.tsx
index f82ff38d7cb..a0183ee6968 100644
--- a/src/renderer/src/components/github-project/ProjectPickerPanels.tsx
+++ b/src/renderer/src/components/github-project/ProjectPickerPanels.tsx
@@ -126,19 +126,23 @@ function ProjectViewPickerRow({
   view: GitHubProjectViewSummary
   onPick: (view: GitHubProjectViewSummary) => void | Promise<void>
 }): React.JSX.Element {
-  const supported = view.layout === 'TABLE_LAYOUT'
+  const supported = view.layout === 'TABLE_LAYOUT' || view.layout === 'ROADMAP_LAYOUT'
   const layoutLabel =
     view.layout === 'TABLE_LAYOUT'
       ? translate('auto.components.github.project.ProjectPicker.1a2b8e512e', 'Table')
-      : view.layout === 'BOARD_LAYOUT'
-        ? translate(
-            'auto.components.github.project.ProjectPicker.d34ef9b554',
-            'Board (unsupported)'
-          )
-        : translate(
-            'auto.components.github.project.ProjectPicker.ab1a2c357d',
-            'Roadmap (unsupported)'
-          )
+      : view.layout === 'ROADMAP_LAYOUT'
+        ? translate('auto.components.github.project.ProjectPickerPanels.04ec212ccb', 'Roadmap')
+        : view.layout === 'BOARD_LAYOUT'
+          ? translate(
+              'auto.components.github.project.ProjectPicker.d34ef9b554',
+              'Board (unsupported)'
+            )
+          : // Why: raw.layout is cast unchecked, so a future GitHub layout value
+            // lands here — keep it disabled instead of mislabeling it.
+            translate(
+              'auto.components.github.project.ProjectPickerPanels.9fe1ac868c',
+              'Unsupported'
+            )
   return (
     <button
       type="button"
diff --git a/src/renderer/src/components/github-project/ProjectRoadmap.test.tsx b/src/renderer/src/components/github-project/ProjectRoadmap.test.tsx
new file mode 100644
index 00000000000..24d04bcb239
--- /dev/null
+++ b/src/renderer/src/components/github-project/ProjectRoadmap.test.tsx
@@ -0,0 +1,273 @@
+// @vitest-environment happy-dom
+
+import type { ReactNode } from 'react'
+import { act, cleanup, fireEvent, render, screen } from '@testing-library/react'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import ProjectRoadmap from './ProjectRoadmap'
+import type {
+  GitHubProjectField,
+  GitHubProjectFieldValue,
+  GitHubProjectRow,
+  GitHubProjectTable
+} from '../../../../shared/github/project-types'
+
+vi.mock('@/components/ui/tooltip', () => ({
+  Tooltip: ({ children }: { children: ReactNode }) => <>{children}</>,
+  TooltipTrigger: ({ children }: { children: ReactNode }) => <>{children}</>,
+  TooltipContent: ({ children }: { children: ReactNode }) => <div role="tooltip">{children}</div>
+}))
+
+const START_FIELD: GitHubProjectField = {
+  kind: 'field',
+  id: 'f_start',
+  name: 'Start date',
+  dataType: 'DATE'
+}
+const TARGET_FIELD: GitHubProjectField = {
+  kind: 'field',
+  id: 'f_end',
+  name: 'Target date',
+  dataType: 'DATE'
+}
+const TITLE_FIELD: GitHubProjectField = {
+  kind: 'field',
+  id: 'f_title',
+  name: 'Title',
+  dataType: 'TITLE'
+}
+
+function row(id: string, title: string, values: GitHubProjectFieldValue[]): GitHubProjectRow {
+  const fieldValuesByFieldId: Record<string, GitHubProjectFieldValue> = {}
+  for (const value of values) {
+    fieldValuesByFieldId[value.fieldId] = value
+  }
+  return {
+    id,
+    itemType: 'ISSUE',
+    content: {
+      number: 7,
+      title,
+      body: null,
+      url: 'https://github.com/o/r/issues/7',
+      state: 'OPEN',
+      stateReason: null,
+      isDraft: null,
+      repository: 'o/r',
+      assignees: [],
+      labels: [],
+      parentIssue: null,
+      issueType: null
+    },
+    fieldValuesByFieldId,
+    updatedAt: '2026-08-31T00:00:00Z',
+    position: 0
+  }
+}
+
+function table(fields: GitHubProjectField[], rows: GitHubProjectRow[]): GitHubProjectTable {
+  return {
+    project: {
+      id: 'PVT_1',
+      owner: 'stablyai',
+      ownerType: 'organization',
+      number: 3,
+      title: 'Orca',
+      url: 'https://github.com/orgs/stablyai/projects/3'
+    },
+    selectedView: {
+      id: 'PVTV_1',
+      number: 2,
+      name: 'Roadmap',
+      layout: 'ROADMAP_LAYOUT',
+      filter: '',
+      fields,
+      groupByFields: [],
+      sortByFields: []
+    },
+    rows,
+    totalCount: rows.length,
+    parentFieldDropped: false
+  }
+}
+
+afterEach(() => {
+  cleanup()
+  vi.useRealTimers()
+  window.localStorage.clear()
+})
+
+describe('ProjectRoadmap', () => {
+  it('moves the today marker across local midnight without resetting scroll and cleans up its timer', () => {
+    vi.useFakeTimers()
+    vi.setSystemTime(new Date(2026, 8, 5, 23, 59, 59))
+    const { unmount } = render(
+      <ProjectRoadmap
+        table={table(
+          [START_FIELD, TARGET_FIELD],
+          [row('one', 'Scheduled', [{ kind: 'date', fieldId: 'f_start', date: '2026-09-01' }])]
+        )}
+        fallback={<div>list</div>}
+      />
+    )
+    const scroller = screen.getByTestId('project-roadmap-scroller')
+    const marker = scroller.querySelector<HTMLElement>('.sticky.top-0 .absolute')!
+    const before = Number.parseFloat(marker.style.left)
+    scroller.scrollLeft = 123
+    act(() => vi.advanceTimersByTime(2100))
+    expect(Number.parseFloat(marker.style.left) - before).toBeCloseTo(148 / 30)
+    expect(scroller.scrollLeft).toBe(123)
+    expect(vi.getTimerCount()).toBe(1)
+    unmount()
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it.each([false, true])(
+    'centers when an initially empty view gains dated rows (fields hidden: %s)',
+    (hidden) => {
+      vi.useFakeTimers()
+      vi.setSystemTime(new Date(2026, 8, 5, 12))
+      const fields = hidden ? [TITLE_FIELD] : [TITLE_FIELD, START_FIELD, TARGET_FIELD]
+      const { rerender } = render(
+        <ProjectRoadmap table={table(fields, [])} fallback={<div>list</div>} />
+      )
+      const populated = table(fields, [
+        row('one', 'Arrived', [
+          { kind: 'date', fieldId: 'f_start', date: '2026-01-01' },
+          { kind: 'date', fieldId: 'f_end', date: '2026-09-10' }
+        ])
+      ])
+      rerender(<ProjectRoadmap table={populated} fallback={<div>list</div>} />)
+      const scroller = screen.getByTestId('project-roadmap-scroller')
+      expect(scroller.scrollLeft).toBeGreaterThan(1000)
+      scroller.scrollLeft = 123
+      rerender(
+        <ProjectRoadmap
+          table={{ ...populated, rows: [...populated.rows] }}
+          fallback={<div>list</div>}
+        />
+      )
+      expect(scroller.scrollLeft).toBe(123)
+      fireEvent.click(screen.getByRole('button', { name: 'Year' }))
+      expect(scroller.scrollLeft).not.toBe(123)
+      expect(window.localStorage.getItem('orca.githubProject.roadmapZoom')).toBe('year')
+    }
+  )
+
+  it('places a dated row on the timeline and names the fields driving it', () => {
+    render(
+      <ProjectRoadmap
+        table={table(
+          [TITLE_FIELD, START_FIELD, TARGET_FIELD],
+          [
+            row('PVTI_1', 'Ship the thing', [
+              { kind: 'date', fieldId: 'f_start', date: '2026-03-02' },
+              { kind: 'date', fieldId: 'f_end', date: '2026-03-20' }
+            ])
+          ]
+        )}
+        fallback={<div>list</div>}
+      />
+    )
+    expect(screen.getByText('Placed by Start date → Target date')).toBeTruthy()
+    expect(screen.getByLabelText(/^Ship the thing — /)).toBeTruthy()
+    expect(screen.queryByText('list')).toBeNull()
+  })
+
+  it('keeps an undated row in place and flags it rather than hiding it', () => {
+    render(
+      <ProjectRoadmap
+        table={table(
+          [TITLE_FIELD, START_FIELD, TARGET_FIELD],
+          [
+            row('PVTI_1', 'Dated', [{ kind: 'date', fieldId: 'f_start', date: '2026-03-02' }]),
+            row('PVTI_2', 'Undated', [])
+          ]
+        )}
+        fallback={<div>list</div>}
+      />
+    )
+    expect(screen.getByText('No dates')).toBeTruthy()
+    expect(screen.getByText('1 without dates')).toBeTruthy()
+    expect(screen.queryByLabelText(/^Undated — /)).toBeNull()
+  })
+
+  it('opens the row dialog when a bar is clicked', () => {
+    const onOpenDialog = vi.fn()
+    render(
+      <ProjectRoadmap
+        table={table(
+          [TITLE_FIELD, START_FIELD, TARGET_FIELD],
+          [
+            row('PVTI_1', 'Ship the thing', [
+              { kind: 'date', fieldId: 'f_start', date: '2026-03-02' },
+              { kind: 'date', fieldId: 'f_end', date: '2026-03-20' }
+            ])
+          ]
+        )}
+        onOpenDialog={onOpenDialog}
+        fallback={<div>list</div>}
+      />
+    )
+    fireEvent.click(screen.getByLabelText(/^Ship the thing — /))
+    expect(onOpenDialog).toHaveBeenCalledTimes(1)
+    expect(onOpenDialog.mock.calls[0]?.[0]).toMatchObject({ id: 'PVTI_1' })
+  })
+
+  it('places items from row-carried dates when the view hides its date fields', () => {
+    render(
+      <ProjectRoadmap
+        table={table(
+          [TITLE_FIELD],
+          [
+            row('PVTI_1', 'Hidden-field item', [
+              { kind: 'date', fieldId: 'f_start', date: '2026-03-02', fieldName: 'Start date' },
+              { kind: 'date', fieldId: 'f_end', date: '2026-03-20', fieldName: 'Target date' }
+            ])
+          ]
+        )}
+        fallback={<div>list</div>}
+      />
+    )
+    expect(screen.getByText('Placed by Start date → Target date')).toBeTruthy()
+    expect(screen.getByLabelText(/^Hidden-field item — /)).toBeTruthy()
+    expect(screen.queryByText('list')).toBeNull()
+  })
+
+  it('announces restricted items by name in the bar label', () => {
+    const redacted: GitHubProjectRow = {
+      ...row('PVTI_9', '', [
+        { kind: 'date', fieldId: 'f_start', date: '2026-03-02' },
+        { kind: 'date', fieldId: 'f_end', date: '2026-03-05' }
+      ]),
+      itemType: 'REDACTED'
+    }
+    render(
+      <ProjectRoadmap
+        table={table([TITLE_FIELD, START_FIELD, TARGET_FIELD], [redacted])}
+        fallback={<div>list</div>}
+      />
+    )
+    expect(screen.getByLabelText(/^Restricted item — /)).toBeTruthy()
+  })
+
+  it('falls back to the caller-supplied list when no field can place items', () => {
+    render(<ProjectRoadmap table={table([TITLE_FIELD], [])} fallback={<div>list</div>} />)
+    expect(screen.getByText('list')).toBeTruthy()
+    expect(
+      screen.getByText(
+        'This roadmap view has no date or iteration field to place items on, so Orca is listing them instead.'
+      )
+    ).toBeTruthy()
+  })
+
+  it('reports an empty filter result instead of drawing an empty grid', () => {
+    render(
+      <ProjectRoadmap
+        table={table([TITLE_FIELD, START_FIELD, TARGET_FIELD], [])}
+        fallback={<div>list</div>}
+      />
+    )
+    expect(screen.getByText("No items match this view's filter.")).toBeTruthy()
+    expect(screen.queryByText('list')).toBeNull()
+  })
+})
diff --git a/src/renderer/src/components/github-project/ProjectRoadmap.tsx b/src/renderer/src/components/github-project/ProjectRoadmap.tsx
new file mode 100644
index 00000000000..d06ef409dff
--- /dev/null
+++ b/src/renderer/src/components/github-project/ProjectRoadmap.tsx
@@ -0,0 +1,419 @@
+import React, { useCallback, useEffect, useLayoutEffect, useMemo, useRef, useState } from 'react'
+import { CalendarClock } from 'lucide-react'
+import { Button } from '@/components/ui/button'
+import { usePrefersReducedMotion } from '@/hooks/usePrefersReducedMotion'
+import { cn } from '@/lib/utils'
+import { i18n, translate } from '@/i18n/i18n'
+import ProjectGroupHeader from './ProjectGroupHeader'
+import ProjectRoadmapBar from './ProjectRoadmapBar'
+import { ProjectTitleCell } from './ProjectCellIdentity'
+import { formatRoadmapTick } from './roadmap-tick-format'
+import { loadRoadmapZoom, saveRoadmapZoom } from './roadmap-zoom-preference'
+import { groupRows, sortRows } from '../../../../shared/github/project-group-sort'
+import {
+  buildRoadmapTicks,
+  getRoadmapSpan,
+  resolveRoadmapDateSource,
+  roadmapOffsetPx,
+  roadmapSourceFieldNames,
+  type RoadmapSpan,
+  type RoadmapTick,
+  type RoadmapZoom
+} from '../../../../shared/github/project-roadmap-timeline'
+import type { GitHubProjectRow, GitHubProjectTable } from '../../../../shared/github/project-types'
+
+const LABEL_WIDTH_PX = 280
+const LANE_HEIGHT_PX = 36
+const TICK_WIDTH_PX: Record<RoadmapZoom, number> = { month: 148, quarter: 128, year: 160 }
+const ZOOMS: RoadmapZoom[] = ['month', 'quarter', 'year']
+
+function localTodayAsUtcMidnightMs(): number {
+  const now = new Date()
+  return Date.UTC(now.getFullYear(), now.getMonth(), now.getDate())
+}
+
+type Props = {
+  table: GitHubProjectTable
+  onOpenDialog?: (row: GitHubProjectRow) => void
+  /** Rendered instead of the timeline when the view has no field to place
+   *  items on — the caller supplies the table list so the items stay usable. */
+  fallback: React.ReactNode
+}
+
+export default function ProjectRoadmap({
+  table,
+  onOpenDialog,
+  fallback
+}: Props): React.JSX.Element {
+  const view = table.selectedView
+  const prefersReducedMotion = usePrefersReducedMotion()
+  const locale = i18n.resolvedLanguage ?? i18n.language
+  // Why: the grid lives on UTC calendar days (parseRoadmapDate), so "today"
+  // must be the viewer's LOCAL calendar date mapped to UTC midnight — the raw
+  // instant would shift the marker into the wrong day off UTC.
+  const [todayMs, setTodayMs] = useState(localTodayAsUtcMidnightMs)
+  // Why: a pane left open across midnight would otherwise keep yesterday's
+  // marker; re-arm after each fire so multi-day sessions stay honest.
+  useEffect(() => {
+    const now = new Date()
+    const nextLocalMidnight = new Date(
+      now.getFullYear(),
+      now.getMonth(),
+      now.getDate() + 1
+    ).getTime()
+    // Why: the +1s pad absorbs timer drift so the callback lands after the
+    // date change, not just before it.
+    const timer = setTimeout(
+      () => setTodayMs(localTodayAsUtcMidnightMs()),
+      nextLocalMidnight - now.getTime() + 1000
+    )
+    return () => clearTimeout(timer)
+  }, [todayMs])
+  const [zoom, setZoom] = useState<RoadmapZoom>(loadRoadmapZoom)
+  const [collapsed, setCollapsed] = useState<ReadonlySet<string>>(() => new Set())
+  const scrollRef = useRef<HTMLDivElement | null>(null)
+
+  const source = useMemo(() => resolveRoadmapDateSource(view, table.rows), [view, table.rows])
+  const groups = useMemo(() => groupRows(table, sortRows(table, table.rows)), [table])
+  const spans = useMemo(() => {
+    const bySpan = new Map<string, RoadmapSpan>()
+    if (!source) {
+      return bySpan
+    }
+    for (const row of table.rows) {
+      const span = getRoadmapSpan(row, source)
+      if (span) {
+        bySpan.set(row.id, span)
+      }
+    }
+    return bySpan
+  }, [source, table.rows])
+
+  const tickWidth = TICK_WIDTH_PX[zoom]
+  const ticks = useMemo(
+    () => buildRoadmapTicks(Array.from(spans.values()), zoom, todayMs),
+    [spans, todayMs, zoom]
+  )
+  const timelineWidth = ticks.length * tickWidth
+  const todayPx = roadmapOffsetPx(todayMs, ticks, tickWidth)
+  const hasTimeline = source !== null && table.rows.length > 0
+
+  // Why: the interesting part of a roadmap is around now — open there instead
+  // of at the padded left edge, and re-centre when the zoom changes scale.
+  const scrollToToday = useCallback(() => {
+    const scroller = scrollRef.current
+    if (!scroller) {
+      return
+    }
+    const lead = (scroller.clientWidth - LABEL_WIDTH_PX) / 3
+    scroller.scrollTo({
+      left: Math.max(0, todayPx - lead),
+      behavior: prefersReducedMotion ? 'instant' : 'smooth'
+    })
+  }, [todayPx, prefersReducedMotion])
+  const todayPxRef = useRef(todayPx)
+  useLayoutEffect(() => {
+    todayPxRef.current = todayPx
+  })
+  // Center when the timeline appears or zoom changes; refetches must preserve user scroll.
+  useEffect(() => {
+    const scroller = scrollRef.current
+    if (!scroller) {
+      return
+    }
+    const lead = (scroller.clientWidth - LABEL_WIDTH_PX) / 3
+    scroller.scrollLeft = Math.max(0, todayPxRef.current - lead)
+  }, [zoom, hasTimeline])
+
+  const colorFieldId = useMemo(() => {
+    const grouped = view.groupByFields.find((field) => field.kind === 'single-select')
+    return (grouped ?? view.fields.find((field) => field.kind === 'single-select'))?.id ?? null
+  }, [view])
+
+  if (!source) {
+    return (
+      <div className="flex min-h-0 min-w-0 flex-1 flex-col">
+        <div className="flex-none border-b border-border/50 bg-muted/30 px-3 py-2 text-xs text-muted-foreground">
+          {translate(
+            'auto.components.github.project.ProjectRoadmap.be52f7b6db',
+            'This roadmap view has no date or iteration field to place items on, so Orca is listing them instead.'
+          )}
+        </div>
+        {fallback}
+      </div>
+    )
+  }
+
+  if (table.rows.length === 0) {
+    return (
+      <div className="flex min-h-[120px] items-center justify-center p-6 text-sm text-muted-foreground">
+        {translate(
+          'auto.components.github.project.ProjectViewList.4f57d2e0b1',
+          "No items match this view's filter."
+        )}
+      </div>
+    )
+  }
+
+  const undatedCount = table.rows.length - spans.size
+  const bandWidth = LABEL_WIDTH_PX + timelineWidth
+  return (
+    <div className="flex min-h-0 min-w-0 flex-1 flex-col">
+      <RoadmapControls
+        placedBy={roadmapSourceFieldNames(source).join(' → ')}
+        undatedCount={undatedCount}
+        zoom={zoom}
+        onZoom={(next) => {
+          setZoom(next)
+          saveRoadmapZoom(next)
+        }}
+        onToday={scrollToToday}
+      />
+      <div
+        ref={scrollRef}
+        className="min-h-0 min-w-0 flex-1 overflow-auto scrollbar-sleek"
+        data-testid="project-roadmap-scroller"
+      >
+        <div className="relative w-max min-w-full">
+          <RoadmapHeaderRow
+            ticks={ticks}
+            tickWidth={tickWidth}
+            zoom={zoom}
+            locale={locale}
+            todayPx={todayPx}
+          />
+          <div className="relative">
+            <div
+              aria-hidden
+              className="pointer-events-none absolute inset-y-0 right-0"
+              style={{
+                left: LABEL_WIDTH_PX,
+                backgroundImage: 'linear-gradient(to right, var(--border) 0 1px, transparent 1px)',
+                backgroundSize: `${tickWidth}px 100%`
+              }}
+            />
+            <div
+              aria-hidden
+              className="pointer-events-none absolute inset-y-0 w-px bg-foreground/30"
+              style={{ left: LABEL_WIDTH_PX + todayPx }}
+            />
+            {groups.map((group) => {
+              const expanded = !collapsed.has(group.key)
+              return (
+                <div key={group.key}>
+                  {view.groupByFields[0] ? (
+                    <ProjectGroupHeader
+                      group={group}
+                      expanded={expanded}
+                      bandWidth={bandWidth}
+                      onToggle={() =>
+                        setCollapsed((previous) => {
+                          const next = new Set(previous)
+                          if (!next.delete(group.key)) {
+                            next.add(group.key)
+                          }
+                          return next
+                        })
+                      }
+                    />
+                  ) : null}
+                  {expanded
+                    ? group.rows.map((row) => (
+                        <RoadmapLane
+                          key={row.id}
+                          row={row}
+                          span={spans.get(row.id) ?? null}
+                          ticks={ticks}
+                          tickWidth={tickWidth}
+                          timelineWidth={timelineWidth}
+                          colorFieldId={colorFieldId}
+                          locale={locale}
+                          onOpenDialog={onOpenDialog}
+                        />
+                      ))
+                    : null}
+                </div>
+              )
+            })}
+          </div>
+        </div>
+      </div>
+    </div>
+  )
+}
+
+function RoadmapControls({
+  placedBy,
+  undatedCount,
+  zoom,
+  onZoom,
+  onToday
+}: {
+  placedBy: string
+  undatedCount: number
+  zoom: RoadmapZoom
+  onZoom: (zoom: RoadmapZoom) => void
+  onToday: () => void
+}): React.JSX.Element {
+  const zoomLabels: Record<RoadmapZoom, string> = {
+    month: translate('auto.components.github.project.ProjectRoadmap.6405e036e0', 'Month'),
+    quarter: translate('auto.components.github.project.ProjectRoadmap.f2b1cabef7', 'Quarter'),
+    year: translate('auto.components.github.project.ProjectRoadmap.b6afc6fe45', 'Year')
+  }
+  return (
+    <div className="flex min-w-0 flex-none flex-wrap items-center gap-2 border-b border-border/50 px-3 py-1.5 text-xs text-muted-foreground">
+      <span className="truncate">
+        {translate(
+          'auto.components.github.project.ProjectRoadmap.343888b143',
+          'Placed by {{value0}}',
+          {
+            value0: placedBy
+          }
+        )}
+      </span>
+      {undatedCount > 0 ? (
+        <span className="rounded-full border border-border/50 px-1.5 text-[10px]">
+          {translate(
+            'auto.components.github.project.ProjectRoadmap.6a088a5da1',
+            '{{value0}} without dates',
+            { value0: undatedCount }
+          )}
+        </span>
+      ) : null}
+      <div className="ml-auto flex items-center gap-1">
+        <Button type="button" size="xs" variant="outline" onClick={onToday}>
+          <CalendarClock className="size-3" />
+          {translate('auto.components.github.project.ProjectRoadmap.86eebd6020', 'Today')}
+        </Button>
+        <div
+          role="group"
+          aria-label={translate(
+            'auto.components.github.project.ProjectRoadmap.0bb1c1bc07',
+            'Timeline zoom'
+          )}
+          className="flex items-center rounded-md border border-border/60"
+        >
+          {ZOOMS.map((option) => (
+            <button
+              key={option}
+              type="button"
+              aria-pressed={option === zoom}
+              onClick={() => onZoom(option)}
+              className={cn(
+                'px-2 py-0.5 text-[11px] first:rounded-l-md last:rounded-r-md',
+                option === zoom ? 'bg-accent text-foreground' : 'hover:bg-accent/60'
+              )}
+            >
+              {zoomLabels[option]}
+            </button>
+          ))}
+        </div>
+      </div>
+    </div>
+  )
+}
+
+function RoadmapHeaderRow({
+  ticks,
+  tickWidth,
+  zoom,
+  locale,
+  todayPx
+}: {
+  ticks: RoadmapTick[]
+  tickWidth: number
+  zoom: RoadmapZoom
+  locale: string
+  todayPx: number
+}): React.JSX.Element {
+  return (
+    <div className="sticky top-0 z-20 flex border-b border-border/60 bg-background/95 backdrop-blur">
+      <div
+        className="sticky left-0 z-30 shrink-0 border-r border-border/50 bg-background px-3 py-2 text-[11px] font-medium uppercase tracking-wide text-muted-foreground"
+        style={{ width: LABEL_WIDTH_PX }}
+      >
+        {translate('auto.components.github.project.ProjectRoadmap.e304235879', 'Item')}
+      </div>
+      <div className="relative flex">
+        {ticks.map((tick, index) => {
+          const { label, sublabel } = formatRoadmapTick(tick, zoom, index, locale)
+          return (
+            <div
+              key={tick.key}
+              className="shrink-0 border-l border-border/40 px-2 py-2 text-[11px] text-muted-foreground"
+              style={{ width: tickWidth }}
+            >
+              <span className="font-medium text-foreground/80">{label}</span>
+              {sublabel ? <span className="ml-1 opacity-70">{sublabel}</span> : null}
+            </div>
+          )
+        })}
+        <div
+          aria-hidden
+          className="pointer-events-none absolute inset-y-0 w-px bg-foreground/30"
+          style={{ left: todayPx }}
+        />
+      </div>
+    </div>
+  )
+}
+
+function RoadmapLane({
+  row,
+  span,
+  ticks,
+  tickWidth,
+  timelineWidth,
+  colorFieldId,
+  locale,
+  onOpenDialog
+}: {
+  row: GitHubProjectRow
+  span: RoadmapSpan | null
+  ticks: RoadmapTick[]
+  tickWidth: number
+  timelineWidth: number
+  colorFieldId: string | null
+  locale: string
+  onOpenDialog?: (row: GitHubProjectRow) => void
+}): React.JSX.Element {
+  const statusValue = colorFieldId ? row.fieldValuesByFieldId[colorFieldId] : undefined
+  const chipColor = statusValue?.kind === 'single-select' ? statusValue.color : null
+  const left = span ? roadmapOffsetPx(span.startMs, ticks, tickWidth) : 0
+  const width = span ? roadmapOffsetPx(span.endMs, ticks, tickWidth) - left : 0
+  return (
+    <div
+      className="group flex items-stretch border-b border-border/30 hover:bg-accent/40"
+      style={{ minHeight: LANE_HEIGHT_PX }}
+    >
+      <div
+        className={cn(
+          'sticky left-0 z-10 flex shrink-0 items-center gap-2 overflow-hidden border-r border-border/40 px-3',
+          '[background:color-mix(in_srgb,var(--background)_95%,var(--muted))]',
+          'group-hover:[background:color-mix(in_srgb,var(--accent)_60%,var(--background))]'
+        )}
+        style={{ width: LABEL_WIDTH_PX }}
+      >
+        <ProjectTitleCell row={row} onOpenDialog={() => onOpenDialog?.(row)} />
+        {span ? null : (
+          <span className="shrink-0 text-[10px] text-muted-foreground">
+            {translate('auto.components.github.project.ProjectRoadmap.e077c79083', 'No dates')}
+          </span>
+        )}
+      </div>
+      <div className="relative shrink-0" style={{ width: timelineWidth }}>
+        {span ? (
+          <ProjectRoadmapBar
+            row={row}
+            span={span}
+            leftPx={left}
+            widthPx={width}
+            chipColor={chipColor}
+            locale={locale}
+            onOpen={() => onOpenDialog?.(row)}
+          />
+        ) : null}
+      </div>
+    </div>
+  )
+}
diff --git a/src/renderer/src/components/github-project/ProjectRoadmapBar.tsx b/src/renderer/src/components/github-project/ProjectRoadmapBar.tsx
new file mode 100644
index 00000000000..361378c0710
--- /dev/null
+++ b/src/renderer/src/components/github-project/ProjectRoadmapBar.tsx
@@ -0,0 +1,92 @@
+import React from 'react'
+import { GitPullRequest, Lock } from 'lucide-react'
+import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip'
+import { cn } from '@/lib/utils'
+import { translate } from '@/i18n/i18n'
+import { chipStyle, labelChipColors, singleSelectChipColors } from './project-cell-chip-colors'
+import { formatRoadmapSpan } from './roadmap-tick-format'
+import type { RoadmapSpan } from '../../../../shared/github/project-roadmap-timeline'
+import type { GitHubProjectRow } from '../../../../shared/github/project-types'
+
+const MIN_BAR_WIDTH_PX = 24
+
+type Props = {
+  row: GitHubProjectRow
+  span: RoadmapSpan
+  leftPx: number
+  widthPx: number
+  /** GitHub single-select color token for the row's status, when it has one. */
+  chipColor: string | null
+  locale: string
+  onOpen?: () => void
+}
+
+export default function ProjectRoadmapBar({
+  row,
+  span,
+  leftPx,
+  widthPx,
+  chipColor,
+  locale,
+  onOpen
+}: Props): React.JSX.Element {
+  const colors = chipColor ? singleSelectChipColors(chipColor) : labelChipColors('')
+  const interactive = row.itemType !== 'REDACTED' && row.itemType !== 'DRAFT_ISSUE'
+  const dates = formatRoadmapSpan(span, locale)
+  // Why: shared by the visible text, aria-label, and tooltip — a redacted row
+  // must never announce or render an empty name.
+  const title =
+    row.itemType === 'REDACTED'
+      ? translate('auto.components.github.project.ProjectRoadmapBar.7d1220d979', 'Restricted item')
+      : row.content.title
+  const bar = (
+    <button
+      type="button"
+      aria-disabled={interactive ? undefined : true}
+      onClick={interactive ? onOpen : undefined}
+      aria-label={translate(
+        'auto.components.github.project.ProjectRoadmapBar.cd68ccc17a',
+        '{{value0}} — {{value1}}',
+        { value0: title, value1: dates }
+      )}
+      className={cn(
+        'absolute top-1/2 flex h-6 -translate-y-1/2 items-center gap-1.5 overflow-hidden rounded-md px-2 text-[11px] font-medium leading-none',
+        'text-[var(--github-project-chip-fg-light)] dark:text-[var(--github-project-chip-fg-dark)]',
+        interactive ? 'cursor-pointer hover:brightness-110' : 'cursor-default',
+        row.itemType === 'REDACTED' && 'opacity-60',
+        // Why: a point marker sizes to its own label instead of the span, so
+        // a single-date item stays readable rather than collapsing to a sliver.
+        span.point && 'max-w-60'
+      )}
+      style={{
+        left: span.point ? Math.max(0, leftPx - 6) : leftPx,
+        ...(span.point ? {} : { width: Math.max(widthPx, MIN_BAR_WIDTH_PX) }),
+        ...chipStyle(colors)
+      }}
+    >
+      {span.point ? (
+        <span aria-hidden className="size-2 shrink-0 rotate-45 rounded-[1px] bg-current" />
+      ) : null}
+      {row.itemType === 'PULL_REQUEST' ? (
+        <GitPullRequest className="size-3 shrink-0" />
+      ) : row.itemType === 'REDACTED' ? (
+        <Lock className="size-3 shrink-0" />
+      ) : null}
+      {row.content.number == null ? null : (
+        <span className="shrink-0 opacity-70">#{row.content.number}</span>
+      )}
+      <span className="truncate">{title}</span>
+    </button>
+  )
+  return (
+    <Tooltip>
+      <TooltipTrigger asChild>{bar}</TooltipTrigger>
+      <TooltipContent side="top" align="start">
+        <div className="max-w-72 space-y-0.5">
+          <div className="truncate font-medium">{title}</div>
+          <div className="text-muted-foreground">{dates}</div>
+        </div>
+      </TooltipContent>
+    </Tooltip>
+  )
+}
diff --git a/src/renderer/src/components/github-project/ProjectViewStates.tsx b/src/renderer/src/components/github-project/ProjectViewStates.tsx
index 83e088b2759..e3184878851 100644
--- a/src/renderer/src/components/github-project/ProjectViewStates.tsx
+++ b/src/renderer/src/components/github-project/ProjectViewStates.tsx
@@ -42,13 +42,17 @@ function ProjectViewTab({
   active: boolean
   onPick: (viewId: string) => void
 }): React.JSX.Element {
-  const supported = view.layout === 'TABLE_LAYOUT'
+  // Why: allowlist, not denylist — raw.layout is cast unchecked, so a future
+  // GitHub layout value must stay disabled instead of masquerading as a table.
+  const supported = view.layout === 'TABLE_LAYOUT' || view.layout === 'ROADMAP_LAYOUT'
   const layoutLabel =
     view.layout === 'BOARD_LAYOUT'
       ? 'Board'
       : view.layout === 'ROADMAP_LAYOUT'
         ? 'Roadmap'
-        : 'Table'
+        : view.layout === 'TABLE_LAYOUT'
+          ? 'Table'
+          : formatUnknownLayout(view.layout)
   const Icon =
     view.layout === 'BOARD_LAYOUT'
       ? KanbanSquare
@@ -106,8 +110,8 @@ function ProjectViewTab({
           <p className="text-xs leading-5 text-muted-foreground">
             {message}{' '}
             {translate(
-              'auto.components.github.project.ProjectViewWrapper.1bf8c01c8b',
-              'Switch to a Table view to work with this project in Orca.'
+              'auto.components.github.project.ProjectViewStates.ac83c45672',
+              'Switch to a Table or Roadmap view to work with this project in Orca.'
             )}
           </p>
           <Button
@@ -154,7 +158,12 @@ export function ProjectViewErrorState({
     error.type === 'too_large'
       ? `This view has ${totalCount ?? 'many'} items — too large to render in Orca. Narrow the view's filter on GitHub.`
       : error.type === 'unsupported_layout'
-        ? 'Orca only renders table views yet. This is a Board or Roadmap view.'
+        ? // Why: an older paired host still reports roadmaps as unsupported, so this
+          // copy must not name the layout — the tab strip already does that.
+          translate(
+            'auto.components.github.project.ProjectViewStates.e4cc8b14f2',
+            'Orca renders table and roadmap project views. This view uses a layout it cannot render yet.'
+          )
         : error.type === 'not_found'
           ? 'Could not find this project or view.'
           : error.type === 'schema_drift'
@@ -168,6 +177,14 @@ export function ProjectViewErrorState({
   )
 }
 
+function formatUnknownLayout(layout: string): string {
+  const base = layout
+    .replace(/_LAYOUT$/, '')
+    .replaceAll('_', ' ')
+    .toLowerCase()
+  return base ? base.charAt(0).toUpperCase() + base.slice(1) : layout
+}
+
 function OpenInGitHubButton({ onClick }: { onClick: () => void }): React.JSX.Element {
   return (
     <Button size="sm" variant="outline" onClick={onClick}>
diff --git a/src/renderer/src/components/github-project/ProjectViewWrapper.tsx b/src/renderer/src/components/github-project/ProjectViewWrapper.tsx
index effce05b970..1a40186edea 100644
--- a/src/renderer/src/components/github-project/ProjectViewWrapper.tsx
+++ b/src/renderer/src/components/github-project/ProjectViewWrapper.tsx
@@ -4,6 +4,7 @@ import { launchWorkItemDirect } from '@/lib/launch-work-item-direct'
 import { useAppStore } from '@/store'
 import { translate } from '@/i18n/i18n'
 import ProjectViewList from './ProjectViewList'
+import ProjectRoadmap from './ProjectRoadmap'
 import ProjectItemSlugDialog from './ProjectItemSlugDialog'
 import { ProjectMissingRepoDialog } from './ProjectMissingRepoDialog'
 import { ProjectViewToolbar } from './ProjectViewToolbar'
@@ -123,7 +124,7 @@ function ProjectViewBody({
   if (!visibleTable) {
     return null
   }
-  return (
+  const list = (
     <ProjectViewList
       table={visibleTable}
       onOpenDialog={rowActions.openDialog}
@@ -140,4 +141,10 @@ function ProjectViewBody({
       sourceSettings={tableState.settings}
     />
   )
+  if (visibleTable.selectedView.layout === 'ROADMAP_LAYOUT') {
+    return (
+      <ProjectRoadmap table={visibleTable} onOpenDialog={rowActions.openDialog} fallback={list} />
+    )
+  }
+  return list
 }
diff --git a/src/renderer/src/components/github-project/roadmap-tick-format.ts b/src/renderer/src/components/github-project/roadmap-tick-format.ts
new file mode 100644
index 00000000000..2157939ab75
--- /dev/null
+++ b/src/renderer/src/components/github-project/roadmap-tick-format.ts
@@ -0,0 +1,68 @@
+// Why: tick geometry is locale-free and lives in the shared timeline module;
+// only the human-readable labels need Intl, so they are formatted here.
+import type {
+  RoadmapSpan,
+  RoadmapTick,
+  RoadmapZoom
+} from '../../../../shared/github/project-roadmap-timeline'
+import { ROADMAP_DAY_MS } from '../../../../shared/github/project-roadmap-timeline'
+
+export type RoadmapTickLabel = { label: string; sublabel: string | null }
+
+// Why: Intl.DateTimeFormat construction costs ~0.1-1ms, and these run per tick
+// and per bar on every render — cache per locale; the options never vary.
+const monthFormatters = new Map<string, Intl.DateTimeFormat>()
+const dayFormatters = new Map<string, Intl.DateTimeFormat>()
+
+function cachedFormatter(
+  cache: Map<string, Intl.DateTimeFormat>,
+  locale: string,
+  options: Intl.DateTimeFormatOptions
+): Intl.DateTimeFormat {
+  let formatter = cache.get(locale)
+  if (!formatter) {
+    formatter = new Intl.DateTimeFormat(locale, options)
+    cache.set(locale, formatter)
+  }
+  return formatter
+}
+
+export function formatRoadmapTick(
+  tick: RoadmapTick,
+  zoom: RoadmapZoom,
+  index: number,
+  locale: string
+): RoadmapTickLabel {
+  const date = new Date(tick.startMs)
+  const year = String(date.getUTCFullYear())
+  if (zoom === 'year') {
+    return { label: year, sublabel: null }
+  }
+  if (zoom === 'quarter') {
+    return { label: `Q${Math.floor(date.getUTCMonth() / 3) + 1}`, sublabel: year }
+  }
+  const month = cachedFormatter(monthFormatters, locale, {
+    month: 'short',
+    timeZone: 'UTC'
+  }).format(date)
+  // Why: repeating the year on every month is noise — show it where the
+  // reader loses the thread, at the grid's start and each January.
+  return { label: month, sublabel: index === 0 || date.getUTCMonth() === 0 ? year : null }
+}
+
+/** Renders the span back as the inclusive calendar range the user typed on
+ *  GitHub, so the tooltip matches the field values rather than the exclusive
+ *  end the geometry uses. */
+export function formatRoadmapSpan(span: RoadmapSpan, locale: string): string {
+  const format = cachedFormatter(dayFormatters, locale, {
+    year: 'numeric',
+    month: 'short',
+    day: 'numeric',
+    timeZone: 'UTC'
+  })
+  const start = format.format(new Date(span.startMs))
+  if (span.point) {
+    return start
+  }
+  return `${start} – ${format.format(new Date(span.endMs - ROADMAP_DAY_MS))}`
+}
diff --git a/src/renderer/src/components/github-project/roadmap-zoom-preference.ts b/src/renderer/src/components/github-project/roadmap-zoom-preference.ts
new file mode 100644
index 00000000000..843a75089cd
--- /dev/null
+++ b/src/renderer/src/components/github-project/roadmap-zoom-preference.ts
@@ -0,0 +1,27 @@
+// Why: timeline zoom is a per-device viewing preference like column widths —
+// keep it out of the debounced settings write and off the remote wire.
+import type { RoadmapZoom } from '../../../../shared/github/project-roadmap-timeline'
+
+const STORAGE_KEY = 'orca.githubProject.roadmapZoom'
+const DEFAULT_ZOOM: RoadmapZoom = 'month'
+
+function isRoadmapZoom(value: string | null): value is RoadmapZoom {
+  return value === 'month' || value === 'quarter' || value === 'year'
+}
+
+export function loadRoadmapZoom(): RoadmapZoom {
+  try {
+    const stored = window.localStorage.getItem(STORAGE_KEY)
+    return isRoadmapZoom(stored) ? stored : DEFAULT_ZOOM
+  } catch {
+    return DEFAULT_ZOOM
+  }
+}
+
+export function saveRoadmapZoom(zoom: RoadmapZoom): void {
+  try {
+    window.localStorage.setItem(STORAGE_KEY, zoom)
+  } catch {
+    // localStorage may be disabled — zoom just won't persist this session.
+  }
+}
diff --git a/src/renderer/src/components/mobile/MobilePage.test.tsx b/src/renderer/src/components/mobile/MobilePage.test.tsx
index 2ef1cf5e965..2149cadc284 100644
--- a/src/renderer/src/components/mobile/MobilePage.test.tsx
+++ b/src/renderer/src/components/mobile/MobilePage.test.tsx
@@ -18,6 +18,7 @@ type StoreState = {
     mobilePairingCustomAddresses?: string[]
   }
   updateSettings: () => Promise<void>
+  fetchOrcaProfileAuthStatus: () => Promise<unknown>
 }
 
 const mocks = vi.hoisted(() => ({
@@ -146,7 +147,8 @@ describe('MobilePage pairing connection mode', () => {
       closeMobilePage: vi.fn(),
       orcaProfileAuthStatus: { state: 'connected' },
       settings: { showMobileButton: true },
-      updateSettings: vi.fn().mockResolvedValue(undefined)
+      updateSettings: vi.fn().mockResolvedValue(undefined),
+      fetchOrcaProfileAuthStatus: vi.fn().mockResolvedValue(null)
     }
     Object.defineProperty(window, 'api', {
       configurable: true,
diff --git a/src/renderer/src/components/mobile/MobilePage.tsx b/src/renderer/src/components/mobile/MobilePage.tsx
index ccb9a9e093f..434f0298626 100644
--- a/src/renderer/src/components/mobile/MobilePage.tsx
+++ b/src/renderer/src/components/mobile/MobilePage.tsx
@@ -39,6 +39,7 @@ export default function MobilePage(): React.JSX.Element {
   const [relayMintFailure, setRelayMintFailure] = useState<MobileRelayMintFailure | null>(null)
   const [pairLoading, setPairLoading] = useState(false)
   const signedIn = useAppStore((state) => state.orcaProfileAuthStatus?.state === 'connected')
+  const refreshAuthStatus = useAppStore((state) => state.fetchOrcaProfileAuthStatus)
   const [connectionMode, setConnectionMode] = useMobilePairingConnectionMode()
   const [networkInterfaces, setNetworkInterfaces] = useState<MobileNetworkInterface[]>([])
   const pairingAddressChangeRef = useRef<(change: MobilePairingAddressChange) => void>(() => {})
@@ -93,7 +94,8 @@ export default function MobilePage(): React.JSX.Element {
     setPairingUrl,
     setPairingQrError,
     setPairLoading,
-    setRelayMintFailure
+    setRelayMintFailure,
+    refreshAuthStatus
   })
   useLayoutEffect(() => {
     pairingAddressChangeRef.current = ({ address, source }) => {
diff --git a/src/renderer/src/components/mobile/mobile-platform-copy.ts b/src/renderer/src/components/mobile/mobile-platform-copy.ts
index fd70176609d..cd6669891a3 100644
--- a/src/renderer/src/components/mobile/mobile-platform-copy.ts
+++ b/src/renderer/src/components/mobile/mobile-platform-copy.ts
@@ -22,7 +22,7 @@ const IOS_CHANNEL_COPY: Record<IosChannel, InstallCopy> = {
 
 const ANDROID_COPY: InstallCopy = {
   ctaLabel: 'Download APK',
-  url: 'https://github.com/stablyai/orca/releases/download/mobile-android-v0.0.46/app-release.apk'
+  url: 'https://github.com/stablyai/orca/releases/download/mobile-android-v0.0.47/app-release.apk'
 }
 
 export function getInstallCopy(platform: Platform, iosChannel: IosChannel): InstallCopy {
diff --git a/src/renderer/src/components/mobile/mobile-relay-mint-failure-notice.tsx b/src/renderer/src/components/mobile/mobile-relay-mint-failure-notice.tsx
index d5e929152fb..ee3d82a51d1 100644
--- a/src/renderer/src/components/mobile/mobile-relay-mint-failure-notice.tsx
+++ b/src/renderer/src/components/mobile/mobile-relay-mint-failure-notice.tsx
@@ -3,6 +3,7 @@ import { CircleAlert, Loader2 } from 'lucide-react'
 import { Button } from '../ui/button'
 import { translate } from '@/i18n/i18n'
 import type { MobileRelayMintFailure } from '../../../../shared/mobile-relay-mint-failure'
+import { useAppStore } from '@/store'
 import { cn } from '@/lib/utils'
 
 export function MobileRelayMintFailureNotice({
@@ -23,6 +24,10 @@ export function MobileRelayMintFailureNotice({
   busy?: boolean
 }): React.JSX.Element {
   const providerMissing = failure.stage === 'provider_missing'
+  // Why: a revoked cloud session fails every mint; "retry or use LAN" hides the one action that works.
+  const reconnectRequired = useAppStore(
+    (state) => state.orcaProfileAuthStatus?.state === 'reconnect-required'
+  )
   const [showBusyFeedback, setShowBusyFeedback] = useState(false)
   useEffect(() => {
     if (!busy) {
@@ -43,10 +48,15 @@ export function MobileRelayMintFailureNotice({
           'auto.components.mobile.MobileRelayMintFailureNotice.unavailableTitle',
           'Orca Relay isn’t available on this desktop.'
         )
-      : translate(
-          'auto.components.mobile.MobileRelayMintFailureNotice.title',
-          'Couldn’t create a Relay pairing code.'
-        )
+      : reconnectRequired
+        ? translate(
+            'auto.components.mobile.MobileRelayMintFailureNotice.reconnectTitle',
+            'Your Orca account session expired.'
+          )
+        : translate(
+            'auto.components.mobile.MobileRelayMintFailureNotice.title',
+            'Couldn’t create a Relay pairing code.'
+          )
   const body = visibleBusy
     ? translate(
         'auto.components.mobile.MobileRelayMintFailureNotice.retryingBody',
@@ -57,10 +67,15 @@ export function MobileRelayMintFailureNotice({
           'auto.components.mobile.MobileRelayMintFailureNotice.unavailableBody',
           'Use LAN to pair over Tailscale or the same Wi‑Fi.'
         )
-      : translate(
-          'auto.components.mobile.MobileRelayMintFailureNotice.body',
-          'Retry, or use LAN to pair over Tailscale or the same Wi‑Fi.'
-        )
+      : reconnectRequired
+        ? translate(
+            'auto.components.mobile.MobileRelayMintFailureNotice.reconnectBody',
+            'Sign in again to use Orca Relay, or use LAN to pair over Tailscale or the same Wi‑Fi.'
+          )
+        : translate(
+            'auto.components.mobile.MobileRelayMintFailureNotice.body',
+            'Retry, or use LAN to pair over Tailscale or the same Wi‑Fi.'
+          )
 
   return (
     <div
@@ -90,7 +105,7 @@ export function MobileRelayMintFailureNotice({
           <Button type="button" size={compact ? 'xs' : 'sm'} onClick={onUseLan}>
             {translate('auto.components.mobile.MobileRelayMintFailureNotice.useLan', 'Use LAN')}
           </Button>
-          {!providerMissing ? (
+          {!providerMissing && !reconnectRequired ? (
             <Button
               type="button"
               size={compact ? 'xs' : 'sm'}
diff --git a/src/renderer/src/components/mobile/use-mobile-pairing-generation.ts b/src/renderer/src/components/mobile/use-mobile-pairing-generation.ts
index 084d256e424..088e1c6d229 100644
--- a/src/renderer/src/components/mobile/use-mobile-pairing-generation.ts
+++ b/src/renderer/src/components/mobile/use-mobile-pairing-generation.ts
@@ -28,6 +28,8 @@ export function useMobilePairingGeneration(params: {
   setPairingQrError: (value: boolean) => void
   setPairLoading: (value: boolean) => void
   setRelayMintFailure: (value: MobileRelayMintFailure | null) => void
+  /** Re-read on a Relay mint failure: a revoked session is the likeliest cause. */
+  refreshAuthStatus: () => void
 }): {
   generatePairing: (
     rotate: boolean,
@@ -47,7 +49,8 @@ export function useMobilePairingGeneration(params: {
     setPairingUrl,
     setPairingQrError,
     setPairLoading,
-    setRelayMintFailure
+    setRelayMintFailure,
+    refreshAuthStatus
   } = params
 
   const generatePairing = useCallback(
@@ -92,6 +95,7 @@ export function useMobilePairingGeneration(params: {
             setPairingQrError(false)
             if (result.reason === 'relay_mint_failed' && result.relayFailure) {
               setRelayMintFailure(result.relayFailure)
+              refreshAuthStatus()
             } else {
               setRelayMintFailure(null)
               // Why: IPC now forwards reason/guidance for all unavailability paths;
@@ -132,6 +136,7 @@ export function useMobilePairingGeneration(params: {
       hasGeneratedRef,
       mountedRef,
       pairingRequestIdRef,
+      refreshAuthStatus,
       selectedAddress,
       setPairLoading,
       setPairQrDataUrl,
diff --git a/src/renderer/src/components/native-chat/NativeChatBackgroundTasksStatus.tsx b/src/renderer/src/components/native-chat/NativeChatBackgroundTasksStatus.tsx
new file mode 100644
index 00000000000..9f8f08e1efd
--- /dev/null
+++ b/src/renderer/src/components/native-chat/NativeChatBackgroundTasksStatus.tsx
@@ -0,0 +1,140 @@
+import { useId, useState } from 'react'
+import { ChevronDown } from 'lucide-react'
+import type { AgentSessionBackgroundTask } from '../../../../shared/agent-session-wire'
+import { AgentStateDot } from '@/components/AgentStateDot'
+import { Button } from '@/components/ui/button'
+import { translate } from '@/i18n/i18n'
+
+function backgroundTaskLabel(task: AgentSessionBackgroundTask): string {
+  if (task.description) {
+    return task.description
+  }
+  switch (task.kind) {
+    case 'agent':
+      return translate('components.native-chat.backgroundTasks.agent', 'Background agent')
+    case 'workflow':
+      return translate('components.native-chat.backgroundTasks.workflow', 'Background workflow')
+    case 'command':
+      return translate('components.native-chat.backgroundTasks.command', 'Background command')
+    case 'monitor':
+      return translate('components.native-chat.backgroundTasks.monitor', 'Background monitor')
+    case 'unknown':
+      return translate('components.native-chat.backgroundTasks.task', 'Background task')
+  }
+}
+
+export function NativeChatBackgroundTasksStatus(props: {
+  tasks: readonly AgentSessionBackgroundTask[]
+  supportsTaskStop: boolean
+  stoppingTaskIds: ReadonlySet<string>
+  stoppingAll: boolean
+  onStop: (taskId?: string) => void
+}): React.JSX.Element {
+  const [expanded, setExpanded] = useState(false)
+  const taskListId = useId()
+  return (
+    <div
+      data-native-chat-background-tasks="true"
+      className="shrink-0 bg-background px-3 pt-2 sm:px-4"
+    >
+      <div className="mx-auto w-full max-w-4xl overflow-hidden rounded-lg border border-border bg-muted/50 text-xs text-muted-foreground shadow-xs">
+        <div className="flex h-8 items-center px-1.5">
+          <button
+            type="button"
+            className="flex h-6 min-w-0 flex-1 cursor-pointer items-center gap-2 rounded-md px-1.5 text-left outline-none hover:bg-accent hover:text-accent-foreground focus-visible:ring-[3px] focus-visible:ring-ring/50"
+            aria-expanded={expanded}
+            aria-controls={taskListId}
+            onClick={() => setExpanded((current) => !current)}
+          >
+            <span aria-hidden="true">
+              <AgentStateDot state="monitoring" size="md" title={null} />
+            </span>
+            <span className="min-w-0 flex-1 truncate">
+              {translate(
+                'components.native-chat.backgroundTasks.monitoring',
+                'Monitoring background tasks'
+              )}
+            </span>
+            <ChevronDown
+              aria-hidden="true"
+              className={`size-3 transition-transform ${expanded ? 'rotate-180' : ''}`}
+            />
+          </button>
+        </div>
+        {expanded ? (
+          <div
+            id={taskListId}
+            className="scrollbar-sleek max-h-40 overflow-y-auto border-t border-border px-3 py-2"
+          >
+            {props.tasks.length > 0 ? (
+              <ul
+                role="list"
+                aria-label={translate(
+                  'components.native-chat.backgroundTasks.runningList',
+                  'Running background tasks'
+                )}
+                className="space-y-1.5"
+              >
+                {props.tasks.map((task) => {
+                  const label = backgroundTaskLabel(task)
+                  return (
+                    <li
+                      key={task.id}
+                      className="flex min-w-0 items-center gap-2 text-foreground/80"
+                    >
+                      <span
+                        aria-hidden="true"
+                        className="size-1.5 shrink-0 rounded-full bg-primary"
+                      />
+                      <span className="min-w-0 flex-1 break-words">{label}</span>
+                      {props.supportsTaskStop ? (
+                        <Button
+                          type="button"
+                          variant="ghost"
+                          size="xs"
+                          aria-label={translate(
+                            'components.native-chat.backgroundTasks.stopTask',
+                            'Stop {{value0}}',
+                            { value0: label }
+                          )}
+                          disabled={props.stoppingTaskIds.has(task.id)}
+                          onClick={() => props.onStop(task.id)}
+                        >
+                          {translate('components.native-chat.backgroundTasks.stop', 'Stop')}
+                        </Button>
+                      ) : null}
+                    </li>
+                  )
+                })}
+              </ul>
+            ) : (
+              <p>
+                {translate(
+                  'components.native-chat.backgroundTasks.detailsUnavailable',
+                  'Task details are unavailable for this session.'
+                )}
+              </p>
+            )}
+            {!props.supportsTaskStop ? (
+              <div className={props.tasks.length > 0 ? 'mt-2 border-t border-border pt-2' : 'mt-2'}>
+                <Button
+                  type="button"
+                  variant="ghost"
+                  size="xs"
+                  aria-label={translate(
+                    'components.native-chat.backgroundTasks.stopAll',
+                    'Stop background tasks'
+                  )}
+                  disabled={props.stoppingAll}
+                  onClick={() => props.onStop()}
+                >
+                  {translate('components.native-chat.backgroundTasks.stop', 'Stop')}
+                </Button>
+              </div>
+            ) : null}
+          </div>
+        ) : null}
+      </div>
+    </div>
+  )
+}
diff --git a/src/renderer/src/components/native-chat/NativeChatComposer.test.tsx b/src/renderer/src/components/native-chat/NativeChatComposer.test.tsx
index a1aecd23419..a6f233b96a3 100644
--- a/src/renderer/src/components/native-chat/NativeChatComposer.test.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatComposer.test.tsx
@@ -6,7 +6,6 @@ import type {
   SessionOptionDescriptor,
   SessionOptionsSurface
 } from '../../../../shared/native-chat-session-options'
-import type * as nativeChatAgentProfiles from '../../../../shared/native-chat-agent-profiles'
 import { clearNativeChatSessionOptionCacheForTests } from './native-chat-session-option-cache'
 import { clearNativeChatModelEnrichmentForTests } from './native-chat-session-option-enrichment'
 
@@ -27,6 +26,7 @@ const mocks = vi.hoisted(() => ({
     sessionOptionsSnapshot?: SessionOptionDescriptor[]
     attachDisabled?: boolean
     sendButtonDisabled?: boolean
+    autocomplete?: { mode: string; items?: { kind: string; name: string }[] }
   } | null,
   modelSwitchOutcome: 'applied' as 'applied' | 'rejected' | 'unknown',
   confirmationObserver: null as {
@@ -90,10 +90,6 @@ vi.mock('./claude-model-switch-confirmation', () => ({
   createClaudeModelSwitchConfirmationObserver: (...args: unknown[]) =>
     mocks.createClaudeModelSwitchConfirmationObserver(...args)
 }))
-vi.mock('../../../../shared/native-chat-agent-profiles', async (importOriginal) => ({
-  ...(await importOriginal<typeof nativeChatAgentProfiles>()),
-  getVerifiedNativeChatCommands: () => []
-}))
 vi.mock('@/lib/native-chat-telemetry', () => ({
   emitNativeChatMessageSent: vi.fn(),
   emitNativeChatPickerItemAccepted: vi.fn(),
@@ -308,6 +304,43 @@ describe('NativeChatComposer', () => {
     expect(mocks.setDraft).toHaveBeenCalledWith('')
   })
 
+  // The structured slash menu must offer the running agent's own catalog. Offering
+  // another agent's tokens sends them past the command guard as literal prompt text.
+  it.each([
+    ['claude', 'compact', 'vim'],
+    ['codex', 'vim', 'help']
+  ] as const)('offers %s its own structured slash commands', (agent, offered, withheld) => {
+    mocks.draft = '/'
+    render(
+      <NativeChatComposer
+        terminalTabId="tab-1"
+        paneKey={`tab-1:structured-${agent}`}
+        targetPtyId={null}
+        agent={agent}
+        structuredTransport={{
+          send: vi.fn(() => true),
+          dispatchCommand: vi.fn(async () => ({ handled: false, accepted: false, error: null })),
+          optionsSurface: {
+            getSnapshot: () => [],
+            setOption: vi.fn(),
+            invokeAction: vi.fn(),
+            subscribe: () => () => {}
+          },
+          optionSnapshot: [],
+          onError: vi.fn(),
+          runtime: 'local'
+        }}
+      />
+    )
+
+    const names = (mocks.fieldProps?.autocomplete?.items ?? [])
+      .filter((item) => item.kind === 'command')
+      .map((item) => item.name)
+    expect(names).toContain(offered)
+    expect(names).toContain('effort')
+    expect(names).not.toContain(withheld)
+  })
+
   it('sends structured image attachments through the durable transport', async () => {
     mocks.draft = ''
     mocks.imageAttachments = [{ id: 'image-1', path: '/tmp/image.png' }]
diff --git a/src/renderer/src/components/native-chat/NativeChatComposer.tsx b/src/renderer/src/components/native-chat/NativeChatComposer.tsx
index e0b1d97a057..06ae0ec5c8c 100644
--- a/src/renderer/src/components/native-chat/NativeChatComposer.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatComposer.tsx
@@ -3,7 +3,7 @@ import { useAppStore } from '../../store'
 import { sendRuntimePtyInput } from '@/runtime/runtime-terminal-inspection'
 import { getSettingsForAgentTabRuntimeOwner } from '@/lib/agent-paste-draft'
 import { getVerifiedNativeChatCommands } from '../../../../shared/native-chat-agent-profiles'
-import { STRUCTURED_AGENT_SESSION_SLASH_COMMANDS } from '../../../../shared/structured-agent-session-composer'
+import { structuredSlashCommands } from '../../../../shared/structured-agent-session-composer'
 import {
   applyMentionSuggestion,
   EMPTY_HISTORY,
@@ -111,9 +111,7 @@ const NativeChatComposerPane = forwardRef<NativeChatComposerHandle, NativeChatCo
 
     const agentCommands = useMemo(
       () =>
-        structuredTransport
-          ? STRUCTURED_AGENT_SESSION_SLASH_COMMANDS
-          : getVerifiedNativeChatCommands(agent),
+        structuredTransport ? structuredSlashCommands(agent) : getVerifiedNativeChatCommands(agent),
       [agent, structuredTransport]
     )
     const picker = useNativeChatPickerState({
diff --git a/src/renderer/src/components/native-chat/NativeChatCopyButton.tsx b/src/renderer/src/components/native-chat/NativeChatCopyButton.tsx
index 36fa791f57d..0e933584d41 100644
--- a/src/renderer/src/components/native-chat/NativeChatCopyButton.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatCopyButton.tsx
@@ -12,9 +12,12 @@ import { translate } from '@/i18n/i18n'
  */
 export function NativeChatCopyButton({
   text,
+  label: copyLabel,
   className
 }: {
   text: string
+  /** What this button copies, when it is not the whole message. */
+  label?: string
   className?: string
 }): React.JSX.Element {
   const [copied, setCopied] = useState(false)
@@ -46,7 +49,7 @@ export function NativeChatCopyButton({
 
   const label = copied
     ? translate('components.native-chat.copyMessage.copied', 'Copied')
-    : translate('components.native-chat.copyMessage.copy', 'Copy message')
+    : (copyLabel ?? translate('components.native-chat.copyMessage.copy', 'Copy message'))
 
   return (
     <button
diff --git a/src/renderer/src/components/native-chat/NativeChatDiffCard.tsx b/src/renderer/src/components/native-chat/NativeChatDiffCard.tsx
new file mode 100644
index 00000000000..8bbdb6ce988
--- /dev/null
+++ b/src/renderer/src/components/native-chat/NativeChatDiffCard.tsx
@@ -0,0 +1,203 @@
+import { useMemo, useState } from 'react'
+import { ChevronRight, FilePlus2, FileMinus2, FilePen } from 'lucide-react'
+import { cn } from '@/lib/utils'
+import { translate } from '@/i18n/i18n'
+import { DiffLineCounts } from '../right-sidebar/source-control/listing/diff-line-counts'
+import { NativeChatCopyButton } from './NativeChatCopyButton'
+import {
+  unifiedLineNumber,
+  type NativeChatEditFile,
+  type NativeChatEditLine
+} from '../../../../shared/native-chat-edit-model'
+
+function verbLabel(file: NativeChatEditFile): string {
+  switch (file.changeKind) {
+    case 'added':
+      return translate('components.native-chat.tool.addedFile', 'Added file')
+    case 'deleted':
+      return translate('components.native-chat.tool.deletedFile', 'Deleted file')
+    case 'renamed':
+      return translate('components.native-chat.tool.renamedFile', 'Renamed file')
+    case 'edited':
+      return translate('components.native-chat.tool.editedFile', 'Edited file')
+  }
+}
+
+function VerbIcon({ kind }: { kind: NativeChatEditFile['changeKind'] }): React.JSX.Element {
+  const className = 'size-3.5 shrink-0 text-muted-foreground'
+  if (kind === 'added') {
+    return <FilePlus2 className={className} />
+  }
+  if (kind === 'deleted') {
+    return <FileMinus2 className={className} />
+  }
+  return <FilePen className={className} />
+}
+
+function baseName(path: string): string {
+  return path.split(/[\\/]/).at(-1) || path
+}
+
+function patchText(lines: readonly NativeChatEditLine[]): string {
+  return lines
+    .filter((line) => line.kind !== 'gap')
+    .map((line) => `${line.kind === 'add' ? '+' : line.kind === 'del' ? '-' : ' '}${line.text}`)
+    .join('\n')
+}
+
+/** The break between two regions of the file, quiet enough not to read as a
+ *  row of content but present enough that the gutter's jump is accounted for. */
+function DiffGapRow(): React.JSX.Element {
+  return (
+    <div
+      role="separator"
+      aria-label={translate('components.native-chat.tool.diffGap', 'Lines not shown')}
+      className="select-none border-y border-border/60 bg-accent/30 py-0.5 text-center text-muted-foreground"
+    >
+      ⋯
+    </div>
+  )
+}
+
+function DiffRow({ line, gutterWidth }: { line: NativeChatEditLine; gutterWidth: number }) {
+  if (line.kind === 'gap') {
+    return <DiffGapRow />
+  }
+  return (
+    <div
+      className={cn(
+        'flex items-start',
+        line.kind === 'add' && 'bg-[var(--diff-added-ground)]',
+        line.kind === 'del' && 'bg-[var(--diff-removed-ground)]'
+      )}
+    >
+      {gutterWidth > 0 ? (
+        <span
+          // Why: the gutter carries its own ground so the number column stays
+          // legible against a tinted row instead of dissolving into it.
+          className={cn(
+            'shrink-0 select-none pr-1.5 text-right tabular-nums text-muted-foreground',
+            line.kind === 'add' && 'bg-[var(--diff-added-gutter)]',
+            line.kind === 'del' && 'bg-[var(--diff-removed-gutter)]',
+            line.kind === 'context' && 'bg-accent/40'
+          )}
+          style={{ width: `${gutterWidth}ch` }}
+          aria-hidden
+        >
+          {unifiedLineNumber(line) ?? ''}
+        </span>
+      ) : null}
+      <span
+        className={cn(
+          'w-3 shrink-0 select-none text-center',
+          line.kind === 'add' && 'text-[var(--git-decoration-added)]',
+          line.kind === 'del' && 'text-[var(--git-decoration-deleted)]'
+        )}
+        aria-hidden
+      >
+        {line.kind === 'add' ? '+' : line.kind === 'del' ? '-' : ' '}
+      </span>
+      <span className="min-w-0 whitespace-pre-wrap break-words pr-2 text-foreground/85">
+        {line.text}
+      </span>
+    </div>
+  )
+}
+
+/** Inline card for one file an agent edited: verb header, path with change
+ *  counts, and the unified rows. The gutter is blank when the provider gave no
+ *  resolved ranges, because a snippet-relative number would read as a file
+ *  position. A change reported with no body — a delete names the file and
+ *  nothing else — keeps the header rows and offers no empty disclosure. */
+export function NativeChatDiffCard({
+  file,
+  initiallyExpanded = false
+}: {
+  file: NativeChatEditFile
+  initiallyExpanded?: boolean
+}): React.JSX.Element {
+  const [expanded, setExpanded] = useState(initiallyExpanded)
+  // Joining every row to seed the copy button is the card's most expensive
+  // work, and a collapsed card renders none of those rows.
+  const copyText = useMemo(() => patchText(file.lines), [file.lines])
+  const hasBody = file.lines.length > 0
+  const widest = file.lineNumbersKnown
+    ? file.lines.reduce((max, line) => Math.max(max, unifiedLineNumber(line) ?? 0), 0)
+    : 0
+  const gutterWidth = file.lineNumbersKnown ? Math.max(3, String(widest).length + 1) : 0
+
+  return (
+    <div className="my-1 overflow-hidden rounded-md border border-border">
+      <button
+        type="button"
+        onClick={() => hasBody && setExpanded((value) => !value)}
+        className={cn(
+          'group flex w-full items-center gap-1.5 px-2 py-1 text-left',
+          hasBody ? 'cursor-pointer hover:bg-accent/30' : 'cursor-default'
+        )}
+        aria-expanded={hasBody ? expanded : undefined}
+      >
+        <VerbIcon kind={file.changeKind} />
+        <span className="shrink-0 text-[11px] text-muted-foreground group-hover:text-foreground/80">
+          {verbLabel(file)}
+        </span>
+        {hasBody ? (
+          <ChevronRight
+            className={cn(
+              'size-3.5 shrink-0 text-muted-foreground transition-transform',
+              expanded && 'rotate-90'
+            )}
+          />
+        ) : null}
+      </button>
+      <div className="flex items-center gap-1.5 border-t border-border bg-accent/40 px-2 py-1">
+        {file.oldPath ? (
+          <>
+            <span className="min-w-0 truncate font-mono text-[11px] text-muted-foreground line-through">
+              {baseName(file.oldPath)}
+            </span>
+            <span className="shrink-0 text-[11px] text-muted-foreground">→</span>
+          </>
+        ) : null}
+        <span
+          className="min-w-0 truncate font-mono text-[11px] font-medium text-foreground"
+          title={file.path}
+        >
+          {baseName(file.path)}
+        </span>
+        <DiffLineCounts added={file.added} removed={file.removed} />
+        {file.truncated ? (
+          // Beside the counts rather than under the rows: a collapsed card, and
+          // one clipped down to no rows at all, would otherwise say nothing.
+          <span className="shrink-0 text-[11px] text-muted-foreground">
+            {translate('components.native-chat.tool.diffTruncated', 'Diff truncated')}
+          </span>
+        ) : null}
+        <NativeChatCopyButton
+          text={copyText}
+          label={translate('components.native-chat.tool.copyDiff', 'Copy diff')}
+          className="ml-auto shrink-0"
+        />
+      </div>
+      {hasBody && expanded ? (
+        // Focusable so the rows can be scrolled from the keyboard.
+        <div
+          tabIndex={0}
+          className="max-h-72 overflow-auto font-mono text-[11px] leading-relaxed scrollbar-sleek focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-ring/70"
+        >
+          {(() => {
+            const seen = new Map<string, number>()
+            return file.lines.map((line) => {
+              const signature = `${line.kind}:${line.oldLineNumber}:${line.newLineNumber}:${line.text}`
+              const occurrence = seen.get(signature) ?? 0
+              seen.set(signature, occurrence + 1)
+              return (
+                <DiffRow key={`${signature}:${occurrence}`} line={line} gutterWidth={gutterWidth} />
+              )
+            })
+          })()}
+        </div>
+      ) : null}
+    </div>
+  )
+}
diff --git a/src/renderer/src/components/native-chat/NativeChatMessageList.stream-render.perf.test.tsx b/src/renderer/src/components/native-chat/NativeChatMessageList.stream-render.perf.test.tsx
new file mode 100644
index 00000000000..361045b4642
--- /dev/null
+++ b/src/renderer/src/components/native-chat/NativeChatMessageList.stream-render.perf.test.tsx
@@ -0,0 +1,91 @@
+// @vitest-environment happy-dom
+
+import '@testing-library/jest-dom/vitest'
+
+import { cleanup, render } from '@testing-library/react'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type * as NativeChatProseModule from './native-chat-prose'
+import type { NativeChatMessage } from '../../../../shared/native-chat-types'
+import type { NativeChatLiveSession } from './use-native-chat-live-session'
+
+// Counting real per-row work rather than a render counter: a future refactor could keep the
+// render count low while still re-deriving every row's markdown.
+const proseCalls = vi.hoisted(() => ({ count: 0 }))
+vi.mock('./native-chat-prose', async (importOriginal) => {
+  const actual = await importOriginal<typeof NativeChatProseModule>()
+  return {
+    ...actual,
+    nativeChatProseToMarkdown: (prose: Parameters<typeof actual.nativeChatProseToMarkdown>[0]) => {
+      proseCalls.count += 1
+      return actual.nativeChatProseToMarkdown(prose)
+    }
+  }
+})
+
+const { NativeChatMessageList } = await import('./NativeChatMessageList')
+
+afterEach(cleanup)
+
+const TRANSCRIPT_LENGTH = 120
+
+function settledMessages(): NativeChatMessage[] {
+  return Array.from({ length: TRANSCRIPT_LENGTH }, (_, index) => ({
+    id: `message-${index}`,
+    role: index % 2 === 0 ? ('user' as const) : ('assistant' as const),
+    blocks: [{ type: 'text' as const, text: `settled line ${index}` }],
+    timestamp: index + 1,
+    source: 'transcript' as const
+  }))
+}
+
+function sessionWith(messages: NativeChatMessage[]): NativeChatLiveSession {
+  return {
+    messages,
+    status: 'ready',
+    sessionId: 'session-1',
+    agent: 'codex',
+    hasMore: false,
+    loadingEarlier: false,
+    loadEarlier: vi.fn(),
+    readPhase: 'ready'
+  }
+}
+
+describe('native chat transcript re-render cost during a streaming turn', () => {
+  it('rebuilds only the rows whose blocks changed, not the whole transcript per frame', () => {
+    const messages = settledMessages()
+    const { rerender } = render(
+      <NativeChatMessageList
+        session={sessionWith(messages)}
+        isWorking={true}
+        expandSignal={false}
+        fontScale={1}
+      />
+    )
+
+    const afterFirstPaint = proseCalls.count
+    expect(afterFirstPaint).toBeGreaterThanOrEqual(TRANSCRIPT_LENGTH)
+
+    // A streaming turn publishes a frame per SDK event; only the tail message's blocks change.
+    const STREAM_FRAMES = 20
+    for (let frame = 1; frame <= STREAM_FRAMES; frame += 1) {
+      const streaming = messages.slice(0, -1).concat({
+        ...messages.at(-1)!,
+        blocks: [{ type: 'text' as const, text: `streaming token ${frame}` }]
+      })
+      rerender(
+        <NativeChatMessageList
+          session={sessionWith(streaming)}
+          isWorking={true}
+          expandSignal={false}
+          fontScale={1}
+        />
+      )
+    }
+
+    const perFrame = (proseCalls.count - afterFirstPaint) / STREAM_FRAMES
+    // Without row memoization every settled row rebuilt its markdown on every frame. Settled
+    // rows keep their block identity, so only the streaming tail should rebuild.
+    expect(perFrame).toBeLessThan(TRANSCRIPT_LENGTH / 10)
+  })
+})
diff --git a/src/renderer/src/components/native-chat/NativeChatMessageList.test.tsx b/src/renderer/src/components/native-chat/NativeChatMessageList.test.tsx
index 9695317f3af..860464ac65b 100644
--- a/src/renderer/src/components/native-chat/NativeChatMessageList.test.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatMessageList.test.tsx
@@ -215,7 +215,7 @@ describe('NativeChatMessageList assistant messages', () => {
     )
 
     const user = screen.getByText('Run the checks')
-    const status = screen.getByText('Working for 0 seconds')
+    const status = screen.getByText('Working for 0s')
     const assistant = screen.getByText('I am checking now.')
     expect(user.compareDocumentPosition(status)).toBe(Node.DOCUMENT_POSITION_FOLLOWING)
     expect(status.compareDocumentPosition(assistant)).toBe(Node.DOCUMENT_POSITION_FOLLOWING)
@@ -252,7 +252,7 @@ describe('NativeChatMessageList assistant messages', () => {
       />
     )
 
-    expect(screen.getByText('Working for 3 seconds')).toBeInTheDocument()
+    expect(screen.getByText('Working for 3s')).toBeInTheDocument()
   })
 
   it('keeps the completed duration below the user message', () => {
@@ -298,7 +298,7 @@ describe('NativeChatMessageList assistant messages', () => {
     )
 
     const user = screen.getByText('Complete this task')
-    const status = screen.getByText('Worked for 3 seconds')
+    const status = screen.getByText('Worked for 3s')
     const assistant = screen.getByText('Task complete.')
     expect(user.compareDocumentPosition(status)).toBe(Node.DOCUMENT_POSITION_FOLLOWING)
     expect(status.compareDocumentPosition(assistant)).toBe(Node.DOCUMENT_POSITION_FOLLOWING)
@@ -326,7 +326,7 @@ describe('NativeChatMessageList assistant messages', () => {
       />
     )
 
-    expect(screen.getByText('Worked for 3 seconds')).toBeInTheDocument()
+    expect(screen.getByText('Worked for 3s')).toBeInTheDocument()
     expect(screen.getByText('Thinking')).toBeInTheDocument()
   })
 
diff --git a/src/renderer/src/components/native-chat/NativeChatMessageList.tsx b/src/renderer/src/components/native-chat/NativeChatMessageList.tsx
index 12b10e0f714..debcfb1c94b 100644
--- a/src/renderer/src/components/native-chat/NativeChatMessageList.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatMessageList.tsx
@@ -1,27 +1,17 @@
 import { Fragment, useCallback, useEffect, useLayoutEffect, useMemo, useRef, useState } from 'react'
 import { ArrowDown } from 'lucide-react'
-import CommentMarkdown, {
-  type CommentMarkdownLinkClickHandler
-} from '@/components/sidebar/CommentMarkdown'
-import { cn } from '@/lib/utils'
+import type { CommentMarkdownLinkClickHandler } from '@/components/sidebar/CommentMarkdown'
 import { translate } from '@/i18n/i18n'
-import type { NativeChatMessage } from '../../../../shared/native-chat-types'
 import type { NativeChatLiveSession } from './use-native-chat-live-session'
 import { orderNativeChatMessages } from './native-chat-message-grouping'
 import { stripNoiseMessages } from './native-chat-noise'
-import { foldToolMessages, splitNativeChatBlocks } from './native-chat-tool-fold'
+import { foldToolMessages } from './native-chat-tool-fold'
 import { isNearBottom, shouldShowJumpToLatest, type ScrollGeometry } from './native-chat-autoscroll'
-import { NativeChatToolRun } from './NativeChatToolRun'
+import { MessageRow } from './NativeChatMessageRow'
 import { shouldShowNativeChatTypingIndicator } from './native-chat-typing-indicator'
 import { NativeChatWorkingStatus } from './NativeChatWorkingStatus'
 import { useNativeChatTurnStatus } from './use-native-chat-turn-status'
-import { nativeChatProseToMarkdown } from './native-chat-prose'
 import { NativeChatTypingIndicatorRow } from './NativeChatTypingIndicatorRow'
-import {
-  NativeChatAgentControls,
-  NativeChatImageAttachments,
-  ProviderFrameRow
-} from './NativeChatTranscriptChrome'
 import type { RuntimeFileOperationArgs } from '@/runtime/runtime-file-client'
 
 export { ProviderFrameRow } from './NativeChatTranscriptChrome'
@@ -32,152 +22,6 @@ function geometryOf(el: HTMLElement): ScrollGeometry {
 
 const MAX_EXPANDED_TURNS = 128
 
-/** One message: its prose first, then a collapsible run folding all of the
- *  turn's tool activity. Monochrome per STYLEGUIDE: user prompts read as a
- *  lifted card, assistant prose as body copy, reasoning de-emphasized. */
-function MessageRow({
-  message,
-  expandSignal,
-  activeTurnIsWorking,
-  onScrollMessageToTop,
-  onLinkClick,
-  allowFileUriLinks = false,
-  deliveryFailed = false,
-  activityExpandOverride,
-  structuredActivityUi = true,
-  runtimeContext
-}: {
-  message: NativeChatMessage
-  expandSignal: boolean
-  activeTurnIsWorking?: boolean
-  /** Align this message's top to the top of the scroll viewport. */
-  onScrollMessageToTop: (el: HTMLElement) => void
-  onLinkClick?: CommentMarkdownLinkClickHandler
-  allowFileUriLinks?: boolean
-  deliveryFailed?: boolean
-  activityExpandOverride?: boolean
-  structuredActivityUi?: boolean
-  runtimeContext?: RuntimeFileOperationArgs | null
-}): React.JSX.Element | null {
-  const rowRef = useRef<HTMLDivElement | null>(null)
-  const { prose, tools } = useMemo(() => splitNativeChatBlocks(message.blocks), [message.blocks])
-  const markdown = nativeChatProseToMarkdown(prose)
-  const hasImages = prose.some((block) => block.type === 'image-ref')
-  const isUser = message.role === 'user'
-  const isReasoning = message.role === 'reasoning'
-  const isSystem = message.role === 'system'
-  const providerFrame = message.blocks.find((block) => block.type === 'text' && block.providerFrame)
-
-  const scrollToTop = useCallback(() => {
-    if (rowRef.current) {
-      onScrollMessageToTop(rowRef.current)
-    }
-  }, [onScrollMessageToTop])
-
-  // Skip rows with nothing renderable so the transcript shows no empty/ghost
-  // bubble.
-  // After all hooks, so hook order stays unconditional.
-  if (markdown.length === 0 && !hasImages && tools.length === 0) {
-    return null
-  }
-
-  if (providerFrame) {
-    return (
-      <div ref={rowRef}>
-        <ProviderFrameRow block={providerFrame} />
-      </div>
-    )
-  }
-
-  if (isUser) {
-    return (
-      <div ref={rowRef} className="flex flex-col items-end gap-0.5">
-        {/* User turns get a distinct muted fill (not the card/canvas color) so
-            the prompt reads apart from the assistant's body copy. */}
-        <div className="max-w-[85%] rounded-lg rounded-tr-sm bg-muted px-3.5 py-2.5 text-sm text-foreground">
-          {markdown ? (
-            <>
-              <NativeChatImageAttachments
-                blocks={prose}
-                runtimeContext={runtimeContext}
-                enablePreview={runtimeContext !== undefined}
-              />
-              <CommentMarkdown
-                content={markdown}
-                variant="document"
-                className="text-sm"
-                onLinkClick={onLinkClick}
-                allowFileUriLinks={allowFileUriLinks}
-              />
-            </>
-          ) : (
-            <NativeChatImageAttachments
-              blocks={prose}
-              runtimeContext={runtimeContext}
-              enablePreview={runtimeContext !== undefined}
-            />
-          )}
-        </div>
-        {deliveryFailed ? (
-          <div className="max-w-[85%] text-[11px] text-destructive/80">
-            {translate(
-              'components.native-chat.launchPromptNotDelivered',
-              'Not delivered — check the terminal'
-            )}
-          </div>
-        ) : null}
-      </div>
-    )
-  }
-
-  // Plain assistant prose is the copyable unit; reasoning/system asides stay
-  // chrome-free. The controls reveal on hover (and on keyboard focus-within).
-  const showControls = !isReasoning && !isSystem && markdown.length > 0
-
-  return (
-    <div
-      ref={rowRef}
-      className={cn(
-        'group relative max-w-full select-text text-sm leading-relaxed text-foreground',
-        // Reasoning is the agent thinking aloud — quieter, italic, like an aside.
-        isReasoning && 'border-l-2 border-border/60 pl-3 italic text-muted-foreground',
-        isSystem && 'text-xs text-muted-foreground'
-      )}
-    >
-      <NativeChatImageAttachments
-        blocks={prose}
-        runtimeContext={runtimeContext}
-        enablePreview={runtimeContext !== undefined}
-      />
-      {markdown ? (
-        <CommentMarkdown
-          content={markdown}
-          variant="document"
-          className="text-sm"
-          onLinkClick={onLinkClick}
-          allowFileUriLinks={allowFileUriLinks}
-        />
-      ) : null}
-      {tools.length > 0 ? (
-        <NativeChatToolRun
-          blocks={tools}
-          expandSignal={expandSignal}
-          expandOverride={activityExpandOverride}
-          activeTurnIsWorking={activeTurnIsWorking}
-          structuredActivityUi={structuredActivityUi}
-        />
-      ) : null}
-      {showControls ? (
-        <NativeChatAgentControls
-          markdown={markdown}
-          onScrollToTop={scrollToTop}
-          className="pointer-events-none mt-1 -mb-5 w-fit select-none opacity-0 transition-opacity group-hover:pointer-events-auto group-hover:opacity-100 group-focus-within:pointer-events-auto group-focus-within:opacity-100"
-        />
-      ) : null}
-    </div>
-  )
-}
-
 export function NativeChatMessageList({
   session,
   isWorking,
@@ -200,7 +44,7 @@ export function NativeChatMessageList({
   onLinkClick?: CommentMarkdownLinkClickHandler
   allowFileUriLinks?: boolean
   failedDeliveryMessageIds?: ReadonlySet<string>
-  /** Turn timing/disclosure is available only on the structured Codex lane. */
+  /** Turn timing and disclosure are available on structured agent sessions. */
   showTurnStatus?: boolean
   runtimeContext?: RuntimeFileOperationArgs | null
 }): React.JSX.Element {
diff --git a/src/renderer/src/components/native-chat/NativeChatMessageRow.tsx b/src/renderer/src/components/native-chat/NativeChatMessageRow.tsx
new file mode 100644
index 00000000000..07ea51b5a62
--- /dev/null
+++ b/src/renderer/src/components/native-chat/NativeChatMessageRow.tsx
@@ -0,0 +1,172 @@
+import { memo, useCallback, useMemo, useRef } from 'react'
+import CommentMarkdown, {
+  type CommentMarkdownLinkClickHandler
+} from '@/components/sidebar/CommentMarkdown'
+import { cn } from '@/lib/utils'
+import { translate } from '@/i18n/i18n'
+import type { NativeChatMessage } from '../../../../shared/native-chat-types'
+import { splitNativeChatBlocks } from './native-chat-tool-fold'
+import { NativeChatToolRun } from './NativeChatToolRun'
+import { nativeChatProseToMarkdown } from './native-chat-prose'
+import {
+  NativeChatAgentControls,
+  NativeChatImageAttachments,
+  ProviderFrameRow
+} from './NativeChatTranscriptChrome'
+import type { RuntimeFileOperationArgs } from '@/runtime/runtime-file-client'
+
+/** One message: its prose first, then a collapsible run folding all of the
+ *  turn's tool activity. Monochrome per STYLEGUIDE: user prompts read as a
+ *  lifted card, assistant prose as body copy, reasoning de-emphasized.
+ *  Memoized: a stream frame republishes the whole transcript, but settled rows
+ *  keep their block identity, so only the changed row re-renders. */
+export const MessageRow = memo(function MessageRow({
+  message,
+  expandSignal,
+  activeTurnIsWorking,
+  onScrollMessageToTop,
+  onLinkClick,
+  allowFileUriLinks = false,
+  deliveryFailed = false,
+  activityExpandOverride,
+  structuredActivityUi = true,
+  runtimeContext
+}: {
+  message: NativeChatMessage
+  expandSignal: boolean
+  activeTurnIsWorking?: boolean
+  /** Align this message's top to the top of the scroll viewport. */
+  onScrollMessageToTop: (el: HTMLElement) => void
+  onLinkClick?: CommentMarkdownLinkClickHandler
+  allowFileUriLinks?: boolean
+  deliveryFailed?: boolean
+  activityExpandOverride?: boolean
+  structuredActivityUi?: boolean
+  runtimeContext?: RuntimeFileOperationArgs | null
+}): React.JSX.Element | null {
+  const rowRef = useRef<HTMLDivElement | null>(null)
+  // One pass per block set: a streaming turn re-renders this row on every frame, and these
+  // derivations used to re-run each time even though `message.blocks` had not changed.
+  const { hasImages, markdown, prose, tools } = useMemo(() => {
+    const split = splitNativeChatBlocks(message.blocks)
+    return {
+      ...split,
+      markdown: nativeChatProseToMarkdown(split.prose),
+      hasImages: split.prose.some((block) => block.type === 'image-ref')
+    }
+  }, [message.blocks])
+  const isUser = message.role === 'user'
+  const isReasoning = message.role === 'reasoning'
+  const isSystem = message.role === 'system'
+  const providerFrame = message.blocks.find((block) => block.type === 'text' && block.providerFrame)
+
+  const scrollToTop = useCallback(() => {
+    if (rowRef.current) {
+      onScrollMessageToTop(rowRef.current)
+    }
+  }, [onScrollMessageToTop])
+
+  // Skip rows with nothing renderable so the transcript shows no empty/ghost
+  // bubble.
+  // After all hooks, so hook order stays unconditional.
+  if (markdown.length === 0 && !hasImages && tools.length === 0) {
+    return null
+  }
+
+  if (providerFrame) {
+    return (
+      <div ref={rowRef}>
+        <ProviderFrameRow block={providerFrame} />
+      </div>
+    )
+  }
+
+  if (isUser) {
+    return (
+      <div ref={rowRef} className="flex flex-col items-end gap-0.5">
+        {/* User turns get a distinct muted fill (not the card/canvas color) so
+            the prompt reads apart from the assistant's body copy. */}
+        <div className="max-w-[85%] rounded-lg rounded-tr-sm bg-muted px-3.5 py-2.5 text-sm text-foreground">
+          {markdown ? (
+            <>
+              <NativeChatImageAttachments
+                blocks={prose}
+                runtimeContext={runtimeContext}
+                enablePreview={runtimeContext !== undefined}
+              />
+              <CommentMarkdown
+                content={markdown}
+                variant="document"
+                className="text-sm"
+                onLinkClick={onLinkClick}
+                allowFileUriLinks={allowFileUriLinks}
+              />
+            </>
+          ) : (
+            <NativeChatImageAttachments
+              blocks={prose}
+              runtimeContext={runtimeContext}
+              enablePreview={runtimeContext !== undefined}
+            />
+          )}
+        </div>
+        {deliveryFailed ? (
+          <div className="max-w-[85%] text-[11px] text-destructive/80">
+            {translate(
+              'components.native-chat.launchPromptNotDelivered',
+              'Not delivered — check the terminal'
+            )}
+          </div>
+        ) : null}
+      </div>
+    )
+  }
+
+  // Plain assistant prose is the copyable unit; reasoning/system asides stay
+  // chrome-free. The controls reveal on hover (and on keyboard focus-within).
+  const showControls = !isReasoning && !isSystem && markdown.length > 0
+
+  return (
+    <div
+      ref={rowRef}
+      className={cn(
+        'group relative max-w-full select-text text-sm leading-relaxed text-foreground',
+        // Reasoning is the agent thinking aloud — quieter, italic, like an aside.
+        isReasoning && 'border-l-2 border-border/60 pl-3 italic text-muted-foreground',
+        isSystem && 'text-xs text-muted-foreground'
+      )}
+    >
+      <NativeChatImageAttachments
+        blocks={prose}
+        runtimeContext={runtimeContext}
+        enablePreview={runtimeContext !== undefined}
+      />
+      {markdown ? (
+        <CommentMarkdown
+          content={markdown}
+          variant="document"
+          className="text-sm"
+          onLinkClick={onLinkClick}
+          allowFileUriLinks={allowFileUriLinks}
+          linkifyFilePaths={onLinkClick !== undefined}
+        />
+      ) : null}
+      {tools.length > 0 ? (
+        <NativeChatToolRun
+          blocks={tools}
+          expandSignal={expandSignal}
+          expandOverride={activityExpandOverride}
+          activeTurnIsWorking={activeTurnIsWorking}
+          structuredActivityUi={structuredActivityUi}
+        />
+      ) : null}
+      {showControls ? (
+        <NativeChatAgentControls
+          markdown={markdown}
+          onScrollToTop={scrollToTop}
+          className="pointer-events-none mt-1 -mb-5 w-fit select-none opacity-0 transition-opacity group-hover:pointer-events-auto group-hover:opacity-100 group-focus-within:pointer-events-auto group-focus-within:opacity-100"
+        />
+      ) : null}
+    </div>
+  )
+})
diff --git a/src/renderer/src/components/native-chat/NativeChatQuestionCard.test.tsx b/src/renderer/src/components/native-chat/NativeChatQuestionCard.test.tsx
index b6748fe7e82..9b1a2967682 100644
--- a/src/renderer/src/components/native-chat/NativeChatQuestionCard.test.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatQuestionCard.test.tsx
@@ -28,7 +28,7 @@ afterEach(() => {
 function render(
   prompt: AskPrompt,
   onAnswer: (s: AskAnswerSelection[]) => void,
-  allowOther = true
+  allowOther: boolean | readonly boolean[] = true
 ): void {
   act(() => {
     root.render(
@@ -155,4 +155,71 @@ describe('NativeChatQuestionCard', () => {
     expect(container.querySelector('input')).toBeNull()
     expect(container.textContent).not.toContain('Type your answer')
   })
+
+  it('applies free-text capability per question in a grouped prompt', () => {
+    render(
+      {
+        questions: [
+          {
+            header: 'Listed',
+            question: 'Pick a listed value',
+            multiSelect: false,
+            options: [{ label: 'One' }]
+          },
+          {
+            header: 'Custom',
+            question: 'Provide a custom value',
+            multiSelect: false,
+            options: []
+          }
+        ]
+      },
+      vi.fn(),
+      [false, true]
+    )
+
+    expect(container.querySelector('input')).toBeNull()
+    clickAction('Skip')
+    expect(container.querySelector('input')).not.toBeNull()
+  })
+
+  it('submits grouped multi-select and free-text answers together', () => {
+    const onAnswer = vi.fn()
+    render(
+      {
+        questions: [
+          {
+            header: 'Targets',
+            question: 'Which targets?',
+            multiSelect: true,
+            options: [{ label: 'Web' }, { label: 'Mobile' }]
+          },
+          {
+            header: 'Notes',
+            question: 'Anything else?',
+            multiSelect: false,
+            options: []
+          }
+        ]
+      },
+      onAnswer,
+      [false, true]
+    )
+
+    clickOption('Web')
+    clickOption('Mobile')
+    clickAction('Next')
+    const input = container.querySelector('input')!
+    act(() => {
+      const setter = Object.getOwnPropertyDescriptor(HTMLInputElement.prototype, 'value')!.set!
+      setter.call(input, 'SSH host')
+      input.dispatchEvent(new Event('input', { bubbles: true }))
+    })
+    clickAction('Submit')
+
+    expect(onAnswer).toHaveBeenCalledWith([
+      { indices: [0, 1], other: '' },
+      { indices: [], other: 'SSH host' }
+    ])
+  })
 })
diff --git a/src/renderer/src/components/native-chat/NativeChatQuestionCard.tsx b/src/renderer/src/components/native-chat/NativeChatQuestionCard.tsx
index 4bc881ee3e1..1b1ce5a3547 100644
--- a/src/renderer/src/components/native-chat/NativeChatQuestionCard.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatQuestionCard.tsx
@@ -10,7 +10,7 @@ export type NativeChatQuestionCardProps = {
   isSubmitting?: boolean
   /** Deliver the chosen answer (per-question option indices + free text). */
   onAnswer: (selections: AskAnswerSelection[]) => void
-  allowOther?: boolean
+  allowOther?: boolean | readonly boolean[]
   /** Dismiss the prompt (sends Escape to the agent). */
   onCancel: () => void
   /** Exposes the free-text row so pane-level Paste can target it while the
@@ -42,6 +42,7 @@ export function NativeChatQuestionCard({
   const total = prompt.questions.length
   const isLast = index === total - 1
   const q = prompt.questions[index]!
+  const questionAllowsOther = Array.isArray(allowOther) ? (allowOther[index] ?? false) : allowOther
 
   const setOther = (qi: number, value: string): void => {
     setOtherText((prev) => {
@@ -186,7 +187,7 @@ export function NativeChatQuestionCard({
               />
             ))}
             <div className="flex items-center gap-3 px-3.5 py-2.5">
-              {allowOther ? (
+              {questionAllowsOther ? (
                 <>
                   <span className="flex size-6 shrink-0 items-center justify-center rounded-md bg-muted text-muted-foreground">
                     <Pencil className="size-3.5" />
diff --git a/src/renderer/src/components/native-chat/NativeChatResolvedView.tsx b/src/renderer/src/components/native-chat/NativeChatResolvedView.tsx
index dc152df4c70..6f934f66a6e 100644
--- a/src/renderer/src/components/native-chat/NativeChatResolvedView.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatResolvedView.tsx
@@ -52,6 +52,9 @@ import { useNativeChatFileLinkClick } from './use-native-chat-file-link-click'
 import type { NativeChatResolvedViewProps } from './native-chat-view-types'
 import { useNativeChatFileLinkContext } from './use-native-chat-file-link-context'
 import { NativeChatOrchestrationPausedNotice } from './NativeChatOrchestrationPausedNotice'
+import { matchNativeChatSplitShortcut } from './native-chat-split-shortcut'
+import { getShortcutPlatform } from '@/lib/shortcut-platform'
+import { formatShortcutLabel } from '@/hooks/useShortcutLabel'
 
 /** Renders the bridge UI after NativeChatSessionGate resolves its agent session. */
 export function NativeChatResolvedView({
@@ -73,6 +76,7 @@ export function NativeChatResolvedView({
   const runtimeEnvironmentId = useAppStore((s) =>
     selectNativeChatRuntimeEnvironmentId(s, terminalTabId)
   )
+  const keybindings = useAppStore((s) => s.keybindings)
   const session = useNativeChatRetainedSession({
     paneKey,
     agent,
@@ -131,6 +135,10 @@ export function NativeChatResolvedView({
   const contextMenu = useNativeChatContextMenu({
     rootRef,
     onSwitchToTerminal,
+    splitShortcutLabels: {
+      right: formatShortcutLabel('terminal.splitRight', keybindings),
+      down: formatShortcutLabel('terminal.splitDown', keybindings)
+    },
     actions: {
       onPaste: pasteClipboardIntoComposer,
       ...(contextMenuActions ?? emptyNativeChatContextMenuActions)
@@ -337,6 +345,19 @@ export function NativeChatResolvedView({
         }
       }}
       onKeyDownCapture={(event) => {
+        const splitDirection = event.repeat
+          ? null
+          : matchNativeChatSplitShortcut(event, getShortcutPlatform(), keybindings)
+        if (splitDirection && contextMenuActions) {
+          event.preventDefault()
+          event.stopPropagation()
+          if (splitDirection === 'right') {
+            contextMenuActions.onSplitRight()
+          } else {
+            contextMenuActions.onSplitDown()
+          }
+          return
+        }
         // Backspace/Delete outside an input focuses the composer (like typing)
         // but inserts nothing — let the now-focused field handle the keystroke.
         if (shouldFocusNativeChatComposerFromEditingKey(event)) {
diff --git a/src/renderer/src/components/native-chat/NativeChatSessionOptionPickers.test.tsx b/src/renderer/src/components/native-chat/NativeChatSessionOptionPickers.test.tsx
index d53e8f536d2..031ce4bcd15 100644
--- a/src/renderer/src/components/native-chat/NativeChatSessionOptionPickers.test.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatSessionOptionPickers.test.tsx
@@ -165,6 +165,7 @@ function model(overrides: Partial<SessionOptionDescriptor> = {}): SessionOptionD
       ]
     },
     valueSource: 'applied',
+    transport: 'catalog',
     settable: true,
     ...overrides
   }
@@ -183,6 +184,7 @@ const effort: SessionOptionDescriptor = {
     ]
   },
   valueSource: 'applied',
+  transport: 'catalog',
   settable: true
 }
 
@@ -192,6 +194,7 @@ const fast: SessionOptionDescriptor = {
   category: 'mode',
   kind: { type: 'boolean', currentValue: true },
   valueSource: 'applied',
+  transport: 'catalog',
   settable: true
 }
 
@@ -342,17 +345,48 @@ describe('NativeChatSessionOptionPickers', () => {
     expect(screen.queryByRole('button', { name: /^Effort/ })).toBeNull()
   })
 
-  it('shows the unconfirmed hint for dispatched values', () => {
+  // The terminal transport typed the value at the agent and has not read it back,
+  // so the pill says so; the structured transport's own per-turn report is the
+  // confirmation, which makes the same hedge transient noise there.
+  it('hedges a dispatched value the terminal transport produced', () => {
     render(
       <NativeChatSessionOptionPickers
         surface={surface}
-        snapshot={[model({ valueSource: 'dispatched' })]}
+        snapshot={[model({ valueSource: 'dispatched', transport: 'catalog' })]}
         isWorking={false}
       />
     )
-    expect(screen.getByText('Sent to the agent — not confirmed')).not.toBeNull()
+    expect(screen.getByText('Model')).not.toBeNull()
+    expect(screen.getAllByText('Sent to the agent — not confirmed').length).toBeGreaterThan(0)
   })
 
+  it('does not hedge a dispatched value the structured transport produced', () => {
+    render(
+      <NativeChatSessionOptionPickers
+        surface={surface}
+        snapshot={[model({ valueSource: 'dispatched', transport: 'agent-session' })]}
+        isWorking={false}
+      />
+    )
+    expect(screen.getByText('Model')).not.toBeNull()
+    expect(screen.queryByText(/not confirmed/)).toBeNull()
+  })
+
+  it.each(['catalog', 'agent-session'] as const)(
+    'does not hedge a reported value on the %s transport',
+    (transport) => {
+      render(
+        <NativeChatSessionOptionPickers
+          surface={surface}
+          snapshot={[model({ valueSource: 'reported', transport })]}
+          isWorking={false}
+        />
+      )
+      expect(screen.getByText('Model')).not.toBeNull()
+      expect(screen.queryByText(/not confirmed/)).toBeNull()
+    }
+  )
+
   it('renders agent-picker routes as one action instead of radio choices', async () => {
     const invokeAction = vi.fn().mockResolvedValue({ snapshot: [] })
     const liveSurface = { ...surface, invokeAction }
@@ -449,6 +483,7 @@ describe('NativeChatSessionOptionPickers', () => {
             category: 'mode',
             kind: { type: 'boolean' },
             valueSource: 'unknown',
+            transport: 'catalog',
             settable: true
           }
         ]}
@@ -463,26 +498,7 @@ describe('NativeChatSessionOptionPickers', () => {
     await waitFor(() => expect(setOption).toHaveBeenCalledWith('thinking', false))
   })
 
-  it('does not show unconfirmed for applied flip-only booleans', () => {
-    render(
-      <NativeChatSessionOptionPickers
-        surface={surface}
-        snapshot={[
-          model(),
-          {
-            ...fast,
-            kind: { type: 'boolean', currentValue: true },
-            // Why: flip-only tracks as applied — never a healable dispatched state.
-            valueSource: 'applied'
-          }
-        ]}
-        isWorking={false}
-      />
-    )
-    expect(screen.queryByText('Sent to the agent — not confirmed')).toBeNull()
-  })
-
-  it('shows unconfirmed for confirmable dispatched booleans', () => {
+  it('tooltips a dispatched option pill with the category alone', () => {
     render(
       <NativeChatSessionOptionPickers
         surface={surface}
@@ -494,12 +510,14 @@ describe('NativeChatSessionOptionPickers', () => {
             category: 'mode',
             kind: { type: 'boolean', currentValue: true },
             valueSource: 'dispatched',
+            transport: 'catalog',
             settable: true
           }
         ]}
         isWorking={false}
       />
     )
-    expect(screen.getByText('Sent to the agent — not confirmed')).not.toBeNull()
+    expect(screen.getAllByText('Thinking').length).toBeGreaterThan(0)
+    expect(screen.getAllByText('Sent to the agent — not confirmed').length).toBeGreaterThan(0)
   })
 })
diff --git a/src/renderer/src/components/native-chat/NativeChatSessionOptionPickers.tsx b/src/renderer/src/components/native-chat/NativeChatSessionOptionPickers.tsx
index 87a860662d2..31ff2cbdc4e 100644
--- a/src/renderer/src/components/native-chat/NativeChatSessionOptionPickers.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatSessionOptionPickers.tsx
@@ -15,10 +15,11 @@ import {
 import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip'
 import { translate } from '@/i18n/i18n'
 import { sortNativeChatSessionOptions } from '../../../../shared/native-chat-session-option-snapshot'
-import type {
-  SessionOptionDescriptor,
-  SessionOptionsSurface,
-  SessionOptionValue
+import {
+  sessionOptionDispatchUnconfirmed,
+  type SessionOptionDescriptor,
+  type SessionOptionsSurface,
+  type SessionOptionValue
 } from '../../../../shared/native-chat-session-options'
 import {
   nativeChatModelPillLabel,
@@ -250,7 +251,7 @@ function NativeChatSessionOptionPickersInner({
             tooltipLabel={optionsTooltip}
             disabled={isWorking || pendingId !== null}
             disabledReason={optionsReason}
-            dispatched={options.some((descriptor) => descriptor.valueSource === 'dispatched')}
+            dispatched={options.some(sessionOptionDispatchUnconfirmed)}
           />
           <DropdownMenuContent align="start" side="top" collisionPadding={8} className="w-60">
             {options.map((descriptor, index) => {
@@ -283,7 +284,7 @@ function NativeChatSessionOptionPickersInner({
           tooltipLabel={modelTooltip}
           disabled={isWorking || pendingId !== null}
           disabledReason={modelReason}
-          dispatched={model.valueSource === 'dispatched'}
+          dispatched={sessionOptionDispatchUnconfirmed(model)}
         />
         <DropdownMenuContent align="start" side="top" collisionPadding={8} className="w-64">
           {modelReason && !model.settable ? (
diff --git a/src/renderer/src/components/native-chat/NativeChatStructuredSession.test.tsx b/src/renderer/src/components/native-chat/NativeChatStructuredSession.test.tsx
index bfb3dd1ef52..2b4a9686aaf 100644
--- a/src/renderer/src/components/native-chat/NativeChatStructuredSession.test.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatStructuredSession.test.tsx
@@ -3,6 +3,10 @@
 import { act, cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react'
 import React, { forwardRef, useImperativeHandle } from 'react'
 import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { AgentJournalRenderItem } from '../../../../shared/agent-session-journal-types'
+import type { AgentSessionBackgroundTask } from '../../../../shared/agent-session-wire'
+import { decodeAgentSessionQuestionAnswers } from '../../../../shared/agent-session-question-answer'
+import type { NativeChatQuestionCardProps } from './NativeChatQuestionCard'
 
 const mocks = vi.hoisted(() => ({
   call: vi.fn(),
@@ -11,11 +15,23 @@ const mocks = vi.hoisted(() => ({
   messageListProps: null as null | {
     allowFileUriLinks?: boolean
     onLinkClick?: (...args: unknown[]) => void
+    showTurnStatus?: boolean
+    runtimeContext?: unknown
   },
-  composerProps: null as null | { structuredTransport?: Record<string, unknown> },
+  composerProps: null as null | {
+    structuredTransport?: Record<string, unknown>
+    isWorking?: boolean
+  },
+  questionCardProps: null as NativeChatQuestionCardProps | null,
+  promptItems: [] as AgentJournalRenderItem[],
+  respond: vi.fn(),
   handlePasteEvent: vi.fn(),
   pasteFromClipboard: vi.fn(),
-  submissions: [] as unknown[]
+  submissions: [] as unknown[],
+  monitoringBackgroundTasks: false,
+  supportsBackgroundTaskStop: false,
+  backgroundTasks: [] as AgentSessionBackgroundTask[],
+  stopBackgroundTask: vi.fn()
 }))
 
 vi.mock('@/runtime/structured-agent-session-client', () => ({
@@ -53,15 +69,19 @@ vi.mock('./use-structured-agent-session', async () => {
         hasOlder: false,
         loadingOlder: false,
         loadOlder: vi.fn(),
-        prompts: [],
+        prompts: mocks.promptItems,
         outbox: outbox.outbox,
         blockedClientMessageId: outbox.blockedClientMessageId,
         send: outbox.send,
         retry: outbox.retry,
         isWorking: false,
+        isMonitoringBackgroundTasks: mocks.monitoringBackgroundTasks,
+        supportsBackgroundTaskStop: mocks.supportsBackgroundTaskStop,
+        backgroundTasks: mocks.backgroundTasks,
         turnId: null,
         cancel: vi.fn(),
-        respond: vi.fn(),
+        stopBackgroundTask: (taskId?: string) => mocks.stopBackgroundTask(props.sessionId, taskId),
+        respond: mocks.respond,
         optionSnapshot: [
           {
             id: 'model',
@@ -125,7 +145,12 @@ vi.mock('./NativeChatComposer', () => ({
 }))
 vi.mock('./NativeChatEmptyState', () => ({ NativeChatEmptyState: () => null }))
 vi.mock('./NativeChatApprovalCard', () => ({ NativeChatApprovalCard: () => null }))
-vi.mock('./NativeChatQuestionCard', () => ({ NativeChatQuestionCard: () => null }))
+vi.mock('./NativeChatQuestionCard', () => ({
+  NativeChatQuestionCard: (props: NativeChatQuestionCardProps) => {
+    mocks.questionCardProps = props
+    return null
+  }
+}))
 
 import { NativeChatStructuredSession } from './NativeChatStructuredSession'
 
@@ -136,9 +161,16 @@ describe('NativeChatStructuredSession', () => {
     mocks.mode = 'static'
     mocks.messageListProps = null
     mocks.composerProps = null
+    mocks.questionCardProps = null
+    mocks.promptItems = []
+    mocks.respond.mockReset()
     mocks.handlePasteEvent.mockReset()
     mocks.pasteFromClipboard.mockReset()
     mocks.submissions = []
+    mocks.monitoringBackgroundTasks = false
+    mocks.supportsBackgroundTaskStop = false
+    mocks.stopBackgroundTask.mockReset()
+    mocks.backgroundTasks = []
   })
 
   it('routes app-menu paste into the structured composer', () => {
@@ -149,7 +181,6 @@ describe('NativeChatStructuredSession', () => {
         sessionId="session-paste"
         target={{ kind: 'local' }}
         agent="codex"
-        allowFileUriLinks
       />
     )
 
@@ -160,15 +191,14 @@ describe('NativeChatStructuredSession', () => {
     expect(mocks.pasteFromClipboard).toHaveBeenCalledOnce()
   })
 
-  it('wires local structured file links through the native chat opener', () => {
+  it('wires remote structured file links through the host-aware native chat opener', () => {
     render(
       <NativeChatStructuredSession
         isVisible
         tabId="structured-tab-1"
         sessionId="session-1"
-        target={{ kind: 'local' }}
+        target={{ kind: 'environment', environmentId: 'env-1' }}
         agent="codex"
-        allowFileUriLinks
       />
     )
 
@@ -176,6 +206,191 @@ describe('NativeChatStructuredSession', () => {
     expect(mocks.messageListProps?.onLinkClick).toBe(mocks.fileLinkClick)
   })
 
+  // Turn status and transcript image previews shipped Codex-first. Every
+  // structured session renders through the same list, so neither is agent-gated.
+  it.each(['codex', 'claude'] as const)(
+    'renders the same structured transcript chrome for %s',
+    (agent) => {
+      render(
+        <NativeChatStructuredSession
+          isVisible
+          tabId="structured-tab-parity"
+          sessionId="session-parity"
+          target={{ kind: 'local' }}
+          agent={agent}
+        />
+      )
+
+      expect(mocks.messageListProps?.showTurnStatus).toBe(true)
+      expect(mocks.messageListProps?.runtimeContext).not.toBeUndefined()
+    }
+  )
+
+  it('places background monitoring above the usable composer and stops without an active turn', async () => {
+    mocks.monitoringBackgroundTasks = true
+    mocks.supportsBackgroundTaskStop = true
+    mocks.backgroundTasks = [
+      { id: 'task-command', kind: 'command', description: 'sleep 180' },
+      { id: 'task-agent', kind: 'agent' }
+    ]
+    mocks.stopBackgroundTask.mockResolvedValue({ cancelled: true })
+
+    render(
+      <NativeChatStructuredSession
+        isVisible
+        tabId="structured-tab-background"
+        sessionId="session-background"
+        target={{ kind: 'local' }}
+        agent="claude"
+      />
+    )
+
+    const status = screen
+      .getByText('Monitoring background tasks')
+      .closest('[data-native-chat-background-tasks="true"]')
+    const composer = screen.getByTestId('structured-composer')
+    if (!status) {
+      throw new Error('background task status was not rendered')
+    }
+    expect(status.compareDocumentPosition(composer) & Node.DOCUMENT_POSITION_FOLLOWING).toBeTruthy()
+    expect(mocks.composerProps?.isWorking).toBe(false)
+    expect(screen.queryByRole('list', { name: 'Running background tasks' })).toBeNull()
+    expect(screen.queryByRole('button', { name: /^Stop / })).toBeNull()
+
+    const disclosure = screen.getByRole('button', { name: 'Monitoring background tasks' })
+    expect(disclosure.getAttribute('aria-expanded')).toBe('false')
+    fireEvent.click(disclosure)
+    expect(disclosure.getAttribute('aria-expanded')).toBe('true')
+    expect(screen.getByRole('list', { name: 'Running background tasks' })).toBeTruthy()
+    expect(screen.getByText('sleep 180')).toBeTruthy()
+    expect(screen.getByText('Background agent')).toBeTruthy()
+
+    fireEvent.click(screen.getByRole('button', { name: 'Stop sleep 180' }))
+    await waitFor(() =>
+      expect(mocks.stopBackgroundTask).toHaveBeenCalledWith('session-background', 'task-command')
+    )
+  })
+
+  it('tracks concurrent task stops independently and clears each pending result', async () => {
+    mocks.monitoringBackgroundTasks = true
+    mocks.supportsBackgroundTaskStop = true
+    mocks.backgroundTasks = [
+      { id: 'task-one', kind: 'command', description: 'First task' },
+      { id: 'task-two', kind: 'command', description: 'Second task' }
+    ]
+    let finishFirst!: (value: unknown) => void
+    let finishSecond!: (value: unknown) => void
+    mocks.stopBackgroundTask.mockImplementation(
+      (_sessionId: string, taskId: string) =>
+        new Promise((resolve) => {
+          if (taskId === 'task-one') {
+            finishFirst = resolve
+          } else {
+            finishSecond = resolve
+          }
+        })
+    )
+
+    render(
+      <NativeChatStructuredSession
+        isVisible
+        tabId="structured-tab-concurrent-background"
+        sessionId="session-concurrent-background"
+        target={{ kind: 'local' }}
+        agent="claude"
+      />
+    )
+    fireEvent.click(screen.getByRole('button', { name: 'Monitoring background tasks' }))
+    const firstStop = screen.getByRole('button', { name: 'Stop First task' })
+    const secondStop = screen.getByRole('button', { name: 'Stop Second task' })
+
+    fireEvent.click(firstStop)
+    fireEvent.click(secondStop)
+    expect((firstStop as HTMLButtonElement).disabled).toBe(true)
+    expect((secondStop as HTMLButtonElement).disabled).toBe(true)
+
+    await act(async () => finishFirst({ cancelled: true }))
+    await waitFor(() => expect((firstStop as HTMLButtonElement).disabled).toBe(false))
+    expect((secondStop as HTMLButtonElement).disabled).toBe(true)
+
+    await act(async () => finishSecond(null))
+    await waitFor(() => expect((secondStop as HTMLButtonElement).disabled).toBe(false))
+  })
+
+  it('keeps a stale session stop result from clearing the current session pending state', async () => {
+    mocks.monitoringBackgroundTasks = true
+    mocks.supportsBackgroundTaskStop = true
+    mocks.backgroundTasks = [{ id: 'task-one', kind: 'command', description: 'Shared task' }]
+    let finishOld!: (value: unknown) => void
+    let finishCurrent!: (value: unknown) => void
+    mocks.stopBackgroundTask.mockImplementation(
+      (sessionId: string) =>
+        new Promise((resolve) => {
+          if (sessionId === 'session-old') {
+            finishOld = resolve
+          } else {
+            finishCurrent = resolve
+          }
+        })
+    )
+    const { rerender } = render(
+      <NativeChatStructuredSession
+        isVisible
+        tabId="structured-tab-stale-background"
+        sessionId="session-old"
+        target={{ kind: 'local' }}
+        agent="claude"
+      />
+    )
+    fireEvent.click(screen.getByRole('button', { name: 'Monitoring background tasks' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Stop Shared task' }))
+
+    rerender(
+      <NativeChatStructuredSession
+        isVisible
+        tabId="structured-tab-stale-background"
+        sessionId="session-current"
+        target={{ kind: 'local' }}
+        agent="claude"
+      />
+    )
+    const currentStop = screen.getByRole('button', { name: 'Stop Shared task' })
+    expect((currentStop as HTMLButtonElement).disabled).toBe(false)
+    fireEvent.click(currentStop)
+    expect((currentStop as HTMLButtonElement).disabled).toBe(true)
+
+    await act(async () => finishOld({ cancelled: true }))
+    expect((currentStop as HTMLButtonElement).disabled).toBe(true)
+    await act(async () => finishCurrent({ cancelled: true }))
+    await waitFor(() => expect((currentStop as HTMLButtonElement).disabled).toBe(false))
+  })
+
+  it('keeps the expanded all-task stop fallback for a taskless older host', async () => {
+    mocks.monitoringBackgroundTasks = true
+    mocks.stopBackgroundTask.mockResolvedValue({ cancelled: true })
+
+    render(
+      <NativeChatStructuredSession
+        isVisible
+        tabId="structured-tab-taskless-background"
+        sessionId="session-taskless-background"
+        target={{ kind: 'local' }}
+        agent="claude"
+      />
+    )
+    expect(screen.queryByRole('button', { name: 'Stop background tasks' })).toBeNull()
+    fireEvent.click(screen.getByRole('button', { name: 'Monitoring background tasks' }))
+    expect(screen.getByText('Task details are unavailable for this session.')).toBeTruthy()
+    fireEvent.click(screen.getByRole('button', { name: 'Stop background tasks' }))
+
+    await waitFor(() =>
+      expect(mocks.stopBackgroundTask).toHaveBeenCalledWith(
+        'session-taskless-background',
+        undefined
+      )
+    )
+  })
+
   it('routes a bare model command to the native option picker', async () => {
     render(
       <NativeChatStructuredSession
@@ -184,7 +399,6 @@ describe('NativeChatStructuredSession', () => {
         sessionId="session-1"
         target={{ kind: 'local' }}
         agent="codex"
-        allowFileUriLinks
       />
     )
     const dispatchCommand = mocks.composerProps?.structuredTransport?.dispatchCommand as
@@ -220,7 +434,6 @@ describe('NativeChatStructuredSession', () => {
         sessionId="session-1"
         target={{ kind: 'local' }}
         agent="codex"
-        allowFileUriLinks
       />
     )
 
@@ -252,7 +465,6 @@ describe('NativeChatStructuredSession', () => {
         sessionId="session-wedge"
         target={{ kind: 'local' }}
         agent="codex"
-        allowFileUriLinks
       />
     )
 
@@ -284,7 +496,6 @@ describe('NativeChatStructuredSession', () => {
         sessionId="session-probe-flag"
         target={{ kind: 'local' }}
         agent="codex"
-        allowFileUriLinks
       />
     )
 
@@ -317,7 +528,6 @@ describe('NativeChatStructuredSession', () => {
         sessionId="session-parked"
         target={{ kind: 'local' }}
         agent="codex"
-        allowFileUriLinks
       />
     )
 
@@ -367,7 +577,6 @@ describe('NativeChatStructuredSession', () => {
         sessionId="session-churn"
         target={{ kind: 'local' }}
         agent="codex"
-        allowFileUriLinks
       />
     )
     const { rerender } = render(makeView())
@@ -421,7 +630,6 @@ describe('NativeChatStructuredSession', () => {
         sessionId="session-target-switch"
         target={target}
         agent="codex"
-        allowFileUriLinks
       />
     )
     const { rerender } = render(makeView({ kind: 'local' }))
@@ -456,7 +664,6 @@ describe('NativeChatStructuredSession', () => {
         sessionId="session-forced"
         target={{ kind: 'local' }}
         agent="codex"
-        allowFileUriLinks
       />
     )
 
@@ -495,7 +702,6 @@ describe('NativeChatStructuredSession', () => {
         sessionId="session-pending"
         target={{ kind: 'local' }}
         agent="codex"
-        allowFileUriLinks
       />
     )
 
@@ -525,7 +731,6 @@ describe('NativeChatStructuredSession', () => {
           sessionId="session-budget"
           target={{ kind: 'local' }}
           agent="codex"
-          allowFileUriLinks
         />
       )
 
@@ -546,4 +751,129 @@ describe('NativeChatStructuredSession', () => {
       vi.useRealTimers()
     }
   }, 30000)
+
+  it('passes Claude grouped questions and one shared answer through the card', () => {
+    mocks.promptItems = [
+      {
+        itemId: 'question-item',
+        revision: 1,
+        sequence: 1,
+        observedAt: 1,
+        body: {
+          kind: 'question',
+          question: '2 grouped questions from Claude',
+          options: [],
+          questions: [
+            {
+              id: 'q1',
+              header: 'Targets',
+              question: 'Which targets?',
+              multiSelect: true,
+              options: [
+                { id: 'target-web', label: 'Web' },
+                { id: 'target-mobile', label: 'Mobile' }
+              ],
+              freeTextQuestionId: 'q1'
+            },
+            {
+              id: 'q2',
+              header: 'Host',
+              question: 'Where should it run?',
+              multiSelect: false,
+              options: [],
+              freeTextQuestionId: 'q2'
+            }
+          ],
+          resolution: {
+            state: 'pending',
+            selectedOptionId: null,
+            resolvedBy: null,
+            resolvedAt: null
+          }
+        }
+      }
+    ]
+
+    render(
+      <NativeChatStructuredSession
+        isVisible
+        tabId="structured-tab-questions"
+        sessionId="session-questions"
+        target={{ kind: 'local' }}
+        agent="claude"
+      />
+    )
+
+    const card = mocks.questionCardProps
+    if (!card) {
+      throw new Error('question card was not rendered')
+    }
+    expect(card.prompt.questions).toHaveLength(2)
+    expect(card.prompt.questions[0]).toMatchObject({
+      question: 'Which targets?',
+      multiSelect: true,
+      options: [{ label: 'Web' }, { label: 'Mobile' }]
+    })
+    expect(card.allowOther).toEqual([true, true])
+
+    card.onAnswer([
+      { indices: [0, 1], other: '' },
+      { indices: [], other: 'SSH host' }
+    ])
+    const encoded = mocks.respond.mock.calls[0]?.[1]
+    expect(decodeAgentSessionQuestionAnswers(encoded)).toEqual([
+      { questionId: 'q1', optionIds: ['target-web', 'target-mobile'] },
+      { questionId: 'q2', optionIds: [], other: 'SSH host' }
+    ])
+  })
+
+  it('keeps legacy single-question option ids and free text behavior', () => {
+    mocks.promptItems = [
+      {
+        itemId: 'legacy-question-item',
+        revision: 1,
+        sequence: 1,
+        observedAt: 1,
+        body: {
+          kind: 'question',
+          question: 'Pick a library',
+          options: [
+            { id: 'q1:choice-1', label: 'React' },
+            { id: 'q1:choice-2', label: 'Vue' }
+          ],
+          freeTextQuestionId: 'q1',
+          resolution: {
+            state: 'pending',
+            selectedOptionId: null,
+            resolvedBy: null,
+            resolvedAt: null
+          }
+        }
+      }
+    ]
+
+    render(
+      <NativeChatStructuredSession
+        isVisible
+        tabId="structured-tab-legacy-question"
+        sessionId="session-legacy-question"
+        target={{ kind: 'local' }}
+        agent="claude"
+      />
+    )
+
+    const card = mocks.questionCardProps
+    if (!card) {
+      throw new Error('question card was not rendered')
+    }
+    expect(card.prompt.questions).toEqual([
+      {
+        question: 'Pick a library',
+        multiSelect: false,
+        options: [{ label: 'React' }, { label: 'Vue' }]
+      }
+    ])
+    card.onAnswer([{ indices: [1], other: '' }])
+    expect(mocks.respond).toHaveBeenCalledWith(mocks.promptItems[0], 'q1:choice-2')
+  })
 })
diff --git a/src/renderer/src/components/native-chat/NativeChatStructuredSession.tsx b/src/renderer/src/components/native-chat/NativeChatStructuredSession.tsx
index f7d2fd62663..87adb0bda73 100644
--- a/src/renderer/src/components/native-chat/NativeChatStructuredSession.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatStructuredSession.tsx
@@ -1,13 +1,9 @@
 import { useMemo, useRef, useState } from 'react'
 import { RotateCcw } from 'lucide-react'
-import type {
-  AgentStatusOrchestrationContext,
-  AgentType
-} from '../../../../shared/agent-status-types'
+import { encodeAgentSessionQuestionAnswers } from '../../../../shared/agent-session-question-answer'
 import { dispatchStructuredAgentSessionComposerCommand } from '../../../../shared/structured-agent-session-composer'
 import { structuredAgentSessionPaneKey } from '../../../../shared/structured-agent-session-projection'
 import type { NativeChatLiveSession } from './use-native-chat-live-session'
-import type { RuntimeClientTarget } from '@/runtime/runtime-rpc-client'
 import { Button } from '@/components/ui/button'
 import { NativeChatApprovalCard } from './NativeChatApprovalCard'
 import { NativeChatComposer, type NativeChatComposerHandle } from './NativeChatComposer'
@@ -21,24 +17,30 @@ import { useNativeChatFileLinkContext } from './use-native-chat-file-link-contex
 import { useStructuredAgentSession } from './use-structured-agent-session'
 import { translate } from '@/i18n/i18n'
 import { NativeChatOrchestrationPausedNotice } from './NativeChatOrchestrationPausedNotice'
-import { useNativeChatPasteBridge } from './use-native-chat-paste-bridge'
 import { useNativeChatImageRuntimeContext } from './native-chat-image-runtime-context'
+import { useStructuredNativeChatPaneCommands } from './use-structured-native-chat-pane-commands'
+import type { NativeChatStructuredViewProps } from './native-chat-view-types'
+import { NativeChatBackgroundTasksStatus } from './NativeChatBackgroundTasksStatus'
+
+type StoppingBackgroundTasks = {
+  sessionId: string
+  taskIds: ReadonlySet<string>
+  all: boolean
+}
+
+const NO_STOPPING_TASKS: ReadonlySet<string> = new Set()
 
 function encodeQuestionAnswer(questionId: string, answer: string): string {
   return `${encodeURIComponent(questionId)}:${encodeURIComponent(answer)}`
 }
 
-export function NativeChatStructuredSession(props: {
-  tabId: string
-  sessionId: string
-  target: RuntimeClientTarget
-  agent: AgentType
-  isVisible: boolean
-  allowFileUriLinks: boolean
-  orchestrationDispatchStatus?: AgentStatusOrchestrationContext['dispatchStatus']
-}): React.JSX.Element {
+export function NativeChatStructuredSession(
+  props: Omit<NativeChatStructuredViewProps, 'mode'>
+): React.JSX.Element {
   const controller = useStructuredAgentSession(props)
   const [composerError, setComposerError] = useState<string | null>(null)
+  const [stoppingBackgroundTasks, setStoppingBackgroundTasks] =
+    useState<StoppingBackgroundTasks | null>(null)
   const [optionPickerRequest, setOptionPickerRequest] = useState<{
     id: string
     sequence: number
@@ -49,7 +51,14 @@ export function NativeChatStructuredSession(props: {
   )
   const rootRef = useRef<HTMLDivElement>(null)
   const composerRef = useRef<NativeChatComposerHandle>(null)
-  useNativeChatPasteBridge({ rootRef, composerRef })
+  const paneCommands = useStructuredNativeChatPaneCommands({
+    tabId: props.tabId,
+    groupId: props.groupId,
+    isVisible: props.isVisible,
+    rootRef,
+    composerRef,
+    terminalPaneActions: props.contextMenuActions
+  })
   const session = useMemo<NativeChatLiveSession>(
     () => ({
       messages: controller.messages,
@@ -82,9 +91,26 @@ export function NativeChatStructuredSession(props: {
   const fontScale = useNativeChatFontScale(viewState.kind === 'ready')
   const fileLinkContext = useNativeChatFileLinkContext(props.tabId)
   const imageRuntimeContext = useNativeChatImageRuntimeContext(props.tabId)
-  const fileLinkClick = useNativeChatFileLinkClick(props.allowFileUriLinks ? fileLinkContext : null)
+  const fileLinkClick = useNativeChatFileLinkClick(fileLinkContext)
+  const activeStoppingBackgroundTasks =
+    stoppingBackgroundTasks?.sessionId === props.sessionId ? stoppingBackgroundTasks : null
   const prompt = controller.prompts[0] ?? null
   const questionBody = prompt?.body.kind === 'question' ? prompt.body : null
+  const questions =
+    questionBody?.questions ??
+    (questionBody
+      ? [
+          {
+            id: questionBody.freeTextQuestionId ?? 'q1',
+            question: questionBody.question,
+            options: questionBody.options,
+            multiSelect: false,
+            ...(questionBody.freeTextQuestionId
+              ? { freeTextQuestionId: questionBody.freeTextQuestionId }
+              : {})
+          }
+        ]
+      : [])
   const retryableOutboxEntry =
     controller.outbox.find((entry) => entry.state === 'unconfirmed') ??
     controller.outbox.find(
@@ -127,6 +153,15 @@ export function NativeChatStructuredSession(props: {
       data-native-chat-root="true"
       data-native-chat-working={controller.isWorking ? 'true' : 'false'}
       tabIndex={-1}
+      onPointerDownCapture={(event) => {
+        if (event.button === 2) {
+          paneCommands.onSelectionCapture()
+        }
+      }}
+      onMouseUpCapture={paneCommands.onSelectionCapture}
+      onKeyUpCapture={paneCommands.onSelectionCapture}
+      onKeyDownCapture={paneCommands.onKeyDownCapture}
+      onContextMenuCapture={paneCommands.onContextMenuCapture}
       className="flex h-full min-h-0 w-full flex-col bg-background focus:outline-none"
     >
       <NativeChatOrchestrationPausedNotice dispatchStatus={props.orchestrationDispatchStatus} />
@@ -144,10 +179,10 @@ export function NativeChatStructuredSession(props: {
             expandSignal={false}
             fontScale={fontScale.scale}
             workingStartedAt={null}
-            showTurnStatus={props.agent === 'codex'}
+            showTurnStatus
             onLinkClick={fileLinkClick}
             allowFileUriLinks={fileLinkClick !== undefined}
-            runtimeContext={props.agent === 'codex' ? imageRuntimeContext : undefined}
+            runtimeContext={imageRuntimeContext}
           />
         )}
       </div>
@@ -166,17 +201,39 @@ export function NativeChatStructuredSession(props: {
       ) : null}
       {prompt && questionBody ? (
         <NativeChatQuestionCard
+          key={`${prompt.itemId}:${prompt.revision}`}
           prompt={{
-            questions: [
-              {
-                question: questionBody.question,
-                multiSelect: false,
-                options: questionBody.options.map((option) => ({ label: option.label }))
-              }
-            ]
+            questions: questions.map((question) => ({
+              question: question.question,
+              ...(question.header ? { header: question.header } : {}),
+              multiSelect: question.multiSelect,
+              options: question.options.map((option) => ({
+                label: option.label,
+                ...(option.description ? { description: option.description } : {})
+              }))
+            }))
           }}
-          allowOther={Boolean(questionBody.freeTextQuestionId)}
+          allowOther={questions.map((question) => Boolean(question.freeTextQuestionId))}
           onAnswer={(answers) => {
+            if (questionBody.questions) {
+              const grouped = questions.map((question, questionIndex) => {
+                const answer = answers[questionIndex]
+                const other = answer?.other?.trim()
+                const optionIds = (answer?.indices ?? []).flatMap((optionIndex) => {
+                  const optionId = question.options[optionIndex]?.id
+                  return optionId ? [optionId] : []
+                })
+                return {
+                  questionId: question.id,
+                  optionIds: question.multiSelect || !other ? optionIds : [],
+                  ...(other ? { other } : {})
+                }
+              })
+              if (grouped.every((answer) => answer.optionIds.length > 0 || answer.other)) {
+                void controller.respond(prompt, encodeAgentSessionQuestionAnswers(grouped))
+              }
+              return
+            }
             const index = answers[0]?.indices[0]
             const other = answers[0]?.other?.trim()
             const optionId =
@@ -228,6 +285,45 @@ export function NativeChatStructuredSession(props: {
           {controller.error ?? composerError}
         </p>
       ) : null}
+      {controller.isMonitoringBackgroundTasks ? (
+        <NativeChatBackgroundTasksStatus
+          tasks={controller.backgroundTasks}
+          supportsTaskStop={controller.supportsBackgroundTaskStop}
+          stoppingTaskIds={activeStoppingBackgroundTasks?.taskIds ?? NO_STOPPING_TASKS}
+          stoppingAll={activeStoppingBackgroundTasks?.all ?? false}
+          onStop={(taskId) => {
+            const targetSessionId = props.sessionId
+            setStoppingBackgroundTasks((current) => {
+              const taskIds = new Set(
+                current?.sessionId === targetSessionId ? current.taskIds : NO_STOPPING_TASKS
+              )
+              if (taskId) {
+                taskIds.add(taskId)
+              }
+              return {
+                sessionId: targetSessionId,
+                taskIds,
+                all: taskId ? current?.sessionId === targetSessionId && current.all : true
+              }
+            })
+            void controller.stopBackgroundTask(taskId).finally(() => {
+              setStoppingBackgroundTasks((current) => {
+                if (current?.sessionId !== targetSessionId) {
+                  return current
+                }
+                const taskIds = new Set(current.taskIds)
+                if (taskId) {
+                  taskIds.delete(taskId)
+                }
+                const all = taskId ? current.all : false
+                return taskIds.size === 0 && !all
+                  ? null
+                  : { sessionId: targetSessionId, taskIds, all }
+              })
+            })
+          }}
+        />
+      ) : null}
       {prompt ? null : (
         <NativeChatComposer
           ref={composerRef}
@@ -245,6 +341,7 @@ export function NativeChatStructuredSession(props: {
           structuredTransport={structuredTransport}
         />
       )}
+      {paneCommands.menu}
     </div>
   )
 }
diff --git a/src/renderer/src/components/native-chat/NativeChatToolIcon.tsx b/src/renderer/src/components/native-chat/NativeChatToolIcon.tsx
new file mode 100644
index 00000000000..de18b89bae3
--- /dev/null
+++ b/src/renderer/src/components/native-chat/NativeChatToolIcon.tsx
@@ -0,0 +1,88 @@
+import {
+  Bot,
+  Eye,
+  Folder,
+  Globe,
+  ListChecks,
+  Pencil,
+  Plug,
+  Search,
+  SquareTerminal,
+  Wrench
+} from 'lucide-react'
+import type { LucideIcon } from 'lucide-react'
+import { cn } from '@/lib/utils'
+import {
+  nativeChatToolIconName,
+  type NativeChatToolIconName
+} from '../../../../shared/native-chat-tool-icon'
+
+/** Glyph name to component. */
+const NATIVE_CHAT_TOOL_GLYPHS: Record<NativeChatToolIconName, LucideIcon> = {
+  eye: Eye,
+  search: Search,
+  folder: Folder,
+  'square-terminal': SquareTerminal,
+  pencil: Pencil,
+  globe: Globe,
+  plug: Plug,
+  bot: Bot,
+  'list-checks': ListChecks,
+  wrench: Wrench
+}
+
+/** The fixed 16px slot with a 14px glyph, which keeps every row left-aligned
+ *  including rows whose category this vocabulary doesn't model. */
+function NativeChatGlyphSlot({
+  glyph: Glyph,
+  className
+}: {
+  glyph: LucideIcon
+  className?: string
+}): React.JSX.Element {
+  return (
+    <span className={cn('flex size-4 shrink-0 items-center justify-center', className)}>
+      <Glyph aria-hidden className="size-3.5" />
+    </span>
+  )
+}
+
+/**
+ * The category glyph on a tool row. Decorative — the word beside it is the
+ * accessible name — so it is `aria-hidden` and must never render without that
+ * word.
+ *
+ * A running run header names one call and so resolves its glyph through this
+ * same component, and can never disagree with the row it names.
+ */
+export function NativeChatToolIcon({
+  rowWord,
+  className
+}: {
+  /** The word the row renders, which is the row's whole identity. */
+  rowWord: string
+  className?: string
+}): React.JSX.Element {
+  return (
+    <NativeChatGlyphSlot
+      glyph={NATIVE_CHAT_TOOL_GLYPHS[nativeChatToolIconName(rowWord)]}
+      className={className}
+    />
+  )
+}
+
+/**
+ * The glyph over a settled run, which speaks for every call in it rather than
+ * for one row, so its caller resolves the category and no row word names it.
+ * Same table and same slot as a row's glyph, so the two can never draw one
+ * category differently.
+ */
+export function NativeChatToolRunIcon({
+  iconName,
+  className
+}: {
+  iconName: NativeChatToolIconName
+  className?: string
+}): React.JSX.Element {
+  return <NativeChatGlyphSlot glyph={NATIVE_CHAT_TOOL_GLYPHS[iconName]} className={className} />
+}
diff --git a/src/renderer/src/components/native-chat/NativeChatToolRun.test.tsx b/src/renderer/src/components/native-chat/NativeChatToolRun.test.tsx
index 41a70a8457d..e19c203ee5c 100644
--- a/src/renderer/src/components/native-chat/NativeChatToolRun.test.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatToolRun.test.tsx
@@ -2,8 +2,8 @@
 
 import '@testing-library/jest-dom/vitest'
 
-import { cleanup, render, screen } from '@testing-library/react'
-import { afterEach, describe, expect, it } from 'vitest'
+import { cleanup, fireEvent, render, screen } from '@testing-library/react'
+import { afterEach, describe, expect, it, vi } from 'vitest'
 import type { AgentJournalRenderItem } from '../../../../shared/agent-session-journal-types'
 import type { NativeChatBlock } from '../../../../shared/native-chat-types'
 import { projectStructuredItemToNativeChat } from '../../../../shared/structured-agent-session-projection'
@@ -11,6 +11,18 @@ import { NativeChatToolRun } from './NativeChatToolRun'
 
 afterEach(cleanup)
 
+/** The first glyph of every row — the run header, then each tool line. Named by
+ *  lucide's own class, so an icon that swaps shows up as a different name. */
+function leadingGlyphs(container: HTMLElement): (string | null)[] {
+  return [...container.querySelectorAll('button')].map(
+    (button) =>
+      button
+        .querySelector('svg')
+        ?.getAttribute('class')
+        ?.match(/lucide-[a-z0-9-]+/)?.[0] ?? null
+  )
+}
+
 describe('NativeChatToolRun', () => {
   it('uses the shared clean label for a desktop tool row', () => {
     const blocks: NativeChatBlock[] = [
@@ -32,6 +44,9 @@ describe('NativeChatToolRun', () => {
       {
         type: 'tool-call',
         name: 'apply_patch',
+        // The patch lives on the call in this lane, so the provider's own
+        // completion is what says the edit landed.
+        state: 'completed',
         input: {
           changes: [
             {
@@ -46,8 +61,9 @@ describe('NativeChatToolRun', () => {
 
     const { container } = render(<NativeChatToolRun blocks={blocks} expandSignal />)
 
-    expect(screen.getByText('+after')).toBeInTheDocument()
-    expect(screen.getByText('-before')).toBeInTheDocument()
+    expect(screen.getByText('after')).toBeInTheDocument()
+    expect(screen.getByText('before')).toBeInTheDocument()
+    expect(screen.getByText('Edited file')).toBeInTheDocument()
     expect(container.querySelector('pre')).toBeNull()
   })
 
@@ -78,18 +94,156 @@ describe('NativeChatToolRun', () => {
       <NativeChatToolRun blocks={projected?.blocks ?? []} expandSignal />
     )
 
-    expect(screen.getByText('+after')).toHaveClass(
-      'bg-emerald-500/10',
-      'text-[var(--git-decoration-added)]'
-    )
-    expect(screen.getByText('-before')).toHaveClass(
-      'bg-rose-500/10',
-      'text-[var(--git-decoration-deleted)]'
-    )
+    // Row grounds come from the diff tokens, not a hardcoded palette value.
+    expect(screen.getByText('after').closest('div')).toHaveClass('bg-[var(--diff-added-ground)]')
+    expect(screen.getByText('before').closest('div')).toHaveClass('bg-[var(--diff-removed-ground)]')
     expect(container).not.toHaveTextContent('"changes"')
     expect(container.querySelector('pre')).toBeNull()
   })
 
+  it('keeps the provider error visible for an edit the agent could not apply', () => {
+    const blocks: NativeChatBlock[] = [
+      {
+        type: 'tool-call',
+        name: 'Edit',
+        input: { file_path: '/repo/a.ts', old_string: 'missing', new_string: 'now' }
+      },
+      { type: 'tool-result', output: 'String to replace not found in file.', isError: true }
+    ]
+
+    const { container } = render(<NativeChatToolRun blocks={blocks} expandSignal />)
+
+    expect(screen.queryByText('Edited file')).toBeNull()
+    const body = container.querySelector('pre')
+    expect(body).toHaveTextContent('String to replace not found in file.')
+    expect(body).toHaveClass('text-destructive')
+  })
+
+  it('leaves a `git diff` command as a command row rather than an edit card', () => {
+    const blocks: NativeChatBlock[] = [
+      { type: 'tool-call', name: 'exec', input: { command: 'git diff' }, state: 'completed' },
+      {
+        type: 'tool-result',
+        output: 'diff --git a/a.ts b/a.ts\n--- a/a.ts\n+++ b/a.ts\n@@ -1 +1 @@\n-was\n+now'
+      }
+    ]
+
+    const { container } = render(<NativeChatToolRun blocks={blocks} expandSignal />)
+
+    expect(screen.queryByText('Edited file')).toBeNull()
+    expect(container).toHaveTextContent('git diff')
+  })
+
+  it('shows no gutter number for a snippet edit, which cannot locate itself', () => {
+    const blocks: NativeChatBlock[] = [
+      {
+        type: 'tool-call',
+        name: 'Edit',
+        input: { file_path: '/repo/a.ts', old_string: 'was', new_string: 'now' },
+        state: 'completed'
+      },
+      { type: 'tool-result', output: 'ok' }
+    ]
+
+    render(<NativeChatToolRun blocks={blocks} expandSignal />)
+
+    // Exact, because a snippet-relative number would sit ahead of the marker.
+    expect(screen.getByText('now').closest('div')?.textContent).toBe('+now')
+    expect(screen.getByText('was').closest('div')?.textContent).toBe('-was')
+  })
+
+  it('separates two regions of a file so the gutter jump is accounted for', () => {
+    const blocks: NativeChatBlock[] = [
+      {
+        type: 'tool-call',
+        name: 'Edit',
+        input: { file_path: '/repo/a.ts' },
+        state: 'completed'
+      },
+      {
+        type: 'tool-result',
+        output: 'ok',
+        editPatch: {
+          filePath: '/repo/a.ts',
+          hunks: [
+            { oldStart: 42, oldLines: 1, newStart: 42, newLines: 1, lines: ['-was', '+now'] },
+            { oldStart: 310, oldLines: 1, newStart: 310, newLines: 1, lines: ['-old', '+new'] }
+          ]
+        }
+      }
+    ]
+
+    render(<NativeChatToolRun blocks={blocks} expandSignal />)
+
+    const separators = screen.getAllByRole('separator')
+    expect(separators).toHaveLength(1)
+    expect(separators[0]).toHaveAccessibleName('Lines not shown')
+  })
+
+  it('offers no empty body for a delete, which names the file and nothing else', () => {
+    const blocks: NativeChatBlock[] = [
+      {
+        type: 'tool-call',
+        name: 'apply_patch',
+        input: { input: '*** Begin Patch\n*** Delete File: gone.ts\n*** End Patch' },
+        state: 'completed'
+      }
+    ]
+
+    render(<NativeChatToolRun blocks={blocks} expandSignal />)
+
+    expect(screen.getByTitle('gone.ts')).toBeInTheDocument()
+    // The header states the change; there is no body behind a disclosure.
+    expect(screen.getByText('Deleted file').closest('button')).not.toHaveAttribute('aria-expanded')
+  })
+
+  it('says a diff was clipped even while the card is collapsed', () => {
+    const blocks: NativeChatBlock[] = [
+      {
+        type: 'tool-call',
+        name: 'Diff',
+        input: { path: 'src/a.ts' },
+        state: 'completed'
+      },
+      { type: 'tool-result', output: '@@ -1,3 +1,3 @@\n ctx\n-was\n+now\n… (48210 bytes)' }
+    ]
+
+    // A defined expandOverride opens the run while leaving each card closed.
+    render(<NativeChatToolRun blocks={blocks} expandSignal={false} expandOverride />)
+
+    expect(screen.getByText('Diff truncated')).toBeInTheDocument()
+    expect(screen.queryByText('was')).toBeNull()
+  })
+
+  it('copies the diff as signed rows, with the region breaks left out', () => {
+    const writeClipboardText = vi.fn()
+    Object.assign(window, { api: { ui: { writeClipboardText } } })
+    const blocks: NativeChatBlock[] = [
+      {
+        type: 'tool-call',
+        name: 'Edit',
+        input: { file_path: '/repo/a.ts' },
+        state: 'completed'
+      },
+      {
+        type: 'tool-result',
+        output: 'ok',
+        editPatch: {
+          filePath: '/repo/a.ts',
+          hunks: [
+            { oldStart: 1, oldLines: 2, newStart: 1, newLines: 2, lines: [' ctx', '-was', '+now'] },
+            { oldStart: 90, oldLines: 1, newStart: 90, newLines: 1, lines: ['+tail'] }
+          ]
+        }
+      }
+    ]
+
+    render(<NativeChatToolRun blocks={blocks} expandSignal />)
+    fireEvent.click(screen.getByRole('button', { name: 'Copy diff' }))
+
+    expect(writeClipboardText).toHaveBeenCalledWith(' ctx\n-was\n+now\n+tail')
+  })
+
   it('keeps a grouped active run to one stable row showing only the latest tool', () => {
     const blocks: NativeChatBlock[] = [
       { type: 'tool-call', name: 'shell', input: { command: 'date' }, state: 'completed' },
@@ -99,7 +253,9 @@ describe('NativeChatToolRun', () => {
 
     const { container } = render(<NativeChatToolRun blocks={blocks} expandSignal={false} />)
 
-    expect(screen.getByText('Running cat package.json')).toBeInTheDocument()
+    const activeLabel = screen.getByText('Running cat package.json')
+    expect(activeLabel).toBeInTheDocument()
+    expect(activeLabel).toHaveClass('animate-pulse', 'motion-reduce:animate-none')
     expect(screen.queryByText('Running date')).toBeNull()
     expect(screen.queryByText('Running pwd')).toBeNull()
     expect(screen.queryByText('Ran 3 commands and used 1 tool')).toBeNull()
@@ -211,4 +367,234 @@ describe('NativeChatToolRun', () => {
     expect(container.querySelector('.lucide-check')).toBeInTheDocument()
     expect(container.querySelector('.lucide-circle-alert')).toBeNull()
   })
+
+  it('shows the category glyph beside the word a classified row is named by', () => {
+    const blocks: NativeChatBlock[] = [
+      {
+        type: 'tool-call',
+        name: 'read',
+        input: { command: "sed -n '1,200p' notes.txt", path: 'notes.txt' },
+        state: 'completed'
+      }
+    ]
+
+    const { container } = render(<NativeChatToolRun blocks={blocks} expandSignal />)
+
+    const glyph = container.querySelector('.lucide-eye')
+    expect(glyph).toBeInTheDocument()
+    expect(glyph).toHaveAttribute('aria-hidden')
+    expect(screen.getByText('read')).toBeInTheDocument()
+  })
+
+  it('holds one glyph for a category across running, completed, and failed', () => {
+    const searchCall = (state: 'running' | 'completed' | 'failed'): NativeChatBlock[] => [
+      { type: 'tool-call', name: 'search', input: { query: 'beta' }, state }
+    ]
+    const { container, rerender } = render(
+      <NativeChatToolRun blocks={searchCall('running')} expandSignal activeTurnIsWorking />
+    )
+
+    expect(leadingGlyphs(container)).toEqual(['lucide-search', 'lucide-search'])
+
+    for (const settled of ['completed', 'failed'] as const) {
+      rerender(
+        <NativeChatToolRun blocks={searchCall(settled)} expandSignal activeTurnIsWorking={false} />
+      )
+
+      // A leading check here would read as the row changing identity on settle.
+      expect(leadingGlyphs(container)).toEqual(['lucide-search', 'lucide-search'])
+    }
+  })
+
+  it('falls back to the generic tool glyph, not the terminal, for an unmodelled row', () => {
+    const blocks: NativeChatBlock[] = [
+      {
+        type: 'tool-call',
+        name: 'AskUserQuestion',
+        input: { prompt: 'which?' },
+        state: 'completed'
+      }
+    ]
+
+    const { container } = render(<NativeChatToolRun blocks={blocks} expandSignal />)
+
+    // A terminal here would assert a shell ran when nothing says one did.
+    expect(container.querySelector('.lucide-square-terminal')).toBeNull()
+    expect(container.querySelector('.lucide-wrench')).toBeInTheDocument()
+  })
+
+  it('agrees between the header and the row it names for an unmodelled tool', () => {
+    const blocks: NativeChatBlock[] = [
+      {
+        type: 'tool-call',
+        name: 'AskUserQuestion',
+        input: { prompt: 'which?' },
+        state: 'completed'
+      }
+    ]
+
+    const { container } = render(<NativeChatToolRun blocks={blocks} expandSignal />)
+
+    // Header and row read the same function, so one run cannot show two glyphs.
+    expect(leadingGlyphs(container)).toEqual(['lucide-wrench', 'lucide-wrench'])
+  })
+
+  it('leaves a result row without a category glyph, its word being translated copy', () => {
+    const blocks: NativeChatBlock[] = [
+      { type: 'tool-call', name: 'read', input: { path: 'notes.txt' }, state: 'completed' },
+      { type: 'tool-result', output: 'first line' }
+    ]
+
+    render(<NativeChatToolRun blocks={blocks} expandSignal />)
+
+    const resultRow = screen.getByText('Result').closest('button')
+    // Keying a category off 'Result' would resolve a different glyph per locale.
+    expect(
+      [...(resultRow?.querySelectorAll('svg') ?? [])].map(
+        (svg) => svg.getAttribute('class')?.match(/lucide-[a-z0-9-]+/)?.[0]
+      )
+    ).toEqual(['lucide-chevron-right'])
+  })
+
+  it('heads a projected diff run with the file-change glyph, not the generic one', () => {
+    const projected = projectStructuredItemToNativeChat({
+      itemId: 'file-change',
+      revision: 1,
+      sequence: 1,
+      observedAt: 1,
+      body: {
+        kind: 'diff',
+        path: 'src/a.ts',
+        patch: {
+          head: '@@ -1 +1 @@\n-was\n+now',
+          truncated: false,
+          byteLength: 24,
+          digest: 'a'.repeat(64)
+        }
+      }
+    })
+
+    const { container } = render(
+      <NativeChatToolRun blocks={projected?.blocks ?? []} expandSignal={false} expandOverride />
+    )
+
+    // The run renders an edited-file card, so a wrench above it reads as a tool
+    // this vocabulary does not model.
+    expect(container.querySelector('.lucide-pencil')).toBeInTheDocument()
+    expect(container.querySelector('.lucide-wrench')).toBeNull()
+  })
+
+  describe('the settled header glyph over a whole run', () => {
+    // The header's text summarizes the run's first calls, so its glyph has to
+    // describe the same run rather than whichever call happened to finish last.
+    const call = (name: string, input: unknown): NativeChatBlock => ({
+      type: 'tool-call',
+      name,
+      input,
+      state: 'completed'
+    })
+
+    it('heads a run that is all reads with the read glyph', () => {
+      const blocks: NativeChatBlock[] = [
+        call('read', { command: "sed -n '1,50p' a.ts", path: 'a.ts' }),
+        call('read', { command: "sed -n '1,50p' b.ts", path: 'b.ts' })
+      ]
+
+      const { container } = render(
+        <NativeChatToolRun blocks={blocks} expandSignal activeTurnIsWorking={false} />
+      )
+
+      expect(leadingGlyphs(container)).toEqual(['lucide-eye', 'lucide-eye', 'lucide-eye'])
+    })
+
+    it('heads a run that is all shell with the terminal glyph, whatever each is named', () => {
+      const blocks: NativeChatBlock[] = [
+        call('shell', { command: 'npm test' }),
+        call('Bash', { command: 'git status' })
+      ]
+
+      const { container } = render(
+        <NativeChatToolRun blocks={blocks} expandSignal activeTurnIsWorking={false} />
+      )
+
+      expect(leadingGlyphs(container)).toEqual([
+        'lucide-square-terminal',
+        'lucide-square-terminal',
+        'lucide-square-terminal'
+      ])
+    })
+
+    it('heads a run spanning categories with the generic tool glyph', () => {
+      const blocks: NativeChatBlock[] = [
+        call('shell', { command: 'npm test' }),
+        call('read', { command: "sed -n '1,50p' a.ts", path: 'a.ts' })
+      ]
+
+      const { container } = render(
+        <NativeChatToolRun blocks={blocks} expandSignal activeTurnIsWorking={false} />
+      )
+
+      // An eye here — the last call's glyph — would claim a category the summary
+      // beside it does not describe.
+      expect(leadingGlyphs(container)).toEqual([
+        'lucide-wrench',
+        'lucide-square-terminal',
+        'lucide-eye'
+      ])
+    })
+
+    it('heads a single-call run with that call\u2019s own glyph', () => {
+      const { container } = render(
+        <NativeChatToolRun
+          blocks={[call('Grep', { pattern: 'todo' })]}
+          expandSignal
+          activeTurnIsWorking={false}
+        />
+      )
+
+      expect(leadingGlyphs(container)).toEqual(['lucide-search', 'lucide-search'])
+    })
+
+    it('leaves a run with no tool calls headed by no category glyph', () => {
+      const blocks: NativeChatBlock[] = [{ type: 'tool-result', output: 'first line' }]
+
+      const { container } = render(
+        <NativeChatToolRun blocks={blocks} expandSignal activeTurnIsWorking={false} />
+      )
+
+      // Only the trailing check and the chevron; a wrench here would claim a
+      // tool category for a run holding no tool call.
+      expect(leadingGlyphs(container)).toEqual(['lucide-check', 'lucide-chevron-right'])
+    })
+
+    it('keeps naming the active call while the run is still running', () => {
+      const blocks: NativeChatBlock[] = [
+        call('read', { command: "sed -n '1,50p' a.ts", path: 'a.ts' }),
+        { type: 'tool-call', name: 'shell', input: { command: 'npm test' }, state: 'running' }
+      ]
+
+      const { container } = render(
+        <NativeChatToolRun blocks={blocks} expandSignal activeTurnIsWorking />
+      )
+
+      // The running header names one call, so its glyph is that call's.
+      expect(leadingGlyphs(container)[0]).toBe('lucide-square-terminal')
+    })
+  })
+
+  it('labels a bare list row by the command it ran rather than an invented path', () => {
+    const blocks: NativeChatBlock[] = [
+      {
+        type: 'tool-call',
+        name: 'list',
+        input: { command: 'ls', cwd: '/repo' },
+        state: 'completed'
+      }
+    ]
+
+    const { container } = render(<NativeChatToolRun blocks={blocks} expandSignal />)
+
+    expect(container.querySelector('.lucide-folder')).toBeInTheDocument()
+    expect(screen.getByTitle('ls')).toHaveTextContent('ls')
+  })
 })
diff --git a/src/renderer/src/components/native-chat/NativeChatToolRun.tsx b/src/renderer/src/components/native-chat/NativeChatToolRun.tsx
index 716d293838e..faaab338c66 100644
--- a/src/renderer/src/components/native-chat/NativeChatToolRun.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatToolRun.tsx
@@ -1,5 +1,5 @@
-import { useEffect, useState } from 'react'
-import { Check, ChevronRight, SquareTerminal, Wrench } from 'lucide-react'
+import { useEffect, useMemo, useState } from 'react'
+import { Check, ChevronRight } from 'lucide-react'
 import { cn } from '@/lib/utils'
 import { translate } from '@/i18n/i18n'
 import {
@@ -8,53 +8,38 @@ import {
   type NativeChatBlock
 } from '../../../../shared/native-chat-types'
 import { diffFromText, diffFromToolCall, type DiffLine } from './native-chat-diff'
+import { NativeChatDiffCard } from './NativeChatDiffCard'
+import { pairToolBlocks } from './native-chat-tool-fold'
+import {
+  editFilesFromToolPair,
+  isEditToolName
+} from '../../../../shared/native-chat-edit-normalize'
+import type { NativeChatEditFile } from '../../../../shared/native-chat-edit-model'
 import {
   countToolCalls,
   createToolInputDisplay,
   summarizeToolRun,
   truncateToolDetail
 } from './native-chat-tool-summary'
+import {
+  describeActiveToolCall,
+  NATIVE_CHAT_TOOL_ACTIVITY_COPY,
+  selectActiveToolCall
+} from '../../../../shared/native-chat-tool-activity'
+import { nativeChatToolRunIconName } from '../../../../shared/native-chat-tool-icon'
 import { NativeChatDiffView } from './NativeChatDiffView'
-
-const COMMAND_TOOL_NAMES = new Set([
-  'bash',
-  'shell',
-  'powershell',
-  'terminal',
-  'execute',
-  'run_command',
-  'run_shell_command',
-  'shell_command',
-  'exec_command',
-  'run_terminal_cmd',
-  'run_terminal_command'
-])
-
-function normalizedToolName(name: string): string {
-  return name.trim().toLowerCase()
-}
+import { NativeChatToolIcon, NativeChatToolRunIcon } from './NativeChatToolIcon'
 
 function activeToolLabel(call: Extract<NativeChatBlock, { type: 'tool-call' }>): string {
-  const preview = createToolInputDisplay(call.input).label
-  if (COMMAND_TOOL_NAMES.has(normalizedToolName(call.name))) {
-    return preview
-      ? translate('components.native-chat.tool.runningPreview', 'Running {{preview}}', {
-          preview
-        })
-      : translate('components.native-chat.tool.runningCommand', 'Running command')
-  }
-  return preview
-    ? translate(
-        'components.native-chat.tool.runningNamedPreview',
-        'Running {{toolName}} {{preview}}',
-        {
-          toolName: call.name,
-          preview
-        }
-      )
-    : translate('components.native-chat.tool.runningNamed', 'Running {{toolName}}', {
-        toolName: call.name
-      })
+  const { key, toolName, preview } = describeActiveToolCall(call)
+  const copy = NATIVE_CHAT_TOOL_ACTIVITY_COPY[key]
+  return key === 'runningPreview'
+    ? translate('components.native-chat.tool.runningPreview', copy, { preview })
+    : key === 'runningCommand'
+      ? translate('components.native-chat.tool.runningCommand', copy)
+      : key === 'runningNamedPreview'
+        ? translate('components.native-chat.tool.runningNamedPreview', copy, { toolName, preview })
+        : translate('components.native-chat.tool.runningNamed', copy, { toolName })
 }
 
 /** A single inline tool line — `▸ ToolName  preview` — that expands in place to
@@ -76,8 +61,9 @@ function ToolLine({
   let body: { output: string; isError?: boolean } | null = null
   let detail: string | null = null
   let inputHasDetail = false
+  const isCall = isToolCallBlock(block)
 
-  if (isToolCallBlock(block)) {
+  if (isCall) {
     name = block.name
     const inputDisplay = createToolInputDisplay(block.input)
     preview = inputDisplay.label
@@ -106,6 +92,14 @@ function ToolLine({
         )}
         aria-expanded={hasDetail ? expanded : undefined}
       >
+        {isCall ? (
+          /* Decorative category glyph; the word beside it is the row's name. */
+          <NativeChatToolIcon rowWord={name} className="text-muted-foreground" />
+        ) : (
+          /* A result's word is translated copy, not a tool name, so there is no
+             category to read from it. The empty slot keeps rows aligned. */
+          <span aria-hidden className="size-4 shrink-0" />
+        )}
         <code className="shrink-0 font-mono text-xs font-semibold text-foreground/90 transition-colors group-hover:text-foreground">
           {name}
         </code>
@@ -151,6 +145,50 @@ function ToolLine({
   )
 }
 
+type EditCardModel = {
+  editCards: Map<NativeChatBlock, { files: NativeChatEditFile[]; key: string }>
+  /** Result blocks the card already speaks for, so they render no second row. */
+  consumedResults: Set<NativeChatBlock>
+}
+
+const NO_EDIT_CARDS: EditCardModel = { editCards: new Map(), consumedResults: new Set() }
+
+/** An edit renders as one card, so its result block is folded into the call. The
+ *  model decides which calls have landed; a call that has not keeps the generic
+ *  tool view, its result still visible as the provider's own error. */
+function buildEditCards(blocks: NativeChatBlock[]): EditCardModel {
+  const editCards: EditCardModel['editCards'] = new Map()
+  const consumedResults: EditCardModel['consumedResults'] = new Set()
+  for (const [index, pair] of pairToolBlocks(blocks).entries()) {
+    const call = pair.call
+    if (!call || !isEditToolName(call.name)) {
+      continue
+    }
+    const files = editFilesFromToolPair({
+      name: call.name,
+      input: call.input,
+      ...(call.state ? { state: call.state } : {}),
+      ...(pair.result
+        ? {
+            result: {
+              output: pair.result.output,
+              isError: pair.result.isError,
+              editPatch: pair.result.editPatch
+            }
+          }
+        : {})
+    })
+    if (!files || files.length === 0) {
+      continue
+    }
+    editCards.set(call, { files, key: `${call.name}:${index}` })
+    if (pair.result) {
+      consumedResults.add(pair.result)
+    }
+  }
+  return { editCards, consumedResults }
+}
+
 /** A run of a message's tool calls/results, collapsed to a one-line summary that
  *  expands to the individual inline tool lines. `expandSignal` lets the global
  *  toolbar toggle drive every run at once while still allowing per-run override. */
@@ -176,27 +214,30 @@ export function NativeChatToolRun({
 
   const callCount = countToolCalls(blocks) || blocks.length
   const summary = summarizeToolRun(blocks)
-  const calls = blocks.filter(isToolCallBlock)
-  const activeCalls = structuredActivityUi
-    ? calls.filter(
-        (call) =>
-          (call.state === 'running' || (call.state == null && activeTurnIsWorking === true)) &&
-          activeTurnIsWorking !== false
-      )
-    : []
-  const latestActiveCall = activeCalls.at(-1)
+  const latestActiveCall = structuredActivityUi
+    ? selectActiveToolCall(blocks, { activeTurnIsWorking })
+    : null
   const isSettled = latestActiveCall == null
   // The turn caret opens the activity group, while each child tool remains
   // collapsed. The global expand toolbar still opens child details together.
   const expandToolLines = expandOverride === undefined ? open : false
-  const ActiveToolIcon =
-    latestActiveCall && COMMAND_TOOL_NAMES.has(normalizedToolName(latestActiveCall.name))
-      ? SquareTerminal
-      : Wrench
+  // Diffing every edit is the run's most expensive work, so a collapsed run —
+  // which renders none of it — never pays for it.
+  const { editCards, consumedResults } = useMemo(
+    () => (open ? buildEditCards(blocks) : NO_EDIT_CARDS),
+    [open, blocks]
+  )
+  // Only the settled header reads this. It stands over `summary`, which speaks
+  // for the run's first calls rather than its last, so a glyph taken from one
+  // call would assert a category the text beside it doesn't describe. A run that
+  // spans categories therefore heads with the generic tool glyph. The glyph is
+  // fixed once settled, so state rides on the trailing mark — a leading glyph
+  // that flipped to a check would read as a change of identity.
+  const settledHeaderIcon = nativeChatToolRunIconName(blocks.filter(isToolCallBlock))
   const fallbackLabel =
     callCount === 1
-      ? translate('components.native-chat.tool.countOne', '1 tool call')
-      : translate('components.native-chat.tool.countN', '{{value0}} tool calls', {
+      ? translate('components.native-chat.tool.countOne', NATIVE_CHAT_TOOL_ACTIVITY_COPY.countOne)
+      : translate('components.native-chat.tool.countN', NATIVE_CHAT_TOOL_ACTIVITY_COPY.countN, {
           value0: callCount
         })
 
@@ -224,10 +265,8 @@ export function NativeChatToolRun({
           aria-expanded={open}
           aria-live="polite"
         >
-          <span className="flex size-6 shrink-0 items-center justify-center text-muted-foreground">
-            <ActiveToolIcon className="size-4" />
-          </span>
-          <span className="min-w-0 flex-1 truncate text-foreground/85">
+          <NativeChatToolIcon rowWord={latestActiveCall.name} className="text-muted-foreground" />
+          <span className="min-w-0 flex-1 animate-pulse truncate text-foreground/85 motion-reduce:animate-none">
             {activeToolLabel(latestActiveCall)}
           </span>
           {open ? <ChevronRight className="size-3.5 rotate-90 text-muted-foreground" /> : null}
@@ -239,10 +278,8 @@ export function NativeChatToolRun({
           className="group flex min-h-6 w-full items-center gap-1.5 py-0.5 text-left"
           aria-expanded={open}
         >
-          {structuredActivityUi ? (
-            <span className="flex size-6 shrink-0 items-center justify-center text-muted-foreground">
-              <Check className="size-3.5" />
-            </span>
+          {structuredActivityUi && settledHeaderIcon ? (
+            <NativeChatToolRunIcon iconName={settledHeaderIcon} className="text-muted-foreground" />
           ) : null}
           <span className="shrink-0 font-mono text-[11px] font-bold text-muted-foreground transition-colors group-hover:text-foreground/80">
             {callCount}×
@@ -250,6 +287,10 @@ export function NativeChatToolRun({
           <span className="min-w-0 truncate font-mono text-[11px] text-muted-foreground transition-colors group-hover:text-foreground/80">
             {summary || fallbackLabel}
           </span>
+          {/* Completion reads as a trailing mark so the leading glyph can stay fixed. */}
+          {structuredActivityUi ? (
+            <Check aria-hidden className="size-3 shrink-0 text-muted-foreground" />
+          ) : null}
           {/* Chevron is revealed on hover when collapsed and points down when open. */}
           <ChevronRight
             className={cn(
@@ -264,6 +305,23 @@ export function NativeChatToolRun({
           {(() => {
             const seen = new Map<string, number>()
             return blocks.map((block) => {
+              const edit = editCards.get(block)
+              if (edit) {
+                return (
+                  <div key={`edit:${edit.key}`}>
+                    {edit.files.map((file, fileIndex) => (
+                      <NativeChatDiffCard
+                        key={`${edit.key}:${fileIndex}`}
+                        file={file}
+                        initiallyExpanded={expandToolLines}
+                      />
+                    ))}
+                  </div>
+                )
+              }
+              if (consumedResults.has(block)) {
+                return null
+              }
               const signature =
                 block.type === 'tool-call'
                   ? `${block.type}:${block.name}:${JSON.stringify(block.input)}`
diff --git a/src/renderer/src/components/native-chat/NativeChatWorkingStatus.tsx b/src/renderer/src/components/native-chat/NativeChatWorkingStatus.tsx
index a883429f658..e6c38de83f5 100644
--- a/src/renderer/src/components/native-chat/NativeChatWorkingStatus.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatWorkingStatus.tsx
@@ -2,6 +2,14 @@ import { useState } from 'react'
 import { ChevronRight } from 'lucide-react'
 import { translate } from '@/i18n/i18n'
 import { useNow } from '@/hooks/use-now'
+import {
+  describeNativeChatTurnStatus,
+  formatNativeChatDuration,
+  NATIVE_CHAT_TURN_STATUS_COPY,
+  nativeChatElapsedSeconds
+} from '../../../../shared/native-chat-turn-status'
+
+export { formatNativeChatDuration }
 
 export function NativeChatWorkingStatus({
   startedAt,
@@ -24,21 +32,29 @@ export function NativeChatWorkingStatus({
   // Why: preserves the old effect's `startedAt ?? Date.now()` epoch for the
   // single frame before the turn's startedAt lands.
   const [mountedAt] = useState(() => Date.now())
-  const elapsedSeconds = counting
-    ? Math.max(0, Math.floor((now - (startedAt ?? mountedAt)) / 1000))
-    : 0
+  const elapsedSeconds = counting ? nativeChatElapsedSeconds(startedAt, mountedAt, now) : 0
 
+  const { key, duration } = describeNativeChatTurnStatus({
+    thinking,
+    workedSeconds,
+    elapsedSeconds
+  })
   const label =
-    workedSeconds != null
-      ? translate('components.native-chat.status.workedFor', 'Worked for {{value0}} seconds', {
-          value0: workedSeconds
-        })
-      : thinking
-        ? translate('components.native-chat.status.thinking', 'Thinking')
-        : translate('components.native-chat.status.workingFor', 'Working for {{value0}} seconds', {
-            value0: elapsedSeconds
-          })
-
+    key === 'workedFor'
+      ? translate(
+          'components.native-chat.status.workedFor',
+          NATIVE_CHAT_TURN_STATUS_COPY.workedFor,
+          {
+            value0: duration
+          }
+        )
+      : key === 'thinking'
+        ? translate('components.native-chat.status.thinking', NATIVE_CHAT_TURN_STATUS_COPY.thinking)
+        : translate(
+            'components.native-chat.status.workingFor',
+            NATIVE_CHAT_TURN_STATUS_COPY.workingFor,
+            { value0: duration }
+          )
   const className = `flex min-h-8 items-center gap-1 text-sm text-muted-foreground${thinking ? '' : ' border-b border-border'}`
   const caret =
     workedSeconds != null ? (
@@ -52,7 +68,10 @@ export function NativeChatWorkingStatus({
       <button
         type="button"
         className={`${className} w-full text-left hover:text-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-ring/70`}
-        aria-label={translate('components.native-chat.status.toggleDetails', 'Toggle turn details')}
+        aria-label={translate(
+          'components.native-chat.status.toggleDetails',
+          NATIVE_CHAT_TURN_STATUS_COPY.toggleDetails
+        )}
         aria-expanded={expanded}
         onClick={onToggleExpanded}
       >
@@ -65,7 +84,10 @@ export function NativeChatWorkingStatus({
   return (
     <div
       className={className}
-      aria-label={translate('components.native-chat.status.responding', 'Agent is responding')}
+      aria-label={translate(
+        'components.native-chat.status.responding',
+        NATIVE_CHAT_TURN_STATUS_COPY.responding
+      )}
       aria-live="polite"
     >
       <span className={thinking ? 'animate-pulse' : undefined}>{label}</span>
diff --git a/src/renderer/src/components/native-chat/StructuredAgentSessionHandoffChrome.test.tsx b/src/renderer/src/components/native-chat/StructuredAgentSessionHandoffChrome.test.tsx
new file mode 100644
index 00000000000..4a185a3d630
--- /dev/null
+++ b/src/renderer/src/components/native-chat/StructuredAgentSessionHandoffChrome.test.tsx
@@ -0,0 +1,58 @@
+// @vitest-environment happy-dom
+
+import { cleanup, fireEvent, render, screen } from '@testing-library/react'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { AgentSessionHandoffStatus } from '../../../../shared/agent-session-wire'
+import { StructuredAgentSessionHandoffChrome } from './StructuredAgentSessionHandoffChrome'
+
+const IDLE_NATIVE: AgentSessionHandoffStatus = {
+  owner: 'native',
+  direction: null,
+  phase: 'idle',
+  stage: null,
+  operationId: null
+}
+
+afterEach(cleanup)
+
+describe('StructuredAgentSessionHandoffChrome', () => {
+  it('uses queued-safe admission when the native view still appears idle', () => {
+    const onRequest = vi.fn()
+    render(
+      <StructuredAgentSessionHandoffChrome
+        status={IDLE_NATIVE}
+        isWorking={false}
+        onRequest={onRequest}
+      />
+    )
+
+    fireEvent.click(screen.getByRole('button', { name: 'Open agent TUI' }))
+
+    expect(onRequest).toHaveBeenCalledWith('to-tui', 'after-turn')
+  })
+
+  it('offers one Retry action for a recoverable dead TUI owner', () => {
+    const onRequest = vi.fn()
+    render(
+      <StructuredAgentSessionHandoffChrome
+        status={{
+          owner: 'tui',
+          direction: 'to-native',
+          phase: 'failed',
+          stage: 'old-owner-stopped',
+          operationId: '1800000000000-00000000000000000000000000000001',
+          error: {
+            message: "Couldn't resume chat — the agent terminal still owns this session",
+            recoverableOwner: 'tui'
+          }
+        }}
+        isWorking={false}
+        onRequest={onRequest}
+      />
+    )
+
+    expect(screen.queryByRole('button', { name: 'Return to chat' })).toBeNull()
+    fireEvent.click(screen.getByRole('button', { name: 'Retry' }))
+    expect(onRequest).toHaveBeenCalledWith('to-native', 'now', 'retry')
+  })
+})
diff --git a/src/renderer/src/components/native-chat/StructuredAgentSessionHandoffChrome.tsx b/src/renderer/src/components/native-chat/StructuredAgentSessionHandoffChrome.tsx
new file mode 100644
index 00000000000..840039564d8
--- /dev/null
+++ b/src/renderer/src/components/native-chat/StructuredAgentSessionHandoffChrome.tsx
@@ -0,0 +1,225 @@
+import type {
+  AgentSessionHandoffDirection,
+  AgentSessionHandoffMode,
+  AgentSessionHandoffStatus
+} from '../../../../shared/agent-session-wire'
+import { Button } from '@/components/ui/button'
+import { Badge } from '@/components/ui/badge'
+import { translate } from '@/i18n/i18n'
+
+type Props = {
+  status: AgentSessionHandoffStatus | null
+  isWorking: boolean
+  onRequest: (
+    direction: AgentSessionHandoffDirection,
+    mode: AgentSessionHandoffMode,
+    action?: 'start' | 'cancel-queued' | 'retry' | 'recover'
+  ) => void
+}
+
+function handoffStageCopy(status: AgentSessionHandoffStatus): string {
+  if (status.stage === 'preparing') {
+    return status.direction === 'to-tui'
+      ? translate('components.native-chat.handoff.stage.finishingChat', 'Finishing chat session…')
+      : translate(
+          'components.native-chat.handoff.stage.finishingTerminal',
+          'Finishing agent terminal…'
+        )
+  }
+  if (status.stage === 'old-owner-stopped') {
+    return status.direction === 'to-tui'
+      ? translate('components.native-chat.handoff.stage.openingTerminal', 'Opening agent terminal…')
+      : translate('components.native-chat.handoff.stage.resumingChat', 'Resuming chat session…')
+  }
+  if (status.stage === 'new-owner-proving') {
+    return status.direction === 'to-tui'
+      ? translate(
+          'components.native-chat.handoff.stage.verifyingTerminal',
+          'Verifying agent terminal…'
+        )
+      : translate('components.native-chat.handoff.stage.verifyingChat', 'Verifying chat session…')
+  }
+  if (status.stage === 'recovering') {
+    return translate('components.native-chat.handoff.stage.recovering', 'Recovering agent session…')
+  }
+  if (status.stage === 'manual-recovery') {
+    return translate(
+      'components.native-chat.handoff.stage.manualRecovery',
+      'Agent session needs recovery'
+    )
+  }
+  return translate('components.native-chat.handoff.switchingOwner', 'Switching session owner…')
+}
+
+export function StructuredAgentSessionHandoffChrome({
+  status,
+  isWorking,
+  onRequest
+}: Props): React.JSX.Element | null {
+  if (!status) {
+    return null
+  }
+  const owner = status?.owner ?? 'native'
+  const phase = status?.phase ?? 'idle'
+  const switching = phase === 'switching' || phase === 'waiting-for-exit'
+  return (
+    <>
+      <div className="flex min-h-9 items-center gap-2 border-b border-border px-3 py-1.5">
+        <Badge variant="outline">
+          {switching
+            ? translate('components.native-chat.handoff.mode.switching', 'Switching')
+            : owner === 'tui'
+              ? translate('components.native-chat.handoff.mode.terminal', 'Terminal')
+              : translate('components.native-chat.handoff.mode.chat', 'Chat')}
+        </Badge>
+        <div className="ml-auto flex items-center gap-1.5">
+          {phase === 'queued' && status?.direction ? (
+            <>
+              <span className="text-xs text-muted-foreground">
+                {status.direction === 'to-tui'
+                  ? translate(
+                      'components.native-chat.handoff.switchingAfterTurn',
+                      'Switching after this turn'
+                    )
+                  : translate(
+                      'components.native-chat.handoff.returningAfterTurn',
+                      'Returning after this turn'
+                    )}
+              </span>
+              <Button
+                type="button"
+                variant="ghost"
+                size="xs"
+                onClick={() => onRequest(status.direction!, 'after-turn', 'cancel-queued')}
+              >
+                {translate('components.native-chat.handoff.cancel', 'Cancel')}
+              </Button>
+            </>
+          ) : owner === 'native' && phase === 'idle' ? (
+            isWorking ? (
+              <>
+                <Button
+                  type="button"
+                  variant="ghost"
+                  size="xs"
+                  onClick={() => onRequest('to-tui', 'after-turn')}
+                >
+                  {translate(
+                    'components.native-chat.handoff.switchAfterTurn',
+                    'Switch after this turn'
+                  )}
+                </Button>
+                <Button
+                  type="button"
+                  variant="secondary"
+                  size="xs"
+                  onClick={() => onRequest('to-tui', 'stop-turn')}
+                >
+                  {translate(
+                    'components.native-chat.handoff.stopTurnAndSwitch',
+                    'Stop turn and switch'
+                  )}
+                </Button>
+              </>
+            ) : (
+              <Button
+                type="button"
+                variant="ghost"
+                size="xs"
+                // A submitted turn can reach the host before isWorking updates; after-turn is immediate when idle.
+                onClick={() => onRequest('to-tui', 'after-turn')}
+              >
+                {translate('components.native-chat.handoff.openAgentTui', 'Open agent TUI')}
+              </Button>
+            )
+          ) : owner === 'tui' && phase === 'idle' ? (
+            <Button
+              type="button"
+              variant="ghost"
+              size="xs"
+              onClick={() => onRequest('to-native', 'after-turn')}
+            >
+              {isWorking
+                ? translate(
+                    'components.native-chat.handoff.returnAfterTurn',
+                    'Return after this turn'
+                  )
+                : translate('components.native-chat.handoff.returnToChat', 'Return to chat')}
+            </Button>
+          ) : null}
+        </div>
+      </div>
+      {owner === 'tui' && phase === 'idle' ? (
+        <div className="flex items-center justify-between gap-3 border-b border-border bg-muted px-3 py-2 text-xs">
+          <span>
+            {status?.hostLabel
+              ? translate(
+                  'components.native-chat.handoff.agentOpenOnHost',
+                  'Agent is open in terminal on {{value0}}.',
+                  { value0: status.hostLabel }
+                )
+              : translate('components.native-chat.handoff.agentOpen', 'Agent is open in terminal.')}
+          </span>
+          <Button
+            type="button"
+            variant="link"
+            size="xs"
+            onClick={() => onRequest('to-native', 'after-turn')}
+          >
+            {translate('components.native-chat.handoff.returnToChat', 'Return to chat')}
+          </Button>
+        </div>
+      ) : null}
+      {switching ? (
+        <div className="border-b border-border bg-muted px-3 py-3 text-center text-sm text-muted-foreground">
+          {phase === 'waiting-for-exit'
+            ? translate(
+                'components.native-chat.handoff.exitTerminal',
+                'Exit the agent terminal to continue in chat.'
+              )
+            : status?.stage
+              ? handoffStageCopy(status)
+              : translate(
+                  'components.native-chat.handoff.switchingOwner',
+                  'Switching session owner…'
+                )}
+        </div>
+      ) : null}
+      {phase === 'failed' && status?.error ? (
+        <div
+          className="border-b border-destructive/40 bg-destructive/10 px-3 py-2 text-xs text-destructive"
+          role="alert"
+        >
+          <div className="flex items-center justify-between gap-3">
+            <span>{status.error.message}</span>
+            {status.direction && status.error.canRetryProof ? (
+              <Button
+                type="button"
+                variant="ghost"
+                size="xs"
+                onClick={() => onRequest(status.direction!, 'now', 'recover')}
+              >
+                {translate('components.native-chat.handoff.retryProof', 'Retry proof')}
+              </Button>
+            ) : status.direction && status.error.recoverableOwner !== 'none' ? (
+              <Button
+                type="button"
+                variant="ghost"
+                size="xs"
+                onClick={() => onRequest(status.direction!, 'now', 'retry')}
+              >
+                {translate('components.native-chat.handoff.retry', 'Retry')}
+              </Button>
+            ) : null}
+          </div>
+          {status.error.details ? (
+            <details className="mt-1">
+              <summary>{translate('components.native-chat.handoff.details', 'Details')}</summary>
+              <p className="mt-1 text-muted-foreground">{status.error.details}</p>
+            </details>
+          ) : null}
+        </div>
+      ) : null}
+    </>
+  )
+}
diff --git a/src/renderer/src/components/native-chat/StructuredAgentSessionPaneOverlayLayer.test.tsx b/src/renderer/src/components/native-chat/StructuredAgentSessionPaneOverlayLayer.test.tsx
index 25991eac3ff..05101f14fd1 100644
--- a/src/renderer/src/components/native-chat/StructuredAgentSessionPaneOverlayLayer.test.tsx
+++ b/src/renderer/src/components/native-chat/StructuredAgentSessionPaneOverlayLayer.test.tsx
@@ -8,7 +8,6 @@ type MockAppState = {
   unifiedTabsByWorktree: Record<string, readonly Tab[]>
   groupsByWorktree: Record<string, readonly TabGroup[]>
   runtimeEnvironmentId: string | null
-  executionHostId: string
   focusGroup: (worktreeId: string, groupId: string) => void
 }
 
@@ -16,7 +15,8 @@ const mocks = vi.hoisted(() => ({
   store: null as null | { setState: (state: Partial<MockAppState>) => void },
   focusGroup: vi.fn(),
   mountsByTabId: new Map<string, number>(),
-  unmountsByTabId: new Map<string, number>()
+  unmountsByTabId: new Map<string, number>(),
+  groupIdByTabId: new Map<string, string | undefined>()
 }))
 
 vi.mock('@/store', async () => {
@@ -25,7 +25,6 @@ vi.mock('@/store', async () => {
     unifiedTabsByWorktree: {},
     groupsByWorktree: {},
     runtimeEnvironmentId: null,
-    executionHostId: 'local',
     focusGroup: mocks.focusGroup
   }))
   mocks.store = useAppStore
@@ -33,8 +32,7 @@ vi.mock('@/store', async () => {
 })
 
 vi.mock('@/lib/worktree-runtime-owner', () => ({
-  getRuntimeEnvironmentIdForWorktree: (state: MockAppState) => state.runtimeEnvironmentId,
-  getExecutionHostIdForWorktree: (state: MockAppState) => state.executionHostId
+  getRuntimeEnvironmentIdForWorktree: (state: MockAppState) => state.runtimeEnvironmentId
 }))
 
 vi.mock('@/runtime/runtime-rpc-client', () => ({
@@ -53,11 +51,14 @@ vi.mock('./NativeChatView', async () => {
   return {
     default: function MockNativeChatView({
       tabId,
+      groupId,
       isVisible
     }: {
       tabId: string
+      groupId?: string
       isVisible: boolean
     }) {
+      mocks.groupIdByTabId.set(tabId, groupId)
       useEffect(() => {
         mocks.mountsByTabId.set(tabId, (mocks.mountsByTabId.get(tabId) ?? 0) + 1)
         return () => {
@@ -87,6 +88,7 @@ describe('StructuredAgentSessionPaneOverlayLayer', () => {
     mocks.focusGroup.mockClear()
     mocks.mountsByTabId.clear()
     mocks.unmountsByTabId.clear()
+    mocks.groupIdByTabId.clear()
     mocks.store?.setState(createState(FIRST_TAB_ID))
   })
 
@@ -125,6 +127,12 @@ describe('StructuredAgentSessionPaneOverlayLayer', () => {
     expect(mocks.mountsByTabId.get(FIRST_TAB_ID)).toBe(1)
     expect(mocks.mountsByTabId.get(SECOND_TAB_ID)).toBe(1)
     expect(mocks.unmountsByTabId.size).toBe(0)
+    expect(mocks.groupIdByTabId).toEqual(
+      new Map([
+        [FIRST_TAB_ID, GROUP_ID],
+        [SECOND_TAB_ID, GROUP_ID]
+      ])
+    )
   })
 
   it('routes overlay interaction back to the owning split group', () => {
@@ -166,7 +174,6 @@ function createState(activeTabId: string): MockAppState {
     },
     groupsByWorktree: { [WORKTREE_ID]: [createGroup(activeTabId)] },
     runtimeEnvironmentId: null,
-    executionHostId: 'local',
     focusGroup: mocks.focusGroup
   }
 }
diff --git a/src/renderer/src/components/native-chat/StructuredAgentSessionPaneOverlayLayer.tsx b/src/renderer/src/components/native-chat/StructuredAgentSessionPaneOverlayLayer.tsx
index 555d23b9ec4..01b8c256277 100644
--- a/src/renderer/src/components/native-chat/StructuredAgentSessionPaneOverlayLayer.tsx
+++ b/src/renderer/src/components/native-chat/StructuredAgentSessionPaneOverlayLayer.tsx
@@ -3,10 +3,7 @@ import { useShallow } from 'zustand/react/shallow'
 import type { Tab, TabGroup } from '../../../../shared/tab-types'
 import { isAgentSessionHandleProvider } from '../../../../shared/agent-session-provider-handle'
 import { useAppStore } from '@/store'
-import {
-  getExecutionHostIdForWorktree,
-  getRuntimeEnvironmentIdForWorktree
-} from '@/lib/worktree-runtime-owner'
+import { getRuntimeEnvironmentIdForWorktree } from '@/lib/worktree-runtime-owner'
 import { getActiveRuntimeTarget, type RuntimeClientTarget } from '@/runtime/runtime-rpc-client'
 import { tabGroupBodyAnchorName } from '../tab-group/tab-group-body-anchor'
 import NativeChatView from './NativeChatView'
@@ -24,14 +21,12 @@ const StructuredAgentSessionOverlaySlot = memo(function StructuredAgentSessionOv
   groupId,
   isActive,
   target,
-  allowFileUriLinks,
   onFocusOwningGroup
 }: {
   tab: StructuredAgentSessionTab
   groupId: string | undefined
   isActive: boolean
   target: RuntimeClientTarget
-  allowFileUriLinks: boolean
   onFocusOwningGroup: ((groupId: string) => void) | undefined
 }): React.JSX.Element {
   const anchorName = groupId !== undefined ? tabGroupBodyAnchorName(groupId) : undefined
@@ -69,11 +64,11 @@ const StructuredAgentSessionOverlaySlot = memo(function StructuredAgentSessionOv
       <NativeChatView
         mode="structured"
         tabId={tab.id}
+        groupId={groupId}
         sessionId={tab.entityId}
         agent={tab.agentSessionAgent}
         isVisible={isActive}
         target={target}
-        allowFileUriLinks={allowFileUriLinks}
       />
     </div>
   )
@@ -87,12 +82,11 @@ const StructuredAgentSessionPaneOverlayLayer = memo(
     worktreeId: string
     isWorktreeActive: boolean
   }): React.JSX.Element {
-    const { unifiedTabs, groups, runtimeEnvironmentId, allowFileUriLinks } = useAppStore(
+    const { unifiedTabs, groups, runtimeEnvironmentId } = useAppStore(
       useShallow((state) => ({
         unifiedTabs: state.unifiedTabsByWorktree[worktreeId] ?? EMPTY_UNIFIED_TABS,
         groups: state.groupsByWorktree[worktreeId] ?? EMPTY_GROUPS,
-        runtimeEnvironmentId: getRuntimeEnvironmentIdForWorktree(state, worktreeId),
-        allowFileUriLinks: getExecutionHostIdForWorktree(state, worktreeId) === 'local'
+        runtimeEnvironmentId: getRuntimeEnvironmentIdForWorktree(state, worktreeId)
       }))
     )
     const focusGroup = useAppStore((state) => state.focusGroup)
@@ -127,7 +121,6 @@ const StructuredAgentSessionPaneOverlayLayer = memo(
             groupId={tab.groupId}
             isActive={Boolean(isWorktreeActive && groupActiveTabById.get(tab.groupId) === tab.id)}
             target={target}
-            allowFileUriLinks={allowFileUriLinks}
             onFocusOwningGroup={focusOwningGroup}
           />
         ))}
diff --git a/src/renderer/src/components/native-chat/StructuredAgentSessionStatusBridge.test.tsx b/src/renderer/src/components/native-chat/StructuredAgentSessionStatusBridge.test.tsx
index 8a61399d669..a8eb22ae7a5 100644
--- a/src/renderer/src/components/native-chat/StructuredAgentSessionStatusBridge.test.tsx
+++ b/src/renderer/src/components/native-chat/StructuredAgentSessionStatusBridge.test.tsx
@@ -2,17 +2,23 @@
 
 import { act, cleanup, render, waitFor } from '@testing-library/react'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type {
+  AgentSessionStatusEvent,
+  AgentSessionStatusSummary
+} from '../../../../shared/agent-session-wire'
 import type { Tab } from '../../../../shared/tab-types'
+import type * as RuntimeRpcClientModule from '@/runtime/runtime-rpc-client'
 
 const mocks = vi.hoisted(() => ({
-  call: vi.fn(),
   removeAgentStatus: vi.fn(),
   setAgentStatus: vi.fn(),
   store: null as null | {
     getState: () => Record<string, unknown>
     setState: (state: Record<string, unknown>) => void
   },
-  subscribe: vi.fn(),
+  subscribeStatus: vi.fn(),
+  subscribeTranscript: vi.fn(),
+  supportsCapability: vi.fn(),
   unsubscribe: vi.fn()
 }))
 
@@ -73,17 +79,22 @@ vi.mock('@/lib/worktree-runtime-owner', () => ({
     state.testRuntimeOwner ?? null
 }))
 
+vi.mock('@/runtime/runtime-rpc-client', async (importOriginal) => ({
+  ...(await importOriginal<typeof RuntimeRpcClientModule>()),
+  runtimeEnvironmentSupportsCapability: mocks.supportsCapability
+}))
+
 vi.mock('@/runtime/structured-agent-session-client', () => ({
-  callStructuredAgentSession: mocks.call,
-  subscribeStructuredAgentSession: mocks.subscribe
+  callStructuredAgentSession: vi.fn(),
+  subscribeStructuredAgentSession: mocks.subscribeTranscript,
+  subscribeStructuredAgentSessionStatus: mocks.subscribeStatus
 }))
 
 import {
   getStructuredAgentSessionTabs,
   StructuredAgentSessionStatusBridge
 } from './StructuredAgentSessionStatusBridge'
-import { resetStructuredAgentSessionReadOwnersForTests } from './structured-agent-session-read-owner'
-import { useStructuredAgentSessionRead } from './use-structured-agent-session-read'
+import { resetStructuredAgentSessionStatusFeedsForTests } from '@/runtime/structured-agent-session-status-feed'
 
 const structuredTab = {
   id: 'structured-tab-1',
@@ -100,60 +111,40 @@ const structuredTab = {
   agentSessionAgent: 'codex'
 } satisfies Tab
 
-const userItem = {
-  itemId: 'item-1',
-  revision: 1,
-  sequence: 1,
-  observedAt: 1,
-  body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'hello' }] }
-} as const
+const providerSession = { key: 'session_id', id: '01a002e9-9a1c-7d42-a642-e481f64446f1' } as const
 
-const historyResult = {
-  ok: true,
-  providerSession: { key: 'session_id', id: '01a002e9-9a1c-7d42-a642-e481f64446f1' },
-  page: {
+function summary(overrides: Partial<AgentSessionStatusSummary> = {}): AgentSessionStatusSummary {
+  return {
     sessionId: 'session-1',
-    epoch: 'epoch-1',
-    fence: 1,
-    direction: 'tail',
-    items: [userItem],
-    removedItemIds: [],
-    submissions: [],
-    window: {
-      oldest: { epoch: 'epoch-1', sequence: 1 },
-      newest: { epoch: 'epoch-1', sequence: 1 },
-      nextCursor: { epoch: 'epoch-1', sequence: 1 }
-    },
-    liveCursor: { epoch: 'epoch-1', sequence: 1 },
-    hasOlder: false,
-    hasNewer: false
+    workspaceId: 'wt-1',
+    agent: 'codex',
+    status: 'working',
+    latestPrompt: 'hello',
+    providerSession,
+    updatedAt: 1,
+    ...overrides
   }
 }
 
-function ActiveSessionRead(): null {
-  useStructuredAgentSessionRead({
-    sessionId: structuredTab.entityId,
-    target: { kind: 'local' },
-    isVisible: true
-  })
-  return null
+function statuses(): Record<string, unknown>[] {
+  return Object.values(mocks.store?.getState().agentStatusByPaneKey ?? {})
 }
 
-function ActiveComposition(): React.JSX.Element {
-  return (
-    <>
-      <ActiveSessionRead />
-      <StructuredAgentSessionStatusBridge />
-    </>
-  )
+/** The host side of the most recent status subscription. */
+function feed(index = 0): { target: unknown; emit: (event: AgentSessionStatusEvent) => void } {
+  const call = mocks.subscribeStatus.mock.calls[index]
+  if (!call) {
+    throw new Error('status feed not subscribed')
+  }
+  return { target: call[0], emit: call[1] as (event: AgentSessionStatusEvent) => void }
 }
 
 describe('StructuredAgentSessionStatusBridge', () => {
   beforeEach(() => {
     vi.clearAllMocks()
-    resetStructuredAgentSessionReadOwnersForTests()
-    mocks.call.mockResolvedValue(historyResult)
-    mocks.subscribe.mockResolvedValue({ unsubscribe: mocks.unsubscribe })
+    resetStructuredAgentSessionStatusFeedsForTests()
+    mocks.subscribeStatus.mockResolvedValue({ unsubscribe: mocks.unsubscribe })
+    mocks.supportsCapability.mockResolvedValue(true)
     mocks.store?.setState({
       agentStatusByPaneKey: {},
       testRuntimeOwner: null,
@@ -163,7 +154,7 @@ describe('StructuredAgentSessionStatusBridge', () => {
 
   afterEach(() => {
     cleanup()
-    resetStructuredAgentSessionReadOwnersForTests()
+    resetStructuredAgentSessionStatusFeedsForTests()
   })
 
   it('reuses the structured-tab projection for an unchanged tab map', () => {
@@ -194,65 +185,111 @@ describe('StructuredAgentSessionStatusBridge', () => {
     ])
   })
 
-  it('keeps restored inactive tabs transport-neutral', async () => {
+  it('projects the host status feed without opening a transcript reader', async () => {
     render(<StructuredAgentSessionStatusBridge />)
-    await act(() => Promise.resolve())
+    await waitFor(() => expect(mocks.subscribeStatus).toHaveBeenCalledOnce())
+    expect(feed().target).toEqual({ kind: 'local' })
+    expect(mocks.subscribeTranscript).not.toHaveBeenCalled()
 
-    expect(mocks.call).not.toHaveBeenCalled()
-    expect(mocks.subscribe).not.toHaveBeenCalled()
+    act(() => feed().emit({ type: 'snapshot', sessions: [summary()] }))
+
+    expect(statuses()).toEqual([
+      expect.objectContaining({
+        state: 'working',
+        prompt: 'hello',
+        agentType: 'codex',
+        sessionBoundary: false,
+        tabId: structuredTab.id,
+        worktreeId: 'wt-1',
+        terminalTitle: 'Codex Chat',
+        terminalResumeEligible: false,
+        providerSession
+      })
+    ])
+  })
+
+  // Hiddenness is the host's side of this: see structured-agent-session-subscribers.test.ts,
+  // which drives an unsubscribed journal through the feed. Here the transport is a mock, so
+  // only the summary-to-store mapping is under test.
+  it('maps each host status onto the sidebar agent state', async () => {
+    render(<StructuredAgentSessionStatusBridge />)
+    await waitFor(() => expect(mocks.subscribeStatus).toHaveBeenCalledOnce())
+    act(() => feed().emit({ type: 'snapshot', sessions: [summary()] }))
+    expect(statuses()).toEqual([expect.objectContaining({ state: 'working' })])
+
+    act(() => feed().emit({ type: 'status', session: summary({ status: 'idle', updatedAt: 2 }) }))
+    expect(statuses()).toEqual([expect.objectContaining({ state: 'done', sessionBoundary: true })])
+
+    act(() =>
+      feed().emit({ type: 'status', session: summary({ status: 'attention', updatedAt: 3 }) })
+    )
+    expect(statuses()).toEqual([expect.objectContaining({ state: 'blocked' })])
+  })
+
+  it('shows no status before a persisted turn', async () => {
+    render(<StructuredAgentSessionStatusBridge />)
+    await waitFor(() => expect(mocks.subscribeStatus).toHaveBeenCalledOnce())
+
+    act(() => feed().emit({ type: 'snapshot', sessions: [summary({ status: null })] }))
     expect(mocks.setAgentStatus).not.toHaveBeenCalled()
+
+    act(() => feed().emit({ type: 'status', session: summary({ updatedAt: 2 }) }))
+    expect(statuses()).toEqual([expect.objectContaining({ state: 'working' })])
   })
 
-  it('shares the visible pane subscriber with status projection', async () => {
-    render(<ActiveComposition />)
-
-    await waitFor(() => expect(mocks.setAgentStatus).toHaveBeenCalledOnce())
-    expect(mocks.call).toHaveBeenCalledOnce()
-    expect(mocks.subscribe).toHaveBeenCalledOnce()
-    expect(mocks.setAgentStatus.mock.calls[0]?.[5]).toEqual({
-      providerSession: historyResult.providerSession,
-      terminalResumeEligible: false
-    })
-  })
-
-  it('keeps the status map reference stable for coalesced assistant deltas', async () => {
-    render(<ActiveComposition />)
-    await waitFor(() => expect(mocks.setAgentStatus).toHaveBeenCalledOnce())
+  it('keeps the status map reference stable for repeated equal summaries', async () => {
+    render(<StructuredAgentSessionStatusBridge />)
+    await waitFor(() => expect(mocks.subscribeStatus).toHaveBeenCalledOnce())
+    act(() => feed().emit({ type: 'snapshot', sessions: [summary()] }))
     const before = mocks.store?.getState().agentStatusByPaneKey
-    const onEvent = mocks.subscribe.mock.calls[0]?.[2] as (event: unknown) => void
 
     act(() => {
-      for (let sequence = 2; sequence <= 12; sequence += 1) {
-        onEvent({
-          type: 'batch',
-          sessionId: 'session-1',
-          batch: {
-            cursor: { epoch: 'epoch-1', sequence },
-            items: [
-              {
-                itemId: 'assistant-1',
-                revision: sequence,
-                sequence,
-                observedAt: sequence,
-                body: {
-                  kind: 'message',
-                  role: 'assistant',
-                  blocks: [{ type: 'text', text: `delta-${sequence}` }]
-                }
-              }
-            ],
-            removedItemIds: [],
-            submissions: []
-          }
-        })
+      for (let updatedAt = 2; updatedAt <= 12; updatedAt += 1) {
+        feed().emit({ type: 'status', session: summary({ updatedAt }) })
       }
     })
-    await act(async () => new Promise((resolve) => setTimeout(resolve, 60)))
 
     expect(mocks.setAgentStatus).toHaveBeenCalledOnce()
     expect(mocks.store?.getState().agentStatusByPaneKey).toBe(before)
   })
 
+  it('drops the status and the feed when the last structured tab closes', async () => {
+    render(<StructuredAgentSessionStatusBridge />)
+    await waitFor(() => expect(mocks.subscribeStatus).toHaveBeenCalledOnce())
+    act(() => feed().emit({ type: 'snapshot', sessions: [summary()] }))
+    expect(statuses()).toHaveLength(1)
+
+    act(() => mocks.store?.setState({ unifiedTabsByWorktree: { 'wt-1': [] } }))
+
+    expect(statuses()).toEqual([])
+    await waitFor(() => expect(mocks.unsubscribe).toHaveBeenCalledOnce())
+  })
+
+  it('reconnects after the host ends the stream', async () => {
+    vi.useFakeTimers()
+    try {
+      render(<StructuredAgentSessionStatusBridge />)
+      await act(() => Promise.resolve())
+      expect(mocks.subscribeStatus).toHaveBeenCalledOnce()
+
+      act(() => feed().emit({ type: 'end' }))
+      await act(() => vi.advanceTimersByTimeAsync(300))
+
+      expect(mocks.unsubscribe).toHaveBeenCalledOnce()
+      expect(mocks.subscribeStatus).toHaveBeenCalledTimes(2)
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('keys the feed by the worktree runtime environment', async () => {
+    mocks.store?.setState({ testRuntimeOwner: 'env-1' })
+    render(<StructuredAgentSessionStatusBridge />)
+    await waitFor(() => expect(mocks.subscribeStatus).toHaveBeenCalledOnce())
+
+    expect(feed().target).toEqual({ kind: 'environment', environmentId: 'env-1' })
+  })
+
   it('does not project an unknown provider as Codex', async () => {
     mocks.store?.setState({
       unifiedTabsByWorktree: {
@@ -262,8 +299,7 @@ describe('StructuredAgentSessionStatusBridge', () => {
     render(<StructuredAgentSessionStatusBridge />)
     await act(() => Promise.resolve())
 
-    expect(mocks.call).not.toHaveBeenCalled()
-    expect(mocks.subscribe).not.toHaveBeenCalled()
+    expect(mocks.subscribeStatus).not.toHaveBeenCalled()
     expect(mocks.setAgentStatus).not.toHaveBeenCalled()
   })
 })
diff --git a/src/renderer/src/components/native-chat/StructuredAgentSessionStatusBridge.tsx b/src/renderer/src/components/native-chat/StructuredAgentSessionStatusBridge.tsx
index 8409858dd17..d4cb74ab93b 100644
--- a/src/renderer/src/components/native-chat/StructuredAgentSessionStatusBridge.tsx
+++ b/src/renderer/src/components/native-chat/StructuredAgentSessionStatusBridge.tsx
@@ -1,19 +1,14 @@
-import { useEffect, useMemo } from 'react'
+import { useEffect, useMemo, useSyncExternalStore } from 'react'
 import { useShallow } from 'zustand/react/shallow'
-import type { AgentProviderSessionMetadata } from '../../../../shared/agent-session-resume'
 import { agentProviderSessionsEqual } from '../../../../shared/agent-session-resume'
-import {
-  hasPersistedStructuredAgentSessionTurn,
-  projectStructuredAgentSessionStatus,
-  structuredAgentSessionPaneKey
-} from '../../../../shared/structured-agent-session-projection'
-import type { StructuredAgentSessionState } from '../../../../shared/structured-agent-session-reducer'
+import type { AgentSessionStatusSummary } from '../../../../shared/agent-session-wire'
+import { structuredAgentSessionPaneKey } from '../../../../shared/structured-agent-session-projection'
 import type { Tab } from '../../../../shared/tab-types'
 import { isAgentSessionHandleProvider } from '../../../../shared/agent-session-provider-handle'
 import { getRuntimeEnvironmentIdForWorktree } from '@/lib/worktree-runtime-owner'
 import { useAppStore } from '@/store'
-import { getActiveRuntimeTarget } from '@/runtime/runtime-rpc-client'
-import { useStructuredAgentSessionReadObservation } from './use-structured-agent-session-read'
+import { getActiveRuntimeTarget, type RuntimeClientTarget } from '@/runtime/runtime-rpc-client'
+import { getStructuredAgentSessionStatusFeed } from '@/runtime/structured-agent-session-status-feed'
 
 type StructuredTab = Tab & { contentType: 'agent-session' }
 
@@ -47,35 +42,40 @@ export function getStructuredAgentSessionTabs(
   return tabs
 }
 
-function latestPrompt(state: StructuredAgentSessionState): string {
-  for (let index = state.items.length - 1; index >= 0; index -= 1) {
-    const body = state.items[index]?.body
-    if (body?.kind === 'message' && body.role === 'user') {
-      return body.blocks.flatMap((block) => (block.type === 'text' ? [block.text] : [])).join('\n')
-    }
-  }
-  return ''
+/** The host's projected status for one session, live while the caller is mounted. */
+function useStructuredAgentSessionStatusSummary(
+  sessionId: string,
+  target: RuntimeClientTarget
+): AgentSessionStatusSummary | null {
+  const feed = useMemo(() => getStructuredAgentSessionStatusFeed(target), [target])
+  useEffect(() => feed.activate(), [feed])
+  return useSyncExternalStore(
+    feed.subscribe,
+    () => feed.getSnapshot().get(sessionId) ?? null,
+    () => null
+  )
 }
 
-function projectStatus(
-  tab: StructuredTab,
-  state: StructuredAgentSessionState,
-  providerSession: AgentProviderSessionMetadata | undefined
-): void {
+function projectStatus(tab: StructuredTab, summary: AgentSessionStatusSummary | null): void {
   const paneKey = structuredAgentSessionPaneKey(tab.id, tab.entityId)
   const store = useAppStore.getState()
-  if (!hasPersistedStructuredAgentSessionTurn(state.items)) {
+  // No persisted turn yet (or nothing known): the row shows no agent status at all.
+  if (!summary?.status) {
     if (store.agentStatusByPaneKey?.[paneKey]) {
       store.removeAgentStatus(paneKey)
     }
     return
   }
-  const projection = projectStructuredAgentSessionStatus(state.items)
   const desired = {
-    state: projection === 'working' ? 'working' : projection === 'attention' ? 'blocked' : 'done',
-    prompt: latestPrompt(state),
+    state:
+      summary.status === 'working'
+        ? 'working'
+        : summary.status === 'attention'
+          ? 'blocked'
+          : 'done',
+    prompt: summary.latestPrompt,
     agentType: tab.agentSessionAgent,
-    sessionBoundary: projection === 'idle'
+    sessionBoundary: summary.status === 'idle'
   } as const
   const current = store.agentStatusByPaneKey?.[paneKey]
   if (
@@ -87,7 +87,11 @@ function projectStatus(
     current.tabId === tab.id &&
     current.worktreeId === tab.worktreeId &&
     current.terminalResumeEligible === false &&
-    agentProviderSessionsEqual(tab.agentSessionAgent, current.providerSession, providerSession)
+    agentProviderSessionsEqual(
+      tab.agentSessionAgent,
+      current.providerSession,
+      summary.providerSession
+    )
   ) {
     return
   }
@@ -98,7 +102,7 @@ function projectStatus(
     undefined,
     { tabId: tab.id, worktreeId: tab.worktreeId },
     {
-      ...(providerSession ? { providerSession } : {}),
+      ...(summary.providerSession ? { providerSession: summary.providerSession } : {}),
       terminalResumeEligible: false
     }
   )
@@ -112,13 +116,10 @@ function StructuredAgentSessionStatusProjection({ tab }: { tab: StructuredTab })
     () => getActiveRuntimeTarget({ activeRuntimeEnvironmentId: environmentId }),
     [environmentId]
   )
-  const { providerSession, state } = useStructuredAgentSessionReadObservation({
-    sessionId: tab.entityId,
-    target
-  })
+  const summary = useStructuredAgentSessionStatusSummary(tab.entityId, target)
   useEffect(() => {
-    projectStatus(tab, state, providerSession)
-  }, [providerSession, state, tab])
+    projectStatus(tab, summary)
+  }, [summary, tab])
   useEffect(
     () => () =>
       useAppStore.getState().removeAgentStatus(structuredAgentSessionPaneKey(tab.id, tab.entityId)),
diff --git a/src/renderer/src/components/native-chat/native-chat-layout-actions.test.ts b/src/renderer/src/components/native-chat/native-chat-layout-actions.test.ts
new file mode 100644
index 00000000000..6f3a3868bdf
--- /dev/null
+++ b/src/renderer/src/components/native-chat/native-chat-layout-actions.test.ts
@@ -0,0 +1,57 @@
+import { describe, expect, it } from 'vitest'
+import type { AppState } from '@/store/types'
+import {
+  canRunNativeChatSplitTarget,
+  resolveActiveNativeChatSplitTarget
+} from './native-chat-layout-actions'
+
+function stateWithActiveTab(tab: Record<string, unknown>, tabOrder = ['chat', 'other']) {
+  return {
+    groupsByWorktree: {
+      workspace: [{ id: 'group', worktreeId: 'workspace', activeTabId: 'chat', tabOrder }]
+    },
+    unifiedTabsByWorktree: {
+      workspace: [
+        {
+          id: 'chat',
+          entityId: 'session',
+          groupId: 'group',
+          worktreeId: 'workspace',
+          ...tab
+        }
+      ]
+    }
+  } as unknown as Pick<AppState, 'groupsByWorktree' | 'unifiedTabsByWorktree'>
+}
+
+describe('native chat layout actions', () => {
+  it('resolves structured chats to the reusable workspace-tab move path', () => {
+    const state = stateWithActiveTab({ contentType: 'agent-session' })
+    const target = resolveActiveNativeChatSplitTarget(state, 'workspace', 'group')
+
+    expect(target).toEqual({ kind: 'workspace-tab', unifiedTabId: 'chat', groupId: 'group' })
+    expect(canRunNativeChatSplitTarget(state, target)).toBe(true)
+    expect(
+      canRunNativeChatSplitTarget(
+        stateWithActiveTab({ contentType: 'agent-session' }, ['chat']),
+        target
+      )
+    ).toBe(false)
+  })
+
+  it('resolves terminal-backed chat mode to the existing pane split path', () => {
+    const state = stateWithActiveTab({ contentType: 'terminal', viewMode: 'chat' })
+
+    expect(resolveActiveNativeChatSplitTarget(state, 'workspace', 'group')).toEqual({
+      kind: 'terminal-pane',
+      terminalTabId: 'session'
+    })
+    expect(
+      resolveActiveNativeChatSplitTarget(
+        stateWithActiveTab({ contentType: 'terminal', viewMode: 'terminal' }),
+        'workspace',
+        'group'
+      )
+    ).toBeNull()
+  })
+})
diff --git a/src/renderer/src/components/native-chat/native-chat-layout-actions.ts b/src/renderer/src/components/native-chat/native-chat-layout-actions.ts
new file mode 100644
index 00000000000..4f24a8a663c
--- /dev/null
+++ b/src/renderer/src/components/native-chat/native-chat-layout-actions.ts
@@ -0,0 +1,74 @@
+import type { AppState } from '@/store/types'
+import { useAppStore } from '@/store'
+import {
+  canMoveTabToNewPaneColumnFromState,
+  moveTabToNewPaneColumn
+} from '@/components/tab-bar/tab-move-to-pane-column'
+import { requestActiveTerminalPaneSplit } from '@/components/tab-bar/request-active-terminal-pane-split'
+import type { NativeChatSplitDirection } from './native-chat-split-shortcut'
+
+export type NativeChatSplitTarget =
+  | { kind: 'terminal-pane'; terminalTabId: string }
+  | { kind: 'workspace-tab'; unifiedTabId: string; groupId: string }
+
+export function resolveActiveNativeChatSplitTarget(
+  state: Pick<AppState, 'groupsByWorktree' | 'unifiedTabsByWorktree'>,
+  worktreeId: string | null,
+  groupId: string | null
+): NativeChatSplitTarget | null {
+  if (!worktreeId || !groupId) {
+    return null
+  }
+  const group = (state.groupsByWorktree?.[worktreeId] ?? []).find((entry) => entry.id === groupId)
+  const tab = (state.unifiedTabsByWorktree?.[worktreeId] ?? []).find(
+    (entry) => entry.id === group?.activeTabId && entry.groupId === groupId
+  )
+  if (tab?.contentType === 'agent-session') {
+    return { kind: 'workspace-tab', unifiedTabId: tab.id, groupId }
+  }
+  if (tab?.contentType === 'terminal' && tab.viewMode === 'chat') {
+    return { kind: 'terminal-pane', terminalTabId: tab.entityId }
+  }
+  return null
+}
+
+export function canRunNativeChatSplitTarget(
+  state: Pick<AppState, 'groupsByWorktree' | 'unifiedTabsByWorktree'>,
+  target: NativeChatSplitTarget | null
+): boolean {
+  if (!target) {
+    return false
+  }
+  return (
+    target.kind === 'terminal-pane' ||
+    canMoveTabToNewPaneColumnFromState(state, target.unifiedTabId, target.groupId)
+  )
+}
+
+export function runNativeChatSplitTarget(
+  target: NativeChatSplitTarget,
+  direction: NativeChatSplitDirection
+): boolean {
+  if (target.kind === 'terminal-pane') {
+    requestActiveTerminalPaneSplit({
+      tabId: target.terminalTabId,
+      direction: direction === 'right' ? 'vertical' : 'horizontal'
+    })
+    return true
+  }
+  return moveTabToNewPaneColumn({
+    unifiedTabId: target.unifiedTabId,
+    groupId: target.groupId,
+    direction
+  })
+}
+
+export function runActiveNativeChatSplit(
+  worktreeId: string | null,
+  groupId: string | null,
+  direction: NativeChatSplitDirection
+): boolean {
+  const state = useAppStore.getState()
+  const target = resolveActiveNativeChatSplitTarget(state, worktreeId, groupId)
+  return target ? runNativeChatSplitTarget(target, direction) : false
+}
diff --git a/src/renderer/src/components/native-chat/native-chat-pty-session-options.test.ts b/src/renderer/src/components/native-chat/native-chat-pty-session-options.test.ts
index 9dae22da197..8cf82b69ca1 100644
--- a/src/renderer/src/components/native-chat/native-chat-pty-session-options.test.ts
+++ b/src/renderer/src/components/native-chat/native-chat-pty-session-options.test.ts
@@ -117,6 +117,7 @@ describe('native chat PTY session options', () => {
     expect(effortResult.snapshot.map(({ id }) => id)).toEqual(['model', 'effort', 'fastMode'])
     expect(effortResult.snapshot.find(({ id }) => id === 'effort')).toMatchObject({
       valueSource: 'dispatched',
+      transport: 'catalog',
       kind: { currentValue: 'high' }
     })
     expect(listener).toHaveBeenCalledOnce()
diff --git a/src/renderer/src/components/native-chat/native-chat-pty-session-options.ts b/src/renderer/src/components/native-chat/native-chat-pty-session-options.ts
index aa7562b5944..3e3587e68d1 100644
--- a/src/renderer/src/components/native-chat/native-chat-pty-session-options.ts
+++ b/src/renderer/src/components/native-chat/native-chat-pty-session-options.ts
@@ -98,7 +98,8 @@ export function createNativeChatPtySessionOptions(
     catalog,
     models: activeModels(),
     record,
-    mode: args.mode
+    mode: args.mode,
+    liveTransport: 'catalog'
   })
   const listeners = new Set<(value: SessionOptionDescriptor[]) => void>()
 
@@ -108,7 +109,8 @@ export function createNativeChatPtySessionOptions(
       catalog,
       models: activeModels(),
       record,
-      mode: args.mode
+      mode: args.mode,
+      liveTransport: 'catalog'
     })
     for (const listener of listeners) {
       listener(snapshot)
diff --git a/src/renderer/src/components/native-chat/native-chat-session-option-labels.test.ts b/src/renderer/src/components/native-chat/native-chat-session-option-labels.test.ts
index 60d0ffe6aba..7cdf621b272 100644
--- a/src/renderer/src/components/native-chat/native-chat-session-option-labels.test.ts
+++ b/src/renderer/src/components/native-chat/native-chat-session-option-labels.test.ts
@@ -18,6 +18,7 @@ function modelDescriptor(
     id: 'model',
     label: 'Model',
     valueSource,
+    transport: 'catalog',
     settable: true,
     kind: {
       type: 'select',
diff --git a/src/renderer/src/components/native-chat/native-chat-session-option-snapshot.ts b/src/renderer/src/components/native-chat/native-chat-session-option-snapshot.ts
index 9010aa66f27..4acb1a1932a 100644
--- a/src/renderer/src/components/native-chat/native-chat-session-option-snapshot.ts
+++ b/src/renderer/src/components/native-chat/native-chat-session-option-snapshot.ts
@@ -7,6 +7,7 @@ import {
   buildNativeChatSessionOptionSnapshot as buildSharedSnapshot,
   resolveEffectiveNativeChatModelId,
   withTrackedNativeChatModel,
+  type NativeChatLiveOptionTransport,
   type NativeChatSessionOptionMode
 } from '../../../../shared/native-chat-session-option-snapshot'
 import {
@@ -15,7 +16,7 @@ import {
 } from '../../../../shared/native-chat-session-option-state'
 import { translate } from '@/i18n/i18n'
 
-export type { NativeChatSessionOptionMode }
+export type { NativeChatLiveOptionTransport, NativeChatSessionOptionMode }
 export {
   flattenNativeChatSessionOptionRecord,
   resolveEffectiveNativeChatModelId,
@@ -27,6 +28,7 @@ export function buildNativeChatSessionOptionSnapshot(args: {
   models: readonly CatalogModel[]
   record: NativeChatSessionOptionRecord
   mode: NativeChatSessionOptionMode
+  liveTransport: NativeChatLiveOptionTransport
 }): SessionOptionDescriptor[] {
   return buildSharedSnapshot({
     ...args,
diff --git a/src/renderer/src/components/native-chat/native-chat-shared-copy-matches-catalog.test.ts b/src/renderer/src/components/native-chat/native-chat-shared-copy-matches-catalog.test.ts
new file mode 100644
index 00000000000..d73bdc81802
--- /dev/null
+++ b/src/renderer/src/components/native-chat/native-chat-shared-copy-matches-catalog.test.ts
@@ -0,0 +1,43 @@
+import { describe, expect, it } from 'vitest'
+import en from '@/i18n/locales/en.json'
+import { NATIVE_CHAT_TOOL_ACTIVITY_COPY } from '../../../../shared/native-chat-tool-activity'
+import { NATIVE_CHAT_TURN_STATUS_COPY } from '../../../../shared/native-chat-turn-status'
+
+// The shared copy is desktop's i18n fallback and mobile's actual rendered string.
+// If the two drift, desktop keeps showing en.json while mobile shows the constant —
+// silently, since neither side errors. These are the exact keys that made these
+// strings runtime-required (i18next can no longer rebuild them from a literal
+// call-site default), so they must stay byte-identical to the catalog.
+const catalog = en as unknown as {
+  components: {
+    'native-chat': {
+      status: Record<string, string>
+      tool: Record<string, string>
+    }
+  }
+}
+
+describe('native-chat shared copy matches the English catalog', () => {
+  it.each(Object.entries(NATIVE_CHAT_TURN_STATUS_COPY))(
+    'status.%s matches en.json',
+    (key, value) => {
+      expect(catalog.components['native-chat'].status[key]).toBe(value)
+    }
+  )
+
+  it.each(Object.entries(NATIVE_CHAT_TOOL_ACTIVITY_COPY))(
+    'tool.%s matches en.json',
+    (key, value) => {
+      expect(catalog.components['native-chat'].tool[key]).toBe(value)
+    }
+  )
+
+  it('keeps the interpolation placeholders the catalog expects', () => {
+    expect(NATIVE_CHAT_TURN_STATUS_COPY.workedFor).toContain('{{value0}}')
+    expect(NATIVE_CHAT_TURN_STATUS_COPY.workingFor).toContain('{{value0}}')
+    expect(NATIVE_CHAT_TOOL_ACTIVITY_COPY.countN).toContain('{{value0}}')
+    expect(NATIVE_CHAT_TOOL_ACTIVITY_COPY.runningPreview).toContain('{{preview}}')
+    expect(NATIVE_CHAT_TOOL_ACTIVITY_COPY.runningNamedPreview).toContain('{{toolName}}')
+    expect(NATIVE_CHAT_TOOL_ACTIVITY_COPY.runningNamedPreview).toContain('{{preview}}')
+  })
+})
diff --git a/src/renderer/src/components/native-chat/native-chat-split-shortcut.test.ts b/src/renderer/src/components/native-chat/native-chat-split-shortcut.test.ts
new file mode 100644
index 00000000000..0a5b2bd6688
--- /dev/null
+++ b/src/renderer/src/components/native-chat/native-chat-split-shortcut.test.ts
@@ -0,0 +1,38 @@
+import { describe, expect, it } from 'vitest'
+import { matchNativeChatSplitShortcut } from './native-chat-split-shortcut'
+
+describe('matchNativeChatSplitShortcut', () => {
+  it('uses the existing platform split bindings', () => {
+    expect(
+      matchNativeChatSplitShortcut(
+        { key: 'd', metaKey: true, ctrlKey: false, altKey: false, shiftKey: false },
+        'darwin',
+        {}
+      )
+    ).toBe('right')
+    expect(
+      matchNativeChatSplitShortcut(
+        { key: 'd', metaKey: false, ctrlKey: true, altKey: false, shiftKey: true },
+        'win32',
+        {}
+      )
+    ).toBe('right')
+    expect(
+      matchNativeChatSplitShortcut(
+        { key: 'd', metaKey: false, ctrlKey: false, altKey: true, shiftKey: true },
+        'linux',
+        {}
+      )
+    ).toBe('down')
+  })
+
+  it('respects customized bindings', () => {
+    expect(
+      matchNativeChatSplitShortcut(
+        { key: 'ArrowRight', metaKey: false, ctrlKey: true, altKey: true, shiftKey: false },
+        'linux',
+        { 'terminal.splitRight': ['Ctrl+Alt+Right'] }
+      )
+    ).toBe('right')
+  })
+})
diff --git a/src/renderer/src/components/native-chat/native-chat-split-shortcut.ts b/src/renderer/src/components/native-chat/native-chat-split-shortcut.ts
new file mode 100644
index 00000000000..5ded10fa6bb
--- /dev/null
+++ b/src/renderer/src/components/native-chat/native-chat-split-shortcut.ts
@@ -0,0 +1,21 @@
+import {
+  keybindingMatchesAction,
+  type KeybindingInput,
+  type KeybindingOverrides
+} from '../../../../shared/keybindings'
+
+export type NativeChatSplitDirection = 'right' | 'down'
+
+export function matchNativeChatSplitShortcut(
+  input: KeybindingInput,
+  platform: NodeJS.Platform,
+  keybindings: KeybindingOverrides
+): NativeChatSplitDirection | null {
+  if (keybindingMatchesAction('terminal.splitRight', input, platform, keybindings)) {
+    return 'right'
+  }
+  if (keybindingMatchesAction('terminal.splitDown', input, platform, keybindings)) {
+    return 'down'
+  }
+  return null
+}
diff --git a/src/renderer/src/components/native-chat/native-chat-stop-layering.test.ts b/src/renderer/src/components/native-chat/native-chat-stop-layering.test.ts
index 716f1dc3182..46bee5d6172 100644
--- a/src/renderer/src/components/native-chat/native-chat-stop-layering.test.ts
+++ b/src/renderer/src/components/native-chat/native-chat-stop-layering.test.ts
@@ -6,6 +6,15 @@ function source(path: string): string {
   return readFileSync(join(process.cwd(), path), 'utf8')
 }
 
+function workingChatZIndex(css: string): number {
+  const match =
+    /\.native-chat-pane-shell:has\(\[data-native-chat-working='true'\]\)[^{]*\{[^}]*z-index:\s*(\d+);/s.exec(
+      css
+    )
+  expect(match, 'working native-chat z-index rule not found in main.css').not.toBeNull()
+  return Number(match?.[1])
+}
+
 describe('native chat Stop layering', () => {
   it('keeps a working chat pane above bottom-right product chrome', () => {
     const css = source('src/renderer/src/assets/main.css')
@@ -15,9 +24,24 @@ describe('native chat Stop layering', () => {
 
     expect(terminalPane).toContain('native-chat-pane-shell absolute inset-0 z-10')
     expect(css).toMatch(/\[data-sonner-toaster\][^{]*\{[^}]*z-index:\s*40\s*!important;/s)
-    expect(css).toMatch(
-      /\.native-chat-pane-shell:has\(\[data-native-chat-working='true'\]\)[^{]*\{[^}]*z-index:\s*50;/s
+    expect(workingChatZIndex(css)).toBeGreaterThan(40)
+  })
+
+  // Why both bounds: raising the working pane over the panel hides a summoned
+  // floating workspace behind the chat column while an agent streams.
+  it('stays under the floating workspace panel while working', () => {
+    // Comments stripped first: the surrounding layering comment cites bare z-40/z-50
+    // tiers, and a reworded one could otherwise be read as the panel's own class.
+    const panel = source(
+      'src/renderer/src/components/floating-terminal/FloatingTerminalPanelSurface.tsx'
+    ).replace(/\/\*[\s\S]*?\*\/|\/\/[^\n]*/g, '')
+    const panelZIndex = Number(
+      /data-floating-terminal-panel[\s\S]*?className=[\s\S]*?z-\[(\d+)\]/.exec(panel)?.[1]
     )
+
+    // FloatingTerminalPanel.bounds.test.tsx pins this same 45 through a real render.
+    expect(panelZIndex).toBe(45)
+    expect(workingChatZIndex(source('src/renderer/src/assets/main.css'))).toBeLessThan(panelZIndex)
   })
 
   it('publishes working state from both structured and bridge chat roots', () => {
diff --git a/src/renderer/src/components/native-chat/native-chat-view-types.ts b/src/renderer/src/components/native-chat/native-chat-view-types.ts
index 106b29b429d..920bede7028 100644
--- a/src/renderer/src/components/native-chat/native-chat-view-types.ts
+++ b/src/renderer/src/components/native-chat/native-chat-view-types.ts
@@ -37,11 +37,12 @@ export type NativeChatBridgeViewProps = NativeChatOrchestrationProps & {
 export type NativeChatStructuredViewProps = NativeChatOrchestrationProps & {
   mode: 'structured'
   tabId: string
+  groupId?: string
   sessionId: string
   target: RuntimeClientTarget
   agent: AgentType
   isVisible: boolean
-  allowFileUriLinks: boolean
+  contextMenuActions?: Omit<NativeChatContextMenuActions, 'onPaste'>
 }
 
 export type NativeChatResolvedViewProps = NativeChatOrchestrationProps & {
diff --git a/src/renderer/src/components/native-chat/native-chat-working-status-shared-clock.test.tsx b/src/renderer/src/components/native-chat/native-chat-working-status-shared-clock.test.tsx
index dfea16ae0e4..e4bae292004 100644
--- a/src/renderer/src/components/native-chat/native-chat-working-status-shared-clock.test.tsx
+++ b/src/renderer/src/components/native-chat/native-chat-working-status-shared-clock.test.tsx
@@ -3,7 +3,7 @@
 import { act } from 'react'
 import { createRoot, type Root } from 'react-dom/client'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { NativeChatWorkingStatus } from './NativeChatWorkingStatus'
+import { formatNativeChatDuration, NativeChatWorkingStatus } from './NativeChatWorkingStatus'
 
 let container: HTMLDivElement
 let root: Root
@@ -49,34 +49,50 @@ afterEach(() => {
 })
 
 describe('native chat working status elapsed clock', () => {
+  it.each([
+    [0, '0s'],
+    [59, '59s'],
+    [60, '1m 0s'],
+    [69, '1m 9s'],
+    [3_725, '1h 2m 5s']
+  ])('formats %s seconds as %s', (seconds, expected) => {
+    expect(formatNativeChatDuration(seconds)).toBe(expected)
+  })
+
+  it('renders the compact duration in the completed status label', () => {
+    act(() => {
+      root.render(
+        <NativeChatWorkingStatus startedAt={1_000_000} thinking={false} workedSeconds={69} />
+      )
+    })
+
+    expect(elapsedLabels()).toEqual(['Worked for 1m 9s'])
+  })
+
   it('collapses every in-flight turn onto one shared visibility-gated timer', () => {
     renderTurns(3, 1_000_000)
 
     // One shared 1s clock for all three turns, not one interval per turn.
     expect(vi.getTimerCount()).toBe(1)
     act(() => vi.advanceTimersByTime(3_000))
-    expect(elapsedLabels()).toEqual([
-      'Working for 3 seconds',
-      'Working for 3 seconds',
-      'Working for 3 seconds'
-    ])
+    expect(elapsedLabels()).toEqual(['Working for 3s', 'Working for 3s', 'Working for 3s'])
   })
 
   it('stops ticking while hidden and re-syncs the elapsed value on return', () => {
     renderTurns(1, 1_000_000)
     act(() => vi.advanceTimersByTime(3_000))
-    expect(elapsedLabels()).toEqual(['Working for 3 seconds'])
+    expect(elapsedLabels()).toEqual(['Working for 3s'])
 
     setDocumentVisibility('hidden')
     expect(vi.getTimerCount()).toBe(0)
 
     // A minute of hidden wall-clock: no callbacks, no commits, label frozen.
     act(() => vi.advanceTimersByTime(60_000))
-    expect(elapsedLabels()).toEqual(['Working for 3 seconds'])
+    expect(elapsedLabels()).toEqual(['Working for 3s'])
 
     // Returning re-derives elapsed from startedAt, so nothing was lost.
     setDocumentVisibility('visible')
-    expect(elapsedLabels()).toEqual(['Working for 63 seconds'])
+    expect(elapsedLabels()).toEqual(['Working for 1m 3s'])
     expect(vi.getTimerCount()).toBe(1)
   })
 
diff --git a/src/renderer/src/components/native-chat/use-native-chat-context-menu.test.tsx b/src/renderer/src/components/native-chat/use-native-chat-context-menu.test.tsx
index f4e8b3efc72..14841e6c56d 100644
--- a/src/renderer/src/components/native-chat/use-native-chat-context-menu.test.tsx
+++ b/src/renderer/src/components/native-chat/use-native-chat-context-menu.test.tsx
@@ -3,7 +3,8 @@
  */
 import React, { createRef, type ReactNode } from 'react'
 import { renderToStaticMarkup } from 'react-dom/server'
-import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { cleanup, render } from '@testing-library/react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import {
   emptyNativeChatContextMenuActions,
   useNativeChatContextMenu,
@@ -52,6 +53,10 @@ vi.mock('@/i18n/i18n', () => ({
   translate: (_key: string, fallback: string) => fallback
 }))
 
+vi.mock('@/components/tab-bar/TabWorkspaceLayoutMenuSection', () => ({
+  TabWorkspaceLayoutMenuSection: () => 'Move Tab to Split'
+}))
+
 function childrenText(children: ReactNode): string {
   return React.Children.toArray(children)
     .map((child) => {
@@ -65,11 +70,22 @@ function childrenText(children: ReactNode): string {
     .join('')
 }
 
-function Harness({ onSwitchToTerminal }: { onSwitchToTerminal?: () => void }) {
+function Harness({
+  onSwitchToTerminal,
+  structured = false,
+  enabled = true
+}: {
+  onSwitchToTerminal?: () => void
+  structured?: boolean
+  enabled?: boolean
+}) {
   const rootRef = createRef<HTMLDivElement>()
   const { menu } = useNativeChatContextMenu({
     rootRef,
+    enabled,
     onSwitchToTerminal,
+    showTerminalPaneActions: !structured,
+    workspaceLayout: structured ? { unifiedTabId: 'chat-tab', groupId: 'group-1' } : undefined,
     actions: {
       ...emptyNativeChatContextMenuActions,
       onPaste: vi.fn()
@@ -83,6 +99,11 @@ describe('useNativeChatContextMenu', () => {
     items.list = []
   })
 
+  afterEach(() => {
+    cleanup()
+    vi.restoreAllMocks()
+  })
+
   it('restores the bridge switch-to-terminal action when supplied', () => {
     const onSwitchToTerminal = vi.fn()
 
@@ -107,4 +128,31 @@ describe('useNativeChatContextMenu', () => {
       items.list.some((candidate) => childrenText(candidate.children) === 'Switch to terminal view')
     ).toBe(false)
   })
+
+  it('reuses workspace layout actions without terminal-only pane commands', () => {
+    const markup = renderToStaticMarkup(<Harness structured />)
+
+    expect(markup).toContain('Move Tab to Split')
+    expect(markup).not.toContain('Split Terminal Right')
+    expect(markup).not.toContain('Fork Agent Session')
+  })
+
+  it('subscribes to selection changes only while its retained chat is visible', () => {
+    const getSelection = vi.spyOn(window, 'getSelection').mockReturnValue(null)
+    const view = render(<Harness enabled={false} />)
+
+    getSelection.mockClear()
+    document.dispatchEvent(new Event('selectionchange'))
+    expect(getSelection).not.toHaveBeenCalled()
+
+    view.rerender(<Harness enabled />)
+    getSelection.mockClear()
+    document.dispatchEvent(new Event('selectionchange'))
+    expect(getSelection).toHaveBeenCalledOnce()
+
+    view.rerender(<Harness enabled={false} />)
+    getSelection.mockClear()
+    document.dispatchEvent(new Event('selectionchange'))
+    expect(getSelection).not.toHaveBeenCalled()
+  })
 })
diff --git a/src/renderer/src/components/native-chat/use-native-chat-context-menu.tsx b/src/renderer/src/components/native-chat/use-native-chat-context-menu.tsx
index a2d7dae4c93..48d896d4aea 100644
--- a/src/renderer/src/components/native-chat/use-native-chat-context-menu.tsx
+++ b/src/renderer/src/components/native-chat/use-native-chat-context-menu.tsx
@@ -30,6 +30,8 @@ import {
 } from '@/components/ui/dropdown-menu'
 import { translate } from '@/i18n/i18n'
 import { isMacPlatform, nativeChatToggleShortcutLabel } from './native-chat-shortcut'
+import { TabWorkspaceLayoutMenuSection } from '@/components/tab-bar/TabWorkspaceLayoutMenuSection'
+import type { TabSplitDirection } from '@/store/slices/tabs'
 
 type NativeChatContextMenuState = {
   open: boolean
@@ -39,9 +41,17 @@ type NativeChatContextMenuState = {
 
 type UseNativeChatContextMenuArgs = {
   rootRef: RefObject<HTMLElement | null>
-  /** Bridge-only escape hatch; structured sessions never mount this menu. */
+  enabled?: boolean
+  /** Bridge-only escape hatch; structured sessions have no terminal view. */
   onSwitchToTerminal?: () => void
   actions: NativeChatContextMenuActions
+  showTerminalPaneActions?: boolean
+  splitShortcutLabels?: { right: string; down: string }
+  workspaceLayout?: {
+    unifiedTabId: string
+    groupId: string
+    shortcutLabels?: Partial<Record<TabSplitDirection, string>>
+  }
 }
 
 export type NativeChatContextMenuActions = {
@@ -88,8 +98,12 @@ export const emptyNativeChatContextMenuActions: Omit<NativeChatContextMenuAction
 
 export function useNativeChatContextMenu({
   rootRef,
+  enabled = true,
   onSwitchToTerminal,
-  actions
+  actions,
+  showTerminalPaneActions = true,
+  splitShortcutLabels,
+  workspaceLayout
 }: UseNativeChatContextMenuArgs): {
   onContextMenuCapture: MouseEventHandler<HTMLElement>
   onSelectionCapture: () => void
@@ -112,9 +126,18 @@ export function useNativeChatContextMenu({
   }, [rootRef])
 
   useEffect(() => {
+    if (!enabled) {
+      return
+    }
     document.addEventListener('selectionchange', rememberCurrentSelection)
     return () => document.removeEventListener('selectionchange', rememberCurrentSelection)
-  }, [rememberCurrentSelection])
+  }, [enabled, rememberCurrentSelection])
+
+  useEffect(() => {
+    if (!enabled) {
+      setState((current) => (current.open ? { ...current, open: false } : current))
+    }
+  }, [enabled])
 
   const onContextMenuCapture = useCallback(
     (event: React.MouseEvent<HTMLElement>) => {
@@ -142,7 +165,7 @@ export function useNativeChatContextMenu({
     onContextMenuCapture,
     onSelectionCapture: rememberCurrentSelection,
     menu: (
-      <DropdownMenu open={state.open} onOpenChange={setOpen} modal={false}>
+      <DropdownMenu open={enabled && state.open} onOpenChange={setOpen} modal={false}>
         <DropdownMenuTrigger asChild>
           <button
             aria-hidden
@@ -169,113 +192,135 @@ export function useNativeChatContextMenu({
             <Clipboard />
             {translate('auto.components.terminal.pane.TerminalContextMenu.0a917b591a', 'Paste')}
           </DropdownMenuItem>
-          {onSwitchToTerminal ? (
-            <DropdownMenuItem onSelect={onSwitchToTerminal}>
-              <SquareTerminal />
-              {translate(
-                'components.tab.bar.SortableTabContextMenu.switchToTerminalView',
-                'Switch to terminal view'
-              )}
-              <DropdownMenuShortcut>{shortcutLabel}</DropdownMenuShortcut>
-            </DropdownMenuItem>
-          ) : null}
-          {actions.canContinueAgentSessionInNewSession ? (
-            <DropdownMenuItem onSelect={actions.onContinueAgentSessionInNewSession}>
-              <MessageSquarePlus />
-              {translate(
-                'components.agentSessionContinuation.continueInNewSession',
-                'Continue in New Session…'
-              )}
-            </DropdownMenuItem>
-          ) : null}
-          <DropdownMenuItem onSelect={actions.onForkAgentSession}>
-            <GitFork />
-            {translate(
-              'auto.components.terminal.pane.TerminalContextMenu.8a7ddb8b8a',
-              'Fork Agent Session…'
-            )}
-          </DropdownMenuItem>
-          <DropdownMenuSeparator />
-          <DropdownMenuItem onSelect={actions.onSplitRight}>
-            <PanelRightClose />
-            {translate(
-              'auto.components.terminal.pane.TerminalContextMenu.20e565d865',
-              'Split Terminal Right'
-            )}
-          </DropdownMenuItem>
-          <DropdownMenuItem onSelect={actions.onSplitDown}>
-            <PanelBottomClose />
-            {translate(
-              'auto.components.terminal.pane.TerminalContextMenu.98bccf4fa2',
-              'Split Terminal Down'
-            )}
-          </DropdownMenuItem>
-          {actions.canEqualizePaneSizes ? (
-            <DropdownMenuItem onSelect={actions.onEqualizePaneSizes}>
-              <PanelsTopLeft />
-              {translate(
-                'auto.components.terminal.pane.TerminalContextMenu.06c2b0f043',
-                'Equalize Pane Sizes'
-              )}
-            </DropdownMenuItem>
-          ) : null}
-          {actions.canExpandPane ? (
-            <DropdownMenuItem onSelect={actions.onToggleExpand}>
-              {actions.isPaneExpanded ? <Minimize2 /> : <Maximize2 />}
-              {actions.isPaneExpanded
-                ? translate(
-                    'auto.components.terminal.pane.TerminalContextMenu.df766809e0',
-                    'Collapse Pane'
-                  )
-                : translate(
-                    'auto.components.terminal.pane.TerminalContextMenu.925f49f210',
-                    'Expand Pane'
-                  )}
-            </DropdownMenuItem>
-          ) : null}
-          <DropdownMenuSeparator />
-          <DropdownMenuItem onSelect={actions.onSetTitle}>
-            <Pencil />
-            {translate(
-              'auto.components.terminal.pane.TerminalContextMenu.39809d152f',
-              'Set Title…'
-            )}
-          </DropdownMenuItem>
-          {actions.canCopyAgentSessionId ? (
-            <DropdownMenuItem onSelect={actions.onCopyAgentSessionId}>
-              <Copy />
-              {translate(
-                'components.terminalPane.TerminalContextMenu.copySessionId',
-                'Copy Session ID'
-              )}
-            </DropdownMenuItem>
-          ) : null}
-          <DropdownMenuItem onSelect={actions.onCopyTerminalId}>
-            <Copy />
-            {translate(
-              'auto.components.terminal.pane.TerminalContextMenu.copyTerminalId',
-              'Copy Terminal ID'
-            )}
-          </DropdownMenuItem>
-          <DropdownMenuItem onSelect={actions.onCopyPaneId}>
-            <Copy />
-            {translate(
-              'auto.components.terminal.pane.TerminalContextMenu.2cf85a6a55',
-              'Copy Pane ID'
-            )}
-          </DropdownMenuItem>
-          {actions.canClosePane ? (
+          {showTerminalPaneActions ? (
             <>
-              <DropdownMenuSeparator />
-              <DropdownMenuItem variant="destructive" onSelect={actions.onClosePane}>
-                <X />
+              {onSwitchToTerminal ? (
+                <DropdownMenuItem onSelect={onSwitchToTerminal}>
+                  <SquareTerminal />
+                  {translate(
+                    'components.tab.bar.SortableTabContextMenu.switchToTerminalView',
+                    'Switch to terminal view'
+                  )}
+                  <DropdownMenuShortcut>{shortcutLabel}</DropdownMenuShortcut>
+                </DropdownMenuItem>
+              ) : null}
+              {actions.canContinueAgentSessionInNewSession ? (
+                <DropdownMenuItem onSelect={actions.onContinueAgentSessionInNewSession}>
+                  <MessageSquarePlus />
+                  {translate(
+                    'components.agentSessionContinuation.continueInNewSession',
+                    'Continue in New Session…'
+                  )}
+                </DropdownMenuItem>
+              ) : null}
+              <DropdownMenuItem onSelect={actions.onForkAgentSession}>
+                <GitFork />
                 {translate(
-                  'auto.components.terminal.pane.TerminalContextMenu.8c17d6786d',
-                  'Close Pane'
+                  'auto.components.terminal.pane.TerminalContextMenu.8a7ddb8b8a',
+                  'Fork Agent Session…'
                 )}
               </DropdownMenuItem>
             </>
           ) : null}
+          {workspaceLayout ? (
+            <TabWorkspaceLayoutMenuSection
+              unifiedTabId={workspaceLayout.unifiedTabId}
+              groupId={workspaceLayout.groupId}
+              leadingSeparator
+              shortcutLabels={workspaceLayout.shortcutLabels}
+            />
+          ) : null}
+          {showTerminalPaneActions ? (
+            <>
+              <DropdownMenuSeparator />
+              <DropdownMenuItem onSelect={actions.onSplitRight}>
+                <PanelRightClose />
+                {translate(
+                  'auto.components.terminal.pane.TerminalContextMenu.20e565d865',
+                  'Split Terminal Right'
+                )}
+                {splitShortcutLabels ? (
+                  <DropdownMenuShortcut>{splitShortcutLabels.right}</DropdownMenuShortcut>
+                ) : null}
+              </DropdownMenuItem>
+              <DropdownMenuItem onSelect={actions.onSplitDown}>
+                <PanelBottomClose />
+                {translate(
+                  'auto.components.terminal.pane.TerminalContextMenu.98bccf4fa2',
+                  'Split Terminal Down'
+                )}
+                {splitShortcutLabels ? (
+                  <DropdownMenuShortcut>{splitShortcutLabels.down}</DropdownMenuShortcut>
+                ) : null}
+              </DropdownMenuItem>
+              {actions.canEqualizePaneSizes ? (
+                <DropdownMenuItem onSelect={actions.onEqualizePaneSizes}>
+                  <PanelsTopLeft />
+                  {translate(
+                    'auto.components.terminal.pane.TerminalContextMenu.06c2b0f043',
+                    'Equalize Pane Sizes'
+                  )}
+                </DropdownMenuItem>
+              ) : null}
+              {actions.canExpandPane ? (
+                <DropdownMenuItem onSelect={actions.onToggleExpand}>
+                  {actions.isPaneExpanded ? <Minimize2 /> : <Maximize2 />}
+                  {actions.isPaneExpanded
+                    ? translate(
+                        'auto.components.terminal.pane.TerminalContextMenu.df766809e0',
+                        'Collapse Pane'
+                      )
+                    : translate(
+                        'auto.components.terminal.pane.TerminalContextMenu.925f49f210',
+                        'Expand Pane'
+                      )}
+                </DropdownMenuItem>
+              ) : null}
+              <DropdownMenuSeparator />
+              <DropdownMenuItem onSelect={actions.onSetTitle}>
+                <Pencil />
+                {translate(
+                  'auto.components.terminal.pane.TerminalContextMenu.39809d152f',
+                  'Set Title…'
+                )}
+              </DropdownMenuItem>
+              {actions.canCopyAgentSessionId ? (
+                <DropdownMenuItem onSelect={actions.onCopyAgentSessionId}>
+                  <Copy />
+                  {translate(
+                    'components.terminalPane.TerminalContextMenu.copySessionId',
+                    'Copy Session ID'
+                  )}
+                </DropdownMenuItem>
+              ) : null}
+              <DropdownMenuItem onSelect={actions.onCopyTerminalId}>
+                <Copy />
+                {translate(
+                  'auto.components.terminal.pane.TerminalContextMenu.copyTerminalId',
+                  'Copy Terminal ID'
+                )}
+              </DropdownMenuItem>
+              <DropdownMenuItem onSelect={actions.onCopyPaneId}>
+                <Copy />
+                {translate(
+                  'auto.components.terminal.pane.TerminalContextMenu.2cf85a6a55',
+                  'Copy Pane ID'
+                )}
+              </DropdownMenuItem>
+              {actions.canClosePane ? (
+                <>
+                  <DropdownMenuSeparator />
+                  <DropdownMenuItem variant="destructive" onSelect={actions.onClosePane}>
+                    <X />
+                    {translate(
+                      'auto.components.terminal.pane.TerminalContextMenu.8c17d6786d',
+                      'Close Pane'
+                    )}
+                  </DropdownMenuItem>
+                </>
+              ) : null}
+            </>
+          ) : null}
         </DropdownMenuContent>
       </DropdownMenu>
     )
diff --git a/src/renderer/src/components/native-chat/use-native-chat-turn-status.ts b/src/renderer/src/components/native-chat/use-native-chat-turn-status.ts
index 3c4d563dc2b..eb703523dd9 100644
--- a/src/renderer/src/components/native-chat/use-native-chat-turn-status.ts
+++ b/src/renderer/src/components/native-chat/use-native-chat-turn-status.ts
@@ -1,16 +1,14 @@
 import { useLayoutEffect, useState } from 'react'
 import type { NativeChatMessage } from '../../../../shared/native-chat-types'
+import {
+  nativeChatTurnHasResponse,
+  reduceNativeChatTurnTiming,
+  selectNativeChatTurnStatuses,
+  type NativeChatTurnStatus,
+  type NativeChatTurnTimingByTurn
+} from '../../../../shared/native-chat-turn-status'
 
-type NativeChatTurnTiming = {
-  startedAt: number
-  workedSeconds: number | null
-}
-
-export type NativeChatTurnStatus = {
-  startedAt: number | null
-  thinking: boolean
-  workedSeconds: number | null
-}
+export type { NativeChatTurnStatus }
 
 export function useNativeChatTurnStatus({
   messages,
@@ -26,95 +24,30 @@ export function useNativeChatTurnStatus({
   active: NativeChatTurnStatus | null
   completedByTurn: Readonly<Record<string, NativeChatTurnStatus>>
 } {
-  const currentTurnMessages = messages.slice(latestUserIndex + 1)
-  const hasCurrentTurnResponse = currentTurnMessages.some(
-    (message) =>
-      (message.role === 'assistant' || message.role === 'tool') &&
-      message.blocks.some(
-        (block) =>
-          block.type === 'tool-call' ||
-          block.type === 'tool-result' ||
-          (block.type === 'text' && block.text.trim().length > 0)
-      )
-  )
+  const hasCurrentTurnResponse = nativeChatTurnHasResponse(messages, latestUserIndex)
   const latestUserId = latestUserIndex !== -1 ? (messages[latestUserIndex]?.id ?? null) : null
   const activeTurnKey = latestUserId ?? '__unanchored__'
-  const [timingByTurn, setTimingByTurn] = useState<Record<string, NativeChatTurnTiming>>({})
+  const [timingByTurn, setTimingByTurn] = useState<NativeChatTurnTimingByTurn>({})
 
   useLayoutEffect(() => {
     const validTurnKeys = new Set(
       messages.filter((message) => message.role === 'user').map((message) => message.id)
     )
-    validTurnKeys.add(activeTurnKey)
-    if (isWorking) {
-      setTimingByTurn((current) => {
-        let retained = current
-        for (const turnKey of Object.keys(current)) {
-          if (!validTurnKeys.has(turnKey)) {
-            if (retained === current) {
-              retained = { ...current }
-            }
-            delete retained[turnKey]
-          }
-        }
-        const timing = retained[activeTurnKey]
-        const startedAt =
-          workingStartedAt ??
-          (timing?.workedSeconds == null && timing ? timing.startedAt : Date.now())
-        if (timing?.startedAt === startedAt && timing.workedSeconds == null) {
-          return retained
-        }
-        const next = { ...retained }
-        next[activeTurnKey] = { startedAt, workedSeconds: null }
-        return next
+    setTimingByTurn((current) =>
+      reduceNativeChatTurnTiming(current, {
+        activeTurnKey,
+        validTurnKeys,
+        isWorking,
+        workingStartedAt,
+        now: Date.now()
       })
-      return
-    }
-    setTimingByTurn((current) => {
-      let retained = current
-      for (const turnKey of Object.keys(current)) {
-        if (!validTurnKeys.has(turnKey)) {
-          if (retained === current) {
-            retained = { ...current }
-          }
-          delete retained[turnKey]
-        }
-      }
-      const timing = retained[activeTurnKey]
-      if (timing?.workedSeconds != null) {
-        return retained
-      }
-      const startedAt = timing?.startedAt ?? workingStartedAt
-      if (startedAt == null) {
-        return retained
-      }
-      return {
-        ...retained,
-        [activeTurnKey]: {
-          startedAt,
-          workedSeconds: Math.max(0, Math.floor((Date.now() - startedAt) / 1000))
-        }
-      }
-    })
+    )
   }, [activeTurnKey, isWorking, messages, workingStartedAt])
 
-  const currentTiming = timingByTurn[activeTurnKey]
-  const completedByTurn = Object.fromEntries(
-    Object.entries(timingByTurn)
-      .filter(([, timing]) => timing.workedSeconds != null)
-      .map(([turnKey, timing]) => [
-        turnKey,
-        { startedAt: timing.startedAt, thinking: false, workedSeconds: timing.workedSeconds }
-      ])
-  )
-  return {
-    active: isWorking
-      ? {
-          startedAt: workingStartedAt ?? currentTiming?.startedAt ?? null,
-          thinking: !hasCurrentTurnResponse,
-          workedSeconds: null
-        }
-      : (completedByTurn[activeTurnKey] ?? null),
-    completedByTurn
-  }
+  return selectNativeChatTurnStatuses(timingByTurn, {
+    activeTurnKey,
+    isWorking,
+    workingStartedAt,
+    hasCurrentTurnResponse
+  })
 }
diff --git a/src/renderer/src/components/native-chat/use-structured-agent-session-read.test.tsx b/src/renderer/src/components/native-chat/use-structured-agent-session-read.test.tsx
index 2d320694c9c..9e1ce8067b7 100644
--- a/src/renderer/src/components/native-chat/use-structured-agent-session-read.test.tsx
+++ b/src/renderer/src/components/native-chat/use-structured-agent-session-read.test.tsx
@@ -19,10 +19,7 @@ vi.mock('@/runtime/structured-agent-session-client', () => ({
   subscribeStructuredAgentSession: mocks.subscribe
 }))
 
-import {
-  useStructuredAgentSessionRead,
-  useStructuredAgentSessionReadObservation
-} from './use-structured-agent-session-read'
+import { useStructuredAgentSessionRead } from './use-structured-agent-session-read'
 import { resetStructuredAgentSessionReadOwnersForTests } from './structured-agent-session-read-owner'
 
 const LOCAL_TARGET = { kind: 'local' } as const
@@ -357,32 +354,6 @@ describe('useStructuredAgentSessionRead history window', () => {
     second.unmount()
   })
 
-  it('shares one subscriber when pane and projection observe the same visible session', async () => {
-    const unsubscribe = vi.fn()
-    mocks.call.mockResolvedValue({ ok: true, page: page('tail', [], false) })
-    mocks.subscribe.mockResolvedValue({ unsubscribe })
-
-    const view = renderHook(() => {
-      const pane = useStructuredAgentSessionRead({
-        sessionId: 'session-shared',
-        target: LOCAL_TARGET,
-        isVisible: true
-      })
-      const projection = useStructuredAgentSessionReadObservation({
-        sessionId: 'session-shared',
-        target: LOCAL_TARGET
-      })
-      return { pane, projection }
-    })
-
-    await waitFor(() => expect(mocks.subscribe).toHaveBeenCalledOnce())
-    expect(mocks.call).toHaveBeenCalledOnce()
-    expect(view.result.current.pane.state).toBe(view.result.current.projection.state)
-
-    view.unmount()
-    expect(unsubscribe).toHaveBeenCalledOnce()
-  })
-
   it('preserves cached state while switching away and refreshes once on re-entry', async () => {
     const unsubscribe = vi.fn()
     mocks.call.mockImplementation((_target, _method, params) => {
diff --git a/src/renderer/src/components/native-chat/use-structured-agent-session-read.ts b/src/renderer/src/components/native-chat/use-structured-agent-session-read.ts
index 894730f5e65..834d11d3fa1 100644
--- a/src/renderer/src/components/native-chat/use-structured-agent-session-read.ts
+++ b/src/renderer/src/components/native-chat/use-structured-agent-session-read.ts
@@ -20,13 +20,6 @@ function useReadOwnerSnapshot(
   return { owner, snapshot }
 }
 
-export function useStructuredAgentSessionReadObservation(args: {
-  sessionId: string
-  target: RuntimeClientTarget
-}): StructuredAgentSessionReadSnapshot {
-  return useReadOwnerSnapshot(args.sessionId, args.target).snapshot
-}
-
 export function useStructuredAgentSessionRead(args: {
   sessionId: string
   target: RuntimeClientTarget
diff --git a/src/renderer/src/components/native-chat/use-structured-agent-session.test.tsx b/src/renderer/src/components/native-chat/use-structured-agent-session.test.tsx
index 2e611e4c726..9a42ccb6da6 100644
--- a/src/renderer/src/components/native-chat/use-structured-agent-session.test.tsx
+++ b/src/renderer/src/components/native-chat/use-structured-agent-session.test.tsx
@@ -296,4 +296,40 @@ describe('useStructuredAgentSession options', () => {
 
     expect(result.current.error).toBeNull()
   })
+
+  it('includes one background task id in the cancel fingerprint and payload', async () => {
+    mocks.call.mockImplementation((_target, method) =>
+      method === 'agentSession.options'
+        ? Promise.resolve(OPTIONS)
+        : Promise.resolve({
+            ok: true,
+            value: { turnId: 'background-tasks', cancelled: true }
+          })
+    )
+    const { result } = renderHook(() =>
+      useStructuredAgentSession({
+        sessionId: 'session-1',
+        target: LOCAL_TARGET,
+        agent: 'claude',
+        isVisible: true
+      })
+    )
+
+    await act(async () => {
+      await expect(result.current.stopBackgroundTask('task-2')).resolves.toMatchObject({
+        cancelled: true
+      })
+    })
+
+    const mutation = mocks.call.mock.calls.find(([, method]) => method === 'agentSession.cancel')
+    expect(mutation?.[2]).toMatchObject({
+      envelope: {
+        sessionId: 'session-1',
+        expectedRuntimeFence: 3
+      },
+      turnId: 'background-tasks',
+      scope: 'background-tasks',
+      taskId: 'task-2'
+    })
+  })
 })
diff --git a/src/renderer/src/components/native-chat/use-structured-agent-session.ts b/src/renderer/src/components/native-chat/use-structured-agent-session.ts
index 5bea1af8c50..8af9a36e0c4 100644
--- a/src/renderer/src/components/native-chat/use-structured-agent-session.ts
+++ b/src/renderer/src/components/native-chat/use-structured-agent-session.ts
@@ -136,6 +136,13 @@ export function useStructuredAgentSession(args: {
     [sessionId, target]
   )
 
+  // Turns are what confirm an option: the provider names the model it is running
+  // on the frame that opens each one, so re-read the options as a turn changes
+  // rather than leaving the last write unconfirmed for the life of the session.
+  const turnId = activeStructuredAgentSessionTurnId(state.items)
+  const isMonitoringBackgroundTasks =
+    turnId === null && state.backgroundTasks?.state === 'monitoring'
+
   useEffect(() => {
     if (!isVisible || !optionCatalog) {
       return
@@ -157,7 +164,7 @@ export function useStructuredAgentSession(args: {
     return () => {
       stale = true
     }
-  }, [isVisible, optionCatalog, sessionId, state.fence, target])
+  }, [isVisible, optionCatalog, sessionId, state.fence, target, turnId])
 
   const optionSnapshot = useMemo(
     () => structuredAgentSessionOptionSnapshot(optionState),
@@ -219,7 +226,6 @@ export function useStructuredAgentSession(args: {
       (item.body.kind === 'approval' || item.body.kind === 'question') &&
       item.body.resolution.state === 'pending'
   )
-  const turnId = activeStructuredAgentSessionTurnId(state.items)
   return {
     messages: projectStructuredAgentSessionMessages(
       state.items,
@@ -237,8 +243,17 @@ export function useStructuredAgentSession(args: {
     send: outboxController.send,
     retry: outboxController.retry,
     isWorking: turnId !== null,
+    isMonitoringBackgroundTasks,
+    backgroundTasks: state.backgroundTasks?.tasks ?? [],
+    supportsBackgroundTaskStop: state.backgroundTasks?.supportsTaskStop === true,
     turnId,
     cancel: (turnId: string) => mutate('agentSession.cancel', 'agentSession.cancel', { turnId }),
+    stopBackgroundTask: (taskId?: string) =>
+      mutate('agentSession.cancel', 'agentSession.cancel', {
+        turnId: 'background-tasks',
+        scope: 'background-tasks',
+        ...(taskId ? { taskId } : {})
+      }),
     respond: (item: StructuredPromptItem, optionId: string) =>
       mutate<AgentSessionPromptResult>(
         item.body.kind === 'approval'
diff --git a/src/renderer/src/components/native-chat/use-structured-native-chat-pane-commands.ts b/src/renderer/src/components/native-chat/use-structured-native-chat-pane-commands.ts
new file mode 100644
index 00000000000..d479c6ac03a
--- /dev/null
+++ b/src/renderer/src/components/native-chat/use-structured-native-chat-pane-commands.ts
@@ -0,0 +1,90 @@
+import { useCallback, type KeyboardEventHandler, type RefObject } from 'react'
+import { useAppStore } from '@/store'
+import { formatShortcutLabel } from '@/hooks/useShortcutLabel'
+import { getShortcutPlatform } from '@/lib/shortcut-platform'
+import type { NativeChatComposerHandle } from './NativeChatComposer'
+import { useNativeChatPasteBridge } from './use-native-chat-paste-bridge'
+import {
+  emptyNativeChatContextMenuActions,
+  useNativeChatContextMenu,
+  type NativeChatContextMenuActions
+} from './use-native-chat-context-menu'
+import { matchNativeChatSplitShortcut } from './native-chat-split-shortcut'
+import { runNativeChatSplitTarget } from './native-chat-layout-actions'
+
+export function useStructuredNativeChatPaneCommands({
+  tabId,
+  groupId,
+  isVisible,
+  rootRef,
+  composerRef,
+  terminalPaneActions
+}: {
+  tabId: string
+  groupId?: string
+  isVisible: boolean
+  rootRef: RefObject<HTMLDivElement | null>
+  composerRef: RefObject<NativeChatComposerHandle | null>
+  terminalPaneActions?: Omit<NativeChatContextMenuActions, 'onPaste'>
+}) {
+  const keybindings = useAppStore((state) => state.keybindings)
+  const pasteClipboardIntoComposer = useNativeChatPasteBridge({ rootRef, composerRef })
+  const contextMenu = useNativeChatContextMenu({
+    rootRef,
+    actions: {
+      ...emptyNativeChatContextMenuActions,
+      ...terminalPaneActions,
+      onPaste: pasteClipboardIntoComposer
+    },
+    enabled: isVisible,
+    showTerminalPaneActions: terminalPaneActions !== undefined,
+    splitShortcutLabels: {
+      right: formatShortcutLabel('terminal.splitRight', keybindings),
+      down: formatShortcutLabel('terminal.splitDown', keybindings)
+    },
+    workspaceLayout:
+      groupId && terminalPaneActions === undefined
+        ? {
+            unifiedTabId: tabId,
+            groupId,
+            shortcutLabels: {
+              right: formatShortcutLabel('terminal.splitRight', keybindings),
+              down: formatShortcutLabel('terminal.splitDown', keybindings)
+            }
+          }
+        : undefined
+  })
+  const onKeyDownCapture = useCallback<KeyboardEventHandler<HTMLDivElement>>(
+    (event) => {
+      if (event.repeat) {
+        return
+      }
+      const direction = matchNativeChatSplitShortcut(event, getShortcutPlatform(), keybindings)
+      if (!direction) {
+        return
+      }
+      let handled = false
+      if (terminalPaneActions) {
+        if (direction === 'right') {
+          terminalPaneActions.onSplitRight()
+        } else {
+          terminalPaneActions.onSplitDown()
+        }
+        handled = true
+      } else if (groupId) {
+        handled = runNativeChatSplitTarget(
+          { kind: 'workspace-tab', unifiedTabId: tabId, groupId },
+          direction
+        )
+      }
+      if (!handled) {
+        return
+      }
+      event.preventDefault()
+      event.stopPropagation()
+    },
+    [groupId, keybindings, tabId, terminalPaneActions]
+  )
+
+  return { ...contextMenu, onKeyDownCapture }
+}
diff --git a/src/renderer/src/components/new-workspace/ProjectCombobox.dialog-handoff.test.tsx b/src/renderer/src/components/new-workspace/ProjectCombobox.dialog-handoff.test.tsx
new file mode 100644
index 00000000000..e1f3a50f777
--- /dev/null
+++ b/src/renderer/src/components/new-workspace/ProjectCombobox.dialog-handoff.test.tsx
@@ -0,0 +1,152 @@
+// @vitest-environment happy-dom
+
+import React, { act, useRef, useState } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { Dialog, DialogContent, DialogTitle } from '@/components/ui/dialog'
+import ProjectCombobox from './ProjectCombobox'
+
+vi.mock('./use-recent-project-ids', () => ({ useRecentProjectIds: () => [] }))
+
+function Composer({ populated }: { populated: boolean }): React.JSX.Element {
+  const [adding, setAdding] = useState(false)
+  const nameRef = useRef<HTMLInputElement>(null)
+  return (
+    <Dialog open>
+      <DialogContent aria-describedby={undefined}>
+        <DialogTitle>New workspace</DialogTitle>
+        <ProjectCombobox
+          options={
+            populated
+              ? [
+                  {
+                    kind: 'project',
+                    id: 'project:existing',
+                    projectId: 'project:existing',
+                    displayName: 'Existing project',
+                    badgeColor: 'var(--muted)',
+                    detail: 'Project'
+                  }
+                ]
+              : []
+          }
+          value={populated ? 'project:existing' : null}
+          onValueChange={vi.fn()}
+          onAddProject={() => setAdding(true)}
+        />
+        <input ref={nameRef} aria-label="Workspace name" />
+        <Dialog open={adding} onOpenChange={setAdding}>
+          <DialogContent
+            aria-describedby={undefined}
+            onCloseAutoFocus={(event) => {
+              event.preventDefault()
+              nameRef.current?.focus()
+            }}
+          >
+            <DialogTitle>Add a project</DialogTitle>
+            <input aria-label="Project path" />
+            <button onClick={() => setAdding(false)}>Cancel</button>
+          </DialogContent>
+        </Dialog>
+      </DialogContent>
+    </Dialog>
+  )
+}
+
+let container: HTMLDivElement
+let root: Root
+
+beforeEach(() => {
+  // Radix Presence retains closing content when the production exit animation runs.
+  const getStyle = window.getComputedStyle.bind(window)
+  vi.spyOn(window, 'getComputedStyle').mockImplementation((element, ...args) => {
+    const style = getStyle(element, ...args)
+    if (element.getAttribute('data-slot') === 'popover-content') {
+      return new Proxy(style, {
+        get: (target, property) =>
+          property === 'animationName'
+            ? element.getAttribute('data-state') === 'closed'
+              ? 'exit'
+              : 'enter'
+            : Reflect.get(target, property)
+      })
+    }
+    return style
+  })
+  container = document.createElement('div')
+  document.body.appendChild(container)
+  root = createRoot(container)
+})
+
+afterEach(async () => {
+  await act(async () => root.unmount())
+  container.remove()
+  vi.restoreAllMocks()
+})
+
+function projectField(): HTMLInputElement {
+  return document.querySelector<HTMLInputElement>('[role="combobox"][aria-label="Project"]')!
+}
+
+function addOption(): HTMLElement {
+  return Array.from(document.querySelectorAll<HTMLElement>('[role="option"]')).find((option) =>
+    option.textContent?.includes('Add a new project')
+  )!
+}
+
+describe.each([false, true])(
+  'project selector to nested dialog handoff (populated: %s)',
+  (populated) => {
+    it.each(['mouse', 'keyboard'] as const)(
+      'removes the selector before the creation dialog is active via %s',
+      async (input) => {
+        await act(async () => root.render(<Composer populated={populated} />))
+        await act(async () => projectField().click())
+        expect(document.querySelector('[role="listbox"]')).not.toBeNull()
+
+        await act(async () => {
+          if (input === 'mouse') {
+            addOption().dispatchEvent(
+              new MouseEvent('mousedown', { bubbles: true, cancelable: true })
+            )
+            addOption().click()
+          } else if (populated) {
+            projectField().dispatchEvent(
+              new KeyboardEvent('keydown', { key: 'ArrowDown', bubbles: true, cancelable: true })
+            )
+          }
+        })
+        if (input === 'keyboard') {
+          await act(async () => {
+            projectField().dispatchEvent(
+              new KeyboardEvent('keydown', { key: 'Enter', bubbles: true, cancelable: true })
+            )
+          })
+        }
+
+        expect(document.querySelector('[role="listbox"]')).toBeNull()
+        expect(document.querySelector('[data-slot="popover-content"]')).toBeNull()
+        expect(projectField().getAttribute('aria-expanded')).toBe('false')
+        expect(projectField().hasAttribute('aria-activedescendant')).toBe(false)
+        const path = document.querySelector<HTMLInputElement>('[aria-label="Project path"]')!
+        expect(document.activeElement).toBe(path)
+        expect(path.closest('[aria-hidden="true"]')).toBeNull()
+        expect(projectField().closest('[aria-hidden="true"]')).not.toBeNull()
+
+        await act(async () => {
+          Array.from(document.querySelectorAll('button'))
+            .find((b) => b.textContent === 'Cancel')!
+            .click()
+        })
+        await vi.waitFor(() =>
+          expect(document.activeElement).toBe(
+            document.querySelector('[aria-label="Workspace name"]')
+          )
+        )
+        await act(async () => projectField().click())
+        expect(projectField().getAttribute('aria-expanded')).toBe('true')
+        expect(document.querySelector('[role="listbox"]')).not.toBeNull()
+      }
+    )
+  }
+)
diff --git a/src/renderer/src/components/new-workspace/ProjectCombobox.test.tsx b/src/renderer/src/components/new-workspace/ProjectCombobox.test.tsx
index 3b7931238b3..aa6b8df7b2d 100644
--- a/src/renderer/src/components/new-workspace/ProjectCombobox.test.tsx
+++ b/src/renderer/src/components/new-workspace/ProjectCombobox.test.tsx
@@ -72,7 +72,7 @@ function field(): HTMLInputElement {
 
 function openList(): void {
   act(() => {
-    field().dispatchEvent(new FocusEvent('focus', { bubbles: true }))
+    field().focus()
   })
 }
 
diff --git a/src/renderer/src/components/new-workspace/ProjectCombobox.tsx b/src/renderer/src/components/new-workspace/ProjectCombobox.tsx
index c305964ca0e..8561465d57e 100644
--- a/src/renderer/src/components/new-workspace/ProjectCombobox.tsx
+++ b/src/renderer/src/components/new-workspace/ProjectCombobox.tsx
@@ -229,129 +229,132 @@ export default function ProjectCombobox({
           </button>
         </div>
       </PopoverAnchor>
-      <PopoverContent
-        align="start"
-        sideOffset={4}
-        // Why opaque + no fade: this popover lands directly on the composer
-        // dialog, not the app canvas. The shared surface is translucent and
-        // fades 0→1, so mid-animation the Name field underneath reads straight
-        // through the list — two layers at once, which is the "double flash".
-        // An opaque surface that zooms without fading resolves it. (`bg-popover`
-        // alone loses to the primitive's arbitrary-value background, hence the
-        // matching arbitrary form.) Every other caller keeps the blur and fade.
-        className={cn(
-          'flex w-[var(--radix-popover-trigger-width)] min-w-[17rem] flex-col p-0',
-          COMBOBOX_POPOVER_SURFACE
-        )}
-        // Focus stays in the field — it's the search box — so the popover must
-        // not steal it on open, nor yank it back on close after a pick.
-        onOpenAutoFocus={(event) => event.preventDefault()}
-        onCloseAutoFocus={(event) => event.preventDefault()}
-        // Why: the field lives in the anchor, not inside the content, so Radix
-        // sees a focus/pointer event "outside" the layer and dismisses it the
-        // instant you tab in. Keep the layer open whenever the interaction is
-        // within this control; genuine outside events still close it.
-        onFocusOutside={(event) => {
-          if (isWithinComboboxRoot(event.target, ROOT_ATTRIBUTE)) {
-            event.preventDefault()
-          }
-        }}
-        onInteractOutside={(event) => {
-          if (isWithinComboboxRoot(event.target, ROOT_ATTRIBUTE)) {
-            event.preventDefault()
-          }
-        }}
-      >
-        {/* The listbox wraps a scrolling pane plus the pinned Add row, so both
-            stay `option` children of one listbox. */}
-        <div
-          id={listId}
-          role="listbox"
-          aria-label={translate(
-            'auto.components.new.workspace.ProjectCombobox.listLabel',
-            'Projects'
+      {/* Closing must remove the selector before a nested dialog takes focus. */}
+      {open ? (
+        <PopoverContent
+          align="start"
+          sideOffset={4}
+          // Why opaque + no fade: this popover lands directly on the composer
+          // dialog, not the app canvas. The shared surface is translucent and
+          // fades 0→1, so mid-animation the Name field underneath reads straight
+          // through the list — two layers at once, which is the "double flash".
+          // An opaque surface that zooms without fading resolves it. (`bg-popover`
+          // alone loses to the primitive's arbitrary-value background, hence the
+          // matching arbitrary form.) Every other caller keeps the blur and fade.
+          className={cn(
+            'flex w-[var(--radix-popover-trigger-width)] min-w-[17rem] flex-col p-0',
+            COMBOBOX_POPOVER_SURFACE
           )}
-          className="flex min-h-0 flex-col"
+          // Focus stays in the field — it's the search box — so the popover must
+          // not steal it on open, nor yank it back on close after a pick.
+          onOpenAutoFocus={(event) => event.preventDefault()}
+          onCloseAutoFocus={(event) => event.preventDefault()}
+          // Why: the field lives in the anchor, not inside the content, so Radix
+          // sees a focus/pointer event "outside" the layer and dismisses it the
+          // instant you tab in. Keep the layer open whenever the interaction is
+          // within this control; genuine outside events still close it.
+          onFocusOutside={(event) => {
+            if (isWithinComboboxRoot(event.target, ROOT_ATTRIBUTE)) {
+              event.preventDefault()
+            }
+          }}
+          onInteractOutside={(event) => {
+            if (isWithinComboboxRoot(event.target, ROOT_ATTRIBUTE)) {
+              event.preventDefault()
+            }
+          }}
         >
-          {/* Why: `presentation` — this element exists to scroll, and an
+          {/* The listbox wraps a scrolling pane plus the pinned Add row, so both
+            stay `option` children of one listbox. */}
+          <div
+            id={listId}
+            role="listbox"
+            aria-label={translate(
+              'auto.components.new.workspace.ProjectCombobox.listLabel',
+              'Projects'
+            )}
+            className="flex min-h-0 flex-col"
+          >
+            {/* Why: `presentation` — this element exists to scroll, and an
               unroled div between a listbox and its options breaks the
               ownership relationship assistive tech relies on. */}
-          <div
-            ref={setListNode}
-            role="presentation"
-            className="max-h-72 min-h-0 flex-1 overflow-y-auto p-1 scrollbar-sleek"
-          >
-            {matches.length === 0 ? (
-              // Why: row-height rather than a tall centred block — a 60px panel
-              // next to 32px rows reads as a different kind of surface and
-              // makes an empty result feel like an error.
-              <p className="flex h-8 items-center justify-center px-2 text-sm text-muted-foreground">
-                {options.length === 0
-                  ? translate(
-                      'auto.components.new.workspace.ProjectCombobox.noProjects',
-                      'No projects yet.'
-                    )
-                  : translate(
-                      'auto.components.new.workspace.ProjectCombobox.empty',
-                      'No projects match your search.'
-                    )}
-              </p>
-            ) : null}
-            {sections.map((section) => (
-              // Why: `role="group"` — a bare div between a listbox and its
-              // options breaks the ownership relationship for screen readers,
-              // which is the only thing that makes the headings announceable.
-              <div key={section.key} role="group" aria-label={section.heading ?? undefined}>
-                {section.heading ? (
-                  <div
-                    aria-hidden="true"
-                    className="px-2 pt-2.5 pb-1 text-[11px] font-semibold tracking-[0.05em] text-muted-foreground uppercase"
-                  >
-                    {section.heading}
-                  </div>
-                ) : null}
-                {section.items.map((scored) => (
-                  <ProjectOptionRow
-                    key={scored.option.id}
-                    option={scored.option}
-                    nameHits={scored.nameHits}
-                    detailHits={scored.detailHits}
-                    armed={armedKey === scored.option.id}
-                    current={scored.option.id === value}
-                    ambiguous={ambiguous.has(scored.option.id)}
-                    optionId={armedKey === scored.option.id ? `${listId}-armed` : undefined}
-                    onArm={() => arm(scored.option.id)}
-                    onCommit={() => commit(scored.option.id)}
-                  />
-                ))}
-              </div>
-            ))}
-          </div>
-          {onAddProject ? (
             <div
-              role="option"
-              id={armedKey === ADD_PROJECT_KEY ? `${listId}-armed` : undefined}
-              aria-selected={armedKey === ADD_PROJECT_KEY}
-              data-armed={armedKey === ADD_PROJECT_KEY || undefined}
-              onMouseDown={(event) => event.preventDefault()}
-              onMouseMove={() => arm(ADD_PROJECT_KEY)}
-              onClick={() => commit(ADD_PROJECT_KEY)}
-              className={cn(
-                'flex h-9 shrink-0 cursor-default items-center gap-2 border-t border-border px-2 text-sm',
-                armedKey === ADD_PROJECT_KEY && 'bg-accent text-accent-foreground'
-              )}
+              ref={setListNode}
+              role="presentation"
+              className="max-h-72 min-h-0 flex-1 overflow-y-auto p-1 scrollbar-sleek"
             >
-              <FolderPlus className="size-3.5 shrink-0 text-muted-foreground" />
-              <span className="truncate">
-                {translate(
-                  'auto.components.new.workspace.ProjectCombobox.addProject',
-                  'Add a new project'
-                )}
-              </span>
+              {matches.length === 0 ? (
+                // Why: row-height rather than a tall centred block — a 60px panel
+                // next to 32px rows reads as a different kind of surface and
+                // makes an empty result feel like an error.
+                <p className="flex h-8 items-center justify-center px-2 text-sm text-muted-foreground">
+                  {options.length === 0
+                    ? translate(
+                        'auto.components.new.workspace.ProjectCombobox.noProjects',
+                        'No projects yet.'
+                      )
+                    : translate(
+                        'auto.components.new.workspace.ProjectCombobox.empty',
+                        'No projects match your search.'
+                      )}
+                </p>
+              ) : null}
+              {sections.map((section) => (
+                // Why: `role="group"` — a bare div between a listbox and its
+                // options breaks the ownership relationship for screen readers,
+                // which is the only thing that makes the headings announceable.
+                <div key={section.key} role="group" aria-label={section.heading ?? undefined}>
+                  {section.heading ? (
+                    <div
+                      aria-hidden="true"
+                      className="px-2 pt-2.5 pb-1 text-[11px] font-semibold tracking-[0.05em] text-muted-foreground uppercase"
+                    >
+                      {section.heading}
+                    </div>
+                  ) : null}
+                  {section.items.map((scored) => (
+                    <ProjectOptionRow
+                      key={scored.option.id}
+                      option={scored.option}
+                      nameHits={scored.nameHits}
+                      detailHits={scored.detailHits}
+                      armed={armedKey === scored.option.id}
+                      current={scored.option.id === value}
+                      ambiguous={ambiguous.has(scored.option.id)}
+                      optionId={armedKey === scored.option.id ? `${listId}-armed` : undefined}
+                      onArm={() => arm(scored.option.id)}
+                      onCommit={() => commit(scored.option.id)}
+                    />
+                  ))}
+                </div>
+              ))}
             </div>
-          ) : null}
-        </div>
-      </PopoverContent>
+            {onAddProject ? (
+              <div
+                role="option"
+                id={armedKey === ADD_PROJECT_KEY ? `${listId}-armed` : undefined}
+                aria-selected={armedKey === ADD_PROJECT_KEY}
+                data-armed={armedKey === ADD_PROJECT_KEY || undefined}
+                onMouseDown={(event) => event.preventDefault()}
+                onMouseMove={() => arm(ADD_PROJECT_KEY)}
+                onClick={() => commit(ADD_PROJECT_KEY)}
+                className={cn(
+                  'flex h-9 shrink-0 cursor-default items-center gap-2 border-t border-border px-2 text-sm',
+                  armedKey === ADD_PROJECT_KEY && 'bg-accent text-accent-foreground'
+                )}
+              >
+                <FolderPlus className="size-3.5 shrink-0 text-muted-foreground" />
+                <span className="truncate">
+                  {translate(
+                    'auto.components.new.workspace.ProjectCombobox.addProject',
+                    'Add a new project'
+                  )}
+                </span>
+              </div>
+            ) : null}
+          </div>
+        </PopoverContent>
+      ) : null}
     </Popover>
   )
 }
diff --git a/src/renderer/src/components/right-sidebar/active-checks-status.test.ts b/src/renderer/src/components/right-sidebar/active-checks-status.test.ts
index 2686937c345..5bf09276c72 100644
--- a/src/renderer/src/components/right-sidebar/active-checks-status.test.ts
+++ b/src/renderer/src/components/right-sidebar/active-checks-status.test.ts
@@ -1,5 +1,9 @@
-import { describe, expect, it } from 'vitest'
-import { getActiveChecksStatus } from './active-checks-status'
+import { beforeEach, describe, expect, it } from 'vitest'
+import {
+  ACTIVE_CHECKS_STATUS_INPUT_KEYS,
+  clearActiveChecksStatusCacheForTests,
+  getActiveChecksStatus
+} from './active-checks-status'
 import type { AppState } from '../../store/types'
 import type { PRInfo } from '../../../../shared/github/pull-request-types'
 
@@ -16,6 +20,10 @@ function makePR(status: PRInfo['checksStatus']): PRInfo {
 }
 
 describe('getActiveChecksStatus', () => {
+  beforeEach(() => {
+    clearActiveChecksStatusCacheForTests()
+  })
+
   it('prefers repo-id scoped status over stale path-scoped status for the active worktree', () => {
     const state = {
       activeWorktreeId: 'wt-1',
@@ -125,3 +133,67 @@ describe('getActiveChecksStatus', () => {
     expect(getActiveChecksStatus(state)).toBeNull()
   })
 })
+
+describe('getActiveChecksStatus caching', () => {
+  beforeEach(() => {
+    clearActiveChecksStatusCacheForTests()
+  })
+
+  function makeState(prCache: Record<string, unknown>) {
+    return {
+      activeWorktreeId: 'wt-1',
+      repos: [{ id: 'repo-1', path: '/repo' }],
+      worktreesByRepo: {
+        'repo-1': [{ id: 'wt-1', repoId: 'repo-1', branch: 'refs/heads/feature/test' }]
+      },
+      prCache
+    } as unknown as Pick<AppState, 'activeWorktreeId' | 'repos' | 'worktreesByRepo' | 'prCache'>
+  }
+
+  it('reuses the cached status when every input reference is unchanged', () => {
+    const prCache = { 'repo-1::feature/test': { data: makePR('success'), fetchedAt: 2 } }
+    const state = makeState(prCache)
+
+    expect(getActiveChecksStatus(state)).toBe('success')
+    // A different state object carrying the same field references must still hit the cache.
+    expect(getActiveChecksStatus({ ...state })).toBe('success')
+  })
+
+  it('recomputes when a keyed input reference changes', () => {
+    expect(
+      getActiveChecksStatus(
+        makeState({ 'repo-1::feature/test': { data: makePR('success'), fetchedAt: 2 } })
+      )
+    ).toBe('success')
+    expect(
+      getActiveChecksStatus(
+        makeState({ 'repo-1::feature/test': { data: makePR('failure'), fetchedAt: 3 } })
+      )
+    ).toBe('failure')
+  })
+
+  it('reads no store field the cache is not keyed on', () => {
+    // Guards against a cast or widened type bypassing the derived key list: every property the
+    // computation touches on the state object must invalidate the cache.
+    const reads = new Set<PropertyKey>()
+    const keyed = new Set<PropertyKey>(ACTIVE_CHECKS_STATUS_INPUT_KEYS)
+    const state = new Proxy(
+      makeState({ 'repo-1::feature/test': { data: makePR('success'), fetchedAt: 2 } }),
+      {
+        get(target, prop, receiver) {
+          reads.add(prop)
+          return Reflect.get(target, prop, receiver)
+        },
+        has(target, prop) {
+          reads.add(prop)
+          return Reflect.has(target, prop)
+        }
+      }
+    )
+
+    expect(getActiveChecksStatus(state)).toBe('success')
+    expect([...reads].filter((prop) => !keyed.has(prop))).toEqual([])
+    // The read set must also be non-trivial, or the guard proves nothing.
+    expect(reads.has('prCache')).toBe(true)
+  })
+})
diff --git a/src/renderer/src/components/right-sidebar/active-checks-status.ts b/src/renderer/src/components/right-sidebar/active-checks-status.ts
index d6f29e80658..9f1e08a03ba 100644
--- a/src/renderer/src/components/right-sidebar/active-checks-status.ts
+++ b/src/renderer/src/components/right-sidebar/active-checks-status.ts
@@ -5,17 +5,69 @@ import { getGitHubPRCacheKey } from '../../store/slices/github-cache-key'
 import { getHostedReviewCacheKey } from '../../store/slices/hosted-review-cache-identity'
 import { isGitHubPRSuppressed } from '../../../../shared/worktree/github-pr-suppression'
 
-type ActiveChecksStatusState = Pick<
-  AppState,
-  'activeWorktreeId' | 'worktreesByRepo' | 'repos' | 'prCache'
-> &
-  Partial<Pick<AppState, 'settings' | 'hostedReviewCache'>>
+// Why one list: the parameter type and the cache key both derive from it, so a new store field
+// cannot be read here (TS rejects it) without also invalidating the cache on it.
+const REQUIRED_INPUT_KEYS = [
+  'activeWorktreeId',
+  'worktreesByRepo',
+  'repos',
+  'prCache'
+] as const satisfies readonly (keyof AppState)[]
+const OPTIONAL_INPUT_KEYS = [
+  'settings',
+  'hostedReviewCache'
+] as const satisfies readonly (keyof AppState)[]
+/** @internal Every store field getActiveChecksStatus may read; the cache invalidates on any of them. */
+export const ACTIVE_CHECKS_STATUS_INPUT_KEYS = [
+  ...REQUIRED_INPUT_KEYS,
+  ...OPTIONAL_INPUT_KEYS
+] as const
+
+type ActiveChecksStatusState = Pick<AppState, (typeof REQUIRED_INPUT_KEYS)[number]> &
+  Partial<Pick<AppState, (typeof OPTIONAL_INPUT_KEYS)[number]>>
+type ActiveChecksStatusInputs = {
+  [K in (typeof ACTIVE_CHECKS_STATUS_INPUT_KEYS)[number]]: ActiveChecksStatusState[K]
+}
 
 function branchDisplayName(branch: string): string {
   return branch.replace(/^refs\/heads\//, '')
 }
 
+// Why cached: the right sidebar is always mounted, so this ran on every store write and rebuilt two
+// cache-key strings each time. Same single-entry, reference-keyed shape as selectFloatingVisibleTabCount.
+let activeChecksStatusCache: {
+  inputs: ActiveChecksStatusInputs
+  status: CheckStatus | null
+} | null = null
+
+/** @internal */
+export function clearActiveChecksStatusCacheForTests(): void {
+  activeChecksStatusCache = null
+}
+
+function hasSameInputs(inputs: ActiveChecksStatusInputs, state: ActiveChecksStatusState): boolean {
+  for (const key of ACTIVE_CHECKS_STATUS_INPUT_KEYS) {
+    if (inputs[key] !== state[key]) {
+      return false
+    }
+  }
+  return true
+}
+
 export function getActiveChecksStatus(state: ActiveChecksStatusState): CheckStatus | null {
+  const cached = activeChecksStatusCache
+  if (cached && hasSameInputs(cached.inputs, state)) {
+    return cached.status
+  }
+  const status = computeActiveChecksStatus(state)
+  const inputs = Object.fromEntries(
+    ACTIVE_CHECKS_STATUS_INPUT_KEYS.map((key) => [key, state[key]])
+  ) as ActiveChecksStatusInputs
+  activeChecksStatusCache = { inputs, status }
+  return status
+}
+
+function computeActiveChecksStatus(state: ActiveChecksStatusState): CheckStatus | null {
   const activeWorktree = state.activeWorktreeId
     ? (getWorktreeMapFromState(state).get(state.activeWorktreeId) ?? null)
     : null
diff --git a/src/renderer/src/components/right-sidebar/file-explorer-batch-deletion.test.ts b/src/renderer/src/components/right-sidebar/file-explorer-batch-deletion.test.ts
index e93928bf4fd..688683bce13 100644
--- a/src/renderer/src/components/right-sidebar/file-explorer-batch-deletion.test.ts
+++ b/src/renderer/src/components/right-sidebar/file-explorer-batch-deletion.test.ts
@@ -37,6 +37,66 @@ describe('selectDeletionRoots', () => {
     const other = node('/repo/a.ts/impossible-child')
     expect(selectDeletionRoots([file, other])).toEqual([file, other])
   })
+
+  it('reads directory membership once per selected node, including file-only selections', () => {
+    let directoryReads = 0
+    const nodes = Array.from({ length: 1_000 }, (_, index) => ({
+      ...node(`/repo/file-${index}.ts`),
+      get isDirectory() {
+        directoryReads += 1
+        return false
+      }
+    }))
+    const selected = selectDeletionRoots(nodes)
+    expect(directoryReads).toBe(nodes.length)
+    expect(selected).not.toBe(nodes)
+    selected.forEach((entry, index) => expect(entry).toBe(nodes[index]))
+  })
+
+  it('preserves order, node identity and host ownership when children precede parents', () => {
+    const child = node('/repo/docs/guide.md')
+    const first = { ...node('/repo/first.ts'), operationOwner: { kind: 'local' as const } }
+    const parent = {
+      ...node('/repo/docs', true),
+      operationOwner: { kind: 'ssh' as const, connectionId: 'ssh-owner' }
+    }
+    const last = {
+      ...node('/repo/last.ts'),
+      operationOwner: { kind: 'unresolved' as const }
+    }
+    const nodes = [child, first, parent, last]
+    const selected = selectDeletionRoots(nodes)
+    expect(selected).toEqual([first, parent, last])
+    expect(selected[0]).toBe(first)
+    expect(selected[1]).toBe(parent)
+    expect(selected[2]).toBe(last)
+    expect(nodes).toEqual([child, first, parent, last])
+  })
+
+  it('keeps repeated references but excludes distinct directories with the same path', () => {
+    const dir = node('/repo/docs', true)
+    expect(selectDeletionRoots([dir, dir])).toEqual([dir, dir])
+    expect(selectDeletionRoots([dir, { ...dir }])).toEqual([])
+    const file = node('/repo/docs')
+    expect(selectDeletionRoots([file, dir])).toEqual([dir])
+  })
+
+  it.each([
+    ['/repo/docs/', '/repo/docs/guide.md', '/repo/docs-other/guide.md'],
+    ['C:\\Repo\\Docs\\', 'c:/repo/docs/guide.md', 'C:/Repo/Docs-other/guide.md'],
+    ['\\\\Server\\Share\\Docs', '//server/share/docs/guide.md', '//server/other/docs/guide.md']
+  ])('retains path boundaries for %s', (parentPath, childPath, outsidePath) => {
+    const parent = node(parentPath, true)
+    const child = node(childPath)
+    const outside = node(outsidePath)
+    expect(selectDeletionRoots([outside, child, parent])).toEqual([outside, parent])
+  })
+
+  it('keeps case-distinct POSIX paths', () => {
+    const parent = node('/repo/Docs', true)
+    const outside = node('/repo/docs/guide.md')
+    expect(selectDeletionRoots([outside, parent])).toEqual([outside, parent])
+  })
 })
 
 describe('runBatchDeletion', () => {
diff --git a/src/renderer/src/components/right-sidebar/file-explorer-batch-deletion.ts b/src/renderer/src/components/right-sidebar/file-explorer-batch-deletion.ts
index 63a5d029739..5f052bec588 100644
--- a/src/renderer/src/components/right-sidebar/file-explorer-batch-deletion.ts
+++ b/src/renderer/src/components/right-sidebar/file-explorer-batch-deletion.ts
@@ -5,11 +5,9 @@ import type { TreeNode } from './file-explorer-types'
 // already removes the child, and issuing both requests races on the
 // now-missing path and produces spurious errors.
 export function selectDeletionRoots(nodes: TreeNode[]): TreeNode[] {
+  const directories = nodes.filter((node) => node.isDirectory)
   return nodes.filter(
-    (n) =>
-      !nodes.some(
-        (other) => other !== n && other.isDirectory && isPathEqualOrDescendant(n.path, other.path)
-      )
+    (n) => !directories.some((other) => other !== n && isPathEqualOrDescendant(n.path, other.path))
   )
 }
 
diff --git a/src/renderer/src/components/right-sidebar/file-explorer-entries.ts b/src/renderer/src/components/right-sidebar/file-explorer-entries.ts
index 4e5b6e7b423..f21116c7822 100644
--- a/src/renderer/src/components/right-sidebar/file-explorer-entries.ts
+++ b/src/renderer/src/components/right-sidebar/file-explorer-entries.ts
@@ -9,8 +9,5 @@ function isDotfileSegment(segment: string): boolean {
 }
 
 export function isDotfileRelativePath(relativePath: string): boolean {
-  return relativePath
-    .split(/[\\/]+/)
-    .filter(Boolean)
-    .some(isDotfileSegment)
+  return relativePath.split(/[\\/]+/).some(isDotfileSegment)
 }
diff --git a/src/renderer/src/components/right-sidebar/source-control-tree.ts b/src/renderer/src/components/right-sidebar/source-control-tree.ts
index d855201646b..df0938e9097 100644
--- a/src/renderer/src/components/right-sidebar/source-control-tree.ts
+++ b/src/renderer/src/components/right-sidebar/source-control-tree.ts
@@ -128,12 +128,16 @@ export function buildSourceControlTree<
     }
 
     let parent = root
+    // Why accumulated and only materialized on a miss: `slice().join('/')` per segment made
+    // tree building O(files x depth^2) in characters copied, and the Source Control filter
+    // rebuilds this whole tree on every keystroke.
+    let ancestorPath = ''
     for (let index = 0; index < segments.length - 1; index += 1) {
       const name = segments[index]
-      const path = segments.slice(0, index + 1).join('/')
+      ancestorPath = ancestorPath ? `${ancestorPath}/${name}` : name
       let dir = parent.directoryChildren.get(name)
       if (!dir) {
-        dir = makeDirectoryNode<Entry, Area>(area, path, name, index)
+        dir = makeDirectoryNode<Entry, Area>(area, ancestorPath, name, index)
         parent.directoryChildren.set(name, dir)
         parent.children.push(dir)
       }
diff --git a/src/renderer/src/components/right-sidebar/source-control/listing/too-many-changes-banner.tsx b/src/renderer/src/components/right-sidebar/source-control/listing/too-many-changes-banner.tsx
index 3da7b3e58f1..468f919ce6b 100644
--- a/src/renderer/src/components/right-sidebar/source-control/listing/too-many-changes-banner.tsx
+++ b/src/renderer/src/components/right-sidebar/source-control/listing/too-many-changes-banner.tsx
@@ -68,9 +68,12 @@ export function TooManyChangesBanner({
   }
 
   return (
-    <div className="rounded-md border border-amber-500/25 bg-amber-500/5 px-3 py-2">
-      <div className="flex items-center gap-2">
-        <AlertTriangle className="size-4 shrink-0 text-amber-600 dark:text-amber-400" />
+    <div
+      data-testid="too-many-changes-banner"
+      className="flex flex-col gap-2 rounded-md border border-amber-500/25 bg-amber-500/5 px-3 py-2"
+    >
+      <div className="flex items-start gap-2">
+        <AlertTriangle className="mt-px size-4 shrink-0 text-amber-600 dark:text-amber-400" />
         <span className="min-w-0 flex-1 text-xs text-foreground">
           {translate(
             'auto.components.right.sidebar.SourceControl.tooManyChanges',
@@ -78,18 +81,18 @@ export function TooManyChangesBanner({
             { value0: limit.toLocaleString() }
           )}
         </span>
-        <Button
-          type="button"
-          variant="outline"
-          size="xs"
-          className="w-24 shrink-0 text-xs"
-          disabled={isRetrying}
-          onClick={() => void handleRetry()}
-        >
-          {showSpinner ? <Loader2 className="size-3 animate-spin" /> : null}
-          {translate('auto.components.right.sidebar.SourceControl.286dbda4d6', 'Retry')}
-        </Button>
       </div>
+      <Button
+        type="button"
+        variant="outline"
+        size="xs"
+        className="self-end text-xs"
+        disabled={isRetrying}
+        onClick={() => void handleRetry()}
+      >
+        {showSpinner ? <Loader2 className="size-3 animate-spin" /> : null}
+        {translate('auto.components.right.sidebar.SourceControl.286dbda4d6', 'Retry')}
+      </Button>
     </div>
   )
 }
diff --git a/src/renderer/src/components/right-sidebar/source-control/listing/use-selection.ts b/src/renderer/src/components/right-sidebar/source-control/listing/use-selection.ts
index 635ec2102f3..c76576d50dd 100644
--- a/src/renderer/src/components/right-sidebar/source-control/listing/use-selection.ts
+++ b/src/renderer/src/components/right-sidebar/source-control/listing/use-selection.ts
@@ -1,4 +1,4 @@
-import { useState, useCallback, useEffect, useRef, type RefObject } from 'react'
+import { useState, useCallback, useEffect, useMemo, useRef, type RefObject } from 'react'
 import type { GitStatusEntry } from '../../../../../../shared/git-status-types'
 import type { SourceControlRowOpenEvent } from './split-open'
 
@@ -34,6 +34,10 @@ export function reconcileSourceControlSelectionState(args: {
   flatEntries: FlatEntry[]
 }): { selectedKeys: ReadonlySet<string>; anchorKey: string | null } {
   const { anchorKey, flatEntries, selectedKeys } = args
+  // Nothing to prune and no anchor to invalidate: skip building the key set over every visible row.
+  if (selectedKeys.size === 0 && anchorKey === null) {
+    return { selectedKeys, anchorKey }
+  }
   const validKeys = new Set(flatEntries.map((e) => e.key))
   const nextSelected = new Set<string>()
   let selectedChanged = false
@@ -111,11 +115,12 @@ export function useSourceControlSelection({
     shouldOpenAsSplitRef.current = shouldOpenAsSplit
   }, [shouldOpenAsSplit])
 
-  const reconciledSelection = reconcileSourceControlSelectionState({
-    selectedKeys,
-    anchorKey,
-    flatEntries
-  })
+  // Memoized: this hook re-runs on every Source Control panel render (commit-message keystrokes,
+  // status polls), but the reconciliation only moves when one of these three references does.
+  const reconciledSelection = useMemo(
+    () => reconcileSourceControlSelectionState({ selectedKeys, anchorKey, flatEntries }),
+    [selectedKeys, anchorKey, flatEntries]
+  )
   if (reconciledSelection.selectedKeys !== selectedKeys) {
     // Why: visible source-control rows can disappear after filtering, staging,
     // or status refresh; prune stale bulk-action keys before children see them.
diff --git a/src/renderer/src/components/right-sidebar/useSourceControlSelection.test.ts b/src/renderer/src/components/right-sidebar/useSourceControlSelection.test.ts
index 7821b7f07f5..574d2c5c708 100644
--- a/src/renderer/src/components/right-sidebar/useSourceControlSelection.test.ts
+++ b/src/renderer/src/components/right-sidebar/useSourceControlSelection.test.ts
@@ -38,6 +38,41 @@ describe('reconcileSelectionKeys', () => {
 })
 
 describe('reconcileSourceControlSelectionState', () => {
+  it('returns the same references without scanning rows when nothing is selected', () => {
+    const selectedKeys: ReadonlySet<string> = new Set()
+    let keyReads = 0
+    const flatEntries = Array.from({ length: 50 }, (_, index) => ({
+      get key() {
+        keyReads += 1
+        return `file-${index}.ts`
+      }
+    })) as unknown as Parameters<typeof reconcileSourceControlSelectionState>[0]['flatEntries']
+
+    const result = reconcileSourceControlSelectionState({
+      selectedKeys,
+      anchorKey: null,
+      flatEntries
+    })
+
+    expect(keyReads).toBe(0)
+    expect(result.selectedKeys).toBe(selectedKeys)
+    expect(result.anchorKey).toBeNull()
+  })
+
+  it('still drops an anchor that is no longer visible when nothing is selected', () => {
+    const selectedKeys: ReadonlySet<string> = new Set()
+    const result = reconcileSourceControlSelectionState({
+      selectedKeys,
+      anchorKey: 'gone.ts',
+      flatEntries: [{ key: 'kept.ts' }] as unknown as Parameters<
+        typeof reconcileSourceControlSelectionState
+      >[0]['flatEntries']
+    })
+
+    expect(result.anchorKey).toBeNull()
+    expect(result.selectedKeys).toBe(selectedKeys)
+  })
+
   it('keeps selected keys and anchor identity when all keys are still visible', () => {
     const flatEntries = [
       makeEntry('unstaged::a.ts', 'unstaged', 'a.ts'),
diff --git a/src/renderer/src/components/settings/ArtifactsSettingsPane.tsx b/src/renderer/src/components/settings/ArtifactsSettingsPane.tsx
index 60dd3e0c0c9..7e8b87029d4 100644
--- a/src/renderer/src/components/settings/ArtifactsSettingsPane.tsx
+++ b/src/renderer/src/components/settings/ArtifactsSettingsPane.tsx
@@ -1,8 +1,8 @@
-import { useEffect } from 'react'
 import { ArrowRight, Files } from 'lucide-react'
 import type { GlobalSettings } from '../../../../shared/global-settings-types'
 import { Button } from '@/components/ui/button'
 import { SettingsSwitchRow } from './SettingsFormControls'
+import { useOrcaProfileAuthStatusRefresh } from '@/hooks/use-orca-profile-auth-status-refresh'
 import { useAppStore } from '@/store'
 import { isWebClientLocation } from '@/lib/web-client-location'
 import { translate } from '@/i18n/i18n'
@@ -20,18 +20,13 @@ export function ArtifactsSettingsPane({
   const authStatus = useAppStore((state) => state.orcaProfileAuthStatus)
   const connecting = useAppStore((state) => state.orcaProfileConnecting)
   const connect = useAppStore((state) => state.connectCurrentOrcaProfile)
-  const fetchAuthStatus = useAppStore((state) => state.fetchOrcaProfileAuthStatus)
   const signedIn = authStatus?.state === 'connected'
   // Why: the capability lives in the desktop host's store and is deliberately absent from the
   // settings.update allowlist, so a web client can only mirror it — never grant it.
   const isWebClient = isWebClientLocation()
   const sharingEnabled = settings.artifactSharingEnabled === true
 
-  useEffect(() => {
-    if (!authStatus) {
-      void fetchAuthStatus()
-    }
-  }, [authStatus, fetchAuthStatus])
+  useOrcaProfileAuthStatusRefresh()
 
   const howToSteps: HowToStep[] = [
     ...(sharingEnabled
diff --git a/src/renderer/src/components/settings/DebouncedSettingsTextInput.tsx b/src/renderer/src/components/settings/DebouncedSettingsTextInput.tsx
new file mode 100644
index 00000000000..3461133d299
--- /dev/null
+++ b/src/renderer/src/components/settings/DebouncedSettingsTextInput.tsx
@@ -0,0 +1,39 @@
+import type React from 'react'
+import { Input } from '../ui/input'
+import { useDebouncedSettingsTextDraft } from './use-debounced-settings-text-draft'
+
+type DebouncedSettingsTextInputProps = Omit<
+  React.ComponentProps<typeof Input>,
+  'value' | 'onChange' | 'onBlur'
+> & {
+  value: string
+  commit: (next: string) => void
+  onEdit?: () => void
+}
+
+/**
+ * Text input for a free-text setting, committed on a debounce instead of per keystroke.
+ *
+ * Why a component and not a hook at the call site: the account sections are render functions the
+ * settings search calls conditionally, so hooks cannot live in them. Rendering this as JSX gives
+ * the draft its own component to mount and unmount with.
+ */
+export function DebouncedSettingsTextInput({
+  value,
+  commit,
+  onEdit,
+  ...inputProps
+}: DebouncedSettingsTextInputProps): React.JSX.Element {
+  const draft = useDebouncedSettingsTextDraft({ value, commit })
+  return (
+    <Input
+      {...inputProps}
+      value={draft.value}
+      onChange={(event) => {
+        onEdit?.()
+        draft.onChange(event.target.value)
+      }}
+      onBlur={draft.onBlur}
+    />
+  )
+}
diff --git a/src/renderer/src/components/settings/DevToolsPane.tsx b/src/renderer/src/components/settings/DevToolsPane.tsx
index 11bfb36d933..5084dbfb4de 100644
--- a/src/renderer/src/components/settings/DevToolsPane.tsx
+++ b/src/renderer/src/components/settings/DevToolsPane.tsx
@@ -5,6 +5,7 @@ import { Badge } from '../ui/badge'
 import { SettingsSubsectionHeader } from './SettingsFormControls'
 import { showDeleteWorktreeFailureToast } from '../sidebar/delete-worktree-failure-toast'
 import { showLocalBaseRefUpdateSuggestionToast } from '../sidebar/local-base-ref-suggestion-toast'
+import { useOrcaProfileAuthStatusRefresh } from '@/hooks/use-orca-profile-auth-status-refresh'
 import { translate } from '@/i18n/i18n'
 import { useAppStore } from '@/store'
 import type { AppState } from '@/store/types'
@@ -137,6 +138,7 @@ function OrcaCloudDevSubsection(): React.JSX.Element {
   const refresh = useAppStore((s) => s.fetchOrcaProfileAuthStatus)
   const configured = authStatus?.configured === true
   const connected = authStatus?.state === 'connected'
+  useOrcaProfileAuthStatusRefresh()
 
   return (
     <section className="space-y-3">
diff --git a/src/renderer/src/components/settings/ExperimentalPane.test.tsx b/src/renderer/src/components/settings/ExperimentalPane.test.tsx
index b421b77bfc2..ba8e1518921 100644
--- a/src/renderer/src/components/settings/ExperimentalPane.test.tsx
+++ b/src/renderer/src/components/settings/ExperimentalPane.test.tsx
@@ -258,8 +258,12 @@ describe('ExperimentalPane', () => {
     })
 
     expect(container.textContent).toContain('Use updated structured native chat')
+    // The one opt-in gates both providers, so its copy must not name only Codex.
     expect(container.textContent).toContain(
-      'Local macOS and Linux sessions only for now. Windows, WSL, and remote execution hosts (including SSH) continue to use terminal chat.'
+      'Opt in to the host-owned structured chat runtime for Codex and Claude.'
+    )
+    expect(container.textContent).toContain(
+      'Local sessions only for now. WSL and remote execution hosts (including SSH) continue to use terminal chat, and Windows falls back to it unless Orca can read process start times.'
     )
     expect(container.textContent).toContain('Default view')
     root.unmount()
diff --git a/src/renderer/src/components/settings/MobilePairingConnectionOptions.test.tsx b/src/renderer/src/components/settings/MobilePairingConnectionOptions.test.tsx
index 6ff64efa82a..a08c220038c 100644
--- a/src/renderer/src/components/settings/MobilePairingConnectionOptions.test.tsx
+++ b/src/renderer/src/components/settings/MobilePairingConnectionOptions.test.tsx
@@ -2,6 +2,7 @@
 
 import '@testing-library/jest-dom/vitest'
 
+import { StrictMode, useSyncExternalStore } from 'react'
 import { cleanup, render, screen, waitFor, within } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
@@ -17,13 +18,28 @@ type MobileRelayStoreState = {
 }
 
 const mocks = vi.hoisted(() => ({
-  state: {} as MobileRelayStoreState
+  state: {} as MobileRelayStoreState,
+  listeners: new Set<() => void>()
 }))
 
+// Why subscribable: a mid-mount auth re-read has to reach the rendered tree, which a
+// plain selector-over-a-mutable-object mock silently swallows.
 vi.mock('../../store', () => ({
-  useAppStore: (selector: (state: MobileRelayStoreState) => unknown) => selector(mocks.state)
+  useAppStore: (selector: (state: MobileRelayStoreState) => unknown) =>
+    useSyncExternalStore(
+      (onStoreChange) => {
+        mocks.listeners.add(onStoreChange)
+        return () => mocks.listeners.delete(onStoreChange)
+      },
+      () => selector(mocks.state)
+    )
 }))
 
+function publishStoreState(next: MobileRelayStoreState): void {
+  mocks.state = next
+  mocks.listeners.forEach((listener) => listener())
+}
+
 vi.mock('../../i18n/i18n', () => ({
   translate: (_key: string, fallback: string) => fallback
 }))
@@ -251,4 +267,39 @@ describe('MobilePairingConnectionOptions', () => {
     await user.click(lan)
     expect(onChange).toHaveBeenCalledWith('local-only')
   })
+
+  it('re-reads a session revoked since startup and offers Sign in again', async () => {
+    // Regression: the store cached "connected" at startup and the pane only
+    // fetched when it was empty, so a revoked session stayed invisible.
+    const connectedState: MobileRelayStoreState = {
+      ...mocks.state,
+      orcaProfileAuthStatus: {
+        activeProfileId: 'profile-1',
+        configured: true,
+        state: 'connected',
+        persistence: 'encrypted'
+      }
+    }
+    mocks.state = connectedState
+    fetchAuthStatus.mockImplementation(async () => {
+      const revoked: OrcaProfileAuthStatus = {
+        activeProfileId: 'profile-1',
+        configured: true,
+        state: 'reconnect-required',
+        persistence: 'encrypted'
+      }
+      publishStoreState({ ...connectedState, orcaProfileAuthStatus: revoked })
+      return revoked
+    })
+
+    // StrictMode double-invokes the effect: a fetch keyed on what it writes would loop.
+    render(
+      <StrictMode>
+        <MobilePairingConnectionOptions value="automatic" onChange={vi.fn()} />
+      </StrictMode>
+    )
+
+    expect(await screen.findByRole('button', { name: 'Sign in again for Relay' })).toBeVisible()
+    expect(fetchAuthStatus).toHaveBeenCalledTimes(2)
+  })
 })
diff --git a/src/renderer/src/components/settings/MobilePairingConnectionOptions.tsx b/src/renderer/src/components/settings/MobilePairingConnectionOptions.tsx
index 1af58c45827..7874bc5047f 100644
--- a/src/renderer/src/components/settings/MobilePairingConnectionOptions.tsx
+++ b/src/renderer/src/components/settings/MobilePairingConnectionOptions.tsx
@@ -4,6 +4,7 @@ import { Badge } from '../ui/badge'
 import { Button } from '../ui/button'
 import { translate } from '../../i18n/i18n'
 import { useAppStore } from '../../store'
+import { useOrcaProfileAuthStatusRefresh } from '@/hooks/use-orca-profile-auth-status-refresh'
 import { cn } from '@/lib/utils'
 import type { MobileRelayStatus } from '../../../../shared/mobile-relay-status'
 import type { MobilePairingConnectionMode } from '../../../../shared/mobile-pairing-connection-mode'
@@ -54,7 +55,6 @@ export function MobilePairingConnectionOptions({
   const authStatus = useAppStore((state) => state.orcaProfileAuthStatus)
   const connecting = useAppStore((state) => state.orcaProfileConnecting)
   const connect = useAppStore((state) => state.connectCurrentOrcaProfile)
-  const fetchAuthStatus = useAppStore((state) => state.fetchOrcaProfileAuthStatus)
   const [relayStatus, setRelayStatus] = useState<MobileRelayStatus>('offline')
   const signedIn = authStatus?.state === 'connected'
   const reconnectRequired = authStatus?.state === 'reconnect-required'
@@ -93,11 +93,7 @@ export function MobilePairingConnectionOptions({
     optionRefs.current[next]?.focus()
   }
 
-  useEffect(() => {
-    if (!authStatus) {
-      void fetchAuthStatus()
-    }
-  }, [authStatus, fetchAuthStatus])
+  useOrcaProfileAuthStatusRefresh()
 
   useEffect(() => {
     let receivedEvent = false
diff --git a/src/renderer/src/components/settings/MobilePane.test.tsx b/src/renderer/src/components/settings/MobilePane.test.tsx
index 1695263a740..28f83ccf697 100644
--- a/src/renderer/src/components/settings/MobilePane.test.tsx
+++ b/src/renderer/src/components/settings/MobilePane.test.tsx
@@ -32,6 +32,7 @@ type StoreState = {
   }
   updateSettings: (patch: Record<string, unknown>) => Promise<void>
   recordFeatureInteraction: (feature: string) => void
+  fetchOrcaProfileAuthStatus: () => Promise<unknown>
 }
 
 const mocks = vi.hoisted(() => {
@@ -188,7 +189,8 @@ describe('MobilePane pairing connection mode', () => {
       settingsSearchQuery: '',
       settings: { mobileAutoRestoreFitMs: null },
       updateSettings,
-      recordFeatureInteraction: vi.fn()
+      recordFeatureInteraction: vi.fn(),
+      fetchOrcaProfileAuthStatus: vi.fn().mockResolvedValue(null)
     }
     Object.defineProperty(window, 'api', {
       configurable: true,
@@ -797,7 +799,8 @@ describe('MobilePane', () => {
       settingsSearchQuery: '',
       settings: { mobileAutoRestoreFitMs: null },
       updateSettings: mocks.updateSettings,
-      recordFeatureInteraction: vi.fn()
+      recordFeatureInteraction: vi.fn(),
+      fetchOrcaProfileAuthStatus: vi.fn().mockResolvedValue(null)
     }
     Object.defineProperty(window, 'api', {
       configurable: true,
diff --git a/src/renderer/src/components/settings/MobilePane.tsx b/src/renderer/src/components/settings/MobilePane.tsx
index 39c6df203c0..0e51b677ffc 100644
--- a/src/renderer/src/components/settings/MobilePane.tsx
+++ b/src/renderer/src/components/settings/MobilePane.tsx
@@ -218,6 +218,9 @@ export function MobilePane(): React.JSX.Element {
           setEndpoint(null)
           if (result.reason === 'relay_mint_failed' && result.relayFailure) {
             setRelayMintFailure(result.relayFailure)
+            // Why: a revoked session is the likeliest cause; re-read it so the
+            // notice can offer sign-in instead of a retry that cannot succeed.
+            void useAppStore.getState().fetchOrcaProfileAuthStatus()
           } else {
             setRelayMintFailure(null)
             // Why: IPC now forwards reason/guidance for all unavailability paths;
diff --git a/src/renderer/src/components/settings/MobileSettingsPane.tsx b/src/renderer/src/components/settings/MobileSettingsPane.tsx
index 2e98a5ccb43..ff8de2b16e5 100644
--- a/src/renderer/src/components/settings/MobileSettingsPane.tsx
+++ b/src/renderer/src/components/settings/MobileSettingsPane.tsx
@@ -13,7 +13,7 @@ export { getMobileSettingsPaneSearchEntries }
 
 const ORCA_IOS_APP_STORE_URL = 'https://apps.apple.com/app/orca-ide/id6766130217'
 const ORCA_ANDROID_APK_URL =
-  'https://github.com/stablyai/orca/releases/download/mobile-android-v0.0.46/app-release.apk'
+  'https://github.com/stablyai/orca/releases/download/mobile-android-v0.0.47/app-release.apk'
 
 export function MobileSettingsPane(): React.JSX.Element {
   const showMobileButton = useAppStore((s) => s.settings?.showMobileButton !== false)
diff --git a/src/renderer/src/components/settings/NativeChatExperimentalSetting.tsx b/src/renderer/src/components/settings/NativeChatExperimentalSetting.tsx
index 93c4b1c899d..85d27dae2e3 100644
--- a/src/renderer/src/components/settings/NativeChatExperimentalSetting.tsx
+++ b/src/renderer/src/components/settings/NativeChatExperimentalSetting.tsx
@@ -126,13 +126,13 @@ export function NativeChatExperimentalSetting({
                 <p className="text-xs text-muted-foreground">
                   {translate(
                     'auto.components.settings.ExperimentalPane.nativeChat.structuredCopy',
-                    'Opt in to the host-owned structured Codex runtime. Off keeps the existing terminal-backed chat path.'
+                    'Opt in to the host-owned structured chat runtime for Codex and Claude. Off keeps the existing terminal-backed chat path.'
                   )}
                 </p>
                 <p className="text-xs text-muted-foreground">
                   {translate(
                     'auto.components.settings.ExperimentalPane.nativeChat.structuredScope',
-                    'Local macOS and Linux sessions only for now. Windows, WSL, and remote execution hosts (including SSH) continue to use terminal chat.'
+                    'Local sessions only for now. WSL and remote execution hosts (including SSH) continue to use terminal chat, and Windows falls back to it unless Orca can read process start times.'
                   )}
                 </p>
               </div>
diff --git a/src/renderer/src/components/settings/OrcaAccountSettingsPane.tsx b/src/renderer/src/components/settings/OrcaAccountSettingsPane.tsx
index cf6aec97946..8d7ef62f086 100644
--- a/src/renderer/src/components/settings/OrcaAccountSettingsPane.tsx
+++ b/src/renderer/src/components/settings/OrcaAccountSettingsPane.tsx
@@ -1,7 +1,8 @@
-import { useEffect, useState } from 'react'
+import { useState } from 'react'
 import { BookOpen, Check, CircleUserRound, Files, Smartphone } from 'lucide-react'
 import { Badge } from '@/components/ui/badge'
 import { Button } from '@/components/ui/button'
+import { useOrcaProfileAuthStatusRefresh } from '@/hooks/use-orca-profile-auth-status-refresh'
 import { cn } from '@/lib/utils'
 import { translate } from '@/i18n/i18n'
 import { useAppStore } from '@/store'
@@ -61,18 +62,13 @@ export function OrcaAccountSettingsPane(): React.JSX.Element {
   const authStatus = useAppStore((state) => state.orcaProfileAuthStatus)
   const connecting = useAppStore((state) => state.orcaProfileConnecting)
   const connect = useAppStore((state) => state.connectCurrentOrcaProfile)
-  const fetchAuthStatus = useAppStore((state) => state.fetchOrcaProfileAuthStatus)
   const signOut = useAppStore((state) => state.signOutCurrentOrcaProfile)
   const [signOutOpen, setSignOutOpen] = useState(false)
   const [signingOut, setSigningOut] = useState(false)
   const connected = authStatus?.state === 'connected'
   const canConnect = authStatus?.configured === true
 
-  useEffect(() => {
-    if (!authStatus) {
-      void fetchAuthStatus()
-    }
-  }, [authStatus, fetchAuthStatus])
+  useOrcaProfileAuthStatusRefresh()
 
   const confirmSignOut = async (): Promise<void> => {
     if (signingOut) {
diff --git a/src/renderer/src/components/settings/ShareSkillsSettingsPane.tsx b/src/renderer/src/components/settings/ShareSkillsSettingsPane.tsx
index 72da1ad4880..ddbf35734c9 100644
--- a/src/renderer/src/components/settings/ShareSkillsSettingsPane.tsx
+++ b/src/renderer/src/components/settings/ShareSkillsSettingsPane.tsx
@@ -1,6 +1,6 @@
-import { useEffect } from 'react'
 import { ArrowRight, BookOpen } from 'lucide-react'
 import { Button } from '@/components/ui/button'
+import { useOrcaProfileAuthStatusRefresh } from '@/hooks/use-orca-profile-auth-status-refresh'
 import { translate } from '@/i18n/i18n'
 import { isWebClientLocation } from '@/lib/web-client-location'
 import { useAppStore } from '@/store'
@@ -16,16 +16,11 @@ export function ShareSkillsSettingsPane(): React.JSX.Element {
   const authStatus = useAppStore((state) => state.orcaProfileAuthStatus)
   const connecting = useAppStore((state) => state.orcaProfileConnecting)
   const connect = useAppStore((state) => state.connectCurrentOrcaProfile)
-  const fetchAuthStatus = useAppStore((state) => state.fetchOrcaProfileAuthStatus)
   const signedIn = authStatus?.state === 'connected'
   const isWebClient = isWebClientLocation()
   const agentSharingEnabled = settings?.agentSkillSharingEnabled === true
 
-  useEffect(() => {
-    if (!authStatus) {
-      void fetchAuthStatus()
-    }
-  }, [authStatus, fetchAuthStatus])
+  useOrcaProfileAuthStatusRefresh()
 
   const steps: HowToStep[] = [
     {
diff --git a/src/renderer/src/components/settings/accounts-pane-minimax-section.tsx b/src/renderer/src/components/settings/accounts-pane-minimax-section.tsx
index 96321584483..ce72bc0a16d 100644
--- a/src/renderer/src/components/settings/accounts-pane-minimax-section.tsx
+++ b/src/renderer/src/components/settings/accounts-pane-minimax-section.tsx
@@ -10,6 +10,7 @@ import { Popover, PopoverContent, PopoverTrigger } from '../ui/popover'
 import { MiniMaxIcon } from '../status-bar/icons'
 import { SearchableSetting } from './SearchableSetting'
 import type { AccountsPaneSectionModel } from './accounts-pane-types'
+import { DebouncedSettingsTextInput } from './DebouncedSettingsTextInput'
 
 const MINIMAX_CONSOLE_URL = 'https://platform.minimax.io/console/usage'
 
@@ -265,10 +266,10 @@ export function renderMiniMaxAccountsSection(model: AccountsPaneSectionModel): R
           <Label>
             {translate('auto.components.settings.AccountsPane.bf160bb6c0', 'Group ID override')}
           </Label>
-          <Input
+          <DebouncedSettingsTextInput
             type="text"
             value={settings.minimaxGroupId}
-            onChange={(e) => updateSettings({ minimaxGroupId: e.target.value })}
+            commit={(minimaxGroupId) => updateSettings({ minimaxGroupId })}
             placeholder={translate(
               'auto.components.settings.AccountsPane.0747d6391a',
               'Use group ID from cookie'
@@ -290,10 +291,10 @@ export function renderMiniMaxAccountsSection(model: AccountsPaneSectionModel): R
           <Label>
             {translate('auto.components.settings.AccountsPane.4ff2af7524', 'Usage model names')}
           </Label>
-          <Input
+          <DebouncedSettingsTextInput
             type="text"
             value={settings.minimaxUsageModels}
-            onChange={(e) => updateSettings({ minimaxUsageModels: e.target.value })}
+            commit={(minimaxUsageModels) => updateSettings({ minimaxUsageModels })}
             placeholder={translate('auto.components.settings.AccountsPane.3c92b0d31c', 'general')}
             spellCheck={false}
             className="text-xs"
diff --git a/src/renderer/src/components/settings/accounts-pane-provider-setting-sections.tsx b/src/renderer/src/components/settings/accounts-pane-provider-setting-sections.tsx
index 258dea971ae..6bf03df51f4 100644
--- a/src/renderer/src/components/settings/accounts-pane-provider-setting-sections.tsx
+++ b/src/renderer/src/components/settings/accounts-pane-provider-setting-sections.tsx
@@ -1,11 +1,11 @@
 import { translate } from '@/i18n/i18n'
 import { Button } from '../ui/button'
-import { Input } from '../ui/input'
 import { Label } from '../ui/label'
 import { Switch } from '../ui/switch'
 import { GeminiIcon, OpenCodeGoIcon } from '../status-bar/icons'
 import { SearchableSetting } from './SearchableSetting'
 import type { AccountsPaneSectionModel } from './accounts-pane-types'
+import { DebouncedSettingsTextInput } from './DebouncedSettingsTextInput'
 
 export function renderGeminiAccountsSection(model: AccountsPaneSectionModel): React.JSX.Element {
   const { localAccountRuntimeSentenceLabel, recordFeatureInteraction, settings, updateSettings } =
@@ -114,13 +114,11 @@ export function renderOpenCodeAccountsSection(model: AccountsPaneSectionModel):
           )}
         </Label>
         <div className="flex gap-2">
-          <Input
+          <DebouncedSettingsTextInput
             type="password"
             value={settings.opencodeSessionCookie}
-            onChange={(e) => {
-              recordOpenCodeSettingEdit('cookie')
-              updateSettings({ opencodeSessionCookie: e.target.value })
-            }}
+            onEdit={() => recordOpenCodeSettingEdit('cookie')}
+            commit={(opencodeSessionCookie) => updateSettings({ opencodeSessionCookie })}
             placeholder={translate(
               'auto.components.settings.AccountsPane.a7e38affcd',
               'Fe26.2**… token or auth=Fe26.2**… header'
@@ -180,13 +178,11 @@ export function renderOpenCodeAccountsSection(model: AccountsPaneSectionModel):
           {translate('auto.components.settings.AccountsPane.dbdb0b0bd8', 'Workspace ID override')}
         </Label>
         <div className="flex gap-2">
-          <Input
+          <DebouncedSettingsTextInput
             type="text"
             value={settings.opencodeWorkspaceId}
-            onChange={(e) => {
-              recordOpenCodeSettingEdit('workspaceId')
-              updateSettings({ opencodeWorkspaceId: e.target.value })
-            }}
+            onEdit={() => recordOpenCodeSettingEdit('workspaceId')}
+            commit={(opencodeWorkspaceId) => updateSettings({ opencodeWorkspaceId })}
             placeholder={translate(
               'auto.components.settings.AccountsPane.a122332371',
               'wrk_… (leave blank for automatic lookup)'
diff --git a/src/renderer/src/components/settings/use-debounced-settings-text-draft.test.ts b/src/renderer/src/components/settings/use-debounced-settings-text-draft.test.ts
new file mode 100644
index 00000000000..da12fd96a26
--- /dev/null
+++ b/src/renderer/src/components/settings/use-debounced-settings-text-draft.test.ts
@@ -0,0 +1,222 @@
+// @vitest-environment happy-dom
+
+import { StrictMode } from 'react'
+import { act, cleanup, renderHook } from '@testing-library/react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { useDebouncedSettingsTextDraft } from './use-debounced-settings-text-draft'
+
+beforeEach(() => {
+  vi.useFakeTimers()
+})
+
+afterEach(() => {
+  cleanup()
+  vi.useRealTimers()
+})
+
+describe('useDebouncedSettingsTextDraft', () => {
+  it('shows every keystroke immediately but commits once', () => {
+    const commit = vi.fn()
+    const { result } = renderHook(() => useDebouncedSettingsTextDraft({ value: '', commit }))
+
+    for (const next of ['w', 'wr', 'wrk']) {
+      act(() => result.current.onChange(next))
+    }
+
+    expect(result.current.value).toBe('wrk')
+    expect(commit).not.toHaveBeenCalled()
+
+    act(() => {
+      vi.advanceTimersByTime(700)
+    })
+
+    expect(commit).toHaveBeenCalledTimes(1)
+    expect(commit).toHaveBeenCalledWith('wrk')
+  })
+
+  it('commits immediately on blur without waiting for the debounce', () => {
+    const commit = vi.fn()
+    const { result } = renderHook(() => useDebouncedSettingsTextDraft({ value: '', commit }))
+
+    act(() => result.current.onChange('abc'))
+    act(() => result.current.onBlur())
+
+    expect(commit).toHaveBeenCalledExactlyOnceWith('abc')
+
+    act(() => {
+      vi.advanceTimersByTime(700)
+    })
+
+    // The pending timer must not fire a second, duplicate commit.
+    expect(commit).toHaveBeenCalledTimes(1)
+  })
+
+  it('commits a pending edit when the field unmounts', () => {
+    const commit = vi.fn()
+    const { result, unmount } = renderHook(() =>
+      useDebouncedSettingsTextDraft({ value: '', commit })
+    )
+
+    act(() => result.current.onChange('half-typed'))
+    unmount()
+
+    expect(commit).toHaveBeenCalledExactlyOnceWith('half-typed')
+  })
+
+  it('adopts an external value while the field is untouched', () => {
+    const commit = vi.fn()
+    const { result, rerender } = renderHook(
+      ({ value }) => useDebouncedSettingsTextDraft({ value, commit }),
+      { initialProps: { value: 'first' } }
+    )
+
+    rerender({ value: 'from-another-window' })
+
+    expect(result.current.value).toBe('from-another-window')
+    expect(commit).not.toHaveBeenCalled()
+  })
+
+  it('does not let an external value overwrite an in-progress edit', () => {
+    const commit = vi.fn()
+    const { result, rerender } = renderHook(
+      ({ value }) => useDebouncedSettingsTextDraft({ value, commit }),
+      { initialProps: { value: 'first' } }
+    )
+
+    act(() => result.current.onChange('typing'))
+    rerender({ value: 'from-another-window' })
+
+    expect(result.current.value).toBe('typing')
+  })
+
+  it('does not commit when nothing was edited', () => {
+    const commit = vi.fn()
+    const { result } = renderHook(() => useDebouncedSettingsTextDraft({ value: 'x', commit }))
+
+    act(() => result.current.onBlur())
+
+    expect(commit).not.toHaveBeenCalled()
+  })
+})
+
+describe('useDebouncedSettingsTextDraft flush paths', () => {
+  it('commits a pending edit on beforeunload, since a window close never unmounts the tree', () => {
+    const commit = vi.fn()
+    const { result, unmount } = renderHook(() =>
+      useDebouncedSettingsTextDraft({ value: '', commit })
+    )
+
+    act(() => result.current.onChange('quit-mid-word'))
+    act(() => {
+      window.dispatchEvent(new Event('beforeunload', { cancelable: true }))
+    })
+
+    expect(commit).toHaveBeenCalledExactlyOnceWith('quit-mid-word')
+
+    // The later unmount and timer must not commit the same value again.
+    unmount()
+    act(() => {
+      vi.advanceTimersByTime(700)
+    })
+    expect(commit).toHaveBeenCalledTimes(1)
+  })
+
+  it('does not commit on beforeunload when nothing is pending', () => {
+    const commit = vi.fn()
+    renderHook(() => useDebouncedSettingsTextDraft({ value: 'x', commit }))
+
+    act(() => {
+      window.dispatchEvent(new Event('beforeunload', { cancelable: true }))
+    })
+
+    expect(commit).not.toHaveBeenCalled()
+  })
+
+  it('stops listening for beforeunload after unmount', () => {
+    const commit = vi.fn()
+    const { result, unmount } = renderHook(() =>
+      useDebouncedSettingsTextDraft({ value: '', commit })
+    )
+
+    act(() => result.current.onChange('abc'))
+    unmount()
+    act(() => {
+      window.dispatchEvent(new Event('beforeunload', { cancelable: true }))
+    })
+
+    expect(commit).toHaveBeenCalledExactlyOnceWith('abc')
+  })
+
+  it('commits every edit burst, not only the first', () => {
+    const commit = vi.fn()
+    const { result } = renderHook(() => useDebouncedSettingsTextDraft({ value: '', commit }))
+
+    act(() => result.current.onChange('one'))
+    act(() => {
+      vi.advanceTimersByTime(700)
+    })
+    act(() => result.current.onChange('one two'))
+    act(() => {
+      vi.advanceTimersByTime(700)
+    })
+
+    expect(commit).toHaveBeenNthCalledWith(1, 'one')
+    expect(commit).toHaveBeenNthCalledWith(2, 'one two')
+  })
+
+  it('adopts external values again once a pending edit has been committed', () => {
+    const commit = vi.fn()
+    const { result, rerender } = renderHook(
+      ({ value }) => useDebouncedSettingsTextDraft({ value, commit }),
+      { initialProps: { value: '' } }
+    )
+
+    act(() => result.current.onChange('typed'))
+    act(() => {
+      vi.advanceTimersByTime(700)
+    })
+    expect(commit).toHaveBeenCalledExactlyOnceWith('typed')
+
+    // The store echoes the commit, then another window writes a different value.
+    rerender({ value: 'typed' })
+    rerender({ value: 'from-another-window' })
+
+    expect(result.current.value).toBe('from-another-window')
+  })
+
+  it('keeps a keystroke typed while the previous commit is still in flight', () => {
+    const commit = vi.fn()
+    const { result, rerender } = renderHook(
+      ({ value }) => useDebouncedSettingsTextDraft({ value, commit }),
+      { initialProps: { value: '' } }
+    )
+
+    act(() => result.current.onChange('abc'))
+    act(() => {
+      vi.advanceTimersByTime(700)
+    })
+    act(() => result.current.onChange('abcd'))
+    // The store echoes the first commit after the user has already typed more.
+    rerender({ value: 'abc' })
+
+    expect(result.current.value).toBe('abcd')
+
+    act(() => result.current.onBlur())
+    expect(commit).toHaveBeenLastCalledWith('abcd')
+    expect(commit).toHaveBeenCalledTimes(2)
+  })
+
+  it('does not spuriously commit under StrictMode effect replay', () => {
+    const commit = vi.fn()
+    const { result } = renderHook(() => useDebouncedSettingsTextDraft({ value: 'x', commit }), {
+      wrapper: StrictMode
+    })
+
+    expect(commit).not.toHaveBeenCalled()
+
+    act(() => result.current.onChange('xy'))
+    act(() => result.current.onBlur())
+
+    expect(commit).toHaveBeenCalledExactlyOnceWith('xy')
+  })
+})
diff --git a/src/renderer/src/components/settings/use-debounced-settings-text-draft.ts b/src/renderer/src/components/settings/use-debounced-settings-text-draft.ts
new file mode 100644
index 00000000000..1f9fe235ead
--- /dev/null
+++ b/src/renderer/src/components/settings/use-debounced-settings-text-draft.ts
@@ -0,0 +1,86 @@
+import { useCallback, useEffect, useRef, useState } from 'react'
+
+// Matches the repository-hook script draft, the established debounce for settings text in this pane.
+const SETTINGS_TEXT_COMMIT_DEBOUNCE_MS = 700
+
+export type DebouncedSettingsTextDraft = {
+  value: string
+  onChange: (next: string) => void
+  onBlur: () => void
+}
+
+/**
+ * Local draft for a free-text setting, committed on a debounce and flushed on blur, unmount, and
+ * window unload.
+ *
+ * Why: binding an `<Input>` straight to `updateSettings` sends one IPC round trip per keystroke,
+ * and each one replaces the `settings` object identity in every other window, re-rendering every
+ * component subscribed to it. The committed value is unchanged — only the number of commits is.
+ *
+ * A pending timer is the single source of truth for "the draft has uncommitted edits": `onChange`
+ * is the only place that arms it and `flush` the only place that clears it, so there is no separate
+ * dirty flag to fall out of sync.
+ */
+export function useDebouncedSettingsTextDraft(args: {
+  value: string
+  commit: (next: string) => void
+}): DebouncedSettingsTextDraft {
+  const { value, commit } = args
+  const [draft, setDraft] = useState(value)
+  const draftRef = useRef(draft)
+  const commitRef = useRef(commit)
+  const timerRef = useRef<ReturnType<typeof setTimeout> | null>(null)
+
+  // Why an effect, not a render-time write: render must stay pure, and React can replay it.
+  useEffect(() => {
+    commitRef.current = commit
+  }, [commit])
+
+  // Why gated on a pending commit: an external write (another window, a reset) should land in the
+  // field, but must not yank characters out from under someone mid-edit.
+  useEffect(() => {
+    if (timerRef.current !== null) {
+      return
+    }
+    draftRef.current = value
+    setDraft(value)
+  }, [value])
+
+  const flush = useCallback(() => {
+    if (timerRef.current === null) {
+      return
+    }
+    clearTimeout(timerRef.current)
+    timerRef.current = null
+    commitRef.current(draftRef.current)
+  }, [])
+
+  const onChange = useCallback(
+    (next: string) => {
+      draftRef.current = next
+      setDraft(next)
+      if (timerRef.current !== null) {
+        clearTimeout(timerRef.current)
+      }
+      timerRef.current = setTimeout(flush, SETTINGS_TEXT_COMMIT_DEBOUNCE_MS)
+    },
+    [flush]
+  )
+
+  // Why unmount: closing the pane (or the settings search hiding the section) mid-word must persist
+  // the same value typing it would have. `flush` has no dependencies, so this cleanup only ever runs
+  // on unmount.
+  // Why beforeunload: a window close or app quit never unmounts the tree, so the cleanup cannot run.
+  // The close coordinator dispatches a synthetic beforeunload while the tree is still mounted so
+  // listeners like this one can flush; `updateSettings` issues its IPC synchronously, ahead of the
+  // close confirmation, so main persists the value before it flushes the store on quit.
+  useEffect(() => {
+    window.addEventListener('beforeunload', flush)
+    return () => {
+      window.removeEventListener('beforeunload', flush)
+      flush()
+    }
+  }, [flush])
+
+  return { value: draft, onChange, onBlur: flush }
+}
diff --git a/src/renderer/src/components/sidebar/CommentMarkdown.link-click.test.tsx b/src/renderer/src/components/sidebar/CommentMarkdown.link-click.test.tsx
index 575d4343c3b..a3f7c7aad1f 100644
--- a/src/renderer/src/components/sidebar/CommentMarkdown.link-click.test.tsx
+++ b/src/renderer/src/components/sidebar/CommentMarkdown.link-click.test.tsx
@@ -3,6 +3,10 @@
 import { act } from 'react'
 import { createRoot, type Root } from 'react-dom/client'
 import { afterEach, describe, expect, it, vi } from 'vitest'
+import {
+  NATIVE_CHAT_FILE_HREF_PREFIX,
+  routeNativeChatHref
+} from '../../../../shared/native-chat-href-routing'
 import CommentMarkdown from './CommentMarkdown'
 
 describe('CommentMarkdown link click handler', () => {
@@ -48,6 +52,72 @@ describe('CommentMarkdown link click handler', () => {
     expect(event.defaultPrevented).toBe(true)
   })
 
+  it('intercepts auxiliary clicks on generated native file links', () => {
+    const onLinkClick = vi.fn((event: React.MouseEvent<HTMLElement>) => {
+      event.preventDefault()
+    })
+    container = document.createElement('div')
+    document.body.appendChild(container)
+    root = createRoot(container)
+
+    act(() => {
+      root?.render(
+        <CommentMarkdown
+          variant="document"
+          content="Open src/foo.ts"
+          onLinkClick={onLinkClick}
+          linkifyFilePaths
+        />
+      )
+    })
+
+    const anchor = container.querySelector<HTMLAnchorElement>('a')
+    const event = new window.MouseEvent('auxclick', {
+      bubbles: true,
+      cancelable: true,
+      button: 1
+    })
+
+    act(() => {
+      anchor?.dispatchEvent(event)
+    })
+
+    expect(onLinkClick).toHaveBeenCalledWith(expect.any(Object), expect.stringMatching(/^#orca-/))
+    expect(event.defaultPrevented).toBe(true)
+  })
+
+  it('does not activate generated native file links on right-click', () => {
+    const onLinkClick = vi.fn()
+    container = document.createElement('div')
+    document.body.appendChild(container)
+    root = createRoot(container)
+
+    act(() => {
+      root?.render(
+        <CommentMarkdown
+          variant="document"
+          content="Open src/foo.ts"
+          onLinkClick={onLinkClick}
+          linkifyFilePaths
+        />
+      )
+    })
+
+    const anchor = container.querySelector<HTMLAnchorElement>('a')
+    const event = new window.MouseEvent('auxclick', {
+      bubbles: true,
+      cancelable: true,
+      button: 2
+    })
+
+    act(() => {
+      anchor?.dispatchEvent(event)
+    })
+
+    expect(onLinkClick).not.toHaveBeenCalled()
+    expect(event.defaultPrevented).toBe(false)
+  })
+
   it('sanitizes file URI links unless the caller opts in', () => {
     container = document.createElement('div')
     document.body.appendChild(container)
@@ -146,4 +216,388 @@ describe('CommentMarkdown link click handler', () => {
     expect(onLinkClick).toHaveBeenCalledWith(expect.any(Object), 'assets/diagram.png')
     expect(event.defaultPrevented).toBe(true)
   })
+
+  it('linkifies bare POSIX and Windows document paths without an extension allowlist', () => {
+    container = document.createElement('div')
+    document.body.appendChild(container)
+    root = createRoot(container)
+
+    act(() => {
+      root?.render(
+        <CommentMarkdown
+          variant="document"
+          content={String.raw`Open /tmp/sta-6481-explainer.html, docs/review.docx, C:\Reports\final.pages, ./scripts/release, and src/release:12.`}
+          onLinkClick={vi.fn()}
+          linkifyFilePaths
+        />
+      )
+    })
+
+    const routes = Array.from(container.querySelectorAll<HTMLAnchorElement>('a')).map((anchor) =>
+      routeNativeChatHref(anchor.getAttribute('href'))
+    )
+    expect(routes).toEqual([
+      { kind: 'file', pathText: '/tmp/sta-6481-explainer.html', line: null },
+      { kind: 'file', pathText: 'docs/review.docx', line: null },
+      { kind: 'file', pathText: String.raw`C:\Reports\final.pages`, line: null },
+      { kind: 'file', pathText: './scripts/release', line: null },
+      { kind: 'file', pathText: 'src/release:12', line: null }
+    ])
+  })
+
+  it('makes an inline-code file path clickable while preserving code styling', () => {
+    const onLinkClick = vi.fn((event: React.MouseEvent<HTMLElement>) => event.preventDefault())
+    container = document.createElement('div')
+    document.body.appendChild(container)
+    root = createRoot(container)
+
+    act(() => {
+      root?.render(
+        <CommentMarkdown
+          variant="document"
+          content={'Open `C:\\Reports\\release.docx`.'}
+          onLinkClick={onLinkClick}
+          linkifyFilePaths
+        />
+      )
+    })
+
+    const code = container.querySelector('code')
+    const anchor = code?.closest('a')
+    expect(anchor).not.toBeNull()
+    expect(routeNativeChatHref(anchor?.getAttribute('href'))).toEqual({
+      kind: 'file',
+      pathText: String.raw`C:\Reports\release.docx`,
+      line: null
+    })
+
+    act(() => {
+      anchor?.dispatchEvent(new window.MouseEvent('click', { bubbles: true, cancelable: true }))
+    })
+    expect(onLinkClick).toHaveBeenCalledOnce()
+  })
+
+  it('leaves prose-shaped slash tokens and numeric versions unlinked', () => {
+    const proseFalsePositives = ['and/or', 'TCP/IP', '24/7', 'N/A', 'km/h', 'A/B test']
+    const inlineCodeFalsePositives = ['origin/main', 'v1.2.3', '1.0']
+    const quotedFalsePositives = ['"and/or"', '"A/B test"']
+    container = document.createElement('div')
+    document.body.appendChild(container)
+    root = createRoot(container)
+
+    act(() => {
+      root?.render(
+        <CommentMarkdown
+          variant="document"
+          content={`${proseFalsePositives.join(', ')}; ${inlineCodeFalsePositives.map((value) => `\`${value}\``).join(', ')}; ${quotedFalsePositives.join(', ')}`}
+          onLinkClick={vi.fn()}
+          linkifyFilePaths
+        />
+      )
+    })
+
+    expect(container.querySelectorAll('a')).toHaveLength(0)
+    for (const value of proseFalsePositives) {
+      expect(container.textContent).toContain(value)
+    }
+    for (const value of quotedFalsePositives) {
+      expect(container.textContent).toContain(value)
+    }
+    expect(Array.from(container.querySelectorAll('code')).map((code) => code.textContent)).toEqual(
+      inlineCodeFalsePositives
+    )
+  })
+
+  it('links each relative path separately when prose joins them', () => {
+    container = document.createElement('div')
+    document.body.appendChild(container)
+    root = createRoot(container)
+
+    act(() => {
+      root?.render(
+        <CommentMarkdown
+          variant="document"
+          content="Updated src/foo.ts and src/bar.ts, then docs/My Folder/notes.md."
+          onLinkClick={vi.fn()}
+          linkifyFilePaths
+        />
+      )
+    })
+
+    expect(Array.from(container.querySelectorAll('a')).map((anchor) => anchor.textContent)).toEqual(
+      ['src/foo.ts', 'src/bar.ts', 'docs/My Folder/notes.md']
+    )
+  })
+
+  it('links quoted spaced-first-segment paths around apostrophes', () => {
+    container = document.createElement('div')
+    document.body.appendChild(container)
+    root = createRoot(container)
+
+    act(() => {
+      root?.render(
+        <CommentMarkdown
+          variant="document"
+          content={"Don't skip \"Brennan's Folder/notes.md\"; open 'My Folder/guide.md'."}
+          onLinkClick={vi.fn()}
+          linkifyFilePaths
+        />
+      )
+    })
+
+    const anchors = container.querySelectorAll<HTMLAnchorElement>('a')
+    expect(Array.from(anchors).map((anchor) => anchor.textContent)).toEqual([
+      "Brennan's Folder/notes.md",
+      'My Folder/guide.md'
+    ])
+    expect(container.textContent).toBe(
+      "Don't skip \"Brennan's Folder/notes.md\"; open 'My Folder/guide.md'."
+    )
+    expect(
+      Array.from(anchors).map((anchor) => routeNativeChatHref(anchor.getAttribute('href')))
+    ).toEqual([
+      { kind: 'file', pathText: "Brennan's Folder/notes.md", line: null },
+      { kind: 'file', pathText: 'My Folder/guide.md', line: null }
+    ])
+  })
+
+  it('links a spaced-first-segment relative path when inline code disambiguates it', () => {
+    container = document.createElement('div')
+    document.body.appendChild(container)
+    root = createRoot(container)
+
+    act(() => {
+      root?.render(
+        <CommentMarkdown
+          variant="document"
+          content="Open `My Folder/notes.md`."
+          onLinkClick={vi.fn()}
+          linkifyFilePaths
+        />
+      )
+    })
+
+    const anchor = container.querySelector<HTMLAnchorElement>('a')
+    expect(anchor?.textContent).toBe('My Folder/notes.md')
+    expect(routeNativeChatHref(anchor?.getAttribute('href'))).toEqual({
+      kind: 'file',
+      pathText: 'My Folder/notes.md',
+      line: null
+    })
+  })
+
+  it('requires path shape before a spaced line suffix can make a link', () => {
+    container = document.createElement('div')
+    document.body.appendChild(container)
+    root = createRoot(container)
+
+    act(() => {
+      root?.render(
+        <CommentMarkdown
+          variant="document"
+          content='Keep `aspect 16:9` and "John 3:16" as references.'
+          onLinkClick={vi.fn()}
+          linkifyFilePaths
+        />
+      )
+    })
+
+    expect(container.querySelectorAll('a')).toHaveLength(0)
+    expect(container.querySelector('code')?.textContent).toBe('aspect 16:9')
+    expect(container.textContent).toContain('"John 3:16"')
+  })
+
+  it('preserves line suffixes on valid spaced path shapes', () => {
+    const content =
+      'Open "My Folder/notes:12", `My Notes.md:7`, and "C:\\My Folder\\notes.txt:12:3".'
+    container = document.createElement('div')
+    document.body.appendChild(container)
+    root = createRoot(container)
+
+    act(() => {
+      root?.render(
+        <CommentMarkdown
+          variant="document"
+          content={content}
+          onLinkClick={vi.fn()}
+          linkifyFilePaths
+        />
+      )
+    })
+
+    const anchors = Array.from(container.querySelectorAll<HTMLAnchorElement>('a'))
+    expect(anchors.map((anchor) => anchor.textContent)).toEqual([
+      'My Folder/notes:12',
+      'My Notes.md:7',
+      String.raw`C:\My Folder\notes.txt:12:3`
+    ])
+    expect(anchors.map((anchor) => routeNativeChatHref(anchor.getAttribute('href')))).toEqual([
+      { kind: 'file', pathText: 'My Folder/notes:12', line: null },
+      { kind: 'file', pathText: 'My Notes.md:7', line: null },
+      { kind: 'file', pathText: String.raw`C:\My Folder\notes.txt:12:3`, line: null }
+    ])
+  })
+
+  it('links complete Unicode paths and extensions that begin with a digit', () => {
+    container = document.createElement('div')
+    document.body.appendChild(container)
+    root = createRoot(container)
+
+    act(() => {
+      root?.render(
+        <CommentMarkdown
+          variant="document"
+          content="Open /tmp/报告.html, docs/报告/file.html, docs/café/report.pdf, and docs/archive.7z."
+          onLinkClick={vi.fn()}
+          linkifyFilePaths
+        />
+      )
+    })
+
+    expect(Array.from(container.querySelectorAll('a')).map((anchor) => anchor.textContent)).toEqual(
+      ['/tmp/报告.html', 'docs/报告/file.html', 'docs/café/report.pdf', 'docs/archive.7z']
+    )
+  })
+
+  it('never links an ASCII suffix inside a path containing an unsupported character', () => {
+    container = document.createElement('div')
+    document.body.appendChild(container)
+    root = createRoot(container)
+
+    act(() => {
+      root?.render(
+        <CommentMarkdown
+          variant="document"
+          content="Leave /tmp/$draft/report.html as one path or plain text."
+          onLinkClick={vi.fn()}
+          linkifyFilePaths
+        />
+      )
+    })
+
+    expect(container.querySelectorAll('a')).toHaveLength(0)
+    expect(container.textContent).toContain('/tmp/$draft/report.html')
+  })
+
+  it('links paths before common sentence punctuation', () => {
+    container = document.createElement('div')
+    document.body.appendChild(container)
+    root = createRoot(container)
+
+    act(() => {
+      root?.render(
+        <CommentMarkdown
+          variant="document"
+          content="Open src/foo.ts! Read docs/guide.md? View assets/report.pdf—then continue."
+          onLinkClick={vi.fn()}
+          linkifyFilePaths
+        />
+      )
+    })
+
+    expect(Array.from(container.querySelectorAll('a')).map((anchor) => anchor.textContent)).toEqual(
+      ['src/foo.ts', 'docs/guide.md', 'assets/report.pdf']
+    )
+  })
+
+  it('links paths after CLI assignment and before Unicode sentence punctuation', () => {
+    container = document.createElement('div')
+    document.body.appendChild(container)
+    root = createRoot(container)
+
+    act(() => {
+      root?.render(
+        <CommentMarkdown
+          variant="document"
+          content="Run --config=./config.yaml。然后打开 docs/指南.md！再看 docs/报告.pdf？"
+          onLinkClick={vi.fn()}
+          linkifyFilePaths
+        />
+      )
+    })
+
+    expect(Array.from(container.querySelectorAll('a')).map((anchor) => anchor.textContent)).toEqual(
+      ['./config.yaml', 'docs/指南.md', 'docs/报告.pdf']
+    )
+  })
+
+  it('does not link partial paths across unsupported punctuation', () => {
+    container = document.createElement('div')
+    document.body.appendChild(container)
+    root = createRoot(container)
+
+    act(() => {
+      root?.render(
+        <CommentMarkdown
+          variant="document"
+          content="Leave src/foo.ts!draft/file.html, src/foo.ts—draft/file.html."
+          onLinkClick={vi.fn()}
+          linkifyFilePaths
+        />
+      )
+    })
+
+    expect(container.querySelectorAll('a')).toHaveLength(0)
+  })
+
+  it('prevents the default action for an unresolved internal file href', () => {
+    const onLinkClick = vi.fn()
+    container = document.createElement('div')
+    document.body.appendChild(container)
+    root = createRoot(container)
+
+    act(() => {
+      root?.render(
+        <CommentMarkdown
+          variant="document"
+          content="Open ~/x"
+          onLinkClick={onLinkClick}
+          linkifyFilePaths
+        />
+      )
+    })
+
+    const anchor = container.querySelector<HTMLAnchorElement>('a')
+    expect(anchor?.getAttribute('href')).toMatch(new RegExp(`^${NATIVE_CHAT_FILE_HREF_PREFIX}`))
+    const event = new window.MouseEvent('click', { bubbles: true, cancelable: true })
+
+    act(() => {
+      anchor?.dispatchEvent(event)
+    })
+
+    expect(onLinkClick).toHaveBeenCalledOnce()
+    expect(event.defaultPrevented).toBe(true)
+  })
+
+  it('normalizes Windows markdown hrefs but leaves fenced paths as source text', () => {
+    container = document.createElement('div')
+    document.body.appendChild(container)
+    root = createRoot(container)
+
+    act(() => {
+      root?.render(
+        <CommentMarkdown
+          variant="document"
+          content={[
+            String.raw`[report](C:\Reports\summary.pdf)`,
+            '',
+            '```text',
+            '/tmp/not-a-link.html',
+            '```'
+          ].join('\n')}
+          onLinkClick={vi.fn()}
+          linkifyFilePaths
+        />
+      )
+    })
+
+    const anchors = container.querySelectorAll<HTMLAnchorElement>('a')
+    expect(anchors).toHaveLength(1)
+    expect(routeNativeChatHref(anchors[0]?.getAttribute('href'))).toEqual({
+      kind: 'file',
+      pathText: String.raw`C:\Reports\summary.pdf`,
+      line: null
+    })
+    expect(container.querySelector('pre')?.textContent).toContain('/tmp/not-a-link.html')
+  })
 })
diff --git a/src/renderer/src/components/sidebar/CommentMarkdown.tsx b/src/renderer/src/components/sidebar/CommentMarkdown.tsx
index 8673baedefa..0999c23c8c6 100644
--- a/src/renderer/src/components/sidebar/CommentMarkdown.tsx
+++ b/src/renderer/src/components/sidebar/CommentMarkdown.tsx
@@ -13,6 +13,7 @@ import {
   isTrustedCompactImageSrc,
   type CommentMarkdownLinkClickHandler
 } from './comment-markdown-element-renderers'
+import { remarkNativeChatFileLinks } from './comment-markdown-native-chat-file-links'
 
 export type { CommentMarkdownLinkClickHandler } from './comment-markdown-element-renderers'
 
@@ -185,6 +186,7 @@ type CommentMarkdownProps = React.ComponentPropsWithoutRef<'div'> & {
   githubRepo?: GitHubRepoReference | null
   onLinkClick?: CommentMarkdownLinkClickHandler
   allowFileUriLinks?: boolean
+  linkifyFilePaths?: boolean
   expandImages?: boolean
 }
 
@@ -200,6 +202,7 @@ const CommentMarkdown = React.memo(
       githubRepo,
       onLinkClick,
       allowFileUriLinks = false,
+      linkifyFilePaths = false,
       expandImages = false,
       ...rest
     },
@@ -217,10 +220,12 @@ const CommentMarkdown = React.memo(
         ? createDocumentCommentMarkdownComponents(onLinkClick)
         : createCompactCommentMarkdownComponents(onLinkClick, expandImages)
     }, [expandImages, variant, onLinkClick])
-    const activeRemarkPlugins = React.useMemo(
-      () => (githubRepo ? [...remarkPlugins, remarkGitHubReferences(githubRepo)] : remarkPlugins),
-      [githubRepo]
-    )
+    const activeRemarkPlugins = React.useMemo(() => {
+      const plugins = linkifyFilePaths
+        ? [...remarkPlugins, remarkNativeChatFileLinks]
+        : remarkPlugins
+      return githubRepo ? [...plugins, remarkGitHubReferences(githubRepo)] : plugins
+    }, [githubRepo, linkifyFilePaths])
 
     return (
       <div
diff --git a/src/renderer/src/components/sidebar/NonGitFolderDialog.tsx b/src/renderer/src/components/sidebar/NonGitFolderDialog.tsx
index 5709dc87f90..13f3a0c883d 100644
--- a/src/renderer/src/components/sidebar/NonGitFolderDialog.tsx
+++ b/src/renderer/src/components/sidebar/NonGitFolderDialog.tsx
@@ -17,8 +17,9 @@ import { markOnboardingProjectAdded } from '@/lib/onboarding-project-checklist'
 import { translate } from '@/i18n/i18n'
 import { upsertAddedRepoWithProjectHostSetup } from './add-repo-store-upsert'
 import { worktreeRefreshOptions } from './add-repo-runtime-owner'
-import { startStructuredCodexLaunch } from '@/lib/structured-agent-session-launch'
-import { StructuredAgentSessionCreateRefusalError } from '@/lib/launch-structured-codex-session'
+import { startStructuredAgentLaunch } from '@/lib/structured-agent-session-launch'
+import { isAgentSessionHandleProvider } from '../../../../shared/agent-session-provider-handle'
+import { StructuredAgentSessionCreateRefusalError } from '@/lib/launch-structured-agent-session'
 
 const NonGitFolderDialog = React.memo(function NonGitFolderDialog() {
   const activeModal = useAppStore((s) => s.activeModal)
@@ -101,8 +102,11 @@ const NonGitFolderDialog = React.memo(function NonGitFolderDialog() {
               ...(launch.startup ? { startup: launch.startup } : {}),
               ...(launch.route === 'structured-native-chat' ? { providesInitialSurface: true } : {})
             })
-            if (launch.route === 'structured-native-chat' && launch.agent === 'codex') {
-              const structured = startStructuredCodexLaunch(folderWorktree.id)
+            if (
+              launch.route === 'structured-native-chat' &&
+              isAgentSessionHandleProvider(launch.agent)
+            ) {
+              const structured = startStructuredAgentLaunch(folderWorktree.id, launch.agent)
               const fallback = structured.claimDefinitiveRefusalFallback(() => {
                 activateAndRevealWorktree(folderWorktree.id, {
                   sidebarRevealBehavior: 'auto',
diff --git a/src/renderer/src/components/sidebar/SidebarAgentsList.tsx b/src/renderer/src/components/sidebar/SidebarAgentsList.tsx
index ca5a8c5bce1..3a00b8ee079 100644
--- a/src/renderer/src/components/sidebar/SidebarAgentsList.tsx
+++ b/src/renderer/src/components/sidebar/SidebarAgentsList.tsx
@@ -4,7 +4,6 @@ import { useTranslation } from 'react-i18next'
 import { Input } from '@/components/ui/input'
 import { useAppStore } from '@/store'
 import { translate } from '@/i18n/i18n'
-import { ActivityScopeFilterChips } from '@/components/activity/activity-scope-filter-controls'
 import { hasActivityThreadWorkspace } from '@/components/activity/activity-thread-actions'
 import { useActivityThreadActionBindings } from '@/components/activity/use-activity-thread-action-bindings'
 import { ActivityThreadListPane } from '@/components/activity/activity-thread-list-pane'
@@ -164,7 +163,6 @@ export default function SidebarAgentsList({
         showFilterControls={false}
         showOptionsMenu={false}
         showInlineActions={false}
-        scopeFilterRow={<ActivityScopeFilterChips />}
         scrollTopRef={scrollTopRef}
       />
       {optionsTarget
diff --git a/src/renderer/src/components/sidebar/WorktreeList.card-memo-stability.test.tsx b/src/renderer/src/components/sidebar/WorktreeList.card-memo-stability.test.tsx
index 8278eb3482b..978ce0e180e 100644
--- a/src/renderer/src/components/sidebar/WorktreeList.card-memo-stability.test.tsx
+++ b/src/renderer/src/components/sidebar/WorktreeList.card-memo-stability.test.tsx
@@ -1,5 +1,9 @@
 // @vitest-environment happy-dom
 
+vi.mock('@/components/confirmation-dialog-context', () => ({
+  useConfirmationDialog: () => vi.fn().mockResolvedValue(false)
+}))
+
 import { act, type ReactNode } from 'react'
 import { createRoot, type Root } from 'react-dom/client'
 import { afterEach, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest'
diff --git a/src/renderer/src/components/sidebar/WorktreeList.lineage-agent-expansion-coupling.test.tsx b/src/renderer/src/components/sidebar/WorktreeList.lineage-agent-expansion-coupling.test.tsx
index ab4d4a605d4..a68908e5618 100644
--- a/src/renderer/src/components/sidebar/WorktreeList.lineage-agent-expansion-coupling.test.tsx
+++ b/src/renderer/src/components/sidebar/WorktreeList.lineage-agent-expansion-coupling.test.tsx
@@ -1,5 +1,9 @@
 // @vitest-environment happy-dom
 
+vi.mock('@/components/confirmation-dialog-context', () => ({
+  useConfirmationDialog: () => vi.fn().mockResolvedValue(false)
+}))
+
 // Regression test for the child-worktrees <-> agent-list expansion coupling:
 // in a worktree card that shows BOTH inline agent rows (with orchestration
 // lineage) AND a "N children" child-worktrees chip, toggling the child-worktrees
diff --git a/src/renderer/src/components/sidebar/WorktreeList.lineage-child-real-card.test.tsx b/src/renderer/src/components/sidebar/WorktreeList.lineage-child-real-card.test.tsx
index a14d69a7267..a3f7e14b818 100644
--- a/src/renderer/src/components/sidebar/WorktreeList.lineage-child-real-card.test.tsx
+++ b/src/renderer/src/components/sidebar/WorktreeList.lineage-child-real-card.test.tsx
@@ -1,5 +1,9 @@
 // @vitest-environment happy-dom
 
+vi.mock('@/components/confirmation-dialog-context', () => ({
+  useConfirmationDialog: () => vi.fn().mockResolvedValue(false)
+}))
+
 import { act, type ReactNode } from 'react'
 import { createRoot, type Root } from 'react-dom/client'
 import { afterEach, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest'
diff --git a/src/renderer/src/components/sidebar/WorktreeList.status-lane-lineage-drop.test.tsx b/src/renderer/src/components/sidebar/WorktreeList.status-lane-lineage-drop.test.tsx
index 4e726dca60c..35919acae1d 100644
--- a/src/renderer/src/components/sidebar/WorktreeList.status-lane-lineage-drop.test.tsx
+++ b/src/renderer/src/components/sidebar/WorktreeList.status-lane-lineage-drop.test.tsx
@@ -1,5 +1,9 @@
 // @vitest-environment happy-dom
 
+vi.mock('@/components/confirmation-dialog-context', () => ({
+  useConfirmationDialog: () => vi.fn().mockResolvedValue(false)
+}))
+
 import { act, type ReactNode } from 'react'
 import { createRoot, type Root } from 'react-dom/client'
 import { afterEach, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest'
diff --git a/src/renderer/src/components/sidebar/comment-markdown-element-renderers.tsx b/src/renderer/src/components/sidebar/comment-markdown-element-renderers.tsx
index 18cef393c56..bb82a47356b 100644
--- a/src/renderer/src/components/sidebar/comment-markdown-element-renderers.tsx
+++ b/src/renderer/src/components/sidebar/comment-markdown-element-renderers.tsx
@@ -1,5 +1,6 @@
 import React from 'react'
 import type { Components } from 'react-markdown'
+import { NATIVE_CHAT_FILE_HREF_PREFIX } from '../../../../shared/native-chat-href-routing'
 import { isMermaidFence, isMermaidPre, renderMermaidFence } from './comment-mermaid-fence'
 import {
   GitHubUserAttachmentImage,
@@ -32,12 +33,26 @@ function handleMarkdownAnchorClick(
   // Why: link clicks should not also trigger an outer row/card click handler;
   // images only claim the click when an image handler is wired below.
   event.stopPropagation()
-  if (href?.trim().toLowerCase().startsWith('file:')) {
+  const trimmedHref = href?.trim()
+  if (
+    trimmedHref?.toLowerCase().startsWith('file:') ||
+    trimmedHref?.startsWith(NATIVE_CHAT_FILE_HREF_PREFIX)
+  ) {
     event.preventDefault()
   }
   onLinkClick?.(event, href)
 }
 
+function handleMarkdownAnchorAuxClick(
+  event: React.MouseEvent<HTMLAnchorElement>,
+  href: string | undefined,
+  onLinkClick: CommentMarkdownLinkClickHandler | undefined
+): void {
+  if (event.button === 1) {
+    handleMarkdownAnchorClick(event, href, onLinkClick)
+  }
+}
+
 function handleMarkdownImageClick(
   event: React.MouseEvent<HTMLImageElement>,
   src: string | undefined,
@@ -65,6 +80,7 @@ export function createCompactCommentMarkdownComponents(
         rel="noreferrer"
         className="underline underline-offset-2 text-foreground/80 hover:text-foreground"
         onClick={(e) => handleMarkdownAnchorClick(e, href, onLinkClick)}
+        onAuxClick={(e) => handleMarkdownAnchorAuxClick(e, href, onLinkClick)}
       >
         {children}
       </a>
@@ -154,6 +170,7 @@ export function createCompactCommentMarkdownComponents(
             rel="noreferrer"
             className="underline underline-offset-2 text-foreground/80 hover:text-foreground"
             onClick={(e) => handleMarkdownAnchorClick(e, src, onLinkClick)}
+            onAuxClick={(e) => handleMarkdownAnchorAuxClick(e, src, onLinkClick)}
           >
             {alt || src}
           </a>
@@ -184,6 +201,7 @@ export function createCompactCommentMarkdownComponents(
           target="_blank"
           rel="noreferrer"
           onClick={(e) => handleMarkdownAnchorClick(e, src, onLinkClick)}
+          onAuxClick={(e) => handleMarkdownAnchorAuxClick(e, src, onLinkClick)}
         >
           {image}
         </a>
@@ -221,6 +239,7 @@ export function createDocumentCommentMarkdownComponents(
           rel="noreferrer"
           className="break-all text-primary underline underline-offset-2 hover:text-primary/80"
           onClick={(e) => handleMarkdownAnchorClick(e, href, onLinkClick)}
+          onAuxClick={(e) => handleMarkdownAnchorAuxClick(e, href, onLinkClick)}
         >
           {children}
         </a>
diff --git a/src/renderer/src/components/sidebar/comment-markdown-native-chat-file-links.ts b/src/renderer/src/components/sidebar/comment-markdown-native-chat-file-links.ts
new file mode 100644
index 00000000000..ee81b859dcc
--- /dev/null
+++ b/src/renderer/src/components/sidebar/comment-markdown-native-chat-file-links.ts
@@ -0,0 +1,243 @@
+import {
+  createNativeChatFileHref,
+  routeNativeChatHref
+} from '../../../../shared/native-chat-href-routing'
+import { parseFileLinkLocation } from '../../../../shared/file-link-location'
+import { extractTerminalFileLinks, type ParsedTerminalFileLink } from '@/lib/terminal-links'
+
+type MarkdownNode = {
+  type: string
+  value?: string
+  url?: string
+  children?: MarkdownNode[]
+}
+
+const ROOTED_PATH_PREFIX_PATTERN = /^(?:~[\\/]|\.{1,2}[\\/]|[\\/]|[A-Za-z]:[\\/])/
+
+function isLinkifiableFile(link: ParsedTerminalFileLink, requireSeparator: boolean): boolean {
+  const hasRootedPrefix = ROOTED_PATH_PREFIX_PATTERN.test(link.pathText)
+  const hasLineSuffix = link.line !== null || link.column !== null
+  const hasAlphabeticExtension = /\.[\p{L}][\p{L}\p{N}\p{M}_+-]*$/u.test(link.pathText)
+  const hasPathExtension = /\.[\p{L}\p{N}][\p{L}\p{N}\p{M}_+-]*$/u.test(link.pathText)
+  return (
+    (!requireSeparator || /[\\/]/.test(link.pathText)) &&
+    (hasRootedPrefix ||
+      hasLineSuffix ||
+      (requireSeparator ? hasPathExtension : hasAlphabeticExtension)) &&
+    routeNativeChatHref(link.displayText).kind === 'file'
+  )
+}
+
+const SAFE_LEADING_BOUNDARY_PATTERN = /[\s([{'",;=]/
+const SAFE_TRAILING_BOUNDARY_PATTERN = /[\s)\]}>'",;.:。！？，、；：]/
+const SENTENCE_PATH_PUNCTUATION_PATTERN =
+  /\.[\p{L}\p{N}][\p{L}\p{N}\p{M}_+-]*([!?—。！？，、；：])/gu
+const QUOTED_TEXT_PATTERN = /"([^"\r\n]+)"|'([^"'\r\n]+)'/gu
+const MAX_DASHED_PROSE_WORD_LENGTH = 32
+
+function hasBoundedProseAfterDash(value: string, startIndex: number): boolean {
+  const endIndex = Math.min(value.length, startIndex + MAX_DASHED_PROSE_WORD_LENGTH)
+  for (let index = startIndex; index < endIndex; index += 1) {
+    const char = value[index]
+    if (!char || SAFE_TRAILING_BOUNDARY_PATTERN.test(char)) {
+      return true
+    }
+    if (char === '/' || char === '\\') {
+      return false
+    }
+  }
+  return endIndex === value.length
+}
+
+function isSafeTrailingBoundary(value: string, endIndex: number): boolean {
+  const boundary = value[endIndex]
+  if (boundary === undefined || SAFE_TRAILING_BOUNDARY_PATTERN.test(boundary)) {
+    return true
+  }
+  if (boundary === '!' || boundary === '?') {
+    const next = value[endIndex + 1]
+    return next === undefined || SAFE_TRAILING_BOUNDARY_PATTERN.test(next)
+  }
+  if (boundary === '—') {
+    return hasBoundedProseAfterDash(value, endIndex + 1)
+  }
+  return false
+}
+
+function hasPartialPathBoundary(value: string, link: ParsedTerminalFileLink): boolean {
+  const before = value[link.startIndex - 1]
+  return (
+    (before !== undefined && !SAFE_LEADING_BOUNDARY_PATTERN.test(before)) ||
+    !isSafeTrailingBoundary(value, link.endIndex)
+  )
+}
+
+function createFileLinkNode(value: string, child: MarkdownNode): MarkdownNode {
+  return {
+    type: 'link',
+    url: createNativeChatFileHref(value),
+    children: [child]
+  }
+}
+
+// Why: the terminal extractor spans "src/a.ts and src/b.ts" as one spaced path.
+// An unrooted span holding a bare word or several linkable tokens is prose
+// joining paths, so link the tokens on their own; a spaced folder name keeps
+// every token path-shaped and stays one link.
+function splitProseJoinedLinks(link: ParsedTerminalFileLink): ParsedTerminalFileLink[] {
+  if (ROOTED_PATH_PREFIX_PATTERN.test(link.pathText)) {
+    return [link]
+  }
+  const tokens = Array.from(link.displayText.matchAll(/\S+/g))
+  const tokenLinks: ParsedTerminalFileLink[] = []
+  for (const match of tokens) {
+    const token = match[0]
+    const exactLink = extractTerminalFileLinks(token).find(
+      (candidate) => candidate.startIndex === 0 && candidate.endIndex === token.length
+    )
+    if (exactLink && isLinkifiableFile(exactLink, true)) {
+      const startIndex = link.startIndex + (match.index ?? 0)
+      tokenLinks.push({ ...exactLink, startIndex, endIndex: startIndex + token.length })
+    }
+  }
+  const hasBareWord = tokens.some((match) => !/[\\/.]/.test(match[0]))
+  return hasBareWord || tokenLinks.length > 1 ? tokenLinks : [link]
+}
+
+function splitTextSegment(value: string): MarkdownNode[] {
+  const links = extractTerminalFileLinks(value)
+    .filter((link) => !hasPartialPathBoundary(value, link))
+    .filter((link) => isLinkifiableFile(link, true))
+    .flatMap(splitProseJoinedLinks)
+  if (links.length === 0) {
+    return [{ type: 'text', value }]
+  }
+
+  const children: MarkdownNode[] = []
+  let cursor = 0
+  for (const link of links) {
+    if (link.startIndex < cursor) {
+      continue
+    }
+    if (link.startIndex > cursor) {
+      children.push({ type: 'text', value: value.slice(cursor, link.startIndex) })
+    }
+    children.push(createFileLinkNode(link.displayText, { type: 'text', value: link.displayText }))
+    cursor = link.endIndex
+  }
+  if (cursor < value.length) {
+    children.push({ type: 'text', value: value.slice(cursor) })
+  }
+  return children
+}
+
+function splitUnquotedText(value: string): MarkdownNode[] {
+  const children: MarkdownNode[] = []
+  let cursor = 0
+  for (const match of value.matchAll(SENTENCE_PATH_PUNCTUATION_PATTERN)) {
+    const punctuationIndex = (match.index ?? 0) + match[0].length - 1
+    if (!isSafeTrailingBoundary(value, punctuationIndex)) {
+      continue
+    }
+    children.push(...splitTextSegment(value.slice(cursor, punctuationIndex)))
+    children.push({ type: 'text', value: value[punctuationIndex] })
+    cursor = punctuationIndex + 1
+  }
+  if (cursor === 0) {
+    return splitTextSegment(value)
+  }
+  children.push(...splitTextSegment(value.slice(cursor)))
+  return children
+}
+
+function exactFileLink(value: string, allowSpacedRelative: boolean): ParsedTerminalFileLink | null {
+  const exactLink = extractTerminalFileLinks(value).find(
+    (link) => link.startIndex === 0 && link.endIndex === value.length
+  )
+  if (exactLink && isLinkifiableFile(exactLink, false)) {
+    return exactLink
+  }
+  if (!allowSpacedRelative || !/\s/.test(value)) {
+    return null
+  }
+  const parsed = parseFileLinkLocation(value)
+  if (!parsed) {
+    return null
+  }
+  const hasPathShape =
+    ROOTED_PATH_PREFIX_PATTERN.test(parsed.pathText) ||
+    /[\\/]/.test(parsed.pathText) ||
+    /\.[\p{L}][\p{L}\p{N}\p{M}_+-]*$/u.test(parsed.pathText)
+  if (!hasPathShape) {
+    return null
+  }
+  const explicitLink = {
+    ...parsed,
+    startIndex: 0,
+    endIndex: value.length,
+    displayText: value
+  }
+  return isLinkifiableFile(explicitLink, false) ? explicitLink : null
+}
+
+function splitTextNode(value: string): MarkdownNode[] {
+  const children: MarkdownNode[] = []
+  let cursor = 0
+  for (const match of value.matchAll(QUOTED_TEXT_PATTERN)) {
+    const content = match[1] ?? match[2]
+    if (!content || !exactFileLink(content, true)) {
+      continue
+    }
+    const matchIndex = match.index ?? 0
+    const quote = match[0][0]
+    children.push(...splitUnquotedText(value.slice(cursor, matchIndex)))
+    children.push({ type: 'text', value: quote })
+    children.push(createFileLinkNode(content, { type: 'text', value: content }))
+    children.push({ type: 'text', value: quote })
+    cursor = matchIndex + match[0].length
+  }
+  if (cursor === 0) {
+    return splitUnquotedText(value)
+  }
+  children.push(...splitUnquotedText(value.slice(cursor)))
+  return children
+}
+
+function inlineCodeFileLink(node: MarkdownNode): MarkdownNode | null {
+  const value = node.value?.trim()
+  if (!value) {
+    return null
+  }
+  return exactFileLink(value, true) ? createFileLinkNode(value, node) : null
+}
+
+function transformFileLinks(node: MarkdownNode): void {
+  if (node.type === 'link') {
+    if (node.url && routeNativeChatHref(node.url).kind === 'file') {
+      node.url = createNativeChatFileHref(node.url)
+    }
+    return
+  }
+  if (!node.children || node.type === 'image') {
+    return
+  }
+
+  const children: MarkdownNode[] = []
+  for (const child of node.children) {
+    if (child.type === 'text' && child.value !== undefined) {
+      children.push(...splitTextNode(child.value))
+      continue
+    }
+    if (child.type === 'inlineCode') {
+      children.push(inlineCodeFileLink(child) ?? child)
+      continue
+    }
+    transformFileLinks(child)
+    children.push(child)
+  }
+  node.children = children
+}
+
+export function remarkNativeChatFileLinks(): (tree: MarkdownNode) => void {
+  return (tree) => transformFileLinks(tree)
+}
diff --git a/src/renderer/src/components/sidebar/folder-workspace-composer-submit.ts b/src/renderer/src/components/sidebar/folder-workspace-composer-submit.ts
index 661bf623880..b6f1a1654f3 100644
--- a/src/renderer/src/components/sidebar/folder-workspace-composer-submit.ts
+++ b/src/renderer/src/components/sidebar/folder-workspace-composer-submit.ts
@@ -28,8 +28,9 @@ import {
   resolveAgentLaunchRoute
 } from '@/lib/agent-launch-routing'
 import { readLocalRuntimeCapabilities } from '@/runtime/local-runtime-capabilities'
-import { startStructuredCodexLaunch } from '@/lib/structured-agent-session-launch'
-import { StructuredAgentSessionCreateRefusalError } from '@/lib/launch-structured-codex-session'
+import { startStructuredAgentLaunch } from '@/lib/structured-agent-session-launch'
+import { isAgentSessionHandleProvider } from '../../../../shared/agent-session-provider-handle'
+import { StructuredAgentSessionCreateRefusalError } from '@/lib/launch-structured-agent-session'
 import { useAppStore } from '@/store'
 import {
   buildFolderWorkspaceLinkedStartupPlan,
@@ -232,8 +233,8 @@ export async function submitFolderWorkspaceCreate({
       runtimeEnvironmentId
     })
     let structuredLaunchAccepted = structuredLaunch
-    if (structuredLaunch && quickAgent === 'codex') {
-      const launch = startStructuredCodexLaunch(folderWorkspaceKey(workspace.id), {
+    if (structuredLaunch && isAgentSessionHandleProvider(quickAgent)) {
+      const launch = startStructuredAgentLaunch(folderWorkspaceKey(workspace.id), quickAgent, {
         prompt: launchDraftPrompt ?? note
       })
       const refusalFallback = launch.claimDefinitiveRefusalFallback(async () => {
diff --git a/src/renderer/src/components/sidebar/header-drag-click-swallow.ts b/src/renderer/src/components/sidebar/header-drag-click-swallow.ts
new file mode 100644
index 00000000000..1e875558b70
--- /dev/null
+++ b/src/renderer/src/components/sidebar/header-drag-click-swallow.ts
@@ -0,0 +1,20 @@
+/**
+ * Swallow the click that follows a completed header drag.
+ *
+ * Why: the pointerup that ends a promoted drag is followed by a click on the
+ * drag handle, which would also toggle the section the user just reordered.
+ * The listener removes itself on the first click; the returned timeout handle
+ * is the fallback for a drop that produces no click.
+ */
+export function swallowNextClickOnDragHandle(handleEl: HTMLElement): ReturnType<typeof setTimeout> {
+  const swallow = (event: MouseEvent): void => {
+    const target = event.target as Node | null
+    if (target && handleEl.contains(target)) {
+      event.stopPropagation()
+      event.preventDefault()
+    }
+    window.removeEventListener('click', swallow, true)
+  }
+  window.addEventListener('click', swallow, true)
+  return setTimeout(() => window.removeEventListener('click', swallow, true), 0)
+}
diff --git a/src/renderer/src/components/sidebar/header-drag-pointer-release.ts b/src/renderer/src/components/sidebar/header-drag-pointer-release.ts
new file mode 100644
index 00000000000..4e8466ed3e7
--- /dev/null
+++ b/src/renderer/src/components/sidebar/header-drag-pointer-release.ts
@@ -0,0 +1,14 @@
+/**
+ * True when a pointermove arrives with no button held, meaning the pointerup
+ * that should have ended the armed drag never reached us.
+ *
+ * Why: the header drag hooks subscribe to window pointer events from an effect
+ * armed by pointerdown state, so a fast click's release can land before that
+ * effect runs (a heavy sidebar render sits between them). The session then
+ * survives the click and the next hover promotes a drag the user is not doing —
+ * for host sections that hides the header outright and force-collapses every
+ * host. A capture-phase listener swallowing pointerup has the same effect.
+ */
+export function hasPointerBeenReleased(event: PointerEvent): boolean {
+  return event.buttons === 0
+}
diff --git a/src/renderer/src/components/sidebar/host-header-drag.test.tsx b/src/renderer/src/components/sidebar/host-header-drag.test.tsx
new file mode 100644
index 00000000000..6c9e0f66e33
--- /dev/null
+++ b/src/renderer/src/components/sidebar/host-header-drag.test.tsx
@@ -0,0 +1,92 @@
+// @vitest-environment happy-dom
+import React from 'react'
+import { act, render } from '@testing-library/react'
+import { describe, expect, it, vi } from 'vitest'
+
+import { useHostHeaderDrag } from './host-header-drag'
+import type { ExecutionHostId } from '../../../../shared/execution-host'
+
+function setup() {
+  const scrollContainer = document.createElement('div')
+  document.body.append(scrollContainer)
+  const controller: { current: ReturnType<typeof useHostHeaderDrag> | null } = { current: null }
+
+  function Harness(): React.JSX.Element {
+    const drag = useHostHeaderDrag({
+      orderedHostIds: ['ssh:host-a', 'ssh:host-b'] as ExecutionHostId[],
+      onCommit: vi.fn(),
+      getScrollContainer: () => scrollContainer
+    })
+    controller.current = drag
+    return (
+      <div
+        data-host-header-drag-id="ssh:host-a"
+        onPointerDown={(event) => drag.onHandlePointerDown(event, 'ssh:host-a')}
+      />
+    )
+  }
+
+  const view = render(<Harness />)
+  const header = view.container.querySelector<HTMLElement>('[data-host-header-drag-id]')!
+  header.setPointerCapture = vi.fn()
+  header.releasePointerCapture = vi.fn()
+  return { controller, header }
+}
+
+function pointer(type: string, init: PointerEventInit): PointerEvent {
+  return new PointerEvent(type, { bubbles: true, pointerId: 1, ...init })
+}
+
+describe('useHostHeaderDrag', () => {
+  it('does not start a drag when the pointer is released before the window listeners attach', () => {
+    const { controller, header } = setup()
+
+    // A click: pointerdown arms the session, pointerup lands before React has
+    // flushed the passive effect that subscribes to window pointer events.
+    act(() => {
+      header.dispatchEvent(pointer('pointerdown', { button: 0, clientX: 10, clientY: 10 }))
+      window.dispatchEvent(pointer('pointerup', { clientX: 10, clientY: 10 }))
+    })
+
+    // Moving the mouse afterwards, with no button held, must not promote a drag.
+    act(() => {
+      window.dispatchEvent(pointer('pointermove', { clientX: 200, clientY: 400, buttons: 0 }))
+    })
+
+    expect(controller.current?.state.draggingHostId).toBeNull()
+  })
+
+  it('clears a session whose pointerup was missed so a later drag still works', () => {
+    const { controller, header } = setup()
+
+    act(() => {
+      header.dispatchEvent(pointer('pointerdown', { button: 0, clientX: 10, clientY: 10 }))
+      window.dispatchEvent(pointer('pointerup', { clientX: 10, clientY: 10 }))
+    })
+    act(() => {
+      window.dispatchEvent(pointer('pointermove', { clientX: 200, clientY: 400, buttons: 0 }))
+    })
+
+    act(() => {
+      header.dispatchEvent(pointer('pointerdown', { button: 0, clientX: 10, clientY: 10 }))
+    })
+    act(() => {
+      window.dispatchEvent(pointer('pointermove', { clientX: 40, clientY: 60, buttons: 1 }))
+    })
+
+    expect(controller.current?.state.draggingHostId).toBe('ssh:host-a')
+  })
+
+  it('still promotes a drag while the pointer stays down', () => {
+    const { controller, header } = setup()
+
+    act(() => {
+      header.dispatchEvent(pointer('pointerdown', { button: 0, clientX: 10, clientY: 10 }))
+    })
+    act(() => {
+      window.dispatchEvent(pointer('pointermove', { clientX: 40, clientY: 60, buttons: 1 }))
+    })
+
+    expect(controller.current?.state.draggingHostId).toBe('ssh:host-a')
+  })
+})
diff --git a/src/renderer/src/components/sidebar/host-header-drag.ts b/src/renderer/src/components/sidebar/host-header-drag.ts
index 8b6ea676a46..cb1955dda02 100644
--- a/src/renderer/src/components/sidebar/host-header-drag.ts
+++ b/src/renderer/src/components/sidebar/host-header-drag.ts
@@ -16,6 +16,8 @@ import {
   readHostHeaderRects,
   type HostHeaderRect
 } from './host-header-drag-dom'
+import { hasPointerBeenReleased } from './header-drag-pointer-release'
+import { swallowNextClickOnDragHandle } from './header-drag-click-swallow'
 
 export type HostDragState = {
   draggingHostId: ExecutionHostId | null
@@ -157,17 +159,7 @@ export function useHostHeaderDrag({
       session.preview?.remove()
       setSidebarPointerDragDocumentStyles(false)
       if (session.promoted) {
-        const handleEl = session.handleEl
-        const swallow = (e: MouseEvent): void => {
-          const target = e.target as Node | null
-          if (target && handleEl.contains(target)) {
-            e.stopPropagation()
-            e.preventDefault()
-          }
-          window.removeEventListener('click', swallow, true)
-        }
-        window.addEventListener('click', swallow, true)
-        setTimeout(() => window.removeEventListener('click', swallow, true), 0)
+        swallowNextClickOnDragHandle(session.handleEl)
       }
       const finalIndex =
         commit && session.promoted
@@ -206,6 +198,10 @@ export function useHostHeaderDrag({
       if (!session || e.pointerId !== session.pointerId) {
         return
       }
+      if (hasPointerBeenReleased(e)) {
+        endDrag(false)
+        return
+      }
       if (!session.promoted) {
         const dx = e.clientX - session.startX
         const dy = e.clientY - session.startY
diff --git a/src/renderer/src/components/sidebar/natural-worktree-ids.test.ts b/src/renderer/src/components/sidebar/natural-worktree-ids.test.ts
new file mode 100644
index 00000000000..b36fc2aa262
--- /dev/null
+++ b/src/renderer/src/components/sidebar/natural-worktree-ids.test.ts
@@ -0,0 +1,45 @@
+import { describe, expect, it } from 'vitest'
+import { PINNED_GROUP_KEY } from './worktree-list/grouping/group-keys'
+import { getNaturalWorktreeIds } from './natural-worktree-ids'
+
+const item = (id: string, sectionKey: string) => ({
+  type: 'item' as const,
+  sectionKey,
+  worktree: { id }
+})
+
+describe('getNaturalWorktreeIds', () => {
+  it('collects item rows outside the pinned section', () => {
+    expect([...getNaturalWorktreeIds([item('a', 'group-1'), item('b', 'group-2')])]).toEqual([
+      'a',
+      'b'
+    ])
+  })
+
+  it('excludes a pinned duplicate that also renders in its natural group', () => {
+    const rows = [item('a', PINNED_GROUP_KEY), item('a', 'group-1'), item('b', PINNED_GROUP_KEY)]
+
+    const ids = getNaturalWorktreeIds(rows)
+
+    expect(ids.has('a')).toBe(true)
+    expect(ids.has('b')).toBe(false)
+  })
+
+  it('ignores every non-item row type', () => {
+    const rows = [
+      { type: 'header', key: 'k' },
+      { type: 'host-header' },
+      { type: 'imported-worktrees-card' },
+      { type: 'new-external-worktrees-inbox' },
+      { type: 'pending-creation' },
+      { type: 'folder-workspace' },
+      item('a', 'group-1')
+    ]
+
+    expect([...getNaturalWorktreeIds(rows)]).toEqual(['a'])
+  })
+
+  it('returns an empty set for no rows', () => {
+    expect(getNaturalWorktreeIds([]).size).toBe(0)
+  })
+})
diff --git a/src/renderer/src/components/sidebar/natural-worktree-ids.ts b/src/renderer/src/components/sidebar/natural-worktree-ids.ts
new file mode 100644
index 00000000000..7ac21ba1f9f
--- /dev/null
+++ b/src/renderer/src/components/sidebar/natural-worktree-ids.ts
@@ -0,0 +1,24 @@
+import { PINNED_GROUP_KEY } from './worktree-list/grouping/group-keys'
+
+/** The row shape both drag models share: only `item` rows carry a worktree and a section. */
+type NaturalWorktreeIdRow = { type: string } & Partial<{
+  sectionKey: string
+  worktree: { id: string }
+}>
+
+/**
+ * Ids of worktrees rendered in their own group.
+ *
+ * Why: a pinned duplicate of a worktree that also renders in its natural group is not its own drag
+ * slot. Shared by every drag model so the rule lives in one place, and built with a loop rather
+ * than `flatMap` — that allocated a throwaway array per row, four times per row-model rebuild.
+ */
+export function getNaturalWorktreeIds(rows: readonly NaturalWorktreeIdRow[]): Set<string> {
+  const ids = new Set<string>()
+  for (const row of rows) {
+    if (row.type === 'item' && row.sectionKey !== PINNED_GROUP_KEY && row.worktree) {
+      ids.add(row.worktree.id)
+    }
+  }
+  return ids
+}
diff --git a/src/renderer/src/components/sidebar/project-group-header-drag.ts b/src/renderer/src/components/sidebar/project-group-header-drag.ts
index e2a879aebdc..853adfc751f 100644
--- a/src/renderer/src/components/sidebar/project-group-header-drag.ts
+++ b/src/renderer/src/components/sidebar/project-group-header-drag.ts
@@ -15,6 +15,8 @@ import {
 } from './project-group-header-drag-contract'
 import { createProjectGroupHeaderDragSession } from './project-group-header-drag-start'
 import { getWorktreeSidebarDragAutoscroll } from './worktree-sidebar-drag-autoscroll'
+import { hasPointerBeenReleased } from './header-drag-pointer-release'
+import { swallowNextClickOnDragHandle } from './header-drag-click-swallow'
 
 // Why pointer events instead of HTML5 DnD: Project Group rows are virtualized
 // and may unmount while scrolling; cached row-model indices keep drops stable.
@@ -114,20 +116,7 @@ export function useProjectGroupHeaderDrag({
         // capture may already be released (pointercancel, element unmounted)
       }
       if (session.promoted) {
-        const handleEl = session.handleEl
-        const swallow = (event: MouseEvent): void => {
-          const target = event.target as Node | null
-          if (target && handleEl.contains(target)) {
-            event.stopPropagation()
-            event.preventDefault()
-          }
-          window.removeEventListener('click', swallow, true)
-        }
-        window.addEventListener('click', swallow, true)
-        clickSwallowTimeoutRef.current = setTimeout(() => {
-          window.removeEventListener('click', swallow, true)
-          clickSwallowTimeoutRef.current = null
-        }, 0)
+        clickSwallowTimeoutRef.current = swallowNextClickOnDragHandle(session.handleEl)
       }
       const sidebarDropIndex =
         commit && session.promoted && latestDropIndexRef.current !== null
@@ -199,6 +188,10 @@ export function useProjectGroupHeaderDrag({
       if (!session || event.pointerId !== session.pointerId) {
         return
       }
+      if (hasPointerBeenReleased(event)) {
+        endDrag(false)
+        return
+      }
       session.latestPointerY = event.clientY
       if (!session.promoted) {
         const dx = event.clientX - session.startX
diff --git a/src/renderer/src/components/sidebar/project-header-drag.ts b/src/renderer/src/components/sidebar/project-header-drag.ts
index 4d13ddfa0af..68ab299d616 100644
--- a/src/renderer/src/components/sidebar/project-header-drag.ts
+++ b/src/renderer/src/components/sidebar/project-header-drag.ts
@@ -15,6 +15,8 @@ import {
 } from './project-header-drag-contract'
 import { createProjectHeaderDragSession } from './project-header-drag-start'
 import { getWorktreeSidebarDragAutoscroll } from './worktree-sidebar-drag-autoscroll'
+import { hasPointerBeenReleased } from './header-drag-pointer-release'
+import { swallowNextClickOnDragHandle } from './header-drag-click-swallow'
 
 // Why pointer events instead of HTML5 DnD: rows are absolutely-positioned by
 // react-virtual and unmount/remount as scroll changes, so DnD enter/leave fire
@@ -124,20 +126,7 @@ export function useRepoHeaderDrag({
         // capture may already be released (pointercancel, element unmounted)
       }
       if (session.promoted) {
-        const handleEl = session.handleEl
-        const swallow = (e: MouseEvent): void => {
-          const target = e.target as Node | null
-          if (target && handleEl.contains(target)) {
-            e.stopPropagation()
-            e.preventDefault()
-          }
-          window.removeEventListener('click', swallow, true)
-        }
-        window.addEventListener('click', swallow, true)
-        clickSwallowTimeoutRef.current = setTimeout(() => {
-          window.removeEventListener('click', swallow, true)
-          clickSwallowTimeoutRef.current = null
-        }, 0)
+        clickSwallowTimeoutRef.current = swallowNextClickOnDragHandle(session.handleEl)
       }
       const sidebarDropIndex =
         commit && session.promoted && latestDropIndexRef.current !== null
@@ -212,6 +201,10 @@ export function useRepoHeaderDrag({
       if (!session || e.pointerId !== session.pointerId) {
         return
       }
+      if (hasPointerBeenReleased(e)) {
+        endDrag(false)
+        return
+      }
       session.latestPointerY = e.clientY
       if (!session.promoted) {
         const dx = e.clientX - session.startX
diff --git a/src/renderer/src/components/sidebar/use-workspace-kanban-search.ts b/src/renderer/src/components/sidebar/use-workspace-kanban-search.ts
index e782b419ab3..8c2735b5259 100644
--- a/src/renderer/src/components/sidebar/use-workspace-kanban-search.ts
+++ b/src/renderer/src/components/sidebar/use-workspace-kanban-search.ts
@@ -2,7 +2,10 @@ import { useCallback, useDeferredValue, useMemo, useState } from 'react'
 import { isWorktreePaletteQueryTooLarge } from '@/lib/worktree-palette-query-bounds'
 import type { Repo } from '../../../../shared/repo-types'
 import type { Worktree } from '../../../../shared/worktree/types'
-import { matchWorkspaceBoardWorktrees } from './workspace-kanban-search'
+import {
+  buildWorkspaceBoardPaletteDocuments,
+  matchWorkspaceBoardWorktrees
+} from './workspace-kanban-search'
 
 function areWorktreeIdSetsEqual(a: ReadonlySet<string>, b: ReadonlySet<string>): boolean {
   if (a.size !== b.size) {
@@ -48,14 +51,27 @@ export function useWorkspaceKanbanSearch(args: {
   // lets React interrupt the board re-render.
   const deferredQuery = useDeferredValue(query)
 
+  // Why split from the match memo: the index only depends on the worktrees and repos, so a
+  // keystroke reruns the search over an already-built index instead of rebuilding every
+  // worktree's normalized fields.
+  const documents = useMemo(
+    () =>
+      buildWorkspaceBoardPaletteDocuments({
+        worktrees: args.worktrees,
+        repoMap: args.repoMap
+      }),
+    [args.repoMap, args.worktrees]
+  )
+
   const matched = useMemo(
     () =>
       matchWorkspaceBoardWorktrees({
         worktrees: args.worktrees,
         query: deferredQuery,
-        repoMap: args.repoMap
+        repoMap: args.repoMap,
+        documents
       }),
-    [args.repoMap, args.worktrees, deferredQuery]
+    [args.repoMap, args.worktrees, deferredQuery, documents]
   )
 
   const matchingWorktreeIds =
diff --git a/src/renderer/src/components/sidebar/workspace-kanban-search.ts b/src/renderer/src/components/sidebar/workspace-kanban-search.ts
index a47320e0bc9..1d7b88c34e1 100644
--- a/src/renderer/src/components/sidebar/workspace-kanban-search.ts
+++ b/src/renderer/src/components/sidebar/workspace-kanban-search.ts
@@ -1,5 +1,7 @@
 import { isWorktreePaletteQueryTooLarge } from '@/lib/worktree-palette-query-bounds'
-import { searchWorktrees } from '@/lib/worktree-palette-search'
+import { searchWorktreeDocuments } from '@/lib/worktree-palette-search'
+import { buildWorktreePaletteDocuments } from '@/lib/worktree-palette-document'
+import type { PaletteDocument } from '@/lib/palette-match/palette-document'
 import type { Repo } from '../../../../shared/repo-types'
 import type { WorkspaceStatus, Worktree } from '../../../../shared/worktree/types'
 import {
@@ -12,8 +14,25 @@ export type WorkspaceKanbanLaneView = {
   totalCount: number
 }
 
-// Why: the board is a drag surface for named workspaces, so a card may only be
-// hidden by fields the user can read on it. PR/issue/port matches are palette-only.
+/**
+ * Builds the board's palette index once per worktree/repo identity.
+ *
+ * Why separate from the match: the index is identical across keystrokes, and building it inline
+ * meant normalizing and segmenting every indexed field of every worktree on every character —
+ * and again on every agent-status tick, which churns board identities while a query is active.
+ */
+export function buildWorkspaceBoardPaletteDocuments(args: {
+  worktrees: readonly Worktree[]
+  repoMap: ReadonlyMap<string, Repo>
+}): Map<string, PaletteDocument> {
+  // Why the board policy (#15170): the board is a drag surface for named workspaces, so a card
+  // may only be hidden by text printed on it. Ports, reviews and automation runs are palette-only.
+  return buildWorktreePaletteDocuments(args.worktrees, {
+    repoMap: args.repoMap,
+    evidencePolicy: 'board'
+  })
+}
+
 /**
  * Returns `null` when no filtering is active — distinct from an empty set, which
  * means a real query matched nothing.
@@ -22,6 +41,7 @@ export function matchWorkspaceBoardWorktrees(args: {
   worktrees: Worktree[]
   query: string
   repoMap: Map<string, Repo>
+  documents?: ReadonlyMap<string, PaletteDocument>
 }): ReadonlySet<string> | null {
   if (!args.query.trim()) {
     return null
@@ -33,10 +53,14 @@ export function matchWorkspaceBoardWorktrees(args: {
   }
 
   const matched = new Set<string>()
-  // Why the board policy (#15170): a card may only be hidden by text printed on it, so
-  // palette-only evidence such as ports, reviews and automation runs is excluded.
-  for (const result of searchWorktrees(args.worktrees, args.query, args.repoMap, {
-    evidencePolicy: 'board'
+  const documents =
+    args.documents ??
+    buildWorkspaceBoardPaletteDocuments({ worktrees: args.worktrees, repoMap: args.repoMap })
+  for (const result of searchWorktreeDocuments({
+    worktrees: args.worktrees,
+    query: args.query,
+    documents,
+    repoMap: args.repoMap
   })) {
     if (result.matchedFields.length) {
       // Why (STA-4343): two hosts can publish the same id, and a board filter keyed on the
diff --git a/src/renderer/src/components/sidebar/worktree-drag-units.ts b/src/renderer/src/components/sidebar/worktree-drag-units.ts
index e53d663a9f0..9b900ab72fc 100644
--- a/src/renderer/src/components/sidebar/worktree-drag-units.ts
+++ b/src/renderer/src/components/sidebar/worktree-drag-units.ts
@@ -1,5 +1,6 @@
 import type { WorktreeDragGroup } from './worktree-manual-order'
 import { ALL_GROUP_KEY, PINNED_GROUP_KEY } from './worktree-list/grouping/group-keys'
+import { getNaturalWorktreeIds } from './natural-worktree-ids'
 
 export type WorktreeDragUnitGroup = WorktreeDragGroup & {
   units: { worktreeId: string; worktreeIds: string[] }[]
@@ -19,11 +20,7 @@ export function getWorktreeDragUnitGroups(
 ): WorktreeDragUnitGroup[] {
   const groups: WorktreeDragUnitGroup[] = []
   let current: { key: string; units: WorktreeDragUnitGroup['units'] } | null = null
-  const naturalWorktreeIds = new Set(
-    rows.flatMap((row) =>
-      row.type === 'item' && row.sectionKey !== PINNED_GROUP_KEY ? [row.worktree.id] : []
-    )
-  )
+  const naturalWorktreeIds = getNaturalWorktreeIds(rows)
 
   for (const row of rows) {
     if (row.type === 'header') {
diff --git a/src/renderer/src/components/sidebar/worktree-header-section-boundaries.test.ts b/src/renderer/src/components/sidebar/worktree-header-section-boundaries.test.ts
new file mode 100644
index 00000000000..5b7fec3bb75
--- /dev/null
+++ b/src/renderer/src/components/sidebar/worktree-header-section-boundaries.test.ts
@@ -0,0 +1,95 @@
+import { describe, expect, it } from 'vitest'
+
+import {
+  getProjectGroupHeaderSectionEndByGroupId,
+  getRepoHeaderSectionEndByRepoId
+} from './worktree-header-section-boundaries'
+import type { RenderRow } from './worktree-list/listing/render-row'
+
+const repoHeader = (id: string): RenderRow =>
+  ({ type: 'header', key: `repo:${id}`, label: id, count: 1, tone: '', repo: { id } }) as RenderRow
+const groupHeader = (id: string): RenderRow =>
+  ({
+    type: 'header',
+    key: `group:${id}`,
+    label: id,
+    count: 1,
+    tone: '',
+    projectGroup: { id },
+    projectGroupDepth: 0
+  }) as RenderRow
+const item = { type: 'item' } as RenderRow
+
+// Estimated starts: first header 28, later headers 32, items 116.
+const rows = [repoHeader('a'), item, repoHeader('b'), item, repoHeader('c'), item]
+const startOfB = 28 + 116
+const startOfC = startOfB + 32 + 116
+
+describe('getRepoHeaderSectionEndByRepoId', () => {
+  it('ends a section at the successor from the header’s own bucket', () => {
+    const ends = getRepoHeaderSectionEndByRepoId({
+      rows,
+      firstHeaderIndex: 0,
+      sidebarRepoHeaderIdsByBucket: new Map([
+        ['group:one', ['a', 'b']],
+        ['group:two', ['a', 'c']]
+      ]),
+      repoHeaderBucketByRepoId: new Map([
+        ['a', 'group:two'],
+        ['b', 'group:one'],
+        ['c', 'group:two']
+      ])
+    })
+
+    // Regression: a successor index keyed on id alone picked `b` from the first bucket.
+    expect(ends.get('a')).toBe(startOfC)
+    expect(ends.get('b')).toBe(startOfC)
+  })
+
+  it('falls back to the next header when a bucket has no successor', () => {
+    const ends = getRepoHeaderSectionEndByRepoId({
+      rows,
+      firstHeaderIndex: 0,
+      sidebarRepoHeaderIdsByBucket: new Map([['ungrouped', ['a']]]),
+      repoHeaderBucketByRepoId: new Map([['a', 'ungrouped']])
+    })
+
+    expect(ends.get('a')).toBe(startOfB)
+  })
+
+  it('resolves a header id that renders twice to its first row, matching findIndex', () => {
+    const ends = getRepoHeaderSectionEndByRepoId({
+      rows: [repoHeader('a'), item, repoHeader('b'), item, repoHeader('b')],
+      firstHeaderIndex: 0,
+      sidebarRepoHeaderIdsByBucket: new Map([['ungrouped', ['a', 'b', 'b']]]),
+      repoHeaderBucketByRepoId: new Map([
+        ['a', 'ungrouped'],
+        ['b', 'ungrouped']
+      ])
+    })
+
+    expect(ends.get('a')).toBe(startOfB)
+    // The first `b` succeeds itself; a last-wins index would jump to the second `b` row.
+    expect(ends.get('b')).toBe(startOfB)
+  })
+})
+
+describe('getProjectGroupHeaderSectionEndByGroupId', () => {
+  it('ends a section at the successor from the group’s own bucket', () => {
+    const ends = getProjectGroupHeaderSectionEndByGroupId({
+      rows: [groupHeader('a'), item, groupHeader('b'), item, groupHeader('c'), item],
+      firstHeaderIndex: 0,
+      sidebarProjectGroupHeaderIdsByBucket: new Map([
+        ['root', ['a', 'b']],
+        ['parent:x', ['a', 'c']]
+      ]),
+      projectGroupHeaderBucketByGroupId: new Map([
+        ['a', 'parent:x'],
+        ['b', 'root'],
+        ['c', 'parent:x']
+      ])
+    })
+
+    expect(ends.get('a')).toBe(startOfC)
+  })
+})
diff --git a/src/renderer/src/components/sidebar/worktree-header-section-boundaries.ts b/src/renderer/src/components/sidebar/worktree-header-section-boundaries.ts
index d6b97601295..417f710d071 100644
--- a/src/renderer/src/components/sidebar/worktree-header-section-boundaries.ts
+++ b/src/renderer/src/components/sidebar/worktree-header-section-boundaries.ts
@@ -1,5 +1,6 @@
 import { estimateRenderRowSize } from './worktree-list/viewport/virtual-rows'
 import type { RenderRow } from './worktree-list/listing/render-row'
+import type { GroupHeaderRow } from './worktree-list/grouping/row-types'
 
 function getEstimatedRenderRowStarts(
   rows: readonly RenderRow[],
@@ -15,18 +16,39 @@ function getEstimatedRenderRowStarts(
   return starts
 }
 
-function findRepoHeaderRenderRowIndex(rows: readonly RenderRow[], repoId: string): number {
-  return rows.findIndex((row) => row.type === 'header' && row.repo?.id === repoId)
+// Why indexed once instead of a findIndex per header: both boundary passes ran a full row scan
+// for every header row, so the sidebar row model cost O(headers x rows) on every rebuild — and it
+// rebuilds on agent-status ticks, not just on drag. First match wins, matching findIndex.
+function indexHeaderRenderRows(
+  rows: readonly RenderRow[],
+  keyOf: (row: GroupHeaderRow) => string | null | undefined
+): Map<string, number> {
+  const indexByKey = new Map<string, number>()
+  rows.forEach((row, index) => {
+    const key = row.type === 'header' ? keyOf(row) : undefined
+    if (typeof key === 'string' && !indexByKey.has(key)) {
+      indexByKey.set(key, index)
+    }
+  })
+  return indexByKey
 }
 
-function findProjectGroupHeaderRenderRowIndex(rows: readonly RenderRow[], groupId: string): number {
-  return rows.findIndex(
-    (row) =>
-      row.type === 'header' &&
-      !row.repo &&
-      typeof row.projectGroup?.id === 'string' &&
-      row.projectGroup.id === groupId
-  )
+// Kept per bucket: an id can sit in more than one bucket, and the caller's bucket lookup decides
+// which ordering applies. First occurrence wins within a bucket, matching indexOf.
+function indexBucketSuccessors(
+  idsByBucket: ReadonlyMap<string, readonly string[]>
+): Map<string, ReadonlyMap<string, string | undefined>> {
+  const successorsByBucket = new Map<string, ReadonlyMap<string, string | undefined>>()
+  for (const [bucketKey, ids] of idsByBucket) {
+    const successorById = new Map<string, string | undefined>()
+    ids.forEach((id, index) => {
+      if (!successorById.has(id)) {
+        successorById.set(id, ids[index + 1])
+      }
+    })
+    successorsByBucket.set(bucketKey, successorById)
+  }
+  return successorsByBucket
 }
 
 function findNextHeaderRenderRowIndex(rows: readonly RenderRow[], startIndex: number): number {
@@ -70,6 +92,8 @@ export function getRepoHeaderSectionEndByRepoId(args: {
   repoHeaderBucketByRepoId: ReadonlyMap<string, string>
 }): Map<string, number> {
   const rowStarts = getEstimatedRenderRowStarts(args.rows, args.firstHeaderIndex)
+  const repoHeaderIndexByRepoId = indexHeaderRenderRows(args.rows, (row) => row.repo?.id)
+  const repoSuccessorsByBucket = indexBucketSuccessors(args.sidebarRepoHeaderIdsByBucket)
   const sectionEndByRepoId = new Map<string, number>()
   for (let index = 0; index < args.rows.length; index++) {
     const row = args.rows[index]
@@ -78,11 +102,9 @@ export function getRepoHeaderSectionEndByRepoId(args: {
       continue
     }
     const bucketKey = args.repoHeaderBucketByRepoId.get(repoId)
-    const bucketRepoIds = bucketKey ? args.sidebarRepoHeaderIdsByBucket.get(bucketKey) : undefined
-    const bucketIndex = bucketRepoIds?.indexOf(repoId) ?? -1
-    const nextRepoId = bucketIndex >= 0 ? bucketRepoIds?.[bucketIndex + 1] : undefined
+    const nextRepoId = bucketKey ? repoSuccessorsByBucket.get(bucketKey)?.get(repoId) : undefined
     const endIndex = nextRepoId
-      ? findRepoHeaderRenderRowIndex(args.rows, nextRepoId)
+      ? (repoHeaderIndexByRepoId.get(nextRepoId) ?? -1)
       : findNextHeaderRenderRowIndex(args.rows, index + 1)
     sectionEndByRepoId.set(
       repoId,
@@ -99,6 +121,10 @@ export function getProjectGroupHeaderSectionEndByGroupId(args: {
   projectGroupHeaderBucketByGroupId: ReadonlyMap<string, string>
 }): Map<string, number> {
   const rowStarts = getEstimatedRenderRowStarts(args.rows, args.firstHeaderIndex)
+  const projectGroupHeaderIndexByGroupId = indexHeaderRenderRows(args.rows, (row) =>
+    row.repo ? undefined : row.projectGroup?.id
+  )
+  const groupSuccessorsByBucket = indexBucketSuccessors(args.sidebarProjectGroupHeaderIdsByBucket)
   const sectionEndByGroupId = new Map<string, number>()
   for (let index = 0; index < args.rows.length; index++) {
     const row = args.rows[index]
@@ -114,14 +140,10 @@ export function getProjectGroupHeaderSectionEndByGroupId(args: {
       continue
     }
     const bucketKey = args.projectGroupHeaderBucketByGroupId.get(groupId)
-    const bucketGroupIds = bucketKey
-      ? args.sidebarProjectGroupHeaderIdsByBucket.get(bucketKey)
-      : undefined
-    const bucketIndex = bucketGroupIds?.indexOf(groupId) ?? -1
-    const nextGroupId = bucketIndex >= 0 ? bucketGroupIds?.[bucketIndex + 1] : undefined
+    const nextGroupId = bucketKey ? groupSuccessorsByBucket.get(bucketKey)?.get(groupId) : undefined
     const depth = projectGroupHeader.row.projectGroupDepth ?? 0
     const endIndex = nextGroupId
-      ? findProjectGroupHeaderRenderRowIndex(args.rows, nextGroupId)
+      ? (projectGroupHeaderIndexByGroupId.get(nextGroupId) ?? -1)
       : findProjectGroupSectionEndIndex(args.rows, index + 1, depth)
     sectionEndByGroupId.set(
       groupId,
diff --git a/src/renderer/src/components/sidebar/worktree-keyboard-cycle.test.ts b/src/renderer/src/components/sidebar/worktree-keyboard-cycle.test.ts
index c4c4bda6da1..430736c92be 100644
--- a/src/renderer/src/components/sidebar/worktree-keyboard-cycle.test.ts
+++ b/src/renderer/src/components/sidebar/worktree-keyboard-cycle.test.ts
@@ -165,8 +165,11 @@ describe('WorktreeList keyboard cycling', () => {
 
     // Why: a second buildRows call drifts from the rendered layout (host sections,
     // pinned placement); cycling must read the same rows the viewport renders.
-    expect(navigateWorktree).toContain('getCyclableWorktrees(rows, pinnedDisplayPolicy)')
-    expect(navigateWorktree).toContain('getWorktreeHostIdentity')
+    expect(navigateWorktree).toContain('getCyclableWorktreeRows(rows, pinnedDisplayPolicy)')
+    expect(navigateWorktree).toContain('getCyclableRowIdentity')
+    // Why: the active host is stored resolved while a local row is unqualified; comparing raw identities wraps to the top.
+    expect(navigateWorktree).toContain('resolveActiveCycleIdentity')
+    expect(navigateWorktree).not.toContain('composeWorktreeHostIdentity')
     expect(navigateWorktree).toContain('executionHostId: nextWorktree.hostId')
     expect(navigateWorktree).toContain('resolveCycledWorktreeId')
     expect(navigateWorktree).not.toContain('buildRows(')
diff --git a/src/renderer/src/components/sidebar/worktree-keyboard-cycle.ts b/src/renderer/src/components/sidebar/worktree-keyboard-cycle.ts
index 0a2bf23e905..4c50c78b5f5 100644
--- a/src/renderer/src/components/sidebar/worktree-keyboard-cycle.ts
+++ b/src/renderer/src/components/sidebar/worktree-keyboard-cycle.ts
@@ -1,9 +1,49 @@
 import type { HostSectionRow } from './host-section-rows'
 import type { Worktree } from '../../../../shared/worktree/types'
-import { getWorktreeHostIdentity } from '../../../../shared/worktree/host-qualified-identity'
+import { composeWorktreeHostIdentity } from '../../../../shared/worktree/host-qualified-identity'
+import { getWorktreeExecutionHostId, type ExecutionHostId } from '../../../../shared/execution-host'
 import type { PinnedWorktreeDisplayPolicy, WorktreeRow } from './worktree-list/grouping/row-types'
 import { getPreferredWorktreeRows } from './worktree-sidebar-row-preference'
 
+/** Host-resolved identity for a cyclable row.
+ *
+ * Why resolved rather than `getWorktreeHostIdentity`: a local worktree carries no
+ * `hostId` (`withRepoHostOwnership` leaves it unqualified), but every activation
+ * path stores the host it resolved to, so raw and resolved identities never match.
+ */
+export function getCyclableRowIdentity(row: Pick<WorktreeRow, 'worktree' | 'repo'>): string {
+  return composeWorktreeHostIdentity(
+    getWorktreeExecutionHostId(row.worktree, row.repo),
+    row.worktree.id
+  )
+}
+
+export function getCyclableWorktreeRows(
+  rows: readonly HostSectionRow[],
+  pinnedDisplayPolicy: PinnedWorktreeDisplayPolicy
+): WorktreeRow[] {
+  const itemRows = rows.filter((row): row is WorktreeRow => row.type === 'item')
+  return getPreferredWorktreeRows(itemRows, pinnedDisplayPolicy)
+}
+
+/** Identity that locates the active workspace among the cyclable rows. */
+export function resolveActiveCycleIdentity(args: {
+  rows: readonly WorktreeRow[]
+  activeWorktreeId: string | null
+  activeWorkspaceExecutionHostId: ExecutionHostId | null
+}): string | null {
+  const { rows, activeWorktreeId, activeWorkspaceExecutionHostId } = args
+  if (!activeWorktreeId) {
+    return null
+  }
+  if (activeWorkspaceExecutionHostId) {
+    return composeWorktreeHostIdentity(activeWorkspaceExecutionHostId, activeWorktreeId)
+  }
+  // Host-unqualified activation names no host; the row it landed on does.
+  const row = rows.find((candidate) => candidate.worktree.id === activeWorktreeId)
+  return row ? getCyclableRowIdentity(row) : null
+}
+
 /** Worktree ids in sidebar order, taken from the rows the sidebar actually
  *  rendered, so collapsed groups and collapsed host sections drop out on their own. */
 export function getCyclableWorktreeIds(
@@ -12,11 +52,10 @@ export function getCyclableWorktreeIds(
 ): string[] {
   // Why item-only: folder workspaces render as their own row type and are not
   // activatable through activateAndRevealWorktree, so cycling has never included them.
-  const itemRows = rows.filter((row): row is WorktreeRow => row.type === 'item')
   const ids: string[] = []
   const seen = new Set<string>()
-  for (const row of getPreferredWorktreeRows(itemRows, pinnedDisplayPolicy)) {
-    const identity = getWorktreeHostIdentity(row.worktree)
+  for (const row of getCyclableWorktreeRows(rows, pinnedDisplayPolicy)) {
+    const identity = getCyclableRowIdentity(row)
     if (seen.has(identity)) {
       continue
     }
@@ -30,8 +69,7 @@ export function getCyclableWorktrees(
   rows: readonly HostSectionRow[],
   pinnedDisplayPolicy: PinnedWorktreeDisplayPolicy
 ): Worktree[] {
-  const itemRows = rows.filter((row): row is WorktreeRow => row.type === 'item')
-  return getPreferredWorktreeRows(itemRows, pinnedDisplayPolicy).map((row) => row.worktree)
+  return getCyclableWorktreeRows(rows, pinnedDisplayPolicy).map((row) => row.worktree)
 }
 
 /** Pick the worktree that `worktree.navigateUp` / `worktree.navigateDown` moves
diff --git a/src/renderer/src/components/sidebar/worktree-list-lineage-card-test-harness.ts b/src/renderer/src/components/sidebar/worktree-list-lineage-card-test-harness.ts
index 46e44d6e836..ef47c1fac63 100644
--- a/src/renderer/src/components/sidebar/worktree-list-lineage-card-test-harness.ts
+++ b/src/renderer/src/components/sidebar/worktree-list-lineage-card-test-harness.ts
@@ -1,6 +1,7 @@
 import React from 'react'
 import { renderToStaticMarkup } from 'react-dom/server'
 import { vi } from 'vitest'
+import { ConfirmationDialogContext } from '@/components/confirmation-dialog-context'
 import type { Repo } from '../../../../shared/repo-types'
 import type { Worktree } from '../../../../shared/worktree/types'
 
@@ -20,10 +21,14 @@ export async function loadWorktreeList(): Promise<void> {
 
 export async function renderWorktreeListMarkup(): Promise<string> {
   return renderToStaticMarkup(
-    React.createElement(WorktreeList!, {
-      scrollOffsetRef: { current: 0 },
-      scrollAnchorRef: { current: null }
-    })
+    React.createElement(
+      ConfirmationDialogContext.Provider,
+      { value: async () => false },
+      React.createElement(WorktreeList!, {
+        scrollOffsetRef: { current: 0 },
+        scrollAnchorRef: { current: null }
+      })
+    )
   )
 }
 
diff --git a/src/renderer/src/components/sidebar/worktree-list/drag/groups.ts b/src/renderer/src/components/sidebar/worktree-list/drag/groups.ts
index f8ee60c495e..7f1a8e19f49 100644
--- a/src/renderer/src/components/sidebar/worktree-list/drag/groups.ts
+++ b/src/renderer/src/components/sidebar/worktree-list/drag/groups.ts
@@ -1,16 +1,8 @@
 import { ALL_GROUP_KEY, PINNED_GROUP_KEY } from '../grouping/group-keys'
+import { getNaturalWorktreeIds } from '../../natural-worktree-ids'
 import type { HostSectionRow } from '../../host-section-rows'
 import type { WorktreeDragGroup } from '../../worktree-manual-order'
 
-// A pinned duplicate of a worktree that also renders in its natural group is not its own drag slot.
-function getNaturalWorktreeIds(rows: readonly HostSectionRow[]): Set<string> {
-  return new Set(
-    rows.flatMap((row) =>
-      row.type === 'item' && row.sectionKey !== PINNED_GROUP_KEY ? [row.worktree.id] : []
-    )
-  )
-}
-
 export function getWorktreeDragGroups(rows: HostSectionRow[]): WorktreeDragGroup[] {
   const groups: WorktreeDragGroup[] = []
   let current: { key: string; ids: string[] } | null = null
diff --git a/src/renderer/src/components/sidebar/worktree-list/drag/use-session.ts b/src/renderer/src/components/sidebar/worktree-list/drag/use-session.ts
index 78b25b25f38..92e23ec4928 100644
--- a/src/renderer/src/components/sidebar/worktree-list/drag/use-session.ts
+++ b/src/renderer/src/components/sidebar/worktree-list/drag/use-session.ts
@@ -24,6 +24,7 @@ import {
 } from '../../worktree-sidebar-drop-preview'
 import { getWorktreeDragGroups, getWorktreeDragIndexes } from './groups'
 import type { WorktreeItemRow } from '../listing/renderable-rows'
+import { getNaturalWorktreeIds } from '../../natural-worktree-ids'
 
 export type WorktreeStatusDropRequest = {
   pointerY: number
@@ -48,15 +49,7 @@ export function useWorktreeDragSession(args: {
 
   const worktreeDragGroups = useMemo(() => getWorktreeDragGroups(rows), [rows])
   const worktreeDragUnitGroups = useMemo(() => getWorktreeDragUnitGroups(rows), [rows])
-  const naturalDragWorktreeIds = useMemo(
-    () =>
-      new Set(
-        rows.flatMap((row) =>
-          row.type === 'item' && row.sectionKey !== PINNED_GROUP_KEY ? [row.worktree.id] : []
-        )
-      ),
-    [rows]
-  )
+  const naturalDragWorktreeIds = useMemo(() => getNaturalWorktreeIds(rows), [rows])
   const worktreeLineageDragRows = useMemo(
     () =>
       rows
diff --git a/src/renderer/src/components/sidebar/worktree-list/grouping/host-labels.test.ts b/src/renderer/src/components/sidebar/worktree-list/grouping/host-labels.test.ts
new file mode 100644
index 00000000000..7411dc00d6a
--- /dev/null
+++ b/src/renderer/src/components/sidebar/worktree-list/grouping/host-labels.test.ts
@@ -0,0 +1,62 @@
+import { describe, expect, it } from 'vitest'
+import type { ExecutionHostId } from '../../../../../../shared/execution-host'
+import type { Repo } from '../../../../../../shared/repo-types'
+import type { Worktree } from '../../../../../../shared/worktree/types'
+import { getHostWorktreeCounts, getHostWorktreeIds } from './host-labels'
+
+const LOCAL = 'local' as ExecutionHostId
+
+function makeRepos(hostByRepo: Record<string, ExecutionHostId | undefined>): Map<string, Repo> {
+  return new Map(
+    Object.entries(hostByRepo).map(([id, executionHostId]) => [
+      id,
+      { id, path: `/${id}`, ...(executionHostId ? { executionHostId } : {}) } as Repo
+    ])
+  )
+}
+
+function makeWorktrees(rows: { id: string; repoId: string }[]): Worktree[] {
+  return rows.map((row) => row as Worktree)
+}
+
+describe('host worktree counts and ids', () => {
+  it('reports a count equal to the length of each host id list', () => {
+    const repoMap = makeRepos({
+      'repo-local': undefined,
+      'repo-remote': 'ssh:other' as ExecutionHostId
+    })
+    const worktrees = makeWorktrees([
+      { id: 'a', repoId: 'repo-local' },
+      { id: 'b', repoId: 'repo-local' },
+      { id: 'c', repoId: 'repo-remote' }
+    ])
+
+    const counts = getHostWorktreeCounts(worktrees, repoMap, LOCAL)
+    const ids = getHostWorktreeIds(worktrees, repoMap, LOCAL)
+
+    expect(ids).toBeDefined()
+    expect(counts).toBeDefined()
+    for (const [hostId, hostIds] of ids ?? []) {
+      expect(counts?.get(hostId), `count for ${hostId}`).toBe(hostIds.length)
+    }
+    expect([...(counts?.keys() ?? [])].sort()).toEqual([...(ids?.keys() ?? [])].sort())
+  })
+
+  it('counts a repeated host identity once', () => {
+    const repoMap = makeRepos({ 'repo-local': undefined })
+    const worktrees = makeWorktrees([
+      { id: 'a', repoId: 'repo-local' },
+      { id: 'a', repoId: 'repo-local' },
+      { id: 'b', repoId: 'repo-local' }
+    ])
+
+    expect(getHostWorktreeCounts(worktrees, repoMap, LOCAL)?.get(LOCAL)).toBe(2)
+    expect(getHostWorktreeIds(worktrees, repoMap, LOCAL)?.get(LOCAL)).toEqual(['a', 'b'])
+  })
+
+  it('returns undefined for an empty lane', () => {
+    const repoMap = makeRepos({})
+    expect(getHostWorktreeCounts([], repoMap, LOCAL)).toBeUndefined()
+    expect(getHostWorktreeIds([], repoMap, LOCAL)).toBeUndefined()
+  })
+})
diff --git a/src/renderer/src/components/sidebar/worktree-list/grouping/host-labels.ts b/src/renderer/src/components/sidebar/worktree-list/grouping/host-labels.ts
index d1c5c8be2d4..925b04eed41 100644
--- a/src/renderer/src/components/sidebar/worktree-list/grouping/host-labels.ts
+++ b/src/renderer/src/components/sidebar/worktree-list/grouping/host-labels.ts
@@ -153,17 +153,17 @@ export function getHostWorktreeCounts(
   if (worktrees.length === 0) {
     return undefined
   }
-  const counts = new Map<ExecutionHostId, number>()
+  // Derived from the id map rather than repeating its dedupe walk: every caller asks for both,
+  // and a host's count is exactly the length of its id list by construction.
   // Dedup by host, not by bare id: the same id on two hosts is two workspaces
   // and has to be counted under each of them (STA-4343).
-  const seenIdentities = new Set<string>()
-  for (const worktree of worktrees) {
-    if (seenIdentities.has(getWorktreeHostIdentity(worktree))) {
-      continue
-    }
-    seenIdentities.add(getWorktreeHostIdentity(worktree))
-    const hostId = getWorktreeExecutionHostId(worktree, repoMap.get(worktree.repoId), defaultHostId)
-    counts.set(hostId, (counts.get(hostId) ?? 0) + 1)
+  const idsByHost = getHostWorktreeIds(worktrees, repoMap, defaultHostId)
+  if (!idsByHost) {
+    return undefined
+  }
+  const counts = new Map<ExecutionHostId, number>()
+  for (const [hostId, ids] of idsByHost) {
+    counts.set(hostId, ids.length)
   }
   return counts
 }
@@ -179,10 +179,12 @@ export function getHostWorktreeIds(
   const idsByHost = new Map<ExecutionHostId, string[]>()
   const seenIdentities = new Set<string>()
   for (const worktree of worktrees) {
-    if (seenIdentities.has(getWorktreeHostIdentity(worktree))) {
+    // Hoisted: the identity string was built twice per row, once to test and once to record.
+    const identity = getWorktreeHostIdentity(worktree)
+    if (seenIdentities.has(identity)) {
       continue
     }
-    seenIdentities.add(getWorktreeHostIdentity(worktree))
+    seenIdentities.add(identity)
     const hostId = getWorktreeExecutionHostId(worktree, repoMap.get(worktree.repoId), defaultHostId)
     const ids = idsByHost.get(hostId) ?? []
     ids.push(worktree.id)
diff --git a/src/renderer/src/components/sidebar/worktree-list/navigation/use-keyboard.host-identity.test.tsx b/src/renderer/src/components/sidebar/worktree-list/navigation/use-keyboard.host-identity.test.tsx
new file mode 100644
index 00000000000..efac59a9c07
--- /dev/null
+++ b/src/renderer/src/components/sidebar/worktree-list/navigation/use-keyboard.host-identity.test.tsx
@@ -0,0 +1,122 @@
+// @vitest-environment happy-dom
+
+import { act } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { Worktree } from '../../../../../../shared/worktree/types'
+import type { HostSectionRow } from '../../host-section-rows'
+import type { RenderRow } from '../listing/render-row'
+import { getShortcutPlatform } from '@/lib/shortcut-platform'
+
+const activateAndRevealWorktree = vi.fn()
+
+vi.mock('@/lib/worktree-activation', () => ({
+  activateAndRevealWorktree: (...args: unknown[]) => activateAndRevealWorktree(...args)
+}))
+
+vi.mock('@/store', () => ({
+  useAppStore: (selector: (state: { keybindings: undefined }) => unknown) =>
+    selector({ keybindings: undefined })
+}))
+
+const { useWorktreeListKeyboardNavigation } = await import('./use-keyboard')
+
+;(globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true
+
+const repo = { id: 'repo-1', path: '/repo-1', displayName: 'Repo 1' }
+
+// Local worktrees carry no `hostId` — `withRepoHostOwnership` leaves them unqualified.
+function localRow(id: string): HostSectionRow & { type: 'item' } {
+  return {
+    type: 'item',
+    rowKey: `row:${id}`,
+    sectionKey: 'repo:repo-1',
+    worktree: { id, repoId: repo.id } as unknown as Worktree,
+    repo: repo as never,
+    depth: 0,
+    groupDepth: 0,
+    lineageTrail: [],
+    isLastLineageChild: false,
+    lineageChildCount: 0
+  }
+}
+
+const rows: HostSectionRow[] = [localRow('a'), localRow('b'), localRow('c')]
+const renderRows = rows as unknown as RenderRow[]
+
+let container: HTMLDivElement
+let root: Root
+
+function press(direction: 'up' | 'down'): void {
+  const mod = getShortcutPlatform() === 'darwin' ? { metaKey: true } : { ctrlKey: true }
+  act(() => {
+    window.dispatchEvent(
+      new KeyboardEvent('keydown', {
+        key: direction === 'down' ? 'ArrowDown' : 'ArrowUp',
+        code: direction === 'down' ? 'ArrowDown' : 'ArrowUp',
+        shiftKey: true,
+        bubbles: true,
+        cancelable: true,
+        ...mod
+      })
+    )
+  })
+}
+
+function renderProbe(activeWorktreeId: string, activeHostId: 'local' | null): void {
+  function Probe(): null {
+    useWorktreeListKeyboardNavigation({
+      rows,
+      renderRows,
+      activeWorktreeId,
+      activeWorkspaceExecutionHostId: activeHostId,
+      pinnedDisplayPolicy: 'single-location',
+      virtualizer: { scrollToIndex: () => {} } as never,
+      scrollRef: { current: null },
+      activeModal: 'none',
+      markDirectScrollInput: () => {}
+    })
+    return null
+  }
+  act(() => root.render(<Probe />))
+}
+
+beforeEach(() => {
+  activateAndRevealWorktree.mockClear()
+  container = document.createElement('div')
+  document.body.appendChild(container)
+  root = createRoot(container)
+})
+
+afterEach(() => {
+  act(() => root.unmount())
+  container.remove()
+})
+
+describe('worktree keyboard cycling with a resolved active host', () => {
+  it('steps to the next row when the active host resolved to local but rows are unqualified', () => {
+    // Why: a sidebar click activates with the repo-resolved host (`local`), while
+    // local rows carry no hostId; a raw identity compare misses and wraps to the top.
+    renderProbe('b', 'local')
+
+    press('down')
+
+    expect(activateAndRevealWorktree).toHaveBeenCalledWith('c', {})
+  })
+
+  it('steps to the previous row when the active host resolved to local', () => {
+    renderProbe('b', 'local')
+
+    press('up')
+
+    expect(activateAndRevealWorktree).toHaveBeenCalledWith('a', {})
+  })
+
+  it('still steps normally when the active host is unqualified', () => {
+    renderProbe('b', null)
+
+    press('down')
+
+    expect(activateAndRevealWorktree).toHaveBeenCalledWith('c', {})
+  })
+})
diff --git a/src/renderer/src/components/sidebar/worktree-list/navigation/use-keyboard.ts b/src/renderer/src/components/sidebar/worktree-list/navigation/use-keyboard.ts
index 5746e16bf2a..c8d3ec5d80d 100644
--- a/src/renderer/src/components/sidebar/worktree-list/navigation/use-keyboard.ts
+++ b/src/renderer/src/components/sidebar/worktree-list/navigation/use-keyboard.ts
@@ -4,16 +4,17 @@ import type { Virtualizer } from '@tanstack/react-virtual'
 import { useAppStore } from '@/store'
 import { activateAndRevealWorktree } from '@/lib/worktree-activation'
 import type { ExecutionHostId } from '../../../../../../shared/execution-host'
-import {
-  composeWorktreeHostIdentity,
-  getWorktreeHostIdentity
-} from '../../../../../../shared/worktree/host-qualified-identity'
 import { getShortcutPlatform } from '@/lib/shortcut-platform'
 import { keybindingMatchesAction } from '../../../../../../shared/keybindings'
 import type { HostSectionRow } from '../../host-section-rows'
 import type { PinnedWorktreeDisplayPolicy } from '../grouping/row-types'
 import type { RenderRow } from '../listing/render-row'
-import { getCyclableWorktrees, resolveCycledWorktreeId } from '../../worktree-keyboard-cycle'
+import {
+  getCyclableRowIdentity,
+  getCyclableWorktreeRows,
+  resolveActiveCycleIdentity,
+  resolveCycledWorktreeId
+} from '../../worktree-keyboard-cycle'
 import { findPreferredRenderRowIndexForWorktreeIdentity } from './render-row-lookup'
 
 function isEditableTarget(target: EventTarget | null): boolean {
@@ -65,24 +66,22 @@ export function useWorktreeListKeyboardNavigation(args: {
       // Why: cycle over the rows the sidebar actually rendered — collapsing a group
       // means "not now", and a rebuilt near-copy would drift from what is on screen
       // (host sections, pinned placement, folder workspaces).
-      const worktrees = getCyclableWorktrees(rows, pinnedDisplayPolicy)
-      const worktreeIdentities = worktrees.map(getWorktreeHostIdentity)
+      const worktreeRows = getCyclableWorktreeRows(rows, pinnedDisplayPolicy)
       const nextWorktreeIdentity = resolveCycledWorktreeId({
-        worktreeIds: worktreeIdentities,
-        activeWorktreeId: activeWorktreeId
-          ? composeWorktreeHostIdentity(
-              activeWorkspaceExecutionHostId ?? undefined,
-              activeWorktreeId
-            )
-          : null,
+        worktreeIds: worktreeRows.map(getCyclableRowIdentity),
+        activeWorktreeId: resolveActiveCycleIdentity({
+          rows: worktreeRows,
+          activeWorktreeId,
+          activeWorkspaceExecutionHostId
+        }),
         direction
       })
       if (nextWorktreeIdentity === null) {
         return
       }
-      const nextWorktree = worktrees.find(
-        (worktree) => getWorktreeHostIdentity(worktree) === nextWorktreeIdentity
-      )
+      const nextWorktree = worktreeRows.find(
+        (row) => getCyclableRowIdentity(row) === nextWorktreeIdentity
+      )?.worktree
       if (!nextWorktree) {
         return
       }
diff --git a/src/renderer/src/components/sidebar/worktree-list/navigation/use-reveal-requests.test.tsx b/src/renderer/src/components/sidebar/worktree-list/navigation/use-reveal-requests.test.tsx
new file mode 100644
index 00000000000..7f78d3d011a
--- /dev/null
+++ b/src/renderer/src/components/sidebar/worktree-list/navigation/use-reveal-requests.test.tsx
@@ -0,0 +1,191 @@
+// @vitest-environment happy-dom
+import { act } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { ConfirmationDialogProvider } from '@/components/confirmation-dialog'
+import {
+  requestScrollToCurrentWorkspaceReveal,
+  requestScrollToCurrentWorkspaceRevealAndRename
+} from '@/lib/scroll-to-current-workspace-status'
+import { folderWorkspaceKey } from '../../../../../../shared/workspace-scope'
+import { useSidebarRevealRequests } from './use-reveal-requests'
+import type { Worktree } from '../../../../../../shared/worktree/types'
+
+globalThis.IS_REACT_ACT_ENVIRONMENT = true
+
+const state = vi.hoisted(() => ({
+  setGroupBy: vi.fn(),
+  pendingRevealSidebarRow: null,
+  revealSidebarRow: vi.fn(),
+  revealWorktreeInSidebar: vi.fn(),
+  setContextualToursBlockingSurfaceVisible: vi.fn()
+}))
+vi.mock('@/store', () => ({
+  useAppStore: (selector: (value: typeof state) => unknown) => selector(state)
+}))
+
+type Args = Parameters<typeof useSidebarRevealRequests>[0]
+function Host({ args }: { args: Args }): null {
+  useSidebarRevealRequests(args)
+  return null
+}
+
+let root: Root
+let container: HTMLDivElement
+let args: Args
+
+async function render(): Promise<void> {
+  await act(async () => {
+    root.render(
+      <ConfirmationDialogProvider>
+        <Host args={args} />
+      </ConfirmationDialogProvider>
+    )
+  })
+}
+
+async function click(label: string): Promise<void> {
+  const button = Array.from(document.querySelectorAll('button')).find(
+    (candidate) => candidate.textContent === label
+  )
+  expect(button).toBeDefined()
+  await act(async () => button!.click())
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  container = document.createElement('div')
+  document.body.append(container)
+  root = createRoot(container)
+  const worktree: Worktree = {
+    id: 'wt-1',
+    hostId: 'ssh:dev',
+    repoId: 'repo-1',
+    path: '/repo/feature',
+    displayName: 'Feature',
+    branch: 'feature',
+    head: 'abc123',
+    isBare: false,
+    isMainWorktree: false,
+    comment: '',
+    linkedIssue: null,
+    linkedPR: null,
+    linkedLinearIssue: null,
+    linkedGitLabMR: null,
+    linkedGitLabIssue: null,
+    isArchived: false,
+    isUnread: false,
+    isPinned: false,
+    sortOrder: 1,
+    lastActivityAt: 1
+  }
+  args = {
+    groupBy: 'repo',
+    renderedSidebarRowKeys: new Set(),
+    renderedWorktreeIdentities: [],
+    currentSidebarWorktreeId: worktree.id,
+    currentSidebarExecutionHostId: 'ssh:dev',
+    worktreeMap: new Map([[worktree.id, worktree]]),
+    worktrees: [worktree],
+    folderWorkspaces: [],
+    hasFilters: true,
+    clearFilters: vi.fn()
+  }
+})
+
+afterEach(async () => {
+  await act(async () => root.unmount())
+  container.remove()
+})
+
+describe('revealing a filtered workspace', () => {
+  it('explains the filter reset and leaves filters intact when dismissed', async () => {
+    await render()
+    await act(async () => requestScrollToCurrentWorkspaceReveal())
+    expect(document.body.textContent).toContain('Revealing it will clear your sidebar filters.')
+    expect(args.clearFilters).not.toHaveBeenCalled()
+    expect(state.revealWorktreeInSidebar).not.toHaveBeenCalled()
+    await click('Keep filters')
+    expect(args.clearFilters).not.toHaveBeenCalled()
+    expect(state.revealWorktreeInSidebar).not.toHaveBeenCalled()
+  })
+
+  it('clears filters and reveals on the original execution host only after confirmation', async () => {
+    await render()
+    await act(async () => {
+      requestScrollToCurrentWorkspaceReveal()
+      requestScrollToCurrentWorkspaceReveal()
+    })
+    await click('Clear filters and reveal')
+    expect(args.clearFilters).toHaveBeenCalledTimes(1)
+    expect(state.revealWorktreeInSidebar).toHaveBeenCalledWith('wt-1', {
+      behavior: 'smooth',
+      highlight: true,
+      beginRename: false,
+      executionHostId: 'ssh:dev'
+    })
+    expect(document.querySelector('[role="dialog"]')).toBeNull()
+  })
+
+  it.each([true, false])(
+    'reveals immediately when clearing filters is unnecessary (%s)',
+    async (visible) => {
+      args = {
+        ...args,
+        hasFilters: visible,
+        renderedWorktreeIdentities: visible ? ['ssh:dev|wt-1'] : []
+      }
+      await render()
+      await act(async () => requestScrollToCurrentWorkspaceReveal())
+      expect(document.querySelector('[role="dialog"]')).toBeNull()
+      expect(args.clearFilters).not.toHaveBeenCalled()
+      expect(state.revealWorktreeInSidebar).toHaveBeenCalledTimes(1)
+    }
+  )
+
+  it('does not apply a stale confirmation after switching workspaces', async () => {
+    await render()
+    await act(async () => requestScrollToCurrentWorkspaceReveal())
+    args = { ...args, currentSidebarWorktreeId: 'wt-2' }
+    await render()
+    await click('Clear filters and reveal')
+    expect(args.clearFilters).not.toHaveBeenCalled()
+    expect(state.revealWorktreeInSidebar).not.toHaveBeenCalled()
+  })
+
+  it('confirms filtered folder workspaces and preserves the rename request', async () => {
+    args = {
+      ...args,
+      currentSidebarWorktreeId: folderWorkspaceKey('folder-1'),
+      currentSidebarExecutionHostId: null,
+      folderWorkspaces: [
+        {
+          id: 'folder-1',
+          projectGroupId: 'project-1',
+          name: 'Notes',
+          folderPath: '/notes',
+          linkedTask: null,
+          comment: '',
+          isArchived: false,
+          isUnread: false,
+          isPinned: false,
+          sortOrder: 1,
+          lastActivityAt: 1,
+          createdAt: 1,
+          updatedAt: 1
+        }
+      ]
+    }
+    await render()
+    await act(async () => requestScrollToCurrentWorkspaceRevealAndRename())
+    expect(args.clearFilters).not.toHaveBeenCalled()
+    await click('Clear filters and reveal')
+    expect(args.clearFilters).toHaveBeenCalledTimes(1)
+    expect(state.revealWorktreeInSidebar).toHaveBeenCalledWith(folderWorkspaceKey('folder-1'), {
+      behavior: 'smooth',
+      highlight: true,
+      beginRename: true,
+      executionHostId: undefined
+    })
+  })
+})
diff --git a/src/renderer/src/components/sidebar/worktree-list/navigation/use-reveal-requests.ts b/src/renderer/src/components/sidebar/worktree-list/navigation/use-reveal-requests.ts
index bbe9d57e0cb..27a8ff5c3fa 100644
--- a/src/renderer/src/components/sidebar/worktree-list/navigation/use-reveal-requests.ts
+++ b/src/renderer/src/components/sidebar/worktree-list/navigation/use-reveal-requests.ts
@@ -1,4 +1,7 @@
-import { useCallback, useEffect } from 'react'
+import { useCallback, useEffect, useLayoutEffect, useRef } from 'react'
+import { Crosshair } from 'lucide-react'
+import { useConfirmationDialog } from '@/components/confirmation-dialog-context'
+import { translate } from '@/i18n/i18n'
 import { useAppStore } from '@/store'
 import {
   SCROLL_TO_CURRENT_WORKSPACE_REVEAL_REQUEST_EVENT,
@@ -41,6 +44,12 @@ export function useSidebarRevealRequests(args: {
   const pendingRevealSidebarRow = useAppStore((s) => s.pendingRevealSidebarRow)
   const revealSidebarRow = useAppStore((s) => s.revealSidebarRow)
   const revealWorktreeInSidebar = useAppStore((s) => s.revealWorktreeInSidebar)
+  const confirm = useConfirmationDialog()
+  const confirmationPending = useRef(false)
+  const latestArgs = useRef(args)
+  useLayoutEffect(() => {
+    latestArgs.current = args
+  })
 
   useEffect(() => {
     if (!pendingRevealSidebarRow) {
@@ -68,7 +77,7 @@ export function useSidebarRevealRequests(args: {
   ])
 
   const handleRevealCurrentWorkspaceRequest = useCallback(
-    (event: Event) => {
+    async (event: Event) => {
       const detail =
         event instanceof CustomEvent
           ? (event.detail as ScrollToCurrentWorkspaceRevealRequestDetail | undefined)
@@ -101,9 +110,40 @@ export function useSidebarRevealRequests(args: {
         currentSidebarExecutionHostId ?? undefined,
         currentSidebarWorktreeId
       )
-      if (!renderedWorktreeIdentities.includes(currentIdentity)) {
-        // Why: the reveal action must show the current workspace, so relax filters that hide it first.
-        clearFilters()
+      if (hasFilters && !renderedWorktreeIdentities.includes(currentIdentity)) {
+        if (confirmationPending.current) {
+          return
+        }
+        confirmationPending.current = true
+        let confirmed: boolean
+        try {
+          confirmed = await confirm({
+            icon: Crosshair,
+            initialFocus: 'confirm',
+            cancelVariant: 'ghost',
+            title: translate('sidebar.revealFiltered.title', 'Reveal hidden workspace?'),
+            description: translate(
+              'sidebar.revealFiltered.description',
+              'The active workspace is hidden in the sidebar. Revealing it will clear your sidebar filters.'
+            ),
+            confirmLabel: translate('sidebar.revealFiltered.confirm', 'Clear filters and reveal'),
+            cancelLabel: translate('sidebar.revealFiltered.cancel', 'Keep filters')
+          })
+        } finally {
+          confirmationPending.current = false
+        }
+        const latest = latestArgs.current
+        // A workspace switch while the dialog is open must not clear filters for a stale target.
+        if (
+          !confirmed ||
+          latest.currentSidebarWorktreeId !== currentSidebarWorktreeId ||
+          latest.currentSidebarExecutionHostId !== currentSidebarExecutionHostId
+        ) {
+          return
+        }
+        if (latest.hasFilters && !latest.renderedWorktreeIdentities.includes(currentIdentity)) {
+          latest.clearFilters()
+        }
       }
       revealWorktreeInSidebar(currentSidebarWorktreeId, {
         behavior: 'smooth',
@@ -113,7 +153,8 @@ export function useSidebarRevealRequests(args: {
       })
     },
     [
-      clearFilters,
+      confirm,
+      hasFilters,
       currentSidebarWorktreeId,
       currentSidebarExecutionHostId,
       folderWorkspaces,
diff --git a/src/renderer/src/components/sidebar/worktree-list/rows/RepoScanUnavailableIndicator.test.tsx b/src/renderer/src/components/sidebar/worktree-list/rows/RepoScanUnavailableIndicator.test.tsx
new file mode 100644
index 00000000000..5ce0c7a950b
--- /dev/null
+++ b/src/renderer/src/components/sidebar/worktree-list/rows/RepoScanUnavailableIndicator.test.tsx
@@ -0,0 +1,102 @@
+// @vitest-environment happy-dom
+
+import { act } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { TooltipProvider } from '@/components/ui/tooltip'
+import { useAppStore } from '@/store'
+import type { Repo } from '../../../../../../shared/repo-types'
+import { makeDetectedResult } from '@/store/slices/worktrees-detected-listing-fixtures'
+import { RepoScanUnavailableIndicator } from './RepoScanUnavailableIndicator'
+
+const repo = {
+  id: 'repo-1',
+  path: 'C:\\repo',
+  displayName: 'repo',
+  badgeColor: '#000',
+  addedAt: 0
+} as Repo
+
+const initialState = useAppStore.getInitialState()
+const roots: Root[] = []
+
+async function render(): Promise<HTMLDivElement> {
+  const container = document.createElement('div')
+  document.body.appendChild(container)
+  const root = createRoot(container)
+  roots.push(root)
+  await act(async () => {
+    root.render(
+      <TooltipProvider>
+        <RepoScanUnavailableIndicator repo={repo} />
+      </TooltipProvider>
+    )
+  })
+  return container
+}
+
+describe('RepoScanUnavailableIndicator', () => {
+  beforeEach(() => {
+    globalThis.IS_REACT_ACT_ENVIRONMENT = true
+    useAppStore.setState(initialState, true)
+  })
+
+  afterEach(async () => {
+    for (const root of roots.splice(0)) {
+      await act(async () => root.unmount())
+    }
+    document.body.innerHTML = ''
+    useAppStore.setState(initialState, true)
+  })
+
+  it('renders nothing for an authoritative listing', async () => {
+    useAppStore.setState({
+      detectedWorktreesByRepo: { [repo.id]: makeDetectedResult(repo.id, []) }
+    })
+
+    const container = await render()
+
+    expect(container.querySelector('button')).toBeNull()
+  })
+
+  // Why: a non-authoritative listing without a reason is the disconnected-SSH shape, which the
+  // host header already explains; this marker is only for a scan that failed with a cause.
+  it('renders nothing for a non-authoritative listing that carries no reason', async () => {
+    useAppStore.setState({
+      detectedWorktreesByRepo: {
+        [repo.id]: makeDetectedResult(repo.id, [], {
+          authoritative: false,
+          source: 'metadata-fallback'
+        })
+      }
+    })
+
+    const container = await render()
+
+    expect(container.querySelector('button')).toBeNull()
+  })
+
+  it('marks a failed scan and re-runs it on click', async () => {
+    const fetchWorktrees = vi.fn(async () => true)
+    useAppStore.setState({
+      fetchWorktrees: fetchWorktrees as never,
+      detectedWorktreesByRepo: {
+        [repo.id]: makeDetectedResult(repo.id, [], {
+          authoritative: false,
+          source: 'metadata-fallback',
+          unavailableReason: 'wsl.exe host failure (distro "kali-linux"): WSL_E_DISTRO_NOT_FOUND'
+        })
+      }
+    })
+
+    const container = await render()
+    const button = container.querySelector('button')
+
+    expect(button?.getAttribute('aria-label')).toContain('Worktree scan failed for repo')
+    expect(button?.className).toContain('text-destructive')
+    await act(async () => {
+      button?.click()
+    })
+    expect(fetchWorktrees).toHaveBeenCalledWith(repo.id, { executionHostId: 'local' })
+  })
+})
diff --git a/src/renderer/src/components/sidebar/worktree-list/rows/RepoScanUnavailableIndicator.tsx b/src/renderer/src/components/sidebar/worktree-list/rows/RepoScanUnavailableIndicator.tsx
new file mode 100644
index 00000000000..a956598140e
--- /dev/null
+++ b/src/renderer/src/components/sidebar/worktree-list/rows/RepoScanUnavailableIndicator.tsx
@@ -0,0 +1,75 @@
+import React from 'react'
+import { TriangleAlert } from 'lucide-react'
+import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip'
+import { cn } from '@/lib/utils'
+import { translate } from '@/i18n/i18n'
+import { useAppStore } from '@/store'
+import type { Repo } from '../../../../../../shared/repo-types'
+import { getRepoExecutionHostId } from '../../../../../../shared/execution-host'
+import {
+  handleRepoHeaderActionPointerDown,
+  stopRepoHeaderKeyboardToggle
+} from './header-event-guards'
+
+/**
+ * Marks a repo whose worktree scan failed, so its rows are retained but cannot be trusted.
+ * Click re-runs the scan: the failure is otherwise re-tried only by the next incidental refresh.
+ */
+export function RepoScanUnavailableIndicator({ repo }: { repo: Repo }): React.JSX.Element | null {
+  const detected = useAppStore((s) => s.detectedWorktreesByRepo[repo.id])
+  const fetchWorktrees = useAppStore((s) => s.fetchWorktrees)
+  const [pending, setPending] = React.useState(false)
+  if (!detected || detected.authoritative || !detected.unavailableReason) {
+    return null
+  }
+  const title = translate(
+    'auto.components.sidebar.RepoScanUnavailableIndicator.title',
+    'Worktree scan failed for {{value0}}',
+    { value0: repo.displayName }
+  )
+  const retryLabel = translate(
+    'auto.components.sidebar.RepoScanUnavailableIndicator.retry',
+    'Retry scan'
+  )
+  return (
+    <Tooltip>
+      <TooltipTrigger asChild>
+        <button
+          type="button"
+          data-repo-header-action=""
+          className={cn(
+            'inline-flex size-4 shrink-0 items-center justify-center rounded-[4px] text-destructive',
+            pending && 'opacity-60'
+          )}
+          aria-label={`${title}. ${retryLabel}`}
+          aria-busy={pending}
+          disabled={pending}
+          onKeyDown={stopRepoHeaderKeyboardToggle}
+          onPointerDown={handleRepoHeaderActionPointerDown}
+          onClick={(event) => {
+            event.preventDefault()
+            event.stopPropagation()
+            setPending(true)
+            void fetchWorktrees(repo.id, {
+              executionHostId: getRepoExecutionHostId(repo)
+            }).finally(() => setPending(false))
+          }}
+        >
+          <TriangleAlert className="size-3.5" aria-hidden="true" />
+        </button>
+      </TooltipTrigger>
+      <TooltipContent side="bottom" sideOffset={6} className="max-w-72">
+        <div className="space-y-1">
+          <div className="font-medium">{title}</div>
+          <div className="break-words text-muted-foreground">{detected.unavailableReason}</div>
+          <div className="text-muted-foreground">
+            {translate(
+              'auto.components.sidebar.RepoScanUnavailableIndicator.retained',
+              'Existing worktrees are kept until a scan succeeds. Click to retry.'
+            )}
+          </div>
+        </div>
+      </TooltipContent>
+    </Tooltip>
+  )
+}
diff --git a/src/renderer/src/components/sidebar/worktree-list/rows/SectionHeader.tsx b/src/renderer/src/components/sidebar/worktree-list/rows/SectionHeader.tsx
index b4ed149712a..db0c7ec1371 100644
--- a/src/renderer/src/components/sidebar/worktree-list/rows/SectionHeader.tsx
+++ b/src/renderer/src/components/sidebar/worktree-list/rows/SectionHeader.tsx
@@ -26,6 +26,7 @@ import {
   WORKTREE_SECTION_HEADER_PADDING_LEFT
 } from './indentation'
 import { FolderPathStatusIndicator } from './FolderPathStatusIndicator'
+import { RepoScanUnavailableIndicator } from './RepoScanUnavailableIndicator'
 import {
   ProjectGroupCreateWorkspaceButton,
   ProjectGroupHeaderMenu
@@ -334,6 +335,7 @@ export function renderWorktreeSectionHeaderRow(args: {
               </div>
               <RepoForkIndicator upstream={row.repo?.upstream} />
               <FolderPathStatusIndicator status={projectGroupPathStatus} />
+              {isRepoHeader ? <RepoScanUnavailableIndicator repo={row.repo!} /> : null}
             </div>
           </div>
         </div>
diff --git a/src/renderer/src/components/sidebar/worktree-list/viewport/use-row-measurement.ts b/src/renderer/src/components/sidebar/worktree-list/viewport/use-row-measurement.ts
index ff812a950be..a6f795cf392 100644
--- a/src/renderer/src/components/sidebar/worktree-list/viewport/use-row-measurement.ts
+++ b/src/renderer/src/components/sidebar/worktree-list/viewport/use-row-measurement.ts
@@ -51,10 +51,6 @@ export function useVirtualRowMeasurementSync(args: {
   const { virtualizer, isCurrentVirtualRowElement } = virtualization
   const prCacheLen = useAppStore((s) => countRecordKeysByReference(s.prCache))
   const issueCacheLen = useAppStore((s) => countRecordKeysByReference(s.issueCache))
-  const renderRowKeySignature = useMemo(
-    () => renderRows.map(getRenderRowKey).join('\n'),
-    [renderRows]
-  )
   const activeRenderRowKeys = useMemo(() => new Set(renderRows.map(getRenderRowKey)), [renderRows])
   const lineageRowRekeys = useMemo(() => buildLineageRowRekeyMap(renderRows), [renderRows])
   const totalSize = virtualizer.getTotalSize()
@@ -100,14 +96,7 @@ export function useVirtualRowMeasurementSync(args: {
     measureMountedRows()
     const frameId = window.requestAnimationFrame(measureMountedRows)
     return () => window.cancelAnimationFrame(frameId)
-  }, [
-    activeRenderRowKeys,
-    prCacheLen,
-    issueCacheLen,
-    measureMountedRows,
-    renderRowKeySignature,
-    virtualizer
-  ])
+  }, [activeRenderRowKeys, prCacheLen, issueCacheLen, measureMountedRows, virtualizer])
 
   useVirtualizedScrollAnchor({
     anchorRef: scrollAnchorRef,
diff --git a/src/renderer/src/components/status-bar/ClaudeSwitcherMenu.tsx b/src/renderer/src/components/status-bar/ClaudeSwitcherMenu.tsx
index c5414d66d9a..2e159c67018 100644
--- a/src/renderer/src/components/status-bar/ClaudeSwitcherMenu.tsx
+++ b/src/renderer/src/components/status-bar/ClaudeSwitcherMenu.tsx
@@ -34,6 +34,7 @@ import {
 import { AccountRuntimeToggle } from './StatusBarAccountControls'
 import { InlineUsageBars, InlineUsageSkeleton } from './InlineProviderUsage'
 import { ProviderDetailsMenu } from './ProviderDetailsMenu'
+import { getClaudeAccountSyncKey } from './provider-account-sync-key'
 
 // Exported so its account-switch/reset logic is preserved for row drill-in even
 // though the footer now opens the consolidated UsageRosterPanel first.
@@ -83,13 +84,7 @@ export function ClaudeSwitcherMenu({
     getWindowsTerminalCapabilityOwnerKey(settings?.activeRuntimeEnvironmentId),
     runtimeTarget
   )
-  const claudeAccountSyncKey = useAppStore((s) => {
-    const settings = s.settings
-    if (!settings) {
-      return 'no-settings'
-    }
-    return `${settings.activeRuntimeEnvironmentId?.trim() || 'local'}:${settings.activeClaudeManagedAccountId ?? 'system'}:${JSON.stringify(settings.activeClaudeManagedAccountIdsByRuntime ?? null)}:${settings.claudeManagedAccounts.map((account) => `${account.id}:${account.updatedAt}`).join('|')}`
-  })
+  const claudeAccountSyncKey = useAppStore((s) => getClaudeAccountSyncKey(s.settings))
   const accountState = resolveClaudeStatusAccountState(settings, accounts)
 
   useEffect(() => {
diff --git a/src/renderer/src/components/status-bar/PortsStatusSegment.render-stability.test.tsx b/src/renderer/src/components/status-bar/PortsStatusSegment.render-stability.test.tsx
new file mode 100644
index 00000000000..d6d4ad95184
--- /dev/null
+++ b/src/renderer/src/components/status-bar/PortsStatusSegment.render-stability.test.tsx
@@ -0,0 +1,89 @@
+// @vitest-environment happy-dom
+
+import React, { act } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+vi.mock('@/components/ui/popover', () => ({
+  Popover: ({ children }: { children: React.ReactNode }) => <>{children}</>,
+  PopoverContent: ({ children }: { children: React.ReactNode }) => <>{children}</>,
+  PopoverTrigger: ({ children }: { children: React.ReactNode }) => <>{children}</>
+}))
+
+vi.mock('@/components/ui/tooltip', () => ({
+  Tooltip: ({ children }: { children: React.ReactNode }) => <>{children}</>,
+  TooltipContent: ({ children }: { children: React.ReactNode }) => <>{children}</>,
+  TooltipTrigger: ({ children }: { children: React.ReactNode }) => <>{children}</>
+}))
+
+vi.mock('@/components/SelectedTextCopyMenu', () => ({
+  SelectedTextCopyMenu: ({ children }: { children: React.ReactNode }) => <>{children}</>
+}))
+
+vi.mock('./ports-status-popover-rows', () => ({
+  PortRow: () => <div />,
+  WorkspaceGroupRows: () => <div />
+}))
+
+vi.mock('@/lib/react-error-boundary-reporting', () => ({
+  reportReactErrorBoundaryCrash: vi.fn()
+}))
+
+vi.mock('@/i18n/i18n', () => ({
+  translate: (_key: string, fallback: string, options?: Record<string, unknown>) =>
+    options
+      ? fallback.replace(/{{(\w+)}}/g, (_match, name: string) => String(options[name] ?? ''))
+      : fallback
+}))
+
+import { RecoverableRenderErrorBoundary } from '../error-boundaries/RecoverableRenderErrorBoundary'
+import { useAppStore } from '@/store'
+import { PortsStatusSegment } from './PortsStatusSegment'
+
+describe('PortsStatusSegment render stability', () => {
+  let container: HTMLDivElement
+  let root: Root
+  let consoleError: ReturnType<typeof vi.spyOn>
+
+  beforeEach(() => {
+    useAppStore.setState(useAppStore.getInitialState(), true)
+    container = document.createElement('div')
+    document.body.appendChild(container)
+    root = createRoot(container)
+    consoleError = vi.spyOn(console, 'error').mockImplementation(() => undefined)
+  })
+
+  afterEach(() => {
+    act(() => root.unmount())
+    container.remove()
+    consoleError.mockRestore()
+  })
+
+  it('keeps the status controls mounted when the runtime owner is local', () => {
+    act(() => {
+      root.render(
+        <RecoverableRenderErrorBoundary
+          boundaryId="oracle.status-bar"
+          surface="overlay"
+          compact
+          reportAsCrash={false}
+          title="The status bar hit an error."
+          description="Retry the status bar to remount its controls."
+        >
+          <PortsStatusSegment iconOnly={false} />
+        </RecoverableRenderErrorBoundary>
+      )
+    })
+
+    const underlyingException = consoleError.mock.calls.find(
+      ([message, error]) =>
+        message === '[oracle.status-bar] render crash contained by boundary' &&
+        error instanceof Error &&
+        error.message.includes('Maximum update depth exceeded')
+    )
+
+    expect.soft(container.textContent).not.toContain('The status bar hit an error.')
+    expect.soft(underlyingException).toBeUndefined()
+    expect(container.querySelector('button[aria-label^="Ports, 0 workspace"]')).not.toBeNull()
+  })
+})
diff --git a/src/renderer/src/components/status-bar/codex-switcher-projection.ts b/src/renderer/src/components/status-bar/codex-switcher-projection.ts
index 192f8d76fd9..5bddcce53f2 100644
--- a/src/renderer/src/components/status-bar/codex-switcher-projection.ts
+++ b/src/renderer/src/components/status-bar/codex-switcher-projection.ts
@@ -1,13 +1,7 @@
-import type { GlobalSettings } from '../../../../shared/global-settings-types'
 import type { ProviderRateLimits } from '../../../../shared/rate-limit-types'
 import { formatResetCreditExpiry } from './tooltip'
 
-export function getCodexAccountSyncKey(settings: GlobalSettings | null | undefined): string {
-  if (!settings) {
-    return 'no-settings'
-  }
-  return `${settings.activeRuntimeEnvironmentId?.trim() || 'local'}:${settings.activeCodexManagedAccountId ?? 'system'}:${JSON.stringify(settings.activeCodexManagedAccountIdsByRuntime ?? null)}:${settings.codexManagedAccounts.map((account) => `${account.id}:${account.updatedAt}`).join('|')}`
-}
+export { getCodexAccountSyncKey } from './provider-account-sync-key'
 
 export function getCodexResetProjection(
   codex: ProviderRateLimits,
diff --git a/src/renderer/src/components/status-bar/provider-account-sync-key.test.ts b/src/renderer/src/components/status-bar/provider-account-sync-key.test.ts
new file mode 100644
index 00000000000..7931bb1598b
--- /dev/null
+++ b/src/renderer/src/components/status-bar/provider-account-sync-key.test.ts
@@ -0,0 +1,42 @@
+import { describe, expect, it } from 'vitest'
+import type { GlobalSettings } from '../../../../shared/global-settings-types'
+import { getClaudeAccountSyncKey, getCodexAccountSyncKey } from './provider-account-sync-key'
+
+function makeSettings(overrides: Partial<GlobalSettings> = {}): GlobalSettings {
+  return {
+    activeRuntimeEnvironmentId: null,
+    activeClaudeManagedAccountId: null,
+    activeClaudeManagedAccountIdsByRuntime: null,
+    claudeManagedAccounts: [{ id: 'a1', updatedAt: 5 }],
+    activeCodexManagedAccountId: null,
+    activeCodexManagedAccountIdsByRuntime: null,
+    codexManagedAccounts: [{ id: 'c1', updatedAt: 7 }],
+    ...overrides
+  } as unknown as GlobalSettings
+}
+
+describe.each([
+  ['claude', getClaudeAccountSyncKey],
+  ['codex', getCodexAccountSyncKey]
+])('%s account sync key', (_provider, getSyncKey) => {
+  it('returns the same string for the same settings identity', () => {
+    const settings = makeSettings()
+    expect(getSyncKey(settings)).toBe(getSyncKey(settings))
+  })
+
+  it('answers no-settings when settings are absent', () => {
+    expect(getSyncKey(null)).toBe('no-settings')
+    expect(getSyncKey(undefined)).toBe('no-settings')
+  })
+
+  it('recomputes for a new settings identity', () => {
+    const first = getSyncKey(makeSettings())
+    const second = getSyncKey(
+      makeSettings({
+        claudeManagedAccounts: [{ id: 'a1', updatedAt: 6 }],
+        codexManagedAccounts: [{ id: 'c1', updatedAt: 8 }]
+      } as unknown as Partial<GlobalSettings>)
+    )
+    expect(second).not.toBe(first)
+  })
+})
diff --git a/src/renderer/src/components/status-bar/provider-account-sync-key.ts b/src/renderer/src/components/status-bar/provider-account-sync-key.ts
new file mode 100644
index 00000000000..acc8e3e9867
--- /dev/null
+++ b/src/renderer/src/components/status-bar/provider-account-sync-key.ts
@@ -0,0 +1,42 @@
+import type { GlobalSettings } from '../../../../shared/global-settings-types'
+
+// Why memoized on settings identity: these run inside useAppStore selectors, which Zustand re-runs
+// on every store write. Building the key stringifies a map and joins the whole managed-account
+// roster, and its inputs only move when `settings` is replaced.
+const claudeKeyBySettings = new WeakMap<GlobalSettings, string>()
+const codexKeyBySettings = new WeakMap<GlobalSettings, string>()
+
+function memoizeSyncKey(
+  cache: WeakMap<GlobalSettings, string>,
+  settings: GlobalSettings | null | undefined,
+  build: (settings: GlobalSettings) => string
+): string {
+  if (!settings) {
+    return 'no-settings'
+  }
+  const cached = cache.get(settings)
+  if (cached !== undefined) {
+    return cached
+  }
+  const key = build(settings)
+  cache.set(settings, key)
+  return key
+}
+
+export function getClaudeAccountSyncKey(settings: GlobalSettings | null | undefined): string {
+  return memoizeSyncKey(
+    claudeKeyBySettings,
+    settings,
+    (resolved) =>
+      `${resolved.activeRuntimeEnvironmentId?.trim() || 'local'}:${resolved.activeClaudeManagedAccountId ?? 'system'}:${JSON.stringify(resolved.activeClaudeManagedAccountIdsByRuntime ?? null)}:${resolved.claudeManagedAccounts.map((account) => `${account.id}:${account.updatedAt}`).join('|')}`
+  )
+}
+
+export function getCodexAccountSyncKey(settings: GlobalSettings | null | undefined): string {
+  return memoizeSyncKey(
+    codexKeyBySettings,
+    settings,
+    (resolved) =>
+      `${resolved.activeRuntimeEnvironmentId?.trim() || 'local'}:${resolved.activeCodexManagedAccountId ?? 'system'}:${JSON.stringify(resolved.activeCodexManagedAccountIdsByRuntime ?? null)}:${resolved.codexManagedAccounts.map((account) => `${account.id}:${account.updatedAt}`).join('|')}`
+  )
+}
diff --git a/src/renderer/src/components/tab-bar/BrowserTab.tsx b/src/renderer/src/components/tab-bar/BrowserTab.tsx
index b72f27287f9..3b716c3bd51 100644
--- a/src/renderer/src/components/tab-bar/BrowserTab.tsx
+++ b/src/renderer/src/components/tab-bar/BrowserTab.tsx
@@ -191,14 +191,12 @@ export default function BrowserTab({
           muted-foreground made the icon read as "disabled" in practice. */}
       <BrowserFavicon
         faviconUrl={tab.faviconUrl}
+        loading={tab.loading && !tab.loadError && !isBlankBrowserTab(tab)}
         className="size-3 mr-1"
         fallbackClassName="text-blue-500"
       />
       {isPinned && <Pin className="mr-1 size-3 shrink-0 text-muted-foreground" aria-hidden />}
       <span className={`${TAB_LABEL_WIDTH_CLASSES} mr-1`}>{tabLabel}</span>
-      {tab.loading && !tab.loadError && !isBlankBrowserTab(tab) && (
-        <span className="mr-1 size-1.5 rounded-full bg-sky-500/80 shrink-0" />
-      )}
       {!isPinned && (
         <button
           className={`flex items-center justify-center w-4 h-4 rounded-sm shrink-0 ${
diff --git a/src/renderer/src/components/tab-bar/ClientHostedBrowserTab.tsx b/src/renderer/src/components/tab-bar/ClientHostedBrowserTab.tsx
index 1ca91557b0e..2b21260fb5e 100644
--- a/src/renderer/src/components/tab-bar/ClientHostedBrowserTab.tsx
+++ b/src/renderer/src/components/tab-bar/ClientHostedBrowserTab.tsx
@@ -1,4 +1,4 @@
-import { Laptop, X } from 'lucide-react'
+import { Laptop, Loader2, X } from 'lucide-react'
 import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip'
 import { translate } from '@/i18n/i18n'
 import type { ClientHostedBrowserRow } from '../../../../shared/client-hosted-browser-rows'
@@ -36,6 +36,8 @@ export default function ClientHostedBrowserTab({
   onClose: () => void
   includeTopTabBorder?: boolean
 }): React.JSX.Element {
+  const loading = row.loading && !row.hostAbsent
+  const PageIcon = loading ? Loader2 : Laptop
   const label = getClientHostedBrowserRowLabel(row)
   const hostDescription = describeClientHostedBrowserRowHost(row)
 
@@ -62,8 +64,8 @@ export default function ClientHostedBrowserTab({
             }}
           >
             {isActive && <span className={ACTIVE_TAB_INDICATOR_CLASSES} aria-hidden />}
-            <Laptop
-              className={`mr-1 size-3 shrink-0 ${row.hostAbsent ? 'text-muted-foreground' : 'text-blue-500'}`}
+            <PageIcon
+              className={`mr-1 size-3 shrink-0 ${loading ? 'motion-safe:animate-spin' : ''} ${row.hostAbsent ? 'text-muted-foreground' : 'text-blue-500'}`}
               aria-hidden
             />
             <span
@@ -71,9 +73,6 @@ export default function ClientHostedBrowserTab({
             >
               {label}
             </span>
-            {row.loading && (
-              <span className="mr-1 size-1.5 shrink-0 rounded-full bg-sky-500/80" aria-hidden />
-            )}
             <button
               type="button"
               aria-label={translate('browser.clientHosted.hostRowClose', 'Close hosted page')}
diff --git a/src/renderer/src/components/tab-bar/QuickLaunchButton.tsx b/src/renderer/src/components/tab-bar/QuickLaunchButton.tsx
index 85d978e3bf6..6d5b523c2af 100644
--- a/src/renderer/src/components/tab-bar/QuickLaunchButton.tsx
+++ b/src/renderer/src/components/tab-bar/QuickLaunchButton.tsx
@@ -8,6 +8,7 @@ import { useAgentDetectionTargetForWorktree } from '@/hooks/useAgentDetectionTar
 import { useDetectedAgents } from '@/hooks/useDetectedAgents'
 import { useOptionalShortcutLabel } from '@/hooks/useShortcutLabel'
 import { launchAgentInNewTab } from '@/lib/launch-agent-in-new-tab'
+import { isAgentSessionHandleProvider } from '../../../../shared/agent-session-provider-handle'
 import type { TuiAgent } from '../../../../shared/tui-agent'
 import type { LaunchSource } from '../../../../shared/telemetry-events'
 import {
@@ -15,7 +16,7 @@ import {
   filterEnabledTuiAgents
 } from '../../../../shared/tui-agent-selection'
 import { translate } from '@/i18n/i18n'
-import { useStructuredCodexLaunchStatus } from '@/lib/structured-agent-session-launch'
+import { useStructuredAgentLaunchStatus } from '@/lib/structured-agent-session-launch'
 
 export type QuickLaunchAgentMenuItemsProps = {
   worktreeId: string
@@ -117,7 +118,12 @@ function QuickLaunchAgentMenuItemsInner({
   const openSettingsPage = useAppStore((s) => s.openSettingsPage)
   const openSettingsTarget = useAppStore((s) => s.openSettingsTarget)
   const newAgentShortcut = useOptionalShortcutLabel('tab.newAgent')
-  const structuredCodexLaunchStatus = useStructuredCodexLaunchStatus(worktreeId)
+  // One hook per structured provider: the launch registry is keyed by agent, and hooks cannot run
+  // inside the agent list's render loop.
+  const structuredLaunchStatusByAgent = {
+    claude: useStructuredAgentLaunchStatus(worktreeId, 'claude'),
+    codex: useStructuredAgentLaunchStatus(worktreeId, 'codex')
+  }
 
   const openAgentSettings = useCallback(() => {
     openSettingsTarget({ pane: 'agents', repoId: null })
@@ -199,26 +205,33 @@ function QuickLaunchAgentMenuItemsInner({
       {agents.map((agent) => {
         const entry = getCatalogEntry(agent)
         const label = entry?.label ?? agent
-        const isStructuredCodexPending =
-          agent === 'codex' && structuredCodexLaunchStatus === 'pending'
-        const menuLabel = isStructuredCodexPending ? 'Starting Codex chat…' : label
+        const isStructuredLaunchPending =
+          isAgentSessionHandleProvider(agent) && structuredLaunchStatusByAgent[agent] === 'pending'
+        const pendingLabel = translate(
+          'components.native-chat.structuredSessionLaunchPending',
+          'Starting {{value0}} chat…',
+          { value0: label }
+        )
+        const menuLabel = isStructuredLaunchPending ? pendingLabel : label
         const showsDefaultAgentShortcut =
           newAgentShortcut !== null && defaultAgent !== 'blank' && agent === defaultAgent
         return (
           <DropdownMenuItem
             key={agent}
-            disabled={isStructuredCodexPending}
+            disabled={isStructuredLaunchPending}
             onSelect={() => runLaunch(agent)}
             className="gap-2 rounded-[7px] px-2 py-1.5 text-[12px] leading-5 font-medium"
-            title={translate(
-              'auto.components.tab.bar.QuickLaunchButton.ec2adf093e',
-              isStructuredCodexPending
-                ? 'Starting Codex chat…'
-                : 'Launch {{value0}} in a new terminal',
-              isStructuredCodexPending ? undefined : { value0: label }
-            )}
+            title={
+              isStructuredLaunchPending
+                ? pendingLabel
+                : translate(
+                    'auto.components.tab.bar.QuickLaunchButton.ec2adf093e',
+                    'Launch {{value0}} in a new terminal',
+                    { value0: label }
+                  )
+            }
           >
-            {isStructuredCodexPending ? (
+            {isStructuredLaunchPending ? (
               <Loader2 className="size-3.5 shrink-0 animate-spin" aria-hidden="true" />
             ) : (
               <AgentIcon agent={agent} size={14} />
diff --git a/src/renderer/src/components/tab-bar/SortableTab.tsx b/src/renderer/src/components/tab-bar/SortableTab.tsx
index 8e793f96773..c138e36bd6e 100644
--- a/src/renderer/src/components/tab-bar/SortableTab.tsx
+++ b/src/renderer/src/components/tab-bar/SortableTab.tsx
@@ -58,6 +58,7 @@ type SortableTabProps = {
   isChatView?: boolean
   /** Toggle the tab between terminal and native chat view. */
   onToggleViewMode?: () => void
+  canSplitTerminal?: boolean
 }
 
 export const CLOSE_ALL_CONTEXT_MENUS_EVENT = 'orca-close-all-context-menus'
@@ -86,7 +87,8 @@ export default function SortableTab({
   includeTopTabBorder = true,
   canToggleViewMode = false,
   isChatView = false,
-  onToggleViewMode
+  onToggleViewMode,
+  canSplitTerminal = true
 }: SortableTabProps): React.JSX.Element {
   // Why: agent-completion unread exists even with terminal-attention off; collapse both sources to one primitive so unrelated tabs don't re-render.
   const hasUnreadActivity = useAppStore((s) =>
@@ -399,6 +401,7 @@ export default function SortableTab({
         canToggleViewMode={canToggleViewMode}
         isChatView={isChatView}
         onToggleViewMode={onToggleViewMode}
+        canSplitTerminal={canSplitTerminal}
       />
     </>
   )
diff --git a/src/renderer/src/components/tab-bar/SortableTabContextMenu.test.tsx b/src/renderer/src/components/tab-bar/SortableTabContextMenu.test.tsx
index 9d3e506e3f1..c01b028ecb4 100644
--- a/src/renderer/src/components/tab-bar/SortableTabContextMenu.test.tsx
+++ b/src/renderer/src/components/tab-bar/SortableTabContextMenu.test.tsx
@@ -250,6 +250,13 @@ describe('SortableTabContextMenu', () => {
     })
   })
 
+  it('hides terminal-only split actions for structured chat tabs', () => {
+    const { container } = renderMenu({ canSplitTerminal: false })
+
+    expect(container.textContent).toContain('Move Tab to Split')
+    expect(container.textContent).not.toContain('Split terminal')
+  })
+
   it('routes the directional close actions to their handlers with the tab id', () => {
     const onCloseOthers = vi.fn()
     const onCloseToRight = vi.fn()
diff --git a/src/renderer/src/components/tab-bar/SortableTabContextMenu.tsx b/src/renderer/src/components/tab-bar/SortableTabContextMenu.tsx
index 5b6caaecb55..1d66f143210 100644
--- a/src/renderer/src/components/tab-bar/SortableTabContextMenu.tsx
+++ b/src/renderer/src/components/tab-bar/SortableTabContextMenu.tsx
@@ -116,6 +116,7 @@ type SortableTabContextMenuProps = {
   isChatView?: boolean
   /** Toggle the tab between terminal and native chat view. */
   onToggleViewMode?: () => void
+  canSplitTerminal?: boolean
 }
 
 export function SortableTabContextMenu({
@@ -140,7 +141,8 @@ export function SortableTabContextMenu({
   onTogglePin,
   canToggleViewMode = false,
   isChatView = false,
-  onToggleViewMode
+  onToggleViewMode,
+  canSplitTerminal = true
 }: SortableTabContextMenuProps): React.JSX.Element {
   const keybindings = useAppStore((state) => state.keybindings)
   const splitRightShortcut = formatShortcutLabel('terminal.splitRight', keybindings)
@@ -168,6 +170,7 @@ export function SortableTabContextMenu({
           onActivate={onActivate}
           splitRightShortcut={splitRightShortcut}
           splitDownShortcut={splitDownShortcut}
+          showTerminalSplit={canSplitTerminal}
         />
         {canToggleViewMode && onToggleViewMode ? (
           <>
diff --git a/src/renderer/src/components/tab-bar/TabBarCreateEntry.keyboard.test.tsx b/src/renderer/src/components/tab-bar/TabBarCreateEntry.keyboard.test.tsx
index 88dd5ed32aa..8eab22f3c8c 100644
--- a/src/renderer/src/components/tab-bar/TabBarCreateEntry.keyboard.test.tsx
+++ b/src/renderer/src/components/tab-bar/TabBarCreateEntry.keyboard.test.tsx
@@ -39,7 +39,7 @@ vi.mock('@/lib/agent-catalog', () => ({
   AgentIcon: () => null
 }))
 vi.mock('@/lib/structured-agent-session-launch', () => ({
-  useStructuredCodexLaunchStatus: () => structuredLaunchMock.status
+  useStructuredAgentLaunchStatus: () => structuredLaunchMock.status
 }))
 
 import TabBarCreateEntry from './TabBarCreateEntry'
diff --git a/src/renderer/src/components/tab-bar/TabBarCreateEntry.tsx b/src/renderer/src/components/tab-bar/TabBarCreateEntry.tsx
index 3aa1755de51..5c39d07bf84 100644
--- a/src/renderer/src/components/tab-bar/TabBarCreateEntry.tsx
+++ b/src/renderer/src/components/tab-bar/TabBarCreateEntry.tsx
@@ -33,7 +33,10 @@ import {
   getTabEntryOmniboxPlaceholder
 } from './tab-create-entry-copy'
 import { EMPTY_AGENT_OPTIONS, EMPTY_MENU_OPTIONS } from './tab-create-entry-empty-options'
-import { useStructuredCodexLaunchStatus } from '@/lib/structured-agent-session-launch'
+import { useStructuredAgentLaunchStatus } from '@/lib/structured-agent-session-launch'
+import { isAgentSessionHandleProvider } from '../../../../shared/agent-session-provider-handle'
+import type { TuiAgent } from '../../../../shared/tui-agent'
+import { translate } from '@/i18n/i18n'
 import type { TabEntryActionClassification } from './tab-create-entry-classifier'
 import type { TabBarCreateEntryProps } from './tab-create-entry-props'
 
@@ -60,7 +63,14 @@ function TabBarCreateEntrySession({
   const [error, setError] = useState<string | null>(null)
   const [switchError, setSwitchError] = useState<string | null>(null)
   const [selectionGuidance, setSelectionGuidance] = useState<string | null>(null)
-  const structuredCodexLaunchStatus = useStructuredCodexLaunchStatus(worktreeId)
+  // One hook per structured provider: the launch registry is keyed by agent, and hooks cannot run
+  // inside the option render loop.
+  const structuredLaunchStatusByAgent = {
+    claude: useStructuredAgentLaunchStatus(worktreeId, 'claude'),
+    codex: useStructuredAgentLaunchStatus(worktreeId, 'codex')
+  }
+  const isStructuredLaunchPending = (agent: TuiAgent): boolean =>
+    isAgentSessionHandleProvider(agent) && structuredLaunchStatusByAgent[agent] === 'pending'
   // null = follow ranking (deferred tabs can prepend); set on arrow keys only.
   const [pinnedOptionId, setPinnedOptionId] = useState<string | null>(null)
   const inputRef = useRef<HTMLInputElement>(null)
@@ -228,7 +238,7 @@ function TabBarCreateEntrySession({
       return
     }
     if (selectedOption.kind === 'agent') {
-      if (selectedOption.option.agent === 'codex' && structuredCodexLaunchStatus === 'pending') {
+      if (isStructuredLaunchPending(selectedOption.option.agent)) {
         return
       }
       onLaunchAgent?.(selectedOption.option.agent)
@@ -380,24 +390,22 @@ function TabBarCreateEntrySession({
                 option={option}
                 selected={index === activeSelectedIndex}
                 labelOverride={
-                  option.kind === 'agent' &&
-                  option.option.agent === 'codex' &&
-                  structuredCodexLaunchStatus === 'pending'
-                    ? 'Starting Codex chat…'
+                  option.kind === 'agent' && isStructuredLaunchPending(option.option.agent)
+                    ? translate(
+                        'components.native-chat.structuredSessionLaunchPending',
+                        'Starting {{value0}} chat…',
+                        { value0: option.option.label }
+                      )
                     : undefined
                 }
                 disabled={
                   disabled ||
                   pending ||
-                  (option.kind === 'agent' &&
-                    option.option.agent === 'codex' &&
-                    structuredCodexLaunchStatus === 'pending')
+                  (option.kind === 'agent' && isStructuredLaunchPending(option.option.agent))
                 }
                 loading={
                   (pending && index === activeSelectedIndex) ||
-                  (option.kind === 'agent' &&
-                    option.option.agent === 'codex' &&
-                    structuredCodexLaunchStatus === 'pending')
+                  (option.kind === 'agent' && isStructuredLaunchPending(option.option.agent))
                 }
                 onClick={() => {
                   setSelectionGuidance(null)
diff --git a/src/renderer/src/components/tab-bar/TabStripScrollIndicator.test.tsx b/src/renderer/src/components/tab-bar/TabStripScrollIndicator.test.tsx
new file mode 100644
index 00000000000..2ce81fdb7f6
--- /dev/null
+++ b/src/renderer/src/components/tab-bar/TabStripScrollIndicator.test.tsx
@@ -0,0 +1,223 @@
+// @vitest-environment happy-dom
+
+import React, { createRef } from 'react'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { cleanup, fireEvent, render } from '@testing-library/react'
+import { TabStripScrollIndicator } from './TabStripScrollIndicator'
+import type { TabStripScrollMetrics } from './tab-strip-scroll-metrics'
+
+afterEach(() => {
+  cleanup()
+  vi.restoreAllMocks()
+})
+
+const OVERFLOW_METRICS: TabStripScrollMetrics = {
+  hasOverflow: true,
+  canScrollStart: false,
+  canScrollEnd: true,
+  thumbSizeFraction: 0.4,
+  thumbOffsetFraction: 0
+}
+
+const NO_OVERFLOW_METRICS: TabStripScrollMetrics = {
+  hasOverflow: false,
+  canScrollStart: false,
+  canScrollEnd: false,
+  thumbSizeFraction: 1,
+  thumbOffsetFraction: 0
+}
+
+describe('TabStripScrollIndicator', () => {
+  it('renders null when there is no overflow', () => {
+    const { container } = render(<TabStripScrollIndicator metrics={NO_OVERFLOW_METRICS} />)
+    expect(container.firstChild).toBeNull()
+  })
+
+  it('renders under the tabs with bottom-0 and idle 2px height', () => {
+    const { getByTestId } = render(<TabStripScrollIndicator metrics={OVERFLOW_METRICS} />)
+    const indicator = getByTestId('tab-strip-scroll-indicator')
+    expect(indicator).toBeTruthy()
+    expect(indicator.className).toContain('bottom-0')
+    expect(indicator.className).toContain('h-[2px]')
+    expect(indicator.className).toContain('z-[12]')
+    expect(indicator.className).toContain('opacity-0')
+    expect(indicator.className).toContain('group-hover/tab-strip:opacity-100')
+
+    const thumb = getByTestId('tab-strip-scroll-thumb')
+    expect(thumb).toBeTruthy()
+  })
+
+  it('expands to 3px and becomes opaque on pointer hover, restores on leave', () => {
+    const { getByTestId } = render(<TabStripScrollIndicator metrics={OVERFLOW_METRICS} />)
+    const indicator = getByTestId('tab-strip-scroll-indicator')
+    expect(indicator.className).toContain('h-[2px]')
+    expect(indicator.className).toContain('opacity-0')
+
+    fireEvent.pointerEnter(indicator)
+    expect(indicator.className).toContain('h-[3px]')
+    expect(indicator.className).toContain('opacity-100')
+
+    fireEvent.pointerLeave(indicator)
+    expect(indicator.className).toContain('h-[2px]')
+    expect(indicator.className).toContain('opacity-0')
+  })
+
+  it('applies pointer-events-none when disabled', () => {
+    const { getByTestId } = render(
+      <TabStripScrollIndicator metrics={OVERFLOW_METRICS} disabled={true} />
+    )
+    const indicator = getByTestId('tab-strip-scroll-indicator')
+    expect(indicator.className).toContain('pointer-events-none')
+    expect(indicator.className).not.toContain('group-hover/tab-strip:pointer-events-auto')
+  })
+
+  it('stays hidden and unexpanded on hover when disabled', () => {
+    const { getByTestId } = render(
+      <TabStripScrollIndicator metrics={OVERFLOW_METRICS} disabled={true} />
+    )
+    const indicator = getByTestId('tab-strip-scroll-indicator')
+    fireEvent.pointerEnter(indicator)
+    expect(indicator.className).toContain('opacity-0')
+    expect(indicator.className).not.toContain('opacity-100')
+    expect(indicator.className).toContain('h-[2px]')
+  })
+
+  it('does not forward wheel events when disabled', () => {
+    const scrollContainer = document.createElement('div')
+    scrollContainer.scrollLeft = 0
+    const scrollContainerRef = createRef<HTMLElement>()
+    ;(scrollContainerRef as React.MutableRefObject<HTMLElement>).current = scrollContainer
+
+    const { getByTestId } = render(
+      <TabStripScrollIndicator
+        metrics={OVERFLOW_METRICS}
+        scrollContainerRef={scrollContainerRef}
+        disabled={true}
+      />
+    )
+    fireEvent.wheel(getByTestId('tab-strip-scroll-indicator'), { deltaX: 40, deltaY: 0 })
+
+    expect(scrollContainer.scrollLeft).toBe(0)
+  })
+
+  it('forwards wheel events to scrollContainer', () => {
+    const scrollContainer = document.createElement('div')
+    scrollContainer.scrollLeft = 0
+    const scrollContainerRef = createRef<HTMLElement>()
+    ;(scrollContainerRef as React.MutableRefObject<HTMLElement>).current = scrollContainer
+
+    const { getByTestId } = render(
+      <TabStripScrollIndicator metrics={OVERFLOW_METRICS} scrollContainerRef={scrollContainerRef} />
+    )
+    const indicator = getByTestId('tab-strip-scroll-indicator')
+    fireEvent.wheel(indicator, { deltaX: 40, deltaY: 0 })
+
+    expect(scrollContainer.scrollLeft).toBe(40)
+  })
+
+  it('handles track click and smooth scrolls container', () => {
+    const scrollContainer = document.createElement('div')
+    Object.defineProperty(scrollContainer, 'scrollWidth', { value: 1000, configurable: true })
+    Object.defineProperty(scrollContainer, 'clientWidth', { value: 400, configurable: true })
+    scrollContainer.scrollLeft = 0
+    const scrollToMock = vi.fn()
+    scrollContainer.scrollTo = scrollToMock
+
+    const scrollContainerRef = createRef<HTMLElement>()
+    ;(scrollContainerRef as React.MutableRefObject<HTMLElement>).current = scrollContainer
+
+    const { getByTestId } = render(
+      <TabStripScrollIndicator metrics={OVERFLOW_METRICS} scrollContainerRef={scrollContainerRef} />
+    )
+    const indicator = getByTestId('tab-strip-scroll-indicator')
+    Object.defineProperty(indicator, 'clientWidth', { value: 400, configurable: true })
+    vi.spyOn(indicator, 'getBoundingClientRect').mockReturnValue({
+      left: 100,
+      right: 500,
+      top: 30,
+      bottom: 33,
+      width: 400,
+      height: 3,
+      x: 100,
+      y: 30,
+      toJSON: () => {}
+    } as DOMRect)
+
+    // Click track at clientX = 300 (offset 200 within 400px track)
+    fireEvent.pointerDown(indicator, { button: 0, clientX: 300 })
+    expect(scrollToMock).toHaveBeenCalledTimes(1)
+    expect(scrollToMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        behavior: 'smooth'
+      })
+    )
+  })
+
+  it('scrolls container when dragging thumb', () => {
+    const scrollContainer = document.createElement('div')
+    Object.defineProperty(scrollContainer, 'scrollWidth', { value: 1000, configurable: true })
+    Object.defineProperty(scrollContainer, 'clientWidth', { value: 400, configurable: true })
+    scrollContainer.scrollLeft = 0
+
+    const scrollContainerRef = createRef<HTMLElement>()
+    ;(scrollContainerRef as React.MutableRefObject<HTMLElement>).current = scrollContainer
+
+    const { getByTestId } = render(
+      <TabStripScrollIndicator
+        metrics={{
+          ...OVERFLOW_METRICS,
+          thumbSizeFraction: 0.4
+        }}
+        scrollContainerRef={scrollContainerRef}
+      />
+    )
+    const indicator = getByTestId('tab-strip-scroll-indicator')
+    Object.defineProperty(indicator, 'clientWidth', { value: 400, configurable: true })
+    const thumb = getByTestId('tab-strip-scroll-thumb')
+
+    // Start drag on thumb
+    fireEvent.pointerDown(thumb, { button: 0, clientX: 50 })
+    expect(indicator.className).toContain('h-[3px]')
+
+    // Move pointer by 60px
+    fireEvent(window, new MouseEvent('pointermove', { clientX: 110 }))
+    expect(scrollContainer.scrollLeft).toBeGreaterThan(0)
+
+    // Release drag
+    fireEvent(window, new MouseEvent('pointerup'))
+    expect(indicator.className).toContain('h-[2px]')
+  })
+
+  it('cancels an active thumb drag when it becomes disabled', () => {
+    const scrollContainer = document.createElement('div')
+    Object.defineProperty(scrollContainer, 'scrollWidth', { value: 1000, configurable: true })
+    Object.defineProperty(scrollContainer, 'clientWidth', { value: 400, configurable: true })
+    scrollContainer.scrollLeft = 0
+
+    const scrollContainerRef = createRef<HTMLElement>()
+    ;(scrollContainerRef as React.MutableRefObject<HTMLElement>).current = scrollContainer
+
+    const { getByTestId, rerender } = render(
+      <TabStripScrollIndicator metrics={OVERFLOW_METRICS} scrollContainerRef={scrollContainerRef} />
+    )
+    const indicator = getByTestId('tab-strip-scroll-indicator')
+    Object.defineProperty(indicator, 'clientWidth', { value: 400, configurable: true })
+
+    fireEvent.pointerDown(getByTestId('tab-strip-scroll-thumb'), { button: 0, clientX: 50 })
+    expect(document.body.style.userSelect).toBe('none')
+
+    rerender(
+      <TabStripScrollIndicator
+        metrics={OVERFLOW_METRICS}
+        scrollContainerRef={scrollContainerRef}
+        disabled={true}
+      />
+    )
+
+    expect(document.body.style.userSelect).toBe('')
+    expect(document.body.style.cursor).toBe('')
+
+    fireEvent(window, new MouseEvent('pointermove', { clientX: 300 }))
+    expect(scrollContainer.scrollLeft).toBe(0)
+  })
+})
diff --git a/src/renderer/src/components/tab-bar/TabStripScrollIndicator.tsx b/src/renderer/src/components/tab-bar/TabStripScrollIndicator.tsx
index 42cecfcb942..c800d51ad2f 100644
--- a/src/renderer/src/components/tab-bar/TabStripScrollIndicator.tsx
+++ b/src/renderer/src/components/tab-bar/TabStripScrollIndicator.tsx
@@ -1,4 +1,4 @@
-import React, { useCallback, useLayoutEffect, useRef, useState } from 'react'
+import React, { useCallback, useEffect, useLayoutEffect, useRef, useState } from 'react'
 import {
   computeTabStripThumbLayout,
   type TabStripScrollMetrics,
@@ -7,13 +7,24 @@ import {
 
 const EMPTY_THUMB_LAYOUT: TabStripThumbLayout = { widthPx: 0, leftPx: 0 }
 
-export function TabStripScrollIndicator({
-  metrics
-}: {
+export type TabStripScrollIndicatorProps = {
   metrics: TabStripScrollMetrics
-}): React.JSX.Element | null {
+  scrollContainerRef?: React.RefObject<HTMLElement | null>
+  disabled?: boolean
+}
+
+export function TabStripScrollIndicator({
+  metrics,
+  scrollContainerRef,
+  disabled = false
+}: TabStripScrollIndicatorProps): React.JSX.Element | null {
   const trackRef = useRef<HTMLDivElement>(null)
+  const cleanupDragRef = useRef<(() => void) | null>(null)
   const [thumbLayout, setThumbLayout] = useState<TabStripThumbLayout>(EMPTY_THUMB_LAYOUT)
+  const [isHovered, setIsHovered] = useState(false)
+  const [isDragging, setIsDragging] = useState(false)
+  const [isScrolling, setIsScrolling] = useState(false)
+  const scrollTimeoutRef = useRef<ReturnType<typeof setTimeout> | null>(null)
 
   const remeasureThumb = useCallback((): void => {
     const track = trackRef.current
@@ -37,23 +48,185 @@ export function TabStripScrollIndicator({
     return () => resizeObserver.disconnect()
   }, [remeasureThumb])
 
+  useEffect(() => {
+    const scrollContainer = scrollContainerRef?.current
+    if (!scrollContainer) {
+      return
+    }
+    const handleScroll = (): void => {
+      setIsScrolling(true)
+      if (scrollTimeoutRef.current) {
+        clearTimeout(scrollTimeoutRef.current)
+      }
+      scrollTimeoutRef.current = setTimeout(() => {
+        setIsScrolling(false)
+      }, 800)
+    }
+    scrollContainer.addEventListener('scroll', handleScroll, { passive: true })
+    return () => {
+      scrollContainer.removeEventListener('scroll', handleScroll)
+      if (scrollTimeoutRef.current) {
+        clearTimeout(scrollTimeoutRef.current)
+      }
+    }
+  }, [scrollContainerRef])
+
+  useEffect(() => {
+    return () => {
+      cleanupDragRef.current?.()
+    }
+  }, [])
+
+  // Why: hiding the indicator mid-drag would otherwise leave window listeners and body cursor/user-select stuck.
+  useEffect(() => {
+    if (disabled || !metrics.hasOverflow) {
+      cleanupDragRef.current?.()
+    }
+  }, [disabled, metrics.hasOverflow])
+
+  const handleThumbPointerDown = (e: React.PointerEvent<HTMLDivElement>): void => {
+    if (e.button !== 0 || disabled) {
+      return
+    }
+    e.preventDefault()
+    e.stopPropagation()
+
+    const scrollContainer = scrollContainerRef?.current
+    const track = trackRef.current
+    if (!scrollContainer || !track) {
+      return
+    }
+
+    const startX = e.clientX
+    const startScrollLeft = scrollContainer.scrollLeft
+    const trackWidth = track.clientWidth
+    const maxLeft = Math.max(1, trackWidth - thumbLayout.widthPx)
+    const maxScrollLeft = Math.max(0, scrollContainer.scrollWidth - scrollContainer.clientWidth)
+
+    if (maxScrollLeft <= 0 || maxLeft <= 0) {
+      return
+    }
+
+    setIsDragging(true)
+    const prevUserSelect = document.body.style.userSelect
+    const prevCursor = document.body.style.cursor
+    document.body.style.userSelect = 'none'
+    document.body.style.cursor = 'grabbing'
+
+    const onPointerMove = (moveEvent: PointerEvent): void => {
+      const deltaX = moveEvent.clientX - startX
+      const scrollDelta = (deltaX / maxLeft) * maxScrollLeft
+      scrollContainer.scrollLeft = Math.max(
+        0,
+        Math.min(maxScrollLeft, startScrollLeft + scrollDelta)
+      )
+    }
+
+    const cleanup = (): void => {
+      setIsDragging(false)
+      document.body.style.userSelect = prevUserSelect
+      document.body.style.cursor = prevCursor
+      window.removeEventListener('pointermove', onPointerMove)
+      window.removeEventListener('pointerup', cleanup)
+      window.removeEventListener('pointercancel', cleanup)
+      cleanupDragRef.current = null
+    }
+
+    cleanupDragRef.current = cleanup
+    window.addEventListener('pointermove', onPointerMove)
+    window.addEventListener('pointerup', cleanup)
+    window.addEventListener('pointercancel', cleanup)
+  }
+
+  const handleTrackPointerDown = (e: React.PointerEvent<HTMLDivElement>): void => {
+    if (e.button !== 0 || disabled) {
+      return
+    }
+    if (e.target !== trackRef.current) {
+      return
+    }
+    e.preventDefault()
+    e.stopPropagation()
+
+    const scrollContainer = scrollContainerRef?.current
+    const track = trackRef.current
+    if (!scrollContainer || !track) {
+      return
+    }
+
+    const trackRect = track.getBoundingClientRect()
+    const clickX = e.clientX - trackRect.left
+    const trackWidth = track.clientWidth
+    const thumbWidth = thumbLayout.widthPx
+    const maxLeft = Math.max(1, trackWidth - thumbWidth)
+    const maxScrollLeft = Math.max(0, scrollContainer.scrollWidth - scrollContainer.clientWidth)
+
+    if (maxScrollLeft <= 0 || maxLeft <= 0) {
+      return
+    }
+
+    const targetThumbLeft = Math.max(0, Math.min(maxLeft, clickX - thumbWidth / 2))
+    const targetScrollLeft = (targetThumbLeft / maxLeft) * maxScrollLeft
+
+    scrollContainer.scrollTo({
+      left: targetScrollLeft,
+      behavior: 'smooth'
+    })
+  }
+
+  const handleWheel = (e: React.WheelEvent<HTMLDivElement>): void => {
+    const scrollContainer = scrollContainerRef?.current
+    if (!scrollContainer || disabled) {
+      return
+    }
+    // Why: forward wheel events to tab container so scrolling over the indicator scrolls the strip.
+    const delta = Math.abs(e.deltaX) > Math.abs(e.deltaY) ? e.deltaX : e.deltaY
+    scrollContainer.scrollLeft += delta
+  }
+
   if (!metrics.hasOverflow) {
     return null
   }
 
+  // Why: during a tab drag the indicator fully yields — no reveal, no pointer/wheel interaction.
+  const isExpanded = !disabled && (isHovered || isDragging)
+  const isVisible = !disabled && (isHovered || isDragging || isScrolling)
+
   return (
-    // Why: top rail keeps the active tab's bottom underline unobstructed.
+    // Why: under-tab position matches editor tab scrollbar conventions, auto-hiding when idle so it never mimics an underline.
     <div
       ref={trackRef}
-      className="pointer-events-none absolute inset-x-0 top-0 z-[1] h-px bg-muted-foreground/10"
+      data-testid="tab-strip-scroll-indicator"
+      className={`absolute inset-x-0 bottom-0 z-[12] select-none transition-[height,background-color,opacity] duration-150 ease-out ${
+        isExpanded ? 'h-[3px] bg-muted-foreground/10 cursor-pointer' : 'h-[2px] bg-transparent'
+      } ${
+        disabled
+          ? 'opacity-0 pointer-events-none'
+          : isVisible
+            ? 'opacity-100 pointer-events-auto'
+            : 'opacity-0 group-hover/tab-strip:opacity-100 pointer-events-none group-hover/tab-strip:pointer-events-auto'
+      }`}
+      onPointerEnter={() => setIsHovered(true)}
+      onPointerLeave={() => setIsHovered(false)}
+      onPointerDown={handleTrackPointerDown}
+      onWheel={handleWheel}
+      // Why: decorative rail — keyboard/AT users scroll the strip with the adjacent labelled scroll buttons.
       aria-hidden
     >
       <div
-        className="absolute top-0 h-full rounded-full bg-muted-foreground/40 transition-[left,width] duration-75 ease-out"
+        data-testid="tab-strip-scroll-thumb"
+        className={`absolute bottom-0 h-full rounded-full transition-colors duration-150 ease-out ${
+          isDragging
+            ? 'bg-foreground/40 cursor-grabbing'
+            : isHovered
+              ? 'bg-muted-foreground/50 cursor-grab'
+              : 'bg-muted-foreground/25 cursor-default'
+        }`}
         style={{
           width: `${thumbLayout.widthPx}px`,
           left: `${thumbLayout.leftPx}px`
         }}
+        onPointerDown={handleThumbPointerDown}
       />
     </div>
   )
diff --git a/src/renderer/src/components/tab-bar/TabWorkspaceLayoutMenuSection.tsx b/src/renderer/src/components/tab-bar/TabWorkspaceLayoutMenuSection.tsx
index faa784240b7..34ad57b1d62 100644
--- a/src/renderer/src/components/tab-bar/TabWorkspaceLayoutMenuSection.tsx
+++ b/src/renderer/src/components/tab-bar/TabWorkspaceLayoutMenuSection.tsx
@@ -3,7 +3,8 @@ import {
   DropdownMenuSub,
   DropdownMenuSubContent,
   DropdownMenuSubTrigger,
-  DropdownMenuItem
+  DropdownMenuItem,
+  DropdownMenuShortcut
 } from '@/components/ui/dropdown-menu'
 import { ArrowDown, ArrowLeft, ArrowRight, ArrowUp, Columns2 } from 'lucide-react'
 import type { TabSplitDirection } from '../../store/slices/tabs'
@@ -42,11 +43,15 @@ function paneColumnDirectionLabel(direction: TabSplitDirection): string {
 export function TabWorkspaceLayoutMenuSection({
   unifiedTabId,
   groupId,
-  trailingSeparator = false
+  leadingSeparator = false,
+  trailingSeparator = false,
+  shortcutLabels
 }: {
   unifiedTabId: string
   groupId: string
+  leadingSeparator?: boolean
   trailingSeparator?: boolean
+  shortcutLabels?: Partial<Record<TabSplitDirection, string>>
 }): React.JSX.Element | null {
   if (!canMoveTabToNewPaneColumn(unifiedTabId, groupId)) {
     return null
@@ -54,6 +59,7 @@ export function TabWorkspaceLayoutMenuSection({
 
   return (
     <>
+      {leadingSeparator ? <DropdownMenuSeparator /> : null}
       <DropdownMenuSub>
         <DropdownMenuSubTrigger className="[&>svg:last-child]:size-3.5">
           <Columns2 className="size-3.5 shrink-0" />
@@ -72,6 +78,9 @@ export function TabWorkspaceLayoutMenuSection({
             >
               {paneColumnDirectionIcon(direction)}
               {paneColumnDirectionLabel(direction)}
+              {shortcutLabels?.[direction] ? (
+                <DropdownMenuShortcut>{shortcutLabels[direction]}</DropdownMenuShortcut>
+              ) : null}
             </DropdownMenuItem>
           ))}
         </DropdownMenuSubContent>
diff --git a/src/renderer/src/components/tab-bar/TerminalTabSplitMenuSection.tsx b/src/renderer/src/components/tab-bar/TerminalTabSplitMenuSection.tsx
index 1b620e35dbe..a2226036f27 100644
--- a/src/renderer/src/components/tab-bar/TerminalTabSplitMenuSection.tsx
+++ b/src/renderer/src/components/tab-bar/TerminalTabSplitMenuSection.tsx
@@ -21,6 +21,7 @@ export function TerminalTabSplitMenuSection({
   onActivate,
   splitRightShortcut,
   splitDownShortcut,
+  showTerminalSplit = true,
   trailingSeparator = false
 }: {
   unifiedTabId: string
@@ -30,6 +31,7 @@ export function TerminalTabSplitMenuSection({
   onActivate: (tabId: string) => void
   splitRightShortcut: string
   splitDownShortcut: string
+  showTerminalSplit?: boolean
   trailingSeparator?: boolean
 }): React.JSX.Element {
   const splitActiveTerminalPane = (direction: 'vertical' | 'horizontal'): void => {
@@ -42,33 +44,37 @@ export function TerminalTabSplitMenuSection({
   return (
     <>
       <TabWorkspaceLayoutMenuSection unifiedTabId={unifiedTabId} groupId={groupId} />
-      <DropdownMenuSub>
-        <DropdownMenuSubTrigger className="[&>svg:last-child]:size-3.5">
-          <SquareTerminal className="size-3.5 shrink-0" />
-          {translate(
-            'auto.components.tab.bar.TerminalTabSplitMenuSection.splitTerminal',
-            'Split terminal'
-          )}
-        </DropdownMenuSubTrigger>
-        <DropdownMenuSubContent className={cn('min-w-[12rem]', TAB_CONTEXT_SUBMENU_CONTENT_CLASS)}>
-          <DropdownMenuItem onSelect={() => splitActiveTerminalPane('vertical')}>
-            <PanelRightClose className="size-3.5 shrink-0" />
+      {showTerminalSplit ? (
+        <DropdownMenuSub>
+          <DropdownMenuSubTrigger className="[&>svg:last-child]:size-3.5">
+            <SquareTerminal className="size-3.5 shrink-0" />
             {translate(
-              'auto.components.tab.bar.SortableTabContextMenu.splitTerminalRight',
-              'Split terminal right'
+              'auto.components.tab.bar.TerminalTabSplitMenuSection.splitTerminal',
+              'Split terminal'
             )}
-            <DropdownMenuShortcut>{splitRightShortcut}</DropdownMenuShortcut>
-          </DropdownMenuItem>
-          <DropdownMenuItem onSelect={() => splitActiveTerminalPane('horizontal')}>
-            <PanelBottomClose className="size-3.5 shrink-0" />
-            {translate(
-              'auto.components.tab.bar.SortableTabContextMenu.splitTerminalDown',
-              'Split terminal down'
-            )}
-            <DropdownMenuShortcut>{splitDownShortcut}</DropdownMenuShortcut>
-          </DropdownMenuItem>
-        </DropdownMenuSubContent>
-      </DropdownMenuSub>
+          </DropdownMenuSubTrigger>
+          <DropdownMenuSubContent
+            className={cn('min-w-[12rem]', TAB_CONTEXT_SUBMENU_CONTENT_CLASS)}
+          >
+            <DropdownMenuItem onSelect={() => splitActiveTerminalPane('vertical')}>
+              <PanelRightClose className="size-3.5 shrink-0" />
+              {translate(
+                'auto.components.tab.bar.SortableTabContextMenu.splitTerminalRight',
+                'Split terminal right'
+              )}
+              <DropdownMenuShortcut>{splitRightShortcut}</DropdownMenuShortcut>
+            </DropdownMenuItem>
+            <DropdownMenuItem onSelect={() => splitActiveTerminalPane('horizontal')}>
+              <PanelBottomClose className="size-3.5 shrink-0" />
+              {translate(
+                'auto.components.tab.bar.SortableTabContextMenu.splitTerminalDown',
+                'Split terminal down'
+              )}
+              <DropdownMenuShortcut>{splitDownShortcut}</DropdownMenuShortcut>
+            </DropdownMenuItem>
+          </DropdownMenuSubContent>
+        </DropdownMenuSub>
+      ) : null}
       {trailingSeparator ? <DropdownMenuSeparator /> : null}
     </>
   )
diff --git a/src/renderer/src/components/tab-bar/drop-indicator.ts b/src/renderer/src/components/tab-bar/drop-indicator.ts
index ab9f0ef5623..1b2c8221180 100644
--- a/src/renderer/src/components/tab-bar/drop-indicator.ts
+++ b/src/renderer/src/components/tab-bar/drop-indicator.ts
@@ -26,7 +26,7 @@ export function getDropIndicatorClasses(dropIndicator: DropIndicator): string {
 // flips the strip between "fits exactly" and "overflows by 1px", which jitters
 // every tab by 1px because the browser preserves scrollLeft near the end.
 export const ACTIVE_TAB_INDICATOR_CLASSES =
-  'pointer-events-none absolute inset-x-0 bottom-0 h-[2px] bg-[color-mix(in_srgb,var(--foreground)_60%,var(--card))] z-10'
+  'pointer-events-none absolute inset-x-0 bottom-0 h-[2px] bg-[color-mix(in_srgb,var(--foreground)_60%,var(--card))] z-20'
 
 export function getTabRootStateClasses(isActive: boolean): string {
   return isActive
diff --git a/src/renderer/src/components/tab-bar/tab-bar-item-surface.tsx b/src/renderer/src/components/tab-bar/tab-bar-item-surface.tsx
index 24114f42a16..95e9a98e7bb 100644
--- a/src/renderer/src/components/tab-bar/tab-bar-item-surface.tsx
+++ b/src/renderer/src/components/tab-bar/tab-bar-item-surface.tsx
@@ -266,6 +266,7 @@ export function renderTabBarItems({
           onSetTabColor={onSetTabColor}
           onTogglePin={() => togglePinned(item)}
           onToggleExpand={() => {}}
+          canSplitTerminal={false}
           dragData={dragData}
           dropIndicator={dropIndicatorByVisibleId.get(item.id) ?? null}
           includeTopTabBorder={includeTopTabBorder}
diff --git a/src/renderer/src/components/tab-bar/tab-bar-surface.tsx b/src/renderer/src/components/tab-bar/tab-bar-surface.tsx
index 5ed5936a457..dcf22611227 100644
--- a/src/renderer/src/components/tab-bar/tab-bar-surface.tsx
+++ b/src/renderer/src/components/tab-bar/tab-bar-surface.tsx
@@ -157,7 +157,7 @@ export function renderTabBarSurface({
       <SortableContext items={sortableIds}>
         {/* Why: no-drag lets tab interactions work inside the titlebar's drag region (outer container stays window-draggable). */}
         <div
-          className="relative flex min-h-0 min-w-0 max-w-full flex-[0_1_auto]"
+          className="group/tab-strip relative flex min-h-0 min-w-0 max-w-full flex-[0_1_auto]"
           style={{ WebkitAppRegion: 'no-drag' } as React.CSSProperties}
         >
           <div
@@ -181,7 +181,11 @@ export function renderTabBarSurface({
               />
             ) : null}
           </div>
-          <TabStripScrollIndicator metrics={tabStripOverflowState} />
+          <TabStripScrollIndicator
+            metrics={tabStripOverflowState}
+            scrollContainerRef={tabStripRef}
+            disabled={tabStripDragScroll.isTabDragActive}
+          />
         </div>
       </SortableContext>
       {tabStripOverflowState.hasOverflow ? (
diff --git a/src/renderer/src/components/tab-bar/tab-title-tooltip.test.tsx b/src/renderer/src/components/tab-bar/tab-title-tooltip.test.tsx
index 63d6a30040a..c5e863af5ca 100644
--- a/src/renderer/src/components/tab-bar/tab-title-tooltip.test.tsx
+++ b/src/renderer/src/components/tab-bar/tab-title-tooltip.test.tsx
@@ -188,10 +188,10 @@ function expectTabContainerWidth(markup: string, root: string): void {
   const container = firstOpeningTag(markup)
   // Why: pinned literally — a definite `w-*` is what stops live title updates from resizing
   // every tab, so asserting against the constant would let that guarantee be edited away.
-  const widthClasses = 'w-[180px] min-w-[88px] min-[1280px]:w-[220px]'
+  const widthClasses = 'w-[180px] min-w-[72px] min-[1280px]:w-[220px]'
   expect(container).toContain(widthClasses)
   expect(root).not.toContain('w-[180px]')
-  expect(root).not.toContain('min-w-[88px]')
+  expect(root).not.toContain('min-w-[72px]')
   expect(root).not.toContain('min-[1280px]:w-[220px]')
 }
 
diff --git a/src/renderer/src/components/tab-bar/tab-width-rules.ts b/src/renderer/src/components/tab-bar/tab-width-rules.ts
index c96fe099650..c7460650244 100644
--- a/src/renderer/src/components/tab-bar/tab-width-rules.ts
+++ b/src/renderer/src/components/tab-bar/tab-width-rules.ts
@@ -1,5 +1,5 @@
 // Why: the strip shrink-wraps its tabs, so a content-derived width lets one live title update
 // resize every tab; a definite width pins them and flex-shrink still narrows to the floor.
-export const TAB_CONTAINER_WIDTH_CLASSES = 'w-[180px] min-w-[88px] min-[1280px]:w-[220px]'
+export const TAB_CONTAINER_WIDTH_CLASSES = 'w-[180px] min-w-[72px] min-[1280px]:w-[220px]'
 
 export const TAB_LABEL_WIDTH_CLASSES = 'min-w-0 flex-1 truncate'
diff --git a/src/renderer/src/components/tab-group/AiVaultSessionDropLayer.tsx b/src/renderer/src/components/tab-group/AiVaultSessionDropLayer.tsx
index 55be0effcf7..11569358c18 100644
--- a/src/renderer/src/components/tab-group/AiVaultSessionDropLayer.tsx
+++ b/src/renderer/src/components/tab-group/AiVaultSessionDropLayer.tsx
@@ -23,7 +23,7 @@ import { resolveDropZone } from './tab-drop-zone'
 import type { TabDropZone } from './useTabDragSplit'
 import { translate } from '@/i18n/i18n'
 import type { AiVaultPrepareSessionResumeResult } from '../../../../shared/ai-vault-resume-preparation'
-import { activateStructuredAgentSessionById } from '@/lib/structured-agent-session-tab-activation'
+import { activateAiVaultStructuredSession } from '@/lib/activate-ai-vault-structured-session'
 
 type PaneDropTarget = {
   groupId: string
@@ -177,15 +177,9 @@ export default function AiVaultSessionDropLayer({
         return true
       }
       if (payload.structuredSession) {
-        const { sessionId, workspaceId } = payload.structuredSession
-        if (!activateStructuredAgentSessionById({ worktreeId: workspaceId, sessionId })) {
-          toast.error(
-            translate(
-              'auto.lib.activateAiVaultStructuredSession.unavailable',
-              'The structured agent session is not available yet. Retry in a moment.'
-            )
-          )
-        }
+        // Same row, same reveal as clicking Resume. Activating by id alone cannot reach a chat
+        // whose tab is closed, which is the case this drop is most often used for.
+        void activateAiVaultStructuredSession(payload)
         return true
       }
 
diff --git a/src/renderer/src/components/tab-group/useTabGroupItemProjections.ts b/src/renderer/src/components/tab-group/useTabGroupItemProjections.ts
index 921176604b0..782af51595a 100644
--- a/src/renderer/src/components/tab-group/useTabGroupItemProjections.ts
+++ b/src/renderer/src/components/tab-group/useTabGroupItemProjections.ts
@@ -50,6 +50,18 @@ export function useTabGroupItemProjections({
     () => new Map(worktreeState.terminalTabs.map((item) => [item.id, item])),
     [worktreeState.terminalTabs]
   )
+  // Why indexed like the terminal tabs above: `openFiles` is the global list across every
+  // worktree and `tabOrder` is as long as the group, so the per-tab `.find` scans below were
+  // quadratic in tab count on a path that reruns whenever any unified tab is written.
+  const openFileById = useMemo(
+    () => new Map(worktreeState.openFiles.map((item) => [item.id, item])),
+    [worktreeState.openFiles]
+  )
+  const browserTabById = useMemo(
+    () => new Map(worktreeState.browserTabs.map((item) => [item.id, item])),
+    [worktreeState.browserTabs]
+  )
+  const groupTabById = useMemo(() => new Map(groupTabs.map((item) => [item.id, item])), [groupTabs])
 
   const terminalTabs = useMemo<TerminalTabItem[]>(
     () =>
@@ -100,11 +112,11 @@ export function useTabGroupItemProjections({
             item.contentType === 'check-details'
         )
         .map((item) => {
-          const file = worktreeState.openFiles.find((candidate) => candidate.id === item.entityId)
+          const file = openFileById.get(item.entityId)
           return file ? { ...file, tabId: item.id } : null
         })
         .filter((item): item is GroupEditorItem => item !== null),
-    [groupTabs, worktreeState.openFiles]
+    [groupTabs, openFileById]
   )
 
   const browserItems = useMemo<GroupBrowserItem[]>(
@@ -112,11 +124,11 @@ export function useTabGroupItemProjections({
       groupTabs
         .filter((item) => item.contentType === 'browser')
         .map((item) => {
-          const bt = worktreeState.browserTabs.find((candidate) => candidate.id === item.entityId)
+          const bt = browserTabById.get(item.entityId)
           return bt ? { ...bt, tabId: item.id } : null
         })
         .filter((item): item is GroupBrowserItem => item !== null),
-    [groupTabs, worktreeState.browserTabs]
+    [browserTabById, groupTabs]
   )
 
   const agentSessionItems = useMemo<GroupAgentSessionItem[]>(
@@ -130,7 +142,7 @@ export function useTabGroupItemProjections({
   const tabBarOrder = useMemo(
     () =>
       (group?.tabOrder ?? []).map((itemId) => {
-        const item = groupTabs.find((candidate) => candidate.id === itemId)
+        const item = groupTabById.get(itemId)
         if (!item) {
           return itemId
         }
@@ -138,7 +150,7 @@ export function useTabGroupItemProjections({
           ? item.entityId
           : item.id
       }),
-    [group, groupTabs]
+    [group, groupTabById]
   )
 
   return {
diff --git a/src/renderer/src/components/tab-group/useTabGroupTabCloseCommands.structured-session.test.ts b/src/renderer/src/components/tab-group/useTabGroupTabCloseCommands.structured-session.test.ts
index 20791dd3dde..d1feb923255 100644
--- a/src/renderer/src/components/tab-group/useTabGroupTabCloseCommands.structured-session.test.ts
+++ b/src/renderer/src/components/tab-group/useTabGroupTabCloseCommands.structured-session.test.ts
@@ -3,7 +3,7 @@ import type * as ReactModule from 'react'
 
 const mocks = vi.hoisted(() => ({
   callRuntimeRpc: vi.fn(),
-  cancelStructuredCodexLaunch: vi.fn(),
+  cancelStructuredAgentLaunch: vi.fn(),
   closeBrowserTab: vi.fn(),
   closeFile: vi.fn(),
   closeStructuredAgentSession: vi.fn(),
@@ -73,7 +73,7 @@ vi.mock('@/runtime/structured-agent-session-close', () => ({
 }))
 
 vi.mock('@/lib/structured-agent-session-launch', () => ({
-  cancelStructuredCodexLaunch: mocks.cancelStructuredCodexLaunch
+  cancelStructuredAgentLaunch: mocks.cancelStructuredAgentLaunch
 }))
 
 vi.mock('@/runtime/runtime-worktree-selector', () => ({
@@ -129,7 +129,7 @@ describe('structured agent-session close ordering', () => {
     closeItem(AGENT_TAB.id)
 
     await vi.waitFor(() => expect(order).toEqual(['agent-close', 'tab-close', 'local-remove']))
-    expect(mocks.cancelStructuredCodexLaunch).toHaveBeenCalledWith('wt-1', 'session-1')
+    expect(mocks.cancelStructuredAgentLaunch).toHaveBeenCalledWith('wt-1', 'session-1')
   })
 
   it('keeps the tab available when owner disposal fails, so close can be retried', async () => {
@@ -154,7 +154,7 @@ describe('structured agent-session close ordering', () => {
 
     closeMany([AGENT_TAB.id])
 
-    expect(mocks.cancelStructuredCodexLaunch).toHaveBeenCalledWith('wt-1', 'session-1')
+    expect(mocks.cancelStructuredAgentLaunch).toHaveBeenCalledWith('wt-1', 'session-1')
     await vi.waitFor(() => expect(mocks.closeUnifiedTab).toHaveBeenCalledWith(AGENT_TAB.id))
   })
 })
diff --git a/src/renderer/src/components/tab-group/useTabGroupTabCloseCommands.ts b/src/renderer/src/components/tab-group/useTabGroupTabCloseCommands.ts
index 0c8c71d6d7c..a5a9a65455d 100644
--- a/src/renderer/src/components/tab-group/useTabGroupTabCloseCommands.ts
+++ b/src/renderer/src/components/tab-group/useTabGroupTabCloseCommands.ts
@@ -10,7 +10,7 @@ import { getRuntimeEnvironmentIdForWorktree } from '@/lib/worktree-runtime-owner
 import { closeBrowserWorkspaceTabOnHosts } from '@/runtime/browser-workspace-tab-close'
 import { callRuntimeRpc, getActiveRuntimeTarget } from '@/runtime/runtime-rpc-client'
 import { closeStructuredAgentSession } from '@/runtime/structured-agent-session-close'
-import { cancelStructuredCodexLaunch } from '@/lib/structured-agent-session-launch'
+import { cancelStructuredAgentLaunch } from '@/lib/structured-agent-session-launch'
 import { toRuntimeWorktreeSelector } from '@/runtime/runtime-worktree-selector'
 import { translate } from '@/i18n/i18n'
 
@@ -18,7 +18,7 @@ function reportStructuredSessionCloseError(error: unknown): void {
   toast.error(
     translate(
       'components.native-chat.structuredSessionCloseFailed',
-      'Could not close this Codex chat'
+      'Could not close this chat session'
     ),
     { description: error instanceof Error ? error.message : String(error) }
   )
@@ -121,12 +121,12 @@ export function useTabGroupTabCloseCommands({
         worktreeId
       )
       if (item.contentType === 'agent-session') {
-        cancelStructuredCodexLaunch(worktreeId, item.entityId)
+        cancelStructuredAgentLaunch(worktreeId, item.entityId)
         // Why: the structured session lives on the host, so the local tab close must also
         // retire the host's canonical row or it reappears on the next sync.
         // Cancel a still-reconciling create before closing its owner; otherwise a missing
         // post-create snapshot is mistaken for an unknown outcome and retried after close.
-        cancelStructuredCodexLaunch(worktreeId, item.entityId)
+        cancelStructuredAgentLaunch(worktreeId, item.entityId)
         const target = getActiveRuntimeTarget({
           activeRuntimeEnvironmentId: runtimeEnvironmentId
         })
@@ -198,7 +198,7 @@ export function useTabGroupTabCloseCommands({
           worktreeId
         )
         if (item.contentType === 'agent-session') {
-          cancelStructuredCodexLaunch(worktreeId, item.entityId)
+          cancelStructuredAgentLaunch(worktreeId, item.entityId)
           const target = getActiveRuntimeTarget({
             activeRuntimeEnvironmentId: runtimeEnvironmentId
           })
diff --git a/src/renderer/src/components/terminal-pane/StructuredAgentSessionTerminalReturnButton.tsx b/src/renderer/src/components/terminal-pane/StructuredAgentSessionTerminalReturnButton.tsx
new file mode 100644
index 00000000000..bba08bd914c
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/StructuredAgentSessionTerminalReturnButton.tsx
@@ -0,0 +1,25 @@
+import { Button } from '@/components/ui/button'
+import { translate } from '@/i18n/i18n'
+
+export function StructuredAgentSessionTerminalReturnButton(props: {
+  enabled: boolean
+  onReturn?: () => void
+}): React.JSX.Element | null {
+  if (!props.enabled) {
+    return null
+  }
+  return (
+    <Button
+      type="button"
+      variant="ghost"
+      size="xs"
+      className="pane-title-split-trigger"
+      onClick={(event) => {
+        event.stopPropagation()
+        props.onReturn?.()
+      }}
+    >
+      {translate('components.native-chat.handoff.returnToChat', 'Return to chat')}
+    </Button>
+  )
+}
diff --git a/src/renderer/src/components/terminal-pane/TerminalPaneNativeChatPortal.tsx b/src/renderer/src/components/terminal-pane/TerminalPaneNativeChatPortal.tsx
index 1b5e94b4a11..da2a3f02133 100644
--- a/src/renderer/src/components/terminal-pane/TerminalPaneNativeChatPortal.tsx
+++ b/src/renderer/src/components/terminal-pane/TerminalPaneNativeChatPortal.tsx
@@ -41,6 +41,31 @@ export function TerminalPaneNativeChatPortal({
     return null
   }
 
+  const contextMenuActions = {
+    onSplitRight: () => contextMenu.runForPane(chatPane.id, contextMenu.onSplitRight),
+    onSplitDown: () => contextMenu.runForPane(chatPane.id, contextMenu.onSplitDown),
+    canEqualizePaneSizes: managedPanes.length > 1 && expandedPaneId === null,
+    onEqualizePaneSizes: () => contextMenu.runForPane(chatPane.id, contextMenu.onEqualizePaneSizes),
+    canExpandPane: managedPanes.length > 1,
+    isPaneExpanded: expandedPaneId === chatPane.id,
+    onToggleExpand: () => contextMenu.runForPane(chatPane.id, contextMenu.onToggleExpand),
+    canContinueAgentSessionInNewSession: canContinueAgentSessionInNewSession(
+      resolveAgentForLeaf(chatPane.leafId)
+    ),
+    onContinueAgentSessionInNewSession: () =>
+      contextMenu.runForPane(chatPane.id, contextMenu.onContinueAgentSessionInNewSession),
+    onForkAgentSession: () =>
+      void contextMenu.runForPane(chatPane.id, contextMenu.onForkAgentSession),
+    onSetTitle: () => contextMenu.runForPane(chatPane.id, contextMenu.onSetTitle),
+    onCopyTerminalId: () => void contextMenu.runForPane(chatPane.id, contextMenu.onCopyTerminalId),
+    onCopyPaneId: () => void contextMenu.runForPane(chatPane.id, contextMenu.onCopyPaneId),
+    canCopyAgentSessionId: chatPaneSessionId !== null,
+    onCopyAgentSessionId: () =>
+      void contextMenu.runForPane(chatPane.id, contextMenu.onCopyAgentSessionId),
+    canClosePane: managedPanes.length > 1,
+    onClosePane: () => contextMenu.runForPane(chatPane.id, contextMenu.onClosePane)
+  }
+
   return createPortal(
     <div className="native-chat-pane-shell absolute inset-0 z-10 flex min-h-0 min-w-0 bg-background">
       {structuredSessionId && structuredChatAgent ? (
@@ -51,7 +76,7 @@ export function TerminalPaneNativeChatPortal({
           agent={structuredChatAgent}
           isVisible={isRendererVisible}
           target={structuredChatTarget}
-          allowFileUriLinks
+          contextMenuActions={contextMenuActions}
           orchestrationDispatchStatus={chatPaneDispatchStatus}
         />
       ) : (
@@ -65,32 +90,7 @@ export function TerminalPaneNativeChatPortal({
           ownsTabWideLaunchDraft={chatPaneOwnsTabWideLaunchDraft}
           onSwitchToTerminal={switchNativeChatToTerminal}
           readTerminalScreen={readNativeChatTerminalScreen}
-          contextMenuActions={{
-            onSplitRight: () => contextMenu.runForPane(chatPane.id, contextMenu.onSplitRight),
-            onSplitDown: () => contextMenu.runForPane(chatPane.id, contextMenu.onSplitDown),
-            canEqualizePaneSizes: managedPanes.length > 1 && expandedPaneId === null,
-            onEqualizePaneSizes: () =>
-              contextMenu.runForPane(chatPane.id, contextMenu.onEqualizePaneSizes),
-            canExpandPane: managedPanes.length > 1,
-            isPaneExpanded: expandedPaneId === chatPane.id,
-            onToggleExpand: () => contextMenu.runForPane(chatPane.id, contextMenu.onToggleExpand),
-            canContinueAgentSessionInNewSession: canContinueAgentSessionInNewSession(
-              resolveAgentForLeaf(chatPane.leafId)
-            ),
-            onContinueAgentSessionInNewSession: () =>
-              contextMenu.runForPane(chatPane.id, contextMenu.onContinueAgentSessionInNewSession),
-            onForkAgentSession: () =>
-              void contextMenu.runForPane(chatPane.id, contextMenu.onForkAgentSession),
-            onSetTitle: () => contextMenu.runForPane(chatPane.id, contextMenu.onSetTitle),
-            onCopyTerminalId: () =>
-              void contextMenu.runForPane(chatPane.id, contextMenu.onCopyTerminalId),
-            onCopyPaneId: () => void contextMenu.runForPane(chatPane.id, contextMenu.onCopyPaneId),
-            canCopyAgentSessionId: chatPaneSessionId !== null,
-            onCopyAgentSessionId: () =>
-              void contextMenu.runForPane(chatPane.id, contextMenu.onCopyAgentSessionId),
-            canClosePane: managedPanes.length > 1,
-            onClosePane: () => contextMenu.runForPane(chatPane.id, contextMenu.onClosePane)
-          }}
+          contextMenuActions={contextMenuActions}
           orchestrationDispatchStatus={chatPaneDispatchStatus}
         />
       )}
diff --git a/src/renderer/src/components/terminal-pane/agent-completion-coordinator-types.ts b/src/renderer/src/components/terminal-pane/agent-completion-coordinator-types.ts
index 7d7c53f6bb8..7bf7e90f7f9 100644
--- a/src/renderer/src/components/terminal-pane/agent-completion-coordinator-types.ts
+++ b/src/renderer/src/components/terminal-pane/agent-completion-coordinator-types.ts
@@ -32,7 +32,7 @@ export type AgentCompletionCoordinatorOptions = {
   inspectProcess: (
     settings: Pick<GlobalSettings, 'activeRuntimeEnvironmentId'> | null | undefined,
     ptyId: string,
-    options?: { expectedIncarnationId?: string }
+    options?: { expectedIncarnationId?: string; steadyState?: boolean }
   ) => Promise<RuntimeTerminalProcessInspection>
   dispatchCompletion: (title: string, meta?: AgentCompletionDispatchMeta) => void
   dispatchAttention?: (title: string, meta: AgentAttentionDispatchMeta) => void
diff --git a/src/renderer/src/components/terminal-pane/agent-completion-poll-interval.test.ts b/src/renderer/src/components/terminal-pane/agent-completion-poll-interval.test.ts
new file mode 100644
index 00000000000..fffbb94de90
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/agent-completion-poll-interval.test.ts
@@ -0,0 +1,72 @@
+import { describe, expect, it } from 'vitest'
+import { PROCESS_TABLE_SNAPSHOT_MAX_STALENESS_MS } from '../../../../shared/process-table-snapshot-reader'
+import { POLL_TIER_INTERVAL_MS } from './agent-completion-poll-cadence'
+import { nextCadenceInspectionDelayMs } from './agent-completion-poll-interval'
+
+const IDLE_MS = POLL_TIER_INTERVAL_MS.idle
+
+describe('nextCadenceInspectionDelayMs', () => {
+  const alignedDelay = (now: number): number =>
+    nextCadenceInspectionDelayMs({
+      baseMs: IDLE_MS,
+      hasConsecutiveErrors: false,
+      alignToSharedGrid: true,
+      now
+    })
+
+  it('walks panes that scheduled at different moments onto one shared deadline', () => {
+    // Why this matters: the inspection queue collapses shared-observation tasks enqueued in the
+    // same tick onto one process-table capture, so a shared deadline is one `ps` for all panes.
+    const clocks = [0, 137, 999, 1_501].map((offset) => 1_700_000_000_000 + offset)
+    // Each pane may only be pulled forward by the snapshot TTL per step, so convergence takes
+    // at most IDLE_MS / TTL steps.
+    for (let step = 0; step < IDLE_MS / PROCESS_TABLE_SNAPSHOT_MAX_STALENESS_MS; step += 1) {
+      for (let pane = 0; pane < clocks.length; pane += 1) {
+        clocks[pane] += alignedDelay(clocks[pane]!)
+      }
+    }
+
+    expect(new Set(clocks).size).toBe(1)
+  })
+
+  it('never waits longer than the tier interval, nor more than the snapshot TTL less', () => {
+    for (let offset = 0; offset < IDLE_MS * 3; offset += 1) {
+      const delay = alignedDelay(1_700_000_000_000 + offset)
+      expect(delay).toBeGreaterThanOrEqual(IDLE_MS - PROCESS_TABLE_SNAPSHOT_MAX_STALENESS_MS)
+      expect(delay).toBeLessThanOrEqual(IDLE_MS)
+    }
+  })
+
+  it('keeps jitter while backing off, so a failing host is not retried by every pane at once', () => {
+    const lowJitter = nextCadenceInspectionDelayMs({
+      baseMs: IDLE_MS,
+      hasConsecutiveErrors: true,
+      alignToSharedGrid: true,
+      now: 1_700_000_000_000,
+      random: () => 0
+    })
+    const highJitter = nextCadenceInspectionDelayMs({
+      baseMs: IDLE_MS,
+      hasConsecutiveErrors: true,
+      alignToSharedGrid: true,
+      now: 1_700_000_000_000,
+      random: () => 1
+    })
+
+    expect(lowJitter).toBe(Math.round(IDLE_MS * 0.9))
+    expect(highJitter).toBe(Math.round(IDLE_MS * 1.1))
+  })
+
+  it('degrades safely on a non-positive interval', () => {
+    for (const baseMs of [0, -1, Number.NaN, Number.POSITIVE_INFINITY]) {
+      expect(
+        nextCadenceInspectionDelayMs({
+          baseMs,
+          hasConsecutiveErrors: false,
+          alignToSharedGrid: true,
+          now: 1_700_000_000_000
+        })
+      ).toBe(0)
+    }
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/agent-completion-poll-interval.ts b/src/renderer/src/components/terminal-pane/agent-completion-poll-interval.ts
new file mode 100644
index 00000000000..0de8632f552
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/agent-completion-poll-interval.ts
@@ -0,0 +1,43 @@
+// Why not the sibling reader that re-exports this: it imports `node:child_process`, which the
+// renderer cannot load — reaching it blanks the window at module evaluation.
+import { PROCESS_TABLE_SNAPSHOT_MAX_STALENESS_MS } from '../../../../shared/process-table-snapshot'
+
+/**
+ * Picks the delay until a pane's next cadence inspection.
+ *
+ * Local panes all resolve out of one TTL-deduped process-table snapshot, and the inspection
+ * queue collapses every shared-observation task enqueued in the same tick onto a single host
+ * capture. Independent per-pane jitter defeated that: panes drifted apart, each landing in its
+ * own tick and forking its own `ps`. Snapping to a grid anchored at the epoch puts same-tier
+ * panes back in one tick, so N panes cost one capture instead of N.
+ *
+ * The pull-forward is clamped to the process-table snapshot TTL, so a pane never polls more than
+ * that early and never later than its tier interval. A pane off the grid therefore walks onto it
+ * in at most `baseMs / TTL` steps, costing at most one extra inspection in total, and no
+ * inspection is ever delayed.
+ *
+ * Alignment is scoped to genuinely idle panes: no foreground agent and no pane activity inside
+ * the hot window. A pane that just produced output keeps its exact interval, so the bounded
+ * post-activity cadence is unchanged, and the error-backoff path keeps its jitter — spreading
+ * retries across panes is the point when a host has just failed.
+ */
+
+export function nextCadenceInspectionDelayMs(args: {
+  baseMs: number
+  hasConsecutiveErrors: boolean
+  alignToSharedGrid: boolean
+  now: number
+  random?: () => number
+}): number {
+  const { alignToSharedGrid, baseMs, hasConsecutiveErrors, now } = args
+  if (!Number.isFinite(baseMs) || baseMs <= 0) {
+    return 0
+  }
+  if (hasConsecutiveErrors || !alignToSharedGrid) {
+    const random = args.random ?? Math.random
+    return Math.round(baseMs * (1 + (random() * 0.2 - 0.1)))
+  }
+  const deadline = Math.floor((now + baseMs) / baseMs) * baseMs
+  const earliest = Math.max(1, baseMs - PROCESS_TABLE_SNAPSHOT_MAX_STALENESS_MS)
+  return Math.min(baseMs, Math.max(earliest, deadline - now))
+}
diff --git a/src/renderer/src/components/terminal-pane/agent-completion-poll-scheduler.ts b/src/renderer/src/components/terminal-pane/agent-completion-poll-scheduler.ts
index 8894edbd9c6..30a7b2e817e 100644
--- a/src/renderer/src/components/terminal-pane/agent-completion-poll-scheduler.ts
+++ b/src/renderer/src/components/terminal-pane/agent-completion-poll-scheduler.ts
@@ -7,6 +7,7 @@ import {
   POLL_TIER_INTERVAL_MS,
   type PollCadenceTier
 } from './agent-completion-poll-cadence'
+import { nextCadenceInspectionDelayMs } from './agent-completion-poll-interval'
 
 export function createAgentCompletionPollScheduler(args: {
   options: AgentCompletionCoordinatorOptions
@@ -88,7 +89,19 @@ export function createAgentCompletionPollScheduler(args: {
       state.consecutiveInspectionErrors > 0
         ? Math.min(Math.max(10_000, base), base * 2 ** state.consecutiveInspectionErrors)
         : base
-    const interval = Math.round(backoff * (1 + (Math.random() * 0.2 - 0.1)))
+    const now = Date.now()
+    // Only genuinely idle panes share a deadline: a pane with a foreground agent, or one still
+    // inside the post-activity hot window, keeps its exact interval and its own phase.
+    const isIdlePane =
+      state.lastForegroundAgent === null &&
+      (state.lastPaneActivityAt === null ||
+        now - state.lastPaneActivityAt >= NO_EVIDENCE_ACTIVITY_HOT_WINDOW_MS)
+    const interval = nextCadenceInspectionDelayMs({
+      baseMs: backoff,
+      hasConsecutiveErrors: state.consecutiveInspectionErrors > 0,
+      alignToSharedGrid: isIdlePane,
+      now
+    })
     state.pollTimerTier = tier
     state.pollTimer = setTimeout(() => {
       state.pollTimer = null
diff --git a/src/renderer/src/components/terminal-pane/agent-completion-process-monitor.ts b/src/renderer/src/components/terminal-pane/agent-completion-process-monitor.ts
index f34ceffa97e..ca2456aedbb 100644
--- a/src/renderer/src/components/terminal-pane/agent-completion-process-monitor.ts
+++ b/src/renderer/src/components/terminal-pane/agent-completion-process-monitor.ts
@@ -108,10 +108,18 @@ export function createAgentCompletionProcessMonitor({
         let inspectedRecognizedAgent = false
         let inspectionSucceeded = false
         try {
-          const result = await (expectedIncarnationIdAtRequest
-            ? options.inspectProcess(options.getSettings(), ptyId, {
-                expectedIncarnationId: expectedIncarnationIdAtRequest
-              })
+          // Only a cadence tick on a local pane reads nothing but the name; every other read
+          // (pending-title, remote) needs the full capture and must not ask for the cheap one.
+          const inspectOptions = {
+            ...(expectedIncarnationIdAtRequest
+              ? { expectedIncarnationId: expectedIncarnationIdAtRequest }
+              : {}),
+            ...(priority === 'cadence' && options.isRemotePtyId?.(ptyId) !== true
+              ? { steadyState: true }
+              : {})
+          }
+          const result = await (Object.keys(inspectOptions).length > 0
+            ? options.inspectProcess(options.getSettings(), ptyId, inspectOptions)
             : options.inspectProcess(options.getSettings(), ptyId))
           if (
             !state.disposed &&
diff --git a/src/renderer/src/components/terminal-pane/agent-completion-stale-evidence-backoff.test.ts b/src/renderer/src/components/terminal-pane/agent-completion-stale-evidence-backoff.test.ts
new file mode 100644
index 00000000000..82714edce6e
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/agent-completion-stale-evidence-backoff.test.ts
@@ -0,0 +1,136 @@
+// The second consumer of the capture budget, at the point where a user feels it.
+//
+// A whole-machine `ps` costs seconds on a large or loaded host: 2.5-9.0s on an idle 2,002-process
+// laptop, 4.0-18.6s at load 46. Publishing that as a truthful-but-late `live` record does not help
+// this pane. `admitRemoteForegroundEvidence` refuses it, every refusal increments
+// `consecutiveInspectionErrors`, and the poll scheduler's backoff then stretches the cadence to its
+// 10s floor -- so agent-completion detection degrades on exactly the hosts where a capture is
+// slowest, which are the hosts where agents take longest to finish.
+//
+// Giving up on the capture and publishing a prompt `unverifiable` instead costs one poll and
+// nothing else: the record is admitted, so no error is counted.
+import { describe, expect, it, vi } from 'vitest'
+import { handleAgentCompletionInspectionResult } from './agent-completion-inspection-result'
+import type { RemoteInspectionState } from './agent-completion-inspection-result'
+import type { ProcessMonitorState } from './agent-completion-process-types'
+import type { AgentCompletionCoordinatorOptions } from './agent-completion-coordinator-types'
+import type { RuntimeTerminalProcessInspection } from '@/runtime/runtime-terminal-inspection'
+import { toAppSshPtyId } from '../../../../shared/ssh-pty-id'
+import { REMOTE_FOREGROUND_EVIDENCE_MAX_AGE_MS } from '../../../../shared/remote-foreground-evidence-admission'
+
+const SSH_PTY_ID = toAppSshPtyId('target-1', 'pty-1')
+const INCARNATION = 'inc-1'
+
+function liveRecord(capturedAgeMs: number): RuntimeTerminalProcessInspection {
+  return {
+    foregroundProcess: 'claude',
+    hasChildProcesses: true,
+    foregroundProcessEvidence: {
+      verdict: 'live',
+      processName: 'claude',
+      authorityGeneration: 'gen-1',
+      observationEpoch: 1,
+      capturedAgeMs,
+      ptyId: 'pty-1',
+      ptyIncarnationId: INCARNATION,
+      fence: {
+        platform: 'posix',
+        shellPid: 10,
+        shellStartTime: '100',
+        tty: '/dev/pts/2',
+        foregroundPgid: 11,
+        process: { pid: 11, startTime: '101' }
+      }
+    }
+  }
+}
+
+/** What both relay call sites publish when the capture misses its budget. */
+function unreadableTableRecord(): RuntimeTerminalProcessInspection {
+  return {
+    foregroundProcess: 'claude',
+    hasChildProcesses: true,
+    foregroundProcessEvidence: {
+      verdict: 'unverifiable',
+      reason: 'process_table_unreadable',
+      authorityGeneration: 'gen-1',
+      observationEpoch: 1,
+      capturedAgeMs: 0,
+      ptyId: 'pty-1',
+      ptyIncarnationId: INCARNATION
+    }
+  }
+}
+
+function inspect(result: RuntimeTerminalProcessInspection, roundTripMs = 20): ProcessMonitorState {
+  const state: ProcessMonitorState = {
+    disposed: false,
+    inspectionInFlight: false,
+    inspectionGeneration: 0,
+    consecutiveInspectionErrors: 0,
+    pollTrackingStarted: true,
+    pollTimer: null,
+    pollTimerTier: null,
+    lastPaneActivityAt: null,
+    hasAgentRunEvidence: false,
+    pendingProcessExitAgent: null,
+    lastForegroundAgent: null,
+    processSession: 1
+  }
+  const remoteInspection: RemoteInspectionState = {
+    authorityGeneration: null,
+    observationEpoch: -1,
+    bindingKey: null,
+    knownAuthorityGenerations: new Set<string>()
+  }
+  const started = performance.now()
+  vi.spyOn(performance, 'now').mockReturnValue(started + roundTripMs)
+  handleAgentCompletionInspectionResult({
+    result,
+    requestStartedAtMonotonic: started,
+    options: {
+      paneKey: 'tab-1:leaf-1',
+      getPtyId: () => SSH_PTY_ID,
+      getSettings: () => null,
+      isRemotePtyId: () => true,
+      getExpectedIncarnationId: () => INCARNATION
+    } as unknown as AgentCompletionCoordinatorOptions,
+    state,
+    identityScope: {} as never,
+    clearAgentRunEvidence: vi.fn(),
+    hasPendingHookDone: () => false,
+    hasPendingCodexAttention: () => false,
+    scheduleNextPoll: vi.fn(),
+    handleRecognizedProcess: vi.fn(),
+    dispatchCompletion: vi.fn(),
+    remoteInspection
+  })
+  vi.restoreAllMocks()
+  return state
+}
+
+describe('agent completion polling under a host capture it cannot use', () => {
+  it('counts no error for the prompt unverifiable a capture over budget produces', () => {
+    expect(inspect(unreadableTableRecord()).consecutiveInspectionErrors).toBe(0)
+  })
+
+  it('counts an error for the late live record the same capture would have produced', () => {
+    // One of the measured captures. Every poll refusing this way is what drives the cadence to
+    // its 10s backoff floor and stops completion detection for the pane.
+    expect(inspect(liveRecord(6_140)).consecutiveInspectionErrors).toBe(1)
+  })
+
+  it.each([
+    ['at the ceiling', REMOTE_FOREGROUND_EVIDENCE_MAX_AGE_MS, 0],
+    ['one step past it', REMOTE_FOREGROUND_EVIDENCE_MAX_AGE_MS + 1, 1]
+  ])('counts %s as %s errors', (_label, capturedAgeMs, errors) => {
+    expect(inspect(liveRecord(capturedAgeMs), 0).consecutiveInspectionErrors).toBe(errors)
+  })
+
+  it('admits a capture that lands inside the evidence budget', () => {
+    // The reason the budget is 1,200ms rather than lower: a capture inside it must still clear the
+    // 2,000ms ceiling once its duration is counted once instead of twice. Under the double count
+    // this same record was refused, because 1,200 + a 1,300ms round trip read as 2,500.
+    expect(inspect(liveRecord(1_200), 1_300).consecutiveInspectionErrors).toBe(0)
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/agent-completion-steady-state-opt-in.test.ts b/src/renderer/src/components/terminal-pane/agent-completion-steady-state-opt-in.test.ts
new file mode 100644
index 00000000000..4f2286c7eb7
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/agent-completion-steady-state-opt-in.test.ts
@@ -0,0 +1,84 @@
+import { describe, expect, it, vi } from 'vitest'
+import { createAgentCompletionCoordinator } from './agent-completion-coordinator'
+import {
+  flushAsyncTicks,
+  processResult,
+  useAgentCompletionCoordinatorLifecycle
+} from './agent-completion-coordinator-test-harness'
+
+// The renderer opts a read into the cheap tier ONLY when it is a self-correcting cadence poll on a
+// local pane. Pending-title reads decide a completion once and remote reads consume evidence, so
+// neither may ask for a capture that omits evidence.
+describe('agent completion steadyState opt-in', () => {
+  useAgentCompletionCoordinatorLifecycle()
+
+  const optionsOf = (call: unknown[]): unknown => call[2]
+
+  it('marks cadence polls on a local pane as steadyState', async () => {
+    const inspectProcess = vi.fn(async () => processResult('codex'))
+    const coordinator = createAgentCompletionCoordinator({
+      paneKey: 'tab-1:leaf-1',
+      getPtyId: () => 'pty-1',
+      getSettings: () => null,
+      inspectProcess,
+      dispatchCompletion: vi.fn(),
+      isLive: () => true,
+      shouldPollProcessCadence: () => true
+    })
+    coordinator.startProcessTracking()
+    coordinator.observeTitle('Codex working')
+    vi.advanceTimersByTime(3_000)
+    await flushAsyncTicks()
+    expect(inspectProcess).toHaveBeenCalled()
+    for (const call of inspectProcess.mock.calls) {
+      expect(optionsOf(call as unknown[])).toEqual({ steadyState: true })
+    }
+    coordinator.dispose()
+  })
+
+  it('a pending-title read on a local pane is NOT steadyState: it decides a completion once', async () => {
+    const inspectProcess = vi.fn(async () => processResult('codex'))
+    const coordinator = createAgentCompletionCoordinator({
+      paneKey: 'tab-1:leaf-1',
+      getPtyId: () => 'pty-1',
+      getSettings: () => null,
+      inspectProcess,
+      dispatchCompletion: vi.fn(),
+      isLive: () => true,
+      shouldPollProcessCadence: () => false
+    })
+    coordinator.observeTitle('Codex working')
+    coordinator.observeTitle('/tmp/orca-e2e-repo')
+    await flushAsyncTicks()
+    expect(inspectProcess).toHaveBeenCalled()
+    for (const call of inspectProcess.mock.calls) {
+      expect(optionsOf(call as unknown[])).toBeUndefined()
+    }
+    coordinator.dispose()
+  })
+
+  it('never marks a remote pane as steadyState: remote identity needs evidence', async () => {
+    const inspectProcess = vi.fn(async () => processResult('codex'))
+    const coordinator = createAgentCompletionCoordinator({
+      paneKey: 'tab-1:leaf-1',
+      getPtyId: () => 'remote:pty-1',
+      isRemotePtyId: () => true,
+      getExpectedIncarnationId: () => 'inc-1',
+      getSettings: () => null,
+      inspectProcess,
+      dispatchCompletion: vi.fn(),
+      isLive: () => true,
+      shouldPollProcessCadence: () => true
+    })
+    coordinator.startProcessTracking()
+    coordinator.observeTitle('Codex working')
+    coordinator.observeTitle('/tmp/orca-e2e-repo')
+    vi.advanceTimersByTime(3_000)
+    await flushAsyncTicks()
+    expect(inspectProcess).toHaveBeenCalled()
+    for (const call of inspectProcess.mock.calls) {
+      expect(optionsOf(call as unknown[])).toEqual({ expectedIncarnationId: 'inc-1' })
+    }
+    coordinator.dispose()
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/codex-backfill-error-detector.ts b/src/renderer/src/components/terminal-pane/codex-backfill-error-detector.ts
index 7c95bd7e46c..508ab978101 100644
--- a/src/renderer/src/components/terminal-pane/codex-backfill-error-detector.ts
+++ b/src/renderer/src/components/terminal-pane/codex-backfill-error-detector.ts
@@ -9,6 +9,8 @@ const ANSI_ESCAPE_PATTERN =
   // eslint-disable-next-line no-control-regex -- terminal escape sequences contain control bytes
   /\u001b(?:\[[0-9;?]*[ -/]*[@-~]|\][^\u0007\u001b]*(?:\u0007|\u001b\\)?)/g
 const DETECTOR_BUFFER_MAX_CHARS = 4096
+// Why a regex over toLowerCase(): the case-folded copy allocated the whole 4KB carry on every chunk.
+const CODEX_BACKFILL_TIMEOUT_PATTERN = new RegExp(CODEX_BACKFILL_TIMEOUT_SIGNATURE, 'i')
 
 export type CodexBackfillErrorDetector = { observe(chunk: string): string | null }
 
@@ -23,7 +25,7 @@ export function createCodexBackfillErrorDetector(): CodexBackfillErrorDetector {
       }
       const normalized = (tail + chunk).replace(ANSI_ESCAPE_PATTERN, '').replace(/\r/g, '')
       tail = normalized.slice(-DETECTOR_BUFFER_MAX_CHARS)
-      if (!tail.toLowerCase().includes(CODEX_BACKFILL_TIMEOUT_SIGNATURE)) {
+      if (!CODEX_BACKFILL_TIMEOUT_PATTERN.test(tail)) {
         return null
       }
       armed = false
diff --git a/src/renderer/src/components/terminal-pane/git-bash-console-capacity.test.ts b/src/renderer/src/components/terminal-pane/git-bash-console-capacity.test.ts
index 27067b16828..9b6258efa6d 100644
--- a/src/renderer/src/components/terminal-pane/git-bash-console-capacity.test.ts
+++ b/src/renderer/src/components/terminal-pane/git-bash-console-capacity.test.ts
@@ -11,6 +11,29 @@ describe('Git Bash console capacity detection', () => {
     expect(detector.detected()).toBe(true)
   })
 
+  it('detects the marker at every chunk boundary, in any case', () => {
+    const noisyPrefix = 'x'.repeat(200)
+    const stream = `${noisyPrefix}Console device allocation failure - TOO MANY CONSOLES In Use, Max Consoles Is 128\r\n`
+
+    for (let split = 0; split <= stream.length; split += 1) {
+      const detector = createGitBashConsoleCapacityDetector()
+      detector.observe(stream.slice(0, split))
+      detector.observe(stream.slice(split))
+      expect(detector.detected(), `split at ${split}`).toBe(true)
+    }
+  })
+
+  it('still matches when the carry is rebuilt by chunks that skip the fast path', () => {
+    const detector = createGitBashConsoleCapacityDetector()
+
+    // None of these chunks contain the marker's final character, so each takes the fast path.
+    detector.observe('too many consoles in use, ')
+    detector.observe('max consoles is ')
+    detector.observe('128')
+
+    expect(detector.detected()).toBe(true)
+  })
+
   it('ignores unrelated shell failures', () => {
     const detector = createGitBashConsoleCapacityDetector()
     detector.observe('bash: command not found')
diff --git a/src/renderer/src/components/terminal-pane/git-bash-console-capacity.ts b/src/renderer/src/components/terminal-pane/git-bash-console-capacity.ts
index 6f70a8b2a2e..4753c817ca8 100644
--- a/src/renderer/src/components/terminal-pane/git-bash-console-capacity.ts
+++ b/src/renderer/src/components/terminal-pane/git-bash-console-capacity.ts
@@ -1,4 +1,8 @@
 const GIT_BASH_CONSOLE_CAPACITY_MARKER = 'too many consoles in use, max consoles is 128'
+const CARRY_LENGTH = GIT_BASH_CONSOLE_CAPACITY_MARKER.length - 1
+// Why this char: a match that was not already found must end inside the new chunk, so the chunk has
+// to contain the marker's final character. It is a digit, so the test needs no case folding.
+const MARKER_FINAL_CHAR = GIT_BASH_CONSOLE_CAPACITY_MARKER.at(-1) as string
 
 export type GitBashConsoleCapacityDetector = {
   observe: (data: string) => void
@@ -14,9 +18,17 @@ export function createGitBashConsoleCapacityDetector(): GitBashConsoleCapacityDe
       if (matched || data.length === 0) {
         return
       }
+      if (!data.includes(MARKER_FINAL_CHAR)) {
+        // Fold only the carry instead of copying the whole chunk: this runs per PTY chunk per pane.
+        tail =
+          data.length >= CARRY_LENGTH
+            ? data.slice(-CARRY_LENGTH).toLowerCase()
+            : (tail + data).slice(-CARRY_LENGTH).toLowerCase()
+        return
+      }
       const candidate = (tail + data).toLowerCase()
       matched = candidate.includes(GIT_BASH_CONSOLE_CAPACITY_MARKER)
-      tail = candidate.slice(-(GIT_BASH_CONSOLE_CAPACITY_MARKER.length - 1))
+      tail = candidate.slice(-CARRY_LENGTH)
     },
     detected: () => matched
   }
diff --git a/src/renderer/src/components/terminal-pane/ipc-pty-connect-result.ts b/src/renderer/src/components/terminal-pane/ipc-pty-connect-result.ts
index 3dda2f83fec..bcfc0d3f67c 100644
--- a/src/renderer/src/components/terminal-pane/ipc-pty-connect-result.ts
+++ b/src/renderer/src/components/terminal-pane/ipc-pty-connect-result.ts
@@ -16,6 +16,10 @@ export function projectIpcPtyConnectResult(
       snapshot: spawnResult.snapshot,
       snapshotCols: spawnResult.snapshotCols,
       snapshotRows: spawnResult.snapshotRows,
+      ...(spawnResult.snapshotSeq !== undefined ? { snapshotSeq: spawnResult.snapshotSeq } : {}),
+      ...(spawnResult.snapshotKittyKeyboardFlags !== undefined
+        ? { snapshotKittyKeyboardFlags: spawnResult.snapshotKittyKeyboardFlags }
+        : {}),
       ...(spawnResult.snapshotPrefixAnsi !== undefined
         ? { snapshotPrefixAnsi: spawnResult.snapshotPrefixAnsi }
         : {}),
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-deferred-reattach-live-output.test.ts b/src/renderer/src/components/terminal-pane/pty-connection-deferred-reattach-live-output.test.ts
index fa110cdfe0e..ed38f6a31a4 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-deferred-reattach-live-output.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-deferred-reattach-live-output.test.ts
@@ -231,6 +231,41 @@ describe('connectPanePty', () => {
     expect(transport.sendInput).not.toHaveBeenCalled()
   })
 
+  it.each([
+    { kind: 'covered backlog', snapshot: 'startup\r\n', seq: 9, count: 1 },
+    { kind: 'legacy unsequenced snapshot', snapshot: 'startup\r\n', seq: undefined, count: 2 },
+    { kind: 'blank snapshot', snapshot: '\x1b[2J', seq: 9, count: 1 }
+  ])(
+    'preserves output while reconciling $kind on daemon adoption',
+    async ({ snapshot, seq, count }) => {
+      const { connectPanePty } = await import('./pty-connection')
+      const transport = createMockTransport('tab-pty')
+      transport.connect.mockImplementation(
+        async ({ sessionId, callbacks }: { sessionId?: string; callbacks?: ConnectCallbacks }) => {
+          callbacks?.onData?.('startup\r\n', { seq: 9, rawLength: 9 })
+          callbacks?.onData?.('new output\r\n', { seq: 21, rawLength: 12 })
+          return { id: sessionId, snapshot, snapshotSeq: seq }
+        }
+      )
+      transportFactoryQueue.push(transport)
+      const pane = createPane(1)
+      const { writes, parseCallbacks } = captureCallbackTerminalWrites(pane)
+      const deps = createDeps({
+        isVisibleRef: { current: true },
+        restoredLeafId: LEAF_1,
+        restoredPtyIdByLeafId: { [LEAF_1]: 'tab-pty' }
+      })
+      connectPanePty(pane as never, createManager(1) as never, deps as never)
+      await flushAsyncTicks(20)
+      for (let step = 0; step < 40; step += 1) {
+        parseCallbacks.shift()?.()
+        await flushAsyncTicks(2)
+      }
+      expect(writes.join('').match(/startup/g)).toHaveLength(count)
+      expect(writes.join('')).toContain('new output')
+    }
+  )
+
   it('drains live bytes after transport confirms an explicit reattach', async () => {
     const { connectPanePty } = await import('./pty-connection')
     const { deliverTerminalDataWithDeferredCredit } =
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/apply-reattach-payload.ts b/src/renderer/src/components/terminal-pane/pty-connection/apply-reattach-payload.ts
index cb0806900af..ad64d458711 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection/apply-reattach-payload.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection/apply-reattach-payload.ts
@@ -100,6 +100,13 @@ export function createReattachPayloadHandlers(
         // Why last: re-arm the dangling mid-escape after the reset (whose ESC would abort it) so the live continuation completes it (#7329).
         session.writeReplayData(ctx.connectResult.pendingEscapeTailAnsi)
       }
+      // The initial attach backlog can contain bytes already painted by this snapshot.
+      session.setRestoredSnapshotBaseline(
+        ctx.ptyId,
+        { seq: ctx.connectResult.snapshotSeq },
+        restoredSnapshotPaintsPrintableContent({ data: daemonSnapshotReplay })
+      )
+      session.recordRendererOrderedSeq({ seq: ctx.connectResult.snapshotSeq })
       session.sendFocusedReattachFocusInAfterReplay(ctx.ptyId, ctx.attemptGeneration)
       if (ctx.connectResult.coldRestore) {
         // Snapshot superseded the cold-restore payload; ack so the daemon doesn't redeliver it.
diff --git a/src/renderer/src/components/terminal-pane/pty-transport-connect-spawn.test.ts b/src/renderer/src/components/terminal-pane/pty-transport-connect-spawn.test.ts
index 66dca98b360..138059f372b 100644
--- a/src/renderer/src/components/terminal-pane/pty-transport-connect-spawn.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-transport-connect-spawn.test.ts
@@ -26,6 +26,24 @@ describe('createIpcPtyTransport', () => {
     restorePtySpecWindow(originalWindow)
   })
 
+  it.each([0, 420])(
+    'preserves snapshot sequence and keyboard proof %s across IPC reattach',
+    async (seq) => {
+      const { createIpcPtyTransport } = await import('./pty-transport')
+      vi.mocked(window.api.pty.spawn).mockResolvedValue({
+        id: 'existing',
+        isReattach: true,
+        snapshot: 'ready',
+        snapshotSeq: seq,
+        snapshotKittyKeyboardFlags: 0
+      })
+      const transport = createIpcPtyTransport({})
+      const result = await transport.connect({ url: '', sessionId: 'existing', callbacks: {} })
+      expect(result).toMatchObject({ snapshotSeq: seq, snapshotKittyKeyboardFlags: 0 })
+      transport.detach?.()
+    }
+  )
+
   it('leaves title tracking to the PTY data stream (no OpenCode IPC channel)', async () => {
     // Why: the OpenCode status IPC channel is gone (now the agent-hooks server), so the transport has no per-agent status callback.
     const { createIpcPtyTransport } = await import('./pty-transport')
diff --git a/src/renderer/src/components/terminal-pane/terminal-pane-manager-options.ts b/src/renderer/src/components/terminal-pane/terminal-pane-manager-options.ts
index 08eab4c0cf5..128b715a3c5 100644
--- a/src/renderer/src/components/terminal-pane/terminal-pane-manager-options.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-pane-manager-options.ts
@@ -1,6 +1,7 @@
 import type { IDisposable } from '@xterm/xterm'
 import type { PaneManagerOptions } from '@/lib/pane-manager/pane-manager'
 import { useAppStore } from '@/store'
+import { resolveTerminalLigaturesEnabled } from '../../../../shared/terminal-ligatures'
 import { resolveTerminalFontWeights } from '../../../../shared/terminal-fonts'
 import { normalizeTerminalLineHeight } from '../../../../shared/terminal-line-height-settings'
 import { normalizeDesktopTerminalScrollbackRows } from '../../../../shared/terminal-scrollback-policy'
@@ -102,6 +103,11 @@ export function createTerminalPaneManagerOptions(
     },
     resolveExternalPaneDropTarget,
     onExternalPaneDrop,
+    terminalLigaturesEnabled: () =>
+      resolveTerminalLigaturesEnabled(
+        settingsRef.current?.terminalLigatures,
+        settingsRef.current?.terminalFontFamily
+      ),
     terminalOptions: () => {
       const currentSettings = settingsRef.current
       const terminalFontWeights = resolveTerminalFontWeights(
diff --git a/src/renderer/src/components/terminal-pane/terminal-paste-executor-default-yield.test.ts b/src/renderer/src/components/terminal-pane/terminal-paste-executor-default-yield.test.ts
new file mode 100644
index 00000000000..4adc98a585b
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/terminal-paste-executor-default-yield.test.ts
@@ -0,0 +1,101 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+
+// Why: the executor must yield through the shared helper by default, not a local setTimeout(0)
+// that Chromium clamps once nested. Mocking the module pins the default's identity without
+// depending on the helper's Vitest-only setTimeout fallback.
+const { events, yieldToEventLoop } = vi.hoisted(() => {
+  const events: string[] = []
+  return {
+    events,
+    yieldToEventLoop: vi.fn(async () => {
+      events.push('yield')
+    })
+  }
+})
+
+vi.mock('../../../../shared/event-loop-yield', () => ({ yieldToEventLoop }))
+
+import { planTerminalPaste, type TerminalPasteTarget } from './terminal-paste-coordinator'
+import { executeTerminalPastePlan } from './terminal-paste-executor'
+
+const target: TerminalPasteTarget = {
+  kind: 'terminal',
+  paneId: 1,
+  leafId: 'leaf-1',
+  ptyId: 'pty-default-yield',
+  runtime: { platform: 'linux', runtimeKey: 'local:linux', kind: 'local' }
+}
+
+function chunkedPlan() {
+  return planTerminalPaste({
+    text: '0123456789abcdef',
+    source: 'keyboard',
+    target,
+    maxDirectBytes: 4,
+    maxChunkBytes: 4
+  })
+}
+
+afterEach(() => {
+  events.length = 0
+  yieldToEventLoop.mockClear()
+  vi.restoreAllMocks()
+})
+
+describe('terminal paste executor default yield', () => {
+  it('yields after every chunk through the shared event-loop helper, never a timer', async () => {
+    const setTimeoutSpy = vi.spyOn(globalThis, 'setTimeout')
+    const writePty = vi.fn((chunk: string) => {
+      events.push(`write:${chunk}`)
+      return true
+    })
+    const plan = chunkedPlan()
+    expect(plan.mode).toBe('chunked')
+
+    const result = await executeTerminalPastePlan(plan, {
+      pasteText: vi.fn(),
+      writePty,
+      isTargetCurrent: () => true,
+      canContinue: () => true,
+      // Why: 0 disables the per-operation timeout timer, so any setTimeout call would be a yield.
+      operationTimeoutMs: 0
+    })
+
+    expect(result.status).toBe('pasted')
+    expect(events).toEqual([
+      'write:0123',
+      'yield',
+      'write:4567',
+      'yield',
+      'write:89ab',
+      'yield',
+      'write:cdef',
+      'yield'
+    ])
+    expect(setTimeoutSpy).not.toHaveBeenCalled()
+  })
+
+  it('re-checks the target after a default yield before writing the next chunk', async () => {
+    let current = true
+    yieldToEventLoop.mockImplementationOnce(async () => {
+      events.push('yield')
+      current = false
+    })
+    const writePty = vi.fn((chunk: string) => {
+      events.push(`write:${chunk}`)
+      return true
+    })
+
+    const result = await executeTerminalPastePlan(chunkedPlan(), {
+      pasteText: vi.fn(),
+      writePty,
+      isTargetCurrent: () => current,
+      canContinue: () => true,
+      operationTimeoutMs: 0
+    })
+
+    expect(result.status).toBe('cancelled')
+    expect(result.reason).toBe('stale-target')
+    expect(events).toEqual(['write:0123', 'yield'])
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/terminal-paste-executor.ts b/src/renderer/src/components/terminal-pane/terminal-paste-executor.ts
index 39a05f4dd24..747bc7b8bed 100644
--- a/src/renderer/src/components/terminal-pane/terminal-paste-executor.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-paste-executor.ts
@@ -1,3 +1,4 @@
+import { yieldToEventLoop as yieldToEventLoopTask } from '../../../../shared/event-loop-yield'
 import { BRACKETED_PASTE_END, BRACKETED_PASTE_START } from './terminal-bracketed-paste'
 import { iterateTerminalPastePlanChunks } from './terminal-paste-chunks'
 import { createRedactedPasteExecutionDiagnostic } from './terminal-paste-diagnostics'
@@ -40,7 +41,7 @@ async function executeTerminalPastePlanNow(
     writePty,
     isTargetCurrent,
     canContinue,
-    yieldToEventLoop = defaultYieldToEventLoop,
+    yieldToEventLoop = yieldToEventLoopTask,
     operationTimeoutMs = getTerminalPasteOperationTimeoutMs(plan),
     now = defaultNow
   }: ExecuteTerminalPastePlanArgs
@@ -190,7 +191,3 @@ function result(
 function defaultNow(): number {
   return globalThis.performance?.now?.() ?? Date.now()
 }
-
-function defaultYieldToEventLoop(): Promise<void> {
-  return new Promise((resolve) => setTimeout(resolve, 0))
-}
diff --git a/src/renderer/src/components/terminal-pane/use-terminal-pane-close-actions.ts b/src/renderer/src/components/terminal-pane/use-terminal-pane-close-actions.ts
index 886c19fdf0d..330b42166cd 100644
--- a/src/renderer/src/components/terminal-pane/use-terminal-pane-close-actions.ts
+++ b/src/renderer/src/components/terminal-pane/use-terminal-pane-close-actions.ts
@@ -5,7 +5,7 @@ import { makePaneKey } from '../../../../shared/stable-pane-id'
 import { closeWebRuntimeTerminal } from '@/runtime/web-runtime-session'
 import { resolveLeafCloseCopyKind } from '../terminal/terminal-close-copy-kind'
 import { RUNNING_CLOSE_PROBE_TIMEOUT_MS } from '../terminal/running-terminal-close-guard'
-import { inspectRuntimeTerminalProcess } from '@/runtime/runtime-terminal-inspection'
+import { probePtyRunningWork } from '../terminal/pty-running-work-probe'
 import {
   detachTerminalPaneToTab,
   isTerminalTabStripDropTarget,
@@ -99,12 +99,14 @@ export function useTerminalPaneCloseActions(controller: TerminalPaneBindingContr
           copyKind: getCloseDialogCopyKind(paneId)
         })
       const probeTimeout = setTimeout(() => decide(confirmClose), RUNNING_CLOSE_PROBE_TIMEOUT_MS)
-      void inspectRuntimeTerminalProcess(settings, ptyId)
-        .then((process) => {
+      // Why the shared probe rather than a direct inspect: this is the same question the tab-close
+      // guard asks, and the two must not drift on what an unanswered host means.
+      void probePtyRunningWork(settings, [ptyId], { timeoutMs: RUNNING_CLOSE_PROBE_TIMEOUT_MS })
+        .then((probes) => {
           clearTimeout(probeTimeout)
           decide(() => {
             if (
-              !process.hasChildProcesses ||
+              probes[0]?.verdict !== 'live' ||
               settings?.skipCloseTerminalWithRunningProcessConfirm
             ) {
               executeClosePane(paneId)
diff --git a/src/renderer/src/components/terminal/pty-running-work-probe-child-evidence.test.ts b/src/renderer/src/components/terminal/pty-running-work-probe-child-evidence.test.ts
new file mode 100644
index 00000000000..4d002ee0191
--- /dev/null
+++ b/src/renderer/src/components/terminal/pty-running-work-probe-child-evidence.test.ts
@@ -0,0 +1,94 @@
+// The probe is the one place an inspection becomes a verdict, so it is the one place that has to
+// know `hasChildProcesses` cannot hold the third answer. A host that could not read its own process
+// table spells that the same way as one that read it and found nothing; Windows relays spelled it
+// `false` unconditionally, which read here as `exited` -- an idle verdict for a pane nobody looked at.
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { inspectRuntimeTerminalProcessMock } = vi.hoisted(() => ({
+  inspectRuntimeTerminalProcessMock: vi.fn()
+}))
+
+vi.mock('@/runtime/runtime-terminal-inspection', () => ({
+  inspectRuntimeTerminalProcess: inspectRuntimeTerminalProcessMock
+}))
+
+import { probePtyRunningWork } from './pty-running-work-probe'
+
+const SETTINGS = { activeRuntimeEnvironmentId: null }
+
+describe('probePtyRunningWork child-process evidence', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('asks the host to pay for a scan, because these probes back destructive decisions', async () => {
+    inspectRuntimeTerminalProcessMock.mockResolvedValue({
+      foregroundProcess: 'cmd.exe',
+      hasChildProcesses: false,
+      childProcessEvidence: 'no-children'
+    })
+
+    await probePtyRunningWork(SETTINGS, ['pty-a'], { timeoutMs: 1000 })
+
+    expect(inspectRuntimeTerminalProcessMock).toHaveBeenCalledWith(SETTINGS, 'pty-a', {
+      scanChildProcesses: true
+    })
+  })
+
+  it('reports a host that could not observe the pane as unverifiable, not exited', async () => {
+    inspectRuntimeTerminalProcessMock.mockResolvedValue({
+      foregroundProcess: 'cmd.exe',
+      hasChildProcesses: false,
+      childProcessEvidence: 'unverifiable'
+    })
+
+    const [probe] = await probePtyRunningWork(SETTINGS, ['pty-a'], { timeoutMs: 1000 })
+
+    expect(probe).toMatchObject({
+      verdict: 'unverifiable',
+      reason: 'host_child_processes_unobserved',
+      timedOut: false
+    })
+  })
+
+  it('reports an observed-empty pane as exited', async () => {
+    inspectRuntimeTerminalProcessMock.mockResolvedValue({
+      foregroundProcess: 'cmd.exe',
+      hasChildProcesses: false,
+      childProcessEvidence: 'no-children'
+    })
+
+    const [probe] = await probePtyRunningWork(SETTINGS, ['pty-a'], { timeoutMs: 1000 })
+
+    expect(probe?.verdict).toBe('exited')
+  })
+
+  it('reports an observed child as live', async () => {
+    inspectRuntimeTerminalProcessMock.mockResolvedValue({
+      foregroundProcess: 'PING.EXE',
+      hasChildProcesses: true,
+      childProcessEvidence: 'children'
+    })
+
+    const [probe] = await probePtyRunningWork(SETTINGS, ['pty-a'], { timeoutMs: 1000 })
+
+    expect(probe?.verdict).toBe('live')
+  })
+
+  it('keeps the boolean meaning for a host that never published the verdict', async () => {
+    inspectRuntimeTerminalProcessMock.mockResolvedValueOnce({
+      foregroundProcess: 'node',
+      hasChildProcesses: true
+    })
+    inspectRuntimeTerminalProcessMock.mockResolvedValueOnce({
+      foregroundProcess: 'bash',
+      hasChildProcesses: false
+    })
+
+    const [live] = await probePtyRunningWork(SETTINGS, ['pty-a'], { timeoutMs: 1000 })
+    const [idle] = await probePtyRunningWork(SETTINGS, ['pty-b'], { timeoutMs: 1000 })
+
+    expect(live?.verdict).toBe('live')
+    expect(idle?.verdict).toBe('exited')
+  })
+})
diff --git a/src/renderer/src/components/terminal/pty-running-work-probe.ts b/src/renderer/src/components/terminal/pty-running-work-probe.ts
new file mode 100644
index 00000000000..1ee456ba389
--- /dev/null
+++ b/src/renderer/src/components/terminal/pty-running-work-probe.ts
@@ -0,0 +1,105 @@
+import type { GlobalSettings } from '../../../../shared/global-settings-types'
+import { inspectRuntimeTerminalProcess } from '@/runtime/runtime-terminal-inspection'
+import { isRemoteExecutionHostPtyId } from '../../../../shared/remote-execution-host-pty-id'
+import { isClientOnlyUnverifiableInspection } from '../../../../shared/terminal-process-inspection'
+
+/**
+ * One probe answer in the fixed `live` / `unverifiable` / `exited` vocabulary of
+ * `docs/reference/ssh-execution-boundary.md`. `exited` is only ever produced by a host that
+ * answered; every failure to reach the owner — a rejection, a closed transport, or a deadline
+ * that expired first — stays `unverifiable`, because loss of contact is not evidence of death.
+ */
+export type PtyRunningWorkVerdict = 'live' | 'unverifiable' | 'exited'
+
+export type PtyRunningWorkProbe = {
+  ptyId: string
+  verdict: PtyRunningWorkVerdict
+  /** Why the owner could not be observed. Only set for `unverifiable`. */
+  reason?: string
+  /** The deadline expired before this pty's probe answered at all. */
+  timedOut: boolean
+  /** The pty is owned by a remote execution host (relay runtime or app SSH). */
+  remote: boolean
+}
+
+type ProbeSettings = Pick<GlobalSettings, 'activeRuntimeEnvironmentId'> | null | undefined
+
+/**
+ * Probes every pty for running work and resolves at whichever comes first: every answer, or the
+ * deadline. Never rejects, and never reports a pty it did not hear back about as idle.
+ *
+ * Callers own the policy. This owns only the measurement, so the tab-close guard and the
+ * window-close guard cannot drift apart on what an unanswered remote host means.
+ */
+export async function probePtyRunningWork(
+  settings: ProbeSettings,
+  ptyIds: readonly string[],
+  options: { timeoutMs: number }
+): Promise<PtyRunningWorkProbe[]> {
+  if (ptyIds.length === 0) {
+    return []
+  }
+  const probes: PtyRunningWorkProbe[] = ptyIds.map((ptyId) => ({
+    ptyId,
+    verdict: 'unverifiable',
+    reason: 'probe_deadline',
+    timedOut: true,
+    remote: isRemoteExecutionHostPtyId(ptyId)
+  }))
+
+  const settle = Promise.all(
+    ptyIds.map(async (ptyId, index) => {
+      const probe = probes[index]
+      if (!probe) {
+        return
+      }
+      try {
+        // Why the flag: this probe backs decisions that act once and destructively, so it is worth
+        // a host process-table read on platforms where the child question costs one. The polled
+        // inspections deliberately do not ask for it.
+        const inspection = await inspectRuntimeTerminalProcess(settings, ptyId, {
+          scanChildProcesses: true
+        })
+        probe.timedOut = false
+        if (isClientOnlyUnverifiableInspection(inspection)) {
+          probe.verdict = 'unverifiable'
+          probe.reason = inspection.reason
+          return
+        }
+        // `hasChildProcesses` cannot hold the third answer: a host that could not read its own
+        // process table spells that the same way as one that read it and found nothing. Windows
+        // relays spelled it `false` unconditionally, which read here as `exited`.
+        if (inspection.childProcessEvidence === 'unverifiable') {
+          probe.verdict = 'unverifiable'
+          probe.reason = 'host_child_processes_unobserved'
+          return
+        }
+        probe.verdict =
+          (inspection.childProcessEvidence ??
+            (inspection.hasChildProcesses ? 'children' : 'no-children')) === 'children'
+            ? 'live'
+            : 'exited'
+        delete probe.reason
+      } catch {
+        // Why: `inspectRuntimeTerminalProcess` already maps every failure it can classify onto a
+        // reason; an unclassified throw is still a failure to observe, so it stays unverifiable.
+        probe.timedOut = false
+        probe.verdict = 'unverifiable'
+        probe.reason = 'probe_failed'
+      }
+    })
+  )
+
+  let deadline: ReturnType<typeof setTimeout> | undefined
+  try {
+    await Promise.race([
+      settle,
+      new Promise<void>((resolve) => {
+        deadline = setTimeout(resolve, options.timeoutMs)
+      })
+    ])
+  } finally {
+    clearTimeout(deadline)
+  }
+  return probes
+}
diff --git a/src/renderer/src/components/terminal/running-terminal-close-guard.test.ts b/src/renderer/src/components/terminal/running-terminal-close-guard.test.ts
index d63c69df7c9..6b5b8343086 100644
--- a/src/renderer/src/components/terminal/running-terminal-close-guard.test.ts
+++ b/src/renderer/src/components/terminal/running-terminal-close-guard.test.ts
@@ -46,10 +46,12 @@ function visibleRequest() {
   return useRunningTerminalCloseConfirmStore.getState().runningTerminalCloseConfirm
 }
 
+// Drains pending microtasks. The probe resolves through several await points (per-pty inspect,
+// the batch join, the deadline race), so this flushes generously rather than counting ticks.
 async function settleProbe(): Promise<void> {
-  await Promise.resolve()
-  await Promise.resolve()
-  await Promise.resolve()
+  for (let tick = 0; tick < 12; tick += 1) {
+    await Promise.resolve()
+  }
 }
 
 describe('shouldConfirmRunningTerminalClose', () => {
@@ -109,7 +111,9 @@ describe('guardRunningTerminalClose', () => {
     guard(onClose)
     await settleProbe()
 
-    expect(inspectRuntimeTerminalProcessMock).toHaveBeenCalledWith(expect.anything(), 'pty-a')
+    expect(inspectRuntimeTerminalProcessMock).toHaveBeenCalledWith(expect.anything(), 'pty-a', {
+      scanChildProcesses: true
+    })
     expect(onClose).not.toHaveBeenCalled()
     expect(visibleRequest()).toMatchObject({ terminalTabId: 'tab-1' })
   })
@@ -329,6 +333,7 @@ describe('guardRunningTerminalClose', () => {
 
     vi.advanceTimersByTime(RUNNING_CLOSE_PROBE_TIMEOUT_MS)
     vi.useRealTimers()
+    await settleProbe()
 
     expect(onClose).not.toHaveBeenCalled()
     expect(visibleRequest()).toMatchObject({ terminalTabId: 'tab-1', tabLabel: 'npm run dev' })
@@ -351,6 +356,7 @@ describe('guardRunningTerminalClose', () => {
     guard()
     vi.advanceTimersByTime(RUNNING_CLOSE_PROBE_TIMEOUT_MS)
     vi.useRealTimers()
+    await settleProbe()
 
     expect(visibleRequest()?.copyKind).toBe('agent')
   })
@@ -368,6 +374,7 @@ describe('guardRunningTerminalClose', () => {
     guard(onClose)
     vi.advanceTimersByTime(RUNNING_CLOSE_PROBE_TIMEOUT_MS)
     vi.useRealTimers()
+    await settleProbe()
     requestSpy.mockRestore()
 
     expect(onClose).toHaveBeenCalledTimes(1)
@@ -385,6 +392,7 @@ describe('guardRunningTerminalClose', () => {
     vi.advanceTimersByTime(RUNNING_CLOSE_PROBE_TIMEOUT_MS)
     vi.useRealTimers()
     await settleProbe()
+    await settleProbe()
 
     expect(onClose).not.toHaveBeenCalled()
     useRunningTerminalCloseConfirmStore.getState().confirmRunningTerminalClose()
diff --git a/src/renderer/src/components/terminal/running-terminal-close-guard.ts b/src/renderer/src/components/terminal/running-terminal-close-guard.ts
index 881cd262353..6bb9ff5a582 100644
--- a/src/renderer/src/components/terminal/running-terminal-close-guard.ts
+++ b/src/renderer/src/components/terminal/running-terminal-close-guard.ts
@@ -1,10 +1,9 @@
 import { useAppStore } from '@/store'
-import { inspectRuntimeTerminalProcess } from '@/runtime/runtime-terminal-inspection'
 import { useRunningTerminalCloseConfirmStore } from '@/store/running-terminal-close-confirm'
 import type { TerminalTabCloseReason } from '@/store/slices/terminal-tab-retirement'
 import type { AppState } from '@/store/types'
 import { resolveBusyPtyCloseCopyKind } from './terminal-close-copy-kind'
-import { isClientOnlyUnverifiableInspection } from '../../../../shared/terminal-process-inspection'
+import { probePtyRunningWork } from './pty-running-work-probe'
 
 export type RunningTerminalCloseGuardOptions = {
   force?: boolean
@@ -44,7 +43,7 @@ export function shouldConfirmRunningTerminalClose(
  *  the store's own teardown collector unions both for exactly that reason — reading only
  *  the map would let a close slip through the window with no prompt. A stale id costs
  *  nothing: its probe fails and the guard falls open. */
-function collectTabPtyIds(
+export function collectTabPtyIds(
   state: Pick<AppState, 'ptyIdsByTabId' | 'terminalLayoutsByTabId'>,
   terminalTabId: string
 ): string[] {
@@ -112,44 +111,33 @@ export function guardRunningTerminalClose(params: {
     decided = true
   }
 
-  const probeTimeout = setTimeout(() => {
-    try {
+  void probePtyRunningWork(settings, ptyIds, { timeoutMs: RUNNING_CLOSE_PROBE_TIMEOUT_MS })
+    .then((probes) => {
+      if (decided) {
+        return
+      }
       // Why: a probe that has not answered yet is unknown, not idle. Ask, treating every pty
       // as a candidate, so a degraded relay costs a click instead of a killed remote command.
-      confirmClose(ptyIds)
-    } catch {
-      closeNow()
-    }
-  }, RUNNING_CLOSE_PROBE_TIMEOUT_MS)
-
-  void Promise.allSettled(ptyIds.map((ptyId) => inspectRuntimeTerminalProcess(settings, ptyId)))
-    .then((results) => {
-      clearTimeout(probeTimeout)
-      if (decided) {
+      if (probes.some((probe) => probe.timedOut)) {
+        confirmClose(ptyIds)
         return
       }
       // Why: fail open on an *answered* probe, matching the Cmd+W pane path — a rejection
       // (wedged relay, legacy provider) or a stale remote handle is not evidence of a live
       // child, and a close button that silently does nothing is worse than closing a busy tab.
-      const busyPtyIds = ptyIds.filter((_, index) => {
-        const result = results[index]
-        return (
-          result?.status === 'fulfilled' &&
-          !isClientOnlyUnverifiableInspection(result.value) &&
-          result.value.hasChildProcesses
-        )
-      })
+      const busyPtyIds = probes
+        .filter((probe) => probe.verdict === 'live')
+        .map((probe) => probe.ptyId)
       if (busyPtyIds.length === 0) {
         closeNow()
         return
       }
       confirmClose(busyPtyIds)
     })
-    // Why: allSettled never rejects, so this only fires when the decision above throws (a
+    // Why: the probe never rejects, so this only fires when the decision above throws (a
     // copy-kind lookup, a store subscriber). Without it the tab would silently never close
     // and the user would get no feedback at all; the pane path it replaced had this catch.
     .catch(() => {
-      clearTimeout(probeTimeout)
       closeNow()
     })
 }
diff --git a/src/renderer/src/components/terminal/terminal-close-confirm-keyboard-vs-mouse.test.ts b/src/renderer/src/components/terminal/terminal-close-confirm-keyboard-vs-mouse.test.ts
index 29b2e6cfd08..b2cdcb5b2ad 100644
--- a/src/renderer/src/components/terminal/terminal-close-confirm-keyboard-vs-mouse.test.ts
+++ b/src/renderer/src/components/terminal/terminal-close-confirm-keyboard-vs-mouse.test.ts
@@ -5,7 +5,7 @@
  *
  * Mouse close path: SortableTab (X onClick / onAuxClick button===1) -> onClose
  *   -> Terminal.tsx handleCloseTab -> closeTerminalTab() -> running-process guard.
- * Keyboard path: Cmd+W -> TerminalPane.handleRequestClosePane -> inspectRuntimeTerminalProcess
+ * Keyboard path: Cmd+W -> TerminalPane.handleRequestClosePane -> probePtyRunningWork
  *   (split panes) or closeTerminalTab's guard (last pane) -> CloseTerminalDialog.
  */
 import { readFileSync } from 'node:fs'
@@ -99,8 +99,11 @@ describe('#10142 close confirmation policy is the same for keyboard and mouse',
       'utf8'
     )
     const handler = source.slice(source.indexOf('const handleRequestClosePane'))
+    // The shared probe, not a direct inspect: the pane path asks the same question as the tab
+    // guard, and routing both through one measurement is what stops them drifting on what an
+    // unanswered host means.
     expect(handler.slice(0, handler.indexOf('useImperativeHandle'))).toContain(
-      'inspectRuntimeTerminalProcess'
+      'probePtyRunningWork'
     )
   })
 
diff --git a/src/renderer/src/components/terminal/terminal-tab-actions.ts b/src/renderer/src/components/terminal/terminal-tab-actions.ts
index 49bc3d11fef..92eb85b49e5 100644
--- a/src/renderer/src/components/terminal/terminal-tab-actions.ts
+++ b/src/renderer/src/components/terminal/terminal-tab-actions.ts
@@ -157,7 +157,7 @@ export function closeTerminalTab(
         toast.error(
           translate(
             'components.native-chat.structuredSessionCloseFailed',
-            'Could not close this Codex chat'
+            'Could not close this chat session'
           ),
           {
             description: translate(
diff --git a/src/renderer/src/components/terminal/terminal-tab-close-running-confirm.test.ts b/src/renderer/src/components/terminal/terminal-tab-close-running-confirm.test.ts
index 066c5795ef9..9dfe20ef501 100644
--- a/src/renderer/src/components/terminal/terminal-tab-close-running-confirm.test.ts
+++ b/src/renderer/src/components/terminal/terminal-tab-close-running-confirm.test.ts
@@ -87,10 +87,12 @@ function visibleRequest() {
   return useRunningTerminalCloseConfirmStore.getState().runningTerminalCloseConfirm
 }
 
+// Drains pending microtasks. The probe resolves through several await points (per-pty inspect,
+// the batch join, the deadline race), so this flushes generously rather than counting ticks.
 async function settleProbe(): Promise<void> {
-  await Promise.resolve()
-  await Promise.resolve()
-  await Promise.resolve()
+  for (let tick = 0; tick < 12; tick += 1) {
+    await Promise.resolve()
+  }
 }
 
 describe('closeTerminalTab running-process confirmation', () => {
diff --git a/src/renderer/src/components/terminal/window-close-running-work.test.ts b/src/renderer/src/components/terminal/window-close-running-work.test.ts
new file mode 100644
index 00000000000..77dc4ad745b
--- /dev/null
+++ b/src/renderer/src/components/terminal/window-close-running-work.test.ts
@@ -0,0 +1,231 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { getStateMock, inspectRuntimeTerminalProcessMock } = vi.hoisted(() => ({
+  getStateMock: vi.fn(),
+  inspectRuntimeTerminalProcessMock: vi.fn()
+}))
+
+vi.mock('@/store', () => ({
+  useAppStore: { getState: getStateMock }
+}))
+
+vi.mock('@/runtime/runtime-terminal-inspection', () => ({
+  inspectRuntimeTerminalProcess: inspectRuntimeTerminalProcessMock
+}))
+
+import {
+  assessWindowCloseRunningWork,
+  WINDOW_CLOSE_PROBE_TIMEOUT_MS
+} from './window-close-running-work'
+
+const LOCAL_PTY = 'pty-local'
+const SSH_PTY = 'ssh:openclaw@@pty-7'
+const RUNTIME_PTY = 'remote:env-1@@handle-1'
+/** A runtime pty minted without an owner id. Still someone else's machine. */
+const OWNERLESS_RUNTIME_PTY = 'remote:handle-2'
+
+const BUSY = {
+  foregroundProcess: 'pnpm build',
+  hasChildProcesses: true,
+  foregroundProcessEvidence: {}
+}
+const IDLE = { foregroundProcess: 'bash', hasChildProcesses: false, foregroundProcessEvidence: {} }
+const UNVERIFIABLE = {
+  foregroundProcess: null,
+  hasChildProcesses: false,
+  verdict: 'unverifiable',
+  reason: 'transport_loss'
+}
+
+/** One worktree, one tab, owning `ptyIds`. */
+function setState(ptyIds: string[]): void {
+  getStateMock.mockReturnValue({
+    settings: { activeRuntimeEnvironmentId: null },
+    tabsByWorktree: { 'worktree-1': [{ id: 'tab-1' }] },
+    ptyIdsByTabId: { 'tab-1': ptyIds },
+    terminalLayoutsByTabId: {}
+  })
+}
+
+/** Answers each pty id from `byPtyId`; anything unlisted never settles. */
+function answerWith(byPtyId: Record<string, unknown>): void {
+  inspectRuntimeTerminalProcessMock.mockImplementation((_settings: unknown, ptyId: string) =>
+    ptyId in byPtyId ? Promise.resolve(byPtyId[ptyId]) : new Promise(() => {})
+  )
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+})
+
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+describe('assessWindowCloseRunningWork', () => {
+  it('warns about a live process on an SSH host (F15: remote work was filtered out entirely)', async () => {
+    setState([SSH_PTY])
+    answerWith({ [SSH_PTY]: BUSY })
+
+    await expect(assessWindowCloseRunningWork({ isQuitting: false })).resolves.toEqual({
+      kind: 'running'
+    })
+  })
+
+  it('warns on quit about a live process on an SSH host', async () => {
+    setState([SSH_PTY])
+    answerWith({ [SSH_PTY]: BUSY })
+
+    await expect(assessWindowCloseRunningWork({ isQuitting: true })).resolves.toEqual({
+      kind: 'running'
+    })
+  })
+
+  it('warns on quit about a live process on a paired runtime host', async () => {
+    setState([RUNTIME_PTY])
+    answerWith({ [RUNTIME_PTY]: BUSY })
+
+    await expect(assessWindowCloseRunningWork({ isQuitting: true })).resolves.toEqual({
+      kind: 'running'
+    })
+  })
+
+  it('counts an owner-less remote pty as remote work', async () => {
+    setState([OWNERLESS_RUNTIME_PTY])
+    answerWith({ [OWNERLESS_RUNTIME_PTY]: BUSY })
+
+    await expect(assessWindowCloseRunningWork({ isQuitting: true })).resolves.toEqual({
+      kind: 'running'
+    })
+  })
+
+  // The crux of docs/reference/ssh-execution-boundary.md: an unreachable host is `unverifiable`,
+  // and quitting on `unverifiable` as though it were `exited` is what orphans live remote work.
+  it('warns rather than quitting silently when a remote host answers unverifiable', async () => {
+    setState([SSH_PTY])
+    answerWith({ [SSH_PTY]: UNVERIFIABLE })
+
+    await expect(assessWindowCloseRunningWork({ isQuitting: true })).resolves.toEqual({
+      kind: 'unverifiable'
+    })
+  })
+
+  it('warns rather than quitting silently when a remote probe throws', async () => {
+    setState([SSH_PTY])
+    inspectRuntimeTerminalProcessMock.mockRejectedValue(new Error('relay wedged'))
+
+    await expect(assessWindowCloseRunningWork({ isQuitting: true })).resolves.toEqual({
+      kind: 'unverifiable'
+    })
+  })
+
+  it('stops waiting at the budget and warns, so an unreachable host cannot hang the quit', async () => {
+    setState([SSH_PTY])
+    answerWith({})
+    vi.useFakeTimers()
+
+    const pending = assessWindowCloseRunningWork({ isQuitting: true })
+    await vi.advanceTimersByTimeAsync(WINDOW_CLOSE_PROBE_TIMEOUT_MS)
+
+    await expect(pending).resolves.toEqual({ kind: 'unverifiable' })
+  })
+
+  it('does not resolve before the budget expires', async () => {
+    setState([SSH_PTY])
+    answerWith({})
+    vi.useFakeTimers()
+    const settled = vi.fn()
+
+    void assessWindowCloseRunningWork({ isQuitting: true }).then(settled)
+    await vi.advanceTimersByTimeAsync(WINDOW_CLOSE_PROBE_TIMEOUT_MS - 1)
+
+    expect(settled).not.toHaveBeenCalled()
+  })
+
+  it('does not warn when the owning remote host reports an idle shell', async () => {
+    setState([SSH_PTY])
+    answerWith({ [SSH_PTY]: IDLE })
+
+    await expect(assessWindowCloseRunningWork({ isQuitting: true })).resolves.toEqual({
+      kind: 'none'
+    })
+  })
+
+  it('reports a live process even when a sibling remote pane is only unverifiable', async () => {
+    setState([SSH_PTY, RUNTIME_PTY])
+    answerWith({ [SSH_PTY]: UNVERIFIABLE, [RUNTIME_PTY]: BUSY })
+
+    await expect(assessWindowCloseRunningWork({ isQuitting: true })).resolves.toEqual({
+      kind: 'running'
+    })
+  })
+
+  it('still warns about a live local process when closing the window', async () => {
+    setState([LOCAL_PTY])
+    answerWith({ [LOCAL_PTY]: BUSY })
+
+    await expect(assessWindowCloseRunningWork({ isQuitting: false })).resolves.toEqual({
+      kind: 'running'
+    })
+  })
+
+  // A local probe has no transport to lose, so its failure means the pty is gone — unlike a
+  // remote host going quiet, it is not a reason to hold up the close.
+  it('does not warn when only a local probe is unverifiable', async () => {
+    setState([LOCAL_PTY])
+    answerWith({ [LOCAL_PTY]: UNVERIFIABLE })
+
+    await expect(assessWindowCloseRunningWork({ isQuitting: false })).resolves.toEqual({
+      kind: 'none'
+    })
+  })
+
+  // #524 decided quitting is an unambiguous instruction to end this machine's processes. It is
+  // not an instruction to end execution on someone else's, which is why remote still warns above.
+  it('leaves local-only quit unprompted, and never probes for it', async () => {
+    setState([LOCAL_PTY])
+    answerWith({ [LOCAL_PTY]: BUSY })
+
+    await expect(assessWindowCloseRunningWork({ isQuitting: true })).resolves.toEqual({
+      kind: 'none'
+    })
+    expect(inspectRuntimeTerminalProcessMock).not.toHaveBeenCalled()
+  })
+
+  it('probes a pane the layout has bound before the liveness map caught up', async () => {
+    getStateMock.mockReturnValue({
+      settings: { activeRuntimeEnvironmentId: null },
+      tabsByWorktree: { 'worktree-1': [{ id: 'tab-1' }] },
+      ptyIdsByTabId: {},
+      terminalLayoutsByTabId: { 'tab-1': { ptyIdsByLeafId: { leaf: SSH_PTY } } }
+    })
+    answerWith({ [SSH_PTY]: BUSY })
+
+    await expect(assessWindowCloseRunningWork({ isQuitting: true })).resolves.toEqual({
+      kind: 'running'
+    })
+  })
+
+  it('probes each pty once when the map and the layout name the same one', async () => {
+    getStateMock.mockReturnValue({
+      settings: { activeRuntimeEnvironmentId: null },
+      tabsByWorktree: { 'worktree-1': [{ id: 'tab-1' }] },
+      ptyIdsByTabId: { 'tab-1': [SSH_PTY] },
+      terminalLayoutsByTabId: { 'tab-1': { ptyIdsByLeafId: { leaf: SSH_PTY } } }
+    })
+    answerWith({ [SSH_PTY]: IDLE })
+
+    await assessWindowCloseRunningWork({ isQuitting: true })
+
+    expect(inspectRuntimeTerminalProcessMock).toHaveBeenCalledTimes(1)
+  })
+
+  it('closes without probing when no workspace owns a pty', async () => {
+    setState([])
+
+    await expect(assessWindowCloseRunningWork({ isQuitting: false })).resolves.toEqual({
+      kind: 'none'
+    })
+    expect(inspectRuntimeTerminalProcessMock).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/renderer/src/components/terminal/window-close-running-work.ts b/src/renderer/src/components/terminal/window-close-running-work.ts
new file mode 100644
index 00000000000..427ee72dae6
--- /dev/null
+++ b/src/renderer/src/components/terminal/window-close-running-work.ts
@@ -0,0 +1,70 @@
+import { useAppStore } from '@/store'
+import { isRemoteExecutionHostPtyId } from '../../../../shared/remote-execution-host-pty-id'
+import { collectTabPtyIds } from './running-terminal-close-guard'
+import { probePtyRunningWork } from './pty-running-work-probe'
+
+/**
+ * Upper bound on how long closing the window or quitting may wait on the probes.
+ *
+ * Shorter than the tab-close guard's 4s because quit is time-sensitive in a way one tab close is
+ * not: the user has already asked to leave, and a quit that stalls on an unreachable host is its
+ * own bug. A healthy local inspect answers in single-digit milliseconds and a healthy remote one
+ * is a single RPC round-trip on an already-open mux channel, so this leaves roughly 3x headroom
+ * over a slow-but-live transcontinental host while capping the worst case — a host that is simply
+ * gone — at ~1.5s instead of the 15s RPC timeout the probe would otherwise inherit.
+ *
+ * Expiry raises the prompt rather than quitting silently: an unanswered probe is `unverifiable`,
+ * and `unverifiable` is never evidence that remote work has stopped.
+ */
+export const WINDOW_CLOSE_PROBE_TIMEOUT_MS = 1_500
+
+/** Which warning the close should raise, if any. */
+export type WindowCloseRunningWork =
+  /** Every pty that mattered answered, and none had children. */
+  | { kind: 'none' }
+  /** An owning host reported a live child process. */
+  | { kind: 'running' }
+  /** A remote execution host could not be observed, so its work may still be live. */
+  | { kind: 'unverifiable' }
+
+/**
+ * Decides whether a window close or quit should stop and ask.
+ *
+ * Two deliberate asymmetries:
+ *
+ * - **Quit only considers remote ptys.** Quitting is an unambiguous instruction to end this
+ *   machine's processes (#524), but it is not an instruction to end execution on someone else's:
+ *   the client detaches while the relay keeps running, and a target with a bounded grace period
+ *   then SIGKILLs that work once the countdown expires.
+ * - **Only a remote `unverifiable` warns.** A local probe has no transport to lose, so its failure
+ *   means the pty is gone. A remote one that cannot be reached is the case
+ *   `docs/reference/ssh-execution-boundary.md` exists to protect: loss of contact is not evidence
+ *   of `exited`, so it must fail toward asking rather than toward a silent quit.
+ */
+export async function assessWindowCloseRunningWork(params: {
+  isQuitting: boolean
+}): Promise<WindowCloseRunningWork> {
+  const state = useAppStore.getState()
+  const ptyIds = new Set(
+    Object.values(state.tabsByWorktree)
+      .flatMap((worktreeTabs) => worktreeTabs ?? [])
+      .flatMap((tab) => collectTabPtyIds(state, tab.id))
+  )
+  const candidatePtyIds = params.isQuitting
+    ? [...ptyIds].filter(isRemoteExecutionHostPtyId)
+    : [...ptyIds]
+  if (candidatePtyIds.length === 0) {
+    return { kind: 'none' }
+  }
+
+  const probes = await probePtyRunningWork(state.settings, candidatePtyIds, {
+    timeoutMs: WINDOW_CLOSE_PROBE_TIMEOUT_MS
+  })
+  if (probes.some((probe) => probe.verdict === 'live')) {
+    return { kind: 'running' }
+  }
+  if (probes.some((probe) => probe.remote && probe.verdict === 'unverifiable')) {
+    return { kind: 'unverifiable' }
+  }
+  return { kind: 'none' }
+}
diff --git a/src/renderer/src/components/use-terminal-editor-close-foundation.ts b/src/renderer/src/components/use-terminal-editor-close-foundation.ts
index 74849e3f5a2..2aceced683d 100644
--- a/src/renderer/src/components/use-terminal-editor-close-foundation.ts
+++ b/src/renderer/src/components/use-terminal-editor-close-foundation.ts
@@ -1,8 +1,9 @@
 import { useCallback, useRef, useState } from 'react'
-import { useAppStore } from '../store'
-import { getConnectionId } from '../lib/connection-context'
-import { isRemoteRuntimePtyId } from '@/runtime/runtime-terminal-inspection'
 import { CLOSE_DIALOG_DEBOUNCE_MS } from './terminal-workspace-model'
+import {
+  assessWindowCloseRunningWork,
+  type WindowCloseRunningWork
+} from './terminal/window-close-running-work'
 import type { TerminalWorkspaceProjectionController } from './use-terminal-workspace-projection'
 import { runWithWindowCloseCheckpointScope } from './window-close-request-coordinator'
 import { showShutdownCheckpointFailureToast } from '@/lib/shutdown-checkpoint-failure-toast'
@@ -27,6 +28,11 @@ export function useTerminalEditorCloseFoundation(
     closeDialogDebounceTimersRef.current.add(timer)
   }, [])
   const [windowCloseDialogOpen, setWindowCloseDialogOpen] = useState(false)
+  // Why: "running" and "could not reach the host" are different claims, and telling the user
+  // processes are running when the truth is that a host went quiet is the fabricated certainty
+  // docs/reference/ssh-execution-boundary.md forbids.
+  const [windowCloseDialogKind, setWindowCloseDialogKind] =
+    useState<Exclude<WindowCloseRunningWork['kind'], 'none'>>('running')
   const windowCloseAfterDirtyRef = useRef<{ isQuitting: boolean } | null>(null)
 
   const confirmNativeWindowClose = useCallback(() => {
@@ -46,33 +52,21 @@ export function useTerminalEditorCloseFoundation(
 
   const proceedToNativeWindowClose = useCallback(
     (isQuitting: boolean) => {
-      if (!isQuitting) {
-        const state = useAppStore.getState()
-        const localPtyIds = Object.entries(state.tabsByWorktree).flatMap(
-          ([worktreeId, worktreeTabs]) => {
-            const connectionId = getConnectionId(worktreeId)
-            if (connectionId !== null) {
-              return []
-            }
-            return worktreeTabs
-              .flatMap((tab) => state.ptyIdsByTabId[tab.id] ?? [])
-              .filter((ptyId) => !isRemoteRuntimePtyId(ptyId))
+      void assessWindowCloseRunningWork({ isQuitting })
+        .then((runningWork) => {
+          if (runningWork.kind === 'none') {
+            confirmNativeWindowClose()
+            return
           }
-        )
-        if (localPtyIds.length > 0) {
-          void Promise.all(localPtyIds.map((id) => window.api.pty.hasChildProcesses(id))).then(
-            (results) => {
-              if (results.some(Boolean)) {
-                setWindowCloseDialogOpen(true)
-              } else {
-                confirmNativeWindowClose()
-              }
-            }
-          )
-          return
-        }
-      }
-      confirmNativeWindowClose()
+          setWindowCloseDialogKind(runningWork.kind)
+          setWindowCloseDialogOpen(true)
+        })
+        // Why: the assessment must never be able to trap the window. A thrown store read is
+        // not evidence either way, and a close that silently does nothing is unrecoverable
+        // without SIGKILL, so fall through to the close the user actually asked for.
+        .catch(() => {
+          confirmNativeWindowClose()
+        })
     },
     [confirmNativeWindowClose]
   )
@@ -88,6 +82,7 @@ export function useTerminalEditorCloseFoundation(
     releaseCloseDialogGuardAfterDebounce,
     windowCloseDialogOpen,
     setWindowCloseDialogOpen,
+    windowCloseDialogKind,
     windowCloseAfterDirtyRef,
     confirmNativeWindowClose,
     proceedToNativeWindowClose
diff --git a/src/renderer/src/components/use-terminal-editor-close-foundation.window-close.test.tsx b/src/renderer/src/components/use-terminal-editor-close-foundation.window-close.test.tsx
new file mode 100644
index 00000000000..d7f3f69d925
--- /dev/null
+++ b/src/renderer/src/components/use-terminal-editor-close-foundation.window-close.test.tsx
@@ -0,0 +1,103 @@
+// @vitest-environment happy-dom
+
+/**
+ * Wiring for the window-close/quit running-work warning. The policy in
+ * `terminal/window-close-running-work.ts` is inert unless `proceedToNativeWindowClose` actually
+ * consults it, so pin that it does — and that a warning stops the native close rather than
+ * confirming it.
+ */
+import { act, cleanup, renderHook } from '@testing-library/react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { assessWindowCloseRunningWorkMock, confirmWindowCloseMock } = vi.hoisted(() => ({
+  assessWindowCloseRunningWorkMock: vi.fn(),
+  confirmWindowCloseMock: vi.fn()
+}))
+
+vi.mock('./terminal/window-close-running-work', () => ({
+  assessWindowCloseRunningWork: assessWindowCloseRunningWorkMock
+}))
+vi.mock('./window-close-request-coordinator', () => ({
+  runWithWindowCloseCheckpointScope: (fn: () => unknown) => fn()
+}))
+vi.mock('@/lib/shutdown-checkpoint-failure-toast', () => ({
+  showShutdownCheckpointFailureToast: vi.fn()
+}))
+
+const { useTerminalEditorCloseFoundation } = await import('./use-terminal-editor-close-foundation')
+
+const controller = { openFiles: [] } as unknown as Parameters<
+  typeof useTerminalEditorCloseFoundation
+>[0]
+
+function mountFoundation() {
+  return renderHook(() => useTerminalEditorCloseFoundation(controller))
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  Object.assign(globalThis, {
+    window: Object.assign(globalThis.window, {
+      api: { ui: { confirmWindowClose: confirmWindowCloseMock } }
+    })
+  })
+})
+
+afterEach(() => {
+  cleanup()
+})
+
+describe('proceedToNativeWindowClose', () => {
+  it('asks the running-work policy about the quit rather than assuming it is safe', async () => {
+    assessWindowCloseRunningWorkMock.mockResolvedValue({ kind: 'none' })
+    const { result } = mountFoundation()
+
+    await act(async () => {
+      result.current.proceedToNativeWindowClose(true)
+    })
+
+    expect(assessWindowCloseRunningWorkMock).toHaveBeenCalledWith({ isQuitting: true })
+    expect(confirmWindowCloseMock).toHaveBeenCalledTimes(1)
+    expect(result.current.windowCloseDialogOpen).toBe(false)
+  })
+
+  it('raises the dialog and does not close when a host reports live work', async () => {
+    assessWindowCloseRunningWorkMock.mockResolvedValue({ kind: 'running' })
+    const { result } = mountFoundation()
+
+    await act(async () => {
+      result.current.proceedToNativeWindowClose(true)
+    })
+
+    expect(result.current.windowCloseDialogOpen).toBe(true)
+    expect(result.current.windowCloseDialogKind).toBe('running')
+    expect(confirmWindowCloseMock).not.toHaveBeenCalled()
+  })
+
+  it('raises the unverifiable copy when a remote host could not be reached', async () => {
+    assessWindowCloseRunningWorkMock.mockResolvedValue({ kind: 'unverifiable' })
+    const { result } = mountFoundation()
+
+    await act(async () => {
+      result.current.proceedToNativeWindowClose(true)
+    })
+
+    expect(result.current.windowCloseDialogOpen).toBe(true)
+    expect(result.current.windowCloseDialogKind).toBe('unverifiable')
+    expect(confirmWindowCloseMock).not.toHaveBeenCalled()
+  })
+
+  // Why: a thrown assessment is not evidence either way, and a close that silently does nothing
+  // leaves SIGKILL as the user's only exit.
+  it('falls through to the close when the assessment throws', async () => {
+    assessWindowCloseRunningWorkMock.mockRejectedValue(new Error('store blew up'))
+    const { result } = mountFoundation()
+
+    await act(async () => {
+      result.current.proceedToNativeWindowClose(false)
+    })
+
+    expect(confirmWindowCloseMock).toHaveBeenCalledTimes(1)
+    expect(result.current.windowCloseDialogOpen).toBe(false)
+  })
+})
diff --git a/src/renderer/src/components/use-worktree-jump-palette-quick-actions.ts b/src/renderer/src/components/use-worktree-jump-palette-quick-actions.ts
index 0783a7e5d23..32cddf92a17 100644
--- a/src/renderer/src/components/use-worktree-jump-palette-quick-actions.ts
+++ b/src/renderer/src/components/use-worktree-jump-palette-quick-actions.ts
@@ -56,6 +56,7 @@ export function useWorktreeJumpPaletteQuickActions({
   sshConnectionStates,
   activeGroupIdByWorktree,
   groupsByWorktree,
+  unifiedTabsByWorktree,
   isLoading,
   settings,
   runtimeStatusByEnvironmentId,
@@ -129,6 +130,7 @@ export function useWorktreeJumpPaletteQuickActions({
     void sshConnectionStates
     void activeGroupIdByWorktree
     void groupsByWorktree
+    void unifiedTabsByWorktree
     void isLoading
     void settings?.activeRuntimeEnvironmentId
     void runtimeStatusByEnvironmentId
@@ -144,6 +146,7 @@ export function useWorktreeJumpPaletteQuickActions({
     sshConnectionStates,
     activeGroupIdByWorktree,
     groupsByWorktree,
+    unifiedTabsByWorktree,
     isLoading,
     settings?.activeRuntimeEnvironmentId,
     runtimeStatusByEnvironmentId
diff --git a/src/renderer/src/hooks/agent-hook-completion-store-sync.ts b/src/renderer/src/hooks/agent-hook-completion-store-sync.ts
index fc47a20205a..12c7d9102d6 100644
--- a/src/renderer/src/hooks/agent-hook-completion-store-sync.ts
+++ b/src/renderer/src/hooks/agent-hook-completion-store-sync.ts
@@ -48,7 +48,10 @@ function terminalTabLivenessMatches(
     return false
   }
 
-  for (const [worktreeIndex, worktreeId] of currentWorktreeIds.entries()) {
+  // Indexed loops, not .entries(): this runs on every tab write including title frames, and the
+  // iterator allocated a [index, value] tuple per worktree and per tab in each changed bucket.
+  for (let worktreeIndex = 0; worktreeIndex < currentWorktreeIds.length; worktreeIndex += 1) {
+    const worktreeId = currentWorktreeIds[worktreeIndex]
     // Why: duplicate tab ids use first-worktree-wins lookup semantics, so a
     // worktree-key reorder is a liveness change even when every array is reused.
     if (previousWorktreeIds[worktreeIndex] !== worktreeId) {
@@ -62,7 +65,8 @@ function terminalTabLivenessMatches(
     if (!currentTabs || !previousTabs || currentTabs.length !== previousTabs.length) {
       return false
     }
-    for (const [tabIndex, currentTab] of currentTabs.entries()) {
+    for (let tabIndex = 0; tabIndex < currentTabs.length; tabIndex += 1) {
+      const currentTab = currentTabs[tabIndex]
       visitTab?.()
       const previousTab = previousTabs[tabIndex]
       if (
diff --git a/src/renderer/src/hooks/composer-state/composer-submit-orchestration.ts b/src/renderer/src/hooks/composer-state/composer-submit-orchestration.ts
index e968e499afa..707b9916c5c 100644
--- a/src/renderer/src/hooks/composer-state/composer-submit-orchestration.ts
+++ b/src/renderer/src/hooks/composer-state/composer-submit-orchestration.ts
@@ -140,27 +140,14 @@ export function useComposerSubmitOrchestration(
     workspaceSeedName: target.derivedComposerState.workspaceSeedName
   })
   const multipleCreateReset = useMultipleCreateReset({
+    handleClearSmartNameSelection: source.issueSourceActions.handleClearSmartNameSelection,
     lastAutoNameRef: target.asyncComposerState.lastAutoNameRef,
     nameInputRef: target.asyncComposerState.nameInputRef,
     setAgentPrompt: target.sourceContextState.setAgentPrompt,
     setAttachmentPaths: target.sourceContextState.setAttachmentPaths,
-    setBranchNameOverride: target.workspaceIdentityState.setBranchNameOverride,
-    setBranchNameOverridePreservesNameEdits:
-      target.workspaceIdentityState.setBranchNameOverridePreservesNameEdits,
-    setCompareBaseRef: target.workspaceIdentityState.setCompareBaseRef,
     setCreateError: target.asyncComposerState.setCreateError,
-    setForkPushWarning: target.workspaceIdentityState.setForkPushWarning,
-    setLinkedGitLabIssue: target.workspaceIdentityState.setLinkedGitLabIssue,
-    setLinkedGitLabMR: target.workspaceIdentityState.setLinkedGitLabMR,
-    setLinkedIssue: target.workspaceIdentityState.setLinkedIssue,
-    setLinkedPR: target.workspaceIdentityState.setLinkedPR,
-    setLinkedTaskSourceContext: target.sourceContextState.setLinkedTaskSourceContext,
-    setLinkedWorkItem: target.sourceContextState.setLinkedWorkItem,
     setName: target.sourceContextState.setName,
-    setNote: target.sourceContextState.setNote,
-    setPushTarget: target.workspaceIdentityState.setPushTarget,
-    setReuseSelectedBranch: target.workspaceIdentityState.setReuseSelectedBranch,
-    setStartFromResetHint: target.workspaceIdentityState.setStartFromResetHint
+    setNote: target.sourceContextState.setNote
   })
   const quickSubmitSourcePreparation = useQuickSubmitSourcePreparation({
     baseBranch: target.workspaceIdentityState.baseBranch,
diff --git a/src/renderer/src/hooks/composer-state/full-creation-structured-launch.test.ts b/src/renderer/src/hooks/composer-state/full-creation-structured-launch.test.ts
index 2176a1863ed..77c94652a52 100644
--- a/src/renderer/src/hooks/composer-state/full-creation-structured-launch.test.ts
+++ b/src/renderer/src/hooks/composer-state/full-creation-structured-launch.test.ts
@@ -1,23 +1,23 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const mocks = vi.hoisted(() => ({
-  startStructuredCodexLaunch: vi.fn(),
+  startStructuredAgentLaunch: vi.fn(),
   activateStructuredAgentSessionById: vi.fn()
 }))
 
 vi.mock('@/lib/structured-agent-session-launch', () => ({
-  startStructuredCodexLaunch: mocks.startStructuredCodexLaunch
+  startStructuredAgentLaunch: mocks.startStructuredAgentLaunch
 }))
 
 vi.mock('@/lib/structured-agent-session-tab-activation', () => ({
   activateStructuredAgentSessionById: mocks.activateStructuredAgentSessionById
 }))
 
-vi.mock('@/lib/launch-structured-codex-session', () => ({
+vi.mock('@/lib/launch-structured-agent-session', () => ({
   StructuredAgentSessionCreateRefusalError: class extends Error {}
 }))
 
-import { StructuredAgentSessionCreateRefusalError } from '@/lib/launch-structured-codex-session'
+import { StructuredAgentSessionCreateRefusalError } from '@/lib/launch-structured-agent-session'
 import { settleFullCreationStructuredLaunch } from './full-creation-structured-launch'
 
 describe('settleFullCreationStructuredLaunch', () => {
@@ -26,7 +26,7 @@ describe('settleFullCreationStructuredLaunch', () => {
   it('runs the legacy terminal fallback after a definitive refusal', async () => {
     const fallbackActivation = { primaryTabId: 'fallback-tab' }
     const onDefinitiveRefusal = vi.fn().mockResolvedValue(fallbackActivation)
-    mocks.startStructuredCodexLaunch.mockReturnValue({
+    mocks.startStructuredAgentLaunch.mockReturnValue({
       launchResult: Promise.reject(new StructuredAgentSessionCreateRefusalError('unsupported')),
       isVisibilityUnknown: () => false,
       claimDefinitiveRefusalFallback: (fallback: () => Promise<unknown>) =>
@@ -54,7 +54,7 @@ describe('settleFullCreationStructuredLaunch', () => {
 
   it('reports an unknown outcome without starting a fallback terminal', async () => {
     const onDefinitiveRefusal = vi.fn()
-    mocks.startStructuredCodexLaunch.mockReturnValue({
+    mocks.startStructuredAgentLaunch.mockReturnValue({
       launchResult: Promise.reject(new Error('connection lost')),
       isVisibilityUnknown: () => true,
       claimDefinitiveRefusalFallback: vi.fn(() => Promise.resolve(false))
diff --git a/src/renderer/src/hooks/composer-state/full-creation-structured-launch.ts b/src/renderer/src/hooks/composer-state/full-creation-structured-launch.ts
index f352724d841..90ecb7c6722 100644
--- a/src/renderer/src/hooks/composer-state/full-creation-structured-launch.ts
+++ b/src/renderer/src/hooks/composer-state/full-creation-structured-launch.ts
@@ -1,7 +1,8 @@
+import { isAgentSessionHandleProvider } from '../../../../shared/agent-session-provider-handle'
 import type { TuiAgent } from '../../../../shared/tui-agent'
 import type { ActivateAndRevealResult } from '@/lib/worktree-activation'
-import { startStructuredCodexLaunch } from '@/lib/structured-agent-session-launch'
-import { StructuredAgentSessionCreateRefusalError } from '@/lib/launch-structured-codex-session'
+import { startStructuredAgentLaunch } from '@/lib/structured-agent-session-launch'
+import { StructuredAgentSessionCreateRefusalError } from '@/lib/launch-structured-agent-session'
 import { activateStructuredAgentSessionById } from '@/lib/structured-agent-session-tab-activation'
 
 type Activation = ActivateAndRevealResult | false
@@ -20,11 +21,11 @@ export async function settleFullCreationStructuredLaunch(args: {
 }> {
   let activation = args.initialActivation
   let structuredLaunchAccepted = args.structuredLaunch
-  if (!args.structuredLaunch || args.agent !== 'codex') {
+  if (!args.structuredLaunch || !isAgentSessionHandleProvider(args.agent)) {
     return { structuredLaunchAccepted, visibilityUnknown: false, activation }
   }
 
-  const launch = startStructuredCodexLaunch(args.worktreeId, { prompt: args.prompt })
+  const launch = startStructuredAgentLaunch(args.worktreeId, args.agent, { prompt: args.prompt })
   const refusalFallback = launch.claimDefinitiveRefusalFallback(async () => {
     structuredLaunchAccepted = false
     activation = await args.onDefinitiveRefusal()
diff --git a/src/renderer/src/hooks/composer-state/multiple-create-reset.test.ts b/src/renderer/src/hooks/composer-state/multiple-create-reset.test.ts
new file mode 100644
index 00000000000..910143cace8
--- /dev/null
+++ b/src/renderer/src/hooks/composer-state/multiple-create-reset.test.ts
@@ -0,0 +1,168 @@
+// @vitest-environment happy-dom
+
+import { useRef, useState } from 'react'
+import { act, renderHook } from '@testing-library/react'
+import { describe, expect, it, vi } from 'vitest'
+import type { LinkedWorkItemSummary } from '@/lib/new-workspace'
+import { useIssueSourceActions } from './issue-source-actions'
+import { useMultipleCreateReset } from './multiple-create-reset'
+import type { SmartGitHubPrStartPointSelection } from './source-selection-decisions'
+
+const sources: LinkedWorkItemSummary[] = [
+  {
+    provider: 'github',
+    type: 'pr',
+    number: 42,
+    title: 'Fix checkout',
+    url: 'https://github.com/acme/app/pull/42'
+  },
+  {
+    provider: 'github',
+    type: 'issue',
+    number: 43,
+    title: 'Fix checkout',
+    url: 'https://github.com/acme/app/issues/43'
+  },
+  {
+    provider: 'gitlab',
+    type: 'mr',
+    number: 44,
+    title: 'Fix checkout',
+    url: 'https://gitlab.com/acme/app/-/merge_requests/44'
+  }
+]
+
+function useSelectedSourceReset(
+  initialItem: LinkedWorkItemSummary | null,
+  isProjectGroupTarget = false,
+  initialBaseBranch: string | undefined = '1234567890abcdef1234567890abcdef12345678'
+) {
+  const [linkedWorkItem, setLinkedWorkItem] = useState<LinkedWorkItemSummary | null>(initialItem)
+  const [baseBranch, setBaseBranch] = useState<string | undefined>(initialBaseBranch)
+  const [name, setName] = useState('fix-checkout')
+  const [note, setNote] = useState('User note')
+  const lastAutoNameRef = useRef(name)
+  const branchAutoNameRef = useRef('fix-checkout')
+  const lastAutoNoteRef = useRef('Generated note')
+  const smartGitHubPrStartPointSelectionRef = useRef<SmartGitHubPrStartPointSelection | null>(
+    initialItem?.provider === 'github' && initialItem.type === 'pr'
+      ? {
+          repoId: 'repo-1',
+          item: {
+            ...initialItem,
+            type: 'pr',
+            id: 'pr-42',
+            repoId: 'repo-1',
+            state: 'open',
+            labels: [],
+            updatedAt: '2026-09-01T00:00:00Z',
+            author: null
+          }
+        }
+      : null
+  )
+  const source = useIssueSourceActions({
+    baseBranch,
+    branchAutoNameRef,
+    isProjectGroupTarget,
+    lastAutoNameRef,
+    lastAutoNoteRef,
+    linkedWorkItem,
+    name,
+    noteRef: useRef(note),
+    setBaseBranch,
+    setBranchNameOverride: vi.fn(),
+    setBranchNameOverridePreservesNameEdits: vi.fn(),
+    setCompareBaseRef: vi.fn(),
+    setForkPushWarning: vi.fn(),
+    setLinkedGitLabIssue: vi.fn(),
+    setLinkedGitLabMR: vi.fn(),
+    setLinkedIssue: vi.fn(),
+    setLinkedPR: vi.fn(),
+    setLinkedTaskSourceContext: vi.fn(),
+    setLinkedWorkItem,
+    setName,
+    setNote,
+    setPushTarget: vi.fn(),
+    setReuseEligibleBranch: vi.fn(),
+    setReuseSelectedBranch: vi.fn(),
+    setStartFromResetHint: vi.fn(),
+    smartGitHubPrStartPointSelectionRef
+  })
+  const reset = useMultipleCreateReset({
+    handleClearSmartNameSelection: source.handleClearSmartNameSelection,
+    lastAutoNameRef,
+    nameInputRef: useRef(null),
+    setAgentPrompt: vi.fn(),
+    setAttachmentPaths: vi.fn(),
+    setCreateError: vi.fn(),
+    setName,
+    setNote
+  })
+  return {
+    ...reset,
+    selection: source.smartNameSelection,
+    linkedWorkItem,
+    baseBranch,
+    name,
+    note,
+    branchAutoNameRef,
+    smartGitHubPrStartPointSelectionRef
+  }
+}
+
+describe('create more source reset', () => {
+  it.each(sources)(
+    'clears $provider $type and its checkout source before the next create',
+    (item) => {
+      const { result } = renderHook(() => useSelectedSourceReset(item))
+      expect(result.current.selection?.label).toContain('Fix checkout')
+
+      if (item.provider === 'github' && item.type === 'pr') {
+        expect(result.current.smartGitHubPrStartPointSelectionRef.current).not.toBeNull()
+      }
+
+      act(() => result.current.resetForNextCreate())
+
+      expect(result.current.smartGitHubPrStartPointSelectionRef.current).toBeNull()
+      expect(result.current.selection).toBeNull()
+      expect(result.current.linkedWorkItem).toBeNull()
+      expect(result.current.baseBranch).toBeUndefined()
+      expect(result.current.name).toBe('')
+      expect(result.current.note).toBe('')
+      expect(result.current.branchAutoNameRef.current).toBe('')
+    }
+  )
+
+  it.each(['linear', 'jira'] as const)('clears a %s task on a folder target', (provider) => {
+    const item: LinkedWorkItemSummary = {
+      provider,
+      type: 'issue',
+      number: 0,
+      title: 'Fix checkout',
+      url:
+        provider === 'linear'
+          ? 'https://linear.app/acme/issue/APP-45'
+          : 'https://acme.atlassian.net/browse/APP-45'
+    }
+    const { result } = renderHook(() => useSelectedSourceReset(item, true))
+    expect(result.current.selection?.kind).toBe(provider)
+
+    act(() => result.current.resetForNextCreate())
+
+    expect(result.current.selection).toBeNull()
+    expect(result.current.linkedWorkItem).toBeNull()
+    expect(result.current.name).toBe('')
+    expect(result.current.note).toBe('')
+  })
+
+  it('clears a plain branch selection before the next create', () => {
+    const { result } = renderHook(() => useSelectedSourceReset(null, false, 'feature/checkout'))
+    expect(result.current.selection).toEqual({ kind: 'branch', label: 'feature/checkout' })
+
+    act(() => result.current.resetForNextCreate())
+
+    expect(result.current.selection).toBeNull()
+    expect(result.current.baseBranch).toBeUndefined()
+  })
+})
diff --git a/src/renderer/src/hooks/composer-state/multiple-create-reset.ts b/src/renderer/src/hooks/composer-state/multiple-create-reset.ts
index b1b77720934..e078d692717 100644
--- a/src/renderer/src/hooks/composer-state/multiple-create-reset.ts
+++ b/src/renderer/src/hooks/composer-state/multiple-create-reset.ts
@@ -2,96 +2,48 @@ import type { ComposerModel } from './composer-model'
 
 type MultipleCreateResetInput = Pick<
   ComposerModel,
+  | 'handleClearSmartNameSelection'
   | 'lastAutoNameRef'
   | 'nameInputRef'
   | 'setAgentPrompt'
   | 'setAttachmentPaths'
-  | 'setBranchNameOverride'
-  | 'setBranchNameOverridePreservesNameEdits'
-  | 'setCompareBaseRef'
   | 'setCreateError'
-  | 'setForkPushWarning'
-  | 'setLinkedGitLabIssue'
-  | 'setLinkedGitLabMR'
-  | 'setLinkedIssue'
-  | 'setLinkedPR'
-  | 'setLinkedTaskSourceContext'
-  | 'setLinkedWorkItem'
   | 'setName'
   | 'setNote'
-  | 'setPushTarget'
-  | 'setReuseSelectedBranch'
-  | 'setStartFromResetHint'
 >
 
 import { useCallback } from 'react'
 
 export function useMultipleCreateReset(input: MultipleCreateResetInput) {
   const {
+    handleClearSmartNameSelection,
     lastAutoNameRef,
     nameInputRef,
     setAgentPrompt,
     setAttachmentPaths,
-    setBranchNameOverride,
-    setBranchNameOverridePreservesNameEdits,
-    setCompareBaseRef,
     setCreateError,
-    setForkPushWarning,
-    setLinkedGitLabIssue,
-    setLinkedGitLabMR,
-    setLinkedIssue,
-    setLinkedPR,
-    setLinkedTaskSourceContext,
-    setLinkedWorkItem,
     setName,
-    setNote,
-    setPushTarget,
-    setReuseSelectedBranch,
-    setStartFromResetHint
+    setNote
   } = input
   const resetForNextCreate = useCallback(() => {
-    // Why: clear identity fields derived from a PR pick while retaining repo, base, agent, and group context for sequential creates.
+    // Clear the checkout source too, so a PR's resolved SHA cannot become the next selection.
+    handleClearSmartNameSelection()
     setName('')
     lastAutoNameRef.current = ''
     setAgentPrompt('')
     setNote('')
     setAttachmentPaths([])
-    setLinkedWorkItem(null)
-    setLinkedTaskSourceContext(null)
-    setLinkedIssue('')
-    setLinkedPR(null)
-    setLinkedGitLabIssue(null)
-    setLinkedGitLabMR(null)
-    setBranchNameOverride(undefined)
-    setBranchNameOverridePreservesNameEdits(false)
-    setCompareBaseRef(undefined)
-    setPushTarget(undefined)
-    setReuseSelectedBranch(false)
-    setStartFromResetHint(null)
-    setForkPushWarning(null)
     setCreateError(null)
     requestAnimationFrame(() => nameInputRef.current?.focus())
   }, [
+    handleClearSmartNameSelection,
     lastAutoNameRef,
     nameInputRef,
     setAgentPrompt,
     setAttachmentPaths,
-    setBranchNameOverride,
-    setBranchNameOverridePreservesNameEdits,
-    setCompareBaseRef,
     setCreateError,
-    setForkPushWarning,
-    setLinkedGitLabIssue,
-    setLinkedGitLabMR,
-    setLinkedIssue,
-    setLinkedPR,
-    setLinkedTaskSourceContext,
-    setLinkedWorkItem,
     setName,
-    setNote,
-    setPushTarget,
-    setReuseSelectedBranch,
-    setStartFromResetHint
+    setNote
   ])
 
   return {
diff --git a/src/renderer/src/hooks/ipc-events/app-lifetime-ipc-bridge.ts b/src/renderer/src/hooks/ipc-events/app-lifetime-ipc-bridge.ts
index 17a5357071d..fa683b7188f 100644
--- a/src/renderer/src/hooks/ipc-events/app-lifetime-ipc-bridge.ts
+++ b/src/renderer/src/hooks/ipc-events/app-lifetime-ipc-bridge.ts
@@ -12,6 +12,7 @@ import { createDirectSshBridgeRuntime } from './direct-ssh-bridge-runtime'
 import { registerDirectSshStateIpcBridge } from './direct-ssh-state-ipc-bridge'
 import { registerMobileAndTerminalCloseIpcBridge } from './mobile-terminal-close-ipc-bridge'
 import { registerMobileDriverIpcBridge } from './mobile-driver-ipc-bridge'
+import { registerOrcaProfileAuthIpcBridge } from './orca-profile-auth-ipc-bridge'
 import { registerOsMarkdownFileOpenBridge } from './os-markdown-file-open-bridge'
 import { registerProjectCatalogIpcBridge } from './project-catalog-ipc-bridge'
 import { registerRateLimitIpcBridge } from './rate-limit-ipc-bridge'
@@ -78,6 +79,7 @@ export function installAppLifetimeIpcEvents(
     remountTerminalTabsAwaitingHostHydration
   )
   registerSettingsAndSidebarIpcBridge(unsubs)
+  registerOrcaProfileAuthIpcBridge(unsubs)
   registerWorkspaceShortcutIpcBridge(unsubs)
   registerOsMarkdownFileOpenBridge(unsubs)
   unsubs.push(
diff --git a/src/renderer/src/hooks/ipc-events/browser-state-ipc-bridge.ts b/src/renderer/src/hooks/ipc-events/browser-state-ipc-bridge.ts
index 4f3450dae85..b4fec87e379 100644
--- a/src/renderer/src/hooks/ipc-events/browser-state-ipc-bridge.ts
+++ b/src/renderer/src/hooks/ipc-events/browser-state-ipc-bridge.ts
@@ -81,7 +81,7 @@ export function registerBrowserStateIpcBridge(
     })
   )
   unsubs.push(
-    window.api.browser.onOpenLinkInOrcaTab(({ browserPageId, url }) => {
+    window.api.browser.onOpenLinkInOrcaTab(({ browserPageId, url, activate }) => {
       const store = useAppStore.getState()
       const sourcePage = Object.values(store.browserPagesByWorkspace)
         .flat()
@@ -96,6 +96,7 @@ export function registerBrowserStateIpcBridge(
       )
       store.createBrowserTab(sourcePage.worktreeId, url, {
         title: url,
+        activate: activate ?? true,
         ...(sourceTab
           ? {
               sessionProfileId: sourceTab.sessionProfileId,
diff --git a/src/renderer/src/hooks/ipc-events/browser-state-open-link-profile.test.ts b/src/renderer/src/hooks/ipc-events/browser-state-open-link-profile.test.ts
index b15a5be158c..446a0dc7435 100644
--- a/src/renderer/src/hooks/ipc-events/browser-state-open-link-profile.test.ts
+++ b/src/renderer/src/hooks/ipc-events/browser-state-open-link-profile.test.ts
@@ -24,11 +24,19 @@ import { registerBrowserStateIpcBridge } from './browser-state-ipc-bridge'
 
 const noopUnsubscribe = (): void => {}
 
-function captureOpenLinkHandler(): (event: { browserPageId: string; url: string }) => void {
-  let handler: ((event: { browserPageId: string; url: string }) => void) | null = null
+function captureOpenLinkHandler(): (event: {
+  browserPageId: string
+  url: string
+  activate?: boolean
+}) => void {
+  let handler:
+    | ((event: { browserPageId: string; url: string; activate?: boolean }) => void)
+    | null = null
   const browserApi = new Proxy(
     {
-      onOpenLinkInOrcaTab: (callback: (event: { browserPageId: string; url: string }) => void) => {
+      onOpenLinkInOrcaTab: (
+        callback: (event: { browserPageId: string; url: string; activate?: boolean }) => void
+      ) => {
         handler = callback
         return noopUnsubscribe
       }
@@ -101,4 +109,26 @@ describe('link-opened Orca tabs', () => {
     const options = createBrowserTabMock.mock.calls[0][2] as Record<string, unknown>
     expect('sessionProfileId' in options).toBe(false)
   })
+
+  it('creates modifier-click links in the background', () => {
+    storeState.value = {
+      browserPagesByWorkspace: {
+        'workspace-1': [{ id: 'page-1', workspaceId: 'workspace-1', worktreeId: 'worktree-1' }]
+      },
+      browserTabsByWorktree: {},
+      createBrowserTab: createBrowserTabMock
+    }
+
+    captureOpenLinkHandler()({
+      browserPageId: 'page-1',
+      url: 'https://docs.example.com/background',
+      activate: false
+    })
+
+    expect(createBrowserTabMock).toHaveBeenCalledWith(
+      'worktree-1',
+      'https://docs.example.com/background',
+      expect.objectContaining({ activate: false })
+    )
+  })
 })
diff --git a/src/renderer/src/hooks/ipc-events/orca-profile-auth-ipc-bridge.test.ts b/src/renderer/src/hooks/ipc-events/orca-profile-auth-ipc-bridge.test.ts
new file mode 100644
index 00000000000..593ace5336d
--- /dev/null
+++ b/src/renderer/src/hooks/ipc-events/orca-profile-auth-ipc-bridge.test.ts
@@ -0,0 +1,82 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { OrcaProfileAuthStatus } from '../../../../shared/orca-profiles'
+import { createTestStore } from '../../store/slices/store-test-helpers'
+
+const { storeHolder } = vi.hoisted(() => ({
+  storeHolder: { current: null as { getState: () => unknown } | null }
+}))
+
+vi.mock('../../store', () => ({
+  useAppStore: { getState: () => storeHolder.current?.getState() }
+}))
+
+vi.mock('sonner', () => ({
+  toast: { error: vi.fn(), info: vi.fn(), success: vi.fn(), warning: vi.fn() }
+}))
+
+import { registerOrcaProfileAuthIpcBridge } from './orca-profile-auth-ipc-bridge'
+
+const connectedAuthStatus: OrcaProfileAuthStatus = {
+  activeProfileId: 'local-default',
+  configured: true,
+  state: 'connected',
+  persistence: 'encrypted'
+}
+
+const reconnectRequiredAuthStatus: OrcaProfileAuthStatus = {
+  activeProfileId: 'local-default',
+  configured: true,
+  state: 'reconnect-required',
+  persistence: 'encrypted'
+}
+
+describe('orca profile auth IPC bridge', () => {
+  let listener: (() => void) | null = null
+  const unsubscribe = vi.fn()
+  const authStatus = vi.fn()
+
+  beforeEach(() => {
+    listener = null
+    unsubscribe.mockClear()
+    authStatus.mockReset()
+    vi.stubGlobal('window', {
+      api: {
+        orcaProfiles: {
+          authStatus,
+          onAuthStatusChanged: (callback: () => void) => {
+            listener = callback
+            return unsubscribe
+          }
+        }
+      }
+    })
+  })
+
+  it('re-fetches auth status on the push, flipping connected to reconnect-required', async () => {
+    authStatus.mockResolvedValue(connectedAuthStatus)
+    const store = createTestStore()
+    storeHolder.current = store
+    await store.getState().fetchOrcaProfileAuthStatus()
+    expect(store.getState().orcaProfileAuthStatus).toEqual(connectedAuthStatus)
+
+    const unsubs: (() => void)[] = []
+    registerOrcaProfileAuthIpcBridge(unsubs)
+    authStatus.mockResolvedValue(reconnectRequiredAuthStatus)
+    listener?.()
+    await vi.waitFor(() =>
+      expect(store.getState().orcaProfileAuthStatus).toEqual(reconnectRequiredAuthStatus)
+    )
+
+    unsubs.forEach((dispose) => dispose())
+    expect(unsubscribe).toHaveBeenCalledTimes(1)
+  })
+
+  it('skips registration when the preload bridge does not expose the event', () => {
+    vi.stubGlobal('window', { api: { orcaProfiles: { authStatus } } })
+    const unsubs: (() => void)[] = []
+
+    registerOrcaProfileAuthIpcBridge(unsubs)
+
+    expect(unsubs).toHaveLength(0)
+  })
+})
diff --git a/src/renderer/src/hooks/ipc-events/orca-profile-auth-ipc-bridge.ts b/src/renderer/src/hooks/ipc-events/orca-profile-auth-ipc-bridge.ts
new file mode 100644
index 00000000000..95397b64a62
--- /dev/null
+++ b/src/renderer/src/hooks/ipc-events/orca-profile-auth-ipc-bridge.ts
@@ -0,0 +1,14 @@
+import { useAppStore } from '../../store'
+
+/** Re-reads auth status when main clears a revoked cloud session behind the renderer's back. */
+export function registerOrcaProfileAuthIpcBridge(unsubs: (() => void)[]): void {
+  const subscribe = window.api.orcaProfiles?.onAuthStatusChanged
+  if (typeof subscribe !== 'function') {
+    return
+  }
+  unsubs.push(
+    subscribe(() => {
+      void useAppStore.getState().fetchOrcaProfileAuthStatus()
+    })
+  )
+}
diff --git a/src/renderer/src/hooks/remote-workspace-snapshot-unplaced-tab-adoption.test.ts b/src/renderer/src/hooks/remote-workspace-snapshot-unplaced-tab-adoption.test.ts
index 13daf0c9f20..391bdf10693 100644
--- a/src/renderer/src/hooks/remote-workspace-snapshot-unplaced-tab-adoption.test.ts
+++ b/src/renderer/src/hooks/remote-workspace-snapshot-unplaced-tab-adoption.test.ts
@@ -199,16 +199,25 @@ async function applySnapshot(
   store: TestStore,
   snap: RemoteWorkspaceObservedSnapshot
 ): Promise<void> {
-  await applyDirectSshRemoteWorkspaceSnapshot({
-    store,
-    snapshot: snap,
-    token: token(snap.revision),
-    arrival: 1,
-    isArrivalCurrent: () => true,
-    isPreparationTokenCurrent: () => true,
-    waitForWorkspaceSessionReady: async () => true,
-    finalizeHydratedTerminals: () => 0
-  })
+  vi.useFakeTimers()
+  try {
+    const pending = applyDirectSshRemoteWorkspaceSnapshot({
+      store,
+      snapshot: snap,
+      token: token(snap.revision),
+      arrival: 1,
+      isArrivalCurrent: () => true,
+      isPreparationTokenCurrent: () => true,
+      waitForWorkspaceSessionReady: async () => true,
+      finalizeHydratedTerminals: () => 0
+    })
+    // Exercise the real placement deadline without spending ten wall-clock seconds per snapshot.
+    await vi.advanceTimersByTimeAsync(10_000)
+    await pending
+  } finally {
+    vi.clearAllTimers()
+    vi.useRealTimers()
+  }
 }
 
 function adoptedTabIds(store: TestStore): string[] {
diff --git a/src/renderer/src/hooks/remote-workspace-target-sync.test.ts b/src/renderer/src/hooks/remote-workspace-target-sync.test.ts
index bc0082c03ce..7d9f662ffe0 100644
--- a/src/renderer/src/hooks/remote-workspace-target-sync.test.ts
+++ b/src/renderer/src/hooks/remote-workspace-target-sync.test.ts
@@ -680,7 +680,15 @@ describe('createRemoteWorkspaceTargetSync', () => {
       ]
     })
 
-    await harness.sync.applyUnsolicitedSnapshot('target-a', incoming)
+    vi.useFakeTimers()
+    try {
+      const pending = harness.sync.applyUnsolicitedSnapshot('target-a', incoming)
+      await vi.advanceTimersByTimeAsync(10_000)
+      await pending
+    } finally {
+      harness.sync.stop()
+      vi.useRealTimers()
+    }
 
     const merged = hydrateTabsSession.mock.calls[0][0]
     expect(merged.tabsByWorktree).toEqual({
diff --git a/src/renderer/src/hooks/use-orca-profile-auth-status-refresh.ts b/src/renderer/src/hooks/use-orca-profile-auth-status-refresh.ts
new file mode 100644
index 00000000000..692ed9bcfc1
--- /dev/null
+++ b/src/renderer/src/hooks/use-orca-profile-auth-status-refresh.ts
@@ -0,0 +1,14 @@
+import { useEffect } from 'react'
+import { useAppStore } from '../store'
+
+/**
+ * Re-reads the cloud auth status whenever a surface that renders it mounts. The
+ * store caches the startup value, so without this a session revoked since launch
+ * still reads as connected. The cached value stays rendered while the fetch runs.
+ */
+export function useOrcaProfileAuthStatusRefresh(): void {
+  const fetchAuthStatus = useAppStore((state) => state.fetchOrcaProfileAuthStatus)
+  useEffect(() => {
+    void fetchAuthStatus()
+  }, [fetchAuthStatus])
+}
diff --git a/src/renderer/src/hooks/useIpcEvents-lifecycle.test.ts b/src/renderer/src/hooks/useIpcEvents-lifecycle.test.ts
index 6e0e7238c05..5991c40c4de 100644
--- a/src/renderer/src/hooks/useIpcEvents-lifecycle.test.ts
+++ b/src/renderer/src/hooks/useIpcEvents-lifecycle.test.ts
@@ -19,6 +19,7 @@ const EXPECTED_DIRECT_CALLBACK_METHODS = [
   'emulator.onPaneFocus',
   'gh.onPRRefreshEvent',
   'keybindings.onChanged',
+  'orcaProfiles.onAuthStatusChanged',
   'pty.onExit',
   'rateLimits.onUpdate',
   'remoteWorkspace.onChanged',
@@ -126,6 +127,7 @@ const EXPECTED_CALLBACK_REGISTRATION_SEQUENCE = [
   'ui.onToggleWorktreePalette',
   'ui.onToggleFloatingTerminal',
   'ui.onTerminalShortcutCaptured',
+  'orcaProfiles.onAuthStatusChanged',
   'ui.onOpenQuickOpen',
   'ui.onToggleQuickCommandsMenu',
   'ui.onOpenNewWorkspace',
diff --git a/src/renderer/src/i18n/en-runtime-required.json b/src/renderer/src/i18n/en-runtime-required.json
index 6f3c49a21e3..af43a08f37a 100644
--- a/src/renderer/src/i18n/en-runtime-required.json
+++ b/src/renderer/src/i18n/en-runtime-required.json
@@ -576,12 +576,16 @@
           },
           "ProjectPicker": {
             "43a88ae574": "BOARD_LAYOUT",
+            "ab1a2c357d": "Roadmap (unsupported)",
             "b787682111": "Browse all",
             "ba0ab9a117": "Browse all (loading…)",
             "cafb908f34": "TABLE_LAYOUT"
           },
           "ProjectRow": {
             "c3b81ddea2": "DRAFT_ISSUE"
+          },
+          "ProjectViewWrapper": {
+            "1bf8c01c8b": "Switch to a Table view to work with this project in Orca."
           }
         }
       },
@@ -3665,18 +3669,29 @@
         }
       },
       "status": {
-        "working": "Working…"
+        "responding": "Agent is responding",
+        "thinking": "Thinking",
+        "toggleDetails": "Toggle turn details",
+        "workedFor": "Worked for {{value0}}",
+        "working": "Working…",
+        "workingFor": "Working for {{value0}}"
       },
       "toggle": {
         "showChat": "Show chat view",
         "showTerminal": "Show terminal"
       },
       "tool": {
+        "countN": "{{value0}} tool calls",
+        "countOne": "1 tool call",
         "ranCommandManyToolsSummary": "Ran {{commandCount}} command and used {{toolCount}} tools",
         "ranCommandOneToolSummary": "Ran {{commandCount}} command and used {{toolCount}} tool",
         "ranCommandsManyToolsSummary": "Ran {{commandCount}} commands and used {{toolCount}} tools",
         "ranCommandsOneToolSummary": "Ran {{commandCount}} commands and used {{toolCount}} tool",
         "running": "Running…",
+        "runningCommand": "Running command",
+        "runningNamed": "Running {{toolName}}",
+        "runningNamedPreview": "Running {{toolName}} {{preview}}",
+        "runningPreview": "Running {{preview}}",
         "usedManySummary": "Used {{toolCount}} tools",
         "usedOneSummary": "Used 1 tool"
       }
diff --git a/src/renderer/src/i18n/locales/en.json b/src/renderer/src/i18n/locales/en.json
index 87fcb50a2a1..e5c4a5fb08e 100644
--- a/src/renderer/src/i18n/locales/en.json
+++ b/src/renderer/src/i18n/locales/en.json
@@ -1,4 +1,12 @@
 {
+  "sidebar": {
+    "revealFiltered": {
+      "title": "Reveal hidden workspace?",
+      "description": "The active workspace is hidden in the sidebar. Revealing it will clear your sidebar filters.",
+      "confirm": "Clear filters and reveal",
+      "cancel": "Keep filters"
+    }
+  },
   "app": {
     "recoverableError": {
       "rootTitle": "Orca hit a renderer error.",
@@ -955,7 +963,9 @@
         }
       },
       "activateAiVaultStructuredSession": {
-        "unavailable": "The structured agent session is not available yet. Retry in a moment."
+        "unavailable": "The structured agent session is not available yet. Retry in a moment.",
+        "gone": "This chat is no longer on this host, so it cannot be reopened here.",
+        "hostCannotOpen": "This chat can't be reopened until Orca is updated."
       },
       "ephemeralVmWorktreeCreation": {
         "sparseCheckoutUnsupported": "Provisioned-root recipes do not support sparse checkout."
@@ -2251,7 +2261,8 @@
       "Terminal": {
         "73768427cf": "Close",
         "f82e9f02df": "Cancel",
-        "7958465754": "There are local terminals with running processes. Close the window anyway?",
+        "7958465754": "There are terminals with running processes. Close the window anyway?",
+        "b7c1f0a934": "A remote host could not be reached, so Orca cannot tell whether work is still running there. Close the window anyway?",
         "2fa9c69ff3": "Close Window?",
         "cd51e28d8b": "Save",
         "0037b21794": "Don't Save",
@@ -2550,6 +2561,30 @@
                 "7c302f8174": "Untitled"
               }
             }
+          },
+          "ProjectRoadmap": {
+            "be52f7b6db": "This roadmap view has no date or iteration field to place items on, so Orca is listing them instead.",
+            "6405e036e0": "Month",
+            "f2b1cabef7": "Quarter",
+            "b6afc6fe45": "Year",
+            "343888b143": "Placed by {{value0}}",
+            "6a088a5da1": "{{value0}} without dates",
+            "86eebd6020": "Today",
+            "0bb1c1bc07": "Timeline zoom",
+            "e304235879": "Item",
+            "e077c79083": "No dates"
+          },
+          "ProjectRoadmapBar": {
+            "cd68ccc17a": "{{value0}} — {{value1}}",
+            "7d1220d979": "Restricted item"
+          },
+          "ProjectPickerPanels": {
+            "04ec212ccb": "Roadmap",
+            "9fe1ac868c": "Unsupported"
+          },
+          "ProjectViewStates": {
+            "ac83c45672": "Switch to a Table or Roadmap view to work with this project in Orca.",
+            "e4cc8b14f2": "Orca renders table and roadmap project views. This view uses a layout it cannot render yet."
           }
         },
         "GitHubMarkdownComposer": {
@@ -6230,6 +6265,11 @@
           "projectOnly": "Added in this project only.",
           "useGlobalFor": "Use global for {{value0}}",
           "useGlobal": "Use global"
+        },
+        "RepoScanUnavailableIndicator": {
+          "title": "Worktree scan failed for {{value0}}",
+          "retry": "Retry scan",
+          "retained": "Existing worktrees are kept until a scan succeeds. Click to retry."
         }
       },
       "shared": {
@@ -6963,8 +7003,8 @@
             "defaultViewTerminal": "Terminal chat",
             "defaultViewNative": "Chat UI",
             "structuredTitle": "Use updated structured native chat",
-            "structuredCopy": "Opt in to the host-owned structured Codex runtime. Off keeps the existing terminal-backed chat path.",
-            "structuredScope": "Local macOS and Linux sessions only for now. Windows, WSL, and remote execution hosts (including SSH) continue to use terminal chat.",
+            "structuredCopy": "Opt in to the host-owned structured chat runtime for Codex and Claude. Off keeps the existing terminal-backed chat path.",
+            "structuredScope": "Local sessions only for now. WSL and remote execution hosts (including SSH) continue to use terminal chat, and Windows falls back to it unless Orca can read process start times.",
             "structuredToggleLabel": "Toggle updated structured native chat"
           },
           "agentDashboard": {
@@ -13770,7 +13810,9 @@
           "useLan": "Use LAN",
           "retrying": "Retrying…",
           "retry": "Retry Relay",
-          "copyDiagnostics": "Copy diagnostics"
+          "copyDiagnostics": "Copy diagnostics",
+          "reconnectTitle": "Your Orca account session expired.",
+          "reconnectBody": "Sign in again to use Orca Relay, or use LAN to pair over Tailscale or the same Wi‑Fi."
         }
       },
       "gitlab": {
@@ -15296,8 +15338,18 @@
                 "removeWorktree": "remove worktree",
                 "trashWorktree": "trash worktree",
                 "addQuickCommand": "add quick command",
-                "newQuickCommand": "new quick command"
-              }
+                "newQuickCommand": "new quick command",
+                "splitChatRight": "split chat right",
+                "moveChatRight": "move chat right",
+                "chatPaneRight": "chat pane right",
+                "splitChatDown": "split chat down",
+                "moveChatDown": "move chat down",
+                "chatPaneBelow": "chat pane below"
+              },
+              "splitChatRight": "Split Chat Right",
+              "splitChatRightDescription": "Open the active chat in a split pane to the right.",
+              "splitChatDown": "Split Chat Down",
+              "splitChatDownDescription": "Open the active chat in a split pane below."
             }
           },
           "palette": {
@@ -16135,7 +16187,8 @@
           "search": "Search",
           "showUnreadOnly": "Show unread only",
           "showChildAgents": "Show child agents",
-          "activityOptions": "Activity options"
+          "activityOptions": "Activity options",
+          "threadListOptionsFiltered": "Thread list options, filters active"
         },
         "clearCompleted": {
           "clearedOne": "Cleared 1 completed agent",
@@ -16152,8 +16205,7 @@
           "dc708f3eff": "Close agents"
         },
         "ActivityScopeFilterControls": {
-          "clearHostFilter": "Show all hosts",
-          "clearProjectFilter": "Show all projects",
+          "resetScope": "Show all hosts and projects",
           "hiddenCount": "{{value0}} hidden"
         },
         "ActivityThreadHoverCard": {
@@ -16162,6 +16214,9 @@
           "workspace": "Workspace",
           "copyPath": "Copy path",
           "jumpToWorkspace": "Jump to workspace"
+        },
+        "ActivityThreadRow": {
+          "clearNotification": "Clear notification"
         }
       },
       "confirmation": {
@@ -16940,7 +16995,14 @@
         "ranCommandsOneToolSummary": "Ran {{commandCount}} commands and used {{toolCount}} tool",
         "ranCommandsManyToolsSummary": "Ran {{commandCount}} commands and used {{toolCount}} tools",
         "usedOneSummary": "Used 1 tool",
-        "usedManySummary": "Used {{toolCount}} tools"
+        "usedManySummary": "Used {{toolCount}} tools",
+        "editedFile": "Edited file",
+        "addedFile": "Added file",
+        "deletedFile": "Deleted file",
+        "renamedFile": "Renamed file",
+        "copyDiff": "Copy diff",
+        "diffGap": "Lines not shown",
+        "diffTruncated": "Diff truncated"
       },
       "providerFrame": {
         "byteLength": "{{value0}} bytes"
@@ -16949,10 +17011,23 @@
         "responding": "Agent is responding",
         "working": "Working…",
         "thinking": "Thinking",
-        "workingFor": "Working for {{value0}} seconds",
-        "workedFor": "Worked for {{value0}} seconds",
+        "workingFor": "Working for {{value0}}",
+        "workedFor": "Worked for {{value0}}",
         "toggleDetails": "Toggle turn details"
       },
+      "backgroundTasks": {
+        "monitoring": "Monitoring background tasks",
+        "stop": "Stop",
+        "stopTask": "Stop {{value0}}",
+        "stopAll": "Stop background tasks",
+        "agent": "Background agent",
+        "workflow": "Background workflow",
+        "command": "Background command",
+        "monitor": "Background monitor",
+        "task": "Background task",
+        "runningList": "Running background tasks",
+        "detailsUnavailable": "Task details are unavailable for this session."
+      },
       "jumpToLatest": "Jump to latest",
       "toggle": {
         "showTerminal": "Show terminal",
@@ -17006,9 +17081,45 @@
         "message": "Structured Chat blocks terminal prompts and sends. Orchestration messages remain queued; switch to Terminal, then check the Orca inbox with",
         "command": "orca orchestration check"
       },
-      "structuredSessionCloseFailed": "Could not close this Codex chat",
-      "structuredSessionLaunchFailed": "Could not open Codex chat",
-      "structuredSessionCloseFailedDescription": "The terminal stayed open so the provider remains recoverable."
+      "structuredSessionCloseFailed": "Could not close this chat session",
+      "structuredSessionLaunchFailed": "Could not open {{value0}} chat",
+      "structuredSessionLaunchPending": "Starting {{value0}} chat…",
+      "structuredSessionCloseFailedDescription": "The terminal stayed open so the provider remains recoverable.",
+      "handoff": {
+        "stage": {
+          "finishingChat": "Finishing chat session…",
+          "finishingTerminal": "Finishing agent terminal…",
+          "openingTerminal": "Opening agent terminal…",
+          "resumingChat": "Resuming chat session…",
+          "verifyingTerminal": "Verifying agent terminal…",
+          "verifyingChat": "Verifying chat session…",
+          "recovering": "Recovering agent session…",
+          "manualRecovery": "Agent session needs recovery"
+        },
+        "switchingOwner": "Switching session owner…",
+        "mode": {
+          "switching": "Switching",
+          "terminal": "Terminal",
+          "chat": "Chat"
+        },
+        "switchingAfterTurn": "Switching after this turn",
+        "returningAfterTurn": "Returning after this turn",
+        "cancel": "Cancel",
+        "switchAfterTurn": "Switch after this turn",
+        "stopTurnAndSwitch": "Stop turn and switch",
+        "openAgentTui": "Open agent TUI",
+        "returnAfterTurn": "Return after this turn",
+        "returnToChat": "Return to chat",
+        "agentOpenOnHost": "Agent is open in terminal on {{value0}}.",
+        "agentOpen": "Agent is open in terminal.",
+        "exitTerminal": "Exit the agent terminal to continue in chat.",
+        "retryProof": "Retry proof",
+        "retry": "Retry",
+        "details": "Details"
+      },
+      "structuredSessionFellBackToTerminal": "Structured chat isn't available",
+      "structuredSessionFellBackToTerminalDescription": "Orca tried to open a {{value0}} terminal instead.",
+      "structuredSessionLaunchFailedDescription": "Orca could not open a structured {{value0}} chat. See the logs for details."
     },
     "tab": {
       "bar": {
@@ -17532,5 +17643,17 @@
       "action": "Try Agents",
       "hiddenToast": "Agents tab hidden. Re-enable it in Settings → Experimental."
     }
+  },
+  "rendererRecovery": {
+    "reload": "Reload",
+    "copyCommands": "Copy Commands",
+    "quit": "Quit",
+    "stalledDetail": "Orca reloaded the window after a crash, but it never finished loading.",
+    "crashLoopDetail": "Orca tried to recover {{recoveryCount}} times in a row without success.",
+    "driverFallback": "If that does not help, the cause is usually a graphics driver.",
+    "genericDetail": "This is often a graphics-driver or installation problem. Reload to try again, or quit and relaunch Orca.",
+    "title": "Orca keeps failing to load",
+    "stalledMessage": "The app window stopped responding while reloading after a crash.",
+    "crashLoopMessage": "The app window crashed repeatedly and stopped reloading automatically."
   }
 }
diff --git a/src/renderer/src/i18n/locales/es.json b/src/renderer/src/i18n/locales/es.json
index 9999634daee..3c2881e16f2 100644
--- a/src/renderer/src/i18n/locales/es.json
+++ b/src/renderer/src/i18n/locales/es.json
@@ -1924,7 +1924,7 @@
       "Terminal": {
         "73768427cf": "Cerrar",
         "f82e9f02df": "Cancelar",
-        "7958465754": "Hay terminales locales con procesos en ejecución. ¿Cerrar la ventana de todos modos?",
+        "7958465754": "Hay terminales con procesos en ejecución. ¿Cerrar la ventana de todos modos?",
         "2fa9c69ff3": "¿Cerrar ventana?",
         "cd51e28d8b": "Guardar",
         "0037b21794": "No guardar",
@@ -14180,6 +14180,7 @@
           "770d458144": "Agrupar por",
           "795cbf26e2": "Filtrar...",
           "4616ea39fd": "Ir al workspace",
+          "threadListOptionsFiltered": "Opciones de lista de hilos, filtros activos",
           "markThreadRead": "Marcar hilo como leído",
           "59b131fbd9": "Marcar hilo como no leído",
           "beb2c19173": "No leído",
@@ -14187,6 +14188,12 @@
           "22b22034bc": "Terminal independiente no disponible en Actividad.",
           "afdc2139a8": "Terminal de Agent cerrada. Abre una nueva terminal en este workspace para continuar."
         },
+        "ActivityScopeFilterControls": {
+          "resetScope": "Mostrar todos los hosts y proyectos"
+        },
+        "ActivityThreadRow": {
+          "clearNotification": "Borrar notificación"
+        },
         "ActivityTitlebarControls": {
           "f915168c8e": "no leído",
           "d6a8de3934": "agentes",
diff --git a/src/renderer/src/i18n/locales/fr.json b/src/renderer/src/i18n/locales/fr.json
index 8eff250a820..44f4173b8e6 100644
--- a/src/renderer/src/i18n/locales/fr.json
+++ b/src/renderer/src/i18n/locales/fr.json
@@ -2087,7 +2087,7 @@
       "Terminal": {
         "73768427cf": "Fermer",
         "f82e9f02df": "Annuler",
-        "7958465754": "Des terminaux locaux exécutent des processus. Fermer quand même la fenêtre ?",
+        "7958465754": "Des terminaux exécutent des processus. Fermer quand même la fenêtre ?",
         "2fa9c69ff3": "Fermer la fenêtre ?",
         "cd51e28d8b": "Enregistrer",
         "0037b21794": "Ne pas enregistrer",
@@ -15462,12 +15462,19 @@
           "770d458144": "Grouper l'activité des agents par",
           "795cbf26e2": "Filtrer...",
           "4616ea39fd": "Aller à l'espace de travail",
+          "threadListOptionsFiltered": "Options de la liste des fils, filtres actifs",
           "59b131fbd9": "Marquer le fil comme non lu",
           "beb2c19173": "Non lus",
           "5651b216c6": "Projet inconnu",
           "22b22034bc": "Terminal autonome indisponible dans Activité.",
           "afdc2139a8": "Terminal de l'agent fermé. Ouvrez un nouveau terminal dans cet espace de travail pour continuer."
         },
+        "ActivityScopeFilterControls": {
+          "resetScope": "Afficher tous les hôtes et projets"
+        },
+        "ActivityThreadRow": {
+          "clearNotification": "Effacer la notification"
+        },
         "ActivityTitlebarControls": {
           "f915168c8e": "non lu",
           "d6a8de3934": "agents",
diff --git a/src/renderer/src/i18n/locales/ja.json b/src/renderer/src/i18n/locales/ja.json
index b3c30da9446..c46c27ddf5a 100644
--- a/src/renderer/src/i18n/locales/ja.json
+++ b/src/renderer/src/i18n/locales/ja.json
@@ -1924,7 +1924,7 @@
       "Terminal": {
         "73768427cf": "閉じる",
         "f82e9f02df": "キャンセル",
-        "7958465754": "プロセスが実行中のローカルターミナルがあります。このままウィンドウを閉じますか?",
+        "7958465754": "プロセスが実行中のターミナルがあります。このままウィンドウを閉じますか?",
         "2fa9c69ff3": "ウィンドウを閉じますか?",
         "cd51e28d8b": "保存",
         "0037b21794": "保存しないでください",
@@ -14180,6 +14180,7 @@
           "770d458144": "グループ化",
           "795cbf26e2": "フィルター…",
           "4616ea39fd": "ワークスペースにジャンプ",
+          "threadListOptionsFiltered": "スレッドリストのオプション、フィルターが有効",
           "markThreadRead": "スレッドを既読としてマーク",
           "59b131fbd9": "スレッドを未読としてマークする",
           "beb2c19173": "未読",
@@ -14187,6 +14188,12 @@
           "22b22034bc": "スタンドアロンターミナルはアクティビティでは使用できません。",
           "afdc2139a8": "Agent ターミナルが閉じられました。続行するには、このワークスペースで新規ターミナルを開いてください。"
         },
+        "ActivityScopeFilterControls": {
+          "resetScope": "すべてのホストとプロジェクトを表示"
+        },
+        "ActivityThreadRow": {
+          "clearNotification": "通知を消去"
+        },
         "ActivityTitlebarControls": {
           "f915168c8e": "未読",
           "d6a8de3934": "Agent",
@@ -14561,6 +14568,41 @@
     }
   },
   "components": {
+    "onboarding": {
+      "flow": {
+        "stepTooltip": {
+          "agent": "デフォルトの Agent",
+          "theme": "外観",
+          "windowsTerminal": "Windows ターミナル",
+          "notifications": "通知",
+          "integrations": "連携"
+        },
+        "actions": {
+          "addFirstProject": "最初のプロジェクトを追加",
+          "continue": "続行",
+          "openingAddProject": "[プロジェクトを追加] を開いています…"
+        }
+      },
+      "skipConfirmation": {
+        "skip": "スキップ",
+        "keepGoing": "いいえ、続ける"
+      },
+      "theme": {
+        "hints": {
+          "system": "OS に合わせる",
+          "dark": "目にやさしい",
+          "light": "明るく鮮明"
+        }
+      },
+      "integrations": {
+        "capabilities": {
+          "startWorkspaceFromIssue": "GitHub の Issue や PR から、タイトルとコンテキストがあらかじめ入力されたワークスペースを開始",
+          "browseIssues": "Orca から離れずに、「タスク」ページで GitHub の Issue と PR を閲覧",
+          "reviewStatus": "すべてのワークツリーで Issue の状態、レビュー状況、CI チェックを確認",
+          "managePullRequests": "Orca から離れずに、PR の閲覧、コメント、マージ"
+        }
+      }
+    },
     "native-chat": {
       "composer": {
         "imageUnsupported": "この Agent では画像の貼り付けはサポートされていません。",
diff --git a/src/renderer/src/i18n/locales/ko.json b/src/renderer/src/i18n/locales/ko.json
index ac75cca2209..8314abe56c8 100644
--- a/src/renderer/src/i18n/locales/ko.json
+++ b/src/renderer/src/i18n/locales/ko.json
@@ -1929,7 +1929,7 @@
       "Terminal": {
         "73768427cf": "닫기",
         "f82e9f02df": "취소",
-        "7958465754": "실행 중인 프로세스가 있는 로컬 terminals이 있습니다. 그래도 창을 닫으시겠습니까?",
+        "7958465754": "실행 중인 프로세스가 있는 terminals이 있습니다. 그래도 창을 닫으시겠습니까?",
         "2fa9c69ff3": "창을 닫으시겠습니까?",
         "cd51e28d8b": "저장",
         "0037b21794": "저장하지 않음",
@@ -14258,6 +14258,7 @@
           "770d458144": "그룹화 기준",
           "795cbf26e2": "필터...",
           "4616ea39fd": "워크스페이스로 이동",
+          "threadListOptionsFiltered": "스레드 목록 옵션, 필터 활성화됨",
           "markThreadRead": "스레드를 읽은 것으로 표시",
           "59b131fbd9": "스레드를 읽지 않은 것으로 표시",
           "beb2c19173": "읽지 않음",
@@ -14265,6 +14266,12 @@
           "22b22034bc": "활동에서는 독립형 terminal을 사용할 수 없습니다.",
           "afdc2139a8": "Agent terminal이 닫혔습니다. 계속하려면 이 워크스페이스에서 새 terminal을 여세요."
         },
+        "ActivityScopeFilterControls": {
+          "resetScope": "모든 호스트 및 프로젝트 표시"
+        },
+        "ActivityThreadRow": {
+          "clearNotification": "알림 지우기"
+        },
         "ActivityTitlebarControls": {
           "f915168c8e": "읽지 않음",
           "d6a8de3934": "에이전트",
diff --git a/src/renderer/src/i18n/locales/zh.json b/src/renderer/src/i18n/locales/zh.json
index 7a3b47c8f2a..959296cd869 100644
--- a/src/renderer/src/i18n/locales/zh.json
+++ b/src/renderer/src/i18n/locales/zh.json
@@ -1927,7 +1927,7 @@
       "Terminal": {
         "73768427cf": "关闭",
         "f82e9f02df": "取消",
-        "7958465754": "有正在运行的进程的本地终端。还是关窗吧？",
+        "7958465754": "有正在运行的进程的终端。还是关窗吧？",
         "2fa9c69ff3": "关闭窗口？",
         "cd51e28d8b": "保存",
         "0037b21794": "不保存",
@@ -14236,6 +14236,7 @@
           "770d458144": "分组方式",
           "795cbf26e2": "筛选...",
           "4616ea39fd": "跳转到工作区",
+          "threadListOptionsFiltered": "线程列表选项，筛选器已启用",
           "markThreadRead": "将话题标记为已读",
           "59b131fbd9": "将话题标记为未读",
           "beb2c19173": "未读",
@@ -14243,6 +14244,12 @@
           "22b22034bc": "独立终端在活动中不可用。",
           "afdc2139a8": "智能体终端关闭。在此工作区中打开一个新终端以继续。"
         },
+        "ActivityScopeFilterControls": {
+          "resetScope": "显示所有主机和项目"
+        },
+        "ActivityThreadRow": {
+          "clearNotification": "清除通知"
+        },
         "ActivityTitlebarControls": {
           "f915168c8e": "未读",
           "d6a8de3934": "智能体",
diff --git a/src/renderer/src/lib/activate-ai-vault-structured-session-reveal.test.ts b/src/renderer/src/lib/activate-ai-vault-structured-session-reveal.test.ts
new file mode 100644
index 00000000000..0de7f0edb3a
--- /dev/null
+++ b/src/renderer/src/lib/activate-ai-vault-structured-session-reveal.test.ts
@@ -0,0 +1,152 @@
+/**
+ * The reveal call itself, rather than the activation flow that injects it.
+ *
+ * What it has to get right is which host it negotiates against: the chat lives on the host that
+ * owns the workspace, which for a paired workspace is not this process. Gating on the local build's
+ * capabilities would pass unconditionally on desktop and say nothing about the host being called.
+ */
+
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  call: vi.fn(),
+  supports: vi.fn(),
+  environmentIdFor: vi.fn()
+}))
+
+vi.mock('@/runtime/runtime-rpc-client', async () => {
+  // The real target resolution is the thing under test; only the transport is stubbed.
+  const { getActiveRuntimeTarget } = await import('@/runtime/runtime-client-target')
+  return {
+    getActiveRuntimeTarget,
+    callRuntimeRpc: mocks.call,
+    runtimeEnvironmentSupportsCapability: mocks.supports
+  }
+})
+
+vi.mock('./worktree-runtime-owner', () => ({
+  getRuntimeEnvironmentIdForWorktree: mocks.environmentIdFor
+}))
+
+import { revealStructuredSession } from './activate-ai-vault-structured-session'
+import { STRUCTURED_AGENT_SESSION_REVEAL_RUNTIME_CAPABILITY } from '../../../shared/protocol-version'
+import { RUNTIME_COMPAT_BLOCK_CODE } from '@/runtime/runtime-protocol-compat'
+
+const target = { worktreeId: 'workspace-1', sessionId: 'session-1' }
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.call.mockResolvedValue({ ok: true })
+  mocks.supports.mockResolvedValue(true)
+  mocks.environmentIdFor.mockReturnValue(null)
+})
+
+describe('revealStructuredSession', () => {
+  it('asks a local host without a capability round trip', async () => {
+    // The renderer and its local host are one build, so probing would only cost a round trip on a
+    // user's click to prove something already known.
+    await expect(revealStructuredSession(target)).resolves.toBe('revealed')
+
+    expect(mocks.supports).not.toHaveBeenCalled()
+    expect(mocks.call).toHaveBeenCalledWith(
+      { kind: 'local' },
+      'agentSession.reveal',
+      { sessionId: 'session-1' },
+      expect.objectContaining({ timeoutMs: expect.any(Number) })
+    )
+  })
+
+  it('negotiates against the host that owns the workspace, not the local one', async () => {
+    mocks.environmentIdFor.mockReturnValue('env-1')
+
+    await expect(revealStructuredSession(target)).resolves.toBe('revealed')
+
+    expect(mocks.supports).toHaveBeenCalledWith(
+      'env-1',
+      STRUCTURED_AGENT_SESSION_REVEAL_RUNTIME_CAPABILITY,
+      expect.any(Number)
+    )
+    expect(mocks.call).toHaveBeenCalledWith(
+      { kind: 'environment', environmentId: 'env-1' },
+      'agentSession.reveal',
+      { sessionId: 'session-1' },
+      expect.objectContaining({ timeoutMs: expect.any(Number) })
+    )
+  })
+
+  it('reports a paired host that cannot open it rather than sending an unknown method', async () => {
+    // The regression this guards: an older paired host answers method_not_found, which is
+    // indistinguishable from a refusal, so the user is told the chat is gone when it is not.
+    mocks.environmentIdFor.mockReturnValue('legacy-env')
+    mocks.supports.mockResolvedValue(false)
+
+    await expect(revealStructuredSession(target)).resolves.toBe('host-cannot-open')
+
+    expect(mocks.call).not.toHaveBeenCalled()
+  })
+
+  it('reports unreachable when the capability probe cannot reach the host', async () => {
+    // Losing contact is not evidence about the host's age or about the chat.
+    mocks.environmentIdFor.mockReturnValue('env-1')
+    mocks.supports.mockRejectedValue(new Error('status timeout'))
+
+    await expect(revealStructuredSession(target)).resolves.toBe('unreachable')
+
+    expect(mocks.call).not.toHaveBeenCalled()
+  })
+
+  it('gives up on a probe that never settles instead of hanging the row', async () => {
+    // The in-flight guard releases on settle, so a probe that never answers would otherwise hold
+    // this session's entry for the life of the process and leave the row permanently dead.
+    vi.useFakeTimers()
+    mocks.environmentIdFor.mockReturnValue('env-1')
+    mocks.supports.mockReturnValue(new Promise(() => {}))
+
+    try {
+      const outcome = revealStructuredSession(target)
+      await vi.advanceTimersByTimeAsync(10_000)
+
+      await expect(outcome).resolves.toBe('unreachable')
+      expect(mocks.call).not.toHaveBeenCalled()
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('reports the chat gone only for the refusal that means the record is absent', async () => {
+    mocks.call.mockResolvedValue({
+      ok: false,
+      refusal: { code: 'agent_session_identity_required' }
+    })
+
+    await expect(revealStructuredSession(target)).resolves.toBe('gone')
+  })
+
+  it('does not call a host-side refusal a missing chat', async () => {
+    // The host answers this when it holds the record but no adapter of its own can open it.
+    // Saying "gone" there tells someone their work is lost while it sits on disk.
+    mocks.call.mockResolvedValue({
+      ok: false,
+      refusal: { code: 'structured_agent_session_unsupported' }
+    })
+
+    await expect(revealStructuredSession(target)).resolves.toBe('host-cannot-open')
+  })
+
+  it('reads a version block as a host too old, not as a lost connection', async () => {
+    mocks.environmentIdFor.mockReturnValue('env-1')
+    const blocked = Object.assign(new Error('Update the Orca server'), {
+      code: RUNTIME_COMPAT_BLOCK_CODE
+    })
+    mocks.supports.mockRejectedValue(blocked)
+
+    await expect(revealStructuredSession(target)).resolves.toBe('host-cannot-open')
+    expect(mocks.call).not.toHaveBeenCalled()
+  })
+
+  it('reports unreachable when the call fails rather than answers', async () => {
+    mocks.call.mockRejectedValue(new Error('structured_session_restore_timeout'))
+
+    await expect(revealStructuredSession(target)).resolves.toBe('unreachable')
+  })
+})
diff --git a/src/renderer/src/lib/activate-ai-vault-structured-session.test.ts b/src/renderer/src/lib/activate-ai-vault-structured-session.test.ts
index 1e6cd961d98..fd63c28ba61 100644
--- a/src/renderer/src/lib/activate-ai-vault-structured-session.test.ts
+++ b/src/renderer/src/lib/activate-ai-vault-structured-session.test.ts
@@ -1,3 +1,5 @@
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
 import { describe, expect, it, vi } from 'vitest'
 import type { AiVaultSession } from '../../../shared/ai-vault-types'
 import { activateAiVaultStructuredSession } from './activate-ai-vault-structured-session'
@@ -6,31 +8,178 @@ const structuredSession = {
   structuredSession: { sessionId: 'session-1', workspaceId: 'workspace-1' }
 } as AiVaultSession
 
+function deps(overrides: Partial<Parameters<typeof activateAiVaultStructuredSession>[1]> = {}) {
+  return {
+    activate: vi.fn(() => true),
+    refresh: vi.fn(async () => undefined),
+    reveal: vi.fn(async () => 'revealed' as const),
+    unavailable: vi.fn(),
+    gone: vi.fn(),
+    hostCannotOpen: vi.fn(),
+    ...overrides
+  }
+}
+
 describe('activateAiVaultStructuredSession', () => {
   it('refreshes an unpublished structured tab before activating it', async () => {
-    const activate = vi.fn().mockReturnValueOnce(false).mockReturnValueOnce(true)
-    const refresh = vi.fn(async () => undefined)
-    const unavailable = vi.fn()
+    const parts = deps({
+      activate: vi.fn().mockReturnValueOnce(false).mockReturnValueOnce(true)
+    })
 
-    await expect(
-      activateAiVaultStructuredSession(structuredSession, { activate, refresh, unavailable })
-    ).resolves.toBe(true)
+    await expect(activateAiVaultStructuredSession(structuredSession, parts)).resolves.toBe(true)
 
-    expect(refresh).toHaveBeenCalledWith('workspace-1')
-    expect(activate).toHaveBeenCalledTimes(2)
-    expect(unavailable).not.toHaveBeenCalled()
+    expect(parts.refresh).toHaveBeenCalledWith('workspace-1')
+    expect(parts.activate).toHaveBeenCalledTimes(2)
+    // Why: the refresh alone answered, so the host was never asked to republish anything.
+    expect(parts.reveal).not.toHaveBeenCalled()
+    expect(parts.unavailable).not.toHaveBeenCalled()
+    expect(parts.gone).not.toHaveBeenCalled()
   })
 
-  it('surfaces a retryable state when the structured tab remains unavailable', async () => {
-    const activate = vi.fn(() => false)
-    const refresh = vi.fn(async () => undefined)
-    const unavailable = vi.fn()
+  it('reveals a session the inventory does not carry, then activates it', async () => {
+    const parts = deps({
+      activate: vi.fn().mockReturnValueOnce(false).mockReturnValueOnce(false).mockReturnValue(true)
+    })
 
-    await expect(
-      activateAiVaultStructuredSession(structuredSession, { activate, refresh, unavailable })
-    ).resolves.toBe(true)
+    await expect(activateAiVaultStructuredSession(structuredSession, parts)).resolves.toBe(true)
 
-    expect(activate).toHaveBeenCalledTimes(2)
-    expect(unavailable).toHaveBeenCalledOnce()
+    expect(parts.reveal).toHaveBeenCalledWith({
+      worktreeId: 'workspace-1',
+      sessionId: 'session-1'
+    })
+    // The refresh after the reveal is what carries the republished tab into the store.
+    expect(parts.refresh).toHaveBeenCalledTimes(2)
+    expect(parts.activate).toHaveBeenCalledTimes(3)
+    expect(parts.unavailable).not.toHaveBeenCalled()
+    expect(parts.gone).not.toHaveBeenCalled()
+  })
+
+  it('says the chat is gone rather than asking for a retry that cannot succeed', async () => {
+    // The host answered, and its answer was that it holds no such chat. Waiting cannot change it.
+    const parts = deps({
+      activate: vi.fn(() => false),
+      reveal: vi.fn(async () => 'gone' as const)
+    })
+
+    await expect(activateAiVaultStructuredSession(structuredSession, parts)).resolves.toBe(true)
+
+    expect(parts.gone).toHaveBeenCalledOnce()
+    expect(parts.unavailable).not.toHaveBeenCalled()
+  })
+
+  it('falls back to the retryable message when a revealed tab still does not arrive', async () => {
+    const parts = deps({ activate: vi.fn(() => false) })
+
+    await expect(activateAiVaultStructuredSession(structuredSession, parts)).resolves.toBe(true)
+
+    expect(parts.reveal).toHaveBeenCalledOnce()
+    expect(parts.unavailable).toHaveBeenCalledOnce()
+    expect(parts.gone).not.toHaveBeenCalled()
+  })
+
+  it('still reveals when the inventory refresh itself fails', async () => {
+    // The refresh is an optimization. Letting its failure end the click reinstates the dead end
+    // this whole path exists to remove: a closed chat, and advice to retry that cannot come true.
+    const parts = deps({
+      activate: vi.fn().mockReturnValueOnce(false).mockReturnValue(true),
+      refresh: vi.fn().mockRejectedValueOnce(new Error('structured_session_restore_timeout'))
+    })
+
+    await expect(activateAiVaultStructuredSession(structuredSession, parts)).resolves.toBe(true)
+
+    expect(parts.reveal).toHaveBeenCalledOnce()
+    expect(parts.unavailable).not.toHaveBeenCalled()
+    expect(parts.gone).not.toHaveBeenCalled()
+  })
+
+  it('does not strand the click when the post-reveal refresh fails', async () => {
+    const parts = deps({
+      activate: vi.fn().mockReturnValueOnce(false).mockReturnValueOnce(false).mockReturnValue(true),
+      refresh: vi
+        .fn()
+        .mockResolvedValueOnce(undefined)
+        .mockRejectedValueOnce(new Error('structured_session_restore_timeout'))
+    })
+
+    await expect(activateAiVaultStructuredSession(structuredSession, parts)).resolves.toBe(true)
+
+    // The reveal already emitted a snapshot of its own, so a failed confirmation refresh must not
+    // discard a tab that has in fact arrived.
+    expect(parts.activate).toHaveBeenCalledTimes(3)
+    expect(parts.unavailable).not.toHaveBeenCalled()
+    expect(parts.gone).not.toHaveBeenCalled()
+  })
+
+  it('offers an update rather than a eulogy when the host itself cannot open the chat', async () => {
+    // The chat is not gone. Reporting it as gone hides the one remedy that would bring it back.
+    const parts = deps({
+      activate: vi.fn(() => false),
+      reveal: vi.fn(async () => 'host-cannot-open' as const)
+    })
+
+    await expect(activateAiVaultStructuredSession(structuredSession, parts)).resolves.toBe(true)
+
+    expect(parts.hostCannotOpen).toHaveBeenCalledOnce()
+    expect(parts.gone).not.toHaveBeenCalled()
+    expect(parts.unavailable).not.toHaveBeenCalled()
+  })
+
+  it('keeps the retryable message when the host never answered', async () => {
+    // Losing contact says nothing about the chat, so this is the one miss worth waiting out.
+    const parts = deps({
+      activate: vi.fn(() => false),
+      reveal: vi.fn(async () => 'unreachable' as const)
+    })
+
+    await expect(activateAiVaultStructuredSession(structuredSession, parts)).resolves.toBe(true)
+
+    expect(parts.unavailable).toHaveBeenCalledOnce()
+    expect(parts.gone).not.toHaveBeenCalled()
+    expect(parts.hostCannotOpen).not.toHaveBeenCalled()
+  })
+
+  it('runs one activation per session however many times the row is clicked', async () => {
+    // Three clicks on a slow row used to run three full sequences and land three toasts.
+    let release!: (outcome: 'gone') => void
+    const pending = new Promise<'gone'>((resolve) => {
+      release = resolve
+    })
+    const parts = deps({ activate: vi.fn(() => false), reveal: vi.fn(() => pending) })
+
+    const clicks = [
+      activateAiVaultStructuredSession(structuredSession, parts),
+      activateAiVaultStructuredSession(structuredSession, parts),
+      activateAiVaultStructuredSession(structuredSession, parts)
+    ]
+    release('gone')
+    await Promise.all(clicks)
+
+    expect(parts.reveal).toHaveBeenCalledOnce()
+    expect(parts.gone).toHaveBeenCalledOnce()
+  })
+
+  it('ignores a row that is not a structured chat', async () => {
+    const parts = deps()
+
+    await expect(activateAiVaultStructuredSession({} as AiVaultSession, parts)).resolves.toBe(false)
+
+    expect(parts.reveal).not.toHaveBeenCalled()
+  })
+})
+
+describe('every Agent Session History entry point reaches the same reveal', () => {
+  // A source ratchet rather than a mounted drag harness: what regresses here is a call site
+  // quietly going back to bare activation, which cannot reach a chat whose tab is closed. Both
+  // surfaces act on the identical row, so answering a click and a drop differently is the bug.
+  const entryPoints = [
+    'components/tab-group/AiVaultSessionDropLayer.tsx',
+    'components/right-sidebar/ai-vault-session-launch-actions.ts'
+  ]
+
+  it.each(entryPoints)('%s routes its structured branch through the reveal path', (relative) => {
+    const source = readFileSync(join(__dirname, '..', relative), 'utf8')
+
+    expect(source).toContain('activateAiVaultStructuredSession(')
+    expect(source).not.toContain('activateStructuredAgentSessionById')
   })
 })
diff --git a/src/renderer/src/lib/activate-ai-vault-structured-session.ts b/src/renderer/src/lib/activate-ai-vault-structured-session.ts
index 5fc0684458b..c04378e0a93 100644
--- a/src/renderer/src/lib/activate-ai-vault-structured-session.ts
+++ b/src/renderer/src/lib/activate-ai-vault-structured-session.ts
@@ -5,22 +5,49 @@ import { activateAndRevealWorktree } from './worktree-activation'
 import { activateStructuredAgentSessionById } from './structured-agent-session-tab-activation'
 import { useAppStore } from '@/store'
 import { getRuntimeEnvironmentIdForWorktree } from './worktree-runtime-owner'
-import { callRuntimeRpc, getActiveRuntimeTarget } from '@/runtime/runtime-rpc-client'
+import {
+  callRuntimeRpc,
+  getActiveRuntimeTarget,
+  runtimeEnvironmentSupportsCapability
+} from '@/runtime/runtime-rpc-client'
 import { toRuntimeWorktreeSelector } from '@/runtime/runtime-worktree-selector'
 import type { RuntimeMobileSessionTabsResult } from '../../../shared/runtime-types'
-import { applyStructuredSessionTabSnapshots } from '@/runtime/local-structured-session-tabs-sync'
+import {
+  applyStructuredSessionTabSnapshots,
+  isCurrentLocalStructuredSessionGeneration,
+  localStructuredSessionGeneration
+} from '@/runtime/local-structured-session-tabs-sync'
+import { STRUCTURED_AGENT_SESSION_REVEAL_RUNTIME_CAPABILITY } from '../../../shared/protocol-version'
+import { isRuntimeCompatBlockError } from '@/runtime/runtime-protocol-compat'
 
 const STRUCTURED_SESSION_RESTORE_TIMEOUT_MS = 5_000
 
+/** Why four: the three terminal answers a user can act on differ, and folding them together sends
+ *  someone to the wrong remedy — wait, give up, or update the host. `unreachable` is the only one
+ *  that improves by retrying, and `gone` means the host said it holds no such chat, never that the
+ *  host could not answer for a reason of its own. */
+export type StructuredSessionRevealOutcome =
+  | 'revealed'
+  | 'gone'
+  | 'host-cannot-open'
+  | 'unreachable'
+
 type StructuredSessionActivationDeps = {
   activate: typeof activateStructuredAgentSessionById
   refresh: (worktreeId: string) => Promise<void>
+  reveal: (target: {
+    worktreeId: string
+    sessionId: string
+  }) => Promise<StructuredSessionRevealOutcome>
   unavailable: () => void
+  gone: () => void
+  hostCannotOpen: () => void
 }
 
 const defaultDeps: StructuredSessionActivationDeps = {
   activate: activateStructuredAgentSessionById,
   refresh: refreshStructuredSessionTabs,
+  reveal: revealStructuredSession,
   unavailable: () => {
     toast.error(
       translate(
@@ -28,28 +55,93 @@ const defaultDeps: StructuredSessionActivationDeps = {
         'The structured agent session is not available yet. Retry in a moment.'
       )
     )
+  },
+  // Why a second message: once reveal exists, a miss is no longer a timing problem the user can
+  // wait out, so telling them to retry sends them in a circle.
+  gone: () => {
+    toast.error(
+      translate(
+        'auto.lib.activateAiVaultStructuredSession.gone',
+        'This chat is no longer on this host, so it cannot be reopened here.'
+      )
+    )
+  },
+  // Separate from `gone` because the chat is not gone: something about this pairing cannot open
+  // it — a host too old to know the method, adapters that do not cover the provider, or a version
+  // block that can name EITHER side. Naming a machine here would point half of those at the wrong
+  // one, so the message names the remedy instead. Telling someone their work is lost when an
+  // update would bring it back is the worse of the two wrong answers.
+  hostCannotOpen: () => {
+    toast.error(
+      translate(
+        'auto.lib.activateAiVaultStructuredSession.hostCannotOpen',
+        "This chat can't be reopened until Orca is updated."
+      )
+    )
   }
 }
 
+/**
+ * @param session anything carrying the row's structured pointer — an Agent Session History row or
+ * the drag payload built from one. Only `structuredSession` is read, and both surfaces must reach
+ * the same reveal, or the same row answers a click and a drop differently.
+ */
 export async function activateAiVaultStructuredSession(
-  session: AiVaultSession,
+  session: Pick<AiVaultSession, 'structuredSession'>,
   deps: StructuredSessionActivationDeps = defaultDeps
 ): Promise<boolean> {
   const structured = session.structuredSession
   if (!structured) {
     return false
   }
+  // Why: the click can chain a refresh, a capability probe, a reveal and a second refresh, each
+  // with its own timeout, and nothing on the row says it is working. Without this, an impatient
+  // second click runs the whole sequence again and lands its own toast.
+  const inFlight = activationsInFlight.get(structured.sessionId)
+  if (inFlight) {
+    return inFlight
+  }
+  const activation = activateStructuredSession(structured, deps)
+  activationsInFlight.set(structured.sessionId, activation)
+  try {
+    return await activation
+  } finally {
+    activationsInFlight.delete(structured.sessionId)
+  }
+}
+
+const activationsInFlight = new Map<string, Promise<boolean>>()
+
+async function activateStructuredSession(
+  structured: NonNullable<AiVaultSession['structuredSession']>,
+  deps: StructuredSessionActivationDeps
+): Promise<boolean> {
   const target = { worktreeId: structured.workspaceId, sessionId: structured.sessionId }
   if (!deps.activate(target)) {
-    try {
-      await deps.refresh(structured.workspaceId)
-    } catch {
-      deps.unavailable()
-      return true
-    }
-    if (!deps.activate(target)) {
-      deps.unavailable()
-      return true
+    // A refresh alone can answer, and costs one call instead of two. It is only ever an
+    // optimization, so a refresh that fails must fall through to the reveal rather than end the
+    // click: the host republishing the tab is the repair, and it does not need this to have worked.
+    const refreshed = await refreshedWithoutThrowing(deps, structured.workspaceId)
+    if (!refreshed || !deps.activate(target)) {
+      // The inventory genuinely does not carry this chat: it was closed, or this process never
+      // published it. Ask the host to republish the tab from the record it still holds on disk.
+      const revealed = await deps.reveal(target)
+      if (revealed !== 'revealed') {
+        if (revealed === 'gone') {
+          deps.gone()
+        } else if (revealed === 'host-cannot-open') {
+          deps.hostCannotOpen()
+        } else {
+          // Unreachable: we never got an answer, so this is the one case waiting can still fix.
+          deps.unavailable()
+        }
+        return true
+      }
+      await refreshedWithoutThrowing(deps, structured.workspaceId)
+      if (!deps.activate(target)) {
+        deps.unavailable()
+        return true
+      }
     }
   }
   if (useAppStore.getState().activeWorktreeId !== structured.workspaceId) {
@@ -58,9 +150,93 @@ export async function activateAiVaultStructuredSession(
   return true
 }
 
+/** The inventory refresh is advisory at every call site here, so its failure is a `false`, never a
+ *  thrown end to the click. */
+async function refreshedWithoutThrowing(
+  deps: StructuredSessionActivationDeps,
+  worktreeId: string
+): Promise<boolean> {
+  try {
+    await deps.refresh(worktreeId)
+    return true
+  } catch {
+    return false
+  }
+}
+
+/**
+ * Ask the host to republish a persisted chat's tab.
+ *
+ * Only `revealed` means the tab is on its way. The other three are all terminal for this click, and
+ * they are kept apart because the remedy differs: retry, give up, or update the host.
+ */
+export async function revealStructuredSession(target: {
+  worktreeId: string
+  sessionId: string
+}): Promise<StructuredSessionRevealOutcome> {
+  const environmentId = getRuntimeEnvironmentIdForWorktree(
+    useAppStore.getState(),
+    target.worktreeId
+  )
+  const host = getActiveRuntimeTarget({ activeRuntimeEnvironmentId: environmentId })
+  // Negotiated against the host that will answer this call, not the local one: a paired host runs
+  // its own build, and its method-not-found is indistinguishable from a refusal we should surface.
+  // A local host is this build, so it always has the method and needs no round trip to prove it.
+  if (host.kind === 'environment') {
+    let supported: boolean
+    try {
+      // Raced, not merely given a timeout argument: on a cache hit this awaits a promise created
+      // by an earlier probe that may carry no deadline of its own, and one that never settles
+      // would hold this session's in-flight entry for the life of the process.
+      supported = await withStructuredSessionRestoreTimeout(
+        runtimeEnvironmentSupportsCapability(
+          host.environmentId,
+          STRUCTURED_AGENT_SESSION_REVEAL_RUNTIME_CAPABILITY,
+          STRUCTURED_SESSION_RESTORE_TIMEOUT_MS
+        )
+      )
+    } catch (error) {
+      // A version block is the host's age, stated outright; anything else means we never got to
+      // ask, which is not evidence about the chat or the host. `remote-agent-session-launch`
+      // splits the same probe's failures the same way.
+      return isRuntimeCompatBlockError(error) ? 'host-cannot-open' : 'unreachable'
+    }
+    if (!supported) {
+      return 'host-cannot-open'
+    }
+  }
+  let result: AgentSessionRevealReply | undefined
+  try {
+    result = await withStructuredSessionRestoreTimeout(
+      callRuntimeRpc<AgentSessionRevealReply>(
+        host,
+        'agentSession.reveal',
+        { sessionId: target.sessionId },
+        {
+          timeoutMs: STRUCTURED_SESSION_RESTORE_TIMEOUT_MS
+        }
+      )
+    )
+  } catch {
+    return 'unreachable'
+  }
+  if (result?.ok === true) {
+    return 'revealed'
+  }
+  // The host raises two different refusals here and they mean opposite things to a user: it holds
+  // no such record, or it holds one it cannot open. Only the first is the chat being gone.
+  return result?.refusal?.code === 'agent_session_identity_required' ? 'gone' : 'host-cannot-open'
+}
+
+type AgentSessionRevealReply = { ok?: boolean; refusal?: { code?: string } }
+
 async function refreshStructuredSessionTabs(worktreeId: string): Promise<void> {
   const state = useAppStore.getState()
   const environmentId = getRuntimeEnvironmentIdForWorktree(state, worktreeId)
+  // Every other caller that applies an inventory fences it on the sync generation. Structured chat
+  // can be switched off while this call is in flight, which wipes the mirror; without this the
+  // answer would land afterwards and re-seed a chat row into a renderer that just discarded them.
+  const generation = localStructuredSessionGeneration()
   const snapshot = await withStructuredSessionRestoreTimeout(
     callRuntimeRpc<RuntimeMobileSessionTabsResult>(
       getActiveRuntimeTarget({ activeRuntimeEnvironmentId: environmentId }),
@@ -69,10 +245,12 @@ async function refreshStructuredSessionTabs(worktreeId: string): Promise<void> {
       { timeoutMs: STRUCTURED_SESSION_RESTORE_TIMEOUT_MS }
     )
   )
-  applyStructuredSessionTabSnapshots(
-    [snapshot],
-    environmentId ? `structured-session:${environmentId}` : undefined
-  )
+  if (!isCurrentLocalStructuredSessionGeneration(generation)) {
+    return
+  }
+  // No owner scope: the apply discards any worktree whose execution host is not local before it
+  // reads one, so a paired workspace is carried by the subscription, not by this call.
+  applyStructuredSessionTabSnapshots([snapshot])
 }
 
 async function withStructuredSessionRestoreTimeout<T>(promise: Promise<T>): Promise<T> {
diff --git a/src/renderer/src/lib/agent-launch-routing.test.ts b/src/renderer/src/lib/agent-launch-routing.test.ts
index a16ed1d5ff2..dd33a8357d9 100644
--- a/src/renderer/src/lib/agent-launch-routing.test.ts
+++ b/src/renderer/src/lib/agent-launch-routing.test.ts
@@ -27,6 +27,68 @@ function route(overrides: Partial<Parameters<typeof resolveAgentLaunchRoute>[0]>
 }
 
 describe('resolveAgentLaunchRoute', () => {
+  it.each(['claude', 'codex'] as const)(
+    'routes a supported local %s launch to structured native chat',
+    (agent) => {
+      expect(route({ agent })).toBe('structured-native-chat')
+      expect(
+        route({ agent, launchText: 'explain this change', promptDelivery: 'auto-submit' })
+      ).toBe('structured-native-chat')
+    }
+  )
+
+  /** Boundary guard between this lane and the one that owns Windows Codex. Codex's win32 refusal is
+   *  deliberate, so it is asserted against whatever currently lets Claude through rather than
+   *  against one host answer — a future gate swap must not be able to flip Codex on quietly. */
+  describe("Codex's Windows refusal", () => {
+    it('holds in the exact situation that routes Claude to structured', () => {
+      const onWindows = { platform: 'win32' } as const
+      expect(route({ ...onWindows, agent: 'claude' })).toBe('structured-native-chat')
+      expect(route({ ...onWindows, agent: 'codex' })).toBe('legacy-native-chat')
+    })
+
+    it('holds for every host capability set, including ones that carry extra gates', () => {
+      for (const hostCapabilities of [
+        [STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY],
+        [STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY, 'agent-session.structured.claude.v1'],
+        [STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY, 'agent-session.structured.hold.v1']
+      ]) {
+        expect(route({ agent: 'codex', platform: 'win32', hostCapabilities })).toBe(
+          'legacy-native-chat'
+        )
+      }
+    })
+
+    it('holds for prompted and folder-workspace launches too', () => {
+      expect(
+        route({
+          agent: 'codex',
+          platform: 'win32',
+          launchText: 'go',
+          promptDelivery: 'auto-submit'
+        })
+      ).toBe('legacy-native-chat')
+      expect(route({ agent: 'codex', platform: 'win32', workspaceKind: 'folder' })).toBe(
+        'legacy-native-chat'
+      )
+    })
+  })
+
+  /** Pins Codex's whole platform answer, not just win32, so no platform silently changes here. */
+  it.each([
+    ['darwin', 'structured-native-chat'],
+    ['linux', 'structured-native-chat'],
+    ['win32', 'legacy-native-chat']
+  ] as const)('leaves Codex routing on %s unchanged', (platform, expected) => {
+    expect(route({ agent: 'codex', platform })).toBe(expected)
+  })
+
+  /** Claude's Windows answer is not a client-side platform guess: the route lets it through and the
+   *  executing host settles it with agentSession.createSupport at create time. */
+  it('lets a Windows Claude launch reach the host-measured create support check', () => {
+    expect(route({ agent: 'claude', platform: 'win32' })).toBe('structured-native-chat')
+  })
+
   it('routes a supported local Codex launch to structured native chat', () => {
     expect(route()).toBe('structured-native-chat')
     expect(route({ launchText: 'explain this change', promptDelivery: 'auto-submit' })).toBe(
@@ -52,7 +114,9 @@ describe('resolveAgentLaunchRoute', () => {
 
   it('fails closed for missing capability, unsupported providers, and explicit TUI options', () => {
     expect(route({ hostCapabilities: [] })).toBe('legacy-native-chat')
-    expect(route({ agent: 'claude' })).toBe('legacy-native-chat')
+    // openclaude and grok render native chat but have no structured adapter.
+    expect(route({ agent: 'openclaude' })).toBe('legacy-native-chat')
+    expect(route({ agent: 'grok' })).toBe('legacy-native-chat')
     expect(route({ requiresTuiLaunchCustomization: true })).toBe('legacy-native-chat')
     expect(route({ initialSessionOptions: { model: 'gpt-5.6-sol' } })).toBe('legacy-native-chat')
   })
@@ -71,9 +135,11 @@ describe('resolveAgentLaunchRoute', () => {
     }
   )
 
-  it('keeps floating, Windows, WSL, and repair-required launches terminal-backed', () => {
+  it('keeps floating, WSL, and repair-required launches terminal-backed', () => {
     expect(route({ workspaceKind: 'floating' })).toBe('legacy-native-chat')
-    expect(route({ platform: 'win32' })).toBe('legacy-native-chat')
+    expect(route({ agent: 'claude', workspaceKind: 'floating', platform: 'win32' })).toBe(
+      'legacy-native-chat'
+    )
     expect(
       route({
         projectRuntime: {
diff --git a/src/renderer/src/lib/agent-launch-routing.ts b/src/renderer/src/lib/agent-launch-routing.ts
index dd72cb29794..243788f8117 100644
--- a/src/renderer/src/lib/agent-launch-routing.ts
+++ b/src/renderer/src/lib/agent-launch-routing.ts
@@ -1,5 +1,6 @@
 import type { GlobalSettings } from '../../../shared/global-settings-types'
 import type { ProjectExecutionRuntimeResolution } from '../../../shared/project-execution-runtime'
+import { isAgentSessionHandleProvider } from '../../../shared/agent-session-provider-handle'
 import { STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY } from '../../../shared/protocol-version'
 import type { TuiAgent } from '../../../shared/tui-agent'
 import {
@@ -92,13 +93,16 @@ export function resolveAgentLaunchRoute(input: AgentLaunchRoutingInput): AgentLa
     input.initialSessionOptions && Object.keys(input.initialSessionOptions).length > 0
   )
   const structuredSupported =
-    input.agent === 'codex' &&
+    isAgentSessionHandleProvider(input.agent) &&
     input.promptDelivery !== 'draft' &&
     input.workspaceKind !== 'floating' &&
     input.requiresTuiLaunchCustomization !== true &&
     !hasInitialSessionOptions &&
     input.executionHostId === 'local' &&
-    input.platform !== 'win32' &&
+    // Codex's Windows refusal is deliberate and settled elsewhere, so it stays a client-side
+    // answer. Claude's is measured by the executing host at create time (agentSession.createSupport)
+    // because only that host knows whether it can read a provider child's start time.
+    (input.agent !== 'codex' || input.platform !== 'win32') &&
     !runtimeRefused &&
     input.hostCapabilities.includes(STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY)
 
diff --git a/src/renderer/src/lib/launch-agent-background-session-remote.test.ts b/src/renderer/src/lib/launch-agent-background-session-remote.test.ts
index 6cf8e9b717d..938534f5729 100644
--- a/src/renderer/src/lib/launch-agent-background-session-remote.test.ts
+++ b/src/renderer/src/lib/launch-agent-background-session-remote.test.ts
@@ -219,6 +219,54 @@ describe('launchAgentBackgroundSession remote runtime and SSH startup delivery',
     }
   })
 
+  // #18767: a plain Codex launch carries no shell-ready hint, but the remote host
+  // still arms the marker for it, so writing early would display the launch twice.
+  it('waits for shell-ready for a promptless SSH background Codex launch', async () => {
+    vi.useFakeTimers()
+    try {
+      state.repos = [{ id: 'repo-1', connectionId: 'ssh-1', path: '/repo' }]
+      const { launchAgentBackgroundSession } = await import('./launch-agent-background-session')
+
+      await launchAgentBackgroundSession({ agent: 'codex', worktreeId: 'wt-1' })
+      const dataSidecar = mockSubscribeToPtyData.mock.calls[0]?.[1] as (data: string) => void
+      dataSidecar('user@remote repo % ')
+      vi.advanceTimersByTime(1_400)
+
+      expect(mockWrite).not.toHaveBeenCalled()
+
+      dataSidecar('\x1b]777;orca-shell-ready\x07user@remote repo % ')
+      vi.advanceTimersByTime(50)
+
+      expect(mockWrite).toHaveBeenCalledWith(
+        'pty-1',
+        "codex '--dangerously-bypass-approvals-and-sandbox'\r"
+      )
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('skips the shell-ready wait when the host reports it did not arm the marker', async () => {
+    vi.useFakeTimers()
+    try {
+      state.repos = [{ id: 'repo-1', connectionId: 'ssh-1', path: '/repo' }]
+      mockSpawn.mockResolvedValue({ id: 'pty-1', shellReadyArmed: false })
+      const { launchAgentBackgroundSession } = await import('./launch-agent-background-session')
+
+      await launchAgentBackgroundSession({ agent: 'codex', worktreeId: 'wt-1' })
+      const dataSidecar = mockSubscribeToPtyData.mock.calls[0]?.[1] as (data: string) => void
+      dataSidecar('user@remote repo % ')
+      vi.advanceTimersByTime(50)
+
+      expect(mockWrite).toHaveBeenCalledWith(
+        'pty-1',
+        "codex '--dangerously-bypass-approvals-and-sandbox'\r"
+      )
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
   it('falls back when an SSH shell produces no observable startup data', async () => {
     vi.useFakeTimers()
     try {
diff --git a/src/renderer/src/lib/launch-agent-background-session.ts b/src/renderer/src/lib/launch-agent-background-session.ts
index 6bc6c65e420..9ef4bcfae4a 100644
--- a/src/renderer/src/lib/launch-agent-background-session.ts
+++ b/src/renderer/src/lib/launch-agent-background-session.ts
@@ -28,8 +28,10 @@ import {
   subscribeToRuntimeTerminalData,
   toRemoteRuntimePtyId
 } from '@/runtime/runtime-terminal-stream'
-import { createSshBackgroundStartupDelivery } from '@/lib/ssh-background-startup-delivery'
-import { shouldUseShellReadyStartupDelivery } from '../../../shared/codex-startup-delivery'
+import {
+  createSshBackgroundStartupDelivery,
+  sshBackgroundLaunchWaitsForShellReady
+} from '@/lib/ssh-background-startup-delivery'
 import { isMainTerminalSideEffectAuthorityForPty } from '@/components/terminal-pane/terminal-side-effect-facts-handler'
 import { resolveLocalWindowsAgentStartupShell } from '../../../shared/windows-terminal-shell'
 import { runBestEffortAgentBackgroundCleanups } from '@/lib/agent-background-session-cleanup'
@@ -115,11 +117,7 @@ export async function launchAgentBackgroundSession(
   const sshStartupDelivery = createSshBackgroundStartupDelivery({
     command: sshConnectionId ? startupPlan.launchCommand : null,
     waitForShellReady:
-      Boolean(sshConnectionId) &&
-      shouldUseShellReadyStartupDelivery({
-        command: startupPlan.launchCommand,
-        startupCommandDelivery: startupPlan.startupCommandDelivery
-      }),
+      Boolean(sshConnectionId) && sshBackgroundLaunchWaitsForShellReady(startupPlan),
     write: (ptyId, data) => window.api.pty.write(ptyId, data)
   })
   // Route by the worktree's owner host, not the focused runtime.
@@ -223,6 +221,7 @@ export async function launchAgentBackgroundSession(
       })
       ptyId = result.id
       spawned = result
+      sshStartupDelivery.applyHostShellReadyArmed(result.shellReadyArmed)
     }
     const adopted = await adoptAgentBackgroundSessionTab({
       store,
diff --git a/src/renderer/src/lib/launch-agent-in-new-tab.ts b/src/renderer/src/lib/launch-agent-in-new-tab.ts
index 5259a054bfe..118fcdbeda8 100644
--- a/src/renderer/src/lib/launch-agent-in-new-tab.ts
+++ b/src/renderer/src/lib/launch-agent-in-new-tab.ts
@@ -31,7 +31,8 @@ import type { LaunchSource } from '../../../shared/telemetry-events'
 import { getConnectionIdFromState } from '@/lib/connection-context'
 import { resolveInitialNativeChatSessionOptions } from '@/components/native-chat/native-chat-launch-session-options'
 import { seedNativeChatAppliedSessionOptions } from '@/components/native-chat/native-chat-session-option-cache'
-import { startStructuredCodexLaunch } from '@/lib/structured-agent-session-launch'
+import { startStructuredAgentLaunch } from '@/lib/structured-agent-session-launch'
+import { isAgentSessionHandleProvider } from '../../../shared/agent-session-provider-handle'
 import {
   hasExplicitTuiLaunchCustomization,
   hasExplicitTuiAgentArgs,
@@ -226,8 +227,8 @@ function launchAgentInNewTabInternal(
           hasExplicitTuiLaunchCustomization(store.settings, agent),
         initialSessionOptions: startupPlan.sessionOptions
       })
-  if (launchRoute === 'structured-native-chat' && agent === 'codex') {
-    const structuredLaunch = startStructuredCodexLaunch(worktreeId, {
+  if (launchRoute === 'structured-native-chat' && isAgentSessionHandleProvider(agent)) {
+    const structuredLaunch = startStructuredAgentLaunch(worktreeId, agent, {
       prompt: trimmedPrompt,
       ...(promptDelivery === 'submit-after-ready' ? { promptDelivery } : {}),
       onPromptDelivered
diff --git a/src/renderer/src/lib/launch-agent-structured-chat-guard.test.ts b/src/renderer/src/lib/launch-agent-structured-chat-guard.test.ts
index 35fdcc1d261..5753651c051 100644
--- a/src/renderer/src/lib/launch-agent-structured-chat-guard.test.ts
+++ b/src/renderer/src/lib/launch-agent-structured-chat-guard.test.ts
@@ -13,6 +13,8 @@ const mockLaunchStructuredCodexSession = vi.fn()
 const mockRefreshLocalStructuredSessionTabs = vi.fn()
 const mockToastError = vi.fn()
 const mockCallStructuredAgentSession = vi.fn()
+const STRUCTURED_HOST_CAPABILITIES = ['agent-session.structured.v1']
+let hostCapabilities: readonly string[] = STRUCTURED_HOST_CAPABILITIES
 
 function structuredLaunchIntent(worktreeId: string, sessionId = 'codex-session-1') {
   return {
@@ -91,12 +93,12 @@ vi.mock('@/runtime/web-runtime-session', () => ({
   isWebRuntimeSessionActive: vi.fn(() => false),
   isWebTerminalSurfaceTabId: vi.fn(() => false)
 }))
-vi.mock('@/lib/launch-structured-codex-session', () => {
+vi.mock('@/lib/launch-structured-agent-session', () => {
   class StructuredAgentSessionCreateRefusalError extends Error {}
   return {
-    createStructuredCodexSessionLaunchIntent: mockCreateStructuredCodexSessionLaunchIntent,
+    createStructuredAgentSessionLaunchIntent: mockCreateStructuredCodexSessionLaunchIntent,
     abandonStructuredAgentSessionLaunchIntent: mockAbandonStructuredAgentSessionLaunchIntent,
-    launchStructuredCodexSession: mockLaunchStructuredCodexSession,
+    launchStructuredAgentSession: mockLaunchStructuredCodexSession,
     StructuredAgentSessionCreateRefusalError
   }
 })
@@ -105,7 +107,7 @@ vi.mock('@/runtime/local-structured-session-tabs-sync', () => ({
   LOCAL_STRUCTURED_SESSION_OWNER: 'local-structured-session'
 }))
 vi.mock('@/runtime/local-runtime-capabilities', () => ({
-  readLocalRuntimeCapabilities: () => ['agent-session.structured.v1']
+  readLocalRuntimeCapabilities: () => hostCapabilities
 }))
 vi.mock('@/lib/worktree-runtime-owner', () => ({
   getExecutionHostIdForWorktree: () =>
@@ -149,6 +151,7 @@ describe('structured chat adoption guard on the launch path', () => {
       }
     ])
     mockToastError.mockReset()
+    hostCapabilities = STRUCTURED_HOST_CAPABILITIES
     store.settings.openAgentTabsInChatByDefault = true
   })
 
@@ -164,7 +167,7 @@ describe('structured chat adoption guard on the launch path', () => {
       focusAfterMenuClose: 'structured-session'
     })
     expect(shouldQueueTerminalFocusAfterMenuClose(result!)).toBe(false)
-    expect(mockCreateStructuredCodexSessionLaunchIntent).toHaveBeenCalledWith('wt-1')
+    expect(mockCreateStructuredCodexSessionLaunchIntent).toHaveBeenCalledWith('wt-1', 'codex')
     expect(mockLaunchStructuredCodexSession).toHaveBeenCalledWith(
       expect.objectContaining({ worktreeId: 'wt-1' })
     )
@@ -172,6 +175,51 @@ describe('structured chat adoption guard on the launch path', () => {
     expect(mockWaitForAgentReady).not.toHaveBeenCalled()
   })
 
+  it('takes the structured path for Claude, naming Claude as the create provider', async () => {
+    const { launchAgentInNewTab } = await import('./launch-agent-in-new-tab')
+
+    const result = launchAgentInNewTab({ agent: 'claude', worktreeId: 'wt-1' })
+
+    expect(result).toMatchObject({ tabId: null, focusAfterMenuClose: 'structured-session' })
+    expect(mockCreateStructuredCodexSessionLaunchIntent).toHaveBeenCalledWith('wt-1', 'claude')
+    expect(mockCreateTab).not.toHaveBeenCalled()
+  })
+
+  it('keeps a native-chat agent with no structured adapter on the terminal-backed path', async () => {
+    const { launchAgentInNewTab } = await import('./launch-agent-in-new-tab')
+
+    launchAgentInNewTab({ agent: 'openclaude', worktreeId: 'wt-1' })
+
+    expect(mockCreateStructuredCodexSessionLaunchIntent).not.toHaveBeenCalled()
+    expect(mockCreateTab).toHaveBeenCalled()
+  })
+
+  it('fails a Claude launch closed to the terminal when the host declines create support', async () => {
+    const { StructuredAgentSessionCreateRefusalError } =
+      await import('./launch-structured-agent-session')
+    mockLaunchStructuredCodexSession.mockRejectedValueOnce(
+      new StructuredAgentSessionCreateRefusalError('structured_agent_session_unsupported')
+    )
+    const { launchAgentInNewTab } = await import('./launch-agent-in-new-tab')
+
+    const result = launchAgentInNewTab({ agent: 'claude', worktreeId: 'wt-1' })
+
+    expect(result).toMatchObject({ tabId: null })
+    await vi.waitFor(() => expect(mockCreateTab).toHaveBeenCalledOnce())
+    expect(mockToastError).not.toHaveBeenCalled()
+  })
+
+  it('routes every structured launch through the shared host capability gate', async () => {
+    hostCapabilities = []
+    const { launchAgentInNewTab } = await import('./launch-agent-in-new-tab')
+
+    launchAgentInNewTab({ agent: 'claude', worktreeId: 'wt-1' })
+    launchAgentInNewTab({ agent: 'codex', worktreeId: 'wt-1' })
+
+    expect(mockCreateStructuredCodexSessionLaunchIntent).not.toHaveBeenCalled()
+    expect(mockCreateTab).toHaveBeenCalledTimes(2)
+  })
+
   /** The toggle is hidden under Terminal chat but its persisted value survives, so the launch
    *  path must re-check the default view rather than trust a stale opt-in. */
   it('ignores a stale structured opt-in while the default view is Terminal chat', async () => {
@@ -192,7 +240,7 @@ describe('structured chat adoption guard on the launch path', () => {
 
   it('falls back to the preserved terminal launch on a definitive refusal', async () => {
     const { StructuredAgentSessionCreateRefusalError } =
-      await import('./launch-structured-codex-session')
+      await import('./launch-structured-agent-session')
     mockLaunchStructuredCodexSession.mockRejectedValueOnce(
       new StructuredAgentSessionCreateRefusalError('provider unavailable')
     )
@@ -207,7 +255,7 @@ describe('structured chat adoption guard on the launch path', () => {
 
   it('reports prompt delivery from the definitive-refusal terminal fallback', async () => {
     const { StructuredAgentSessionCreateRefusalError } =
-      await import('./launch-structured-codex-session')
+      await import('./launch-structured-agent-session')
     mockLaunchStructuredCodexSession.mockRejectedValueOnce(
       new StructuredAgentSessionCreateRefusalError('provider unavailable')
     )
diff --git a/src/renderer/src/lib/launch-structured-agent-session.test.ts b/src/renderer/src/lib/launch-structured-agent-session.test.ts
new file mode 100644
index 00000000000..d9a75ee2827
--- /dev/null
+++ b/src/renderer/src/lib/launch-structured-agent-session.test.ts
@@ -0,0 +1,329 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { structuredAgentSessionPayloadFingerprint } from '../../../shared/structured-agent-session-mutation'
+import { callStructuredAgentSession } from '@/runtime/structured-agent-session-client'
+import {
+  createStructuredAgentSessionLaunchIntent,
+  isDefinitiveStructuredAgentSessionCreateError,
+  launchStructuredAgentSession,
+  StructuredAgentSessionCreateRefusalError,
+  StructuredAgentSessionCreateUnknownOutcomeError
+} from './launch-structured-agent-session'
+
+vi.mock('@/runtime/structured-agent-session-client', () => ({
+  callStructuredAgentSession: vi.fn()
+}))
+
+describe('structured agent session launch', () => {
+  beforeEach(() => {
+    vi.mocked(callStructuredAgentSession).mockReset()
+  })
+
+  it('creates a native session with a host-verifiable launch intent', async () => {
+    vi.mocked(callStructuredAgentSession).mockImplementation(async (_target, _method, params) => ({
+      ok: true,
+      replayed: false,
+      fence: 1,
+      cursor: { epoch: 'epoch-1', sequence: 0 },
+      value: {
+        sessionId: (params as { envelope: { sessionId: string } }).envelope.sessionId,
+        fence: 1,
+        page: {
+          sessionId: 'session-1',
+          epoch: 'epoch-1',
+          direction: 'tail',
+          items: [],
+          removedItemIds: [],
+          submissions: [],
+          window: {
+            oldest: null,
+            newest: null,
+            nextCursor: { epoch: 'epoch-1', sequence: 0 }
+          },
+          liveCursor: { epoch: 'epoch-1', sequence: 0 },
+          hasOlder: false,
+          hasNewer: false
+        },
+        unconfirmedClientMessageIds: []
+      }
+    }))
+
+    const intent = createStructuredAgentSessionLaunchIntent('workspace-1', 'codex')
+    const receipt = await launchStructuredAgentSession(intent)
+    const params = vi.mocked(callStructuredAgentSession).mock.calls[0]?.[2] as {
+      envelope: { sessionId: string; payloadFingerprint: string }
+      worktree: string
+      agent: 'codex'
+    }
+
+    expect(receipt).toEqual({
+      sessionId: expect.stringMatching(/^codex_[A-Za-z0-9_]{36}$/),
+      fence: 1
+    })
+    expect(callStructuredAgentSession).toHaveBeenCalledWith(
+      { kind: 'local' },
+      'agentSession.create',
+      expect.objectContaining({ worktree: 'id:workspace-1', agent: 'codex' })
+    )
+    expect(params.envelope.payloadFingerprint).toBe(
+      structuredAgentSessionPayloadFingerprint({
+        method: 'agentSession.create',
+        sessionId: params.envelope.sessionId,
+        fields: { worktree: 'id:workspace-1', agent: 'codex' }
+      })
+    )
+    expect(params).toBe(intent.params)
+  })
+
+  it('names Claude as the create provider and in the session id', () => {
+    const intent = createStructuredAgentSessionLaunchIntent('workspace-1', 'claude')
+    expect(intent.sessionId).toMatch(/^claude_[A-Za-z0-9_]{36}$/)
+    expect(intent.params.agent).toBe('claude')
+    expect(intent.params.envelope.payloadFingerprint).toBe(
+      structuredAgentSessionPayloadFingerprint({
+        method: 'agentSession.create',
+        sessionId: intent.sessionId,
+        fields: { worktree: 'id:workspace-1', agent: 'claude' }
+      })
+    )
+  })
+
+  it('asks the executing host for create support before creating a Claude session', async () => {
+    vi.mocked(callStructuredAgentSession).mockImplementation(async (_target, method) =>
+      method === 'agentSession.createSupport'
+        ? { supported: true }
+        : { ok: true, replayed: false, value: { sessionId: 'claude_1', fence: 1 } }
+    )
+
+    const intent = createStructuredAgentSessionLaunchIntent('workspace-1', 'claude')
+    await launchStructuredAgentSession(intent)
+
+    expect(vi.mocked(callStructuredAgentSession).mock.calls.map(([, method]) => method)).toEqual([
+      'agentSession.createSupport',
+      'agentSession.create'
+    ])
+    expect(callStructuredAgentSession).toHaveBeenNthCalledWith(
+      1,
+      { kind: 'local' },
+      'agentSession.createSupport',
+      { worktree: 'id:workspace-1', agent: 'claude' }
+    )
+  })
+
+  it('refuses a Claude launch the host says it cannot support, without creating', async () => {
+    vi.mocked(callStructuredAgentSession).mockResolvedValue({ supported: false, reason: 'agent' })
+
+    const intent = createStructuredAgentSessionLaunchIntent('workspace-1', 'claude')
+
+    await expect(launchStructuredAgentSession(intent)).rejects.toBeInstanceOf(
+      StructuredAgentSessionCreateRefusalError
+    )
+    expect(vi.mocked(callStructuredAgentSession).mock.calls.map(([, method]) => method)).toEqual([
+      'agentSession.createSupport'
+    ])
+  })
+
+  it('fails closed when the create support probe cannot be answered', async () => {
+    vi.mocked(callStructuredAgentSession).mockRejectedValue(new Error('runtime unreachable'))
+
+    const intent = createStructuredAgentSessionLaunchIntent('workspace-1', 'claude')
+
+    await expect(launchStructuredAgentSession(intent)).rejects.toBeInstanceOf(
+      StructuredAgentSessionCreateRefusalError
+    )
+    expect(callStructuredAgentSession).toHaveBeenCalledOnce()
+  })
+
+  /** A worktree is not resolvable for a beat after createWorktree resolves, so the probe fails with
+   *  selector_not_found instead of answering. That is "not ready", not "no". */
+  it('retries a probe the host cannot answer yet, then creates', async () => {
+    const notResolvableYet = Object.assign(new Error('selector_not_found'), {
+      code: 'selector_not_found'
+    })
+    vi.mocked(callStructuredAgentSession)
+      .mockRejectedValueOnce(notResolvableYet)
+      .mockRejectedValueOnce(notResolvableYet)
+      .mockImplementation(async (_target, method) =>
+        method === 'agentSession.createSupport'
+          ? { supported: true }
+          : { ok: true, replayed: false, value: { sessionId: 'claude_1', fence: 1 } }
+      )
+
+    const intent = createStructuredAgentSessionLaunchIntent('workspace-1', 'claude')
+    await expect(launchStructuredAgentSession(intent)).resolves.toMatchObject({
+      sessionId: 'claude_1'
+    })
+    expect(vi.mocked(callStructuredAgentSession).mock.calls.map(([, method]) => method)).toEqual([
+      'agentSession.createSupport',
+      'agentSession.createSupport',
+      'agentSession.createSupport',
+      'agentSession.create'
+    ])
+  })
+
+  it('refuses once the retry budget for an unresolvable selector is spent', async () => {
+    vi.mocked(callStructuredAgentSession).mockRejectedValue(
+      Object.assign(new Error('selector_not_found'), { code: 'selector_not_found' })
+    )
+
+    const intent = createStructuredAgentSessionLaunchIntent('workspace-1', 'claude')
+
+    await expect(launchStructuredAgentSession(intent)).rejects.toBeInstanceOf(
+      StructuredAgentSessionCreateRefusalError
+    )
+    // Bounded: the first ask plus the retry delays, and never agentSession.create.
+    expect(vi.mocked(callStructuredAgentSession).mock.calls.map(([, method]) => method)).toEqual([
+      'agentSession.createSupport',
+      'agentSession.createSupport',
+      'agentSession.createSupport',
+      'agentSession.createSupport'
+    ])
+  })
+
+  it('does not retry a host that answered no, or an unrelated failure', async () => {
+    vi.mocked(callStructuredAgentSession).mockResolvedValue({ supported: false, reason: 'wsl' })
+    await expect(
+      launchStructuredAgentSession(
+        createStructuredAgentSessionLaunchIntent('workspace-1', 'claude')
+      )
+    ).rejects.toBeInstanceOf(StructuredAgentSessionCreateRefusalError)
+    expect(callStructuredAgentSession).toHaveBeenCalledOnce()
+
+    vi.mocked(callStructuredAgentSession).mockReset()
+    vi.mocked(callStructuredAgentSession).mockRejectedValue(new Error('runtime unreachable'))
+    await expect(
+      launchStructuredAgentSession(
+        createStructuredAgentSessionLaunchIntent('workspace-1', 'claude')
+      )
+    ).rejects.toBeInstanceOf(StructuredAgentSessionCreateRefusalError)
+    expect(callStructuredAgentSession).toHaveBeenCalledOnce()
+  })
+
+  /** A message-wrapped token must not be confused with prose that merely mentions it. */
+  it('does not retry a failure that only mentions the token in passing', async () => {
+    vi.mocked(callStructuredAgentSession).mockRejectedValue(
+      new Error('Access denied after a prior selector_not_found')
+    )
+
+    await expect(
+      launchStructuredAgentSession(
+        createStructuredAgentSessionLaunchIntent('workspace-1', 'claude')
+      )
+    ).rejects.toBeInstanceOf(StructuredAgentSessionCreateRefusalError)
+    expect(callStructuredAgentSession).toHaveBeenCalledOnce()
+  })
+
+  /** Codex's support answer is settled by the launch route and owned elsewhere; this pins that the
+   *  Claude probe did not change Codex's wire traffic. */
+  it('does not probe create support for Codex', async () => {
+    vi.mocked(callStructuredAgentSession).mockResolvedValue({
+      ok: true,
+      replayed: false,
+      value: { sessionId: 'codex_1', fence: 1 }
+    })
+
+    await launchStructuredAgentSession(
+      createStructuredAgentSessionLaunchIntent('workspace-1', 'codex')
+    )
+
+    expect(vi.mocked(callStructuredAgentSession).mock.calls.map(([, method]) => method)).toEqual([
+      'agentSession.create'
+    ])
+  })
+
+  it('replays the exact create envelope when an unknown outcome is retried', async () => {
+    const intent = createStructuredAgentSessionLaunchIntent('workspace-retry', 'codex')
+    vi.mocked(callStructuredAgentSession).mockRejectedValue(new Error('response lost'))
+
+    await expect(launchStructuredAgentSession(intent)).rejects.toThrow('response lost')
+    await expect(launchStructuredAgentSession(intent)).rejects.toThrow('response lost')
+
+    const first = vi.mocked(callStructuredAgentSession).mock.calls[0]?.[2]
+    const second = vi.mocked(callStructuredAgentSession).mock.calls[1]?.[2]
+    expect(first).toBe(intent.params)
+    expect(second).toBe(first)
+    expect(intent.params.envelope.clientOperationId).toMatch(/^\d{13}-[0-9a-f]{32}$/)
+  })
+
+  it('preserves an unknown refusal code without classifying it as fallback-safe', async () => {
+    vi.mocked(callStructuredAgentSession).mockResolvedValue({
+      ok: false,
+      refusal: {
+        code: 'agent_session_operation_unknown',
+        message: 'The chat may already exist.'
+      }
+    })
+
+    const error = await launchStructuredAgentSession(
+      createStructuredAgentSessionLaunchIntent('workspace-unknown', 'codex')
+    ).catch((caught: unknown) => caught)
+
+    expect(error).toBeInstanceOf(StructuredAgentSessionCreateUnknownOutcomeError)
+    expect(error).not.toBeInstanceOf(StructuredAgentSessionCreateRefusalError)
+    expect(error).toMatchObject({ code: 'agent_session_operation_unknown' })
+    expect(isDefinitiveStructuredAgentSessionCreateError(error)).toBe(false)
+  })
+
+  /** The class is the verdict, so a refusal message that happens to end in a definitive token
+   *  must not be re-read into one by the transport-error matcher. */
+  it('keeps an unknown outcome unknown even when its message ends in a definitive token', async () => {
+    vi.mocked(callStructuredAgentSession).mockResolvedValue({
+      ok: false,
+      refusal: {
+        code: 'agent_session_ownership_unknown',
+        message: 'Owner check failed: method_not_found'
+      }
+    })
+
+    const error = await launchStructuredAgentSession(
+      createStructuredAgentSessionLaunchIntent('workspace-unknown-token', 'codex')
+    ).catch((caught: unknown) => caught)
+
+    expect(error).toBeInstanceOf(StructuredAgentSessionCreateUnknownOutcomeError)
+    expect(isDefinitiveStructuredAgentSessionCreateError(error)).toBe(false)
+  })
+
+  it('preserves a definitive refusal code for the fallback path', async () => {
+    vi.mocked(callStructuredAgentSession).mockResolvedValue({
+      ok: false,
+      refusal: {
+        code: 'structured_agent_session_unsupported',
+        message: 'Structured chat is unavailable.'
+      }
+    })
+
+    const error = await launchStructuredAgentSession(
+      createStructuredAgentSessionLaunchIntent('workspace-unsupported', 'codex')
+    ).catch((caught: unknown) => caught)
+
+    expect(error).toBeInstanceOf(StructuredAgentSessionCreateRefusalError)
+    expect(error).toMatchObject({ code: 'structured_agent_session_unsupported' })
+    expect(isDefinitiveStructuredAgentSessionCreateError(error)).toBe(true)
+  })
+
+  it.each(['method_not_found', 'structured_agent_session_unsupported'])(
+    'turns an old-host %s error into a definitive transport refusal',
+    async (code) => {
+      vi.mocked(callStructuredAgentSession).mockRejectedValueOnce(
+        Object.assign(new Error(code), { code })
+      )
+      const oldHostError = await launchStructuredAgentSession(
+        createStructuredAgentSessionLaunchIntent(`workspace-old-host-${code}`, 'codex')
+      ).catch((caught: unknown) => caught)
+
+      expect(oldHostError).toBeInstanceOf(StructuredAgentSessionCreateRefusalError)
+      expect(oldHostError).toMatchObject({ code })
+    }
+  )
+
+  it('keeps an unclassified transport failure outcome unknown', async () => {
+    vi.mocked(callStructuredAgentSession).mockRejectedValueOnce(
+      Object.assign(new Error('Connection lost'), { code: 'runtime_error' })
+    )
+    const transportError = await launchStructuredAgentSession(
+      createStructuredAgentSessionLaunchIntent('workspace-offline', 'codex')
+    ).catch((caught: unknown) => caught)
+
+    expect(transportError).not.toBeInstanceOf(StructuredAgentSessionCreateRefusalError)
+    expect(isDefinitiveStructuredAgentSessionCreateError(transportError)).toBe(false)
+  })
+})
diff --git a/src/renderer/src/lib/launch-structured-agent-session.ts b/src/renderer/src/lib/launch-structured-agent-session.ts
new file mode 100644
index 00000000000..3d7f94a1135
--- /dev/null
+++ b/src/renderer/src/lib/launch-structured-agent-session.ts
@@ -0,0 +1,240 @@
+import type { AgentSessionHandleProvider } from '../../../shared/agent-session-provider-handle'
+import type {
+  AgentSessionAttachResult,
+  AgentSessionMutationEnvelope,
+  AgentSessionMutationResult
+} from '../../../shared/agent-session-wire'
+import {
+  createStructuredAgentSessionOperationId,
+  structuredAgentSessionPayloadFingerprint
+} from '../../../shared/structured-agent-session-mutation'
+import { hasRuntimeRpcErrorCode } from '../../../shared/runtime-rpc-error-code'
+import { isDefinitiveAgentSessionCreateRefusal } from '../../../shared/agent-session-definitive-refusal'
+import { callStructuredAgentSession } from '@/runtime/structured-agent-session-client'
+import { toRuntimeWorktreeSelector } from '@/runtime/runtime-worktree-selector'
+import { useAppStore } from '@/store'
+import {
+  clearWebSessionFocusIntentIfMatches,
+  recordWebSessionFocusIntent,
+  resolveWebSessionVisibleTabId
+} from '@/runtime/web-session-focus-intent'
+import { LOCAL_STRUCTURED_SESSION_OWNER } from '@/runtime/local-structured-session-tabs-sync'
+
+type StructuredAgentSessionCreateParams = {
+  envelope: AgentSessionMutationEnvelope
+  worktree: string
+  agent: AgentSessionHandleProvider
+}
+
+export type StructuredAgentSessionLaunchIntent = {
+  sessionId: string
+  worktreeId: string
+  agent: AgentSessionHandleProvider
+  params: StructuredAgentSessionCreateParams
+}
+
+class StructuredAgentSessionCreateError extends Error {
+  constructor(
+    message: string,
+    /** The wire refusal code, or the RPC error code when the create never reached a handler. */
+    readonly code: string
+  ) {
+    super(message)
+  }
+}
+
+/**
+ * The host proved it created nothing, so a caller may open a legacy terminal instead. The class
+ * itself is the verdict: `launchStructuredAgentSession` is the only place that decides it, against
+ * the shared allowlist, so no consumer has to remember to re-check a code.
+ */
+export class StructuredAgentSessionCreateRefusalError extends StructuredAgentSessionCreateError {
+  constructor(message: string, code: string = 'structured_agent_session_unsupported') {
+    super(message, code)
+    this.name = 'StructuredAgentSessionCreateRefusalError'
+  }
+}
+
+/**
+ * Refused with a code that does not prove the session is absent. A sibling opened here would sit
+ * beside a session the host may already hold, so this deliberately is NOT a refusal error: it flows
+ * down the same path as a lost reply, which replays the intent and reconciles.
+ */
+export class StructuredAgentSessionCreateUnknownOutcomeError extends StructuredAgentSessionCreateError {
+  constructor(message: string, code: string) {
+    super(message, code)
+    this.name = 'StructuredAgentSessionCreateUnknownOutcomeError'
+  }
+}
+
+const DEFINITIVE_CREATE_FAILURE_CODES = [
+  'structured_agent_session_unsupported',
+  'method_not_found'
+] as const
+
+function definitiveStructuredAgentSessionCreateErrorCode(error: unknown): string | null {
+  if (error instanceof StructuredAgentSessionCreateError) {
+    // Our own classes already carry the verdict; message sniffing below could only invert it.
+    return error instanceof StructuredAgentSessionCreateRefusalError &&
+      isDefinitiveAgentSessionCreateRefusal(error.code)
+      ? error.code
+      : null
+  }
+  for (const code of DEFINITIVE_CREATE_FAILURE_CODES) {
+    if (hasRuntimeRpcErrorCode(error, code)) {
+      return code
+    }
+  }
+  return null
+}
+
+export function isDefinitiveStructuredAgentSessionCreateError(error: unknown): boolean {
+  return definitiveStructuredAgentSessionCreateErrorCode(error) !== null
+}
+
+export function createStructuredAgentSessionLaunchIntent(
+  worktreeId: string,
+  agent: AgentSessionHandleProvider
+): StructuredAgentSessionLaunchIntent {
+  const sessionId = `${agent}_${crypto.randomUUID().replaceAll('-', '_')}`
+  const fields = { worktree: toRuntimeWorktreeSelector(worktreeId), agent }
+  const state = useAppStore.getState()
+  recordWebSessionFocusIntent(
+    { environmentId: LOCAL_STRUCTURED_SESSION_OWNER },
+    worktreeId,
+    `agent-session:${sessionId}`,
+    undefined,
+    resolveWebSessionVisibleTabId(state, worktreeId)
+  )
+  return {
+    sessionId,
+    worktreeId,
+    agent,
+    params: {
+      envelope: {
+        sessionId,
+        clientOperationId: createStructuredAgentSessionOperationId(() => crypto.randomUUID()),
+        expectedRuntimeFence: null,
+        payloadFingerprint: structuredAgentSessionPayloadFingerprint({
+          method: 'agentSession.create',
+          sessionId,
+          fields
+        })
+      },
+      ...fields
+    }
+  }
+}
+
+export function abandonStructuredAgentSessionLaunchIntent(
+  intent: StructuredAgentSessionLaunchIntent
+): void {
+  clearWebSessionFocusIntentIfMatches(
+    { environmentId: LOCAL_STRUCTURED_SESSION_OWNER },
+    intent.worktreeId,
+    `agent-session:${intent.sessionId}`
+  )
+}
+
+/** The host answers a worktree selector it cannot resolve yet with this rather than a verdict. */
+const SELECTOR_NOT_RESOLVABLE_CODE = 'selector_not_found'
+
+/**
+ * A worktree is not resolvable for a beat after `createWorktree` resolves, so a probe fired
+ * immediately after creation fails instead of answering. Measured window: under ~250ms. These
+ * delays cover it with margin and bound the wait when the selector is genuinely absent.
+ */
+const CREATE_SUPPORT_RETRY_DELAYS_MS: readonly number[] = [50, 150, 300]
+
+function delay(ms: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms))
+}
+
+/**
+ * Whether the executing host supports creating this session — retrying only while the host cannot
+ * yet resolve the worktree.
+ *
+ * "Could not answer" and "answered no" are different states and only the second is a verdict.
+ * Collapsing them sends a launch to the terminal because a selector was a beat late, which is
+ * indistinguishable to the user from the gate refusing them. The retry is narrowed to that one
+ * transient code so every other failure still refuses on the first ask.
+ */
+async function hostSupportsCreate(intent: StructuredAgentSessionLaunchIntent): Promise<boolean> {
+  for (let attempt = 0; ; attempt += 1) {
+    try {
+      const support = await callStructuredAgentSession<{ supported: boolean; reason?: string }>(
+        { kind: 'local' },
+        'agentSession.createSupport',
+        { worktree: intent.params.worktree, agent: intent.agent }
+      )
+      return support.supported === true
+    } catch (error) {
+      const retryDelayMs = CREATE_SUPPORT_RETRY_DELAYS_MS[attempt]
+      if (
+        retryDelayMs === undefined ||
+        !hasRuntimeRpcErrorCode(error, SELECTOR_NOT_RESOLVABLE_CODE)
+      ) {
+        // An unanswered probe is still not a yes.
+        return false
+      }
+      await delay(retryDelayMs)
+    }
+  }
+}
+
+/**
+ * Only the host that will execute the session can answer whether it supports creating one there —
+ * on Windows that means reading the provider child's process start time, which a client cannot
+ * observe.
+ *
+ * Codex is absent on purpose: its answer is settled by the launch route and owned elsewhere, so
+ * probing here would change Codex's wire traffic. Note that this early return is also why the
+ * unresolvable-selector race above has never been able to refuse a Codex launch — the race is
+ * identical for Codex, nothing asks. Whoever gives Codex a probe inherits it.
+ */
+async function requireHostCreateSupport(intent: StructuredAgentSessionLaunchIntent): Promise<void> {
+  if (intent.agent !== 'claude') {
+    return
+  }
+  if (!(await hostSupportsCreate(intent))) {
+    abandonStructuredAgentSessionLaunchIntent(intent)
+    throw new StructuredAgentSessionCreateRefusalError(
+      'structured_agent_session_unsupported',
+      'structured_agent_session_unsupported'
+    )
+  }
+}
+
+export async function launchStructuredAgentSession(
+  intent: StructuredAgentSessionLaunchIntent
+): Promise<Pick<AgentSessionAttachResult, 'sessionId' | 'fence'>> {
+  await requireHostCreateSupport(intent)
+  let result: AgentSessionMutationResult<AgentSessionAttachResult>
+  try {
+    result = await callStructuredAgentSession<AgentSessionMutationResult<AgentSessionAttachResult>>(
+      { kind: 'local' },
+      'agentSession.create',
+      intent.params
+    )
+  } catch (error) {
+    const code = definitiveStructuredAgentSessionCreateErrorCode(error)
+    if (code) {
+      abandonStructuredAgentSessionLaunchIntent(intent)
+      throw new StructuredAgentSessionCreateRefusalError(
+        error instanceof Error ? error.message : String(error),
+        code
+      )
+    }
+    throw error
+  }
+  if (!result.ok) {
+    const { code, message } = result.refusal
+    if (!isDefinitiveAgentSessionCreateRefusal(code)) {
+      // Keep the focus intent: the session may exist, and recovery still has to adopt it.
+      throw new StructuredAgentSessionCreateUnknownOutcomeError(message, code)
+    }
+    abandonStructuredAgentSessionLaunchIntent(intent)
+    throw new StructuredAgentSessionCreateRefusalError(message, code)
+  }
+  return { sessionId: result.value.sessionId, fence: result.value.fence }
+}
diff --git a/src/renderer/src/lib/launch-structured-codex-session.test.ts b/src/renderer/src/lib/launch-structured-codex-session.test.ts
deleted file mode 100644
index ea498c81719..00000000000
--- a/src/renderer/src/lib/launch-structured-codex-session.test.ts
+++ /dev/null
@@ -1,87 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from 'vitest'
-import { structuredAgentSessionPayloadFingerprint } from '../../../shared/structured-agent-session-mutation'
-import { callStructuredAgentSession } from '@/runtime/structured-agent-session-client'
-import {
-  createStructuredCodexSessionLaunchIntent,
-  launchStructuredCodexSession
-} from './launch-structured-codex-session'
-
-vi.mock('@/runtime/structured-agent-session-client', () => ({
-  callStructuredAgentSession: vi.fn()
-}))
-
-describe('structured Codex launch', () => {
-  beforeEach(() => {
-    vi.mocked(callStructuredAgentSession).mockReset()
-  })
-
-  it('creates a native session with a host-verifiable launch intent', async () => {
-    vi.mocked(callStructuredAgentSession).mockImplementation(async (_target, _method, params) => ({
-      ok: true,
-      replayed: false,
-      fence: 1,
-      cursor: { epoch: 'epoch-1', sequence: 0 },
-      value: {
-        sessionId: (params as { envelope: { sessionId: string } }).envelope.sessionId,
-        fence: 1,
-        page: {
-          sessionId: 'session-1',
-          epoch: 'epoch-1',
-          direction: 'tail',
-          items: [],
-          removedItemIds: [],
-          submissions: [],
-          window: {
-            oldest: null,
-            newest: null,
-            nextCursor: { epoch: 'epoch-1', sequence: 0 }
-          },
-          liveCursor: { epoch: 'epoch-1', sequence: 0 },
-          hasOlder: false,
-          hasNewer: false
-        },
-        unconfirmedClientMessageIds: []
-      }
-    }))
-
-    const intent = createStructuredCodexSessionLaunchIntent('workspace-1')
-    const receipt = await launchStructuredCodexSession(intent)
-    const params = vi.mocked(callStructuredAgentSession).mock.calls[0]?.[2] as {
-      envelope: { sessionId: string; payloadFingerprint: string }
-      worktree: string
-      agent: 'codex'
-    }
-
-    expect(receipt).toEqual({
-      sessionId: expect.stringMatching(/^codex_[A-Za-z0-9_]{36}$/),
-      fence: 1
-    })
-    expect(callStructuredAgentSession).toHaveBeenCalledWith(
-      { kind: 'local' },
-      'agentSession.create',
-      expect.objectContaining({ worktree: 'id:workspace-1', agent: 'codex' })
-    )
-    expect(params.envelope.payloadFingerprint).toBe(
-      structuredAgentSessionPayloadFingerprint({
-        method: 'agentSession.create',
-        sessionId: params.envelope.sessionId,
-        fields: { worktree: 'id:workspace-1', agent: 'codex' }
-      })
-    )
-    expect(params).toBe(intent.params)
-  })
-
-  it('replays the exact create envelope when an unknown outcome is retried', async () => {
-    const intent = createStructuredCodexSessionLaunchIntent('workspace-retry')
-    vi.mocked(callStructuredAgentSession).mockRejectedValue(new Error('response lost'))
-
-    await expect(launchStructuredCodexSession(intent)).rejects.toThrow('response lost')
-    await expect(launchStructuredCodexSession(intent)).rejects.toThrow('response lost')
-
-    const first = vi.mocked(callStructuredAgentSession).mock.calls[0]?.[2]
-    const second = vi.mocked(callStructuredAgentSession).mock.calls[1]?.[2]
-    expect(first).toBe(intent.params)
-    expect(second).toBe(first)
-    expect(intent.params.envelope.clientOperationId).toMatch(/^\d{13}-[0-9a-f]{32}$/)
-  })
-})
diff --git a/src/renderer/src/lib/launch-structured-codex-session.ts b/src/renderer/src/lib/launch-structured-codex-session.ts
deleted file mode 100644
index 32a3feb19b4..00000000000
--- a/src/renderer/src/lib/launch-structured-codex-session.ts
+++ /dev/null
@@ -1,87 +0,0 @@
-import type {
-  AgentSessionAttachResult,
-  AgentSessionMutationEnvelope,
-  AgentSessionMutationResult
-} from '../../../shared/agent-session-wire'
-import {
-  createStructuredAgentSessionOperationId,
-  structuredAgentSessionPayloadFingerprint
-} from '../../../shared/structured-agent-session-mutation'
-import { callStructuredAgentSession } from '@/runtime/structured-agent-session-client'
-import { toRuntimeWorktreeSelector } from '@/runtime/runtime-worktree-selector'
-import { useAppStore } from '@/store'
-import {
-  clearWebSessionFocusIntentIfMatches,
-  recordWebSessionFocusIntent,
-  resolveWebSessionVisibleTabId
-} from '@/runtime/web-session-focus-intent'
-import { LOCAL_STRUCTURED_SESSION_OWNER } from '@/runtime/local-structured-session-tabs-sync'
-
-type StructuredAgentSessionCreateParams = {
-  envelope: AgentSessionMutationEnvelope
-  worktree: string
-  agent: 'codex'
-}
-
-export type StructuredAgentSessionLaunchIntent = {
-  sessionId: string
-  worktreeId: string
-  params: StructuredAgentSessionCreateParams
-}
-
-export class StructuredAgentSessionCreateRefusalError extends Error {}
-
-export function createStructuredCodexSessionLaunchIntent(
-  worktreeId: string
-): StructuredAgentSessionLaunchIntent {
-  const sessionId = `codex_${crypto.randomUUID().replaceAll('-', '_')}`
-  const fields = { worktree: toRuntimeWorktreeSelector(worktreeId), agent: 'codex' as const }
-  const state = useAppStore.getState()
-  recordWebSessionFocusIntent(
-    { environmentId: LOCAL_STRUCTURED_SESSION_OWNER },
-    worktreeId,
-    `agent-session:${sessionId}`,
-    undefined,
-    resolveWebSessionVisibleTabId(state, worktreeId)
-  )
-  return {
-    sessionId,
-    worktreeId,
-    params: {
-      envelope: {
-        sessionId,
-        clientOperationId: createStructuredAgentSessionOperationId(() => crypto.randomUUID()),
-        expectedRuntimeFence: null,
-        payloadFingerprint: structuredAgentSessionPayloadFingerprint({
-          method: 'agentSession.create',
-          sessionId,
-          fields
-        })
-      },
-      ...fields
-    }
-  }
-}
-
-export function abandonStructuredAgentSessionLaunchIntent(
-  intent: StructuredAgentSessionLaunchIntent
-): void {
-  clearWebSessionFocusIntentIfMatches(
-    { environmentId: LOCAL_STRUCTURED_SESSION_OWNER },
-    intent.worktreeId,
-    `agent-session:${intent.sessionId}`
-  )
-}
-
-export async function launchStructuredCodexSession(
-  intent: StructuredAgentSessionLaunchIntent
-): Promise<Pick<AgentSessionAttachResult, 'sessionId' | 'fence'>> {
-  const result = await callStructuredAgentSession<
-    AgentSessionMutationResult<AgentSessionAttachResult>
-  >({ kind: 'local' }, 'agentSession.create', intent.params)
-  if (!result.ok) {
-    abandonStructuredAgentSessionLaunchIntent(intent)
-    throw new StructuredAgentSessionCreateRefusalError(result.refusal.message)
-  }
-  return { sessionId: result.value.sessionId, fence: result.value.fence }
-}
diff --git a/src/renderer/src/lib/launch-work-item-direct-agent-routing.test.ts b/src/renderer/src/lib/launch-work-item-direct-agent-routing.test.ts
index f0e9cf5b783..7d3e6522bc8 100644
--- a/src/renderer/src/lib/launch-work-item-direct-agent-routing.test.ts
+++ b/src/renderer/src/lib/launch-work-item-direct-agent-routing.test.ts
@@ -1,13 +1,13 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const mocks = vi.hoisted(() => ({
-  startStructuredCodexLaunch: vi.fn(),
+  startStructuredAgentLaunch: vi.fn(),
   activateAndRevealWorktree: vi.fn(),
   preflightAgentTrust: vi.fn()
 }))
 
 vi.mock('@/lib/structured-agent-session-launch', () => ({
-  startStructuredCodexLaunch: mocks.startStructuredCodexLaunch
+  startStructuredAgentLaunch: mocks.startStructuredAgentLaunch
 }))
 
 vi.mock('@/lib/worktree-activation', () => ({
@@ -18,7 +18,7 @@ vi.mock('@/lib/agent-trust-preflight', () => ({
   preflightAgentTrust: mocks.preflightAgentTrust
 }))
 
-vi.mock('@/lib/launch-structured-codex-session', () => ({
+vi.mock('@/lib/launch-structured-agent-session', () => ({
   StructuredAgentSessionCreateRefusalError: class extends Error {}
 }))
 
@@ -26,7 +26,7 @@ vi.mock('@/lib/native-chat-transcript-readability', () => ({
   isNativeChatTranscriptLocalReadable: vi.fn(() => true)
 }))
 
-import { StructuredAgentSessionCreateRefusalError } from '@/lib/launch-structured-codex-session'
+import { StructuredAgentSessionCreateRefusalError } from '@/lib/launch-structured-agent-session'
 import { settleDirectWorkItemStructuredLaunch } from './launch-work-item-direct-agent-routing'
 
 const baseArgs = {
@@ -47,7 +47,7 @@ describe('settleDirectWorkItemStructuredLaunch', () => {
 
   it('runs the legacy terminal fallback after a definitive refusal', async () => {
     mocks.activateAndRevealWorktree.mockReturnValue({ primaryTabId: 'fallback-tab' })
-    mocks.startStructuredCodexLaunch.mockReturnValue({
+    mocks.startStructuredAgentLaunch.mockReturnValue({
       launchResult: Promise.reject(new StructuredAgentSessionCreateRefusalError('unsupported')),
       isVisibilityUnknown: () => false,
       claimDefinitiveRefusalFallback: (fallback: () => Promise<unknown>) =>
@@ -65,7 +65,7 @@ describe('settleDirectWorkItemStructuredLaunch', () => {
   })
 
   it('reports an unknown outcome without starting a fallback terminal', async () => {
-    mocks.startStructuredCodexLaunch.mockReturnValue({
+    mocks.startStructuredAgentLaunch.mockReturnValue({
       launchResult: Promise.reject(new Error('connection lost')),
       isVisibilityUnknown: () => true,
       claimDefinitiveRefusalFallback: vi.fn(() => Promise.resolve(false))
diff --git a/src/renderer/src/lib/launch-work-item-direct-agent-routing.ts b/src/renderer/src/lib/launch-work-item-direct-agent-routing.ts
index 43f6a6e700d..7d77b8d0d18 100644
--- a/src/renderer/src/lib/launch-work-item-direct-agent-routing.ts
+++ b/src/renderer/src/lib/launch-work-item-direct-agent-routing.ts
@@ -1,3 +1,4 @@
+import { isAgentSessionHandleProvider } from '../../../shared/agent-session-provider-handle'
 import type { TuiAgent } from '../../../shared/tui-agent'
 import type { AgentStartupPlan } from '@/lib/tui-agent-startup'
 import type { LaunchSource } from '../../../shared/telemetry-events'
@@ -9,8 +10,8 @@ import {
   buildDirectWorkItemAgentStartupPlan,
   buildDirectWorkItemStartupOpts
 } from '@/lib/launch-work-item-direct-agent'
-import { startStructuredCodexLaunch } from '@/lib/structured-agent-session-launch'
-import { StructuredAgentSessionCreateRefusalError } from '@/lib/launch-structured-codex-session'
+import { startStructuredAgentLaunch } from '@/lib/structured-agent-session-launch'
+import { StructuredAgentSessionCreateRefusalError } from '@/lib/launch-structured-agent-session'
 import { isNativeChatTranscriptLocalReadable } from '@/lib/native-chat-transcript-readability'
 import { resolveSourceControlLaunchPlatform } from '@/lib/source-control-launch-platform'
 import { preflightAgentTrust } from '@/lib/agent-trust-preflight'
@@ -127,11 +128,11 @@ export async function settleDirectWorkItemStructuredLaunch(args: {
   primaryTabId: string | null
 }> {
   let { structuredLaunch, primaryTabId } = args
-  if (!structuredLaunch || args.agent !== 'codex') {
+  if (!structuredLaunch || !isAgentSessionHandleProvider(args.agent)) {
     return { completed: false, structuredLaunch, visibilityUnknown: false, primaryTabId }
   }
 
-  const launch = startStructuredCodexLaunch(args.worktreeId, {
+  const launch = startStructuredAgentLaunch(args.worktreeId, args.agent, {
     prompt: args.draftContent,
     ...(args.promptDelivery === 'submit-after-ready' ? { promptDelivery: args.promptDelivery } : {})
   })
diff --git a/src/renderer/src/lib/palette-match/match-field-allocation.test.ts b/src/renderer/src/lib/palette-match/match-field-allocation.test.ts
new file mode 100644
index 00000000000..5b0021d2e71
--- /dev/null
+++ b/src/renderer/src/lib/palette-match/match-field-allocation.test.ts
@@ -0,0 +1,90 @@
+import { describe, expect, it, vi } from 'vitest'
+import {
+  indexPaletteField,
+  type PaletteIdentifierKind,
+  type PaletteFieldProfile
+} from './indexed-field'
+import { matchPaletteField } from './match-field'
+import { createPaletteQueryToken } from './palette-query'
+
+describe('palette field quality allocation', () => {
+  it.each(['scan', 's', '123', 'scna', 'zzz'])(
+    'does not allocate a Set per field for %s',
+    (query) => {
+      const profiles: PaletteFieldProfile[] = [
+        'structured-label',
+        'identifier',
+        'path',
+        'prose',
+        'exact-alias'
+      ]
+      const fields = Array.from({ length: 1_000 }, (_, i) =>
+        indexPaletteField({
+          id: String(i),
+          profile: profiles[i % profiles.length],
+          text: 'scan daily 1234 workspace',
+          ...(i % 2 === 0 ? { identifier: { kind: 'number' as const } } : {})
+        })!
+      )
+      const token = createPaletteQueryToken(query, 0)
+      let allocations = 0
+      const NativeSet = globalThis.Set
+      class CountedSet<T> extends NativeSet<T> {
+        constructor(values?: Iterable<T> | null) {
+          super(values)
+          allocations++
+        }
+      }
+      vi.stubGlobal('Set', CountedSet)
+      try {
+        for (const field of fields) {
+          matchPaletteField(field, token)
+        }
+      } finally {
+        vi.unstubAllGlobals()
+      }
+      expect(allocations).toBe(0)
+    }
+  )
+})
+
+describe('palette quality restrictions remain local to each match', () => {
+  it.each<PaletteIdentifierKind>(['number', 'version', 'date', 'port', 'sha', 'key'])(
+    'preserves prefix permissions for %s',
+    (kind) => {
+      const field = indexPaletteField({
+        id: 'id',
+        profile: 'identifier',
+        text: '12345',
+        identifier: { kind }
+      })!
+      const prefix = createPaletteQueryToken('123', 0)
+      const exact = createPaletteQueryToken('12345', 0)
+      const expected = ['port', 'sha', 'key'].includes(kind)
+        ? { quality: 'field-prefix', ranges: [{ start: 0, end: 3 }] }
+        : null
+      expect(matchPaletteField(field, prefix)).toEqual(expected)
+      expect(matchPaletteField(field, exact)).toEqual({
+        quality: 'field-exact',
+        ranges: [{ start: 0, end: 5 }]
+      })
+      expect(matchPaletteField(field, prefix)).toEqual(expected)
+    }
+  )
+
+  it.each<PaletteFieldProfile>(['structured-label', 'identifier', 'path', 'prose', 'exact-alias'])(
+    'preserves typo restrictions for %s without mutating the profile',
+    (profile) => {
+      const field = indexPaletteField({ id: 'id', profile, text: 'scan' })!
+      expect(matchPaletteField(field, createPaletteQueryToken('s', 0))).toEqual({
+        quality: 'field-prefix',
+        ranges: [{ start: 0, end: 1 }]
+      })
+      expect(matchPaletteField(field, createPaletteQueryToken('scam', 0))).toEqual(
+        ['structured-label', 'prose'].includes(profile)
+          ? { quality: 'typo', ranges: [{ start: 0, end: 4 }] }
+          : null
+      )
+    }
+  )
+})
diff --git a/src/renderer/src/lib/palette-match/match-field.ts b/src/renderer/src/lib/palette-match/match-field.ts
index f9015ec49a5..1744219524c 100644
--- a/src/renderer/src/lib/palette-match/match-field.ts
+++ b/src/renderer/src/lib/palette-match/match-field.ts
@@ -32,7 +32,7 @@ const SIGILS = new Set(['#', '!'])
 function allowedQualities(
   field: PaletteIndexedField,
   token: PaletteQueryToken
-): ReadonlySet<PaletteMatchQuality> {
+): readonly PaletteMatchQuality[] {
   let qualities = paletteProfileAllowedQualities(field.profile)
   if (field.identifier && !identifierKindAllowsPrefix(field.identifier.kind)) {
     qualities = qualities.filter((quality) => !PREFIX_QUALITIES.has(quality))
@@ -43,7 +43,7 @@ function allowedQualities(
   if (token.isIdentifierLike) {
     qualities = qualities.filter((quality) => quality !== 'typo')
   }
-  return new Set(qualities)
+  return qualities
 }
 
 /** `#123` must not reach a GitLab MR, and `!123` must not reach a GitHub PR. */
@@ -83,15 +83,15 @@ function toRanges(field: PaletteIndexedField, start: number, end: number): reado
 function matchLiteral(
   field: PaletteIndexedField,
   token: PaletteQueryToken,
-  qualities: ReadonlySet<PaletteMatchQuality>
+  qualities: readonly PaletteMatchQuality[]
 ): PaletteFieldMatch | null {
   const normalized = field.text.normalized
   const text = token.text
 
-  if (qualities.has('field-exact') && normalized === text) {
+  if (qualities.includes('field-exact') && normalized === text) {
     return { quality: 'field-exact', ranges: toRanges(field, 0, normalized.length) }
   }
-  if (qualities.has('word-exact')) {
+  if (qualities.includes('word-exact')) {
     const word = field.words.find((entry) => entry.text === text)
     if (word) {
       return { quality: 'word-exact', ranges: toRanges(field, word.start, word.end) }
@@ -101,10 +101,10 @@ function matchLiteral(
       return { quality: 'word-exact', ranges: toRanges(field, atom.start, atom.end) }
     }
   }
-  if (qualities.has('field-prefix') && normalized.startsWith(text)) {
+  if (qualities.includes('field-prefix') && normalized.startsWith(text)) {
     return { quality: 'field-prefix', ranges: toRanges(field, 0, text.length) }
   }
-  if (qualities.has('word-prefix')) {
+  if (qualities.includes('word-prefix')) {
     const word = field.words.find((entry) => entry.text.startsWith(text))
     const atom = field.atoms.find((entry) => normalized.startsWith(text, entry.start))
     const start = word && atom ? Math.min(word.start, atom.start) : (word?.start ?? atom?.start)
@@ -117,13 +117,13 @@ function matchLiteral(
   if (literalIndex === -1) {
     return null
   }
-  if (qualities.has('boundary-substring') && isWordStart(field, literalIndex)) {
+  if (qualities.includes('boundary-substring') && isWordStart(field, literalIndex)) {
     return {
       quality: 'boundary-substring',
       ranges: toRanges(field, literalIndex, literalIndex + text.length)
     }
   }
-  if (qualities.has('literal-substring')) {
+  if (qualities.includes('literal-substring')) {
     return {
       quality: 'literal-substring',
       ranges: toRanges(field, literalIndex, literalIndex + text.length)
@@ -135,9 +135,9 @@ function matchLiteral(
 function matchCompact(
   field: PaletteIndexedField,
   token: PaletteQueryToken,
-  qualities: ReadonlySet<PaletteMatchQuality>
+  qualities: readonly PaletteMatchQuality[]
 ): PaletteFieldMatch | null {
-  if (!qualities.has('compact') || token.compact.length < MIN_COMPACT_LENGTH) {
+  if (!qualities.includes('compact') || token.compact.length < MIN_COMPACT_LENGTH) {
     return null
   }
   for (const atom of field.atoms) {
@@ -152,9 +152,9 @@ function matchCompact(
 function matchTypo(
   field: PaletteIndexedField,
   token: PaletteQueryToken,
-  qualities: ReadonlySet<PaletteMatchQuality>
+  qualities: readonly PaletteMatchQuality[]
 ): PaletteFieldMatch | null {
-  if (!qualities.has('typo') || !token.isLetterOnly || !isPaletteTypoCandidate(token.text)) {
+  if (!qualities.includes('typo') || !token.isLetterOnly || !isPaletteTypoCandidate(token.text)) {
     return null
   }
   for (const word of field.words) {
diff --git a/src/renderer/src/lib/pane-manager/pane-lifecycle.test.ts b/src/renderer/src/lib/pane-manager/pane-lifecycle.test.ts
index 3a174253d9c..e84638c33ea 100644
--- a/src/renderer/src/lib/pane-manager/pane-lifecycle.test.ts
+++ b/src/renderer/src/lib/pane-manager/pane-lifecycle.test.ts
@@ -7,7 +7,7 @@ import {
   primeTerminalWebglAddon,
   resetTerminalWebglSuggestion
 } from './pane-webgl-renderer'
-import { attachLigatures, disposePane, openTerminal } from './pane-lifecycle'
+import { attachLigatures, disposePane, openTerminal, setLigaturesEnabled } from './pane-lifecycle'
 import { ensureArabicShapingJoinerForText } from './terminal-arabic-shaping-joiner'
 import {
   buildDefaultTerminalOptions,
@@ -531,6 +531,7 @@ describe('openTerminal — addon and provider wiring', () => {
       }),
       attachCustomWheelEventHandler: vi.fn(),
       onWriteParsed: vi.fn(() => ({ dispose: vi.fn() })),
+      refresh: vi.fn(),
       write: vi.fn(() => {
         events.push('write')
       }),
@@ -588,6 +589,31 @@ describe('openTerminal — addon and provider wiring', () => {
   // unicode v11 is activated (still on default v6 width tables), wide chars
   // lay out as single cells. The bug surfaces as the broken `?`-style glyphs
   // users saw on worktree switch.
+  it('builds one initial WebGL atlas with ligatures and still rebuilds on a live toggle', async () => {
+    await primeTerminalWebglAddon()
+    resetTerminalWebglSuggestion()
+    vi.mocked(WebglAddon).mockClear()
+    webglMock.dispose.mockClear()
+    vi.stubGlobal('navigator', { platform: 'MacIntel', userAgent: 'Macintosh' })
+    const { pane } = createOpenTerminalHarness()
+    pane.terminalGpuAcceleration = 'auto'
+    pane.gpuRenderingEnabled = true
+
+    openTerminal(pane, true)
+    expect(pane.ligaturesAddon).not.toBeNull()
+    expect(pane.webglAddon).not.toBeNull()
+    const addons = vi.mocked(pane.terminal.loadAddon).mock.calls.map(([addon]) => addon)
+    expect(addons.indexOf(pane.ligaturesAddon!)).toBeLessThan(addons.indexOf(pane.webglAddon!))
+    setLigaturesEnabled(pane, true)
+    expect(WebglAddon).toHaveBeenCalledTimes(1)
+    expect(webglMock.dispose).not.toHaveBeenCalled()
+
+    setLigaturesEnabled(pane, false)
+    expect(WebglAddon).toHaveBeenCalledTimes(2)
+    expect(webglMock.dispose).toHaveBeenCalledTimes(1)
+    expect(pane.ligaturesAddon).toBeNull()
+  })
+
   it('activates unicode 11 before any caller-driven write would be possible', () => {
     const { pane, events } = createOpenTerminalHarness()
 
diff --git a/src/renderer/src/lib/pane-manager/pane-lifecycle.ts b/src/renderer/src/lib/pane-manager/pane-lifecycle.ts
index 3c89a6ec723..cf4b50783d1 100644
--- a/src/renderer/src/lib/pane-manager/pane-lifecycle.ts
+++ b/src/renderer/src/lib/pane-manager/pane-lifecycle.ts
@@ -28,7 +28,7 @@ import { installTerminalImeCandidateAnchor } from './terminal-ime-candidate-anch
 export { createPaneDOM } from './pane-dom-creation'
 
 /** Open terminal into its container and load addons. Must be called after the container is in the DOM. */
-export function openTerminal(pane: ManagedPaneInternal): void {
+export function openTerminal(pane: ManagedPaneInternal, ligaturesEnabled = false): void {
   const {
     terminal,
     container,
@@ -100,6 +100,10 @@ export function openTerminal(pane: ManagedPaneInternal): void {
 
   pane.focusClassSyncCleanup = attachDomRendererFocusClassSync(terminal.element)
 
+  // Configure the first atlas with ligatures instead of immediately rebuilding it.
+  if (ligaturesEnabled) {
+    attachLigatures(pane)
+  }
   if (pane.gpuRenderingEnabled) {
     attachWebgl(pane)
   }
diff --git a/src/renderer/src/lib/pane-manager/pane-manager-pane-creation.ts b/src/renderer/src/lib/pane-manager/pane-manager-pane-creation.ts
index 483f49a1f55..c4c3a28c4ca 100644
--- a/src/renderer/src/lib/pane-manager/pane-manager-pane-creation.ts
+++ b/src/renderer/src/lib/pane-manager/pane-manager-pane-creation.ts
@@ -18,7 +18,7 @@ export function createInitialManagedPane(
     overflow: 'hidden'
   })
   host.root.appendChild(pane.container)
-  openTerminal(pane)
+  openTerminal(pane, host.options.terminalLigaturesEnabled?.())
   host.setActivePaneId(pane.id)
   applyPaneOpacity(host.panes.values(), host.getActivePaneId(), host.getStyleOptions())
 
diff --git a/src/renderer/src/lib/pane-manager/pane-manager-types.ts b/src/renderer/src/lib/pane-manager/pane-manager-types.ts
index 7b23c177236..00637ae7f97 100644
--- a/src/renderer/src/lib/pane-manager/pane-manager-types.ts
+++ b/src/renderer/src/lib/pane-manager/pane-manager-types.ts
@@ -63,6 +63,7 @@ export type PaneManagerOptions = {
   resolveExternalPaneDropTarget?: PaneExternalDropResolver
   onExternalPaneDrop?: PaneExternalDropHandler
   terminalOptions?: (paneId: number) => Partial<ITerminalOptions>
+  terminalLigaturesEnabled?: () => boolean
   terminalTuiScrollSensitivity?: () => number | undefined
   onLinkClick?: (paneId: number, event: MouseEvent | undefined, url: string) => void
   /** Resolved per hover so link-routing setting changes apply without recreating panes. */
diff --git a/src/renderer/src/lib/pane-manager/pane-split-close.ts b/src/renderer/src/lib/pane-manager/pane-split-close.ts
index df725156655..c5c71b03be6 100644
--- a/src/renderer/src/lib/pane-manager/pane-split-close.ts
+++ b/src/renderer/src/lib/pane-manager/pane-split-close.ts
@@ -141,7 +141,7 @@ function openSplitPane(
   newPane: ManagedPaneInternal,
   cwd?: string
 ): void {
-  openTerminal(newPane)
+  openTerminal(newPane, args.managerOptions.terminalLigaturesEnabled?.())
   applyPaneOpacity(args.panes.values(), newPane.id, args.styleOptions)
   applyDividerStyles(args.root, args.styleOptions)
   newPane.terminal.focus()
diff --git a/src/renderer/src/lib/session-write-subscriber-allocation.test.ts b/src/renderer/src/lib/session-write-subscriber-allocation.test.ts
index 9681af5a973..74c9c6db968 100644
--- a/src/renderer/src/lib/session-write-subscriber-allocation.test.ts
+++ b/src/renderer/src/lib/session-write-subscriber-allocation.test.ts
@@ -90,6 +90,34 @@ afterEach(() => {
 })
 
 describe('session write subscriber allocation', () => {
+  it.each(['tabsByWorktree', 'unifiedTabsByWorktree'] as const)(
+    'remembers an equivalent %s source before unrelated writes',
+    (field) => {
+      const harness = createHarness()
+      try {
+        harness.write(() => ({ [field]: { 'wt-1': [] } }))
+        vi.advanceTimersByTime(500)
+        harness.persisted.length = 0
+
+        harness.write(() => ({ [field]: { 'wt-1': [] } }))
+        const calls = countFilterCalls(() => {
+          for (let write = 0; write < 200; write += 1) {
+            harness.write(() => ({ runtimePaneTitlesByTabId: {} }))
+          }
+        })
+        expect(calls).toBe(0)
+        vi.advanceTimersByTime(500)
+        expect(harness.persisted).toHaveLength(0)
+
+        harness.write(() => ({ activeTabId: 'next-tab' }))
+        vi.advanceTimersByTime(500)
+        expect(harness.persisted).toHaveLength(1)
+      } finally {
+        harness.dispose()
+      }
+    }
+  )
+
   it('allocates nothing for store writes that touch no session field', () => {
     const harness = createHarness()
     try {
diff --git a/src/renderer/src/lib/session-write-subscriber.ts b/src/renderer/src/lib/session-write-subscriber.ts
index e0e366ef6ba..d54675e15ab 100644
--- a/src/renderer/src/lib/session-write-subscriber.ts
+++ b/src/renderer/src/lib/session-write-subscriber.ts
@@ -233,12 +233,13 @@ export function createSessionWriteSubscriber({
       prev === null
         ? [...SESSION_RELEVANT_FIELDS]
         : SESSION_RELEVANT_FIELDS.filter((key) => prev?.[key] !== next[key])
+    // Equivalent projections still consume the new source identities.
+    prevTabsSource = state.tabsByWorktree
+    prevUnifiedTabsSource = state.unifiedTabsByWorktree
     if (changedFields.length === 0 && pendingChangedFields.size === 0) {
       return
     }
     prev = next
-    prevTabsSource = state.tabsByWorktree
-    prevUnifiedTabsSource = state.unifiedTabsByWorktree
     for (const field of changedFields) {
       pendingChangedFields.add(field)
     }
diff --git a/src/renderer/src/lib/ssh-background-startup-delivery.test.ts b/src/renderer/src/lib/ssh-background-startup-delivery.test.ts
index ee5248cf2fd..427d1dbdb8f 100644
--- a/src/renderer/src/lib/ssh-background-startup-delivery.test.ts
+++ b/src/renderer/src/lib/ssh-background-startup-delivery.test.ts
@@ -18,6 +18,25 @@ function createDelivery(): {
   }
 }
 
+// Bracketed paste only wraps multiline submissions, so the marker's effect on it
+// is only observable through a command that carries a newline.
+const MULTILINE_COMMAND = 'codex "run the\nautomation"'
+
+function createMultilineDelivery(waitForShellReady: boolean): {
+  delivery: ReturnType<typeof createSshBackgroundStartupDelivery>
+  write: ReturnType<typeof vi.fn>
+} {
+  const write = vi.fn()
+  return {
+    delivery: createSshBackgroundStartupDelivery({
+      command: MULTILINE_COMMAND,
+      waitForShellReady,
+      write
+    }),
+    write
+  }
+}
+
 beforeEach(() => {
   vi.useFakeTimers()
 })
@@ -89,4 +108,89 @@ describe('createSshBackgroundStartupDelivery shell-ready fallback', () => {
 
     expect(write).toHaveBeenCalledTimes(1)
   })
+
+  // #18767: the marker is what proves the host wrapped the shell and armed
+  // bracketed paste. A fallback release means it never did.
+  it('uses bracketed paste only after the marker actually arrived', () => {
+    const { delivery, write } = createMultilineDelivery(true)
+
+    delivery.armFallback('pty-1')
+    delivery.handleData(`${SHELL_READY}user@remote repo % `)
+    vi.advanceTimersByTime(50)
+
+    expect(write.mock.calls[0]?.[1]).toContain('\x1b[200~')
+  })
+
+  // The host answers in the spawn reply whether it armed the marker. `false` means
+  // none will ever come, so the pre-#18796 fast path applies; `true` keeps the wait;
+  // absent is an older host and leaves the client-side prediction alone.
+  describe('host shell-ready verdict', () => {
+    it('delivers immediately and raw when the host reports the marker was not armed', () => {
+      const { delivery, write } = createMultilineDelivery(true)
+
+      delivery.applyHostShellReadyArmed(false)
+      delivery.armFallback('pty-1')
+      // The launch flow schedules on every data chunk (launch-agent-background-session).
+      delivery.handleData('user@remote repo % ')
+      delivery.schedule('pty-1')
+      vi.advanceTimersByTime(50)
+
+      expect(write).toHaveBeenCalledTimes(1)
+      expect(write.mock.calls[0]?.[1]).not.toContain('\x1b[200~')
+    })
+
+    it('keeps the short silent-shell budget once the host says no marker is coming', () => {
+      const { delivery, write } = createDelivery()
+
+      delivery.applyHostShellReadyArmed(false)
+      delivery.armFallback('pty-1')
+      vi.advanceTimersByTime(1_550)
+
+      expect(write).toHaveBeenCalledTimes(1)
+    })
+
+    it('still waits for the marker when the host reports it armed one', () => {
+      const { delivery, write } = createDelivery()
+
+      delivery.applyHostShellReadyArmed(true)
+      delivery.armFallback('pty-1')
+      delivery.handleData('user@remote repo % ')
+      vi.advanceTimersByTime(1_400)
+
+      expect(write).not.toHaveBeenCalled()
+
+      delivery.handleData(`${SHELL_READY}user@remote repo % `)
+      vi.advanceTimersByTime(50)
+
+      expect(write).toHaveBeenCalledTimes(1)
+    })
+
+    it('keeps the client-side prediction when an older host omits the verdict', () => {
+      const { delivery, write } = createDelivery()
+
+      delivery.applyHostShellReadyArmed(undefined)
+      delivery.armFallback('pty-1')
+      delivery.handleData('user@remote repo % ')
+      vi.advanceTimersByTime(1_400)
+
+      expect(write).not.toHaveBeenCalled()
+
+      vi.advanceTimersByTime(150)
+      vi.advanceTimersByTime(50)
+
+      expect(write).toHaveBeenCalledTimes(1)
+    })
+  })
+
+  it('submits raw when the wait ends at the fallback instead of the marker', () => {
+    const { delivery, write } = createMultilineDelivery(true)
+
+    delivery.armFallback('pty-1')
+    delivery.handleData('user@remote repo % ')
+    vi.advanceTimersByTime(1_550)
+    vi.advanceTimersByTime(50)
+
+    expect(write).toHaveBeenCalledTimes(1)
+    expect(write.mock.calls[0]?.[1]).not.toContain('\x1b[200~')
+  })
 })
diff --git a/src/renderer/src/lib/ssh-background-startup-delivery.ts b/src/renderer/src/lib/ssh-background-startup-delivery.ts
index 1c11254d6bb..0e1c08c70ff 100644
--- a/src/renderer/src/lib/ssh-background-startup-delivery.ts
+++ b/src/renderer/src/lib/ssh-background-startup-delivery.ts
@@ -2,8 +2,34 @@ import {
   createShellReadyMarkerScanState,
   scanForShellReadyMarker
 } from '@/components/terminal-pane/shell-ready-marker-scan'
+import {
+  isCodexStartupCommand,
+  shouldUseShellReadyStartupDelivery,
+  type StartupCommandDelivery
+} from '../../../shared/codex-startup-delivery'
 import { buildStartupCommandSubmission } from '../../../shared/startup-command-submission'
 
+/**
+ * Why every Codex launch waits and not only the prompt-carrying ones: the remote
+ * shell is the host's to know, and it arms the ready marker for plain Codex too
+ * (#18767). On such a host the wait ends at the prompt and costs nothing. On one
+ * that never publishes a marker -- fish, sh, Windows, or a host predating #18767 --
+ * the fallback below releases instead, at the same price prompt-carrying Codex
+ * already paid there.
+ */
+export function sshBackgroundLaunchWaitsForShellReady(startupPlan: {
+  launchCommand: string | null | undefined
+  startupCommandDelivery?: StartupCommandDelivery
+}): boolean {
+  return (
+    isCodexStartupCommand(startupPlan.launchCommand) ||
+    shouldUseShellReadyStartupDelivery({
+      command: startupPlan.launchCommand,
+      startupCommandDelivery: startupPlan.startupCommandDelivery
+    })
+  )
+}
+
 const SSH_SHELL_READY_STARTUP_FALLBACK_MS = 1500
 // Why: a remote shell that has not emitted a single byte is still booting —
 // /etc/profile plus nvm/conda/pyenv over a cold link routinely needs more than
@@ -22,6 +48,12 @@ export type SshBackgroundStartupDelivery = {
   handleData(data: string): string
   armFallback(ptyId: string): void
   schedule(ptyId: string): void
+  /**
+   * The host's verdict from the spawn reply, which lands after this delivery was built.
+   * `false` releases the wait: no marker will ever come. `true` keeps it. `undefined` is
+   * a host that predates the field, so the constructor-time prediction stands.
+   */
+  applyHostShellReadyArmed(armed: boolean | undefined): void
   clear(): void
 }
 
@@ -30,8 +62,13 @@ export function createSshBackgroundStartupDelivery(
 ): SshBackgroundStartupDelivery {
   let pendingCommand = options.command
   let lastPtyId: string | null = null
-  let startupShellReady = !options.waitForShellReady
-  const markerScan = options.waitForShellReady ? createShellReadyMarkerScanState() : null
+  let waitForShellReady = options.waitForShellReady
+  let startupShellReady = !waitForShellReady
+  // Why tracked apart from `startupShellReady`: only an observed marker proves the
+  // host wrapped the shell and armed bracketed paste. A fallback release means the
+  // host shell never published one, so the raw submit is the only safe form.
+  let markerObserved = false
+  let markerScan = waitForShellReady ? createShellReadyMarkerScanState() : null
   let injectTimer: ReturnType<typeof setTimeout> | null = null
   let fallbackTimer: ReturnType<typeof setTimeout> | null = null
   let sawOutput = false
@@ -53,6 +90,7 @@ export function createSshBackgroundStartupDelivery(
       return
     }
     startupShellReady = true
+    markerObserved = true
     clearFallbackTimer()
     if (pendingCommand && lastPtyId) {
       schedule(lastPtyId)
@@ -66,7 +104,7 @@ export function createSshBackgroundStartupDelivery(
     }
     // The long budget only buys time for the shell-ready marker; the fast path
     // pastes nothing prompt-sensitive, so delaying it there is pure latency.
-    const waitingForSilentShell = options.waitForShellReady && !sawOutput
+    const waitingForSilentShell = waitForShellReady && !sawOutput
     fallbackTimer = setTimeout(
       () => {
         fallbackTimer = null
@@ -100,14 +138,14 @@ export function createSshBackgroundStartupDelivery(
       // Why: the SSH relay treats spawn.command as metadata for interactive
       // PTYs; hidden automation tabs still submit the command themselves.
       // Why bracketed paste: multiline prompts are pasted literally only when we
-      // synchronized on the Orca shell-ready marker (waitForShellReady) — that
-      // is the bash/zsh overlay with bracketed-paste mode armed. Submit with CR
-      // since the relay drives a remote shell.
+      // synchronized on the Orca shell-ready marker — that is the bash/zsh overlay
+      // with bracketed-paste mode armed. Submit with CR since the relay drives a
+      // remote shell.
       options.write(
         ptyId,
         buildStartupCommandSubmission(command, {
           submit: '\r',
-          bracketedPasteSafe: options.waitForShellReady
+          bracketedPasteSafe: markerObserved
         })
       )
     }, 50)
@@ -135,6 +173,19 @@ export function createSshBackgroundStartupDelivery(
     },
     armFallback,
     schedule,
+    applyHostShellReadyArmed(armed) {
+      if (armed !== false || !waitForShellReady) {
+        return
+      }
+      // Not a marker sighting: bracketed paste stays unproven, so the submit stays raw.
+      waitForShellReady = false
+      startupShellReady = true
+      markerScan = null
+      clearFallbackTimer()
+      if (lastPtyId) {
+        schedule(lastPtyId)
+      }
+    },
     clear() {
       clearInjectTimer()
       clearFallbackTimer()
diff --git a/src/renderer/src/lib/structured-agent-session-launch-callers.ts b/src/renderer/src/lib/structured-agent-session-launch-callers.ts
index 7097b085cba..db9715c0c1a 100644
--- a/src/renderer/src/lib/structured-agent-session-launch-callers.ts
+++ b/src/renderer/src/lib/structured-agent-session-launch-callers.ts
@@ -1,6 +1,6 @@
-import { StructuredAgentSessionCreateRefusalError } from '@/lib/launch-structured-codex-session'
+import { StructuredAgentSessionCreateRefusalError } from '@/lib/launch-structured-agent-session'
 import {
-  settleStructuredCodexLaunchPrompt,
+  settleStructuredAgentLaunchPrompt,
   type StructuredPromptDeliveryResult
 } from '@/lib/structured-agent-session-launch-prompt'
 import type { StructuredAgentSessionOutboxEntry } from '../../../shared/structured-agent-session-outbox'
@@ -10,7 +10,7 @@ export type StructuredRefusalFallback = () =>
   | StructuredPromptDeliveryResult
   | Promise<void | StructuredPromptDeliveryResult>
 
-export type StructuredCodexLaunchOptions = {
+export type StructuredAgentLaunchOptions = {
   prompt?: string
   promptDelivery?: 'auto-submit' | 'submit-after-ready'
   onPromptDelivered?: () => void
@@ -137,7 +137,7 @@ function trackPromptDelivery(
 export function addStructuredLaunchCaller(args: {
   group: StructuredLaunchCallerGroup
   launchResult: Promise<{ sessionId: string; fence: number }>
-  options: StructuredCodexLaunchOptions
+  options: StructuredAgentLaunchOptions
   stagedEntry: StructuredAgentSessionOutboxEntry | null
 }): StructuredLaunchCaller {
   const fallback = Promise.withResolvers<boolean>()
@@ -156,7 +156,7 @@ export function addStructuredLaunchCaller(args: {
     }
   }
   args.group.entries.add(caller)
-  const promptDeliveryResult = settleStructuredCodexLaunchPrompt({
+  const promptDeliveryResult = settleStructuredAgentLaunchPrompt({
     launchResult: args.launchResult,
     options: args.options,
     stagedEntry: args.stagedEntry
diff --git a/src/renderer/src/lib/structured-agent-session-launch-prompt.ts b/src/renderer/src/lib/structured-agent-session-launch-prompt.ts
index 513d3055c73..d52105057cd 100644
--- a/src/renderer/src/lib/structured-agent-session-launch-prompt.ts
+++ b/src/renderer/src/lib/structured-agent-session-launch-prompt.ts
@@ -78,7 +78,7 @@ async function dispatchStructuredLaunchPrompt(
   }
 }
 
-export function settleStructuredCodexLaunchPrompt(args: {
+export function settleStructuredAgentLaunchPrompt(args: {
   launchResult: Promise<LaunchReceipt>
   options: StructuredLaunchPromptOptions
   stagedEntry: StructuredAgentSessionOutboxEntry | null
diff --git a/src/renderer/src/lib/structured-agent-session-launch-recovery.ts b/src/renderer/src/lib/structured-agent-session-launch-recovery.ts
index 1c4347281d1..1af33421652 100644
--- a/src/renderer/src/lib/structured-agent-session-launch-recovery.ts
+++ b/src/renderer/src/lib/structured-agent-session-launch-recovery.ts
@@ -1,18 +1,18 @@
 import type { AgentSessionHistoryResult } from '../../../shared/agent-session-wire'
 import {
-  launchStructuredCodexSession,
+  launchStructuredAgentSession,
   StructuredAgentSessionCreateRefusalError,
   type StructuredAgentSessionLaunchIntent
-} from '@/lib/launch-structured-codex-session'
+} from '@/lib/launch-structured-agent-session'
 import { callStructuredAgentSession } from '@/runtime/structured-agent-session-client'
 import { refreshLocalStructuredSessionTabs } from '@/runtime/local-structured-session-tabs-sync'
 import { useAppStore } from '@/store'
 
-export type StructuredCodexLaunchReceipt = { sessionId: string; fence: number }
+export type StructuredAgentLaunchReceipt = { sessionId: string; fence: number }
 
 export type StructuredLaunchRecoveryState = {
   intent: StructuredAgentSessionLaunchIntent
-  promise: Promise<StructuredCodexLaunchReceipt>
+  promise: Promise<StructuredAgentLaunchReceipt>
   visibilityUnknown: boolean
   cancelled: boolean
   onVisibilityChanged?: () => void
@@ -64,7 +64,7 @@ function hasAdoptedStructuredSession(intent: StructuredAgentSessionLaunchIntent)
 
 async function recoverPublishedSessionReceipt(
   state: StructuredLaunchRecoveryState
-): Promise<StructuredCodexLaunchReceipt> {
+): Promise<StructuredAgentLaunchReceipt> {
   await verifyPublishedSession(state)
   const history = await callStructuredAgentSession<AgentSessionHistoryResult>(
     { kind: 'local' },
@@ -82,10 +82,10 @@ async function recoverPublishedSessionReceipt(
 async function retrySameIntent(
   state: StructuredLaunchRecoveryState,
   priorError: unknown
-): Promise<StructuredCodexLaunchReceipt> {
+): Promise<StructuredAgentLaunchReceipt> {
   throwIfLaunchCancelled(state)
   try {
-    const receipt = await launchStructuredCodexSession(state.intent)
+    const receipt = await launchStructuredAgentSession(state.intent)
     throwIfLaunchCancelled(state)
     await verifyPublishedSession(state)
     return receipt
@@ -111,11 +111,11 @@ async function retrySameIntent(
 
 export async function launchAndReconcile(
   state: StructuredLaunchRecoveryState
-): Promise<StructuredCodexLaunchReceipt> {
+): Promise<StructuredAgentLaunchReceipt> {
   throwIfLaunchCancelled(state)
-  let receipt: StructuredCodexLaunchReceipt
+  let receipt: StructuredAgentLaunchReceipt
   try {
-    receipt = await launchStructuredCodexSession(state.intent)
+    receipt = await launchStructuredAgentSession(state.intent)
   } catch (error) {
     if (state.cancelled) {
       throw new StructuredAgentSessionLaunchCancelledError()
@@ -143,7 +143,7 @@ export async function launchAndReconcile(
 
 export async function reconcileUnknownLaunch(
   state: StructuredLaunchRecoveryState
-): Promise<StructuredCodexLaunchReceipt> {
+): Promise<StructuredAgentLaunchReceipt> {
   throwIfLaunchCancelled(state)
   state.visibilityUnknown = false
   state.onVisibilityChanged?.()
diff --git a/src/renderer/src/lib/structured-agent-session-launch-refusal-fallback.test.ts b/src/renderer/src/lib/structured-agent-session-launch-refusal-fallback.test.ts
new file mode 100644
index 00000000000..45c41bd111e
--- /dev/null
+++ b/src/renderer/src/lib/structured-agent-session-launch-refusal-fallback.test.ts
@@ -0,0 +1,208 @@
+// @vitest-environment happy-dom
+
+// The duplicate-session guard: which create refusals may open a legacy terminal beside the chat.
+// Deliberately exercises the real `launch-structured-agent-session`, because the classification
+// under test lives there — mocking it out would assert nothing.
+
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { toast } from 'sonner'
+import type { RuntimeMobileSessionTabsResult } from '../../../shared/runtime-session-contracts'
+import { RuntimeRpcCallError } from '@/runtime/runtime-rpc-client'
+
+const mocks = vi.hoisted(() => ({
+  call: vi.fn(),
+  refresh: vi.fn()
+}))
+
+vi.mock('sonner', () => ({
+  toast: { error: vi.fn(), message: vi.fn() }
+}))
+
+vi.mock('@/i18n/i18n', () => ({
+  translate: (_key: string, fallback: string, options?: { value0?: string }) =>
+    fallback.replace('{{value0}}', options?.value0 ?? '')
+}))
+
+vi.mock('@/lib/agent-catalog', () => ({
+  getAgentCatalog: () => [{ id: 'codex', label: 'Codex' }]
+}))
+
+vi.mock('@/runtime/structured-agent-session-client', () => ({
+  callStructuredAgentSession: mocks.call
+}))
+
+vi.mock('@/runtime/local-structured-session-tabs-sync', () => ({
+  LOCAL_STRUCTURED_SESSION_OWNER: 'local',
+  refreshLocalStructuredSessionTabs: mocks.refresh
+}))
+
+vi.mock('@/store', () => ({
+  useAppStore: {
+    getState: () => ({ unifiedTabsByWorktree: {} }),
+    subscribe: () => () => {}
+  }
+}))
+
+import {
+  StructuredAgentSessionCreateRefusalError,
+  StructuredAgentSessionCreateUnknownOutcomeError
+} from '@/lib/launch-structured-agent-session'
+import {
+  getStructuredAgentLaunchStatus,
+  startStructuredAgentLaunch
+} from './structured-agent-session-launch'
+
+type CreateReply = { ok: boolean; refusal?: { code: string; message: string } }
+
+/** Replies to every `agentSession.create` in turn, repeating the last reply thereafter. */
+function replyToCreates(...replies: CreateReply[]): void {
+  let index = 0
+  mocks.call.mockImplementation(async (_target: unknown, method: string, params: unknown) => {
+    if (method !== 'agentSession.create') {
+      return { ok: true, page: { fence: 1 } }
+    }
+    const reply = replies[Math.min(index, replies.length - 1)]
+    index += 1
+    if (!reply.ok) {
+      return reply
+    }
+    const sessionId = (params as { envelope: { sessionId: string } }).envelope.sessionId
+    return { ok: true, replayed: index > 1, fence: 1, value: { sessionId, fence: 1 } }
+  })
+}
+
+function refused(code: string): CreateReply {
+  return { ok: false, refusal: { code, message: `create refused: ${code}` } }
+}
+
+function publishedSnapshot(worktreeId: string, sessionId: string): RuntimeMobileSessionTabsResult {
+  return {
+    worktree: worktreeId,
+    publicationEpoch: 'epoch-1',
+    snapshotVersion: 1,
+    activeGroupId: null,
+    activeTabId: null,
+    activeTabType: null,
+    tabs: [
+      {
+        type: 'agent-session',
+        id: 'tab-1',
+        title: 'Codex',
+        sessionId,
+        agent: 'codex',
+        isActive: true
+      }
+    ]
+  }
+}
+
+async function flushLaunchSettlement(): Promise<void> {
+  for (let i = 0; i < 20; i += 1) {
+    await Promise.resolve()
+  }
+}
+
+describe('legacy terminal fallback after a refused structured create', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    localStorage.clear()
+    mocks.refresh.mockResolvedValue([])
+  })
+
+  it.each(['agent_session_operation_unknown', 'agent_session_ownership_unknown'])(
+    'opens no sibling terminal when the host answers %s',
+    async (code) => {
+      const worktreeId = `wt-${code}`
+      const legacyTerminals: string[] = []
+      replyToCreates(refused(code))
+
+      const launch = startStructuredAgentLaunch(worktreeId, 'codex')
+      void launch.claimDefinitiveRefusalFallback(() => {
+        legacyTerminals.push('legacy-terminal')
+      })
+
+      await expect(launch.launchResult).rejects.toBeInstanceOf(
+        StructuredAgentSessionCreateUnknownOutcomeError
+      )
+      await flushLaunchSettlement()
+
+      // The host may already hold the session, so the user keeps exactly one thing: no chat it
+      // could confirm, and no terminal beside a session it could not rule out.
+      expect(legacyTerminals).toEqual([])
+      expect(launch.isVisibilityUnknown()).toBe(true)
+      expect(toast.error).toHaveBeenCalledOnce()
+    }
+  )
+
+  it('adopts the session an unknown outcome had already created, without a sibling', async () => {
+    const worktreeId = 'wt-unknown-then-published'
+    const legacyTerminals: string[] = []
+    replyToCreates(refused('agent_session_operation_unknown'), { ok: true })
+
+    const launch = startStructuredAgentLaunch(worktreeId, 'codex')
+    const fallbackRan = launch.claimDefinitiveRefusalFallback(() => {
+      legacyTerminals.push('legacy-terminal')
+    })
+    mocks.refresh
+      .mockResolvedValueOnce([])
+      .mockResolvedValue([publishedSnapshot(worktreeId, launch.sessionId)])
+
+    await expect(launch.launchResult).resolves.toEqual({
+      sessionId: launch.sessionId,
+      fence: 1
+    })
+    await expect(fallbackRan).resolves.toBe(false)
+    await flushLaunchSettlement()
+
+    expect(legacyTerminals).toEqual([])
+    expect(toast.error).not.toHaveBeenCalled()
+  })
+
+  it('opens exactly one legacy terminal when the refusal is on the definitive allowlist', async () => {
+    const worktreeId = 'wt-unsupported'
+    const legacyTerminals: string[] = []
+    replyToCreates(refused('structured_agent_session_unsupported'))
+
+    const launch = startStructuredAgentLaunch(worktreeId, 'codex')
+    const fallbackRan = launch.claimDefinitiveRefusalFallback(() => {
+      legacyTerminals.push('legacy-terminal')
+    })
+
+    await expect(launch.launchResult).rejects.toBeInstanceOf(
+      StructuredAgentSessionCreateRefusalError
+    )
+    await expect(fallbackRan).resolves.toBe(true)
+    await flushLaunchSettlement()
+
+    expect(legacyTerminals).toEqual(['legacy-terminal'])
+    // A proven "nothing was created" needs no replay, so the terminal is the only surface open.
+    expect(
+      mocks.call.mock.calls.filter(([, method]) => method === 'agentSession.create')
+    ).toHaveLength(1)
+    expect(launch.isVisibilityUnknown()).toBe(false)
+  })
+
+  it('opens exactly one legacy terminal when an older runtime has no create method', async () => {
+    const legacyTerminals: string[] = []
+    mocks.call.mockRejectedValue(
+      new RuntimeRpcCallError({
+        id: 'rpc-old-runtime',
+        ok: false,
+        error: { code: 'method_not_found', message: 'Unknown method: agentSession.create' }
+      })
+    )
+
+    const launch = startStructuredAgentLaunch('wt-old-runtime', 'codex')
+    const fallbackRan = launch.claimDefinitiveRefusalFallback(() => {
+      legacyTerminals.push('legacy-terminal')
+    })
+
+    await expect(launch.launchResult).rejects.toBeInstanceOf(
+      StructuredAgentSessionCreateRefusalError
+    )
+    await expect(fallbackRan).resolves.toBe(true)
+    expect(legacyTerminals).toEqual(['legacy-terminal'])
+    expect(mocks.call).toHaveBeenCalledOnce()
+    expect(getStructuredAgentLaunchStatus('wt-old-runtime', 'codex')).toBe('idle')
+  })
+})
diff --git a/src/renderer/src/lib/structured-agent-session-launch.test.ts b/src/renderer/src/lib/structured-agent-session-launch.test.ts
index 812248e7a49..61d24b248d2 100644
--- a/src/renderer/src/lib/structured-agent-session-launch.test.ts
+++ b/src/renderer/src/lib/structured-agent-session-launch.test.ts
@@ -20,12 +20,12 @@ vi.mock('sonner', () => ({
   }
 }))
 
-vi.mock('@/lib/launch-structured-codex-session', () => {
+vi.mock('@/lib/launch-structured-agent-session', () => {
   class StructuredAgentSessionCreateRefusalError extends Error {}
   return {
-    createStructuredCodexSessionLaunchIntent: mocks.createIntent,
+    createStructuredAgentSessionLaunchIntent: mocks.createIntent,
     abandonStructuredAgentSessionLaunchIntent: mocks.abandonIntent,
-    launchStructuredCodexSession: mocks.launch,
+    launchStructuredAgentSession: mocks.launch,
     StructuredAgentSessionCreateRefusalError
   }
 })
@@ -51,17 +51,25 @@ vi.mock('@/store', () => ({
 }))
 
 vi.mock('@/i18n/i18n', () => ({
-  translate: (_key: string, fallback: string) => fallback
+  translate: (_key: string, fallback: string, options?: { value0?: string }) =>
+    fallback.replace('{{value0}}', options?.value0 ?? '')
+}))
+
+vi.mock('@/lib/agent-catalog', () => ({
+  getAgentCatalog: () => [
+    { id: 'claude', label: 'Claude' },
+    { id: 'codex', label: 'Codex' }
+  ]
 }))
 
 import {
   StructuredAgentSessionCreateRefusalError,
   type StructuredAgentSessionLaunchIntent
-} from '@/lib/launch-structured-codex-session'
+} from '@/lib/launch-structured-agent-session'
 import { refreshLocalStructuredSessionTabs } from '@/runtime/local-structured-session-tabs-sync'
 import {
-  cancelStructuredCodexLaunch,
-  startStructuredCodexLaunch
+  cancelStructuredAgentLaunch,
+  startStructuredAgentLaunch
 } from './structured-agent-session-launch'
 import { readOutbox } from '@/components/native-chat/structured-agent-session-outbox-storage'
 
@@ -72,6 +80,7 @@ function launchIntent(
   return {
     worktreeId,
     sessionId,
+    agent: 'codex',
     params: {
       envelope: {
         sessionId,
@@ -112,13 +121,16 @@ async function flushLaunchSettlement(): Promise<void> {
   }
 }
 
-describe('startStructuredCodexLaunch', () => {
+describe('startStructuredAgentLaunch', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     localStorage.clear()
     mocks.rendererTabs = {}
     mocks.listeners.clear()
-    mocks.createIntent.mockImplementation((worktreeId: string) => launchIntent(worktreeId))
+    mocks.createIntent.mockImplementation((worktreeId: string, agent: 'claude' | 'codex') => {
+      const intent = launchIntent(worktreeId, `${agent}-session-${worktreeId}`)
+      return { ...intent, agent, params: { ...intent.params, agent } }
+    })
     mocks.callStructuredAgentSession.mockResolvedValue({
       ok: true,
       page: { fence: 1 }
@@ -138,7 +150,7 @@ describe('startStructuredCodexLaunch', () => {
       value: { submission: { dispatchState: 'accepted' } }
     })
 
-    startStructuredCodexLaunch(worktreeId)
+    startStructuredAgentLaunch(worktreeId, 'codex')
     await flushLaunchSettlement()
 
     expect(mocks.launch).toHaveBeenCalledOnce()
@@ -147,6 +159,42 @@ describe('startStructuredCodexLaunch', () => {
     expect(toast.error).not.toHaveBeenCalled()
   })
 
+  it('keeps a Claude and a Codex launch in the same worktree apart', async () => {
+    const worktreeId = 'wt-two-agents'
+    mocks.launch.mockImplementation(async (intent: StructuredAgentSessionLaunchIntent) => {
+      mocks.rendererTabs[worktreeId] = [
+        ...(mocks.rendererTabs[worktreeId] ?? []),
+        { contentType: 'agent-session', entityId: intent.sessionId, worktreeId }
+      ]
+      return { sessionId: intent.sessionId, fence: 1 }
+    })
+
+    const claude = startStructuredAgentLaunch(worktreeId, 'claude')
+    const codex = startStructuredAgentLaunch(worktreeId, 'codex')
+    await flushLaunchSettlement()
+
+    expect(mocks.createIntent).toHaveBeenNthCalledWith(1, worktreeId, 'claude')
+    expect(mocks.createIntent).toHaveBeenNthCalledWith(2, worktreeId, 'codex')
+    expect(mocks.launch).toHaveBeenCalledTimes(2)
+    expect(vi.mocked(mocks.launch).mock.calls.map(([intent]) => intent.params.agent)).toEqual([
+      'claude',
+      'codex'
+    ])
+    expect(claude.sessionId).not.toBe(codex.sessionId)
+    expect(toast.error).not.toHaveBeenCalled()
+  })
+
+  it('names the refused agent in the launch failure toast', async () => {
+    const worktreeId = 'wt-claude-toast'
+    mocks.launch.mockRejectedValue(new Error('boom'))
+    vi.mocked(refreshLocalStructuredSessionTabs).mockResolvedValue([])
+
+    startStructuredAgentLaunch(worktreeId, 'claude')
+    await flushLaunchSettlement()
+
+    expect(toast.error).toHaveBeenCalledWith('Could not open Claude chat', expect.anything())
+  })
+
   it('completes from the host-emitted projection without listing inventory', async () => {
     const worktreeId = 'wt-host-frame'
     const intent = launchIntent(worktreeId, 'session-host-frame')
@@ -161,7 +209,7 @@ describe('startStructuredCodexLaunch', () => {
       return { sessionId: intent.sessionId, fence: 1 }
     })
 
-    startStructuredCodexLaunch(worktreeId)
+    startStructuredAgentLaunch(worktreeId, 'codex')
     await flushLaunchSettlement()
 
     expect(mocks.launch).toHaveBeenCalledOnce()
@@ -186,8 +234,8 @@ describe('startStructuredCodexLaunch', () => {
       value: { submission: { dispatchState: 'accepted' } }
     })
 
-    startStructuredCodexLaunch(worktreeId)
-    startStructuredCodexLaunch(worktreeId)
+    startStructuredAgentLaunch(worktreeId, 'codex')
+    startStructuredAgentLaunch(worktreeId, 'codex')
 
     expect(mocks.createIntent).toHaveBeenCalledOnce()
     expect(mocks.launch).toHaveBeenCalledOnce()
@@ -213,8 +261,8 @@ describe('startStructuredCodexLaunch', () => {
       ok: true,
       value: { submission: { dispatchState: 'accepted' } }
     })
-    startStructuredCodexLaunch(worktreeId)
-    const second = startStructuredCodexLaunch(worktreeId, { prompt: 'second prompt' })
+    startStructuredAgentLaunch(worktreeId, 'codex')
+    const second = startStructuredAgentLaunch(worktreeId, 'codex', { prompt: 'second prompt' })
 
     resolveLaunch({ sessionId: intent.sessionId, fence: 1 })
     await expect(second.promptDeliveryResult).resolves.toEqual({
@@ -251,12 +299,12 @@ describe('startStructuredCodexLaunch', () => {
       () => new Promise((resolve) => (resolveDelivery = resolve))
     )
 
-    startStructuredCodexLaunch(worktreeId)
-    const coalesced = startStructuredCodexLaunch(worktreeId, { prompt: 'second prompt' })
+    startStructuredAgentLaunch(worktreeId, 'codex')
+    const coalesced = startStructuredAgentLaunch(worktreeId, 'codex', { prompt: 'second prompt' })
     resolveLaunch({ sessionId: intent.sessionId, fence: 1 })
     await vi.waitFor(() => expect(mocks.callStructuredAgentSession).toHaveBeenCalledOnce())
 
-    startStructuredCodexLaunch(worktreeId)
+    startStructuredAgentLaunch(worktreeId, 'codex')
     expect(mocks.createIntent).toHaveBeenCalledOnce()
     expect(mocks.launch).toHaveBeenCalledOnce()
 
@@ -274,9 +322,9 @@ describe('startStructuredCodexLaunch', () => {
     mocks.launch.mockRejectedValue(new Error('offline'))
     vi.mocked(refreshLocalStructuredSessionTabs).mockResolvedValue([])
 
-    startStructuredCodexLaunch(worktreeId, { prompt: 'first prompt' })
+    startStructuredAgentLaunch(worktreeId, 'codex', { prompt: 'first prompt' })
     await flushLaunchSettlement()
-    startStructuredCodexLaunch(worktreeId, { prompt: 'second prompt' })
+    startStructuredAgentLaunch(worktreeId, 'codex', { prompt: 'second prompt' })
     await flushLaunchSettlement()
 
     expect(mocks.createIntent).toHaveBeenCalledOnce()
@@ -291,7 +339,7 @@ describe('startStructuredCodexLaunch', () => {
       publishedSnapshot(worktreeId, intent.sessionId)
     ])
 
-    startStructuredCodexLaunch(worktreeId)
+    startStructuredAgentLaunch(worktreeId, 'codex')
     await flushLaunchSettlement()
 
     expect(mocks.createIntent).toHaveBeenCalledOnce()
@@ -299,6 +347,47 @@ describe('startStructuredCodexLaunch', () => {
     expect(toast.error).not.toHaveBeenCalled()
   })
 
+  it('does not claim a terminal opened when a definitive refusal fallback only settled', async () => {
+    const worktreeId = 'wt-refused-fallback-toast'
+    const intent = launchIntent(worktreeId)
+    const fallback = vi.fn().mockResolvedValue({ delivered: false, failureNotified: true })
+    mocks.createIntent.mockReturnValueOnce(intent)
+    mocks.launch.mockRejectedValue(new StructuredAgentSessionCreateRefusalError('refused'))
+
+    const launch = startStructuredAgentLaunch(worktreeId, 'codex')
+    void launch.claimDefinitiveRefusalFallback(fallback)
+    await expect(launch.launchResult).rejects.toBeInstanceOf(
+      StructuredAgentSessionCreateRefusalError
+    )
+    await flushLaunchSettlement()
+
+    expect(toast.error).not.toHaveBeenCalled()
+    expect(toast.message).toHaveBeenCalledWith(
+      "Structured chat isn't available",
+      expect.objectContaining({
+        description: 'Orca tried to open a Codex terminal instead.'
+      })
+    )
+  })
+
+  it('keeps the raw error out of the failure toast', async () => {
+    const worktreeId = 'wt-no-raw-error-in-toast'
+    const intent = launchIntent(worktreeId)
+    mocks.createIntent.mockReturnValueOnce(intent)
+    mocks.launch.mockRejectedValue(
+      new Error("EEXIST: file already exists, mkdir '/tmp/o97b/agent-sessions'")
+    )
+    vi.mocked(refreshLocalStructuredSessionTabs).mockResolvedValue([])
+
+    startStructuredAgentLaunch(worktreeId, 'codex')
+    await flushLaunchSettlement()
+
+    expect(toast.error).toHaveBeenCalledOnce()
+    const description = String(vi.mocked(toast.error).mock.calls[0]?.[1]?.description ?? '')
+    expect(description).not.toContain('EEXIST')
+    expect(description).not.toContain('/tmp/')
+  })
+
   it('retries an absent unknown outcome with the exact same intent', async () => {
     const worktreeId = 'wt-same-envelope-retry'
     const intent = launchIntent(worktreeId)
@@ -310,7 +399,7 @@ describe('startStructuredCodexLaunch', () => {
       .mockResolvedValueOnce([])
       .mockResolvedValueOnce([publishedSnapshot(worktreeId, intent.sessionId)])
 
-    startStructuredCodexLaunch(worktreeId)
+    startStructuredAgentLaunch(worktreeId, 'codex')
     await flushLaunchSettlement()
 
     expect(mocks.launch).toHaveBeenCalledTimes(2)
@@ -327,14 +416,14 @@ describe('startStructuredCodexLaunch', () => {
     mocks.launch.mockRejectedValue(new Error('offline'))
     vi.mocked(refreshLocalStructuredSessionTabs).mockResolvedValue([])
 
-    startStructuredCodexLaunch(worktreeId)
+    startStructuredAgentLaunch(worktreeId, 'codex')
     await flushLaunchSettlement()
     expect(toast.error).toHaveBeenCalledOnce()
 
     vi.mocked(refreshLocalStructuredSessionTabs).mockResolvedValue([
       publishedSnapshot(worktreeId, intent.sessionId)
     ])
-    startStructuredCodexLaunch(worktreeId)
+    startStructuredAgentLaunch(worktreeId, 'codex')
     await flushLaunchSettlement()
 
     expect(mocks.createIntent).toHaveBeenCalledOnce()
@@ -357,7 +446,7 @@ describe('startStructuredCodexLaunch', () => {
     })
     vi.mocked(refreshLocalStructuredSessionTabs).mockResolvedValueOnce([]).mockResolvedValueOnce([])
 
-    startStructuredCodexLaunch(worktreeId)
+    startStructuredAgentLaunch(worktreeId, 'codex')
     await flushLaunchSettlement()
 
     expect(mocks.createIntent).toHaveBeenCalledOnce()
@@ -374,7 +463,7 @@ describe('startStructuredCodexLaunch', () => {
     mocks.launch.mockRejectedValue(new Error('offline'))
     vi.mocked(refreshLocalStructuredSessionTabs).mockResolvedValue([])
 
-    const first = startStructuredCodexLaunch(worktreeId, { prompt: 'only once' })
+    const first = startStructuredAgentLaunch(worktreeId, 'codex', { prompt: 'only once' })
     const firstFallbackResult = first.claimDefinitiveRefusalFallback(firstFallback)
     await expect(first.launchResult).rejects.toThrow('offline')
     expect(first.releaseCallerAfterUnknownOutcome()).toBe(true)
@@ -382,7 +471,7 @@ describe('startStructuredCodexLaunch', () => {
     vi.mocked(refreshLocalStructuredSessionTabs).mockResolvedValue([
       publishedSnapshot(worktreeId, intent.sessionId)
     ])
-    const retry = startStructuredCodexLaunch(worktreeId)
+    const retry = startStructuredAgentLaunch(worktreeId, 'codex')
     await expect(retry.launchResult).resolves.toEqual({ sessionId: intent.sessionId, fence: 1 })
 
     await expect(firstFallbackResult).resolves.toBe(false)
@@ -408,7 +497,7 @@ describe('startStructuredCodexLaunch', () => {
     mocks.launch.mockRejectedValue(new Error('offline'))
     vi.mocked(refreshLocalStructuredSessionTabs).mockResolvedValue([])
 
-    const first = startStructuredCodexLaunch(worktreeId)
+    const first = startStructuredAgentLaunch(worktreeId, 'codex')
     const firstFallbackResult = first.claimDefinitiveRefusalFallback(firstFallback)
     await expect(first.launchResult).rejects.toThrow('offline')
     expect(first.releaseCallerAfterUnknownOutcome()).toBe(true)
@@ -416,7 +505,7 @@ describe('startStructuredCodexLaunch', () => {
     mocks.launch.mockRejectedValueOnce(
       new StructuredAgentSessionCreateRefusalError('structured launch disabled')
     )
-    const retry = startStructuredCodexLaunch(worktreeId)
+    const retry = startStructuredAgentLaunch(worktreeId, 'codex')
     const retryFallbackResult = retry.claimDefinitiveRefusalFallback(retryFallback)
 
     await expect(retry.launchResult).rejects.toBeInstanceOf(
@@ -428,6 +517,32 @@ describe('startStructuredCodexLaunch', () => {
     expect(retryFallback).toHaveBeenCalledOnce()
   })
 
+  it('never starts a sibling fallback for a post-attach unknown refusal', async () => {
+    const worktreeId = 'wt-post-attach-unknown'
+    const intent = launchIntent(worktreeId)
+    const fallback = vi.fn()
+    mocks.createIntent.mockReturnValueOnce(intent)
+    mocks.launch.mockRejectedValue(
+      Object.assign(new Error('The chat may already exist.'), {
+        code: 'agent_session_operation_unknown'
+      })
+    )
+    vi.mocked(refreshLocalStructuredSessionTabs).mockResolvedValue([])
+
+    const launch = startStructuredAgentLaunch(worktreeId, 'codex')
+    const fallbackResult = launch.claimDefinitiveRefusalFallback(fallback)
+
+    await expect(launch.launchResult).rejects.toMatchObject({
+      code: 'agent_session_operation_unknown'
+    })
+    expect(launch.isVisibilityUnknown()).toBe(true)
+    expect(launch.releaseCallerAfterUnknownOutcome()).toBe(true)
+    await expect(fallbackResult).resolves.toBe(false)
+    expect(fallback).not.toHaveBeenCalled()
+    expect(mocks.createIntent).toHaveBeenCalledOnce()
+    expect(mocks.launch).toHaveBeenCalledTimes(2)
+  })
+
   it('releases a definitively refused intent so a new click can create a new identity', async () => {
     const worktreeId = 'wt-refused'
     const first = launchIntent(worktreeId, 'session-first')
@@ -440,9 +555,9 @@ describe('startStructuredCodexLaunch', () => {
       publishedSnapshot(worktreeId, second.sessionId)
     ])
 
-    startStructuredCodexLaunch(worktreeId)
+    startStructuredAgentLaunch(worktreeId, 'codex')
     await flushLaunchSettlement()
-    startStructuredCodexLaunch(worktreeId)
+    startStructuredAgentLaunch(worktreeId, 'codex')
     await flushLaunchSettlement()
 
     expect(mocks.createIntent).toHaveBeenCalledTimes(2)
@@ -460,7 +575,7 @@ describe('startStructuredCodexLaunch', () => {
       throw new Error('storage unavailable')
     })
 
-    const result = startStructuredCodexLaunch(worktreeId, { prompt: 'start this task' })
+    const result = startStructuredAgentLaunch(worktreeId, 'codex', { prompt: 'start this task' })
     const fallbackResult = result.claimDefinitiveRefusalFallback(fallback)
 
     await expect(result.launchResult).rejects.toBeInstanceOf(
@@ -481,8 +596,8 @@ describe('startStructuredCodexLaunch', () => {
       () => new Promise((_resolve, reject) => (rejectLaunch = reject))
     )
 
-    const first = startStructuredCodexLaunch(worktreeId, { prompt: 'first prompt' })
-    const second = startStructuredCodexLaunch(worktreeId, { prompt: 'second prompt' })
+    const first = startStructuredAgentLaunch(worktreeId, 'codex', { prompt: 'first prompt' })
+    const second = startStructuredAgentLaunch(worktreeId, 'codex', { prompt: 'second prompt' })
     const firstFallback = vi.fn().mockResolvedValue({
       delivered: true,
       failureNotified: false
@@ -525,9 +640,9 @@ describe('startStructuredCodexLaunch', () => {
       () => new Promise((resolve) => (resolveRefresh = resolve))
     )
 
-    startStructuredCodexLaunch(worktreeId)
+    startStructuredAgentLaunch(worktreeId, 'codex')
     await vi.waitFor(() => expect(refreshLocalStructuredSessionTabs).toHaveBeenCalledOnce())
-    expect(cancelStructuredCodexLaunch(worktreeId, intent.sessionId)).toBe(true)
+    expect(cancelStructuredAgentLaunch(worktreeId, intent.sessionId)).toBe(true)
     resolveRefresh([])
     await flushLaunchSettlement()
 
@@ -546,12 +661,12 @@ describe('startStructuredCodexLaunch', () => {
       () => new Promise((resolve) => (resolveRefresh = resolve))
     )
 
-    startStructuredCodexLaunch(worktreeId, { prompt: 'first prompt' })
-    startStructuredCodexLaunch(worktreeId, { prompt: 'second prompt' })
+    startStructuredAgentLaunch(worktreeId, 'codex', { prompt: 'first prompt' })
+    startStructuredAgentLaunch(worktreeId, 'codex', { prompt: 'second prompt' })
     await vi.waitFor(() => expect(refreshLocalStructuredSessionTabs).toHaveBeenCalledOnce())
     expect(readOutbox(intent.sessionId)).toHaveLength(2)
 
-    expect(cancelStructuredCodexLaunch(worktreeId, intent.sessionId)).toBe(true)
+    expect(cancelStructuredAgentLaunch(worktreeId, intent.sessionId)).toBe(true)
     expect(readOutbox(intent.sessionId)).toEqual([])
     resolveRefresh([])
     await flushLaunchSettlement()
@@ -569,9 +684,9 @@ describe('startStructuredCodexLaunch', () => {
       .mockResolvedValueOnce([])
       .mockImplementationOnce(() => new Promise((resolve) => (resolveRetryRefresh = resolve)))
 
-    startStructuredCodexLaunch(worktreeId)
+    startStructuredAgentLaunch(worktreeId, 'codex')
     await vi.waitFor(() => expect(refreshLocalStructuredSessionTabs).toHaveBeenCalledTimes(2))
-    expect(cancelStructuredCodexLaunch(worktreeId, intent.sessionId)).toBe(true)
+    expect(cancelStructuredAgentLaunch(worktreeId, intent.sessionId)).toBe(true)
     resolveRetryRefresh([])
     await flushLaunchSettlement()
 
diff --git a/src/renderer/src/lib/structured-agent-session-launch.ts b/src/renderer/src/lib/structured-agent-session-launch.ts
index e5e3083e8fd..2a97f6acb36 100644
--- a/src/renderer/src/lib/structured-agent-session-launch.ts
+++ b/src/renderer/src/lib/structured-agent-session-launch.ts
@@ -1,11 +1,13 @@
 import { useSyncExternalStore } from 'react'
 import { toast } from 'sonner'
+import type { AgentSessionHandleProvider } from '../../../shared/agent-session-provider-handle'
+import { getAgentCatalog } from '@/lib/agent-catalog'
 import { translate } from '@/i18n/i18n'
 import {
   abandonStructuredAgentSessionLaunchIntent,
-  createStructuredCodexSessionLaunchIntent,
+  createStructuredAgentSessionLaunchIntent,
   StructuredAgentSessionCreateRefusalError
-} from '@/lib/launch-structured-codex-session'
+} from '@/lib/launch-structured-agent-session'
 import {
   discardStructuredAgentSessionLaunchOutbox,
   enqueueStructuredAgentSessionLaunchPrompt
@@ -14,7 +16,7 @@ import {
   launchAndReconcile,
   reconcileUnknownLaunch,
   StructuredAgentSessionLaunchCancelledError,
-  type StructuredCodexLaunchReceipt,
+  type StructuredAgentLaunchReceipt,
   type StructuredLaunchRecoveryState
 } from '@/lib/structured-agent-session-launch-recovery'
 import type { StructuredPromptDeliveryResult } from '@/lib/structured-agent-session-launch-prompt'
@@ -26,13 +28,13 @@ import {
   settleStructuredLaunchCallersWithFallback,
   settleStructuredLaunchCallersWithoutFallback,
   structuredLaunchCallersHavePendingWork,
-  type StructuredCodexLaunchOptions,
+  type StructuredAgentLaunchOptions,
   type StructuredLaunchCaller,
   type StructuredLaunchCallerGroup,
   type StructuredRefusalFallback
 } from '@/lib/structured-agent-session-launch-callers'
 
-export type { StructuredCodexLaunchOptions, StructuredCodexLaunchReceipt }
+export type { StructuredAgentLaunchOptions, StructuredAgentLaunchReceipt }
 
 type StructuredLaunchState = StructuredLaunchRecoveryState & {
   identity: string
@@ -44,16 +46,20 @@ type StructuredLaunchStateResult = {
   caller: StructuredLaunchCaller
 }
 
-export type StructuredCodexLaunchResult = {
+export type StructuredAgentLaunchResult = {
   sessionId: string
-  launchResult: Promise<StructuredCodexLaunchReceipt>
+  launchResult: Promise<StructuredAgentLaunchReceipt>
   promptDeliveryResult?: Promise<StructuredPromptDeliveryResult>
   isVisibilityUnknown: () => boolean
   releaseCallerAfterUnknownOutcome: () => boolean
   claimDefinitiveRefusalFallback: (fallback: StructuredRefusalFallback) => Promise<boolean>
 }
 
-export type StructuredCodexLaunchStatus = 'idle' | 'pending' | 'unknown'
+export type StructuredAgentLaunchStatus = 'idle' | 'pending' | 'unknown'
+
+function structuredAgentLabel(agent: AgentSessionHandleProvider): string {
+  return getAgentCatalog().find((entry) => entry.id === agent)?.label ?? agent
+}
 
 const pendingStructuredLaunchesByIdentity = new Map<string, StructuredLaunchState>()
 const structuredLaunchListeners = new Set<() => void>()
@@ -64,29 +70,37 @@ function notifyStructuredLaunchListeners(): void {
   }
 }
 
-export function subscribeStructuredCodexLaunchStatus(listener: () => void): () => void {
+export function subscribeStructuredAgentLaunchStatus(listener: () => void): () => void {
   structuredLaunchListeners.add(listener)
   return () => structuredLaunchListeners.delete(listener)
 }
 
-export function getStructuredCodexLaunchStatus(worktreeId: string): StructuredCodexLaunchStatus {
-  const state = pendingStructuredLaunchesByIdentity.get(worktreeId)
+export function getStructuredAgentLaunchStatus(
+  worktreeId: string,
+  agent: AgentSessionHandleProvider
+): StructuredAgentLaunchStatus {
+  const state = pendingStructuredLaunchesByIdentity.get(launchIdentity(worktreeId, agent))
   if (!state) {
     return 'idle'
   }
   return state.visibilityUnknown ? 'unknown' : 'pending'
 }
 
-export function useStructuredCodexLaunchStatus(worktreeId: string): StructuredCodexLaunchStatus {
+export function useStructuredAgentLaunchStatus(
+  worktreeId: string,
+  agent: AgentSessionHandleProvider
+): StructuredAgentLaunchStatus {
   return useSyncExternalStore(
-    subscribeStructuredCodexLaunchStatus,
-    () => getStructuredCodexLaunchStatus(worktreeId),
+    subscribeStructuredAgentLaunchStatus,
+    () => getStructuredAgentLaunchStatus(worktreeId, agent),
     () => 'idle'
   )
 }
 
-function launchIdentity(worktreeId: string): string {
-  return worktreeId
+// Why keyed by agent too: one worktree can hold a Claude and a Codex launch at once, and a shared
+// key would hand the second caller the first agent's intent.
+function launchIdentity(worktreeId: string, agent: AgentSessionHandleProvider): string {
+  return `${agent}:${worktreeId}`
 }
 
 function cleanupLaunchState(state: StructuredLaunchState): void {
@@ -114,7 +128,7 @@ function settleDefinitiveRefusalFallback(state: StructuredLaunchState): void {
 
 function trackLaunchSettlement(
   state: StructuredLaunchState,
-  promise: Promise<StructuredCodexLaunchReceipt>
+  promise: Promise<StructuredAgentLaunchReceipt>
 ): void {
   void promise.then(
     () => {
@@ -146,27 +160,54 @@ function trackLaunchFailureToast(state: StructuredLaunchState): void {
     if (error instanceof StructuredAgentSessionLaunchCancelledError) {
       return
     }
+    const agentLabel = structuredAgentLabel(state.intent.agent)
     if (
       error instanceof StructuredAgentSessionCreateRefusalError &&
       (await state.callers.refusalSettlement.promise.catch(() => false))
     ) {
+      // Why: the callback proves the fallback was attempted, not that its terminal became visible.
+      toast.message(
+        translate(
+          'components.native-chat.structuredSessionFellBackToTerminal',
+          "Structured chat isn't available"
+        ),
+        {
+          description: translate(
+            'components.native-chat.structuredSessionFellBackToTerminalDescription',
+            'Orca tried to open a {{value0}} terminal instead.',
+            { value0: agentLabel }
+          )
+        }
+      )
       return
     }
+    // Why: the raw error carries errnos and absolute paths; it belongs in the log, not the toast.
+    console.warn('[native-chat] structured launch failed', error)
     toast.error(
       translate(
         'components.native-chat.structuredSessionLaunchFailed',
-        'Could not open Codex chat'
+        'Could not open {{value0}} chat',
+        {
+          value0: agentLabel
+        }
       ),
-      { description: error instanceof Error ? error.message : String(error) }
+      {
+        description: translate(
+          'components.native-chat.structuredSessionLaunchFailedDescription',
+          'Orca could not open a structured {{value0}} chat. See the logs for details.',
+          { value0: agentLabel }
+        )
+      }
     )
   })
 }
 
-function structuredCodexLaunchState(
+function structuredAgentLaunchState(
   worktreeId: string,
-  options: StructuredCodexLaunchOptions
+  agent: AgentSessionHandleProvider,
+  options: StructuredAgentLaunchOptions
 ): StructuredLaunchStateResult {
-  const identity = launchIdentity(worktreeId)
+  const identity = launchIdentity(worktreeId, agent)
   const existing = pendingStructuredLaunchesByIdentity.get(identity)
   if (existing) {
     if (existing.visibilityUnknown) {
@@ -192,7 +233,7 @@ function structuredCodexLaunchState(
     }
   }
 
-  const intent = createStructuredCodexSessionLaunchIntent(worktreeId)
+  const intent = createStructuredAgentSessionLaunchIntent(worktreeId, agent)
   const text = options.prompt?.trim() ?? ''
   const stagedPrompt = text
     ? enqueueStructuredAgentSessionLaunchPrompt(intent.sessionId, text)
@@ -212,7 +253,7 @@ function structuredCodexLaunchState(
     text && !stagedPrompt
       ? Promise.reject(
           new StructuredAgentSessionCreateRefusalError(
-            'Could not durably stage the Codex launch prompt.'
+            `Could not durably stage the ${structuredAgentLabel(agent)} launch prompt.`
           )
         )
       : launchAndReconcile(state)
@@ -232,7 +273,7 @@ function structuredCodexLaunchState(
   }
 }
 
-export function cancelStructuredCodexLaunch(worktreeId: string, sessionId: string): boolean {
+export function cancelStructuredAgentLaunch(worktreeId: string, sessionId: string): boolean {
   const state = [...pendingStructuredLaunchesByIdentity.values()].find(
     (candidate) =>
       candidate.intent.worktreeId === worktreeId && candidate.intent.sessionId === sessionId
@@ -249,11 +290,12 @@ export function cancelStructuredCodexLaunch(worktreeId: string, sessionId: strin
   return true
 }
 
-export function startStructuredCodexLaunch(
+export function startStructuredAgentLaunch(
   worktreeId: string,
-  options: StructuredCodexLaunchOptions = {}
-): StructuredCodexLaunchResult {
-  const { state, caller } = structuredCodexLaunchState(worktreeId, options)
+  agent: AgentSessionHandleProvider,
+  options: StructuredAgentLaunchOptions = {}
+): StructuredAgentLaunchResult {
+  const { state, caller } = structuredAgentLaunchState(worktreeId, agent, options)
   return {
     sessionId: state.intent.sessionId,
     launchResult: state.promise,
diff --git a/src/renderer/src/lib/terminal-links.test.ts b/src/renderer/src/lib/terminal-links.test.ts
index 66ff8d870a8..d16e3d3b0cc 100644
--- a/src/renderer/src/lib/terminal-links.test.ts
+++ b/src/renderer/src/lib/terminal-links.test.ts
@@ -115,6 +115,15 @@ describe('terminal path helpers', () => {
   })
 
   describe('extractTerminalFileLinks local path tokens', () => {
+    it('keeps Unicode path segments in the detected range', () => {
+      expect(extractTerminalFileLinks('/tmp/报告.html').map((link) => link.displayText)).toEqual([
+        '/tmp/报告.html'
+      ])
+      expect(
+        extractTerminalFileLinks('docs/café/report.pdf').map((link) => link.displayText)
+      ).toEqual(['docs/café/report.pdf'])
+    })
+
     it('detects tilde-prefixed POSIX paths', () => {
       const links = extractTerminalFileLinks('~/Documents/Path/file_name')
       expect(links).toHaveLength(1)
@@ -215,6 +224,15 @@ describe('terminal path helpers', () => {
       expect(links).toHaveLength(20_000)
       expect(links[0].pathText).toBe('/tmp/Foo Bar/file')
     }, 5_000)
+
+    it('keeps extension-heavy assistant prose on a bounded scan path', () => {
+      const filenames = Array.from({ length: 20_000 }, (_, index) => `report-${index}.txt`)
+      const links = extractTerminalFileLinks(`/tmp/root/${filenames.join(' ')}`)
+
+      expect(links).toHaveLength(2)
+      expect(links[0].pathText).toBe(`/tmp/root/${filenames.slice(0, -1).join(' ')}`)
+      expect(links.at(-1)?.pathText).toBe('report-19999.txt')
+    })
   })
 
   it('supports Windows cwd resolution for terminal file links', () => {
diff --git a/src/renderer/src/lib/terminal-links.ts b/src/renderer/src/lib/terminal-links.ts
index 729f2d839e7..970c6d9208c 100644
--- a/src/renderer/src/lib/terminal-links.ts
+++ b/src/renderer/src/lib/terminal-links.ts
@@ -34,7 +34,7 @@ export type ResolvedTerminalFileLink = Pick<ParsedTerminalFileLink, 'line' | 'co
 // Why: framework route files commonly use punctuation segments like
 // `app/(shop)/products/[id]/page.tsx`; keep those links whole.
 const LOCAL_PATH_REGEX =
-  /(?:~[\\/]|[\\/]|\.{1,2}[\\/]|[A-Za-z]:[\\/]|[A-Za-z0-9._-]+[\\/])[A-Za-z0-9._~\-/%+@\\()[\]]*(?::\d+)?(?::\d+)?/g
+  /(?:~[\\/]|[\\/]|\.{1,2}[\\/]|[A-Za-z]:[\\/]|[\p{L}\p{N}\p{M}._-]+[\\/])[\p{L}\p{N}\p{M}._~\-/%+@\\()[\]]*(?::\d+)?(?::\d+)?/gu
 
 // Matches separator paths whose file or folder names include spaces. This runs
 // before LOCAL_PATH_REGEX so `/Users/A/Foo Bar/file.ts` is claimed as one link
@@ -125,11 +125,18 @@ function trimSpacedPathTrailingProse(
   // prose like "failed to start app.py" must not be swallowed.
   let selected: string | null = null
   const extensionPrefixPattern = /\.[A-Za-z0-9_+-]+(?::\d+)?(?::\d+)?(?=\s+|$)/g
+  const pathStartPattern = /(?:^|\s)(?:~[\\/]|[\\/]|\.{1,2}[\\/]|[A-Za-z]:[\\/])/g
+  let pathStartCount = 0
+  let nextPathStart = pathStartPattern.exec(range.text)
   let match: RegExpExecArray | null
   while ((match = extensionPrefixPattern.exec(range.text)) !== null) {
     const end = match.index + match[0].length
     const text = range.text.slice(0, end)
-    if (countPathStarts(text) > 1) {
+    while (nextPathStart && nextPathStart.index + nextPathStart[0].length <= end) {
+      pathStartCount += 1
+      nextPathStart = pathStartPattern.exec(range.text)
+    }
+    if (pathStartCount > 1) {
       continue
     }
     if (
@@ -150,15 +157,6 @@ function trimSpacedPathTrailingProse(
   }
 }
 
-function countPathStarts(text: string): number {
-  let count = 0
-  for (const match of text.matchAll(/(?:^|\s)(?:~[\\/]|[\\/]|\.{1,2}[\\/]|[A-Za-z]:[\\/])/g)) {
-    void match
-    count += 1
-  }
-  return count
-}
-
 function trimTrailingWhitespace(
   range: DetectedTerminalFileLinkRange
 ): DetectedTerminalFileLinkRange {
diff --git a/src/renderer/src/lib/worktree-activation-emptied-workspace-reseed.test.ts b/src/renderer/src/lib/worktree-activation-emptied-workspace-reseed.test.ts
index 85fa0c0428c..2b85ad88003 100644
--- a/src/renderer/src/lib/worktree-activation-emptied-workspace-reseed.test.ts
+++ b/src/renderer/src/lib/worktree-activation-emptied-workspace-reseed.test.ts
@@ -1,6 +1,10 @@
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import { useAppStore } from '@/store'
-import { activateAndRevealFolderWorkspace, activateAndRevealWorktree } from './worktree-activation'
+import {
+  activateAndRevealFolderWorkspace,
+  activateAndRevealWorkspace,
+  activateAndRevealWorktree
+} from './worktree-activation'
 import { ensureWorktreeHasInitialTerminal } from './worktree-initial-terminal-seeding'
 import { folderWorkspaceKey } from '../../../shared/workspace-scope'
 import { toSshExecutionHostId } from '../../../shared/execution-host'
@@ -202,6 +206,25 @@ function seedEmptiedFolderWorkspaceOnTwoHosts(): void {
 }
 
 describe('activating a folder workspace whose last terminal was closed', () => {
+  it.each(['local', SSH_HOST_ID] as const)(
+    'opens a notification on %s without revealing the folder',
+    (executionHostId) => {
+      seedEmptiedFolderWorkspaceOnTwoHosts()
+      useAppStore.setState({ sidebarBody: 'agents' })
+
+      const result = activateAndRevealWorkspace(FOLDER_KEY, {
+        executionHostId,
+        revealInSidebar: false,
+        clearSidebarFilters: false
+      })
+
+      expect(result).not.toBe(false)
+      expect(useAppStore.getState().activeWorktreeId).toBe(FOLDER_KEY)
+      expect(useAppStore.getState().sidebarBody).toBe('agents')
+      expect(useAppStore.getState().revealWorktreeInSidebar).not.toHaveBeenCalled()
+    }
+  )
+
   it('re-seeds a terminal when the workspace is opened', () => {
     seedEmptiedFolderWorkspaceOnTwoHosts()
 
diff --git a/src/renderer/src/lib/worktree-activation.ts b/src/renderer/src/lib/worktree-activation.ts
index fbb464fda49..22bc909e6b7 100644
--- a/src/renderer/src/lib/worktree-activation.ts
+++ b/src/renderer/src/lib/worktree-activation.ts
@@ -79,6 +79,7 @@ export function activateAndRevealFolderWorkspace(
   folderWorkspaceId: string,
   opts?: {
     sidebarRevealBehavior?: PendingSidebarWorktreeReveal['behavior']
+    revealInSidebar?: boolean
     startup?: WorktreeStartupPayload
     runtimeEnvironmentId?: string | null
     executionHostId?: ExecutionHostId
@@ -163,10 +164,11 @@ export function activateAndRevealFolderWorkspace(
         opts?.providesInitialSurface
       )
 
-  if (opts?.sidebarRevealBehavior) {
-    state.revealWorktreeInSidebar(workspaceKey, { behavior: opts.sidebarRevealBehavior })
-  } else {
-    state.revealWorktreeInSidebar(workspaceKey)
+  if (opts?.revealInSidebar !== false) {
+    state.revealWorktreeInSidebar(
+      workspaceKey,
+      opts?.sidebarRevealBehavior ? { behavior: opts.sidebarRevealBehavior } : undefined
+    )
   }
 
   return { primaryTabId }
@@ -346,8 +348,8 @@ export function activateAndRevealWorkspace(
   opts?: {
     executionHostId?: ExecutionHostId
     providesInitialSurface?: boolean
-    /** Worktree-only: folder workspaces are never filter-hidden, so these are dropped there. */
     revealInSidebar?: boolean
+    /** Worktree-only: folder workspaces are never filter-hidden. */
     clearSidebarFilters?: boolean
   }
 ): ActivateAndRevealResult | false {
@@ -355,8 +357,7 @@ export function activateAndRevealWorkspace(
   if (workspaceScope?.type !== 'folder') {
     return activateAndRevealWorktree(workspaceId, opts)
   }
-  const { revealInSidebar: _reveal, clearSidebarFilters: _clear, ...folderOpts } = opts ?? {}
-  return activateAndRevealFolderWorkspace(workspaceScope.folderWorkspaceId, folderOpts)
+  return activateAndRevealFolderWorkspace(workspaceScope.folderWorkspaceId, opts)
 }
 
 // Why: break the import cycle — nav-history slice (under @/store) can't import activation directly, so register the activator here.
diff --git a/src/renderer/src/lib/worktree-creation-flow-execute.ts b/src/renderer/src/lib/worktree-creation-flow-execute.ts
index b6c48da719c..9b6ba569b1e 100644
--- a/src/renderer/src/lib/worktree-creation-flow-execute.ts
+++ b/src/renderer/src/lib/worktree-creation-flow-execute.ts
@@ -13,6 +13,7 @@ import {
   formatWorkspaceCreateError,
   getWorkspaceCreateErrorToastMessage
 } from '@/lib/workspace-create-error-format'
+import { isAgentSessionHandleProvider } from '../../../shared/agent-session-provider-handle'
 import type { CreateWorktreeResult } from '../../../shared/worktree/create-types'
 import type { WorktreeCreationRequest } from '@/lib/pending-worktree-creation'
 import { createBrowserUuid } from '@/lib/browser-uuid'
@@ -208,7 +209,7 @@ export async function executeWorktreeCreation(
   }
 
   let structuredLaunchAccepted = structuredLaunch
-  if (structuredLaunch && preparedRequest.agent === 'codex') {
+  if (structuredLaunch && isAgentSessionHandleProvider(preparedRequest.agent)) {
     const structuredSession = await launchStructuredWorktreeSession({
       creationId,
       request: preparedRequest,
diff --git a/src/renderer/src/lib/worktree-creation-structured-session.test.ts b/src/renderer/src/lib/worktree-creation-structured-session.test.ts
index 0fc91c18393..c58fcd40dce 100644
--- a/src/renderer/src/lib/worktree-creation-structured-session.test.ts
+++ b/src/renderer/src/lib/worktree-creation-structured-session.test.ts
@@ -6,8 +6,8 @@ const mocks = vi.hoisted(() => ({
   },
   listener: null as ((state: { pendingWorktreeCreations: Record<string, unknown> }) => void) | null,
   unsubscribe: vi.fn(),
-  startStructuredCodexLaunch: vi.fn(),
-  cancelStructuredCodexLaunch: vi.fn(),
+  startStructuredAgentLaunch: vi.fn(),
+  cancelStructuredAgentLaunch: vi.fn(),
   closeStructuredAgentSession: vi.fn(),
   callRuntimeRpc: vi.fn(),
   activateStructuredAgentSessionById: vi.fn()
@@ -26,8 +26,8 @@ vi.mock('@/store', () => ({
 }))
 
 vi.mock('@/lib/structured-agent-session-launch', () => ({
-  startStructuredCodexLaunch: mocks.startStructuredCodexLaunch,
-  cancelStructuredCodexLaunch: mocks.cancelStructuredCodexLaunch
+  startStructuredAgentLaunch: mocks.startStructuredAgentLaunch,
+  cancelStructuredAgentLaunch: mocks.cancelStructuredAgentLaunch
 }))
 
 vi.mock('@/runtime/structured-agent-session-close', () => ({
@@ -58,7 +58,7 @@ vi.mock('@/lib/agent-trust-preflight', () => ({
   preflightAgentTrust: vi.fn()
 }))
 
-vi.mock('@/lib/launch-structured-codex-session', () => ({
+vi.mock('@/lib/launch-structured-agent-session', () => ({
   StructuredAgentSessionCreateRefusalError: class extends Error {}
 }))
 
@@ -78,7 +78,7 @@ describe('launchStructuredWorktreeSession', () => {
     const launchResult = new Promise<{ sessionId: string; fence: number }>((resolve) => {
       resolveLaunch = resolve
     })
-    mocks.startStructuredCodexLaunch.mockReturnValue({
+    mocks.startStructuredAgentLaunch.mockReturnValue({
       sessionId: 'session-1',
       launchResult,
       isVisibilityUnknown: () => false,
@@ -117,7 +117,7 @@ describe('launchStructuredWorktreeSession', () => {
       activation: false,
       primaryTabId: null
     })
-    expect(mocks.cancelStructuredCodexLaunch).toHaveBeenCalledWith('worktree-1', 'session-1')
+    expect(mocks.cancelStructuredAgentLaunch).toHaveBeenCalledWith('worktree-1', 'session-1')
     expect(mocks.closeStructuredAgentSession).toHaveBeenCalledWith({ kind: 'local' }, 'session-1')
     expect(mocks.callRuntimeRpc).toHaveBeenCalledWith({ kind: 'local' }, 'session.tabs.close', {
       worktree: { id: 'worktree-1' },
@@ -130,7 +130,7 @@ describe('launchStructuredWorktreeSession', () => {
 
   it('reports an unknown launch without claiming a visible surface', async () => {
     const releaseCallerAfterUnknownOutcome = vi.fn()
-    mocks.startStructuredCodexLaunch.mockReturnValue({
+    mocks.startStructuredAgentLaunch.mockReturnValue({
       sessionId: 'session-unknown',
       launchResult: Promise.reject(new Error('connection lost')),
       isVisibilityUnknown: () => true,
diff --git a/src/renderer/src/lib/worktree-creation-structured-session.ts b/src/renderer/src/lib/worktree-creation-structured-session.ts
index d163852e3ac..2e2cd07698a 100644
--- a/src/renderer/src/lib/worktree-creation-structured-session.ts
+++ b/src/renderer/src/lib/worktree-creation-structured-session.ts
@@ -2,10 +2,11 @@ import { useAppStore } from '@/store'
 import { ensureWorktreeHasInitialTerminal } from '@/lib/worktree-initial-terminal-seeding'
 import { activateAndRevealWorktree, type ActivateAndRevealResult } from '@/lib/worktree-activation'
 import {
-  cancelStructuredCodexLaunch,
-  startStructuredCodexLaunch
+  cancelStructuredAgentLaunch,
+  startStructuredAgentLaunch
 } from '@/lib/structured-agent-session-launch'
-import { StructuredAgentSessionCreateRefusalError } from '@/lib/launch-structured-codex-session'
+import { StructuredAgentSessionCreateRefusalError } from '@/lib/launch-structured-agent-session'
+import { isAgentSessionHandleProvider } from '../../../shared/agent-session-provider-handle'
 import { activateStructuredAgentSessionById } from '@/lib/structured-agent-session-tab-activation'
 import { preflightAgentTrust } from '@/lib/agent-trust-preflight'
 import type { WorktreeCreationRequest } from '@/lib/pending-worktree-creation'
@@ -48,15 +49,17 @@ export async function launchStructuredWorktreeSession(args: {
   let { activation, primaryTabId } = args
   let accepted = true
   let visibilityUnknown = false
-  if (args.request.agent !== 'codex') {
+  const agent = args.request.agent
+  if (!isAgentSessionHandleProvider(agent)) {
     return { accepted, cancelled: false, visibilityUnknown, activation, primaryTabId }
   }
   if (!useAppStore.getState().pendingWorktreeCreations[args.creationId]) {
     return { accepted, cancelled: true, visibilityUnknown, activation, primaryTabId }
   }
 
-  const launch = startStructuredCodexLaunch(
+  const launch = startStructuredAgentLaunch(
     args.worktreeId,
+    agent,
     args.recoverUnknownLaunch
       ? {}
       : { prompt: args.request.launchDraftPrompt ?? args.request.quickPrompt }
@@ -67,7 +70,7 @@ export async function launchStructuredWorktreeSession(args: {
       return
     }
     cancelled = true
-    cancelStructuredCodexLaunch(args.worktreeId, launch.sessionId)
+    cancelStructuredAgentLaunch(args.worktreeId, launch.sessionId)
   }
   const unsubscribe = useAppStore.subscribe((state) => {
     if (!state.pendingWorktreeCreations[args.creationId]) {
diff --git a/src/renderer/src/renderer-node-builtin-boundary.test.ts b/src/renderer/src/renderer-node-builtin-boundary.test.ts
new file mode 100644
index 00000000000..1cc28bd73af
--- /dev/null
+++ b/src/renderer/src/renderer-node-builtin-boundary.test.ts
@@ -0,0 +1,111 @@
+import { existsSync, readFileSync } from 'node:fs'
+import path from 'node:path'
+import { describe, expect, it } from 'vitest'
+
+/**
+ * The renderer runs sandboxed with contextIsolation: `node:*` builtins do not resolve and even a
+ * bare `process` read throws. A module that reaches one is not a degraded feature — the chunk
+ * fails at evaluation, React never mounts, and the window stays blank with `workspaceSessionReady`
+ * stuck false (#18742 did exactly this by importing one constant out of a `node:child_process`
+ * module). Bundling hides it: the offending module can sit in a shared chunk far from the import
+ * that pulled it in.
+ *
+ * So walk the import graph from every renderer entry — lazy routes included, since a `node:`
+ * builtin behind one is just a blank route instead of a blank app — and refuse any builtin.
+ */
+const RENDERER_SRC = import.meta.dirname
+const REPO_SRC = path.resolve(RENDERER_SRC, '../..')
+const ENTRIES = ['main.tsx', 'popout.tsx', 'web/main.tsx']
+const EXTENSIONS = ['.ts', '.tsx', '.js', '.jsx']
+
+/** `import`/`export ... from` and `import(...)` specifiers, minus type-only ones, which erase. */
+function collectValueImportSpecifiers(source: string): string[] {
+  const specifiers: string[] = []
+  const pattern =
+    /(?:^|[\s;}])(?:import|export)(\s+type\s|\s*\{[^}]*\}|[^'"]*?)?\s*from\s*['"]([^'"]+)['"]|(?:^|[\s;}])import\s*['"]([^'"]+)['"]|import\s*\(\s*['"]([^'"]+)['"]\s*\)/g
+  for (const match of source.matchAll(pattern)) {
+    const clause = match[1] ?? ''
+    const specifier = match[2] ?? match[3] ?? match[4]
+    if (!specifier || /^\s*type\s/.test(clause)) {
+      continue
+    }
+    // A brace clause whose every binding is `type`-prefixed also erases entirely.
+    const bindings = clause.trim().startsWith('{') ? clause.trim().slice(1, -1).split(',') : null
+    if (bindings && bindings.some((b) => b.trim()) && bindings.every((b) => /^\s*type\s/.test(b))) {
+      continue
+    }
+    specifiers.push(specifier)
+  }
+  return specifiers
+}
+
+function resolveModule(specifier: string, fromFile: string): string | null {
+  let base: string
+  if (specifier.startsWith('@renderer/')) {
+    base = path.join(RENDERER_SRC, specifier.slice('@renderer/'.length))
+  } else if (specifier.startsWith('@/')) {
+    base = path.join(RENDERER_SRC, specifier.slice(2))
+  } else if (specifier.startsWith('.')) {
+    base = path.resolve(path.dirname(fromFile), specifier)
+  } else {
+    // Bare package specifiers are npm dependencies, not first-party source.
+    return null
+  }
+  for (const candidate of [
+    ...EXTENSIONS.map((ext) => `${base}${ext}`),
+    ...EXTENSIONS.map((ext) => path.join(base, `index${ext}`))
+  ]) {
+    if (existsSync(candidate)) {
+      return candidate
+    }
+  }
+  return null
+}
+
+function walkRendererImportGraph(): Map<string, string[]> {
+  /** file -> the chain of first-party importers that reached it, entry first. */
+  const pathToFile = new Map<string, string[]>()
+  const queue: string[] = []
+  for (const entry of ENTRIES) {
+    const file = path.join(RENDERER_SRC, entry)
+    pathToFile.set(file, [file])
+    queue.push(file)
+  }
+  while (queue.length > 0) {
+    const file = queue.shift() as string
+    const chain = pathToFile.get(file) as string[]
+    for (const specifier of collectValueImportSpecifiers(readFileSync(file, 'utf8'))) {
+      const resolved = resolveModule(specifier, file)
+      if (!resolved || pathToFile.has(resolved)) {
+        continue
+      }
+      pathToFile.set(resolved, [...chain, resolved])
+      queue.push(resolved)
+    }
+  }
+  return pathToFile
+}
+
+describe('renderer node-builtin boundary', () => {
+  it('reaches no module that imports a node: builtin', () => {
+    const graph = walkRendererImportGraph()
+    const offenders: string[] = []
+    for (const [file, chain] of graph) {
+      const builtins = collectValueImportSpecifiers(readFileSync(file, 'utf8')).filter(
+        (specifier) => specifier.startsWith('node:')
+      )
+      if (builtins.length === 0) {
+        continue
+      }
+      const relativeChain = chain.map((step) => path.relative(REPO_SRC, step)).join('\n    -> ')
+      offenders.push(`${builtins.join(', ')} via\n    ${relativeChain}`)
+    }
+    expect(offenders.join('\n\n')).toBe('')
+  })
+
+  it('walks a real graph, so an empty offender list means something', () => {
+    const graph = walkRendererImportGraph()
+    expect(graph.size).toBeGreaterThan(3_000)
+    expect(graph.has(path.join(REPO_SRC, 'shared/process-table-snapshot.ts'))).toBe(true)
+  })
+})
diff --git a/src/renderer/src/runtime/__fixtures__/web-session-terminal-orphan-recovery-regression-fixtures.ts b/src/renderer/src/runtime/__fixtures__/web-session-terminal-orphan-recovery-regression-fixtures.ts
index 3f4860f2302..da9d55bca1d 100644
--- a/src/renderer/src/runtime/__fixtures__/web-session-terminal-orphan-recovery-regression-fixtures.ts
+++ b/src/renderer/src/runtime/__fixtures__/web-session-terminal-orphan-recovery-regression-fixtures.ts
@@ -96,7 +96,9 @@ export function listResult(
     totalCount: terminals.length,
     truncated: options.truncated ?? false,
     ...(options.hostScope === undefined
-      ? { hostScope: { hostIds: [ENVIRONMENT_ID], omittedHostIds: [] } }
+      ? // A host names the execution hosts it covered, not its own environment id: answering
+        // `terminal.list` on a paired runtime reports `local` (verified against a live runtime).
+        { hostScope: { hostIds: ['local'], omittedHostIds: [] } }
       : { hostScope: options.hostScope })
   }
 }
diff --git a/src/renderer/src/runtime/host-live-terminal-probe.ts b/src/renderer/src/runtime/host-live-terminal-probe.ts
index 8e5d8a14539..94c29c1e6cc 100644
--- a/src/renderer/src/runtime/host-live-terminal-probe.ts
+++ b/src/renderer/src/runtime/host-live-terminal-probe.ts
@@ -1,5 +1,6 @@
 import type { RuntimeTerminalListResult } from '../../../shared/runtime-types'
 import type { RuntimeRpcResponse } from '../../../shared/runtime-rpc-envelope'
+import { hostScopeCensusIsComplete } from '../../../shared/runtime-listing-host-scope'
 
 /**
  * Asks the host whether ANY terminal is live in an environment, for the one
@@ -74,10 +75,12 @@ async function probeHost(
   if (response.ok === false || !isTerminalListResult(response.result)) {
     return 'unverifiable'
   }
-  // An omitted execution host is an incomplete census. In particular, a relay
-  // can list its local PTYs while an SSH child host is still starting up.
+  // A host this listing owed coverage for and did not deliver leaves an incomplete census — a
+  // relay can list its local PTYs while an SSH child host is still starting up. A peer runtime
+  // is not such a host: it answers `--environment` for itself, and reading its disclosure entry
+  // as a gap latched this probe forever (#18595).
   const hostScope = response.result.hostScope
-  if (hostScope && hostScope.omittedHostIds.length > 0) {
+  if (hostScope && !hostScopeCensusIsComplete(hostScope)) {
     return 'unverifiable'
   }
   const { terminals, totalCount } = response.result
diff --git a/src/renderer/src/runtime/host-session-mirror-empty-inventory-settle.test.ts b/src/renderer/src/runtime/host-session-mirror-empty-inventory-settle.test.ts
index 8c815968eec..fcbd0c5dc0d 100644
--- a/src/renderer/src/runtime/host-session-mirror-empty-inventory-settle.test.ts
+++ b/src/renderer/src/runtime/host-session-mirror-empty-inventory-settle.test.ts
@@ -335,6 +335,89 @@ describe('empty host inventory settling the session mirror', () => {
     expect(hasHostSessionMirrorHydrated(environmentId, WORKTREE)).toBe(true)
   })
 
+  // #18595, the reporter's shape: the answering host holds a mirrored row for a peer runtime, so
+  // that peer is named in `omittedHostIds` for every listing it will ever give. Reading the
+  // disclosure list as the gate made this probe permanently `unverifiable`, the mirror never
+  // hydrated, and every remote pane parked forever.
+  it('settles on a peer runtime it disclosed but never owed coverage for', async () => {
+    const result = await probeHostLiveTerminals(
+      'env-peer-disclosed',
+      vi.fn(async () => ({
+        id: 'peer-disclosed',
+        ok: true as const,
+        result: {
+          terminals: [],
+          totalCount: 0,
+          truncated: false,
+          hostScope: { hostIds: ['local'], omittedHostIds: ['runtime:env-peer'] }
+        },
+        _meta: { runtimeId: 'runtime' }
+      }))
+    )
+
+    expect(result).toBe('none')
+  })
+
+  it('reports a live terminal through a peer-runtime disclosure', async () => {
+    const result = await probeHostLiveTerminals(
+      'env-peer-live',
+      vi.fn(async () => ({
+        id: 'peer-live',
+        ok: true as const,
+        result: {
+          terminals: [{ handle: 'terminal-1' }],
+          totalCount: 1,
+          truncated: false,
+          hostScope: { hostIds: ['local'], omittedHostIds: ['runtime:env-peer'] }
+        },
+        _meta: { runtimeId: 'runtime' }
+      }))
+    )
+
+    expect(result).toBe('live')
+  })
+
+  it('stays unverifiable for an SSH host the answering runtime did owe coverage for', async () => {
+    const result = await probeHostLiveTerminals(
+      'env-ssh-gap',
+      vi.fn(async () => ({
+        id: 'ssh-gap',
+        ok: true as const,
+        result: {
+          terminals: [],
+          totalCount: 0,
+          truncated: false,
+          hostScope: { hostIds: ['local'], omittedHostIds: ['ssh:box-1'] }
+        },
+        _meta: { runtimeId: 'runtime' }
+      }))
+    )
+
+    expect(result).toBe('unverifiable')
+  })
+
+  // A worktree-scoped listing whose target is a runtime host covers nothing and names `local`
+  // among its omissions. `local` is what keeps this unverifiable — the point is that the
+  // runtime-only rule does not rescue a listing that answered for nothing.
+  it('stays unverifiable when the listing covered no host at all', async () => {
+    const result = await probeHostLiveTerminals(
+      'env-covered-nothing',
+      vi.fn(async () => ({
+        id: 'covered-nothing',
+        ok: true as const,
+        result: {
+          terminals: [],
+          totalCount: 0,
+          truncated: false,
+          hostScope: { hostIds: [], omittedHostIds: ['local', 'runtime:env-peer'] }
+        },
+        _meta: { runtimeId: 'runtime' }
+      }))
+    )
+
+    expect(result).toBe('unverifiable')
+  })
+
   it('rejects a present malformed host scope as unverifiable', async () => {
     const result = await probeHostLiveTerminals(
       'env-malformed-scope',
diff --git a/src/renderer/src/runtime/local-structured-session-retired-epoch-repair.test.ts b/src/renderer/src/runtime/local-structured-session-retired-epoch-repair.test.ts
new file mode 100644
index 00000000000..95edbadbf58
--- /dev/null
+++ b/src/renderer/src/runtime/local-structured-session-retired-epoch-repair.test.ts
@@ -0,0 +1,198 @@
+/**
+ * A live publisher can return to a worktree after another one briefly owned it, and the epoch it
+ * returns under is already in `retired`. The fence rejects that frame — correctly, because it
+ * cannot tell it apart from a delayed frame queued by a dead generation — so the drop has to be
+ * repaired from authority instead of being final.
+ *
+ * The sequence below is the measured one: a renderer publication, a `removed:` retraction, a
+ * headless rebuild whose version restarts at 1, then the same renderer epoch returning at a higher
+ * version carrying a newly published chat tab.
+ */
+
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { RuntimeMobileSessionTabsResult } from '../../../shared/runtime-types'
+import type { Tab } from '../../../shared/tab-types'
+import {
+  applyLocalStructuredSessionTabSnapshots,
+  resetLocalStructuredSessionVersionForTests
+} from './local-structured-session-tabs-sync'
+import { localStructuredSessionEpochHistoryByWorktree } from './local-structured-session-tabs-sync/inventory-generation-fence'
+import type { WebSessionTabsSyncState } from './web-session-tabs-sync'
+import { resetWebSessionFocusIntentForTests } from './web-session-focus-intent'
+
+const WORKTREE = 'folder:ws-1'
+const ROOT_GROUP = 'local-root-group'
+const RENDERER_EPOCH = 'renderer:53c8f87d'
+const HEADLESS_EPOCH = 'headless:pty-backed:mtovsn3x'
+const REMOVED_EPOCH = 'removed:mtovryl4'
+
+afterEach(() => {
+  resetWebSessionFocusIntentForTests()
+  resetLocalStructuredSessionVersionForTests()
+})
+
+/**
+ * The worktree must stay "known" or the trailing cursor sweep deletes its epoch history every
+ * round and nothing ever accumulates in `retired` — which makes this whole scenario vacuous.
+ */
+function stateWithCoordinatorTerminal(): WebSessionTabsSyncState {
+  const terminalTab: Tab = {
+    id: 'u-term-1',
+    entityId: 'term-1',
+    groupId: ROOT_GROUP,
+    worktreeId: WORKTREE,
+    contentType: 'terminal',
+    label: 'Terminal 1',
+    customLabel: null,
+    color: null,
+    sortOrder: 0,
+    createdAt: 1
+  }
+  return {
+    activeBrowserTabId: null,
+    activeBrowserTabIdByWorktree: {},
+    activeFileId: null,
+    activeFileIdByWorktree: {},
+    activeGroupIdByWorktree: { [WORKTREE]: ROOT_GROUP },
+    activeTabId: 'u-term-1',
+    activeTabIdByWorktree: { [WORKTREE]: 'u-term-1' },
+    activeTabType: 'terminal',
+    activeTabTypeByWorktree: { [WORKTREE]: 'terminal' },
+    activeWorktreeId: WORKTREE,
+    agentStatusByPaneKey: {},
+    agentStatusEpoch: 0,
+    browserCertificateFailuresByPageId: {},
+    browserPagesByWorkspace: {},
+    browserTabsByWorktree: {},
+    folderWorkspaces: [{ id: 'ws-1', name: 'ws', folderPath: '/tmp/ws' }],
+    groupsByWorktree: {
+      [WORKTREE]: [
+        { id: ROOT_GROUP, worktreeId: WORKTREE, activeTabId: 'u-term-1', tabOrder: ['u-term-1'] }
+      ]
+    },
+    layoutByWorktree: { [WORKTREE]: { type: 'leaf', groupId: ROOT_GROUP } },
+    openFiles: [],
+    ptyIdsByTabId: { 'term-1': ['pty-1'] },
+    remoteBrowserPageHandlesByPageId: {},
+    tabBarOrderByWorktree: {},
+    tabsByWorktree: {},
+    terminalLayoutsByTabId: {},
+    unifiedTabsByWorktree: { [WORKTREE]: [terminalTab] },
+    unreadTerminalTabs: {},
+    sortEpoch: 0
+  } as unknown as WebSessionTabsSyncState
+}
+
+function frame(
+  publicationEpoch: string,
+  snapshotVersion: number,
+  sessionId: string | null
+): RuntimeMobileSessionTabsResult {
+  const id = sessionId ? `agent-session:${sessionId}` : null
+  return {
+    worktree: WORKTREE,
+    publicationEpoch,
+    snapshotVersion,
+    activeGroupId: ROOT_GROUP,
+    activeTabId: null,
+    activeTabType: null,
+    tabGroups: [{ id: ROOT_GROUP, activeTabId: null, tabOrder: id ? [id] : [] }],
+    tabs: id
+      ? [
+          {
+            type: 'agent-session',
+            id,
+            title: 'Claude Chat',
+            sessionId,
+            agent: 'claude',
+            isActive: false
+          }
+        ]
+      : []
+  } as RuntimeMobileSessionTabsResult
+}
+
+function chatTabs(state: WebSessionTabsSyncState): string[] {
+  return (state.unifiedTabsByWorktree[WORKTREE] ?? [])
+    .filter((tab) => tab.contentType === 'agent-session')
+    .map((tab) => tab.label)
+}
+
+/** Everything up to and including the drop; returns the state the repair has to fix. */
+function replayUntilDrop(
+  onRetiredEpochDrop?: (worktreeId: string, publicationEpoch: string) => void
+): WebSessionTabsSyncState {
+  let state = stateWithCoordinatorTerminal()
+  state = applyLocalStructuredSessionTabSnapshots(state, [frame(RENDERER_EPOCH, 6, null)])
+  state = applyLocalStructuredSessionTabSnapshots(state, [frame(REMOVED_EPOCH, 0, null)])
+  state = applyLocalStructuredSessionTabSnapshots(state, [frame(HEADLESS_EPOCH, 1, null)])
+  return applyLocalStructuredSessionTabSnapshots(
+    state,
+    [frame(RENDERER_EPOCH, 7, 'claude-1')],
+    undefined,
+    undefined,
+    onRetiredEpochDrop ? { onRetiredEpochDrop } : {}
+  )
+}
+
+describe('retired-epoch repair for a returning publisher', () => {
+  it('POSITIVE CONTROL: the same frame lands when no epoch has been retired', () => {
+    const applied = applyLocalStructuredSessionTabSnapshots(stateWithCoordinatorTerminal(), [
+      frame(RENDERER_EPOCH, 7, 'claude-1')
+    ])
+
+    expect(chatTabs(applied)).toEqual(['Claude Chat'])
+  })
+
+  it('drops the returning publisher and reports it to the repair lane', () => {
+    const onRetiredEpochDrop = vi.fn()
+
+    const dropped = replayUntilDrop(onRetiredEpochDrop)
+
+    expect(chatTabs(dropped)).toEqual([])
+    expect(onRetiredEpochDrop).toHaveBeenCalledWith(WORKTREE, RENDERER_EPOCH)
+  })
+
+  it('lands the tab when the authoritative census re-delivers the same frame', () => {
+    const dropped = replayUntilDrop()
+    expect(chatTabs(dropped)).toEqual([])
+
+    const repaired = applyLocalStructuredSessionTabSnapshots(
+      dropped,
+      [frame(RENDERER_EPOCH, 7, 'claude-1')],
+      undefined,
+      undefined,
+      { authoritative: true }
+    )
+
+    expect(chatTabs(repaired)).toEqual(['Claude Chat'])
+  })
+
+  it('a non-authoritative redelivery stays dropped, so only authority repairs it', () => {
+    const dropped = replayUntilDrop()
+
+    const redelivered = applyLocalStructuredSessionTabSnapshots(dropped, [
+      frame(RENDERER_EPOCH, 7, 'claude-1')
+    ])
+
+    expect(chatTabs(redelivered)).toEqual([])
+  })
+
+  it('revives only the epoch authority names, leaving other generations fenced', () => {
+    const dropped = replayUntilDrop()
+    applyLocalStructuredSessionTabSnapshots(
+      dropped,
+      [frame(RENDERER_EPOCH, 7, 'claude-1')],
+      undefined,
+      undefined,
+      { authoritative: true }
+    )
+
+    // The census named the renderer epoch current, so the headless generation it displaced is now
+    // the retired one — and a delayed frame from it must still be rejected.
+    const history = localStructuredSessionEpochHistoryByWorktree.get(WORKTREE)
+    expect(history?.current).toBe(RENDERER_EPOCH)
+    expect(history?.retired).toContain(HEADLESS_EPOCH)
+    expect(history?.retired).not.toContain(RENDERER_EPOCH)
+  })
+})
diff --git a/src/renderer/src/runtime/local-structured-session-reveal-visibility.test.ts b/src/renderer/src/runtime/local-structured-session-reveal-visibility.test.ts
new file mode 100644
index 00000000000..181ec3ebe27
--- /dev/null
+++ b/src/renderer/src/runtime/local-structured-session-reveal-visibility.test.ts
@@ -0,0 +1,206 @@
+// @vitest-environment happy-dom
+
+/**
+ * Reopening a closed chat has to survive the frames the reopen itself provokes.
+ *
+ * The renderer publishes under one epoch string for its whole lifetime, so a frame recorded under
+ * a different lineage retires that epoch permanently — and the click that reopens a chat asks the
+ * host for an inventory first, which answers `none`/v0 for a worktree it holds no entry for. That
+ * answer used to be recorded, retiring the renderer's own epoch and dropping the republished tab
+ * that arrived moments later. The chat only reappeared after a reload minted a new epoch.
+ */
+
+import { afterEach, describe, expect, it } from 'vitest'
+import { UNPUBLISHED_WORKTREE_PUBLICATION_EPOCH } from '../../../shared/runtime-types'
+import type { RuntimeMobileSessionTabsResult } from '../../../shared/runtime-types'
+import type { WorktreeRuntimeOwnerState } from '../lib/worktree-runtime-owner'
+import {
+  applyLocalStructuredSessionTabSnapshots,
+  resetLocalStructuredSessionVersionForTests
+} from './local-structured-session-tabs-sync'
+import type { WebSessionTabsSyncState } from './web-session-tabs-sync'
+import { resetWebSessionTabsSnapshotFreshnessForTests } from './web-session-tabs-sync'
+
+const WORKTREE = 'repo-1::/tmp/wt-reveal'
+const HOST_TAB_ID = 'agent-session:codex-reveal-1'
+// The projection renames a host tab id into the renderer's own namespace.
+const SESSION_TAB = 'structured-agent-session-codex-reveal-1'
+// One string for the renderer's whole lifetime, which is exactly why retiring it is unrecoverable.
+const RENDERER_EPOCH = 'renderer:11111111-2222-3333-4444-555555555555'
+
+type SyncState = WebSessionTabsSyncState & WorktreeRuntimeOwnerState
+
+afterEach(() => {
+  resetLocalStructuredSessionVersionForTests()
+  resetWebSessionTabsSnapshotFreshnessForTests()
+})
+
+function baseState(): SyncState {
+  return {
+    activeBrowserTabId: null,
+    activeBrowserTabIdByWorktree: {},
+    activeFileId: null,
+    activeFileIdByWorktree: {},
+    activeGroupIdByWorktree: {},
+    activeTabId: null,
+    activeTabIdByWorktree: {},
+    activeTabType: 'terminal',
+    activeTabTypeByWorktree: {},
+    activeWorktreeId: WORKTREE,
+    agentStatusByPaneKey: {},
+    agentStatusEpoch: 0,
+    browserCertificateFailuresByPageId: {},
+    browserPagesByWorkspace: {},
+    browserTabsByWorktree: {},
+    groupsByWorktree: {},
+    layoutByWorktree: {},
+    openFiles: [],
+    ptyIdsByTabId: {},
+    remoteBrowserPageHandlesByPageId: {},
+    tabBarOrderByWorktree: {},
+    tabsByWorktree: {},
+    terminalLayoutsByTabId: {},
+    unifiedTabsByWorktree: {},
+    unreadTerminalTabs: {},
+    sortEpoch: 0,
+    // Required: without a catalog entry the trailing cleanup deletes the cursor and hides the bug.
+    worktreesByRepo: { 'repo-1': [{ id: WORKTREE, path: '/tmp/wt-reveal' }] }
+  } as unknown as SyncState
+}
+
+function chatFrame(epoch: string, version: number): RuntimeMobileSessionTabsResult {
+  return {
+    worktree: WORKTREE,
+    publicationEpoch: epoch,
+    snapshotVersion: version,
+    activeGroupId: `headless-terminals:${WORKTREE}`,
+    activeTabId: HOST_TAB_ID,
+    activeTabType: 'agent-session',
+    tabs: [
+      {
+        type: 'agent-session',
+        id: HOST_TAB_ID,
+        title: 'Codex Chat',
+        sessionId: 'codex-reveal-1',
+        agent: 'codex',
+        isActive: true
+      }
+    ]
+  } as unknown as RuntimeMobileSessionTabsResult
+}
+
+function emptyFrame(epoch: string, version: number): RuntimeMobileSessionTabsResult {
+  return {
+    worktree: WORKTREE,
+    publicationEpoch: epoch,
+    snapshotVersion: version,
+    activeGroupId: null,
+    activeTabId: null,
+    activeTabType: null,
+    tabs: []
+  } as unknown as RuntimeMobileSessionTabsResult
+}
+
+function apply(state: SyncState, snapshot: RuntimeMobileSessionTabsResult): SyncState {
+  return applyLocalStructuredSessionTabSnapshots(state, [snapshot])
+}
+
+function chatTabIds(state: SyncState): string[] {
+  return (state.unifiedTabsByWorktree[WORKTREE] ?? [])
+    .filter((tab) => tab.contentType === 'agent-session')
+    .map((tab) => tab.id)
+}
+
+describe('a revealed chat survives the frames the reveal provokes', () => {
+  it('reopens after the click asks an unpublished worktree for its inventory', () => {
+    let state = apply(baseState(), chatFrame(RENDERER_EPOCH, 120))
+    expect(chatTabIds(state)).toHaveLength(1)
+
+    state = apply(state, emptyFrame(RENDERER_EPOCH, 121)) // the user closes the chat
+    expect(chatTabIds(state)).toEqual([])
+
+    // The Resume click's own `session.tabs.list`: the host holds no entry, so it answers the
+    // sentinel. Recording it retired the renderer's epoch and poisoned the reveal that follows.
+    state = apply(state, emptyFrame(UNPUBLISHED_WORKTREE_PUBLICATION_EPOCH, 0))
+
+    state = apply(state, chatFrame(RENDERER_EPOCH, 122)) // reveal republishes
+
+    expect(chatTabIds(state)).toEqual([SESSION_TAB])
+  })
+
+  it('reopens after the host pruned and rebuilt its entry for the worktree', () => {
+    // Closing the last chat prunes the host's entry, which emits a retraction. Recording that
+    // retired the renderer's epoch for good. The rebuild publishes under a fresh epoch at v1 —
+    // what `publishStructuredAgentSessionTab` mints when it finds no existing entry.
+    let state = apply(baseState(), chatFrame(RENDERER_EPOCH, 120))
+    state = apply(state, emptyFrame(RENDERER_EPOCH, 121))
+
+    state = apply(state, { ...emptyFrame('removed:abc', 0), removed: true } as never)
+    state = apply(state, chatFrame('structured:mf3k1', 1))
+
+    expect(chatTabIds(state)).toEqual([SESSION_TAB])
+  })
+
+  it('does not let a frame from before the retraction strand a row', () => {
+    // The retraction keeps its cursor precisely so a `session.tabs.list` response issued before
+    // the close cannot land afterwards and leave a chat on screen that nothing republishes.
+    let state = apply(baseState(), chatFrame(RENDERER_EPOCH, 120))
+    state = apply(state, emptyFrame(RENDERER_EPOCH, 121))
+    state = apply(state, { ...emptyFrame('removed:abc', 0), removed: true } as never)
+
+    state = apply(state, chatFrame(RENDERER_EPOCH, 119)) // in flight since before the close
+
+    expect(chatTabIds(state)).toEqual([])
+  })
+
+  it('does not retire the renderer\u2019s own epoch when a reveal republishes under a new one', () => {
+    // The consumer is also the publisher here. If the retraction leaves its epoch history behind,
+    // recording the reveal's fresh epoch retires the renderer's own, and the NEXT chat it
+    // publishes under that epoch is dropped — the same symptom, one cycle later.
+    let state = apply(baseState(), chatFrame(RENDERER_EPOCH, 120))
+    state = apply(state, emptyFrame(RENDERER_EPOCH, 121))
+    state = apply(state, { ...emptyFrame('removed:abc', 0), removed: true } as never)
+    state = apply(state, chatFrame('structured:mf3k1', 1)) // reveal, fresh lineage
+
+    state = apply(state, emptyFrame('structured:mf3k1', 2)) // closed again
+    state = apply(state, chatFrame(RENDERER_EPOCH, 130)) // renderer publishes a new chat
+
+    expect(chatTabIds(state)).toEqual([SESSION_TAB])
+  })
+
+  it('still fences a delayed frame from an epoch that was already superseded', () => {
+    // The retraction keeps its tombstones. The version cursor only fences within a lineage, so
+    // without them a straggler under a long-dead epoch would put a chat row back on screen for a
+    // worktree the host no longer publishes.
+    let state = apply(baseState(), chatFrame('structured:old', 5))
+    state = apply(state, chatFrame(RENDERER_EPOCH, 120)) // retires structured:old
+    state = apply(state, emptyFrame(RENDERER_EPOCH, 121))
+    state = apply(state, { ...emptyFrame('removed:abc', 0), removed: true } as never)
+
+    state = apply(state, chatFrame('structured:old', 6)) // straggler from the dead epoch
+
+    expect(chatTabIds(state)).toEqual([])
+  })
+
+  it('still prunes the mirrored rows when the host retracts the worktree', () => {
+    // The retraction must not merely stop fencing later frames — it has to take the rows with it,
+    // or a worktree the host no longer publishes keeps a chat on screen that nothing backs.
+    let state = apply(baseState(), chatFrame(RENDERER_EPOCH, 120))
+    expect(chatTabIds(state)).toEqual([SESSION_TAB])
+
+    state = apply(state, { ...chatFrame('removed:abc', 0), tabs: [], removed: true } as never)
+
+    expect(chatTabIds(state)).toEqual([])
+  })
+
+  it('still ignores a genuinely superseded republication', () => {
+    // The fences exist for a reason: without an intervening non-publication frame, an older
+    // version under the same lineage must still lose.
+    let state = apply(baseState(), chatFrame(RENDERER_EPOCH, 120))
+    state = apply(state, emptyFrame(RENDERER_EPOCH, 121))
+
+    state = apply(state, chatFrame(RENDERER_EPOCH, 9))
+
+    expect(chatTabIds(state)).toEqual([])
+  })
+})
diff --git a/src/renderer/src/runtime/local-structured-session-tabs-sync.ts b/src/renderer/src/runtime/local-structured-session-tabs-sync.ts
index 722bd93af8b..79ca334d07a 100644
--- a/src/renderer/src/runtime/local-structured-session-tabs-sync.ts
+++ b/src/renderer/src/runtime/local-structured-session-tabs-sync.ts
@@ -3,7 +3,11 @@ import { useAppStore } from '../store'
 import { clearLocalStructuredSessionTabs } from './local-structured-session-tabs-sync/snapshot-apply'
 import { startLocalStructuredSessionTabsSync } from './local-structured-session-tabs-sync/subscription'
 
-export { resetLocalStructuredSessionVersionForTests } from './local-structured-session-tabs-sync/inventory-generation-fence'
+export {
+  isCurrentLocalStructuredSessionGeneration,
+  localStructuredSessionGeneration,
+  resetLocalStructuredSessionVersionForTests
+} from './local-structured-session-tabs-sync/inventory-generation-fence'
 export {
   refreshLocalStructuredSessionTabs,
   restoreLocalStructuredSessionTabsOnce
diff --git a/src/renderer/src/runtime/local-structured-session-tabs-sync/inventory-refresh.ts b/src/renderer/src/runtime/local-structured-session-tabs-sync/inventory-refresh.ts
index af756458707..136e4fa2e30 100644
--- a/src/renderer/src/runtime/local-structured-session-tabs-sync/inventory-refresh.ts
+++ b/src/renderer/src/runtime/local-structured-session-tabs-sync/inventory-refresh.ts
@@ -21,9 +21,13 @@ export function restoreLocalStructuredSessionTabsOnce(
   )
 }
 
-/** Fetch the current host inventory even after the startup restore has settled. */
+/** Fetch the current host inventory even after the startup restore has settled.
+ *
+ *  `authoritative` is opt-in and belongs to the repair lane alone: the startup restore stays
+ *  fenced exactly as before, so nothing about first paint changes. */
 export function refreshLocalStructuredSessionTabs(
-  expectedGeneration = localStructuredSessionGeneration()
+  expectedGeneration = localStructuredSessionGeneration(),
+  options: { authoritative?: boolean } = {}
 ): Promise<RuntimeMobileSessionTabsResult[]> {
   return window.api.runtime
     .call({ method: 'session.tabs.listAll', params: {} })
@@ -34,7 +38,7 @@ export function refreshLocalStructuredSessionTabs(
       const result = response.result as { snapshots?: RuntimeMobileSessionTabsResult[] }
       const snapshots = result.snapshots ?? []
       if (isCurrentLocalStructuredSessionGeneration(expectedGeneration)) {
-        applyStructuredSessionTabSnapshots(snapshots)
+        applyStructuredSessionTabSnapshots(snapshots, undefined, options)
       }
       return snapshots
     })
diff --git a/src/renderer/src/runtime/local-structured-session-tabs-sync/retired-epoch-repair.test.ts b/src/renderer/src/runtime/local-structured-session-tabs-sync/retired-epoch-repair.test.ts
new file mode 100644
index 00000000000..563a7c3598b
--- /dev/null
+++ b/src/renderer/src/runtime/local-structured-session-tabs-sync/retired-epoch-repair.test.ts
@@ -0,0 +1,121 @@
+/**
+ * The repair lane must not become worse than the bug it fixes: a publisher that keeps re-sending a
+ * retired epoch would otherwise drive an unbounded refetch loop, and a cap that never decays would
+ * hide a chat tab for the renderer's lifetime after a run of transient RPC failures.
+ */
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { localStructuredSessionEpochHistoryByWorktree } from './inventory-generation-fence'
+import {
+  forgetRetiredEpochRepairsOutside,
+  resetRetiredEpochRepairsForTests,
+  scheduleRetiredEpochRepair
+} from './retired-epoch-repair'
+
+const WORKTREE = 'folder:ws-1'
+const EPOCH = 'renderer:53c8f87d'
+
+const runRepair = vi.fn(async (_generation: number) => undefined)
+
+function markRetired(): void {
+  localStructuredSessionEpochHistoryByWorktree.set(WORKTREE, {
+    current: 'headless:pty-backed:x',
+    retired: [EPOCH]
+  })
+}
+
+beforeEach(() => {
+  vi.useFakeTimers()
+  runRepair.mockReset()
+  runRepair.mockImplementation(async () => undefined)
+  resetRetiredEpochRepairsForTests()
+  localStructuredSessionEpochHistoryByWorktree.clear()
+})
+
+afterEach(() => {
+  resetRetiredEpochRepairsForTests()
+  localStructuredSessionEpochHistoryByWorktree.clear()
+  vi.useRealTimers()
+})
+
+describe('retired-epoch repair scheduling', () => {
+  it('asks the host once for a burst of drops on one worktree', async () => {
+    markRetired()
+
+    scheduleRetiredEpochRepair(WORKTREE, EPOCH, runRepair)
+    scheduleRetiredEpochRepair(WORKTREE, EPOCH, runRepair)
+    scheduleRetiredEpochRepair(WORKTREE, EPOCH, runRepair)
+    expect(runRepair).not.toHaveBeenCalled()
+
+    await vi.advanceTimersByTimeAsync(300)
+
+    expect(runRepair).toHaveBeenCalledTimes(1)
+  })
+
+  it('stops after a bounded number of attempts and says so', async () => {
+    markRetired()
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+
+    // The epoch stays retired, so every refresh counts as a failed repair.
+    for (let attempt = 0; attempt < 6; attempt += 1) {
+      scheduleRetiredEpochRepair(WORKTREE, EPOCH, runRepair)
+      await vi.advanceTimersByTimeAsync(5000)
+    }
+
+    expect(runRepair).toHaveBeenCalledTimes(3)
+    expect(warn).toHaveBeenCalledWith(
+      '[structured-session-tabs] retired publication epoch still unrepaired',
+      expect.objectContaining({ worktree: WORKTREE, publicationEpoch: EPOCH })
+    )
+    warn.mockRestore()
+  })
+
+  it('decays the cap instead of latching, so a later drop is still repairable', async () => {
+    markRetired()
+    vi.spyOn(console, 'warn').mockImplementation(() => {})
+
+    for (let attempt = 0; attempt < 4; attempt += 1) {
+      scheduleRetiredEpochRepair(WORKTREE, EPOCH, runRepair)
+      await vi.advanceTimersByTimeAsync(5000)
+    }
+    expect(runRepair).toHaveBeenCalledTimes(3)
+
+    // A quiet minute later the worktree gets its budget back rather than staying hidden forever.
+    await vi.advanceTimersByTimeAsync(60_000)
+    scheduleRetiredEpochRepair(WORKTREE, EPOCH, runRepair)
+    await vi.advanceTimersByTimeAsync(300)
+
+    expect(runRepair).toHaveBeenCalledTimes(4)
+  })
+
+  it('rearms once a repair actually revives the epoch', async () => {
+    markRetired()
+    runRepair.mockImplementation(async () => {
+      localStructuredSessionEpochHistoryByWorktree.set(WORKTREE, {
+        current: EPOCH,
+        retired: ['headless:pty-backed:x']
+      })
+    })
+
+    scheduleRetiredEpochRepair(WORKTREE, EPOCH, runRepair)
+    await vi.advanceTimersByTimeAsync(300)
+    expect(runRepair).toHaveBeenCalledTimes(1)
+
+    markRetired()
+    scheduleRetiredEpochRepair(WORKTREE, EPOCH, runRepair)
+    await vi.advanceTimersByTimeAsync(300)
+
+    expect(runRepair).toHaveBeenCalledTimes(2)
+  })
+
+  it('forgets repair state for worktrees that no longer exist', async () => {
+    markRetired()
+    scheduleRetiredEpochRepair(WORKTREE, EPOCH, runRepair)
+
+    forgetRetiredEpochRepairsOutside(new Set(['folder:other']))
+    await vi.advanceTimersByTimeAsync(5000)
+
+    // The pending refetch for the vanished worktree is cancelled, not merely orphaned.
+    expect(runRepair).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/renderer/src/runtime/local-structured-session-tabs-sync/retired-epoch-repair.ts b/src/renderer/src/runtime/local-structured-session-tabs-sync/retired-epoch-repair.ts
new file mode 100644
index 00000000000..1916fb21546
--- /dev/null
+++ b/src/renderer/src/runtime/local-structured-session-tabs-sync/retired-epoch-repair.ts
@@ -0,0 +1,131 @@
+/**
+ * Repairing a structured session snapshot the retired-epoch fence rejected.
+ *
+ * The fence is right to reject a subscription frame carrying a retired epoch — it cannot tell that
+ * frame apart from a delayed one queued by a dead publisher generation, whose version can be
+ * higher than the live cursor. What it cannot do is notice when the epoch's publisher is actually
+ * still alive and has simply returned after another publisher briefly owned the worktree.
+ *
+ * So the drop is not treated as final: it schedules one authoritative `session.tabs.listAll`, whose
+ * answer settles which epoch is current. If the epoch really is dead the census changes nothing; if
+ * it is live, the census carries it and the tab lands. The fence itself is never relaxed for
+ * subscription frames.
+ *
+ * The refresh is injected rather than imported so this module depends on nothing that in turn
+ * depends on the snapshot apply — which is what lets the apply prune this module's state.
+ */
+
+import {
+  isCurrentLocalStructuredSessionGeneration,
+  localStructuredSessionEpochHistoryByWorktree,
+  localStructuredSessionGeneration
+} from './inventory-generation-fence'
+
+/** Bounded so a publisher that keeps re-sending a retired epoch cannot drive an endless refetch. */
+const MAX_REPAIR_ATTEMPTS = 3
+const BASE_REPAIR_DELAY_MS = 250
+const MAX_REPAIR_DELAY_MS = 5000
+/**
+ * The cap decays rather than latching. A run of transient RPC failures must not hide a chat tab for
+ * the renderer's lifetime; once a worktree has been quiet this long, a fresh drop is a fresh
+ * problem and gets its full budget back.
+ */
+const REPAIR_ATTEMPT_DECAY_MS = 60_000
+
+type RepairState = {
+  attempts: number
+  lastAttemptAt: number
+  timer: ReturnType<typeof setTimeout> | null
+}
+
+export type RetiredEpochRepairRunner = (expectedGeneration: number) => Promise<unknown>
+
+const repairsByWorktree = new Map<string, RepairState>()
+
+function repairState(worktreeId: string, now: number): RepairState {
+  const existing = repairsByWorktree.get(worktreeId)
+  if (!existing) {
+    const created: RepairState = { attempts: 0, lastAttemptAt: now, timer: null }
+    repairsByWorktree.set(worktreeId, created)
+    return created
+  }
+  if (now - existing.lastAttemptAt >= REPAIR_ATTEMPT_DECAY_MS) {
+    existing.attempts = 0
+  }
+  return existing
+}
+
+/**
+ * Schedules the authoritative refetch for a dropped snapshot, coalescing repeat drops for the same
+ * worktree into the one already pending.
+ */
+export function scheduleRetiredEpochRepair(
+  worktreeId: string,
+  publicationEpoch: string,
+  runRepair: RetiredEpochRepairRunner
+): void {
+  const now = Date.now()
+  const state = repairState(worktreeId, now)
+  if (state.timer !== null) {
+    return
+  }
+  if (state.attempts >= MAX_REPAIR_ATTEMPTS) {
+    console.warn('[structured-session-tabs] retired publication epoch still unrepaired', {
+      worktree: worktreeId,
+      publicationEpoch,
+      attempts: state.attempts,
+      retryAfterMs: Math.max(0, REPAIR_ATTEMPT_DECAY_MS - (now - state.lastAttemptAt))
+    })
+    return
+  }
+  const generation = localStructuredSessionGeneration()
+  const delay = Math.min(BASE_REPAIR_DELAY_MS * 2 ** state.attempts, MAX_REPAIR_DELAY_MS)
+  state.attempts += 1
+  state.lastAttemptAt = now
+  state.timer = setTimeout(() => {
+    state.timer = null
+    if (!isCurrentLocalStructuredSessionGeneration(generation)) {
+      repairsByWorktree.delete(worktreeId)
+      return
+    }
+    void runRepair(generation)
+      .then(() => {
+        // Why re-check rather than trust the call: a refresh that succeeds without reviving the
+        // epoch has not repaired anything, and counting it as success would loop forever.
+        const stillRetired =
+          localStructuredSessionEpochHistoryByWorktree
+            .get(worktreeId)
+            ?.retired.includes(publicationEpoch) ?? false
+        if (!stillRetired) {
+          repairsByWorktree.delete(worktreeId)
+        }
+      })
+      .catch((error) => {
+        console.warn('[structured-session-tabs] retired-epoch repair refresh failed', error)
+      })
+  }, delay)
+}
+
+/**
+ * Drops repair state for worktrees that no longer exist, alongside the publisher cursors it
+ * shadows — without this every deleted worktree leaks an entry for the renderer's lifetime.
+ */
+export function forgetRetiredEpochRepairsOutside(knownWorktreeIds: ReadonlySet<string>): void {
+  for (const [worktreeId, state] of repairsByWorktree) {
+    if (!knownWorktreeIds.has(worktreeId)) {
+      if (state.timer !== null) {
+        clearTimeout(state.timer)
+      }
+      repairsByWorktree.delete(worktreeId)
+    }
+  }
+}
+
+export function resetRetiredEpochRepairsForTests(): void {
+  for (const state of repairsByWorktree.values()) {
+    if (state.timer !== null) {
+      clearTimeout(state.timer)
+    }
+  }
+  repairsByWorktree.clear()
+}
diff --git a/src/renderer/src/runtime/local-structured-session-tabs-sync/snapshot-apply.ts b/src/renderer/src/runtime/local-structured-session-tabs-sync/snapshot-apply.ts
index fc254de62dc..e92f03ac671 100644
--- a/src/renderer/src/runtime/local-structured-session-tabs-sync/snapshot-apply.ts
+++ b/src/renderer/src/runtime/local-structured-session-tabs-sync/snapshot-apply.ts
@@ -1,4 +1,7 @@
-import type { RuntimeMobileSessionTabsResult } from '../../../../shared/runtime-types'
+import type {
+  RuntimeMobileSessionTabsRemovedResult,
+  RuntimeMobileSessionTabsResult
+} from '../../../../shared/runtime-types'
 import type { WorktreeRuntimeOwnerState } from '../../lib/worktree-runtime-owner'
 import { getExecutionHostIdForWorktree } from '../../lib/worktree-runtime-owner'
 import {
@@ -7,7 +10,9 @@ import {
 } from '../web-session-tabs-sync'
 import type { WebSessionTabsSyncState } from '../web-session-tabs-sync'
 import {
+  hasRetiredValue,
   noteRetiredValue,
+  reviveRetiredValue,
   sameSessionTabsPublicationLineage
 } from '../web-session-tabs-sync/publisher-identity-fences'
 import {
@@ -21,16 +26,38 @@ import {
   localStructuredSessionVersionByWorktree,
   supersedeLocalStructuredSessionGeneration
 } from './inventory-generation-fence'
+import { forgetRetiredEpochRepairsOutside } from './retired-epoch-repair'
 import { projectLocalStructuredSessionTabs } from './snapshot-projection'
+import { hostSnapshotAffirmsWorktreeContents } from '../host-session-snapshot-authority'
 
 export const LOCAL_STRUCTURED_SESSION_OWNER = 'local-structured-session'
 
+/** The host saying it no longer publishes this worktree at all, rather than publishing an empty one. */
+function isWorktreeRetraction(
+  snapshot: RuntimeMobileSessionTabsResult
+): snapshot is RuntimeMobileSessionTabsRemovedResult {
+  return (snapshot as Partial<RuntimeMobileSessionTabsRemovedResult>).removed === true
+}
+
+export type StructuredSessionSnapshotApplyOptions = {
+  /**
+   * Marks these snapshots as an authoritative `session.tabs.listAll` response, which exempts them
+   * from the retired-epoch fence. A census is the synchronous answer to a request we just issued,
+   * so it cannot be the delayed frame from a dead generation that the fence exists to reject —
+   * whereas a subscription frame can be, and stays fenced.
+   */
+  authoritative?: boolean
+  /** Called for each snapshot the retired-epoch fence rejects; the repair lane listens here. */
+  onRetiredEpochDrop?: (worktreeId: string, publicationEpoch: string) => void
+}
+
 export function applyStructuredSessionTabSnapshots(
   snapshots: readonly RuntimeMobileSessionTabsResult[],
-  owner = LOCAL_STRUCTURED_SESSION_OWNER
+  owner = LOCAL_STRUCTURED_SESSION_OWNER,
+  options: StructuredSessionSnapshotApplyOptions = {}
 ): void {
   const settleStructuredSessionMirror = applyWebSessionTabsStorePatch(
-    (state) => applyLocalStructuredSessionTabSnapshots(state, snapshots, owner),
+    (state) => applyLocalStructuredSessionTabSnapshots(state, snapshots, owner, undefined, options),
     { frames: [] }
   )
   settleStructuredSessionMirror()
@@ -65,7 +92,8 @@ export function applyLocalStructuredSessionTabSnapshots<
   state: State,
   snapshots: readonly RuntimeMobileSessionTabsResult[],
   owner = LOCAL_STRUCTURED_SESSION_OWNER,
-  now = Date.now()
+  now = Date.now(),
+  options: StructuredSessionSnapshotApplyOptions = {}
 ): State {
   let next = state
   for (const snapshot of snapshots) {
@@ -73,13 +101,29 @@ export function applyLocalStructuredSessionTabSnapshots<
     if (getExecutionHostIdForWorktree(next, snapshot.worktree) !== 'local') {
       continue
     }
+    // "Ask me later", not an answer: a worktree the host holds no entry for still answers a forced
+    // inventory, with `none` at version 0. Absence there proves nothing, so it neither applies nor
+    // records — recording it would retire the epoch below. Its cursor is left alone, so a genuinely
+    // stale frame arriving late is still fenced.
+    if (!hostSnapshotAffirmsWorktreeContents(snapshot)) {
+      continue
+    }
     const prior = localStructuredSessionVersionByWorktree.get(snapshot.worktree)
     const sharesLineage = Boolean(
       prior && sameSessionTabsPublicationLineage(prior.publicationEpoch, snapshot.publicationEpoch)
     )
     const epochHistory = localStructuredSessionEpochHistoryByWorktree.get(snapshot.worktree)
-    if (epochHistory?.retired.includes(snapshot.publicationEpoch) && !sharesLineage) {
-      continue
+    // Why not just drop: an epoch is retired whenever another publisher takes over the worktree,
+    // but a live publisher can return after transient interlopers (a `removed:` retraction, then a
+    // headless rebuild), and the structured publish inherits the worktree's existing epoch rather
+    // than minting its own. So a retired epoch is not proof of a dead generation — only authority
+    // can settle it, and the repair lane goes and asks.
+    if (hasRetiredValue(epochHistory, snapshot.publicationEpoch) && !sharesLineage) {
+      if (!options.authoritative) {
+        options.onRetiredEpochDrop?.(snapshot.worktree, snapshot.publicationEpoch)
+        continue
+      }
+      reviveRetiredValue(epochHistory, snapshot.publicationEpoch)
     }
     if (prior && sharesLineage && snapshot.snapshotVersion <= prior.snapshotVersion) {
       continue
@@ -96,6 +140,32 @@ export function applyLocalStructuredSessionTabSnapshots<
       }
     )
     next = patch === next ? next : ({ ...next, ...patch } as State)
+    if (isWorktreeRetraction(snapshot)) {
+      // A retraction was applied above — the mirrored rows must go — but it is not a publication
+      // to fence later frames against. Recording it would retire the renderer's own epoch, which
+      // is one string for the whole process lifetime, and every republication afterwards would be
+      // dropped until a reload minted a new one. That is what left a revealed chat invisible.
+      //
+      // The cursor stays: the host mints a fresh epoch when it rebuilds a pruned entry, so a
+      // republication is never gated by it, while dropping it would leave a frame issued before
+      // the close free to land afterwards and strand a row nothing republishes.
+      //
+      // The history keeps its tombstones but forgets what is current. Unlike the mainstream path —
+      // where the epochs belong to a remote publisher — here the consumer IS the publisher, and
+      // `current` is the renderer's own lifetime epoch: leave it set and the next frame under any
+      // other epoch retires it for good, which is this bug again one cycle later. Clearing the
+      // whole record would instead let a delayed frame from an already-superseded epoch back in,
+      // because the version cursor only fences within a lineage. Dropping `current` alone does
+      // neither: `noteRetiredValue` retires nothing when there is nothing current.
+      const history = localStructuredSessionEpochHistoryByWorktree.get(snapshot.worktree)
+      if (history) {
+        localStructuredSessionEpochHistoryByWorktree.set(snapshot.worktree, {
+          current: null,
+          retired: history.retired
+        })
+      }
+      continue
+    }
     localStructuredSessionVersionByWorktree.set(snapshot.worktree, {
       publicationEpoch: snapshot.publicationEpoch,
       snapshotVersion: snapshot.snapshotVersion
@@ -114,5 +184,6 @@ export function applyLocalStructuredSessionTabSnapshots<
       localStructuredSessionEpochHistoryByWorktree.delete(worktreeId)
     }
   }
+  forgetRetiredEpochRepairsOutside(knownWorktreeIds)
   return next
 }
diff --git a/src/renderer/src/runtime/local-structured-session-tabs-sync/subscription.ts b/src/renderer/src/runtime/local-structured-session-tabs-sync/subscription.ts
index b074cfb1c41..fef55f07a16 100644
--- a/src/renderer/src/runtime/local-structured-session-tabs-sync/subscription.ts
+++ b/src/renderer/src/runtime/local-structured-session-tabs-sync/subscription.ts
@@ -9,7 +9,20 @@ import {
   refreshLocalStructuredSessionTabs,
   restoreLocalStructuredSessionTabsOnce
 } from './inventory-refresh'
-import { applyStructuredSessionTabSnapshots } from './snapshot-apply'
+import { scheduleRetiredEpochRepair } from './retired-epoch-repair'
+import {
+  applyStructuredSessionTabSnapshots,
+  type StructuredSessionSnapshotApplyOptions
+} from './snapshot-apply'
+
+// The refresh is supplied here rather than imported by the repair lane, so nothing the snapshot
+// apply depends on depends back on it.
+const REPAIR_DROPPED_EPOCHS: StructuredSessionSnapshotApplyOptions = {
+  onRetiredEpochDrop: (worktreeId, publicationEpoch) =>
+    scheduleRetiredEpochRepair(worktreeId, publicationEpoch, (generation) =>
+      refreshLocalStructuredSessionTabs(generation, { authoritative: true })
+    )
+}
 
 type SessionTabsEvent =
   | (RuntimeMobileSessionTabsResult & { type: 'snapshot' | 'updated' })
@@ -84,9 +97,9 @@ export async function startLocalStructuredSessionTabsSync(args: {
         }
         const event = response.result as SessionTabsEvent
         if (event.type === 'snapshots') {
-          applyStructuredSessionTabSnapshots(event.snapshots)
+          applyStructuredSessionTabSnapshots(event.snapshots, undefined, REPAIR_DROPPED_EPOCHS)
         } else if (event.type === 'snapshot' || event.type === 'updated') {
-          applyStructuredSessionTabSnapshots([event])
+          applyStructuredSessionTabSnapshots([event], undefined, REPAIR_DROPPED_EPOCHS)
         } else if (event.type === 'end' && generation === subscriptionGeneration) {
           // Reattach with one refresh so a runtime-restart boundary cannot strand stale tabs.
           subscriptionGeneration += 1
diff --git a/src/renderer/src/runtime/runtime-terminal-inspection.test.ts b/src/renderer/src/runtime/runtime-terminal-inspection.test.ts
index 52609b75590..7f54f5873bc 100644
--- a/src/renderer/src/runtime/runtime-terminal-inspection.test.ts
+++ b/src/renderer/src/runtime/runtime-terminal-inspection.test.ts
@@ -146,6 +146,58 @@ describe('runtime terminal owner routing', () => {
     expect(localHasChildren).not.toHaveBeenCalled()
   })
 
+  // Why these exist: the close guards ask the host to pay for a real child-process read, and the
+  // environment path used to drop the option before it reached the wire. The host then declined to
+  // scan and answered `unverifiable`, which the guard reads as running work -- a confirmation
+  // dialog on every idle close of a remote Windows pane. Found by review on #18591.
+  it('forwards scanChildProcesses to the PTY owning environment', async () => {
+    await inspectRuntimeTerminalProcess(
+      { activeRuntimeEnvironmentId: 'env-2' },
+      'remote:env-1@@terminal-1',
+      { scanChildProcesses: true }
+    )
+
+    expect(runtimeCall).toHaveBeenCalledWith({
+      selector: 'env-1',
+      method: 'terminal.inspectProcess',
+      params: { terminal: 'terminal-1', scanChildProcesses: true },
+      timeoutMs: 15_000
+    })
+  })
+
+  it('forwards scanChildProcesses alongside the incarnation fence', async () => {
+    await inspectRuntimeTerminalProcess(
+      { activeRuntimeEnvironmentId: 'env-2' },
+      'remote:env-1@@terminal-1',
+      { expectedIncarnationId: 'incarnation-1', scanChildProcesses: true }
+    )
+
+    expect(runtimeCall).toHaveBeenCalledWith({
+      selector: 'env-1',
+      method: 'terminal.inspectProcess',
+      params: {
+        terminal: 'terminal-1',
+        expectedIncarnationId: 'incarnation-1',
+        scanChildProcesses: true
+      },
+      timeoutMs: 15_000
+    })
+  })
+
+  it('omits scanChildProcesses when the caller is only polling', async () => {
+    await inspectRuntimeTerminalProcess(
+      { activeRuntimeEnvironmentId: 'env-2' },
+      'remote:env-1@@terminal-1'
+    )
+
+    expect(runtimeCall).toHaveBeenCalledWith({
+      selector: 'env-1',
+      method: 'terminal.inspectProcess',
+      params: { terminal: 'terminal-1' },
+      timeoutMs: 15_000
+    })
+  })
+
   it('maps an old host inspection to client-only unverifiable', async () => {
     runtimeCall.mockResolvedValue({
       ok: true,
diff --git a/src/renderer/src/runtime/runtime-terminal-inspection.ts b/src/renderer/src/runtime/runtime-terminal-inspection.ts
index 284496426a0..b34d75f4555 100644
--- a/src/renderer/src/runtime/runtime-terminal-inspection.ts
+++ b/src/renderer/src/runtime/runtime-terminal-inspection.ts
@@ -138,7 +138,7 @@ export function recordRuntimeTerminalInputForPtyId(ptyId: string, timestamp = Da
 export async function inspectRuntimeTerminalProcess(
   settings: Pick<GlobalSettings, 'activeRuntimeEnvironmentId'> | null | undefined,
   ptyId: string,
-  options?: { expectedIncarnationId?: string }
+  options?: { expectedIncarnationId?: string; scanChildProcesses?: boolean; steadyState?: boolean }
 ): Promise<RuntimeTerminalProcessInspection> {
   const ownerEnvironmentId = getRemoteRuntimePtyEnvironmentId(ptyId)
   const target = ownerEnvironmentId
@@ -148,7 +148,7 @@ export async function inspectRuntimeTerminalProcess(
   const remote = isRemoteInspectionPtyId(ptyId)
   if (target.kind !== 'environment' || !terminal) {
     try {
-      const result = await (options?.expectedIncarnationId
+      const result = await (options
         ? window.api.pty.inspectProcess(ptyId, options)
         : window.api.pty.inspectProcess(ptyId))
       return normalizeInspectionResult(result, remote)
@@ -169,7 +169,11 @@ export async function inspectRuntimeTerminalProcess(
         terminal,
         ...(options?.expectedIncarnationId
           ? { expectedIncarnationId: options.expectedIncarnationId }
-          : {})
+          : {}),
+        // Why forwarded: the close guards pass this so the host pays for a real child-process read.
+        // Dropped here, the host declines to scan and answers `unverifiable`, which the guard reads
+        // as running work -- a confirmation dialog on every idle close of a remote Windows pane.
+        ...(options?.scanChildProcesses === true ? { scanChildProcesses: true } : {})
       },
       { timeoutMs: 15_000 }
     )
diff --git a/src/renderer/src/runtime/structured-agent-session-client.ts b/src/renderer/src/runtime/structured-agent-session-client.ts
index 0e8d2ce16f2..71be3f3449d 100644
--- a/src/renderer/src/runtime/structured-agent-session-client.ts
+++ b/src/renderer/src/runtime/structured-agent-session-client.ts
@@ -1,5 +1,8 @@
 import type { RuntimeRpcResponse } from '../../../shared/runtime-rpc-envelope'
-import type { AgentSessionSubscribeEvent } from '../../../shared/agent-session-wire'
+import type {
+  AgentSessionStatusEvent,
+  AgentSessionSubscribeEvent
+} from '../../../shared/agent-session-wire'
 import { getRuntimeEnvironmentRevision } from './runtime-environment-revision'
 import { callRuntimeRpc, type RuntimeClientTarget } from './runtime-rpc-client'
 
@@ -11,10 +14,11 @@ export function callStructuredAgentSession<TResult>(
   return callRuntimeRpc<TResult>(target, method, params)
 }
 
-export async function subscribeStructuredAgentSession(
+async function subscribeStructuredAgentSessionMethod<TEvent>(
   target: RuntimeClientTarget,
+  method: string,
   params: unknown,
-  onEvent: (event: AgentSessionSubscribeEvent) => void,
+  onEvent: (event: TEvent) => void,
   onError: (error: unknown) => void,
   onClose: () => void
 ): Promise<{ unsubscribe: () => void }> {
@@ -23,15 +27,15 @@ export async function subscribeStructuredAgentSession(
       onError(response.error)
       return
     }
-    onEvent(response.result as AgentSessionSubscribeEvent)
+    onEvent(response.result as TEvent)
   }
   if (target.kind === 'local') {
-    return window.api.runtime.subscribe({ method: 'agentSession.subscribe', params }, onResponse)
+    return window.api.runtime.subscribe({ method, params }, onResponse)
   }
   return window.api.runtimeEnvironments.subscribe(
     {
       selector: target.environmentId,
-      method: 'agentSession.subscribe',
+      method,
       params,
       timeoutMs: 15_000,
       expectedEnvironmentPairingRevision: getRuntimeEnvironmentRevision(target.environmentId)
@@ -39,3 +43,37 @@ export async function subscribeStructuredAgentSession(
     { onResponse, onError, onClose }
   )
 }
+
+export function subscribeStructuredAgentSession(
+  target: RuntimeClientTarget,
+  params: unknown,
+  onEvent: (event: AgentSessionSubscribeEvent) => void,
+  onError: (error: unknown) => void,
+  onClose: () => void
+): Promise<{ unsubscribe: () => void }> {
+  return subscribeStructuredAgentSessionMethod(
+    target,
+    'agentSession.subscribe',
+    params,
+    onEvent,
+    onError,
+    onClose
+  )
+}
+
+/** Every structured session's projected status on one runtime, as the host publishes it. */
+export function subscribeStructuredAgentSessionStatus(
+  target: RuntimeClientTarget,
+  onEvent: (event: AgentSessionStatusEvent) => void,
+  onError: (error: unknown) => void,
+  onClose: () => void
+): Promise<{ unsubscribe: () => void }> {
+  return subscribeStructuredAgentSessionMethod(
+    target,
+    'agentSession.subscribeStatus',
+    {},
+    onEvent,
+    onError,
+    onClose
+  )
+}
diff --git a/src/renderer/src/runtime/structured-agent-session-handoff-store.ts b/src/renderer/src/runtime/structured-agent-session-handoff-store.ts
new file mode 100644
index 00000000000..8800f349802
--- /dev/null
+++ b/src/renderer/src/runtime/structured-agent-session-handoff-store.ts
@@ -0,0 +1,50 @@
+import { useSyncExternalStore } from 'react'
+import type { AgentSessionHandoffStatus } from '../../../shared/agent-session-wire'
+
+export type TerminalStructuredHandoff = {
+  sessionId: string
+  fence: number
+  status: AgentSessionHandoffStatus
+}
+
+const byTerminalTabId = new Map<string, TerminalStructuredHandoff>()
+const listeners = new Set<() => void>()
+
+export function publishStructuredHandoff(input: TerminalStructuredHandoff): void {
+  for (const [tabId, current] of byTerminalTabId) {
+    if (current.sessionId === input.sessionId && tabId !== input.status.terminal?.tabId) {
+      byTerminalTabId.delete(tabId)
+    }
+  }
+  if (input.status.terminal) {
+    byTerminalTabId.set(input.status.terminal.tabId, input)
+  }
+  for (const listener of listeners) {
+    listener()
+  }
+}
+
+export function clearStructuredHandoff(sessionId: string): void {
+  let changed = false
+  for (const [tabId, current] of byTerminalTabId) {
+    if (current.sessionId === sessionId) {
+      byTerminalTabId.delete(tabId)
+      changed = true
+    }
+  }
+  if (changed) {
+    for (const listener of listeners) {
+      listener()
+    }
+  }
+}
+
+export function useTerminalStructuredHandoff(tabId: string): TerminalStructuredHandoff | null {
+  return useSyncExternalStore(
+    (listener) => {
+      listeners.add(listener)
+      return () => listeners.delete(listener)
+    },
+    () => byTerminalTabId.get(tabId) ?? null
+  )
+}
diff --git a/src/renderer/src/runtime/structured-agent-session-status-feed.test.ts b/src/renderer/src/runtime/structured-agent-session-status-feed.test.ts
new file mode 100644
index 00000000000..d9cb4dd3d72
--- /dev/null
+++ b/src/renderer/src/runtime/structured-agent-session-status-feed.test.ts
@@ -0,0 +1,140 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type {
+  AgentSessionStatusEvent,
+  AgentSessionStatusSummary
+} from '../../../shared/agent-session-wire'
+import { AGENT_SESSION_STATUS_FEED_RUNTIME_CAPABILITY } from '../../../shared/protocol-version'
+
+const mocks = vi.hoisted(() => ({
+  subscribeStatus: vi.fn(),
+  supportsCapability: vi.fn(),
+  unsubscribe: vi.fn()
+}))
+
+vi.mock('./structured-agent-session-client', () => ({
+  subscribeStructuredAgentSessionStatus: mocks.subscribeStatus
+}))
+
+vi.mock('./runtime-rpc-client', () => ({
+  runtimeEnvironmentSupportsCapability: mocks.supportsCapability
+}))
+
+import {
+  getStructuredAgentSessionStatusFeed,
+  resetStructuredAgentSessionStatusFeedsForTests
+} from './structured-agent-session-status-feed'
+
+const REMOTE = { kind: 'environment', environmentId: 'env-1' } as const
+const LOCAL = { kind: 'local' } as const
+
+function summary(
+  sessionId: string,
+  status: AgentSessionStatusSummary['status'] = 'idle'
+): AgentSessionStatusSummary {
+  return {
+    sessionId,
+    workspaceId: 'wt-1',
+    agent: 'codex',
+    status,
+    latestPrompt: 'hello',
+    updatedAt: 1
+  }
+}
+
+/** The event callback the feed handed to the most recent subscription. */
+function hostEmit(index = 0): (event: AgentSessionStatusEvent) => void {
+  const call = mocks.subscribeStatus.mock.calls[index]
+  if (!call) {
+    throw new Error('status feed not subscribed')
+  }
+  return call[1] as (event: AgentSessionStatusEvent) => void
+}
+
+describe('structured agent session status feed', () => {
+  beforeEach(() => {
+    vi.useFakeTimers()
+    vi.clearAllMocks()
+    resetStructuredAgentSessionStatusFeedsForTests()
+    mocks.subscribeStatus.mockResolvedValue({ unsubscribe: mocks.unsubscribe })
+    mocks.supportsCapability.mockResolvedValue(true)
+  })
+
+  afterEach(() => {
+    resetStructuredAgentSessionStatusFeedsForTests()
+    vi.useRealTimers()
+  })
+
+  it('never subscribes, and never retries, against a host without the status feed', async () => {
+    mocks.supportsCapability.mockResolvedValue(false)
+    getStructuredAgentSessionStatusFeed(REMOTE).activate()
+
+    await vi.advanceTimersByTimeAsync(0)
+    expect(mocks.supportsCapability).toHaveBeenCalledWith(
+      'env-1',
+      AGENT_SESSION_STATUS_FEED_RUNTIME_CAPABILITY
+    )
+    expect(mocks.subscribeStatus).not.toHaveBeenCalled()
+    expect(vi.getTimerCount()).toBe(0)
+
+    await vi.advanceTimersByTimeAsync(60_000)
+    expect(mocks.subscribeStatus).not.toHaveBeenCalled()
+    expect(mocks.supportsCapability).toHaveBeenCalledOnce()
+  })
+
+  it('subscribes once the remote host advertises the status feed', async () => {
+    getStructuredAgentSessionStatusFeed(REMOTE).activate()
+
+    await vi.advanceTimersByTimeAsync(0)
+    expect(mocks.subscribeStatus).toHaveBeenCalledOnce()
+    expect(mocks.subscribeStatus.mock.calls[0]?.[0]).toEqual(REMOTE)
+  })
+
+  it('reconnects when the capability probe fails, which is not an answer', async () => {
+    mocks.supportsCapability.mockRejectedValue(new Error('relay unreachable'))
+    getStructuredAgentSessionStatusFeed(REMOTE).activate()
+
+    await vi.advanceTimersByTimeAsync(0)
+    expect(mocks.supportsCapability).toHaveBeenCalledOnce()
+
+    await vi.advanceTimersByTimeAsync(300)
+    expect(mocks.supportsCapability).toHaveBeenCalledTimes(2)
+    expect(mocks.subscribeStatus).not.toHaveBeenCalled()
+  })
+
+  it('probes nothing for a local host, which is this build', async () => {
+    getStructuredAgentSessionStatusFeed(LOCAL).activate()
+
+    await vi.advanceTimersByTimeAsync(0)
+    expect(mocks.supportsCapability).not.toHaveBeenCalled()
+    expect(mocks.subscribeStatus).toHaveBeenCalledOnce()
+  })
+
+  it('merges a snapshot over the cached rows instead of retracting them', async () => {
+    const feed = getStructuredAgentSessionStatusFeed(LOCAL)
+    feed.activate()
+    await vi.advanceTimersByTimeAsync(0)
+    hostEmit()({ type: 'snapshot', sessions: [summary('session-1'), summary('session-2')] })
+    expect([...feed.getSnapshot().keys()]).toEqual(['session-1', 'session-2'])
+
+    // A restarted host restores its readable sessions after the stream reopens.
+    hostEmit()({ type: 'snapshot', sessions: [] })
+    expect([...feed.getSnapshot().keys()]).toEqual(['session-1', 'session-2'])
+
+    hostEmit()({ type: 'snapshot', sessions: [summary('session-1', 'working')] })
+    expect(feed.getSnapshot().get('session-1')?.status).toBe('working')
+    expect(feed.getSnapshot().get('session-2')?.status).toBe('idle')
+  })
+
+  it('stops a pending reconnect when the feeds are reset between tests', async () => {
+    getStructuredAgentSessionStatusFeed(LOCAL).activate()
+    await vi.advanceTimersByTimeAsync(0)
+    hostEmit()({ type: 'end' })
+    expect(vi.getTimerCount()).toBe(1)
+
+    resetStructuredAgentSessionStatusFeedsForTests()
+
+    expect(vi.getTimerCount()).toBe(0)
+    await vi.advanceTimersByTimeAsync(10_000)
+    expect(mocks.subscribeStatus).toHaveBeenCalledOnce()
+  })
+})
diff --git a/src/renderer/src/runtime/structured-agent-session-status-feed.ts b/src/renderer/src/runtime/structured-agent-session-status-feed.ts
new file mode 100644
index 00000000000..2b550679315
--- /dev/null
+++ b/src/renderer/src/runtime/structured-agent-session-status-feed.ts
@@ -0,0 +1,211 @@
+// One host status stream per runtime target, shared by every session-list projection.
+//
+// The feed is a read-only mirror: the host projects each session's status from its journal and
+// this owner keeps the latest summary per session while anyone is looking. Losing the stream
+// keeps the cached summaries and reconnects; a fresh snapshot merges over them.
+// Which sessions are listed is the tab map's decision, so the feed never retracts a summary.
+
+import type {
+  AgentSessionStatusEvent,
+  AgentSessionStatusSummary
+} from '../../../shared/agent-session-wire'
+import { AGENT_SESSION_STATUS_FEED_RUNTIME_CAPABILITY } from '../../../shared/protocol-version'
+import {
+  runtimeEnvironmentSupportsCapability,
+  type RuntimeClientTarget
+} from './runtime-rpc-client'
+import { subscribeStructuredAgentSessionStatus } from './structured-agent-session-client'
+
+export type StructuredAgentSessionStatusSnapshot = ReadonlyMap<string, AgentSessionStatusSummary>
+
+export type StructuredAgentSessionStatusFeedOwner = {
+  activate: () => () => void
+  getSnapshot: () => StructuredAgentSessionStatusSnapshot
+  subscribe: (listener: () => void) => () => void
+}
+
+const RECONNECT_MAX_DELAY_MS = 5_000
+
+/** `stop` is the map's own teardown, not part of the owner contract callers hold. */
+type OwnedStatusFeed = StructuredAgentSessionStatusFeedOwner & { stop: () => void }
+
+const owners = new Map<string, OwnedStatusFeed>()
+
+export function structuredAgentSessionStatusFeedKey(target: RuntimeClientTarget): string {
+  return target.kind === 'local' ? 'local' : `environment:${target.environmentId}`
+}
+
+function createOwner(target: RuntimeClientTarget): OwnedStatusFeed {
+  let snapshot: StructuredAgentSessionStatusSnapshot = new Map()
+  const listeners = new Set<() => void>()
+  const activations = new Set<symbol>()
+  let generation = 0
+  let handle: { unsubscribe: () => void } | null = null
+  let reconnectTimer: ReturnType<typeof setTimeout> | null = null
+  let reconnectAttempt = 0
+
+  const emit = (): void => {
+    for (const listener of listeners) {
+      listener()
+    }
+  }
+  const setSnapshot = (next: StructuredAgentSessionStatusSnapshot): void => {
+    snapshot = next
+    emit()
+  }
+  const applyEvent = (event: AgentSessionStatusEvent): void => {
+    if (event.type === 'snapshot') {
+      reconnectAttempt = 0
+      // Merged, not replaced: a restarted host restores its readable sessions asynchronously, so
+      // the first snapshot can be empty and dropping those rows flickers every one to no-status.
+      const next = new Map(snapshot)
+      for (const session of event.sessions) {
+        next.set(session.sessionId, session)
+      }
+      setSnapshot(next)
+      return
+    }
+    if (event.type === 'status') {
+      const next = new Map(snapshot)
+      next.set(event.session.sessionId, event.session)
+      setSnapshot(next)
+    }
+  }
+  const active = (candidate: number): boolean => activations.size > 0 && candidate === generation
+  const clearReconnect = (): void => {
+    if (reconnectTimer) {
+      clearTimeout(reconnectTimer)
+      reconnectTimer = null
+    }
+  }
+  const dropHandle = (): void => {
+    handle?.unsubscribe()
+    handle = null
+  }
+  let open = (): void => {}
+  const scheduleReconnect = (candidate: number): void => {
+    if (!active(candidate) || reconnectTimer) {
+      return
+    }
+    const delay = Math.min(250 * 2 ** reconnectAttempt, RECONNECT_MAX_DELAY_MS)
+    reconnectAttempt += 1
+    reconnectTimer = setTimeout(() => {
+      reconnectTimer = null
+      if (active(candidate)) {
+        open()
+      }
+    }, delay)
+  }
+  const subscribeToHost = (candidate: number): void => {
+    void subscribeStructuredAgentSessionStatus(
+      target,
+      (event) => {
+        if (!active(candidate)) {
+          return
+        }
+        if (event.type === 'end') {
+          dropHandle()
+          scheduleReconnect(candidate)
+          return
+        }
+        applyEvent(event)
+      },
+      () => {
+        if (active(candidate)) {
+          dropHandle()
+          scheduleReconnect(candidate)
+        }
+      },
+      () => {
+        if (active(candidate)) {
+          dropHandle()
+          scheduleReconnect(candidate)
+        }
+      }
+    )
+      .then((opened) => {
+        if (active(candidate)) {
+          handle = opened
+        } else {
+          opened.unsubscribe()
+        }
+      })
+      .catch(() => scheduleReconnect(candidate))
+  }
+  open = (): void => {
+    const candidate = ++generation
+    dropHandle()
+    if (target.kind !== 'environment') {
+      // A local host is this build; only a remote one can predate the method.
+      subscribeToHost(candidate)
+      return
+    }
+    const environmentId = target.environmentId
+    void runtimeEnvironmentSupportsCapability(
+      environmentId,
+      AGENT_SESSION_STATUS_FEED_RUNTIME_CAPABILITY
+    )
+      .then((supported) => {
+        if (!active(candidate)) {
+          return
+        }
+        // A host without the method is terminal, not a fault: retrying would relay-probe
+        // forever. A failed probe is not an answer, so that path still reconnects.
+        if (supported) {
+          subscribeToHost(candidate)
+          return
+        }
+        console.warn('[structured-session-status] host too old for the status feed', environmentId)
+      })
+      .catch(() => scheduleReconnect(candidate))
+  }
+  const stop = (): void => {
+    generation += 1
+    clearReconnect()
+    dropHandle()
+    reconnectAttempt = 0
+  }
+
+  return {
+    activate: () => {
+      const token = Symbol('status-feed')
+      activations.add(token)
+      if (activations.size === 1) {
+        open()
+      }
+      return () => {
+        activations.delete(token)
+        if (activations.size === 0) {
+          stop()
+        }
+      }
+    },
+    getSnapshot: () => snapshot,
+    subscribe: (listener) => {
+      listeners.add(listener)
+      return () => listeners.delete(listener)
+    },
+    stop
+  }
+}
+
+export function getStructuredAgentSessionStatusFeed(
+  target: RuntimeClientTarget
+): StructuredAgentSessionStatusFeedOwner {
+  const key = structuredAgentSessionStatusFeedKey(target)
+  let owner = owners.get(key)
+  if (!owner) {
+    owner = createOwner(target)
+    owners.set(key, owner)
+  }
+  return owner
+}
+
+export function resetStructuredAgentSessionStatusFeedsForTests(): void {
+  // Dropping the map alone leaves a live subscription and its pending reconnect running
+  // into the next test, where they reopen a stream nothing is holding.
+  for (const owner of owners.values()) {
+    owner.stop()
+  }
+  owners.clear()
+}
diff --git a/src/renderer/src/runtime/use-worktree-runtime-target.test.ts b/src/renderer/src/runtime/use-worktree-runtime-target.test.ts
new file mode 100644
index 00000000000..6e59c6e035d
--- /dev/null
+++ b/src/renderer/src/runtime/use-worktree-runtime-target.test.ts
@@ -0,0 +1,34 @@
+// @vitest-environment happy-dom
+
+import { act, cleanup, renderHook } from '@testing-library/react'
+import { afterEach, expect, it } from 'vitest'
+import { useAppStore } from '@/store'
+import { useWorktreeRuntimeTarget } from './use-worktree-runtime-target'
+
+const initialState = useAppStore.getInitialState()
+
+afterEach(() => {
+  cleanup()
+  useAppStore.setState(initialState, true)
+})
+
+it('keeps the runtime target identity stable across unrelated store writes', () => {
+  let renders = 0
+  const { result } = renderHook(() => {
+    renders += 1
+    return useWorktreeRuntimeTarget('worktree-1')
+  })
+
+  const first = result.current
+  const rendersAfterMount = renders
+
+  act(() => {
+    for (let index = 0; index < 50; index += 1) {
+      useAppStore.setState({ activeRepoId: `repo-${index}` })
+    }
+  })
+
+  // A selector that built the target object inline re-rendered on every write.
+  expect(renders).toBe(rendersAfterMount)
+  expect(result.current).toBe(first)
+})
diff --git a/src/renderer/src/runtime/use-worktree-runtime-target.ts b/src/renderer/src/runtime/use-worktree-runtime-target.ts
index 25bd9099e90..22ef4ed5c4b 100644
--- a/src/renderer/src/runtime/use-worktree-runtime-target.ts
+++ b/src/renderer/src/runtime/use-worktree-runtime-target.ts
@@ -1,3 +1,4 @@
+import { useMemo } from 'react'
 import { useAppStore } from '@/store'
 import { getExecutionHostIdForWorktree } from '@/lib/worktree-runtime-owner'
 import { runtimeTargetForExecutionHostId, type RuntimeClientTarget } from './runtime-client-target'
@@ -10,7 +11,6 @@ import { runtimeTargetForExecutionHostId, type RuntimeClientTarget } from './run
 export function useWorktreeRuntimeTarget(
   worktreeId: string | null | undefined
 ): RuntimeClientTarget | null {
-  return useAppStore((state) =>
-    runtimeTargetForExecutionHostId(getExecutionHostIdForWorktree(state, worktreeId))
-  )
+  const executionHostId = useAppStore((state) => getExecutionHostIdForWorktree(state, worktreeId))
+  return useMemo(() => runtimeTargetForExecutionHostId(executionHostId), [executionHostId])
 }
diff --git a/src/renderer/src/runtime/web-session-tabs-sync/publisher-identity-fences.ts b/src/renderer/src/runtime/web-session-tabs-sync/publisher-identity-fences.ts
index 96ebe2293c6..fbab01b591b 100644
--- a/src/renderer/src/runtime/web-session-tabs-sync/publisher-identity-fences.ts
+++ b/src/renderer/src/runtime/web-session-tabs-sync/publisher-identity-fences.ts
@@ -36,6 +36,19 @@ export function noteRetiredValue(
   return history
 }
 
+/**
+ * Un-retires one value, leaving every other retired generation fenced.
+ *
+ * Only an authority that names the value current may call this; reviving on a delayed frame's own
+ * say-so is exactly the resurrection `retired` exists to prevent.
+ */
+export function reviveRetiredValue(history: RetiredValueHistory | undefined, value: string): void {
+  const index = history?.retired.indexOf(value) ?? -1
+  if (history && index >= 0) {
+    history.retired.splice(index, 1)
+  }
+}
+
 function normalizeSessionTabsRuntimeId(runtimeId: unknown): string | undefined {
   if (typeof runtimeId !== 'string') {
     return undefined
diff --git a/src/renderer/src/runtime/web-session-terminal-orphan-recovery-host-scope-gate.test.ts b/src/renderer/src/runtime/web-session-terminal-orphan-recovery-host-scope-gate.test.ts
new file mode 100644
index 00000000000..27d03f4642e
--- /dev/null
+++ b/src/renderer/src/runtime/web-session-terminal-orphan-recovery-host-scope-gate.test.ts
@@ -0,0 +1,98 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  ENVIRONMENT_ID,
+  listResult,
+  makeSnapshot,
+  makeState
+} from './__fixtures__/web-session-terminal-orphan-recovery-regression-fixtures'
+import {
+  clearWebSessionTerminalOrphanRecoveryForTests,
+  recoverWebSessionTerminalOrphansBeforeApply
+} from './web-session-terminal-orphan-recovery'
+
+/**
+ * The second consumer of `hostScopeCensusIsComplete`. Pruning here needs two consecutive
+ * authoritative inventories that omit the surface, so an incomplete census must hold the binding
+ * open indefinitely — and a peer runtime named in `omittedHostIds` must not be read as one, or
+ * the ghost binding is retained forever (#18595).
+ */
+const LEAVES = [{ leafId: 'leaf-1', handle: 'term-ghost' }]
+
+/**
+ * `listResult` substitutes a default scope when handed `undefined`, so the absent-scope case has
+ * to drop the key itself — passing `undefined` through the fixture silently tests the default.
+ */
+async function recoverTwice(worktree: string, hostScope: Record<string, unknown> | null) {
+  const state = makeState(worktree, LEAVES)
+  const call = vi.fn(async ({ method }: { method: string }) => {
+    if (method === 'terminal.list') {
+      const listed = listResult(worktree, [])
+      if (hostScope === null) {
+        delete (listed as { hostScope?: unknown }).hostScope
+      } else {
+        listed.hostScope = hostScope as never
+      }
+      return { ok: true as const, result: listed }
+    }
+    return { ok: false as const, error: { code: 'conflict', message: 'unexpected' } }
+  })
+  await recoverWebSessionTerminalOrphansBeforeApply(
+    state,
+    makeSnapshot(worktree, 'epoch-1', LEAVES),
+    ENVIRONMENT_ID,
+    { call: call as never }
+  )
+  return recoverWebSessionTerminalOrphansBeforeApply(
+    state,
+    makeSnapshot(worktree, 'epoch-2', LEAVES),
+    ENVIRONMENT_ID,
+    { call: call as never }
+  )
+}
+
+describe('orphan recovery reads the host scope as coverage owed, not as disclosure', () => {
+  beforeEach(() => {
+    clearWebSessionTerminalOrphanRecoveryForTests()
+  })
+
+  it('prunes a twice-absent binding when the only omission is a peer runtime', async () => {
+    const settled = await recoverTwice('repo::peer-disclosed', {
+      hostIds: ['local'],
+      omittedHostIds: ['runtime:env-peer']
+    })
+
+    expect(settled?.tabs).toEqual([])
+  })
+
+  it('retains the binding when an SSH host this runtime does query went unanswered', async () => {
+    const settled = await recoverTwice('repo::ssh-gap', {
+      hostIds: ['local'],
+      omittedHostIds: ['ssh:box-1']
+    })
+
+    expect(settled?.tabs).toEqual([
+      expect.objectContaining({ leafId: 'leaf-1', terminal: 'term-ghost' })
+    ])
+  })
+
+  it('retains the binding when the listing covered no host at all', async () => {
+    const settled = await recoverTwice('repo::covered-nothing', {
+      hostIds: [],
+      omittedHostIds: ['local', 'runtime:env-peer']
+    })
+
+    expect(settled?.tabs).toEqual([
+      expect.objectContaining({ leafId: 'leaf-1', terminal: 'term-ghost' })
+    ])
+  })
+
+  // Why: a host predating `hostScope` (v1.4.187) cannot say what it covered, and absence of the
+  // claim is never the claim.
+  it('retains the binding when the host is too old to publish a scope', async () => {
+    const settled = await recoverTwice('repo::no-scope', null)
+
+    expect(settled?.tabs).toEqual([
+      expect.objectContaining({ leafId: 'leaf-1', terminal: 'term-ghost' })
+    ])
+  })
+})
diff --git a/src/renderer/src/runtime/web-session-terminal-orphan-recovery-inventory.ts b/src/renderer/src/runtime/web-session-terminal-orphan-recovery-inventory.ts
index 422a741aec8..8dac25b6451 100644
--- a/src/renderer/src/runtime/web-session-terminal-orphan-recovery-inventory.ts
+++ b/src/renderer/src/runtime/web-session-terminal-orphan-recovery-inventory.ts
@@ -18,6 +18,7 @@ import {
   type RecoverySurface
 } from './web-session-terminal-orphan-recovery-surface'
 import { runInTerminalRecoveryRpcLane } from './web-session-terminal-orphan-recovery-rpc-lane'
+import { hostScopeCensusIsComplete } from '../../../shared/runtime-listing-host-scope'
 
 type RuntimeCall = (args: {
   selector: string
@@ -163,9 +164,9 @@ export async function resolveTerminalOrphanInventory(args: {
       listedByHandle.set(terminal.handle, terminal)
     }
   }
-  // Older hosts omit hostScope entirely; an unscoped absence cannot prove a PTY exited.
-  const hostScopeUnverifiable =
-    listed.hostScope === undefined || listed.hostScope.omittedHostIds.length > 0
+  // Older hosts omit hostScope entirely; an unscoped absence cannot prove a PTY exited. A peer
+  // runtime named in `omittedHostIds` is disclosure rather than a gap this host owed (#18595).
+  const hostScopeUnverifiable = !hostScopeCensusIsComplete(listed.hostScope)
   const dispositions = new Map<string, RecoveryDisposition>()
   const claims: RuntimeTerminalOrphanAdoptionClaim[] = []
   for (const surface of inventorySurfaces) {
diff --git a/src/renderer/src/runtime/web-session-terminal-pending-handle-recovery.test.ts b/src/renderer/src/runtime/web-session-terminal-pending-handle-recovery.test.ts
index 1411200b14c..cb92d4c8e98 100644
--- a/src/renderer/src/runtime/web-session-terminal-pending-handle-recovery.test.ts
+++ b/src/renderer/src/runtime/web-session-terminal-pending-handle-recovery.test.ts
@@ -145,7 +145,7 @@ describe('web session pending terminal handle recovery', () => {
             topologyRevisions: { [WORKTREE_ID]: 4 },
             totalCount: 1,
             truncated: false,
-            hostScope: { hostIds: [ENVIRONMENT_ID], omittedHostIds: [] }
+            hostScope: { hostIds: ['local'], omittedHostIds: [] }
           }
         }
       }
@@ -316,7 +316,7 @@ describe('web session pending terminal handle recovery', () => {
             topologyRevisions: { [WORKTREE_ID]: 4 },
             totalCount: 1,
             truncated: false,
-            hostScope: { hostIds: [ENVIRONMENT_ID], omittedHostIds: [] }
+            hostScope: { hostIds: ['local'], omittedHostIds: [] }
           }
         }
       }
@@ -394,7 +394,7 @@ describe('web session pending terminal handle recovery', () => {
             topologyRevisions: { [WORKTREE_ID]: 4 },
             totalCount: 1,
             truncated: false,
-            hostScope: { hostIds: [ENVIRONMENT_ID], omittedHostIds: [] }
+            hostScope: { hostIds: ['local'], omittedHostIds: [] }
           }
         }
       }
@@ -459,7 +459,7 @@ describe('web session pending terminal handle recovery', () => {
         terminals: [],
         totalCount: 0,
         truncated: false,
-        hostScope: { hostIds: [ENVIRONMENT_ID], omittedHostIds: [] }
+        hostScope: { hostIds: ['local'], omittedHostIds: [] }
       }
     }))
 
@@ -655,7 +655,7 @@ describe('web session pending terminal handle recovery', () => {
         terminals: [],
         totalCount: 0,
         truncated: false,
-        hostScope: { hostIds: [ENVIRONMENT_ID], omittedHostIds: [] }
+        hostScope: { hostIds: ['local'], omittedHostIds: [] }
       }
     }))
 
diff --git a/src/renderer/src/startup/startup-ssh-connection-restore.test.ts b/src/renderer/src/startup/startup-ssh-connection-restore.test.ts
index 3464816d0d8..3f74655454a 100644
--- a/src/renderer/src/startup/startup-ssh-connection-restore.test.ts
+++ b/src/renderer/src/startup/startup-ssh-connection-restore.test.ts
@@ -146,6 +146,7 @@ describe('restoreSshConnectionsForStartup', () => {
   })
 
   it('does not push a connected background target back into the deferred list', async () => {
+    vi.useFakeTimers()
     installWindowApi([target('ssh-active'), target('ssh-bg')])
     // The active host never answers and times out; the background host connects first.
     harness.connect.mockImplementation((targetId: string) =>
@@ -154,7 +155,7 @@ describe('restoreSshConnectionsForStartup', () => {
         : new Promise<SshConnectionState>(() => {})
     )
 
-    await restoreSshConnectionsForStartup({
+    const restore = restoreSshConnectionsForStartup({
       connectionIds: ['ssh-active', 'ssh-bg'],
       blockingConnectionIds: ['ssh-active'],
       setDeferredSshReconnectTargets: harness.setDeferredSshReconnectTargets,
@@ -162,11 +163,14 @@ describe('restoreSshConnectionsForStartup', () => {
       publishSshConnectionState: harness.publishSshConnectionState
     })
 
+    await vi.advanceTimersByTimeAsync(15_000)
+    await restore
+
     expect(harness.removeDeferredSshReconnectTarget).toHaveBeenCalledWith('ssh-bg')
     // The timed-out rewrite must not resurrect the reachable background target: a deferred
     // connected target sends fresh panes down the cold-restore path instead of the normal one.
     expect(harness.setDeferredSshReconnectTargets).toHaveBeenLastCalledWith(['ssh-active'])
-  }, 30_000)
+  })
 
   it('keeps passphrase targets deferred and never dials them', async () => {
     installWindowApi([target('ssh-key', true), target('ssh-bg')])
diff --git a/src/renderer/src/store/repos/repo-add-actions.ts b/src/renderer/src/store/repos/repo-add-actions.ts
index d9aa5d6d968..02d8440dc03 100644
--- a/src/renderer/src/store/repos/repo-add-actions.ts
+++ b/src/renderer/src/store/repos/repo-add-actions.ts
@@ -3,6 +3,7 @@ import { toast } from 'sonner'
 import type { AppState } from '../types'
 import type { Repo } from '../../../../shared/repo-types'
 import { isGitRepoKind } from '../../../../shared/repo-kind'
+import { isAgentSessionHandleProvider } from '../../../../shared/agent-session-provider-handle'
 import { getRepoHostIdentity } from '../slices/repo-host-identity'
 import { callRuntimeRpc, getActiveRuntimeTarget } from '../../runtime/runtime-rpc-client'
 import { resolveDismissedOnboardingFolderAgentLaunch } from '@/lib/onboarding-folder-agent-startup'
@@ -202,13 +203,16 @@ export function createRepoAddActions(
             ...(launch.startup ? { startup: launch.startup } : {}),
             ...(launch.route === 'structured-native-chat' ? { providesInitialSurface: true } : {})
           })
-          if (launch.route === 'structured-native-chat' && launch.agent === 'codex') {
-            const [{ startStructuredCodexLaunch }, { StructuredAgentSessionCreateRefusalError }] =
+          if (
+            launch.route === 'structured-native-chat' &&
+            isAgentSessionHandleProvider(launch.agent)
+          ) {
+            const [{ startStructuredAgentLaunch }, { StructuredAgentSessionCreateRefusalError }] =
               await Promise.all([
                 import('@/lib/structured-agent-session-launch'),
-                import('@/lib/launch-structured-codex-session')
+                import('@/lib/launch-structured-agent-session')
               ])
-            const structured = startStructuredCodexLaunch(folderWorktree.id)
+            const structured = startStructuredAgentLaunch(folderWorktree.id, launch.agent)
             const fallback = structured.claimDefinitiveRefusalFallback(() => {
               activateAndRevealWorktree(folderWorktree.id, {
                 sidebarRevealBehavior: 'auto',
diff --git a/src/renderer/src/store/slices/agent-status-provider-session.test.ts b/src/renderer/src/store/slices/agent-status-provider-session.test.ts
index f854517d94f..0d60d023956 100644
--- a/src/renderer/src/store/slices/agent-status-provider-session.test.ts
+++ b/src/renderer/src/store/slices/agent-status-provider-session.test.ts
@@ -16,6 +16,27 @@ function makePiCompatibleProviderSession(agent: 'pi' | 'omp' | 'prime-agent') {
 }
 
 describe('recordAgentProviderSession', () => {
+  it('does not capture a structured native owner for terminal resume on restart', () => {
+    const store = createTestStore()
+    const paneKey = 'structured-tab:leaf-1'
+    const providerSession = { key: 'session_id' as const, id: 'provider-session-uuid' }
+
+    store
+      .getState()
+      .setAgentStatus(
+        paneKey,
+        { state: 'working', prompt: 'keep going', agentType: 'claude' },
+        'Claude Chat',
+        undefined,
+        { tabId: 'structured-tab', worktreeId: 'wt-1' },
+        { providerSession, terminalResumeEligible: false }
+      )
+    store.getState().captureAllSleepingAgentSessions('quit')
+
+    expect(store.getState().agentStatusByPaneKey[paneKey]?.providerSession).toEqual(providerSession)
+    expect(store.getState().sleepingAgentSessionsByPaneKey[paneKey]).toBeUndefined()
+  })
+
   it('preserves the root session while a child permission hook moves Codex to waiting', () => {
     const store = createTestStore()
     const providerSession = { key: 'session_id' as const, id: 'root-session' }
diff --git a/src/renderer/src/store/slices/tab-group-reference-repair.test.ts b/src/renderer/src/store/slices/tab-group-reference-repair.test.ts
new file mode 100644
index 00000000000..a7cb3dca125
--- /dev/null
+++ b/src/renderer/src/store/slices/tab-group-reference-repair.test.ts
@@ -0,0 +1,54 @@
+import { describe, expect, it } from 'vitest'
+import type { TabGroup } from '../../../../shared/tab-types'
+import { appendOwnedTabIdsToGroups } from './tab-group-reference-repair'
+
+function group(id: string, tabOrder: string[]): TabGroup {
+  return { id, worktreeId: 'workspace', activeTabId: null, tabOrder, recentTabIds: [] }
+}
+
+describe('appendOwnedTabIdsToGroups', () => {
+  it('preserves existing order, duplicates, and untouched group identities', () => {
+    const complete = group('complete', ['b', 'a', 'a'])
+    const missing = group('missing', ['stale', 'c'])
+    const unowned = group('unowned', ['external'])
+    const owners = new Map([
+      ['a', 'complete'],
+      ['b', 'complete'],
+      ['d', 'missing'],
+      ['c', 'missing'],
+      ['e', 'missing'],
+      ['elsewhere', 'absent']
+    ])
+    const result = appendOwnedTabIdsToGroups([complete, missing, unowned], owners)
+    expect(result).toEqual([complete, { ...missing, tabOrder: ['stale', 'c', 'd', 'e'] }, unowned])
+    expect(result[0]).toBe(complete)
+    expect(result[2]).toBe(unowned)
+    expect(missing.tabOrder).toEqual(['stale', 'c'])
+  })
+
+  it.each([false, true])('bounds saved-order reads with missing tabs: %s', (missing) => {
+    const count = 1_000
+    const ids = Array.from({ length: count }, (_, i) => `tab-${i}`)
+    let reads = 0
+    const order = new Proxy(ids, {
+      get(target, property, receiver) {
+        if (typeof property === 'string' && /^\d+$/.test(property)) {
+          reads++
+        }
+        return Reflect.get(target, property, receiver)
+      }
+    })
+    const original = group('group', order)
+    const ownedIds = missing ? ids.map((id) => `missing-${id}`) : ids
+    const result = appendOwnedTabIdsToGroups(
+      [original],
+      new Map(ownedIds.map((id) => [id, original.id]))
+    )
+    const repairReads = reads
+    expect(result[0].tabOrder).toEqual(missing ? [...ids, ...ownedIds] : ids)
+    if (!missing) {
+      expect(result[0]).toBe(original)
+    }
+    expect(repairReads).toBeLessThanOrEqual(count * 2)
+  })
+})
diff --git a/src/renderer/src/store/slices/tab-group-reference-repair.ts b/src/renderer/src/store/slices/tab-group-reference-repair.ts
index 2bf1c468093..77d6dd38c81 100644
--- a/src/renderer/src/store/slices/tab-group-reference-repair.ts
+++ b/src/renderer/src/store/slices/tab-group-reference-repair.ts
@@ -72,7 +72,8 @@ export function appendOwnedTabIdsToGroups(
     if (!ownedTabIds) {
       return group
     }
-    const missingTabIds = ownedTabIds.filter((tabId) => !group.tabOrder.includes(tabId))
+    const orderedTabIds = new Set(group.tabOrder)
+    const missingTabIds = ownedTabIds.filter((tabId) => !orderedTabIds.has(tabId))
     return missingTabIds.length > 0
       ? { ...group, tabOrder: [...group.tabOrder, ...missingTabIds] }
       : group
diff --git a/src/renderer/src/store/slices/worktrees/listing/detected-worktree-host-merge.ts b/src/renderer/src/store/slices/worktrees/listing/detected-worktree-host-merge.ts
index 073bd712f32..f8078a9925c 100644
--- a/src/renderer/src/store/slices/worktrees/listing/detected-worktree-host-merge.ts
+++ b/src/renderer/src/store/slices/worktrees/listing/detected-worktree-host-merge.ts
@@ -22,6 +22,7 @@ export function mergeDetectedWorktreesForHost(
     current.repoId === refreshed.repoId &&
     current.authoritative === refreshed.authoritative &&
     current.source === refreshed.source &&
+    current.unavailableReason === refreshed.unavailableReason &&
     current.worktrees === worktrees
   ) {
     return current
diff --git a/src/renderer/src/store/slices/worktrees/listing/detected-worktree-unavailable-reason.test.ts b/src/renderer/src/store/slices/worktrees/listing/detected-worktree-unavailable-reason.test.ts
new file mode 100644
index 00000000000..da44f24c0d3
--- /dev/null
+++ b/src/renderer/src/store/slices/worktrees/listing/detected-worktree-unavailable-reason.test.ts
@@ -0,0 +1,31 @@
+import { describe, expect, it } from 'vitest'
+import { makeDetectedResult } from '../../worktrees-detected-listing-fixtures'
+import { mergeDetectedWorktreesForHost } from './detected-worktree-host-merge'
+import { areDetectedWorktreeResultsEqual } from './worktree-catalog-visibility'
+
+const failed = (unavailableReason?: string) =>
+  makeDetectedResult('repo-1', [], {
+    authoritative: false,
+    source: 'metadata-fallback',
+    ...(unavailableReason ? { unavailableReason } : {})
+  })
+
+// Why: two failed scans differ only by cause; dropping that from equality would freeze the first
+// reason on the header until the listing's rows or authority changed.
+describe('detected listing unavailable reason', () => {
+  it('is part of listing equality', () => {
+    expect(areDetectedWorktreeResultsEqual(failed('distro gone'), failed('distro gone'))).toBe(true)
+    expect(areDetectedWorktreeResultsEqual(failed('distro gone'), failed('mount hung'))).toBe(false)
+    expect(areDetectedWorktreeResultsEqual(failed('distro gone'), failed())).toBe(false)
+  })
+
+  it('survives the host merge when only the reason changed', () => {
+    const merged = mergeDetectedWorktreesForHost(
+      failed('distro gone'),
+      failed('mount hung'),
+      'local'
+    )
+
+    expect(merged.unavailableReason).toBe('mount hung')
+  })
+})
diff --git a/src/renderer/src/store/slices/worktrees/listing/worktree-catalog-visibility.ts b/src/renderer/src/store/slices/worktrees/listing/worktree-catalog-visibility.ts
index ce7a13c4b25..c6d3a9636f7 100644
--- a/src/renderer/src/store/slices/worktrees/listing/worktree-catalog-visibility.ts
+++ b/src/renderer/src/store/slices/worktrees/listing/worktree-catalog-visibility.ts
@@ -14,6 +14,7 @@ export function areDetectedWorktreeResultsEqual(
     current.repoId === next.repoId &&
     current.authoritative === next.authoritative &&
     current.source === next.source &&
+    current.unavailableReason === next.unavailableReason &&
     catalogRowsEqual(current.worktrees, next.worktrees)
   )
 }
diff --git a/src/renderer/src/store/terminals/terminal-layout-state.ts b/src/renderer/src/store/terminals/terminal-layout-state.ts
index d95439cf5a8..9b5cf8323c2 100644
--- a/src/renderer/src/store/terminals/terminal-layout-state.ts
+++ b/src/renderer/src/store/terminals/terminal-layout-state.ts
@@ -43,15 +43,20 @@ export function createTerminalLayoutActions(
         }
       })
     },
+    // Why: pane mount/unmount re-asserts the same booleans; bailing like setTabLayout keeps map subscribers asleep.
     setTabPaneExpanded: (tabId, expanded) => {
-      set((s) => ({
-        expandedPaneByTabId: { ...s.expandedPaneByTabId, [tabId]: expanded }
-      }))
+      set((s) =>
+        s.expandedPaneByTabId[tabId] === expanded
+          ? s
+          : { expandedPaneByTabId: { ...s.expandedPaneByTabId, [tabId]: expanded } }
+      )
     },
     setTabCanExpandPane: (tabId, canExpand) => {
-      set((s) => ({
-        canExpandPaneByTabId: { ...s.canExpandPaneByTabId, [tabId]: canExpand }
-      }))
+      set((s) =>
+        s.canExpandPaneByTabId[tabId] === canExpand
+          ? s
+          : { canExpandPaneByTabId: { ...s.canExpandPaneByTabId, [tabId]: canExpand } }
+      )
     },
     setTabLayout: (tabId, layout) => {
       let ownershipTransfers: ReturnType<typeof resolveTerminalLayoutPtyOwnershipTransfers> = []
diff --git a/src/renderer/src/store/terminals/terminal-pane-expansion-write-bailout.test.tsx b/src/renderer/src/store/terminals/terminal-pane-expansion-write-bailout.test.tsx
new file mode 100644
index 00000000000..d0d32f7742f
--- /dev/null
+++ b/src/renderer/src/store/terminals/terminal-pane-expansion-write-bailout.test.tsx
@@ -0,0 +1,152 @@
+// @vitest-environment happy-dom
+
+import { Profiler } from 'react'
+import { act, cleanup, render } from '@testing-library/react'
+import { afterEach, describe, expect, it } from 'vitest'
+import { createTestStore } from '../slices/store-test-helpers'
+
+afterEach(cleanup)
+
+type TestStore = ReturnType<typeof createTestStore>
+
+const TAB_ID = 'tab-1'
+const NO_OP_WRITES = 25
+
+function recordPublishedMapKeys(store: TestStore): string[] {
+  const published: string[] = []
+  store.subscribe((next, previous) => {
+    if (next.expandedPaneByTabId !== previous.expandedPaneByTabId) {
+      published.push('expandedPaneByTabId')
+    }
+    if (next.canExpandPaneByTabId !== previous.canExpandPaneByTabId) {
+      published.push('canExpandPaneByTabId')
+    }
+  })
+  return published
+}
+
+// Mirrors use-terminal-workspace-store-bindings.ts:17, which subscribes to the raw map.
+function ExpandedPaneSubscriber({ store }: { store: TestStore }): React.JSX.Element {
+  const expandedPaneByTabId = store((s) => s.expandedPaneByTabId)
+  return <span>{String(expandedPaneByTabId[TAB_ID] === true)}</span>
+}
+
+function CanExpandPaneSubscriber({ store }: { store: TestStore }): React.JSX.Element {
+  const canExpandPaneByTabId = store((s) => s.canExpandPaneByTabId)
+  return <span>{String(canExpandPaneByTabId[TAB_ID] === true)}</span>
+}
+
+function renderCommitCounter(subscriber: React.JSX.Element): () => number {
+  let commits = 0
+  render(
+    <Profiler
+      id="terminal-pane-expansion"
+      onRender={() => {
+        commits += 1
+      }}
+    >
+      {subscriber}
+    </Profiler>
+  )
+  const mountCommits = commits
+  return () => commits - mountCommits
+}
+
+describe('setTabPaneExpanded', () => {
+  it('publishes the first write for an unseen tab and a real toggle', () => {
+    const store = createTestStore()
+    const published = recordPublishedMapKeys(store)
+
+    store.getState().setTabPaneExpanded(TAB_ID, false)
+    expect(published).toEqual(['expandedPaneByTabId'])
+    expect(store.getState().expandedPaneByTabId[TAB_ID]).toBe(false)
+
+    store.getState().setTabPaneExpanded(TAB_ID, true)
+    expect(published).toEqual(['expandedPaneByTabId', 'expandedPaneByTabId'])
+    expect(store.getState().expandedPaneByTabId[TAB_ID]).toBe(true)
+  })
+
+  it('bails out when the value is unchanged', () => {
+    const store = createTestStore()
+    store.getState().setTabPaneExpanded(TAB_ID, false)
+    const before = store.getState().expandedPaneByTabId
+    // Root identity too: returning `{}` keeps the map but allocates a new root, so zustand still walks every listener.
+    const rootBefore = store.getState()
+    const published = recordPublishedMapKeys(store)
+
+    for (let i = 0; i < NO_OP_WRITES; i += 1) {
+      store.getState().setTabPaneExpanded(TAB_ID, false)
+    }
+
+    expect(published).toEqual([])
+    expect(store.getState().expandedPaneByTabId).toBe(before)
+    expect(store.getState()).toBe(rootBefore)
+  })
+
+  it('costs no React commit in a map subscriber when the value is unchanged', () => {
+    const store = createTestStore()
+    store.getState().setTabPaneExpanded(TAB_ID, false)
+    const commitsSinceMount = renderCommitCounter(<ExpandedPaneSubscriber store={store} />)
+
+    for (let i = 0; i < NO_OP_WRITES; i += 1) {
+      act(() => {
+        store.getState().setTabPaneExpanded(TAB_ID, false)
+      })
+    }
+    expect(commitsSinceMount()).toBe(0)
+
+    act(() => {
+      store.getState().setTabPaneExpanded(TAB_ID, true)
+    })
+    expect(commitsSinceMount()).toBe(1)
+  })
+})
+
+describe('setTabCanExpandPane', () => {
+  it('publishes the first write for an unseen tab and a real toggle', () => {
+    const store = createTestStore()
+    const published = recordPublishedMapKeys(store)
+
+    store.getState().setTabCanExpandPane(TAB_ID, false)
+    expect(published).toEqual(['canExpandPaneByTabId'])
+    expect(store.getState().canExpandPaneByTabId[TAB_ID]).toBe(false)
+
+    store.getState().setTabCanExpandPane(TAB_ID, true)
+    expect(published).toEqual(['canExpandPaneByTabId', 'canExpandPaneByTabId'])
+    expect(store.getState().canExpandPaneByTabId[TAB_ID]).toBe(true)
+  })
+
+  it('bails out when the value is unchanged', () => {
+    const store = createTestStore()
+    store.getState().setTabCanExpandPane(TAB_ID, false)
+    const before = store.getState().canExpandPaneByTabId
+    const rootBefore = store.getState()
+    const published = recordPublishedMapKeys(store)
+
+    for (let i = 0; i < NO_OP_WRITES; i += 1) {
+      store.getState().setTabCanExpandPane(TAB_ID, false)
+    }
+
+    expect(published).toEqual([])
+    expect(store.getState().canExpandPaneByTabId).toBe(before)
+    expect(store.getState()).toBe(rootBefore)
+  })
+
+  it('costs no React commit in a map subscriber when the value is unchanged', () => {
+    const store = createTestStore()
+    store.getState().setTabCanExpandPane(TAB_ID, false)
+    const commitsSinceMount = renderCommitCounter(<CanExpandPaneSubscriber store={store} />)
+
+    for (let i = 0; i < NO_OP_WRITES; i += 1) {
+      act(() => {
+        store.getState().setTabCanExpandPane(TAB_ID, false)
+      })
+    }
+    expect(commitsSinceMount()).toBe(0)
+
+    act(() => {
+      store.getState().setTabCanExpandPane(TAB_ID, true)
+    })
+    expect(commitsSinceMount()).toBe(1)
+  })
+})
diff --git a/src/renderer/src/web/preload-api/web-orca-profiles-api.ts b/src/renderer/src/web/preload-api/web-orca-profiles-api.ts
index 0b552bf15c8..e59d805ce3d 100644
--- a/src/renderer/src/web/preload-api/web-orca-profiles-api.ts
+++ b/src/renderer/src/web/preload-api/web-orca-profiles-api.ts
@@ -3,6 +3,7 @@ import {
   DEFAULT_LOCAL_ORCA_PROFILE_ID,
   createDefaultLocalOrcaProfile
 } from '../../../../shared/orca-profiles'
+import { noopUnsubscribe } from './web-storage'
 
 export function createWebOrcaProfilesApi(): Partial<PreloadApi> {
   const webOrcaProfileAuthStatus = () =>
@@ -22,6 +23,7 @@ export function createWebOrcaProfilesApi(): Partial<PreloadApi> {
           multiProfileUi: false
         }),
       authStatus: webOrcaProfileAuthStatus,
+      onAuthStatusChanged: () => noopUnsubscribe,
       createLocal: () =>
         Promise.resolve({
           activeProfileId: DEFAULT_LOCAL_ORCA_PROFILE_ID,
diff --git a/src/shared/agent-cli-install-dir-fallback.test.ts b/src/shared/agent-cli-install-dir-fallback.test.ts
new file mode 100644
index 00000000000..793c0861453
--- /dev/null
+++ b/src/shared/agent-cli-install-dir-fallback.test.ts
@@ -0,0 +1,276 @@
+import { delimiter, join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { detectCommandsInInstallDirs } from './local-agent-install-dir-detection'
+import {
+  getVersionManagerBinPaths,
+  resolveCliCommand,
+  resolveCliCommands
+} from './node-cli-command-resolution'
+import { buildPosixFallbackPathPrelude } from './posix-version-manager-bin-dirs'
+import { getSystemCliInstallDirectories } from './system-cli-install-dirs'
+
+/**
+ * The install-dir fallback answers "is this agent CLI installed?" whenever the
+ * login-shell PATH probe does not land. Homebrew, npm's default global prefix
+ * and opencode's own installer are absolute paths, so they cannot be staged
+ * under a temp home -- hence a synthetic fs rather than a fixture tree.
+ *
+ * Every staged path goes through `join`, because the lookup builds candidates
+ * with the host's `join`: a literal `/opt/homebrew/bin/codex` would never match
+ * on a Windows dev machine.
+ */
+const fsFixture = vi.hoisted(() => ({ executables: new Set<string>() }))
+
+const MOCK_HOME = '/home/tester'
+
+vi.mock('node:os', () => ({ homedir: () => MOCK_HOME }))
+
+vi.mock('node:fs', () => ({
+  constants: { X_OK: 1 },
+  statSync: (target: string) => {
+    if (!fsFixture.executables.has(target)) {
+      throw new Error(`ENOENT: ${target}`)
+    }
+    return { isFile: () => true }
+  },
+  accessSync: (target: string) => {
+    if (!fsFixture.executables.has(target)) {
+      throw new Error(`EACCES: ${target}`)
+    }
+  },
+  // No nvm install in any of these cases; the nvm walk is covered by nvm-default-alias.test.ts.
+  existsSync: () => false,
+  readdirSync: () => {
+    throw new Error('ENOENT')
+  },
+  readFileSync: () => {
+    throw new Error('ENOENT')
+  }
+}))
+
+// The PATH a Finder/Dock-launched macOS app inherits with no login shell.
+const GUI_LAUNCH_PATH = ['/usr/bin', '/bin', '/usr/sbin', '/sbin'].join(delimiter)
+
+function stage(...paths: string[]): void {
+  for (const path of paths) {
+    fsFixture.executables.add(path)
+  }
+}
+
+function resolveAll(
+  commands: string[],
+  options: { platform: NodeJS.Platform; homePath: string }
+): Record<string, string> {
+  return Object.fromEntries(
+    resolveCliCommands(commands, { ...options, pathEnv: GUI_LAUNCH_PATH })
+  ) as Record<string, string>
+}
+
+beforeEach(() => {
+  fsFixture.executables.clear()
+  // Why: the no-options entry point reads the ambient PATH, where a dev box's
+  // real /usr/local/bin would answer before the fallback ever runs.
+  vi.stubEnv('PATH', GUI_LAUNCH_PATH)
+})
+
+afterEach(() => {
+  vi.unstubAllEnvs()
+})
+
+describe('agent CLI install-dir fallback', () => {
+  it('finds macOS CLIs installed outside a version manager', () => {
+    const home = '/Users/tester'
+    stage(
+      join(home, '.local', 'bin', 'claude'),
+      join('/opt/homebrew/bin', 'codex'),
+      join('/usr/local/bin', 'cursor-agent'),
+      join(home, '.opencode', 'bin', 'opencode')
+    )
+    expect(
+      resolveAll(['claude', 'codex', 'cursor-agent', 'opencode'], {
+        platform: 'darwin',
+        homePath: home
+      })
+    ).toEqual({
+      claude: join(home, '.local', 'bin', 'claude'),
+      codex: join('/opt/homebrew/bin', 'codex'),
+      'cursor-agent': join('/usr/local/bin', 'cursor-agent'),
+      opencode: join(home, '.opencode', 'bin', 'opencode')
+    })
+  })
+
+  it('finds Linux CLIs in Linuxbrew, snap and nix prefixes, not the macOS brew prefix', () => {
+    const home = '/home/tester'
+    stage(
+      join('/home/linuxbrew/.linuxbrew/bin', 'codex'),
+      join('/snap/bin', 'cursor-agent'),
+      join(home, '.nix-profile', 'bin', 'opencode'),
+      join('/opt/homebrew/bin', 'claude')
+    )
+    expect(
+      resolveAll(['codex', 'cursor-agent', 'opencode', 'claude'], {
+        platform: 'linux',
+        homePath: home
+      })
+    ).toEqual({
+      codex: join('/home/linuxbrew/.linuxbrew/bin', 'codex'),
+      'cursor-agent': join('/snap/bin', 'cursor-agent'),
+      opencode: join(home, '.nix-profile', 'bin', 'opencode'),
+      // Why unresolved: /opt/homebrew is an Apple Silicon prefix; Linuxbrew uses another.
+      claude: 'claude'
+    })
+  })
+
+  it('leaves the win32 branch on its own install dirs', () => {
+    const home = 'C:/Users/tester'
+    stage(join(home, 'AppData', 'Roaming', 'npm', 'codex.cmd'), join('/usr/local/bin', 'claude'))
+    expect(resolveAll(['codex', 'claude'], { platform: 'win32', homePath: home })).toEqual({
+      codex: join(home, 'AppData', 'Roaming', 'npm', 'codex.cmd'),
+      claude: 'claude'
+    })
+  })
+
+  // Why pinned: patchPackagedProcessPath seeds these onto PATH in this order and
+  // the POSIX guest prelude appends them in it, so a divergence here would spawn
+  // a different binary than the packaged PATH scan for the same install.
+  it('ranks system install dirs in the same order as the PATH seed', () => {
+    const home = '/home/tester'
+    const dirs = [
+      '/usr/local/bin',
+      '/snap/bin',
+      '/home/linuxbrew/.linuxbrew/bin',
+      '/nix/var/nix/profiles/default/bin',
+      join(home, '.nix-profile', 'bin'),
+      join(home, '.opencode', 'bin'),
+      join(home, '.vite-plus', 'bin')
+    ]
+    stage(...dirs.map((dir) => join(dir, 'opencode')))
+    for (const expected of dirs) {
+      expect(resolveAll(['opencode'], { platform: 'linux', homePath: home })).toEqual({
+        opencode: join(expected, 'opencode')
+      })
+      fsFixture.executables.delete(join(expected, 'opencode'))
+    }
+  })
+
+  // Why both resolvers and both platforms: resolveCliCommand is what every
+  // spawn site (codex login, app-server, session-index heal) calls, and its
+  // list was once spelled separately from resolveCliCommands'. A same-named
+  // binary in /usr/local/bin must never shadow the one a version manager owns.
+  describe.each([
+    { platform: 'darwin' as const, home: '/Users/tester', systemDir: '/opt/homebrew/bin' },
+    {
+      platform: 'linux' as const,
+      home: '/home/tester',
+      systemDir: '/home/linuxbrew/.linuxbrew/bin'
+    }
+  ])('$platform: system dirs stay last', ({ platform, home, systemDir }) => {
+    it('lets a version-manager install outrank a system one', () => {
+      const managed = join(home, '.volta', 'bin', 'codex')
+      stage(managed, join(systemDir, 'codex'), join('/usr/local/bin', 'codex'))
+      expect(resolveCliCommand('codex', { platform, homePath: home })).toBe(managed)
+      expect(resolveAll(['codex'], { platform, homePath: home })).toEqual({ codex: managed })
+    })
+
+    it('lets an npm --user (~/.local/bin) install outrank a system one', () => {
+      const managed = join(home, '.local', 'bin', 'codex')
+      stage(managed, join(systemDir, 'codex'))
+      expect(resolveCliCommand('codex', { platform, homePath: home })).toBe(managed)
+      expect(resolveAll(['codex'], { platform, homePath: home })).toEqual({ codex: managed })
+    })
+
+    it('lets a copy already on PATH outrank every install dir', () => {
+      const onPath = join('/custom/bin', 'codex')
+      const pathEnv = [GUI_LAUNCH_PATH, '/custom/bin'].join(delimiter)
+      stage(onPath, join(home, '.volta', 'bin', 'codex'), join(systemDir, 'codex'))
+      expect(resolveCliCommand('codex', { platform, homePath: home, pathEnv })).toBe(onPath)
+      expect(resolveCliCommands(['codex'], { platform, homePath: home, pathEnv })).toEqual(
+        new Map([['codex', onPath]])
+      )
+    })
+  })
+
+  // Why this guard: getVersionManagerBinPaths is PREPENDED onto PATH by
+  // patchPackagedProcessPath and the CLI's addAgentNodePaths, so a system dir
+  // leaking into it would re-rank binaries the user already has (#18234).
+  it('keeps system install dirs out of the PATH seed list', () => {
+    for (const platform of ['darwin', 'linux'] as const) {
+      const home = platform === 'darwin' ? '/Users/tester' : '/home/tester'
+      const seeded = getVersionManagerBinPaths({ platform, homePath: home })
+      // Spelled out, not derived from the list under test: a guard that iterates
+      // getSystemCliInstallDirectories passes vacuously if that list is emptied
+      // into getBaseVersionManagerDirectories, which is the leak it guards.
+      for (const directory of [
+        '/opt/homebrew/bin',
+        '/usr/local/bin',
+        '/snap/bin',
+        '/home/linuxbrew/.linuxbrew/bin',
+        '/nix/var/nix/profiles/default/bin',
+        join(home, '.nix-profile', 'bin'),
+        join(home, '.opencode', 'bin'),
+        join(home, '.vite-plus', 'bin')
+      ]) {
+        expect(seeded).not.toContain(directory)
+      }
+    }
+  })
+
+  // Why through this entry point: it is what the `orca` CLI's agent detection
+  // calls, and the "absolute path means installed" contract lives here.
+  it.skipIf(process.platform === 'win32')(
+    'reports a system-installed CLI as detected, not just resolved',
+    () => {
+      stage(
+        join('/usr/local/bin', 'codex'),
+        join(MOCK_HOME, '.opencode', 'bin', 'opencode'),
+        // Why pi: it is a probed detect command on every runtime (tui-agent-config.ts,
+        // no detectUnsupportedRuntimes) and its installer defaults to ~/.vite-plus/bin,
+        // the second dir #829 named and seeded alongside ~/.opencode/bin.
+        join(MOCK_HOME, '.vite-plus', 'bin', 'pi')
+      )
+      // All three come from the fallback: the stubbed PATH holds no system dir.
+      expect(detectCommandsInInstallDirs(['codex', 'opencode', 'pi', 'cursor-agent'])).toEqual(
+        new Set(['codex', 'opencode', 'pi'])
+      )
+    }
+  )
+
+  it('carries the system install dirs into the POSIX guest fallback prelude', () => {
+    const prelude = buildPosixFallbackPathPrelude()
+    const systemDirs = [
+      '"/usr/local/bin"',
+      '"/snap/bin"',
+      '"/home/linuxbrew/.linuxbrew/bin"',
+      '"/nix/var/nix/profiles/default/bin"',
+      '"$HOME/.nix-profile/bin"',
+      '"$HOME/.opencode/bin"',
+      '"$HOME/.vite-plus/bin"'
+    ]
+    const offsets = systemDirs.map((dir) => prelude.indexOf(dir))
+    expect(offsets.every((offset) => offset >= 0)).toBe(true)
+    expect([...offsets].sort((a, b) => a - b)).toEqual(offsets)
+    // Why after: the guest prelude appends, so a version manager must still win.
+    expect(prelude.indexOf('.nvm/versions/node/*/bin')).toBeLessThan(offsets[0])
+    // Why absent: a WSL guest is Linux, so /opt/homebrew is never its brew prefix.
+    expect(prelude).not.toContain('/opt/homebrew')
+  })
+
+  // Why derived: the native and guest lists drifted apart once by hand. Every
+  // version-manager dir the native resolver knows must precede the guest's
+  // first system dir, and the guest's system block must be the native one.
+  it('keeps the WSL guest prelude in step with the native Linux lists', () => {
+    const prelude = buildPosixFallbackPathPrelude()
+    const asGuest = (dir: string): string => `"${dir.split('\\').join('/')}"`
+    const systemDirs = getSystemCliInstallDirectories('linux', '$HOME').map(asGuest)
+    const firstSystemOffset = prelude.indexOf(systemDirs[0])
+    expect(firstSystemOffset).toBeGreaterThan(0)
+    for (const dir of getVersionManagerBinPaths({ platform: 'linux', homePath: '$HOME' })) {
+      const offset = prelude.indexOf(asGuest(dir))
+      expect(offset, dir).toBeGreaterThanOrEqual(0)
+      expect(offset, dir).toBeLessThan(firstSystemOffset)
+    }
+    const systemOffsets = systemDirs.map((dir) => prelude.indexOf(dir))
+    expect(systemOffsets.every((offset) => offset >= firstSystemOffset)).toBe(true)
+    expect([...systemOffsets].sort((a, b) => a - b)).toEqual(systemOffsets)
+  })
+})
diff --git a/src/shared/agent-hook-listener/transcript-reader.test.ts b/src/shared/agent-hook-listener/transcript-reader.test.ts
new file mode 100644
index 00000000000..83780b08388
--- /dev/null
+++ b/src/shared/agent-hook-listener/transcript-reader.test.ts
@@ -0,0 +1,70 @@
+import { describe, expect, it } from 'vitest'
+import { findLastExtractedTranscriptLineText } from './transcript-reader'
+import { extractAssistantTextFromLine } from './transcript-entry-text'
+
+function expectedLines(text: string): string[] {
+  return text
+    .split('\n')
+    .toReversed()
+    .map((line) => line.trim())
+    .filter((line) => line.length > 0)
+}
+
+describe('backward transcript line extraction', () => {
+  it.each(['', '\n', '\n\n', '\r\n', ' \t\r\n', '\na\n', 'a\nb', '😀\r\n漢字'])(
+    'visits each nonblank line once in reverse order for %j',
+    (text) => {
+      const seen: string[] = []
+      expect(
+        findLastExtractedTranscriptLineText(text, (line) => {
+          seen.push(line)
+          return undefined
+        })
+      ).toBeUndefined()
+      expect(seen).toEqual(expectedLines(text))
+    }
+  )
+
+  it('preserves line order and early return across generated delimiters', () => {
+    let seed = 29
+    const fragments = ['a', '\n', '\r\n', ' ', '\t', '😀', '\u2028', '\0']
+    for (let sample = 0; sample < 1000; sample++) {
+      let text = ''
+      for (let i = 0; i < sample % 100; i++) {
+        seed = (Math.imul(seed, 1664525) + 1013904223) >>> 0
+        text += fragments[seed % fragments.length]
+      }
+      const lines = expectedLines(text)
+      const stop = sample % (lines.length + 1)
+      const seen: string[] = []
+      const result = findLastExtractedTranscriptLineText(text, (line) => {
+        seen.push(line)
+        return seen.length === stop + 1 ? line : undefined
+      })
+      expect(seen).toEqual(lines.slice(0, stop + 1))
+      expect(result).toBe(lines[stop])
+    }
+  })
+
+  it('returns the newest assistant message behind a long tool line', () => {
+    const message = JSON.stringify({ role: 'assistant', content: 'latest 😀' })
+    const tool = JSON.stringify({ role: 'tool', content: 'x'.repeat(256 * 1024) })
+    expect(
+      findLastExtractedTranscriptLineText(
+        `\n{"role":"assistant","content":"older"}\r\n${message}\r\n${tool}\n`,
+        extractAssistantTextFromLine
+      )
+    ).toBe('latest 😀')
+  })
+
+  it('treats an empty extracted string as a result and stops before older lines', () => {
+    const seen: string[] = []
+    expect(
+      findLastExtractedTranscriptLineText('older\nlatest\n', (line) => {
+        seen.push(line)
+        return ''
+      })
+    ).toBe('')
+    expect(seen).toEqual(['latest'])
+  })
+})
diff --git a/src/shared/agent-hook-listener/transcript-reader.ts b/src/shared/agent-hook-listener/transcript-reader.ts
index f9b1472384e..89df71da2df 100644
--- a/src/shared/agent-hook-listener/transcript-reader.ts
+++ b/src/shared/agent-hook-listener/transcript-reader.ts
@@ -88,10 +88,8 @@ export function findLastExtractedTranscriptLineText(
 ): string | undefined {
   let lineEnd = text.length
 
-  for (let index = text.length - 1; index >= -1; index--) {
-    if (index >= 0 && text.charCodeAt(index) !== 10) {
-      continue
-    }
+  while (lineEnd > 0) {
+    const index = text.lastIndexOf('\n', lineEnd - 1)
 
     const line = text.slice(index + 1, lineEnd).trim()
     if (line.length > 0) {
diff --git a/src/shared/agent-hook-spool-read.test.ts b/src/shared/agent-hook-spool-read.test.ts
new file mode 100644
index 00000000000..d589f5b2274
--- /dev/null
+++ b/src/shared/agent-hook-spool-read.test.ts
@@ -0,0 +1,65 @@
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { readSpoolFile } from './agent-hook-spool'
+
+let dir: string
+
+beforeEach(() => {
+  dir = mkdtempSync(join(tmpdir(), 'orca-spool-read-'))
+})
+
+afterEach(() => {
+  rmSync(dir, { recursive: true, force: true })
+})
+
+function write(contents: string): string {
+  const file = join(dir, 'spool.jsonl')
+  writeFileSync(file, contents)
+  return file
+}
+
+function record(paneKey: string): string {
+  return JSON.stringify({ paneKey, source: 'PreToolUse', payload: {}, receivedAt: Date.now() })
+}
+
+describe('readSpoolFile', () => {
+  it('leaves a trailing line without its newline unconsumed', () => {
+    const complete = `${record('a')}\n`
+    const result = readSpoolFile(write(`${complete}${record('b')}`))
+
+    expect(result.records.map((entry) => entry.paneKey)).toEqual(['a'])
+    // The in-flight final record must stay replayable: consumed stops at the last newline.
+    expect(result.consumed).toBe(Buffer.byteLength(complete))
+  })
+
+  it('consumes through the final newline when every line is complete', () => {
+    const contents = `${record('a')}\n${record('b')}\n`
+    const result = readSpoolFile(write(contents))
+
+    expect(result.records.map((entry) => entry.paneKey)).toEqual(['a', 'b'])
+    expect(result.consumed).toBe(Buffer.byteLength(contents))
+  })
+
+  it('skips blank lines without consuming less than the bytes they occupy', () => {
+    const contents = `${record('a')}\n\n\n${record('b')}\n`
+    const result = readSpoolFile(write(contents))
+
+    expect(result.records.map((entry) => entry.paneKey)).toEqual(['a', 'b'])
+    expect(result.consumed).toBe(Buffer.byteLength(contents))
+  })
+
+  it('returns nothing for an empty file', () => {
+    expect(readSpoolFile(write(''))).toEqual({ records: [], consumed: 0 })
+  })
+
+  it('returns nothing for a file that is one torn line', () => {
+    expect(readSpoolFile(write(record('a'))).records).toEqual([])
+    expect(readSpoolFile(write(record('a'))).consumed).toBe(0)
+  })
+
+  it('returns nothing for a missing file', () => {
+    expect(readSpoolFile(join(dir, 'absent.jsonl'))).toEqual({ records: [], consumed: 0 })
+  })
+})
diff --git a/src/shared/agent-hook-spool.ts b/src/shared/agent-hook-spool.ts
index 3ad478ed8a5..275e6f5ce52 100644
--- a/src/shared/agent-hook-spool.ts
+++ b/src/shared/agent-hook-spool.ts
@@ -67,19 +67,17 @@ export function readSpoolFile(
   const records: SpoolRecord[] = []
   let consumed = 0
   let start = 0
-  for (let end = 0; end <= bytes.length; end += 1) {
-    if (end !== bytes.length && bytes[end] !== 0x0a) {
-      continue
-    }
+  // indexOf, not a per-byte loop: this runs over every spooled file before the hook listener binds,
+  // and Buffer.indexOf finds the newline with memchr instead of an interpreted scan.
+  for (;;) {
+    const end = bytes.indexOf(0x0a, start)
     // A final line without its newline may still be in flight from a hook writer.
     // Leave it untouched until the writer terminates the record explicitly.
-    if (end === bytes.length && (end === 0 || bytes[end - 1] !== 0x0a)) {
+    if (end === -1) {
       break
     }
     const lineBytes = bytes.subarray(start, end)
-    if (end !== bytes.length) {
-      consumed = end + 1
-    }
+    consumed = end + 1
     start = end + 1
     if (lineBytes.length === 0) {
       continue
diff --git a/src/shared/agent-session-definitive-refusal.test.ts b/src/shared/agent-session-definitive-refusal.test.ts
new file mode 100644
index 00000000000..74dd3529cf6
--- /dev/null
+++ b/src/shared/agent-session-definitive-refusal.test.ts
@@ -0,0 +1,48 @@
+import { describe, expect, it } from 'vitest'
+import { AGENT_SESSION_WIRE_REFUSAL_CODES } from './agent-session-wire'
+import { agentSessionRefusalOperationState } from './agent-session-refusal-retry'
+import { isDefinitiveAgentSessionCreateRefusal } from './agent-session-definitive-refusal'
+
+describe('definitive agent-session create refusals', () => {
+  it('treats an unsupported structured session as definitive', () => {
+    expect(isDefinitiveAgentSessionCreateRefusal('structured_agent_session_unsupported')).toBe(true)
+  })
+
+  it('never treats an unproven outcome as definitive', () => {
+    expect(isDefinitiveAgentSessionCreateRefusal('agent_session_operation_unknown')).toBe(false)
+    expect(isDefinitiveAgentSessionCreateRefusal('agent_session_ownership_unknown')).toBe(false)
+  })
+
+  it('leaves transport failures, timeouts and a missing code unknown', () => {
+    expect(isDefinitiveAgentSessionCreateRefusal('runtime_error')).toBe(false)
+    expect(isDefinitiveAgentSessionCreateRefusal('remote_runtime_unavailable')).toBe(false)
+    expect(isDefinitiveAgentSessionCreateRefusal('timeout')).toBe(false)
+    expect(isDefinitiveAgentSessionCreateRefusal('runtime_timeout')).toBe(false)
+    expect(isDefinitiveAgentSessionCreateRefusal(undefined)).toBe(false)
+    expect(isDefinitiveAgentSessionCreateRefusal(null)).toBe(false)
+    expect(isDefinitiveAgentSessionCreateRefusal('')).toBe(false)
+  })
+
+  it('counts a method an old host never registered as definitive', () => {
+    expect(isDefinitiveAgentSessionCreateRefusal('method_not_found')).toBe(true)
+  })
+
+  it('is an allowlist: every other wire refusal code is unknown', () => {
+    const definitive = AGENT_SESSION_WIRE_REFUSAL_CODES.filter((code) =>
+      isDefinitiveAgentSessionCreateRefusal(code)
+    )
+    expect(definitive).toEqual(['structured_agent_session_unsupported'])
+  })
+
+  it('does not answer the durable-settlement question, which disagrees on the one code that matters', () => {
+    // Guards the reuse this allowlist exists to avoid: settlement state calls the definitive
+    // refusal pending-admission, which would rule out the fallback it is meant to allow.
+    expect(
+      agentSessionRefusalOperationState(
+        'agentSession.create',
+        'structured_agent_session_unsupported'
+      )
+    ).toBe('pending-admission')
+    expect(isDefinitiveAgentSessionCreateRefusal('structured_agent_session_unsupported')).toBe(true)
+  })
+})
diff --git a/src/shared/agent-session-definitive-refusal.ts b/src/shared/agent-session-definitive-refusal.ts
new file mode 100644
index 00000000000..80721592ed9
--- /dev/null
+++ b/src/shared/agent-session-definitive-refusal.ts
@@ -0,0 +1,35 @@
+/**
+ * "May a caller create something else instead?" — the fallback question.
+ *
+ * Deliberately NOT `agentSessionRefusalOperationState`: that answers "did this operation durably
+ * settle?", and for that question `structured_agent_session_unsupported` is correctly
+ * pending-admission. Reused here it would rule out a fallback on the one refusal that most needs
+ * one. The two questions only look alike.
+ *
+ * An allowlist, never a negation: falling back on an outcome the host could not describe is how a
+ * user ends up with two sessions for one intent. Everything absent — transport failures, timeouts,
+ * `agent_session_operation_unknown`, `agent_session_ownership_unknown` — is unknown, and unknown
+ * never falls back.
+ */
+
+import type { AgentSessionWireRefusalCode } from './agent-session-wire'
+
+/** Proves the host neither created a session nor will on a retry. */
+const DEFINITIVE_REFUSAL_CODES: ReadonlySet<string> = new Set<AgentSessionWireRefusalCode>([
+  'structured_agent_session_unsupported'
+])
+
+/** A dispatcher that never registered the method ran no handler at all, which is as definitive as
+ *  a refusal — and the only transport-level answer that is. */
+const DEFINITIVE_RPC_ERROR_CODES: ReadonlySet<string> = new Set(['method_not_found'])
+
+/**
+ * True only when the code proves nothing was created. Accepts a wire refusal code or an RPC error
+ * code; the two namespaces are disjoint.
+ */
+export function isDefinitiveAgentSessionCreateRefusal(code: string | null | undefined): boolean {
+  if (typeof code !== 'string') {
+    return false
+  }
+  return DEFINITIVE_REFUSAL_CODES.has(code) || DEFINITIVE_RPC_ERROR_CODES.has(code)
+}
diff --git a/src/shared/agent-session-journal-schemas.ts b/src/shared/agent-session-journal-schemas.ts
index 2b1ab5404fc..ee200cdcd94 100644
--- a/src/shared/agent-session-journal-schemas.ts
+++ b/src/shared/agent-session-journal-schemas.ts
@@ -1,11 +1,12 @@
 // ─── Canonical runtime schemas for the journal render model ─────────────────
-// The journal admits JSON it did not just write — snapshot files and log rows
-// re-enter from disk and are republished to clients — while the reducer, the
+// The journal admits JSON it did not just write — persisted rows re-enter from
+// SQLite on replay and are republished to clients — while the reducer, the
 // shared projection, and the prompt surfaces dereference nested fields without
 // guards. These schemas are the single deep validators for that render model:
 // admission must reject a JSON-valid but structurally wrong item (a question
-// whose `options` are null, a prompt without its `resolution`) so corruption
-// lands in quarantine instead of throwing mid-render.
+// whose `options` are null, a prompt without its `resolution`) so the row is
+// rejected at replay, where a repair can delete it, instead of throwing
+// mid-render.
 //
 // Discriminants (`kind`, known block `type`s) are validated deeply. Open string
 // fields (roles, dispatch/tool states) stay type-checked, never enum-checked,
@@ -63,7 +64,24 @@ const Block = z.union([
   z.object({ type: z.string() }).refine((block) => !KNOWN_BLOCK_TYPES.has(block.type))
 ])
 
-const PromptOption = z.object({ id: z.string(), label: z.string() })
+const PromptOption = z
+  .object({
+    id: z.string(),
+    label: z.string(),
+    description: z.string().optional()
+  })
+  .strict()
+
+const Question = z
+  .object({
+    id: z.string(),
+    question: z.string(),
+    header: z.string().optional(),
+    multiSelect: z.boolean(),
+    options: z.array(PromptOption),
+    freeTextQuestionId: z.string().optional()
+  })
+  .strict()
 
 const Resolution = z.object({
   state: z.string().min(1),
@@ -100,6 +118,7 @@ export const AgentJournalItemBodySchema = z.discriminatedUnion('kind', [
     kind: z.literal('question'),
     question: z.string(),
     options: z.array(PromptOption),
+    questions: z.array(Question).optional(),
     freeTextQuestionId: z.string().optional(),
     resolution: Resolution
   }),
@@ -154,8 +173,8 @@ export function isAdmissibleAgentJournalSubmission(
   return AgentJournalSubmissionSchema.safeParse(value).success
 }
 
-/** Compile-time proof that every canonical value is admissible, so admission
- *  can never quarantine a row a writer in this build produced. The schemas are
+/** Compile-time proof that every canonical value is admissible, so replay can
+ *  never reject a row a writer in this build produced. The schemas are
  *  deliberately wider on open string fields, so only this direction holds. */
 type Admits<T extends true> = T
 export type CanonicalJournalShapesAreAdmissible = [
diff --git a/src/shared/agent-session-journal-types.ts b/src/shared/agent-session-journal-types.ts
index f5dabfdec23..cf6d89070bf 100644
--- a/src/shared/agent-session-journal-types.ts
+++ b/src/shared/agent-session-journal-types.ts
@@ -58,13 +58,15 @@ export type AgentJournalItemIdentity =
 
 // ─── Bounded payloads ───────────────────────────────────────────────────────
 
-/** A tool output or diff body clipped to a head plus a content-addressed
- *  remainder. Crossing a bound sets `truncated`; it never silently drops. */
+/** A tool output or diff body clipped to a head. The remainder is DISCARDED,
+ *  never stored: crossing a bound sets `truncated` and the two fields below
+ *  describe what was dropped, so it is marked rather than silently lost. */
 export type AgentJournalBoundedPayload = {
   head: string
   /** Byte length of the ORIGINAL payload, not of `head`. */
   byteLength: number
-  /** sha256 of the original payload, and the blob store key when `truncated`. */
+  /** sha256 of the original payload — identification only; nothing stores or
+   *  retrieves the discarded remainder by it. */
   digest: string
   truncated: boolean
 }
@@ -111,6 +113,17 @@ export type AgentJournalResolution = {
 export type AgentJournalPromptOption = {
   id: string
   label: string
+  description?: string
+}
+
+export type AgentJournalQuestion = {
+  id: string
+  question: string
+  header?: string
+  multiSelect: boolean
+  options: AgentJournalPromptOption[]
+  /** Present when the provider accepts an answer outside the offered options. */
+  freeTextQuestionId?: string
 }
 
 export type AgentJournalApprovalItem = {
@@ -125,6 +138,7 @@ export type AgentJournalQuestionItem = {
   kind: 'question'
   question: string
   options: AgentJournalPromptOption[]
+  questions?: AgentJournalQuestion[]
   /** Present when the provider accepts an answer outside the offered options. */
   freeTextQuestionId?: string
   resolution: AgentJournalResolution
diff --git a/src/shared/agent-session-question-answer.test.ts b/src/shared/agent-session-question-answer.test.ts
new file mode 100644
index 00000000000..529bfdfd72d
--- /dev/null
+++ b/src/shared/agent-session-question-answer.test.ts
@@ -0,0 +1,49 @@
+import { describe, expect, it } from 'vitest'
+import {
+  decodeAgentSessionQuestionAnswers,
+  encodeAgentSessionQuestionAnswers,
+  isValidAgentSessionQuestionAnswers,
+  type AgentSessionQuestionAnswer
+} from './agent-session-question-answer'
+
+describe('agent-session grouped question answers', () => {
+  const answers: AgentSessionQuestionAnswer[] = [
+    { questionId: 'q1', optionIds: ['target-web', 'target-mobile'] },
+    { questionId: 'q2', optionIds: [], other: 'SSH host' }
+  ]
+
+  it('round-trips grouped multi-select and free-text answers', () => {
+    expect(decodeAgentSessionQuestionAnswers(encodeAgentSessionQuestionAnswers(answers))).toEqual(
+      answers
+    )
+  })
+
+  it('validates each grouped answer against its question shape', () => {
+    const questions = [
+      {
+        id: 'q1',
+        question: 'Targets',
+        multiSelect: true,
+        options: [
+          { id: 'target-web', label: 'Web' },
+          { id: 'target-mobile', label: 'Mobile' }
+        ]
+      },
+      {
+        id: 'q2',
+        question: 'Host',
+        multiSelect: false,
+        options: [],
+        freeTextQuestionId: 'q2'
+      }
+    ]
+
+    expect(isValidAgentSessionQuestionAnswers(questions, answers)).toBe(true)
+    expect(
+      isValidAgentSessionQuestionAnswers(questions, [
+        { questionId: 'q1', optionIds: ['unknown'] },
+        answers[1]!
+      ])
+    ).toBe(false)
+  })
+})
diff --git a/src/shared/agent-session-question-answer.ts b/src/shared/agent-session-question-answer.ts
new file mode 100644
index 00000000000..f90df30ddff
--- /dev/null
+++ b/src/shared/agent-session-question-answer.ts
@@ -0,0 +1,84 @@
+import type { AgentJournalQuestion } from './agent-session-journal-types'
+
+const GROUP_ANSWER_PREFIX = 'question-group:'
+
+export type AgentSessionQuestionAnswer = {
+  questionId: string
+  optionIds: string[]
+  other?: string
+}
+
+export function encodeAgentSessionQuestionAnswers(
+  answers: readonly AgentSessionQuestionAnswer[]
+): string {
+  return `${GROUP_ANSWER_PREFIX}${encodeURIComponent(JSON.stringify(answers))}`
+}
+
+export function decodeAgentSessionQuestionAnswers(
+  encoded: string
+): AgentSessionQuestionAnswer[] | null {
+  if (!encoded.startsWith(GROUP_ANSWER_PREFIX)) {
+    return null
+  }
+  try {
+    const parsed: unknown = JSON.parse(
+      decodeURIComponent(encoded.slice(GROUP_ANSWER_PREFIX.length))
+    )
+    if (!Array.isArray(parsed)) {
+      return null
+    }
+    const answers = parsed.flatMap((value): AgentSessionQuestionAnswer[] => {
+      if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        return []
+      }
+      const record = value as Record<string, unknown>
+      if (
+        typeof record.questionId !== 'string' ||
+        !Array.isArray(record.optionIds) ||
+        !record.optionIds.every((optionId) => typeof optionId === 'string') ||
+        (record.other !== undefined && typeof record.other !== 'string')
+      ) {
+        return []
+      }
+      return [
+        {
+          questionId: record.questionId,
+          optionIds: record.optionIds,
+          ...(typeof record.other === 'string' ? { other: record.other } : {})
+        }
+      ]
+    })
+    return answers.length === parsed.length ? answers : null
+  } catch {
+    return null
+  }
+}
+
+export function isValidAgentSessionQuestionAnswers(
+  questions: readonly AgentJournalQuestion[],
+  answers: readonly AgentSessionQuestionAnswer[]
+): boolean {
+  if (answers.length !== questions.length) {
+    return false
+  }
+  const byId = new Map(answers.map((answer) => [answer.questionId, answer]))
+  if (byId.size !== answers.length) {
+    return false
+  }
+  return questions.every((question) => {
+    const answer = byId.get(question.id)
+    if (!answer) {
+      return false
+    }
+    const offered = new Set(question.options.map((option) => option.id))
+    if (answer.optionIds.some((optionId) => !offered.has(optionId))) {
+      return false
+    }
+    const other = answer.other?.trim() ?? ''
+    if (other && !question.freeTextQuestionId) {
+      return false
+    }
+    const answerCount = answer.optionIds.length + (other ? 1 : 0)
+    return answerCount > 0 && (question.multiSelect || answerCount === 1)
+  })
+}
diff --git a/src/shared/agent-session-wire.ts b/src/shared/agent-session-wire.ts
index 893534f7f10..b7360bd0e62 100644
--- a/src/shared/agent-session-wire.ts
+++ b/src/shared/agent-session-wire.ts
@@ -12,8 +12,13 @@ import type {
   AgentJournalResolution,
   AgentJournalSubmission
 } from './agent-session-journal-types'
-import type { AgentSessionHandoffStage, AgentSessionOwnerRuntimeKind } from './agent-session-record'
+import type {
+  AgentSessionHandoffStage,
+  AgentSessionOwnerRuntimeKind,
+  AgentSessionRecord
+} from './agent-session-record'
 import type { AgentProviderSessionMetadata } from './agent-session-resume'
+import type { StructuredAgentSessionProjectedStatus } from './structured-agent-session-projection'
 
 export type AgentSessionHandoffDirection = 'to-tui' | 'to-native'
 export type AgentSessionHandoffMode = 'now' | 'after-turn' | 'stop-turn'
@@ -49,6 +54,20 @@ export type AgentSessionHandoffRequest = {
 
 export type AgentSessionHandoffResult = { status: AgentSessionHandoffStatus }
 
+export type AgentSessionBackgroundTask = {
+  id: string
+  kind: 'agent' | 'workflow' | 'command' | 'monitor' | 'unknown'
+  description?: string
+}
+
+export type AgentSessionBackgroundTaskState = {
+  state: 'monitoring'
+  /** Optional so mixed-version clients can consume state-only hosts. */
+  tasks?: AgentSessionBackgroundTask[]
+  /** Optional so clients only send targeted stops to hosts that accept them. */
+  supportsTaskStop?: boolean
+}
+
 /** Backward paging is the client's normal read; 40 matches the page size the
  *  mobile list renders without a visible fill-in. */
 export const AGENT_SESSION_HISTORY_DEFAULT_LIMIT = 40
@@ -92,6 +111,8 @@ export type AgentSessionHistoryPage = {
   liveCursor?: AgentJournalCursor
   hasOlder: boolean
   hasNewer: boolean
+  /** Present on hosts that expose provider-owned background task lifecycle. */
+  backgroundTasks?: AgentSessionBackgroundTaskState | null
 }
 
 export type AgentSessionHistoryResult =
@@ -123,6 +144,7 @@ export type AgentSessionSubscribeEvent =
       page: AgentSessionHistoryPage
       fence: number
       handoff?: AgentSessionHandoffStatus
+      backgroundTasks?: AgentSessionBackgroundTaskState | null
     }
   | {
       type: 'batch'
@@ -131,6 +153,7 @@ export type AgentSessionSubscribeEvent =
       /** Added with handoff state so mixed-version cursors retain the ownership fence. */
       fence?: number
       handoff?: AgentSessionHandoffStatus
+      backgroundTasks?: AgentSessionBackgroundTaskState | null
     }
   | {
       type: 'reset'
@@ -139,9 +162,33 @@ export type AgentSessionSubscribeEvent =
       page: AgentSessionHistoryPage
       fence: number
       handoff?: AgentSessionHandoffStatus
+      backgroundTasks?: AgentSessionBackgroundTaskState | null
     }
   | { type: 'end' }
 
+// ─── Status feed ────────────────────────────────────────────────────────────
+
+/** What a session list needs to know about one session. The host projects it
+ *  from the journal so no client has to replay a transcript to learn whether a
+ *  turn is running. Additive surface: an older host has no such method. */
+export type AgentSessionStatusSummary = {
+  sessionId: string
+  workspaceId: string
+  agent: AgentSessionRecord['provider']
+  /** Null until the journal holds a persisted user or assistant message. */
+  status: StructuredAgentSessionProjectedStatus | null
+  latestPrompt: string
+  providerSession?: AgentProviderSessionMetadata
+  updatedAt: number
+}
+
+/** A summary outlives its provider child: an evicted idle session is still idle, so the host
+ *  keeps the last projection and never retracts one. Tabs, not this feed, decide what is listed. */
+export type AgentSessionStatusEvent =
+  | { type: 'snapshot'; sessions: AgentSessionStatusSummary[] }
+  | { type: 'status'; session: AgentSessionStatusSummary }
+  | { type: 'end' }
+
 // ─── Mutation envelope ──────────────────────────────────────────────────────
 
 /**
@@ -176,6 +223,17 @@ export const AGENT_SESSION_WIRE_REFUSAL_CODES = [
 ] as const
 export type AgentSessionWireRefusalCode = (typeof AGENT_SESSION_WIRE_REFUSAL_CODES)[number]
 
+/** For a host path that raises its refusal as the thrown code. Narrowing through this keeps an
+ *  unrelated fault from being reported to the client as a tidy, wrong refusal. */
+export function isAgentSessionWireRefusalCode(
+  value: unknown
+): value is AgentSessionWireRefusalCode {
+  return (
+    typeof value === 'string' &&
+    (AGENT_SESSION_WIRE_REFUSAL_CODES as readonly string[]).includes(value)
+  )
+}
+
 export type AgentSessionWireRefusal = {
   code: AgentSessionWireRefusalCode
   message: string
@@ -254,5 +312,11 @@ export type AgentSessionOptionsResult = {
   current: {
     model: string
     effort?: string
+    /**
+     * Option ids whose value the provider reported back, not merely accepted.
+     * Optional: a host that predates it sends nothing and the client keeps
+     * treating the value as unconfirmed, which is what it was before.
+     */
+    confirmed?: readonly string[]
   }
 }
diff --git a/src/shared/browser-network-tunnel-stream-framing.test.ts b/src/shared/browser-network-tunnel-stream-framing.test.ts
index 75eb07d0996..621f297a525 100644
--- a/src/shared/browser-network-tunnel-stream-framing.test.ts
+++ b/src/shared/browser-network-tunnel-stream-framing.test.ts
@@ -55,6 +55,98 @@ describe('browser network tunnel stream framing', () => {
     )
   })
 
+  it.each([1, 2, 3, 16, 256, 4096, 65556])(
+    'preserves maximum-size frames split into %i-byte chunks',
+    (chunkSize) => {
+      const payload = Uint8Array.from({ length: 65552 }, (_, index) => index % 251)
+      const encoded = encodeBrowserNetworkTunnelStreamFrame(payload)
+      const frames: Uint8Array[] = []
+      const onError = vi.fn()
+      const decoder = new BrowserNetworkTunnelStreamFrameDecoder(
+        (frame) => frames.push(frame),
+        onError
+      )
+      for (let offset = 0; offset < encoded.length; offset += chunkSize) {
+        decoder.feed(encoded.subarray(offset, offset + chunkSize))
+      }
+      expect(frames).toEqual([payload])
+      expect(onError).not.toHaveBeenCalled()
+    }
+  )
+
+  it('copies fragmented bytes once instead of recopying the growing carry', () => {
+    const encoded = encodeBrowserNetworkTunnelStreamFrame(new Uint8Array(65536))
+    const decoder = new BrowserNetworkTunnelStreamFrameDecoder(
+      () => {},
+      () => {}
+    )
+    const originalSet = Uint8Array.prototype.set
+    let copiedBytes = 0
+    const set = vi
+      .spyOn(Uint8Array.prototype, 'set')
+      .mockImplementation(function (this: Uint8Array, source, offset) {
+        copiedBytes += source.length
+        originalSet.call(this, source, offset)
+      })
+    try {
+      for (const byte of encoded) {
+        decoder.feed(new Uint8Array([byte]))
+      }
+      expect(copiedBytes).toBe(encoded.length)
+    } finally {
+      set.mockRestore()
+    }
+  })
+
+  it('owns partial input and emitted frames independently of caller buffers', () => {
+    const frames: Uint8Array[] = []
+    const decoder = new BrowserNetworkTunnelStreamFrameDecoder(
+      (frame) => frames.push(frame),
+      () => {}
+    )
+    const first = new Uint8Array([0, 0, 0, 3, 1])
+    decoder.feed(first)
+    first.fill(255)
+    const rest = new Uint8Array([2, 3])
+    decoder.feed(rest)
+    rest.fill(255)
+    decoder.feed(encodeBrowserNetworkTunnelStreamFrame(new Uint8Array([4])))
+    expect(frames).toEqual([new Uint8Array([1, 2, 3]), new Uint8Array([4])])
+  })
+
+  it('enforces the retained cap before decoding complete frames in a feed', () => {
+    const onFrame = vi.fn()
+    const onError = vi.fn()
+    const decoder = new BrowserNetworkTunnelStreamFrameDecoder(onFrame, onError, 16, 8)
+    decoder.feed(new Uint8Array([0, 0]))
+    decoder.feed(new Uint8Array([0, 1, 7, 0, 0, 0, 1]))
+    decoder.feed(new Uint8Array([8]))
+    expect(onFrame).not.toHaveBeenCalled()
+    expect(onError).toHaveBeenCalledExactlyOnceWith(
+      expect.objectContaining({ message: 'browser_tunnel_stream_buffer_overflow' })
+    )
+  })
+
+  it('counts the retained header and payload against the exact cap', () => {
+    const onFrame = vi.fn()
+    const onError = vi.fn()
+    const decoder = new BrowserNetworkTunnelStreamFrameDecoder(onFrame, onError, 16, 7)
+    decoder.feed(new Uint8Array([0, 0, 0, 3, 1]))
+    decoder.feed(new Uint8Array([2, 3]))
+    expect(onFrame).toHaveBeenCalledExactlyOnceWith(new Uint8Array([1, 2, 3]))
+    expect(onError).not.toHaveBeenCalled()
+  })
+
+  it('stops decoding coalesced frames when the callback closes the decoder', () => {
+    const onFrame = vi.fn(() => decoder.close())
+    const onError = vi.fn()
+    const decoder = new BrowserNetworkTunnelStreamFrameDecoder(onFrame, onError)
+    decoder.feed(new Uint8Array([0, 0, 0, 1, 7, 0, 0, 0, 1, 8]))
+    decoder.feed(new Uint8Array([0, 0, 0, 1, 9]))
+    expect(onFrame).toHaveBeenCalledExactlyOnceWith(new Uint8Array([7]))
+    expect(onError).not.toHaveBeenCalled()
+  })
+
   it('serializes writes and rejects bounded queue overflow', () => {
     const callbacks: ((error?: Error | null) => void)[] = []
     const writes: Uint8Array[] = []
diff --git a/src/shared/browser-network-tunnel-stream-framing.ts b/src/shared/browser-network-tunnel-stream-framing.ts
index 734a304520c..042224253ee 100644
--- a/src/shared/browser-network-tunnel-stream-framing.ts
+++ b/src/shared/browser-network-tunnel-stream-framing.ts
@@ -15,7 +15,10 @@ export function encodeBrowserNetworkTunnelStreamFrame(frame: Uint8Array): Uint8A
 }
 
 export class BrowserNetworkTunnelStreamFrameDecoder {
-  private retained = new Uint8Array()
+  private readonly header = new Uint8Array(LENGTH_BYTES)
+  private headerBytes = 0
+  private frame: Uint8Array | null = null
+  private frameBytes = 0
   private closed = false
 
   constructor(
@@ -29,30 +32,50 @@ export class BrowserNetworkTunnelStreamFrameDecoder {
     if (this.closed || chunk.byteLength === 0) {
       return
     }
-    if (this.retained.byteLength + chunk.byteLength > this.maxRetainedBytes) {
+    if (this.headerBytes + this.frameBytes + chunk.byteLength > this.maxRetainedBytes) {
       this.fail(new Error('browser_tunnel_stream_buffer_overflow'))
       return
     }
-    const combined = new Uint8Array(this.retained.byteLength + chunk.byteLength)
-    combined.set(this.retained)
-    combined.set(chunk, this.retained.byteLength)
     let offset = 0
-    while (combined.byteLength - offset >= LENGTH_BYTES) {
-      const length = new DataView(
-        combined.buffer,
-        combined.byteOffset + offset,
-        LENGTH_BYTES
-      ).getUint32(0, false)
-      if (length === 0 || length > this.maxFrameBytes) {
-        this.fail(new Error('browser_tunnel_stream_frame_invalid'))
+    while (offset < chunk.byteLength) {
+      if (this.headerBytes < LENGTH_BYTES) {
+        let length: number
+        if (this.headerBytes === 0 && chunk.byteLength - offset >= LENGTH_BYTES) {
+          length = new DataView(chunk.buffer, chunk.byteOffset + offset, LENGTH_BYTES).getUint32(
+            0,
+            false
+          )
+          this.headerBytes = LENGTH_BYTES
+          offset += LENGTH_BYTES
+        } else {
+          const count = Math.min(LENGTH_BYTES - this.headerBytes, chunk.byteLength - offset)
+          this.header.set(chunk.subarray(offset, offset + count), this.headerBytes)
+          this.headerBytes += count
+          offset += count
+          if (this.headerBytes < LENGTH_BYTES) {
+            return
+          }
+          length = new DataView(this.header.buffer).getUint32(0, false)
+        }
+        if (length === 0 || length > this.maxFrameBytes) {
+          this.fail(new Error('browser_tunnel_stream_frame_invalid'))
+          return
+        }
+        this.frame = new Uint8Array(length)
+      }
+      const frame = this.frame!
+      const count = Math.min(frame.byteLength - this.frameBytes, chunk.byteLength - offset)
+      frame.set(chunk.subarray(offset, offset + count), this.frameBytes)
+      this.frameBytes += count
+      offset += count
+      if (this.frameBytes < frame.byteLength) {
         return
       }
-      const end = offset + LENGTH_BYTES + length
-      if (end > combined.byteLength) {
-        break
-      }
+      this.frame = null
+      this.frameBytes = 0
+      this.headerBytes = 0
       try {
-        this.onFrame(combined.slice(offset + LENGTH_BYTES, end))
+        this.onFrame(frame)
       } catch (error) {
         this.fail(error instanceof Error ? error : new Error(String(error)))
         return
@@ -60,14 +83,14 @@ export class BrowserNetworkTunnelStreamFrameDecoder {
       if (this.closed) {
         return
       }
-      offset = end
     }
-    this.retained = combined.slice(offset)
   }
 
   close(): void {
     this.closed = true
-    this.retained = new Uint8Array()
+    this.frame = null
+    this.frameBytes = 0
+    this.headerBytes = 0
   }
 
   private fail(error: Error): void {
diff --git a/src/shared/cheap-process-table-snapshot-reader.ts b/src/shared/cheap-process-table-snapshot-reader.ts
new file mode 100644
index 00000000000..1d2401f2045
--- /dev/null
+++ b/src/shared/cheap-process-table-snapshot-reader.ts
@@ -0,0 +1,51 @@
+import { runProcess } from './child-process/run-process'
+import {
+  CHEAP_PS_ARGS,
+  PS_MAX_BUFFER_BYTES,
+  ProcessTableCaptureError,
+  parseCheapProcessTableRows,
+  type CheapProcessTableRow
+} from './process-table-snapshot'
+import {
+  PS_TIMEOUT_MS,
+  createProcessTableSnapshotReader,
+  withEvidenceBudget
+} from './process-table-snapshot-reader'
+
+/**
+ * The cheap-tier sibling of the strict evidence reader: same coalescing and TTL, a
+ * column set without `tty=`/`command=`. Separate instance because the two column sets
+ * parse differently and a cheap capture must never be served to an evidence consumer.
+ */
+const cheapProcessTableReader = createProcessTableSnapshotReader<CheapProcessTableRow[]>({
+  runPs: async () => {
+    const result = await runProcess({
+      program: 'ps',
+      args: CHEAP_PS_ARGS,
+      timeoutMs: PS_TIMEOUT_MS,
+      maxOutputBytes: PS_MAX_BUFFER_BYTES
+    })
+    // A ceiling hit is truncation, not absence: name it in the domain vocabulary.
+    if (result.outputTruncated) {
+      throw new ProcessTableCaptureError('capture_truncated')
+    }
+    if (result.timedOut) {
+      throw new ProcessTableCaptureError('capture_timeout')
+    }
+    if (result.code !== 0) {
+      throw new ProcessTableCaptureError(`ps_exit_${result.code ?? result.signal ?? 'unknown'}`)
+    }
+    return parseCheapProcessTableRows(result.stdout)
+  },
+  now: () => Date.now()
+})
+
+/** Same wait bound as the evidence read: a stalled cheap capture must fall through to the full
+ *  path's own handling rather than pin a polled tick. */
+export async function getCheapProcessTableSnapshot(): Promise<CheapProcessTableRow[]> {
+  return withEvidenceBudget(cheapProcessTableReader.getSnapshot())
+}
+
+export function resetCheapProcessTableSnapshotForTests(): void {
+  cheapProcessTableReader.reset()
+}
diff --git a/src/shared/cheap-process-table-snapshot.test.ts b/src/shared/cheap-process-table-snapshot.test.ts
new file mode 100644
index 00000000000..74bbba2b69b
--- /dev/null
+++ b/src/shared/cheap-process-table-snapshot.test.ts
@@ -0,0 +1,147 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { runProcessMock } = vi.hoisted(() => ({ runProcessMock: vi.fn() }))
+
+// The cheap reader goes through Orca's single child-process entry point (windowsHide, argv
+// encoding, tree termination); mock at that seam rather than node:child_process.
+vi.mock('./child-process/run-process', () => ({ runProcess: runProcessMock }))
+
+import {
+  getCheapProcessTableSnapshot,
+  resetCheapProcessTableSnapshotForTests
+} from './cheap-process-table-snapshot-reader'
+import { PS_TIMEOUT_MS } from './process-table-snapshot-reader'
+import {
+  CHEAP_PS_ARGS,
+  PS_ARGS,
+  PS_MAX_BUFFER_BYTES,
+  parseCheapProcessTableRows,
+  ProcessTableCaptureError
+} from './process-table-snapshot'
+
+function installPs(stdout: string, outputTruncated = false): string[][] {
+  const calls: string[][] = []
+  runProcessMock.mockImplementation(async (spec: { program: string; args: readonly string[] }) => {
+    calls.push([spec.program, ...spec.args])
+    return { code: 0, signal: null, stdout, stderr: '', timedOut: false, outputTruncated }
+  })
+  return calls
+}
+
+describe('parseCheapProcessTableRows', () => {
+  it('parses the macOS column set with a padded lstart marker', () => {
+    const rows = parseCheapProcessTableRows(
+      [
+        '    1     0     1    0 Ss   Tue Sep  1 01:49:39 2026',
+        ' 4242  4200  4242 4243 S    Thu Sep  3 16:02:01 2026',
+        ' 4243  4242  4243 4243 S+   Thu Sep  3 16:02:05 2026',
+        ''
+      ].join('\n')
+    )
+    expect(rows).toEqual([
+      { pid: 1, ppid: 0, pgid: 1, tpgid: 0, stat: 'Ss', startTime: 'Tue Sep  1 01:49:39 2026' },
+      {
+        pid: 4242,
+        ppid: 4200,
+        pgid: 4242,
+        tpgid: 4243,
+        stat: 'S',
+        startTime: 'Thu Sep  3 16:02:01 2026'
+      },
+      {
+        pid: 4243,
+        ppid: 4242,
+        pgid: 4243,
+        tpgid: 4243,
+        stat: 'S+',
+        startTime: 'Thu Sep  3 16:02:05 2026'
+      }
+    ])
+  })
+
+  it('parses the Linux column set, which carries no start marker', () => {
+    const rows = parseCheapProcessTableRows(
+      '   2     0     0   -1 S\r\n 900   1   900  900 Ss+\r\n'
+    )
+    expect(rows).toEqual([
+      { pid: 2, ppid: 0, pgid: 0, tpgid: -1, stat: 'S' },
+      { pid: 900, ppid: 1, pgid: 900, tpgid: 900, stat: 'Ss+' }
+    ])
+  })
+
+  it('skips malformed rows rather than failing the capture', () => {
+    expect(parseCheapProcessTableRows('garbage\n 7 1 7 7 S\n')).toEqual([
+      { pid: 7, ppid: 1, pgid: 7, tpgid: 7, stat: 'S' }
+    ])
+  })
+
+  it('treats an empty capture as unreadable, never as "no processes"', () => {
+    expect(() => parseCheapProcessTableRows('\n\n')).toThrow(ProcessTableCaptureError)
+  })
+})
+
+describe('getCheapProcessTableSnapshot', () => {
+  beforeEach(() => {
+    runProcessMock.mockReset()
+    resetCheapProcessTableSnapshotForTests()
+    vi.useFakeTimers({ toFake: ['Date'] })
+    vi.setSystemTime(0)
+  })
+
+  afterEach(() => {
+    vi.useRealTimers()
+  })
+
+  it('forks ps with the cheap column set only, never tty or command', async () => {
+    const calls = installPs(' 7 1 7 7 S\n')
+    await getCheapProcessTableSnapshot()
+    expect(calls).toEqual([['ps', ...CHEAP_PS_ARGS]])
+    expect(CHEAP_PS_ARGS.join(' ')).not.toMatch(/tty=|command=|etimes=/)
+    expect(CHEAP_PS_ARGS).not.toEqual(PS_ARGS)
+  })
+
+  it('coalesces concurrent readers onto one fork and honours the TTL', async () => {
+    const calls = installPs(' 7 1 7 7 S\n')
+    await Promise.all([getCheapProcessTableSnapshot(), getCheapProcessTableSnapshot()])
+    await getCheapProcessTableSnapshot()
+    expect(calls).toHaveLength(1)
+    vi.setSystemTime(600)
+    await getCheapProcessTableSnapshot()
+    expect(calls).toHaveLength(2)
+  })
+
+  it('passes the full-tier buffer ceiling and timeout to the runner', async () => {
+    installPs(' 7 1 7 7 S\n')
+    await getCheapProcessTableSnapshot()
+    expect(runProcessMock).toHaveBeenCalledWith(
+      expect.objectContaining({ maxOutputBytes: PS_MAX_BUFFER_BYTES, timeoutMs: PS_TIMEOUT_MS })
+    )
+  })
+
+  it('names a clipped capture as truncated, a killed one as a timeout, and a non-zero exit by its code', async () => {
+    installPs(' 7 1 7 7 S\n', true)
+    await expect(getCheapProcessTableSnapshot()).rejects.toMatchObject({
+      reason: 'capture_truncated'
+    })
+    resetCheapProcessTableSnapshotForTests()
+    runProcessMock.mockResolvedValueOnce({
+      code: null,
+      signal: 'SIGKILL',
+      stdout: '',
+      stderr: '',
+      timedOut: true
+    })
+    await expect(getCheapProcessTableSnapshot()).rejects.toMatchObject({
+      reason: 'capture_timeout'
+    })
+    resetCheapProcessTableSnapshotForTests()
+    runProcessMock.mockResolvedValueOnce({
+      code: 1,
+      signal: null,
+      stdout: '',
+      stderr: 'ps: bad column',
+      timedOut: false
+    })
+    await expect(getCheapProcessTableSnapshot()).rejects.toMatchObject({ reason: 'ps_exit_1' })
+  })
+})
diff --git a/src/shared/child-process/__fixtures__/child-process-import-allowlist.txt b/src/shared/child-process/__fixtures__/child-process-import-allowlist.txt
index 929cc4f10ad..fd8502d8913 100644
--- a/src/shared/child-process/__fixtures__/child-process-import-allowlist.txt
+++ b/src/shared/child-process/__fixtures__/child-process-import-allowlist.txt
@@ -176,7 +176,6 @@ src/relay/git-stdout-stream.ts
 src/relay/preflight-handler.ts
 src/relay/pty-shell-utils.ts
 src/relay/subprocess-tree-termination.ts
-src/relay/windows-port-scan.ts
 src/relay/workspace-space-scan.ts
 src/shared/ephemeral-vm-recipe-process.ts
 src/shared/ephemeral-vm-recipe-runner.ts
@@ -184,5 +183,4 @@ src/shared/fish-binary-requirement.ts
 src/shared/process-table-snapshot-reader.ts
 src/shared/pty-slave-line-discipline-echo.ts
 src/shared/ripgrep-process-availability.ts
-src/shared/secure-path-windows-acl.ts
 src/shared/shell-process-readiness.ts
diff --git a/src/shared/child-process/__fixtures__/windows-cmd-shim-bodies.ts b/src/shared/child-process/__fixtures__/windows-cmd-shim-bodies.ts
new file mode 100644
index 00000000000..956f92f5ac0
--- /dev/null
+++ b/src/shared/child-process/__fixtures__/windows-cmd-shim-bodies.ts
@@ -0,0 +1,126 @@
+/**
+ * Shim bodies transcribed verbatim from a real Windows 11 install, plus
+ * builders that emit the same shapes around a caller-chosen target.
+ *
+ * The verbatim copies are what pins the shapes to reality: the resolver is only
+ * allowed to recognise files these generators actually write, and a copy here
+ * is how a reviewer checks that without a Windows box.
+ *
+ * Sources:
+ *   %APPDATA%\npm\codex.cmd            — npm cmd-shim, node script
+ *   %APPDATA%\npm\agent-browser.cmd    — npm cmd-shim, bundled .exe
+ *   %APPDATA%\npm\pnx.cmd              — npm cmd-shim, extensionless target
+ *   <repo>\node_modules\.bin\vitest.cmd— pnpm @zkochan/cmd-shim, node script
+ *   %LOCALAPPDATA%\pnpm\bin\pnpm.CMD   — pnpm, bundled .exe
+ *   %LOCALAPPDATA%\pnpm\bin\pn.CMD     — pnpm alias, bare PATH command
+ */
+
+function crlf(lines: readonly string[]): string {
+  return `${lines.join('\r\n')}\r\n`
+}
+
+/** npm's `cmd-shim` for a node script — the shape MDE flagged as `codex.cmd`. */
+export const REAL_CODEX_CMD = crlf([
+  '@ECHO off',
+  'GOTO start',
+  ':find_dp0',
+  'SET dp0=%~dp0',
+  'EXIT /b',
+  ':start',
+  'SETLOCAL',
+  'CALL :find_dp0',
+  '',
+  'IF EXIST "%dp0%\\node.exe" (',
+  '  SET "_prog=%dp0%\\node.exe"',
+  ') ELSE (',
+  '  SET "_prog=node"',
+  '  SET PATHEXT=%PATHEXT:;.JS;=;%',
+  ')',
+  '',
+  'endLocal & goto #_undefined_# 2>NUL || title %COMSPEC% & "%_prog%"  "%dp0%\\node_modules\\@openai\\codex\\bin\\codex.js" %*'
+])
+
+/** npm's `cmd-shim` for a package that ships its own executable. */
+export const REAL_AGENT_BROWSER_CMD = crlf([
+  '@ECHO off',
+  '"%~dp0node_modules\\agent-browser\\bin\\agent-browser-win32-x64.exe" %*'
+])
+
+/** npm's `cmd-shim` for an extensionless target — cmd resolves it via PATHEXT,
+ * so it must NOT resolve. */
+export const REAL_PNX_CMD = crlf([
+  '@ECHO off',
+  'GOTO start',
+  ':find_dp0',
+  'SET dp0=%~dp0',
+  'EXIT /b',
+  ':start',
+  'SETLOCAL',
+  'CALL :find_dp0',
+  '"%dp0%\\node_modules\\pnpm\\pnx"   %*'
+])
+
+const VITEST_NODE_PATH = [
+  'C:\\Users\\neil\\orca\\orca\\node_modules\\.pnpm\\vitest@4.1.11\\node_modules\\vitest\\node_modules',
+  'C:\\Users\\neil\\orca\\orca\\node_modules\\.pnpm\\vitest@4.1.11\\node_modules',
+  'C:\\Users\\neil\\orca\\orca\\node_modules\\.pnpm\\node_modules'
+].join(';')
+
+/** pnpm's `.bin` shim: two interpreter branches plus the NODE_PATH prepend. */
+export const REAL_VITEST_CMD = crlf([
+  '@SETLOCAL',
+  '@IF NOT DEFINED NODE_PATH (',
+  `  @SET "NODE_PATH=${VITEST_NODE_PATH}"`,
+  ') ELSE (',
+  `  @SET "NODE_PATH=${VITEST_NODE_PATH};%NODE_PATH%"`,
+  ')',
+  '@IF EXIST "%~dp0\\node.exe" (',
+  '  "%~dp0\\node.exe"  "%~dp0\\..\\vitest\\vitest.mjs" %*',
+  ') ELSE (',
+  '  @SET PATHEXT=%PATHEXT:;.JS;=;%',
+  '  node  "%~dp0\\..\\vitest\\vitest.mjs" %*',
+  ')'
+])
+
+export const REAL_VITEST_NODE_PATH = VITEST_NODE_PATH
+
+/** pnpm's global shim for a bundled executable. */
+export const REAL_PNPM_CMD = crlf([
+  '@SETLOCAL',
+  '@"%~dp0\\..\\global\\v11\\27d0-19f7df4c136-1fab7163f1a52461\\node_modules\\@pnpm\\exe\\pnpm.exe"   %*'
+])
+
+/** pnpm's `pn` alias: a bare PATH command, with nothing to resolve. */
+export const REAL_PN_CMD = crlf(['@echo off', 'pnpm %*'])
+
+/** The npm `%_prog%` shape around an arbitrary script. */
+export function npmProgNodeShim(scriptRelative: string): string {
+  return REAL_CODEX_CMD.replace('node_modules\\@openai\\codex\\bin\\codex.js', scriptRelative)
+}
+
+/** The pnpm two-branch shape, with the NODE_PATH block only when asked for. */
+export function pnpmBranchedNodeShim(scriptRelative: string, nodePathPrefix?: string): string {
+  return crlf([
+    '@SETLOCAL',
+    ...(nodePathPrefix
+      ? [
+          '@IF NOT DEFINED NODE_PATH (',
+          `  @SET "NODE_PATH=${nodePathPrefix}"`,
+          ') ELSE (',
+          `  @SET "NODE_PATH=${nodePathPrefix};%NODE_PATH%"`,
+          ')'
+        ]
+      : []),
+    '@IF EXIST "%~dp0\\node.exe" (',
+    `  "%~dp0\\node.exe"  "%~dp0\\${scriptRelative}" %*`,
+    ') ELSE (',
+    '  @SET PATHEXT=%PATHEXT:;.JS;=;%',
+    `  node  "%~dp0\\${scriptRelative}" %*`,
+    ')'
+  ])
+}
+
+/** The npm one-line shape around an arbitrary target. */
+export function npmDirectShim(targetRelative: string): string {
+  return crlf(['@ECHO off', `"%~dp0${targetRelative}" %*`])
+}
diff --git a/src/shared/child-process/__fixtures__/windows-console-visibility-allowlist.txt b/src/shared/child-process/__fixtures__/windows-console-visibility-allowlist.txt
index a657002a8ff..068f9a8a96f 100644
--- a/src/shared/child-process/__fixtures__/windows-console-visibility-allowlist.txt
+++ b/src/shared/child-process/__fixtures__/windows-console-visibility-allowlist.txt
@@ -60,7 +60,6 @@ relay/fs-list-files-fallback-chain.ts
 relay/git-handler.ts
 relay/pty-shell-utils.ts
 relay/subprocess-tree-termination.ts
-relay/windows-port-scan.ts
 relay/workspace-space-scan.ts
 shared/fish-binary-requirement.ts
 shared/process-table-snapshot-reader.ts
diff --git a/src/shared/child-process/child-process-import-boundary.test.ts b/src/shared/child-process/child-process-import-boundary.test.ts
index 32c6c9d890e..3abdf8023c4 100644
--- a/src/shared/child-process/child-process-import-boundary.test.ts
+++ b/src/shared/child-process/child-process-import-boundary.test.ts
@@ -29,7 +29,7 @@ const CHILD_PROCESS_IMPORT_ALLOWLIST: readonly string[] = readFileSync(
  * May only ever be DECREASED, and only by migrating a file off
  * `node:child_process`. Raising it is never the fix.
  */
-const DIRECT_IMPORTER_PIN = 158
+const DIRECT_IMPORTER_PIN = 156
 
 const IMPORT_PATTERN =
   /(?:from\s+['"]node:child_process['"]|from\s+['"]child_process['"]|require\(\s*['"]node:child_process['"]|require\(\s*['"]child_process['"])/
diff --git a/src/shared/child-process/process-tree-kill-gate.ts b/src/shared/child-process/process-tree-kill-gate.ts
new file mode 100644
index 00000000000..420fbfeda9b
--- /dev/null
+++ b/src/shared/child-process/process-tree-kill-gate.ts
@@ -0,0 +1,43 @@
+/**
+ * Seam that lets the main process decide, and record, the tree-kills issued
+ * from code it does not own.
+ *
+ * Why a seam and not a direct call: `signalProcessTree` is the choke point every
+ * `runProcess` termination funnels through, and the codex app-server and
+ * ephemeral-VM kills are shared with the CLI — all of them live outside
+ * `src/main` and cannot import the own-Chromium guard or the crash breadcrumb
+ * store. Main registers the guard at startup; everywhere else this admits every
+ * kill and records nothing.
+ */
+
+/** Blast radius, not mechanism: `win-taskkill-tree` is addressed by pid and walks
+ *  whatever tree that pid has *now*, so it can land on a recycled pid that is
+ *  since one of Orca's own Chromium processes. A process group can only contain
+ *  processes Orca itself put there. */
+export type ProcessTreeKillScope = 'win-taskkill-tree' | 'posix-process-group'
+
+export type ProcessTreeKill = {
+  pid: number
+  site: string
+  scope: ProcessTreeKillScope
+}
+
+/** False means the caller must not walk that pid's tree — main is accounting for
+ *  it. Killing the root through its own child handle stays correct and required:
+ *  a handle cannot land on the recycled pid the refusal is about. */
+type ProcessTreeKillGate = (kill: ProcessTreeKill) => boolean
+
+let gate: ProcessTreeKillGate | null = null
+
+export function setProcessTreeKillGate(next: ProcessTreeKillGate | null): void {
+  gate = next
+}
+
+export function admitProcessTreeKill(kill: ProcessTreeKill): boolean {
+  try {
+    return gate?.(kill) ?? true
+  } catch {
+    // Diagnostics must never turn a successful termination into a failed one.
+    return true
+  }
+}
diff --git a/src/shared/child-process/process-tree-kill-observer.ts b/src/shared/child-process/process-tree-kill-observer.ts
deleted file mode 100644
index 8abf971798a..00000000000
--- a/src/shared/child-process/process-tree-kill-observer.ts
+++ /dev/null
@@ -1,37 +0,0 @@
-/**
- * Seam that lets the main process record the tree-kills issued from here.
- *
- * Why a seam and not a direct call: `signalProcessTree` is the choke point every
- * `runProcess` termination funnels through, but it lives in `src/shared` and so
- * runs in the CLI and relay too — it cannot import the main-process crash
- * breadcrumb store. Main registers the recorder at startup; everywhere else this
- * stays a no-op.
- */
-
-/** Blast radius, not mechanism: `win-taskkill-tree` is addressed by pid and walks
- *  whatever tree that pid has *now*, so it can land on a recycled pid that is
- *  since one of Orca's own Chromium processes. A process group can only contain
- *  processes Orca itself put there. */
-export type ProcessTreeKillScope = 'win-taskkill-tree' | 'posix-process-group'
-
-export type ProcessTreeKill = {
-  pid: number
-  site: string
-  scope: ProcessTreeKillScope
-}
-
-type ProcessTreeKillObserver = (kill: ProcessTreeKill) => void
-
-let observer: ProcessTreeKillObserver | null = null
-
-export function setProcessTreeKillObserver(next: ProcessTreeKillObserver | null): void {
-  observer = next
-}
-
-export function notifyProcessTreeKill(kill: ProcessTreeKill): void {
-  try {
-    observer?.(kill)
-  } catch {
-    // Diagnostics must never turn a successful termination into a failed one.
-  }
-}
diff --git a/src/shared/child-process/process-tree-termination.test.ts b/src/shared/child-process/process-tree-termination.test.ts
index cc3394fb5a3..10a4c725089 100644
--- a/src/shared/child-process/process-tree-termination.test.ts
+++ b/src/shared/child-process/process-tree-termination.test.ts
@@ -7,7 +7,7 @@ const { spawnMock } = vi.hoisted(() => ({ spawnMock: vi.fn() }))
 vi.mock('node:child_process', () => ({ spawn: spawnMock }))
 
 import { forceTerminateProcessTree, signalProcessTree } from './process-tree-termination'
-import { setProcessTreeKillObserver, type ProcessTreeKill } from './process-tree-kill-observer'
+import { setProcessTreeKillGate, type ProcessTreeKill } from './process-tree-kill-gate'
 
 function mockProcess(pid: number): ChildProcess {
   const child = new EventEmitter() as EventEmitter & {
@@ -103,11 +103,14 @@ describe('process-tree-kill breadcrumb seam', () => {
 
   beforeEach(() => {
     observed.length = 0
-    setProcessTreeKillObserver((kill) => observed.push(kill))
+    setProcessTreeKillGate((kill) => {
+      observed.push(kill)
+      return true
+    })
   })
 
   afterEach(() => {
-    setProcessTreeKillObserver(null)
+    setProcessTreeKillGate(null)
     spawnMock.mockReset()
     vi.restoreAllMocks()
   })
diff --git a/src/shared/child-process/process-tree-termination.ts b/src/shared/child-process/process-tree-termination.ts
index 15264b2f6ce..ffcb93b2245 100644
--- a/src/shared/child-process/process-tree-termination.ts
+++ b/src/shared/child-process/process-tree-termination.ts
@@ -1,5 +1,5 @@
 import { spawn as nodeSpawn, type ChildProcess } from 'node:child_process'
-import { notifyProcessTreeKill } from './process-tree-kill-observer'
+import { admitProcessTreeKill } from './process-tree-kill-gate'
 
 const PROBE_INTERVAL_MS = 25
 const SUBPROCESS_TIMEOUT_MS = 2_000
@@ -13,8 +13,17 @@ const MAX_PS_OUTPUT_BYTES = 8 * 1024 * 1024
  * leader would hand it to whatever group it inherited instead.
  *
  * Runs in every host — Electron main, the daemon, the relay, the CLI — so the
- * main-process own-Chromium guard cannot reach here; the exit check below is
- * what keeps the Windows branch off a pid that is no longer ours.
+ * own-Chromium guard arrives through `process-tree-kill-gate`, which main
+ * installs and every other host leaves admitting. The exit check below is what
+ * keeps the Windows branch off a pid that is no longer ours on those hosts.
+ *
+ * Both arms ask before walking the tree, so a refused pid never gets a
+ * pid-addressed kill; that also means the recorded crumb says "about to kill",
+ * not "killed". The root is still killed through its handle, which cannot reach
+ * the recycled pid the refusal was about, so a refusal is never a leak. Main's
+ * gate only ever refuses the `win-taskkill-tree` scope — a POSIX group holds
+ * only what Orca put in it — so the POSIX refusal arm is the seam's contract,
+ * not something any installed gate exercises today.
  */
 export function signalProcessTree(child: ChildProcess, signal?: NodeJS.Signals): Promise<boolean> {
   if (!child.pid) {
@@ -39,13 +48,20 @@ export function signalProcessTree(child: ChildProcess, signal?: NodeJS.Signals):
     }
     return taskkillTree(child, child.pid, signal)
   }
-  try {
-    process.kill(-child.pid, signal)
-    notifyProcessTreeKill({
+  if (
+    !admitProcessTreeKill({
       pid: child.pid,
       site: 'run-process-tree',
       scope: 'posix-process-group'
     })
+  ) {
+    // Same shape as the reaped-pid skip above: refuse the group, still kill the
+    // root by handle, and report unverified.
+    killRoot(child, signal)
+    return Promise.resolve(false)
+  }
+  try {
+    process.kill(-child.pid, signal)
     return Promise.resolve(true)
   } catch {
     return Promise.resolve(!processGroupExists(child.pid))
@@ -73,6 +89,13 @@ function taskkillTree(
   rootPid: number,
   signal?: NodeJS.Signals
 ): Promise<boolean> {
+  // Asked before the spawn, not after: a refusal has to prevent the taskkill.
+  if (
+    !admitProcessTreeKill({ pid: rootPid, site: 'run-process-tree', scope: 'win-taskkill-tree' })
+  ) {
+    killRoot(child, signal)
+    return Promise.resolve(false)
+  }
   return new Promise((resolve) => {
     let killer: ChildProcess
     try {
@@ -86,7 +109,6 @@ function taskkillTree(
       resolve(false)
       return
     }
-    notifyProcessTreeKill({ pid: rootPid, site: 'run-process-tree', scope: 'win-taskkill-tree' })
     let settled = false
     const finish = (fallback: boolean): void => {
       if (settled) {
diff --git a/src/shared/child-process/run-process.ts b/src/shared/child-process/run-process.ts
index 67bd48f5b81..736b093a56f 100644
--- a/src/shared/child-process/run-process.ts
+++ b/src/shared/child-process/run-process.ts
@@ -2,10 +2,9 @@ import {
   spawn as nodeSpawn,
   spawnSync as nodeSpawnSync,
   type ChildProcess,
-  type ChildProcessWithoutNullStreams,
-  type SpawnOptions as NodeSpawnOptions
+  type ChildProcessWithoutNullStreams
 } from 'node:child_process'
-import { buildWindowsCmdShimCommandLine, isCmdInterpretedProgram } from './windows-command-line'
+import { resolveSpawn } from './spawn-resolution'
 import { forceTerminateProcessTree, signalProcessTree } from './process-tree-termination'
 
 import { createOutputSink } from './bounded-output-sink'
@@ -19,6 +18,7 @@ export type {
   ProcessResult
 } from './process-spec'
 export { DEFAULT_PROCESS_TIMEOUT_MS, DEFAULT_MAX_OUTPUT_BYTES } from './process-spec'
+export { resolveSpawn, type ResolvedSpawn } from './spawn-resolution'
 import type { ProcessSpec, ProcessResult } from './process-spec'
 import { DEFAULT_PROCESS_TIMEOUT_MS, DEFAULT_MAX_OUTPUT_BYTES } from './process-spec'
 /**
@@ -40,54 +40,6 @@ const PROCESS_EXIT_GRACE_MS = 2_000
  */
 const BARRIER_UNVERIFIED_EXIT_GRACE_MS = 10_000
 
-export type ResolvedSpawn = {
-  file: string
-  args: readonly string[]
-  options: NodeSpawnOptions
-}
-
-/**
- * Translate a spec into the exact `child_process.spawn` call to make.
- *
- * Kept pure and exported so the Windows branch is testable from macOS/Linux:
- * the decisions below are the whole point of this module, and they must not be
- * observable only on the platform that breaks.
- */
-export function resolveSpawn(spec: ProcessSpec, platform: NodeJS.Platform): ResolvedSpawn {
-  const args = spec.args ?? []
-  const base: NodeSpawnOptions = {
-    cwd: spec.cwd,
-    env: spec.env,
-    stdio: spec.stdio ?? ['pipe', 'pipe', 'pipe'],
-    // Why unconditional: Orca's main process is GUI-subsystem and owns no
-    // console, so every console-subsystem child it starts gets a fresh visible
-    // conhost that takes foreground — keystrokes typed into an Orca terminal at
-    // that moment land in the black box instead.
-    windowsHide: true,
-    detached: spec.detached,
-    windowsVerbatimArguments: spec.windowsVerbatimArguments,
-    // Why never `shell: true`: it concatenates arguments without escaping (Node
-    // itself warns DEP0190) and it silently makes windowsHide a no-op.
-    shell: false,
-    ...(spec.terminationBarrier && platform !== 'win32' ? { detached: true } : {})
-  }
-
-  if (platform !== 'win32' || !isCmdInterpretedProgram(spec.program)) {
-    return { file: spec.program, args, options: base }
-  }
-
-  // Node refuses to spawn `.cmd`/`.bat` without a shell (EINVAL, the
-  // CVE-2024-27980 mitigation), so cmd.exe has to be the program. Building the
-  // line ourselves — rather than handing Node `shell: true` — is what keeps the
-  // arguments intact and the console hidden.
-  const comSpec = spec.env?.ComSpec ?? process.env.ComSpec ?? 'cmd.exe'
-  return {
-    file: comSpec,
-    args: [buildWindowsCmdShimCommandLine(spec.program, args)],
-    options: { ...base, windowsVerbatimArguments: true }
-  }
-}
-
 /**
  * Start a child process. Use for long-lived or streaming children.
  *
diff --git a/src/shared/child-process/spawn-resolution.ts b/src/shared/child-process/spawn-resolution.ts
new file mode 100644
index 00000000000..3a3d1e9481b
--- /dev/null
+++ b/src/shared/child-process/spawn-resolution.ts
@@ -0,0 +1,80 @@
+import type { SpawnOptions as NodeSpawnOptions } from 'node:child_process'
+import { buildWindowsCmdShimCommandLine, isCmdInterpretedProgram } from './windows-command-line'
+import { resolveWindowsCmdShim } from './windows-cmd-shim-resolution'
+import type { ProcessSpec } from './process-spec'
+
+export type ResolvedSpawn = {
+  file: string
+  args: readonly string[]
+  options: NodeSpawnOptions
+}
+
+/**
+ * Translate a spec into the exact `child_process.spawn` call to make.
+ *
+ * Exported so the Windows branch is testable from macOS/Linux: the decisions
+ * below are the whole point of the spawn chokepoint, and they must not be
+ * observable only on the platform that breaks.
+ *
+ * Pure except on the win32 `.cmd` branch, where shim resolution does a `stat`
+ * and (on a cache miss) one bounded read of the shim itself. Both are inside
+ * try/catch and any failure falls back to the cmd.exe path, so the function
+ * still cannot throw or reach anything but the program path it was handed.
+ */
+export function resolveSpawn(spec: ProcessSpec, platform: NodeJS.Platform): ResolvedSpawn {
+  const args = spec.args ?? []
+  const base: NodeSpawnOptions = {
+    cwd: spec.cwd,
+    env: spec.env,
+    stdio: spec.stdio ?? ['pipe', 'pipe', 'pipe'],
+    // Why unconditional: Orca's main process is GUI-subsystem and owns no
+    // console, so every console-subsystem child it starts gets a fresh visible
+    // conhost that takes foreground — keystrokes typed into an Orca terminal at
+    // that moment land in the black box instead.
+    windowsHide: true,
+    detached: spec.detached,
+    windowsVerbatimArguments: spec.windowsVerbatimArguments,
+    // Why never `shell: true`: it concatenates arguments without escaping (Node
+    // itself warns DEP0190) and it silently makes windowsHide a no-op.
+    shell: false,
+    ...(spec.terminationBarrier && platform !== 'win32' ? { detached: true } : {})
+  }
+
+  if (platform !== 'win32' || !isCmdInterpretedProgram(spec.program)) {
+    return { file: spec.program, args, options: base }
+  }
+
+  // An npm/pnpm shim is a generated file that only locates node and runs a
+  // script, so reading it lets us spawn that program directly. That drops
+  // cmd.exe from the tree — which is what Defender scores as obfuscation once
+  // the caret-escaped payload is agent prompt text — and lifts cmd's ban on
+  // arguments containing a line break. Unrecognised shims resolve to null and
+  // keep the cmd.exe path below.
+  const shim = resolveWindowsCmdShim(spec.program, spec.env ?? process.env)
+  if (shim) {
+    return {
+      file: shim.program,
+      args: [...shim.prefixArgs, ...args],
+      options: {
+        ...base,
+        ...(shim.env ? { env: shim.env } : {}),
+        // Why cleared rather than inherited: the flag exists for callers that
+        // hand us a whole pre-built command line, and there is no such line
+        // here — Node would join `[script, ...args]` unquoted and shred any
+        // argument containing a space.
+        windowsVerbatimArguments: undefined
+      }
+    }
+  }
+
+  // Node refuses to spawn `.cmd`/`.bat` without a shell (EINVAL, the
+  // CVE-2024-27980 mitigation), so cmd.exe has to be the program. Building the
+  // line ourselves — rather than handing Node `shell: true` — is what keeps the
+  // arguments intact and the console hidden.
+  const comSpec = spec.env?.ComSpec ?? process.env.ComSpec ?? 'cmd.exe'
+  return {
+    file: comSpec,
+    args: [buildWindowsCmdShimCommandLine(spec.program, args)],
+    options: { ...base, windowsVerbatimArguments: true }
+  }
+}
diff --git a/src/shared/child-process/windows-cmd-shim-resolution.test.ts b/src/shared/child-process/windows-cmd-shim-resolution.test.ts
new file mode 100644
index 00000000000..2005d6e8bf2
--- /dev/null
+++ b/src/shared/child-process/windows-cmd-shim-resolution.test.ts
@@ -0,0 +1,376 @@
+import { mkdtempSync, rmSync, utimesSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterAll, beforeAll, describe, expect, it } from 'vitest'
+import { removeTreeSync } from '../windows-transient-lock-removal'
+import { parseWindowsCmdShim, resolveWindowsCmdShim } from './windows-cmd-shim-resolution'
+import { resolveSpawn } from './run-process'
+import {
+  REAL_AGENT_BROWSER_CMD,
+  REAL_CODEX_CMD,
+  REAL_PNPM_CMD,
+  REAL_PN_CMD,
+  REAL_PNX_CMD,
+  REAL_VITEST_CMD,
+  REAL_VITEST_NODE_PATH,
+  npmDirectShim,
+  npmProgNodeShim,
+  pnpmBranchedNodeShim
+} from './__fixtures__/windows-cmd-shim-bodies'
+
+describe('parseWindowsCmdShim', () => {
+  it('reads the npm node shim MDE flagged (codex.cmd)', () => {
+    expect(parseWindowsCmdShim(REAL_CODEX_CMD)).toEqual({
+      kind: 'node',
+      script: 'node_modules\\@openai\\codex\\bin\\codex.js'
+    })
+  })
+
+  it('reads the pnpm two-branch shim, including its NODE_PATH prepend', () => {
+    expect(parseWindowsCmdShim(REAL_VITEST_CMD)).toEqual({
+      kind: 'node',
+      script: '..\\vitest\\vitest.mjs',
+      nodePathPrefix: REAL_VITEST_NODE_PATH
+    })
+  })
+
+  it('reads a pnpm branch shim with no NODE_PATH block', () => {
+    expect(parseWindowsCmdShim(pnpmBranchedNodeShim('..\\x\\cli.js'))).toEqual({
+      kind: 'node',
+      script: '..\\x\\cli.js'
+    })
+  })
+
+  it('reads the npm and pnpm shims for a bundled executable', () => {
+    expect(parseWindowsCmdShim(REAL_AGENT_BROWSER_CMD)).toEqual({
+      kind: 'direct',
+      target: 'node_modules\\agent-browser\\bin\\agent-browser-win32-x64.exe'
+    })
+    expect(parseWindowsCmdShim(REAL_PNPM_CMD)).toEqual({
+      kind: 'direct',
+      target:
+        '..\\global\\v11\\27d0-19f7df4c136-1fab7163f1a52461\\node_modules\\@pnpm\\exe\\pnpm.exe'
+    })
+  })
+
+  it.each([
+    ['a bare PATH command with no target to read', REAL_PN_CMD],
+    ['an arbitrary batch script', '@echo off\r\nnode "%~dp0echoargs.js" %*\r\n'],
+    ['a shim with extra interpreter flags', '@ECHO off\r\nnode --experimental "%~dp0a.js" %*\r\n'],
+    [
+      'a shim whose branches disagree about the script',
+      pnpmBranchedNodeShim('..\\a.js').replace('node  "%~dp0\\..\\a.js"', 'node  "%~dp0\\..\\b.js"')
+    ],
+    ['a shim with anything appended after the target line', `${REAL_CODEX_CMD}echo tampered\r\n`],
+    ['an unexpanded variable in the target', '@ECHO off\r\n"%~dp0%TARGET%\\a.exe" %*\r\n'],
+    ['an empty file', '']
+  ])('refuses %s', (_case, contents) => {
+    expect(parseWindowsCmdShim(contents)).toBeNull()
+  })
+
+  it.each([
+    ['a direct target', npmDirectShim('D:evil.exe')],
+    ['a node script', npmProgNodeShim('D:evil.js')],
+    ['a same-drive spelling', npmDirectShim('C:evil.exe')]
+  ])('refuses a drive-relative path in %s', (_case, contents) => {
+    // `win32.isAbsolute('D:evil.js')` is false, yet `win32.resolve` reads the
+    // drive letter and lands on `D:\evil.js` — outside the shim directory
+    // entirely. cmd would build `C:\shim\D:evil.js` and fail, so accepting it
+    // is the silent-wrong-execution case this parser exists to exclude.
+    expect(parseWindowsCmdShim(contents)).toBeNull()
+  })
+
+  it.each([
+    ['%* replaced by %1, which forwards only the first argument', '%1'],
+    ['%* duplicated, which forwards every argument twice', '%* %*']
+  ])('refuses %s', (_case, forwarding) => {
+    expect(parseWindowsCmdShim(npmProgNodeShim('cli.js').replace('%*', forwarding))).toBeNull()
+  })
+
+  it.each([
+    ['a UTF-8 BOM', (body: string) => `${body}`],
+    ['a doubled UTF-8 BOM', (body: string) => `${body}`],
+    ['LF-only line endings', (body: string) => body.replace(/\r\n/g, '\n')],
+    ['no final newline', (body: string) => body.replace(/\r\n$/, '')],
+    ['trailing whitespace on every line', (body: string) => body.replace(/\r\n/g, '  \t\r\n')],
+    ['doubled blank lines', (body: string) => body.replace(/\r\n/g, '\r\n\r\n')],
+    ['an all-lowercase body', (body: string) => body.toLowerCase()],
+    ['an all-uppercase body', (body: string) => body.toUpperCase()]
+  ])('reads the codex shim through %s', (_case, rewrite) => {
+    // Line endings, casing and surrounding whitespace vary with the generator,
+    // the editor and the transport; none of them changes what the shim runs.
+    // Only the captured path is case-sensitive, so the case cases compare
+    // against the rewritten spelling.
+    const parsed = parseWindowsCmdShim(rewrite(REAL_CODEX_CMD))
+    expect(parsed?.kind).toBe('node')
+    expect((parsed as { script: string }).script.toLowerCase()).toBe(
+      'node_modules\\@openai\\codex\\bin\\codex.js'
+    )
+  })
+
+  it('refuses lone-CR line endings, which leave the body as one unsplit line', () => {
+    expect(parseWindowsCmdShim(REAL_CODEX_CMD.replace(/\r\n/g, '\r'))).toBeNull()
+  })
+
+  it('refuses a NODE_PATH block whose branches are not a plain prepend', () => {
+    const tampered = pnpmBranchedNodeShim('..\\a.js', 'C:\\p').replace(
+      '"NODE_PATH=C:\\p;%NODE_PATH%"',
+      '"NODE_PATH=C:\\evil;%NODE_PATH%"'
+    )
+    expect(parseWindowsCmdShim(tampered)).toBeNull()
+  })
+})
+
+/**
+ * Resolution reads the filesystem with win32 path semantics, so it can only run
+ * here. The shape recognition above is the platform-independent half.
+ */
+const describeOnWindows = process.platform === 'win32' ? describe : describe.skip
+
+describeOnWindows('resolveWindowsCmdShim', () => {
+  let dir: string
+  let env: NodeJS.ProcessEnv
+
+  beforeAll(() => {
+    dir = mkdtempSync(join(tmpdir(), 'orca-shim-resolve-'))
+    env = { ...process.env }
+    writeFileSync(join(dir, 'cli.js'), 'process.stdout.write("hi")\n')
+    writeFileSync(join(dir, 'ci2.js'), '')
+    writeFileSync(join(dir, 'real.exe'), '')
+    writeFileSync(join(dir, 'nested.cmd'), '')
+  })
+
+  afterAll(() => {
+    removeTreeSync(dir)
+  })
+
+  function write(name: string, contents: string): string {
+    const path = join(dir, name)
+    writeFileSync(path, contents)
+    return path
+  }
+
+  it('resolves the npm node shim to node.exe plus the script', () => {
+    const resolved = resolveWindowsCmdShim(write('codexish.cmd', npmProgNodeShim('cli.js')), env)
+    expect(resolved?.program.toLowerCase().endsWith('node.exe')).toBe(true)
+    expect(resolved?.prefixArgs).toEqual([join(dir, 'cli.js')])
+    expect(resolved?.env).toBeUndefined()
+  })
+
+  it('prefers a node.exe sitting beside the shim, as the shim itself does', () => {
+    const sibling = mkdtempSync(join(tmpdir(), 'orca-shim-sibling-'))
+    try {
+      writeFileSync(join(sibling, 'node.exe'), '')
+      writeFileSync(join(sibling, 'cli.js'), '')
+      const shim = join(sibling, 'a.cmd')
+      writeFileSync(shim, npmProgNodeShim('cli.js'))
+      expect(resolveWindowsCmdShim(shim, env)?.program).toBe(join(sibling, 'node.exe'))
+    } finally {
+      removeTreeSync(sibling)
+    }
+  })
+
+  it('prepends the pnpm NODE_PATH the shim would have set', () => {
+    const shim = write('pnpmish.cmd', pnpmBranchedNodeShim('cli.js', 'C:\\store\\a'))
+    expect(resolveWindowsCmdShim(shim, { ...env, NODE_PATH: 'C:\\existing' })?.env?.NODE_PATH).toBe(
+      'C:\\store\\a;C:\\existing'
+    )
+    expect(resolveWindowsCmdShim(shim, { ...env, NODE_PATH: undefined })?.env?.NODE_PATH).toBe(
+      'C:\\store\\a'
+    )
+  })
+
+  it('resolves a direct .exe target', () => {
+    const shim = write('direct.cmd', npmDirectShim('real.exe'))
+    expect(resolveWindowsCmdShim(shim, env)).toEqual({
+      program: join(dir, 'real.exe'),
+      prefixArgs: []
+    })
+  })
+
+  it.each([
+    ['a target that does not exist', 'missing', npmProgNodeShim('missing.js')],
+    ['an extensionless direct target, which needs cmd PATHEXT search', 'pnx', REAL_PNX_CMD],
+    ['a direct target that is itself a .cmd', 'nested', npmDirectShim('nested.cmd')],
+    [
+      'an absolute target, which the shim would not spell that way',
+      'abs',
+      npmDirectShim('C:\\o.exe')
+    ],
+    [
+      'a drive-relative target that would escape the shim directory',
+      'drive',
+      npmDirectShim('D:o.exe')
+    ],
+    ['a file that is not a generated shim', 'alias', REAL_PN_CMD]
+  ])('falls back for %s', (_case, name, contents) => {
+    // A file per case: the resolution cache is keyed on path, mtime and size,
+    // and two same-size writes in one clock tick would otherwise collide.
+    expect(resolveWindowsCmdShim(write(`fallback-${name}.cmd`, contents), env)).toBeNull()
+  })
+
+  it('falls back for a relative program path', () => {
+    write('relative.cmd', npmProgNodeShim('cli.js'))
+    expect(resolveWindowsCmdShim('relative.cmd', env)).toBeNull()
+  })
+
+  it('honours the kill switch', () => {
+    const shim = write('killswitch.cmd', npmProgNodeShim('cli.js'))
+    expect(resolveWindowsCmdShim(shim, env)).not.toBeNull()
+    expect(
+      resolveWindowsCmdShim(shim, {
+        ...env,
+        ORCA_DISABLE_CMD_SHIM_RESOLUTION: '1'
+      })
+    ).toBeNull()
+  })
+
+  it('re-reads a shim whose mtime moved even at an identical size', () => {
+    // An upgrade rewrites the shim in place; a path-only cache would keep
+    // launching the previous entry point.
+    const shim = write('upgraded.cmd', npmProgNodeShim('cli.js'))
+    expect(resolveWindowsCmdShim(shim, env)?.prefixArgs).toEqual([join(dir, 'cli.js')])
+
+    // Same length as the first body, so only the mtime can invalidate it.
+    writeFileSync(shim, npmProgNodeShim('ci2.js'))
+    const later = new Date(Date.now() + 5_000)
+    utimesSync(shim, later, later)
+    expect(resolveWindowsCmdShim(shim, env)?.prefixArgs).toEqual([join(dir, 'ci2.js')])
+  })
+
+  it('walks PATH once per shim directory, not once per spawn', () => {
+    // The parse cache spares the shim read but not the interpreter walk, so an
+    // already-parsed shim was still paying one `stat` per PATH entry on every
+    // spawn. Proven by effect rather than by counting: `early` gains a node.exe
+    // only AFTER the first resolution, so a second call that still answers
+    // `late` cannot have re-walked PATH. Delete the node cache and this fails.
+    const early = mkdtempSync(join(tmpdir(), 'orca-shim-path-early-'))
+    const late = mkdtempSync(join(tmpdir(), 'orca-shim-path-late-'))
+    const shimDir = mkdtempSync(join(tmpdir(), 'orca-shim-path-'))
+    try {
+      writeFileSync(join(late, 'node.exe'), '')
+      writeFileSync(join(shimDir, 'cli.js'), '')
+      const shim = join(shimDir, 'walk.cmd')
+      writeFileSync(shim, npmProgNodeShim('cli.js'))
+      const pathEnv = { ...env, Path: undefined, PATH: `${early};${late}` }
+
+      expect(resolveWindowsCmdShim(shim, pathEnv)?.program).toBe(join(late, 'node.exe'))
+
+      writeFileSync(join(early, 'node.exe'), '')
+      expect(resolveWindowsCmdShim(shim, pathEnv)?.program).toBe(join(late, 'node.exe'))
+
+      // A PATH edit must miss: caching the walk must not outlive its input.
+      expect(resolveWindowsCmdShim(shim, { ...pathEnv, PATH: `${early};${late};` })?.program).toBe(
+        join(early, 'node.exe')
+      )
+    } finally {
+      removeTreeSync(early)
+      removeTreeSync(late)
+      removeTreeSync(shimDir)
+    }
+  })
+
+  it('gives up when cmd would resolve `node` to a non-.exe PATHEXT spelling', () => {
+    // cmd stops at the first PATH directory holding ANY PATHEXT spelling, and
+    // `.COM` outranks `.EXE`, so `first\node.com` is what the shim actually
+    // runs. Scanning past it to `second\node.exe` would silently start a
+    // different binary -- so resolution gives up and cmd.exe keeps the job.
+    // Delete the PATHEXT loop and this returns the .exe instead of null.
+    const first = mkdtempSync(join(tmpdir(), 'orca-shim-ext-first-'))
+    const second = mkdtempSync(join(tmpdir(), 'orca-shim-ext-second-'))
+    const shimDir = mkdtempSync(join(tmpdir(), 'orca-shim-ext-'))
+    try {
+      writeFileSync(join(first, 'node.com'), '')
+      const nodeExe = join(second, 'node.exe')
+      writeFileSync(nodeExe, '')
+      writeFileSync(join(shimDir, 'cli.js'), '')
+      const shim = join(shimDir, 'pathext.cmd')
+      writeFileSync(shim, npmProgNodeShim('cli.js'))
+      const pathEnv = { ...env, Path: undefined, PATH: `${first};${second}` }
+
+      expect(resolveWindowsCmdShim(shim, { ...pathEnv, PATHEXT: undefined })).toBeNull()
+
+      // PATHEXT is honoured, not assumed: with `.COM` absent from it, cmd never
+      // considers the `node.com` and the `.exe` is the right answer again. This
+      // also pins PATHEXT into the cache key -- the two calls differ only there.
+      expect(resolveWindowsCmdShim(shim, { ...pathEnv, PATHEXT: '.EXE;.BAT' })?.program).toBe(
+        nodeExe
+      )
+    } finally {
+      removeTreeSync(first)
+      removeTreeSync(second)
+      removeTreeSync(shimDir)
+    }
+  })
+
+  it('falls back to cmd.exe when the cached interpreter has been uninstalled', () => {
+    // The mirror of the test above, and the direction that breaks: a cached
+    // node.exe that is later removed must not still be handed to `resolveSpawn`,
+    // which would fail the spawn with ENOENT where an uncached process falls
+    // back to cmd.exe and succeeds. Delete the `statFile` on the cache hit and
+    // this returns the deleted path instead of null.
+    const nodeDir = mkdtempSync(join(tmpdir(), 'orca-shim-gone-node-'))
+    const shimDir = mkdtempSync(join(tmpdir(), 'orca-shim-gone-'))
+    try {
+      const nodeExe = join(nodeDir, 'node.exe')
+      writeFileSync(nodeExe, '')
+      writeFileSync(join(shimDir, 'cli.js'), '')
+      const shim = join(shimDir, 'gone.cmd')
+      writeFileSync(shim, npmProgNodeShim('cli.js'))
+      const pathEnv = { ...env, Path: undefined, PATH: nodeDir }
+
+      expect(resolveWindowsCmdShim(shim, pathEnv)?.program).toBe(nodeExe)
+
+      rmSync(nodeExe)
+      expect(resolveWindowsCmdShim(shim, pathEnv)).toBeNull()
+    } finally {
+      removeTreeSync(nodeDir)
+      removeTreeSync(shimDir)
+    }
+  })
+
+  it('keeps cmd.exe out of the spawn for a recognised shim', () => {
+    const resolved = resolveSpawn(
+      {
+        program: write('spawned.cmd', npmProgNodeShim('cli.js')),
+        args: ['a b', 'c"d'],
+        env
+      },
+      'win32'
+    )
+    expect(resolved.file.toLowerCase()).not.toContain('cmd.exe')
+    expect(resolved.args).toEqual([join(dir, 'cli.js'), 'a b', 'c"d'])
+    // Node's own quoting is CommandLineToArgvW-correct; the verbatim line is
+    // only needed for the cmd hop we just removed.
+    expect(resolved.options.windowsVerbatimArguments).toBeUndefined()
+  })
+
+  it('clears a caller-set windowsVerbatimArguments on the resolved path', () => {
+    // The flag means "I built the whole command line, hand it through". There
+    // is no such line here, so honouring it would make Node join
+    // `[script, ...args]` unquoted and shred every argument with a space.
+    const resolved = resolveSpawn(
+      {
+        program: write('verbatim.cmd', npmProgNodeShim('cli.js')),
+        args: ['a b'],
+        env,
+        windowsVerbatimArguments: true
+      },
+      'win32'
+    )
+    expect(resolved.options.windowsVerbatimArguments).toBeUndefined()
+  })
+
+  it('still routes an unrecognised .cmd through cmd.exe', () => {
+    const resolved = resolveSpawn(
+      {
+        program: write('plain.cmd', REAL_PN_CMD),
+        args: ['x'],
+        env: { ComSpec: 'C:\\W\\cmd.exe' }
+      },
+      'win32'
+    )
+    expect(resolved.file).toBe('C:\\W\\cmd.exe')
+    expect(resolved.args[0]).toContain('/d /v:off /s /c')
+  })
+})
diff --git a/src/shared/child-process/windows-cmd-shim-resolution.ts b/src/shared/child-process/windows-cmd-shim-resolution.ts
new file mode 100644
index 00000000000..c75da83ea81
--- /dev/null
+++ b/src/shared/child-process/windows-cmd-shim-resolution.ts
@@ -0,0 +1,401 @@
+/**
+ * Resolve an npm/pnpm-generated `.cmd` shim to the program it would have run.
+ *
+ * Why: a `.cmd` target forces the spawn through `cmd.exe /c` with every
+ * argument caret-escaped (see windows-command-line.ts for that encoding). A
+ * long `cmd.exe /c` line whose caret-escaped payload is natural-language agent
+ * prompt text is what Microsoft Defender for Endpoint's command-line model
+ * scores as obfuscation, and `codex.cmd` sits in the spawn cluster of a real
+ * MDE incident against Orca. These shims are generated files whose entire body
+ * is "find node, run this script", so reading one and spawning
+ * `node.exe <script> <args…>` removes cmd.exe — and with it the escaping —
+ * from the process tree.
+ *
+ * It also removes a real limitation: cmd's parser ends the command at a raw
+ * CR/LF whatever the quote state, so a multi-line agent prompt through a `.cmd`
+ * shim has to be rejected outright. The resolved path has no such problem.
+ *
+ * Everything here is deliberately all-or-nothing. A file that does not match a
+ * known shape exactly, or whose resolved target cannot be confirmed on disk,
+ * returns null and the caller keeps today's `cmd.exe /c` behaviour. A
+ * mis-resolution silently runs the wrong program or drops arguments, which is
+ * far worse than an EDR alert.
+ */
+import { readFileSync, statSync, type Stats } from 'node:fs'
+import { win32 } from 'node:path'
+
+/** Escape hatch if resolution ever picks the wrong target in the field. */
+const DISABLE_FLAG = 'ORCA_DISABLE_CMD_SHIM_RESOLUTION'
+
+/** Real shims are under 2KB; anything larger is not one of these generators. */
+const MAX_SHIM_BYTES = 64 * 1024
+
+/** Both spellings of the shim's own directory. Each already ends in `\`, so the
+ * separator the shim writes after it is optional and inert. */
+const DP0 = String.raw`(?:%~dp0|%dp0%)\\?`
+const DP0_NODE_EXE = `"${DP0}node\\.exe"`
+const dp0Path = (group: string): string => `"${DP0}(?<${group}>[^"\\r\\n]+)"`
+
+const ECHO_OFF = String.raw`@echo off\n`
+/** npm's `cmd-shim` captures its own directory through a subroutine. */
+const FIND_DP0 = String.raw`GOTO start\n:find_dp0\nSET dp0=%~dp0\nEXIT /b\n:start\nSETLOCAL\nCALL :find_dp0\n`
+/** pnpm prepends its virtual-store directories so the script can resolve deps. */
+const NODE_PATH_BLOCK = String.raw`(?:@IF NOT DEFINED NODE_PATH \(\n@SET "NODE_PATH=(?<nodePath>[^"\r\n]*)"\n\) ELSE \(\n@SET "NODE_PATH=(?<nodePathElse>[^"\r\n]*)"\n\)\n)?`
+const PATHEXT_STRIP = String.raw`SET PATHEXT=%PATHEXT:;\.JS;=;%`
+
+/**
+ * Current `cmd-shim`: picks the interpreter into `%_prog%`, then runs it from a
+ * single trailing line. This is the shape of `codex.cmd`.
+ */
+const NPM_PROG_NODE_SHIM = new RegExp(
+  String.raw`^${ECHO_OFF}${FIND_DP0}IF EXIST ${DP0_NODE_EXE} \(\nSET "_prog=${DP0}node\.exe"\n\) ELSE \(\nSET "_prog=node"\n${PATHEXT_STRIP}\n\)\nendLocal & goto #_undefined_# 2>NUL \|\| title %COMSPEC% & "%_prog%" +${dp0Path('script')} +%\*$`,
+  'i'
+)
+
+/**
+ * Legacy `cmd-shim` and pnpm's `@zkochan/cmd-shim`: the same script spelled once
+ * per interpreter branch.
+ */
+const BRANCHED_NODE_SHIM = new RegExp(
+  String.raw`^(?:@SETLOCAL\n)?${NODE_PATH_BLOCK}@?IF EXIST ${DP0_NODE_EXE} \(\n${DP0_NODE_EXE} +${dp0Path('script')} +%\*\n\) ELSE \(\n(?:@?SETLOCAL\n)?@?${PATHEXT_STRIP}\nnode +${dp0Path('scriptElse')} +%\*\n\)$`,
+  'i'
+)
+
+/** `cmd-shim` for a target that needs no interpreter (a bundled `.exe`). */
+const NPM_DIRECT_SHIM = new RegExp(
+  String.raw`^${ECHO_OFF}(?:${FIND_DP0})?${dp0Path('target')} +%\*$`,
+  'i'
+)
+
+/** pnpm's equivalent, which omits `@echo off` and keeps only `@SETLOCAL`. */
+const PNPM_DIRECT_SHIM = new RegExp(String.raw`^(?:@SETLOCAL\n)?@?${dp0Path('target')} +%\*$`, 'i')
+
+// `:` matters as much as the operators: `win32.isAbsolute('D:evil.js')` is
+// false, but `win32.resolve` reads the drive letter and lands on `D:\evil.js`,
+// outside the shim directory entirely.
+//
+// Rejecting every `:` is provably free rather than merely untested: Windows
+// reserves the character in a path segment, so a relative path cannot contain
+// one at all. The only spellings that can are drive-qualified (`D:x`), an
+// alternate data stream (`a.js:zone`), or a `\\?\` device path — and the last
+// is already refused as absolute. No generator can emit a shim-relative path
+// this rule would wrongly refuse.
+const UNSAFE_SHIM_PATH = /[%^&|<>":\r\n]/
+
+/** A target with no interpreter must be something CreateProcess can start on
+ * its own. Extensionless or `.cmd` targets need cmd's own PATHEXT search, which
+ * is exactly the hop being removed. */
+const DIRECT_TARGET_EXTENSIONS = ['.exe', '.com']
+
+export type ParsedWindowsCmdShim =
+  | { kind: 'node'; script: string; nodePathPrefix?: string }
+  | { kind: 'direct'; target: string }
+
+/**
+ * A captured path must be relative to the shim's own directory and free of the
+ * characters that mean we misread the file — `%` is an unexpanded variable, the
+ * rest are cmd operators we are not emulating.
+ */
+function isPlainRelativePath(spelled: string): boolean {
+  return !UNSAFE_SHIM_PATH.test(spelled) && !win32.isAbsolute(spelled)
+}
+
+/** Collapse a shim to comparable text: shims differ only in line endings,
+ * indentation and blank lines between generators and versions. */
+function canonicalize(contents: string): string {
+  return contents
+    .replace(/^\uFEFF/, '')
+    .split(/\r?\n/)
+    .map((line) => line.trim())
+    .filter((line) => line.length > 0)
+    .join('\n')
+}
+
+/**
+ * Recognise a generated shim. Pure, so the shapes are testable off Windows.
+ *
+ * Returns paths exactly as the shim spells them, relative to its own directory.
+ */
+export function parseWindowsCmdShim(contents: string): ParsedWindowsCmdShim | null {
+  const canonical = canonicalize(contents)
+
+  const prog = NPM_PROG_NODE_SHIM.exec(canonical)?.groups
+  if (prog?.script) {
+    return isPlainRelativePath(prog.script) ? { kind: 'node', script: prog.script } : null
+  }
+
+  const branched = BRANCHED_NODE_SHIM.exec(canonical)?.groups
+  if (branched?.script) {
+    // Both branches must name the same script; if they differ we matched a file
+    // that only looks like a shim.
+    if (branched.script !== branched.scriptElse || !isPlainRelativePath(branched.script)) {
+      return null
+    }
+    const nodePath = branched.nodePath
+    if (nodePath === undefined) {
+      return { kind: 'node', script: branched.script }
+    }
+    // The else branch must be exactly "prefix, then whatever was there", or the
+    // prepend we would reproduce is not the one the shim performs.
+    if (nodePath.includes('%') || branched.nodePathElse !== `${nodePath};%NODE_PATH%`) {
+      return null
+    }
+    return { kind: 'node', script: branched.script, nodePathPrefix: nodePath }
+  }
+
+  for (const pattern of [NPM_DIRECT_SHIM, PNPM_DIRECT_SHIM]) {
+    const target = pattern.exec(canonical)?.groups?.target
+    if (target) {
+      return isPlainRelativePath(target) ? { kind: 'direct', target } : null
+    }
+  }
+  return null
+}
+
+type ParseCacheEntry = {
+  mtimeMs: number
+  size: number
+  parsed: ParsedWindowsCmdShim | null
+}
+
+/** Shim bodies do not change between spawns, but an upgrade rewrites them —
+ * hence the mtime/size half of the key. */
+const parseCache = new Map<string, ParseCacheEntry>()
+const PARSE_CACHE_LIMIT = 256
+
+/**
+ * The interpreter each shim directory resolves to, keyed by that directory and
+ * the PATH that was searched.
+ *
+ * Why cached at all: the parse cache spares the shim read but not this walk, so
+ * a 30-entry PATH cost 30 `stat`s on every spawn of an already-parsed shim —
+ * synchronous I/O on `resolveSpawn`, where one dead network mount in PATH
+ * blocks the calling thread each time.
+ *
+ * Held for the process's life, and the two stale directions are treated
+ * differently on purpose:
+ *
+ * - A stale `null` is left alone. A `node.exe` installed after the first probe
+ *   is not picked up until restart, which only means the working cmd.exe
+ *   fallback stays in use — and re-probing to catch that is the whole cost this
+ *   cache exists to avoid.
+ * - A stale path is revalidated on every hit, because it is the direction that
+ *   breaks. `resolveSpawn` would otherwise keep returning an interpreter that
+ *   has since been uninstalled, failing the spawn with ENOENT where an uncached
+ *   process falls back to cmd.exe and succeeds. Verified by execution: without
+ *   the check, deleting the cached `node.exe` still yielded its path.
+ *
+ * Known gap: PATH is in the key, so a caller that rebuilds `env` per spawn with
+ * a varying PATH — a per-worktree `.bin` prepended, say — misses every time and
+ * pays the full walk. Correct, just no faster than before. The 256 cap and the
+ * wholesale clear mean those misses cost memory nothing, so this is a bound on
+ * who benefits rather than a leak.
+ */
+const nodeCache = new Map<string, string | null>()
+const NODE_CACHE_LIMIT = 256
+
+function statFile(path: string): Stats | null {
+  try {
+    const stats = statSync(path)
+    return stats.isFile() ? stats : null
+  } catch {
+    return null
+  }
+}
+
+function readParsedShim(program: string): ParsedWindowsCmdShim | null {
+  // This `stat` puts synchronous I/O on the spawn path, where `resolveSpawn`
+  // previously had none: a shim on an unresponsive network share now blocks the
+  // caller's thread until the filesystem gives up. Judged acceptable because a
+  // `.cmd` on such a share was already about to be spawned from it. It is the
+  // only such cost paid when nothing resolves — the interpreter lookup runs
+  // only for a shim that already parsed, and is itself cached.
+  const stats = statFile(program)
+  if (!stats || stats.size > MAX_SHIM_BYTES) {
+    return null
+  }
+  const cached = parseCache.get(program)
+  if (cached && cached.mtimeMs === stats.mtimeMs && cached.size === stats.size) {
+    return cached.parsed
+  }
+  let contents: string
+  try {
+    contents = readFileSync(program, 'utf8')
+  } catch {
+    return null
+  }
+  const parsed = parseWindowsCmdShim(contents)
+  // Clearing wholesale drops hot entries with cold ones, where an LRU would
+  // not. Left as is because the cap is per-process and one entry per distinct
+  // `.cmd` path Orca ever spawns; reaching it means a re-read, not a wrong
+  // answer.
+  if (parseCache.size >= PARSE_CACHE_LIMIT) {
+    parseCache.clear()
+  }
+  parseCache.set(program, { mtimeMs: stats.mtimeMs, size: stats.size, parsed })
+  return parsed
+}
+
+/** Win32 resolves environment names case-insensitively; a JS object does not. */
+function firstEnvKey(env: NodeJS.ProcessEnv, name: string): string | undefined {
+  const lower = name.toLowerCase()
+  return Object.keys(env).find((key) => key.toLowerCase() === lower && env[key] !== undefined)
+}
+
+/** cmd's own default when PATHEXT is unset or empty. The order is the point:
+ * `.COM` outranks `.EXE`, so a `node.com` is what cmd runs even with a
+ * `node.exe` sitting beside it. */
+const DEFAULT_PATHEXT = '.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC'
+
+/**
+ * The interpreter the shim itself would pick: a `node.exe` beside it, else
+ * whatever a bare `node` resolves to on PATH.
+ *
+ * The sibling test is exact, matching the shim's own literal
+ * `IF EXIST "%~dp0\node.exe"`. The PATH scan follows cmd's rule instead: the
+ * first directory holding ANY PATHEXT spelling of `node` wins, and inside that
+ * directory PATHEXT order decides. So a `node.com` early on PATH beats a
+ * `node.exe` later, and only the `.exe` outcome is one we can start directly.
+ * Every other winning spelling returns null and keeps the cmd.exe path, which a
+ * `.bat`/`.cmd` node would have needed anyway.
+ *
+ * Scanning past a non-`.exe` winner to a `node.exe` further down PATH is the
+ * tempting shortcut and the one bug this module must never have: it silently
+ * runs a different binary than the shim does. Every decision here stays a
+ * strict subset of what cmd.exe would pick, or gives up.
+ *
+ * Not searched: the working directory, which cmd would consult first for a bare
+ * name. Preferring a `node.exe` that happens to sit in the cwd over the
+ * installed one is a Windows footgun, not a behaviour worth reproducing.
+ */
+function resolveShimNode(directory: string, env: NodeJS.ProcessEnv): string | null {
+  const pathKey = firstEnvKey(env, 'PATH')
+  const pathValue = (pathKey ? env[pathKey] : undefined) ?? ''
+  const pathExtKey = firstEnvKey(env, 'PATHEXT')
+  const pathExtValue = (pathExtKey ? env[pathExtKey] : undefined) || DEFAULT_PATHEXT
+  // All three inputs are in the key because all three decide the answer: the
+  // shim prefers its own directory, falls back to PATH, and PATHEXT orders the
+  // spellings tried within each PATH entry. An edit to any of them therefore
+  // misses rather than serving the previous interpreter. Newlines separate them
+  // because Windows allows one in none of the three.
+  const key = `${directory}\n${pathValue}\n${pathExtValue}`
+  const cached = nodeCache.get(key)
+  // A hit is confirmed still on disk before it is used, because the two stale
+  // directions are not symmetric. A stale `null` is safe and stays uncorrected:
+  // it keeps the cmd.exe fallback, which works. A stale path is not — handing
+  // `resolveSpawn` a `node.exe` that has since been uninstalled (or dropped
+  // from PATH by a version manager) fails the spawn with ENOENT, where an
+  // uncached process would have fallen back and succeeded. One `stat` instead
+  // of one per PATH entry, so the walk this cache exists to skip is still skipped.
+  if (cached !== undefined && (cached === null || statFile(cached))) {
+    return cached
+  }
+  const resolved = probeShimNode(directory, pathValue, pathExtValue)
+  // Same wholesale eviction as the parse cache, for the same reason: the cap is
+  // per-process and one entry per distinct shim directory Orca ever spawns from.
+  if (nodeCache.size >= NODE_CACHE_LIMIT) {
+    nodeCache.clear()
+  }
+  nodeCache.set(key, resolved)
+  return resolved
+}
+
+function probeShimNode(directory: string, pathValue: string, pathExtValue: string): string | null {
+  const sibling = win32.join(directory, 'node.exe')
+  if (statFile(sibling)) {
+    return sibling
+  }
+  const extensions = pathExtValue
+    .split(';')
+    .map((extension) => extension.trim().toLowerCase())
+    .filter((extension) => extension.startsWith('.'))
+  for (const entry of pathValue.split(';')) {
+    const trimmed = entry.trim().replace(/^"(.*)"$/, '$1')
+    // A relative PATH entry resolves against the child's working directory, so
+    // we cannot answer it here.
+    if (!trimmed || !win32.isAbsolute(trimmed)) {
+      continue
+    }
+    // Why every spelling and not just `.exe`: cmd stops at the first directory
+    // holding any of them, so passing over a `node.com` here and matching a
+    // `node.exe` further down PATH would run a binary the shim never would.
+    // Costs one `stat` per PATHEXT entry per node-less directory, paid once per
+    // process because of the cache above -- where the per-spawn walk it
+    // replaced paid its own stats on every single spawn.
+    for (const extension of extensions) {
+      const candidate = win32.join(trimmed, `node${extension}`)
+      if (!statFile(candidate)) {
+        continue
+      }
+      return extension === '.exe' ? candidate : null
+    }
+  }
+  return null
+}
+
+function withNodePath(env: NodeJS.ProcessEnv, prefix: string): NodeJS.ProcessEnv {
+  const key = firstEnvKey(env, 'NODE_PATH') ?? 'NODE_PATH'
+  const existing = env[key]
+  // `IF NOT DEFINED` is false for an empty value too — cmd has no empty variables.
+  return { ...env, [key]: existing ? `${prefix};${existing}` : prefix }
+}
+
+export type WindowsCmdShimResolution = {
+  /** Executable to spawn in place of the `.cmd`. */
+  program: string
+  /** Arguments the shim inserts ahead of the caller's own argv. */
+  prefixArgs: readonly string[]
+  /** Set only when the shim itself mutates the environment (pnpm's NODE_PATH). */
+  env?: NodeJS.ProcessEnv
+}
+
+/**
+ * Resolve `program` to the executable its shim body would have launched, or
+ * null to keep the `cmd.exe /c` path.
+ *
+ * `env` is the environment the child will actually receive, because both the
+ * PATH lookup for `node` and the NODE_PATH prepend depend on it.
+ */
+export function resolveWindowsCmdShim(
+  program: string,
+  env: NodeJS.ProcessEnv
+): WindowsCmdShimResolution | null {
+  const disableKey = firstEnvKey(env, DISABLE_FLAG)
+  if (disableKey && env[disableKey]) {
+    return null
+  }
+  // A relative program is resolved against the child's working directory, which
+  // is the caller's to decide, not ours to guess.
+  if (!win32.isAbsolute(program)) {
+    return null
+  }
+  const parsed = readParsedShim(program)
+  if (!parsed) {
+    return null
+  }
+  const directory = win32.dirname(program)
+
+  // `resolve` collapses the `..` hops and the doubled separator `%dp0%\` leaves.
+  if (parsed.kind === 'direct') {
+    const target = win32.resolve(directory, parsed.target)
+    const lower = target.toLowerCase()
+    if (!DIRECT_TARGET_EXTENSIONS.some((extension) => lower.endsWith(extension))) {
+      return null
+    }
+    return statFile(target) ? { program: target, prefixArgs: [] } : null
+  }
+
+  const script = win32.resolve(directory, parsed.script)
+  if (!statFile(script)) {
+    return null
+  }
+  const node = resolveShimNode(directory, env)
+  if (!node) {
+    return null
+  }
+  return {
+    program: node,
+    prefixArgs: [script],
+    ...(parsed.nodePathPrefix ? { env: withNodePath(env, parsed.nodePathPrefix) } : {})
+  }
+}
diff --git a/src/shared/child-process/windows-cmd-shim-resolution.win32.test.ts b/src/shared/child-process/windows-cmd-shim-resolution.win32.test.ts
new file mode 100644
index 00000000000..8e5fee32d41
--- /dev/null
+++ b/src/shared/child-process/windows-cmd-shim-resolution.win32.test.ts
@@ -0,0 +1,73 @@
+import { mkdtempSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterAll, beforeAll, describe, expect, it } from 'vitest'
+import { removeTreeSync } from '../windows-transient-lock-removal'
+import { runProcess } from './run-process'
+import { WINDOWS_ARGUMENT_CORPUS } from './__fixtures__/windows-argument-corpus'
+import { npmProgNodeShim } from './__fixtures__/windows-cmd-shim-bodies'
+
+/**
+ * The resolved path has to deliver exactly what the cmd.exe path delivers, for
+ * the same real shim on a real Windows box. Anything less and removing cmd.exe
+ * has traded an EDR alert for a silent argument bug.
+ *
+ * Runs only on win32; skipped elsewhere.
+ */
+const describeOnWindows = process.platform === 'win32' ? describe : describe.skip
+
+describeOnWindows('resolved .cmd shim spawn', () => {
+  let dir: string
+  let shim: string
+
+  beforeAll(() => {
+    dir = mkdtempSync(join(tmpdir(), 'orca-shim-spawn-'))
+    shim = join(dir, 'echoargs.cmd')
+    writeFileSync(shim, npmProgNodeShim('echoargs.js'))
+    writeFileSync(
+      join(dir, 'echoargs.js'),
+      'process.stdout.write(process.argv.slice(2).map((a) => `ARG<${a}>`).join("\\u0000"))\n'
+    )
+  })
+
+  afterAll(() => {
+    removeTreeSync(dir)
+  })
+
+  function decode(stdout: string): string[] {
+    return stdout.split('\u0000').map((entry) => entry.replace(/^ARG<([\s\S]*)>$/, '$1'))
+  }
+
+  it('delivers the whole adversarial corpus through the resolved shim', async () => {
+    const values = WINDOWS_ARGUMENT_CORPUS.map((entry) => entry.value)
+    const result = await runProcess({
+      program: shim,
+      args: values,
+      timeoutMs: 30_000
+    })
+    expect(result.code).toBe(0)
+    expect(decode(result.stdout)).toEqual(values)
+  })
+
+  it('delivers a multi-line agent prompt that cmd.exe could not carry at all', async () => {
+    // cmd ends the command at a raw CR/LF whatever the quote state, so the
+    // fallback path has to reject this input. Resolving the shim is what makes
+    // it expressible.
+    const prompt = 'Fix "src/a b.ts"\n- run tests\r\n- report 100% & stop'
+    const result = await runProcess({
+      program: shim,
+      args: [prompt],
+      timeoutMs: 30_000
+    })
+    expect(result.code).toBe(0)
+    expect(decode(result.stdout)).toEqual([prompt])
+  })
+
+  it('reports the script exit code without a cmd.exe hop in between', async () => {
+    const failing = join(dir, 'fail.cmd')
+    writeFileSync(failing, npmProgNodeShim('fail.js'))
+    writeFileSync(join(dir, 'fail.js'), 'process.exit(7)\n')
+    const result = await runProcess({ program: failing, timeoutMs: 30_000 })
+    expect(result.code).toBe(7)
+  })
+})
diff --git a/src/shared/child-process/windows-command-line.ts b/src/shared/child-process/windows-command-line.ts
index 44d5248add7..401141e36c7 100644
--- a/src/shared/child-process/windows-command-line.ts
+++ b/src/shared/child-process/windows-command-line.ts
@@ -101,7 +101,9 @@ export function buildWindowsCmdShimCommandLine(program: string, args: readonly s
   // does not survive a line break. Encoding one anyway truncates the argument
   // and can leave the remainder to be interpreted as a further command. Agent
   // prompts are the motivating input here and can contain newlines, so this
-  // has to fail loudly rather than silently mangle.
+  // has to fail loudly rather than silently mangle. Recognised npm/pnpm shims
+  // no longer reach this line at all — windows-cmd-shim-resolution.ts spawns
+  // their target directly, where a newline is just another character.
   for (const value of [program, ...args]) {
     if (/[\r\n]/.test(value)) {
       throw new Error('cmd.exe cannot receive an argument containing a line break')
diff --git a/src/shared/child-process/windows-console-visibility.test.ts b/src/shared/child-process/windows-console-visibility.test.ts
index 596728fa245..69b0a99eb5b 100644
--- a/src/shared/child-process/windows-console-visibility.test.ts
+++ b/src/shared/child-process/windows-console-visibility.test.ts
@@ -34,7 +34,7 @@ const ALLOWLIST: readonly string[] = readAllowlist(
  * the allowlist does not bound this: a swap (one file fixed and delisted, one
  * new file added with its entry) satisfies both membership assertions.
  */
-const UNHIDDEN_SPAWNER_PIN = 66
+const UNHIDDEN_SPAWNER_PIN = 65
 
 const CHILD_PROCESS_IMPORT =
   /from\s+['"](?:node:)?child_process['"]|require\(\s*['"](?:node:)?child_process['"]/
@@ -45,8 +45,9 @@ const SPAWN_CALL =
   /\b(?:spawn|spawnSync|spawnDetached|execFile|execFileSync|execFileAsync|execFileCb|exec|execSync|execAsync)\s*\(/g
 const SOURCE_ROOT = resolve(__dirname, '../..')
 /**
- * `run-process.ts` is the chokepoint: it sets windowsHide in `resolveSpawn`,
- * not at the call, so scanning it flags its own implementation.
+ * `run-process.ts` is the chokepoint: the flag comes from `resolveSpawn` (now
+ * in `spawn-resolution.ts`), not from the call, so scanning it flags its own
+ * implementation.
  *
  * `fork` is deliberately absent from SPAWN_CALL. Node forwards the option to
  * spawn at runtime, but `ForkOptions` does not declare it, so the two live
diff --git a/src/shared/child-process/windows-system-binary.ts b/src/shared/child-process/windows-system-binary.ts
index f74b8fa7200..1efeef50c79 100644
--- a/src/shared/child-process/windows-system-binary.ts
+++ b/src/shared/child-process/windows-system-binary.ts
@@ -1,4 +1,7 @@
-import { join } from 'node:path'
+// Why win32 and not the host `join`: these are Windows paths and are only ever spawned on Windows,
+// but they are also built off-platform (tests, and any code that plans a Windows command from a
+// POSIX host), where the host separator produces the mixed `C:\Windows/System32/whoami.exe`.
+import { win32 as pathWin32 } from 'node:path'
 
 /**
  * Absolute paths for the Windows system binaries Orca shells out to.
@@ -17,12 +20,12 @@ function systemRoot(env: NodeJS.ProcessEnv = process.env): string {
 }
 
 export function windowsPowerShellPath(env: NodeJS.ProcessEnv = process.env): string {
-  return join(systemRoot(env), 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe')
+  return pathWin32.join(systemRoot(env), 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe')
 }
 
 export function windowsSystem32Binary(
   fileName: string,
   env: NodeJS.ProcessEnv = process.env
 ): string {
-  return join(systemRoot(env), 'System32', fileName)
+  return pathWin32.join(systemRoot(env), 'System32', fileName)
 }
diff --git a/src/shared/codex-startup-delivery.test.ts b/src/shared/codex-startup-delivery.test.ts
index e7788f778fe..87e65f7514c 100644
--- a/src/shared/codex-startup-delivery.test.ts
+++ b/src/shared/codex-startup-delivery.test.ts
@@ -1,5 +1,8 @@
 import { describe, expect, it } from 'vitest'
-import { hasCodexNativeDraftFlag } from './codex-startup-delivery'
+import {
+  hasCodexNativeDraftFlag,
+  shouldUseShellReadyStartupDelivery
+} from './codex-startup-delivery'
 
 describe('hasCodexNativeDraftFlag', () => {
   it('matches Codex --prefill option tokens', () => {
@@ -26,3 +29,42 @@ describe('hasCodexNativeDraftFlag', () => {
     expect(hasCodexNativeDraftFlag('codex --model gpt-5')).toBe(false)
   })
 })
+
+describe('shouldUseShellReadyStartupDelivery', () => {
+  it('honours an explicit shell-ready hint whatever the command', () => {
+    expect(
+      shouldUseShellReadyStartupDelivery({
+        command: 'claude',
+        startupCommandDelivery: 'shell-ready'
+      })
+    ).toBe(true)
+  })
+
+  it('keeps plain Codex on the fast path when the shell is unknown', () => {
+    expect(shouldUseShellReadyStartupDelivery({ command: 'codex' })).toBe(false)
+  })
+
+  it('waits for plain Codex on shells that publish the marker from the line editor', () => {
+    expect(shouldUseShellReadyStartupDelivery({ command: 'codex', shellPath: '/bin/bash' })).toBe(
+      true
+    )
+    expect(
+      shouldUseShellReadyStartupDelivery({ command: 'codex', shellPath: '/opt/homebrew/bin/zsh' })
+    ).toBe(true)
+  })
+
+  it('leaves plain Codex unwaited on shells that emit the marker before the reader', () => {
+    expect(
+      shouldUseShellReadyStartupDelivery({ command: 'codex', shellPath: '/usr/bin/fish' })
+    ).toBe(false)
+  })
+
+  it('does not change non-Codex commands, which their transports already wait for', () => {
+    expect(shouldUseShellReadyStartupDelivery({ command: 'claude', shellPath: '/bin/bash' })).toBe(
+      false
+    )
+    expect(shouldUseShellReadyStartupDelivery({ command: undefined, shellPath: '/bin/bash' })).toBe(
+      false
+    )
+  })
+})
diff --git a/src/shared/codex-startup-delivery.ts b/src/shared/codex-startup-delivery.ts
index a45337dd0be..538b3befa19 100644
--- a/src/shared/codex-startup-delivery.ts
+++ b/src/shared/codex-startup-delivery.ts
@@ -1,4 +1,5 @@
 import { recognizeAgentProcessFromCommandLine } from './agent-process-recognition'
+import { shellReadyMarkerComesFromLineEditor } from './shell-ready-marker-timing'
 
 export type StartupCommandDelivery = 'fast' | 'shell-ready'
 
@@ -74,9 +75,23 @@ export function hasCodexNativeDraftFlag(command: string | null | undefined): boo
   )
 }
 
+export function isCodexStartupCommand(command: string | null | undefined): boolean {
+  return recognizeAgentProcessFromCommandLine(command)?.agent === 'codex'
+}
+
 export function shouldUseShellReadyStartupDelivery(args: {
   command: string | null | undefined
   startupCommandDelivery?: StartupCommandDelivery
+  /** The shell that will run the command, when the deciding side knows it. Plain Codex
+   *  waits for the handshake on shells that publish the marker from their line editor:
+   *  there the wait ends at the prompt, while an early write double-echoes the launch. */
+  shellPath?: string
 }): boolean {
-  return args.startupCommandDelivery === 'shell-ready' || hasCodexNativeDraftFlag(args.command)
+  return (
+    args.startupCommandDelivery === 'shell-ready' ||
+    hasCodexNativeDraftFlag(args.command) ||
+    (args.shellPath !== undefined &&
+      shellReadyMarkerComesFromLineEditor(args.shellPath) &&
+      isCodexStartupCommand(args.command))
+  )
 }
diff --git a/src/shared/command-code-output-status.test.ts b/src/shared/command-code-output-status.test.ts
index 77a8005056e..4ca0be25bbc 100644
--- a/src/shared/command-code-output-status.test.ts
+++ b/src/shared/command-code-output-status.test.ts
@@ -49,6 +49,22 @@ describe('createCommandCodeOutputStatusDetector', () => {
     expect(onWorking).toHaveBeenCalledWith('')
   })
 
+  it('detects the banner after chunks that carry no banner characters at all', () => {
+    const onWorking = vi.fn()
+    const detector = createCommandCodeOutputStatusDetector({
+      startupCommand: null,
+      onWorking
+    })
+
+    // Ordinary agent output with no '#': the raw prefilter skips these without building a window.
+    expect(detector.observe('Codex is editing the file and rendering a diff\r\n')).toBe(false)
+    expect(detector.observe('Codex wrote 12 lines\r\n')).toBe(false)
+    expect(detector.observe('# Command Code v0.27.2\r\n')).toBe(false)
+    expect(detector.observe('⌘ Parsing...')).toBe(true)
+
+    expect(onWorking).toHaveBeenCalledWith('')
+  })
+
   it('detects the Command Code banner when ANSI styling splits the words', () => {
     const onWorking = vi.fn()
     const detector = createCommandCodeOutputStatusDetector({
diff --git a/src/shared/command-code-output-status.ts b/src/shared/command-code-output-status.ts
index 16942674219..e98f72d857b 100644
--- a/src/shared/command-code-output-status.ts
+++ b/src/shared/command-code-output-status.ts
@@ -142,6 +142,21 @@ function rawTextMayContainCommandCodeBanner(rawText: string): boolean {
   return rawText.includes('C') && rawText.includes('o') && rawText.includes('d')
 }
 
+// COMMAND_CODE_BANNER_RE requires a literal '#', and stripTerminalControl only ever removes
+// characters, so raw bytes without one cannot produce a banner match.
+const BANNER_REQUIRED_RAW_CHAR = '#'
+
+/**
+ * Prefilter run against the raw chunk before the scan windows are built. Testing the whole carry
+ * plus chunk over-admits relative to the window test (the windows drop middle content), so it can
+ * never turn a match into a miss.
+ */
+function rawChunkMayContainCommandCodeBanner(previousRawText: string, data: string): boolean {
+  return (
+    data.includes(BANNER_REQUIRED_RAW_CHAR) || previousRawText.includes(BANNER_REQUIRED_RAW_CHAR)
+  )
+}
+
 function appendRecentRawText(previousRawText: string, data: string): string {
   if (data.length >= RECENT_TEXT_LIMIT) {
     return data.slice(-RECENT_TEXT_LIMIT)
@@ -233,6 +248,11 @@ export function createCommandCodeOutputStatusDetector(args: {
     observe(data: string): boolean {
       const previousRawText = recentRawText
       recentRawText = appendRecentRawText(previousRawText, data)
+      // Why before the windows: a non-Command-Code pane pays two ~4KB string builds per chunk
+      // otherwise, only to fail the same prefilter a few lines later.
+      if (!hasSeenCommandCodeUi && !rawChunkMayContainCommandCodeBanner(previousRawText, data)) {
+        return false
+      }
       const scanRawText = buildStatusScanRawText(previousRawText, data)
       const scanRawTextWithChunkBoundary = previousRawText
         ? buildStatusScanRawText(`${previousRawText}\n`, data)
diff --git a/src/shared/ephemeral-vm-recipe-process.ts b/src/shared/ephemeral-vm-recipe-process.ts
index b258a1b2704..30d44ac1dbc 100644
--- a/src/shared/ephemeral-vm-recipe-process.ts
+++ b/src/shared/ephemeral-vm-recipe-process.ts
@@ -1,5 +1,6 @@
 import { spawn, type ChildProcessWithoutNullStreams } from 'node:child_process'
 import type { EphemeralVmRecipeContext } from './ephemeral-vm-recipe-runner'
+import { admitProcessTreeKill } from './child-process/process-tree-kill-gate'
 
 const DEFAULT_MAX_CAPTURE_BYTES = 1024 * 1024
 const CANCEL_FORCE_KILL_DELAY_MS = 5_000
@@ -132,13 +133,26 @@ export async function runRecipeCommand(args: {
   })
 }
 
-function killRecipeProcess(child: ChildProcessWithoutNullStreams, force = false): void {
+/** Exported for the refusal-fallback test; the abort path is otherwise unreachable. */
+export function killRecipeProcess(child: ChildProcessWithoutNullStreams, force = false): void {
   const signal = force ? 'SIGKILL' : 'SIGTERM'
   if (process.platform === 'win32') {
     // Recipes run through `cmd.exe /c` (shell: true), so child.kill() would only
     // terminate the wrapper and orphan the actual recipe subprocess (e.g. a cloud
     // CLI mid-provision). taskkill /T walks and kills the whole tree.
     if (child.pid) {
+      if (
+        !admitProcessTreeKill({
+          pid: child.pid,
+          site: 'ephemeral-vm-recipe',
+          scope: 'win-taskkill-tree'
+        })
+      ) {
+        // Refusal blocks the tree walk, not the termination: the root kill is
+        // handle-addressed, so it cannot reach the recycled pid we refused.
+        child.kill(signal)
+        return
+      }
       const killer = spawn('taskkill', ['/pid', String(child.pid), '/t', '/f'], {
         windowsHide: true,
         stdio: 'ignore'
diff --git a/src/shared/execution-host.test.ts b/src/shared/execution-host.test.ts
index 9905fc5fe2a..fba1d1fee8d 100644
--- a/src/shared/execution-host.test.ts
+++ b/src/shared/execution-host.test.ts
@@ -2,6 +2,7 @@ import { afterEach, describe, expect, it, vi } from 'vitest'
 import {
   ALL_EXECUTION_HOSTS_SCOPE,
   LOCAL_EXECUTION_HOST_ID,
+  getExecutionHostLabel,
   getLocalExecutionHostLabel,
   getRepoExecutionHostId,
   getRepoSshConnectionId,
@@ -169,4 +170,16 @@ describe('execution host id delimiter invariant', () => {
       targetId: 'a|b'
     })
   })
+
+  // "All hosts" is the everything-scope. Answering with it for an id that names no host shows one
+  // unroutable row as though it were on every host, which is the opposite of what it is.
+  it('labels an id that names no host as one unknown host, not as every host', () => {
+    for (const id of ['ssh:', 'ssh:a|b', 'ssh:%zz', 'runtime:', 'quantum:box'] as const) {
+      expect(getExecutionHostLabel(id as never)).toBe('Unknown host')
+    }
+    expect(getExecutionHostLabel(null)).toBe('Unknown host')
+    expect(getExecutionHostLabel(ALL_EXECUTION_HOSTS_SCOPE)).toBe('All hosts')
+    expect(getExecutionHostLabel('ssh:box')).toBe('box')
+    expect(getExecutionHostLabel('runtime:env-1')).toBe('env-1')
+  })
 })
diff --git a/src/shared/execution-host.ts b/src/shared/execution-host.ts
index a77d02b3882..bbe55aea1a0 100644
--- a/src/shared/execution-host.ts
+++ b/src/shared/execution-host.ts
@@ -226,13 +226,18 @@ export function getSettingsFocusedExecutionHostId(
     : LOCAL_EXECUTION_HOST_ID
 }
 
-export function getExecutionHostLabel(id: ExecutionHostScope): string {
+export function getExecutionHostLabel(id: ExecutionHostScope | null | undefined): string {
   if (id === ALL_EXECUTION_HOSTS_SCOPE) {
     return 'All hosts'
   }
   const parsed = parseExecutionHostId(id)
   if (!parsed) {
-    return 'All hosts'
+    // Not "All hosts": an id that names no host is one *unknown* host, and answering with the
+    // everything-scope label shows an unroutable row as though it were on every host.
+    // Plain English like every other label in this module (`Local Mac`, `This computer`,
+    // `All hosts`) — none of them resolve through the renderer's i18n catalog, so a lone
+    // translated string here would read inconsistently.
+    return 'Unknown host'
   }
   switch (parsed.kind) {
     case 'local':
diff --git a/src/shared/folder-workspace-execution-host.test.ts b/src/shared/folder-workspace-execution-host.test.ts
index 2ccced49907..e1af0a7920e 100644
--- a/src/shared/folder-workspace-execution-host.test.ts
+++ b/src/shared/folder-workspace-execution-host.test.ts
@@ -174,6 +174,194 @@ describe('folder workspace execution host', () => {
     expect(resolveFolderWorkspaceHost(state({ repos: [] }), 'fw-1')).toEqual({ kind: 'local' })
   })
 
+  // SSH ownership has two spellings on a repo row. A row carrying only `executionHostId: 'ssh:*'`
+  // has no `connectionId`, and reading the raw field counted it as a local repo — so a workspace
+  // whose files live on an SSH host resolved `local`, which is an execute-here answer for a remote
+  // path. These fire on well-formed rows; nothing malformed is involved.
+  it('resolves a repo that names its SSH host only through executionHostId', () => {
+    const resolved = resolveFolderWorkspaceHost(
+      state({
+        repos: [
+          repo({
+            id: 'repo-1',
+            path: '/work/app/a',
+            projectGroupId: 'group-1',
+            executionHostId: 'ssh:box'
+          })
+        ]
+      }),
+      'fw-1'
+    )
+
+    expect(resolved).toEqual({ kind: 'ssh', targetId: 'box' })
+  })
+
+  it('mixes such a repo with a local one as ambiguous rather than local', () => {
+    const resolved = resolveFolderWorkspaceHost(
+      state({
+        repos: [
+          repo({ id: 'repo-1', path: '/work/app/a', projectGroupId: 'group-1' }),
+          repo({
+            id: 'repo-2',
+            path: '/work/app/b',
+            projectGroupId: 'group-1',
+            executionHostId: 'ssh:box'
+          })
+        ]
+      }),
+      'fw-1'
+    )
+
+    expect(resolved).toEqual({ kind: 'ambiguous' })
+  })
+
+  it('matches a scope connection against such a repo instead of calling it ambiguous', () => {
+    const resolved = resolveFolderWorkspaceHost(
+      state({
+        folderWorkspaces: [workspace({ connectionId: 'box' })],
+        repos: [
+          repo({
+            id: 'repo-1',
+            path: '/work/app/a',
+            projectGroupId: 'group-1',
+            executionHostId: 'ssh:box'
+          })
+        ]
+      }),
+      'fw-1'
+    )
+
+    expect(resolved).toEqual({ kind: 'ssh', targetId: 'box' })
+  })
+
+  it('reads the target off the host, so a percent-encoded id decodes', () => {
+    const resolved = resolveFolderWorkspaceHost(
+      state({
+        repos: [
+          repo({
+            id: 'repo-1',
+            path: '/work/app/a',
+            projectGroupId: 'group-1',
+            executionHostId: `ssh:${encodeURIComponent('box 1')}`
+          })
+        ]
+      }),
+      'fw-1'
+    )
+
+    expect(resolved).toEqual({ kind: 'ssh', targetId: 'box 1' })
+  })
+
+  // Deliberately unchanged: a `runtime:` row's nested SSH target is not this client's to dial, but
+  // narrowing that here would be a second behaviour change riding on the SSH fix.
+  it('leaves a runtime row contributing its nested connection exactly as before', () => {
+    const resolved = resolveFolderWorkspaceHost(
+      state({
+        repos: [
+          repo({
+            id: 'repo-1',
+            path: '/work/app/a',
+            projectGroupId: 'group-1',
+            executionHostId: 'runtime:env-1',
+            connectionId: 'nested-box'
+          })
+        ]
+      }),
+      'fw-1'
+    )
+
+    expect(resolved).toEqual({ kind: 'ssh', targetId: 'nested-box' })
+  })
+
+  it('still answers local for a runtime pin, which the type cannot express otherwise', () => {
+    const resolved = resolveFolderWorkspaceHost(
+      state({
+        folderWorkspaces: [workspace({ executionHostId: 'runtime:env-1' })]
+      }),
+      'fw-1'
+    )
+
+    expect(resolved).toEqual({ kind: 'local' })
+  })
+
+  // The candidate FILTER decides which rows reach the resolver, and it read `repo.connectionId` raw
+  // too — so an SSH-only repo outside the project-group subtree was dropped before any of the above
+  // could classify it. Every test before this one uses a repo inside the subtree, which is never
+  // filtered, so none of them could have caught it (found in review by CodeRabbit).
+  describe('a repo matched only by path, outside the project-group subtree', () => {
+    const sshOnlyPathRepo = repo({
+      id: 'repo-path',
+      path: '/work/app/nested',
+      executionHostId: 'ssh:box'
+    })
+
+    it('survives the scope-connection filter instead of being dropped as connectionless', () => {
+      const scoped = state({
+        folderWorkspaces: [workspace({ connectionId: 'box' })],
+        repos: [sshOnlyPathRepo]
+      })
+
+      expect(findFolderWorkspaceCandidateRepos(scoped, 'fw-1')).toEqual([sshOnlyPathRepo])
+      expect(resolveFolderWorkspaceHost(scoped, 'fw-1')).toEqual({ kind: 'ssh', targetId: 'box' })
+    })
+
+    // Pins the resolver, not the filter: under the old raw read BOTH rows came back connectionless,
+    // so they matched each other by accident and this case survived the filter either way. The
+    // legacy-vs-unified pairing below is the one that discriminates.
+    it('survives the group-connection filter when the group is on that same SSH host', () => {
+      const scoped = state({
+        repos: [
+          repo({
+            id: 'repo-group',
+            path: '/work/app/group',
+            projectGroupId: 'group-1',
+            executionHostId: 'ssh:box'
+          }),
+          sshOnlyPathRepo
+        ]
+      })
+
+      expect(findFolderWorkspaceCandidateRepos(scoped, 'fw-1')).toHaveLength(2)
+      expect(resolveFolderWorkspaceHost(scoped, 'fw-1')).toEqual({ kind: 'ssh', targetId: 'box' })
+    })
+
+    // Both sides of the group comparison are resolved, so the legacy spelling on one side and the
+    // unified spelling on the other still match.
+    it('matches a legacy-spelled group repo against a unified-spelled path repo', () => {
+      const scoped = state({
+        repos: [
+          repo({
+            id: 'repo-group',
+            path: '/work/app/group',
+            projectGroupId: 'group-1',
+            connectionId: 'box'
+          }),
+          sshOnlyPathRepo
+        ]
+      })
+
+      expect(findFolderWorkspaceCandidateRepos(scoped, 'fw-1')).toHaveLength(2)
+      expect(resolveFolderWorkspaceHost(scoped, 'fw-1')).toEqual({ kind: 'ssh', targetId: 'box' })
+    })
+
+    // A `runtime:` row's nested target is still read from the raw field, so it matches a scope
+    // connection exactly as it does today. Pinned so the carve-out stays a decision.
+    it('leaves a runtime row matching the scope connection through its nested target', () => {
+      const runtimePathRepo = repo({
+        id: 'repo-path',
+        path: '/work/app/nested',
+        executionHostId: 'runtime:env-1',
+        connectionId: 'box'
+      })
+      const scoped = state({
+        folderWorkspaces: [workspace({ connectionId: 'box' })],
+        repos: [runtimePathRepo]
+      })
+
+      expect(findFolderWorkspaceCandidateRepos(scoped, 'fw-1')).toEqual([runtimePathRepo])
+    })
+  })
+
   it('reads each repository membership once while collecting candidates', () => {
     let membershipReads = 0
     const repos = Array.from({ length: 32 }, (_, index) => {
diff --git a/src/shared/folder-workspace-execution-host.ts b/src/shared/folder-workspace-execution-host.ts
index dc4dc80c51f..0aee75de543 100644
--- a/src/shared/folder-workspace-execution-host.ts
+++ b/src/shared/folder-workspace-execution-host.ts
@@ -17,7 +17,7 @@ import type { ProjectGroup } from './project-group-types'
 import type { Repo } from './repo-types'
 import { isPathInsideOrEqual } from './cross-platform-path'
 import { getProjectGroupSubtreeIds } from './project-groups'
-import { parseExecutionHostId } from './execution-host'
+import { getRepoExecutionHostId, parseExecutionHostId } from './execution-host'
 
 export type FolderWorkspaceHostState = {
   folderWorkspaces: readonly FolderWorkspace[]
@@ -36,6 +36,24 @@ export function normalizeConnectionId(value: string | null | undefined): string
   return value?.trim() || null
 }
 
+/**
+ * The SSH target whose filesystem holds this repo's files, or `null` for anything else.
+ *
+ * SSH ownership has two spellings on a repo row — the legacy `connectionId` field and the unified
+ * `executionHostId` — so reading the raw field sees only one of them and a row carrying only
+ * `executionHostId: 'ssh:<target>'` reads as if it had no connection at all. Every comparison in
+ * this file goes through here: the candidate filters decide which rows reach the resolver, so
+ * reading raw in either place drops the row before the resolver can classify it.
+ *
+ * A non-SSH host falls back to the raw field so a `runtime:` row keeps contributing its nested
+ * target exactly as it does today. That target is not this client's to dial, but changing it is a
+ * separate defect with its own reasoning — see the note in `resolveFolderWorkspaceHost`.
+ */
+function getRepoScopeConnectionId(repo: Repo): string | null {
+  const host = parseExecutionHostId(getRepoExecutionHostId(repo))
+  return host?.kind === 'ssh' ? host.targetId : normalizeConnectionId(repo.connectionId)
+}
+
 function getFolderScopeCandidateRepos(args: {
   folderPath: string
   projectGroupId: string
@@ -59,18 +77,18 @@ function getFolderScopeCandidateRepos(args: {
   if (args.connectionId) {
     return [
       ...groupRepos,
-      ...pathRepos.filter((repo) => normalizeConnectionId(repo.connectionId) === args.connectionId)
+      ...pathRepos.filter((repo) => getRepoScopeConnectionId(repo) === args.connectionId)
     ]
   }
   if (groupRepos.length === 0) {
     return pathRepos
   }
-  const groupConnectionIds = new Set(
-    groupRepos.map((repo) => normalizeConnectionId(repo.connectionId))
-  )
+  // Both sides resolved: comparing a resolved path repo against a raw group read would reintroduce
+  // the same mismatch from the other direction.
+  const groupConnectionIds = new Set(groupRepos.map(getRepoScopeConnectionId))
   return [
     ...groupRepos,
-    ...pathRepos.filter((repo) => groupConnectionIds.has(normalizeConnectionId(repo.connectionId)))
+    ...pathRepos.filter((repo) => groupConnectionIds.has(getRepoScopeConnectionId(repo)))
   ]
 }
 
@@ -102,6 +120,12 @@ export function resolveFolderWorkspaceHost(
   }
   const explicitHost = parseExecutionHostId(workspace.executionHostId)
   if (explicitHost) {
+    // A `runtime:` workspace deliberately answers `local`, and `FolderWorkspaceHost` has no runtime
+    // variant to answer with instead. That omission is known: a runtime environment's own server
+    // normalizes its work to `local`, and the nested SSH target on such a row is addressable only as
+    // the pair (environmentId, targetId) — handing it to this client's SSH table would dial a
+    // same-named box in the wrong namespace. Widening the type is its own change, not an oversight
+    // here.
     return explicitHost.kind === 'ssh'
       ? { kind: 'ssh', targetId: explicitHost.targetId }
       : { kind: 'local' }
@@ -114,7 +138,7 @@ export function resolveFolderWorkspaceHost(
   let hasLocalRepo = false
   const connectionIds = new Set<string>()
   for (const repo of candidateRepos) {
-    const connectionId = normalizeConnectionId(repo.connectionId)
+    const connectionId = getRepoScopeConnectionId(repo)
     if (connectionId) {
       connectionIds.add(connectionId)
     } else {
diff --git a/src/shared/git-binary-compatibility.test.ts b/src/shared/git-binary-compatibility.test.ts
index 6387f200b4c..e11fa6ed2c4 100644
--- a/src/shared/git-binary-compatibility.test.ts
+++ b/src/shared/git-binary-compatibility.test.ts
@@ -111,6 +111,33 @@ describeBinaryCompatibility('real Git binary compatibility', () => {
     }
   })
 
+  it('quietly distinguishes present and absent branch refs', async () => {
+    const head = (await runGit(['rev-parse', 'HEAD'])).stdout.trim()
+    await runGit(['branch', 'quiet-probe-present', head])
+    await expect(
+      runGit(['rev-parse', '--verify', '--quiet', 'refs/heads/quiet-probe-present'])
+    ).resolves.toMatchObject({ stdout: `${head}\n`, stderr: '' })
+    await expect(
+      runGit(['rev-parse', '--verify', '--quiet', 'refs/heads/quiet-probe-absent'])
+    ).rejects.toMatchObject({ code: 1, stdout: '', stderr: '' })
+  })
+
+  it('distinguishes an absent branch from a ref pointing at a missing object', async () => {
+    const missingObject = 'a'.repeat(40)
+    const refPath = join(repoPath, '.git', 'refs', 'heads', 'quiet-probe-dangling')
+    await writeFile(refPath, `${missingObject}\n`)
+    try {
+      await expect(
+        runGit(['rev-parse', '--verify', '--quiet', 'refs/heads/quiet-probe-dangling'])
+      ).resolves.toMatchObject({ stdout: `${missingObject}\n`, stderr: '' })
+      await expect(
+        runGit(['rev-parse', '--verify', '--quiet', 'refs/heads/quiet-probe-dangling^{commit}'])
+      ).rejects.toMatchObject({ code: 1, stdout: '', stderr: '' })
+    } finally {
+      await rm(refPath)
+    }
+  })
+
   it('recognizes worktree-list and rev-parse compatibility boundaries', async () => {
     await expectPreferredOrRecognizedFallback(
       ['worktree', 'list', '--porcelain', '-z'],
@@ -177,6 +204,16 @@ describeBinaryCompatibility('real Git binary compatibility', () => {
     await rm(join(repoPath, 'deferred-trash'), { recursive: true, force: true })
   })
 
+  it('removes locked prepared worktrees without a separate unlock', async () => {
+    await runGit(['worktree', 'add', '--detach', '--no-checkout', 'compat-discard', 'HEAD'])
+    await runGit(['-C', 'compat-discard', 'reset', '--hard', 'HEAD'])
+    await runGit(['worktree', 'lock', '--reason', 'owned preparation', 'compat-discard'])
+    await runGit(['worktree', 'remove', '--force', '--force', 'compat-discard'])
+    expect((await runGit(['worktree', 'list', '--porcelain'])).stdout).not.toContain(
+      'compat-discard'
+    )
+  })
+
   it('supports prepared worktree creation and finalization', async () => {
     await runGit(['worktree', 'add', '--detach', '--no-checkout', 'compat-prepared', 'HEAD'])
     await runGit(['-C', 'compat-prepared', 'reset', '--hard', 'HEAD'])
diff --git a/src/shared/github/project-roadmap-timeline.test.ts b/src/shared/github/project-roadmap-timeline.test.ts
new file mode 100644
index 00000000000..ec7bf8b0e77
--- /dev/null
+++ b/src/shared/github/project-roadmap-timeline.test.ts
@@ -0,0 +1,310 @@
+import { describe, expect, it } from 'vitest'
+import {
+  buildRoadmapTicks,
+  getRoadmapSpan,
+  parseRoadmapDate,
+  resolveRoadmapDateSource,
+  roadmapOffsetPx,
+  ROADMAP_DAY_MS,
+  type RoadmapSpan
+} from './project-roadmap-timeline'
+import type {
+  GitHubProjectField,
+  GitHubProjectFieldValue,
+  GitHubProjectRow,
+  GitHubProjectView
+} from './project-types'
+
+function dateField(id: string, name: string): GitHubProjectField {
+  return { kind: 'field', id, name, dataType: 'DATE' }
+}
+
+function iterationField(id: string, name: string): GitHubProjectField {
+  return { kind: 'iteration', id, name, dataType: 'ITERATION', iterations: [] }
+}
+
+function view(fields: GitHubProjectField[]): GitHubProjectView {
+  return {
+    id: 'PVTV_1',
+    number: 1,
+    name: 'Roadmap',
+    layout: 'ROADMAP_LAYOUT',
+    filter: '',
+    fields,
+    groupByFields: [],
+    sortByFields: []
+  }
+}
+
+function row(values: GitHubProjectFieldValue[]): GitHubProjectRow {
+  const fieldValuesByFieldId: Record<string, GitHubProjectFieldValue> = {}
+  for (const value of values) {
+    fieldValuesByFieldId[value.fieldId] = value
+  }
+  return {
+    id: 'PVTI_1',
+    itemType: 'ISSUE',
+    content: {
+      number: 1,
+      title: 'Item',
+      body: null,
+      url: 'https://github.com/o/r/issues/1',
+      state: 'OPEN',
+      stateReason: null,
+      isDraft: null,
+      repository: 'o/r',
+      assignees: [],
+      labels: [],
+      parentIssue: null,
+      issueType: null
+    },
+    fieldValuesByFieldId,
+    updatedAt: '2026-08-31T00:00:00Z',
+    position: 0
+  }
+}
+
+const utc = (iso: string): number => Date.parse(`${iso}T00:00:00Z`)
+
+describe('resolveRoadmapDateSource', () => {
+  it('pairs date fields by name regardless of view order', () => {
+    const target = dateField('f_end', 'Target date')
+    const start = dateField('f_start', 'Start date')
+    expect(resolveRoadmapDateSource(view([target, start]))).toEqual({
+      kind: 'date-range',
+      startField: start,
+      targetField: target
+    })
+  })
+
+  it('keeps a name-matched field in its role when the other name matches nothing', () => {
+    const review = dateField('f_review', 'Review date')
+    const start = dateField('f_start', 'Start date')
+    expect(resolveRoadmapDateSource(view([review, start]))).toEqual({
+      kind: 'date-range',
+      startField: start,
+      targetField: review
+    })
+  })
+
+  it('finds placement fields via sortByFields when the visible list hides them', () => {
+    const start = dateField('f_start', 'Start date')
+    const target = dateField('f_end', 'Target date')
+    const hidden = view([{ kind: 'field', id: 'f_t', name: 'Title', dataType: 'TITLE' }])
+    hidden.sortByFields = [
+      { direction: 'ASC', field: start },
+      { direction: 'ASC', field: target }
+    ]
+    expect(resolveRoadmapDateSource(hidden)).toEqual({
+      kind: 'date-range',
+      startField: start,
+      targetField: target
+    })
+  })
+
+  it('derives placement fields from row values when no configured field has them', () => {
+    const bare = view([{ kind: 'field', id: 'f_t', name: 'Title', dataType: 'TITLE' }])
+    const rows = [
+      row([
+        { kind: 'date', fieldId: 'f_start', date: '2026-03-02', fieldName: 'Start date' },
+        { kind: 'date', fieldId: 'f_end', date: '2026-03-04', fieldName: 'Target date' }
+      ])
+    ]
+    expect(resolveRoadmapDateSource(bare, rows)).toEqual({
+      kind: 'date-range',
+      startField: { kind: 'field', id: 'f_start', name: 'Start date', dataType: 'DATE' },
+      targetField: { kind: 'field', id: 'f_end', name: 'Target date', dataType: 'DATE' }
+    })
+  })
+
+  it('falls back to view order when names do not match the patterns', () => {
+    const first = dateField('f_1', '開始')
+    const second = dateField('f_2', '完了')
+    expect(resolveRoadmapDateSource(view([first, second]))).toEqual({
+      kind: 'date-range',
+      startField: first,
+      targetField: second
+    })
+  })
+
+  it('prefers an iteration field over a lone date field', () => {
+    const iteration = iterationField('f_it', 'Sprint')
+    expect(resolveRoadmapDateSource(view([dateField('f_1', 'Start date'), iteration]))).toEqual({
+      kind: 'iteration',
+      field: iteration
+    })
+  })
+
+  it('uses a lone date field as a point source', () => {
+    const only = dateField('f_1', 'Ship date')
+    expect(resolveRoadmapDateSource(view([only]))).toEqual({ kind: 'date-point', field: only })
+  })
+
+  it('returns null when the view has nothing to place items on', () => {
+    expect(
+      resolveRoadmapDateSource(
+        view([{ kind: 'field', id: 'f_t', name: 'Title', dataType: 'TITLE' }])
+      )
+    ).toBeNull()
+  })
+})
+
+describe('getRoadmapSpan', () => {
+  const start = dateField('f_start', 'Start date')
+  const target = dateField('f_end', 'Target date')
+  const source = { kind: 'date-range', startField: start, targetField: target } as const
+
+  it('spans an inclusive end date', () => {
+    const span = getRoadmapSpan(
+      row([
+        { kind: 'date', fieldId: 'f_start', date: '2026-03-02' },
+        { kind: 'date', fieldId: 'f_end', date: '2026-03-04' }
+      ]),
+      source
+    )
+    expect(span).toEqual({ startMs: utc('2026-03-02'), endMs: utc('2026-03-05'), point: false })
+  })
+
+  it('renders a single known date as a point', () => {
+    const span = getRoadmapSpan(
+      row([{ kind: 'date', fieldId: 'f_end', date: '2026-03-04' }]),
+      source
+    )
+    expect(span).toEqual({ startMs: utc('2026-03-04'), endMs: utc('2026-03-05'), point: true })
+  })
+
+  it('orders an inverted pair instead of dropping the row', () => {
+    const span = getRoadmapSpan(
+      row([
+        { kind: 'date', fieldId: 'f_start', date: '2026-03-10' },
+        { kind: 'date', fieldId: 'f_end', date: '2026-03-01' }
+      ]),
+      source
+    )
+    expect(span).toEqual({ startMs: utc('2026-03-01'), endMs: utc('2026-03-11'), point: false })
+  })
+
+  it('returns null when neither date is set', () => {
+    expect(getRoadmapSpan(row([]), source)).toBeNull()
+  })
+
+  it('derives the span from an iteration value', () => {
+    const span = getRoadmapSpan(
+      row([
+        {
+          kind: 'iteration',
+          fieldId: 'f_it',
+          iterationId: 'it_1',
+          title: 'Sprint 1',
+          startDate: '2026-03-02',
+          duration: 14
+        }
+      ]),
+      { kind: 'iteration', field: iterationField('f_it', 'Sprint') }
+    )
+    expect(span).toEqual({
+      startMs: utc('2026-03-02'),
+      endMs: utc('2026-03-02') + 14 * ROADMAP_DAY_MS,
+      point: false
+    })
+  })
+
+  it('ignores a value whose kind does not match the source', () => {
+    expect(
+      getRoadmapSpan(row([{ kind: 'text', fieldId: 'f_start', text: '2026-03-02' }]), source)
+    ).toBeNull()
+  })
+})
+
+describe('parseRoadmapDate', () => {
+  it('reads the date part of an ISO timestamp', () => {
+    expect(parseRoadmapDate('2026-03-02T11:22:33Z')).toBe(utc('2026-03-02'))
+  })
+
+  it('rejects malformed input', () => {
+    expect(parseRoadmapDate('March 2')).toBeNull()
+  })
+
+  it('rejects invalid calendar dates instead of letting Date.UTC normalize them', () => {
+    expect(parseRoadmapDate('2026-02-30')).toBeNull()
+    expect(parseRoadmapDate('2026-13-01')).toBeNull()
+    expect(parseRoadmapDate('2026-04-31')).toBeNull()
+    expect(parseRoadmapDate('2024-02-29')).toBe(Date.parse('2024-02-29T00:00:00Z'))
+  })
+})
+
+describe('buildRoadmapTicks', () => {
+  const span = (from: string, to: string): RoadmapSpan => ({
+    startMs: utc(from),
+    endMs: utc(to),
+    point: false
+  })
+
+  it('pads one month on each side of the covered range', () => {
+    const ticks = buildRoadmapTicks([span('2026-03-02', '2026-10-10')], 'month', utc('2026-03-15'))
+    expect(ticks[0]?.startMs).toBe(utc('2026-02-01'))
+    expect(ticks.at(-1)?.endMs).toBe(utc('2026-12-01'))
+  })
+
+  it('always covers today even when every item sits elsewhere', () => {
+    const ticks = buildRoadmapTicks([span('2026-03-02', '2026-03-10')], 'month', utc('2026-09-15'))
+    expect(ticks[0]?.startMs).toBe(utc('2026-02-01'))
+    expect(ticks.at(-1)?.endMs).toBe(utc('2026-11-01'))
+  })
+
+  it('widens an empty roadmap to the minimum readable width', () => {
+    expect(buildRoadmapTicks([], 'month', utc('2026-03-15'))).toHaveLength(6)
+    expect(buildRoadmapTicks([], 'quarter', utc('2026-03-15'))).toHaveLength(4)
+    expect(buildRoadmapTicks([], 'year', utc('2026-03-15'))).toHaveLength(3)
+  })
+
+  it('snaps quarter and year grids to their unit boundaries', () => {
+    const quarters = buildRoadmapTicks(
+      [span('2026-05-02', '2026-05-10')],
+      'quarter',
+      utc('2026-05-15')
+    )
+    expect(quarters[0]?.startMs).toBe(utc('2026-01-01'))
+    const years = buildRoadmapTicks([span('2026-05-02', '2026-05-10')], 'year', utc('2026-05-15'))
+    expect(years[0]?.startMs).toBe(utc('2025-01-01'))
+  })
+
+  it('caps the grid instead of expanding for a far-future date, keeping today visible', () => {
+    const today = utc('2026-03-15')
+    const ticks = buildRoadmapTicks([span('2026-03-02', '9999-01-01')], 'month', today)
+    expect(ticks).toHaveLength(480)
+    expect(ticks[0]!.startMs).toBeLessThanOrEqual(today)
+    expect(ticks.at(-1)!.endMs).toBeGreaterThan(today)
+  })
+
+  it('caps the grid for a far-past date without pushing today off the edge', () => {
+    const today = utc('2026-03-15')
+    const ticks = buildRoadmapTicks([span('0206-03-02', '0206-03-10')], 'month', today)
+    expect(ticks).toHaveLength(480)
+    expect(ticks[0]!.startMs).toBeLessThanOrEqual(today)
+    expect(ticks.at(-1)!.endMs).toBeGreaterThan(today)
+    // One month of trailing padding after today survives the trim.
+    expect(ticks.at(-1)!.endMs).toBe(utc('2026-05-01'))
+  })
+})
+
+describe('roadmapOffsetPx', () => {
+  const ticks = buildRoadmapTicks([], 'month', utc('2026-03-15'))
+
+  it('interpolates inside the containing tick so column rules stay aligned', () => {
+    const second = ticks[1]
+    expect(second).toBeDefined()
+    expect(roadmapOffsetPx(second!.startMs, ticks, 100)).toBe(100)
+    const midpoint = second!.startMs + (second!.endMs - second!.startMs) / 2
+    expect(roadmapOffsetPx(midpoint, ticks, 100)).toBeCloseTo(150, 5)
+  })
+
+  it('clamps out-of-range timestamps to the grid edges', () => {
+    expect(roadmapOffsetPx(utc('1990-01-01'), ticks, 100)).toBe(0)
+    expect(roadmapOffsetPx(utc('2090-01-01'), ticks, 100)).toBe(ticks.length * 100)
+  })
+
+  it('returns zero for an empty grid', () => {
+    expect(roadmapOffsetPx(utc('2026-03-15'), [], 100)).toBe(0)
+  })
+})
diff --git a/src/shared/github/project-roadmap-timeline.ts b/src/shared/github/project-roadmap-timeline.ts
new file mode 100644
index 00000000000..ad539bed61d
--- /dev/null
+++ b/src/shared/github/project-roadmap-timeline.ts
@@ -0,0 +1,301 @@
+// Why: GitHub's GraphQL API never exposes which fields a Roadmap view places
+// its items on — `ProjectV2View` carries the layout and the field set, not the
+// roadmap's date configuration. The placement is therefore derived from the
+// view's own fields here, as pure logic, so desktop and mobile can draw the
+// same bars and the geometry stays testable without a renderer.
+import type { GitHubProjectField, GitHubProjectRow, GitHubProjectView } from './project-types'
+
+export const ROADMAP_DAY_MS = 86_400_000
+
+export type RoadmapZoom = 'month' | 'quarter' | 'year'
+
+export type RoadmapDateSource =
+  | { kind: 'date-range'; startField: GitHubProjectField; targetField: GitHubProjectField }
+  | { kind: 'date-point'; field: GitHubProjectField }
+  | { kind: 'iteration'; field: GitHubProjectField }
+
+export type RoadmapSpan = {
+  startMs: number
+  /** Exclusive — a single-day item ends one day after it starts. */
+  endMs: number
+  /** True when only one date was known, so the bar renders as a marker. */
+  point: boolean
+}
+
+export type RoadmapTick = {
+  key: string
+  startMs: number
+  /** Exclusive. */
+  endMs: number
+}
+
+const START_FIELD_PATTERN = /start|kick.?off|begin/i
+const TARGET_FIELD_PATTERN = /target|end|due|finish|complet|deadline|ship/i
+
+const MONTHS_PER_UNIT: Record<RoadmapZoom, number> = { month: 1, quarter: 3, year: 12 }
+const MIN_UNITS: Record<RoadmapZoom, number> = { month: 6, quarter: 4, year: 3 }
+// Why: one bogus far-future date must not expand the grid to tens of thousands
+// of columns. Beyond this the range stops growing and out-of-range bars clamp
+// to the edge, which is visibly wrong in the right way rather than a hang.
+const MAX_TICKS = 480
+
+function isDateField(field: GitHubProjectField): boolean {
+  return field.kind === 'field' && field.dataType === 'DATE'
+}
+
+function pickDateSource(
+  dateFields: GitHubProjectField[],
+  iterationField: GitHubProjectField | null
+): RoadmapDateSource | null {
+  const startField = dateFields.find((field) => START_FIELD_PATTERN.test(field.name))
+  const targetField = dateFields.find(
+    (field) => field.id !== startField?.id && TARGET_FIELD_PATTERN.test(field.name)
+  )
+  if (startField && targetField) {
+    return { kind: 'date-range', startField, targetField }
+  }
+  // Why: when only one name matched, keep it in its matched role and pair it
+  // with the remaining date field — a plain order fallback inverts the pair.
+  if (startField) {
+    const other = dateFields.find((field) => field.id !== startField.id)
+    if (other) {
+      return { kind: 'date-range', startField, targetField: other }
+    }
+  }
+  if (targetField) {
+    const other = dateFields.find((field) => field.id !== targetField.id)
+    if (other) {
+      return { kind: 'date-range', startField: other, targetField }
+    }
+  }
+  const [first, second] = dateFields
+  // Why: localized or oddly named date fields still describe a range — fall
+  // back to the view's own field order rather than degrading to a marker.
+  if (first && second) {
+    return { kind: 'date-range', startField: first, targetField: second }
+  }
+  if (iterationField) {
+    return { kind: 'iteration', field: iterationField }
+  }
+  if (first) {
+    return { kind: 'date-point', field: first }
+  }
+  return null
+}
+
+export function resolveRoadmapDateSource(
+  view: GitHubProjectView,
+  rows: readonly GitHubProjectRow[] = []
+): RoadmapDateSource | null {
+  // Why: roadmaps are commonly placed by fields hidden from the view's
+  // visible-field list — sort/group fields are the next best config signal.
+  const seen = new Set<string>()
+  const candidates: GitHubProjectField[] = []
+  for (const field of [
+    ...view.fields,
+    ...view.sortByFields.map((sort) => sort.field),
+    ...view.groupByFields
+  ]) {
+    if (!seen.has(field.id)) {
+      seen.add(field.id)
+      candidates.push(field)
+    }
+  }
+  const fromConfig = pickDateSource(
+    candidates.filter(isDateField),
+    candidates.find((field) => field.kind === 'iteration') ?? null
+  )
+  // Why: item field values are fetched independently of the view config, so
+  // rows can carry usable dates even when no configured field exposes them.
+  return fromConfig ?? pickDateSource(...collectRowPlacementFields(rows))
+}
+
+function collectRowPlacementFields(
+  rows: readonly GitHubProjectRow[]
+): [GitHubProjectField[], GitHubProjectField | null] {
+  const dateFieldsById = new Map<string, GitHubProjectField>()
+  let iterationField: GitHubProjectField | null = null
+  for (const row of rows) {
+    for (const value of Object.values(row.fieldValuesByFieldId)) {
+      if (value.kind === 'date' && !dateFieldsById.has(value.fieldId)) {
+        dateFieldsById.set(value.fieldId, {
+          kind: 'field',
+          id: value.fieldId,
+          name: value.fieldName ?? 'Date',
+          dataType: 'DATE'
+        })
+      } else if (value.kind === 'iteration' && !iterationField) {
+        iterationField = {
+          kind: 'iteration',
+          id: value.fieldId,
+          name: value.fieldName ?? 'Iteration',
+          dataType: 'ITERATION',
+          iterations: []
+        }
+      }
+    }
+  }
+  return [Array.from(dateFieldsById.values()), iterationField]
+}
+
+/** Accepts the `YYYY-MM-DD` calendar dates GitHub returns, and tolerates a
+ *  full ISO timestamp by reading its date part. */
+export function parseRoadmapDate(value: string): number | null {
+  const match = /^(\d{4})-(\d{2})-(\d{2})/.exec(value)
+  if (!match) {
+    return null
+  }
+  const [, year, month, day] = match
+  const ms = Date.UTC(Number(year), Number(month) - 1, Number(day))
+  if (Number.isNaN(ms)) {
+    return null
+  }
+  // Why: Date.UTC normalizes overflow (2026-02-30 → Mar 2) instead of failing;
+  // round-trip the components so an invalid calendar date is rejected, not
+  // silently moved to a different day.
+  const roundTrip = new Date(ms)
+  if (
+    roundTrip.getUTCFullYear() !== Number(year) ||
+    roundTrip.getUTCMonth() !== Number(month) - 1 ||
+    roundTrip.getUTCDate() !== Number(day)
+  ) {
+    return null
+  }
+  return ms
+}
+
+function readDateValue(row: GitHubProjectRow, field: GitHubProjectField): number | null {
+  const value = row.fieldValuesByFieldId[field.id]
+  return value?.kind === 'date' ? parseRoadmapDate(value.date) : null
+}
+
+export function getRoadmapSpan(
+  row: GitHubProjectRow,
+  source: RoadmapDateSource
+): RoadmapSpan | null {
+  if (source.kind === 'iteration') {
+    const value = row.fieldValuesByFieldId[source.field.id]
+    if (value?.kind !== 'iteration') {
+      return null
+    }
+    const startMs = parseRoadmapDate(value.startDate)
+    if (startMs === null) {
+      return null
+    }
+    const days = value.duration > 0 ? value.duration : 1
+    return { startMs, endMs: startMs + days * ROADMAP_DAY_MS, point: false }
+  }
+  if (source.kind === 'date-point') {
+    const ms = readDateValue(row, source.field)
+    return ms === null ? null : { startMs: ms, endMs: ms + ROADMAP_DAY_MS, point: true }
+  }
+  const startValue = readDateValue(row, source.startField)
+  const targetValue = readDateValue(row, source.targetField)
+  if (startValue === null || targetValue === null) {
+    const known = startValue ?? targetValue
+    return known === null ? null : { startMs: known, endMs: known + ROADMAP_DAY_MS, point: true }
+  }
+  // Why: a target before the start is user data, not corruption — order the
+  // pair so the item still gets a visible bar.
+  return {
+    startMs: Math.min(startValue, targetValue),
+    endMs: Math.max(startValue, targetValue) + ROADMAP_DAY_MS,
+    point: false
+  }
+}
+
+function unitIndexOf(ms: number, zoom: RoadmapZoom): number {
+  const date = new Date(ms)
+  return Math.floor((date.getUTCFullYear() * 12 + date.getUTCMonth()) / MONTHS_PER_UNIT[zoom])
+}
+
+function unitStart(index: number, zoom: RoadmapZoom): number {
+  const months = index * MONTHS_PER_UNIT[zoom]
+  return Date.UTC(Math.floor(months / 12), months % 12, 1)
+}
+
+/** Builds the column grid covering every span plus today, padded by one unit
+ *  on each side and widened to a readable minimum. */
+export function buildRoadmapTicks(
+  spans: readonly RoadmapSpan[],
+  zoom: RoadmapZoom,
+  todayMs: number
+): RoadmapTick[] {
+  let earliest = todayMs
+  let latest = todayMs
+  for (const span of spans) {
+    earliest = Math.min(earliest, span.startMs)
+    latest = Math.max(latest, span.endMs)
+  }
+  let firstIdx = unitIndexOf(earliest, zoom) - 1
+  // Why: span ends are exclusive, so step back a tick before resolving the
+  // containing unit — otherwise a span landing exactly on a boundary claims
+  // the next unit and the trailing padding drifts by one column.
+  let lastIdxExclusive = unitIndexOf(latest - 1, zoom) + 2
+  if (lastIdxExclusive - firstIdx < MIN_UNITS[zoom]) {
+    lastIdxExclusive = firstIdx + MIN_UNITS[zoom]
+  }
+  // Why: the cap must keep today inside the grid — a single typo'd date in
+  // either direction otherwise consumes every column and the whole roadmap
+  // clamps to one edge. Trim the side farther from today first.
+  if (lastIdxExclusive - firstIdx > MAX_TICKS) {
+    const todayIdx = unitIndexOf(todayMs, zoom)
+    firstIdx = Math.max(firstIdx, todayIdx + 2 - MAX_TICKS)
+    lastIdxExclusive = Math.min(lastIdxExclusive, firstIdx + MAX_TICKS)
+  }
+  const ticks: RoadmapTick[] = []
+  for (let index = firstIdx; index < lastIdxExclusive; index++) {
+    const startMs = unitStart(index, zoom)
+    ticks.push({
+      key: new Date(startMs).toISOString().slice(0, 10),
+      startMs,
+      endMs: unitStart(index + 1, zoom)
+    })
+  }
+  return ticks
+}
+
+/** Maps a timestamp to a pixel offset inside the grid. Interpolating within
+ *  the containing tick (rather than across the whole range) is what keeps bar
+ *  edges aligned to the column rules, since months differ in length. */
+export function roadmapOffsetPx(
+  ms: number,
+  ticks: readonly RoadmapTick[],
+  tickWidthPx: number
+): number {
+  const first = ticks[0]
+  const last = ticks.at(-1)
+  if (!first || !last) {
+    return 0
+  }
+  if (ms <= first.startMs) {
+    return 0
+  }
+  if (ms >= last.endMs) {
+    return ticks.length * tickWidthPx
+  }
+  let low = 0
+  let high = ticks.length - 1
+  while (low < high) {
+    const mid = (low + high) >> 1
+    const tick = ticks[mid]
+    if (tick && ms >= tick.endMs) {
+      low = mid + 1
+    } else {
+      high = mid
+    }
+  }
+  const tick = ticks[low]
+  if (!tick) {
+    return 0
+  }
+  const ratio = (ms - tick.startMs) / (tick.endMs - tick.startMs)
+  return (low + ratio) * tickWidthPx
+}
+
+export function roadmapSourceFieldNames(source: RoadmapDateSource): string[] {
+  if (source.kind === 'date-range') {
+    return [source.startField.name, source.targetField.name]
+  }
+  return [source.field.name]
+}
diff --git a/src/shared/github/project-types.ts b/src/shared/github/project-types.ts
index 864bf90d18a..0d33dc5d976 100644
--- a/src/shared/github/project-types.ts
+++ b/src/shared/github/project-types.ts
@@ -133,10 +133,13 @@ export type GitHubProjectFieldValue =
       title: string
       startDate: string
       duration: number
+      /** Owning field's display name. Optional for wire compat — older hosts
+       *  don't send it; used when the field is hidden from the view config. */
+      fieldName?: string
     }
   | { kind: 'text'; fieldId: string; text: string }
   | { kind: 'number'; fieldId: string; number: number }
-  | { kind: 'date'; fieldId: string; date: string }
+  | { kind: 'date'; fieldId: string; date: string; fieldName?: string }
   | { kind: 'labels'; fieldId: string; labels: GitHubProjectLabel[] }
   | { kind: 'users'; fieldId: string; users: GitHubProjectUser[] }
 
diff --git a/src/shared/native-chat-begin-patch.ts b/src/shared/native-chat-begin-patch.ts
new file mode 100644
index 00000000000..becd0ece46a
--- /dev/null
+++ b/src/shared/native-chat-begin-patch.ts
@@ -0,0 +1,173 @@
+import { finalizeEditFile, type NativeChatEditFile } from './native-chat-edit-model'
+import { editLinesFromUnifiedPatch, editLinesFromWholeFile } from './native-chat-unified-patch'
+
+const BEGIN = '*** Begin Patch'
+const END = '*** End Patch'
+const FILE_HEADER = /^\*\*\* (Add|Update|Delete) File: (.+)$/
+const MOVE_HEADER = /^\*\*\* Move to: (.+)$/
+/** Envelope structure that carries no file content of its own. */
+const CONTROL_LINE = /^\*\*\* (?:End of File|Environment ID:)/
+
+/** The envelope reaches a command tool as one of its patch or command
+ *  arguments, either whole or as one word of the argument vector it runs.
+ *  Recover its text. Callers must gate this on the tool being one that runs a
+ *  patch: a file's own contents may quote an envelope.
+ *
+ *  `requireApplyCommand` is for a general command tool, where the envelope
+ *  proves nothing on its own — a command writing documentation quotes one
+ *  without applying it, and the command must say it is applying it. */
+export function unwrapBeginPatch(
+  input: unknown,
+  options?: { requireApplyCommand?: boolean }
+): string | null {
+  const source = envelopeSource(input, options?.requireApplyCommand === true)
+  if (!source) {
+    return null
+  }
+  const start = source.indexOf(BEGIN)
+  if (start === -1) {
+    return null
+  }
+  const end = source.indexOf(END, start)
+  if (end === -1) {
+    // Without the closing marker there is nothing separating the patch body from
+    // whatever the command line continues with, and trailing shell syntax would
+    // render as file content the agent never wrote.
+    return null
+  }
+  return source.slice(start, end + END.length)
+}
+
+/** The arguments that carry a patch or the command line that applies one. Only
+ *  these are searched: any other value is data the tool operates on, and a file
+ *  whose own contents quote an envelope would otherwise be read as a patch
+ *  against some other file entirely. */
+const ENVELOPE_ARGUMENTS = ['input', 'command', 'patch', 'arguments', 'script'] as const
+/** What a command tool runs to apply an envelope, as opposed to quoting one.
+ *  Both spellings the runner accepts, since either one really applies it. */
+const APPLY_COMMAND = /apply_?patch/
+
+/** The call payload may itself be a string holding JSON. Decoding it here, in
+ *  the one consumer that needs its structure, keeps every other reader of the
+ *  call input seeing exactly what the provider sent. */
+function envelopeSource(input: unknown, requireApplyCommand: boolean): string | null {
+  if (typeof input === 'string') {
+    const record = jsonRecord(input)
+    return record
+      ? envelopeArgument(record, requireApplyCommand)
+      : applied(input, requireApplyCommand)
+  }
+  return typeof input === 'object' && input !== null
+    ? envelopeArgument(input as Record<string, unknown>, requireApplyCommand)
+    : null
+}
+
+function applied(value: string, requireApplyCommand: boolean): string | null {
+  return !requireApplyCommand || APPLY_COMMAND.test(value) ? value : null
+}
+
+function jsonRecord(value: string): Record<string, unknown> | null {
+  if (!value.trimStart().startsWith('{')) {
+    return null
+  }
+  try {
+    const parsed: unknown = JSON.parse(value)
+    return typeof parsed === 'object' && parsed !== null && !Array.isArray(parsed)
+      ? (parsed as Record<string, unknown>)
+      : null
+  } catch {
+    return null
+  }
+}
+
+/** A command tool's argument is a vector, so the envelope sits one level in and
+ *  the words that apply it may be a different element than the envelope. */
+function envelopeArgument(
+  record: Record<string, unknown>,
+  requireApplyCommand: boolean
+): string | null {
+  for (const key of ENVELOPE_ARGUMENTS) {
+    const value = record[key]
+    const words =
+      typeof value === 'string'
+        ? [value]
+        : Array.isArray(value)
+          ? value.filter((entry): entry is string => typeof entry === 'string')
+          : []
+    if (requireApplyCommand && !words.some((word) => APPLY_COMMAND.test(word))) {
+      continue
+    }
+    const word = words.find((entry) => entry.includes(BEGIN))
+    if (word) {
+      return word
+    }
+  }
+  return null
+}
+
+/** Splits a `*** Begin Patch` envelope into one entry per file it touches. */
+export function editFilesFromBeginPatch(envelope: string): NativeChatEditFile[] {
+  const sections: { kind: 'Add' | 'Update' | 'Delete'; path: string; body: string[] }[] = []
+  const moves = new Map<number, string>()
+
+  // Split on both newline forms once, so every marker below can be matched
+  // exactly rather than each pattern having to tolerate a trailing `\r`.
+  for (const raw of envelope.split(/\r?\n/)) {
+    const header = FILE_HEADER.exec(raw)
+    if (header) {
+      sections.push({
+        kind: header[1] as 'Add' | 'Update' | 'Delete',
+        path: header[2]!.trim(),
+        body: []
+      })
+      continue
+    }
+    const move = MOVE_HEADER.exec(raw)
+    if (move && sections.length > 0) {
+      moves.set(sections.length - 1, move[1]!.trim())
+      continue
+    }
+    if (raw === BEGIN || raw === END || CONTROL_LINE.test(raw) || sections.length === 0) {
+      continue
+    }
+    sections.at(-1)!.body.push(raw)
+  }
+
+  return sections.flatMap((section, index) => {
+    const body = section.body.join('\n')
+    const moved = moves.get(index) ?? null
+    if (section.kind === 'Add' || section.kind === 'Delete') {
+      const sign = section.kind === 'Add' ? '+' : '-'
+      // Add/Delete bodies carry a sign per line but no hunk header.
+      const stripped = section.body
+        .map((line) => (line.startsWith(sign) ? line.slice(1) : line))
+        .join('\n')
+      const whole = editLinesFromWholeFile(stripped, section.kind === 'Add' ? 'add' : 'del')
+      return [
+        finalizeEditFile({
+          path: section.path,
+          oldPath: null,
+          changeKind: section.kind === 'Add' ? 'added' : 'deleted',
+          lines: whole.lines,
+          lineNumbersKnown: true,
+          truncated: whole.truncated
+        })
+      ]
+    }
+    // The first chunk of an update may carry no hunk header at all, and a
+    // section may carry no body either. The envelope named the file, so it is
+    // reported with whatever rows it has rather than dropped from a multi-file
+    // envelope with nothing to say it went missing.
+    const parsed = editLinesFromUnifiedPatch(body, { implicitFirstHunk: true })
+    return [
+      finalizeEditFile({
+        path: moved ?? section.path,
+        oldPath: moved ? section.path : null,
+        changeKind: moved ? 'renamed' : 'edited',
+        lines: parsed?.lines ?? [],
+        lineNumbersKnown: parsed?.lineNumbersKnown ?? false,
+        truncated: parsed?.truncated ?? false
+      })
+    ]
+  })
+}
diff --git a/src/shared/native-chat-diff.ts b/src/shared/native-chat-diff.ts
index 1df82db4800..783cf3d38fa 100644
--- a/src/shared/native-chat-diff.ts
+++ b/src/shared/native-chat-diff.ts
@@ -5,7 +5,8 @@ export type NativeChatDiffLine = {
   text: string
 }
 
-const EDIT_TOOL_NAMES = new Set(['Edit', 'MultiEdit', 'Write', 'str_replace', 'apply_patch'])
+/** Tools whose call carries the edit itself, so its row is a file change. */
+export const EDIT_TOOL_NAMES = new Set(['Edit', 'MultiEdit', 'Write', 'str_replace', 'apply_patch'])
 const MAX_DIFF_CHARS = 32_000
 const DEFAULT_MAX_DIFF_LINES = 120
 const DIFF_TRUNCATED_LINE: NativeChatDiffLine = {
@@ -14,8 +15,11 @@ const DIFF_TRUNCATED_LINE: NativeChatDiffLine = {
 }
 
 const HUNK_HEADER = /^@@ -\d+(?:,\d+)? \+\d+(?:,\d+)? @@/
-// Lines that open a new file section, so any hunk before them has ended.
-const FILE_SECTION_START =
+/** Lines that open a new file section, so any hunk before them has ended.
+ *  `--- `/`+++ ` are deliberately absent: inside a hunk they are content — a
+ *  removed `-- comment` is emitted as `--- comment` — so they go through
+ *  `isFileHeaderPair` instead. */
+export const FILE_SECTION_START =
   /^(?:diff |index |old mode |new mode |new file mode |deleted file mode |similarity index |dissimilarity index |rename |copy |Binary files )/
 // Markdown thematic break or YAML document separator, not a marker.
 const BARE_RULE = /^(?:-{3,}|\+{3,})$/
@@ -28,11 +32,17 @@ type DiffStructure = {
 }
 
 /**
- * Locates the `--- <old>` / `+++ <new>` file headers. A bare `---`/`+++` prefix
- * is not enough to spot one: a removed line whose content began with `--`
- * (SQL/Lua `-- comment`, C `--i`) is emitted as `---<content>`. Real headers
- * always come as an adjacent pair and never appear inside a hunk.
+ * True when the row at `index` opens a `--- <old>` / `+++ <new>` file header. A
+ * bare `---`/`+++` prefix is not enough to spot one: a removed line whose
+ * content began with `--` (SQL/Lua `-- comment`, C `--i`) is emitted as
+ * `---<content>`. Real headers always come as an adjacent pair and never appear
+ * inside a hunk, so callers must check this only outside one.
  */
+export function isFileHeaderPair(lines: readonly string[], index: number): boolean {
+  return (lines[index] ?? '').startsWith('--- ') && (lines[index + 1] ?? '').startsWith('+++ ')
+}
+
+/** Locates the file headers and rules that are structure rather than content. */
 function scanDiffStructure(lines: string[]): DiffStructure {
   const metaIndices = new Set<number>()
   let isStructuredDiff = false
@@ -57,7 +67,7 @@ function scanDiffStructure(lines: string[]): DiffStructure {
       metaIndices.add(index)
       continue
     }
-    if (line.startsWith('--- ') && (lines[index + 1] ?? '').startsWith('+++ ')) {
+    if (isFileHeaderPair(lines, index)) {
       metaIndices.add(index)
       metaIndices.add(index + 1)
       index += 1
diff --git a/src/shared/native-chat-edit-lcs.ts b/src/shared/native-chat-edit-lcs.ts
new file mode 100644
index 00000000000..733d5f5c700
--- /dev/null
+++ b/src/shared/native-chat-edit-lcs.ts
@@ -0,0 +1,105 @@
+import {
+  MAX_EDIT_DIFF_CELLS,
+  splitEditContent,
+  type NativeChatEditLine
+} from './native-chat-edit-model'
+
+/** Line diff between two contents, interleaved with context. Numbers are
+ *  positions within the given contents, so they locate rows in the file only
+ *  when the caller passed whole files. */
+export function editLinesFromContents(
+  originalContent: string,
+  modifiedContent: string
+): { lines: NativeChatEditLine[]; truncated: boolean } {
+  const original = splitEditContent(originalContent)
+  const modified = splitEditContent(modifiedContent)
+  const lines =
+    original.lines.length * modified.lines.length <= MAX_EDIT_DIFF_CELLS
+      ? lcsLines(original.lines, modified.lines)
+      : prefixSuffixLines(original.lines, modified.lines)
+  return { lines, truncated: original.truncated || modified.truncated }
+}
+
+function context(text: string, oldNo: number, newNo: number): NativeChatEditLine {
+  return { kind: 'context', text, oldLineNumber: oldNo, newLineNumber: newNo }
+}
+
+function removal(text: string, oldNo: number): NativeChatEditLine {
+  return { kind: 'del', text, oldLineNumber: oldNo, newLineNumber: null }
+}
+
+function addition(text: string, newNo: number): NativeChatEditLine {
+  return { kind: 'add', text, oldLineNumber: null, newLineNumber: newNo }
+}
+
+function lcsLines(original: string[], modified: string[]): NativeChatEditLine[] {
+  const width = modified.length + 1
+  const dp = new Uint32Array((original.length + 1) * width)
+  for (let i = original.length - 1; i >= 0; i -= 1) {
+    for (let j = modified.length - 1; j >= 0; j -= 1) {
+      dp[i * width + j] =
+        original[i] === modified[j]
+          ? dp[(i + 1) * width + j + 1]! + 1
+          : Math.max(dp[(i + 1) * width + j]!, dp[i * width + j + 1]!)
+    }
+  }
+
+  const lines: NativeChatEditLine[] = []
+  let oldIndex = 0
+  let newIndex = 0
+  while (oldIndex < original.length && newIndex < modified.length) {
+    if (original[oldIndex] === modified[newIndex]) {
+      lines.push(context(original[oldIndex] ?? '', oldIndex + 1, newIndex + 1))
+      oldIndex += 1
+      newIndex += 1
+    } else if (dp[(oldIndex + 1) * width + newIndex]! >= dp[oldIndex * width + newIndex + 1]!) {
+      lines.push(removal(original[oldIndex] ?? '', oldIndex + 1))
+      oldIndex += 1
+    } else {
+      lines.push(addition(modified[newIndex] ?? '', newIndex + 1))
+      newIndex += 1
+    }
+  }
+  for (; oldIndex < original.length; oldIndex += 1) {
+    lines.push(removal(original[oldIndex] ?? '', oldIndex + 1))
+  }
+  for (; newIndex < modified.length; newIndex += 1) {
+    lines.push(addition(modified[newIndex] ?? '', newIndex + 1))
+  }
+  return lines
+}
+
+function prefixSuffixLines(original: string[], modified: string[]): NativeChatEditLine[] {
+  let prefix = 0
+  while (
+    prefix < original.length &&
+    prefix < modified.length &&
+    original[prefix] === modified[prefix]
+  ) {
+    prefix += 1
+  }
+  let suffix = 0
+  while (
+    suffix + prefix < original.length &&
+    suffix + prefix < modified.length &&
+    original[original.length - suffix - 1] === modified[modified.length - suffix - 1]
+  ) {
+    suffix += 1
+  }
+
+  const lines: NativeChatEditLine[] = []
+  for (let i = 0; i < prefix; i += 1) {
+    lines.push(context(original[i] ?? '', i + 1, i + 1))
+  }
+  for (let i = prefix; i < original.length - suffix; i += 1) {
+    lines.push(removal(original[i] ?? '', i + 1))
+  }
+  for (let i = prefix; i < modified.length - suffix; i += 1) {
+    lines.push(addition(modified[i] ?? '', i + 1))
+  }
+  for (let i = original.length - suffix; i < original.length; i += 1) {
+    const newIndex = modified.length - suffix + (i - (original.length - suffix))
+    lines.push(context(original[i] ?? '', i + 1, newIndex + 1))
+  }
+  return lines
+}
diff --git a/src/shared/native-chat-edit-model.ts b/src/shared/native-chat-edit-model.ts
new file mode 100644
index 00000000000..6a26f87c599
--- /dev/null
+++ b/src/shared/native-chat-edit-model.ts
@@ -0,0 +1,107 @@
+/** One rendered diff row. Numbers are per side: a removed row has no new-side
+ *  number and an added row has no old-side number. `gap` marks the break
+ *  between two regions of the file, which are otherwise concatenated and read
+ *  as one continuous block even as the gutter jumps hundreds of lines. */
+export type NativeChatEditLineKind = 'context' | 'add' | 'del' | 'gap'
+
+export type NativeChatEditLine = {
+  kind: NativeChatEditLineKind
+  text: string
+  oldLineNumber: number | null
+  newLineNumber: number | null
+}
+
+export type NativeChatEditChangeKind = 'added' | 'deleted' | 'edited' | 'renamed'
+
+export type NativeChatEditFile = {
+  path: string
+  /** Set only when the change moved the file. */
+  oldPath: string | null
+  changeKind: NativeChatEditChangeKind
+  lines: NativeChatEditLine[]
+  added: number
+  removed: number
+  /** False when the numbers locate a row inside a snippet rather than the file,
+   *  which is the case whenever the provider gave us no resolved hunk ranges. */
+  lineNumbersKnown: boolean
+  truncated: boolean
+}
+
+export const MAX_EDIT_LINES = 2_000
+export const MAX_EDIT_CHARS = 96_000
+/** The LCS table is quadratic; above this a linear prefix/suffix diff is used. */
+export const MAX_EDIT_DIFF_CELLS = 200_000
+
+/** Rows of a source string, plus whether it was clipped before splitting. */
+export type EditContentLines = { lines: string[]; truncated: boolean }
+
+/** The one row splitter for every edit shape. Splits on both newline forms so a
+ *  CRLF file never carries a trailing `\r` into a row, where it would render as
+ *  a stray character, defeat the phantom-row guard, and reach the clipboard. */
+export function splitEditContent(content: string): EditContentLines {
+  if (content.length === 0) {
+    return { lines: [], truncated: false }
+  }
+  const truncated = content.length > MAX_EDIT_CHARS
+  const body = truncated ? content.slice(0, MAX_EDIT_CHARS) : content
+  const lines = body.split(/\r?\n/)
+  // Tested against the clipped body: on the un-clipped string this popped a
+  // real line whenever the slice fired.
+  if (body.endsWith('\n')) {
+    lines.pop()
+  }
+  return { lines, truncated }
+}
+
+/** The break between two regions of a file. Carries no text and no position. */
+function editGapLine(): NativeChatEditLine {
+  return { kind: 'gap', text: '', oldLineNumber: null, newLineNumber: null }
+}
+
+/** Appends a gap when rows already exist, so the break never opens a diff or
+ *  doubles up behind an empty region. */
+export function pushEditGap(lines: NativeChatEditLine[]): void {
+  if (lines.length > 0 && lines.at(-1)?.kind !== 'gap') {
+    lines.push(editGapLine())
+  }
+}
+
+/** Unified line numbering: a removed row is located on the old side, everything
+ *  else on the new side. One column, so a replaced line repeats its number. */
+export function unifiedLineNumber(line: NativeChatEditLine): number | null {
+  return line.kind === 'del' ? line.oldLineNumber : (line.newLineNumber ?? line.oldLineNumber)
+}
+
+export function finalizeEditFile(
+  input: Omit<NativeChatEditFile, 'added' | 'removed' | 'truncated'> & {
+    /** Set when the source text was clipped before it became rows. */
+    truncated?: boolean
+  }
+): NativeChatEditFile {
+  const overLineCap = input.lines.length > MAX_EDIT_LINES
+  const truncated = overLineCap || input.truncated === true
+  const capped = overLineCap ? input.lines.slice(0, MAX_EDIT_LINES) : input.lines
+  // A gap marks a break between regions, so one at the end marks nothing. The
+  // row cap can leave one behind even when the source did not.
+  let end = capped.length
+  while (end > 0 && capped[end - 1]?.kind === 'gap') {
+    end -= 1
+  }
+  const trimmed = end === capped.length ? capped : capped.slice(0, end)
+  // Without resolved ranges the numbers locate a row inside a snippet; dropping
+  // them keeps a plausible-looking wrong position out of the gutter, the copy
+  // text, and the row keys.
+  const lines = input.lineNumbersKnown
+    ? trimmed
+    : trimmed.map((line) => ({ ...line, oldLineNumber: null, newLineNumber: null }))
+  let added = 0
+  let removed = 0
+  for (const line of lines) {
+    if (line.kind === 'add') {
+      added += 1
+    } else if (line.kind === 'del') {
+      removed += 1
+    }
+  }
+  return { ...input, lines, added, removed, truncated }
+}
diff --git a/src/shared/native-chat-edit-normalize.test.ts b/src/shared/native-chat-edit-normalize.test.ts
new file mode 100644
index 00000000000..f49e23be296
--- /dev/null
+++ b/src/shared/native-chat-edit-normalize.test.ts
@@ -0,0 +1,609 @@
+import { describe, expect, it } from 'vitest'
+import { editFilesFromToolPair, isEditToolName } from './native-chat-edit-normalize'
+import { MAX_EDIT_CHARS, unifiedLineNumber } from './native-chat-edit-model'
+import { editLinesFromUnifiedPatch } from './native-chat-unified-patch'
+import { unwrapBeginPatch } from './native-chat-begin-patch'
+
+const gutter = (files: ReturnType<typeof editFilesFromToolPair>): (number | null)[] =>
+  (files ?? []).flatMap((file) => file.lines.map((line) => unifiedLineNumber(line)))
+
+/** A card takes evidence the edit landed, so these cases report the call as
+ *  complete. Cases about the lifecycle itself pass their own state. */
+const settledFiles = (
+  pair: Parameters<typeof editFilesFromToolPair>[0]
+): ReturnType<typeof editFilesFromToolPair> =>
+  editFilesFromToolPair({ state: 'completed', ...pair })
+
+describe('editLinesFromUnifiedPatch', () => {
+  it('numbers deletes from the old side and adds from the new side', () => {
+    const parsed = editLinesFromUnifiedPatch('@@ -12,3 +12,3 @@\n ctx\n-was\n+now\n tail')
+    expect(parsed?.lineNumbersKnown).toBe(true)
+    expect(parsed?.lines.map((line) => [line.kind, unifiedLineNumber(line)])).toEqual([
+      ['context', 12],
+      ['del', 13],
+      ['add', 13],
+      ['context', 14]
+    ])
+  })
+
+  it('leaves rows unnumbered when the hunk header carries no ranges', () => {
+    const parsed = editLinesFromUnifiedPatch('@@\n ctx\n-was\n+now')
+    expect(parsed?.lineNumbersKnown).toBe(false)
+    expect(parsed?.lines.every((line) => unifiedLineNumber(line) === null)).toBe(true)
+  })
+
+  it('returns null for text with no hunk header', () => {
+    expect(editLinesFromUnifiedPatch('just prose\n- a bullet')).toBeNull()
+  })
+
+  it('keeps the hunk open across a mid-hunk no-newline marker', () => {
+    const parsed = editLinesFromUnifiedPatch(
+      '@@ -1,2 +1,2 @@\n keep\n-old\n\\ No newline at end of file\n+new\n\\ No newline at end of file'
+    )
+    expect(parsed?.lines.map((line) => [line.kind, line.text])).toEqual([
+      ['context', 'keep'],
+      ['del', 'old'],
+      ['add', 'new']
+    ])
+  })
+
+  it('reads a removed line that starts with `--` as content, not a file header', () => {
+    const parsed = editLinesFromUnifiedPatch('@@ -1,4 +1,3 @@\n keep\n--- comment\n-gone\n tail')
+    expect(parsed?.lines.map((line) => [line.kind, line.text])).toEqual([
+      ['context', 'keep'],
+      ['del', '-- comment'],
+      ['del', 'gone'],
+      ['context', 'tail']
+    ])
+  })
+
+  it('skips a real file header pair, which only appears outside a hunk', () => {
+    const parsed = editLinesFromUnifiedPatch(
+      'diff --git a/a.ts b/a.ts\n--- a/a.ts\n+++ b/a.ts\n@@ -1,1 +1,1 @@\n-was\n+now'
+    )
+    expect(parsed?.lines.map((line) => [line.kind, line.text])).toEqual([
+      ['del', 'was'],
+      ['add', 'now']
+    ])
+  })
+
+  it('splits CRLF rows without leaving a carriage return or a phantom row', () => {
+    const parsed = editLinesFromUnifiedPatch('@@ -1,2 +1,2 @@\r\n ctx\r\n-was\r\n+now\r\n')
+    expect(parsed?.lines.map((line) => line.text)).toEqual(['ctx', 'was', 'now'])
+  })
+
+  it('reports truncation when the patch text runs past the character cap', () => {
+    const body = `@@ -1,1 +1,1 @@\n${'+x\n'.repeat(MAX_EDIT_CHARS)}`
+    expect(editLinesFromUnifiedPatch(body)?.truncated).toBe(true)
+  })
+
+  it('marks the break between hunks, and only between them', () => {
+    const parsed = editLinesFromUnifiedPatch(
+      '@@ -40,2 +40,2 @@\n keep\n-was\n@@ -310,2 +310,2 @@\n+now\n tail'
+    )
+    expect(parsed?.lines.map((line) => [line.kind, unifiedLineNumber(line)])).toEqual([
+      ['context', 40],
+      ['del', 41],
+      ['gap', null],
+      ['add', 310],
+      ['context', 311]
+    ])
+  })
+
+  it('reads a body that opens with no hunk header as an unlocatable hunk', () => {
+    const parsed = editLinesFromUnifiedPatch('-was\n+now', { implicitFirstHunk: true })
+    expect(parsed?.lines.map((line) => line.kind)).toEqual(['del', 'add'])
+    expect(parsed?.lineNumbersKnown).toBe(false)
+    // Without the option the same body is not a patch at all.
+    expect(editLinesFromUnifiedPatch('-was\n+now')).toBeNull()
+  })
+})
+
+describe('unwrapBeginPatch', () => {
+  it('recovers an envelope carried in one word of an argument vector', () => {
+    const envelope = '*** Begin Patch\n*** Update File: a.ts\n@@\n-x\n+y\n*** End Patch'
+    expect(
+      unwrapBeginPatch({
+        command: ['bash', '-lc', `apply_patch <<'EOF'\n${envelope}\nEOF`],
+        workdir: '/repo'
+      })
+    ).toBe(envelope)
+  })
+
+  it('leaves an already-decoded envelope alone', () => {
+    const plain = '*** Begin Patch\n*** Update File: a.ts\n@@\n-x\n+y\n*** End Patch'
+    expect(unwrapBeginPatch(plain)).toBe(plain)
+  })
+
+  it('ignores input with no envelope', () => {
+    expect(unwrapBeginPatch('ls -la')).toBeNull()
+  })
+
+  it('declines an envelope with no closing marker rather than swallowing the command line', () => {
+    const command = 'bash -c "*** Begin Patch\n*** Update File: a.ts\n@@\n-x\n+y" && echo ok'
+    expect(unwrapBeginPatch(command)).toBeNull()
+    expect(settledFiles({ name: 'shell', input: command })).toBeNull()
+  })
+})
+
+describe('editFilesFromToolPair', () => {
+  it('renders an apply_patch run through a command tool, which produced no diff', () => {
+    const files = settledFiles({
+      name: 'exec',
+      input: {
+        command: [
+          'bash',
+          '-lc',
+          "apply_patch <<'EOF'\n*** Begin Patch\n*** Update File: src/a.ts\n@@\n ctx\n-was\n+now\n*** End Patch\nEOF"
+        ]
+      }
+    })
+    expect(files).toHaveLength(1)
+    expect(files?.[0]?.path).toBe('src/a.ts')
+    expect(files?.[0]?.changeKind).toBe('edited')
+    expect(files?.[0]?.added).toBe(1)
+    expect(files?.[0]?.removed).toBe(1)
+    // Codex hunk headers are context anchors, so no row may claim a file position.
+    expect(files?.[0]?.lineNumbersKnown).toBe(false)
+  })
+
+  it('numbers an added file from 1', () => {
+    const files = settledFiles({
+      name: 'exec',
+      input:
+        "apply_patch <<'EOF'\n*** Begin Patch\n*** Add File: new.ts\n+one\n+two\n*** End Patch\nEOF"
+    })
+    expect(files?.[0]?.changeKind).toBe('added')
+    expect(files?.[0]?.lineNumbersKnown).toBe(true)
+    expect(gutter(files)).toEqual([1, 2])
+  })
+
+  it('keeps a file whose update body carries no hunk header', () => {
+    const files = settledFiles({
+      name: 'apply_patch',
+      input: {
+        input:
+          '*** Begin Patch\n*** Update File: first.ts\n ctx\n-was\n+now\n*** Update File: second.ts\n@@ -1,1 +1,1 @@\n-a\n+b\n*** End Patch'
+      }
+    })
+    expect(files?.map((file) => file.path)).toEqual(['first.ts', 'second.ts'])
+    expect(files?.[0]?.lines.map((line) => line.kind)).toEqual(['context', 'del', 'add'])
+    expect(files?.[0]?.lineNumbersKnown).toBe(false)
+  })
+
+  it('does not render envelope control lines as file content', () => {
+    const files = settledFiles({
+      name: 'apply_patch',
+      input: {
+        input:
+          '*** Begin Patch\n*** Environment ID: abc123\n*** Update File: a.ts\n@@\n-was\n+now\n*** End of File\n*** End Patch'
+      }
+    })
+    expect(files?.[0]?.lines.map((line) => line.text)).toEqual(['was', 'now'])
+  })
+
+  it('reports a delete that names the file and carries no body', () => {
+    const files = settledFiles({
+      name: 'apply_patch',
+      input: { input: '*** Begin Patch\n*** Delete File: gone.ts\n*** End Patch' }
+    })
+    expect(files).toHaveLength(1)
+    expect(files?.[0]?.changeKind).toBe('deleted')
+    expect(files?.[0]?.path).toBe('gone.ts')
+    expect(files?.[0]?.lines).toEqual([])
+  })
+
+  it('reads a CRLF envelope, whose markers otherwise match nothing', () => {
+    const files = settledFiles({
+      name: 'apply_patch',
+      input: {
+        input:
+          '*** Begin Patch\r\n*** Update File: a.ts\r\n@@ -1,2 +1,2 @@\r\n-was\r\n+now\r\n*** End Patch'
+      }
+    })
+    expect(files).toHaveLength(1)
+    expect(files?.[0]?.path).toBe('a.ts')
+    expect(files?.[0]?.lines.map((line) => line.text)).toEqual(['was', 'now'])
+  })
+
+  it('marks the break between resolved hunks that sit far apart', () => {
+    const files = settledFiles({
+      name: 'Edit',
+      input: { file_path: '/repo/a.ts' },
+      result: {
+        editPatch: {
+          filePath: '/repo/a.ts',
+          hunks: [
+            { oldStart: 42, oldLines: 1, newStart: 42, newLines: 1, lines: ['-was', '+now'] },
+            { oldStart: 310, oldLines: 1, newStart: 310, newLines: 1, lines: ['-old', '+new'] }
+          ]
+        }
+      }
+    })
+    expect(files?.[0]?.lines.map((line) => line.kind)).toEqual(['del', 'add', 'gap', 'del', 'add'])
+    // A break marks nothing at either end, and counts no change of its own.
+    expect(files?.[0]?.added).toBe(2)
+    expect(files?.[0]?.removed).toBe(2)
+    expect(gutter(files)).toEqual([42, 42, null, 310, 310])
+  })
+
+  it('reads a move header as a rename', () => {
+    const files = settledFiles({
+      name: 'exec',
+      input:
+        "apply_patch <<'EOF'\n*** Begin Patch\n*** Update File: old.ts\n*** Move to: new.ts\n@@\n-a\n+b\n*** End Patch\nEOF"
+    })
+    expect(files?.[0]?.changeKind).toBe('renamed')
+    expect(files?.[0]?.oldPath).toBe('old.ts')
+    expect(files?.[0]?.path).toBe('new.ts')
+  })
+
+  it('interleaves a Claude snippet pair without claiming line positions', () => {
+    const files = settledFiles({
+      name: 'Edit',
+      input: {
+        file_path: '/repo/a.ts',
+        old_string: 'keep\nwas\ntail',
+        new_string: 'keep\nnow\ntail'
+      }
+    })
+    expect(files?.[0]?.lines.map((line) => line.kind)).toEqual(['context', 'del', 'add', 'context'])
+    expect(files?.[0]?.lineNumbersKnown).toBe(false)
+  })
+
+  it('prefers the resolved hunks on the result over the snippet pair', () => {
+    const files = settledFiles({
+      name: 'Edit',
+      input: { file_path: '/repo/a.ts', old_string: 'was', new_string: 'now' },
+      result: {
+        editPatch: {
+          filePath: '/repo/a.ts',
+          hunks: [
+            {
+              oldStart: 12,
+              oldLines: 3,
+              newStart: 12,
+              newLines: 3,
+              lines: [' ctx', '-was', '+now', ' tail']
+            }
+          ]
+        }
+      }
+    })
+    expect(files?.[0]?.lineNumbersKnown).toBe(true)
+    expect(gutter(files)).toEqual([12, 13, 13, 14])
+  })
+
+  it('treats a Write the provider reported as a creation as an added file', () => {
+    const files = settledFiles({
+      name: 'Write',
+      input: { file_path: '/repo/new.ts', content: 'one\ntwo\n' },
+      result: { output: 'File created successfully at: /repo/new.ts' }
+    })
+    expect(files?.[0]?.changeKind).toBe('added')
+    expect(gutter(files)).toEqual([1, 2])
+  })
+
+  it('does not claim a creation for a Write over an existing file', () => {
+    const overwrite = settledFiles({
+      name: 'Write',
+      input: { file_path: '/repo/a.ts', content: 'one\ntwo\n' },
+      result: { output: 'The file /repo/a.ts has been updated.' }
+    })
+    expect(overwrite?.[0]?.changeKind).toBe('edited')
+    // With no result at all there is no evidence of a creation either.
+    const unreported = settledFiles({
+      name: 'Write',
+      input: { file_path: '/repo/a.ts', content: 'one\n' }
+    })
+    expect(unreported?.[0]?.changeKind).toBe('edited')
+  })
+
+  it('reads a MultiEdit, whose snippet pairs sit in edits[]', () => {
+    const files = settledFiles({
+      name: 'MultiEdit',
+      input: {
+        file_path: '/repo/a.ts',
+        edits: [
+          { old_string: 'was', new_string: 'now' },
+          { old_string: 'gone', new_string: 'kept' }
+        ]
+      }
+    })
+    expect(files).toHaveLength(1)
+    expect(files?.[0]?.path).toBe('/repo/a.ts')
+    // Each entry is its own region, so a break separates them.
+    expect(files?.[0]?.lines.map((line) => [line.kind, line.text])).toEqual([
+      ['del', 'was'],
+      ['add', 'now'],
+      ['gap', ''],
+      ['del', 'gone'],
+      ['add', 'kept']
+    ])
+    expect(files?.[0]?.added).toBe(2)
+    expect(files?.[0]?.removed).toBe(2)
+  })
+
+  it('leaves NotebookEdit to the generic tool view', () => {
+    expect(isEditToolName('NotebookEdit')).toBe(false)
+  })
+
+  it('drops the gutter numbers whenever they locate a snippet rather than the file', () => {
+    const files = settledFiles({
+      name: 'Edit',
+      input: { file_path: '/repo/a.ts', old_string: 'keep\nwas', new_string: 'keep\nnow' }
+    })
+    expect(files?.[0]?.lineNumbersKnown).toBe(false)
+    expect(gutter(files)).toEqual([null, null, null])
+    expect(
+      files?.[0]?.lines.every((line) => line.oldLineNumber === null && line.newLineNumber === null)
+    ).toBe(true)
+  })
+
+  it('renders no card for an edit the provider rejected or has not landed', () => {
+    const failedInput = { file_path: '/repo/a.ts', old_string: 'missing', new_string: 'now' }
+    expect(
+      settledFiles({
+        name: 'Edit',
+        input: failedInput,
+        result: { output: 'String to replace not found in file.', isError: true }
+      })
+    ).toBeNull()
+    expect(
+      settledFiles({
+        name: 'apply_patch',
+        input: {
+          changes: [{ path: 'a.ts', kind: { type: 'update' }, diff: '@@ -1 +1 @@\n-a\n+b' }]
+        },
+        state: 'failed'
+      })
+    ).toBeNull()
+    expect(settledFiles({ name: 'Edit', input: failedInput, state: 'running' })).toBeNull()
+  })
+
+  it('does not read a command tool result as a file edit', () => {
+    const patch = 'diff --git a/a.ts b/a.ts\n--- a/a.ts\n+++ b/a.ts\n@@ -1 +1 @@\n-was\n+now'
+    expect(
+      settledFiles({
+        name: 'exec',
+        input: { command: 'git diff' },
+        result: { output: patch }
+      })
+    ).toBeNull()
+    // The structured journal's `Diff` item carries its patch only on the result.
+    const diffed = settledFiles({
+      name: 'Diff',
+      input: { path: '/repo/a.ts' },
+      result: { output: patch }
+    })
+    expect(diffed?.[0]?.path).toBe('/repo/a.ts')
+    expect(diffed?.[0]?.added).toBe(1)
+  })
+
+  it('reports truncation when the content runs past the character cap', () => {
+    const files = settledFiles({
+      name: 'Write',
+      input: { file_path: '/repo/a.ts', content: `${'x'.repeat(MAX_EDIT_CHARS)}\nlast\n` }
+    })
+    expect(files?.[0]?.truncated).toBe(true)
+    // The clipped body ends mid-line, so its one row is real and must survive.
+    expect(files?.[0]?.lines).toHaveLength(1)
+  })
+
+  it('reads Codex structured changes, stripping the move marker from the body', () => {
+    const files = settledFiles({
+      name: 'apply_patch',
+      input: {
+        changes: [
+          {
+            path: 'old.ts',
+            kind: { type: 'update', move_path: 'new.ts' },
+            diff: '@@ -1,2 +1,2 @@\n-a\n+b\n\nMoved to: new.ts'
+          }
+        ]
+      }
+    })
+    expect(files?.[0]?.changeKind).toBe('renamed')
+    expect(files?.[0]?.lines.some((line) => line.text.includes('Moved to'))).toBe(false)
+    expect(gutter(files)).toEqual([1, 1])
+  })
+
+  it('reads a Codex add change, which arrives as raw content with no hunk header', () => {
+    const files = settledFiles({
+      name: 'apply_patch',
+      input: { changes: [{ path: 'new.ts', kind: { type: 'add' }, diff: 'one\ntwo' }] }
+    })
+    expect(files?.[0]?.changeKind).toBe('added')
+    expect(files?.[0]?.added).toBe(2)
+  })
+
+  it('renders the file a write actually wrote, not one its content quotes', () => {
+    const files = settledFiles({
+      name: 'Write',
+      input: {
+        file_path: 'docs/patch-format.md',
+        content:
+          'Example:\n\n*** Begin Patch\n*** Update File: src/victim.ts\n@@\n-a\n+b\n*** End Patch\n'
+      },
+      result: { output: 'File created successfully at: docs/patch-format.md' }
+    })
+    expect(files?.map((file) => file.path)).toEqual(['docs/patch-format.md'])
+    expect(files?.[0]?.lines.some((line) => line.text.includes('Begin Patch'))).toBe(true)
+  })
+
+  it('finds an envelope in a command payload that arrived as JSON text', () => {
+    const envelope = '*** Begin Patch\n*** Update File: src/a.ts\n@@\n-was\n+now\n*** End Patch'
+    const files = settledFiles({
+      name: 'shell',
+      input: JSON.stringify({
+        command: ['bash', '-lc', `apply_patch <<'EOF'\n${envelope}\nEOF`],
+        workdir: '/repo'
+      })
+    })
+    expect(files?.[0]?.path).toBe('src/a.ts')
+    expect(files?.[0]?.added).toBe(1)
+  })
+
+  it('renders no card for a call the turn never answered', () => {
+    const input = { file_path: '/repo/a.ts', old_string: 'was', new_string: 'now' }
+    // No lifecycle and no result: nothing says the edit was applied.
+    expect(editFilesFromToolPair({ name: 'Edit', input })).toBeNull()
+    expect(editFilesFromToolPair({ name: 'Edit', input, state: 'completed' })).toHaveLength(1)
+    expect(editFilesFromToolPair({ name: 'Edit', input, result: { output: 'ok' } })).toHaveLength(1)
+  })
+
+  it('splits a multi-file patch into one card per file', () => {
+    const files = settledFiles({
+      name: 'Diff',
+      input: { path: '/repo/one.ts' },
+      result: {
+        output:
+          'diff --git a/one.ts b/one.ts\n--- a/one.ts\n+++ b/one.ts\n@@ -1,1 +1,1 @@\n-first\n+FIRST\n' +
+          'diff --git a/two.ts b/two.ts\n--- a/two.ts\n+++ b/two.ts\n@@ -10,1 +10,1 @@\n-second\n+SECOND'
+      }
+    })
+    expect(files?.map((file) => file.path)).toEqual(['one.ts', 'two.ts'])
+    expect(files?.[0]?.lines.map((line) => line.text)).toEqual(['first', 'FIRST'])
+    expect(gutter(files?.slice(1) ?? null)).toEqual([10, 10])
+  })
+
+  it('keeps a file whose envelope section carries no body at all', () => {
+    const files = settledFiles({
+      name: 'apply_patch',
+      input: {
+        input:
+          '*** Begin Patch\n*** Update File: first.ts\n@@\n-a\n+b\n*** Update File: second.ts\n*** Update File: third.ts\n@@\n-c\n+d\n*** End Patch'
+      }
+    })
+    expect(files?.map((file) => file.path)).toEqual(['first.ts', 'second.ts', 'third.ts'])
+    expect(files?.[1]?.lines).toEqual([])
+  })
+
+  it('splits a multi-file patch written without per-file preamble lines', () => {
+    const files = settledFiles({
+      name: 'Diff',
+      input: { path: '/repo/one.ts' },
+      result: {
+        output:
+          '--- a/one.ts\n+++ b/one.ts\n@@ -1,1 +1,1 @@\n-first\n+FIRST\n' +
+          '--- a/two.ts\n+++ b/two.ts\n@@ -10,1 +10,1 @@\n-second\n+SECOND'
+      }
+    })
+    expect(files?.map((file) => file.path)).toEqual(['one.ts', 'two.ts'])
+    expect(gutter(files?.slice(1) ?? null)).toEqual([10, 10])
+  })
+
+  it('refuses a card when the call names a file count instead of a file', () => {
+    expect(
+      settledFiles({
+        name: 'Diff',
+        input: { path: '2 files' },
+        result: { output: '@@\n-a\n+b\n@@\n-c\n+d' }
+      })
+    ).toBeNull()
+  })
+
+  it('reports a clipped patch as truncated instead of rendering its marker', () => {
+    const files = settledFiles({
+      name: 'Diff',
+      input: { path: 'src/a.ts' },
+      result: { output: '@@ -1,3 +1,3 @@\n ctx\n-was\n+now\n… (48210 bytes)' }
+    })
+    expect(files?.[0]?.truncated).toBe(true)
+    expect(files?.[0]?.lines.map((line) => line.text)).toEqual(['ctx', 'was', 'now'])
+  })
+
+  it('reads a move appended to the patch body as a rename, as the other lane does', () => {
+    const files = settledFiles({
+      name: 'Diff',
+      input: { path: 'src/old.ts' },
+      result: { output: '@@ -1,1 +1,1 @@\n-a\n+b\n\nMoved to: src/new.ts' }
+    })
+    expect(files?.[0]?.changeKind).toBe('renamed')
+    expect(files?.[0]?.path).toBe('src/new.ts')
+    expect(files?.[0]?.oldPath).toBe('src/old.ts')
+    expect(files?.[0]?.lines.some((line) => line.text.includes('Moved to'))).toBe(false)
+  })
+
+  it('does not read a row that merely mentions a move as one', () => {
+    const body = '@@ -1,2 +1,2 @@\n ctx\n+See Moved to: docs/archive/index.md'
+    const fromPatch = settledFiles({
+      name: 'Diff',
+      input: { path: 'docs/index.md' },
+      result: { output: body }
+    })
+    const fromChanges = settledFiles({
+      name: 'apply_patch',
+      input: { changes: [{ path: 'docs/index.md', kind: { type: 'update' }, diff: body }] }
+    })
+    for (const files of [fromPatch, fromChanges]) {
+      expect(files?.[0]?.changeKind).toBe('edited')
+      expect(files?.[0]?.oldPath).toBeNull()
+      expect(files?.[0]?.path).toBe('docs/index.md')
+      expect(files?.[0]?.lines.at(-1)?.text).toBe('See Moved to: docs/archive/index.md')
+    }
+  })
+
+  it('accepts either spelling of the command that applies an envelope', () => {
+    const envelope = '*** Begin Patch\n*** Update File: src/a.ts\n@@\n-was\n+now\n*** End Patch'
+    const files = settledFiles({
+      name: 'shell',
+      input: { command: ['bash', '-lc', `applypatch <<'EOF'\n${envelope}\nEOF`] }
+    })
+    expect(files?.[0]?.path).toBe('src/a.ts')
+  })
+
+  it('keeps the header destination for a rename the call names by its old path', () => {
+    const files = settledFiles({
+      name: 'Diff',
+      input: { path: 'old.txt' },
+      result: {
+        output:
+          'diff --git a/old.txt b/new.txt\n--- a/old.txt\n+++ b/new.txt\n@@ -1,1 +1,1 @@\n-a\n+b'
+      }
+    })
+    expect(files?.[0]?.path).toBe('new.txt')
+    expect(files?.[0]?.oldPath).toBe('old.txt')
+  })
+
+  it('does not read a command that only quotes an envelope as an edit', () => {
+    const envelope = '*** Begin Patch\n*** Update File: src/real.ts\n@@\n-a\n+b\n*** End Patch'
+    expect(
+      settledFiles({
+        name: 'shell',
+        input: { command: ['bash', '-lc', `cat > notes.md <<'EOF'\n${envelope}\nEOF`] }
+      })
+    ).toBeNull()
+  })
+
+  it('does not call two compared directories a rename', () => {
+    const files = settledFiles({
+      name: 'Diff',
+      input: {},
+      result: { output: '--- d1/x.ts\n+++ d2/x.ts\n@@ -1,1 +1,1 @@\n-a\n+b' }
+    })
+    expect(files?.[0]?.changeKind).toBe('edited')
+    expect(files?.[0]?.oldPath).toBeNull()
+    expect(files?.[0]?.path).toBe('d2/x.ts')
+  })
+
+  it('lets the call name the file when a preamble precedes the only header', () => {
+    const files = settledFiles({
+      name: 'Diff',
+      input: { path: '/repo/one.ts' },
+      result: {
+        output:
+          'warning: something\ndiff --git a/one.ts b/one.ts\n--- a/one.ts\n+++ b/one.ts\n@@ -1,1 +1,1 @@\n-a\n+b'
+      }
+    })
+    // The preamble is its own nameless section, and must not make this look
+    // like a patch over several files.
+    expect(files?.map((file) => file.path)).toEqual(['/repo/one.ts'])
+  })
+
+  it('returns null for a tool that did not edit a file', () => {
+    expect(settledFiles({ name: 'Bash', input: { command: 'ls' } })).toBeNull()
+    expect(isEditToolName('Bash')).toBe(false)
+    expect(isEditToolName('Edit')).toBe(true)
+  })
+})
diff --git a/src/shared/native-chat-edit-normalize.ts b/src/shared/native-chat-edit-normalize.ts
new file mode 100644
index 00000000000..95c2ca18bd5
--- /dev/null
+++ b/src/shared/native-chat-edit-normalize.ts
@@ -0,0 +1,349 @@
+import { editFilesFromBeginPatch, unwrapBeginPatch } from './native-chat-begin-patch'
+import { editLinesFromContents } from './native-chat-edit-lcs'
+import {
+  finalizeEditFile,
+  pushEditGap,
+  type NativeChatEditFile,
+  type NativeChatEditLine
+} from './native-chat-edit-model'
+import { stripBoundedTextMarker } from './structured-agent-session-projection'
+import {
+  editLinesFromUnifiedPatch,
+  editLinesFromWholeFile,
+  unifiedPatchSections,
+  type UnifiedPatchSection
+} from './native-chat-unified-patch'
+import type { NativeChatEditPatch } from './native-chat-types'
+
+// `NotebookEdit` is deliberately absent: its input carries only the new cell
+// source, so a card would render an unchanged cell as wholly added. It falls
+// through to the generic tool view instead.
+const CLAUDE_EDIT_TOOLS = new Set(['Edit', 'MultiEdit', 'Write', 'str_replace'])
+/** Command tools, which run a patch as one of many things they can run, so a
+ *  quoted envelope is not evidence that one was applied. */
+const COMMAND_PATCH_TOOLS = new Set(['exec', 'shell', 'local_shell'])
+/** Tools whose input may wrap a `*** Begin Patch` envelope. The dedicated patch
+ *  tool applies whatever it is given; a command tool must say that it is. */
+const PATCH_ENVELOPE_TOOLS = new Set(['apply_patch', ...COMMAND_PATCH_TOOLS])
+/** A count standing in for a path, from a producer that joined several files'
+ *  patches and kept no per-file path. */
+const FILE_COUNT_PATH = /^\d+ files?$/
+/** Tools whose whole payload is patch text. `Diff` reaches its patch only
+ *  through the result, because the structured journal projects a diff item as a
+ *  call carrying just the path. */
+const PATCH_TEXT_TOOLS = new Set(['apply_patch', 'Diff'])
+
+export function isEditToolName(name: string): boolean {
+  return CLAUDE_EDIT_TOOLS.has(name) || PATCH_ENVELOPE_TOOLS.has(name) || PATCH_TEXT_TOOLS.has(name)
+}
+
+function record(value: unknown): Record<string, unknown> | null {
+  return typeof value === 'object' && value !== null ? (value as Record<string, unknown>) : null
+}
+
+function text(value: unknown): string | null {
+  return typeof value === 'string' ? value : null
+}
+
+/** Rows straight from resolved hunks, which is the only path with true numbers
+ *  for a provider that reports its edits as a snippet pair. */
+function linesFromEditPatch(patch: NativeChatEditPatch): NativeChatEditLine[] {
+  const lines: NativeChatEditLine[] = []
+  for (const hunk of patch.hunks) {
+    // Hunks are separate regions of the file; run together the gutter jumps
+    // from one to the next with nothing marking the skipped span.
+    pushEditGap(lines)
+    let oldNo = hunk.oldStart
+    let newNo = hunk.newStart
+    for (const raw of hunk.lines) {
+      if (raw.startsWith('+')) {
+        lines.push({ kind: 'add', text: raw.slice(1), oldLineNumber: null, newLineNumber: newNo })
+        newNo += 1
+      } else if (raw.startsWith('-')) {
+        lines.push({ kind: 'del', text: raw.slice(1), oldLineNumber: oldNo, newLineNumber: null })
+        oldNo += 1
+      } else {
+        lines.push({
+          kind: 'context',
+          text: raw.startsWith(' ') ? raw.slice(1) : raw,
+          oldLineNumber: oldNo,
+          newLineNumber: newNo
+        })
+        oldNo += 1
+        newNo += 1
+      }
+    }
+  }
+  return lines
+}
+
+/** A whole-content write looks identical whether it created the file or
+ *  overwrote one, so only positive evidence may claim a creation. With no
+ *  evidence either way this errs toward the weaker claim: calling a creation an
+ *  edit is imprecise, while calling an overwrite a creation is false and paints
+ *  an existing file as wholly new. */
+const CREATED_FILE_RESULT = /^\s*File created successfully/
+
+function wholeContentChangeKind(
+  input: Record<string, unknown>,
+  output: string | undefined
+): 'added' | 'edited' {
+  if (text(input.command) === 'create') {
+    return 'added'
+  }
+  return output !== undefined && CREATED_FILE_RESULT.test(output) ? 'added' : 'edited'
+}
+
+/** `MultiEdit` carries its snippet pairs in `edits[]`, not at the top level. */
+function multiEditFiles(input: Record<string, unknown>, path: string): NativeChatEditFile[] | null {
+  if (!Array.isArray(input.edits)) {
+    return null
+  }
+  const lines: NativeChatEditLine[] = []
+  let truncated = false
+  for (const entry of input.edits) {
+    const edit = record(entry)
+    const oldString = text(edit?.old_string) ?? text(edit?.oldString)
+    const newString = text(edit?.new_string) ?? text(edit?.newString)
+    if (oldString === null && newString === null) {
+      continue
+    }
+    // Each entry is its own snippet, so it starts a new region.
+    pushEditGap(lines)
+    const diffed = editLinesFromContents(oldString ?? '', newString ?? '')
+    lines.push(...diffed.lines)
+    truncated ||= diffed.truncated
+  }
+  if (lines.length === 0) {
+    return null
+  }
+  return [
+    finalizeEditFile({
+      path,
+      oldPath: null,
+      changeKind: 'edited',
+      lines,
+      // A snippet pair cannot say where in the file it sits.
+      lineNumbersKnown: false,
+      truncated
+    })
+  ]
+}
+
+function claudeEditFiles(
+  name: string,
+  input: Record<string, unknown>,
+  output: string | undefined
+): NativeChatEditFile[] | null {
+  const path = text(input.file_path) ?? text(input.path) ?? 'file'
+  if (name === 'MultiEdit') {
+    return multiEditFiles(input, path)
+  }
+  const oldString = text(input.old_string) ?? text(input.oldString)
+  const newString = text(input.new_string) ?? text(input.newString)
+  const content = text(input.content) ?? text(input.file_text)
+  if (oldString === null && content !== null) {
+    const whole = editLinesFromWholeFile(content, 'add')
+    return [
+      finalizeEditFile({
+        path,
+        oldPath: null,
+        changeKind: wholeContentChangeKind(input, output),
+        lines: whole.lines,
+        lineNumbersKnown: true,
+        truncated: whole.truncated
+      })
+    ]
+  }
+  if (oldString === null && newString === null) {
+    return null
+  }
+  const diffed = editLinesFromContents(oldString ?? '', newString ?? content ?? '')
+  return [
+    finalizeEditFile({
+      path,
+      oldPath: null,
+      changeKind: 'edited',
+      lines: diffed.lines,
+      // A snippet pair cannot say where in the file it sits.
+      lineNumbersKnown: false,
+      truncated: diffed.truncated
+    })
+  ]
+}
+
+/** A move is appended to the patch body as prose rather than a header field, on
+ *  every lane that carries the body as text. Left in place it renders as a
+ *  numbered line of the file it moved.
+ *
+ *  Anchored to the start of the final line: unanchored, a row whose own content
+ *  mentions a move was cut in half and the file it names claimed as a rename
+ *  that never happened. */
+const MOVE_MARKER = /(?:^|\n)Moved to: (.+)$/
+
+function splitMoveMarker(patch: string): { body: string; movedTo: string | null } {
+  const match = MOVE_MARKER.exec(patch)
+  return match
+    ? { body: patch.slice(0, match.index), movedTo: match[1]!.trim() }
+    : { body: patch, movedTo: null }
+}
+
+function codexChangeFiles(changes: unknown[]): NativeChatEditFile[] {
+  return changes.flatMap((entry) => {
+    const change = record(entry)
+    const path = text(change?.path)
+    const diff = text(change?.diff)
+    if (!change || !path || !diff) {
+      return []
+    }
+    const kind = record(change.kind)
+    const kindType = text(kind?.type) ?? text(change.kind) ?? 'update'
+    const movePath = text(kind?.move_path) ?? text(change.movePath)
+    if (kindType === 'add' || kindType === 'delete') {
+      // Add and delete arrive as raw file content, with no hunk header or signs.
+      const whole = editLinesFromWholeFile(diff, kindType === 'add' ? 'add' : 'del')
+      return [
+        finalizeEditFile({
+          path,
+          oldPath: null,
+          changeKind: kindType === 'add' ? 'added' : 'deleted',
+          lines: whole.lines,
+          lineNumbersKnown: true,
+          truncated: whole.truncated
+        })
+      ]
+    }
+    const parsed = editLinesFromUnifiedPatch(splitMoveMarker(diff).body)
+    if (!parsed) {
+      return []
+    }
+    return [
+      finalizeEditFile({
+        path: movePath ?? path,
+        oldPath: movePath ? path : null,
+        changeKind: movePath ? 'renamed' : 'edited',
+        lines: parsed.lines,
+        lineNumbersKnown: parsed.lineNumbersKnown,
+        truncated: parsed.truncated
+      })
+    ]
+  })
+}
+
+/** One diff model for a tool call and its result, across every shape the
+ *  supported agents use to report a file edit. */
+export function editFilesFromToolPair(pair: {
+  name: string
+  input: unknown
+  /** Provider lifecycle for the call, when the lane reports one. */
+  state?: 'running' | 'completed' | 'failed'
+  result?: { output?: string; isError?: boolean; editPatch?: NativeChatEditPatch }
+}): NativeChatEditFile[] | null {
+  // A card states the edit as made, so it takes evidence that it landed: the
+  // provider reporting the call complete, or a result that is not an error.
+  // Anything else — failed, still running, or a turn that stopped before the
+  // call was answered — keeps the generic tool view and its error body.
+  if (pair.state === 'failed' || pair.state === 'running' || pair.result?.isError === true) {
+    return null
+  }
+  if (pair.state !== 'completed' && pair.result === undefined) {
+    return null
+  }
+  const input = record(pair.input)
+  const patch = pair.result?.editPatch
+  if (patch && patch.hunks.length > 0) {
+    return [
+      finalizeEditFile({
+        path: patch.filePath ?? text(input?.file_path) ?? 'file',
+        oldPath: null,
+        changeKind: 'edited',
+        lines: linesFromEditPatch(patch),
+        lineNumbersKnown: true
+      })
+    ]
+  }
+
+  // Only a tool that runs a patch may be searched for an envelope: a file's own
+  // contents can quote one, and scanning a write's payload rendered a card for
+  // the quoted file while the file actually written never appeared.
+  if (PATCH_ENVELOPE_TOOLS.has(pair.name)) {
+    const envelope = unwrapBeginPatch(pair.input, {
+      requireApplyCommand: COMMAND_PATCH_TOOLS.has(pair.name)
+    })
+    const files = envelope ? editFilesFromBeginPatch(envelope) : []
+    if (files.length > 0) {
+      return files
+    }
+  }
+
+  if (input && Array.isArray(input.changes)) {
+    const files = codexChangeFiles(input.changes)
+    if (files.length > 0) {
+      return files
+    }
+  }
+
+  if (input && CLAUDE_EDIT_TOOLS.has(pair.name)) {
+    return claudeEditFiles(pair.name, input, pair.result?.output)
+  }
+
+  if (!PATCH_TEXT_TOOLS.has(pair.name)) {
+    return null
+  }
+  // The result fallback is scoped to `Diff`, whose call carries only a path.
+  // Reading any command tool's output as a patch reclassified `git diff` as a
+  // file edit and swallowed the command line with it.
+  const patchText =
+    text(input?.patch) ?? text(input?.diff) ?? (pair.name === 'Diff' ? pair.result?.output : null)
+  if (!patchText) {
+    return null
+  }
+  // The body carries its own marker when the journal clipped it. Read as
+  // content it becomes a numbered line of the file, and the rows that follow
+  // are reported complete.
+  const bounded = stripBoundedTextMarker(patchText)
+  const moved = splitMoveMarker(bounded.text)
+  // One card per file the patch touches: run together, the later files' rows
+  // and gutter numbers sit under the first file's name.
+  const split = unifiedPatchSections(moved.body)
+  const callerPath = text(input?.path) ?? text(input?.file_path)
+  if (callerPath !== null && FILE_COUNT_PATH.test(callerPath)) {
+    // The producer joined several files' patches and kept a count in place of a
+    // path, so nothing here can name a file. Naming the card after the count
+    // would assert a file that does not exist.
+    return null
+  }
+  // A patch that names one file is the file the call is reporting on, so the
+  // call's own path wins — it is the provider's, where the header's is relative
+  // to the patch. A patch naming several has no one path, and a rename's
+  // destination is only ever in the header. Sections that name nothing are
+  // preamble and must not change that count.
+  const namedSections = split.sections.filter((section) => section.path !== null).length
+  const named = (section: UnifiedPatchSection): string =>
+    (namedSections <= 1 && section.oldPath === null
+      ? (callerPath ?? section.path)
+      : (section.path ?? callerPath)) ?? 'file'
+  const files = split.sections.flatMap((section) => {
+    const parsed = editLinesFromUnifiedPatch(section.body)
+    if (!parsed && section.path === null) {
+      return []
+    }
+    return [
+      finalizeEditFile({
+        path: named(section),
+        oldPath: section.oldPath,
+        changeKind: section.changeKind,
+        lines: parsed?.lines ?? [],
+        lineNumbersKnown: parsed?.lineNumbersKnown ?? false,
+        truncated: bounded.truncated || split.truncated || (parsed?.truncated ?? false)
+      })
+    ]
+  })
+  // The move marker names where the whole patch moved, so it can only speak for
+  // a patch describing one file.
+  if (moved.movedTo !== null && files.length === 1 && files[0]) {
+    const only = files[0]
+    return [{ ...only, path: moved.movedTo, oldPath: only.path, changeKind: 'renamed' }]
+  }
+  return files.length > 0 ? files : null
+}
diff --git a/src/shared/native-chat-href-routing.test.ts b/src/shared/native-chat-href-routing.test.ts
index 1b7c276ffd3..5f6e7ad4595 100644
--- a/src/shared/native-chat-href-routing.test.ts
+++ b/src/shared/native-chat-href-routing.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest'
-import { routeNativeChatHref } from './native-chat-href-routing'
+import { createNativeChatFileHref, routeNativeChatHref } from './native-chat-href-routing'
 
 describe('routeNativeChatHref', () => {
   it('classifies web and mail links', () => {
@@ -47,6 +47,35 @@ describe('routeNativeChatHref', () => {
     })
   })
 
+  it('routes encoded renderer file targets without treating Windows drives as schemes', () => {
+    expect(
+      routeNativeChatHref(createNativeChatFileHref(String.raw`C:\repo\report.docx:12`))
+    ).toEqual({
+      kind: 'file',
+      pathText: String.raw`C:\repo\report.docx:12`,
+      line: null
+    })
+    expect(routeNativeChatHref(createNativeChatFileHref('/tmp/report.html'))).toEqual({
+      kind: 'file',
+      pathText: '/tmp/report.html',
+      line: null
+    })
+  })
+
+  it('bounds nested renderer file target decoding', () => {
+    let href = '/tmp/report.html'
+    for (let depth = 0; depth < 4; depth += 1) {
+      href = createNativeChatFileHref(` ${href}`)
+    }
+    expect(routeNativeChatHref(href)).toEqual({
+      kind: 'file',
+      pathText: '/tmp/report.html',
+      line: null
+    })
+
+    expect(routeNativeChatHref(createNativeChatFileHref(` ${href}`))).toEqual({ kind: 'none' })
+  })
+
   it('drops anchors, unknown schemes, malformed file URIs, and empty hrefs', () => {
     expect(routeNativeChatHref('#section')).toEqual({ kind: 'none' })
     expect(routeNativeChatHref(undefined)).toEqual({ kind: 'none' })
diff --git a/src/shared/native-chat-href-routing.ts b/src/shared/native-chat-href-routing.ts
index 005ab957f65..edf36565dab 100644
--- a/src/shared/native-chat-href-routing.ts
+++ b/src/shared/native-chat-href-routing.ts
@@ -8,6 +8,24 @@ export type NativeChatHrefRoute =
 
 const WEB_SCHEME_PATTERN = /^(?:https?|mailto):/i
 const SCHEME_PATTERN = /^[A-Za-z][A-Za-z0-9+.-]*:/
+export const NATIVE_CHAT_FILE_HREF_PREFIX = '#orca-native-chat-file='
+const MAX_NATIVE_CHAT_FILE_HREF_DECODES = 4
+
+export function createNativeChatFileHref(pathText: string): string {
+  return `${NATIVE_CHAT_FILE_HREF_PREFIX}${encodeURIComponent(pathText)}`
+}
+
+function decodeNativeChatFileHref(href: string): string | null {
+  if (!href.startsWith(NATIVE_CHAT_FILE_HREF_PREFIX)) {
+    return null
+  }
+  try {
+    const decoded = decodeURIComponent(href.slice(NATIVE_CHAT_FILE_HREF_PREFIX.length))
+    return decoded && !decoded.startsWith(NATIVE_CHAT_FILE_HREF_PREFIX) ? decoded : null
+  } catch {
+    return null
+  }
+}
 
 function parseLineFragment(hash: string): number | null {
   if (!hash) {
@@ -45,8 +63,21 @@ function maybeDecodeHrefPath(value: string): string {
 }
 
 export function routeNativeChatHref(href: string | null | undefined): NativeChatHrefRoute {
-  const trimmed = href?.trim()
-  if (!trimmed || trimmed.startsWith('#')) {
+  let trimmed = href?.trim()
+  if (!trimmed) {
+    return { kind: 'none' }
+  }
+  for (let depth = 0; depth < MAX_NATIVE_CHAT_FILE_HREF_DECODES; depth += 1) {
+    const encodedFileHref = decodeNativeChatFileHref(trimmed)
+    if (!encodedFileHref) {
+      break
+    }
+    trimmed = encodedFileHref.trim()
+  }
+  if (!trimmed || trimmed.startsWith(NATIVE_CHAT_FILE_HREF_PREFIX)) {
+    return { kind: 'none' }
+  }
+  if (trimmed.startsWith('#')) {
     return { kind: 'none' }
   }
   if (WEB_SCHEME_PATTERN.test(trimmed)) {
diff --git a/src/shared/native-chat-session-option-snapshot.test.ts b/src/shared/native-chat-session-option-snapshot.test.ts
index 5286ad9154b..c9980be3b3b 100644
--- a/src/shared/native-chat-session-option-snapshot.test.ts
+++ b/src/shared/native-chat-session-option-snapshot.test.ts
@@ -1,5 +1,8 @@
 import { describe, expect, it } from 'vitest'
-import type { SessionOptionDescriptor } from './native-chat-session-options'
+import {
+  sessionOptionDispatchUnconfirmed,
+  type SessionOptionDescriptor
+} from './native-chat-session-options'
 import { mergeDiscoveredAuthoritativeModels } from './agent-session-option-catalog'
 import {
   CLAUDE_SESSION_OPTION_CATALOG,
@@ -22,13 +25,37 @@ function claudeRecord(): NativeChatSessionOptionRecord {
 }
 
 describe('buildNativeChatSessionOptionSnapshot', () => {
+  // The producer names its lane once, here; `dispatched` is emitted by both and
+  // is not evidence of which one, so the descriptor has to carry the answer.
+  it.each(['catalog', 'agent-session'] as const)(
+    'stamps every descriptor with the %s transport it was built for',
+    (liveTransport) => {
+      const record = claudeRecord()
+      record.model = { value: 'sonnet', source: 'dispatched' }
+      const snapshot = buildNativeChatSessionOptionSnapshot({
+        catalog: CLAUDE_SESSION_OPTION_CATALOG,
+        models: CLAUDE_SESSION_OPTION_CATALOG.models,
+        record,
+        mode: 'live',
+        modelLabel: 'Model',
+        liveTransport
+      })
+      expect(snapshot.length).toBeGreaterThan(1)
+      expect(snapshot.every((descriptor) => descriptor.transport === liveTransport)).toBe(true)
+      const dispatched = snapshot.filter((descriptor) => descriptor.valueSource === 'dispatched')
+      expect(dispatched.length).toBeGreaterThan(0)
+      expect(dispatched.every(sessionOptionDispatchUnconfirmed)).toBe(liveTransport === 'catalog')
+    }
+  )
+
   it('offers every catalog model with the current value unknown', () => {
     const snapshot = buildNativeChatSessionOptionSnapshot({
       catalog: CLAUDE_SESSION_OPTION_CATALOG,
       models: CLAUDE_SESSION_OPTION_CATALOG.models,
       record: claudeRecord(),
       mode: 'live',
-      modelLabel: 'Model'
+      modelLabel: 'Model',
+      liveTransport: 'catalog'
     })
     expect(snapshot).toHaveLength(1)
     const model = snapshot[0]!
@@ -50,7 +77,8 @@ describe('buildNativeChatSessionOptionSnapshot', () => {
       models: CLAUDE_SESSION_OPTION_CATALOG.models,
       record,
       mode: 'live',
-      modelLabel: 'Model'
+      modelLabel: 'Model',
+      liveTransport: 'catalog'
     })
     expect(snapshot.map((descriptor) => descriptor.id)).toEqual(['model', 'effort'])
     expect(snapshot[0]).toMatchObject({ valueSource: 'dispatched' })
@@ -66,7 +94,8 @@ describe('buildNativeChatSessionOptionSnapshot', () => {
       models: CLAUDE_SESSION_OPTION_CATALOG.models,
       record,
       mode: 'live',
-      modelLabel: 'Model'
+      modelLabel: 'Model',
+      liveTransport: 'catalog'
     })
     const model = snapshot[0]!
     if (model.kind.type !== 'select') {
@@ -84,7 +113,8 @@ describe('buildNativeChatSessionOptionSnapshot', () => {
         models: [],
         record: claudeRecord(),
         mode: 'live',
-        modelLabel: 'Model'
+        modelLabel: 'Model',
+        liveTransport: 'catalog'
       })
     ).toEqual([])
   })
@@ -136,7 +166,8 @@ describe('buildNativeChatSessionOptionSnapshot', () => {
         models: reconciled,
         record,
         mode: 'live',
-        modelLabel: 'Model'
+        modelLabel: 'Model',
+        liveTransport: 'catalog'
       })
       const model = snapshot[0]!
       if (model.kind.type !== 'select') {
@@ -197,7 +228,8 @@ describe('buildNativeChatSessionOptionSnapshot', () => {
         models: reconciled,
         record,
         mode: 'live',
-        modelLabel: 'Model'
+        modelLabel: 'Model',
+        liveTransport: 'catalog'
       })
       expect(snapshot.map((descriptor) => descriptor.id)).toEqual(['model', 'effort'])
       expect(resolveAgentSessionOptionLaunch('grok', { model: 'grok-4.5' }).args).toEqual([
@@ -215,7 +247,8 @@ describe('buildNativeChatSessionOptionSnapshot', () => {
       models: CODEX_SESSION_OPTION_CATALOG.models,
       record: createNativeChatSessionOptionRecord('codex'),
       mode: 'live',
-      modelLabel: 'Model'
+      modelLabel: 'Model',
+      liveTransport: 'catalog'
     })
     expect(snapshot[0]).toMatchObject({ settable: true })
     expect(snapshot[0]?.action).toEqual({ type: 'agent-picker' })
@@ -233,7 +266,8 @@ describe('buildNativeChatSessionOptionSnapshot', () => {
       models: CLAUDE_SESSION_OPTION_CATALOG.models,
       record,
       mode: 'live',
-      modelLabel: 'Model'
+      modelLabel: 'Model',
+      liveTransport: 'catalog'
     })
     const fastMode = snapshot.find((descriptor) => descriptor.id === 'fastMode')
     expect(fastMode).toMatchObject({ action: { type: 'toggle-command' } })
@@ -250,7 +284,8 @@ describe('defaults on load', () => {
       models,
       record: createNativeChatSessionOptionRecord('grok'),
       mode,
-      modelLabel: 'Model'
+      modelLabel: 'Model',
+      liveTransport: 'catalog'
     })
 
   it('shows the default model before anything is picked', () => {
@@ -299,7 +334,8 @@ describe('defaults on load', () => {
       ],
       record,
       mode: 'draft',
-      modelLabel: 'Model'
+      modelLabel: 'Model',
+      liveTransport: 'catalog'
     })
     expect(snapshot[0]).toMatchObject({ valueSource: 'dispatched' })
     expect(snapshot[0]!.kind.type === 'select' ? snapshot[0]!.kind.currentValue : null).toBe(
@@ -315,7 +351,8 @@ describe('defaults on load', () => {
       models: CLAUDE_SESSION_OPTION_CATALOG.models,
       record: claudeRecord(),
       mode: 'draft',
-      modelLabel: 'Model'
+      modelLabel: 'Model',
+      liveTransport: 'catalog'
     })
     expect(CLAUDE_SESSION_OPTION_CATALOG.models.some((model) => model.isDefault)).toBe(true)
     expect(CLAUDE_SESSION_OPTION_CATALOG.defaultModelIsCliDefault).toBeUndefined()
@@ -332,7 +369,8 @@ describe('defaults on load', () => {
       models: CLAUDE_SESSION_OPTION_CATALOG.models,
       record,
       mode: 'draft',
-      modelLabel: 'Model'
+      modelLabel: 'Model',
+      liveTransport: 'catalog'
     })
     const effort = snapshot.find((descriptor) => descriptor.id === 'effort')
     expect(effort).toMatchObject({ valueSource: 'default' })
diff --git a/src/shared/native-chat-session-option-snapshot.ts b/src/shared/native-chat-session-option-snapshot.ts
index 76556211ab0..9fba42cf897 100644
--- a/src/shared/native-chat-session-option-snapshot.ts
+++ b/src/shared/native-chat-session-option-snapshot.ts
@@ -5,6 +5,7 @@ import type {
   CatalogOption
 } from './agent-session-option-catalog'
 import type {
+  NativeChatLiveOptionTransport,
   SessionOptionDescriptor,
   SessionOptionSelectChoice
 } from './native-chat-session-options'
@@ -15,7 +16,7 @@ import {
 } from './native-chat-session-option-state'
 
 export type NativeChatSessionOptionMode = 'draft' | 'live'
-export type NativeChatLiveOptionTransport = 'catalog' | 'agent-session'
+export type { NativeChatLiveOptionTransport }
 
 function choiceWithCurrent(
   choices: readonly SessionOptionSelectChoice[],
@@ -107,6 +108,7 @@ function optionDescriptor(args: {
         choices
       },
       valueSource,
+      transport: liveTransport,
       ...settable,
       ...(action ? { action } : {})
     }
@@ -127,6 +129,7 @@ function optionDescriptor(args: {
       ...(currentValue === undefined ? {} : { currentValue })
     },
     valueSource,
+    transport: liveTransport,
     ...settable,
     ...(action ? { action } : {})
   }
@@ -202,9 +205,11 @@ export function buildNativeChatSessionOptionSnapshot(args: {
   record: NativeChatSessionOptionRecord
   mode: NativeChatSessionOptionMode
   modelLabel: string
-  liveTransport?: NativeChatLiveOptionTransport
+  /** Required, not defaulted: this is the only place a descriptor is built, so a
+   *  producer that must state its lane here cannot silently inherit the other's. */
+  liveTransport: NativeChatLiveOptionTransport
 }): SessionOptionDescriptor[] {
-  const { catalog, models, record, mode, modelLabel, liveTransport = 'catalog' } = args
+  const { catalog, models, record, mode, modelLabel, liveTransport } = args
   if (models.length === 0) {
     return []
   }
@@ -232,6 +237,7 @@ export function buildNativeChatSessionOptionSnapshot(args: {
         choices: modelChoices
       },
       valueSource: modelTracked?.source ?? (defaultModelId ? 'default' : 'unknown'),
+      transport: liveTransport,
       ...settableState({ mode, liveTransport, apply: catalog.modelApply }),
       ...(modelAction ? { action: modelAction } : {})
     }
diff --git a/src/shared/native-chat-session-option-state.ts b/src/shared/native-chat-session-option-state.ts
index 78b70980270..5d070969775 100644
--- a/src/shared/native-chat-session-option-state.ts
+++ b/src/shared/native-chat-session-option-state.ts
@@ -122,25 +122,30 @@ export function flattenNativeChatSessionOptionRecord(
 
 export function applyNativeChatReportedSessionOptions(
   record: NativeChatSessionOptionRecord,
-  values: Record<string, SessionOptionValue>
+  values: Record<string, SessionOptionValue>,
+  /** Ids the provider reported back. Omitted means every value is a report, which
+   *  is what a surface that only ever learns values by reading them sends. */
+  confirmed?: readonly string[]
 ): boolean {
+  const sourceFor = (id: string): TrackedNativeChatSessionOption['source'] =>
+    confirmed === undefined || confirmed.includes(id) ? 'reported' : 'dispatched'
   const modelId = typeof values.model === 'string' ? values.model : null
   if (!modelId) {
     return false
   }
   const modelChanged = record.model?.value !== modelId
-  let changed = modelChanged || record.model?.source !== 'reported'
-  record.model = { value: modelId, source: 'reported' }
+  let changed = modelChanged || record.model?.source !== sourceFor('model')
+  record.model = { value: modelId, source: sourceFor('model') }
   const modelValues = modelChanged ? {} : { ...record.valuesByModel[modelId] }
   for (const [id, value] of Object.entries(values)) {
     if (id === 'model') {
       continue
     }
     const current = modelValues[id]
-    if (current?.value !== value || current.source !== 'reported') {
+    if (current?.value !== value || current.source !== sourceFor(id)) {
       changed = true
     }
-    modelValues[id] = { value, source: 'reported' }
+    modelValues[id] = { value, source: sourceFor(id) }
   }
   record.valuesByModel[modelId] = modelValues
   return changed
diff --git a/src/shared/native-chat-session-options.ts b/src/shared/native-chat-session-options.ts
index 84b23dcba06..33567d39131 100644
--- a/src/shared/native-chat-session-options.ts
+++ b/src/shared/native-chat-session-options.ts
@@ -7,9 +7,17 @@ export type SessionOptionSelectChoice = {
 }
 
 /** `default` is the catalog's own value shown before anything is observed —
- *  truthful to display, but never evidence about a running agent. */
+ *  truthful to display, but never evidence about a running agent. `dispatched`
+ *  is sent-but-unread: the pill shows it, and a later report that disagrees is
+ *  what corrects it. Both transports emit it, so it alone names neither — see
+ *  `transport` on the descriptor. */
 export type SessionOptionValueSource = 'applied' | 'dispatched' | 'reported' | 'default' | 'unknown'
 
+/** How a live value reaches the agent. `catalog` types the catalog's command into
+ *  the agent's terminal and can only learn the outcome by parsing the screen back;
+ *  `agent-session` writes over the structured protocol, which reports every turn. */
+export type NativeChatLiveOptionTransport = 'catalog' | 'agent-session'
+
 /** Closed set of reasons an option is not settable in the current mode. A key
  *  (not free English) so the producer and the localized label stay in sync —
  *  an exhaustive switch turns any drift into a type error instead of leaking
@@ -34,6 +42,9 @@ export type SessionOptionDescriptor = {
         currentValue?: boolean
       }
   valueSource: SessionOptionValueSource
+  /** Required so a new producer cannot inherit the wrong lane's rendering by
+   *  omission — `dispatched` is emitted identically by both and cannot discriminate. */
+  transport: NativeChatLiveOptionTransport
   settable: boolean
   disabledReason?: SessionOptionDisabledReason
   /** Why: picker-only and toggle-only PTY commands cannot be represented as
@@ -41,6 +52,15 @@ export type SessionOptionDescriptor = {
   action?: { type: 'agent-picker' | 'toggle-command' }
 }
 
+/** A value we typed at the agent and have never read back. Only the terminal
+ *  transport can be in this state: the structured lane's own per-turn report is
+ *  what moves a value off `dispatched`, and until it lands nothing else has. */
+export function sessionOptionDispatchUnconfirmed(
+  descriptor: Pick<SessionOptionDescriptor, 'valueSource' | 'transport'>
+): boolean {
+  return descriptor.valueSource === 'dispatched' && descriptor.transport === 'catalog'
+}
+
 export type SessionOptionSetResult = {
   snapshot: SessionOptionDescriptor[]
 }
diff --git a/src/shared/native-chat-tool-activity.test.ts b/src/shared/native-chat-tool-activity.test.ts
new file mode 100644
index 00000000000..915e2b69729
--- /dev/null
+++ b/src/shared/native-chat-tool-activity.test.ts
@@ -0,0 +1,109 @@
+import { describe, expect, it } from 'vitest'
+import type { NativeChatBlock } from './native-chat-types'
+import {
+  describeActiveToolCall,
+  formatActiveToolLabel,
+  formatToolCallCount,
+  isCommandToolName,
+  selectActiveToolCall
+} from './native-chat-tool-activity'
+
+function call(
+  name: string,
+  input: unknown,
+  state?: 'running' | 'completed' | 'failed'
+): Extract<NativeChatBlock, { type: 'tool-call' }> {
+  return { type: 'tool-call', name, input, ...(state ? { state } : {}) } as Extract<
+    NativeChatBlock,
+    { type: 'tool-call' }
+  >
+}
+
+describe('isCommandToolName', () => {
+  it('matches the shell-running tools regardless of case or padding', () => {
+    expect(isCommandToolName('bash')).toBe(true)
+    expect(isCommandToolName('  Bash ')).toBe(true)
+    expect(isCommandToolName('run_terminal_cmd')).toBe(true)
+  })
+
+  it('does not match a named tool', () => {
+    expect(isCommandToolName('Read')).toBe(false)
+    expect(isCommandToolName('')).toBe(false)
+  })
+})
+
+describe('describeActiveToolCall / formatActiveToolLabel', () => {
+  it('drops the tool name for a shell command with a preview', () => {
+    const descriptor = describeActiveToolCall(call('Bash', { command: 'npm test' }))
+    expect(descriptor.key).toBe('runningPreview')
+    expect(descriptor.isCommand).toBe(true)
+    expect(formatActiveToolLabel(descriptor)).toBe('Running npm test')
+  })
+
+  it('falls back to a generic command label when there is no preview', () => {
+    const descriptor = describeActiveToolCall(call('bash', null))
+    expect(descriptor.key).toBe('runningCommand')
+    expect(formatActiveToolLabel(descriptor)).toBe('Running command')
+  })
+
+  it('keeps the tool name for a non-command tool', () => {
+    const descriptor = describeActiveToolCall(call('Read', { file_path: 'a/b.ts' }))
+    expect(descriptor.key).toBe('runningNamedPreview')
+    expect(descriptor.isCommand).toBe(false)
+    expect(formatActiveToolLabel(descriptor)).toBe('Running Read a/b.ts')
+  })
+
+  it('names a previewless tool on its own', () => {
+    const descriptor = describeActiveToolCall(call('Think', null))
+    expect(descriptor.key).toBe('runningNamed')
+    expect(formatActiveToolLabel(descriptor)).toBe('Running Think')
+  })
+})
+
+describe('selectActiveToolCall', () => {
+  it('returns nothing once the turn is known to have ended', () => {
+    const blocks = [call('Bash', { command: 'x' }, 'running')]
+    expect(selectActiveToolCall(blocks, { activeTurnIsWorking: false })).toBeNull()
+  })
+
+  it('picks the latest explicitly running call', () => {
+    const blocks = [
+      call('Read', { file_path: 'a' }, 'completed'),
+      call('Bash', { command: 'x' }, 'running'),
+      call('Grep', { pattern: 'y' }, 'running')
+    ]
+    expect(selectActiveToolCall(blocks, { activeTurnIsWorking: true })?.name).toBe('Grep')
+  })
+
+  it('ignores settled calls even while the turn works', () => {
+    const blocks = [call('Read', { file_path: 'a' }, 'completed')]
+    expect(selectActiveToolCall(blocks, { activeTurnIsWorking: true })).toBeNull()
+  })
+
+  it('treats a lifecycle-less call as running only while the turn works', () => {
+    const blocks = [call('Read', { file_path: 'a' })]
+    expect(selectActiveToolCall(blocks, { activeTurnIsWorking: true })?.name).toBe('Read')
+    expect(selectActiveToolCall(blocks, { activeTurnIsWorking: undefined })).toBeNull()
+  })
+
+  it('still surfaces an explicitly running call when the turn state is unknown', () => {
+    const blocks = [call('Bash', { command: 'x' }, 'running')]
+    expect(selectActiveToolCall(blocks, { activeTurnIsWorking: undefined })?.name).toBe('Bash')
+  })
+
+  it('skips non-tool-call blocks', () => {
+    const blocks: NativeChatBlock[] = [
+      { type: 'text', text: 'hello' },
+      call('Bash', { command: 'x' }, 'running')
+    ]
+    expect(selectActiveToolCall(blocks, { activeTurnIsWorking: true })?.name).toBe('Bash')
+  })
+})
+
+describe('formatToolCallCount', () => {
+  it('singularizes one call', () => {
+    expect(formatToolCallCount(1)).toBe('1 tool call')
+    expect(formatToolCallCount(4)).toBe('4 tool calls')
+    expect(formatToolCallCount(0)).toBe('0 tool calls')
+  })
+})
diff --git a/src/shared/native-chat-tool-activity.ts b/src/shared/native-chat-tool-activity.ts
new file mode 100644
index 00000000000..533dd75aecf
--- /dev/null
+++ b/src/shared/native-chat-tool-activity.ts
@@ -0,0 +1,97 @@
+// Live tool-activity derivation and copy for the native-chat "Running …" row,
+// shared by the desktop renderer (as its i18n fallback strings) and the mobile
+// app (used directly — mobile ships English only) so the two surfaces never drift.
+
+import { createToolInputDisplay } from './native-chat-tool-summary'
+import { isToolCallBlock, type NativeChatBlock } from './native-chat-types'
+
+type NativeChatToolCallBlock = Extract<NativeChatBlock, { type: 'tool-call' }>
+
+export const NATIVE_CHAT_TOOL_ACTIVITY_COPY = {
+  runningPreview: 'Running {{preview}}',
+  runningCommand: 'Running command',
+  runningNamedPreview: 'Running {{toolName}} {{preview}}',
+  runningNamed: 'Running {{toolName}}',
+  countOne: '1 tool call',
+  countN: '{{value0}} tool calls'
+} as const
+
+/** Tools whose call is a shell command, so the row reads as terminal activity
+ *  (and takes the terminal glyph) rather than a named tool invocation. */
+export const COMMAND_TOOL_NAMES: ReadonlySet<string> = new Set([
+  'bash',
+  'shell',
+  'powershell',
+  'terminal',
+  'execute',
+  'run_command',
+  'run_shell_command',
+  'shell_command',
+  'exec_command',
+  'run_terminal_cmd',
+  'run_terminal_command'
+])
+
+export function isCommandToolName(name: string): boolean {
+  return COMMAND_TOOL_NAMES.has(name.trim().toLowerCase())
+}
+
+export type NativeChatActiveToolDescriptor = {
+  key: 'runningPreview' | 'runningCommand' | 'runningNamedPreview' | 'runningNamed'
+  toolName: string
+  preview: string
+  isCommand: boolean
+}
+
+/** Which copy key and arguments the active-tool row renders for a running call. */
+export function describeActiveToolCall(
+  call: NativeChatToolCallBlock
+): NativeChatActiveToolDescriptor {
+  const preview = createToolInputDisplay(call.input).label
+  const isCommand = isCommandToolName(call.name)
+  const key = isCommand
+    ? preview
+      ? 'runningPreview'
+      : 'runningCommand'
+    : preview
+      ? 'runningNamedPreview'
+      : 'runningNamed'
+  return { key, toolName: call.name, preview, isCommand }
+}
+
+/** Resolve the active-tool label in English. For platforms without i18n (mobile). */
+export function formatActiveToolLabel(descriptor: NativeChatActiveToolDescriptor): string {
+  return NATIVE_CHAT_TOOL_ACTIVITY_COPY[descriptor.key]
+    .replaceAll('{{preview}}', descriptor.preview)
+    .replaceAll('{{toolName}}', descriptor.toolName)
+}
+
+/** The most recent still-running call in a run, or null once the run is settled.
+ *  A block without lifecycle `state` only counts while the turn is known to be
+ *  working, so a restored transcript never spins on an orphaned call. */
+export function selectActiveToolCall(
+  blocks: readonly NativeChatBlock[],
+  { activeTurnIsWorking }: { activeTurnIsWorking?: boolean }
+): NativeChatToolCallBlock | null {
+  if (activeTurnIsWorking === false) {
+    return null
+  }
+  const calls = blocks.filter(isToolCallBlock)
+  for (let index = calls.length - 1; index >= 0; index--) {
+    const call = calls[index]
+    if (
+      call &&
+      (call.state === 'running' || (call.state == null && activeTurnIsWorking === true))
+    ) {
+      return call
+    }
+  }
+  return null
+}
+
+/** Fallback summary when no per-tool summary is available. */
+export function formatToolCallCount(callCount: number): string {
+  return callCount === 1
+    ? NATIVE_CHAT_TOOL_ACTIVITY_COPY.countOne
+    : NATIVE_CHAT_TOOL_ACTIVITY_COPY.countN.replaceAll('{{value0}}', String(callCount))
+}
diff --git a/src/shared/native-chat-tool-icon.test.ts b/src/shared/native-chat-tool-icon.test.ts
new file mode 100644
index 00000000000..78a6107c86d
--- /dev/null
+++ b/src/shared/native-chat-tool-icon.test.ts
@@ -0,0 +1,247 @@
+import { describe, expect, it } from 'vitest'
+import {
+  isShellActivityToolCall,
+  NATIVE_CHAT_TOOL_ICON_NAMES,
+  nativeChatToolCategory,
+  nativeChatToolIconName,
+  nativeChatToolRunCategory,
+  nativeChatToolRunIconName,
+  type NativeChatToolCategory
+} from './native-chat-tool-icon'
+
+const ALL_CATEGORIES: NativeChatToolCategory[] = [
+  'read',
+  'search',
+  'listFiles',
+  'unknown',
+  'fileChange',
+  'webSearch',
+  'mcpToolCall',
+  'subAgentActivity',
+  'todoList',
+  'other'
+]
+
+describe('native chat tool icons', () => {
+  it('names a glyph for every category in the vocabulary', () => {
+    expect(NATIVE_CHAT_TOOL_ICON_NAMES).toEqual({
+      read: 'eye',
+      search: 'search',
+      listFiles: 'folder',
+      unknown: 'square-terminal',
+      fileChange: 'pencil',
+      webSearch: 'globe',
+      mcpToolCall: 'plug',
+      subAgentActivity: 'bot',
+      todoList: 'list-checks',
+      other: 'wrench'
+    })
+    expect(Object.keys(NATIVE_CHAT_TOOL_ICON_NAMES).sort()).toEqual([...ALL_CATEGORIES].sort())
+  })
+
+  it('gives each category a distinct glyph so rows are told apart by icon', () => {
+    const glyphs = ALL_CATEGORIES.map((category) => NATIVE_CHAT_TOOL_ICON_NAMES[category])
+    expect(new Set(glyphs).size).toBe(glyphs.length)
+  })
+
+  it('maps the row words the Codex lane renders to their category', () => {
+    expect(nativeChatToolCategory('read')).toBe('read')
+    expect(nativeChatToolCategory('search')).toBe('search')
+    expect(nativeChatToolCategory('list')).toBe('listFiles')
+    expect(nativeChatToolCategory('shell')).toBe('unknown')
+    expect(nativeChatToolCategory('apply_patch')).toBe('fileChange')
+    expect(nativeChatToolCategory('web search')).toBe('webSearch')
+  })
+
+  it('maps the tool names the Claude lane renders verbatim', () => {
+    expect(nativeChatToolIconName('Read')).toBe('eye')
+    expect(nativeChatToolIconName('Bash')).toBe('square-terminal')
+    expect(nativeChatToolIconName('Grep')).toBe('search')
+    expect(nativeChatToolIconName('Glob')).toBe('search')
+    expect(nativeChatToolIconName('Task')).toBe('bot')
+    expect(nativeChatToolIconName('WebFetch')).toBe('globe')
+    expect(nativeChatToolIconName('TodoWrite')).toBe('list-checks')
+  })
+
+  it('reads the whole edit family from the shared set, not a parallel list', () => {
+    for (const name of ['Edit', 'MultiEdit', 'Write', 'str_replace', 'apply_patch']) {
+      expect(nativeChatToolCategory(name)).toBe('fileChange')
+      expect(nativeChatToolIconName(name)).toBe('pencil')
+    }
+  })
+
+  it('reads the projected `Diff` row as a file change, which is what it renders', () => {
+    // Every Codex fileChange item projects to a call named `Diff`, so a wrench
+    // here headed a run whose body is an edited-file card.
+    expect(nativeChatToolCategory('Diff')).toBe('fileChange')
+    expect(nativeChatToolIconName('Diff')).toBe('pencil')
+  })
+
+  it('reads an MCP tool by its prefix, since the row is named after the tool', () => {
+    expect(nativeChatToolCategory('mcp__linear__create_issue')).toBe('mcpToolCall')
+    expect(nativeChatToolIconName('mcp__playwright__browser_click')).toBe('plug')
+    // Not a prefix match: a tool merely mentioning mcp is not an MCP call.
+    expect(nativeChatToolCategory('run_mcp__thing')).toBeNull()
+  })
+
+  it('resolves the glyph for each classified row word', () => {
+    expect(nativeChatToolIconName('read')).toBe('eye')
+    expect(nativeChatToolIconName('search')).toBe('search')
+    expect(nativeChatToolIconName('list')).toBe('folder')
+    expect(nativeChatToolIconName('shell')).toBe('square-terminal')
+    expect(nativeChatToolIconName('edit')).toBe('pencil')
+    expect(nativeChatToolIconName('web search')).toBe('globe')
+  })
+
+  it('reads a row word regardless of case or surrounding space', () => {
+    expect(nativeChatToolIconName('  Read ')).toBe('eye')
+    expect(nativeChatToolIconName('WebSearch')).toBe('globe')
+  })
+
+  it('falls back to the generic tool glyph, not the terminal, outside the vocabulary', () => {
+    // Claiming a terminal here would assert a shell ran when nothing says one did.
+    expect(nativeChatToolCategory('AskUserQuestion')).toBeNull()
+    expect(nativeChatToolIconName('AskUserQuestion')).toBe('wrench')
+    expect(nativeChatToolIconName('')).toBe('wrench')
+  })
+
+  it('keeps the terminal glyph for a row that really ran a command', () => {
+    // `exec` and `local_shell` are how the Codex rollout transcript names a
+    // shell call; `native-chat-edit-normalize` already calls the three command
+    // tools by those words, so a wrench on one would deny a command that ran.
+    for (const name of ['shell', 'bash', 'run_terminal_cmd', 'exec', 'local_shell']) {
+      expect(nativeChatToolCategory(name)).toBe('unknown')
+      expect(nativeChatToolIconName(name)).toBe('square-terminal')
+    }
+  })
+
+  describe('terminal activity for a two-glyph lane', () => {
+    // Mobile has only a terminal and a wrench, so it asks this instead of
+    // `nativeChatToolIconName`. The row word alone cannot answer it: Codex's
+    // classified `read` and Claude's `Read` are the same word lowercased.
+
+    it('reads a classified Codex row as terminal activity, by the command it kept', () => {
+      for (const [name, fields] of [
+        ['read', { path: 'src/app.ts' }],
+        ['search', { query: 'todo', directory: 'src' }],
+        ['list', { directory: 'src' }]
+      ] as const) {
+        expect(
+          isShellActivityToolCall({
+            name,
+            input: { command: 'rg todo src', cwd: '/repo', ...fields }
+          })
+        ).toBe(true)
+      }
+    })
+
+    it('reads an unclassified shell row as terminal activity, by its name', () => {
+      for (const name of ['shell', 'bash', 'Bash', 'run_terminal_cmd']) {
+        expect(isShellActivityToolCall({ name, input: null })).toBe(true)
+      }
+    })
+
+    it('reads a rollout-transcript shell call as terminal activity', () => {
+      // `exec` and `local_shell` are not command tool names, so only the argv
+      // command in their input says a shell ran.
+      expect(
+        isShellActivityToolCall({ name: 'exec', input: '{"command":["bash","-lc","ls"]}' })
+      ).toBe(true)
+      expect(
+        isShellActivityToolCall({ name: 'local_shell', input: { command: ['bash', '-lc', 'ls'] } })
+      ).toBe(true)
+    })
+
+    it('leaves a Claude filesystem tool a generic tool, since no command ran', () => {
+      expect(
+        isShellActivityToolCall({ name: 'Read', input: { file_path: '/repo/src/app.ts' } })
+      ).toBe(false)
+      expect(
+        isShellActivityToolCall({ name: 'Grep', input: { pattern: 'todo', path: 'src' } })
+      ).toBe(false)
+      expect(isShellActivityToolCall({ name: 'Glob', input: { pattern: '**/*.ts' } })).toBe(false)
+    })
+
+    it('leaves an unmodelled tool a generic tool', () => {
+      expect(
+        isShellActivityToolCall({ name: 'AskUserQuestion', input: { question: 'which?' } })
+      ).toBe(false)
+      for (const name of ['Edit', 'Diff', 'Task', 'WebFetch', 'TodoWrite', '']) {
+        expect(isShellActivityToolCall({ name, input: { file_path: 'a.ts' } })).toBe(false)
+      }
+    })
+
+    it('answers false for an input that carries no command, whatever its shape', () => {
+      for (const input of [
+        null,
+        undefined,
+        'ls -la',
+        42,
+        ['bash', '-lc', 'ls'],
+        {},
+        { cwd: '/r' }
+      ]) {
+        expect(isShellActivityToolCall({ name: 'read', input })).toBe(false)
+      }
+      // A present-but-blank command is not a command that ran.
+      expect(isShellActivityToolCall({ name: 'read', input: { command: '   ' } })).toBe(false)
+      expect(isShellActivityToolCall({ name: 'read', input: { command: null } })).toBe(false)
+    })
+  })
+
+  describe('the glyph over a whole run', () => {
+    // A run header stands over a summary of the run's first calls, so its glyph
+    // may only claim a category every call in the run shares.
+
+    it('keeps the category when every call in the run is of it', () => {
+      const run = [{ name: 'Read' }, { name: 'read' }, { name: '  Read  ' }]
+
+      expect(nativeChatToolRunCategory(run)).toBe('read')
+      expect(nativeChatToolRunIconName(run)).toBe('eye')
+    })
+
+    it('reads a run of differently-named shell calls as one shell run', () => {
+      // The categories agree even though the words do not, so the run is still
+      // one thing and keeps the terminal.
+      const run = [{ name: 'shell' }, { name: 'Bash' }, { name: 'local_shell' }]
+
+      expect(nativeChatToolRunCategory(run)).toBe('unknown')
+      expect(nativeChatToolRunIconName(run)).toBe('square-terminal')
+    })
+
+    it('falls back to the generic tool glyph when the run spans categories', () => {
+      const run = [{ name: 'shell' }, { name: 'Read' }]
+
+      expect(nativeChatToolRunCategory(run)).toBeNull()
+      // Either category here would describe only part of the run.
+      expect(nativeChatToolRunIconName(run)).toBe('wrench')
+      // Order does not make one call speak for the rest.
+      expect(nativeChatToolRunIconName([{ name: 'Read' }, { name: 'shell' }])).toBe('wrench')
+    })
+
+    it('takes a single call at its own category', () => {
+      expect(nativeChatToolRunCategory([{ name: 'Grep' }])).toBe('search')
+      expect(nativeChatToolRunIconName([{ name: 'Grep' }])).toBe('search')
+      expect(nativeChatToolRunIconName([{ name: 'apply_patch' }])).toBe('pencil')
+    })
+
+    it('reads a run of unmodelled tools as the generic category, not as spanning', () => {
+      const run = [{ name: 'AskUserQuestion' }, { name: 'SomeOtherTool' }]
+
+      expect(nativeChatToolRunCategory(run)).toBe('other')
+      expect(nativeChatToolRunIconName(run)).toBe('wrench')
+    })
+
+    it('has no glyph to give a run with no tool calls', () => {
+      expect(nativeChatToolRunCategory([])).toBeNull()
+      // Null, not a wrench: an empty header shows no glyph rather than a false one.
+      expect(nativeChatToolRunIconName([])).toBeNull()
+    })
+  })
+
+  it('does not answer a prototype key with a glyph', () => {
+    expect(nativeChatToolCategory('__proto__')).toBeNull()
+    expect(nativeChatToolCategory('constructor')).toBeNull()
+    expect(nativeChatToolIconName('__proto__')).toBe('wrench')
+  })
+})
diff --git a/src/shared/native-chat-tool-icon.ts b/src/shared/native-chat-tool-icon.ts
new file mode 100644
index 00000000000..60ca81bc901
--- /dev/null
+++ b/src/shared/native-chat-tool-icon.ts
@@ -0,0 +1,155 @@
+/**
+ * The category vocabulary for native-chat tool rows, and the one glyph each
+ * category keeps. A row is `icon + word + argument`: the icon is decorative and
+ * the word carries identity, so a renderer must never draw the glyph alone.
+ *
+ * The glyph is fixed per category across running/completed/failed — only tone
+ * changes, plus a trailing mark on failure. A row that swapped glyphs when it
+ * finished would read as changing identity.
+ */
+import { EDIT_TOOL_NAMES } from './native-chat-diff'
+import { isCommandToolName } from './native-chat-tool-activity'
+import { toolInputCommand } from './native-chat-tool-summary'
+
+export type NativeChatToolCategory =
+  | 'read'
+  | 'search'
+  | 'listFiles'
+  /** A shell command that ran unclassified — Codex's own word for one. */
+  | 'unknown'
+  | 'fileChange'
+  | 'webSearch'
+  | 'mcpToolCall'
+  | 'subAgentActivity'
+  | 'todoList'
+  /** A tool this vocabulary doesn't model. Distinct from `unknown`: claiming a
+   *  terminal for it would assert a shell ran when nothing says one did. */
+  | 'other'
+
+/** lucide glyph ids. Spelled the same by `lucide-react` and `lucide-react-native`,
+ *  so desktop and mobile can resolve one name to their own component. */
+export type NativeChatToolIconName =
+  | 'eye'
+  | 'search'
+  | 'folder'
+  | 'square-terminal'
+  | 'pencil'
+  | 'globe'
+  | 'plug'
+  | 'bot'
+  | 'list-checks'
+  | 'wrench'
+
+/** Category to glyph. */
+export const NATIVE_CHAT_TOOL_ICON_NAMES: Record<NativeChatToolCategory, NativeChatToolIconName> = {
+  read: 'eye',
+  search: 'search',
+  listFiles: 'folder',
+  unknown: 'square-terminal',
+  fileChange: 'pencil',
+  webSearch: 'globe',
+  mcpToolCall: 'plug',
+  subAgentActivity: 'bot',
+  todoList: 'list-checks',
+  other: 'wrench'
+}
+
+/**
+ * Row word to category, keyed by the word a lane actually renders rather than by
+ * the protocol type, because that word is all a row model carries. The edit
+ * family and the command tools come from their own shared sets below, so this
+ * table holds only what neither of those already names.
+ * A `Map`, not an object: an object index answers `__proto__` with a truthy value.
+ */
+const CATEGORY_BY_ROW_WORD = new Map<string, NativeChatToolCategory>([
+  // Codex's classified shell rows.
+  ['read', 'read'],
+  ['search', 'search'],
+  ['list', 'listFiles'],
+  // Codex's rollout-transcript names for a shell call, which the activity set
+  // below does not carry: `isCommandToolName` also picks the running row's copy,
+  // and this vocabulary only picks a glyph.
+  ['exec', 'unknown'],
+  ['local_shell', 'unknown'],
+  // Every Codex file change projects as a `Diff` call, and the edit set below
+  // names the tools that carry the edit in their input, not that projection.
+  ['diff', 'fileChange'],
+  // Claude's tool names, which its lane renders verbatim.
+  ['grep', 'search'],
+  ['glob', 'search'],
+  ['task', 'subAgentActivity'],
+  ['webfetch', 'webSearch'],
+  ['todowrite', 'todoList'],
+  ['web search', 'webSearch'],
+  ['websearch', 'webSearch']
+])
+
+/** The edit family, lowercased for row-word matching. Deliberately not
+ *  `isEditToolName`: that predicate answers "could this input wrap a patch",
+ *  which is true of command tools too, and a shell row is not an edit. */
+const EDIT_ROW_WORDS = new Set([...EDIT_TOOL_NAMES].map((name) => name.toLowerCase()))
+
+/** MCP tools arrive as `mcp__<server>__<tool>` and the row is named after the
+ *  tool, so only the prefix identifies one. */
+const MCP_TOOL_PREFIX = 'mcp__'
+
+/** The category a row word names, or null when the lane emitted something this
+ *  vocabulary doesn't model yet. */
+export function nativeChatToolCategory(rowWord: string): NativeChatToolCategory | null {
+  const word = rowWord.trim().toLowerCase()
+  if (word.startsWith(MCP_TOOL_PREFIX)) {
+    return 'mcpToolCall'
+  }
+  // Before the edit family: a command tool runs whatever it is handed, so a
+  // patch in its input is not evidence the row is an edit.
+  if (isCommandToolName(word)) {
+    return 'unknown'
+  }
+  return CATEGORY_BY_ROW_WORD.get(word) ?? (EDIT_ROW_WORDS.has(word) ? 'fileChange' : null)
+}
+
+/** The glyph for a row word. Never empty, so rows stay left-aligned: a word
+ *  outside the vocabulary takes the generic tool glyph, and only a row that
+ *  really ran a command claims the terminal. */
+export function nativeChatToolIconName(rowWord: string): NativeChatToolIconName {
+  return NATIVE_CHAT_TOOL_ICON_NAMES[nativeChatToolCategory(rowWord) ?? 'other']
+}
+
+/** The one category every call in a run shares, or null when the run spans
+ *  categories or holds no calls. A run header names the whole run, not any one
+ *  call in it, so it may only claim a category true of all of them. */
+export function nativeChatToolRunCategory(
+  calls: readonly { name: string }[]
+): NativeChatToolCategory | null {
+  let shared: NativeChatToolCategory | null = null
+  for (const call of calls) {
+    const category = nativeChatToolCategory(call.name) ?? 'other'
+    if (shared !== null && shared !== category) {
+      return null
+    }
+    shared = category
+  }
+  return shared
+}
+
+/** The glyph for a run header: the shared category's glyph, the generic tool
+ *  glyph for a run that spans categories, and null when the run has no tool
+ *  call to describe and so heads with no glyph at all. */
+export function nativeChatToolRunIconName(
+  calls: readonly { name: string }[]
+): NativeChatToolIconName | null {
+  if (calls.length === 0) {
+    return null
+  }
+  return NATIVE_CHAT_TOOL_ICON_NAMES[nativeChatToolRunCategory(calls) ?? 'other']
+}
+
+/** Whether a call reads as terminal activity, for a lane with no per-category
+ *  glyph (mobile) that only chooses between a terminal and a generic tool.
+ *  The row word cannot decide it alone: Codex names a classified shell row
+ *  `read` / `search` / `list`, which lowercase to Claude's own `Read` / `Grep` /
+ *  `Glob`, and those ran no command. So the input breaks the tie — Codex keeps
+ *  the command it ran, while Claude's `Read` carries only a file path. */
+export function isShellActivityToolCall(call: { name: string; input?: unknown }): boolean {
+  return isCommandToolName(call.name) || toolInputCommand(call.input) !== null
+}
diff --git a/src/shared/native-chat-tool-summary.test.ts b/src/shared/native-chat-tool-summary.test.ts
index 57cc5eff074..f11481b1136 100644
--- a/src/shared/native-chat-tool-summary.test.ts
+++ b/src/shared/native-chat-tool-summary.test.ts
@@ -133,6 +133,35 @@ describe('describeToolInput', () => {
       'https://example.com'
     )
     expect(briefToolArg({ cmd: '', query: 'needle' })).toBe('needle')
+    // Inverted, so the skip is still exercised now that the search keys rank first.
+    expect(describeToolInput({ query: '', command: 'git status' })).toBe('git status')
+    expect(briefToolArg({ pattern: '   ', cmd: 'git status' })).toBe('git status')
+  })
+
+  it('labels a classified search row by its term, not the command that ran it', () => {
+    // Codex `commandActions` rows are the only input carrying both keys: the
+    // search term identifies the row, the raw command stays for the detail view.
+    const search = { command: 'rg -n --no-heading beta .', cwd: '/repo', query: 'beta', path: '.' }
+
+    expect(describeToolInput(search)).toBe('beta')
+    expect(briefToolArg(search)).toBe('beta')
+    expect(toolFilePath(search)).toBeNull()
+  })
+
+  it('labels by a listed directory without offering it as a file target', () => {
+    // A folder under `path` becomes a tappable open-file link on mobile.
+    const listing = { command: 'ls src', cwd: '/repo', directory: 'src' }
+
+    expect(describeToolInput(listing)).toBe('src')
+    expect(briefToolArg(listing)).toBe('src')
+    expect(toolFilePath(listing)).toBeNull()
+  })
+
+  it('leaves a command-only input labelled by its command', () => {
+    // Bash and Codex's unclassified shell rows carry no search key at all.
+    expect(describeToolInput({ command: 'pnpm test', description: 'Run tests' })).toBe('pnpm test')
+    expect(briefToolArg({ command: 'pnpm test' })).toBe('pnpm test')
+    expect(describeToolInput({ cmd: 'git status --short' })).toBe('git status --short')
   })
 })
 
diff --git a/src/shared/native-chat-tool-summary.ts b/src/shared/native-chat-tool-summary.ts
index 9954521bed4..57b42607569 100644
--- a/src/shared/native-chat-tool-summary.ts
+++ b/src/shared/native-chat-tool-summary.ts
@@ -5,8 +5,24 @@ const MAX_PREVIEW_STRING_INPUT = 160
 const MAX_PREVIEW_COLLECTION_ITEMS = 8
 const MAX_PREVIEW_DEPTH = 2
 const MAX_TOOL_RUN_SUMMARY_PARTS = 3
-const PRIMARY_ARG_KEYS = ['command', 'cmd', 'query', 'pattern', 'url', 'description'] as const
-const BRIEF_ARG_KEYS = ['command', 'cmd', 'query', 'pattern'] as const
+// Search term before command: a classified search row carries both, and the
+// term is what identifies it. No other tool input supplies the two together.
+// `directory` is a scan root or a listed folder — it labels a row but is
+// deliberately absent from the file-target keys below, because a folder reaches
+// mobile as a tappable open-file link that can only fail.
+const PRIMARY_ARG_KEYS = [
+  'query',
+  'pattern',
+  'directory',
+  'command',
+  'cmd',
+  'url',
+  'description'
+] as const
+const BRIEF_ARG_KEYS = ['query', 'pattern', 'directory', 'command', 'cmd'] as const
+// Only the keys that hold a shell command, so a search term or a listed folder
+// cannot stand in for one.
+const COMMAND_ARG_KEYS = ['command', 'cmd'] as const
 export const MAX_TOOL_DETAIL_LENGTH = 4000
 
 export type ToolInputDisplay = {
@@ -167,6 +183,18 @@ export function briefToolArg(input: unknown): string {
   return summarizeToolInput(normalized).slice(0, 28)
 }
 
+/** The shell command a call carries in its input, or null when it carries none.
+ *  Codex keeps the raw command on a classified `read`/`search`/`list` row, so
+ *  this is what tells one apart from a Claude tool of the same lowercased word. */
+export function toolInputCommand(input: unknown): string | null {
+  const normalized = normalizeToolInput(input)
+  return isToolInputRecord(normalized) ? firstPrimaryToolArg(normalized, COMMAND_ARG_KEYS) : null
+}
+
+function isToolInputRecord(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === 'object' && !Array.isArray(value)
+}
+
 /** Codex delivers tool arguments as a JSON string. Parse those into the object
  *  shape every helper below already understands; leave prose strings alone. */
 function normalizeToolInput(input: unknown): unknown {
diff --git a/src/shared/native-chat-turn-status.test.ts b/src/shared/native-chat-turn-status.test.ts
new file mode 100644
index 00000000000..3fdcccb7bf3
--- /dev/null
+++ b/src/shared/native-chat-turn-status.test.ts
@@ -0,0 +1,336 @@
+import { describe, expect, it } from 'vitest'
+import type { NativeChatMessage } from './native-chat-types'
+import {
+  describeNativeChatTurnStatus,
+  formatNativeChatDuration,
+  formatNativeChatTurnStatusLabel,
+  nativeChatElapsedSeconds,
+  nativeChatTurnHasResponse,
+  reduceNativeChatTurnTiming,
+  selectNativeChatTurnStatuses,
+  type NativeChatTurnTimingByTurn
+} from './native-chat-turn-status'
+
+function message(
+  id: string,
+  role: NativeChatMessage['role'],
+  blocks: NativeChatMessage['blocks']
+): NativeChatMessage {
+  return { id, role, blocks, timestamp: null, source: 'transcript' }
+}
+
+describe('formatNativeChatDuration', () => {
+  it.each([
+    [0, '0s'],
+    [12, '12s'],
+    [59, '59s'],
+    [60, '1m 0s'],
+    [184, '3m 4s'],
+    [3600, '1h 0m 0s'],
+    [3723, '1h 2m 3s']
+  ])('formats %i seconds as %s', (seconds, expected) => {
+    expect(formatNativeChatDuration(seconds)).toBe(expected)
+  })
+
+  it('floors a fractional count and clamps a negative or non-finite one', () => {
+    expect(formatNativeChatDuration(12.9)).toBe('12s')
+    expect(formatNativeChatDuration(-5)).toBe('0s')
+    expect(formatNativeChatDuration(Number.NaN)).toBe('0s')
+  })
+})
+
+describe('describeNativeChatTurnStatus', () => {
+  it('prefers the settled duration over the thinking and counting labels', () => {
+    expect(
+      describeNativeChatTurnStatus({ thinking: true, workedSeconds: 184, elapsedSeconds: 9 })
+    ).toEqual({ key: 'workedFor', duration: '3m 4s' })
+  })
+
+  it('reports thinking before the turn produces output', () => {
+    expect(
+      describeNativeChatTurnStatus({ thinking: true, workedSeconds: null, elapsedSeconds: 9 })
+    ).toEqual({ key: 'thinking', duration: null })
+  })
+
+  it('counts once the turn has output', () => {
+    expect(
+      describeNativeChatTurnStatus({ thinking: false, workedSeconds: null, elapsedSeconds: 12 })
+    ).toEqual({ key: 'workingFor', duration: '12s' })
+  })
+})
+
+describe('formatNativeChatTurnStatusLabel', () => {
+  it('renders each state in English for platforms without i18n', () => {
+    expect(
+      formatNativeChatTurnStatusLabel({ thinking: true, workedSeconds: null, elapsedSeconds: 0 })
+    ).toBe('Thinking')
+    expect(
+      formatNativeChatTurnStatusLabel({ thinking: false, workedSeconds: null, elapsedSeconds: 12 })
+    ).toBe('Working for 12s')
+    expect(
+      formatNativeChatTurnStatusLabel({ thinking: false, workedSeconds: 184, elapsedSeconds: 0 })
+    ).toBe('Worked for 3m 4s')
+  })
+})
+
+describe('nativeChatTurnHasResponse', () => {
+  const user = message('u1', 'user', [{ type: 'text', text: 'go' }])
+
+  it('is false while the turn has produced nothing', () => {
+    expect(nativeChatTurnHasResponse([user], 0)).toBe(false)
+  })
+
+  it('ignores a whitespace-only assistant block', () => {
+    const blank = message('a1', 'assistant', [{ type: 'text', text: '   \n ' }])
+    expect(nativeChatTurnHasResponse([user, blank], 0)).toBe(false)
+  })
+
+  it('is true on the first real text, tool call, or tool result', () => {
+    expect(
+      nativeChatTurnHasResponse(
+        [user, message('a1', 'assistant', [{ type: 'text', text: 'hi' }])],
+        0
+      )
+    ).toBe(true)
+    expect(
+      nativeChatTurnHasResponse(
+        [user, message('t1', 'tool', [{ type: 'tool-call', name: 'Read', input: {} }])],
+        0
+      )
+    ).toBe(true)
+    expect(
+      nativeChatTurnHasResponse(
+        [user, message('t1', 'tool', [{ type: 'tool-result', output: 'ok' }])],
+        0
+      )
+    ).toBe(true)
+  })
+
+  it('does not count output that preceded the latest user turn', () => {
+    const earlier = message('a0', 'assistant', [{ type: 'text', text: 'old' }])
+    expect(nativeChatTurnHasResponse([earlier, user], 1)).toBe(false)
+  })
+})
+
+describe('reduceNativeChatTurnTiming', () => {
+  const validTurnKeys = new Set(['u1'])
+
+  it('stamps a start when a turn begins working', () => {
+    const next = reduceNativeChatTurnTiming(
+      {},
+      { activeTurnKey: 'u1', validTurnKeys, isWorking: true, now: 1_000 }
+    )
+    expect(next).toEqual({ u1: { startedAt: 1_000, workedSeconds: null } })
+  })
+
+  it('keeps the original start across later working ticks', () => {
+    const first = reduceNativeChatTurnTiming(
+      {},
+      { activeTurnKey: 'u1', validTurnKeys, isWorking: true, now: 1_000 }
+    )
+    const second = reduceNativeChatTurnTiming(first, {
+      activeTurnKey: 'u1',
+      validTurnKeys,
+      isWorking: true,
+      now: 9_000
+    })
+    expect(second).toBe(first)
+  })
+
+  it('prefers an authoritative host start over the local stamp', () => {
+    const next = reduceNativeChatTurnTiming(
+      {},
+      {
+        activeTurnKey: 'u1',
+        validTurnKeys,
+        isWorking: true,
+        workingStartedAt: 500,
+        now: 1_000
+      }
+    )
+    expect(next.u1?.startedAt).toBe(500)
+  })
+
+  it('settles the turn to whole elapsed seconds when work stops', () => {
+    const working = reduceNativeChatTurnTiming(
+      {},
+      { activeTurnKey: 'u1', validTurnKeys, isWorking: true, now: 1_000 }
+    )
+    const settled = reduceNativeChatTurnTiming(working, {
+      activeTurnKey: 'u1',
+      validTurnKeys,
+      isWorking: false,
+      now: 13_400
+    })
+    expect(settled.u1).toEqual({ startedAt: 1_000, workedSeconds: 12 })
+  })
+
+  it('never re-settles an already settled turn', () => {
+    const settled: NativeChatTurnTimingByTurn = { u1: { startedAt: 1_000, workedSeconds: 12 } }
+    expect(
+      reduceNativeChatTurnTiming(settled, {
+        activeTurnKey: 'u1',
+        validTurnKeys,
+        isWorking: false,
+        now: 99_000
+      })
+    ).toBe(settled)
+  })
+
+  it('does not invent a settled turn that never started', () => {
+    expect(
+      reduceNativeChatTurnTiming(
+        {},
+        { activeTurnKey: 'u1', validTurnKeys, isWorking: false, now: 1_000 }
+      )
+    ).toEqual({})
+  })
+
+  it('carries the elapsed start across an optimistic echo becoming a transcript row', () => {
+    // The mobile composer renders an accepted send as `pending-N` until the
+    // transcript echo lands under its real id. Without the carry-over the active
+    // turn key flips mid-turn and "Working for 8s" restarts at 0s.
+    const working = reduceNativeChatTurnTiming(
+      {},
+      {
+        activeTurnKey: 'pending-1',
+        validTurnKeys: new Set<string>(),
+        isWorking: true,
+        now: 1_000
+      }
+    )
+    expect(working['pending-1']?.startedAt).toBe(1_000)
+    const swapped = reduceNativeChatTurnTiming(working, {
+      activeTurnKey: 'u9',
+      previousActiveTurnKey: 'pending-1',
+      validTurnKeys: new Set(['u9']),
+      isWorking: true,
+      now: 9_000
+    })
+    expect(swapped.u9).toEqual({ startedAt: 1_000, workedSeconds: null })
+    expect(swapped['pending-1']).toBeUndefined()
+  })
+
+  it('keeps a settled turn visible when the echo is replaced after it finished', () => {
+    // The swap can land after the turn settles. Re-keying (rather than only
+    // carrying a start) is what keeps the "Worked for N" row from vanishing.
+    const settled: NativeChatTurnTimingByTurn = {
+      'pending-1': { startedAt: 1_000, workedSeconds: 12 }
+    }
+    const swapped = reduceNativeChatTurnTiming(settled, {
+      activeTurnKey: 'u9',
+      previousActiveTurnKey: 'pending-1',
+      validTurnKeys: new Set(['u9']),
+      isWorking: false,
+      now: 20_000
+    })
+    expect(swapped.u9).toEqual({ startedAt: 1_000, workedSeconds: 12 })
+    expect(swapped['pending-1']).toBeUndefined()
+  })
+
+  it('settles a re-keyed in-flight turn from its original start', () => {
+    const working = reduceNativeChatTurnTiming(
+      {},
+      { activeTurnKey: 'pending-1', validTurnKeys: new Set<string>(), isWorking: true, now: 1_000 }
+    )
+    const settled = reduceNativeChatTurnTiming(working, {
+      activeTurnKey: 'u9',
+      previousActiveTurnKey: 'pending-1',
+      validTurnKeys: new Set(['u9']),
+      isWorking: false,
+      now: 13_400
+    })
+    expect(settled.u9).toEqual({ startedAt: 1_000, workedSeconds: 12 })
+  })
+
+  it('does not carry the start into a genuinely new turn', () => {
+    // The previous turn is still in the transcript, so this is the user sending
+    // again — that turn starts its own clock.
+    const working = reduceNativeChatTurnTiming(
+      {},
+      { activeTurnKey: 'u1', validTurnKeys: new Set(['u1']), isWorking: true, now: 1_000 }
+    )
+    const next = reduceNativeChatTurnTiming(working, {
+      activeTurnKey: 'u2',
+      previousActiveTurnKey: 'u1',
+      validTurnKeys: new Set(['u1', 'u2']),
+      isWorking: true,
+      now: 9_000
+    })
+    expect(next.u2?.startedAt).toBe(9_000)
+  })
+
+  it('does not carry a start from a turn that had already settled', () => {
+    const settled: NativeChatTurnTimingByTurn = {
+      'pending-1': { startedAt: 1_000, workedSeconds: 5 }
+    }
+    const next = reduceNativeChatTurnTiming(settled, {
+      activeTurnKey: 'u9',
+      previousActiveTurnKey: 'pending-1',
+      validTurnKeys: new Set(['u9']),
+      isWorking: true,
+      now: 9_000
+    })
+    expect(next.u9?.startedAt).toBe(9_000)
+  })
+
+  it('drops timings for turns that left the transcript, keeping the active one', () => {
+    const current: NativeChatTurnTimingByTurn = {
+      gone: { startedAt: 1, workedSeconds: 2 },
+      u1: { startedAt: 1_000, workedSeconds: 12 }
+    }
+    const next = reduceNativeChatTurnTiming(current, {
+      activeTurnKey: 'u1',
+      validTurnKeys,
+      isWorking: false,
+      now: 2_000
+    })
+    expect(Object.keys(next)).toEqual(['u1'])
+  })
+})
+
+describe('selectNativeChatTurnStatuses', () => {
+  it('reports the working turn as thinking until it produces output', () => {
+    const { active } = selectNativeChatTurnStatuses(
+      { u1: { startedAt: 1_000, workedSeconds: null } },
+      { activeTurnKey: 'u1', isWorking: true, hasCurrentTurnResponse: false }
+    )
+    expect(active).toEqual({ startedAt: 1_000, thinking: true, workedSeconds: null })
+  })
+
+  it('stops thinking once the turn has output', () => {
+    const { active } = selectNativeChatTurnStatuses(
+      { u1: { startedAt: 1_000, workedSeconds: null } },
+      { activeTurnKey: 'u1', isWorking: true, hasCurrentTurnResponse: true }
+    )
+    expect(active?.thinking).toBe(false)
+  })
+
+  it('exposes settled turns and resolves the active one from them when idle', () => {
+    const { active, completedByTurn } = selectNativeChatTurnStatuses(
+      { u1: { startedAt: 1_000, workedSeconds: 12 } },
+      { activeTurnKey: 'u1', isWorking: false, hasCurrentTurnResponse: true }
+    )
+    expect(completedByTurn.u1).toEqual({ startedAt: 1_000, thinking: false, workedSeconds: 12 })
+    expect(active).toEqual(completedByTurn.u1)
+  })
+
+  it('omits an in-flight turn from the completed map', () => {
+    const { completedByTurn } = selectNativeChatTurnStatuses(
+      { u1: { startedAt: 1_000, workedSeconds: null } },
+      { activeTurnKey: 'u1', isWorking: true, hasCurrentTurnResponse: true }
+    )
+    expect(completedByTurn).toEqual({})
+  })
+})
+
+describe('nativeChatElapsedSeconds', () => {
+  it('falls back to the mount epoch before the turn start lands', () => {
+    expect(nativeChatElapsedSeconds(null, 1_000, 5_400)).toBe(4)
+    expect(nativeChatElapsedSeconds(2_000, 1_000, 5_400)).toBe(3)
+  })
+
+  it('never counts backwards', () => {
+    expect(nativeChatElapsedSeconds(9_000, 1_000, 5_000)).toBe(0)
+  })
+})
diff --git a/src/shared/native-chat-turn-status.ts b/src/shared/native-chat-turn-status.ts
new file mode 100644
index 00000000000..1012f8fc604
--- /dev/null
+++ b/src/shared/native-chat-turn-status.ts
@@ -0,0 +1,210 @@
+// Turn-status derivation and copy for the native-chat "Thinking / Working for N /
+// Worked for N" row, shared by the desktop renderer (as its i18n fallback strings)
+// and the mobile app (used directly — mobile ships English only) so the two
+// surfaces never drift. Everything here is pure; each platform owns its own clock.
+
+import type { NativeChatMessage } from './native-chat-types'
+
+export const NATIVE_CHAT_TURN_STATUS_COPY = {
+  thinking: 'Thinking',
+  workingFor: 'Working for {{value0}}',
+  workedFor: 'Worked for {{value0}}',
+  toggleDetails: 'Toggle turn details',
+  responding: 'Agent is responding'
+} as const
+
+/** Format turn time without exposing an ever-growing raw seconds count. */
+export function formatNativeChatDuration(seconds: number): string {
+  const totalSeconds = Number.isFinite(seconds) ? Math.max(0, Math.floor(seconds)) : 0
+  if (totalSeconds < 60) {
+    return `${totalSeconds}s`
+  }
+  const minutes = Math.floor(totalSeconds / 60)
+  const remainingSeconds = totalSeconds % 60
+  if (minutes < 60) {
+    return `${minutes}m ${remainingSeconds}s`
+  }
+  const hours = Math.floor(minutes / 60)
+  return `${hours}h ${minutes % 60}m ${remainingSeconds}s`
+}
+
+/** Which of the three copy keys a turn-status row renders, and its duration
+ *  argument. Desktop maps this onto `translate`; mobile formats it directly. */
+export function describeNativeChatTurnStatus({
+  thinking,
+  workedSeconds,
+  elapsedSeconds
+}: {
+  thinking: boolean
+  workedSeconds?: number | null
+  elapsedSeconds: number
+}): { key: 'thinking' | 'workingFor' | 'workedFor'; duration: string | null } {
+  if (workedSeconds != null) {
+    return { key: 'workedFor', duration: formatNativeChatDuration(workedSeconds) }
+  }
+  if (thinking) {
+    return { key: 'thinking', duration: null }
+  }
+  return { key: 'workingFor', duration: formatNativeChatDuration(elapsedSeconds) }
+}
+
+/** Resolve the turn-status label in English. For platforms without i18n (mobile). */
+export function formatNativeChatTurnStatusLabel(input: {
+  thinking: boolean
+  workedSeconds?: number | null
+  elapsedSeconds: number
+}): string {
+  const { key, duration } = describeNativeChatTurnStatus(input)
+  const copy = NATIVE_CHAT_TURN_STATUS_COPY[key]
+  return duration == null ? copy : copy.replaceAll('{{value0}}', duration)
+}
+
+/** True once the current turn has produced anything renderable — the boundary
+ *  between the "Thinking" label and the counting "Working for N" label. */
+export function nativeChatTurnHasResponse(
+  messages: readonly NativeChatMessage[],
+  latestUserIndex: number
+): boolean {
+  return messages
+    .slice(latestUserIndex + 1)
+    .some(
+      (message) =>
+        (message.role === 'assistant' || message.role === 'tool') &&
+        message.blocks.some(
+          (block) =>
+            block.type === 'tool-call' ||
+            block.type === 'tool-result' ||
+            (block.type === 'text' && block.text.trim().length > 0)
+        )
+    )
+}
+
+export type NativeChatTurnTiming = {
+  startedAt: number
+  workedSeconds: number | null
+}
+
+export type NativeChatTurnStatus = {
+  startedAt: number | null
+  thinking: boolean
+  workedSeconds: number | null
+}
+
+export type NativeChatTurnTimingByTurn = Readonly<Record<string, NativeChatTurnTiming>>
+
+/** The turn-timing state machine, lifted out of the React hook so desktop and
+ *  mobile stamp start/stop identically. Returns the same reference when nothing
+ *  changed so callers can bail out of a state update. */
+export function reduceNativeChatTurnTiming(
+  current: NativeChatTurnTimingByTurn,
+  {
+    activeTurnKey,
+    previousActiveTurnKey,
+    validTurnKeys,
+    isWorking,
+    workingStartedAt,
+    now
+  }: {
+    activeTurnKey: string
+    /** The key this turn had on the previous pass. When it names a turn that has
+     *  since left the transcript, the two are the same turn under two ids — an
+     *  optimistic echo that the transcript replaced — so the clock carries over
+     *  instead of restarting. Omit it to keep the plain restart behavior. */
+    previousActiveTurnKey?: string
+    validTurnKeys: ReadonlySet<string>
+    isWorking: boolean
+    workingStartedAt?: number | null
+    now: number
+  }
+): NativeChatTurnTimingByTurn {
+  // The same turn under two ids: an optimistic echo the transcript has since
+  // replaced. Re-key its timing so neither the running clock nor an already
+  // settled duration is lost when the swap lands.
+  const replacedTiming =
+    previousActiveTurnKey !== undefined &&
+    previousActiveTurnKey !== activeTurnKey &&
+    !validTurnKeys.has(previousActiveTurnKey) &&
+    current[activeTurnKey] === undefined
+      ? current[previousActiveTurnKey]
+      : undefined
+  let retained = replacedTiming ? { ...current, [activeTurnKey]: replacedTiming } : current
+  for (const turnKey of Object.keys(retained)) {
+    if (turnKey !== activeTurnKey && !validTurnKeys.has(turnKey)) {
+      if (retained === current) {
+        retained = { ...current }
+      }
+      delete (retained as Record<string, NativeChatTurnTiming>)[turnKey]
+    }
+  }
+
+  const timing = retained[activeTurnKey]
+  if (isWorking) {
+    // An in-flight turn keeps the start it already had; only a fresh turn (or an
+    // authoritative host timestamp) restamps it.
+    const startedAt =
+      workingStartedAt ?? (timing && timing.workedSeconds == null ? timing.startedAt : now)
+    if (timing?.startedAt === startedAt && timing.workedSeconds == null) {
+      return retained
+    }
+    return { ...retained, [activeTurnKey]: { startedAt, workedSeconds: null } }
+  }
+
+  if (timing?.workedSeconds != null) {
+    return retained
+  }
+  const startedAt = timing?.startedAt ?? workingStartedAt
+  if (startedAt == null) {
+    return retained
+  }
+  return {
+    ...retained,
+    [activeTurnKey]: {
+      startedAt,
+      workedSeconds: Math.max(0, Math.floor((now - startedAt) / 1000))
+    }
+  }
+}
+
+/** Split the timing map into the active turn's status and the settled ones. */
+export function selectNativeChatTurnStatuses(
+  timingByTurn: NativeChatTurnTimingByTurn,
+  {
+    activeTurnKey,
+    isWorking,
+    workingStartedAt,
+    hasCurrentTurnResponse
+  }: {
+    activeTurnKey: string
+    isWorking: boolean
+    workingStartedAt?: number | null
+    hasCurrentTurnResponse: boolean
+  }
+): { active: NativeChatTurnStatus | null; completedByTurn: Record<string, NativeChatTurnStatus> } {
+  const completedByTurn = Object.fromEntries(
+    Object.entries(timingByTurn)
+      .filter(([, timing]) => timing.workedSeconds != null)
+      .map(([turnKey, timing]) => [
+        turnKey,
+        { startedAt: timing.startedAt, thinking: false, workedSeconds: timing.workedSeconds }
+      ])
+  ) as Record<string, NativeChatTurnStatus>
+  return {
+    active: isWorking
+      ? {
+          startedAt: workingStartedAt ?? timingByTurn[activeTurnKey]?.startedAt ?? null,
+          thinking: !hasCurrentTurnResponse,
+          workedSeconds: null
+        }
+      : (completedByTurn[activeTurnKey] ?? null),
+    completedByTurn
+  }
+}
+
+/** Elapsed whole seconds for a counting turn, tolerating a not-yet-stamped start. */
+export function nativeChatElapsedSeconds(
+  startedAt: number | null,
+  fallbackStartedAt: number,
+  now: number
+): number {
+  return Math.max(0, Math.floor((now - (startedAt ?? fallbackStartedAt)) / 1000))
+}
diff --git a/src/shared/native-chat-types.ts b/src/shared/native-chat-types.ts
index 5daa16f760e..124ee55dbe1 100644
--- a/src/shared/native-chat-types.ts
+++ b/src/shared/native-chat-types.ts
@@ -55,11 +55,31 @@ export type NativeChatToolCallBlock = {
   state?: 'running' | 'completed' | 'failed'
 }
 
+/** One resolved hunk from a provider's edit result, carrying true file ranges. */
+export type NativeChatEditPatchHunk = {
+  oldStart: number
+  oldLines: number
+  newStart: number
+  newLines: number
+  /** Signed unified rows, as the provider emitted them. */
+  lines: string[]
+}
+
+/** Hunks the provider resolved against the real file before reporting the edit.
+ *  Claude supplies these on its edit results; Codex resolves equivalently before
+ *  sending, so its patch already carries ranges and needs no companion. */
+export type NativeChatEditPatch = {
+  filePath?: string
+  hunks: NativeChatEditPatchHunk[]
+}
+
 /** The result returned to the agent for a prior tool call. */
 export type NativeChatToolResultBlock = {
   type: 'tool-result'
   output: string
   isError?: boolean
+  /** Present only for edit tools whose result reported resolved hunks. */
+  editPatch?: NativeChatEditPatch
 }
 
 /** A reference to an image, by local path or remote URL. Exactly the field
diff --git a/src/shared/native-chat-unified-patch.ts b/src/shared/native-chat-unified-patch.ts
new file mode 100644
index 00000000000..2e34c79a6b3
--- /dev/null
+++ b/src/shared/native-chat-unified-patch.ts
@@ -0,0 +1,255 @@
+import { FILE_SECTION_START, isFileHeaderPair } from './native-chat-diff'
+import { pushEditGap, splitEditContent, type NativeChatEditLine } from './native-chat-edit-model'
+
+const HUNK_RANGES = /^@@+ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@/
+
+export type UnifiedPatchLines = {
+  lines: NativeChatEditLine[]
+  /** True only when every hunk carried real `@@` ranges. */
+  lineNumbersKnown: boolean
+  /** The patch text was clipped before it became rows. */
+  truncated: boolean
+}
+
+/** Parses unified patch text, keeping the `@@` ranges as per-row line numbers.
+ *  A hunk header whose `@@` is a bare context anchor with no ranges leaves its
+ *  rows unnumbered rather than numbered from 1, because a wrong number reads as
+ *  authoritative.
+ *
+ *  `implicitFirstHunk` opens the body as a hunk of unknown position, for the
+ *  patch dialect whose first chunk may carry no header at all. */
+export function editLinesFromUnifiedPatch(
+  text: string,
+  options?: { implicitFirstHunk?: boolean }
+): UnifiedPatchLines | null {
+  const source = splitEditContent(text)
+  const rows = source.lines
+  const lines: NativeChatEditLine[] = []
+  let oldNo: number | null = null
+  let newNo: number | null = null
+  let sawHunk = options?.implicitFirstHunk === true
+  let ranged = true
+  let inHunk = sawHunk
+
+  for (let index = 0; index < rows.length; index += 1) {
+    const raw = rows[index] ?? ''
+    if (raw.startsWith('@@')) {
+      const match = HUNK_RANGES.exec(raw)
+      oldNo = match ? Number(match[1]) : null
+      newNo = match ? Number(match[3]) : null
+      // Successive hunks are separate regions of the file; concatenated with no
+      // break the gutter jumps and the reader sees one continuous block.
+      pushEditGap(lines)
+      sawHunk = true
+      inHunk = true
+      continue
+    }
+    // `\ No newline at end of file` sits mid-hunk, between the removed old last
+    // line and the added new one, so it ends nothing.
+    if (raw.startsWith('\\')) {
+      continue
+    }
+    if (!inHunk && isFileHeaderPair(rows, index)) {
+      index += 1
+      continue
+    }
+    if (FILE_SECTION_START.test(raw)) {
+      inHunk = false
+      continue
+    }
+    if (!inHunk) {
+      continue
+    }
+    // Read off the rows rather than the header, so a body that opened with no
+    // header is reported as unlocatable just like a rangeless `@@`.
+    ranged &&= oldNo !== null || newNo !== null
+    if (raw.startsWith('+')) {
+      lines.push({
+        kind: 'add',
+        text: raw.slice(1),
+        oldLineNumber: null,
+        newLineNumber: newNo
+      })
+      newNo = newNo === null ? null : newNo + 1
+      continue
+    }
+    if (raw.startsWith('-')) {
+      lines.push({
+        kind: 'del',
+        text: raw.slice(1),
+        oldLineNumber: oldNo,
+        newLineNumber: null
+      })
+      oldNo = oldNo === null ? null : oldNo + 1
+      continue
+    }
+    lines.push({
+      kind: 'context',
+      text: raw.startsWith(' ') ? raw.slice(1) : raw,
+      oldLineNumber: oldNo,
+      newLineNumber: newNo
+    })
+    oldNo = oldNo === null ? null : oldNo + 1
+    newNo = newNo === null ? null : newNo + 1
+  }
+
+  if (!sawHunk || lines.length === 0) {
+    return null
+  }
+  return { lines, lineNumbersKnown: ranged, truncated: source.truncated }
+}
+
+const GIT_DIFF_HEADER = 'diff --git '
+
+export type UnifiedPatchSection = {
+  /** Null when the patch text named no file, leaving it to the caller. */
+  path: string | null
+  oldPath: string | null
+  changeKind: 'added' | 'deleted' | 'edited' | 'renamed'
+  body: string
+}
+
+type Section = {
+  rows: string[]
+  oldPath: string | null
+  newPath: string | null
+  named: boolean
+  /** A `--- `/`+++ ` pair already named this section, so the next one is a new file. */
+  hasHeaderPair: boolean
+  /** Only a `diff --git` header states both sides of a move as such. A bare
+   *  pair with differing paths is just as likely two directories compared. */
+  fromGitHeader: boolean
+}
+
+/** Splits patch text into one section per file it touches. Without this a
+ *  multi-file patch renders as a single card under the first file's name, with
+ *  the later files' rows and gutter numbers beneath it. */
+export function unifiedPatchSections(text: string): {
+  sections: UnifiedPatchSection[]
+  truncated: boolean
+} {
+  const source = splitEditContent(text)
+  const rows = source.lines
+  const sections: Section[] = []
+  let current: Section | null = null
+  let inHunk = false
+
+  const open = (): Section => {
+    const section: Section = {
+      rows: [],
+      oldPath: null,
+      newPath: null,
+      named: false,
+      hasHeaderPair: false,
+      fromGitHeader: false
+    }
+    sections.push(section)
+    return section
+  }
+
+  for (let index = 0; index < rows.length; index += 1) {
+    const raw = rows[index] ?? ''
+    if (raw.startsWith(GIT_DIFF_HEADER)) {
+      const paths = gitHeaderPaths(raw)
+      current = open()
+      current.oldPath = paths.oldPath
+      current.newPath = paths.newPath
+      current.named = true
+      current.fromGitHeader = true
+      inHunk = false
+      continue
+    }
+    // A header pair is structure outside a hunk. Inside one it is also a file
+    // boundary, but only when a hunk header follows it immediately: a removed
+    // `-- x` over an added `++ y` is never followed by a column-0 `@@`, and
+    // that is what separates the files of a patch written without `diff --git`
+    // headers, where nothing else would end the previous file's hunk.
+    if (isFileHeaderPair(rows, index) && (!inHunk || (rows[index + 2] ?? '').startsWith('@@'))) {
+      // The pair names the section a `diff --git` just opened; a second pair in
+      // the same section is the next file of a patch written without them.
+      if (!current || current.hasHeaderPair) {
+        current = open()
+      }
+      current.oldPath = sourceHeaderPath(rows[index] ?? '')
+      current.newPath = sourceHeaderPath(rows[index + 1] ?? '')
+      current.named = true
+      current.hasHeaderPair = true
+      inHunk = false
+      index += 1
+      continue
+    }
+    if (raw.startsWith('@@')) {
+      inHunk = true
+    } else if (FILE_SECTION_START.test(raw)) {
+      inHunk = false
+    }
+    current ??= open()
+    current.rows.push(raw)
+  }
+
+  return {
+    sections: sections.map((section) => ({
+      path: section.newPath ?? section.oldPath,
+      oldPath: sectionChangeKind(section) === 'renamed' ? section.oldPath : null,
+      changeKind: sectionChangeKind(section),
+      body: section.rows.join('\n')
+    })),
+    truncated: source.truncated
+  }
+}
+
+function sectionChangeKind(section: Section): UnifiedPatchSection['changeKind'] {
+  if (!section.named) {
+    return 'edited'
+  }
+  if (section.newPath === null) {
+    return 'deleted'
+  }
+  if (section.oldPath === null) {
+    return 'added'
+  }
+  if (section.oldPath === section.newPath) {
+    return 'edited'
+  }
+  // Differing sides are a move only where the header says so. Bare pairs carry
+  // whatever paths the producer compared, which may be two directories.
+  return section.fromGitHeader ? 'renamed' : 'edited'
+}
+
+/** `--- a/<path>` / `+++ b/<path>`, where the absent side is `/dev/null` and a
+ *  trailing tab introduces the timestamp some producers append. */
+function sourceHeaderPath(line: string): string | null {
+  const value = (line.slice(4).split('\t')[0] ?? '').trim()
+  return value === '' || value === '/dev/null' ? null : value.replace(/^[ab]\//, '')
+}
+
+function gitHeaderPaths(line: string): { oldPath: string | null; newPath: string | null } {
+  const rest = line.slice(GIT_DIFF_HEADER.length)
+  // Both halves carry the same path unless the file moved, so the second one
+  // starts at the last ` b/` rather than at the first space.
+  const split = rest.lastIndexOf(' b/')
+  if (split === -1) {
+    return { oldPath: null, newPath: null }
+  }
+  return {
+    oldPath: rest.slice(0, split).replace(/^a\//, ''),
+    newPath: rest.slice(split + 1).replace(/^b\//, '')
+  }
+}
+
+/** Rows for a whole-file add or delete, which legitimately number from 1. */
+export function editLinesFromWholeFile(
+  content: string,
+  kind: 'add' | 'del'
+): { lines: NativeChatEditLine[]; truncated: boolean } {
+  const body = splitEditContent(content)
+  return {
+    lines: body.lines.map((text, index) => ({
+      kind,
+      text,
+      oldLineNumber: kind === 'del' ? index + 1 : null,
+      newLineNumber: kind === 'add' ? index + 1 : null
+    })),
+    truncated: body.truncated
+  }
+}
diff --git a/src/shared/node-cli-command-resolution.ts b/src/shared/node-cli-command-resolution.ts
index 6931cc8fc7e..c7407ac5eb1 100644
--- a/src/shared/node-cli-command-resolution.ts
+++ b/src/shared/node-cli-command-resolution.ts
@@ -1,6 +1,7 @@
 import { accessSync, constants, existsSync, readFileSync, readdirSync, statSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { delimiter, dirname, isAbsolute, join } from 'node:path'
+import { getSystemCliInstallDirectories } from './system-cli-install-dirs'
 
 type ResolveCommandOptions = {
   pathEnv?: string | null
@@ -245,6 +246,17 @@ function getVersionManagerDirectories(
   return directories
 }
 
+// Why one list for both resolvers: the system block must stay LAST so a
+// version-manager install always outranks a Homebrew/npm/snap one, and two
+// hand-spelled spreads is how the native and WSL lists drifted apart before.
+function getCliInstallDirectories(platform: NodeJS.Platform, homePath: string): string[] {
+  return [
+    ...getNvmVersionDirectories(homePath),
+    ...getBaseVersionManagerDirectories(platform, homePath),
+    ...getSystemCliInstallDirectories(platform, homePath)
+  ]
+}
+
 export function resolveCliCommand(
   commandName: string,
   options: ResolveCommandOptions = {}
@@ -258,19 +270,12 @@ export function resolveCliCommand(
   }
 
   const homePath = options.homePath ?? homedir()
-  const nvmCandidate = findFirstExecutable(
+  const installCandidate = findFirstExecutable(
     platform,
-    getNvmVersionDirectories(homePath),
+    getCliInstallDirectories(platform, homePath),
     executableNames
   )
-  const versionManagerCandidate =
-    nvmCandidate ??
-    findFirstExecutable(
-      platform,
-      getBaseVersionManagerDirectories(platform, homePath),
-      executableNames
-    )
-  return versionManagerCandidate ?? commandName
+  return installCandidate ?? commandName
 }
 
 export function resolveCliCommands(
@@ -281,10 +286,7 @@ export function resolveCliCommands(
   const pathEnv = options.pathEnv ?? process.env.PATH ?? process.env.Path ?? null
   const pathDirectories = splitPath(pathEnv)
   const homePath = options.homePath ?? homedir()
-  const installDirectories = [
-    ...getNvmVersionDirectories(homePath),
-    ...getBaseVersionManagerDirectories(platform, homePath)
-  ]
+  const installDirectories = getCliInstallDirectories(platform, homePath)
   const resolved = new Map<string, string>()
 
   for (const commandName of new Set(commandNames)) {
diff --git a/src/shared/orca-profiles.ts b/src/shared/orca-profiles.ts
index 851021a0779..298cfc28312 100644
--- a/src/shared/orca-profiles.ts
+++ b/src/shared/orca-profiles.ts
@@ -4,6 +4,8 @@ import type { ExecutionHostId } from './execution-host'
 export const ORCA_PROFILE_INDEX_SCHEMA_VERSION = 1
 export const DEFAULT_LOCAL_ORCA_PROFILE_ID = 'local-default'
 export const DEFAULT_LOCAL_ORCA_PROFILE_NAME = 'Personal'
+/** Main -> renderer push when the stored auth status changed without the renderer asking. */
+export const ORCA_PROFILE_AUTH_STATUS_CHANGED_CHANNEL = 'orcaProfiles:authStatusChanged'
 const LEGACY_ORCA_BROWSER_SESSION_PARTITION_PREFIX = 'persist:orca-browser-session-'
 
 export type OrcaProfileAvatar = {
diff --git a/src/shared/orchestration-dispatch-refusal-contract.test.ts b/src/shared/orchestration-dispatch-refusal-contract.test.ts
new file mode 100644
index 00000000000..4f9fa4bf617
--- /dev/null
+++ b/src/shared/orchestration-dispatch-refusal-contract.test.ts
@@ -0,0 +1,67 @@
+import { describe, expect, it } from 'vitest'
+import {
+  buildInjectRejectionMessage,
+  taskNotFoundRefusal,
+  taskNotStartableRefusal
+} from './orchestration-dispatch-refusal-contract'
+import { TUI_AGENT_CONFIG } from './tui-agent-config'
+import { recognizeAgentProcess } from './agent-process-recognition'
+
+describe('buildInjectRejectionMessage', () => {
+  const message = buildInjectRejectionMessage('term_a')
+
+  it('keeps the substring callers and scripts match on', () => {
+    expect(message).toContain('Cannot dispatch --inject to terminal term_a')
+    expect(message).toContain('no recognized agent detected')
+  })
+
+  it('names every agent Orca recognizes, including agy', () => {
+    expect(message).toMatch(/\bagy\b/)
+    for (const config of Object.values(TUI_AGENT_CONFIG)) {
+      expect(message).toContain(config.expectedProcess)
+    }
+  })
+
+  it('lists only names detection actually resolves, deduped and sorted', () => {
+    const listed = (/\(([^)]+)\)/.exec(message)?.[1] ?? '').split(', ')
+
+    expect(listed.length).toBeGreaterThan(0)
+    expect(new Set(listed).size).toBe(listed.length)
+    expect([...listed].sort()).toEqual(listed)
+    for (const name of listed) {
+      expect(recognizeAgentProcess(name)).not.toBeNull()
+    }
+  })
+})
+
+// Why: these strings are published receipts; they are pinned as literals, independent of the
+// builders, so a refactor cannot silently rewrite them together with the expectation.
+describe('dispatch refusal receipts keep their published messages', () => {
+  it('leaves the message exactly as each call site supplies it', () => {
+    expect(taskNotFoundRefusal('Task not found: task_1', { taskId: 'task_1' }).message).toBe(
+      'Task not found: task_1'
+    )
+    expect(
+      taskNotStartableRefusal('Task task_1 is pending; only a ready Task can start.', {
+        taskId: 'task_1',
+        status: 'pending',
+        unmetDependencies: []
+      }).message
+    ).toBe('Task task_1 is pending; only a ready Task can start.')
+  })
+
+  it('tailors nextSteps to retry, dependency, occupancy, and terminal-status refusals', () => {
+    const base = { taskId: 'task_1', status: 'failed', unmetDependencies: [] }
+    expect(taskNotStartableRefusal('m', { ...base, retryOf: 'ctx_1' }).data.nextSteps[0]).toMatch(
+      /--retry-of.*ctx_1/
+    )
+    expect(
+      taskNotStartableRefusal('m', { ...base, status: 'pending', unmetDependencies: ['task_0'] })
+        .data.nextSteps[0]
+    ).toMatch(/task_0.*unblock failed/)
+    expect(
+      taskNotStartableRefusal('m', { ...base, status: 'dispatched' }).data.nextSteps[0]
+    ).toMatch(/dispatch-show --task task_1/)
+    expect(taskNotStartableRefusal('m', base).data.nextSteps[0]).toMatch(/failed Task cannot/)
+  })
+})
diff --git a/src/shared/orchestration-dispatch-refusal-contract.ts b/src/shared/orchestration-dispatch-refusal-contract.ts
new file mode 100644
index 00000000000..b764067402b
--- /dev/null
+++ b/src/shared/orchestration-dispatch-refusal-contract.ts
@@ -0,0 +1,102 @@
+import { TUI_AGENT_CONFIG } from './tui-agent-config'
+
+// Why: one source for each dispatch refusal's code, message, and data, so the runtime emits and
+// the CLI test formats the identical envelope. Messages are supplied per call site because each
+// existing string is a published receipt an old consumer may match on.
+
+export type DispatchRefusalReceipt = {
+  code: 'task_not_found' | 'task_not_startable' | 'inject_rejected'
+  message: string
+  data: Record<string, unknown> & { nextSteps: string[] }
+}
+
+export function taskNotFoundRefusal(
+  message: string,
+  detail: { taskId: string; runId?: string }
+): DispatchRefusalReceipt {
+  return {
+    code: 'task_not_found',
+    message,
+    data: {
+      ...detail,
+      nextSteps: [
+        'Run orca orchestration task-list --json in the bound Run to find the intended Task id.',
+        'If the Task does not exist yet, create it with orca orchestration task-create --spec <text> --json.'
+      ]
+    }
+  }
+}
+
+export type TaskNotStartableDetail = {
+  taskId: string
+  status: string
+  unmetDependencies: string[]
+  retryOf?: string
+}
+
+export function taskNotStartableRefusal(
+  message: string,
+  detail: TaskNotStartableDetail
+): DispatchRefusalReceipt {
+  return {
+    code: 'task_not_startable',
+    message,
+    data: { ...detail, nextSteps: taskNotStartableNextSteps(detail) }
+  }
+}
+
+function taskNotStartableNextSteps(detail: TaskNotStartableDetail): string[] {
+  if (detail.retryOf) {
+    return [
+      `--retry-of must name the latest settled Dispatch of a failed or blocked Task; check orca orchestration dispatch-show --task ${detail.taskId} --json and orca orchestration worker-show --dispatch ${detail.retryOf} --json.`
+    ]
+  }
+  if (detail.unmetDependencies.length > 0) {
+    return [
+      `Dependencies ${detail.unmetDependencies.join(', ')} are not completed. Wait for running ones with orca orchestration check --wait --json; retry or unblock failed ones before dispatching again.`
+    ]
+  }
+  if (detail.status === 'dispatched') {
+    return [
+      `The Task already has an active Dispatch; inspect it with orca orchestration dispatch-show --task ${detail.taskId} --json.`
+    ]
+  }
+  return [
+    `A ${detail.status} Task cannot be dispatched; create a new Task or use worker-start --retry-of for a failed attempt.`
+  ]
+}
+
+// Why: the old five-name example read as an allowlist (#15125); derive from the field detection keys on so it cannot drift.
+// Not filtered by `disabledTuiAgents` — that gates Orca's launchers, not detection, so a hand-started disabled agent still injects.
+const RECOGNIZED_AGENT_PROCESS_NAMES = [
+  ...new Set(Object.values(TUI_AGENT_CONFIG).map((config) => config.expectedProcess))
+].sort()
+
+export function buildInjectRejectionMessage(terminal: string): string {
+  return (
+    `Cannot dispatch --inject to terminal ${terminal}: no recognized agent detected. ` +
+    `Orca detects these agent CLIs (${RECOGNIZED_AGENT_PROCESS_NAMES.join(', ')}). ` +
+    'Start one in the terminal and let it finish launching, ' +
+    'or dispatch without --inject and send the prompt manually.'
+  )
+}
+
+export type InjectRejectionReason = 'no_agent_detected'
+
+export function injectRejectedRefusal(
+  terminal: string,
+  reason: InjectRejectionReason
+): DispatchRefusalReceipt {
+  return {
+    code: 'inject_rejected',
+    message: buildInjectRejectionMessage(terminal),
+    data: {
+      terminal,
+      reason,
+      nextSteps: [
+        'Start a recognized agent CLI in that terminal and wait for it to finish launching, or pick a terminal that already runs one.',
+        'Alternatively dispatch without --inject and deliver the prompt with orca terminal send --terminal <handle> --text <prompt> --enter --json.'
+      ]
+    }
+  }
+}
diff --git a/src/shared/pane-agent-identity-inventory.test.ts b/src/shared/pane-agent-identity-inventory.test.ts
index ee868bfcc16..d493dec1aef 100644
--- a/src/shared/pane-agent-identity-inventory.test.ts
+++ b/src/shared/pane-agent-identity-inventory.test.ts
@@ -56,7 +56,7 @@ const INVENTORY: readonly InventoryGroup[] = [
         'src/renderer/src/components/agent-session-continuation/AgentSessionContinuationDialog.tsx',
         2
       ],
-      ['src/renderer/src/components/automations/AutomationListLocalRows.tsx', 2],
+      ['src/renderer/src/components/automations/AutomationListLocalRow.tsx', 2],
       'src/renderer/src/components/automations/automation-draft-model.ts',
       ['src/renderer/src/components/automations/automation-list-search-rows.ts', 2],
       ['src/renderer/src/components/dashboard-popout/AgentMapSnapshotWorkspaceMenu.tsx', 2],
diff --git a/src/shared/posix-version-manager-bin-dirs.ts b/src/shared/posix-version-manager-bin-dirs.ts
index 698b0f7f5b1..85eb581ccb1 100644
--- a/src/shared/posix-version-manager-bin-dirs.ts
+++ b/src/shared/posix-version-manager-bin-dirs.ts
@@ -8,8 +8,20 @@
  * installed, which is #9725.
  *
  * Kept in step with `getBaseVersionManagerDirectories` in
- * node-cli-command-resolution.ts: a WSL user on asdf, mise, volta or fnm would
- * otherwise still hit #9725 while the same user on native does not.
+ * node-cli-command-resolution.ts and `getSystemCliInstallDirectories` in
+ * system-cli-install-dirs.ts: a WSL user on asdf, mise, volta or fnm -- or on
+ * Linuxbrew, snap or nix -- would otherwise still hit #9725 while the same user
+ * on native does not. `/opt/homebrew` stays out because a WSL guest is Linux,
+ * where Homebrew installs to the Linuxbrew prefix below.
+ *
+ * Version-manager dirs lead and the system block trails, which took the one
+ * behavior change here: `/usr/local/bin` moved from before the nvm glob to
+ * after it, so the guest ranks a version manager over a system install the way
+ * native does. Bounded, not free: every entry is APPENDED behind a resolved
+ * login PATH, so this can only re-rank a command that BOTH consumers would
+ * otherwise miss, and both only test presence. Not full parity either -- the
+ * glob expands lexicographically, while native orders nvm dirs
+ * default-alias-first (#10932).
  *
  * Each entry is quoted so a `$HOME` containing a space cannot word-split into
  * a relative path -- except the nvm glob, where only the prefix is quoted so
@@ -24,8 +36,15 @@ const POSIX_VERSION_MANAGER_BIN_DIRS = [
   '"$HOME/.asdf/shims"',
   '"$HOME/.fnm/aliases/default/bin"',
   '"$HOME/.local/share/mise/shims"',
+  '"$HOME"/.nvm/versions/node/*/bin',
   '"/usr/local/bin"',
-  '"$HOME"/.nvm/versions/node/*/bin'
+  '"/snap/bin"',
+  '"/home/linuxbrew/.linuxbrew/bin"',
+  '"/nix/var/nix/profiles/default/bin"',
+  '"$HOME/.nix-profile/bin"',
+  // Why both: the opencode and Pi installers' own defaults, which no version manager owns (#829).
+  '"$HOME/.opencode/bin"',
+  '"$HOME/.vite-plus/bin"'
 ].join(' ')
 
 /**
diff --git a/src/shared/process-table-snapshot-reader.ts b/src/shared/process-table-snapshot-reader.ts
index 8e1655d400d..962a24c7f48 100644
--- a/src/shared/process-table-snapshot-reader.ts
+++ b/src/shared/process-table-snapshot-reader.ts
@@ -2,6 +2,7 @@ import { execFile as execFileCb } from 'node:child_process'
 import { readFile } from 'node:fs/promises'
 import { promisify } from 'node:util'
 import {
+  PROCESS_TABLE_SNAPSHOT_MAX_STALENESS_MS,
   PS_ARGS,
   PS_MAX_BUFFER_BYTES,
   ProcessTableCaptureError,
@@ -10,15 +11,19 @@ import {
   type ProcessTableRow
 } from './process-table-snapshot'
 
-export { PS_ARGS, PS_MAX_BUFFER_BYTES }
+export { PROCESS_TABLE_SNAPSHOT_MAX_STALENESS_MS, PS_ARGS, PS_MAX_BUFFER_BYTES }
 
 const execFile = promisify(execFileCb)
 
-/** Columns used by the evidence reader. Keep command last so its spaces survive parsing. */
-export const PS_TIMEOUT_MS = 3000
-const DEFAULT_SNAPSHOT_TTL_MS = 500
+// Why 15s: the `command=` column costs a per-pid argv read (measured 1.15s for 1,948
+// processes; 0.03s without it), and CPU contention multiplies that -- at load 27 the same
+// capture measured 1.3-6.0s, so a 3s budget timed out on 6 of 20 consecutive tries and the
+// whole subsystem answered "unverifiable" about a table it could read. This keeps a wedged
+// `ps` bounded while staying out of reach of a host that is merely busy.
+export const PS_TIMEOUT_MS = 15_000
+const DEFAULT_SNAPSHOT_TTL_MS = PROCESS_TABLE_SNAPSHOT_MAX_STALENESS_MS
 
-type Snapshot<T> = { value: T; capturedAtMs: number }
+type Snapshot<T> = { value: T; capturedAtMs: number; completedAtMs: number }
 
 type ProcessTableSnapshotReaderDeps<T> = {
   runPs: () => Promise<T>
@@ -42,11 +47,16 @@ export function createProcessTableSnapshotReader<T = string>(
   let freshQueued: { promise: Promise<T>; startSequence: number | null } | null = null
 
   async function runSnapshot(): Promise<T> {
+    // Two stamps because they answer different questions: `capturedAtMs` is when `ps` read the
+    // kernel table, which is what a destructive consumer bounds staleness against, while the TTL
+    // keys on completion so a capture slower than the TTL still coalesces instead of forking a
+    // whole-machine `ps` per caller on exactly the loaded host that can least afford it.
+    const capturedAtMs = deps.now()
     const promise = deps.runPs()
     inFlight = promise
     try {
       const value = await promise
-      cached = { value, capturedAtMs: deps.now() }
+      cached = { value, capturedAtMs, completedAtMs: deps.now() }
       return value
     } finally {
       if (inFlight === promise) {
@@ -56,7 +66,7 @@ export function createProcessTableSnapshotReader<T = string>(
   }
 
   async function getSnapshot(): Promise<T> {
-    if (cached && deps.now() - cached.capturedAtMs < ttlMs) {
+    if (cached && deps.now() - cached.completedAtMs < ttlMs) {
       return cached.value
     }
     if (inFlight) {
@@ -198,6 +208,19 @@ function assertWholeCapture(stdout: string): string {
   return stdout
 }
 
+/** Field 22 (`starttime`) of `/proc/<pid>/stat`, read past the parenthesised comm. */
+export function parseLinuxProcStatStartTime(stat: string): string | null {
+  const closingParen = stat.lastIndexOf(')')
+  if (closingParen === -1) {
+    return null
+  }
+  const tail = stat
+    .slice(closingParen + 1)
+    .trim()
+    .split(/\s+/)
+  return tail[19] || null
+}
+
 /** Read Linux's stable PID start-time ticks without spawning another process. */
 async function readLinuxProcessStartTimes(
   rows: readonly ProcessTableRow[]
@@ -209,16 +232,9 @@ async function readLinuxProcessStartTimes(
   const starts = await Promise.all(
     candidates.map(async (row) => {
       try {
-        const stat = await readFile(`/proc/${row.pid}/stat`, 'utf8')
-        const closingParen = stat.lastIndexOf(')')
-        if (closingParen === -1) {
-          return null
-        }
-        const tail = stat
-          .slice(closingParen + 1)
-          .trim()
-          .split(/\s+/)
-        const startTime = tail[19]
+        const startTime = parseLinuxProcStatStartTime(
+          await readFile(`/proc/${row.pid}/stat`, 'utf8')
+        )
         return startTime ? ([row.pid, startTime] as const) : null
       } catch {
         return null
@@ -269,17 +285,53 @@ export async function getStrictProcessTableSnapshot(): Promise<ProcessTableRow[]
   return (await processTableReader.getSnapshot()).strict()
 }
 
+/** How long an evidence-publishing read waits for the shared capture before giving up on it.
+ *
+ *  Sized from both ends rather than picked. The floor is what the capture costs: the `command=`
+ *  column measured 1.15s for 1,948 processes on an idle host, so a budget under that answers
+ *  `unverifiable` about a machine nobody is straining. The ceiling is the consumer's --
+ *  `REMOTE_FOREGROUND_EVIDENCE_MAX_AGE_MS` is 2,000ms and a TTL-shared capture may already be
+ *  {@link PROCESS_TABLE_SNAPSHOT_MAX_STALENESS_MS} old when it is served, which leaves 1,500ms,
+ *  and transit takes the rest.
+ *
+ *  Deliberately an order of magnitude below {@link PS_TIMEOUT_MS}, because the two answer
+ *  different questions. Identity proof asks whether a process exists and must not read a slow
+ *  capture as an absent one, so it waits. These consumers ask whether an observation describes
+ *  NOW, and on a host where the capture costs more than this, it does not: the same capture
+ *  measured 4.0-18.6s at load 46, and 2.5-9.0s on an idle 2,002-process laptop. A late answer is
+ *  rejected by the age gate anyway, having first blocked a polled path for the whole capture, so
+ *  a prompt `unverifiable` is both the truthful verdict and the cheaper one. */
+export const PROCESS_TABLE_EVIDENCE_BUDGET_MS = 1_200
+
+/** Bounds the WAIT, never the capture. The reader coalesces, so this caller may be joining a
+ *  capture some identity probe started under the 15s budget; abandoning the wait leaves that
+ *  capture running to fill the cache instead of forking a second whole-machine `ps` on the host
+ *  that can least afford one. */
+export async function withEvidenceBudget<T>(pending: Promise<T>): Promise<T> {
+  let timer: ReturnType<typeof setTimeout> | undefined
+  try {
+    return await Promise.race([
+      pending,
+      new Promise<never>((_resolve, reject) => {
+        timer = setTimeout(
+          () => reject(new ProcessTableCaptureError('capture_over_budget')),
+          PROCESS_TABLE_EVIDENCE_BUDGET_MS
+        )
+      })
+    ])
+  } finally {
+    clearTimeout(timer)
+  }
+}
+
 export async function getStrictProcessTableSnapshotWithAge(): Promise<{
   rows: ProcessTableRow[]
   capturedAgeMs: number
 }> {
-  const snapshot = await processTableReader.getSnapshotWithAge()
+  const snapshot = await withEvidenceBudget(processTableReader.getSnapshotWithAge())
   return { rows: snapshot.value.strict(), capturedAgeMs: snapshot.capturedAgeMs }
 }
 
-/** How much older than its own await a TTL-cached capture may be. */
-export const PROCESS_TABLE_SNAPSHOT_MAX_STALENESS_MS = DEFAULT_SNAPSHOT_TTL_MS
-
 export function resetProcessTableSnapshotForTests(): void {
   processTableReader.reset()
 }
diff --git a/src/shared/process-table-snapshot.test.ts b/src/shared/process-table-snapshot.test.ts
index 80f9ed1ab20..fea3d891b6d 100644
--- a/src/shared/process-table-snapshot.test.ts
+++ b/src/shared/process-table-snapshot.test.ts
@@ -1,6 +1,6 @@
 import { readFileSync } from 'node:fs'
 import { join } from 'node:path'
-import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
 const { execFileMock } = vi.hoisted(() => ({ execFileMock: vi.fn() }))
 
@@ -10,7 +10,10 @@ import {
   createProcessTableSnapshotReader,
   getProcessTableSnapshot,
   getStrictProcessTableSnapshot,
+  getStrictProcessTableSnapshotWithAge,
+  PROCESS_TABLE_EVIDENCE_BUDGET_MS,
   PS_MAX_BUFFER_BYTES,
+  PS_TIMEOUT_MS,
   resetProcessTableSnapshotForTests
 } from './process-table-snapshot-reader'
 import {
@@ -124,6 +127,26 @@ describe('process-table-snapshot reader', () => {
     expect(scans).toBe(1)
   })
 
+  it('reports the age of the capture instant, not of the moment ps finished', async () => {
+    let clock = 0
+    const gate = deferred<string>()
+    const reader = createProcessTableSnapshotReader({
+      runPs: () => gate.promise,
+      now: () => clock,
+      ttlMs: 500
+    })
+
+    const first = reader.getSnapshot()
+    // A capture that took 4s of wall clock describes the machine as it was 4s ago.
+    clock = 4_000
+    gate.resolve('scan-1')
+    await first
+
+    // Age used to start at the callback, so a capture older than the destructive
+    // consumer's ceiling was admitted as if it had just been taken.
+    expect((await reader.getSnapshotWithAge()).capturedAgeMs).toBe(4_000)
+  })
+
   it('does not cache failures and retries on the next call', async () => {
     let scans = 0
     const reader = createProcessTableSnapshotReader({
@@ -599,4 +622,118 @@ describe('process-table capture completeness', () => {
     await expect(getProcessTableSnapshot()).rejects.toThrow(ProcessTableCaptureError)
     await expect(getProcessTableSnapshot()).rejects.toThrow('empty_capture')
   })
+
+  /**
+   * Emulate Node's own execFile deadline: past `timeout` it SIGTERMs the child and calls
+   * back with `Command failed: <argv>` and no stderr -- indistinguishable from a broken
+   * `ps` unless the budget itself is under test.
+   */
+  function mockPsTakingMs(durationMs: number, stdout: string): void {
+    execFileMock.mockImplementation(
+      (command: string, args: string[], options: unknown, callback: unknown) => {
+        const done = callback as (err: unknown, result: { stdout: string; stderr: string }) => void
+        const timeout = (options as { timeout?: number })?.timeout
+        if (timeout !== undefined && durationMs > timeout) {
+          const error = Object.assign(
+            new Error(`Command failed: ${[command, ...args].join(' ')}\n`),
+            { code: null, killed: true, signal: 'SIGTERM' }
+          )
+          done(error, { stdout: '', stderr: '' })
+          return
+        }
+        done(null, { stdout, stderr: '' })
+      }
+    )
+  }
+
+  it('reads a loaded host whose whole-machine ps runs for seconds', async () => {
+    // Measured on a 1,948-process host at load 27: the `command=` argv read alone costs
+    // 1.15s, and contention stretched the same capture to 6.0s. The old 3s budget killed
+    // 6 of 20 consecutive captures, so a readable table answered "unverifiable".
+    mockPsTakingMs(6_000, busyHostTable(200))
+
+    expect(PS_TIMEOUT_MS).toBeGreaterThan(6_000)
+    await expect(getProcessTableSnapshot()).resolves.toHaveLength(200)
+  })
+
+  it('still bounds a ps that never returns', async () => {
+    mockPsTakingMs(PS_TIMEOUT_MS + 1, busyHostTable(200))
+
+    await expect(getProcessTableSnapshot()).rejects.toThrow('Command failed: ps')
+  })
+})
+
+/**
+ * The evidence-publishing read has a far shorter budget than identity proof, and the two are not
+ * interchangeable. Identity proof asks whether a process exists and must not read a slow capture
+ * as an absent one, so it waits out `PS_TIMEOUT_MS`. These consumers ask whether an observation
+ * describes NOW: past this budget it cannot, so the answer they need is a prompt `unverifiable`,
+ * which both relay call sites already produce from a rejection.
+ */
+describe('evidence-publishing capture budget', () => {
+  beforeEach(() => {
+    execFileMock.mockReset()
+    resetProcessTableSnapshotForTests()
+    vi.useFakeTimers()
+  })
+
+  afterEach(() => {
+    vi.useRealTimers()
+  })
+
+  /** A `ps` that answers after `durationMs` of wall clock, the way a loaded host does. */
+  function mockPsTaking(durationMs: number, stdout = '1 0 1 1 S+ ?? Jan 1 00:00:00 2026 bash\n') {
+    execFileMock.mockImplementation(
+      (_command: string, _args: string[], _options: unknown, callback: unknown) => {
+        const done = callback as (err: unknown, result: { stdout: string; stderr: string }) => void
+        setTimeout(() => done(null, { stdout, stderr: '' }), durationMs)
+      }
+    )
+  }
+
+  it('answers from a capture that lands one tick inside the budget', async () => {
+    mockPsTaking(PROCESS_TABLE_EVIDENCE_BUDGET_MS - 1)
+    const pending = getStrictProcessTableSnapshotWithAge()
+
+    await vi.advanceTimersByTimeAsync(PROCESS_TABLE_EVIDENCE_BUDGET_MS)
+
+    // The age carries the capture's own duration, which is the whole reason the budget is this
+    // far under the 2,000ms admission ceiling rather than under PS_TIMEOUT_MS.
+    expect((await pending).capturedAgeMs).toBe(PROCESS_TABLE_EVIDENCE_BUDGET_MS - 1)
+  })
+
+  it('gives up on a capture one tick past the budget instead of waiting out PS_TIMEOUT_MS', async () => {
+    mockPsTaking(PROCESS_TABLE_EVIDENCE_BUDGET_MS + 1)
+    const pending = getStrictProcessTableSnapshotWithAge()
+    const settled = pending.then(
+      () => 'resolved',
+      (error: Error) => error.message
+    )
+
+    await vi.advanceTimersByTimeAsync(PROCESS_TABLE_EVIDENCE_BUDGET_MS)
+
+    expect(await settled).toContain('process table unreadable')
+  })
+
+  it('leaves the abandoned capture running to fill the cache for the next reader', async () => {
+    // Why this matters: a whole-machine `ps` is the most expensive thing the host does, and the
+    // host that blows the budget is by definition the one that can least afford a second one.
+    mockPsTaking(PROCESS_TABLE_EVIDENCE_BUDGET_MS + 100)
+    const abandoned = getStrictProcessTableSnapshotWithAge().catch(() => null)
+
+    await vi.advanceTimersByTimeAsync(PROCESS_TABLE_EVIDENCE_BUDGET_MS)
+    expect(await abandoned).toBeNull()
+
+    await vi.advanceTimersByTimeAsync(100)
+    expect(await getStrictProcessTableSnapshotWithAge()).toMatchObject({
+      capturedAgeMs: PROCESS_TABLE_EVIDENCE_BUDGET_MS + 100
+    })
+    expect(execFileMock).toHaveBeenCalledTimes(1)
+  })
+
+  it('keeps the identity budget far above its own', () => {
+    // A slow capture must still not read as an absent process; only the consumers that need the
+    // observation to describe NOW gave up waiting for it.
+    expect(PROCESS_TABLE_EVIDENCE_BUDGET_MS).toBeLessThan(PS_TIMEOUT_MS)
+  })
 })
diff --git a/src/shared/process-table-snapshot.ts b/src/shared/process-table-snapshot.ts
index 00cf1f1c380..3b3236079c4 100644
--- a/src/shared/process-table-snapshot.ts
+++ b/src/shared/process-table-snapshot.ts
@@ -13,19 +13,86 @@ export type ProcessTableRow = {
   command: string
 }
 
+// Why guarded: this module is the renderer-safe half of the process-table pair, and the renderer
+// runs sandboxed with contextIsolation, where a bare `process` read throws at module evaluation
+// and takes the whole chunk — and the app — down with it. Only hosts ever run these argv.
+const HOST_IS_DARWIN = typeof process !== 'undefined' && process.platform === 'darwin'
+
 /** Columns used by the evidence reader. Keep command last so its spaces survive parsing. */
 export const PS_ARGS = (
-  process.platform === 'darwin'
+  HOST_IS_DARWIN
     ? ['-axo', 'pid=,ppid=,pgid=,tpgid=,stat=,tty=,lstart=,command=']
     : ['-axo', 'pid=,ppid=,pgid=,tpgid=,stat=,tty=,etimes=,command=']
 ) as readonly string[]
 
+/**
+ * Cheap tier: the same job-control columns without `tty=` (0.29s of the 0.34s on a
+ * 1,900-process Mac) or `command=` (per-pid argv read, 1.15s on Linux). Enough to prove a
+ * pane's subtree is unchanged since the last full capture; never enough to name a process.
+ * No `etimes=` on Linux: it is elapsed seconds, so it changes every tick; the stable start
+ * marker comes from `/proc/<pid>/stat` for the pane subtree only.
+ */
+export const CHEAP_PS_ARGS = (
+  HOST_IS_DARWIN
+    ? ['-axo', 'pid=,ppid=,pgid=,tpgid=,stat=,lstart=']
+    : ['-axo', 'pid=,ppid=,pgid=,tpgid=,stat=']
+) as readonly string[]
+
+export type CheapProcessTableRow = {
+  pid: number
+  ppid: number
+  pgid: number
+  tpgid: number
+  stat: string
+  /** Host start marker when the column set carries one (macOS `lstart`). */
+  startTime?: string
+}
+
+/**
+ * Parse a {@link CHEAP_PS_ARGS} capture. Lenient on purpose: a dropped row can only make a
+ * fingerprint DIFFER from the strict full-capture one, which escalates to the full capture --
+ * the safe direction. An empty capture is unreadable, not "no processes".
+ */
+export function parseCheapProcessTableRows(stdout: string): CheapProcessTableRow[] {
+  const rows: CheapProcessTableRow[] = []
+  for (const rawLine of stdout.split(/\r?\n/)) {
+    const match = rawLine.trim().match(/^(\d+)\s+(\d+)\s+(-?\d+)\s+(-?\d+)\s+(\S+)(?:\s+(.+?))?$/)
+    if (!match) {
+      continue
+    }
+    const pid = Number(match[1])
+    if (!Number.isSafeInteger(pid) || pid <= 0) {
+      continue
+    }
+    rows.push({
+      pid,
+      ppid: Number(match[2]),
+      pgid: Number(match[3]),
+      tpgid: Number(match[4]),
+      stat: match[5],
+      ...(match[6] !== undefined ? { startTime: match[6] } : {})
+    })
+  }
+  if (rows.length === 0) {
+    throw new ProcessTableCaptureError('empty_capture')
+  }
+  return rows
+}
+
 // Why: execFile's 1MB default leaves ~3x headroom (326KB / 1,460 processes, and
 // a single 5KB argv row is ordinary), so a busy host overflows it and then EVERY
 // capture fails — a readable process table degrading into permanent
 // "unverifiable". Matches the sibling reader in pty-descendant-termination.ts.
 export const PS_MAX_BUFFER_BYTES = 32 * 1024 * 1024
 
+/** How much older than its own await a TTL-cached capture may be, on top of the capture's own
+ *  duration. Reported ages carry both, so this alone is not the staleness bound.
+ *
+ *  Why here and not beside the reader that applies it: the renderer's cadence scheduler pulls a
+ *  pane's next poll forward by at most this much, and the reader is a `node:child_process` module
+ *  the renderer must never reach. */
+export const PROCESS_TABLE_SNAPSHOT_MAX_STALENESS_MS = 500
+
 /**
  * Parse legacy or evidence-shaped `ps` output into rows. Tolerates CRLF so a
  * snapshot parsed on any host stays correct; `command` (last field) keeps its
diff --git a/src/shared/protocol-version.ts b/src/shared/protocol-version.ts
index ed235094473..e4121c95a67 100644
--- a/src/shared/protocol-version.ts
+++ b/src/shared/protocol-version.ts
@@ -121,15 +121,27 @@ export const AGENT_SESSION_HOST_AUTHORITY_RUNTIME_CAPABILITY =
   'agent-session.host-authority.v1' as const
 export const AGENT_SESSION_OMP_RESUME_PATH_RUNTIME_CAPABILITY =
   'agent-session.omp-resume-path.v1' as const
-// Why: structured sessions are journal-backed, not PTY-backed, so a client that
-// cannot read them must not see them at all — it would render an agent tab it
-// can neither display nor drive. The host also refuses every agentSession.*
-// method from a connection that does not advertise this.
+// Why: structured sessions are journal-backed, not PTY-backed, so an incapable client must not
+// receive their journal or drive their lifecycle. Mobile may receive a metadata-only placeholder;
+// the host still refuses agentSession.* methods and destructive tab mutations without capability.
 export const STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY = 'agent-session.structured.v1' as const
+// Why: paired clients advertise Claude-structured support so the host can gate its agent-specific
+// journal and lifecycle surfaces independently from Codex support.
+export const CLAUDE_STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY =
+  'agent-session.structured.claude.v1' as const
 // Why: paired structured clients explicitly hold every visible session surface, allowing the host
 // to stop provider children after the last surface closes without tying lifetime to a transport.
 export const STRUCTURED_AGENT_SESSION_HOLD_RUNTIME_CAPABILITY =
   'agent-session.structured.hold.v1' as const
+// Why: a client holding only a session id — an Agent Session History row — asks the host to
+// republish that chat's tab. An older host has no such method, and a client must learn that during
+// negotiation rather than by calling and reading a refusal it cannot distinguish from a real one.
+export const STRUCTURED_AGENT_SESSION_REVEAL_RUNTIME_CAPABILITY =
+  'agent-session.structured.reveal.v1' as const
+// Why: agentSession.subscribeStatus is additive to a surface that already shipped, so a host
+// advertising agent-session.structured.v1 may still answer it with method_not_found. Clients must
+// probe before subscribing or they reconnect forever and never show any status at all.
+export const AGENT_SESSION_STATUS_FEED_RUNTIME_CAPABILITY = 'agent-session.status-feed.v1' as const
 // Why: adding kimi to RESUMABLE_TUI_AGENTS grows terminal.ensureAgentSession's enum, and an
 // older host answers the unknown member with invalid_argument — a code the launch fallback does
 // not retry on — so clients must probe before taking the host-authority path.
@@ -226,6 +238,8 @@ export const RUNTIME_CAPABILITIES = [
   AGENT_SESSION_OMP_RESUME_PATH_RUNTIME_CAPABILITY,
   STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY,
   STRUCTURED_AGENT_SESSION_HOLD_RUNTIME_CAPABILITY,
+  STRUCTURED_AGENT_SESSION_REVEAL_RUNTIME_CAPABILITY,
+  AGENT_SESSION_STATUS_FEED_RUNTIME_CAPABILITY,
   AGENT_SESSION_KIMI_RESUME_RUNTIME_CAPABILITY,
   FILE_MUTATION_OWNERSHIP_RUNTIME_CAPABILITY,
   GITHUB_MARK_PR_READY_RUNTIME_CAPABILITY,
diff --git a/src/shared/quick-open-filter.test.ts b/src/shared/quick-open-filter.test.ts
index 1d96bc1744f..c481a1e8854 100644
--- a/src/shared/quick-open-filter.test.ts
+++ b/src/shared/quick-open-filter.test.ts
@@ -102,6 +102,43 @@ describe('buildExcludePathPrefixes', () => {
 })
 
 describe('shouldExcludeQuickOpenRelPath', () => {
+  it('matches the original filter across boundary and Unicode path combinations', () => {
+    const paths = [
+      '',
+      '/',
+      'a',
+      'a/',
+      'a//',
+      'ab',
+      'a/b',
+      'a\\b',
+      'A/b',
+      '界/😀',
+      '界/😀x',
+      'a[1]/x',
+      'a./x'
+    ]
+    for (const prefix of paths) {
+      for (const relPath of paths) {
+        const expected =
+          relPath === prefix || (relPath.length > prefix.length && relPath.startsWith(`${prefix}/`))
+        expect(shouldExcludeQuickOpenRelPath(relPath, [prefix])).toBe(expected)
+      }
+    }
+  })
+
+  it('preserves normalized Windows and UNC exclusion boundaries', () => {
+    for (const [root, excluded] of [
+      ['C:\\Repo', 'C:\\Repo\\trees\\one'],
+      ['\\\\server\\share\\repo', '\\\\server\\share\\repo\\trees\\one']
+    ]) {
+      const prefixes = buildExcludePathPrefixes(root, [excluded])
+      expect(prefixes).toEqual(['trees/one'])
+      expect(shouldExcludeQuickOpenRelPath('trees/one/file.ts', prefixes)).toBe(true)
+      expect(shouldExcludeQuickOpenRelPath('trees/one-more/file.ts', prefixes)).toBe(false)
+    }
+  })
+
   it('matches exact and boundary paths only', () => {
     expect(shouldExcludeQuickOpenRelPath('packages/app', ['packages/app'])).toBe(true)
     expect(shouldExcludeQuickOpenRelPath('packages/app/x.ts', ['packages/app'])).toBe(true)
diff --git a/src/shared/quick-open-filter.ts b/src/shared/quick-open-filter.ts
index 9d5bebd80b3..b7592657a11 100644
--- a/src/shared/quick-open-filter.ts
+++ b/src/shared/quick-open-filter.ts
@@ -119,7 +119,7 @@ export function shouldExcludeQuickOpenRelPath(
     if (relPath === prefix) {
       return true
     }
-    if (relPath.length > prefix.length && relPath.startsWith(`${prefix}/`)) {
+    if (relPath[prefix.length] === '/' && relPath.startsWith(prefix)) {
       return true
     }
   }
diff --git a/src/shared/relay-artifacts.ts b/src/shared/relay-artifacts.ts
index 273f6e059b8..73ce8c7af1b 100644
--- a/src/shared/relay-artifacts.ts
+++ b/src/shared/relay-artifacts.ts
@@ -37,6 +37,12 @@ export type RelayArtifact = {
    * optional one would loop forever redeploying a relay that is already correct.
    */
   optional?: boolean
+  /**
+   * Forked by the relay daemon as a long-lived child of its own. These are relay
+   * infrastructure, never user work, and the reap gate subtracts them from a daemon's
+   * child census; see src/main/ssh/relay-daemon-service-children.ts.
+   */
+  daemonServiceChild?: boolean
 }
 
 /** The bare Windows process-table addon; see docs/reference/windows-process-enumeration.md. */
@@ -44,13 +50,17 @@ export const RELAY_WINDOWS_PROCESS_TREE_FILENAME = 'windows-process-tree.node'
 
 export const RELAY_ARTIFACTS: readonly RelayArtifact[] = [
   { filename: 'relay.js' },
-  { filename: 'relay-watcher.js' },
-  { filename: 'relay-ai-vault-service.js' },
+  { filename: 'relay-watcher.js', daemonServiceChild: true },
+  { filename: 'relay-ai-vault-service.js', daemonServiceChild: true },
   { filename: 'managed-hook-runtime.js' },
   // Forked by the AI Vault title reader; without it a relay answers every WSL
   // title request with no title and no error.
   { filename: 'wsl-transcript-fs-process-entry.js' },
   { filename: 'node-pty-1.1.0-console-list-agent-patch.cjs', windowsOnly: true },
+  // The ConPTY teardown release the desktop's own node-pty patch already carries; pnpm patches do
+  // not cross the SSH boundary, so a relay ran the unpatched npm tree and leaked one Windows File
+  // handle per terminal for the life of the relay process.
+  { filename: 'node-pty-1.1.0-windows-pty-teardown-patch.cjs', windowsOnly: true },
   // Only Linux relays run it, but it ships everywhere: the manifest's only
   // platform axis is Windows, and a second one would buy nothing but a fork in
   // the hash. Its presence is what moves a host to a fresh relay directory, and
@@ -62,6 +72,14 @@ export const RELAY_ARTIFACTS: readonly RelayArtifact[] = [
   { filename: RELAY_WINDOWS_PROCESS_TREE_FILENAME, windowsOnly: true, optional: true }
 ]
 
+/**
+ * The daemon's own service children, by entry filename. Anything else under a relay pid is
+ * either user work or unidentified, and both keep the relay unreapable.
+ */
+export const RELAY_DAEMON_SERVICE_ENTRY_FILENAMES: readonly string[] = RELAY_ARTIFACTS.filter(
+  (artifact) => artifact.daemonServiceChild
+).map((artifact) => artifact.filename)
+
 /** Written after the artifacts, so it is never an input to its own hash. */
 export const RELAY_VERSION_FILENAME = '.version'
 
diff --git a/src/shared/relay-frame-buffer.test.ts b/src/shared/relay-frame-buffer.test.ts
new file mode 100644
index 00000000000..55dd744e57a
--- /dev/null
+++ b/src/shared/relay-frame-buffer.test.ts
@@ -0,0 +1,69 @@
+import { describe, expect, it, vi } from 'vitest'
+import { RelayFrameBuffer } from './relay-frame-buffer'
+
+describe('RelayFrameBuffer', () => {
+  it('preserves a byte stream across fragmented peeks, takes, discards and drains', () => {
+    const buffer = new RelayFrameBuffer()
+    let expected = Buffer.alloc(0)
+    for (let step = 0; step < 5000; step += 1) {
+      const chunk = Buffer.from([step % 256, (step + 1) % 256, (step + 2) % 256])
+      buffer.append(chunk)
+      expected = Buffer.concat([expected, chunk])
+      if (step % 3 === 0) {
+        const count = Math.min(expected.length, 5)
+        expect(buffer.peek(count).subarray(0, count)).toEqual(expected.subarray(0, count))
+        expect(buffer.take(count)).toEqual(expected.subarray(0, count))
+        expected = expected.subarray(count)
+      }
+      if (step % 7 === 0) {
+        const count = Math.min(expected.length, 4)
+        buffer.discard(count)
+        expected = expected.subarray(count)
+      }
+      if (step % 101 === 0) {
+        expect(buffer.drain()).toEqual(expected)
+        expected = Buffer.alloc(0)
+      }
+      expect(buffer.length).toBe(expected.length)
+    }
+    expect(buffer.drain()).toEqual(expected)
+    expect(buffer.drain()).toEqual(Buffer.alloc(0))
+  })
+
+  it('releases consumed references and amortizes storage compaction in a large backlog', () => {
+    const buffer = new RelayFrameBuffer()
+    const chunks = Array.from({ length: 32768 }, (_, index) => Buffer.from([index % 256]))
+    for (const chunk of chunks) {
+      buffer.append(chunk)
+    }
+    const shifted = vi.spyOn(Array.prototype, 'shift')
+    let shiftCount: number
+    try {
+      buffer.discard(16000)
+      shiftCount = shifted.mock.calls.length
+    } finally {
+      shifted.mockRestore()
+    }
+    expect(shiftCount).toBe(0)
+    const storage = buffer as unknown as { chunks: (Buffer | undefined)[]; head: number }
+    expect(storage.chunks.slice(0, storage.head).every((chunk) => chunk === undefined)).toBe(true)
+    expect(buffer.take(1000)).toEqual(Buffer.concat(chunks.slice(16000, 17000)))
+    expect(storage.chunks.length).toBeLessThan(chunks.length)
+    expect(buffer.drain()).toEqual(Buffer.concat(chunks.slice(17000)))
+    expect(storage.chunks).toHaveLength(0)
+    expect(buffer.length).toBe(0)
+  })
+
+  it('keeps single-chunk views and clears partial data before reuse', () => {
+    const buffer = new RelayFrameBuffer()
+    const chunk = Buffer.from('abcdef')
+    buffer.append(chunk)
+    expect(buffer.peek(2)).toBe(chunk)
+    const taken = buffer.take(2)
+    expect(taken.buffer).toBe(chunk.buffer)
+    expect(taken.toString()).toBe('ab')
+    buffer.clear()
+    buffer.append(Buffer.from('fresh'))
+    expect(buffer.drain().toString()).toBe('fresh')
+  })
+})
diff --git a/src/shared/relay-frame-buffer.ts b/src/shared/relay-frame-buffer.ts
index 5083804f1e1..a851426c6d8 100644
--- a/src/shared/relay-frame-buffer.ts
+++ b/src/shared/relay-frame-buffer.ts
@@ -1,5 +1,6 @@
 export class RelayFrameBuffer {
-  private chunks: Buffer[] = []
+  private chunks: (Buffer | undefined)[] = []
+  private head = 0
   private bytes = 0
 
   get length(): number {
@@ -13,23 +14,28 @@ export class RelayFrameBuffer {
 
   clear(): void {
     this.chunks = []
+    this.head = 0
     this.bytes = 0
   }
 
   drain(): Buffer {
-    const out = this.chunks.length === 1 ? this.chunks[0] : Buffer.concat(this.chunks, this.bytes)
+    const out =
+      this.chunks.length - this.head === 1
+        ? this.chunks[this.head]!
+        : Buffer.concat(this.chunks.slice(this.head) as Buffer[], this.bytes)
     this.clear()
     return out
   }
 
   peek(count: number): Buffer {
-    const first = this.chunks[0]
+    const first = this.chunks[this.head]!
     if (first.length >= count) {
       return first
     }
     const out = Buffer.allocUnsafe(count)
     let copied = 0
-    for (const part of this.chunks) {
+    for (let index = this.head; index < this.chunks.length; index += 1) {
+      const part = this.chunks[index]!
       copied += part.copy(out, copied, 0, Math.min(part.length, count - copied))
       if (copied >= count) {
         break
@@ -39,43 +45,56 @@ export class RelayFrameBuffer {
   }
 
   take(count: number): Buffer {
-    const first = this.chunks[0]
+    const first = this.chunks[this.head]!
     if (first.length === count) {
-      this.chunks.shift()
+      this.removeHead()
       this.bytes -= count
       return first
     }
     if (first.length > count) {
-      this.chunks[0] = first.subarray(count)
+      this.chunks[this.head] = first.subarray(count)
       this.bytes -= count
       return first.subarray(0, count)
     }
     const out = Buffer.allocUnsafe(count)
     let copied = 0
     while (copied < count) {
-      const part = this.chunks[0]
+      const part = this.chunks[this.head]!
       const take = Math.min(part.length, count - copied)
       part.copy(out, copied, 0, take)
       copied += take
       if (take === part.length) {
-        this.chunks.shift()
+        this.removeHead()
       } else {
-        this.chunks[0] = part.subarray(take)
+        this.chunks[this.head] = part.subarray(take)
       }
     }
     this.bytes -= count
     return out
   }
 
+  private removeHead(): void {
+    this.chunks[this.head] = undefined
+    this.head += 1
+    // Amortize compaction without retaining consumed buffers.
+    if (
+      this.head === this.chunks.length ||
+      (this.head >= 1024 && this.head * 2 >= this.chunks.length)
+    ) {
+      this.chunks = this.chunks.slice(this.head)
+      this.head = 0
+    }
+  }
+
   discard(count: number): void {
     let remaining = count
     while (remaining > 0) {
-      const part = this.chunks[0]
+      const part = this.chunks[this.head]!
       if (part.length <= remaining) {
-        this.chunks.shift()
+        this.removeHead()
         remaining -= part.length
       } else {
-        this.chunks[0] = part.subarray(remaining)
+        this.chunks[this.head] = part.subarray(remaining)
         remaining = 0
       }
     }
diff --git a/src/shared/relay-host-close-reason.ts b/src/shared/relay-host-close-reason.ts
new file mode 100644
index 00000000000..460aa704a34
--- /dev/null
+++ b/src/shared/relay-host-close-reason.ts
@@ -0,0 +1,19 @@
+// Why a WebSocket close reason and not a JSON field: every relay-hello and
+// director-resolve schema on the phone is zod `.strict()`, so an added key is a
+// hard parse failure on already-shipped phones. The close reason is a wire slot
+// old peers never read, which makes it the only additive channel here.
+export const RELAY_HOST_CLOSE_REASON = {
+  // The desktop lost its Orca Cloud session (cleared, or refused with 401).
+  SIGNED_OUT: 'signed-out'
+} as const
+
+export type RelayHostCloseReason =
+  (typeof RELAY_HOST_CLOSE_REASON)[keyof typeof RELAY_HOST_CLOSE_REASON]
+
+const REASONS: readonly string[] = Object.values(RELAY_HOST_CLOSE_REASON)
+
+// Close reasons are attacker-adjacent free text; only exact known members count.
+export function relayHostCloseReasonFrom(value: unknown): RelayHostCloseReason | null {
+  const text = typeof value === 'string' ? value : (value?.toString() ?? '')
+  return REASONS.includes(text) ? (text as RelayHostCloseReason) : null
+}
diff --git a/src/shared/remote-execution-host-pty-id.ts b/src/shared/remote-execution-host-pty-id.ts
new file mode 100644
index 00000000000..c76ada39e03
--- /dev/null
+++ b/src/shared/remote-execution-host-pty-id.ts
@@ -0,0 +1,14 @@
+import { parseRemoteRuntimePtyId } from './remote-runtime-pty-id'
+import { parseAppSshPtyId } from './ssh-pty-id'
+
+/**
+ * Whether the process behind this pty runs on an execution host other than this machine —
+ * a paired runtime environment or an app SSH target.
+ *
+ * Deliberately broader than the inspection module's private remote check, which only counts a
+ * `remote:` id that carries an owner environment id. An owner-less `remote:<handle>` still runs
+ * somewhere else, and treating it as local is how remote work becomes invisible to a guard.
+ */
+export function isRemoteExecutionHostPtyId(ptyId: string): boolean {
+  return parseRemoteRuntimePtyId(ptyId) !== null || parseAppSshPtyId(ptyId) !== null
+}
diff --git a/src/shared/remote-foreground-evidence-admission.ts b/src/shared/remote-foreground-evidence-admission.ts
index 335d724d7b8..b9f060a346b 100644
--- a/src/shared/remote-foreground-evidence-admission.ts
+++ b/src/shared/remote-foreground-evidence-admission.ts
@@ -40,7 +40,16 @@ export function admitRemoteForegroundEvidence(
     0,
     admission.receivedAtMonotonic - admission.requestStartedAtMonotonic
   )
-  if (value.capturedAgeMs + receiveDelay > REMOTE_FOREGROUND_EVIDENCE_MAX_AGE_MS) {
+  // The larger of the two, never their sum: `ps` runs INSIDE this round trip, so its duration is
+  // already in `receiveDelay`, and `capturedAgeMs` -- stamped at capture start -- is that same
+  // duration measured on the host's clock. Adding them charged the capture twice and halved the
+  // budget this ceiling actually grants a host, from ~2.0s of `ps` to ~1.0s: a 1.2s capture
+  // stamped 1200 and arrived at 1300, summed to 2500, and was refused as too old at 1.3s.
+  //
+  // Not the same shape as the sweep's gate, which sums deliberately and correctly:
+  // `evidenceAgeSinceListingMs` is stamped AFTER the listing arrives, so it measures only
+  // planning time and overlaps nothing.
+  if (Math.max(value.capturedAgeMs, receiveDelay) > REMOTE_FOREGROUND_EVIDENCE_MAX_AGE_MS) {
     return null
   }
   if (
diff --git a/src/shared/remote-foreground-evidence.test.ts b/src/shared/remote-foreground-evidence.test.ts
index 10b9371b7c0..2fc1f8f93fc 100644
--- a/src/shared/remote-foreground-evidence.test.ts
+++ b/src/shared/remote-foreground-evidence.test.ts
@@ -59,14 +59,82 @@ describe('remote foreground evidence contract', () => {
     expect(
       admitRemoteForegroundEvidence(live, { ...base, expectedIncarnationId: 'inc-2' })
     ).toBeNull()
+    // `+ 1`, not the ceiling itself: the ceiling used to be crossed by the ceiling plus this
+    // admission's 10ms round trip, which was the capture being charged a second time.
     expect(
       admitRemoteForegroundEvidence(
-        { ...live, capturedAgeMs: REMOTE_FOREGROUND_EVIDENCE_MAX_AGE_MS },
+        { ...live, capturedAgeMs: REMOTE_FOREGROUND_EVIDENCE_MAX_AGE_MS + 1 },
         base
       )
     ).toBeNull()
   })
 
+  // The capture runs inside the round trip, so `capturedAgeMs` and `receiveDelay` measure
+  // overlapping intervals on two clocks. Summing them charged `ps` twice and halved the budget
+  // this ceiling grants a host; these pin the boundary on the surviving measurement.
+  describe('does not charge the capture twice', () => {
+    const admission = {
+      expectedPtyId: 'pty-1',
+      expectedIncarnationId: 'inc-1',
+      requestStartedAtMonotonic: 0,
+      receivedAtMonotonic: 0,
+      lastAuthorityGeneration: 'host-a',
+      lastObservationEpoch: 3
+    }
+
+    it('admits a capture whose duration alone is inside the ceiling', () => {
+      // 1,200ms on the host, 1,300ms round trip: the same 1.2s of `ps` seen twice. The sum said
+      // 2,500 and refused it; the observation is 1.3s old.
+      expect(
+        admitRemoteForegroundEvidence(
+          { ...live, capturedAgeMs: 1_200 },
+          { ...admission, receivedAtMonotonic: 1_300 }
+        )
+      ).not.toBeNull()
+    })
+
+    it.each([
+      ['host-measured', REMOTE_FOREGROUND_EVIDENCE_MAX_AGE_MS - 1, 0],
+      ['client-measured', 0, REMOTE_FOREGROUND_EVIDENCE_MAX_AGE_MS - 1]
+    ])('admits at the %s boundary', (_label, capturedAgeMs, receiveDelay) => {
+      expect(
+        admitRemoteForegroundEvidence(
+          { ...live, capturedAgeMs },
+          { ...admission, receivedAtMonotonic: receiveDelay }
+        )
+      ).not.toBeNull()
+    })
+
+    it.each([
+      ['host-measured', REMOTE_FOREGROUND_EVIDENCE_MAX_AGE_MS + 1, 0],
+      ['client-measured', 0, REMOTE_FOREGROUND_EVIDENCE_MAX_AGE_MS + 1]
+    ])('refuses one step past the %s boundary', (_label, capturedAgeMs, receiveDelay) => {
+      expect(
+        admitRemoteForegroundEvidence(
+          { ...live, capturedAgeMs },
+          { ...admission, receivedAtMonotonic: receiveDelay }
+        )
+      ).toBeNull()
+    })
+
+    it('still admits the prompt unverifiable a capture over its budget produces', () => {
+      // The reason the evidence path gives up on a slow capture rather than publishing a late
+      // truthful one: a REFUSED record is what bumps `consecutiveInspectionErrors` and stalls the
+      // completion poller, while an admitted `unverifiable` costs a poll and nothing else.
+      expect(
+        admitRemoteForegroundEvidence(
+          {
+            ...live,
+            verdict: 'unverifiable' as const,
+            reason: 'process_table_unreadable',
+            capturedAgeMs: 0
+          },
+          admission
+        )
+      ).not.toBeNull()
+    })
+  })
+
   it('rejects delayed observations from a previously accepted host generation', () => {
     const knownAuthorityGenerations = new Set(['host-a', 'host-b'])
     const admission = {
diff --git a/src/shared/runtime-listing-host-scope.test.ts b/src/shared/runtime-listing-host-scope.test.ts
new file mode 100644
index 00000000000..a5fd79de454
--- /dev/null
+++ b/src/shared/runtime-listing-host-scope.test.ts
@@ -0,0 +1,81 @@
+import { describe, expect, it } from 'vitest'
+import { hostScopeCensusIsComplete } from './runtime-listing-host-scope'
+
+/**
+ * The gate and the disclosure list answer different questions off the same field. These pin the
+ * cases where they disagree — which is every case that mattered in #18595.
+ */
+describe('hostScopeCensusIsComplete', () => {
+  it('reads a peer runtime as disclosure, not as coverage this host owed', () => {
+    expect(
+      hostScopeCensusIsComplete({ hostIds: ['local'], omittedHostIds: ['runtime:env-7'] })
+    ).toBe(true)
+  })
+
+  it('still reads an SSH host as a gap, because this runtime does query those', () => {
+    expect(hostScopeCensusIsComplete({ hostIds: ['local'], omittedHostIds: ['ssh:box-1'] })).toBe(
+      false
+    )
+  })
+
+  it('reads a mixed omission as incomplete on the strength of the SSH host alone', () => {
+    expect(
+      hostScopeCensusIsComplete({
+        hostIds: ['local'],
+        omittedHostIds: ['runtime:env-7', 'ssh:box-1']
+      })
+    ).toBe(false)
+  })
+
+  it('calls a clean census complete', () => {
+    expect(hostScopeCensusIsComplete({ hostIds: ['local', 'ssh:box-1'], omittedHostIds: [] })).toBe(
+      true
+    )
+  })
+
+  // Defence in depth: `listKnownExecutionHostIds` always seeds `local`, so a real scope that
+  // covered nothing also omits `local` and is refused by the runtime-only rule anyway. This
+  // branch is what stops a scope that answered for no host from ever reading complete if that
+  // ever stops holding.
+  it('refuses a listing that covered no host at all', () => {
+    expect(hostScopeCensusIsComplete({ hostIds: [], omittedHostIds: ['runtime:env-7'] })).toBe(
+      false
+    )
+    expect(hostScopeCensusIsComplete({ hostIds: [], omittedHostIds: [] })).toBe(false)
+  })
+
+  // Why: `hostScope` shipped in v1.4.187. An older host cannot say what it covered, and absence
+  // of the claim is never the claim — this must stay the first branch.
+  it('refuses a host too old to publish a scope', () => {
+    expect(hostScopeCensusIsComplete(undefined)).toBe(false)
+  })
+
+  // Why: without this the runtime-only rule trusts a coverage claim it cannot read — the shape
+  // `{hostIds: ['runtime:'], omittedHostIds: ['runtime:env-7']}` was `unverifiable` before the
+  // gate changed and must not become `complete` on the strength of an unparseable id.
+  it('refuses a coverage claim with no legible host in it', () => {
+    expect(
+      hostScopeCensusIsComplete({
+        hostIds: ['runtime:' as never],
+        omittedHostIds: ['runtime:env-7']
+      })
+    ).toBe(false)
+  })
+
+  // Why "at least one legible" and not "all legible": a host that later gains a kind this client
+  // cannot parse must not report an incomplete census forever — that is this bug in a new coat.
+  it('accepts a coverage claim carrying one legible host beside an unreadable one', () => {
+    expect(
+      hostScopeCensusIsComplete({ hostIds: ['local', 'newkind:x' as never], omittedHostIds: [] })
+    ).toBe(true)
+  })
+
+  it('refuses an unparseable host id rather than discounting it', () => {
+    expect(
+      hostScopeCensusIsComplete({
+        hostIds: ['local'],
+        omittedHostIds: ['runtime:' as never]
+      })
+    ).toBe(false)
+  })
+})
diff --git a/src/shared/runtime-listing-host-scope.ts b/src/shared/runtime-listing-host-scope.ts
index 6232b0a4259..97dbb1a8249 100644
--- a/src/shared/runtime-listing-host-scope.ts
+++ b/src/shared/runtime-listing-host-scope.ts
@@ -1,4 +1,4 @@
-import type { ExecutionHostId } from './execution-host'
+import { parseExecutionHostId, type ExecutionHostId } from './execution-host'
 
 /**
  * What a bounded listing did and did not cover, by execution host. An absent scope means the
@@ -10,3 +10,32 @@ export type RuntimeListingHostScope = {
   hostIds: ExecutionHostId[]
   omittedHostIds: ExecutionHostId[]
 }
+
+/**
+ * Whether the answering runtime enumerated every host its listing owed coverage for.
+ *
+ * `omittedHostIds` is a disclosure list and deliberately over-names — `omitted-host-scope-selectors.ts`
+ * keeps ids for servers that are no longer paired so a caller can still see the gap. That makes it the
+ * wrong input for a completeness gate, which needs "coverage owed and not delivered". The two jobs pull
+ * in opposite directions, and reading the disclosure list as the gate latched every remote pane on any
+ * client that had ever paired outward (#18595).
+ *
+ * A `runtime:` host is never owed coverage by the runtime answering: a paired runtime is a peer with its
+ * own control plane, reached with `--environment`, and this runtime has no paired-runtime PTY provider to
+ * have queried. Its terminals are its own answer to give, so its presence here is disclosure, not a gap.
+ */
+export function hostScopeCensusIsComplete(scope: RuntimeListingHostScope | undefined): boolean {
+  // A host too old to publish a scope cannot claim one; absence is never completeness.
+  if (scope === undefined) {
+    return false
+  }
+  // A listing that covered no host proves nothing, and an unreadable coverage claim is not a
+  // claim: `isTerminalListResult` checks only that `hostIds` is an array, so at least one covered
+  // id has to be legible before the claim can be believed. Deliberately "at least one" rather than
+  // "all": a host that later gains a kind this client cannot parse would otherwise report an
+  // incomplete census forever, which is the bug this predicate exists to stop.
+  if (!scope.hostIds.some((hostId) => parseExecutionHostId(hostId))) {
+    return false
+  }
+  return scope.omittedHostIds.every((hostId) => parseExecutionHostId(hostId)?.kind === 'runtime')
+}
diff --git a/src/shared/runtime-mobile-session-tab-contracts.ts b/src/shared/runtime-mobile-session-tab-contracts.ts
index d43c43dd4e0..01a7b1ba4da 100644
--- a/src/shared/runtime-mobile-session-tab-contracts.ts
+++ b/src/shared/runtime-mobile-session-tab-contracts.ts
@@ -93,7 +93,7 @@ export type RuntimeMobileSessionAgentTab = {
   id: string
   title: string
   sessionId: string
-  agent: 'codex'
+  agent: 'claude' | 'codex'
   color?: string | null
   isPinned?: boolean
   isActive: boolean
diff --git a/src/shared/search-subprocess-lines.test.ts b/src/shared/search-subprocess-lines.test.ts
index 3344776072e..34425801105 100644
--- a/src/shared/search-subprocess-lines.test.ts
+++ b/src/shared/search-subprocess-lines.test.ts
@@ -1,7 +1,32 @@
-import { describe, expect, it } from 'vitest'
+import { describe, expect, it, vi } from 'vitest'
 import { SearchSubprocessLineAccumulator } from './search-subprocess-lines'
 
 describe('SearchSubprocessLineAccumulator', () => {
+  it('keeps complete decoded batches as strings without allocating byte copies', () => {
+    const parser = new SearchSubprocessLineAccumulator()
+    const lines: string[] = []
+    const from = vi.spyOn(Buffer, 'from')
+    let copies: number
+    try {
+      parser.push('first🐋\n\nlast\n', (line) => lines.push(line))
+      copies = from.mock.calls.length
+    } finally {
+      from.mockRestore()
+    }
+    expect(copies).toBe(0)
+    expect(lines).toEqual(['first🐋', '', 'last'])
+    expect(parser.finish()).toBeNull()
+  })
+
+  it('still enforces per-line UTF-8 byte limits for decoded batches', () => {
+    const parser = new SearchSubprocessLineAccumulator(4)
+    const lines: string[] = []
+    expect(parser.push('éé\n漢\n', (line) => lines.push(line))).toBe(true)
+    expect(parser.push('漢é\n', (line) => lines.push(line))).toBe(false)
+    expect(lines).toEqual(['éé', '漢'])
+    expect(parser.finish()).toBeNull()
+  })
+
   it('preserves UTF-8 records split across raw byte chunks', () => {
     const parser = new SearchSubprocessLineAccumulator(32)
     const bytes = Buffer.from('first🐋\nsecond')
diff --git a/src/shared/search-subprocess-lines.ts b/src/shared/search-subprocess-lines.ts
index 5c04d9e8292..26f98b4d348 100644
--- a/src/shared/search-subprocess-lines.ts
+++ b/src/shared/search-subprocess-lines.ts
@@ -12,6 +12,20 @@ export class SearchSubprocessLineAccumulator {
   }
 
   push(rawChunk: Buffer | string, onLine: (line: string) => void): boolean {
+    // Three bytes per UTF-16 code unit bounds UTF-8 size without re-encoding complete batches.
+    if (
+      typeof rawChunk === 'string' &&
+      this.bytes === 0 &&
+      rawChunk.endsWith('\n') &&
+      rawChunk.length * 3 <= this.maxLineBytes
+    ) {
+      const lines = rawChunk.split('\n')
+      lines.pop()
+      for (const line of lines) {
+        onLine(line)
+      }
+      return true
+    }
     const chunk = Buffer.isBuffer(rawChunk) ? rawChunk : Buffer.from(rawChunk, 'utf8')
     let cursor = 0
     while (cursor < chunk.length) {
diff --git a/src/shared/secure-file.test.ts b/src/shared/secure-file.test.ts
index d7b7e9e4415..2439c6d2137 100644
--- a/src/shared/secure-file.test.ts
+++ b/src/shared/secure-file.test.ts
@@ -1,24 +1,73 @@
-import { execFile, execFileSync } from 'node:child_process'
 import { chmodSync, mkdirSync, mkdtempSync, rmSync, statSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { runProcess, runProcessSync } from './child-process/run-process'
+import { mayAttemptHardening } from './secure-path-hardening-retry-budget'
 import {
   __getSecureFileHardeningCacheStateForTests,
   __resetSecureFileHardenedPathsForTests,
   __resetSecureFileWindowsUserSidForTests,
   hardenExistingSecureFile,
   hardenSecurePath,
+  isUnreadableError,
   writeSecureFile
 } from './secure-file'
 
 const posixModeIt = process.platform === 'win32' ? it.skip : it
 
-vi.mock('child_process', () => ({
-  execFileSync: vi.fn(),
-  execFile: vi.fn()
+vi.mock('./child-process/run-process', () => ({
+  runProcess: vi.fn(),
+  runProcessSync: vi.fn()
 }))
 
+const OK = { code: 0, signal: null, stdout: '', stderr: '', timedOut: false }
+const USER_SID = 'S-1-5-21-1000'
+
+type FakeSpec = { program: string; args?: readonly string[] }
+
+/** Paths the fake considers already hardened, with the ACE flags the grant pass used. */
+const hardenedByFake = new Map<string, string>()
+
+/** Paths whose verify pass should answer with a DACL that is not the intended one. */
+const forcedBadSddl = new Map<string, string>()
+
+/**
+ * Stands in for icacls. `/save` really writes a UTF-16LE SDDL file, because the code under test
+ * reads that file back off disk — which also means these tests exercise the real SDDL parser
+ * rather than a restatement of it.
+ */
+function fakeIcacls(spec: FakeSpec): typeof OK {
+  const args = spec.args ?? []
+  const path = args[0] ?? ''
+  const grantIndex = args.indexOf('/grant:r')
+  if (grantIndex !== -1) {
+    const grant = args[grantIndex + 1]!
+    hardenedByFake.set(path, grant.includes('(OI)(CI)') ? 'OICI' : '')
+    return OK
+  }
+  const saveIndex = args.indexOf('/save')
+  if (saveIndex === -1) {
+    return OK // /reset
+  }
+  writeFileSync(args[saveIndex + 1]!, fakeSddl(path), 'utf16le')
+  return OK
+}
+
+function fakeSddl(path: string): string {
+  const forced = forcedBadSddl.get(path)
+  if (forced) {
+    return `name\r\n${forced}\r\n`
+  }
+  const aceFlags = hardenedByFake.get(path)
+  if (aceFlags === undefined) {
+    // Never hardened: the inherited DACL a fresh file carries, so the first verify must fail.
+    return `name\r\nD:(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;FA;;;${USER_SID})\r\n`
+  }
+  const ace = (sid: string): string => `(A;${aceFlags};FA;;;${sid})`
+  return `name\r\nD:PAI${ace('BA')}${ace('SY')}${ace(USER_SID)}\r\n`
+}
+
 describe('hardenSecurePath', () => {
   const originalSystemRoot = process.env.SystemRoot
   const originalWindir = process.env.WINDIR
@@ -30,24 +79,19 @@ describe('hardenSecurePath', () => {
     delete process.env.WINDIR
     __resetSecureFileWindowsUserSidForTests()
     __resetSecureFileHardenedPathsForTests()
-    vi.mocked(execFileSync).mockReset()
-    vi.mocked(execFile).mockReset()
-    // execFileSync handles whoami.exe (SID lookup) and the SYNCHRONOUS PowerShell file-ACL
-    // path used by writeSecureFile. The directory + read-path re-harden use async execFile.
-    vi.mocked(execFileSync).mockImplementation((file) => {
-      if (file === 'C:\\Windows\\System32\\whoami.exe') {
-        return '"USER","S-1-5-21-1000"'
+    vi.mocked(runProcessSync).mockReset()
+    vi.mocked(runProcess).mockReset()
+    hardenedByFake.clear()
+    forcedBadSddl.clear()
+    // runProcessSync serves whoami.exe (SID lookup) and the SYNCHRONOUS icacls file-ACL path
+    // used by writeSecureFile. Directory + read-path re-hardens use async runProcess.
+    vi.mocked(runProcessSync).mockImplementation((spec) => {
+      if (spec.program === 'C:\\Windows\\System32\\whoami.exe') {
+        return { ...OK, stdout: `"USER","${USER_SID}"` }
       }
-      // Synchronous PowerShell ACL apply succeeds (returns empty stdout).
-      return ''
-    })
-    // Directory + read-path PowerShell is called asynchronously; simulate immediate success
-    vi.mocked(execFile).mockImplementation((_file, _args, _opts, callback) => {
-      if (typeof callback === 'function') {
-        callback(null, '', '')
-      }
-      return {} as ReturnType<typeof execFile>
+      return fakeIcacls(spec)
     })
+    vi.mocked(runProcess).mockImplementation((spec) => Promise.resolve(fakeIcacls(spec)))
   })
 
   afterEach(() => {
@@ -71,64 +115,358 @@ describe('hardenSecurePath', () => {
     }
   })
 
-  it('rewrites Windows ACLs through the system PowerShell path', () => {
+  it('rewrites Windows ACLs through icacls, purging explicit ACEs before granting', async () => {
     hardenSecurePath('C:\\Users\\me\\.orca\\secret.json', {
       isDirectory: false,
       platform: 'win32'
     })
+    await flushAsyncAcl()
 
     // whoami.exe called synchronously to obtain SID
-    expect(execFileSync).toHaveBeenNthCalledWith(
-      1,
-      'C:\\Windows\\System32\\whoami.exe',
-      ['/user', '/fo', 'csv', '/nh'],
-      expect.objectContaining({ encoding: 'utf-8' })
-    )
-    // PowerShell called asynchronously
-    const [powershellFile, powershellArgs, powershellOptions] = vi.mocked(execFile).mock.calls[0]!
-    expect(powershellFile).toBe('C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe')
-    expect(powershellArgs).toEqual(
-      expect.arrayContaining([
-        '-NoProfile',
-        '-NonInteractive',
-        '-ExecutionPolicy',
-        'Bypass',
-        'C:\\Users\\me\\.orca\\secret.json',
-        'S-1-5-21-1000',
-        '0'
-      ])
-    )
-    const script = (powershellArgs as string[])[5]!
-    expect(script).toContain('SetAccessRuleProtection($true, $false)')
-    expect(script).toContain('RemoveAccessRuleSpecific')
-    expect(script).toContain('Unexpected ACL entry')
-    expect(powershellOptions).toEqual(expect.objectContaining({ windowsHide: true, timeout: 5000 }))
-  })
-
-  it('adds inheritable rules when hardening a Windows directory', () => {
-    hardenSecurePath('C:\\Users\\me\\.orca', { isDirectory: true, platform: 'win32' })
-
-    const powershellArgs = vi.mocked(execFile).mock.calls[0]![1] as string[]
-    expect(powershellArgs.at(-1)).toBe('1')
-    expect(powershellArgs[5]).toContain('ContainerInherit')
-    expect(powershellArgs[5]).toContain('ObjectInherit')
-  })
-
-  it('keeps Windows hardening best-effort when ACL rewriting fails', () => {
-    // Simulate async PowerShell failure — the callback receives an error
-    vi.mocked(execFile).mockImplementationOnce((_file, _args, _opts, callback) => {
-      if (typeof callback === 'function') {
-        callback(new Error('access denied'), '', '')
-      }
-      return {} as ReturnType<typeof execFile>
+    expect(vi.mocked(runProcessSync).mock.calls[0]![0]).toMatchObject({
+      program: 'C:\\Windows\\System32\\whoami.exe',
+      args: ['/user', '/fo', 'csv', '/nh']
     })
 
+    const specs = vi.mocked(runProcess).mock.calls.map(([spec]) => spec)
+    expect(specs.every((spec) => spec.program === 'C:\\Windows\\System32\\icacls.exe')).toBe(true)
+    // Verify runs first, so an already-correct DACL is never rewritten.
+    expect(specs[0]!.args?.slice(0, 2)).toEqual(['C:\\Users\\me\\.orca\\secret.json', '/save'])
+    expect(specs[1]!.args).toEqual(['C:\\Users\\me\\.orca\\secret.json', '/reset', '/q'])
+    expect(specs[2]!.args).toEqual([
+      'C:\\Users\\me\\.orca\\secret.json',
+      '/inheritance:r',
+      '/grant:r',
+      `*${USER_SID}:(F)`,
+      '/grant:r',
+      '*S-1-5-18:(F)',
+      '/grant:r',
+      '*S-1-5-32-544:(F)',
+      '/q'
+    ])
+    // The apply is read back: a loosened ACL has to be detectable, not just overwritten.
+    expect(specs[3]!.args?.slice(0, 2)).toEqual(['C:\\Users\\me\\.orca\\secret.json', '/save'])
+    expect(specs[2]!.timeoutMs).toBe(5000)
+  })
+
+  // BLOCKING 1: re-running /reset on an already-correct DACL restores the inherited (broader) one
+  // for the few ms until the grant pass lands, for no gain. A correct DACL must be left alone.
+  it('leaves an already-correct ACL untouched instead of rewriting it', async () => {
+    const target = 'C:\\Users\\me\\.orca\\secret.json'
+    hardenedByFake.set(target, '')
+
+    hardenSecurePath(target, { isDirectory: false, platform: 'win32' })
+    await flushAsyncAcl()
+
+    const specs = vi.mocked(runProcess).mock.calls.map(([spec]) => spec)
+    expect(specs).toHaveLength(1)
+    expect(specs[0]!.args).toContain('/save')
+    expect(specs.some((spec) => spec.args?.includes('/reset'))).toBe(false)
+    expect(specs.some((spec) => spec.args?.includes('/grant:r'))).toBe(false)
+  })
+
+  // BLOCKING 3: the verify pass must check *identity*, not just rule count, inheritance and rights.
+  // Granting Everyone full control satisfies all three of those and is the failure it exists for.
+  it.each([
+    ['full control to Everyone', 'D:PAI(A;;FA;;;BA)(A;;FA;;;SY)(A;;FA;;;WD)', 'S-1-1-0'],
+    ['a deny rule', `D:PAI(D;;FA;;;BA)(A;;FA;;;SY)(A;;FA;;;${USER_SID})`, 'unexpected D rule'],
+    ['an unprotected DACL', `D:AI(A;;FA;;;BA)(A;;FA;;;SY)(A;;FA;;;${USER_SID})`, 'not protected'],
+    [
+      'a surviving inherited rule',
+      `D:PAI(A;ID;FA;;;BA)(A;;FA;;;SY)(A;;FA;;;${USER_SID})`,
+      'inherited'
+    ],
+    ['read-only rights', `D:PAI(A;;FR;;;BA)(A;;FA;;;SY)(A;;FA;;;${USER_SID})`, 'not full control']
+  ])('rejects a verified DACL granting %s', async (_label, sddl, expected) => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const target = 'C:\\Users\\me\\.orca\\secret.json'
+    forcedBadSddl.set(target, sddl)
+
+    hardenSecurePath(target, { isDirectory: false, platform: 'win32' })
+    await flushAsyncAcl()
+
+    expect(warn).toHaveBeenCalledWith(
+      '[secure-path.windows-acl] failed to restrict path',
+      expect.objectContaining({
+        stage: 'verify',
+        detail: expect.stringContaining(expected)
+      })
+    )
+    warn.mockRestore()
+  })
+
+  /**
+   * Evicting the cache on every failed apply is the #4901 storm wearing a different hat: the env
+   * store re-hardens on the *read* path at ~2/s, so on a host where hardening legitimately cannot
+   * work (FAT32, network path, restricted token) that is two icacls spawns and two warnings a
+   * second, forever.
+   *
+   * The curve itself is pinned in secure-path-hardening-retry-budget.test.ts; what matters here is
+   * that the read path is actually wired to it.
+   */
+  it('collapses a failing read-path poll to a single attempt', async () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+    const targetPath = writeFailingHardenTarget()
+
+    for (let read = 0; read < 25; read++) {
+      hardenExistingSecureFile(targetPath)
+      await flushAsyncAcl()
+    }
+
+    expect(attemptsFor(targetPath)).toHaveLength(1)
+    warn.mockRestore()
+  })
+
+  /**
+   * A budget that expires rather than latching: three transient failures used to abandon a path
+   * for the life of the process, so one AV scan or momentary lock left every later credential
+   * write unprotected on a host where hardening would now succeed.
+   */
+  it('re-probes a long-failing path once its backoff has elapsed', async () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+    const targetPath = writeFailingHardenTarget()
+    let clock = performance.now()
+    const now = vi.spyOn(performance, 'now').mockImplementation(() => clock)
+
+    // A day of failing, well past any fixed cap, stepping by more than the 30-minute ceiling.
+    for (let step = 0; step < 48; step++) {
+      hardenExistingSecureFile(targetPath)
+      await flushAsyncAcl()
+      clock += 31 * 60_000
+    }
+
+    expect(attemptsFor(targetPath)).toHaveLength(48)
+    now.mockRestore()
+    warn.mockRestore()
+  })
+
+  it('reports recovery when a previously throttled path hardens again', async () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const info = vi.spyOn(console, 'info').mockImplementation(() => {})
+    Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+    const targetPath = writeFailingHardenTarget()
+    let clock = performance.now()
+    const now = vi.spyOn(performance, 'now').mockImplementation(() => clock)
+
+    // Three failures to reach the announced degraded state, each past its own backoff.
+    for (const wait of [0, 61_000, 121_000]) {
+      clock += wait
+      hardenExistingSecureFile(targetPath)
+      await flushAsyncAcl()
+    }
+    expect(throttleReports(warn, targetPath)).toHaveLength(1)
+
+    // The transient condition clears; the next re-probe must notice.
+    clock += 5 * 60_000
+    vi.mocked(runProcess).mockImplementation((spec) => Promise.resolve(fakeIcacls(spec)))
+    hardenExistingSecureFile(targetPath)
+    await flushAsyncAcl()
+
+    expect(info).toHaveBeenCalledWith(
+      '[secure-path.windows-acl] path hardening recovered',
+      expect.objectContaining({ targetPath, stage: 'recovered' })
+    )
+    now.mockRestore()
+    info.mockRestore()
+    warn.mockRestore()
+  })
+
+  /**
+   * The write path is exempt from the budget, but it was also invisible to it: a successful write
+   * left the failure record standing, so the read path went on backing off for up to 30 minutes
+   * after the host had demonstrably recovered, and no `recovered` transition came from this lane.
+   */
+  it('clears the read-path backoff when the exempt write path succeeds', async () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const info = vi.spyOn(console, 'info').mockImplementation(() => {})
+    Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+    const targetPath = writeFailingHardenTarget()
+    let clock = performance.now()
+    const now = vi.spyOn(performance, 'now').mockImplementation(() => clock)
+
+    // Three read-path failures: the path is throttled and its next re-probe is minutes away.
+    for (const wait of [0, 61_000, 121_000]) {
+      clock += wait
+      hardenExistingSecureFile(targetPath)
+      await flushAsyncAcl()
+    }
+    expect(mayAttemptHardening(targetPath)).toBe(false)
+
+    // The host recovers and a credential is written. The synchronous apply succeeds (runProcessSync
+    // was never made to fail), so the read path must stop backing off.
+    writeSecureFile(targetPath, 'contents')
+
+    expect(mayAttemptHardening(targetPath)).toBe(true)
+    expect(info).toHaveBeenCalledWith(
+      '[secure-path.windows-acl] path hardening recovered',
+      expect.objectContaining({ targetPath, stage: 'recovered' })
+    )
+    now.mockRestore()
+    info.mockRestore()
+    warn.mockRestore()
+  })
+
+  /**
+   * The SID lookup's own one-minute latch, which is the read-path budget's twin and strictly
+   * worse: a failed lookup makes the plan null, disabling the *synchronous write* path too — so
+   * the write-path exemption that recovers the budget cannot recover this. Measured against the
+   * wall clock, a backwards step held it shut for the whole length of the step.
+   */
+  it('re-probes the user SID after a backwards clock step', () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+    let clock = performance.now()
+    const now = vi.spyOn(performance, 'now').mockImplementation(() => clock)
+    let wallClock = Date.parse('2026-01-01T00:00:00Z')
+    const wallNow = vi.spyOn(Date, 'now').mockImplementation(() => wallClock)
+    const userDataPath = mkdtempSync(join(tmpdir(), 'orca-secure-file-'))
+    tempDirs.push(userDataPath)
+    const targetPath = join(userDataPath, 'secret.json')
+    let sidLookupFails = true
+    vi.mocked(runProcessSync).mockImplementation((spec) => {
+      if (spec.program === 'C:\\Windows\\System32\\whoami.exe') {
+        return sidLookupFails ? { ...OK, code: 1 } : { ...OK, stdout: `"USER","${USER_SID}"` }
+      }
+      return fakeIcacls(spec)
+    })
+
+    // No SID, so no plan, so hardening is off entirely — not merely throttled.
+    expect(writeSecureFile(targetPath, 'first')).toBe(false)
+
+    // A minute of real time passes while the wall clock steps back a year.
+    clock += 61_000
+    wallClock -= 365 * 24 * 60 * 60_000
+    sidLookupFails = false
+
+    expect(writeSecureFile(targetPath, 'second')).toBe(true)
+    wallNow.mockRestore()
+    now.mockRestore()
+    warn.mockRestore()
+  })
+
+  // Scoped to one path: the parent directory is hardened too, and reports its own transition.
+  function throttleReports(warn: ReturnType<typeof vi.spyOn>, targetPath: string): unknown[] {
+    return warn.mock.calls.filter((call) => {
+      const entry = call[1] as { stage?: string; targetPath?: string } | undefined
+      return entry?.stage === 'throttled' && entry.targetPath === targetPath
+    })
+  }
+
+  function writeFailingHardenTarget(): string {
+    const userDataPath = mkdtempSync(join(tmpdir(), 'orca-secure-file-'))
+    tempDirs.push(userDataPath)
+    const targetPath = join(userDataPath, 'secret.json')
+    writeFileSync(targetPath, '{}')
+    vi.mocked(runProcess).mockResolvedValue({ ...OK, code: 5, stderr: 'Access is denied.' })
+    return targetPath
+  }
+
+  function attemptsFor(targetPath: string): { args?: readonly string[] }[] {
+    return getHardenAclCalls().filter((spec) => getAclTarget(spec) === targetPath)
+  }
+
+  // /c makes icacls exit 0 while printing "Failed processing 1 files" — a silent no-op by another route.
+  it('never passes the icacls /c continue-on-error flag', async () => {
+    Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+    const userDataPath = mkdtempSync(join(tmpdir(), 'orca-secure-file-'))
+    tempDirs.push(userDataPath)
+    // Cover both runners: the write path is synchronous, the directory re-harden is not.
+    writeSecureFile(join(userDataPath, 'secret.json'), 'contents')
+    hardenSecurePath('C:\\Users\\me\\.orca\\other.json', {
+      isDirectory: false,
+      platform: 'win32'
+    })
+    await flushAsyncAcl()
+
+    const specs = [
+      ...vi.mocked(runProcess).mock.calls.map(([spec]) => spec),
+      ...vi.mocked(runProcessSync).mock.calls.map(([spec]) => spec)
+    ]
+    expect(specs.length).toBeGreaterThan(4)
+    for (const spec of specs) {
+      expect(spec.args).not.toContain('/c')
+    }
+  })
+
+  it('adds inheritable rules when hardening a Windows directory', async () => {
+    hardenSecurePath('C:\\Users\\me\\.orca', { isDirectory: true, platform: 'win32' })
+    await flushAsyncAcl()
+
+    const grantArgs = vi
+      .mocked(runProcess)
+      .mock.calls.map(([spec]) => spec.args as string[])
+      .find((args) => args.includes('/grant:r'))!
+    expect(grantArgs).toContain(`*${USER_SID}:(OI)(CI)(F)`)
+    expect(grantArgs).toContain('*S-1-5-18:(OI)(CI)(F)')
+  })
+
+  it('keeps Windows hardening best-effort when ACL rewriting fails', async () => {
+    vi.mocked(runProcess).mockRejectedValue(new Error('access denied'))
+
     expect(() =>
       hardenSecurePath('C:\\Users\\me\\.orca\\secret.json', {
         isDirectory: false,
         platform: 'win32'
       })
     ).not.toThrow()
+    await expect(flushAsyncAcl()).resolves.toBeUndefined()
+  })
+
+  // The old PowerShell command line never reached the grant step at all, so a failure had to be
+  // visible somewhere; "best effort" may not mean "undetectable".
+  it('logs when a Windows ACL apply fails instead of swallowing it', async () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    vi.mocked(runProcess).mockResolvedValue({ ...OK, code: 5, stderr: 'Access is denied.' })
+
+    hardenSecurePath('C:\\Users\\me\\.orca\\secret.json', {
+      isDirectory: false,
+      platform: 'win32'
+    })
+    await flushAsyncAcl()
+
+    expect(warn).toHaveBeenCalledWith(
+      '[secure-path.windows-acl] failed to restrict path',
+      expect.objectContaining({
+        targetPath: 'C:\\Users\\me\\.orca\\secret.json',
+        stage: 'reset',
+        detail: 'Access is denied.'
+      })
+    )
+    warn.mockRestore()
+  })
+
+  it('reports a failed synchronous ACL apply to the caller and the log', () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+    vi.mocked(runProcessSync).mockImplementation((spec) => {
+      if (spec.program === 'C:\\Windows\\System32\\whoami.exe') {
+        return { ...OK, stdout: '"USER","S-1-5-21-1000"' }
+      }
+      return { ...OK, code: 5, stderr: 'Access is denied.' }
+    })
+    const userDataPath = mkdtempSync(join(tmpdir(), 'orca-secure-file-'))
+    tempDirs.push(userDataPath)
+
+    writeSecureFile(join(userDataPath, 'secret.json'), 'contents')
+
+    expect(warn).toHaveBeenCalledWith(
+      '[secure-path.windows-acl] failed to restrict path',
+      expect.objectContaining({ stage: 'reset', detail: 'Access is denied.' })
+    )
+    warn.mockRestore()
+  })
+
+  // Paths past MAX_PATH make icacls report "cannot find the path specified"; the extended prefix is the escape.
+  it('uses the extended-length prefix for paths past MAX_PATH', async () => {
+    const longPath = `C:\\Users\\me\\.orca\\${'d'.repeat(300)}\\secret.json`
+    hardenSecurePath(longPath, { isDirectory: false, platform: 'win32' })
+    await flushAsyncAcl()
+
+    for (const [spec] of vi.mocked(runProcess).mock.calls) {
+      expect(spec.args![0]).toBe(`\\\\?\\${longPath}`)
+    }
   })
 
   it('caches successful existing-file hardening within a process', () => {
@@ -142,8 +480,8 @@ describe('hardenSecurePath', () => {
     hardenExistingSecureFile(targetPath)
 
     // dir hardened once (path-cached), file hardened once (metadata-cached) — 2 total
-    expect(getPowerShellCalls()).toHaveLength(2)
-    expect(getPowerShellCalls().map(getPowerShellTarget)).toEqual([userDataPath, targetPath])
+    expect(getHardenAclCalls()).toHaveLength(2)
+    expect(getHardenAclCalls().map(getAclTarget)).toEqual([userDataPath, targetPath])
   })
 
   it('LRU-evicts Windows file hardening entries and safely re-hardens an evicted path', () => {
@@ -165,8 +503,8 @@ describe('hardenSecurePath', () => {
 
     hardenExistingSecureFile(paths[0]!)
 
-    const fileTargets = getPowerShellCalls()
-      .map(getPowerShellTarget)
+    const fileTargets = getHardenAclCalls()
+      .map(getAclTarget)
       .filter((path) => paths.includes(path))
     expect(fileTargets).toEqual([...paths, paths[0]])
     expect(__getSecureFileHardeningCacheStateForTests().paths).toMatchObject({
@@ -196,8 +534,8 @@ describe('hardenSecurePath', () => {
 
     hardenExistingSecureFile(files[0]!)
 
-    const directoryTargets = getPowerShellCalls()
-      .map(getPowerShellTarget)
+    const directoryTargets = getHardenAclCalls()
+      .map(getAclTarget)
       .filter((path) => directories.includes(path))
     expect(directoryTargets).toEqual([...directories, directories[0]])
     expect(__getSecureFileHardeningCacheStateForTests().directories).toMatchObject({
@@ -218,12 +556,8 @@ describe('hardenSecurePath', () => {
     hardenExistingSecureFile(targetPath)
 
     // call 1: dir + file. call 2: dir skipped (path-cached), file re-hardened (new mtime)
-    expect(getPowerShellCalls()).toHaveLength(3)
-    expect(getPowerShellCalls().map(getPowerShellTarget)).toEqual([
-      userDataPath,
-      targetPath,
-      targetPath
-    ])
+    expect(getHardenAclCalls()).toHaveLength(3)
+    expect(getHardenAclCalls().map(getAclTarget)).toEqual([userDataPath, targetPath, targetPath])
   })
 
   it('keeps post-rename target hardening on every write while caching the directory', () => {
@@ -236,19 +570,19 @@ describe('hardenSecurePath', () => {
     writeSecureFile(targetPath, 'second')
 
     // The DIRECTORY is hardened async + path-cached: exactly once across both writes.
-    const asyncTargets = getPowerShellCalls().map(getPowerShellTarget)
+    const asyncTargets = getHardenAclCalls().map(getAclTarget)
     expect(asyncTargets).toEqual([userDataPath])
 
     // The credential FILES (tmpFile + renamed target) are hardened SYNCHRONOUSLY on each write.
     // write 1: tmpFile(1) + targetFile(1) = 2; write 2: tmpFile(1) + targetFile(1) = 2; total 4.
-    const syncTargets = getSyncPowerShellCalls().map(getPowerShellTarget)
+    const syncTargets = getSyncHardenAclCalls().map(getAclTarget)
     expect(syncTargets).toHaveLength(4)
     expect(syncTargets.filter((entry) => entry === targetPath)).toHaveLength(2)
     // No directory should be hardened via the synchronous path.
     expect(syncTargets.filter((entry) => entry === userDataPath)).toHaveLength(0)
   })
 
-  // Regression test: #4901 — env-store reads at ~2×/s caused a PowerShell storm because the
+  // Regression test: #4901 — env-store reads at ~2×/s caused an ACL-spawn storm because the
   // parent directory mtime churned (every secure write updates it), so the mtime-keyed cache
   // never matched. Directories must be path-cached for the process lifetime.
   it('does not re-harden the parent directory when its mtime changes between reads', async () => {
@@ -268,9 +602,7 @@ describe('hardenSecurePath', () => {
     hardenExistingSecureFile(targetPath)
 
     // The parent directory must be hardened exactly ONCE despite its mtime changing
-    const dirCalls = getPowerShellCalls().filter(
-      (call) => getPowerShellTarget(call) === userDataPath
-    )
+    const dirCalls = getHardenAclCalls().filter((call) => getAclTarget(call) === userDataPath)
     expect(dirCalls).toHaveLength(1)
   })
 
@@ -285,27 +617,25 @@ describe('hardenSecurePath', () => {
     hardenExistingSecureFile(targetPath)
     hardenExistingSecureFile(targetPath)
 
-    const fileCalls = getPowerShellCalls().filter(
-      (call) => getPowerShellTarget(call) === targetPath
-    )
+    const fileCalls = getHardenAclCalls().filter((call) => getAclTarget(call) === targetPath)
     expect(fileCalls).toHaveLength(1)
   })
 
-  it('applies the read-path ACL asynchronously without blocking (async execFile)', () => {
+  it('applies the read-path ACL asynchronously without blocking (async runProcess)', () => {
     hardenSecurePath('C:\\Users\\me\\.orca\\secret.json', {
       isDirectory: false,
       platform: 'win32'
     })
 
-    // The default (read/dir) path must launch PowerShell via execFile (async), never sync.
-    expect(getSyncPowerShellCalls()).toHaveLength(0)
-    expect(getPowerShellCalls()).toHaveLength(1)
+    // The default (read/dir) path must launch icacls via runProcess (async), never sync.
+    expect(getSyncHardenAclCalls()).toHaveLength(0)
+    expect(getHardenAclCalls()).toHaveLength(1)
   })
 
   // Security regression guard (#5006 review finding): writeSecureFile must restrict the
   // credential FILE's ACL SYNCHRONOUSLY before returning. On Windows writeFileSync({mode})
   // is a no-op, so an async file ACL would leave the credential briefly readable under the
-  // parent's inherited (broader) ACL for the ~1-1.5s PowerShell cold-start window.
+  // parent's inherited (broader) ACL for the duration of the spawn.
   it('hardens the credential file synchronously while keeping the directory async', () => {
     Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
     const userDataPath = mkdtempSync(join(tmpdir(), 'orca-secure-file-'))
@@ -315,13 +645,13 @@ describe('hardenSecurePath', () => {
     writeSecureFile(targetPath, 'contents')
 
     // Directory: async only.
-    expect(getPowerShellCalls().map(getPowerShellTarget)).toEqual([userDataPath])
+    expect(getHardenAclCalls().map(getAclTarget)).toEqual([userDataPath])
     // File (tmpFile + renamed target): synchronous only — no async file ACL window.
-    const syncTargets = getSyncPowerShellCalls().map(getPowerShellTarget)
+    const syncTargets = getSyncHardenAclCalls().map(getAclTarget)
     expect(syncTargets).toContain(targetPath)
     expect(syncTargets.filter((entry) => entry === userDataPath)).toHaveLength(0)
     // The final published target's ACL must have been applied via the synchronous path.
-    expect(getPowerShellCalls().map(getPowerShellTarget)).not.toContain(targetPath)
+    expect(getHardenAclCalls().map(getAclTarget)).not.toContain(targetPath)
   })
 
   // Nit #1 (review): the synchronous file path must cache as hardened ONLY on confirmed
@@ -333,30 +663,30 @@ describe('hardenSecurePath', () => {
     tempDirs.push(userDataPath)
     const targetPath = join(userDataPath, 'secret.json')
 
-    // First write: the synchronous PowerShell ACL apply throws for every powershell call.
-    vi.mocked(execFileSync).mockImplementation((file) => {
-      if (file === 'C:\\Windows\\System32\\whoami.exe') {
-        return '"USER","S-1-5-21-1000"'
+    // First write: the synchronous icacls ACL apply throws for every icacls call.
+    vi.mocked(runProcessSync).mockImplementation((spec) => {
+      if (spec.program === 'C:\\Windows\\System32\\whoami.exe') {
+        return { ...OK, stdout: '"USER","S-1-5-21-1000"' }
       }
       throw new Error('access denied')
     })
     expect(() => writeSecureFile(targetPath, 'first')).not.toThrow()
-    const firstWriteTargetCalls = getSyncPowerShellCalls()
-      .map(getPowerShellTarget)
+    const firstWriteTargetCalls = getSyncHardenAclCalls()
+      .map(getAclTarget)
       .filter((entry) => entry === targetPath)
     expect(firstWriteTargetCalls).toHaveLength(1)
 
     // Second write: ACL apply now succeeds. Because the failed apply was NOT cached, the
     // target file is hardened again rather than skipped.
-    vi.mocked(execFileSync).mockImplementation((file) => {
-      if (file === 'C:\\Windows\\System32\\whoami.exe') {
-        return '"USER","S-1-5-21-1000"'
+    vi.mocked(runProcessSync).mockImplementation((spec) => {
+      if (spec.program === 'C:\\Windows\\System32\\whoami.exe') {
+        return { ...OK, stdout: '"USER","S-1-5-21-1000"' }
       }
-      return ''
+      return OK
     })
     writeSecureFile(targetPath, 'second')
-    const allTargetCalls = getSyncPowerShellCalls()
-      .map(getPowerShellTarget)
+    const allTargetCalls = getSyncHardenAclCalls()
+      .map(getAclTarget)
       .filter((entry) => entry === targetPath)
     expect(allTargetCalls).toHaveLength(2)
   })
@@ -374,15 +704,13 @@ describe('hardenSecurePath', () => {
       writeSecureFile(join(userDataPath, `secret-${i}.json`), `contents-${i}`)
     }
 
-    const dirCalls = getPowerShellCalls().filter(
-      (call) => getPowerShellTarget(call) === userDataPath
-    )
+    const dirCalls = getHardenAclCalls().filter((call) => getAclTarget(call) === userDataPath)
     expect(dirCalls).toHaveLength(1)
   })
 
-  // win32-only guard: on non-win32 platforms no PowerShell is ever spawned (sync or async);
+  // win32-only guard: on non-win32 platforms no icacls is ever spawned (sync or async);
   // POSIX hardening uses chmodSync only.
-  it('never spawns PowerShell on non-win32 platforms', () => {
+  it('never spawns icacls on non-win32 platforms', () => {
     Object.defineProperty(process, 'platform', { configurable: true, value: 'linux' })
     const userDataPath = mkdtempSync(join(tmpdir(), 'orca-secure-file-'))
     tempDirs.push(userDataPath)
@@ -391,8 +719,8 @@ describe('hardenSecurePath', () => {
     writeSecureFile(targetPath, 'contents')
     hardenExistingSecureFile(targetPath)
 
-    expect(getPowerShellCalls()).toHaveLength(0)
-    expect(getSyncPowerShellCalls()).toHaveLength(0)
+    expect(getHardenAclCalls()).toHaveLength(0)
+    expect(getSyncHardenAclCalls()).toHaveLength(0)
   })
 
   posixModeIt('re-hardens a POSIX directory when its metadata changes after caching', () => {
@@ -440,22 +768,51 @@ describe('hardenSecurePath', () => {
   })
 })
 
-const POWERSHELL_SUFFIX = 'WindowsPowerShell\\v1.0\\powershell.exe'
-
-// Async PowerShell calls (directory hardening + read-path file re-harden).
-function getPowerShellCalls(): unknown[][] {
-  return vi.mocked(execFile).mock.calls.filter(([file]) => String(file).endsWith(POWERSHELL_SUFFIX))
+/**
+ * Every harden opens with a `/save` verify; one that has work to do then runs `/reset`, `/grant:r`
+ * and a closing `/save`. Counting only the *opening* verify keeps "one harden = one entry"
+ * regardless of which of the two shapes it took.
+ */
+function hardenInitiations(specs: FakeSpec[]): { args?: readonly string[] }[] {
+  const initiations: { args?: readonly string[] }[] = []
+  const awaitingClosingVerify = new Set<string>()
+  for (const spec of specs) {
+    if (!spec.program.endsWith('icacls.exe')) {
+      continue
+    }
+    const path = spec.args?.[0] ?? ''
+    if (spec.args?.includes('/grant:r')) {
+      awaitingClosingVerify.add(path)
+    } else if (spec.args?.includes('/save')) {
+      if (awaitingClosingVerify.has(path)) {
+        awaitingClosingVerify.delete(path)
+      } else {
+        initiations.push(spec)
+      }
+    }
+  }
+  return initiations
 }
 
-// Synchronous PowerShell calls (credential-file ACL on the write path).
-function getSyncPowerShellCalls(): unknown[][] {
-  return vi
-    .mocked(execFileSync)
-    .mock.calls.filter(([file]) => String(file).endsWith(POWERSHELL_SUFFIX))
+// Async icacls calls (directory hardening + read-path file re-harden).
+function getHardenAclCalls(): { args?: readonly string[] }[] {
+  return hardenInitiations(vi.mocked(runProcess).mock.calls.map(([spec]) => spec))
 }
 
-function getPowerShellTarget(call: unknown[]): string {
-  return (call[1] as string[])[6]!
+// Synchronous icacls calls (credential-file ACL on the write path).
+function getSyncHardenAclCalls(): { args?: readonly string[] }[] {
+  return hardenInitiations(vi.mocked(runProcessSync).mock.calls.map(([spec]) => spec))
+}
+
+function getAclTarget(spec: { args?: readonly string[] }): string {
+  return spec.args![0]!
+}
+
+// The async harden awaits three icacls passes, so let the chain settle before asserting on it.
+async function flushAsyncAcl(): Promise<void> {
+  for (let i = 0; i < 4; i++) {
+    await new Promise((resolve) => setTimeout(resolve, 0))
+  }
 }
 
 async function waitForFileTimestampTick(): Promise<void> {
@@ -465,3 +822,37 @@ async function waitForFileTimestampTick(): Promise<void> {
 function statMode(path: string): number {
   return statSync(path).mode & 0o777
 }
+
+describe('isUnreadableError', () => {
+  const withCode = (code: string): NodeJS.ErrnoException => Object.assign(new Error(code), { code })
+
+  // The hardened-DACL case this predicate was written for.
+  it('reports a denied read', () => {
+    expect(isUnreadableError(withCode('EPERM'))).toBe(true)
+    expect(isUnreadableError(withCode('EACCES'))).toBe(true)
+  })
+
+  /**
+   * The likelier half on Windows: antivirus holding a credential open during startup yields
+   * EBUSY, and fd exhaustion yields EMFILE. Neither says the bytes were read, so neither may
+   * license a regenerate-and-overwrite.
+   */
+  it('reports a read that never reached the contents for any other reason', () => {
+    expect(isUnreadableError(withCode('EBUSY'))).toBe(true)
+    expect(isUnreadableError(withCode('EMFILE'))).toBe(true)
+    expect(isUnreadableError(withCode('ENFILE'))).toBe(true)
+    expect(isUnreadableError(withCode('EIO'))).toBe(true)
+  })
+
+  /**
+   * The other side of the distinction, and the reason this is an allow list rather than
+   * "everything except ENOENT": a missing file licenses creating one, and bytes that were read
+   * and did not parse are the self-heal these stores exist to perform.
+   */
+  it('does not report a missing file or a parse failure', () => {
+    expect(isUnreadableError(withCode('ENOENT'))).toBe(false)
+    expect(isUnreadableError(new SyntaxError('Unexpected end of JSON input'))).toBe(false)
+    expect(isUnreadableError(withCode('EISDIR'))).toBe(false)
+    expect(isUnreadableError(undefined)).toBe(false)
+  })
+})
diff --git a/src/shared/secure-file.ts b/src/shared/secure-file.ts
index 639630c7c65..c04ea9afe5b 100644
--- a/src/shared/secure-file.ts
+++ b/src/shared/secure-file.ts
@@ -13,9 +13,15 @@ import {
 } from 'node:fs'
 import { dirname } from 'node:path'
 import {
+  DEFAULT_HARDENING_CACHE_BOUNDS,
   SecurePathHardeningCache,
   type SecurePathHardeningCacheBounds
 } from './secure-path-hardening-cache'
+import {
+  configureHardeningRetryBudget,
+  mayAttemptHardening,
+  recordHardeningOutcome
+} from './secure-path-hardening-retry-budget'
 import {
   bestEffortRestrictWindowsPath,
   resetSecureFileWindowsUserSidForTests,
@@ -33,24 +39,14 @@ type HardenedPathCacheEntry = {
   birthtimeMs: number
 }
 
-export const SECURE_PATH_HARDENING_CACHE_MAX_ENTRIES = 1024
-export const SECURE_PATH_HARDENING_CACHE_KEY_MAX_BYTES = 64 * 1024
-export const SECURE_PATH_HARDENING_CACHE_KEYS_MAX_BYTES = 512 * 1024
-
-const DEFAULT_HARDENING_CACHE_BOUNDS: SecurePathHardeningCacheBounds = {
-  maxEntries: SECURE_PATH_HARDENING_CACHE_MAX_ENTRIES,
-  maxKeyBytes: SECURE_PATH_HARDENING_CACHE_KEY_MAX_BYTES,
-  maxTotalKeyBytes: SECURE_PATH_HARDENING_CACHE_KEYS_MAX_BYTES
-}
-
 const UNSUPPORTED_DIRECTORY_FSYNC_CODES = new Set(['EINVAL', 'ENOTSUP', 'EOPNOTSUPP'])
 
-// Why: PowerShell hardening (~1-1.5s) stalls the main thread, so cache idempotent re-hardens per process.
+// Why: hardening spawns icacls synchronously (once when the DACL already verifies, four times when it must be rewritten), so cache idempotent re-hardens per process.
 let hardenedPathsThisProcess = new SecurePathHardeningCache<HardenedPathCacheEntry>(
   DEFAULT_HARDENING_CACHE_BOUNDS
 )
 
-// Why: child writes constantly bump a dir's mtime, so cache dirs by path (not metadata) to avoid a PowerShell spawn every read (#4901).
+// Why: child writes constantly bump a dir's mtime, so cache dirs by path (not metadata) to avoid an icacls spawn every read (#4901).
 // Limitation: a dir deleted+recreated in-process won't re-harden; fine since we never delete our secure dirs at runtime.
 let hardenedDirectoryPathsThisProcess = new SecurePathHardeningCache<true>(
   DEFAULT_HARDENING_CACHE_BOUNDS
@@ -61,9 +57,13 @@ function hardenSecureDirectoryOnce(dirPath: string): void {
   if (hardenedDirectoryPathsThisProcess.get(dirPath)) {
     return
   }
-  applySecurePathRestriction(dirPath, true, process.platform, false)
-  // Cache even though the async ACL may still be in flight — dir restriction is best-effort, no retry.
+  // Cache before the ACL lands so concurrent writes don't restorm; a failure drops it, under the retry budget.
   hardenedDirectoryPathsThisProcess.set(dirPath, true)
+  applySecurePathRestriction(dirPath, true, process.platform, false, (restricted) => {
+    if (!restricted) {
+      hardenedDirectoryPathsThisProcess.delete(dirPath)
+    }
+  })
 }
 
 function hardenSecurePathOnce(targetPath: string, isDirectory: boolean): boolean {
@@ -81,26 +81,50 @@ function hardenSecurePathOnce(targetPath: string, isDirectory: boolean): boolean
     return true
   }
   // Why: async re-harden is safe here — read path hardens each file at most once/process; new files harden synchronously on the write path.
-  if (applySecurePathRestriction(targetPath, isDirectory, process.platform, false)) {
+  const outcome = applySecurePathRestriction(
+    targetPath,
+    isDirectory,
+    process.platform,
+    false,
+    (restricted) => {
+      if (!restricted) {
+        hardenedPathsThisProcess.delete(targetPath)
+      }
+    }
+  )
+  if (outcome !== 'failed') {
     rememberHardenedPath(targetPath, isDirectory)
     return true
   }
   return false
 }
 
-export function writeSecureJsonFile(targetPath: string, value: unknown): void {
-  writeSecureFile(targetPath, JSON.stringify(value, null, 2))
+/** Returns false when the file was written but its permissions could not be restricted. */
+export function writeSecureJsonFile(targetPath: string, value: unknown): boolean {
+  return writeSecureFile(targetPath, JSON.stringify(value, null, 2))
 }
 
-export function writeDurableSecureJsonFile(targetPath: string, value: unknown): void {
-  writeSecureFile(targetPath, JSON.stringify(value, null, 2), { durable: true })
+/** Returns false when the file was written but its permissions could not be restricted. */
+export function writeDurableSecureJsonFile(targetPath: string, value: unknown): boolean {
+  return writeSecureFile(targetPath, JSON.stringify(value, null, 2), { durable: true })
 }
 
+/**
+ * Writes `contents` and restricts the result to the current user.
+ *
+ * Returns whether the restriction actually took. Hardening stays best-effort — it fails
+ * legitimately on FAT32, network paths and restricted tokens, and must not break a write — but
+ * the outcome is now reported rather than assumed, so a caller storing a credential can react.
+ *
+ * The return value covers the *file* only. The parent directory is hardened fire-and-forget — on
+ * Windows that lane is async and answers `pending` regardless — so a `true` here says nothing
+ * about the directory's ACL.
+ */
 export function writeSecureFile(
   targetPath: string,
   contents: string,
   options: { durable?: boolean } = {}
-): void {
+): boolean {
   const dir = dirname(targetPath)
   if (!existsSync(dir)) {
     mkdirSync(dir, { recursive: true, mode: 0o700 })
@@ -118,15 +142,18 @@ export function writeSecureFile(
       fsyncFileSync(tmpFile)
     }
     // Why: writeFileSync mode is a no-op on Windows, so restrict the credential's ACL synchronously before the rename publishes it under inherited ACLs.
-    applySecurePathRestriction(tmpFile, false, process.platform, true)
+    const stagedOutcome = applySecurePathRestriction(tmpFile, false, process.platform, true)
     renameSync(tmpFile, targetPath)
     // Why: these hold auth credentials, so the published path must stay current-user only; cache only on confirmed success so failures retry.
-    if (applySecurePathRestriction(targetPath, false, process.platform, true)) {
+    // The staged file's protected DACL survives the rename, so this pass usually just verifies it.
+    const publishedOutcome = applySecurePathRestriction(targetPath, false, process.platform, true)
+    if (publishedOutcome === 'applied') {
       rememberHardenedPath(targetPath, false)
     }
     if (options.durable) {
       bestEffortFsyncDirectorySync(dir)
     }
+    return stagedOutcome === 'applied' && publishedOutcome === 'applied'
   } catch (error) {
     rmSync(tmpFile, { force: true })
     throw error
@@ -164,6 +191,34 @@ export function bestEffortFsyncDirectorySync(directory: string): void {
   }
 }
 
+/**
+ * Errors that mean the contents were never seen, so they say nothing about what the file holds.
+ *
+ * `ENOENT` is deliberately absent: "there is no file" genuinely licenses creating one. So is a
+ * parse failure, which means the bytes WERE read and were garbage - the self-heal these stores
+ * were built for. The distinction is "could not read it" versus "read it and it was garbage".
+ *
+ * Why it matters: a reader that treats every failure as corruption regenerates the file, and the
+ * regeneration succeeds - `renameSync` over an unreadable file needs `FILE_DELETE_CHILD` on the
+ * parent, not `DELETE` on the file - so the original is destroyed by the code meant to heal it.
+ * `EPERM`/`EACCES` is the hardened-DACL case: a file granting a SID this process does not hold,
+ * reachable through a relocated user-data path, a share or roaming profile, a restored backup
+ * under a new local SID, or a half-applied harden. The rest are transient and, on Windows, more
+ * likely than that: `EBUSY` is what antivirus produces by holding a file open at the moment of a
+ * read, which for a credential read on the startup path is an ordinary Tuesday.
+ */
+export function isUnreadableError(error: unknown): boolean {
+  const code = (error as NodeJS.ErrnoException | null)?.code
+  return (
+    code === 'EPERM' ||
+    code === 'EACCES' ||
+    code === 'EBUSY' ||
+    code === 'EMFILE' ||
+    code === 'ENFILE' ||
+    code === 'EIO'
+  )
+}
+
 export function hardenExistingSecureFile(targetPath: string): void {
   const dir = dirname(targetPath)
   if (existsSync(dir)) {
@@ -191,24 +246,48 @@ export function hardenSecurePath(
   )
 }
 
-/** Applies hardening; async Windows calls only report that best-effort ACL work was accepted. */
+/**
+ * `pending` is the honest answer for the async Windows branch: it has not happened yet, and
+ * reporting it as `applied` is what let a dead ACL look like a working one. The real outcome
+ * arrives through `onAsyncSettled`.
+ */
+type HardeningOutcome = 'applied' | 'pending' | 'failed'
+
 function applySecurePathRestriction(
   targetPath: string,
   isDirectory: boolean,
   platform: NodeJS.Platform,
-  sync: boolean
-): boolean {
+  sync: boolean,
+  onAsyncSettled?: (restricted: boolean) => void
+): HardeningOutcome {
   if (platform === 'win32') {
     if (sync) {
+      // Why no retry floor here: the write path is user-driven, not polled, and a failed apply
+      // must still be retried on the next write of the same credential.
       // Why: apply the ACL synchronously so the credential file isn't briefly readable under inherited ACLs (writeFileSync mode is a no-op on Windows).
-      return restrictWindowsPathSync(targetPath, isDirectory)
+      const restricted = restrictWindowsPathSync(targetPath, isDirectory)
+      if (restricted) {
+        // Success only: this is how a recovered host clears the read path's backoff (and reports
+        // `recovered`). Recording a failure here would put the exempt lane back under the budget.
+        recordHardeningOutcome(targetPath, true)
+      }
+      return restricted ? 'applied' : 'failed'
     }
-    // Why: dir/read-path re-harden runs async to avoid blocking the main thread (#4901); return true optimistically since it's best-effort.
-    bestEffortRestrictWindowsPath(targetPath, isDirectory)
-    return true
+    // Why the floor: this is the read path, polled at ~2/s (#4901). Retrying every failure there
+    // is the same storm the cache exists to prevent.
+    if (!mayAttemptHardening(targetPath)) {
+      onAsyncSettled?.(false)
+      return 'failed'
+    }
+    // Why: dir/read-path re-harden runs async to avoid blocking the main thread (#4901).
+    bestEffortRestrictWindowsPath(targetPath, isDirectory, (restricted) => {
+      recordHardeningOutcome(targetPath, restricted)
+      onAsyncSettled?.(restricted)
+    })
+    return 'pending'
   }
   chmodSync(targetPath, isDirectory ? 0o700 : 0o600)
-  return true
+  return 'applied'
 }
 
 /** Caches the current metadata snapshot for a just-hardened path, or clears it if the path is gone. */
@@ -275,6 +354,7 @@ export function __resetSecureFileHardenedPathsForTests(
 ): void {
   hardenedPathsThisProcess = new SecurePathHardeningCache(bounds)
   hardenedDirectoryPathsThisProcess = new SecurePathHardeningCache(bounds)
+  configureHardeningRetryBudget(bounds)
 }
 
 export function __getSecureFileHardeningCacheStateForTests(): {
diff --git a/src/shared/secure-path-hardening-cache.ts b/src/shared/secure-path-hardening-cache.ts
index 3ec32de4f8b..eb1f7200bf9 100644
--- a/src/shared/secure-path-hardening-cache.ts
+++ b/src/shared/secure-path-hardening-cache.ts
@@ -4,6 +4,21 @@ export type SecurePathHardeningCacheBounds = {
   maxTotalKeyBytes: number
 }
 
+export const SECURE_PATH_HARDENING_CACHE_MAX_ENTRIES = 1024
+export const SECURE_PATH_HARDENING_CACHE_KEY_MAX_BYTES = 64 * 1024
+export const SECURE_PATH_HARDENING_CACHE_KEYS_MAX_BYTES = 512 * 1024
+
+/**
+ * The bounds every hardening cache uses unless a caller overrides them. They live here rather
+ * than with one consumer so a cache can default itself instead of depending on some other module
+ * being imported first.
+ */
+export const DEFAULT_HARDENING_CACHE_BOUNDS: SecurePathHardeningCacheBounds = {
+  maxEntries: SECURE_PATH_HARDENING_CACHE_MAX_ENTRIES,
+  maxKeyBytes: SECURE_PATH_HARDENING_CACHE_KEY_MAX_BYTES,
+  maxTotalKeyBytes: SECURE_PATH_HARDENING_CACHE_KEYS_MAX_BYTES
+}
+
 type RetainedSecurePath<T> = {
   value: T
   keyBytes: number
diff --git a/src/shared/secure-path-hardening-report.ts b/src/shared/secure-path-hardening-report.ts
new file mode 100644
index 00000000000..45408da0317
--- /dev/null
+++ b/src/shared/secure-path-hardening-report.ts
@@ -0,0 +1,43 @@
+/**
+ * Where path-hardening outcomes are announced, kept apart from the code that applies them so the
+ * retry budget can report degradation and recovery without importing the Windows ACL lane.
+ */
+export type SecurePathHardeningReport = {
+  targetPath: string
+  /**
+   * `throttled` and `recovered` mark entering and leaving the rate-limited degraded state;
+   * `settle` is the async lane's own callback failing, which is a caller bug rather than a host one.
+   */
+  stage: 'sid-lookup' | 'reset' | 'grant' | 'verify' | 'settle' | 'throttled' | 'recovered'
+  detail: string
+}
+
+/**
+ * Why a hook: hardening runs in the Electron main process, which is GUI-subsystem on Windows and
+ * owns no console, so `console.warn` reaches nothing in a packaged build. The main process
+ * installs a reporter that routes into the diagnostic trace; the console default keeps dev runs
+ * and the CLI readable.
+ */
+const consoleReporter = (entry: SecurePathHardeningReport): void => {
+  if (entry.stage === 'recovered') {
+    console.info('[secure-path.windows-acl] path hardening recovered', entry)
+    return
+  }
+  console.warn('[secure-path.windows-acl] failed to restrict path', entry)
+}
+
+let reportEntry: (entry: SecurePathHardeningReport) => void = consoleReporter
+
+export function setSecurePathHardeningReporter(
+  reporter: ((entry: SecurePathHardeningReport) => void) | null
+): void {
+  reportEntry = reporter ?? consoleReporter
+}
+
+export function reportSecurePathHardening(
+  targetPath: string,
+  stage: SecurePathHardeningReport['stage'],
+  detail: string
+): void {
+  reportEntry({ targetPath, stage, detail: detail.trim().slice(0, 500) })
+}
diff --git a/src/shared/secure-path-hardening-retry-budget.test.ts b/src/shared/secure-path-hardening-retry-budget.test.ts
new file mode 100644
index 00000000000..e2b76b7cec1
--- /dev/null
+++ b/src/shared/secure-path-hardening-retry-budget.test.ts
@@ -0,0 +1,174 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  configureHardeningRetryBudget,
+  hardeningRetryDelayMs,
+  mayAttemptHardening,
+  recordHardeningOutcome
+} from './secure-path-hardening-retry-budget'
+import {
+  setSecurePathHardeningReporter,
+  type SecurePathHardeningReport
+} from './secure-path-hardening-report'
+
+const PATH = 'C:\\Users\\me\\.orca\\secret.json'
+const OTHER = 'C:\\Users\\me\\.orca\\other.json'
+const MINUTE = 60_000
+
+describe('secure path hardening retry budget', () => {
+  /** Elapsed monotonic time, which is what the budget measures. */
+  let clock = 0
+  /** The wall clock, which it must not measure: it steps backwards on real machines. */
+  let wallClock = 0
+  let reports: SecurePathHardeningReport[] = []
+
+  beforeEach(() => {
+    clock = 1_000_000
+    wallClock = Date.parse('2026-01-01T00:00:00Z')
+    vi.spyOn(performance, 'now').mockImplementation(() => clock)
+    vi.spyOn(Date, 'now').mockImplementation(() => wallClock)
+    reports = []
+    setSecurePathHardeningReporter((entry) => reports.push(entry))
+    configureHardeningRetryBudget({
+      maxEntries: 64,
+      maxKeyBytes: 4096,
+      maxTotalKeyBytes: 65_536
+    })
+  })
+
+  afterEach(() => {
+    setSecurePathHardeningReporter(null)
+    vi.restoreAllMocks()
+  })
+
+  /** Drives the loop the read path drives: attempt when allowed, record the failure, advance. */
+  function pollUntil(elapsedMs: number, stepMs: number, restricted = false): number[] {
+    const attemptedAt: number[] = []
+    const startedAt = clock
+    while (clock - startedAt <= elapsedMs) {
+      if (mayAttemptHardening(PATH)) {
+        attemptedAt.push(clock - startedAt)
+        recordHardeningOutcome(PATH, restricted)
+      }
+      clock += stepMs
+      wallClock += stepMs
+    }
+    return attemptedAt
+  }
+
+  it('doubles the delay after each consecutive failure, up to the ceiling', () => {
+    expect(hardeningRetryDelayMs(1)).toBe(1 * MINUTE)
+    expect(hardeningRetryDelayMs(2)).toBe(2 * MINUTE)
+    expect(hardeningRetryDelayMs(3)).toBe(4 * MINUTE)
+    expect(hardeningRetryDelayMs(4)).toBe(8 * MINUTE)
+    expect(hardeningRetryDelayMs(5)).toBe(16 * MINUTE)
+    // Ceiling reached, and it stays there however long the host has been broken.
+    expect(hardeningRetryDelayMs(6)).toBe(30 * MINUTE)
+    expect(hardeningRetryDelayMs(50)).toBe(30 * MINUTE)
+    expect(hardeningRetryDelayMs(5000)).toBe(30 * MINUTE)
+  })
+
+  it('allows the first attempt for a path it has never seen', () => {
+    expect(mayAttemptHardening(PATH)).toBe(true)
+  })
+
+  // The #4901 condition: the env store re-hardens on the read path about twice a second.
+  it('collapses a read-path poll to a single attempt in the first minute', () => {
+    const attemptedAt = pollUntil(55_000, 500)
+
+    expect(attemptedAt).toEqual([0])
+  })
+
+  it('re-probes on the documented curve rather than on every read', () => {
+    // Six hours of polling every 30s: 720 reads, and only the backoff decides how many run.
+    const attemptedAt = pollUntil(6 * 60 * MINUTE, 30_000)
+
+    // 0, +1, +2, +4, +8, +16, then every 30 minutes forever.
+    expect(attemptedAt.slice(0, 6).map((ms) => ms / MINUTE)).toEqual([0, 1, 3, 7, 15, 31])
+    const trailingGaps = attemptedAt
+      .slice(-4)
+      .map((ms, index, all) => (all[index + 1]! - ms) / MINUTE)
+    expect(trailingGaps.slice(0, -1)).toEqual([30, 30, 30])
+  })
+
+  // The failure this replaced: three transient failures used to disable a path until restart.
+  it('never abandons a path, however long it has been failing', () => {
+    pollUntil(30 * 24 * 60 * MINUTE, 15 * MINUTE)
+
+    // A month of failures later, the very next elapsed ceiling still re-probes.
+    clock += 31 * MINUTE
+    expect(mayAttemptHardening(PATH)).toBe(true)
+  })
+
+  /**
+   * The same latch by another route. NTP corrections, VM snapshot restores and a user changing the
+   * clock all step `Date.now()` backwards; measured against the wall clock that makes the elapsed
+   * time negative, so the path stayed below its delay for the whole length of the step — a year,
+   * here — which is exactly the permanent abandonment the backoff exists to remove.
+   */
+  it('re-probes after a backwards clock step rather than waiting for the wall clock', () => {
+    pollUntil(6 * 60 * MINUTE, 30_000)
+
+    wallClock -= 365 * 24 * 60 * MINUTE
+    clock += 31 * MINUTE
+
+    expect(mayAttemptHardening(PATH)).toBe(true)
+  })
+
+  it('announces the degraded state once, not once per failure', () => {
+    pollUntil(6 * 60 * MINUTE, 30_000)
+
+    const throttled = reports.filter((entry) => entry.stage === 'throttled')
+    expect(throttled).toHaveLength(1)
+    expect(throttled[0]).toMatchObject({ targetPath: PATH, stage: 'throttled' })
+  })
+
+  it('announces recovery when a throttled path hardens again, and resets the curve', () => {
+    pollUntil(10 * MINUTE, 30_000)
+    expect(reports.filter((entry) => entry.stage === 'throttled')).toHaveLength(1)
+
+    recordHardeningOutcome(PATH, true)
+
+    expect(reports.filter((entry) => entry.stage === 'recovered')).toMatchObject([
+      { targetPath: PATH, stage: 'recovered' }
+    ])
+    // Record cleared: the next failure starts at the floor rather than the ceiling.
+    expect(mayAttemptHardening(PATH)).toBe(true)
+    recordHardeningOutcome(PATH, false)
+    clock += 59_000
+    expect(mayAttemptHardening(PATH)).toBe(false)
+    clock += 2_000
+    expect(mayAttemptHardening(PATH)).toBe(true)
+  })
+
+  it('stays silent about recovery for a path that never reached the degraded state', () => {
+    recordHardeningOutcome(PATH, false)
+    recordHardeningOutcome(PATH, true)
+
+    expect(reports).toEqual([])
+  })
+
+  it('budgets each path separately', () => {
+    recordHardeningOutcome(PATH, false)
+
+    expect(mayAttemptHardening(PATH)).toBe(false)
+    expect(mayAttemptHardening(OTHER)).toBe(true)
+  })
+
+  /**
+   * The state every other test here configures away: a module instance nobody has called
+   * `configureHardeningRetryBudget` on, which is what a second importer gets. It used to throw,
+   * and from the async lane that throw is an unhandled rejection rather than a caught error, so
+   * "the budget is unconfigured" surfaced as a dead main process. Nothing is imported here but
+   * the module itself — importing `secure-file.ts` is what used to hide this.
+   */
+  it('defaults its bounds when nothing configured it', async () => {
+    vi.resetModules()
+    const budget = await import('./secure-path-hardening-retry-budget.js')
+
+    expect(budget.mayAttemptHardening(PATH)).toBe(true)
+    expect(() => budget.recordHardeningOutcome(PATH, false)).not.toThrow()
+    // Proof it recorded into a real cache rather than merely not throwing.
+    expect(budget.mayAttemptHardening(PATH)).toBe(false)
+    expect(budget.mayAttemptHardening(OTHER)).toBe(true)
+  })
+})
diff --git a/src/shared/secure-path-hardening-retry-budget.ts b/src/shared/secure-path-hardening-retry-budget.ts
new file mode 100644
index 00000000000..9dfd93f02f3
--- /dev/null
+++ b/src/shared/secure-path-hardening-retry-budget.ts
@@ -0,0 +1,100 @@
+import {
+  DEFAULT_HARDENING_CACHE_BOUNDS,
+  SecurePathHardeningCache,
+  type SecurePathHardeningCacheBounds
+} from './secure-path-hardening-cache'
+import { reportSecurePathHardening } from './secure-path-hardening-report'
+
+type HardeningFailureRecord = { at: number; attempts: number }
+
+/**
+ * How often a path whose hardening keeps failing may be retried.
+ *
+ * Why throttle at all: the env store re-hardens on the *read* path at ~2/s (#4901), so retrying
+ * every failure is an icacls-and-log storm on hosts where hardening cannot work — FAT32/exFAT have
+ * no ACLs, and network paths, redirected profiles and restricted tokens refuse.
+ *
+ * Why exponential and not a cap: a cap that never expires latches a *transient* failure — one AV
+ * scan or momentary lock and the path is abandoned for the life of the process, which can be days.
+ * Backoff bounds the rate without ever bounding the lifetime. It settles at ~2 attempts/hour on a
+ * permanently incapable host, which matters because the budget is per path and there are several
+ * secure files; a fixed one-minute floor would leave a standing five-figure daily spawn count for
+ * work that will never succeed.
+ *
+ * Why slowing it down is close to free: the synchronous write path is deliberately *not*
+ * throttled, so a host that recovers hardens on its very next credential write. This read-path
+ * re-probe is a backstop, not the recovery mechanism.
+ */
+const HARDENING_RETRY_FLOOR_MS = 60_000
+const HARDENING_RETRY_CEILING_MS = 30 * 60_000
+
+/**
+ * Why not `Date.now`: an NTP correction, a VM snapshot restore or a user changing the clock steps
+ * the wall clock backwards, which made the elapsed time negative and held every path below its
+ * delay until the clock caught up — a year, for a year-long step. That is the permanent latch this
+ * backoff exists to remove. Elapsed monotonic time cannot go backwards.
+ */
+const monotonicNowMs = (): number => performance.now()
+
+/** Consecutive failures before the degraded state is announced. */
+const HARDENING_THROTTLE_ANNOUNCE_AFTER = 3
+
+/** Exported so the tests pin the real curve rather than a copy of it. */
+export function hardeningRetryDelayMs(attempts: number): number {
+  return Math.min(HARDENING_RETRY_FLOOR_MS * 2 ** (attempts - 1), HARDENING_RETRY_CEILING_MS)
+}
+
+let hardeningFailures: SecurePathHardeningCache<HardeningFailureRecord> | null = null
+
+/**
+ * Why it defaults instead of throwing: this used to require `configureHardeningRetryBudget` first,
+ * and the only thing keeping that contract was import order — one module configured it at module
+ * scope and happened to be the sole importer. Any second importer got a throw, and from the async
+ * lane that throw lands in a `.then` handler as an unhandled rejection, which takes the Electron
+ * main process down. A retry budget is not worth a crash, and a default is not worth a caller.
+ */
+function failures(): SecurePathHardeningCache<HardeningFailureRecord> {
+  hardeningFailures ??= new SecurePathHardeningCache<HardeningFailureRecord>(
+    DEFAULT_HARDENING_CACHE_BOUNDS
+  )
+  return hardeningFailures
+}
+
+/** Overrides the default bounds. Optional: nothing has to call this before the budget is used. */
+export function configureHardeningRetryBudget(bounds: SecurePathHardeningCacheBounds): void {
+  hardeningFailures = new SecurePathHardeningCache<HardeningFailureRecord>(bounds)
+}
+
+export function mayAttemptHardening(targetPath: string): boolean {
+  const failure = failures().get(targetPath)
+  if (!failure) {
+    return true
+  }
+  // No cap: once the backoff elapses the path is re-probed, however long it has been failing.
+  return monotonicNowMs() - failure.at >= hardeningRetryDelayMs(failure.attempts)
+}
+
+export function recordHardeningOutcome(targetPath: string, restricted: boolean): void {
+  const previous = failures().get(targetPath)
+  if (restricted) {
+    failures().delete(targetPath)
+    if (previous && previous.attempts >= HARDENING_THROTTLE_ANNOUNCE_AFTER) {
+      reportSecurePathHardening(
+        targetPath,
+        'recovered',
+        `hardening succeeded again after ${previous.attempts} consecutive failures`
+      )
+    }
+    return
+  }
+  const attempts = (previous?.attempts ?? 0) + 1
+  failures().set(targetPath, { at: monotonicNowMs(), attempts })
+  // Fires exactly once: attempts only rises, and a success clears the record entirely.
+  if (attempts === HARDENING_THROTTLE_ANNOUNCE_AFTER) {
+    reportSecurePathHardening(
+      targetPath,
+      'throttled',
+      `hardening failed ${attempts} times; backing off toward one retry per ${HARDENING_RETRY_CEILING_MS / 60_000} minutes until it succeeds`
+    )
+  }
+}
diff --git a/src/shared/secure-path-windows-acl.ts b/src/shared/secure-path-windows-acl.ts
index 4d61dff79e1..ac0aac0d1ce 100644
--- a/src/shared/secure-path-windows-acl.ts
+++ b/src/shared/secure-path-windows-acl.ts
@@ -1,144 +1,351 @@
-import { execFile, execFileSync } from 'node:child_process'
-import { win32 as pathWin32 } from 'node:path'
+import { randomBytes } from 'node:crypto'
+import { readFileSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, win32 as pathWin32 } from 'node:path'
+import { runProcess, runProcessSync } from './child-process/run-process'
+import { windowsSystem32Binary } from './child-process/windows-system-binary'
+import {
+  reportSecurePathHardening,
+  type SecurePathHardeningReport
+} from './secure-path-hardening-report'
+import { localDomainSidOf, parseSddlDacl } from './windows-security-descriptor'
 
-let cachedWindowsUserSid: string | null | undefined
+const ACL_TIMEOUT_MS = 5000
 
-function buildWindowsRestrictAclArgs(
-  targetPath: string,
-  currentUserSid: string,
+/** SYSTEM and the local Administrators group: they can take ownership regardless, so denying them buys nothing. */
+const LOCAL_SYSTEM_SID = 'S-1-5-18'
+const BUILTIN_ADMINISTRATORS_SID = 'S-1-5-32-544'
+
+const WINDOWS_SID_PATTERN = /^S-1-\d+(?:-\d+)+$/
+
+type AclPlan = {
+  program: string
+  /** The path as icacls must receive it, already extended-length prefixed when needed. */
+  icaclsPath: string
   isDirectory: boolean
-): string[] {
-  return [
-    '-NoProfile',
-    '-NonInteractive',
-    '-ExecutionPolicy',
-    'Bypass',
-    '-Command',
-    WINDOWS_RESTRICT_ACL_SCRIPT,
-    targetPath,
-    currentUserSid,
-    isDirectory ? '1' : '0'
-  ]
+  allowedSids: string[]
+  /** Resolves the machine-relative aliases `/save` emits; null when the user SID is not one. */
+  localDomainSid: string | null
+  resetArgs: string[]
+  grantArgs: string[]
 }
 
-export function bestEffortRestrictWindowsPath(targetPath: string, isDirectory: boolean): void {
-  const currentUserSid = getCurrentWindowsUserSid()
-  if (!currentUserSid) {
+function buildAclPlan(targetPath: string, currentUserSid: string, isDirectory: boolean): AclPlan {
+  const icaclsPath = toIcaclsPath(targetPath)
+  // Directories propagate to children (artifact-intent files rely on inheritance); files take no flags.
+  const rights = isDirectory ? '(OI)(CI)(F)' : '(F)'
+  const allowedSids = [...new Set([currentUserSid, LOCAL_SYSTEM_SID, BUILTIN_ADMINISTRATORS_SID])]
+  return {
+    program: windowsSystem32Binary('icacls.exe'),
+    icaclsPath,
+    isDirectory,
+    allowedSids,
+    localDomainSid: localDomainSidOf(currentUserSid),
+    // `/reset` purges explicit ACEs, which `/inheritance:r` leaves in place — a planted
+    // `Everyone:(R)` survives the grant pass otherwise. The two cannot be combined in one call.
+    resetArgs: [icaclsPath, '/reset', '/q'],
+    // Never add /c: it makes icacls exit 0 on "Failed processing 1 files", a silent no-op by another route.
+    grantArgs: [
+      icaclsPath,
+      '/inheritance:r',
+      ...allowedSids.flatMap((sid) => ['/grant:r', `*${sid}:${rights}`]),
+      '/q'
+    ]
+  }
+}
+
+function verifyArgs(plan: AclPlan, savePath: string): string[] {
+  return [plan.icaclsPath, '/save', savePath, '/q']
+}
+
+function sddlSavePath(): string {
+  return join(tmpdir(), `orca-acl-${process.pid}-${randomBytes(6).toString('hex')}.sddl`)
+}
+
+/**
+ * Judges a `/save` result. Returns a failure reason, or null when the DACL on disk is exactly the
+ * intended one — protected, granting full control to the allowed SIDs and to nobody else.
+ */
+function evaluateSavedAcl(
+  plan: AclPlan,
+  result: { code: number | null; stderr: string },
+  savePath: string
+): string | null {
+  if (result.code !== 0) {
+    return result.stderr.trim() || `icacls exited ${result.code}`
+  }
+  let sddl: string
+  try {
+    // icacls writes the descriptor as UTF-16LE, which sidesteps the OEM codepage its stdout uses.
+    sddl = readFileSync(savePath, 'utf16le')
+  } catch {
+    return 'icacls saved no security descriptor'
+  }
+  return validateHardenedDacl(sddl, plan)
+}
+
+function validateHardenedDacl(sddl: string, plan: AclPlan): string | null {
+  const dacl = parseSddlDacl(sddl, plan.localDomainSid ?? undefined)
+  if (!dacl) {
+    return 'no DACL in the saved security descriptor'
+  }
+  if (!dacl.isProtected) {
+    return 'DACL is not protected; the parent still propagates into it'
+  }
+  // Exactly these, in any order: a directory's rules must be inheritable and nothing else.
+  const expectedFlags = plan.isDirectory ? ['OI', 'CI'] : []
+  const observed = new Set<string>()
+  for (const ace of dacl.aces) {
+    if (ace.type !== 'A') {
+      return `unexpected ${ace.type} rule for ${ace.sid}`
+    }
+    if (ace.flags.includes('ID')) {
+      return `inherited rule survived for ${ace.sid}`
+    }
+    if (ace.rights !== 'FA') {
+      return `rule for ${ace.sid} grants ${ace.rights || 'nothing'}, not full control`
+    }
+    // The whole set, not just OI. (OI) without (CI) leaves subdirectories unprotected, and
+    // adding (IO) makes every rule inherit-only, so the directory object itself grants nobody
+    // anything and Orca cannot even write into it. Both used to be repaired blindly on every
+    // pass; since hardening short-circuits on a DACL that verifies, whatever this accepts stays.
+    if (
+      ace.flags.length !== expectedFlags.length ||
+      !expectedFlags.every((flag) => ace.flags.includes(flag))
+    ) {
+      return `wrong inheritance flags (${ace.flags.join('') || 'none'}) for ${ace.sid}`
+    }
+    observed.add(ace.sid)
+  }
+  // Identity, not just shape: a count check alone accepts a granted SID swapped for another.
+  // Unexpected principals are reported before missing ones — "Everyone has full control" is the
+  // headline, and a substitution always produces both.
+  for (const sid of observed) {
+    if (!plan.allowedSids.includes(sid)) {
+      return `unexpected rule for ${sid}`
+    }
+  }
+  for (const sid of plan.allowedSids) {
+    if (!observed.has(sid)) {
+      return `missing rule for ${sid}`
+    }
+  }
+  return null
+}
+
+/**
+ * icacls resolves through the MAX_PATH-limited API and fails with "cannot find the path
+ * specified" past 259 characters; the extended prefix is the documented escape.
+ */
+function toIcaclsPath(targetPath: string): string {
+  if (targetPath.length < 260 || targetPath.startsWith('\\\\?\\')) {
+    return targetPath
+  }
+  const normalized = pathWin32.normalize(targetPath)
+  if (/^[A-Za-z]:\\/.test(normalized)) {
+    return `\\\\?\\${normalized}`
+  }
+  if (normalized.startsWith('\\\\')) {
+    return `\\\\?\\UNC\\${normalized.slice(2)}`
+  }
+  return targetPath
+}
+
+function report(
+  targetPath: string,
+  stage: SecurePathHardeningReport['stage'],
+  detail: string
+): void {
+  reportSecurePathHardening(targetPath, stage, detail)
+}
+
+/**
+ * Applies the ACL without blocking. `onSettled` reports the real outcome, which the return value
+ * cannot: the caller's cache must not keep claiming a path is hardened when the apply failed.
+ */
+export function bestEffortRestrictWindowsPath(
+  targetPath: string,
+  isDirectory: boolean,
+  onSettled?: (restricted: boolean) => void
+): void {
+  const plan = planFor(targetPath, isDirectory)
+  if (!plan) {
+    onSettled?.(false)
     return
   }
-  // Why: async to avoid blocking the main thread — sync PowerShell cold-start (~1-1.5s) on the frequent read path stormed it (#4901).
-  execFile(
-    getWindowsSystemToolPath('WindowsPowerShell\\v1.0\\powershell.exe'),
-    buildWindowsRestrictAclArgs(targetPath, currentUserSid, isDirectory),
-    {
-      windowsHide: true,
-      timeout: 5000
-    },
-    () => {
-      // Why: ignore errors — hardening is best-effort; PowerShell ACL APIs may be unavailable or locked down.
+  // Why async: hardening runs on the read path, and blocking it on a spawn stormed the main thread (#4901).
+  // Why both arms and a terminal catch: a bare `void p.then(fn)` makes a rejected `restrictAsync`
+  // *and* a throw from `onSettled` itself an unhandled rejection, which Node's default turns into
+  // a main-process crash — the exact opposite of what the reporter hook exists for. `false` is the
+  // right value on the error arm: it drops the path from the caller's cache and leaves it retryable.
+  void restrictAsync(targetPath, plan)
+    .then(onSettled, () => onSettled?.(false))
+    .catch((error: unknown) => reportSettlementThrow(targetPath, error))
+}
+
+/**
+ * The last frame before an unhandled rejection, so it must not throw either — and the reporter it
+ * calls is a caller-installed hook, which is the one thing here that plausibly does.
+ */
+function reportSettlementThrow(targetPath: string, error: unknown): void {
+  try {
+    report(targetPath, 'settle', `hardening settlement callback threw: ${String(error)}`)
+  } catch {
+    // Nothing left to report through; losing one diagnostic beats crashing the main process.
+  }
+}
+
+async function restrictAsync(targetPath: string, plan: AclPlan): Promise<boolean> {
+  // Verify first: a path that already reads back correct needs no write at all. Re-running
+  // `/reset` on a correct DACL would briefly restore the inherited (broader) one for no gain.
+  if ((await verifyAsync(plan)) === null) {
+    return true
+  }
+  for (const [stage, args] of [
+    ['reset', plan.resetArgs],
+    ['grant', plan.grantArgs]
+  ] as const) {
+    try {
+      const result = await runProcess({ program: plan.program, args, timeoutMs: ACL_TIMEOUT_MS })
+      if (result.code !== 0) {
+        report(targetPath, stage, result.stderr || `icacls exited ${result.code}`)
+        return false
+      }
+    } catch (error) {
+      report(targetPath, stage, String(error))
+      return false
     }
-  )
+  }
+  const invalid = await verifyAsync(plan)
+  if (invalid) {
+    report(targetPath, 'verify', invalid)
+    return false
+  }
+  return true
+}
+
+async function verifyAsync(plan: AclPlan): Promise<string | null> {
+  const savePath = sddlSavePath()
+  try {
+    const result = await runProcess({
+      program: plan.program,
+      args: verifyArgs(plan, savePath),
+      timeoutMs: ACL_TIMEOUT_MS
+    })
+    return evaluateSavedAcl(plan, result, savePath)
+  } catch (error) {
+    return String(error)
+  } finally {
+    discard(savePath)
+  }
 }
 
 export function restrictWindowsPathSync(targetPath: string, isDirectory: boolean): boolean {
+  const plan = planFor(targetPath, isDirectory)
+  if (!plan) {
+    return false
+  }
+  // Why sync: the file must not be published until its ACL is actually restricted (read path stays async, #4901).
+  if (verifySync(plan) === null) {
+    return true
+  }
+  for (const [stage, args] of [
+    ['reset', plan.resetArgs],
+    ['grant', plan.grantArgs]
+  ] as const) {
+    try {
+      const result = runProcessSync({ program: plan.program, args, timeoutMs: ACL_TIMEOUT_MS })
+      if (result.code !== 0) {
+        report(targetPath, stage, result.stderr || `icacls exited ${result.code}`)
+        return false
+      }
+    } catch (error) {
+      // Why not fatal: a failed ACL apply must not crash the write; false leaves the path uncached to retry later.
+      report(targetPath, stage, String(error))
+      return false
+    }
+  }
+  const invalid = verifySync(plan)
+  if (invalid) {
+    report(targetPath, 'verify', invalid)
+    return false
+  }
+  return true
+}
+
+function verifySync(plan: AclPlan): string | null {
+  const savePath = sddlSavePath()
+  try {
+    const result = runProcessSync({
+      program: plan.program,
+      args: verifyArgs(plan, savePath),
+      timeoutMs: ACL_TIMEOUT_MS
+    })
+    return evaluateSavedAcl(plan, result, savePath)
+  } catch (error) {
+    return String(error)
+  } finally {
+    discard(savePath)
+  }
+}
+
+function discard(savePath: string): void {
+  try {
+    rmSync(savePath, { force: true })
+  } catch {
+    // The descriptor holds no secrets; a leftover temp file is not worth reporting.
+  }
+}
+
+function planFor(targetPath: string, isDirectory: boolean): AclPlan | null {
   const currentUserSid = getCurrentWindowsUserSid()
   if (!currentUserSid) {
-    return false
-  }
-  // Why: file must not be published until its ACL is actually restricted, so block and report real success (read path stays async, #4901).
-  try {
-    execFileSync(
-      getWindowsSystemToolPath('WindowsPowerShell\\v1.0\\powershell.exe'),
-      buildWindowsRestrictAclArgs(targetPath, currentUserSid, isDirectory),
-      {
-        stdio: ['ignore', 'ignore', 'ignore'],
-        windowsHide: true,
-        timeout: 5000
-      }
-    )
-    return true
-  } catch {
-    // Why: best-effort — a failed ACL apply must not crash the write; false leaves the path uncached to retry later.
-    return false
+    report(targetPath, 'sid-lookup', 'could not resolve the current user SID')
+    return null
   }
+  return buildAclPlan(targetPath, currentUserSid, isDirectory)
 }
 
-const WINDOWS_RESTRICT_ACL_SCRIPT = `
-$ErrorActionPreference = 'Stop'
-$path = $args[0]
-$currentUserSid = $args[1]
-$isDirectory = $args[2] -eq '1'
-$allowedSidTexts = @($currentUserSid, 'S-1-5-18', 'S-1-5-32-544')
-$allowedSids = @{}
-foreach ($sidText in $allowedSidTexts) {
-  $allowedSids[$sidText] = $true
-}
-$acl = Get-Acl -LiteralPath $path
-$acl.SetAccessRuleProtection($true, $false)
-foreach ($rule in @($acl.Access)) {
-  [void]$acl.RemoveAccessRuleSpecific($rule)
-}
-$inheritanceFlags = [System.Security.AccessControl.InheritanceFlags]::None
-if ($isDirectory) {
-  $inheritanceFlags = [System.Security.AccessControl.InheritanceFlags]::ContainerInherit -bor [System.Security.AccessControl.InheritanceFlags]::ObjectInherit
-}
-foreach ($sidText in $allowedSidTexts) {
-  $sid = [System.Security.Principal.SecurityIdentifier]::new($sidText)
-  $rule = [System.Security.AccessControl.FileSystemAccessRule]::new(
-    $sid,
-    [System.Security.AccessControl.FileSystemRights]::FullControl,
-    $inheritanceFlags,
-    [System.Security.AccessControl.PropagationFlags]::None,
-    [System.Security.AccessControl.AccessControlType]::Allow
-  )
-  [void]$acl.AddAccessRule($rule)
-}
-Set-Acl -LiteralPath $path -AclObject $acl
-$verifiedAcl = Get-Acl -LiteralPath $path
-if (-not $verifiedAcl.AreAccessRulesProtected) {
-  throw 'ACL inheritance is still enabled'
-}
-$fullControl = [System.Security.AccessControl.FileSystemRights]::FullControl
-foreach ($rule in @($verifiedAcl.Access)) {
-  $sid = $rule.IdentityReference.Translate([System.Security.Principal.SecurityIdentifier]).Value
-  if (-not $allowedSids.ContainsKey($sid)) {
-    throw "Unexpected ACL entry $sid"
-  }
-  if ($rule.AccessControlType -ne [System.Security.AccessControl.AccessControlType]::Allow) {
-    throw "Unexpected ACL deny entry $sid"
-  }
-  if (($rule.FileSystemRights -band $fullControl) -ne $fullControl) {
-    throw "ACL entry $sid does not grant FullControl"
-  }
-}
-`.trim()
+let cachedWindowsUserSid: string | null = null
+let sidLookupFailedAt: number | null = null
+const SID_LOOKUP_RETRY_MS = 60_000
 
+/**
+ * Why monotonic and not `Date.now`: a backwards wall-clock step held this window open until the
+ * clock caught up, and this latch is worse than the read-path budget's — a failed lookup makes
+ * `planFor` return null, which disables the synchronous *write* path too, so the write-path
+ * exemption that recovers from that one cannot recover from this.
+ */
+const monotonicNowMs = (): number => performance.now()
+
+/**
+ * Only a well-formed SID is cached for the process lifetime. A failure is cached for a minute:
+ * caching it forever let one transient `whoami` hiccup disable hardening until restart.
+ */
 function getCurrentWindowsUserSid(): string | null {
-  if (cachedWindowsUserSid !== undefined) {
+  if (cachedWindowsUserSid) {
     return cachedWindowsUserSid
   }
-  try {
-    const output = execFileSync(
-      getWindowsSystemToolPath('whoami.exe'),
-      ['/user', '/fo', 'csv', '/nh'],
-      {
-        encoding: 'utf-8',
-        stdio: ['ignore', 'pipe', 'ignore'],
-        windowsHide: true,
-        timeout: 5000
-      }
-    ).trim()
-    const columns = parseCsvLine(output)
-    cachedWindowsUserSid = columns[1] ?? null
-  } catch {
-    cachedWindowsUserSid = null
+  if (sidLookupFailedAt !== null && monotonicNowMs() - sidLookupFailedAt < SID_LOOKUP_RETRY_MS) {
+    return null
   }
-  return cachedWindowsUserSid
-}
-
-function getWindowsSystemToolPath(relativeSystem32Path: string): string {
-  const systemRoot = process.env.SystemRoot || process.env.WINDIR || 'C:\\Windows'
-  return pathWin32.join(systemRoot, 'System32', relativeSystem32Path)
+  try {
+    const result = runProcessSync({
+      program: windowsSystem32Binary('whoami.exe'),
+      args: ['/user', '/fo', 'csv', '/nh'],
+      timeoutMs: ACL_TIMEOUT_MS
+    })
+    const candidate = result.code === 0 ? parseCsvLine(result.stdout.trim())[1] : undefined
+    if (candidate && WINDOWS_SID_PATTERN.test(candidate)) {
+      cachedWindowsUserSid = candidate
+      sidLookupFailedAt = null
+      return candidate
+    }
+  } catch {
+    // Fall through to the failure record below.
+  }
+  sidLookupFailedAt = monotonicNowMs()
+  return null
 }
 
 function parseCsvLine(line: string): string[] {
@@ -146,5 +353,6 @@ function parseCsvLine(line: string): string[] {
 }
 
 export function resetSecureFileWindowsUserSidForTests(): void {
-  cachedWindowsUserSid = undefined
+  cachedWindowsUserSid = null
+  sidLookupFailedAt = null
 }
diff --git a/src/shared/secure-path-windows-acl.win32.test.ts b/src/shared/secure-path-windows-acl.win32.test.ts
new file mode 100644
index 00000000000..7ae193d70c5
--- /dev/null
+++ b/src/shared/secure-path-windows-acl.win32.test.ts
@@ -0,0 +1,404 @@
+import { mkdirSync, mkdtempSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
+import { runProcessSync } from './child-process/run-process'
+import { windowsSystem32Binary } from './child-process/windows-system-binary'
+import {
+  setSecurePathHardeningReporter,
+  type SecurePathHardeningReport
+} from './secure-path-hardening-report'
+import {
+  bestEffortRestrictWindowsPath,
+  resetSecureFileWindowsUserSidForTests,
+  restrictWindowsPathSync
+} from './secure-path-windows-acl'
+import { removeTreeSync } from './windows-transient-lock-removal'
+
+/**
+ * The half of the proof a mocked argv test cannot give.
+ *
+ * The shipped bug was not a wrong argv — it was an argv the *callee* never
+ * received: `powershell.exe -Command <script> <path> <sid>` leaves `$args`
+ * empty, so the script died on its first statement and every caller was told
+ * the path had been hardened. Asserting on the constructed arguments passed
+ * happily throughout. Only reading the resulting ACL back off a real file
+ * catches it, so that is what this does.
+ *
+ * Runs only on win32; skipped elsewhere.
+ */
+const describeOnWindows = process.platform === 'win32' ? describe : describe.skip
+
+const EVERYONE_SID = 'S-1-1-0'
+const BUILTIN_ADMINISTRATORS_SID = 'S-1-5-32-544'
+/** High, System and Protected mandatory levels: the token is elevated. Medium (S-1-16-8192) is not. */
+const ELEVATED_INTEGRITY_SID = /\bS-1-16-(?:12288|16384|20480)\b/
+
+/** The SID the production code will grant to, so a planted DACL can differ only in its flags. */
+function currentUserSid(): string {
+  const result = runProcessSync({
+    program: windowsSystem32Binary('whoami.exe'),
+    args: ['/user', '/fo', 'csv', '/nh'],
+    timeoutMs: 10_000
+  })
+  return result.stdout.trim().split(/","/)[1]!.replace(/"$/, '')
+}
+
+/**
+ * Plants an exact DACL. Two invocations on purpose: combining `/inheritance:r` with `/grant:r`
+ * leaves the argument order to icacls, and on Windows Server the inherited ACEs survive the
+ * combined form as explicit ones -- which is a planted precondition that silently is not the
+ * one written down. Removing inheritance first makes the grant the whole DACL.
+ */
+function plantDacl(path: string, grants: string[]): void {
+  expect(icacls(path, '/inheritance:r', '/q').code).toBe(0)
+  expect(icacls(path, ...grants.flatMap((grant) => ['/grant:r', grant]), '/q').code).toBe(0)
+}
+
+function icacls(...args: string[]): { code: number | null; stdout: string } {
+  const result = runProcessSync({
+    program: windowsSystem32Binary('icacls.exe'),
+    args,
+    timeoutMs: 10_000
+  })
+  return { code: result.code, stdout: result.stdout }
+}
+
+/**
+ * Whether this process could rewrite a system file's DACL — decided before anything is written.
+ *
+ * `icacls <hosts> /save` is not the probe it looks like: `BUILTIN\Users` holds `(RX)`, so
+ * READ_CONTROL succeeds unelevated and every machine would report elevated. The token's mandatory
+ * integrity level is the thing that actually differs, and it is a SID rather than a localized
+ * string, so it reads the same on a non-English Windows.
+ */
+function isElevated(): boolean {
+  if (process.platform !== 'win32') {
+    return false
+  }
+  const result = runProcessSync({
+    program: windowsSystem32Binary('whoami.exe'),
+    args: ['/groups', '/fo', 'csv', '/nh'],
+    timeoutMs: 10_000
+  })
+  if (ELEVATED_INTEGRITY_SID.test(result.stdout)) {
+    return true
+  }
+  // Unelevated, Administrators is present only as "Group used for deny only".
+  const administrators = result.stdout
+    .split(/\r?\n/)
+    .find((line) => line.includes(BUILTIN_ADMINISTRATORS_SID))
+  return administrators?.includes('Enabled group') ?? false
+}
+
+/**
+ * The `Principal:(flags)` entries of `icacls <path>`. The first line carries the path, which is
+ * stripped by the exact string passed in so its own spaces cannot be mistaken for the separator.
+ */
+function readAclEntries(path: string): string[] {
+  const arg = path.length < 260 ? path : `\\\\?\\${path}`
+  const { stdout } = icacls(arg)
+  const entries: string[] = []
+  for (const [index, rawLine] of stdout.split(/\r?\n/).entries()) {
+    const line = index === 0 ? rawLine.slice(arg.length) : rawLine
+    const trimmed = line.trim()
+    if (!trimmed && index > 0) {
+      break
+    }
+    if (trimmed.includes(':(')) {
+      entries.push(trimmed)
+    }
+  }
+  return entries
+}
+
+/**
+ * `toHaveLength` reports only the count, and vitest elides the array past a few items — which on a
+ * host that lists a DACL differently is exactly the information needed. Name the entries.
+ */
+function listed(entries: string[]): string {
+  return `icacls listed ${entries.length} entries: ${entries.join(' | ')}`
+}
+
+describeOnWindows('restrictWindowsPathSync against a real filesystem', () => {
+  const elevated = isElevated()
+  let root: string
+
+  beforeAll(() => {
+    resetSecureFileWindowsUserSidForTests()
+    root = mkdtempSync(join(tmpdir(), 'orca-acl-win32-'))
+    // %TEMP% grants [user, SYSTEM, Administrators] (OI)(CI)(F) by default, and those
+    // propagate into every fixture below. Strip them here so a planted DACL is exactly what
+    // the test planted: on a host where the running user is also one of the three principals
+    // a test grants, an inherited copy is otherwise indistinguishable from a planted one.
+    plantDacl(root, [`*${currentUserSid()}:(OI)(CI)(F)`])
+  })
+
+  afterAll(() => {
+    // This suite plants hostile DACLs on purpose, and `removeTreeSync` only retries *transient*
+    // locks. Should a repair regress, an `(OI)(CI)(IO)` grant leaves the tree permanently
+    // undeletable — so restore inheritance first rather than leaking it into %TEMP% every run.
+    icacls(root, '/reset', '/t', '/q')
+    removeTreeSync(root)
+  })
+
+  it('actually applies the ACL to a real file, dropping inherited and foreign ACEs', () => {
+    const file = join(root, 'credential.json')
+    writeFileSync(file, '{"token":"secret"}')
+    // A planted explicit ACE: /inheritance:r alone does not remove these.
+    expect(icacls(file, '/grant', `*${EVERYONE_SID}:(R)`).code).toBe(0)
+
+    const before = readAclEntries(file)
+    expect(before.some((entry) => entry.startsWith('Everyone:'))).toBe(true)
+    expect(before.some((entry) => entry.includes('(I)'))).toBe(true)
+
+    expect(restrictWindowsPathSync(file, false)).toBe(true)
+
+    const after = readAclEntries(file)
+    // No inherited ACE survives: the DACL is protected.
+    expect(after.every((entry) => !entry.includes('(I)'))).toBe(true)
+    expect(after.some((entry) => entry.startsWith('Everyone:'))).toBe(false)
+    // Exactly the three intended principals, each with FullControl.
+    expect(after).toHaveLength(3)
+    expect(after.every((entry) => entry.endsWith(':(F)'))).toBe(true)
+  })
+
+  it('gives a real directory inheritable rules so files created inside stay restricted', () => {
+    const dir = join(root, 'secure-dir')
+    mkdirSync(dir)
+
+    expect(restrictWindowsPathSync(dir, true)).toBe(true)
+
+    const after = readAclEntries(dir)
+    expect(after).toHaveLength(3)
+    expect(after.every((entry) => entry.endsWith(':(OI)(CI)(F)'))).toBe(true)
+    expect(after.every((entry) => !entry.includes('(I)'))).toBe(true)
+
+    // The point of the inheritance flags: a child written afterwards is already restricted.
+    const child = join(dir, 'inherited.json')
+    writeFileSync(child, '{}')
+    const childEntries = readAclEntries(child)
+    expect(childEntries).toHaveLength(3)
+    expect(childEntries.every((entry) => entry.includes('(I)'))).toBe(true)
+    expect(childEntries.some((entry) => entry.startsWith('Everyone:'))).toBe(false)
+  })
+
+  // Paths reach this code from user-chosen workspace locations, so the quoting hazards that
+  // ruled out interpolating them into a PowerShell command line get exercised for real.
+  it.each([
+    ['spaces', 'a b c'],
+    ['single quote and dollar', "quo'te $var"],
+    ['backtick', 'back`tick'],
+    ['brackets', 'brack[et]s'],
+    ['semicolon and ampersand', 'semi;colon & amp'],
+    ['comma', 'com,ma'],
+    ['parentheses', 'paren(s)'],
+    ['caret and percent', 'car^et %PATH%']
+  ])('hardens a path containing %s', (_label, segment) => {
+    const dir = join(root, segment)
+    mkdirSync(dir, { recursive: true })
+    const file = join(dir, 'secret.json')
+    writeFileSync(file, '{}')
+
+    expect(restrictWindowsPathSync(file, false)).toBe(true)
+
+    const after = readAclEntries(file)
+    expect(after).toHaveLength(3)
+    expect(after.every((entry) => !entry.includes('(I)'))).toBe(true)
+  })
+
+  it('hardens a path longer than MAX_PATH', () => {
+    let dir = join(root, 'long')
+    while (dir.length < 280) {
+      dir = join(dir, 'x'.repeat(40))
+    }
+    mkdirSync(dir, { recursive: true })
+    const file = join(dir, 'secret.json')
+    expect(file.length).toBeGreaterThan(260)
+    writeFileSync(file, '{}')
+
+    expect(restrictWindowsPathSync(file, false)).toBe(true)
+    expect(readAclEntries(file)).toHaveLength(3)
+  })
+
+  /**
+   * The shape of a DACL is not the same question as who is on it. This one is protected, carries
+   * exactly three non-inherited full-control rules, and grants Everyone — so it satisfies every
+   * check that does not compare SIDs, and hardening would report success and leave it alone.
+   */
+  it('repairs a protected three-rule DACL that grants the wrong principal', () => {
+    const file = join(root, 'substituted.json')
+    writeFileSync(file, '{"token":"secret"}')
+    plantDacl(file, [`*${EVERYONE_SID}:(F)`, '*S-1-5-18:(F)', '*S-1-5-32-544:(F)'])
+
+    const before = readAclEntries(file)
+    expect(before, listed(before)).toHaveLength(3)
+    expect(before.every((entry) => !entry.includes('(I)'))).toBe(true)
+    expect(before.some((entry) => entry.startsWith('Everyone:'))).toBe(true)
+
+    expect(restrictWindowsPathSync(file, false)).toBe(true)
+
+    const after = readAclEntries(file)
+    expect(after, listed(after)).toHaveLength(3)
+    expect(after.some((entry) => entry.startsWith('Everyone:'))).toBe(false)
+  })
+
+  /**
+   * Wrong *flags* rather than a wrong principal. Both of these are protected, carry three
+   * non-inherited full-control rules for exactly the right SIDs, and differ from correct only in
+   * their inheritance flags — so a check that tests OI alone accepts them.
+   *
+   * That under-check was harmless while /reset + /grant ran unconditionally and repaired whatever
+   * was there. Verify-first made it load-bearing: what verification accepts is now left alone.
+   */
+  it.each([
+    ['(OI) without (CI), leaving subdirectories unprotected', '(OI)(F)'],
+    ['(OI)(CI)(IO), which grants nobody anything on the directory itself', '(OI)(CI)(IO)(F)']
+  ])('repairs a directory whose rules are %s', (_label, rights) => {
+    const dir = join(root, `wrong-flags-${rights.replace(/[^A-Z]/g, '')}`)
+    mkdirSync(dir)
+    plantDacl(dir, [
+      `*${currentUserSid()}:${rights}`,
+      `*S-1-5-18:${rights}`,
+      `*S-1-5-32-544:${rights}`
+    ])
+
+    const before = readAclEntries(dir)
+    expect(before, listed(before)).toHaveLength(3)
+    expect(before.every((entry) => !entry.includes('(I)'))).toBe(true)
+    expect(before.every((entry) => entry.endsWith(rights))).toBe(true)
+
+    expect(restrictWindowsPathSync(dir, true)).toBe(true)
+
+    const after = readAclEntries(dir)
+    expect(after, listed(after)).toHaveLength(3)
+    expect(after.every((entry) => entry.endsWith(':(OI)(CI)(F)'))).toBe(true)
+
+    // The point of the (IO) case: before the repair the directory object grants nobody anything,
+    // so Orca cannot write into the directory it just cached as hardened.
+    const child = join(dir, 'child.json')
+    expect(() => writeFileSync(child, '{}')).not.toThrow()
+    expect(readAclEntries(child).every((entry) => entry.includes('(I)'))).toBe(true)
+  })
+
+  it('is idempotent: a second harden leaves the same DACL', () => {
+    const file = join(root, 'idempotent.json')
+    writeFileSync(file, '{}')
+
+    expect(restrictWindowsPathSync(file, false)).toBe(true)
+    const first = readAclEntries(file)
+    expect(restrictWindowsPathSync(file, false)).toBe(true)
+
+    expect(readAclEntries(file)).toEqual(first)
+  })
+
+  /**
+   * Verification writes a temp SDDL file. If it cannot, the ACL may well have been applied — but
+   * it cannot be *proved*, so hardening must report failure rather than assume success. Fail
+   * closed, and say so: a silently-unverifiable control is the shape of the original bug.
+   */
+  it('reports failure, loudly, when verification cannot write its descriptor', () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const file = join(root, 'unverifiable.json')
+    writeFileSync(file, '{}')
+    const realTemp = process.env.TEMP
+    const realTmp = process.env.TMP
+    // Point the descriptor save at a directory that cannot exist.
+    process.env.TEMP = join(root, 'no-such-dir', 'nested')
+    process.env.TMP = process.env.TEMP
+
+    try {
+      expect(restrictWindowsPathSync(file, false)).toBe(false)
+      expect(warn).toHaveBeenCalledWith(
+        '[secure-path.windows-acl] failed to restrict path',
+        expect.objectContaining({ stage: 'verify' })
+      )
+    } finally {
+      if (realTemp === undefined) {
+        delete process.env.TEMP
+      } else {
+        process.env.TEMP = realTemp
+      }
+      if (realTmp === undefined) {
+        delete process.env.TMP
+      } else {
+        process.env.TMP = realTmp
+      }
+      warn.mockRestore()
+    }
+
+    // And the ACL itself was still applied, so the failure is a loss of proof, not of protection.
+    expect(readAclEntries(file)).toHaveLength(3)
+  })
+
+  it('reports failure for a path that does not exist', () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    expect(restrictWindowsPathSync(join(root, 'absent.json'), false)).toBe(false)
+    expect(warn).toHaveBeenCalledWith(
+      '[secure-path.windows-acl] failed to restrict path',
+      expect.objectContaining({ stage: 'reset' })
+    )
+    warn.mockRestore()
+  })
+
+  /**
+   * Skipped rather than branched: elevated, hardening *succeeds* here, so the case would assert
+   * nothing and would instead rewrite `hosts`. `icacls /reset` is no undo — it drops all explicit
+   * ACEs, and `hosts` ships with an explicit `NT AUTHORITY\SYSTEM:(F)`. Ephemeral on a CI runner;
+   * permanent for anyone running this lane from an elevated shell. So: assert, or skip.
+   */
+  it.skipIf(elevated)('reports failure for a path it has no permission to modify', () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    // Owned by TrustedInstaller; a non-elevated user cannot rewrite its DACL.
+    const systemFile = windowsSystem32Binary('drivers\\etc\\hosts')
+
+    expect(restrictWindowsPathSync(systemFile, false)).toBe(false)
+    expect(warn).toHaveBeenCalledWith(
+      '[secure-path.windows-acl] failed to restrict path',
+      expect.objectContaining({ detail: expect.stringContaining('denied') })
+    )
+    warn.mockRestore()
+  })
+
+  /**
+   * `void promise.then(onSettled)` attaches no rejection handler, so a throw from `onSettled` —
+   * which runs *after* the promise resolved, outside every try/catch inside the apply — rejects a
+   * promise nobody holds. Node's default turns that into a dead Electron main process, which
+   * presents as an Orca crash rather than as the hardening problem it is.
+   */
+  it('reports rather than crashes when the settlement callback throws', async () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const reports: SecurePathHardeningReport[] = []
+    setSecurePathHardeningReporter((entry) => reports.push(entry))
+    const file = join(root, 'settle-throws.json')
+    writeFileSync(file, '{}')
+
+    const unhandled: unknown[] = []
+    const capture = (reason: unknown): void => {
+      unhandled.push(reason)
+    }
+    process.on('unhandledRejection', capture)
+    let settled = false
+    try {
+      bestEffortRestrictWindowsPath(file, false, () => {
+        settled = true
+        throw new Error('settlement callback exploded')
+      })
+      await vi.waitFor(() => expect(settled).toBe(true))
+      // An unhandled rejection is raised a turn later, so give the loop one.
+      await new Promise((resolve) => setTimeout(resolve, 50))
+    } finally {
+      process.off('unhandledRejection', capture)
+      setSecurePathHardeningReporter(null)
+      warn.mockRestore()
+    }
+
+    expect(unhandled).toEqual([])
+    expect(reports).toContainEqual(
+      expect.objectContaining({
+        stage: 'settle',
+        detail: expect.stringContaining('settlement callback exploded')
+      })
+    )
+  })
+})
diff --git a/src/shared/setup-agent-sequencing.test.ts b/src/shared/setup-agent-sequencing.test.ts
index fd567c145b0..1b8d69f0aa5 100644
--- a/src/shared/setup-agent-sequencing.test.ts
+++ b/src/shared/setup-agent-sequencing.test.ts
@@ -271,13 +271,13 @@ describe('createSequencedSetupAgentCommands', () => {
     const startupPowerShell = decodePowerShellScript(result.startupCommand)
 
     expect(result.setupCommand).toContain(
-      'powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand'
+      'powershell.exe -NoProfile -NonInteractive -EncodedCommand'
     )
     expect(setupPowerShell).toContain("$runner = 'C:\\repo\\.git\\orca\\setup-runner.cmd'")
     expect(setupPowerShell).toContain('$nonce + ":" + $setupStatus')
     expect(result.startupCommand.match(/powershell\.exe/g)).toHaveLength(1)
     expect(result.startupCommand).toContain(
-      'powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand'
+      'powershell.exe -NoProfile -NonInteractive -EncodedCommand'
     )
     expect(startupPowerShell).toContain('AddSeconds(3)')
     expect(startupPowerShell).toContain('Missing setup marker path.')
@@ -292,6 +292,31 @@ describe('createSequencedSetupAgentCommands', () => {
     expect(result.startupEnv).toEqual({
       [SETUP_AGENT_SEQUENCE_STARTUP_COMMAND_ENV]: "codex --model gpt-5 'fix !PATH! & test'"
     })
+    // Why: `-EncodedCommand` is not execution-policy gated — only `-File` is — so the switch
+    // was a no-op, and base64 beside `-ExecutionPolicy Bypass` is a heavily EDR-flagged shape.
+    // The base64 itself must stay: these strings are typed into a terminal pane.
+    expect(result.setupCommand).not.toMatch(/-ExecutionPolicy/i)
+    expect(result.startupCommand).not.toMatch(/-ExecutionPolicy/i)
+    // Why: dropping the switch alone would break a user startup command that invokes a
+    // `.ps1` — a `.ps1` IS policy gated even though `-EncodedCommand` is not. The relief
+    // moves into the payload, where it is not part of the flagged command-line shape.
+    expect(startupPowerShell).toContain(
+      'Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force -ErrorAction Stop'
+    )
+    // Why `-ErrorAction Stop` and a reporting catch: autoload can fail for reasons that are
+    // not about policy at all (a 5.1 install with duplicate extended type data fails every
+    // cmdlet in Microsoft.PowerShell.Security), and the old SilentlyContinue plus `catch {}`
+    // hid that -- the user saw only their own script being refused. The catch must report and
+    // must NOT rethrow, or a broken policy cmdlet would take the whole startup with it.
+    expect(startupPowerShell).not.toContain('catch {}')
+    expect(startupPowerShell).toMatch(/catch \{ \[Console\]::Error\.WriteLine\(/)
+    expect(startupPowerShell).toContain('$_.FullyQualifiedErrorId')
+    expect(startupPowerShell).not.toMatch(/catch \{[^}]*throw/)
+    // Why: the autoloaded module's progress record would otherwise corrupt this gate's stderr.
+    expect(startupPowerShell).toContain("$ProgressPreference = 'SilentlyContinue'")
+    expect(startupPowerShell).toContain('$ProgressPreference = $orcaProgress')
+    // The setup gate only ever launches a .cmd/.bat runner, so it needs no relief.
+    expect(setupPowerShell).not.toMatch(/Set-ExecutionPolicy/i)
   })
 
   it('launches a batch runner through the cmd launcher inside a Git Bash gate', () => {
@@ -307,7 +332,7 @@ describe('createSequencedSetupAgentCommands', () => {
     })
 
     expect(result.setupCommand).toContain(
-      'powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand'
+      'powershell.exe -NoProfile -NonInteractive -EncodedCommand'
     )
     expect(result.setupCommand).not.toMatch(/bash\s+\S*setup-runner/)
     expect(decodePowerShellScript(result.setupCommand)).toContain(
diff --git a/src/shared/setup-agent-sequencing.ts b/src/shared/setup-agent-sequencing.ts
index 7108360f645..367be99c212 100644
--- a/src/shared/setup-agent-sequencing.ts
+++ b/src/shared/setup-agent-sequencing.ts
@@ -227,6 +227,27 @@ function buildWindowsStartupCommand(
   // Why: native Windows setup runners launch through cmd.exe, but PowerShell
   // gives us safe bounded file polling/parsing without a fragile batch label loop.
   const script = [
+    // Why: the startup command is user-authored and may invoke a `.ps1`, which IS
+    // execution-policy gated even though `-EncodedCommand` is not. This is the in-payload
+    // stand-in for the `-ExecutionPolicy Bypass` switch dropped from the command line
+    // (same trade as the agent-hooks launcher). Progress must be silenced first and
+    // restored after: Set-ExecutionPolicy autoloads a module whose "Preparing modules for
+    // first use." record would otherwise land on the stderr this gate writes to.
+    //
+    // The failure is reported rather than swallowed. Autoload can fail for reasons that
+    // have nothing to do with policy -- a 5.1 install with duplicate extended type data
+    // fails every cmdlet in Microsoft.PowerShell.Security -- and the old
+    // `-ErrorAction SilentlyContinue` plus empty `catch` hid that completely, leaving the
+    // user with an execution-policy refusal from their own script and no trace that the
+    // relief had been attempted. `-ErrorAction Stop` is what routes a non-terminating
+    // failure into the catch at all. Still never throws: a diagnostic is worth a line of
+    // stderr, but not the startup this gate exists to run.
+    "$orcaProgress = $ProgressPreference; $ProgressPreference = 'SilentlyContinue'",
+    'try { Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force -ErrorAction Stop } ' +
+      'catch { [Console]::Error.WriteLine("Orca: could not relax the execution policy for this " + ' +
+      '"session (" + $_.FullyQualifiedErrorId + "). A startup command that runs a .ps1 " + ' +
+      '"may be blocked.") }',
+    '$ProgressPreference = $orcaProgress',
     `$marker = ${quotePowerShellString(markerPath)}`,
     'if ([string]::IsNullOrWhiteSpace($marker)) {',
     '  [Console]::Error.WriteLine("Missing setup marker path.")',
@@ -269,8 +290,11 @@ function buildWindowsStartupCommand(
   return encodePowerShellInvocation(script)
 }
 
+// Why: `-EncodedCommand` is not execution-policy gated (only `-File` is), so `-ExecutionPolicy
+// Bypass` was a no-op — and it is one of the most heavily EDR-flagged PowerShell tokens. The
+// base64 stays: these strings are typed into a terminal pane and re-parsed by its shell.
 function encodePowerShellInvocation(script: string): string {
-  return `powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand ${encodePowerShellCommand(script)}`
+  return `powershell.exe -NoProfile -NonInteractive -EncodedCommand ${encodePowerShellCommand(script)}`
 }
 
 function quotePosixArg(value: string): string {
diff --git a/src/shared/setup-runner-command.test.ts b/src/shared/setup-runner-command.test.ts
index 069130b1313..4280ed4f6e0 100644
--- a/src/shared/setup-runner-command.test.ts
+++ b/src/shared/setup-runner-command.test.ts
@@ -82,7 +82,7 @@ describe('buildSetupRunnerCommand', () => {
 
     expect(command).not.toContain('cmd.exe /c')
     expect(command).toMatch(
-      /^powershell\.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand [A-Za-z0-9+/=]+$/
+      /^powershell\.exe -NoProfile -NonInteractive -EncodedCommand [A-Za-z0-9+/=]+$/
     )
   })
 
@@ -129,7 +129,7 @@ describe('buildSetupRunnerCommand cmd metacharacter guard', () => {
       })
 
       expect(command).toMatch(
-        /^powershell\.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand [A-Za-z0-9+/=]+$/
+        /^powershell\.exe -NoProfile -NonInteractive -EncodedCommand [A-Za-z0-9+/=]+$/
       )
     }
   )
diff --git a/src/shared/shell-process-readiness.test.ts b/src/shared/shell-process-readiness.test.ts
index 9c3abad9783..a31f8ba7737 100644
--- a/src/shared/shell-process-readiness.test.ts
+++ b/src/shared/shell-process-readiness.test.ts
@@ -2,7 +2,11 @@ import { mkdir, mkdtemp, rm, symlink } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { basename, dirname, join } from 'node:path'
 import { describe, expect, it } from 'vitest'
-import { parseDarwinExecutablePath, resolveShellExecutablePath } from './shell-process-readiness'
+import {
+  parseDarwinExecutablePath,
+  resolveInstalledShellExecutablePaths,
+  resolveShellExecutablePath
+} from './shell-process-readiness'
 
 describe('shell process readiness', () => {
   it('extracts the primary text image from macOS lsof output', () => {
@@ -70,4 +74,46 @@ describe('shell process readiness', () => {
       }
     }
   )
+
+  it.skipIf(process.platform === 'win32')(
+    'lists every PATH installation of a shell name, deduplicated and canonical',
+    async () => {
+      const root = await mkdtemp(join(tmpdir(), 'orca-installed-shells-'))
+      const first = join(root, 'first')
+      const second = join(root, 'second')
+      const missing = join(root, 'missing')
+      await mkdir(first)
+      await mkdir(second)
+      await symlink(process.execPath, join(first, 'shell-name'))
+      await symlink(process.execPath, join(second, 'shell-name'))
+      try {
+        const canonical = await resolveShellExecutablePath(process.execPath, root, '')
+        await expect(
+          resolveInstalledShellExecutablePaths('shell-name', root, `${first}:${missing}:${second}`)
+        ).resolves.toEqual([canonical])
+      } finally {
+        await rm(root, { recursive: true, force: true })
+      }
+    }
+  )
+
+  it.skipIf(process.platform === 'win32')(
+    'omits a same-name executable that no PATH entry reaches',
+    async () => {
+      const root = await mkdtemp(join(tmpdir(), 'orca-offpath-shell-'))
+      const onPath = join(root, 'bin')
+      const offPath = join(root, 'dropped')
+      await mkdir(onPath)
+      await mkdir(offPath)
+      await symlink(process.execPath, join(onPath, 'shell-name'))
+      await symlink(process.execPath, join(offPath, 'shell-name'))
+      try {
+        await expect(
+          resolveInstalledShellExecutablePaths('shell-name', root, onPath)
+        ).resolves.not.toContain(join(offPath, 'shell-name'))
+      } finally {
+        await rm(root, { recursive: true, force: true })
+      }
+    }
+  )
 })
diff --git a/src/shared/shell-process-readiness.ts b/src/shared/shell-process-readiness.ts
index ebb94c13eb5..c9976b0d03e 100644
--- a/src/shared/shell-process-readiness.ts
+++ b/src/shared/shell-process-readiness.ts
@@ -56,12 +56,12 @@ export async function readShellProcessReadiness(
     : null
 }
 
-export async function resolveShellExecutablePath(
+function shellExecutableCandidates(
   shellPath: string,
   cwd: string,
   pathEnv: string | undefined
-): Promise<string | null> {
-  const candidates = shellPath.includes('/')
+): string[] {
+  return shellPath.includes('/')
     ? [isAbsolute(shellPath) ? shellPath : resolve(cwd, shellPath)]
     : (
         pathEnv ??
@@ -69,14 +69,42 @@ export async function resolveShellExecutablePath(
       )
         .split(delimiter)
         .map((entry) => resolve(isAbsolute(entry) ? entry : resolve(cwd, entry), shellPath))
-  for (const candidate of candidates) {
-    try {
-      await access(candidate, constants.X_OK)
-      const canonicalPath = await realpath(candidate)
-      if ((await stat(canonicalPath)).isFile()) {
-        return canonicalPath
-      }
-    } catch {}
+}
+
+async function canonicalizeExecutable(candidate: string): Promise<string | null> {
+  try {
+    await access(candidate, constants.X_OK)
+    const canonicalPath = await realpath(candidate)
+    return (await stat(canonicalPath)).isFile() ? canonicalPath : null
+  } catch {
+    return null
+  }
+}
+
+export async function resolveShellExecutablePath(
+  shellPath: string,
+  cwd: string,
+  pathEnv: string | undefined
+): Promise<string | null> {
+  for (const candidate of shellExecutableCandidates(shellPath, cwd, pathEnv)) {
+    const canonicalPath = await canonicalizeExecutable(candidate)
+    if (canonicalPath) {
+      return canonicalPath
+    }
   }
   return null
 }
+
+/** Every canonical executable `shellName` names on `pathEnv` — the installations a
+ *  startup profile could legitimately `exec` into, and nothing a dropped-in binary
+ *  outside the search path can reach. `shellName` must be a bare name. */
+export async function resolveInstalledShellExecutablePaths(
+  shellName: string,
+  cwd: string,
+  pathEnv: string | undefined
+): Promise<string[]> {
+  const canonicalPaths = await Promise.all(
+    shellExecutableCandidates(shellName, cwd, pathEnv).map(canonicalizeExecutable)
+  )
+  return [...new Set(canonicalPaths.filter((path): path is string => path !== null))]
+}
diff --git a/src/shared/shell-ready-marker-timing.ts b/src/shared/shell-ready-marker-timing.ts
new file mode 100644
index 00000000000..7c73afb4c31
--- /dev/null
+++ b/src/shared/shell-ready-marker-timing.ts
@@ -0,0 +1,18 @@
+/**
+ * When in a shell's startup Orca's OSC 777 ready marker is published.
+ *
+ * Why this is a decision of its own: it is what separates "waiting for the marker
+ * is free" from "waiting for the marker costs the user real startup latency", and
+ * all three transports (daemon, relay, local provider) have to answer it the same
+ * way or a startup command is delivered twice on one of them.
+ */
+
+/**
+ * True when the marker rides the shell's line editor (zsh `precmd`, bash
+ * `PROMPT_COMMAND`), so it arrives at the same moment the prompt can accept input.
+ * Every other wrapped shell emits it from startup, ahead of the reader.
+ */
+export function shellReadyMarkerComesFromLineEditor(shellPath: string): boolean {
+  const shellName = shellPath.replace(/\\/g, '/').split('/').pop()?.toLowerCase() ?? ''
+  return shellName === 'bash' || shellName === 'zsh'
+}
diff --git a/src/shared/source-scan/source-tree-scan.test.ts b/src/shared/source-scan/source-tree-scan.test.ts
index be4b72e4ce9..07ddb52a845 100644
--- a/src/shared/source-scan/source-tree-scan.test.ts
+++ b/src/shared/source-scan/source-tree-scan.test.ts
@@ -47,6 +47,13 @@ describe('stripComments', () => {
 })
 
 describe('blankStringContents', () => {
+  it('does not rescan the accumulated source for each division operator', () => {
+    const source = 'const x = value / 2;\n'.repeat(10000)
+    const started = performance.now()
+    expect(blankStringContents(source)).toBe(source)
+    expect(performance.now() - started).toBeLessThan(200)
+  })
+
   it('neutralises parentheses inside a string so a call is matched whole', () => {
     // A shell script embedded as a string closed the call early, so the options
     // object fell outside the match and its flags read as absent.
diff --git a/src/shared/source-scan/source-tree-scan.ts b/src/shared/source-scan/source-tree-scan.ts
index dce7ae1a274..937a2fc39db 100644
--- a/src/shared/source-scan/source-tree-scan.ts
+++ b/src/shared/source-scan/source-tree-scan.ts
@@ -179,8 +179,7 @@ export function blankStringContentsDesynced(source: string): boolean {
  * each also has a prefix reading: `!` (non-null assertion vs `!/re/.test(x)`),
  * `+` `-` `*` `%` `^` `~` (postfix `--`/`++`), and `>` `}` (JSX close).
  */
-function startsRegexLiteral(emitted: string): boolean {
-  const prev = emitted.replace(/\s+$/, '').at(-1)
+function startsRegexLiteral(prev: string | undefined): boolean {
   return prev === undefined || '(,=:[&|?;'.includes(prev)
 }
 
@@ -209,6 +208,7 @@ function findRegexLiteralEnd(source: string, start: number): number {
 
 export function blankStringContents(source: string, reportDesync = false): string {
   let out = ''
+  let lastSignificantChar: string | undefined
   let index = 0
   let quote: string | null = null
   // Brace depth per interpolation, so a `}` inside `${ { a: 1 } }` does not
@@ -220,6 +220,7 @@ export function blankStringContents(source: string, reportDesync = false): strin
       templates.push(0)
       quote = null
       out += '${'
+      lastSignificantChar = '{'
       index += 2
       continue
     }
@@ -232,6 +233,7 @@ export function blankStringContents(source: string, reportDesync = false): strin
           templates.pop()
           quote = '`'
           out += char
+          lastSignificantChar = char
           index += 1
           continue
         }
@@ -256,6 +258,7 @@ export function blankStringContents(source: string, reportDesync = false): strin
       if (char === quote) {
         quote = null
         out += char
+        lastSignificantChar = char
       } else {
         out += char === '\n' ? char : ' '
       }
@@ -270,10 +273,11 @@ export function blankStringContents(source: string, reportDesync = false): strin
     // comments first, but this runs standalone too, and at index 0 a file
     // starting with a banner comment read as one giant regex.
     const next = source[index + 1]
-    if (char === '/' && next !== '/' && next !== '*' && startsRegexLiteral(out)) {
+    if (char === '/' && next !== '/' && next !== '*' && startsRegexLiteral(lastSignificantChar)) {
       const end = findRegexLiteralEnd(source, index)
       if (end !== -1) {
         out += `/${' '.repeat(end - index - 1)}`
+        lastSignificantChar = '/'
         index = end
         continue
       }
@@ -282,6 +286,9 @@ export function blankStringContents(source: string, reportDesync = false): strin
       quote = char
     }
     out += char
+    if (/\S/.test(char)) {
+      lastSignificantChar = char
+    }
     index += 1
   }
   if (reportDesync) {
diff --git a/src/shared/ssh-relay-pty-ownership-proof.test.ts b/src/shared/ssh-relay-pty-ownership-proof.test.ts
index b17f96808f9..92e523d3e25 100644
--- a/src/shared/ssh-relay-pty-ownership-proof.test.ts
+++ b/src/shared/ssh-relay-pty-ownership-proof.test.ts
@@ -174,6 +174,52 @@ describe('planRelayPtySweep', () => {
     expect(reasonFor(plan, 'pty-1')).toBe('host foreground observation is malformed')
   })
 
+  // The kill gate's own boundary. Unlike the renderer's admission this sum is correct --
+  // `evidenceAgeSinceListingMs` is stamped after the listing ARRIVES, so it measures planning time
+  // and overlaps the host's capture window not at all.
+  it.each([
+    ['at the ceiling', RELAY_PTY_SWEEP_MAX_EVIDENCE_AGE_MS, 0],
+    ['at the ceiling once planning is counted', RELAY_PTY_SWEEP_MAX_EVIDENCE_AGE_MS - 10, 10]
+  ])('still sweeps on an observation %s', (_label, capturedAgeMs, evidenceAgeSinceListingMs) => {
+    const plan = planRelayPtySweep(
+      [orphan({ foregroundProcessEvidence: { ...idleShell(), capturedAgeMs } })],
+      context({ evidenceAgeSinceListingMs })
+    )
+
+    expect(plan.sweep).toEqual([{ ptyId: 'pty-1', incarnationId: 'inc-1' }])
+  })
+
+  it.each([
+    ['the capture alone', RELAY_PTY_SWEEP_MAX_EVIDENCE_AGE_MS + 1, 0],
+    ['the capture plus planning', RELAY_PTY_SWEEP_MAX_EVIDENCE_AGE_MS, 1]
+  ])('refuses the stop one step past the ceiling on %s', (_label, capturedAgeMs, sinceListing) => {
+    const plan = planRelayPtySweep(
+      [orphan({ foregroundProcessEvidence: { ...idleShell(), capturedAgeMs } })],
+      context({ evidenceAgeSinceListingMs: sinceListing })
+    )
+
+    expect(plan.sweep).toEqual([])
+    expect(reasonFor(plan, 'pty-1')).toBe(
+      'host foreground observation is too old to authorize a stop'
+    )
+  })
+
+  it('refuses the stop on a capture slow enough to be worth waiting out', () => {
+    // Measured `ps` with PS_ARGS: 2.5-9.0s on a 2,002-process laptop, 4.0-18.6s at load 46. This
+    // gate tolerates the fast end and refuses the rest, so waiting out a slow capture cannot buy a
+    // sweep -- which is why the evidence path gives up on one instead of blocking a connect for it.
+    for (const capturedAgeMs of [6_140, 9_010, 18_600]) {
+      const plan = planRelayPtySweep(
+        [orphan({ foregroundProcessEvidence: { ...idleShell(), capturedAgeMs } })],
+        context()
+      )
+      expect(plan.sweep, `capturedAgeMs=${capturedAgeMs}`).toEqual([])
+      expect(reasonFor(plan, 'pty-1'), `capturedAgeMs=${capturedAgeMs}`).toBe(
+        'host foreground observation is too old to authorize a stop'
+      )
+    }
+  })
+
   it('never sweeps on an evidence record whose other host stamps are malformed', () => {
     const plan = planRelayPtySweep(
       [
diff --git a/src/shared/ssh-types.ts b/src/shared/ssh-types.ts
index f234b1c578a..566bc5e17f5 100644
--- a/src/shared/ssh-types.ts
+++ b/src/shared/ssh-types.ts
@@ -65,8 +65,15 @@ export type SshTarget = {
 export type SshTargetCreateInput = Omit<SshTarget, 'id' | 'generation'>
 export type SshTargetUpdateInput = Partial<SshTargetCreateInput>
 
-/** Public target identity safe to mirror to a paired client. */
-export type SshTargetSummary = Pick<SshTarget, 'id' | 'label' | 'generation'>
+/** Public target identity and observed host metadata safe to mirror to a paired client. */
+export type SshTargetSummary = Pick<SshTarget, 'id' | 'label' | 'generation'> & {
+  /** The SSH host's OS, when it has connected and the relay has detected it. */
+  remotePlatform?: SshRemotePlatform
+  /** Whether the target currently has a host-owned connected SSH lifecycle. */
+  connected?: boolean
+  /** Current SSH lifecycle state, when the desktop has one for this target. */
+  connectionStatus?: SshConnectionStatus
+}
 
 /** Identity of a removed SSH target, recorded so that re-adding the same host
  *  can re-point orphaned repos/worktrees from the old (deleted) target id to
diff --git a/src/shared/structured-agent-session-coalescer.test.ts b/src/shared/structured-agent-session-coalescer.test.ts
new file mode 100644
index 00000000000..770b08308af
--- /dev/null
+++ b/src/shared/structured-agent-session-coalescer.test.ts
@@ -0,0 +1,56 @@
+import { describe, expect, it } from 'vitest'
+import type { AgentSessionSubscribeEvent } from './agent-session-wire'
+import { createStructuredAgentSessionEventCoalescer } from './structured-agent-session-coalescer'
+
+function batch(
+  sequence: number,
+  backgroundTasks?: Extract<AgentSessionSubscribeEvent, { type: 'batch' }>['backgroundTasks']
+): Extract<AgentSessionSubscribeEvent, { type: 'batch' }> {
+  return {
+    type: 'batch',
+    sessionId: 'session-1',
+    batch: {
+      cursor: { epoch: 'epoch-1', sequence },
+      items: [],
+      removedItemIds: [],
+      submissions: []
+    },
+    ...(backgroundTasks !== undefined ? { backgroundTasks } : {})
+  }
+}
+
+describe('structured agent session event coalescer', () => {
+  it('preserves background task state when a journal batch follows it', () => {
+    const events: AgentSessionSubscribeEvent[] = []
+    const coalescer = createStructuredAgentSessionEventCoalescer((event) => events.push(event))
+
+    coalescer.push(
+      batch(1, {
+        state: 'monitoring',
+        tasks: [{ id: 'task-1', kind: 'command', description: 'run the build' }]
+      })
+    )
+    coalescer.push(batch(2))
+    coalescer.flush()
+
+    expect(events).toHaveLength(1)
+    expect(events[0]).toMatchObject({
+      backgroundTasks: {
+        state: 'monitoring',
+        tasks: [{ id: 'task-1', kind: 'command', description: 'run the build' }]
+      }
+    })
+  })
+
+  it('keeps an explicit terminal state as the newest coalesced value', () => {
+    const events: AgentSessionSubscribeEvent[] = []
+    const coalescer = createStructuredAgentSessionEventCoalescer((event) => events.push(event))
+
+    coalescer.push(batch(1, { state: 'monitoring' }))
+    coalescer.push(batch(1, null))
+    coalescer.flush()
+
+    expect(events).toHaveLength(1)
+    expect(events[0]).toMatchObject({ backgroundTasks: null })
+  })
+})
diff --git a/src/shared/structured-agent-session-coalescer.ts b/src/shared/structured-agent-session-coalescer.ts
index 51bc7fa0537..fe982d67a69 100644
--- a/src/shared/structured-agent-session-coalescer.ts
+++ b/src/shared/structured-agent-session-coalescer.ts
@@ -35,7 +35,15 @@ function mergeBatch(
     ...(right.fence !== undefined || left.fence !== undefined
       ? { fence: right.fence ?? left.fence }
       : {}),
-    ...(right.handoff || left.handoff ? { handoff: right.handoff ?? left.handoff } : {})
+    ...(right.handoff || left.handoff ? { handoff: right.handoff ?? left.handoff } : {}),
+    ...(right.backgroundTasks !== undefined || left.backgroundTasks !== undefined
+      ? {
+          backgroundTasks:
+            right.backgroundTasks !== undefined
+              ? right.backgroundTasks
+              : (left.backgroundTasks ?? null)
+        }
+      : {})
   }
 }
 
diff --git a/src/shared/structured-agent-session-composer.test.ts b/src/shared/structured-agent-session-composer.test.ts
new file mode 100644
index 00000000000..38fed5ddbc1
--- /dev/null
+++ b/src/shared/structured-agent-session-composer.test.ts
@@ -0,0 +1,31 @@
+import { describe, expect, it } from 'vitest'
+import {
+  isStructuredAgentSessionComposerCommand,
+  structuredSlashCommands
+} from './structured-agent-session-composer'
+
+describe('structuredSlashCommands', () => {
+  // The composer menu and the dispatcher read this one list. When they disagreed,
+  // a Claude session was offered Codex-only tokens that missed the command guard
+  // and reached the model as literal prompt text instead of erroring.
+  it.each(['codex', 'claude'] as const)('offers %s only commands it also accepts', (agent) => {
+    const offered = structuredSlashCommands(agent)
+    expect(offered.length).toBeGreaterThan(0)
+    for (const command of offered) {
+      expect(isStructuredAgentSessionComposerCommand(`/${command.name}`, agent)).toBe(true)
+    }
+  })
+
+  it('offers each agent its own catalog', () => {
+    const claude = structuredSlashCommands('claude').map((command) => command.name)
+    expect(claude).toContain('compact')
+    expect(claude).not.toContain('vim')
+    expect(structuredSlashCommands('codex').map((command) => command.name)).toContain('vim')
+  })
+
+  it('offers effort to every structured agent', () => {
+    for (const agent of ['codex', 'claude'] as const) {
+      expect(structuredSlashCommands(agent).map((command) => command.name)).toContain('effort')
+    }
+  })
+})
diff --git a/src/shared/structured-agent-session-composer.ts b/src/shared/structured-agent-session-composer.ts
index 420651aba5b..18bdeab001d 100644
--- a/src/shared/structured-agent-session-composer.ts
+++ b/src/shared/structured-agent-session-composer.ts
@@ -35,7 +35,10 @@ function commandParts(text: string): { name: string; argument: string } | null {
   return match ? { name: match[1]!.toLowerCase(), argument: match[2]?.trim() ?? '' } : null
 }
 
-function structuredSlashCommands(agent: AgentType): readonly SlashCommandSuggestion[] {
+/** The command catalog a structured session offers and accepts. The composer menu
+ *  and the dispatcher must read the same list, or a menu pick falls through the
+ *  command guard and reaches the model as literal prompt text. */
+export function structuredSlashCommands(agent: AgentType): readonly SlashCommandSuggestion[] {
   if (agent === 'codex') {
     return STRUCTURED_AGENT_SESSION_SLASH_COMMANDS
   }
diff --git a/src/shared/structured-agent-session-mutation.ts b/src/shared/structured-agent-session-mutation.ts
index ccc80475c93..79c82095f29 100644
--- a/src/shared/structured-agent-session-mutation.ts
+++ b/src/shared/structured-agent-session-mutation.ts
@@ -26,6 +26,33 @@ export function structuredAgentSessionPayloadFingerprint(input: {
   return Array.from(bytes, (byte) => byte.toString(16).padStart(2, '0')).join('')
 }
 
+export function structuredAgentSessionCreateFingerprint(input: {
+  sessionId: string
+  worktree: string
+  agent: 'claude' | 'codex'
+}): string {
+  return structuredAgentSessionPayloadFingerprint({
+    method: 'agentSession.create',
+    sessionId: input.sessionId,
+    fields: {
+      worktree: input.worktree,
+      agent: input.agent
+    }
+  })
+}
+
+export function showStructuredAgentSessionChoice(input: {
+  hostCapability: boolean
+  workspaceSupport: boolean
+  agent: string
+}): boolean {
+  return (
+    input.hostCapability &&
+    input.workspaceSupport &&
+    (input.agent === 'claude' || input.agent === 'codex')
+  )
+}
+
 export function createStructuredAgentSessionOperationId(
   randomUuid: () => string,
   now: number = Date.now()
diff --git a/src/shared/structured-agent-session-options.test.ts b/src/shared/structured-agent-session-options.test.ts
index 72f817c7646..0f21efadd98 100644
--- a/src/shared/structured-agent-session-options.test.ts
+++ b/src/shared/structured-agent-session-options.test.ts
@@ -49,8 +49,12 @@ describe('structured agent session options', () => {
       models: CODEX_SESSION_OPTION_CATALOG.models,
       record: bridgeRecord,
       mode: 'live',
-      modelLabel: 'Model'
+      modelLabel: 'Model',
+      liveTransport: 'catalog'
     })
+    // Same catalog, same `dispatched` vocabulary — only the transport separates them.
+    expect(structured.every((descriptor) => descriptor.transport === 'agent-session')).toBe(true)
+    expect(bridge.every((descriptor) => descriptor.transport === 'catalog')).toBe(true)
     expect(bridge[0]).toMatchObject({ action: { type: 'agent-picker' } })
     expect(bridge.find((descriptor) => descriptor.id === 'effort')).toMatchObject({
       action: { type: 'agent-picker' }
diff --git a/src/shared/structured-agent-session-options.ts b/src/shared/structured-agent-session-options.ts
index 94f5f45351a..d746a52025c 100644
--- a/src/shared/structured-agent-session-options.ts
+++ b/src/shared/structured-agent-session-options.ts
@@ -76,10 +76,14 @@ export function applyStructuredAgentSessionOptions(
   seed: AgentSessionOptionCatalog,
   result: AgentSessionOptionsResult
 ): StructuredAgentSessionOptionState {
-  applyNativeChatReportedSessionOptions(state.record, {
-    model: result.current.model,
-    ...(result.current.effort ? { effort: result.current.effort } : {})
-  })
+  applyNativeChatReportedSessionOptions(
+    state.record,
+    {
+      model: result.current.model,
+      ...(result.current.effort ? { effort: result.current.effort } : {})
+    },
+    result.current.confirmed ?? []
+  )
   return { ...state, catalog: structuredAgentSessionOptionCatalog(seed, result) }
 }
 
diff --git a/src/shared/structured-agent-session-projection.test.ts b/src/shared/structured-agent-session-projection.test.ts
index 048051e70a5..8bdce30577e 100644
--- a/src/shared/structured-agent-session-projection.test.ts
+++ b/src/shared/structured-agent-session-projection.test.ts
@@ -1,4 +1,5 @@
 import { describe, expect, it } from 'vitest'
+import { AGENT_STATUS_MAX_FIELD_LENGTH } from './agent-status-field-normalization'
 import type { AgentJournalRenderItem } from './agent-session-journal-types'
 import { parsePaneKey } from './stable-pane-id'
 import {
@@ -6,6 +7,7 @@ import {
   hasPersistedStructuredAgentSessionTurn,
   projectStructuredItemToNativeChat,
   projectStructuredAgentSessionStatus,
+  projectStructuredAgentSessionStatusSummary,
   structuredAgentSessionPaneKey
 } from './structured-agent-session-projection'
 
@@ -44,6 +46,52 @@ describe('structured agent session status projection', () => {
     expect(projectStructuredAgentSessionStatus([running, completed])).toBe('idle')
   })
 
+  it('summarizes status with the newest user prompt, and null before any persisted turn', () => {
+    const running = item('running', 3, {
+      kind: 'status',
+      text: 'Working',
+      turnLifecycle: { turnId: 'turn-1', state: 'running' }
+    })
+    const first = item('first', 1, {
+      kind: 'message',
+      role: 'user',
+      blocks: [{ type: 'text', text: 'first' }]
+    })
+    const second = item('second', 2, {
+      kind: 'message',
+      role: 'user',
+      blocks: [
+        { type: 'text', text: 'second' },
+        { type: 'text', text: 'line' }
+      ]
+    })
+
+    expect(projectStructuredAgentSessionStatusSummary([running])).toEqual({
+      status: null,
+      latestPrompt: ''
+    })
+    expect(projectStructuredAgentSessionStatusSummary([first, second, running])).toEqual({
+      status: 'working',
+      latestPrompt: 'second line'
+    })
+    expect(projectStructuredAgentSessionStatusSummary([first, second])).toEqual({
+      status: 'idle',
+      latestPrompt: 'second line'
+    })
+  })
+
+  it('bounds the wire prompt at the shared agent-status preview cap', () => {
+    const pasted = item('pasted', 1, {
+      kind: 'message',
+      role: 'user',
+      blocks: [{ type: 'text', text: 'x'.repeat(AGENT_STATUS_MAX_FIELD_LENGTH * 40) }]
+    })
+
+    expect(projectStructuredAgentSessionStatusSummary([pasted]).latestPrompt).toHaveLength(
+      AGENT_STATUS_MAX_FIELD_LENGTH
+    )
+  })
+
   it('creates a deterministic pane identity for status stores', () => {
     const paneKey = structuredAgentSessionPaneKey('structured-agent-session-1', 'session-1')
 
diff --git a/src/shared/structured-agent-session-projection.ts b/src/shared/structured-agent-session-projection.ts
index 71cffa43762..6a5f01ba9ea 100644
--- a/src/shared/structured-agent-session-projection.ts
+++ b/src/shared/structured-agent-session-projection.ts
@@ -1,3 +1,4 @@
+import { normalizePromptField } from './agent-status-field-normalization'
 import type { AgentJournalRenderItem } from './agent-session-journal-types'
 import type { NativeChatBlock, NativeChatMessage } from './native-chat-types'
 import { sha256 } from './sha256'
@@ -6,6 +7,22 @@ function boundedText(payload: { head: string; truncated: boolean; byteLength: nu
   return payload.truncated ? `${payload.head}\n… (${payload.byteLength} bytes)` : payload.head
 }
 
+/** The markers a clipped payload carries in its own text, anchored to the end
+ *  so nothing that merely looks like one inside the body can match. */
+const BOUNDED_TEXT_MARKERS = [
+  /\n… \(\d+ bytes\)$/,
+  /\n\[Orca: output truncated — \d+ bytes total, digest [0-9a-f]+\]$/
+]
+
+/** Recovers the clipped body from a bounded payload's text, and says whether a
+ *  marker was there. A reader that treats the text as content renders the
+ *  marker as a line of it — with a line number, which reads as a real position
+ *  in the file — and reports the body as complete. */
+export function stripBoundedTextMarker(text: string): { text: string; truncated: boolean } {
+  const stripped = BOUNDED_TEXT_MARKERS.reduce((value, marker) => value.replace(marker, ''), text)
+  return { text: stripped, truncated: stripped.length !== text.length }
+}
+
 function itemBlocks(item: AgentJournalRenderItem): {
   role: NativeChatMessage['role']
   blocks: NativeChatBlock[]
@@ -146,6 +163,34 @@ export function projectStructuredAgentSessionStatus(
   return activeStructuredAgentSessionTurnId(items) ? 'working' : 'idle'
 }
 
+/** The newest user prompt, as the sidebar quotes it. */
+export function latestStructuredAgentSessionPrompt(
+  items: readonly AgentJournalRenderItem[]
+): string {
+  for (let index = items.length - 1; index >= 0; index -= 1) {
+    const body = items[index]?.body
+    if (body?.kind === 'message' && body.role === 'user') {
+      return body.blocks.flatMap((block) => (block.type === 'text' ? [block.text] : [])).join('\n')
+    }
+  }
+  return ''
+}
+
+/** One projection shared by host and client: null status means "no turn yet", not idle.
+ *  The prompt is bounded to the same preview every other agent-status row carries — a send
+ *  admits 256 KB, and one status frame carries every retained session at once. */
+export function projectStructuredAgentSessionStatusSummary(
+  items: readonly AgentJournalRenderItem[]
+): { status: StructuredAgentSessionProjectedStatus | null; latestPrompt: string } {
+  if (!hasPersistedStructuredAgentSessionTurn(items)) {
+    return { status: null, latestPrompt: '' }
+  }
+  return {
+    status: projectStructuredAgentSessionStatus(items),
+    latestPrompt: normalizePromptField(latestStructuredAgentSessionPrompt(items))
+  }
+}
+
 export function structuredAgentSessionPaneKey(tabId: string, sessionId: string): string {
   const bytes = sha256(new TextEncoder().encode(sessionId))
   const hex = Array.from(bytes.slice(0, 16), (byte) => byte.toString(16).padStart(2, '0')).join('')
diff --git a/src/shared/structured-agent-session-reducer.test.ts b/src/shared/structured-agent-session-reducer.test.ts
index 222db53a564..d36b6717758 100644
--- a/src/shared/structured-agent-session-reducer.test.ts
+++ b/src/shared/structured-agent-session-reducer.test.ts
@@ -54,6 +54,39 @@ function hydrationPage(
 }
 
 describe('structured agent session reducer', () => {
+  it('applies an additive targeted-stop capability update without journal churn', () => {
+    const backgroundTasks = {
+      state: 'monitoring' as const,
+      tasks: [{ id: 'task-1', kind: 'agent' as const }]
+    }
+    const initial = reduceStructuredAgentSession(EMPTY_STRUCTURED_AGENT_SESSION, {
+      type: 'event',
+      event: {
+        type: 'snapshot',
+        sessionId: 'session-a',
+        fence: 1,
+        page: { ...hydrationPage([]), backgroundTasks }
+      }
+    })
+    const updated = reduceStructuredAgentSession(initial, {
+      type: 'event',
+      event: {
+        type: 'batch',
+        sessionId: 'session-a',
+        batch: {
+          cursor: { epoch: 'epoch-a', sequence: 0 },
+          items: [],
+          removedItemIds: [],
+          submissions: []
+        },
+        backgroundTasks: { ...backgroundTasks, supportsTaskStop: true }
+      }
+    })
+
+    expect(updated.backgroundTasks).toEqual({ ...backgroundTasks, supportsTaskStop: true })
+    expect(updated.items).toBe(initial.items)
+  })
+
   it('uses the bounded hydration page pagination boundary', () => {
     const restored = reduceStructuredAgentSession(EMPTY_STRUCTURED_AGENT_SESSION, {
       type: 'event',
@@ -250,4 +283,129 @@ describe('structured agent session reducer', () => {
     expect(state.submissions[0]?.clientMessageId).toBe('client-44')
     expect(state.submissions.at(-1)?.clientMessageId).toBe('client-299')
   })
+
+  it('projects additive background task state without changing transcript identity', () => {
+    const initial = reduceStructuredAgentSession(EMPTY_STRUCTURED_AGENT_SESSION, {
+      type: 'event',
+      event: {
+        type: 'snapshot',
+        sessionId: 'session-a',
+        fence: 1,
+        page: hydrationPage([item('message', 1)]),
+        backgroundTasks: null
+      }
+    })
+    const monitoring = reduceStructuredAgentSession(initial, {
+      type: 'event',
+      event: {
+        type: 'batch',
+        sessionId: 'session-a',
+        batch: {
+          cursor: initial.cursor!,
+          items: [],
+          removedItemIds: [],
+          submissions: []
+        },
+        fence: 1,
+        backgroundTasks: { state: 'monitoring' }
+      }
+    })
+
+    expect(monitoring.backgroundTasks).toEqual({ state: 'monitoring' })
+    expect(monitoring.items).toBe(initial.items)
+  })
+
+  it('returns the same state for duplicate background task publications', () => {
+    const monitoring = reduceStructuredAgentSession(EMPTY_STRUCTURED_AGENT_SESSION, {
+      type: 'event',
+      event: {
+        type: 'snapshot',
+        sessionId: 'session-a',
+        fence: 1,
+        page: hydrationPage([item('message', 1)]),
+        backgroundTasks: { state: 'monitoring' }
+      }
+    })
+    const duplicate = reduceStructuredAgentSession(monitoring, {
+      type: 'event',
+      event: {
+        type: 'batch',
+        sessionId: 'session-a',
+        batch: {
+          cursor: monitoring.cursor!,
+          items: [],
+          removedItemIds: [],
+          submissions: []
+        },
+        fence: 1,
+        backgroundTasks: { state: 'monitoring' }
+      }
+    })
+
+    expect(duplicate).toBe(monitoring)
+  })
+
+  it('applies background task roster changes without a journal update', () => {
+    const monitoring = reduceStructuredAgentSession(EMPTY_STRUCTURED_AGENT_SESSION, {
+      type: 'event',
+      event: {
+        type: 'snapshot',
+        sessionId: 'session-a',
+        fence: 1,
+        page: hydrationPage([item('message', 1)]),
+        backgroundTasks: {
+          state: 'monitoring',
+          tasks: [{ id: 'task-1', kind: 'command', description: 'first command' }]
+        }
+      }
+    })
+    const changed = reduceStructuredAgentSession(monitoring, {
+      type: 'event',
+      event: {
+        type: 'batch',
+        sessionId: 'session-a',
+        batch: {
+          cursor: monitoring.cursor!,
+          items: [],
+          removedItemIds: [],
+          submissions: []
+        },
+        fence: 1,
+        backgroundTasks: {
+          state: 'monitoring',
+          tasks: [{ id: 'task-1', kind: 'agent', description: 'review the change' }]
+        }
+      }
+    })
+
+    expect(changed).not.toBe(monitoring)
+    expect(changed.backgroundTasks?.tasks).toEqual([
+      { id: 'task-1', kind: 'agent', description: 'review the change' }
+    ])
+    expect(changed.items).toBe(monitoring.items)
+  })
+
+  it('clears additive background state when a replacement snapshot omits the field', () => {
+    const monitoring = reduceStructuredAgentSession(EMPTY_STRUCTURED_AGENT_SESSION, {
+      type: 'event',
+      event: {
+        type: 'snapshot',
+        sessionId: 'session-a',
+        fence: 1,
+        page: hydrationPage([item('message', 1)]),
+        backgroundTasks: { state: 'monitoring' }
+      }
+    })
+    const withoutCapability = reduceStructuredAgentSession(monitoring, {
+      type: 'event',
+      event: {
+        type: 'snapshot',
+        sessionId: 'session-a',
+        fence: 2,
+        page: hydrationPage([item('message', 1)])
+      }
+    })
+
+    expect(withoutCapability.backgroundTasks).toBeUndefined()
+  })
 })
diff --git a/src/shared/structured-agent-session-reducer.ts b/src/shared/structured-agent-session-reducer.ts
index 48029b5910e..88d41b2f8e5 100644
--- a/src/shared/structured-agent-session-reducer.ts
+++ b/src/shared/structured-agent-session-reducer.ts
@@ -4,6 +4,7 @@ import type {
   AgentJournalSubmission
 } from './agent-session-journal-types'
 import type {
+  AgentSessionBackgroundTaskState,
   AgentSessionHandoffStatus,
   AgentSessionHistoryPage,
   AgentSessionSubscribeEvent
@@ -19,6 +20,7 @@ export type StructuredAgentSessionState = {
   status: 'idle' | 'loading' | 'ready' | 'error'
   error?: string
   handoff: AgentSessionHandoffStatus | null
+  backgroundTasks?: AgentSessionBackgroundTaskState | null
 }
 
 export type StructuredAgentSessionAction =
@@ -42,10 +44,40 @@ export const EMPTY_STRUCTURED_AGENT_SESSION: StructuredAgentSessionState = {
 
 const MAX_RETAINED_SUBMISSIONS = 256
 
+function backgroundTaskStatesEqual(
+  left: AgentSessionBackgroundTaskState | null | undefined,
+  right: AgentSessionBackgroundTaskState | null | undefined
+): boolean {
+  if (left === right) {
+    return true
+  }
+  if (
+    !left ||
+    !right ||
+    left.state !== right.state ||
+    left.supportsTaskStop !== right.supportsTaskStop
+  ) {
+    return false
+  }
+  if (left.tasks === right.tasks) {
+    return true
+  }
+  if (!left.tasks || !right.tasks || left.tasks.length !== right.tasks.length) {
+    return false
+  }
+  return left.tasks.every(
+    (task, index) =>
+      task.id === right.tasks?.[index]?.id &&
+      task.kind === right.tasks[index]?.kind &&
+      task.description === right.tasks[index]?.description
+  )
+}
+
 function replacePage(
   page: AgentSessionHistoryPage,
   fence: number,
-  handoff?: AgentSessionHandoffStatus
+  handoff?: AgentSessionHandoffStatus,
+  backgroundTasks?: AgentSessionBackgroundTaskState | null
 ): StructuredAgentSessionState {
   return {
     epoch: page.epoch,
@@ -55,7 +87,12 @@ function replacePage(
     submissions: page.submissions,
     hasOlder: page.hasOlder,
     status: 'ready',
-    handoff: handoff ?? null
+    handoff: handoff ?? null,
+    ...(backgroundTasks !== undefined
+      ? { backgroundTasks }
+      : page.backgroundTasks !== undefined
+        ? { backgroundTasks: page.backgroundTasks }
+        : {})
   }
 }
 
@@ -113,12 +150,23 @@ export function reduceStructuredAgentSession(
       state.cursor &&
       (!pageCursor || pageCursor.sequence <= state.cursor.sequence)
     ) {
+      const backgroundTasksChanged =
+        action.page.backgroundTasks !== undefined &&
+        !backgroundTaskStatesEqual(action.page.backgroundTasks, state.backgroundTasks)
       if (
         pageCursor?.sequence === state.cursor.sequence &&
-        action.page.fence !== undefined &&
-        action.page.fence !== state.fence
+        ((action.page.fence !== undefined && action.page.fence !== state.fence) ||
+          backgroundTasksChanged)
       ) {
-        return { ...state, fence: action.page.fence, status: 'ready', error: undefined }
+        return {
+          ...state,
+          ...(action.page.fence !== undefined ? { fence: action.page.fence } : {}),
+          ...(action.page.backgroundTasks !== undefined
+            ? { backgroundTasks: action.page.backgroundTasks }
+            : {}),
+          status: 'ready',
+          error: undefined
+        }
       }
       return state
     }
@@ -133,7 +181,12 @@ export function reduceStructuredAgentSession(
         : action.page.submissions,
       hasOlder: action.page.hasOlder,
       status: 'ready',
-      handoff: state.handoff
+      handoff: state.handoff,
+      ...(action.page.backgroundTasks !== undefined
+        ? { backgroundTasks: action.page.backgroundTasks }
+        : state.backgroundTasks !== undefined
+          ? { backgroundTasks: state.backgroundTasks }
+          : {})
     }
   }
   if (action.type === 'older-page') {
@@ -152,7 +205,7 @@ export function reduceStructuredAgentSession(
     return state
   }
   if (event.type === 'snapshot' || event.type === 'reset') {
-    return replacePage(event.page, event.fence, event.handoff)
+    return replacePage(event.page, event.fence, event.handoff, event.backgroundTasks)
   }
   if (state.epoch !== event.batch.cursor.epoch) {
     return state
@@ -160,15 +213,37 @@ export function reduceStructuredAgentSession(
   if (state.cursor && event.batch.cursor.sequence < state.cursor.sequence) {
     return state
   }
+  const backgroundTasks =
+    event.backgroundTasks !== undefined ? event.backgroundTasks : state.backgroundTasks
+  const journalUnchanged =
+    event.batch.items.length === 0 &&
+    event.batch.removedItemIds.length === 0 &&
+    event.batch.submissions.length === 0
+  if (
+    event.batch.cursor.sequence === state.cursor?.sequence &&
+    journalUnchanged &&
+    (event.fence === undefined || event.fence === state.fence) &&
+    (event.handoff === undefined || event.handoff === state.handoff) &&
+    backgroundTaskStatesEqual(backgroundTasks, state.backgroundTasks) &&
+    state.status === 'ready' &&
+    state.error === undefined
+  ) {
+    return state
+  }
   return {
     ...state,
     cursor: event.batch.cursor,
     fence: event.fence ?? state.fence,
-    items: mergeItems(state.items, event.batch.items, event.batch.removedItemIds),
-    submissions: mergeSubmissions(state.submissions, event.batch.submissions),
+    items: journalUnchanged
+      ? state.items
+      : mergeItems(state.items, event.batch.items, event.batch.removedItemIds),
+    submissions: journalUnchanged
+      ? state.submissions
+      : mergeSubmissions(state.submissions, event.batch.submissions),
     status: 'ready',
     error: undefined,
-    handoff: event.handoff ?? state.handoff
+    handoff: event.handoff ?? state.handoff,
+    ...(backgroundTasks !== undefined ? { backgroundTasks } : {})
   }
 }
 
diff --git a/src/shared/system-cli-install-dirs.ts b/src/shared/system-cli-install-dirs.ts
new file mode 100644
index 00000000000..fe070e761e0
--- /dev/null
+++ b/src/shared/system-cli-install-dirs.ts
@@ -0,0 +1,60 @@
+import { join } from 'node:path'
+
+/**
+ * Where an agent CLI lands when no version manager installed it: Homebrew (both
+ * prefixes), npm's default global prefix, snap, nix, or the CLI's own installer
+ * (#829 named `~/.opencode/bin` and `~/.vite-plus/bin` as the motivating cases,
+ * but only for the login-shell probe; the fallback used when that probe fails
+ * never gained either).
+ *
+ * Ordered to match the system block `patchPackagedProcessPath` appends to PATH,
+ * so a CLI present in two of *these* dirs resolves to the same binary here, in
+ * the packaged PATH scan, and in `POSIX_VERSION_MANAGER_BIN_DIRS`. That parity
+ * stops at the block boundary and is not claimed across it: the seed appends
+ * `~/.local/bin` after this block, while here it arrives ahead of it from
+ * `getBaseVersionManagerDirectories`, so a `claude` installed in both
+ * `~/.local/bin` and `/opt/homebrew/bin` resolves to the former via this
+ * fallback and the latter via the seeded PATH. Pre-existing, and left alone
+ * because closing it means hoisting a system dir over a version-manager one.
+ *
+ * Deliberate gaps vs that seed: the `sbin` dirs, the generic `~/bin`, and
+ * `/opt/homebrew` off darwin -- the seed does push that prefix on every posix,
+ * but Linux Homebrew installs to the Linuxbrew prefix below, so off darwin it
+ * is a directory no brew install can occupy.
+ *
+ * Lookup-only, deliberately outside `getBaseVersionManagerDirectories`: that
+ * list is PREPENDED to PATH by `getVersionManagerBinPaths` callers, and hoisting
+ * a system dir over the inherited PATH re-ranks binaries the user already has
+ * (#18234). One bounded exception: when a hit here ships a sibling `node`,
+ * `withCliRuntimeOnPath` prepends that dir onto the *spawned child's* PATH
+ * (#10932 runtime pairing) -- only for a command PATH did not contain at all.
+ */
+export function getSystemCliInstallDirectories(
+  platform: NodeJS.Platform,
+  homePath: string
+): string[] {
+  // Why nothing here: the PATH seed's system block is POSIX-only too, so
+  // Windows installs outside a version manager (`%USERPROFILE%\.opencode\bin`)
+  // have never had install-dir coverage in either list. Unchanged, not fixed.
+  if (platform === 'win32') {
+    return []
+  }
+  const directories: string[] = []
+  if (platform === 'darwin') {
+    // Apple Silicon Homebrew; Intel Homebrew shares /usr/local with npm's prefix.
+    directories.push('/opt/homebrew/bin')
+  }
+  directories.push('/usr/local/bin')
+  if (platform === 'linux') {
+    // Gated like the seed: snap and Linuxbrew ship on Linux only, so elsewhere they are phantom stats.
+    directories.push('/snap/bin', '/home/linuxbrew/.linuxbrew/bin')
+  }
+  directories.push(
+    '/nix/var/nix/profiles/default/bin',
+    join(homePath, '.nix-profile', 'bin'),
+    // Why both: the opencode and Pi installers' own defaults, which no version manager owns (#829).
+    join(homePath, '.opencode', 'bin'),
+    join(homePath, '.vite-plus', 'bin')
+  )
+  return directories
+}
diff --git a/src/shared/terminal-partial-escape-tail.fuzz.test.ts b/src/shared/terminal-partial-escape-tail.fuzz.test.ts
new file mode 100644
index 00000000000..9f3d0b0e7b9
--- /dev/null
+++ b/src/shared/terminal-partial-escape-tail.fuzz.test.ts
@@ -0,0 +1,154 @@
+import { describe, expect, it } from 'vitest'
+import {
+  advancePartialEscapeTail,
+  extractPartialEscapeTail,
+  MAX_PARTIAL_ESCAPE_TAIL_LENGTH
+} from './terminal-partial-escape-tail'
+
+// Differential fuzz for the ESC-free gate in `advancePartialEscapeTail`: the guarded fold must be
+// byte-for-byte indistinguishable from the unguarded oracle (concat + full walk + cap) on every
+// input, and must preserve the fold property extract(a + b) === extract(extract(a) + b).
+// A 25.6M-case out-of-band sweep (exhaustive len<=5, 2000 x 16 KB random chunks, every BMP code
+// unit) found 0 divergences; this is the CI-sized slice of it.
+
+const oracle = (pending: string, chunk: string): string => {
+  const tail = extractPartialEscapeTail(pending + chunk)
+  return tail.length > MAX_PARTIAL_ESCAPE_TAIL_LENGTH ? '' : tail
+}
+
+// Every byte class the scanner branches on, plus code units the gate's `includes` must not confuse.
+const ALPHABET = [
+  '\x1b',
+  '\x18',
+  '\x1a',
+  '\x07',
+  '\\',
+  '[',
+  ']',
+  'P',
+  'X',
+  '^',
+  '_',
+  '(',
+  '0',
+  ';',
+  'm',
+  '\n',
+  '\x7f',
+  '\x9c',
+  'é',
+  '\u{1f600}',
+  '\ud83d',
+  '\udc00'
+]
+
+// One representative of every state the scanner can be left in.
+const PENDINGS = [
+  '',
+  '\x1b',
+  '\x1b[',
+  '\x1b[3',
+  '\x1b]0;ti',
+  '\x1b]0;ti\x1b',
+  '\x1bP dcs',
+  '\x1bPx\x1b',
+  '\x1b(',
+  '\x1b ',
+  '\x1b[1;2;3'
+]
+
+const SEQUENCES = [
+  '\x1b[1;31m',
+  '\x1b]0;my title\x07',
+  '\x1b]8;;https://example.com\x1b\\',
+  '\x1bPq#0;2;0;0;0#0!6~\x1b\\',
+  '\x1b(B',
+  '\x1b7',
+  '\x1b[?1049h',
+  '\x1b]52;c;aGVsbG8=\x1b\\',
+  'ab\x1b[2Jcd'
+]
+
+// Yields {text, depth} because an astral symbol is two UTF-16 code units: filtering on
+// `text.length` would silently drop every depth-N string containing one, so the corpus would
+// not be exhaustive at depth N the way the test names claim.
+function* stringsUpTo(maxDepth: number): Generator<{ depth: number; text: string }> {
+  yield { depth: 0, text: '' }
+  for (let depth = 1; depth <= maxDepth; depth++) {
+    const digits = Array.from({ length: depth }, () => 0)
+    for (;;) {
+      yield { depth, text: digits.map((digit) => ALPHABET[digit]).join('') }
+      let place = depth - 1
+      while (place >= 0 && ++digits[place] === ALPHABET.length) {
+        digits[place--] = 0
+      }
+      if (place < 0) {
+        break
+      }
+    }
+  }
+}
+
+describe('advancePartialEscapeTail differential fuzz', () => {
+  let checked = 0
+  const check = (pending: string, chunk: string): void => {
+    checked++
+    const actual = advancePartialEscapeTail(pending, chunk)
+    if (actual !== oracle(pending, chunk)) {
+      expect.fail(`gate diverged: ${JSON.stringify({ pending, chunk, actual })}`)
+    }
+    const whole = extractPartialEscapeTail(pending + chunk)
+    if (
+      whole.length <= MAX_PARTIAL_ESCAPE_TAIL_LENGTH &&
+      advancePartialEscapeTail(extractPartialEscapeTail(pending), chunk) !== whole
+    ) {
+      expect.fail(`fold property broke: ${JSON.stringify({ pending, chunk })}`)
+    }
+  }
+
+  it('matches the unguarded oracle on every chunk up to length 4', () => {
+    for (const { text: chunk } of stringsUpTo(3)) {
+      for (const pending of PENDINGS) {
+        check(pending, chunk)
+      }
+    }
+    for (const { depth, text: chunk } of stringsUpTo(4)) {
+      if (depth === 4) {
+        check('', chunk)
+        check('\x1b[', chunk)
+      }
+    }
+  })
+
+  it('matches at every split point of known sequences', () => {
+    for (const sequence of SEQUENCES) {
+      for (let cut = 0; cut <= sequence.length; cut++) {
+        const afterPrefix = advancePartialEscapeTail('', sequence.slice(0, cut))
+        check('', sequence.slice(0, cut))
+        for (let cut2 = cut; cut2 <= sequence.length; cut2++) {
+          check(afterPrefix, sequence.slice(cut, cut2))
+          check(
+            advancePartialEscapeTail(afterPrefix, sequence.slice(cut, cut2)),
+            sequence.slice(cut2)
+          )
+        }
+      }
+    }
+  })
+
+  it('matches across the tail-length cap', () => {
+    const max = MAX_PARTIAL_ESCAPE_TAIL_LENGTH
+    for (const length of [max - 1, max, max + 1, max + 100]) {
+      const osc = `\x1b]0;${'x'.repeat(length - 4)}`
+      for (const chunk of ['', 'y', '\x07', '\x1b\\', '\x1b', 'plain\n', 'x'.repeat(5000)]) {
+        check(osc, chunk)
+        check('', osc + chunk)
+        check('\x1b]0;', osc.slice(4) + chunk)
+      }
+    }
+  })
+
+  it('ran the whole corpus', () => {
+    expect(checked).toBe(593_468)
+  })
+})
diff --git a/src/shared/terminal-partial-escape-tail.test.ts b/src/shared/terminal-partial-escape-tail.test.ts
index e0ef2095ddd..3185abc4cfc 100644
--- a/src/shared/terminal-partial-escape-tail.test.ts
+++ b/src/shared/terminal-partial-escape-tail.test.ts
@@ -84,3 +84,43 @@ describe('advancePartialEscapeTail', () => {
     expect(advancePartialEscapeTail('', huge)).toBe('')
   })
 })
+
+describe('advancePartialEscapeTail ESC-free fast path', () => {
+  // Every pending-tail state the scanner can be left in x every chunk shape, asserted
+  // indistinguishable from the unconditional fold the gate sits in front of.
+  const pieces = [
+    '',
+    'plain output\n',
+    '\x1b[32mgreen\x1b[0m',
+    '\x1b[3',
+    '\x1b]0;title\x07',
+    '\x1b]0;partial',
+    '\x1bP dcs payload',
+    '\x1b',
+    '\x18',
+    '\x1a',
+    '\x1b]8;;https://example.com\x1b\\',
+    '\x1b(',
+    '\x1b[1;2;3'
+  ]
+
+  it('matches an unconditional fold for every pending-tail and chunk pairing', () => {
+    for (const pending of pieces.map((piece) => extractPartialEscapeTail(piece))) {
+      for (const chunk of pieces) {
+        // The cap belongs in the expectation: `advancePartialEscapeTail` abandons a tail over
+        // MAX_PARTIAL_ESCAPE_TAIL_LENGTH, so comparing it against an uncapped extract would stop
+        // modelling the function the moment a pairing crossed the cap.
+        const unguarded = extractPartialEscapeTail(pending + chunk)
+        expect(advancePartialEscapeTail(pending, chunk), JSON.stringify({ pending, chunk })).toBe(
+          unguarded.length > MAX_PARTIAL_ESCAPE_TAIL_LENGTH ? '' : unguarded
+        )
+      }
+    }
+  })
+
+  it('still carries a pending tail through an ESC-free chunk', () => {
+    expect(advancePartialEscapeTail('\x1b]0;my-title', ' still in the OSC')).toBe(
+      '\x1b]0;my-title still in the OSC'
+    )
+  })
+})
diff --git a/src/shared/terminal-partial-escape-tail.ts b/src/shared/terminal-partial-escape-tail.ts
index 1ee606e60f6..b1aa44ec072 100644
--- a/src/shared/terminal-partial-escape-tail.ts
+++ b/src/shared/terminal-partial-escape-tail.ts
@@ -144,6 +144,14 @@ export function extractPartialEscapeTail(stream: string): string {
 /** Ingest-time fold: advance the tracked tail with one more chunk. Returns ''
  *  (tracking abandoned) when the tail exceeds the cap — see the cap comment. */
 export function advancePartialEscapeTail(pendingTail: string, chunk: string): string {
+  // Why the pre-filter: `extractPartialEscapeTail` only leaves `ground` on an ESC byte, so with
+  // no pending tail and no ESC in the chunk the answer is always ''. Taking it here skips both
+  // the full-chunk concat and the per-code-unit walk on ESC-free output (build logs, `cat`,
+  // piped tool output) — the same gate `TerminalOscCwdTitleScanner.scan` and
+  // `TerminalMouseModeMirror.scan` already apply on the very same ingest path.
+  if (pendingTail.length === 0 && !chunk.includes('\x1b')) {
+    return ''
+  }
   const tail = extractPartialEscapeTail(pendingTail + chunk)
   return tail.length > MAX_PARTIAL_ESCAPE_TAIL_LENGTH ? '' : tail
 }
diff --git a/src/shared/terminal-process-inspection.ts b/src/shared/terminal-process-inspection.ts
index 6448cd9580e..c589bb65cdd 100644
--- a/src/shared/terminal-process-inspection.ts
+++ b/src/shared/terminal-process-inspection.ts
@@ -1,5 +1,15 @@
 import type { RemoteForegroundEvidence } from './foreground-process-evidence'
 
+/**
+ * What the execution host observed about processes running under a PTY's shell.
+ *
+ * Separate from `hasChildProcesses` because a boolean cannot hold the third answer. The host that
+ * could not read its own process table and the host that read it and found nothing both had to
+ * spell themselves `false`, and every close guard reads `false` as "nothing is running here".
+ * Windows relays spelled it `false` unconditionally.
+ */
+export type PtyChildProcessVerdict = 'children' | 'no-children' | 'unverifiable'
+
 /** Reasons the renderer could not observe the execution host. */
 export type ClientOnlyUnverifiableReason =
   | 'transport_loss'
@@ -17,6 +27,7 @@ export type ClientOnlyUnverifiableInspection = {
   verdict: 'unverifiable'
   reason: string
   foregroundProcessEvidence?: never
+  childProcessEvidence?: never
   authorityGeneration?: never
   observationEpoch?: never
   capturedAgeMs?: never
@@ -30,6 +41,8 @@ export type HostProcessInspection = {
   hasChildProcesses: boolean
   /** Optional on old hosts; the renderer treats an omitted field as old-host unverifiable. */
   foregroundProcessEvidence?: RemoteForegroundEvidence
+  /** Absent on hosts that predate the member, and on answers the host did not pay to observe. */
+  childProcessEvidence?: PtyChildProcessVerdict
   verdict?: never
   reason?: never
 }
diff --git a/src/shared/utf8-byte-limits.test.ts b/src/shared/utf8-byte-limits.test.ts
index 9556a5c39bc..f5cd2c83ed8 100644
--- a/src/shared/utf8-byte-limits.test.ts
+++ b/src/shared/utf8-byte-limits.test.ts
@@ -1,6 +1,7 @@
 import { describe, expect, it } from 'vitest'
 import {
   clampUtf8TextPrefix,
+  getUtf8ByteLength,
   getUtf8ChunkEndIndex,
   isUtf8ByteLengthWithinLimit,
   measureUtf8ByteLength,
@@ -129,3 +130,33 @@ describe('isUtf8ByteLengthWithinLimit', () => {
     expect(isUtf8ByteLengthWithinLimit(text, maxBytes)).toBe(expected)
   })
 })
+
+describe('isUtf8ByteLengthWithinLimit native fast path', () => {
+  // The bounded check runs through TextEncoder.encodeInto; it must agree with the scan it replaced
+  // for every boundary shape, lone surrogates included.
+  const samples = [
+    '',
+    'a',
+    'ascii only text',
+    'caf\u00e9',
+    '\u20ac\u20ac\u20ac',
+    '\ud83d\ude00\ud83d\ude00',
+    '\ud83d',
+    '\ude00',
+    'mixed \u00e9 \u20ac \ud83d\ude00 tail',
+    'x'.repeat(64)
+  ]
+
+  it('matches the scanning implementation at every limit around the boundary', () => {
+    for (const text of samples) {
+      const exactBytes = getUtf8ByteLength(text)
+      for (let maxBytes = 1; maxBytes <= exactBytes + 2; maxBytes += 1) {
+        expect({ text, maxBytes, within: isUtf8ByteLengthWithinLimit(text, maxBytes) }).toEqual({
+          text,
+          maxBytes,
+          within: text.length <= maxBytes && exactBytes <= maxBytes
+        })
+      }
+    }
+  })
+})
diff --git a/src/shared/utf8-byte-limits.ts b/src/shared/utf8-byte-limits.ts
index df8f99f68ad..767d5bfb877 100644
--- a/src/shared/utf8-byte-limits.ts
+++ b/src/shared/utf8-byte-limits.ts
@@ -51,6 +51,14 @@ export function getUtf8ByteLength(text: string): number {
   return measureUtf8ByteLength(text).byteLength
 }
 
+// Why a native encode: the per-code-unit JS scan walks whole terminal scrollback buffers on the
+// session-write path. `encodeInto` answers "does this fit in maxBytes?" in C++ — it stops at the
+// destination's end, so `read < text.length` means the text needs more than maxBytes. The scratch
+// buffer is reused across calls and grows to the largest limit asked for, up to this cap.
+const MAX_UTF8_SCRATCH_BYTES = 1024 * 1024
+const utf8Encoder = new TextEncoder()
+let utf8Scratch = new Uint8Array(0)
+
 export function isUtf8ByteLengthWithinLimit(text: string, maxBytes: number): boolean {
   if (text.length === 0) {
     return true
@@ -58,6 +66,12 @@ export function isUtf8ByteLengthWithinLimit(text: string, maxBytes: number): boo
   if (text.length > maxBytes) {
     return false
   }
+  if (Number.isSafeInteger(maxBytes) && maxBytes <= MAX_UTF8_SCRATCH_BYTES) {
+    if (utf8Scratch.length < maxBytes) {
+      utf8Scratch = new Uint8Array(maxBytes)
+    }
+    return utf8Encoder.encodeInto(text, utf8Scratch.subarray(0, maxBytes)).read === text.length
+  }
   return !measureUtf8ByteLength(text, { stopAfterBytes: maxBytes }).exceededLimit
 }
 
diff --git a/src/shared/windows-cmd-runner-delayed-launch.test.ts b/src/shared/windows-cmd-runner-delayed-launch.test.ts
new file mode 100644
index 00000000000..21c5cc8befe
--- /dev/null
+++ b/src/shared/windows-cmd-runner-delayed-launch.test.ts
@@ -0,0 +1,36 @@
+import { describe, expect, it } from 'vitest'
+import { buildWindowsCmdRunnerDelayedLaunchCommand } from './windows-cmd-runner-delayed-launch'
+
+function decodePayload(command: string): string {
+  const encoded = command.match(/ -EncodedCommand (\S+)$/)?.[1]
+  if (!encoded) {
+    throw new Error(`no -EncodedCommand payload in: ${command}`)
+  }
+  return Buffer.from(encoded, 'base64').toString('utf16le')
+}
+
+describe('buildWindowsCmdRunnerDelayedLaunchCommand', () => {
+  it('spells no -ExecutionPolicy switch', () => {
+    const command = buildWindowsCmdRunnerDelayedLaunchCommand('C:\\work\\setup.cmd')
+    const switches = command.replace(/ -EncodedCommand \S+$/, '')
+
+    // Why: `-EncodedCommand` is not execution-policy gated — only `-File` is — so the switch
+    // was a no-op next to a heavily EDR-flagged base64 command line.
+    expect(switches).not.toMatch(/-ExecutionPolicy/i)
+    expect(switches).not.toMatch(/Bypass/i)
+    expect(switches).toBe('powershell.exe -NoProfile -NonInteractive')
+  })
+
+  it('keeps the base64 that shields the runner path from the pane shell', () => {
+    // Why: this whole module exists because the path carries cmd metacharacters; the
+    // command is typed into a terminal pane, so the base64 must stay.
+    const command = buildWindowsCmdRunnerDelayedLaunchCommand('C:\\work (x86)\\se&tup.cmd')
+
+    expect(command).toMatch(
+      /^powershell\.exe -NoProfile -NonInteractive -EncodedCommand [A-Za-z0-9+/=]+$/
+    )
+    const script = decodePayload(command)
+    expect(script).toContain("$runner = 'C:\\work (x86)\\se&tup.cmd'")
+    expect(script).toContain('/d /s /v:on /c ""!ORCA_SETUP_RUNNER!""')
+  })
+})
diff --git a/src/shared/windows-cmd-runner-delayed-launch.ts b/src/shared/windows-cmd-runner-delayed-launch.ts
index 50ed131dc99..cdc0af3a48a 100644
--- a/src/shared/windows-cmd-runner-delayed-launch.ts
+++ b/src/shared/windows-cmd-runner-delayed-launch.ts
@@ -34,7 +34,10 @@ export function buildWindowsCmdRunnerDelayedLaunchCommand(runnerScriptPath: stri
     'exit $process.ExitCode'
   ].join('; ')
 
-  return `powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand ${encodePowerShellCommand(script)}`
+  // Why: `-EncodedCommand` is not execution-policy gated (only `-File` is), so `-ExecutionPolicy
+  // Bypass` was a no-op — and it is one of the most heavily EDR-flagged PowerShell tokens. The
+  // base64 stays: this string is typed into a shell, which is the whole point of the guard above.
+  return `powershell.exe -NoProfile -NonInteractive -EncodedCommand ${encodePowerShellCommand(script)}`
 }
 
 function quotePowerShellString(value: string): string {
diff --git a/src/shared/windows-interactive-login-spawn.test.ts b/src/shared/windows-interactive-login-spawn.test.ts
index 07cde964095..ef99f8edabe 100644
--- a/src/shared/windows-interactive-login-spawn.test.ts
+++ b/src/shared/windows-interactive-login-spawn.test.ts
@@ -17,8 +17,14 @@ function encodedValue(value: string): string {
   return `Read-OrcaValue '${Buffer.from(value).toString('base64')}'`
 }
 
+/** Positional-independent so the argv shape can change without silently reading the wrong slot. */
+function decodedScript(args: string[]): string {
+  const payload = args[args.indexOf('-EncodedCommand') + 1] ?? ''
+  return Buffer.from(payload, 'base64').toString('utf16le')
+}
+
 function pidFilePathFromSpawnArgs(args: string[]): string {
-  const script = Buffer.from(args[11] ?? '', 'base64').toString('utf16le')
+  const script = decodedScript(args)
   const encodedPath = script.match(
     /WriteAllText\(\(Read-OrcaValue '([^']+)'\), \[string\]\$PID\)/
   )?.[1]
@@ -40,15 +46,15 @@ describe('buildWindowsHostInteractiveLoginSpawn', () => {
     expect(spawn.command).toBe(getCmdExePath())
     expect(spawn.args.slice(0, 5)).toEqual(['/d', '/c', 'start', '', '/wait'])
     expect(spawn.args[5]).toMatch(/WindowsPowerShell\\v1\.0\\powershell\.exe$/i)
-    expect(spawn.args.slice(6, 11)).toEqual([
-      '-NoLogo',
-      '-NoProfile',
-      '-ExecutionPolicy',
-      'Bypass',
-      '-EncodedCommand'
-    ])
+    // Why: `-ExecutionPolicy Bypass` is a no-op next to `-EncodedCommand` (only `-File` is
+    // policy gated) and is a heavily EDR-flagged token, so it must not come back. The base64
+    // must stay — `start` re-parses this through cmd.exe, whose safe-token guard rejects the
+    // `&` and `"` in the raw relay script.
+    expect(spawn.args.slice(6, 9)).toEqual(['-NoLogo', '-NoProfile', '-EncodedCommand'])
+    expect(spawn.args).not.toContain('-ExecutionPolicy')
+    expect(spawn.args).not.toContain('Bypass')
 
-    const script = Buffer.from(spawn.args[11] ?? '', 'base64').toString('utf16le')
+    const script = decodedScript(spawn.args)
     expect(script).toContain('[string]$PID')
     expect(script).toContain(encodedValue(getCmdExePath()))
     expect(script).toContain(encodedValue('C:\\Tools\\claude.cmd'))
@@ -68,7 +74,7 @@ describe('buildWindowsHostInteractiveLoginSpawn', () => {
     const spawn = withWindows(() =>
       buildWindowsHostInteractiveLoginSpawn('C:\\Tools\\codex.exe', ['login'])
     )
-    const script = Buffer.from(spawn.args[11] ?? '', 'base64').toString('utf16le')
+    const script = decodedScript(spawn.args)
     expect(script).toContain(encodedValue('C:\\Tools\\codex.exe'))
     expect(script).toContain(encodedValue('login'))
     spawn.cleanup()
diff --git a/src/shared/windows-interactive-login-spawn.ts b/src/shared/windows-interactive-login-spawn.ts
index 1068607e38f..a38ba1ae7a8 100644
--- a/src/shared/windows-interactive-login-spawn.ts
+++ b/src/shared/windows-interactive-login-spawn.ts
@@ -78,11 +78,13 @@ export function buildWindowsHostInteractiveLoginSpawn(
     'powershell.exe'
   )
   const script = buildPidRelayScript(spawnCmd, spawnArgs, pidFilePath)
+  // Why: `-EncodedCommand` is not execution-policy gated (only `-File` is), so `-ExecutionPolicy
+  // Bypass` was a no-op — and it is one of the most heavily EDR-flagged PowerShell tokens. The
+  // base64 stays: `wrapWindowsStartWait` sends this through `cmd.exe /c start`, whose
+  // `assertWindowsCmdSafeTokens` guard rejects the `&` and `"` the raw relay script contains.
   const wrapped = wrapWindowsStartWait(powershell, [
     '-NoLogo',
     '-NoProfile',
-    '-ExecutionPolicy',
-    'Bypass',
     '-EncodedCommand',
     Buffer.from(script, 'utf16le').toString('base64')
   ])
diff --git a/src/shared/windows-security-descriptor.test.ts b/src/shared/windows-security-descriptor.test.ts
new file mode 100644
index 00000000000..a846210f92e
--- /dev/null
+++ b/src/shared/windows-security-descriptor.test.ts
@@ -0,0 +1,121 @@
+import { describe, expect, it } from 'vitest'
+import { localDomainSidOf, parseSddlDacl, resolveSddlSid } from './windows-security-descriptor'
+
+const MACHINE_SID = 'S-1-5-21-432636774-4279371817-3971399515'
+const USER_SID = `${MACHINE_SID}-1001`
+/** The built-in Administrator: the account a CI runner and an Administrator-only box log in as. */
+const LOCAL_ADMIN_SID = `${MACHINE_SID}-500`
+
+describe('parseSddlDacl', () => {
+  it('reads a hardened file descriptor as icacls /save emits it', () => {
+    const dacl = parseSddlDacl(`D:PAI(A;;FA;;;BA)(A;;FA;;;SY)(A;;FA;;;${USER_SID})`)
+
+    expect(dacl?.isProtected).toBe(true)
+    expect(dacl?.aces).toEqual([
+      { type: 'A', flags: [], rights: 'FA', sid: 'S-1-5-32-544' },
+      { type: 'A', flags: [], rights: 'FA', sid: 'S-1-5-18' },
+      { type: 'A', flags: [], rights: 'FA', sid: USER_SID }
+    ])
+  })
+
+  it('reads the inheritable flags a hardened directory carries', () => {
+    const dacl = parseSddlDacl('D:PAI(A;OICI;FA;;;SY)')
+
+    expect(dacl?.aces[0]!.flags).toEqual(['OI', 'CI'])
+  })
+
+  it('reports an unprotected descriptor and its inherited rules', () => {
+    const dacl = parseSddlDacl(`D:(A;ID;FA;;;SY)(A;ID;FA;;;${USER_SID})`)
+
+    expect(dacl?.isProtected).toBe(false)
+    expect(dacl?.aces.map((ace) => ace.flags)).toEqual([['ID'], ['ID']])
+  })
+
+  // `OICIID` is three tokens, not a string to search: a substring test for 'ID' would also fire on
+  // flag runs that merely happen to contain those letters in sequence.
+  it('splits a flag run into two-letter tokens', () => {
+    expect(parseSddlDacl('D:P(A;OICIID;FA;;;SY)')?.aces[0]!.flags).toEqual(['OI', 'CI', 'ID'])
+    expect(parseSddlDacl('D:P(A;OICI;FA;;;SY)')?.aces[0]!.flags).not.toContain('ID')
+  })
+
+  it('stops at a trailing SACL rather than absorbing its entries', () => {
+    const dacl = parseSddlDacl('D:P(A;;FA;;;SY)S:AI(AU;SAFA;FA;;;WD)')
+
+    expect(dacl?.aces).toHaveLength(1)
+    expect(dacl?.aces[0]!.sid).toBe('S-1-5-18')
+  })
+
+  it('finds the DACL after an owner and group whose aliases end in D', () => {
+    const dacl = parseSddlDacl('O:WDG:WDD:P(A;;FA;;;SY)')
+
+    expect(dacl?.isProtected).toBe(true)
+    expect(dacl?.aces[0]!.sid).toBe('S-1-5-18')
+  })
+
+  it('returns null when there is no DACL', () => {
+    expect(parseSddlDacl('O:BAG:BA')).toBeNull()
+  })
+
+  it('returns null for a truncated ACE rather than guessing its fields', () => {
+    expect(parseSddlDacl('D:P(A;;FA)')).toBeNull()
+  })
+
+  /**
+   * The DACL a box whose user *is* the built-in Administrator reads back: icacls writes `LA`
+   * where it wrote the raw SID for any other account, so identity checking has to resolve it or
+   * the path it just hardened verifies as wrong and hardening reports failure forever.
+   */
+  it('resolves the built-in Administrator alias against the machine SID', () => {
+    const dacl = parseSddlDacl(`D:PAI(A;;FA;;;BA)(A;;FA;;;SY)(A;;FA;;;LA)`, MACHINE_SID)
+
+    expect(dacl?.aces.map((ace) => ace.sid)).toEqual(['S-1-5-32-544', 'S-1-5-18', LOCAL_ADMIN_SID])
+  })
+
+  it('leaves the alias unresolved when no machine SID is known, so it matches nothing', () => {
+    const dacl = parseSddlDacl('D:PAI(A;;FA;;;LA)')
+
+    expect(dacl?.aces[0]!.sid).toBe('LA')
+  })
+})
+
+describe('resolveSddlSid', () => {
+  it('resolves the aliases icacls substitutes for well-known SIDs', () => {
+    expect(resolveSddlSid('WD')).toBe('S-1-1-0')
+    expect(resolveSddlSid('BA')).toBe('S-1-5-32-544')
+    expect(resolveSddlSid('SY')).toBe('S-1-5-18')
+    expect(resolveSddlSid('AU')).toBe('S-1-5-11')
+  })
+
+  it('passes a raw SID through unchanged', () => {
+    expect(resolveSddlSid(USER_SID)).toBe(USER_SID)
+  })
+
+  // An unknown alias must not silently compare equal to anything expected.
+  it('passes an unrecognized alias through instead of dropping it', () => {
+    expect(resolveSddlSid('ZZ')).toBe('ZZ')
+  })
+
+  // No fixed table can hold these: the SID they name is built from the machine's own.
+  it('builds the machine-relative aliases from the supplied machine SID', () => {
+    expect(resolveSddlSid('LA', MACHINE_SID)).toBe(LOCAL_ADMIN_SID)
+    expect(resolveSddlSid('LG', MACHINE_SID)).toBe(`${MACHINE_SID}-501`)
+  })
+
+  it('keeps a machine-relative alias unresolved without a machine SID', () => {
+    expect(resolveSddlSid('LA')).toBe('LA')
+  })
+})
+
+describe('localDomainSidOf', () => {
+  it('strips the RID off a domain-relative account SID', () => {
+    expect(localDomainSidOf(USER_SID)).toBe(MACHINE_SID)
+    expect(localDomainSidOf(LOCAL_ADMIN_SID)).toBe(MACHINE_SID)
+  })
+
+  // SYSTEM and the built-in groups carry no machine authority to resolve `LA` against.
+  it('returns null for SIDs that are not domain-relative', () => {
+    expect(localDomainSidOf('S-1-5-18')).toBeNull()
+    expect(localDomainSidOf('S-1-5-32-544')).toBeNull()
+    expect(localDomainSidOf('S-1-1-0')).toBeNull()
+  })
+})
diff --git a/src/shared/windows-security-descriptor.ts b/src/shared/windows-security-descriptor.ts
new file mode 100644
index 00000000000..7491af13df1
--- /dev/null
+++ b/src/shared/windows-security-descriptor.ts
@@ -0,0 +1,108 @@
+/**
+ * Parses the DACL out of an SDDL string, as produced by `icacls <path> /save`.
+ *
+ * Why SDDL rather than the human-readable `icacls <path>` listing: the listing prints resolved
+ * account *names*, which are localized and cannot be compared against a SID. Checking only the
+ * shape of that listing — rule count, inheritance marker, rights — accepts a DACL that grants
+ * full control to the wrong principal entirely. SDDL carries raw SIDs, so identity is checkable.
+ */
+
+/**
+ * Aliases naming an account by RID within the machine's *own* SID, so no constant can hold them:
+ * the built-in Administrator is `S-1-5-21-<machine>-500`, and icacls prints `LA` for it. A box
+ * whose interactive user is that account (a CI runner, an Administrator-only install) therefore
+ * reads back an ACE no fixed table can match.
+ */
+const LOCAL_DOMAIN_RELATIVE_RIDS: Record<string, number> = {
+  LA: 500,
+  LG: 501
+}
+
+/** `S-1-5-21-x-y-z-<rid>` split into the machine/domain authority and its RID. */
+const DOMAIN_RELATIVE_SID_PATTERN = /^(S-1-5-21(?:-\d+){3})-\d+$/
+
+/**
+ * The machine/domain authority an account SID belongs to, or null when the SID is not
+ * domain-relative (`S-1-5-18` and the `S-1-5-32-*` built-ins never are).
+ */
+export function localDomainSidOf(accountSid: string): string | null {
+  return DOMAIN_RELATIVE_SID_PATTERN.exec(accountSid.toUpperCase())?.[1] ?? null
+}
+
+/** The two-letter aliases SDDL substitutes for well-known SIDs. */
+const SDDL_SID_ALIASES: Record<string, string> = {
+  AN: 'S-1-5-7',
+  AU: 'S-1-5-11',
+  BA: 'S-1-5-32-544',
+  BG: 'S-1-5-32-546',
+  BU: 'S-1-5-32-545',
+  IU: 'S-1-5-4',
+  LS: 'S-1-5-19',
+  NS: 'S-1-5-20',
+  NU: 'S-1-5-2',
+  SY: 'S-1-5-18',
+  WD: 'S-1-1-0'
+}
+
+export type WindowsAce = {
+  /** `A` for allow, `D` for deny, plus the audit types. */
+  type: string
+  /** Two-letter inheritance/audit tokens, e.g. `['OI', 'CI']` or `['ID']`. */
+  flags: string[]
+  rights: string
+  /**
+   * Always a raw SID: aliases are resolved, unknown tokens are passed through upper-cased.
+   * Machine-relative aliases resolve only when `localDomainSid` is supplied, so an unresolved
+   * `LA` compares unequal to every real SID and the caller fails closed.
+   */
+  sid: string
+}
+
+export type WindowsDacl = {
+  /** True when the DACL carries the `P` flag, i.e. inheritance from the parent is blocked. */
+  isProtected: boolean
+  aces: WindowsAce[]
+}
+
+export function parseSddlDacl(sddl: string, localDomainSid?: string): WindowsDacl | null {
+  // ACE bodies never contain parentheses, so the group stops cleanly at a following `S:` SACL.
+  const dacl = /D:([A-Z]*)((?:\([^()]*\))*)/.exec(sddl)
+  if (!dacl) {
+    return null
+  }
+  const aces: WindowsAce[] = []
+  for (const group of dacl[2]!.matchAll(/\(([^()]*)\)/g)) {
+    const fields = group[1]!.split(';')
+    if (fields.length < 6) {
+      return null
+    }
+    aces.push({
+      type: fields[0]!.toUpperCase(),
+      flags: splitAceFlags(fields[1]!),
+      rights: fields[2]!.toUpperCase(),
+      sid: resolveSddlSid(fields[5]!, localDomainSid)
+    })
+  }
+  return { isProtected: dacl[1]!.includes('P'), aces }
+}
+
+/**
+ * ACE flags are a run of two-letter tokens (`OICIID`), not a free-form string. Splitting them
+ * keeps a substring search from reading `ID` out of an adjacent pair.
+ */
+function splitAceFlags(flags: string): string[] {
+  const tokens: string[] = []
+  for (let index = 0; index + 1 < flags.length; index += 2) {
+    tokens.push(flags.slice(index, index + 2).toUpperCase())
+  }
+  return tokens
+}
+
+export function resolveSddlSid(token: string, localDomainSid?: string): string {
+  const upper = token.toUpperCase()
+  const rid = LOCAL_DOMAIN_RELATIVE_RIDS[upper]
+  if (rid !== undefined) {
+    return localDomainSid ? `${localDomainSid}-${rid}` : upper
+  }
+  return SDDL_SID_ALIASES[upper] ?? upper
+}
diff --git a/src/shared/workspace-session-terminal-buffers.ts b/src/shared/workspace-session-terminal-buffers.ts
index 96bb76cafe2..ef8ac6a273b 100644
--- a/src/shared/workspace-session-terminal-buffers.ts
+++ b/src/shared/workspace-session-terminal-buffers.ts
@@ -3,7 +3,7 @@ import type { WorkspaceSessionState } from './workspace-session-state-types'
 import { FLOATING_TERMINAL_WORKTREE_ID } from './constants'
 import { getRepoIdFromWorktreeId } from './worktree/id'
 import { TERMINAL_SCROLLBACK_SESSION_BUFFER_BYTE_LIMIT } from './terminal-scrollback-limits'
-import { clampUtf8TextTail, measureUtf8ByteLength } from './utf8-byte-limits'
+import { clampUtf8TextTail, isUtf8ByteLengthWithinLimit } from './utf8-byte-limits'
 import { parseExecutionHostId } from './execution-host'
 
 export type RepoConnection = Pick<Repo, 'id' | 'connectionId' | 'executionHostId'>
@@ -50,12 +50,7 @@ export function shouldPreserveTerminalScrollbackBuffers(
 }
 
 export function capTerminalScrollbackSessionBuffer(buffer: string): string {
-  if (
-    buffer.length <= TERMINAL_SCROLLBACK_SESSION_BUFFER_BYTE_LIMIT &&
-    !measureUtf8ByteLength(buffer, {
-      stopAfterBytes: TERMINAL_SCROLLBACK_SESSION_BUFFER_BYTE_LIMIT
-    }).exceededLimit
-  ) {
+  if (isUtf8ByteLengthWithinLimit(buffer, TERMINAL_SCROLLBACK_SESSION_BUFFER_BYTE_LIMIT)) {
     return buffer
   }
   return clampUtf8TextTail(buffer, TERMINAL_SCROLLBACK_SESSION_BUFFER_BYTE_LIMIT).text
diff --git a/src/shared/worktree-execution-host-resolution.test.ts b/src/shared/worktree-execution-host-resolution.test.ts
index b82cea476eb..b31281fe925 100644
--- a/src/shared/worktree-execution-host-resolution.test.ts
+++ b/src/shared/worktree-execution-host-resolution.test.ts
@@ -156,6 +156,40 @@ describe('resolveWorktreeExecutionHost', () => {
     it('reports an unknown owner distinctly from a conflicting one', () => {
       expect(resolve([], { repoId: 'r' })).toEqual({ kind: 'unresolved', reason: 'unknown' })
     })
+
+    // `unknown` is a verdict the launch path disposes of as a plain local folder, so a row that
+    // declared a host and named an unparseable one must not share the word — it has to fail closed.
+    it('reports a row naming an unparseable host distinctly from an unknown one', () => {
+      for (const executionHostId of ['ssh:', 'ssh:a|b', 'ssh:%zz', 'runtime:', 'quantum:box']) {
+        expect(resolve([{ id: 'r', executionHostId }], { repoId: 'r' })).toEqual({
+          kind: 'unresolved',
+          reason: 'malformed'
+        })
+      }
+    })
+
+    it('does not recover a host from the connectionId such a row overrode', () => {
+      expect(
+        resolve([{ id: 'r', executionHostId: 'ssh:a|b', connectionId: 'openclaw' }], {
+          repoId: 'r'
+        })
+      ).toEqual({ kind: 'unresolved', reason: 'malformed' })
+    })
+
+    it('still resolves every row that names a parseable host', () => {
+      expect(resolve([{ id: 'r', executionHostId: 'ssh:box' }], { repoId: 'r' })).toMatchObject({
+        kind: 'resolved',
+        hostId: 'ssh:box'
+      })
+      expect(resolve([{ id: 'r', connectionId: 'box' }], { repoId: 'r' })).toMatchObject({
+        kind: 'resolved',
+        hostId: 'ssh:box'
+      })
+      expect(resolve([{ id: 'r' }], { repoId: 'r' })).toMatchObject({
+        kind: 'resolved',
+        hostId: 'local'
+      })
+    })
   })
 
   it('ignores an unparseable host id rather than treating it as a host', () => {
diff --git a/src/shared/worktree-execution-host-resolution.ts b/src/shared/worktree-execution-host-resolution.ts
index 00b66b7f11c..0172106aee0 100644
--- a/src/shared/worktree-execution-host-resolution.ts
+++ b/src/shared/worktree-execution-host-resolution.ts
@@ -54,7 +54,29 @@ export type WorktreeExecutionHostResolution<T extends ExecutionHostOwnerRow> =
       /** Display metadata only. The decisions are `hostId` / `connectionId`. */
       owner: T | null
     }
-  | { kind: 'unresolved'; reason: 'ambiguous' | 'unknown' }
+  /**
+   * Three reasons, not two, and deliberately not collapsed. `unknown` (nothing carries the id) is a
+   * verdict the launch path may legitimately dispose of as a plain local folder; `malformed` (the
+   * row named a host that cannot be parsed) must fail closed. A vocabulary that cannot express the
+   * difference guarantees it is lost at the first caller that switches on it — the same shape as
+   * #18006, where one word had to stand for two liveness situations.
+   */
+  | { kind: 'unresolved'; reason: 'ambiguous' | 'unknown' | 'malformed' }
+
+/**
+ * The owner row's host, or `null` when the row names one that cannot be parsed.
+ *
+ * Module-private and deliberately not a second exported reading of a repo row: only this resolution
+ * needs the distinction, because only this resolution is routing. `getRepoExecutionHostId` stays the
+ * answer everywhere else — its fall-through to `local` is harmless for the grouping, label and index
+ * callers that make up nearly all of its ~340 call sites, and is wrong only when the value decides
+ * where work runs.
+ */
+function resolveOwnerRowHostId(row: ExecutionHostOwnerRow): ExecutionHostId | null {
+  return row.executionHostId?.trim()
+    ? normalizeExecutionHostId(row.executionHostId)
+    : getRepoExecutionHostId(row)
+}
 
 export function resolveWorktreeExecutionHost<T extends ExecutionHostOwnerRow>(
   lookup: ExecutionHostOwnerLookup<T>,
@@ -80,9 +102,13 @@ export function resolveWorktreeExecutionHost<T extends ExecutionHostOwnerRow>(
   if (match.kind !== 'resolved') {
     return { kind: 'unresolved', reason: match.kind === 'ambiguous' ? 'ambiguous' : 'unknown' }
   }
+  const hostId = resolveOwnerRowHostId(match.owner)
+  if (!hostId) {
+    return { kind: 'unresolved', reason: 'malformed' }
+  }
   return {
     kind: 'resolved',
-    hostId: getRepoExecutionHostId(match.owner),
+    hostId,
     connectionId: getRepoSshConnectionId(match.owner),
     owner: match.owner
   }
@@ -115,12 +141,14 @@ export function createRepoRowExecutionHostLookup<T extends ExecutionHostOwnerRow
       if (!owner) {
         return { kind: 'missing' }
       }
-      const ownerHostId = getRepoExecutionHostId(owner)
-      return rows.some((repo) => getRepoExecutionHostId(repo) !== ownerHostId)
+      const ownerHostId = resolveOwnerRowHostId(owner)
+      return rows.some((repo) => resolveOwnerRowHostId(repo) !== ownerHostId)
         ? { kind: 'ambiguous' }
         : { kind: 'resolved', owner }
     },
+    // A row naming an unparseable host matches no host, which is what stops a worktree on a real
+    // host from adopting it.
     byHost: (repoId, hostId) =>
-      rowsFor(repoId).find((repo) => getRepoExecutionHostId(repo) === hostId) ?? null
+      rowsFor(repoId).find((repo) => resolveOwnerRowHostId(repo) === hostId) ?? null
   }
 }
diff --git a/src/shared/worktree/host-context-labels.test.ts b/src/shared/worktree/host-context-labels.test.ts
new file mode 100644
index 00000000000..ccea06a25ed
--- /dev/null
+++ b/src/shared/worktree/host-context-labels.test.ts
@@ -0,0 +1,53 @@
+import { describe, expect, it } from 'vitest'
+import type { ExecutionHostId } from '../execution-host'
+import { getMixedHostContextLabels } from './host-context-labels'
+
+type Item = { id: string; hostId: ExecutionHostId }
+
+function argsFor(counters: { hostIdReads: number; identityReads: number }) {
+  return {
+    getHostId: (item: Item): ExecutionHostId => {
+      counters.hostIdReads += 1
+      return item.hostId
+    },
+    getIdentity: (item: Item): string => {
+      counters.identityReads += 1
+      return item.id
+    }
+  }
+}
+
+describe('getMixedHostContextLabels', () => {
+  it('returns undefined without building any labels when every item shares one host', () => {
+    const items: Item[] = Array.from({ length: 50 }, (_, index) => ({
+      id: `wt-${index}`,
+      hostId: 'local' as ExecutionHostId
+    }))
+    const counters = { hostIdReads: 0, identityReads: 0 }
+
+    expect(getMixedHostContextLabels(items, argsFor(counters))).toBeUndefined()
+    // The label map was built for all 50 and thrown away before; now nothing is built.
+    expect(counters.identityReads).toBe(0)
+  })
+
+  it('labels every item once a second host appears, wherever it appears', () => {
+    for (const lateIndex of [1, 25, 49]) {
+      const items: Item[] = Array.from({ length: 50 }, (_, index) => ({
+        id: `wt-${index}`,
+        hostId: (index === lateIndex ? 'ssh:other' : 'local') as ExecutionHostId
+      }))
+      const counters = { hostIdReads: 0, identityReads: 0 }
+
+      const labels = getMixedHostContextLabels(items, argsFor(counters))
+
+      expect(labels, `second host at index ${lateIndex}`).toBeDefined()
+      expect(labels?.size).toBe(50)
+      expect(labels?.has(`wt-${lateIndex}`)).toBe(true)
+    }
+  })
+
+  it('returns undefined for an empty list', () => {
+    const counters = { hostIdReads: 0, identityReads: 0 }
+    expect(getMixedHostContextLabels([], argsFor(counters))).toBeUndefined()
+  })
+})
diff --git a/src/shared/worktree/host-context-labels.ts b/src/shared/worktree/host-context-labels.ts
index 4b9481c441b..d3ab9ed2ed7 100644
--- a/src/shared/worktree/host-context-labels.ts
+++ b/src/shared/worktree/host-context-labels.ts
@@ -83,12 +83,30 @@ export function getMixedHostContextLabels<T>(
     sources?: HostContextLabelSources
   }
 ): Map<string, string> | undefined {
-  const labelsByIdentity = new Map<string, string>()
-  const hostIds = new Set<ExecutionHostId>()
+  // Why two passes: on a single-host install the map is built for every item and then discarded.
+  // Deciding first costs one getHostId per item and skips the label work entirely.
+  let firstHostId: ExecutionHostId | undefined
+  let isMixed = false
   for (const item of items) {
     const hostId = args.getHostId(item)
-    hostIds.add(hostId)
-    labelsByIdentity.set(args.getIdentity(item), getHostContextLabel(hostId, args.sources))
+    if (firstHostId === undefined) {
+      firstHostId = hostId
+      continue
+    }
+    if (hostId !== firstHostId) {
+      isMixed = true
+      break
+    }
   }
-  return hostIds.size > 1 ? labelsByIdentity : undefined
+  if (!isMixed) {
+    return undefined
+  }
+  const labelsByIdentity = new Map<string, string>()
+  for (const item of items) {
+    labelsByIdentity.set(
+      args.getIdentity(item),
+      getHostContextLabel(args.getHostId(item), args.sources)
+    )
+  }
+  return labelsByIdentity
 }
diff --git a/src/shared/worktree/types.ts b/src/shared/worktree/types.ts
index 3e5c05a65bc..e368716dc01 100644
--- a/src/shared/worktree/types.ts
+++ b/src/shared/worktree/types.ts
@@ -221,4 +221,6 @@ export type DetectedWorktreeListResult = {
   authoritative: boolean
   source: DetectedWorktreeListSource
   worktrees: DetectedWorktree[]
+  /** Why a non-authoritative listing could not be scanned; additive, older hosts omit it. */
+  unavailableReason?: string
 }
diff --git a/tests/AGENTS.md b/tests/AGENTS.md
index f445415e7df..30f522652fe 100644
--- a/tests/AGENTS.md
+++ b/tests/AGENTS.md
@@ -6,16 +6,17 @@ take the foreground — no window raised over the editor, no focus stolen, no Do
 `src/main/window/foreground-activation-policy.ts` enforces this in the main process. It is on
 whenever `ORCA_E2E_HEADLESS=1`, `ORCA_E2E_HEADFUL=1`, or `ORCA_BACKGROUND_LAUNCH=1`:
 
-- headless → the window never reaches the screen (Playwright drives it via CDP)
-- headful / background → `showInactive()`, no `app.focus({ steal: true })`, no
+- headless / explicit background → the window never reaches the screen (Playwright drives it via CDP)
+- headful without explicit background → `showInactive()`, no `app.focus({ steal: true })`, no
   `moveTop()`/always-on-top reinforcement
-- macOS headless → `accessory` activation policy, so no Dock tile and no menu-bar takeover
+- macOS headless / explicit background → `accessory` activation policy, so no Dock tile and no menu-bar takeover
 
 Rules when adding tests or scripts:
 
 - Launch through `tests/e2e/helpers/orca-app.ts` (or `orca-restart.ts`) — they already set the env.
 - A raw `electron.launch()` outside those helpers must pass `ORCA_BACKGROUND_LAUNCH: '1'`.
-- Call `showInactive()`, never `show()`, when an `app.evaluate()` block reveals a window.
+- Do not reveal windows in explicit background or headless runs. Only an explicitly headful run
+  may call `showInactive()`; never call `show()` or `bringToFront()` in automated background checks.
 - Tag a spec `@headful` only when it needs real pixels; it still runs in the background.
-- `ORCA_E2E_FOREGROUND=1` is the only opt-out, for runs whose subject _is_ native focus (IME and
-  other OS-level key injection). Add a comment saying why.
+- Native-focus tests belong on an isolated display or CI. Do not set `ORCA_E2E_FOREGROUND=1`
+  on the user’s desktop; it cannot override explicit background mode.
diff --git a/tests/e2e/activity-agent-pane-isolation.spec.ts b/tests/e2e/activity-agent-pane-isolation.spec.ts
index 12ac2f68dc6..7f9e734b2d0 100644
--- a/tests/e2e/activity-agent-pane-isolation.spec.ts
+++ b/tests/e2e/activity-agent-pane-isolation.spec.ts
@@ -32,7 +32,7 @@ type SplitGroupTerminal = {
 }
 
 function agentsSidebarButton(page: Page) {
-  return page.getByRole('radio', { name: /^Agents$/ }).first()
+  return page.getByRole('button', { name: 'View activity', exact: true })
 }
 
 async function seedActivityThread(
@@ -124,8 +124,7 @@ async function enableInlineAgentCards(page: Page): Promise<void> {
 
 async function enableActivityAgentsView(page: Page): Promise<void> {
   await page.evaluate(async () => {
-    // Why: the Agents tab is on by default, but a fresh profile opens the intro popover
-    // over it; stamping it as shown keeps the toggle clickable without dismissing it first.
+    // Keep the migration intro from covering the activity toggle.
     const settings = await window.api.settings.set({
       agentsSidebarIntroShown: true
     })
@@ -252,6 +251,8 @@ test.describe('Activity Agent Pane Isolation', () => {
         activeLeafId: first.leafId
       })
 
+    // Revealing a workspace returns the sidebar to its workspace list.
+    await agentsSidebarButton(orcaPage).click()
     await orcaPage.getByRole('button').filter({ hasText: second.prompt }).first().click()
     await expect
       .poll(async () => readActivePaneSelection(orcaPage), {
diff --git a/tests/e2e/add-project-default-checkout.spec.ts b/tests/e2e/add-project-default-checkout.spec.ts
index 0077fa6ff34..6a678c0bf9a 100644
--- a/tests/e2e/add-project-default-checkout.spec.ts
+++ b/tests/e2e/add-project-default-checkout.spec.ts
@@ -1,3 +1,4 @@
+import { openSidebarProjectDialog } from './helpers/sidebar-project-dialog'
 import { execFileSync } from 'node:child_process'
 import { mkdirSync, realpathSync, rmSync, writeFileSync } from 'node:fs'
 import { mkdtemp } from 'node:fs/promises'
@@ -86,10 +87,7 @@ test.describe('Add project default checkout', () => {
     await waitForSessionReady(orcaPage)
     const fixture = await createCloneFixture()
 
-    await orcaPage
-      .getByRole('button', { name: /Add Project/i })
-      .first()
-      .click()
+    await openSidebarProjectDialog(orcaPage)
     const addDialog = orcaPage.getByRole('dialog', { name: /Add a project/i })
     await expect(addDialog).toBeVisible()
     await addDialog.getByRole('button', { name: /Clone from URL/i }).click()
diff --git a/tests/e2e/browser-loading-surface-oracle.ts b/tests/e2e/browser-loading-surface-oracle.ts
new file mode 100644
index 00000000000..5fab1c78c94
--- /dev/null
+++ b/tests/e2e/browser-loading-surface-oracle.ts
@@ -0,0 +1,300 @@
+import { createServer } from 'node:http'
+import { writeFile } from 'node:fs/promises'
+import type { AddressInfo } from 'node:net'
+import { expect, type Page } from '@stablyai/playwright-test'
+import { PNG } from 'pngjs'
+
+// Hold the response, not a timer: every screenshot precedes the first document commit.
+export async function observeBrowserLoadingSurface(
+  page: Page,
+  outputPath: (name: string) => string,
+  crashGuest?: (id: number) => Promise<void>
+) {
+  const pendingResponses: (() => void)[] = []
+  const release = (): void => {
+    pendingResponses.splice(0).forEach((send) => send())
+  }
+  let requestCount = 0
+  let flushPrefix: (() => void) | undefined
+  let retryReady = false
+  const server = createServer((request, response) => {
+    if (request.url === '/fail' && !retryReady) {
+      response.destroy()
+      return
+    }
+    if (request.url !== '/held' && request.url !== '/fail') {
+      response.writeHead(204).end()
+      return
+    }
+    requestCount += 1
+    let prefixSent = false
+    flushPrefix = () => {
+      prefixSent = true
+      response.writeHead(200, { 'Content-Type': 'text/html' })
+      response.write(
+        `<!doctype html><head><title>Surface oracle</title></head><!--${'.'.repeat(4096)}-->`
+      )
+    }
+    pendingResponses.push(() =>
+      response.end(
+        `${prefixSent ? '' : '<!doctype html><title>Surface oracle</title>'}<body><h1>Usable webpage</h1><input value="retained"></body>`
+      )
+    )
+  })
+  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve))
+  const url = `http://127.0.0.1:${(server.address() as AddressInfo).port}/held`
+  const observations: Record<string, unknown>[] = []
+  // Freezing attachment for a screenshot must also freeze the missing-guest watchdog.
+  await page.clock.pauseAt(new Date())
+  const attachGate = await page.evaluateHandle((heldUrl) => {
+    const original = Element.prototype.setAttribute
+    const pending: (() => void)[] = []
+    Element.prototype.setAttribute = function (name, value) {
+      if (this.tagName === 'WEBVIEW' && name === 'src' && value === heldUrl) {
+        pending.push(() => original.call(this, name, value))
+        return
+      }
+      original.call(this, name, value)
+    }
+    return () => {
+      Element.prototype.setAttribute = original
+      pending.splice(0).forEach((release) => release())
+    }
+  }, url)
+  try {
+    await page.evaluate(async () => {
+      await window.__store!.getState().updateSettingsOrThrow({ theme: 'dark' })
+    })
+    await expect(page.locator('html')).toHaveClass(/dark/)
+    const tab = await page.evaluate((url) => {
+      const s = window.__store!.getState()
+      return s.createBrowserTab(s.activeWorktreeId!, url, {
+        activate: true,
+        title: 'Surface oracle'
+      })
+    }, url)
+    let guest = page.locator(`[data-browser-overlay-tab-id="${tab.id}"] webview`)
+    await expect(guest).toHaveCount(1)
+    const capture = async (phase: string, expected: 'theme' | 'white', loading = false) => {
+      const state = await guest.evaluate((element) => {
+        const webview = element as Electron.WebviewTag
+        const rect = webview.closest('[data-browser-page-container]')!.getBoundingClientRect()
+        let loading = false
+        let url = ''
+        let attached = false
+        try {
+          loading = webview.isLoading()
+          url = webview.getURL()
+          attached = webview.getWebContentsId() > 0
+        } catch {
+          /* Guest creation is held by the oracle. */
+        }
+        return {
+          attached,
+          background: getComputedStyle(webview).backgroundColor,
+          theme: getComputedStyle(webview.closest('[data-browser-page-container]')!)
+            .backgroundColor,
+          visibility: getComputedStyle(webview).visibility,
+          display: getComputedStyle(webview).display,
+          loading,
+          url,
+          rect: { x: rect.x, y: rect.y, width: rect.width, height: rect.height }
+        }
+      })
+      const target =
+        expected === 'white' ? [255, 255, 255] : state.theme.match(/\d+/g)!.slice(0, 3).map(Number)
+      let samples: number[][] = []
+      const sampleSurface = async (): Promise<boolean> => {
+        const screenshot = await page.screenshot({ path: outputPath(`${phase}.png`), scale: 'css' })
+        const png = PNG.sync.read(screenshot)
+        samples = [0.08, 0.92].flatMap((x) =>
+          [0.08, 0.85, 0.92].map((y) => {
+            const offset =
+              (Math.floor(state.rect.y + state.rect.height * y) * png.width +
+                Math.floor(state.rect.x + state.rect.width * x)) *
+              4
+            return [...png.data.subarray(offset, offset + 3)]
+          })
+        )
+        return samples.every((rgb) => rgb.every((c, i) => Math.abs(c - target[i]) <= 2))
+      }
+      let pixelPass = await sampleSurface()
+      if (expected === 'white' && !pixelPass) {
+        // Loading can stop before the compositor presents the recovered guest's first frame.
+        await expect.poll(async () => (pixelPass = await sampleSurface())).toBe(true)
+      }
+      const statePass =
+        expected === 'theme'
+          ? state.background === state.theme ||
+            state.visibility === 'hidden' ||
+            state.display === 'none'
+          : state.url.startsWith('http://127.0.0.1:')
+      expect(state.loading).toBe(loading)
+      observations.push({
+        phase,
+        ...state,
+        samples,
+        pixelPass,
+        statePass,
+        pass: pixelPass && statePass
+      })
+    }
+    const dismissDrawHint = page.getByRole('button', { name: 'Got it', exact: true })
+    if (await dismissDrawHint.isVisible()) {
+      await dismissDrawHint.click()
+      await expect(dismissDrawHint).not.toBeVisible()
+    }
+    await page.keyboard.press('Escape')
+    await page.mouse.move(0, 0)
+    await capture('pre-attach', 'theme')
+    await attachGate.evaluate((release) => release())
+    await page.clock.resume()
+    await expect.poll(() => requestCount).toBe(1)
+    await capture('dark-held', 'theme', true)
+    await page.evaluate(async () => {
+      await window.__store!.getState().updateSettingsOrThrow({ theme: 'light' })
+    })
+    await expect(page.locator('html')).toHaveClass(/light/)
+    await capture('light-held', 'theme', true)
+    await page.evaluate(async () => {
+      await window.__store!.getState().updateSettingsOrThrow({ theme: 'dark' })
+    })
+    await expect(page.locator('html')).toHaveClass(/dark/)
+    await capture('dark-again-held', 'theme', true)
+    await page.emulateMedia({ colorScheme: 'light' })
+    await page.evaluate(async () => {
+      await window.__store!.getState().updateSettingsOrThrow({ theme: 'system' })
+    })
+    await expect(page.locator('html')).toHaveClass(/light/)
+    await capture('system-light-held', 'theme', true)
+    await page.emulateMedia({ colorScheme: 'dark' })
+    await expect(page.locator('html')).toHaveClass(/dark/)
+    await capture('system-dark-held', 'theme', true)
+    await page.emulateMedia({ colorScheme: null })
+    await page.evaluate(async () => {
+      await window.__store!.getState().updateSettingsOrThrow({ theme: 'dark' })
+    })
+    flushPrefix!()
+    await expect
+      .poll(() => guest.evaluate((e) => (e as Electron.WebviewTag).getTitle()))
+      .toBe('Surface oracle')
+    await capture('committed-empty', 'theme', true)
+    release!()
+    await expect
+      .poll(() => guest.evaluate((e) => (e as Electron.WebviewTag).isLoading()))
+      .toBe(false)
+    expect(
+      await guest.evaluate((e) =>
+        (e as Electron.WebviewTag).executeJavaScript(
+          '({ text: document.querySelector("h1").textContent, style: document.body.getAttribute("style") })'
+        )
+      )
+    ).toEqual({ text: 'Usable webpage', style: null })
+    await capture('unstyled-painted', 'white')
+    await page.evaluate(async () => {
+      await window.__store!.getState().updateSettingsOrThrow({ theme: 'light' })
+    })
+    await expect(page.locator('html')).toHaveClass(/light/)
+    await capture('unstyled-light', 'white')
+    await page.evaluate(async () => {
+      await window.__store!.getState().updateSettingsOrThrow({ theme: 'dark' })
+    })
+    await expect(page.locator('html')).toHaveClass(/dark/)
+    const pane = page.locator(`[data-browser-overlay-tab-id="${tab.id}"]`)
+    await pane.getByRole('button', { name: 'Reload', exact: true }).click()
+    await expect.poll(() => requestCount).toBe(2)
+    await capture('reload-retained', 'white', true)
+    release!()
+    await expect
+      .poll(() => guest.evaluate((e) => (e as Electron.WebviewTag).isLoading()))
+      .toBe(false)
+    const guestId = await guest.evaluate((e) => (e as Electron.WebviewTag).getWebContentsId())
+    const worktreeId = await page.evaluate(() => window.__store!.getState().activeWorktreeId!)
+    await page.evaluate(() => window.__store!.getState().setActiveWorktree(null))
+    await expect(pane).not.toBeVisible()
+    await page.evaluate(
+      ({ worktreeId, tabId }) => {
+        const s = window.__store!.getState()
+        s.setActiveWorktree(worktreeId)
+        s.setActiveBrowserTab(tabId)
+      },
+      { worktreeId, tabId: tab.id }
+    )
+    await expect(pane).toBeVisible()
+    expect(await guest.evaluate((e) => (e as Electron.WebviewTag).getWebContentsId())).toBe(guestId)
+    await capture('unpark-retained', 'white')
+    if (crashGuest) {
+      await crashGuest(guestId)
+      await expect.poll(() => requestCount).toBe(3)
+      await capture('recovery-held', 'theme', true)
+      release!()
+      await expect
+        .poll(() => guest.evaluate((e) => (e as Electron.WebviewTag).isLoading()))
+        .toBe(false)
+      await capture('recovery-painted', 'white')
+    }
+    const blank = await page.evaluate(() => {
+      const s = window.__store!.getState()
+      return s.createBrowserTab(s.activeWorktreeId!, 'about:blank', { activate: true })
+    })
+    guest = page.locator(`[data-browser-overlay-tab-id="${blank.id}"] webview`)
+    await expect
+      .poll(() =>
+        guest.evaluate((e) => {
+          try {
+            return (e as Electron.WebviewTag).getURL()
+          } catch {
+            return ''
+          }
+        })
+      )
+      .toMatch(/about:blank|data:text\/html,/)
+    await expect
+      .poll(() => guest.evaluate((e) => (e as Electron.WebviewTag).isLoading()))
+      .toBe(false)
+    await page.keyboard.press('Escape')
+    await capture('new-tab', 'theme')
+    // Navigate through the real address input, retaining the blank document while the server waits.
+    const address = page.locator(`[data-browser-overlay-tab-id="${blank.id}"] input`).first()
+    await address.fill(url)
+    await address.press('Enter')
+    await expect.poll(() => requestCount).toBe(crashGuest ? 4 : 3)
+    await capture('new-tab-first-navigation-held', 'theme', true)
+    release!()
+    await expect
+      .poll(() => guest.evaluate((e) => (e as Electron.WebviewTag).isLoading()))
+      .toBe(false)
+    await capture('new-tab-painted', 'white')
+    await address.fill(url.replace('/held', '/fail'))
+    await address.press('Enter')
+    const retry = page
+      .locator(`[data-browser-overlay-tab-id="${blank.id}"]`)
+      .getByRole('button', { name: 'Retry', exact: true })
+      .filter({ hasText: 'Retry' })
+    await expect(retry).toBeVisible()
+    await expect
+      .poll(() => guest.evaluate((e) => (e as Electron.WebviewTag).isLoading()))
+      .toBe(false)
+    await capture('network-error', 'theme')
+    retryReady = true
+    const countBeforeRetry = requestCount
+    await retry.click()
+    await expect.poll(() => requestCount).toBeGreaterThan(countBeforeRetry)
+    await capture('network-retry-held', 'theme', true)
+    release!()
+    await expect(retry).not.toBeVisible()
+    await expect
+      .poll(() => guest.evaluate((e) => (e as Electron.WebviewTag).isLoading()))
+      .toBe(false)
+    await capture('network-retry-painted', 'white')
+    await writeFile(outputPath('observations.json'), JSON.stringify(observations, null, 2))
+    return observations
+  } finally {
+    await attachGate.evaluate((release) => release()).catch(() => {})
+    await page.clock.resume().catch(() => {})
+    await attachGate.dispose()
+    release?.()
+    server.closeAllConnections()
+    await new Promise<void>((resolve) => server.close(() => resolve()))
+  }
+}
diff --git a/tests/e2e/browser-loading-surface.spec.ts b/tests/e2e/browser-loading-surface.spec.ts
new file mode 100644
index 00000000000..ac1f21eac57
--- /dev/null
+++ b/tests/e2e/browser-loading-surface.spec.ts
@@ -0,0 +1,21 @@
+import { expect, test } from './helpers/orca-app'
+import { ensureTerminalVisible, waitForActiveWorktree, waitForSessionReady } from './helpers/store'
+import { crashGuestRenderer } from './browser-guest-runtime-oracle'
+import { observeBrowserLoadingSurface } from './browser-loading-surface-oracle'
+
+test('browser host follows the theme before content and preserves the webpage canvas', async ({
+  orcaPage,
+  electronApp
+}, testInfo) => {
+  await waitForSessionReady(orcaPage)
+  await ensureTerminalVisible(orcaPage)
+  await waitForActiveWorktree(orcaPage)
+  const observations = await observeBrowserLoadingSurface(
+    orcaPage,
+    (name) => testInfo.outputPath(name),
+    async (id) => {
+      await crashGuestRenderer(electronApp, id)
+    }
+  )
+  expect(observations.filter((entry) => !entry.pass)).toEqual([])
+})
diff --git a/tests/e2e/browser-tab.spec.ts b/tests/e2e/browser-tab.spec.ts
index 00075b4af19..347f3452c52 100644
--- a/tests/e2e/browser-tab.spec.ts
+++ b/tests/e2e/browser-tab.spec.ts
@@ -19,6 +19,7 @@ import {
   switchToWorktree,
   ensureTerminalVisible
 } from './helpers/store'
+import { startBrowserLinkServer } from './helpers/browser-link-server'
 
 type CreatedBrowserTab = {
   id: string
@@ -121,84 +122,6 @@ async function startBrowserFormServer(host = '127.0.0.1'): Promise<{
   }
 }
 
-async function startBrowserLinkServer(): Promise<{
-  sourceUrl: string
-  close: () => Promise<void>
-}> {
-  const server = createServer((request, response) => {
-    const origin = `http://127.0.0.1:${(server.address() as AddressInfo).port}`
-    const pathname = new URL(request.url ?? '/', origin).pathname
-    response.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' })
-    if (pathname === '/destination') {
-      response.end(
-        `<!doctype html><html><head><title>Linked destination</title></head><body>Destination <a id="return-link" href="${origin}/source">Return</a></body></html>`
-      )
-      return
-    }
-    if (pathname === '/frame-destination') {
-      response.end(
-        `<!doctype html><html><head><title>Frame destination</title></head><body>Frame destination <a id="return-link" href="${origin}/source">Return</a></body></html>`
-      )
-      return
-    }
-    if (pathname === '/frame-modifier-destination') {
-      response.end(
-        '<!doctype html><html><head><title>Frame modifier destination</title></head><body>Frame modifier destination</body></html>'
-      )
-      return
-    }
-    if (pathname === '/frame-middle-destination') {
-      response.end(
-        '<!doctype html><html><head><title>Frame middle destination</title></head><body>Frame middle destination</body></html>'
-      )
-      return
-    }
-    if (pathname === '/frame') {
-      response.end(
-        `<!doctype html><html><body><a style="display:block" id="frame-link" href="${origin}/frame-destination" target="_blank">Open frame destination</a><a style="display:block" id="frame-modifier-link" href="${origin}/frame-modifier-destination">Open frame modifier destination</a><a style="display:block" id="frame-middle-link" href="${origin}/frame-middle-destination">Open frame middle destination</a></body></html>`
-      )
-      return
-    }
-    if (pathname === '/modifier-destination') {
-      response.end(
-        '<!doctype html><html><head><title>Modifier destination</title></head><body>Modifier destination</body></html>'
-      )
-      return
-    }
-    if (pathname === '/middle-destination') {
-      response.end(
-        '<!doctype html><html><head><title>Middle-click destination</title></head><body>Middle-click destination</body></html>'
-      )
-      return
-    }
-    response.end(`
-      <!doctype html>
-      <html>
-        <head><title>Source page</title></head>
-        <body>
-          <a id="external-link" href="${origin}/destination" target="_blank">Open destination</a>
-          <a id="modifier-link" href="${origin}/modifier-destination">Open with modifier</a>
-          <a id="middle-link" href="${origin}/middle-destination">Open with middle click</a>
-          <a id="cancelled-link" href="${origin}/destination" target="_blank">Handle in page</a>
-          <iframe id="link-frame" src="${origin}/frame" title="Embedded links"></iframe>
-          <script>
-            document.querySelector('#cancelled-link').addEventListener('click', (event) => {
-              event.preventDefault()
-              document.title = 'Click handled in page'
-            })
-          </script>
-        </body>
-      </html>
-    `)
-  })
-  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve))
-  const port = (server.address() as AddressInfo).port
-  return {
-    sourceUrl: `http://127.0.0.1:${port}/source`,
-    close: () => closeServer(server)
-  }
-}
-
 async function startBrowserWindowCloseServer(): Promise<{
   url: string
   sourceUrl: string
@@ -281,8 +204,8 @@ async function clickBrowserLink(
   browserTabId: string,
   selector: string,
   options: {
-    modifiers?: ('meta' | 'control')[]
-    button?: 'left' | 'middle'
+    modifiers?: ('meta' | 'control' | 'shift')[]
+    button?: 'left' | 'middle' | 'right'
     frameSelector?: string
   } = {}
 ): Promise<void> {
@@ -317,21 +240,31 @@ async function clickBrowserLink(
       if (!point) {
         throw new Error(`Missing browser link ${targetSelector}`)
       }
-      await webview.sendInputEvent({ type: 'mouseMove', modifiers: inputModifiers, ...point })
-      await webview.sendInputEvent({
-        type: 'mouseDown',
-        button,
-        clickCount: 1,
-        modifiers: inputModifiers,
-        ...point
-      })
-      await webview.sendInputEvent({
-        type: 'mouseUp',
-        button,
-        clickCount: 1,
-        modifiers: inputModifiers,
-        ...point
-      })
+      const holdShift = inputModifiers.includes('shift')
+      if (holdShift) {
+        await webview.sendInputEvent({ type: 'keyDown', keyCode: 'Shift', modifiers: ['shift'] })
+      }
+      try {
+        await webview.sendInputEvent({ type: 'mouseMove', modifiers: inputModifiers, ...point })
+        await webview.sendInputEvent({
+          type: 'mouseDown',
+          button,
+          clickCount: 1,
+          modifiers: inputModifiers,
+          ...point
+        })
+        await webview.sendInputEvent({
+          type: 'mouseUp',
+          button,
+          clickCount: 1,
+          modifiers: inputModifiers,
+          ...point
+        })
+      } finally {
+        if (holdShift) {
+          await webview.sendInputEvent({ type: 'keyUp', keyCode: 'Shift' })
+        }
+      }
     },
     {
       targetBrowserTabId: browserTabId,
@@ -343,21 +276,43 @@ async function clickBrowserLink(
   )
 }
 
-async function expectBrowserTabActive(
+async function waitForTabIdByExactTitle(
   page: Parameters<typeof getActiveWorktreeId>[0],
   title: string
-): Promise<void> {
+): Promise<string> {
   const resolveTabId = (): Promise<string | null> =>
     page.locator('[data-tab-id]').evaluateAll((tabs, exactTitle) => {
       const tab = tabs.find((candidate) => candidate.textContent?.trim() === exactTitle)
       return tab?.getAttribute('data-tab-id') ?? null
     }, title)
   await expect.poll(resolveTabId, { timeout: 10_000 }).not.toBeNull()
-  const tabId = await resolveTabId()
-  expect(tabId).toBeTruthy()
+  return (await resolveTabId()) as string
+}
+
+async function expectBrowserTabActive(
+  page: Parameters<typeof getActiveWorktreeId>[0],
+  title: string
+): Promise<void> {
+  const tabId = await waitForTabIdByExactTitle(page, title)
   await expect(page.locator(`[data-browser-overlay-tab-id="${tabId}"]`)).toHaveCSS('opacity', '1')
 }
 
+async function expectBrowserTabOpenedInBackground(
+  page: Parameters<typeof getActiveWorktreeId>[0],
+  sourceTabId: string,
+  title: string
+): Promise<void> {
+  const openedTabId = await waitForTabIdByExactTitle(page, title)
+  await expect(page.locator(`[data-browser-overlay-tab-id="${sourceTabId}"]`)).toHaveCSS(
+    'opacity',
+    '1'
+  )
+  await expect(page.locator(`[data-browser-overlay-tab-id="${openedTabId}"]`)).toHaveCSS(
+    'opacity',
+    '0'
+  )
+}
+
 async function readBrowserInputValue(
   page: Parameters<typeof getActiveWorktreeId>[0],
   browserTabId: string
@@ -680,7 +635,7 @@ test.describe('Browser Tab', () => {
     }
   })
 
-  test('every new-tab link gesture activates an Orca tab and never a native window', async ({
+  test('new-tab link gestures follow Chrome foreground and background behavior', async ({
     electronApp,
     orcaPage
   }) => {
@@ -698,38 +653,51 @@ test.describe('Browser Tab', () => {
       const baseWindowCount = await electronApp.evaluate(
         ({ BaseWindow }) => BaseWindow.getAllWindows().length
       )
-      // A plain target=_blank click is a new-tab request, in the main frame and in an iframe;
-      // the source tab must stay put rather than navigate away under it.
+      // A plain main-frame target=_blank click must not navigate the source tab away.
       const sourceTabLocator = orcaPage.locator(`[data-tab-id="${sourceTab!.id}"]`)
-      await clickBrowserLink(orcaPage, sourceTab!.id, '#external-link')
-      await expectBrowserTabActive(orcaPage, 'Linked destination')
+      await clickBrowserLink(orcaPage, sourceTab!.id, '#blank-link')
+      await expectBrowserTabActive(orcaPage, 'Blank target destination')
       await expect(sourceTabLocator).toContainText('Source page')
       await switchToBrowserTab(orcaPage, worktreeId, sourceTab!.id)
 
+      // Context-menu links keep the source visible until the new tab is selected.
+      await clickBrowserLink(orcaPage, sourceTab!.id, '#external-link', { button: 'right' })
+      await orcaPage
+        .getByRole('menuitem', { name: 'Open Link In Orca Browser', exact: true })
+        .click()
+      await expectBrowserTabOpenedInBackground(orcaPage, sourceTab!.id, 'Linked destination')
       await clickBrowserLink(orcaPage, sourceTab!.id, '#frame-link', {
         frameSelector: '#link-frame'
       })
       await expectBrowserTabActive(orcaPage, 'Frame destination')
-      await expect(sourceTabLocator).toContainText('Source page')
       await switchToBrowserTab(orcaPage, worktreeId, sourceTab!.id)
 
       await clickBrowserLink(orcaPage, sourceTab!.id, '#frame-modifier-link', {
         frameSelector: '#link-frame',
         modifiers: process.platform === 'darwin' ? ['meta'] : ['control']
       })
-      await expectBrowserTabActive(orcaPage, 'Frame modifier destination')
-      await switchToBrowserTab(orcaPage, worktreeId, sourceTab!.id)
+      await expectBrowserTabOpenedInBackground(
+        orcaPage,
+        sourceTab!.id,
+        'Frame modifier destination'
+      )
       await clickBrowserLink(orcaPage, sourceTab!.id, '#frame-middle-link', {
         button: 'middle',
         frameSelector: '#link-frame'
       })
-      await expectBrowserTabActive(orcaPage, 'Frame middle destination')
-      await switchToBrowserTab(orcaPage, worktreeId, sourceTab!.id)
+      await expectBrowserTabOpenedInBackground(orcaPage, sourceTab!.id, 'Frame middle destination')
 
       await clickBrowserLink(orcaPage, sourceTab!.id, '#modifier-link', {
         modifiers: process.platform === 'darwin' ? ['meta'] : ['control']
       })
-      await expectBrowserTabActive(orcaPage, 'Modifier destination')
+      await expectBrowserTabOpenedInBackground(orcaPage, sourceTab!.id, 'Modifier destination')
+
+      await clickBrowserLink(orcaPage, sourceTab!.id, '#frame-shift-middle-link', {
+        button: 'middle',
+        modifiers: ['shift'],
+        frameSelector: '#link-frame'
+      })
+      await expectBrowserTabActive(orcaPage, 'Frame shift middle destination')
       await switchToBrowserTab(orcaPage, worktreeId, sourceTab!.id)
 
       const tabCountBeforeCancelledClick = await orcaPage.locator('[data-tab-id]').count()
@@ -740,7 +708,7 @@ test.describe('Browser Tab', () => {
       await expect(orcaPage.locator('[data-tab-id]')).toHaveCount(tabCountBeforeCancelledClick)
 
       await clickBrowserLink(orcaPage, sourceTab!.id, '#middle-link', { button: 'middle' })
-      await expectBrowserTabActive(orcaPage, 'Middle-click destination')
+      await expectBrowserTabOpenedInBackground(orcaPage, sourceTab!.id, 'Middle-click destination')
       await expect
         .poll(() => electronApp.evaluate(({ BaseWindow }) => BaseWindow.getAllWindows().length), {
           timeout: 5_000
diff --git a/tests/e2e/cross-version-wire/cross-version-agent-session-wire.unit.test.ts b/tests/e2e/cross-version-wire/cross-version-agent-session-wire.unit.test.ts
index d79c99b679d..8a407a29d15 100644
--- a/tests/e2e/cross-version-wire/cross-version-agent-session-wire.unit.test.ts
+++ b/tests/e2e/cross-version-wire/cross-version-agent-session-wire.unit.test.ts
@@ -2,9 +2,14 @@
 // way the terminal wire harness is: current code against a real published release.
 //
 // Three skews matter here, and none can be checked from one build alone — an old
-// client must not be shown a session it cannot render, a new client must find an
-// old host's missing surface cleanly, and a client's cursor must survive the host
-// process that minted it.
+// client must not receive a journal-backed RPC surface it cannot read, a new client
+// must find an old host's missing surface cleanly, and a client's cursor must survive
+// the host process that minted it.
+//
+// The session-tabs projection may keep a metadata-only row for an incapable mobile client so the
+// chat is not simply absent on the phone. Every `agentSession.*` method and destructive close stays
+// refused, which is what the tests below pin; the row-level behaviour is pinned in
+// src/main/runtime/rpc/methods/session-tab-agent-status-projection.test.ts.
 
 import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
@@ -18,7 +23,10 @@ import { setStructuredAgentSessionHost } from '../../../src/main/native-chat/age
 import { AgentSessionRecordStore } from '../../../src/main/runtime/agent-session-record-store'
 import { computeAgentSessionPayloadFingerprint } from '../../../src/shared/agent-session-mutation-envelope'
 import type { AgentSessionSubscribeEvent } from '../../../src/shared/agent-session-wire'
-import { STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY } from '../../../src/shared/protocol-version'
+import {
+  AGENT_SESSION_STATUS_FEED_RUNTIME_CAPABILITY,
+  STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY
+} from '../../../src/shared/protocol-version'
 import { resolveBaselineReleaseRef } from './release-checkout'
 import {
   loadAgentSessionWireBuild,
@@ -36,6 +44,7 @@ const WORKSPACE = 'workspace-1'
 const THREAD = '019fd532-7c11-7a90-b6de-4e1a2c3d5f60'
 const NOW = 1_800_000_000_000
 const CLIENT_CAPABILITY_UPDATE_METHOD = 'runtime.clientCapabilities.update'
+const STATUS_FEED_METHOD = 'agentSession.subscribeStatus'
 
 /** Every method the structured surface publishes: the host method it must reach,
  *  and the result it must hand back. A gate that hides one method and leaks
@@ -77,6 +86,11 @@ const STRUCTURED_CALLS: {
     hostMethod: 'setOption',
     result: { ok: true, replayed: false }
   },
+  {
+    method: 'agentSession.requestHandoff',
+    hostMethod: 'requestHandoff',
+    result: { status: { owner: 'native' } }
+  },
   {
     method: 'agentSession.handoffStatus',
     hostMethod: 'handoffStatus',
@@ -87,6 +101,11 @@ const STRUCTURED_CALLS: {
     hostMethod: 'readOptions',
     result: { current: { model: 'gpt-live' } }
   },
+  {
+    method: 'agentSession.reveal',
+    hostMethod: 'revealSession',
+    result: { ok: true, sessionId: SESSION, workspaceId: WORKSPACE, agent: 'codex', readable: true }
+  },
   { method: 'agentSession.hold', hostMethod: 'hold', result: { held: true } },
   { method: 'agentSession.release', hostMethod: 'release', result: { released: true } },
   {
@@ -97,6 +116,12 @@ const STRUCTURED_CALLS: {
   // A subscription that opens with nothing to say answers with no reply at all,
   // so reaching the host is the only signal that the gate opened.
   { method: 'agentSession.subscribe', hostMethod: 'subscribe' },
+  // The status feed opens with a snapshot of every session, so its first reply is the contract.
+  {
+    method: STATUS_FEED_METHOD,
+    hostMethod: 'subscribeStatus',
+    result: { type: 'snapshot', sessions: [] }
+  },
   // Teardown runs through the runtime's subscription registry rather than the
   // host, so its reply is the only signal that the gate opened.
   { method: 'agentSession.unsubscribe', hostMethod: null, result: { unsubscribed: true } }
@@ -197,6 +222,14 @@ function paramsFor(method: string): unknown {
       const fields = { itemId: 'item-1', expectedRevision: 1, optionId: 'allow' }
       return { envelope: envelope({ method, fields, fence }), ...fields }
     }
+    case 'agentSession.requestHandoff': {
+      const fields = {
+        direction: 'to-tui' as const,
+        mode: 'now' as const,
+        action: 'start' as const
+      }
+      return { envelope: envelope({ method, fields, fence }), ...fields }
+    }
     case 'agentSession.setOption': {
       const fields = { key: 'model', value: 'gpt-5' }
       return { envelope: envelope({ method, fields, fence }), ...fields }
@@ -286,9 +319,19 @@ async function callBuild(
 function structuredHostStub(): Record<string, ReturnType<typeof vi.fn>> {
   return {
     attach: vi.fn(async () => ({ ok: true, replayed: false, value: { sessionId: SESSION } })),
+    // Attach-shaped entries take a client-supplied location, so the host is asked whether it
+    // supports creating there. A real host always answers; leaving it unstubbed made every
+    // `ensure` refuse for the harness's own reason rather than the location's.
+    supportsCreate: vi.fn(() => true),
     send: vi.fn(async () => ({ ok: true, replayed: false })),
     cancel: vi.fn(async () => ({ ok: true, replayed: false })),
     close: vi.fn(async () => undefined),
+    revealSession: vi.fn(async () => ({
+      sessionId: SESSION,
+      workspaceId: WORKSPACE,
+      agent: 'codex' as const,
+      readable: true
+    })),
     hold: vi.fn(async () => undefined),
     release: vi.fn(() => undefined),
     respondToPrompt: vi.fn(async () => ({ ok: true, replayed: false })),
@@ -298,6 +341,10 @@ function structuredHostStub(): Record<string, ReturnType<typeof vi.fn>> {
     readOptions: vi.fn(async () => ({ models: [], current: { model: 'gpt-live' } })),
     history: vi.fn(() => ({ ok: true, page: { items: [] } })),
     subscribe: vi.fn(() => () => undefined),
+    subscribeStatus: vi.fn((subscriber: { emit: (event: unknown) => void }) => {
+      subscriber.emit({ type: 'snapshot', sessions: [] })
+      return () => undefined
+    }),
     unsubscribe: vi.fn()
   }
 }
@@ -421,6 +468,14 @@ describe('cross-version structured agent sessions', () => {
       expect(baseline.capabilities.includes(STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY)).toBe(
         baselineStructuredMethods().length > 0
       )
+      // The status feed is additive to a surface that already shipped, so it carries its own
+      // capability or a client cannot tell "host too old" from "the call failed" — and it
+      // would relay-retry a method_not_found forever instead of degrading once.
+      for (const build of [current, baseline]) {
+        expect(build.capabilities.includes(AGENT_SESSION_STATUS_FEED_RUNTIME_CAPABILITY)).toBe(
+          build.methodNames.includes(STATUS_FEED_METHOD)
+        )
+      }
       // Additive surface: bumping the protocol number would strand every paired
       // device on this release rather than degrade one feature.
       expect(current.protocolVersion).toBe(baseline.protocolVersion)
@@ -723,6 +778,10 @@ describe('cross-version structured agent sessions', () => {
     /** Phase 2 owns provider processes; the adapter is the only stub here. */
     function adapter(): StructuredAgentSessionAdapter {
       return {
+        // Every real adapter answers this; without it adapterSupportsCreate falls through to
+        // `supportsLocation`, which this fake also lacks, so the client-supplied-location gate
+        // refused for the fake's silence rather than for the location.
+        supportsCreate: () => true,
         acquire: async ({ fence }) => ({
           process: {
             hostId: 'local',
diff --git a/tests/e2e/cross-version-wire/release-checkout.unit.test.ts b/tests/e2e/cross-version-wire/release-checkout.unit.test.ts
index 7057a38babd..106e2ea778e 100644
--- a/tests/e2e/cross-version-wire/release-checkout.unit.test.ts
+++ b/tests/e2e/cross-version-wire/release-checkout.unit.test.ts
@@ -263,12 +263,24 @@ afterEach(() => {
 describe('release checkout materialization', () => {
   it('single-flights concurrent consumers of one release identity', async () => {
     const cacheRoot = temporaryCacheRoot()
+    let publications = 0
+    const options = {
+      cacheRoot,
+      testHooks: {
+        populateStaging: async (context: CheckoutStagingContext) => {
+          publications++
+          await populateMinimalStaging(context)
+        }
+      }
+    }
     const checkouts = await Promise.all([
-      materializeReleaseCheckout('v1.4.190', { cacheRoot }),
-      materializeReleaseCheckout('v1.4.190', { cacheRoot }),
-      materializeReleaseCheckout('v1.4.190', { cacheRoot })
+      materializeReleaseCheckout('v1.4.190', options),
+      materializeReleaseCheckout('v1.4.190', options),
+      materializeReleaseCheckout('v1.4.190', options)
     ])
 
+    expect(publications).toBe(1)
+
     expect(new Set(checkouts.map(({ root }) => root))).toHaveLength(1)
     expect(relative(cacheRoot, checkouts[0]!.root)).not.toMatch(/^\.\./)
   })
@@ -291,18 +303,29 @@ describe('release checkout materialization', () => {
     )
 
     const cacheRoot = temporaryCacheRoot()
-    const first = await materializeReleaseCheckout(firstRef, { cacheRoot })
+    const options = { cacheRoot, testHooks: { populateStaging: populateMinimalStaging } }
+    const first = await materializeReleaseCheckout(firstRef, options)
     const dependency = join(first.root, 'delayed-dependency.mjs')
     const entry = join(first.root, 'delayed-entry.mjs')
+    const importStarted = join(cacheRoot, 'import-started')
+    const continueImport = join(cacheRoot, 'continue-import')
     writeFileSync(dependency, "export const loaded = 'first-release'\n")
     writeFileSync(
       entry,
-      'await new Promise((resolve) => setTimeout(resolve, 100))\n' +
+      "import { existsSync, writeFileSync } from 'node:fs'\n" +
+        `writeFileSync(${JSON.stringify(importStarted)}, '')\n` +
+        `while (!existsSync(${JSON.stringify(continueImport)})) await new Promise((resolve) => setTimeout(resolve, 10))\n` +
         "export const loaded = (await import('./delayed-dependency.mjs')).loaded\n"
     )
 
     const loading = importReleaseCheckoutModule(first, '/delayed-entry.mjs')
-    const second = await materializeReleaseCheckout(secondRef, { cacheRoot })
+    let second: ReleaseCheckout
+    try {
+      await waitForFile(importStarted, 5_000)
+      second = await materializeReleaseCheckout(secondRef, options)
+    } finally {
+      writeFileSync(continueImport, '')
+    }
 
     await expect(loading).resolves.toMatchObject({ loaded: 'first-release' })
     expect(first.root).not.toBe(second.root)
@@ -311,7 +334,10 @@ describe('release checkout materialization', () => {
   it('causally single-flights a rival process before publishing an in-use checkout', async () => {
     const cacheRoot = temporaryCacheRoot()
     const scratch = temporaryCacheRoot()
-    const published = await materializeReleaseCheckout('v1.4.190', { cacheRoot })
+    const published = await materializeReleaseCheckout('v1.4.190', {
+      cacheRoot,
+      testHooks: { populateStaging: populateMinimalStaging }
+    })
 
     await expect(runContentionPhase(published, scratch, 'locked', false)).resolves.toBe(true)
     // In the same causally acknowledged interleaving, a no-lock materializer
diff --git a/tests/e2e/electron-home-isolation.spec.ts b/tests/e2e/electron-home-isolation.spec.ts
index 65aa1b7dc10..2fae6f42eec 100644
--- a/tests/e2e/electron-home-isolation.spec.ts
+++ b/tests/e2e/electron-home-isolation.spec.ts
@@ -1,4 +1,5 @@
 import type { ElectronApplication } from '@stablyai/playwright-test'
+import { realpathSync } from 'node:fs'
 import path from 'node:path'
 import { expect, test } from './helpers/orca-app'
 
@@ -23,7 +24,7 @@ async function readElectronHomeState(electronApp: ElectronApplication) {
 // HOME boundary and that real-home routing lands inside the disposable profile.
 test('isolates Electron and Codex from the developer home by default', async ({ electronApp }) => {
   const state = await readElectronHomeState(electronApp)
-  const expectedHome = path.join(state.userDataDir!, 'home')
+  const expectedHome = realpathSync.native(path.join(state.userDataDir!, 'home'))
 
   expect(state.appHome).toBe(expectedHome)
   expect(state.nodeHome).toBe(expectedHome)
diff --git a/tests/e2e/ephemeral-vm-provisioned-root.spec.ts b/tests/e2e/ephemeral-vm-provisioned-root.spec.ts
index 0dc51224bb3..394868e63be 100644
--- a/tests/e2e/ephemeral-vm-provisioned-root.spec.ts
+++ b/tests/e2e/ephemeral-vm-provisioned-root.spec.ts
@@ -1,6 +1,6 @@
 import { execFileSync } from 'node:child_process'
 import { chmodSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
-import { tmpdir } from 'node:os'
+import { homedir, tmpdir } from 'node:os'
 import path from 'node:path'
 import { expect, test } from './helpers/orca-app'
 import { ensureDockerSshRelayImage } from './helpers/docker-ssh-relay-image'
@@ -136,6 +136,8 @@ async function addRecipeRepo(page: Parameters<typeof waitForSessionReady>[0], re
 function seedRecipeRepo(repoPath: string, target: DockerSshRelayTarget): string {
   const createScript = path.join(repoPath, 'create.sh')
   const destroyScript = path.join(repoPath, 'destroy.sh')
+  // The recipe's isolated HOME must still address the engine that owns the fixture container.
+  const docker = `docker --config ${shellQuote(process.env.DOCKER_CONFIG ?? path.join(homedir(), '.docker'))}`
   writeFileSync(
     createScript,
     `#!/usr/bin/env bash
@@ -145,8 +147,8 @@ set -euo pipefail
 [ -n "\${ORCA_REPO_REF:-}" ]
 [ -n "\${ORCA_REPO_REF_HEAD:-}" ]
 [ -n "\${ORCA_REPO_BRANCH:-}" ]
-docker exec ${shellQuote(target.containerName)} git -C ${shellQuote(DOCKER_SSH_RELAY_REMOTE_REPO_PATH)} cat-file -e "$ORCA_REPO_REF_HEAD^{commit}"
-docker exec ${shellQuote(target.containerName)} git -C ${shellQuote(DOCKER_SSH_RELAY_REMOTE_REPO_PATH)} checkout -B "$ORCA_REPO_BRANCH" "$ORCA_REPO_REF_HEAD" >&2
+${docker} exec ${shellQuote(target.containerName)} git -C ${shellQuote(DOCKER_SSH_RELAY_REMOTE_REPO_PATH)} cat-file -e "$ORCA_REPO_REF_HEAD^{commit}"
+${docker} exec ${shellQuote(target.containerName)} git -C ${shellQuote(DOCKER_SSH_RELAY_REMOTE_REPO_PATH)} checkout -B "$ORCA_REPO_BRANCH" "$ORCA_REPO_REF_HEAD" >&2
 node -e 'console.log(JSON.stringify({schemaVersion:2,checkoutMode:"provisioned-root",connection:{type:"ssh",projectRoot:process.argv[1],target:{label:"Docker provisioned root",host:process.argv[2],port:Number(process.argv[3]),username:"root",identityFile:process.argv[4],identitiesOnly:true}}}))' ${shellQuote(DOCKER_SSH_RELAY_REMOTE_REPO_PATH)} ${shellQuote(target.host)} ${target.port} ${shellQuote(target.identityFile)}
 `
   )
@@ -155,7 +157,7 @@ node -e 'console.log(JSON.stringify({schemaVersion:2,checkoutMode:"provisioned-r
     `#!/usr/bin/env bash
 set -euo pipefail
 cat >/dev/null
-docker rm -f ${shellQuote(target.containerName)} >/dev/null
+${docker} rm -f ${shellQuote(target.containerName)} >/dev/null
 `
   )
   chmodSync(createScript, 0o755)
diff --git a/tests/e2e/feature-wall.spec.ts b/tests/e2e/feature-wall.spec.ts
index 428ce5d7996..fb422ec8bf8 100644
--- a/tests/e2e/feature-wall.spec.ts
+++ b/tests/e2e/feature-wall.spec.ts
@@ -179,9 +179,40 @@ test.describe('Feature tour modal', () => {
   })
 
   test('does not pre-check configured workflows until the user visits them', async ({
-    orcaPage
+    orcaPage,
+    electronApp
   }) => {
-    await orcaPage.evaluate(() => {
+    await electronApp.evaluate(
+      ({ ipcMain }, preflightStatus) => {
+        ipcMain.removeHandler('preflight:check')
+        ipcMain.handle('preflight:check', () => preflightStatus)
+        ipcMain.removeHandler('linear:status')
+        ipcMain.handle('linear:status', () => ({ connected: false, viewer: null }))
+        ipcMain.removeHandler('jira:status')
+        ipcMain.handle('jira:status', () => ({ connected: false, viewer: null }))
+      },
+      {
+        git: { installed: true },
+        gh: { installed: true, authenticated: true },
+        glab: { installed: false, authenticated: false },
+        bitbucket: { configured: false, authenticated: false, account: null },
+        azureDevOps: {
+          configured: false,
+          authenticated: false,
+          account: null,
+          baseUrl: null,
+          tokenConfigured: false
+        },
+        gitea: {
+          configured: false,
+          authenticated: false,
+          account: null,
+          baseUrl: null,
+          tokenConfigured: false
+        }
+      }
+    )
+    await orcaPage.evaluate(async () => {
       for (const key of [
         'orca.featureWall.visitedWorkflows.v1',
         'orca.featureWall.visitedAgentSteps.v1',
@@ -198,32 +229,12 @@ test.describe('Feature tour modal', () => {
       if (!store) {
         throw new Error('window.__store is not available')
       }
-      store.setState({
-        preflightStatus: {
-          git: { installed: true },
-          gh: { installed: true, authenticated: true },
-          glab: { installed: false, authenticated: false },
-          bitbucket: { configured: false, authenticated: false, account: null },
-          azureDevOps: {
-            configured: false,
-            authenticated: false,
-            account: null,
-            baseUrl: null,
-            tokenConfigured: false
-          },
-          gitea: {
-            configured: false,
-            authenticated: false,
-            account: null,
-            baseUrl: null,
-            tokenConfigured: false
-          }
-        },
-        preflightStatusChecked: true,
-        preflightStatusLoading: false,
-        linearStatus: { connected: false, viewer: null },
-        linearStatusChecked: true
-      })
+      // Seed through the status actions so each result gets the current execution context.
+      await Promise.all([
+        store.getState().refreshPreflightStatus({ force: true }),
+        store.getState().checkLinearConnection(true),
+        store.getState().checkJiraConnection()
+      ])
       store.getState().openModal('feature-wall', { source: 'help_menu' })
     })
 
diff --git a/tests/e2e/file-explorer-watch-refresh.spec.ts b/tests/e2e/file-explorer-watch-refresh.spec.ts
index d8a1bc1e4e7..85fbd66409e 100644
--- a/tests/e2e/file-explorer-watch-refresh.spec.ts
+++ b/tests/e2e/file-explorer-watch-refresh.spec.ts
@@ -35,7 +35,7 @@ test('refreshes the visible tree after external Windows file changes', async ({
   const row = (name: string) =>
     orcaPage
       .locator('[data-file-explorer-row]')
-      .filter({ hasText: new RegExp(`^${name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}$`) })
+      .filter({ has: orcaPage.getByText(name, { exact: true }) })
 
   rmSync(originalPath, { force: true })
   rmSync(renamedPath, { force: true })
diff --git a/tests/e2e/folder-setup-shallow-priority.spec.ts b/tests/e2e/folder-setup-shallow-priority.spec.ts
index 15bccef63ee..e8cb72d64e8 100644
--- a/tests/e2e/folder-setup-shallow-priority.spec.ts
+++ b/tests/e2e/folder-setup-shallow-priority.spec.ts
@@ -1,3 +1,4 @@
+import { openSidebarProjectDialog } from './helpers/sidebar-project-dialog'
 import { execFileSync } from 'node:child_process'
 import { mkdirSync, realpathSync, rmSync, writeFileSync } from 'node:fs'
 import { mkdtemp } from 'node:fs/promises'
@@ -166,10 +167,7 @@ test('prioritizes shallow sibling repositories in a bounded nested scan', async
   const fixture = await createShallowPriorityTruncationFixture()
   await chooseFolderInNativeDialog(electronApp, fixture.parentPath)
 
-  await orcaPage
-    .getByRole('button', { name: /Add Project/i })
-    .first()
-    .click()
+  await openSidebarProjectDialog(orcaPage)
   const dialog = orcaPage.getByRole('dialog', { name: /Add a project/i })
   await expect(dialog).toBeVisible()
   await dialog.getByRole('button', { name: /Browse folder/i }).click()
@@ -256,10 +254,7 @@ test('can stop a nested repo scan and import repositories found so far', async (
   })
   await chooseFolderInNativeDialog(electronApp, fixture.parentPath)
 
-  await orcaPage
-    .getByRole('button', { name: /Add Project/i })
-    .first()
-    .click()
+  await openSidebarProjectDialog(orcaPage)
   const dialog = orcaPage.getByRole('dialog', { name: /Add a project/i })
   await dialog.getByRole('button', { name: /Browse folder/i }).click()
 
diff --git a/tests/e2e/folder-setup.spec.ts b/tests/e2e/folder-setup.spec.ts
index fc0f27824cc..5c736ec7efe 100644
--- a/tests/e2e/folder-setup.spec.ts
+++ b/tests/e2e/folder-setup.spec.ts
@@ -1,3 +1,4 @@
+import { openSidebarProjectDialog } from './helpers/sidebar-project-dialog'
 import { execFileSync } from 'node:child_process'
 import { mkdirSync, realpathSync, rmSync, writeFileSync } from 'node:fs'
 import { mkdtemp } from 'node:fs/promises'
@@ -122,10 +123,7 @@ test.describe('Folder setup', () => {
     const fixture = await createNestedRepoFixture()
     await chooseFolderInNativeDialog(electronApp, fixture.parentPath)
 
-    await orcaPage
-      .getByRole('button', { name: /Add Project/i })
-      .first()
-      .click()
+    await openSidebarProjectDialog(orcaPage)
     const dialog = orcaPage.getByRole('dialog', { name: /Add a project/i })
     await expect(dialog).toBeVisible()
     await dialog.getByRole('button', { name: /Browse folder/i }).click()
@@ -190,10 +188,7 @@ test.describe('Folder setup', () => {
     const fixture = await createLargeNestedRepoFixture()
     await chooseFolderInNativeDialog(electronApp, fixture.parentPath)
 
-    await orcaPage
-      .getByRole('button', { name: /Add Project/i })
-      .first()
-      .click()
+    await openSidebarProjectDialog(orcaPage)
     const dialog = orcaPage.getByRole('dialog', { name: /Add a project/i })
     await expect(dialog).toBeVisible()
     await dialog.getByRole('button', { name: /Browse folder/i }).click()
diff --git a/tests/e2e/git-no-upstream-polling-churn.spec.ts b/tests/e2e/git-no-upstream-polling-churn.spec.ts
index 2cdd1d129f6..6b3ca765fc7 100644
--- a/tests/e2e/git-no-upstream-polling-churn.spec.ts
+++ b/tests/e2e/git-no-upstream-polling-churn.spec.ts
@@ -3,6 +3,23 @@ import { existsSync, readFileSync, realpathSync, unlinkSync, writeFileSync } fro
 import type { Page, TestInfo } from '@stablyai/playwright-test'
 import { test, expect } from './helpers/orca-app'
 
+// This isolated app needs local trace files; network telemetry remains disabled.
+test.use({
+  orcaAppExtraEnv: {
+    CI: '',
+    GITHUB_ACTIONS: '',
+    GITLAB_CI: '',
+    CIRCLECI: '',
+    TRAVIS: '',
+    BUILDKITE: '',
+    JENKINS_URL: '',
+    TEAMCITY_VERSION: '',
+    ORCA_DIAGNOSTICS_DISABLED: '',
+    DO_NOT_TRACK: '1',
+    ORCA_TELEMETRY_DISABLED: '1'
+  }
+})
+
 // Repro command:
 //   SKIP_BUILD=1 pnpm exec playwright test tests/e2e/git-no-upstream-polling-churn.spec.ts --config tests/playwright.config.ts --project electron-headless --reporter=json
 // Trigger: active worktree branch "Initi-Project" has no configured upstream
@@ -21,6 +38,7 @@ type RendererTimerMeasurement = {
 }
 
 type GitProbeFailureCounts = {
+  observedGitCommands: number
   noConfiguredUpstreamFailures: number
   missingSameNameOriginFailures: number
 }
@@ -138,11 +156,11 @@ async function measureRendererDuringPolling(page: Page): Promise<RendererTimerMe
 }
 
 function readGitProbeFailureCounts(traceFilePath: string, repoPath: string): GitProbeFailureCounts {
-  if (!existsSync(traceFilePath)) {
-    return { noConfiguredUpstreamFailures: 0, missingSameNameOriginFailures: 0 }
+  const counts = {
+    observedGitCommands: 0,
+    noConfiguredUpstreamFailures: 0,
+    missingSameNameOriginFailures: 0
   }
-
-  const counts = { noConfiguredUpstreamFailures: 0, missingSameNameOriginFailures: 0 }
   for (const line of readFileSync(traceFilePath, 'utf8').split(/\r?\n/)) {
     if (!line.trim()) {
       continue
@@ -157,11 +175,12 @@ function readGitProbeFailureCounts(traceFilePath: string, repoPath: string): Git
     } catch {
       continue
     }
-    if (
-      record.name !== 'git.exec' ||
-      record.attributes?.cwd !== repoPath ||
-      record.exit?._tag !== 'Failure'
-    ) {
+    if (record.name !== 'git.exec' || record.attributes?.cwd !== repoPath) {
+      continue
+    }
+
+    counts.observedGitCommands += 1
+    if (record.exit?._tag !== 'Failure') {
       continue
     }
 
@@ -185,7 +204,7 @@ function annotatePolling(
     type: 'git-no-upstream-polling-repro',
     description: `elapsed=${measurement.elapsedMs.toFixed(1)}ms maxTimerDrift=${measurement.maxTimerDriftMs.toFixed(
       1
-    )}ms samples=${measurement.samples} noUpstreamFailures=${
+    )}ms samples=${measurement.samples} gitCommands=${counts.observedGitCommands} noUpstreamFailures=${
       counts.noConfiguredUpstreamFailures
     } missingOriginFailures=${counts.missingSameNameOriginFailures}`
   })
@@ -201,7 +220,8 @@ test.describe('Git no-upstream polling churn repro', () => {
     await selectRepoForActivePolling(orcaPage, testRepoPath, repoPath)
 
     const diagnostics = await readDiagnosticsStatus(orcaPage)
-    test.skip(!diagnostics.localFileEnabled, 'local diagnostic traces are disabled')
+    expect(diagnostics.localFileEnabled).toBe(true)
+    expect(diagnostics.bundleEnabled).toBe(false)
 
     clearTraceFile(diagnostics)
     const measurement = await measureRendererDuringPolling(orcaPage)
@@ -209,6 +229,10 @@ test.describe('Git no-upstream polling churn repro', () => {
     const counts = readGitProbeFailureCounts(diagnostics.traceFilePath, repoPath)
     annotatePolling(testInfo, measurement, counts)
 
+    expect(
+      counts.observedGitCommands,
+      'No Git activity was recorded for the measured repo'
+    ).toBeGreaterThan(0)
     expect(measurement.maxTimerDriftMs).toBeLessThan(MAX_RENDERER_TIMER_DRIFT_MS)
     // Why: the #4559 trace showed these stable negative upstream probes being
     // retried every poll. Under parallel e2e load one in-flight refresh can
diff --git a/tests/e2e/github-url-smart-input-transition.spec.ts b/tests/e2e/github-url-smart-input-transition.spec.ts
index e078007bd78..f042c4ef676 100644
--- a/tests/e2e/github-url-smart-input-transition.spec.ts
+++ b/tests/e2e/github-url-smart-input-transition.spec.ts
@@ -203,6 +203,12 @@ async function installHeldGitLabLookup(
         __releaseGitLabUrlLookup?: () => void
       }
       fixture.__gitlabUrlLookupStarted = false
+      ipcMain.removeHandler('preflight:check')
+      ipcMain.handle('preflight:check', () => ({
+        git: { installed: true },
+        gh: { installed: true, authenticated: true },
+        glab: { installed: true, authenticated: true }
+      }))
       ipcMain.removeHandler('gitlab:listMRs')
       ipcMain.handle('gitlab:listMRs', () => ({
         items: [wrongItem],
@@ -221,23 +227,12 @@ async function installHeldGitLabLookup(
     },
     { wrongItem: GITLAB_WRONG_ITEM, targetItem: GITLAB_TARGET_ITEM }
   )
-  await page.evaluate(() => {
+  await page.evaluate(async () => {
     const store = window.__store
     if (!store) {
       throw new Error('window.__store is not available')
     }
-    const state = store.getState()
-    if (!state.preflightStatusContextKey) {
-      throw new Error('preflight context is not ready')
-    }
-    store.setState({
-      preflightStatus: {
-        git: state.preflightStatus?.git ?? { installed: true },
-        gh: state.preflightStatus?.gh ?? { installed: true, authenticated: true },
-        glab: { installed: true, authenticated: true }
-      },
-      preflightStatusChecked: true
-    })
+    await store.getState().refreshPreflightStatus({ force: true })
   })
 }
 
diff --git a/tests/e2e/golden-core-flows.spec.ts b/tests/e2e/golden-core-flows.spec.ts
index 96863251081..7d56b0805b4 100644
--- a/tests/e2e/golden-core-flows.spec.ts
+++ b/tests/e2e/golden-core-flows.spec.ts
@@ -1,3 +1,4 @@
+import { openSidebarProjectDialog } from './helpers/sidebar-project-dialog'
 import { execFileSync } from 'node:child_process'
 import { mkdirSync, realpathSync, rmSync, writeFileSync } from 'node:fs'
 import { mkdtemp } from 'node:fs/promises'
@@ -211,10 +212,7 @@ async function addProjectFromSidebar(
   repoPath: string
 ): Promise<void> {
   await chooseFolderInNativeDialog(electronApp, repoPath)
-  await page
-    .getByRole('button', { name: /Add Project/i })
-    .first()
-    .click()
+  await openSidebarProjectDialog(page)
   const addDialog = page.getByRole('dialog', { name: /Add a project/i })
   await expect(addDialog).toBeVisible()
   await addDialog.getByRole('button', { name: /Browse folder/i }).click()
diff --git a/tests/e2e/helpers/browser-link-server.ts b/tests/e2e/helpers/browser-link-server.ts
new file mode 100644
index 00000000000..81debdc5859
--- /dev/null
+++ b/tests/e2e/helpers/browser-link-server.ts
@@ -0,0 +1,100 @@
+import { createServer, type Server } from 'node:http'
+import type { AddressInfo } from 'node:net'
+
+async function closeServer(server: Server): Promise<void> {
+  await new Promise<void>((resolve, reject) =>
+    server.close((error) => {
+      if (error) {
+        reject(error)
+        return
+      }
+      resolve()
+    })
+  )
+}
+
+export async function startBrowserLinkServer(): Promise<{
+  sourceUrl: string
+  close: () => Promise<void>
+}> {
+  const server = createServer((request, response) => {
+    const origin = `http://127.0.0.1:${(server.address() as AddressInfo).port}`
+    const pathname = new URL(request.url ?? '/', origin).pathname
+    response.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' })
+    if (pathname === '/destination') {
+      response.end(
+        `<!doctype html><html><head><title>Linked destination</title></head><body>Destination <a id="return-link" href="${origin}/source">Return</a></body></html>`
+      )
+      return
+    }
+    if (pathname === '/blank-destination') {
+      response.end(
+        '<!doctype html><html><head><title>Blank target destination</title></head><body>Blank target destination</body></html>'
+      )
+      return
+    }
+    if (pathname === '/frame-destination') {
+      response.end(
+        `<!doctype html><html><head><title>Frame destination</title></head><body>Frame destination <a id="return-link" href="${origin}/source">Return</a></body></html>`
+      )
+      return
+    }
+    if (pathname === '/frame-modifier-destination') {
+      response.end(
+        '<!doctype html><html><head><title>Frame modifier destination</title></head><body>Frame modifier destination</body></html>'
+      )
+      return
+    }
+    if (pathname === '/frame-middle-destination') {
+      response.end(
+        '<!doctype html><html><head><title>Frame middle destination</title></head><body>Frame middle destination</body></html>'
+      )
+      return
+    }
+    if (pathname === '/frame') {
+      response.end(
+        `<!doctype html><html><head><title>${request.url?.includes('shift-middle') ? 'Frame shift middle destination' : ''}</title></head><body><a style="display:block" id="frame-link" href="${origin}/frame-destination" target="_blank">Open frame destination</a><a style="display:block" id="frame-modifier-link" href="${origin}/frame-modifier-destination">Open frame modifier destination</a><a style="display:block" id="frame-middle-link" href="${origin}/frame-middle-destination">Open frame middle destination</a><a style="display:block" id="frame-shift-middle-link" href="${origin}/frame?shift-middle">Open foreground frame tab</a></body></html>`
+      )
+      return
+    }
+    if (pathname === '/modifier-destination') {
+      response.end(
+        '<!doctype html><html><head><title>Modifier destination</title></head><body>Modifier destination</body></html>'
+      )
+      return
+    }
+    if (pathname === '/middle-destination') {
+      response.end(
+        '<!doctype html><html><head><title>Middle-click destination</title></head><body>Middle-click destination</body></html>'
+      )
+      return
+    }
+    response.end(`
+      <!doctype html>
+      <html>
+        <head><title>${request.url?.includes('shift-middle') ? 'Shift middle destination' : 'Source page'}</title></head>
+        <body>
+          <a id="external-link" href="${origin}/destination" target="_blank">Open destination</a>
+          <a id="blank-link" href="${origin}/blank-destination" target="_blank">Open blank target destination</a>
+          <a id="modifier-link" href="${origin}/modifier-destination">Open with modifier</a>
+          <a id="middle-link" href="${origin}/middle-destination">Open with middle click</a>
+          <a id="shift-middle-link" href="${origin}/source?shift-middle">Open foreground tab</a>
+          <a id="cancelled-link" href="${origin}/destination" target="_blank">Handle in page</a>
+          <iframe id="link-frame" src="${origin}/frame" title="Embedded links"></iframe>
+          <script>
+            document.querySelector('#cancelled-link').addEventListener('click', (event) => {
+              event.preventDefault()
+              document.title = 'Click handled in page'
+            })
+          </script>
+        </body>
+      </html>
+    `)
+  })
+  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve))
+  const port = (server.address() as AddressInfo).port
+  return {
+    sourceUrl: `http://127.0.0.1:${port}/source`,
+    close: () => closeServer(server)
+  }
+}
diff --git a/tests/e2e/helpers/docker-ssh-relay-connection.ts b/tests/e2e/helpers/docker-ssh-relay-connection.ts
index a17ad916e66..3e0c35f3c53 100644
--- a/tests/e2e/helpers/docker-ssh-relay-connection.ts
+++ b/tests/e2e/helpers/docker-ssh-relay-connection.ts
@@ -1,4 +1,4 @@
-import type { Page } from '@stablyai/playwright-test'
+import { expect, type Page } from '@stablyai/playwright-test'
 
 import {
   DOCKER_SSH_PROXY_JUMP_REMOTE_REPO_PATH,
@@ -227,3 +227,33 @@ export async function reconnectDisconnectedDockerSshRelayTarget(
 ): Promise<void> {
   return performDockerSshRelayReconnect(page, targetId, false)
 }
+
+export async function recoverDockerSshRelayAfterFault(
+  page: Page,
+  targetId: string,
+  injectFault: () => void | Promise<void>
+): Promise<void> {
+  const readAuthority = () =>
+    page.evaluate((id) => window.__store?.getState().sshConnectionStates.get(id), targetId)
+  const before = await readAuthority()
+  expect(before).toMatchObject({
+    status: 'connected',
+    providerEpoch: expect.any(String),
+    connectionGeneration: expect.any(Number)
+  })
+  await injectFault()
+  // The pre-fault connected publication can remain visible until the next IPC event.
+  await expect
+    .poll(
+      async () => {
+        const after = await readAuthority()
+        return (
+          after?.status === 'connected' &&
+          (after.providerEpoch !== before?.providerEpoch ||
+            after.connectionGeneration !== before?.connectionGeneration)
+        )
+      },
+      { timeout: 120_000, message: 'SSH authority did not recover after the injected fault' }
+    )
+    .toBe(true)
+}
diff --git a/tests/e2e/helpers/electron-crashpad-cleanup.ts b/tests/e2e/helpers/electron-crashpad-cleanup.ts
new file mode 100644
index 00000000000..8ec1a98b26b
--- /dev/null
+++ b/tests/e2e/helpers/electron-crashpad-cleanup.ts
@@ -0,0 +1,46 @@
+import { execFileSync } from 'node:child_process'
+import path from 'node:path'
+
+function ownsCrashpad(command: string, userDataDir: string): boolean {
+  return (
+    command.includes('/chrome_crashpad_handler ') &&
+    command.includes(` --database=${path.join(userDataDir, 'Crashpad')} `)
+  )
+}
+
+export function cleanupE2ECrashpad(userDataDir: string): void {
+  if (process.platform !== 'darwin') {
+    return
+  }
+
+  // macOS reparents Crashpad before app exit; its inherited stderr can keep Playwright open.
+  try {
+    const table = execFileSync('ps', ['-axo', 'pid=,command='], {
+      encoding: 'utf8',
+      timeout: 5_000
+    })
+    for (const row of table.split('\n')) {
+      const match = row.match(/^\s*(\d+)\s+(.+)$/)
+      if (!match || !ownsCrashpad(match[2], userDataDir)) {
+        continue
+      }
+      const pid = Number(match[1])
+      if (!Number.isSafeInteger(pid) || pid <= 1) {
+        continue
+      }
+      try {
+        const command = execFileSync('ps', ['-p', String(pid), '-o', 'command='], {
+          encoding: 'utf8',
+          timeout: 5_000
+        })
+        if (ownsCrashpad(command, userDataDir)) {
+          process.kill(pid, 'SIGTERM')
+        }
+      } catch {
+        // The test-owned reporter may already have exited.
+      }
+    }
+  } catch {
+    // Cleanup remains best-effort when process enumeration is unavailable.
+  }
+}
diff --git a/tests/e2e/helpers/electron-crashpad-cleanup.unit.test.ts b/tests/e2e/helpers/electron-crashpad-cleanup.unit.test.ts
new file mode 100644
index 00000000000..cdf552e2548
--- /dev/null
+++ b/tests/e2e/helpers/electron-crashpad-cleanup.unit.test.ts
@@ -0,0 +1,45 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { execFileSync } from 'node:child_process'
+import path from 'node:path'
+import { cleanupE2ECrashpad } from './electron-crashpad-cleanup'
+
+vi.mock('node:child_process', () => ({ execFileSync: vi.fn() }))
+
+const profile = '/tmp/test profile'
+const database = path.join(profile, 'Crashpad')
+const reporter = `/Electron Framework/Helpers/chrome_crashpad_handler --database=${database} --annotation=prod=Electron`
+
+afterEach(() => vi.restoreAllMocks())
+
+describe('test-owned macOS Crashpad cleanup', () => {
+  it('terminates only the reporter for the exact temporary profile after rechecking ownership', () => {
+    vi.spyOn(process, 'platform', 'get').mockReturnValue('darwin')
+    const kill = vi.spyOn(process, 'kill').mockReturnValue(true)
+    vi.mocked(execFileSync)
+      .mockReturnValueOnce(
+        `111 ${reporter}\n222 ${reporter.replace('Crashpad ', 'Crashpad-old ')}\n333 ${reporter.replace('test profile', 'another profile')}\n444 /bin/echo --database=${database} \n`
+      )
+      .mockReturnValueOnce(reporter)
+    cleanupE2ECrashpad(profile)
+    expect(kill).toHaveBeenCalledExactlyOnceWith(111, 'SIGTERM')
+    expect(execFileSync).toHaveBeenLastCalledWith('ps', ['-p', '111', '-o', 'command='], {
+      encoding: 'utf8',
+      timeout: 5_000
+    })
+  })
+
+  it('does not signal a PID whose ownership changed after enumeration', () => {
+    vi.spyOn(process, 'platform', 'get').mockReturnValue('darwin')
+    const kill = vi.spyOn(process, 'kill').mockReturnValue(true)
+    vi.mocked(execFileSync).mockReturnValueOnce(`111 ${reporter}`).mockReturnValueOnce('/bin/sh')
+    cleanupE2ECrashpad(profile)
+    expect(kill).not.toHaveBeenCalled()
+  })
+
+  it.each(['win32', 'linux'] as const)('does not enumerate processes on %s', (platform) => {
+    vi.spyOn(process, 'platform', 'get').mockReturnValue(platform)
+    vi.mocked(execFileSync).mockClear()
+    cleanupE2ECrashpad(profile)
+    expect(execFileSync).not.toHaveBeenCalled()
+  })
+})
diff --git a/tests/e2e/helpers/electron-launch-args.ts b/tests/e2e/helpers/electron-launch-args.ts
index fc2ff1e81aa..9128a5fb551 100644
--- a/tests/e2e/helpers/electron-launch-args.ts
+++ b/tests/e2e/helpers/electron-launch-args.ts
@@ -7,6 +7,10 @@ export function getOrcaElectronLaunchArgs(mainPath: string, headful: boolean): s
   // these Chromium switches startup can block before the first renderer target.
   const keychainArgs =
     process.platform === 'darwin' ? ['--password-store=basic', '--use-mock-keychain'] : []
+  if (process.platform === 'darwin') {
+    // Crash tests must not block later launches on AppKit's saved-window recovery dialog.
+    return [...keychainArgs, appPath, '-ApplePersistenceIgnoreState', 'YES']
+  }
   if (headful || process.platform !== 'linux') {
     return [...keychainArgs, appPath]
   }
diff --git a/tests/e2e/helpers/electron-launch-args.unit.test.ts b/tests/e2e/helpers/electron-launch-args.unit.test.ts
index ed981951f14..636299fbc4e 100644
--- a/tests/e2e/helpers/electron-launch-args.unit.test.ts
+++ b/tests/e2e/helpers/electron-launch-args.unit.test.ts
@@ -8,10 +8,17 @@ describe('getOrcaElectronLaunchArgs', () => {
     const mainPath = join(root, 'out', 'main', 'index.js')
 
     const args = getOrcaElectronLaunchArgs(mainPath, true)
-    expect(args.at(-1)).toBe(root)
     if (process.platform === 'darwin') {
-      expect(args.slice(0, -1)).toEqual(['--password-store=basic', '--use-mock-keychain'])
+      expect(args).toEqual([
+        '--password-store=basic',
+        '--use-mock-keychain',
+        root,
+        '-ApplePersistenceIgnoreState',
+        'YES'
+      ])
+    } else {
+      expect(args.at(-1)).toBe(root)
     }
-    expect(getOrcaElectronLaunchArgs(mainPath, false).at(-1)).toBe(root)
+    expect(getOrcaElectronLaunchArgs(mainPath, false)).toContain(root)
   })
 })
diff --git a/tests/e2e/helpers/electron-process-shutdown.ts b/tests/e2e/helpers/electron-process-shutdown.ts
index 5180575f1a6..f9b642a676e 100644
--- a/tests/e2e/helpers/electron-process-shutdown.ts
+++ b/tests/e2e/helpers/electron-process-shutdown.ts
@@ -2,6 +2,7 @@ import type { ChildProcess } from 'node:child_process'
 import { execFileSync } from 'node:child_process'
 import { existsSync, readFileSync, readdirSync } from 'node:fs'
 import path from 'node:path'
+import { cleanupE2ECrashpad } from './electron-crashpad-cleanup'
 import type { ElectronApplication } from '@stablyai/playwright-test'
 
 const GRACEFUL_CLOSE_TIMEOUT_MS = 10_000
@@ -19,6 +20,16 @@ function hasExited(proc: ChildProcess): boolean {
   return proc.exitCode !== null || proc.signalCode !== null
 }
 
+function releaseExitedProcessPipes(proc: ChildProcess): void {
+  if (!hasExited(proc)) {
+    return
+  }
+  // Detached SSH helpers can retain inherited pipes after Electron itself exits.
+  for (const stream of proc.stdio) {
+    stream?.destroy()
+  }
+}
+
 function waitForExit(proc: ChildProcess, timeoutMs: number): Promise<boolean> {
   if (hasExited(proc)) {
     return Promise.resolve(true)
@@ -166,12 +177,16 @@ export async function forceQuitElectronAppForE2E(app: ElectronApplication): Prom
     }
   }
   await waitForExit(proc, PROCESS_EXIT_TIMEOUT_MS)
+  releaseExitedProcessPipes(proc)
   // Hands the dead app back to Playwright so worker teardown has nothing left to wait on.
   await app.close().catch(() => undefined)
 }
 
 export async function closeElectronAppForE2E(app: ElectronApplication): Promise<void> {
   const proc = app.process()
+  const releasePipes = (): void => releaseExitedProcessPipes(proc)
+  proc.once('exit', releasePipes)
+  releasePipes()
   try {
     await withTimeout(app.close(), GRACEFUL_CLOSE_TIMEOUT_MS, 'Timed out closing Electron app')
     if (proc) {
@@ -184,6 +199,9 @@ export async function closeElectronAppForE2E(app: ElectronApplication): Promise<
     if (proc) {
       await forceKillProcessTree(proc)
     }
+  } finally {
+    proc.off('exit', releasePipes)
+    releasePipes()
   }
 }
 
@@ -221,4 +239,5 @@ export async function cleanupE2EDaemons(userDataDir: string): Promise<void> {
   for (const pid of readDaemonPidFiles(userDataDir)) {
     await forceKillPidTree(pid)
   }
+  cleanupE2ECrashpad(userDataDir)
 }
diff --git a/tests/e2e/helpers/electron-process-shutdown.unit.test.ts b/tests/e2e/helpers/electron-process-shutdown.unit.test.ts
new file mode 100644
index 00000000000..316aec32ed5
--- /dev/null
+++ b/tests/e2e/helpers/electron-process-shutdown.unit.test.ts
@@ -0,0 +1,59 @@
+import { EventEmitter } from 'node:events'
+import { PassThrough } from 'node:stream'
+import type { ChildProcess } from 'node:child_process'
+import type { ElectronApplication } from '@stablyai/playwright-test'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { closeElectronAppForE2E } from './electron-process-shutdown'
+
+function exitedAppFixture() {
+  const proc = Object.assign(new EventEmitter(), {
+    exitCode: null as number | null,
+    signalCode: null,
+    stdio: [new PassThrough(), new PassThrough(), new PassThrough()]
+  })
+  const pipesClosed = Promise.all(
+    proc.stdio.map((stream) => new Promise<void>((resolve) => stream.once('close', resolve)))
+  )
+  const close = vi.fn(() => pipesClosed)
+  const app = {
+    process: () => proc as unknown as ChildProcess,
+    close
+  } as unknown as ElectronApplication
+  return { proc, app, close }
+}
+
+afterEach(() => vi.useRealTimers())
+
+describe('Electron shutdown with inherited pipes', () => {
+  it('releases retained pipes only after Electron exits, settling Playwright cleanup', async () => {
+    const { proc, app, close } = exitedAppFixture()
+    const closing = closeElectronAppForE2E(app)
+    expect(close).toHaveBeenCalledOnce()
+    expect(proc.stdio.every((stream) => !stream.destroyed)).toBe(true)
+    proc.exitCode = 0
+    proc.emit('exit', 0, null)
+    await closing
+    expect(proc.stdio.every((stream) => stream.destroyed)).toBe(true)
+    expect(proc.listenerCount('exit')).toBe(0)
+  })
+
+  it('releases pipes when Electron already exited before cleanup starts', async () => {
+    const { proc, app } = exitedAppFixture()
+    proc.exitCode = 0
+    await closeElectronAppForE2E(app)
+    expect(proc.stdio.every((stream) => stream.destroyed)).toBe(true)
+  })
+
+  it('does not release pipes if shutdown times out without confirmed process exit', async () => {
+    vi.useFakeTimers()
+    const { proc, app } = exitedAppFixture()
+    const closing = closeElectronAppForE2E(app)
+    await vi.advanceTimersByTimeAsync(10_000)
+    await closing
+    expect(proc.stdio.every((stream) => !stream.destroyed)).toBe(true)
+    expect(proc.listenerCount('exit')).toBe(0)
+    for (const stream of proc.stdio) {
+      stream.destroy()
+    }
+  })
+})
diff --git a/tests/e2e/helpers/git-status-retry-barrier.ts b/tests/e2e/helpers/git-status-retry-barrier.ts
new file mode 100644
index 00000000000..e166313d003
--- /dev/null
+++ b/tests/e2e/helpers/git-status-retry-barrier.ts
@@ -0,0 +1,61 @@
+import type { ElectronApplication } from '@stablyai/playwright-test'
+
+type StatusArgs = { worktreePath?: string; admissionTier?: string }
+type StatusHandler = (event: unknown, args?: StatusArgs) => unknown
+type RetryBarrier = {
+  captured: boolean
+  release: () => void
+  original: StatusHandler
+}
+type BarrierScope = typeof globalThis & { __gitStatusRetryBarrier?: RetryBarrier }
+
+export async function installGitStatusRetryBarrier(
+  app: ElectronApplication,
+  repoPath: string
+): Promise<void> {
+  await app.evaluate(({ ipcMain }, repoPath) => {
+    const scope = globalThis as BarrierScope
+    const handlers = (ipcMain as unknown as { _invokeHandlers: Map<string, StatusHandler> })
+      ._invokeHandlers
+    const original = handlers.get('git:status')
+    if (!original || scope.__gitStatusRetryBarrier) {
+      throw new Error('Git status handler unavailable or retry barrier already installed')
+    }
+    let release!: () => void
+    const pending = new Promise<void>((resolve) => {
+      release = resolve
+    })
+    const state: RetryBarrier = { captured: false, release, original }
+    scope.__gitStatusRetryBarrier = state
+    handlers.set('git:status', async (event, args) => {
+      if (
+        !state.captured &&
+        args?.worktreePath === repoPath &&
+        args.admissionTier === 'interactive'
+      ) {
+        state.captured = true
+        await pending
+      }
+      return original(event, args)
+    })
+  }, repoPath)
+}
+
+export async function hasCapturedGitStatusRetry(app: ElectronApplication): Promise<boolean> {
+  return app.evaluate(() => (globalThis as BarrierScope).__gitStatusRetryBarrier?.captured ?? false)
+}
+
+export async function restoreGitStatusRetryHandler(app: ElectronApplication): Promise<void> {
+  await app.evaluate(({ ipcMain }) => {
+    const scope = globalThis as BarrierScope
+    const state = scope.__gitStatusRetryBarrier
+    if (!state) {
+      return
+    }
+    const handlers = (ipcMain as unknown as { _invokeHandlers: Map<string, StatusHandler> })
+      ._invokeHandlers
+    handlers.set('git:status', state.original)
+    state.release()
+    delete scope.__gitStatusRetryBarrier
+  })
+}
diff --git a/tests/e2e/helpers/git-status-retry-barrier.unit.test.ts b/tests/e2e/helpers/git-status-retry-barrier.unit.test.ts
new file mode 100644
index 00000000000..74bdd8d8159
--- /dev/null
+++ b/tests/e2e/helpers/git-status-retry-barrier.unit.test.ts
@@ -0,0 +1,39 @@
+import type { ElectronApplication } from '@stablyai/playwright-test'
+import { describe, expect, it, vi } from 'vitest'
+import {
+  hasCapturedGitStatusRetry,
+  installGitStatusRetryBarrier,
+  restoreGitStatusRetryHandler
+} from './git-status-retry-barrier'
+
+describe('Git status retry barrier', () => {
+  it('holds the target interactive request and restores the real handler on cleanup', async () => {
+    const original = vi.fn(async (_event: unknown, args: unknown) => args)
+    const handlers = new Map([['git:status', original]])
+    const app = {
+      evaluate: (callback: (electron: unknown, arg?: unknown) => unknown, arg?: unknown) =>
+        Promise.resolve(callback({ ipcMain: { _invokeHandlers: handlers } }, arg))
+    } as unknown as ElectronApplication
+    await installGitStatusRetryBarrier(app, 'target-repo')
+    try {
+      const handler = handlers.get('git:status')!
+      const background = { worktreePath: 'target-repo', admissionTier: 'background' }
+      const otherRepo = { worktreePath: 'another-repo', admissionTier: 'interactive' }
+      await expect(handler({}, background)).resolves.toEqual(background)
+      await expect(handler({}, otherRepo)).resolves.toEqual(otherRepo)
+      expect(await hasCapturedGitStatusRetry(app)).toBe(false)
+
+      const retry = { worktreePath: 'target-repo', admissionTier: 'interactive' }
+      const event = {}
+      const pending = handler(event, retry)
+      expect(await hasCapturedGitStatusRetry(app)).toBe(true)
+      expect(original).toHaveBeenCalledTimes(2)
+      await restoreGitStatusRetryHandler(app)
+      await expect(pending).resolves.toEqual(retry)
+      expect(original).toHaveBeenLastCalledWith(event, retry)
+      expect(handlers.get('git:status')).toBe(original)
+    } finally {
+      await restoreGitStatusRetryHandler(app)
+    }
+  })
+})
diff --git a/tests/e2e/helpers/paired-client-window-reveal.ts b/tests/e2e/helpers/paired-client-window-reveal.ts
index 302d573c3d1..1ec5b635d77 100644
--- a/tests/e2e/helpers/paired-client-window-reveal.ts
+++ b/tests/e2e/helpers/paired-client-window-reveal.ts
@@ -29,22 +29,24 @@ export function assertPairedClientWindowRevealed(report: PairedClientWindowRevea
 export type PairedClientWindowFocusReport = PairedClientWindowRevealReport & { isFocused: boolean }
 
 /**
- * Brings a paired client to the front, which a launched-but-background window never is. Main-side
- * policies that ask whether the reader is looking at a WebContents read the OS focus state, so a
- * spec driving real presses through such a policy has to put the window there first.
+ * Native-focus coverage must run on an isolated display or CI, never in background mode.
  */
 export async function focusPairedClientWindow(
   client: RevealablePairedClient,
   { timeoutMs = 15_000 }: { timeoutMs?: number } = {}
 ): Promise<PairedClientWindowFocusReport> {
+  await client.app.evaluate(() => {
+    if (process.env.ORCA_BACKGROUND_LAUNCH === '1') {
+      throw new Error('Native focus is forbidden by ORCA_BACKGROUND_LAUNCH')
+    }
+  })
   const revealed = await revealPairedClientWindow(client)
   const deadline = Date.now() + timeoutMs
   let isFocused = false
   while (!isFocused) {
     isFocused = await client.app.evaluate(({ app, BrowserWindow }) => {
       const window = BrowserWindow.getAllWindows()[0]
-      // Why steal: nothing else in the run is asking for the front, and the window manager keeps
-      // the launching terminal there otherwise.
+      // Native-focus coverage requires a dedicated foreground session.
       app.focus({ steal: true })
       window?.focus()
       return window?.isFocused() ?? false
@@ -61,6 +63,9 @@ export async function revealPairedClientWindow(
   client: RevealablePairedClient
 ): Promise<PairedClientWindowRevealReport> {
   const report = await client.app.evaluate(({ BrowserWindow }) => {
+    if (process.env.ORCA_BACKGROUND_LAUNCH === '1') {
+      throw new Error('Window reveal is forbidden by ORCA_BACKGROUND_LAUNCH')
+    }
     const windows = BrowserWindow.getAllWindows()
     const window = windows[0]
     const wasVisible = window?.isVisible() ?? false
diff --git a/tests/e2e/helpers/paired-client-window-reveal.unit.test.ts b/tests/e2e/helpers/paired-client-window-reveal.unit.test.ts
index dfb83e4c441..706088e6762 100644
--- a/tests/e2e/helpers/paired-client-window-reveal.unit.test.ts
+++ b/tests/e2e/helpers/paired-client-window-reveal.unit.test.ts
@@ -1,5 +1,10 @@
-import { describe, expect, it } from 'vitest'
-import { assertPairedClientWindowRevealed } from './paired-client-window-reveal'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import {
+  assertPairedClientWindowRevealed,
+  focusPairedClientWindow,
+  revealPairedClientWindow,
+  type RevealablePairedClient
+} from './paired-client-window-reveal'
 
 describe('assertPairedClientWindowRevealed', () => {
   it('accepts a window that the reveal made visible', () => {
@@ -42,3 +47,41 @@ describe('assertPairedClientWindowRevealed', () => {
     ).toThrow(/stayed hidden after showInactive\(\)/)
   })
 })
+
+describe('paired client background safety', () => {
+  afterEach(() => vi.unstubAllEnvs())
+
+  function makeClient() {
+    const showInactive = vi.fn()
+    const focus = vi.fn()
+    const getAllWindows = vi.fn(() => [{ isVisible: () => false, showInactive, focus }])
+    const evaluate = vi.fn(async (callback) =>
+      callback({
+        app: { focus },
+        BrowserWindow: { getAllWindows }
+      })
+    )
+    const client = {
+      app: { evaluate },
+      page: { waitForFunction: vi.fn() }
+    } as unknown as RevealablePairedClient
+    return { client, showInactive, focus, getAllWindows }
+  }
+
+  it('rejects an explicit reveal before touching native windows', async () => {
+    vi.stubEnv('ORCA_BACKGROUND_LAUNCH', '1')
+    const { client, getAllWindows, showInactive } = makeClient()
+    await expect(revealPairedClientWindow(client)).rejects.toThrow('Window reveal is forbidden')
+    expect(getAllWindows).not.toHaveBeenCalled()
+    expect(showInactive).not.toHaveBeenCalled()
+  })
+
+  it.each(['0', '1'])('rejects focus in background mode with foreground=%s', async (foreground) => {
+    vi.stubEnv('ORCA_BACKGROUND_LAUNCH', '1')
+    vi.stubEnv('ORCA_E2E_FOREGROUND', foreground)
+    const { client, focus, getAllWindows } = makeClient()
+    await expect(focusPairedClientWindow(client)).rejects.toThrow('Native focus is forbidden')
+    expect(getAllWindows).not.toHaveBeenCalled()
+    expect(focus).not.toHaveBeenCalled()
+  })
+})
diff --git a/tests/e2e/helpers/remote-skill-cloud-fixture.ts b/tests/e2e/helpers/remote-skill-cloud-fixture.ts
index f1d28d926b7..8e1650947dd 100644
--- a/tests/e2e/helpers/remote-skill-cloud-fixture.ts
+++ b/tests/e2e/helpers/remote-skill-cloud-fixture.ts
@@ -8,13 +8,12 @@ import {
 } from '../../../src/main/skills/skill-package-creation'
 import { SKILL_PACKAGE_CONTENT_TYPE } from '../../../src/shared/skill-package-manifest'
 
-export const REMOTE_SKILL_CLOUD_PORT = Number(process.env.ORCA_E2E_SKILL_CLOUD_PORT ?? '43961')
-export const REMOTE_SKILL_CLOUD_ORIGIN = `http://127.0.0.1:${REMOTE_SKILL_CLOUD_PORT}`
 export const REMOTE_SKILL_PACKAGE_ID = 'package_remote_e2e'
 export const REMOTE_SKILL_VERSION_ID = 'version_remote_e2e'
 export const REMOTE_SKILL_NAME = 'remote-e2e-skill'
 
 export type RemoteSkillCloudFixture = {
+  origin: string
   archive: CreatedSkillPackage
   bytes: Buffer
   requests: { method: string; path: string; body: unknown }[]
@@ -39,19 +38,30 @@ export async function startRemoteSkillCloudFixture(): Promise<RemoteSkillCloudFi
   })
   const bytes = await readFile(archive.archivePath)
   const requests: RemoteSkillCloudFixture['requests'] = []
+  let origin = ''
   const server = createServer((request, response) => {
-    void handleRemoteSkillCloudRequest({ request, response, archive, bytes, requests }).catch(
-      (error) => {
-        response.writeHead(500, { 'content-type': 'application/json' })
-        response.end(JSON.stringify({ code: 'fixture_failed', message: String(error) }))
-      }
-    )
+    void handleRemoteSkillCloudRequest({
+      request,
+      response,
+      archive,
+      bytes,
+      requests,
+      origin
+    }).catch((error) => {
+      response.writeHead(500, { 'content-type': 'application/json' })
+      response.end(JSON.stringify({ code: 'fixture_failed', message: String(error) }))
+    })
   })
   await new Promise<void>((resolve, reject) => {
     server.once('error', reject)
-    server.listen(REMOTE_SKILL_CLOUD_PORT, '127.0.0.1', resolve)
+    server.listen(Number(process.env.ORCA_E2E_SKILL_CLOUD_PORT ?? 0), '127.0.0.1', resolve)
   })
-  return { archive, bytes, requests, root, server }
+  const address = server.address()
+  if (!address || typeof address === 'string') {
+    throw new Error('Skill fixture has no TCP address')
+  }
+  origin = `http://127.0.0.1:${address.port}`
+  return { archive, bytes, requests, root, server, origin }
 }
 
 export async function stopRemoteSkillCloudFixture(fixture: RemoteSkillCloudFixture): Promise<void> {
@@ -60,13 +70,14 @@ export async function stopRemoteSkillCloudFixture(fixture: RemoteSkillCloudFixtu
 }
 
 async function handleRemoteSkillCloudRequest(input: {
+  origin: string
   request: IncomingMessage
   response: ServerResponse
   archive: CreatedSkillPackage
   bytes: Buffer
   requests: RemoteSkillCloudFixture['requests']
 }): Promise<void> {
-  const path = new URL(input.request.url ?? '/', REMOTE_SKILL_CLOUD_ORIGIN).pathname
+  const path = new URL(input.request.url ?? '/', input.origin).pathname
   if (input.request.method === 'GET' && path === '/package.tar.gz') {
     input.requests.push({ method: 'GET', path, body: null })
     input.response.writeHead(200, {
@@ -84,17 +95,19 @@ async function handleRemoteSkillCloudRequest(input: {
     const body = JSON.parse(await readRequestBody(input.request)) as unknown
     input.requests.push({ method: 'POST', path, body })
     input.response.writeHead(200, { 'content-type': 'application/json' })
-    input.response.end(JSON.stringify(downloadGrant(input.archive, input.bytes.length)))
+    input.response.end(
+      JSON.stringify(downloadGrant(input.archive, input.bytes.length, input.origin))
+    )
     return
   }
   input.response.writeHead(404, { 'content-type': 'application/json' })
   input.response.end(JSON.stringify({ code: 'not_found', message: 'Not found' }))
 }
 
-function downloadGrant(archive: CreatedSkillPackage, compressedBytes: number) {
+function downloadGrant(archive: CreatedSkillPackage, compressedBytes: number, origin: string) {
   return {
     grant: {
-      url: `${REMOTE_SKILL_CLOUD_ORIGIN}/package.tar.gz`,
+      url: `${origin}/package.tar.gz`,
       expiresAt: '2099-01-01T00:00:00.000Z'
     },
     version: {
diff --git a/tests/e2e/helpers/remote-skill-cloud-fixture.unit.test.ts b/tests/e2e/helpers/remote-skill-cloud-fixture.unit.test.ts
new file mode 100644
index 00000000000..70291cf0e8f
--- /dev/null
+++ b/tests/e2e/helpers/remote-skill-cloud-fixture.unit.test.ts
@@ -0,0 +1,41 @@
+import { expect, it, vi } from 'vitest'
+import {
+  REMOTE_SKILL_PACKAGE_ID,
+  REMOTE_SKILL_VERSION_ID,
+  startRemoteSkillCloudFixture,
+  stopRemoteSkillCloudFixture
+} from './remote-skill-cloud-fixture'
+
+it('serves concurrent skill fixtures from independent bound origins', async () => {
+  vi.stubEnv('ORCA_E2E_SKILL_CLOUD_PORT', undefined)
+  const results = await Promise.allSettled([
+    startRemoteSkillCloudFixture(),
+    startRemoteSkillCloudFixture()
+  ])
+  const fixtures = results.flatMap((result) =>
+    result.status === 'fulfilled' ? [result.value] : []
+  )
+  try {
+    expect(results.every((result) => result.status === 'fulfilled')).toBe(true)
+    expect(new Set(fixtures.map((fixture) => fixture.origin)).size).toBe(2)
+    for (const fixture of fixtures) {
+      const response = await fetch(
+        `${fixture.origin}/v1/skill-packages/${REMOTE_SKILL_PACKAGE_ID}/versions/${REMOTE_SKILL_VERSION_ID}/download-grants`,
+        {
+          method: 'POST',
+          body: '{}',
+          headers: { 'content-type': 'application/json' }
+        }
+      )
+      expect(response.status).toBe(200)
+      const result = (await response.json()) as { grant: { url: string } }
+      expect(result.grant.url).toBe(`${fixture.origin}/package.tar.gz`)
+      const archive = await fetch(result.grant.url)
+      expect(Buffer.from(await archive.arrayBuffer())).toEqual(fixture.bytes)
+      expect(fixture.requests).toHaveLength(2)
+    }
+  } finally {
+    await Promise.all(fixtures.map(stopRemoteSkillCloudFixture))
+    vi.unstubAllEnvs()
+  }
+})
diff --git a/tests/e2e/helpers/seeded-test-repo.ts b/tests/e2e/helpers/seeded-test-repo.ts
index dd88351b282..34c4f346714 100644
--- a/tests/e2e/helpers/seeded-test-repo.ts
+++ b/tests/e2e/helpers/seeded-test-repo.ts
@@ -28,7 +28,7 @@ export function isValidGitRepo(repoPath: string): boolean {
   }
 }
 
-export function createSeededTestRepo(): string {
+export function createSeededTestRepo(options: { publishPath?: boolean } = {}): string {
   // Why: realpathSync so the seeded path matches the store's repo.path on
   // macOS, where os.tmpdir() (/var/...) symlinks to /private/var/... and the
   // app canonicalizes repo.path via `git rev-parse --show-toplevel` on add.
@@ -63,6 +63,8 @@ export function createSeededTestRepo(): string {
     stdio: 'pipe'
   })
 
-  writeFileSync(TEST_REPO_PATH_FILE, testRepoDir)
+  if (options.publishPath !== false) {
+    writeFileSync(TEST_REPO_PATH_FILE, testRepoDir)
+  }
   return testRepoDir
 }
diff --git a/tests/e2e/helpers/sidebar-project-dialog.ts b/tests/e2e/helpers/sidebar-project-dialog.ts
new file mode 100644
index 00000000000..0cd4c453b5d
--- /dev/null
+++ b/tests/e2e/helpers/sidebar-project-dialog.ts
@@ -0,0 +1,9 @@
+import { expect, type Page } from '@stablyai/playwright-test'
+
+export async function openSidebarProjectDialog(page: Page): Promise<void> {
+  // The compact overflow retains standalone project import; the composer hosts a different flow.
+  await page.evaluate(() => window.__store!.getState().setSidebarWidth(220))
+  await page.getByRole('button', { name: 'More workspace actions', exact: true }).click()
+  await page.getByRole('menuitem', { name: 'Add Project', exact: true }).click()
+  await expect(page.getByRole('dialog', { name: /Add a project/i })).toBeVisible()
+}
diff --git a/tests/e2e/helpers/source-control-ai-generation.ts b/tests/e2e/helpers/source-control-ai-generation.ts
index f6be16d7342..c93a20e37a1 100644
--- a/tests/e2e/helpers/source-control-ai-generation.ts
+++ b/tests/e2e/helpers/source-control-ai-generation.ts
@@ -67,7 +67,7 @@ export async function seedCreatePrComposer(page: Page): Promise<{
   prWorktreePath: string
   primaryBranch: string
 }> {
-  return page.evaluate(async () => {
+  const seeded = await page.evaluate(async () => {
     const store =
       window.__store ??
       (() => {
@@ -101,6 +101,7 @@ export async function seedCreatePrComposer(page: Page): Promise<{
     const eligibility = {
       provider: 'github' as const,
       review: null,
+      reviewLookupOutcome: 'not_found' as const,
       canCreate: true,
       blockedReason: null,
       nextAction: null,
@@ -121,7 +122,7 @@ export async function seedCreatePrComposer(page: Page): Promise<{
         ...current.remoteStatusesByWorktree,
         [prWorktree.id]: {
           hasUpstream: true,
-          upstreamName: `origin/${branch}`,
+          upstreamName: primaryBranch,
           ahead: 0,
           behind: 0
         }
@@ -130,6 +131,10 @@ export async function seedCreatePrComposer(page: Page): Promise<{
         args.branch === branch ? eligibility : { ...eligibility, canCreate: false },
       fetchHostedReviewForBranch: async () => null,
       fetchPRForBranch: async () => null,
+      enqueueGitHubPRRefresh: () => undefined,
+      // Ignore provider work queued before this generation-only fixture was installed.
+      getEffectiveGitHubPRRefreshState: () => undefined,
+      prRefreshStates: {},
       fetchUpstreamStatus: async () => undefined,
       setUpstreamStatus: () => undefined
     }))
@@ -141,6 +146,12 @@ export async function seedCreatePrComposer(page: Page): Promise<{
       primaryBranch
     }
   })
+  // Checks reads fresh Git state instead of the seeded store cache.
+  execFileSync('git', ['branch', '--set-upstream-to', seeded.primaryBranch], {
+    cwd: seeded.prWorktreePath,
+    stdio: 'pipe'
+  })
+  return seeded
 }
 
 export async function seedCommitMessageComposer(page: Page): Promise<{
diff --git a/tests/e2e/helpers/source-control-ai-generators.ts b/tests/e2e/helpers/source-control-ai-generators.ts
index be3f1b43247..8c09bb8b556 100644
--- a/tests/e2e/helpers/source-control-ai-generators.ts
+++ b/tests/e2e/helpers/source-control-ai-generators.ts
@@ -14,13 +14,13 @@ async function setCustomGenerator(page: Page, scriptPath: string): Promise<void>
     }
     await store.getState().updateSettings({
       activeRuntimeEnvironmentId: null,
-      commitMessageAi: {
-        ...currentSettings.commitMessageAi,
+      sourceControlAi: {
         enabled: true,
         agentId: 'custom' as const,
         selectedModelByAgent: {},
         selectedThinkingByModel: {},
-        customPrompt: '',
+        instructionsByOperation: {},
+        actions: {},
         customAgentCommand: `node ${JSON.stringify(scriptPath)}`
       }
     })
diff --git a/tests/e2e/helpers/source-control-generation-app.ts b/tests/e2e/helpers/source-control-generation-app.ts
new file mode 100644
index 00000000000..2a1d00ca390
--- /dev/null
+++ b/tests/e2e/helpers/source-control-generation-app.ts
@@ -0,0 +1,21 @@
+import { test as base, expect } from './orca-app'
+import { createSeededTestRepo } from './seeded-test-repo'
+import { cleanupTestRepository } from '../global-teardown'
+
+export { expect }
+
+export const test = base.extend({
+  testRepoPath: [
+    // oxlint-disable-next-line no-empty-pattern -- Playwright requires destructured fixture arguments.
+    async ({}, provideFixture) => {
+      // Generation must not fetch external remotes installed by unrelated specs.
+      const repoPath = createSeededTestRepo({ publishPath: false })
+      try {
+        await provideFixture(repoPath)
+      } finally {
+        cleanupTestRepository(repoPath)
+      }
+    },
+    { scope: 'worker' }
+  ]
+})
diff --git a/tests/e2e/helpers/ssh-config-host-picker.ts b/tests/e2e/helpers/ssh-config-host-picker.ts
index 482eb9ed84e..bad31c818d9 100644
--- a/tests/e2e/helpers/ssh-config-host-picker.ts
+++ b/tests/e2e/helpers/ssh-config-host-picker.ts
@@ -1,3 +1,4 @@
+import { openSidebarProjectDialog } from './sidebar-project-dialog'
 /**
  * Shared helpers for SSH config host picker / import E2E specs.
  * Prefer role/label locators and user-visible copy over ids / data-*.
@@ -72,23 +73,36 @@ export async function closeSettingsPage(page: Page): Promise<void> {
 
 export async function closeOpenDialogs(page: Page): Promise<void> {
   for (let attempt = 0; attempt < 5; attempt += 1) {
+    // Nested dialogs can finish their exit animations in different frames.
+    await expect(page.locator('[role="dialog"][data-state="closed"]')).toHaveCount(0, {
+      timeout: 3_000
+    })
     const dialogCount = await page.getByRole('dialog').count()
     if (dialogCount === 0) {
       return
     }
-    const dialog = page.getByRole('dialog').last()
-    const cancelOrBack = dialog.getByRole('button', { name: /^(Cancel|Back)$/ })
-    await ((await cancelOrBack
-      .first()
-      .isVisible()
-      .catch(() => false))
-      ? cancelOrBack.first().click()
-      : page.keyboard.press('Escape'))
-    await expect
-      .poll(async () => page.getByRole('dialog').count(), { timeout: 3_000 })
-      .toBeLessThan(dialogCount)
-      .catch(() => undefined)
+    const dialogId = await page.getByRole('dialog').last().getAttribute('id')
+    if (!dialogId) {
+      throw new Error('Open dialog is missing its Radix identity')
+    }
+    const dialog = page.locator(`[role="dialog"][id=${JSON.stringify(dialogId)}]`)
+    const back = dialog.getByRole('button', { name: 'Back', exact: true })
+    if (await back.isVisible()) {
+      await back.click()
+      // The picker and host form reuse the same Radix dialog.
+      await expect(back).toBeHidden({ timeout: 3_000 })
+      await expect(dialog.getByRole('button', { name: 'Cancel', exact: true })).toBeVisible({
+        timeout: 3_000
+      })
+      continue
+    }
+    const cancel = dialog.getByRole('button', { name: 'Cancel', exact: true })
+    await ((await cancel.isVisible()) ? cancel.click() : page.keyboard.press('Escape'))
+    // Hidden Electron windows can park CSS exits before their first compositor frame.
+    await page.screenshot({ animations: 'disabled' })
+    await expect(dialog).toBeHidden({ timeout: 3_000 })
   }
+  await expect(page.getByRole('dialog')).toHaveCount(0, { timeout: 3_000 })
 }
 
 /** Leave settings / overlays so the main shell (Add Project) is reachable. */
@@ -101,10 +115,7 @@ export async function returnToAppShell(page: Page): Promise<void> {
 /** Add Project → Host → Add remote host → Add SSH host → form dialog. */
 export async function openAddSshHostDialog(page: Page): Promise<Locator> {
   await returnToAppShell(page)
-  await page
-    .getByRole('button', { name: /Add Project/i })
-    .first()
-    .click()
+  await openSidebarProjectDialog(page)
   const addProjectDialog = page.getByRole('dialog', { name: /Add a project/i })
   await expect(addProjectDialog).toBeVisible({ timeout: 10_000 })
 
diff --git a/tests/e2e/helpers/ssh-recovery-input-observation.ts b/tests/e2e/helpers/ssh-recovery-input-observation.ts
new file mode 100644
index 00000000000..06b4bd7de3e
--- /dev/null
+++ b/tests/e2e/helpers/ssh-recovery-input-observation.ts
@@ -0,0 +1,53 @@
+import type { Page, TestInfo } from '@playwright/test'
+import type { RuntimeTerminalListResult } from '../../../src/shared/runtime-types'
+
+export async function attachSshRecoveryInputObservation(
+  page: Page,
+  testInfo: TestInfo,
+  targetId: string,
+  originalPtyId: string,
+  label: string
+): Promise<void> {
+  const observation = await page.evaluate(
+    async ({ targetId, originalPtyId }) => {
+      const state = window.__store?.getState()
+      const panes = [...(window.__paneManagers?.entries() ?? [])].flatMap(([tabId, manager]) =>
+        manager.getPanes().map((pane) => ({
+          tabId,
+          leafId: pane.leafId,
+          ptyId: pane.container.dataset.ptyId,
+          active: manager.getActivePane()?.id === pane.id
+        }))
+      )
+      let timer: ReturnType<typeof setTimeout> | undefined
+      try {
+        const runtime = await Promise.race([
+          window.api.runtime
+            .call({ method: 'terminal.list', params: { limit: 50, includeVisualLayouts: false } })
+            .then((response) =>
+              response.ok
+                ? { terminals: (response.result as RuntimeTerminalListResult).terminals }
+                : { error: response.error }
+            ),
+          new Promise<{ error: string }>((resolve) => {
+            timer = setTimeout(() => resolve({ error: 'Observation timed out' }), 1000)
+          })
+        ])
+        return {
+          originalPtyId,
+          authority: state?.sshConnectionStates.get(targetId),
+          activeWorktreeId: state?.activeWorktreeId,
+          panes,
+          runtime
+        }
+      } finally {
+        clearTimeout(timer)
+      }
+    },
+    { targetId, originalPtyId }
+  )
+  await testInfo.attach(`ssh-input-${label}.json`, {
+    body: JSON.stringify(observation, null, 2),
+    contentType: 'application/json'
+  })
+}
diff --git a/tests/e2e/helpers/startup-exec-readiness-oracle.ts b/tests/e2e/helpers/startup-exec-readiness-oracle.ts
index 577702c8ea0..7aa56e38863 100644
--- a/tests/e2e/helpers/startup-exec-readiness-oracle.ts
+++ b/tests/e2e/helpers/startup-exec-readiness-oracle.ts
@@ -9,6 +9,7 @@ import type {
 import { toWebTerminalSurfaceTabId } from '../../../src/shared/terminal-surface-id'
 import { expect } from './orca-app'
 import { getTerminalContent, waitForActivePanePtyId } from './terminal'
+import { readFreshTerminalInventory } from './terminal-inventory-observation'
 
 const RECOVERY_DEADLINE_MS = 8_000
 
@@ -76,10 +77,6 @@ function count(text: string, marker: string): number {
   return text.split(marker).length - 1
 }
 
-function isTransientPtyLivenessError(error: unknown): boolean {
-  return error instanceof Error && error.message.includes('terminal_liveness_unavailable')
-}
-
 async function expectSingleOwningPty(
   page: Page,
   worktreeId: string,
@@ -90,24 +87,15 @@ async function expectSingleOwningPty(
   await expect
     .poll(
       async () => {
-        try {
-          const listed = await callStartupExecRuntime<RuntimeTerminalListResult>(
-            page,
-            'terminal.list',
-            {
-              worktree: `id:${worktreeId}`,
-              requireFreshPtyLiveness: true
-            }
-          )
-          return listed.terminals
-            .filter((candidate) => candidate.tabId === tabId)
-            .map((candidate) => ({ handle: candidate.handle, ptyId: candidate.ptyId }))
-        } catch (error) {
-          if (isTransientPtyLivenessError(error)) {
-            return []
-          }
-          throw error
-        }
+        const listed = await readFreshTerminalInventory(() =>
+          callStartupExecRuntime<RuntimeTerminalListResult>(page, 'terminal.list', {
+            worktree: `id:${worktreeId}`,
+            requireFreshPtyLiveness: true
+          })
+        )
+        return (listed?.terminals ?? [])
+          .filter((candidate) => candidate.tabId === tabId)
+          .map((candidate) => ({ handle: candidate.handle, ptyId: candidate.ptyId }))
       },
       { timeout: 30_000 }
     )
diff --git a/tests/e2e/helpers/terminal-inventory-observation.ts b/tests/e2e/helpers/terminal-inventory-observation.ts
new file mode 100644
index 00000000000..0fcefdb23c8
--- /dev/null
+++ b/tests/e2e/helpers/terminal-inventory-observation.ts
@@ -0,0 +1,14 @@
+import type { RuntimeTerminalListResult } from '../../../src/shared/runtime-types'
+
+export async function readFreshTerminalInventory(
+  read: () => Promise<RuntimeTerminalListResult>
+): Promise<RuntimeTerminalListResult | null> {
+  try {
+    return await read()
+  } catch (error) {
+    if (error instanceof Error && error.message.includes('terminal_liveness_unavailable')) {
+      return null
+    }
+    throw error
+  }
+}
diff --git a/tests/e2e/live-background-terminal-mount-authority.spec.ts b/tests/e2e/live-background-terminal-mount-authority.spec.ts
index ea6ffd1871a..a785454f695 100644
--- a/tests/e2e/live-background-terminal-mount-authority.spec.ts
+++ b/tests/e2e/live-background-terminal-mount-authority.spec.ts
@@ -23,6 +23,10 @@ import type {
 } from '../../src/shared/runtime-types'
 import { PROTOCOL_VERSION } from '../../src/main/daemon/types'
 import { makePaneKey } from '../../src/shared/stable-pane-id'
+import {
+  buildFakeAgentCommandOverride,
+  FAKE_AGENT_WINDOWS_SHELL
+} from './helpers/fake-agent-command-override'
 
 type SpawnEvent = { args: string[]; pid: number }
 type TerminalIdentity = Pick<
@@ -70,6 +74,10 @@ if (process.platform === 'win32') {
   chmodSync(executable, 0o755)
 }
 
+const fakeCodexCommand = buildFakeAgentCommandOverride(
+  path.join(fakeCliDir, process.platform === 'win32' ? 'codex.cmd' : 'codex')
+)
+
 const test = base.extend({
   launchEnv: [
     {
@@ -535,23 +543,28 @@ test('adopts runtime-owned agent and Setup PTYs on first mount', async ({
   const repoId = added.result.repo.id
   await expect
     .poll(() =>
-      orcaPage.evaluate(async (repoId) => {
-        const state = window.__store?.getState()
-        await state?.fetchRepos()
-        const repo = window.__store?.getState().repos.find((candidate) => candidate.id === repoId)
-        if (!repo) {
-          return false
-        }
-        await window.__store?.getState().updateRepo(repoId, {
-          hookSettings: { ...repo.hookSettings, setupAgentStartupPolicy: 'start-immediately' }
-        })
-        await window.__store?.getState().updateSettings({
-          disabledTuiAgents: [],
-          setupScriptLaunchMode: 'new-tab',
-          terminalHiddenViewParking: false
-        })
-        return true
-      }, repoId)
+      orcaPage.evaluate(
+        async ({ repoId, command, windowsShell }) => {
+          const state = window.__store?.getState()
+          await state?.fetchRepos()
+          const repo = window.__store?.getState().repos.find((candidate) => candidate.id === repoId)
+          if (!repo) {
+            return false
+          }
+          await window.__store?.getState().updateRepo(repoId, {
+            hookSettings: { ...repo.hookSettings, setupAgentStartupPolicy: 'start-immediately' }
+          })
+          await window.__store?.getState().updateSettings({
+            agentCmdOverrides: { codex: command },
+            terminalWindowsShell: windowsShell,
+            disabledTuiAgents: [],
+            setupScriptLaunchMode: 'new-tab',
+            terminalHiddenViewParking: false
+          })
+          return true
+        },
+        { repoId, command: fakeCodexCommand, windowsShell: FAKE_AGENT_WINDOWS_SHELL }
+      )
     )
     .toBe(true)
 
diff --git a/tests/e2e/multi-client-navigation-isolation.spec.ts b/tests/e2e/multi-client-navigation-isolation.spec.ts
index c8a01eff636..1f281a9c264 100644
--- a/tests/e2e/multi-client-navigation-isolation.spec.ts
+++ b/tests/e2e/multi-client-navigation-isolation.spec.ts
@@ -1,3 +1,4 @@
+import { openSidebarProjectDialog } from './helpers/sidebar-project-dialog'
 import { execFileSync } from 'node:child_process'
 import { randomUUID } from 'node:crypto'
 import { mkdtempSync, rmSync } from 'node:fs'
@@ -343,10 +344,7 @@ test('routes Add Project folder browsing through the paired host', async ({
   const offer = await createPairingOffer(orcaPage)
   const client = await openPairedClient(electronApp, offer, visibleWorktreeId)
   try {
-    await client
-      .getByRole('button', { name: /Add Project/i })
-      .first()
-      .click()
+    await openSidebarProjectDialog(client)
     const addDialog = client.getByRole('dialog', { name: /Add a project/i })
     await expect(addDialog).toBeVisible()
     await expect(addDialog).not.toContainText('Local Mac')
diff --git a/tests/e2e/new-workspace-create-more.spec.ts b/tests/e2e/new-workspace-create-more.spec.ts
new file mode 100644
index 00000000000..b166d61dfe5
--- /dev/null
+++ b/tests/e2e/new-workspace-create-more.spec.ts
@@ -0,0 +1,106 @@
+import { writeFileSync } from 'node:fs'
+import { execFileSync } from 'node:child_process'
+import { test, expect } from './helpers/orca-app'
+import { waitForActiveWorktree, waitForSessionReady } from './helpers/store'
+
+test.use({ orcaAppExtraEnv: { ORCA_BACKGROUND_LAUNCH: '1' } })
+
+test('Create more clears the GitHub PR source before the next worktree', async ({
+  electronApp,
+  orcaPage,
+  testRepoPath
+}, testInfo) => {
+  await waitForSessionReady(orcaPage)
+  await waitForActiveWorktree(orcaPage)
+  const sha = execFileSync('git', ['rev-parse', 'HEAD'], {
+    cwd: testRepoPath,
+    encoding: 'utf8'
+  }).trim()
+  await electronApp.evaluate(({ ipcMain }, baseBranch) => {
+    ipcMain.removeHandler('worktrees:resolvePrBase')
+    ipcMain.handle('worktrees:resolvePrBase', () => ({ baseBranch }))
+  }, sha)
+  await orcaPage.evaluate(() => {
+    const store = window.__store!
+    const state = store.getState()
+    store.setState({ settings: { ...state.settings!, defaultTuiAgent: 'blank' } })
+  })
+  await orcaPage.getByRole('button', { name: 'New workspace', exact: true }).click()
+  await orcaPage.evaluate(() => {
+    const store = window.__store!
+    const repoId = store.getState().repos[0].id
+    const item = {
+      id: 'pr-4242',
+      provider: 'github' as const,
+      type: 'pr' as const,
+      number: 4242,
+      title: 'Fix workspace task reset',
+      state: 'open' as const,
+      url: 'https://github.com/acme/app/pull/4242',
+      labels: [],
+      updatedAt: '2026-09-01T00:00:00Z',
+      author: 'e2e',
+      repoId
+    }
+    store.setState({
+      getCachedWorkItems: () => [item],
+      fetchWorkItems: async () => [item],
+      fetchWorkItemsAcrossRepos: async () => ({
+        items: [item],
+        failedCount: 0,
+        githubUnavailable: false
+      })
+    })
+  })
+  const dialog = orcaPage.getByRole('dialog', { name: /Create (Workspace|Worktree)/i })
+  const input = dialog.locator('[data-workspace-name-input="true"]')
+  await input.click()
+  await orcaPage
+    .getByRole('option', { name: '#4242 Fix workspace task reset', exact: true })
+    .click()
+  const pill = dialog.locator('[data-workspace-source-pill="true"]')
+  await expect(pill).toContainText('Fix workspace task reset')
+  await dialog.getByRole('switch', { name: 'Create more' }).click()
+  await dialog.getByRole('button', { name: /^Create/ }).click()
+  await expect(dialog).toBeVisible()
+  await expect(input).toHaveValue('')
+  await expect
+    .poll(() =>
+      orcaPage.evaluate(() =>
+        window
+          .__store!.getState()
+          .allWorktrees()
+          .some((worktree) => worktree.linkedPR === 4242)
+      )
+    )
+    .toBe(true)
+  const cdp = await orcaPage.context().newCDPSession(orcaPage)
+  const screenshot = await cdp.send('Page.captureScreenshot')
+  const proofPath = testInfo.outputPath('create-more-result.png')
+  writeFileSync(proofPath, Buffer.from(screenshot.data, 'base64'))
+  await testInfo.attach('create-more-result.png', {
+    path: proofPath,
+    contentType: 'image/png'
+  })
+  await cdp.detach()
+  await expect(pill).toHaveCount(0)
+  await expect(dialog.getByRole('switch', { name: 'Create more' })).toHaveAttribute(
+    'aria-checked',
+    'true'
+  )
+  await input.fill('next-independent-worktree')
+  await dialog.getByRole('button', { name: /^Create/ }).click()
+  await expect
+    .poll(() =>
+      orcaPage.evaluate(() => {
+        const worktree = window
+          .__store!.getState()
+          .allWorktrees()
+          .find((entry) => entry.displayName === 'next-independent-worktree')
+        return worktree ? { linkedPR: worktree.linkedPR, linkedIssue: worktree.linkedIssue } : null
+      })
+    )
+    .toEqual({ linkedPR: null, linkedIssue: null })
+  await expect(input).toHaveValue('')
+  await expect(pill).toHaveCount(0)
+})
diff --git a/tests/e2e/orchestration-worker-terminal-visibility.spec.ts b/tests/e2e/orchestration-worker-terminal-visibility.spec.ts
index af603c8ca1f..32b0013ff5a 100644
--- a/tests/e2e/orchestration-worker-terminal-visibility.spec.ts
+++ b/tests/e2e/orchestration-worker-terminal-visibility.spec.ts
@@ -11,6 +11,10 @@ import {
   waitForSessionReady
 } from './helpers/store'
 import { waitForActivePaneHookDescriptor, waitForActivePanePtyId } from './helpers/terminal'
+import {
+  buildFakeAgentCommandOverride,
+  FAKE_AGENT_WINDOWS_SHELL
+} from './helpers/fake-agent-command-override'
 import { RuntimeClient } from '../../src/cli/runtime-client'
 import type { RuntimeTerminalListResult, RuntimeTerminalRead } from '../../src/shared/runtime-types'
 
@@ -111,6 +115,22 @@ test('worker-start preserves one live inactive worker across workspace re-entry'
   electronApp
 }) => {
   await waitForSessionReady(orcaPage)
+  await orcaPage.evaluate(
+    async ({ command, windowsShell }) => {
+      const state = window.__store!.getState()
+      await state.updateSettings({
+        agentCmdOverrides: { ...state.settings?.agentCmdOverrides, codex: command },
+        terminalWindowsShell: windowsShell
+      })
+    },
+    {
+      command: buildFakeAgentCommandOverride(
+        path.join(fakeCliDir, process.platform === 'win32' ? 'codex.cmd' : 'codex')
+      ),
+      windowsShell: FAKE_AGENT_WINDOWS_SHELL
+    }
+  )
+
   const worktreeId = await waitForActiveWorktree(orcaPage)
   await ensureTerminalVisible(orcaPage)
   const coordinatorTabId = await getActiveTabId(orcaPage)
@@ -160,7 +180,7 @@ test('worker-start preserves one live inactive worker across workspace re-entry'
 
   const terminals = await client.call<RuntimeTerminalListResult>('terminal.list')
   const workerTerminal = terminals.result.terminals.find(
-    (terminal) => terminal.title === 'Codex Ready'
+    (terminal) => terminal.handle === workerHandle
   )
   expect(workerTerminal?.tabId).toBeTruthy()
   expect(workerTerminal?.leafId).toBeTruthy()
diff --git a/tests/e2e/paired-remote-terminal-host-restart-background-sync.spec.ts b/tests/e2e/paired-remote-terminal-host-restart-background-sync.spec.ts
index 9855d8d92b0..cf2f96e9c84 100644
--- a/tests/e2e/paired-remote-terminal-host-restart-background-sync.spec.ts
+++ b/tests/e2e/paired-remote-terminal-host-restart-background-sync.spec.ts
@@ -283,6 +283,24 @@ async function expectTerminalInteractive(
 }
 
 async function moveHostAwayFromWorktree(page: Page, targetWorktreeId: string): Promise<string> {
+  await expect
+    .poll(
+      () =>
+        page.evaluate(async (targetId) => {
+          const state = window.__store?.getState()
+          const target = state?.allWorktrees().find((worktree) => worktree.id === targetId)
+          if (!state || !target) {
+            return false
+          }
+          await state.fetchWorktrees(target.repoId)
+          return window
+            .__store!.getState()
+            .allWorktrees()
+            .some((worktree) => worktree.repoId === target.repoId && worktree.id !== targetId)
+        }, targetWorktreeId),
+      { message: 'Seeded alternate host worktree never loaded' }
+    )
+    .toBe(true)
   const alternateWorktreeId = await page.evaluate((targetId) => {
     const state = window.__store?.getState()
     const alternate = state?.allWorktrees().find((worktree) => worktree.id !== targetId)
@@ -423,6 +441,9 @@ test('foregrounds a preserved daemon PTY after the paired host relaunches', asyn
     expect(reconnectControl.ptyId).not.toBe(target.ptyId)
     await openClientTab(client.page, worktreeId, reconnectControl.webTabId)
     await waitForPaneConnected(client.page, reconnectControl.webTabId)
+    await expect
+      .poll(() => readPaneContent(client!.page, reconnectControl.webTabId), { timeout: 30_000 })
+      .toContain('READY')
     await expectTerminalInteractive(client, reconnectControl, 'y')
   } finally {
     if (client) {
diff --git a/tests/e2e/paired-remote-terminal-materialization-reconnect.spec.ts b/tests/e2e/paired-remote-terminal-materialization-reconnect.spec.ts
index ef331ee6277..fda18fc74c6 100644
--- a/tests/e2e/paired-remote-terminal-materialization-reconnect.spec.ts
+++ b/tests/e2e/paired-remote-terminal-materialization-reconnect.spec.ts
@@ -16,6 +16,7 @@ import {
   launchPairedElectronClient
 } from './helpers/paired-electron-client'
 import { getTerminalContent, waitForActivePanePtyId } from './helpers/terminal'
+import { readFreshTerminalInventory } from './helpers/terminal-inventory-observation'
 
 const scratch = mkdtempSync(path.join(os.tmpdir(), 'orca-paired-materialize-'))
 const fixturePath = path.join(scratch, 'materialize-terminal.mjs')
@@ -316,18 +317,17 @@ async function runMaterializationJourney(
   await tab.click()
   await expect.poll(() => getTerminalContent(page), { timeout: 10_000 }).toContain(marker)
 
-  const listed = await callRuntime<RuntimeTerminalListResult>(
-    page,
-    environmentId,
-    'terminal.list',
-    {
-      worktree: `id:${worktreeId}`,
-      requireFreshPtyLiveness: true
-    }
-  )
-  expect(
-    listed.terminals.filter((terminal) => terminal.tabId === created.tab.parentTabId)
-  ).toHaveLength(1)
+  await expect
+    .poll(async () => {
+      const listed = await readFreshTerminalInventory(() =>
+        callRuntime<RuntimeTerminalListResult>(page, environmentId, 'terminal.list', {
+          worktree: `id:${worktreeId}`,
+          requireFreshPtyLiveness: true
+        })
+      )
+      return listed?.terminals.filter((terminal) => terminal.tabId === created.tab.parentTabId)
+    })
+    .toHaveLength(1)
   await callRuntime(page, environmentId, 'terminal.closeTab', { terminal: replacementHandle })
 }
 
@@ -354,15 +354,7 @@ test('materializes a stopped terminal on reconnect from a headed paired host', a
   }
 })
 
-// Why fixme: this journey's fault injection cannot be set up on a headless `orca serve` host.
-// `terminal.stopExact` keeps returning terminal_exact_stop_failed because stopAndWait's
-// keep-history verification window expires before the parked PTY is observed gone, so the pane
-// never reaches pending-handle and the reconnect behavior is never exercised. That precondition
-// fails identically on this PR's base, so it is a pre-existing exact-stop defect rather than a
-// reconnect-activation one. The recovery behavior itself was confirmed by hand in this topology
-// (the host materializes the pending surface and the client rebinds to the replacement PTY);
-// re-enable once exact stop settles deterministically against a serve host.
-test.fixme('materializes a stopped terminal on reconnect from a headless folder host', async ({
+test('materializes a stopped terminal on reconnect from a headless folder host', async ({
   testRepoPath
 }, testInfo) => {
   test.setTimeout(150_000)
diff --git a/tests/e2e/paired-remote-terminal-stall-recovery.spec.ts b/tests/e2e/paired-remote-terminal-stall-recovery.spec.ts
index 4406ebd2f18..2c81b76f077 100644
--- a/tests/e2e/paired-remote-terminal-stall-recovery.spec.ts
+++ b/tests/e2e/paired-remote-terminal-stall-recovery.spec.ts
@@ -1,3 +1,4 @@
+import { runProcess } from '../../src/shared/child-process/run-process'
 import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
@@ -101,11 +102,26 @@ async function minimizeHeadedHost(electronApp: ElectronApplication, page: Page):
     .poll(() =>
       host.evaluate((window) => ({
         backgroundThrottling: window.webContents.getBackgroundThrottling(),
-        minimized: window.isMinimized(),
-        visible: window.isVisible()
+        minimized: window.isMinimized()
       }))
     )
-    .toEqual({ backgroundThrottling: true, minimized: true, visible: false })
+    .toEqual({ backgroundThrottling: true, minimized: true })
+  // Linux reports isVisible/document visibility differently; the window manager owns iconification.
+  if (process.platform === 'linux') {
+    const nativeId = await host.evaluate((window) => window.getNativeWindowHandle().readUInt32LE(0))
+    await expect
+      .poll(async () => {
+        const result = await runProcess({
+          program: 'xprop',
+          args: ['-id', String(nativeId), '_NET_WM_STATE'],
+          timeoutMs: 5_000
+        })
+        return result.stdout
+      })
+      .toContain('_NET_WM_STATE_HIDDEN')
+  } else {
+    await expect.poll(() => page.evaluate(() => document.visibilityState)).toBe('hidden')
+  }
 }
 
 async function restoreHeadedHost(electronApp: ElectronApplication, page: Page): Promise<void> {
diff --git a/tests/e2e/paired-skill-installation.spec.ts b/tests/e2e/paired-skill-installation.spec.ts
index ac31a81e2f1..0268dbb84a3 100644
--- a/tests/e2e/paired-skill-installation.spec.ts
+++ b/tests/e2e/paired-skill-installation.spec.ts
@@ -14,7 +14,6 @@ import {
   type HeadlessPairedRuntimeHost
 } from './helpers/headless-paired-runtime-host'
 import {
-  REMOTE_SKILL_CLOUD_ORIGIN,
   REMOTE_SKILL_NAME,
   REMOTE_SKILL_PACKAGE_ID,
   REMOTE_SKILL_VERSION_ID,
@@ -119,13 +118,14 @@ test('installs on a headless serve runtime through the same contract', async ({
 })
 
 function cloudClientEnvironment(): Record<string, string> {
+  const { origin } = requireCloudFixture()
   return {
-    ORCA_ARTIFACTS_API_URL: REMOTE_SKILL_CLOUD_ORIGIN,
-    ORCA_CLOUD_API_URL: REMOTE_SKILL_CLOUD_ORIGIN,
+    ORCA_ARTIFACTS_API_URL: origin,
+    ORCA_CLOUD_API_URL: origin,
     ORCA_CLOUD_CLIENT_ID: 'skills-e2e-client',
     ORCA_CLOUD_DEV_AUTH: '1',
     ORCA_CLOUD_ALLOW_PLAINTEXT_SESSION: '1',
-    ORCA_SKILL_PACKAGE_DOWNLOAD_ORIGINS: REMOTE_SKILL_CLOUD_ORIGIN
+    ORCA_SKILL_PACKAGE_DOWNLOAD_ORIGINS: origin
   }
 }
 
diff --git a/tests/e2e/paired-web-add-project-unavailable-host.spec.ts b/tests/e2e/paired-web-add-project-unavailable-host.spec.ts
index 771feffdde7..a4f7ecc8d05 100644
--- a/tests/e2e/paired-web-add-project-unavailable-host.spec.ts
+++ b/tests/e2e/paired-web-add-project-unavailable-host.spec.ts
@@ -1,3 +1,4 @@
+import { openSidebarProjectDialog } from './helpers/sidebar-project-dialog'
 import type { ElectronApplication, Page, TestInfo } from '@stablyai/playwright-test'
 import { expect, test } from './helpers/orca-app'
 import {
@@ -61,10 +62,7 @@ async function assertCreationActionsDisabled(args: {
   testInfo: TestInfo
   topology: 'headed' | 'headless'
 }): Promise<void> {
-  await args.page
-    .getByRole('button', { name: /Add Project/i })
-    .first()
-    .click()
+  await openSidebarProjectDialog(args.page)
   const dialog = args.page.getByRole('dialog', { name: /Add a project/i })
   await expect(dialog).toBeVisible()
   const hostPicker = dialog.getByRole('combobox')
diff --git a/tests/e2e/pr11346-selected-runtime-add.spec.ts b/tests/e2e/pr11346-selected-runtime-add.spec.ts
index 93e49d4c4f2..6225f13c623 100644
--- a/tests/e2e/pr11346-selected-runtime-add.spec.ts
+++ b/tests/e2e/pr11346-selected-runtime-add.spec.ts
@@ -1,3 +1,4 @@
+import { openSidebarProjectDialog } from './helpers/sidebar-project-dialog'
 import { rmSync } from 'node:fs'
 import path from 'node:path'
 import type { ElectronApplication, Locator, Page, TestInfo } from '@stablyai/playwright-test'
@@ -22,10 +23,7 @@ import {
 } from './pr11346-selected-runtime-identity-oracle'
 
 async function selectRuntimeHost(page: Page, runtimeName: string): Promise<Locator> {
-  await page
-    .getByRole('button', { name: /Add Project/i })
-    .first()
-    .click()
+  await openSidebarProjectDialog(page)
   const dialog = page.getByRole('dialog', { name: /Add a project/i })
   await expect(dialog).toBeVisible()
   const hostPicker = dialog.getByRole('combobox')
diff --git a/tests/e2e/restart-restore-terminal-input.spec.ts b/tests/e2e/restart-restore-terminal-input.spec.ts
index 1ceed4254c5..79528fabffe 100644
--- a/tests/e2e/restart-restore-terminal-input.spec.ts
+++ b/tests/e2e/restart-restore-terminal-input.spec.ts
@@ -239,7 +239,6 @@ test('restored pane recovers input after the daemon un-wedges', async (// oxlint
 
     const second = await session.launch()
     secondApp = second.app
-    await settleRestoredLaunch(second.page)
 
     // Field-fidelity check, not a hard gate: does the pane paint restored
     // content while its PTY attach cannot complete? That visible-but-dead
@@ -258,6 +257,8 @@ test('restored pane recovers input after the daemon un-wedges', async (// oxlint
     }
     stoppedDaemonPid = null
 
+    // Session readiness requires a daemon response; resume it before waiting for restoration.
+    await settleRestoredLaunch(second.page)
     await expectRestoredPaneAcceptsInput(
       second.page,
       `daemon wedged during relaunch (painted while wedged: ${paintedWhileWedged}, ` +
diff --git a/tests/e2e/right-sidebar-windows-titlebar.spec.ts b/tests/e2e/right-sidebar-windows-titlebar.spec.ts
index 1d6d4b8981f..ce39d7de28d 100644
--- a/tests/e2e/right-sidebar-windows-titlebar.spec.ts
+++ b/tests/e2e/right-sidebar-windows-titlebar.spec.ts
@@ -6,41 +6,19 @@ type RightSidebarHeaderGeometry = {
   stripTop: number
   closeTop: number
   titlebarActivityButtonCount: number
+  activityButtonCount: number
   firstButtonCenterHitsFirst: boolean
   lastButtonCenterHitsLast: boolean
 }
 
-test.describe('Right sidebar Windows titlebar spacing', () => {
-  test('top activity buttons render inside the sidebar instead of the titlebar', async ({
-    orcaPage
-  }) => {
-    await orcaPage.addInitScript(() => {
-      const userAgent =
-        'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/146 Safari/537.36'
-      Object.defineProperty(navigator, 'userAgent', {
-        get: () => userAgent,
-        configurable: true
-      })
-    })
-    await orcaPage.reload({ waitUntil: 'domcontentloaded' })
-    await orcaPage.waitForFunction(() => Boolean(window.__store), null, { timeout: 30_000 })
+test.describe('Right sidebar native titlebar spacing', () => {
+  test('top activity buttons follow the native desktop chrome layout', async ({ orcaPage }) => {
     await waitForSessionReady(orcaPage)
     await waitForActiveWorktree(orcaPage)
     await ensureTerminalVisible(orcaPage)
 
-    await expect
-      .poll(
-        async () =>
-          orcaPage.evaluate(() => ({
-            hasWindowsUserAgent: navigator.userAgent.includes('Windows'),
-            hasWindowsTitlebarChrome: Boolean(document.querySelector('.window-controls'))
-          })),
-        {
-          timeout: 5_000,
-          message: 'Renderer did not switch to the Windows titlebar branch'
-        }
-      )
-      .toEqual({ hasWindowsUserAgent: true, hasWindowsTitlebarChrome: true })
+    const hasDesktopWindowChrome = process.platform !== 'darwin'
+    expect(await orcaPage.evaluate(() => window.api.platform.get().platform)).toBe(process.platform)
 
     await orcaPage.evaluate(() => {
       const store = window.__store
@@ -95,6 +73,7 @@ test.describe('Right sidebar Windows titlebar spacing', () => {
           stripTop: stripRect.top,
           closeTop: closeRect.top,
           titlebarActivityButtonCount,
+          activityButtonCount: activityButtons.length,
           firstButtonCenterHitsFirst:
             elementAtFirstCenter !== null && firstButton.contains(elementAtFirstCenter),
           lastButtonCenterHitsLast:
@@ -117,8 +96,13 @@ test.describe('Right sidebar Windows titlebar spacing', () => {
       .toBe(true)
 
     expect(headerGeometry).not.toBeNull()
-    expect(headerGeometry!.titlebarActivityButtonCount).toBe(0)
-    expect(headerGeometry!.stripTop).toBeGreaterThanOrEqual(headerGeometry!.headerBottom)
+    if (hasDesktopWindowChrome) {
+      expect(headerGeometry!.titlebarActivityButtonCount).toBe(0)
+      expect(headerGeometry!.stripTop).toBeGreaterThanOrEqual(headerGeometry!.headerBottom)
+    } else {
+      expect(headerGeometry!.titlebarActivityButtonCount).toBe(headerGeometry!.activityButtonCount)
+      expect(headerGeometry!.stripTop).toBeLessThan(headerGeometry!.headerBottom)
+    }
     expect(headerGeometry!.closeTop).toBeLessThan(headerGeometry!.headerBottom)
     expect(headerGeometry!.firstButtonCenterHitsFirst).toBe(true)
     expect(headerGeometry!.lastButtonCenterHitsLast).toBe(true)
diff --git a/tests/e2e/settings-agent-awake.spec.ts b/tests/e2e/settings-agent-awake.spec.ts
index 8a2ad840a14..ebea82a1241 100644
--- a/tests/e2e/settings-agent-awake.spec.ts
+++ b/tests/e2e/settings-agent-awake.spec.ts
@@ -1,4 +1,5 @@
 import { randomUUID } from 'node:crypto'
+import { runProcess } from '../../src/shared/child-process/run-process'
 import type { ElectronApplication, Page } from '@stablyai/playwright-test'
 import { test, expect } from './helpers/orca-app'
 import { waitForSessionReady } from './helpers/store'
@@ -104,6 +105,19 @@ async function readPowerSaveBlockerProbe(
   })
 }
 
+async function readMacosSleepAssertionPids(electronApp: ElectronApplication): Promise<number[]> {
+  const result = await runProcess({
+    program: '/usr/bin/pgrep',
+    args: ['-P', String(electronApp.process().pid), '-f', '^/usr/bin/caffeinate -i -s$'],
+    maxOutputBytes: 4_096
+  })
+  if (result.code === 1) {
+    return []
+  }
+  expect(result.code, result.stderr).toBe(0)
+  return result.stdout.trim().split(/\s+/).filter(Boolean).map(Number)
+}
+
 async function postCodexHookEvent(
   electronApp: ElectronApplication,
   options: {
@@ -176,7 +190,9 @@ test.describe('Agent awake setting', () => {
     electronApp,
     orcaPage
   }) => {
-    await installPowerSaveBlockerProbe(electronApp)
+    if (process.platform !== 'darwin') {
+      await installPowerSaveBlockerProbe(electronApp)
+    }
     await setKeepAwake(orcaPage, true)
 
     const tabId = 'e2e-awake-tab'
@@ -187,24 +203,33 @@ test.describe('Agent awake setting', () => {
       eventName: 'UserPromptSubmit'
     })
 
-    await expect
-      .poll(async () => await readPowerSaveBlockerProbe(electronApp), {
-        timeout: 5_000,
-        message: 'powerSaveBlocker did not start for the working agent'
-      })
-      .toEqual(
-        expect.objectContaining({
-          activeIds: expect.arrayContaining([expect.any(Number)]),
-          starts: expect.arrayContaining([
-            expect.objectContaining({ type: 'prevent-display-sleep' })
-          ])
+    await expect(
+      orcaPage.getByRole('button', { name: 'Keep computer awake, Agent · Active' })
+    ).toBeVisible()
+    let startedIds: number[] = []
+    if (process.platform === 'darwin') {
+      // macOS uses an app-owned caffeinate assertion instead of Electron's display blocker.
+      await expect
+        .poll(() => readMacosSleepAssertionPids(electronApp), { timeout: 5_000 })
+        .not.toEqual([])
+    } else {
+      await expect
+        .poll(async () => await readPowerSaveBlockerProbe(electronApp), {
+          timeout: 5_000,
+          message: 'powerSaveBlocker did not start for the working agent'
         })
-      )
+        .toEqual(
+          expect.objectContaining({
+            activeIds: expect.arrayContaining([expect.any(Number)]),
+            starts: expect.arrayContaining([
+              expect.objectContaining({ type: 'prevent-display-sleep' })
+            ])
+          })
+        )
 
-    const startedIds = (await readPowerSaveBlockerProbe(electronApp)).starts.map(
-      (start) => start.id
-    )
-    expect(startedIds.length).toBeGreaterThan(0)
+      startedIds = (await readPowerSaveBlockerProbe(electronApp)).starts.map((start) => start.id)
+      expect(startedIds.length).toBeGreaterThan(0)
+    }
 
     await postCodexHookEvent(electronApp, {
       paneKey,
@@ -212,6 +237,15 @@ test.describe('Agent awake setting', () => {
       eventName: 'Stop'
     })
 
+    await expect(
+      orcaPage.getByRole('button', { name: 'Keep computer awake, Agent · Inactive' })
+    ).toBeVisible()
+    if (process.platform === 'darwin') {
+      await expect
+        .poll(() => readMacosSleepAssertionPids(electronApp), { timeout: 5_000 })
+        .toEqual([])
+      return
+    }
     await expect
       .poll(async () => await readPowerSaveBlockerProbe(electronApp), {
         timeout: 5_000,
diff --git a/tests/e2e/setup-script-import.spec.ts b/tests/e2e/setup-script-import.spec.ts
index 180b34f85aa..340258c884b 100644
--- a/tests/e2e/setup-script-import.spec.ts
+++ b/tests/e2e/setup-script-import.spec.ts
@@ -1,5 +1,5 @@
 import { execFileSync } from 'node:child_process'
-import { mkdirSync, rmSync, writeFileSync } from 'node:fs'
+import { mkdirSync, realpathSync, rmSync, writeFileSync } from 'node:fs'
 import path from 'node:path'
 import type { Locator, Page } from '@stablyai/playwright-test'
 import { test, expect } from './helpers/orca-app'
@@ -108,7 +108,7 @@ async function addAndActivateRepo(page: Page, repoPath: string): Promise<string>
     state.setActiveWorktree(worktree.id)
     state.setSidebarOpen(true)
     return addedRepo.id
-  }, repoPath)
+  }, realpathSync.native(repoPath))
 }
 
 async function openRepoSettings(page: Page, repoId: string): Promise<Locator> {
diff --git a/tests/e2e/setup-script-prompt-unreadable-orca-yaml.spec.ts b/tests/e2e/setup-script-prompt-unreadable-orca-yaml.spec.ts
index 151a4b02bbc..199694b961a 100644
--- a/tests/e2e/setup-script-prompt-unreadable-orca-yaml.spec.ts
+++ b/tests/e2e/setup-script-prompt-unreadable-orca-yaml.spec.ts
@@ -1,5 +1,5 @@
 import { execFileSync } from 'node:child_process'
-import { mkdirSync, rmSync, writeFileSync } from 'node:fs'
+import { mkdirSync, realpathSync, rmSync, writeFileSync } from 'node:fs'
 import path from 'node:path'
 import type { ElectronApplication, Page } from '@stablyai/playwright-test'
 import { test, expect } from './helpers/orca-app'
@@ -112,17 +112,10 @@ async function addRepoAndActivateMainWorktree(
       if (!store) {
         throw new Error('window.__store is not available')
       }
-      const normalize = (value: string): string =>
-        value.startsWith('/private/var/') ? value.slice('/private'.length) : value
-
       const state = store.getState()
       const worktrees = state.worktreesByRepo[targetRepoId] ?? []
-      const mainWorktree = worktrees.find(
-        (entry) => normalize(entry.path) === normalize(targetRepoPath)
-      )
-      const featureWorktree = worktrees.find(
-        (entry) => normalize(entry.path) === normalize(targetFeaturePath)
-      )
+      const mainWorktree = worktrees.find((entry) => entry.path === targetRepoPath)
+      const featureWorktree = worktrees.find((entry) => entry.path === targetFeaturePath)
       if (!mainWorktree || !featureWorktree) {
         throw new Error(
           `Missing worktrees for ${targetRepoPath}: ${worktrees.map((entry) => entry.path).join(', ')}`
@@ -145,7 +138,11 @@ async function addRepoAndActivateMainWorktree(
         featureWorktreeId: featureWorktree.id
       }
     },
-    { targetRepoId: repoId, targetRepoPath: repoPath, targetFeaturePath: featureWorktreePath }
+    {
+      targetRepoId: repoId,
+      targetRepoPath: realpathSync.native(repoPath),
+      targetFeaturePath: realpathSync.native(featureWorktreePath)
+    }
   )
 }
 
diff --git a/tests/e2e/source-control-large-file-count.spec.ts b/tests/e2e/source-control-large-file-count.spec.ts
index 28a5e7758f2..c8c699b2bd8 100644
--- a/tests/e2e/source-control-large-file-count.spec.ts
+++ b/tests/e2e/source-control-large-file-count.spec.ts
@@ -20,12 +20,18 @@
 import type { ElectronApplication, Page } from '@stablyai/playwright-test'
 import { test, expect } from './helpers/orca-app'
 import { waitForSessionReady } from './helpers/store'
+import {
+  hasCapturedGitStatusRetry,
+  installGitStatusRetryBarrier,
+  restoreGitStatusRetryHandler
+} from './helpers/git-status-retry-barrier'
 import {
   createLargeFileCountRepo,
   removeLargeFileCountRepo,
   removeLargeFileCountUntrackedTree
 } from './large-file-count-fixtures'
 import { DEFAULT_GIT_STATUS_LIMIT } from '../../src/shared/git-status-limit'
+import { RIGHT_SIDEBAR_MIN_WIDTH } from '../../src/renderer/src/components/right-sidebar/right-sidebar-width'
 
 // Matches the large-diff freeze budget: a blocking stall past 1s is the
 // "UI becomes unresponsive" symptom reported in #8013.
@@ -411,12 +417,17 @@ test.describe('Source Control large file count (#8013)', () => {
         rendererWorkingSetMb: { before: workingSetBeforeMb, after: workingSetAfterMb }
       })
 
-      const tooManyChangesBanner = orcaPage.getByText('Too many changes detected.', {
-        exact: false
-      })
+      const tooManyChangesBanner = orcaPage.getByTestId('too-many-changes-banner')
       await expect(tooManyChangesBanner).toBeVisible()
       if (process.env.ORCA_LARGE_FILE_SCREENSHOT_PATH) {
-        await orcaPage.screenshot({ path: process.env.ORCA_LARGE_FILE_SCREENSHOT_PATH })
+        // Narrowest supported sidebar is where the banner layout is worst.
+        await orcaPage.evaluate((minWidth) => {
+          window.__store?.getState().setRightSidebarWidth(minWidth)
+          document.documentElement.classList.add('dark')
+        }, RIGHT_SIDEBAR_MIN_WIDTH)
+        await tooManyChangesBanner.screenshot({
+          path: process.env.ORCA_LARGE_FILE_SCREENSHOT_PATH
+        })
       }
 
       expect(measurement.didHitLimit).toBe(true)
@@ -434,13 +445,17 @@ test.describe('Source Control large file count (#8013)', () => {
       )
       expect(hugeState).not.toBeNull()
 
-      // Why: watcher refreshes stay parked while huge; the visible Retry is the
-      // explicit recovery path after the underlying change count drops.
-      removeLargeFileCountUntrackedTree(fixture.repoPath)
-      await expect(tooManyChangesBanner).toBeVisible()
-      const retryButton = tooManyChangesBanner.locator('..').getByRole('button', { name: 'Retry' })
+      const retryButton = tooManyChangesBanner.getByRole('button', { name: 'Retry' })
       await expect(retryButton).toBeVisible()
-      await retryButton.click()
+      // Keep automatic refreshes from removing Retry before its real request starts.
+      await installGitStatusRetryBarrier(electronApp, fixture.repoPath)
+      try {
+        await retryButton.click()
+        await expect.poll(() => hasCapturedGitStatusRetry(electronApp)).toBe(true)
+        removeLargeFileCountUntrackedTree(fixture.repoPath)
+      } finally {
+        await restoreGitStatusRetryHandler(electronApp)
+      }
       await expect(tooManyChangesBanner).not.toBeVisible()
       await expect
         .poll(() =>
diff --git a/tests/e2e/source-control-pr-generation-switch.spec.ts b/tests/e2e/source-control-pr-generation-switch.spec.ts
index 58091cd3cf8..47b4acb1b5d 100644
--- a/tests/e2e/source-control-pr-generation-switch.spec.ts
+++ b/tests/e2e/source-control-pr-generation-switch.spec.ts
@@ -1,7 +1,7 @@
 import type { Page, TestInfo } from '@stablyai/playwright-test'
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs'
 import path from 'node:path'
-import { test, expect } from './helpers/orca-app'
+import { test, expect } from './helpers/source-control-generation-app'
 import { waitForActiveWorktree, waitForSessionReady } from './helpers/store'
 import {
   createBranchCommit,
diff --git a/tests/e2e/source-control-pr-linked-issue-ai.spec.ts b/tests/e2e/source-control-pr-linked-issue-ai.spec.ts
index 625d19d58b8..be6966b7f3a 100644
--- a/tests/e2e/source-control-pr-linked-issue-ai.spec.ts
+++ b/tests/e2e/source-control-pr-linked-issue-ai.spec.ts
@@ -1,7 +1,7 @@
 import { rmSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
-import { test, expect } from './helpers/orca-app'
+import { test, expect } from './helpers/source-control-generation-app'
 import {
   createBranchCommit,
   openSourceControl,
diff --git a/tests/e2e/ssh-codex-display-artifacts-repro.spec.ts b/tests/e2e/ssh-codex-display-artifacts-repro.spec.ts
index e19a090df4d..f4c02d04c94 100644
--- a/tests/e2e/ssh-codex-display-artifacts-repro.spec.ts
+++ b/tests/e2e/ssh-codex-display-artifacts-repro.spec.ts
@@ -48,7 +48,7 @@ import { resetWebglAndCaptureGraySlabAnalysis } from './terminal-webgl-reset-cap
 
 const RUN_DOCKER_SSH = process.env.ORCA_E2E_SSH_DOCKER === '1'
 const RUN_REAL_REMOTE_CODEX = process.env.ORCA_E2E_REAL_REMOTE_CODEX === '1'
-const EXPECT_NO_ARTIFACTS = process.env.ORCA_E2E_EXPECT_NO_CODEX_ARTIFACTS === '1'
+const EXPECT_NO_ARTIFACTS = process.env.ORCA_E2E_EXPECT_NO_CODEX_ARTIFACTS !== '0'
 const CAPTURE_WHILE_REMOTE_TUI_RUNNING =
   process.env.ORCA_E2E_CAPTURE_WHILE_REMOTE_TUI_RUNNING === '1'
 const HIDE_UNTIL_REMOTE_TUI_DONE = process.env.ORCA_E2E_HIDE_UNTIL_REMOTE_TUI_DONE === '1'
diff --git a/tests/e2e/ssh-codex-repro-remote-fixtures.ts b/tests/e2e/ssh-codex-repro-remote-fixtures.ts
index 3ee48187e7c..14597bc084a 100644
--- a/tests/e2e/ssh-codex-repro-remote-fixtures.ts
+++ b/tests/e2e/ssh-codex-repro-remote-fixtures.ts
@@ -135,7 +135,7 @@ async function insertCodexHistory(frame) {
     const phase = String(frame).padStart(4, '0') + '.' + index
     await write('\\r\\n')
     await write(\`\\x1b[48;2;72;72;72m\\x1b[K\`)
-    await write(\`\\x1b[38;2;220;220;220;48;2;72;72;72m\${pad('gpt-5.5 high · ~/code/pr-12250-migration-compare-move-baseprice-claim · /ps to view · /stop to close ' + phase, width)}\\x1b[0m\`)
+    await write(\`\\x1b[38;2;220;220;220;48;2;72;72;72m\${pad('gpt-5.5 high · ' + phase + ' · ~/code/pr-12250-migration-compare-move-baseprice-claim · /ps to view · /stop to close', width)}\\x1b[0m\`)
   }
   await write('\\x1b[r')
   await write(\`\\x1b[\${viewportBottom};1H\`)
@@ -176,7 +176,7 @@ for (let frame = 0; frame < ${REMOTE_CODEX_FIXTURE_FRAMES}; frame += 1) {
     await reverseIndexCodexHistory(frame)
   }
   if (frame % 9 === 0) {
-    await grayScrollLine(\`gpt-5.5 high · ~/code/pr-12250-migration-compare-move-baseprice-claim · /ps to view · /stop to close \${frame}\`)
+    await grayScrollLine(\`gpt-5.5 high · \${frame} · ~/code/pr-12250-migration-compare-move-baseprice-claim · /ps to view · /stop to close\`)
   }
   await sleep(${REMOTE_CODEX_FIXTURE_FRAME_DELAY_MS})
 }
diff --git a/tests/e2e/ssh-docker-half-open-link.spec.ts b/tests/e2e/ssh-docker-half-open-link.spec.ts
index c5b6f715dc9..d77eba3a264 100644
--- a/tests/e2e/ssh-docker-half-open-link.spec.ts
+++ b/tests/e2e/ssh-docker-half-open-link.spec.ts
@@ -68,7 +68,7 @@ test.describe('Docker SSH half-open link', () => {
       const ptyId = await waitForActivePanePtyId(orcaPage, 60_000)
 
       const runId = String(Date.now())
-      await execInTerminal(orcaPage, ptyId, `echo LIVE_${runId}`)
+      await execInTerminal(orcaPage, ptyId, `printf 'LIVE_%s\\n' ${runId}`)
       await waitForTerminalOutput(orcaPage, `LIVE_${runId}`, 60_000)
       expect(await readSshStatus(orcaPage, remote.targetId)).toBe('connected')
 
@@ -78,13 +78,15 @@ test.describe('Docker SSH half-open link', () => {
       const frozenAt = Date.now()
 
       let verdict: string | null = 'connected'
-      while (Date.now() - frozenAt < LOST_VERDICT_BUDGET_MS) {
-        verdict = await readSshStatus(orcaPage, remote.targetId)
-        if (verdict !== 'connected') {
-          break
-        }
-        await orcaPage.waitForTimeout(1_000)
-      }
+      await expect
+        .poll(
+          async () => {
+            verdict = await readSshStatus(orcaPage, remote.targetId)
+            return verdict
+          },
+          { timeout: LOST_VERDICT_BUDGET_MS, message: 'frozen host remained connected' }
+        )
+        .not.toBe('connected')
       const verdictMs = Date.now() - frozenAt
       console.log(
         `[half-open] ${JSON.stringify({ verdict, verdictMs, budgetMs: LOST_VERDICT_BUDGET_MS })}`
@@ -105,7 +107,7 @@ test.describe('Docker SSH half-open link', () => {
         .poll(() => readSshStatus(orcaPage, remote.targetId), { timeout: 120_000 })
         .toBe('connected')
       const recoveredPtyId = await waitForActivePanePtyId(orcaPage, 60_000)
-      await execInTerminal(orcaPage, recoveredPtyId, `echo RECOVERED_${runId}`)
+      await execInTerminal(orcaPage, recoveredPtyId, `printf 'RECOVERED_%s\\n' ${runId}`)
       await waitForTerminalOutput(orcaPage, `RECOVERED_${runId}`, 90_000)
     } finally {
       if (target && paused) {
diff --git a/tests/e2e/ssh-docker-transport-drop-recovery.spec.ts b/tests/e2e/ssh-docker-transport-drop-recovery.spec.ts
index e18336d12c5..c64761ede80 100644
--- a/tests/e2e/ssh-docker-transport-drop-recovery.spec.ts
+++ b/tests/e2e/ssh-docker-transport-drop-recovery.spec.ts
@@ -1,9 +1,10 @@
 import path from 'node:path'
 import { readFileSync } from 'node:fs'
-import type { ElectronApplication, Page } from '@playwright/test'
+import type { ElectronApplication } from '@playwright/test'
 import { test, expect } from './helpers/orca-app'
 import { DEFAULT_LOCAL_ORCA_PROFILE_ID } from '../../src/shared/orca-profiles'
 import { sshRemotePtyLeaseAllowsReattach, type SshRemotePtyLease } from '../../src/shared/ssh-types'
+import { toRelaySshPtyId } from '../../src/shared/ssh-pty-id'
 import { ensureTerminalVisible, waitForActiveWorktree, waitForSessionReady } from './helpers/store'
 import {
   execInTerminal,
@@ -18,7 +19,10 @@ import {
   startDockerSshRelayTarget,
   type DockerSshRelayTarget
 } from './helpers/docker-ssh-relay-target'
-import { connectDockerSshRelayTarget } from './helpers/docker-ssh-relay-connection'
+import {
+  connectDockerSshRelayTarget,
+  recoverDockerSshRelayAfterFault
+} from './helpers/docker-ssh-relay-connection'
 import {
   clearDockerSshRelayFaults,
   dropDockerSshRelayTransport,
@@ -26,6 +30,8 @@ import {
   withStalledDockerSshRelayTarget
 } from './helpers/docker-ssh-relay-faults'
 
+import { attachSshRecoveryInputObservation } from './helpers/ssh-recovery-input-observation'
+
 const RUN_DOCKER_SSH = process.env.ORCA_E2E_SSH_DOCKER === '1'
 
 /**
@@ -46,13 +52,6 @@ const RUN_DOCKER_SSH = process.env.ORCA_E2E_SSH_DOCKER === '1'
  * with only the first cannot tell a resume from a silent cold start
  * (docs/reference/ssh-execution-boundary.md).
  */
-async function readSshStatus(orcaPage: Page, targetId: string) {
-  return orcaPage.evaluate(
-    (targetId) => window.__store?.getState().sshConnectionStates.get(targetId)?.status ?? null,
-    targetId
-  )
-}
-
 /**
  * Every lease `reattachKnownPtys` would feed to `pty.attach` on the next connect, read from the
  * durable store rather than from the renderer — leases are main-owned and never published.
@@ -122,7 +121,9 @@ test.describe('SSH transport drop recovery', () => {
       enableDockerSshRelayTargetShellTitle(target)
       await waitForSessionReady(orcaPage)
       await waitForActiveWorktree(orcaPage)
-      const remote = await connectDockerSshRelayTarget(orcaPage, target)
+      const remote = await connectDockerSshRelayTarget(orcaPage, target, {
+        relayGracePeriodSeconds: 0
+      })
       await ensureTerminalVisible(orcaPage, 45_000)
       await waitForActiveTerminalManager(orcaPage, 60_000)
       const ptyId = await waitForActivePanePtyId(orcaPage, 60_000)
@@ -134,20 +135,12 @@ test.describe('SSH transport drop recovery', () => {
       await execInTerminal(orcaPage, ptyId, `printf 'DROP_MARKER_%s\\n' ${markerSuffix}`)
       await waitForTerminalOutput(orcaPage, marker, 30_000)
 
-      const dropped = dropDockerSshRelayTransport(target)
-      expect(dropped, 'no live SSH connection was found to drop').toBeGreaterThan(0)
-
-      // Nothing below calls ssh.connect(). Recovery has to come from the client's own ladder,
-      // which is the behaviour users depend on and the thing a scripted reconnect never exercised.
-      await expect
-        .poll(() => readSshStatus(orcaPage, remote.targetId), {
-          timeout: 120_000,
-          message: 'SSH target never returned to connected after the transport was dropped'
-        })
-        .toBe('connected')
+      await recoverDockerSshRelayAfterFault(orcaPage, remote.targetId, () => {
+        expect(dropDockerSshRelayTransport(target!)).toBeGreaterThan(0)
+      })
 
       await waitForActiveTerminalManager(orcaPage, 60_000)
-      await waitForActivePanePtyId(orcaPage, 60_000)
+      expect(await waitForActivePanePtyId(orcaPage, 60_000)).toBe(ptyId)
 
       // The pane must still show what it had. A blank pane here is the reported bug.
       await waitForTerminalOutput(orcaPage, marker, 60_000)
@@ -170,10 +163,7 @@ test.describe('SSH transport drop recovery', () => {
     }
   })
 
-  // Fixme: fails in CI on its first real run — the pane keeps its PTY and repaints, but a command
-  // run after the flood produces no output within the poll budget. Same shape as #18018 (deaf pane
-  // after a stalled host resumes), and not caused by this spec. Tracked there; the three verdict
-  // assertions around it stay enforced.
+  // #18018: local authority-aware recovery still loses the flooded pane's relay channel.
   test.fixme('stays bounded when a disconnected shell floods its pty', async ({
     orcaPage
   }, testInfo) => {
@@ -195,7 +185,9 @@ test.describe('SSH transport drop recovery', () => {
       enableDockerSshRelayTargetShellTitle(target)
       await waitForSessionReady(orcaPage)
       await waitForActiveWorktree(orcaPage)
-      const remote = await connectDockerSshRelayTarget(orcaPage, target)
+      const remote = await connectDockerSshRelayTarget(orcaPage, target, {
+        relayGracePeriodSeconds: 0
+      })
       await ensureTerminalVisible(orcaPage, 45_000)
       await waitForActiveTerminalManager(orcaPage, 240_000)
       const ptyId = await waitForActivePanePtyId(orcaPage, 240_000)
@@ -214,18 +206,12 @@ test.describe('SSH transport drop recovery', () => {
       await execInTerminal(
         orcaPage,
         ptyId,
-        `yes "$(printf 'ORCA_%s' FLOOD_LINE)" | head -c 48000000; echo FLOODED`
+        `yes "$(printf 'ORCA_%s' FLOOD_LINE)" | head -c 48000000; printf 'FLOO%s\\n' DED`
       )
       await waitForTerminalOutput(orcaPage, 'ORCA_FLOOD_LINE', 30_000, 20_000)
-      const dropped = dropDockerSshRelayTransport(target)
-      expect(dropped).toBeGreaterThan(0)
-
-      await expect
-        .poll(() => readSshStatus(orcaPage, remote.targetId), {
-          timeout: 120_000,
-          message: 'SSH target never returned to connected'
-        })
-        .toBe('connected')
+      await recoverDockerSshRelayAfterFault(orcaPage, remote.targetId, () => {
+        expect(dropDockerSshRelayTransport(target!)).toBeGreaterThan(0)
+      })
       await waitForActiveTerminalManager(orcaPage, 240_000)
 
       // Why a generous ceiling: this is an OOM guard, not a memory budget. Unbounded retention of
@@ -236,6 +222,9 @@ test.describe('SSH transport drop recovery', () => {
         `relay grew ${afterRssKb - baselineRssKb}KB after 48MB of undeliverable output`
       ).toBeLessThan(200_000)
 
+      // Wait for the finite producer to finish before sending a shell command behind it.
+      await waitForTerminalOutput(orcaPage, 'FLOODED', 120_000, 20_000)
+
       // And the session must still be usable, not merely alive.
       const markerSuffix = Date.now()
       const marker = `FLOOD_AFTER_${markerSuffix}`
@@ -273,7 +262,9 @@ test.describe('SSH transport drop recovery', () => {
       enableDockerSshRelayTargetShellTitle(target)
       await waitForSessionReady(orcaPage)
       await waitForActiveWorktree(orcaPage)
-      const remote = await connectDockerSshRelayTarget(orcaPage, target)
+      const remote = await connectDockerSshRelayTarget(orcaPage, target, {
+        relayGracePeriodSeconds: 0
+      })
       await ensureTerminalVisible(orcaPage, 45_000)
       await waitForActiveTerminalManager(orcaPage, 60_000)
       const ptyId = await waitForActivePanePtyId(orcaPage, 60_000)
@@ -283,15 +274,9 @@ test.describe('SSH transport drop recovery', () => {
       await execInTerminal(orcaPage, ptyId, `printf 'KILL_MARKER_%s\\n' ${markerSuffix}`)
       await waitForTerminalOutput(orcaPage, marker, 30_000)
 
-      const killed = killDockerSshRelayDaemon(target)
-      expect(killed, 'no relay process was found to kill').toBeGreaterThan(0)
-
-      await expect
-        .poll(() => readSshStatus(orcaPage, remote.targetId), {
-          timeout: 120_000,
-          message: 'SSH target never returned to connected after the relay was killed'
-        })
-        .toBe('connected')
+      await recoverDockerSshRelayAfterFault(orcaPage, remote.targetId, () => {
+        expect(killDockerSshRelayDaemon(target!)).toBeGreaterThan(0)
+      })
       await waitForActiveTerminalManager(orcaPage, 60_000)
 
       // The verdict, expressed as the only thing a user can observe: the pane is now backed by a
@@ -345,7 +330,9 @@ test.describe('SSH transport drop recovery', () => {
       enableDockerSshRelayTargetShellTitle(target)
       await waitForSessionReady(orcaPage)
       await waitForActiveWorktree(orcaPage)
-      const remote = await connectDockerSshRelayTarget(orcaPage, target)
+      const remote = await connectDockerSshRelayTarget(orcaPage, target, {
+        relayGracePeriodSeconds: 0
+      })
       await ensureTerminalVisible(orcaPage, 45_000)
       await waitForActiveTerminalManager(orcaPage, 60_000)
       await waitForActivePanePtyId(orcaPage, 60_000)
@@ -354,35 +341,37 @@ test.describe('SSH transport drop recovery', () => {
       const generations: string[][] = []
 
       for (let generation = 1; generation <= 5; generation++) {
-        expect(
-          killDockerSshRelayDaemon(target),
-          'no relay process was found to kill'
-        ).toBeGreaterThan(0)
-        await expect
-          .poll(() => readSshStatus(orcaPage, remote.targetId), {
-            timeout: 120_000,
-            message: `SSH target never reconnected after relay kill ${generation}`
-          })
-          .toBe('connected')
+        const previousPtyId = await waitForActivePanePtyId(orcaPage, 60_000)
+        await recoverDockerSshRelayAfterFault(orcaPage, remote.targetId, () => {
+          expect(
+            killDockerSshRelayDaemon(target!),
+            'no relay process was found to kill'
+          ).toBeGreaterThan(0)
+        })
         await waitForActiveTerminalManager(orcaPage, 120_000)
-        // The pane must be usable again before the count is meaningful: recovery is what mints the
-        // successor lease that retires the generation before it.
+        // Transport status can still be connected while the pane retains its old binding.
+        await expect
+          .poll(() => waitForActivePanePtyId(orcaPage, 60_000).catch(() => previousPtyId), {
+            timeout: 120_000,
+            message: `pane kept its old PTY binding after relay kill ${generation}`
+          })
+          .not.toBe(previousPtyId)
         const ptyId = await waitForActivePanePtyId(orcaPage, 120_000)
-        const marker = `LEASE_GEN_${generation}_${Date.now()}`
-        await execInTerminal(orcaPage, ptyId, `printf '%s\\n' ${marker}`)
+        const markerSuffix = `${generation}_${Date.now()}`
+        const marker = `LEASE_GEN_${markerSuffix}`
+        await execInTerminal(orcaPage, ptyId, `printf 'LEASE_GEN_%s\\n' ${markerSuffix}`)
         await waitForTerminalOutput(orcaPage, marker, 60_000)
 
         try {
           await expect
-            .poll(() => readReattachablePtyIds(userDataDir, remote.targetId).length, {
+            .poll(() => readReattachablePtyIds(userDataDir, remote.targetId), {
               timeout: 60_000
             })
-            .toBe(1)
+            .toEqual([toRelaySshPtyId(remote.targetId, ptyId)])
         } catch (error) {
-          // Why re-thrown with the rows: the count alone cannot say WHICH predecessor stayed
-          // reattachable, and the user-data dir is torn down before the report is read.
+          // Preserve lease ownership diagnostics before the user-data directory is removed.
           throw new Error(
-            `reattachable lease count never settled at 1 in generation ${generation}; leases: ${describeSshLeases(userDataDir, remote.targetId)}`,
+            `reattachable leases never settled at the active PTY ${ptyId} in generation ${generation}; leases: ${describeSshLeases(userDataDir, remote.targetId)}`,
             { cause: error }
           )
         }
@@ -418,7 +407,7 @@ test.describe('SSH transport drop recovery', () => {
       enableDockerSshRelayTargetShellTitle(target)
       await waitForSessionReady(orcaPage)
       await waitForActiveWorktree(orcaPage)
-      await connectDockerSshRelayTarget(orcaPage, target)
+      await connectDockerSshRelayTarget(orcaPage, target, { relayGracePeriodSeconds: 0 })
       await ensureTerminalVisible(orcaPage, 45_000)
       await waitForActiveTerminalManager(orcaPage, 60_000)
       const ptyId = await waitForActivePanePtyId(orcaPage, 60_000)
@@ -446,38 +435,64 @@ test.describe('SSH transport drop recovery', () => {
     }
   })
 
-  /**
-   * Known broken on main, kept as the reproduction. The verdict test above passes: after a 30s
-   * freeze the pane keeps its PTY and repaints its scrollback. What does not come back is the
-   * shell — a command run afterwards produces no output within 60s, so the pane is live-looking and
-   * deaf. Measured twice at `waitForTerminalOutput(STALL_AFTER_…)`, and it reproduces unchanged
-   * with the reattach-token/delivery-ownership fix applied, so that is not the cause.
-   *
-   * Split out rather than folded into the test above so the `unverifiable` verdict stays enforced
-   * in CI instead of being masked by this failure.
-   */
-  test.fixme('accepts input again after a frozen host resumes', async ({ orcaPage }, testInfo) => {
+  // #18018: wait for the recovered authority before input; a retained manager can still be disconnected.
+  test('accepts input again after a frozen host resumes', async ({ orcaPage }, testInfo) => {
     test.slow()
     let target: DockerSshRelayTarget | null = null
+    let observationTarget: { targetId: string; ptyId: string } | undefined
     try {
       target = startDockerSshRelayTarget(testInfo)
       enableDockerSshRelayTargetShellTitle(target)
       await waitForSessionReady(orcaPage)
       await waitForActiveWorktree(orcaPage)
-      await connectDockerSshRelayTarget(orcaPage, target)
+      const remote = await connectDockerSshRelayTarget(orcaPage, target, {
+        relayGracePeriodSeconds: 0
+      })
       await ensureTerminalVisible(orcaPage, 45_000)
       await waitForActiveTerminalManager(orcaPage, 60_000)
       const ptyId = await waitForActivePanePtyId(orcaPage, 60_000)
 
-      await withStalledDockerSshRelayTarget(target, async () => {
-        await orcaPage.waitForTimeout(30_000)
+      observationTarget = { targetId: remote.targetId, ptyId }
+      const beforeSuffix = Date.now()
+      await execInTerminal(orcaPage, ptyId, `printf 'STALL_BEFORE_%s\\n' ${beforeSuffix}`)
+      await waitForTerminalOutput(orcaPage, `STALL_BEFORE_${beforeSuffix}`, 60_000)
+      await attachSshRecoveryInputObservation(
+        orcaPage,
+        testInfo,
+        remote.targetId,
+        ptyId,
+        'before-freeze'
+      )
+
+      await recoverDockerSshRelayAfterFault(orcaPage, remote.targetId, async () => {
+        await withStalledDockerSshRelayTarget(target!, async () => {
+          await orcaPage.waitForTimeout(30_000)
+        })
       })
       await waitForActiveTerminalManager(orcaPage, 60_000)
 
       const afterSuffix = Date.now()
       const afterMarker = `STALL_AFTER_${afterSuffix}`
       await execInTerminal(orcaPage, ptyId, `printf 'STALL_AFTER_%s\\n' ${afterSuffix}`)
+      await attachSshRecoveryInputObservation(
+        orcaPage,
+        testInfo,
+        remote.targetId,
+        ptyId,
+        'after-write'
+      )
       await waitForTerminalOutput(orcaPage, afterMarker, 60_000)
+    } catch (error) {
+      if (observationTarget) {
+        await attachSshRecoveryInputObservation(
+          orcaPage,
+          testInfo,
+          observationTarget.targetId,
+          observationTarget.ptyId,
+          'failure-before-cleanup'
+        ).catch(() => undefined)
+      }
+      throw error
     } finally {
       if (target) {
         clearDockerSshRelayFaults(target)
diff --git a/tests/e2e/ssh-skill-installation.spec.ts b/tests/e2e/ssh-skill-installation.spec.ts
index a102478fb62..794883b2cd1 100644
--- a/tests/e2e/ssh-skill-installation.spec.ts
+++ b/tests/e2e/ssh-skill-installation.spec.ts
@@ -10,7 +10,6 @@ import {
 import { connectDockerSshRelayTarget } from './helpers/docker-ssh-relay-connection'
 import { waitForActiveWorktree, waitForSessionReady } from './helpers/store'
 import {
-  REMOTE_SKILL_CLOUD_ORIGIN,
   REMOTE_SKILL_NAME,
   REMOTE_SKILL_PACKAGE_ID,
   REMOTE_SKILL_VERSION_ID,
@@ -25,13 +24,19 @@ const REMOTE_FOLDER = '/tmp/orca-skill-folder-workspace'
 let cloud: RemoteSkillCloudFixture | null = null
 
 test.use({
-  orcaAppExtraEnv: {
-    ORCA_ARTIFACTS_API_URL: REMOTE_SKILL_CLOUD_ORIGIN,
-    ORCA_CLOUD_API_URL: REMOTE_SKILL_CLOUD_ORIGIN,
-    ORCA_CLOUD_CLIENT_ID: 'skills-e2e-client',
-    ORCA_CLOUD_DEV_AUTH: '1',
-    ORCA_CLOUD_ALLOW_PLAINTEXT_SESSION: '1',
-    ORCA_SKILL_PACKAGE_DOWNLOAD_ORIGINS: REMOTE_SKILL_CLOUD_ORIGIN
+  // oxlint-disable-next-line no-empty-pattern -- The server starts in beforeAll before this test fixture runs.
+  orcaAppExtraEnv: async ({}, provideEnv) => {
+    if (!cloud) {
+      throw new Error('Skill cloud fixture unavailable')
+    }
+    await provideEnv({
+      ORCA_ARTIFACTS_API_URL: cloud.origin,
+      ORCA_CLOUD_API_URL: cloud.origin,
+      ORCA_CLOUD_CLIENT_ID: 'skills-e2e-client',
+      ORCA_CLOUD_DEV_AUTH: '1',
+      ORCA_CLOUD_ALLOW_PLAINTEXT_SESSION: '1',
+      ORCA_SKILL_PACKAGE_DOWNLOAD_ORIGINS: cloud.origin
+    })
   }
 })
 
diff --git a/tests/e2e/tab-rename.spec.ts b/tests/e2e/tab-rename.spec.ts
index 6e7f0a7fdc1..30cdb9175a9 100644
--- a/tests/e2e/tab-rename.spec.ts
+++ b/tests/e2e/tab-rename.spec.ts
@@ -126,7 +126,7 @@ test.describe('Tab Rename (Inline)', () => {
     expect(originalTitle.length).toBeGreaterThan(0)
 
     await tabLocatorByTitle(orcaPage, originalTitle).click({ button: 'right' })
-    await orcaPage.getByRole('menuitem', { name: 'Change Title', exact: true }).click()
+    await orcaPage.getByRole('menuitem', { name: /^Change Title(?:\s|$)/ }).click()
 
     const renameInput = orcaPage.getByRole('textbox', {
       name: `Rename tab ${originalTitle}`,
diff --git a/tests/e2e/terminal-codex-home.spec.ts b/tests/e2e/terminal-codex-home.spec.ts
index 1f85a4f4c9b..3364152d38c 100644
--- a/tests/e2e/terminal-codex-home.spec.ts
+++ b/tests/e2e/terminal-codex-home.spec.ts
@@ -1,3 +1,5 @@
+import { mkdirSync, writeFileSync } from 'node:fs'
+import path from 'node:path'
 import { test, expect } from './helpers/orca-app'
 import {
   execInTerminal,
@@ -27,7 +29,42 @@ test.describe('Terminal Codex runtime home', () => {
     await ensureTerminalVisible(orcaPage)
   })
 
-  test('terminal process receives the Orca-managed Codex home', async ({ orcaPage }) => {
+  test('terminal process receives the selected account Codex home', async ({
+    electronApp,
+    orcaPage
+  }) => {
+    const userData = await electronApp.evaluate(({ app }) => app.getPath('userData'))
+    const accountId = 'e2e-terminal-home'
+    const managedHomePath = path.join(userData, 'codex-accounts', accountId, 'home')
+    mkdirSync(managedHomePath, { recursive: true })
+    writeFileSync(path.join(managedHomePath, '.orca-managed-home'), `${accountId}\n`)
+    writeFileSync(
+      path.join(managedHomePath, 'auth.json'),
+      JSON.stringify({ OPENAI_API_KEY: 'e2e-placeholder' })
+    )
+    await orcaPage.evaluate(
+      async ({ accountId, managedHomePath }) => {
+        const state = window.__store!.getState()
+        await state.updateSettings({
+          codexManagedAccounts: [
+            {
+              id: accountId,
+              email: 'terminal-home@example.invalid',
+              managedHomePath,
+              createdAt: 1,
+              updatedAt: 1,
+              lastAuthenticatedAt: 1
+            }
+          ],
+          activeCodexManagedAccountId: accountId,
+          activeCodexManagedAccountIdsByRuntime: { host: accountId, wsl: {} }
+        })
+        const tab = state.createTab(state.activeWorktreeId!)
+        state.setActiveTab(tab.id)
+        state.setActiveTabType('terminal')
+      },
+      { accountId, managedHomePath }
+    )
     await waitForActiveTerminalManager(orcaPage)
     const ptyId = await waitForActivePanePtyId(orcaPage)
     const marker = `__ORCA_CODEX_HOME_E2E_${Date.now()}__`
@@ -43,17 +80,10 @@ test.describe('Terminal Codex runtime home', () => {
       .poll(
         async () => {
           probe = readCodexHomeProbe(await getTerminalContent(orcaPage), marker)
-          return Boolean(
-            probe?.codexHome &&
-            probe.orcaCodexHome &&
-            probe.codexHome === probe.orcaCodexHome &&
-            /[\\/]codex-runtime-home[\\/]home$/.test(probe.codexHome)
-          )
+          return probe
         },
-        { timeout: 15_000, message: 'Terminal did not expose Orca-managed Codex home env' }
+        { timeout: 15_000, message: 'Terminal did not expose the selected Codex account home' }
       )
-      .toBe(true)
-
-    expect(probe?.codexHome).toBe(probe?.orcaCodexHome)
+      .toEqual({ codexHome: managedHomePath, orcaCodexHome: managedHomePath })
   })
 })
diff --git a/tests/e2e/terminal-hangul-terminating-digit-native.spec.ts b/tests/e2e/terminal-hangul-terminating-digit-native.spec.ts
index 2fb90a9c992..4344f94adaf 100644
--- a/tests/e2e/terminal-hangul-terminating-digit-native.spec.ts
+++ b/tests/e2e/terminal-hangul-terminating-digit-native.spec.ts
@@ -3,20 +3,18 @@
  * the pty. Written to reproduce #15299, where a digit typed straight after a Hangul syllable was
  * dropped under Wayland but not under X11.
  *
- * THIS DOES NOT RUN IN CI. It is gated on ORCA_E2E_NATIVE_IBUS_HANGUL=1 and needs a compositor
- * session that CI does not have, so it is a manual reproduction harness rather than coverage.
- * That is stated plainly because this repo already carries native IME specs that are skipped
- * everywhere and were mistaken for coverage they never provided.
+ * CI runs the default xdotool injector under X11, checking exact Hangul-plus-digit PTY bytes.
+ * That path passed even before the Wayland fix; it does not prove #15299 is fixed.
+ * Reproducing #15299 still requires the nested Wayland session below.
  *
- * To run it, on a machine with gnome-shell and ibus-hangul:
+ * To run the Wayland reproduction on a machine with gnome-shell and ibus-hangul:
  *
  *   Xvfb :65 -extension GLX &
  *   DISPLAY=:65 gnome-shell --nested --wayland     # nested, NOT --headless
  *   ORCA_E2E_NATIVE_IBUS_HANGUL=1 ORCA_E2E_IME_INJECTOR=nested npx playwright test \
  *     tests/e2e/terminal-hangul-terminating-digit-native.spec.ts
  *
- * Eight things that decide whether a run is real or a silent false negative, each of which cost a
- * failed attempt:
+ * Nested Wayland prerequisites:
  *
  *  - Nested, not headless. A headless mutter never answers RemoteDesktop.CreateSession, so there
  *    is no way to inject input; nested makes the whole compositor an X window that xdotool can
@@ -45,6 +43,7 @@ import { mkdirSync, writeFileSync } from 'node:fs'
 import path from 'node:path'
 import type { Page, TestInfo } from '@stablyai/playwright-test'
 import { test, expect } from './helpers/orca-app'
+import { appendImeEngagementReceipt } from './terminal-ime-engagement-receipt'
 import { ensureTerminalVisible, waitForActiveWorktree, waitForSessionReady } from './helpers/store'
 import {
   focusActiveTerminalInput,
@@ -232,6 +231,11 @@ test.describe('Hangul terminating digit @headful', () => {
       }
 
       receivedBytes = await waitForTerminalImeBytes(page, reader, 20_000)
+      expect(receivedBytes.map((hex) => Buffer.from(hex, 'hex').toString('utf8'))).toEqual(
+        Array.from({ length: REPETITIONS }, () => `${EXPECTED_LINE}\n`)
+      )
+      const trace = await readTerminalImeBoundaryTrace(page)
+      appendImeEngagementReceipt(testInfo.title, trace)
     } finally {
       await writeEvidence(page, testInfo, 'hangul-terminating-digit', {
         expectedHex,
@@ -243,8 +247,5 @@ test.describe('Hangul terminating digit @headful', () => {
       await sendToTerminal(page, ptyId, '\x03').catch(() => undefined)
       removeTerminalImeByteReader(reader)
     }
-    expect(receivedBytes.map((hex) => Buffer.from(hex, 'hex').toString('utf8'))).toEqual(
-      Array.from({ length: REPETITIONS }, () => `${EXPECTED_LINE}\n`)
-    )
   })
 })
diff --git a/tests/e2e/terminal-pane-divider-capture-loss.spec.ts b/tests/e2e/terminal-pane-divider-capture-loss.spec.ts
index 5f3bfca177b..8120c2a60e7 100644
--- a/tests/e2e/terminal-pane-divider-capture-loss.spec.ts
+++ b/tests/e2e/terminal-pane-divider-capture-loss.spec.ts
@@ -1,4 +1,4 @@
-import type { ElectronApplication, Page } from '@stablyai/playwright-test'
+import type { Page } from '@stablyai/playwright-test'
 import { test, expect } from './helpers/orca-app'
 import {
   splitActiveTerminalPane,
@@ -22,32 +22,6 @@ type DividerGeometry = {
 
 test.use({ seedTestRepo: false })
 
-async function setFullscreen(electronApp: ElectronApplication, page: Page): Promise<void> {
-  await expect
-    .poll(async () => {
-      try {
-        return await electronApp.evaluate(({ BrowserWindow }) => {
-          const window = BrowserWindow.getAllWindows()[0]
-          if (!window) {
-            return false
-          }
-          if (window.isMinimized()) {
-            window.restore()
-          }
-          window.show()
-          window.focus()
-          window.setFullScreen(true)
-          return window.isFullScreen()
-        })
-      } catch {
-        return false
-      }
-    })
-    .toBe(true)
-  await expect.poll(() => page.evaluate(() => innerWidth >= 1000 && innerHeight >= 700)).toBe(true)
-  await page.waitForTimeout(1200)
-}
-
 async function addTestRepo(page: Page, repoPath: string): Promise<void> {
   const repoId = await page.evaluate(async (path) => {
     const result = await window.api.repos.add({ path })
@@ -122,17 +96,21 @@ function gridsMatch(geometry: DividerGeometry): boolean {
 }
 
 test('@headful keeps resizing after the divider loses pointer capture', async ({
-  electronApp,
   orcaPage,
   testRepoPath
 }, testInfo) => {
-  await setFullscreen(electronApp, orcaPage)
+  // Keep the 260px drag above the fit floor regardless of the CI display resolution.
+  await orcaPage.setViewportSize({ width: 1600, height: 1000 })
   await addTestRepo(orcaPage, testRepoPath)
   await ensureTerminalVisible(orcaPage, 30_000)
   await waitForActiveTerminalManager(orcaPage, 30_000)
   await splitActiveTerminalPane(orcaPage, 'vertical')
   await waitForPaneCount(orcaPage, 2, 30_000)
 
+  await expect
+    .poll(async () => (await readDividerGeometry(orcaPage)).second.width)
+    .toBeGreaterThan(400)
+
   const divider = orcaPage.locator('.pane-divider.is-vertical').first()
   await expect(divider).toBeVisible()
   const box = await divider.boundingBox()
@@ -170,11 +148,11 @@ test('@headful keeps resizing after the divider loses pointer capture', async ({
     }
     element.releasePointerCapture(pointerId)
   })
+  // Pending capture changes are dispatched with the next pointer event.
+  await orcaPage.mouse.move(startX + 260, startY, { steps: 10 })
   await expect
     .poll(() => divider.evaluate((element) => Number(element.dataset.captureLossCount ?? '0')))
     .toBe(1)
-
-  await orcaPage.mouse.move(startX + 260, startY, { steps: 10 })
   await orcaPage.mouse.up()
   await expect.poll(async () => gridsMatch(await readDividerGeometry(orcaPage))).toBe(true)
   const after = await readDividerGeometry(orcaPage)
diff --git a/tests/e2e/terminal-reattach-mouse-mode-leak.spec.ts b/tests/e2e/terminal-reattach-mouse-mode-leak.spec.ts
index cbdae675a49..8afca0fb7b5 100644
--- a/tests/e2e/terminal-reattach-mouse-mode-leak.spec.ts
+++ b/tests/e2e/terminal-reattach-mouse-mode-leak.spec.ts
@@ -35,6 +35,7 @@ import {
   discoverActivePtyId,
   execInTerminal,
   waitForActiveTerminalManager,
+  waitForActivePanePtyId,
   waitForPaneCount,
   waitForTerminalOutput
 } from './helpers/terminal'
@@ -146,6 +147,10 @@ test.describe('reattach mouse-mode leak', () => {
       await ensureTerminalVisible(secondLaunch.page)
       await waitForActiveTerminalManager(secondLaunch.page, 30_000)
       await waitForPaneCount(secondLaunch.page, 1, 30_000)
+      // Live output is released only after reattach replay has finished.
+      const reattachedPtyId = await waitForActivePanePtyId(secondLaunch.page)
+      await execInTerminal(secondLaunch.page, reattachedPtyId, 'echo ORCA_REATTACHED_$((21+21))')
+      await waitForTerminalOutput(secondLaunch.page, 'ORCA_REATTACHED_42', 15_000)
 
       // The reattach replay re-arms mouse via rehydrate, then the reset must
       // clear it. Poll until it settles to 'none' (times out if the reset
@@ -247,10 +252,7 @@ test.describe('reattach mouse-mode leak', () => {
           return {
             afterReattach,
             classAfterArm,
-            armedReports,
-            // Whether the reattached pane dynamically bound xterm mouse reporting
-            // at all — class and listener attach together, so either signal proves it.
-            armedMouseReporting: classAfterArm || armedReports > 0
+            armedReports
           }
         } finally {
           disposable.dispose()
@@ -261,16 +263,6 @@ test.describe('reattach mouse-mode leak', () => {
       expect(probe.afterReattach.mode).toBe('none')
       expect(probe.afterReattach.hasEnableMouseClass).toBe(false)
       expect(probe.afterReattach.reports).toBe(0)
-      // Why: the positive control needs the reattached pane to dynamically bind
-      // xterm's browser MouseService. Some headless CI renderers never do on a warm
-      // reattach — the core mouseTrackingMode still flips but no DOM class/listener
-      // attaches — so arming is impossible and the probe can't run. Skip there,
-      // matching the pane-manager/shell guards above; the reset invariant stays
-      // covered by repro-7329 + pty-connection unit tests and this suite on macOS.
-      test.skip(
-        !probe.armedMouseReporting,
-        'Reattached pane does not dynamically bind xterm mouse reporting in this environment'
-      )
       // Positive control proves the motion probe genuinely detects reports.
       expect(probe.classAfterArm).toBe(true)
       expect(probe.armedReports).toBeGreaterThan(0)
diff --git a/tests/e2e/terminal-scroll-intent-follow.spec.ts b/tests/e2e/terminal-scroll-intent-follow.spec.ts
index c4d8b171fed..ae2dfa15466 100644
--- a/tests/e2e/terminal-scroll-intent-follow.spec.ts
+++ b/tests/e2e/terminal-scroll-intent-follow.spec.ts
@@ -168,6 +168,7 @@ async function injectQueuedWriteThenType(page: Page, paneKey: string): Promise<v
   await page.evaluate((targetPaneKey) => {
     const injectionTarget = window as Window & {
       __terminalPtyDataInjection?: { inject: (paneKey: string, data: string) => boolean }
+      __releaseScrollIntentTestWrite?: () => void
     }
     const state = window.__store?.getState()
     const worktreeId = state?.activeWorktreeId
@@ -184,38 +185,44 @@ async function injectQueuedWriteThenType(page: Page, paneKey: string): Promise<v
     }
     const terminal = pane.terminal
     const originalWrite = terminal.write
-    const holder: { write: { data: string; callback?: () => void } | null } = { write: null }
+    const heldWrites: { data: string; callback?: () => void }[] = []
     terminal.write = ((data: string, callback?: () => void) => {
-      holder.write = { data, callback }
+      heldWrites.push({ data, callback })
     }) as typeof terminal.write
+    injectionTarget.__releaseScrollIntentTestWrite = () => {
+      terminal.write = originalWrite
+      delete injectionTarget.__releaseScrollIntentTestWrite
+      for (const held of heldWrites) {
+        originalWrite.call(terminal, held.data, held.callback)
+      }
+    }
     try {
       const payload = '\x1b[?2026h\r\x1b[2KWorking in-flight\x1b[?2026l'
       if (!injectionTarget.__terminalPtyDataInjection?.inject(targetPaneKey, payload)) {
         throw new Error('PTY injector unavailable')
       }
+      if (heldWrites.length === 0) {
+        throw new Error('Foreground terminal write was not captured')
+      }
       const textarea = pane.container.querySelector<HTMLTextAreaElement>('.xterm-helper-textarea')
       if (!textarea) {
         throw new Error('xterm helper textarea unavailable')
       }
       textarea.focus()
-      const event = new KeyboardEvent('keydown', {
-        bubbles: true,
-        cancelable: true,
-        key: 'x',
-        code: 'KeyX'
-      })
-      Object.defineProperty(event, 'keyCode', { configurable: true, value: 88 })
-      Object.defineProperty(event, 'which', { configurable: true, value: 88 })
-      textarea.dispatchEvent(event)
-    } finally {
-      terminal.write = originalWrite
+    } catch (error) {
+      injectionTarget.__releaseScrollIntentTestWrite()
+      throw error
     }
-    const heldWrite = holder.write
-    if (!heldWrite) {
-      throw new Error('Foreground terminal write was not captured')
-    }
-    originalWrite.call(terminal, heldWrite.data, heldWrite.callback)
   }, paneKey)
+  try {
+    await page.keyboard.press('x')
+  } finally {
+    await page.evaluate(() => {
+      ;(
+        window as Window & { __releaseScrollIntentTestWrite?: () => void }
+      ).__releaseScrollIntentTestWrite?.()
+    })
+  }
 }
 
 async function startStreamingFixturePhase1(page: Page): Promise<string> {
@@ -308,5 +315,6 @@ test.describe('terminal scroll intent keeps following output', () => {
         { timeout: 5_000, intervals: [25] }
       )
       .toBe(0)
+    await waitForMarkerAtBottom(orcaPage, 'STREAM_PHASE2_DONE')
   })
 })
diff --git a/tests/e2e/terminal-send-agent-prompt-submit.spec.ts b/tests/e2e/terminal-send-agent-prompt-submit.spec.ts
index 3567cb1d8a2..c1a602dd9d1 100644
--- a/tests/e2e/terminal-send-agent-prompt-submit.spec.ts
+++ b/tests/e2e/terminal-send-agent-prompt-submit.spec.ts
@@ -58,6 +58,7 @@ async function createFakeCodexTerminal(
   if (!worktree) {
     throw new Error(`runtime did not register ${testRepoPath}`)
   }
+  rmSync(fixtureReport, { force: true })
   const created = await client.call<{ terminal: { handle: string } }>('terminal.create', {
     worktree: `id:${worktree.id}`,
     command: [fakeCodexCommand, ...args].join(' '),
diff --git a/tests/e2e/workspace-board-lane-virtualization.spec.ts b/tests/e2e/workspace-board-lane-virtualization.spec.ts
index 69a18e06937..36da44dd357 100644
--- a/tests/e2e/workspace-board-lane-virtualization.spec.ts
+++ b/tests/e2e/workspace-board-lane-virtualization.spec.ts
@@ -307,7 +307,6 @@ test.describe('Workspace board lane virtualization', () => {
   })
 
   test('selects the full lane across a single large marquee scroll jump', async ({ orcaPage }) => {
-    test.skip(true, 'Quarantined by https://github.com/stablyai/orca/issues/12415')
     const statusId = 'virtual-marquee'
     const emptyStatusId = 'virtual-marquee-start'
     await orcaPage.evaluate(
@@ -380,32 +379,36 @@ test.describe('Workspace board lane virtualization', () => {
     }
 
     // Why: CI can overlay individual lane pixels, so choose a live board-owned point.
-    const startPoint = await emptyLaneScroll.evaluate((element) => {
-      const ignored = [
-        '[data-workspace-board-card-id]',
-        'a',
-        'button',
-        'input',
-        'select',
-        'textarea',
-        '[role="button"]',
-        '[role="menu"]',
-        '[role="menuitem"]'
-      ].join(',')
-      const rect = element.getBoundingClientRect()
-      for (let y = Math.ceil(rect.top) + 6; y <= Math.floor(rect.top) + 40; y += 6) {
-        for (let x = Math.ceil(rect.left) + 8; x <= Math.floor(rect.right) - 8; x += 8) {
-          const target = document.elementFromPoint(x, y)
-          if (
-            target?.closest('[data-workspace-board-selection-surface]') &&
-            !target.closest(ignored)
-          ) {
-            return { x, y }
+    const findStartPoint = () =>
+      emptyLaneScroll.evaluate((element) => {
+        const ignored = [
+          '[data-workspace-board-card-id]',
+          'a',
+          'button',
+          'input',
+          'select',
+          'textarea',
+          '[role="button"]',
+          '[role="menu"]',
+          '[role="menuitem"]'
+        ].join(',')
+        const rect = element.getBoundingClientRect()
+        for (let y = Math.ceil(rect.top) + 6; y <= Math.floor(rect.top) + 40; y += 6) {
+          for (let x = Math.ceil(rect.left) + 8; x <= Math.floor(rect.right) - 8; x += 8) {
+            const target = document.elementFromPoint(x, y)
+            if (
+              target?.closest('[data-workspace-board-selection-surface]') &&
+              !target.closest(ignored)
+            ) {
+              return { x, y }
+            }
           }
         }
-      }
-      return null
-    })
+        return null
+      })
+    // The board's clip animation can expose cards before the empty lane accepts pointer hits.
+    await expect.poll(findStartPoint).not.toBeNull()
+    const startPoint = await findStartPoint()
     expect(startPoint, 'the empty start lane must expose board-owned space').not.toBeNull()
     if (!startPoint) {
       throw new Error('Expected empty board space for the marquee start')
diff --git a/tests/e2e/worktree-scroll-to-current.spec.ts b/tests/e2e/worktree-scroll-to-current.spec.ts
index 19c51005cfe..07f9f87d05c 100644
--- a/tests/e2e/worktree-scroll-to-current.spec.ts
+++ b/tests/e2e/worktree-scroll-to-current.spec.ts
@@ -1,3 +1,5 @@
+import { mkdirSync } from 'node:fs'
+import { runProcess } from '../../src/shared/child-process/run-process'
 import type { Page } from '@stablyai/playwright-test'
 import { test, expect } from './helpers/orca-app'
 import { waitForActiveWorktree, waitForSessionReady } from './helpers/store'
@@ -39,22 +41,65 @@ test.describe('Reveal active workspace button', () => {
   // the "outside the virtualized window" test below.
 
   test('clears sidebar filters before revealing a hidden current workspace', async ({
-    orcaPage
-  }) => {
+    orcaPage,
+    testRepoPath
+  }, testInfo) => {
+    const filterRepoPath = testInfo.outputPath('filter-repo')
+    mkdirSync(filterRepoPath, { recursive: true })
+    for (const args of [
+      ['init', filterRepoPath],
+      [
+        '-C',
+        filterRepoPath,
+        '-c',
+        'user.name=E2E',
+        '-c',
+        'user.email=e2e@test.local',
+        'commit',
+        '--allow-empty',
+        '-m',
+        'Filter fixture'
+      ]
+    ]) {
+      const result = await runProcess({ program: 'git', args })
+      expect(result.code, result.stderr).toBe(0)
+    }
+    const filterRepoId = await orcaPage.evaluate(async (repoPath) => {
+      const result = await window.api.repos.add({ path: repoPath })
+      if ('error' in result) {
+        throw new Error(result.error)
+      }
+      return result.repo.id
+    }, filterRepoPath)
+    await expect
+      .poll(() =>
+        orcaPage.evaluate(async (id) => {
+          await window.__store!.getState().fetchRepos()
+          return window.__store!.getState().repos.some((repo) => repo.id === id)
+        }, filterRepoId)
+      )
+      .toBe(true)
     await prepareSidebarForScrollTest(orcaPage)
 
-    const renderedOptions = orcaPage.locator('[data-worktree-sidebar] [role="option"]')
-    await expect(renderedOptions).toHaveCount(2)
-
-    const targetId = await renderedOptions.last().getAttribute('data-worktree-id')
+    // Other specs can add worktrees to the shared repository before this test runs.
+    const targetId = await orcaPage.evaluate((repoPath) => {
+      const state = window.__store!.getState()
+      const repo = state.repos.find((candidate) => candidate.path === repoPath)
+      return repo
+        ? state.worktreesByRepo[repo.id]?.find(
+            (worktree) => worktree.branch === 'refs/heads/e2e-secondary'
+          )?.id
+        : undefined
+    }, testRepoPath)
     if (!targetId) {
-      throw new Error('Bottom workspace row did not expose a data-worktree-id')
+      throw new Error('Seeded secondary worktree is missing')
     }
 
     const targetRows = orcaPage.locator(
       `[data-worktree-sidebar] [data-worktree-id=${JSON.stringify(targetId)}]`
     )
     const targetRow = targetRows.first()
+    await expect(targetRows.and(orcaPage.getByRole('option'))).toHaveCount(1)
     const revealButton = orcaPage.getByRole('button', { name: 'Reveal active workspace' })
 
     await orcaPage.evaluate((targetId) => {
@@ -78,20 +123,17 @@ test.describe('Reveal active workspace button', () => {
     }, targetId)
     await expect(targetRow).toHaveAttribute('aria-current', 'page')
 
-    await orcaPage.evaluate(() => {
-      const store = window.__store
-      if (!store) {
-        throw new Error('window.__store is not available')
-      }
-      store.getState().setFilterRepoIds(['__filtered_repo__'])
-    })
-
-    // Why: the filter's row-hiding side effect is covered deterministically by
-    // visible-worktrees.test.ts. Asserting an empty DOM here over-specifies an
-    // incidental render-settle state that flakes under the shared page; the
-    // contract under test is that reveal clears the filter (asserted below).
+    // Catalog refreshes prune nonexistent IDs, so use a real repo to keep the filter applied.
+    await orcaPage.evaluate((repoId) => {
+      window.__store!.getState().setFilterRepoIds([repoId])
+    }, filterRepoId)
+    await expect(targetRows).toHaveCount(0)
 
     await revealButton.click()
+    await orcaPage
+      .getByRole('dialog', { name: 'Reveal hidden workspace?' })
+      .getByRole('button', { name: 'Clear filters and reveal' })
+      .click()
 
     await expect(targetRow).toBeVisible()
     await expect(targetRow).toHaveAttribute('data-scroll-reveal-highlight', 'true')
diff --git a/tests/tools/google-signin-ua-probe.cjs b/tests/tools/google-signin-ua-probe.cjs
index 7adf06bb7a0..70c834b3d9d 100644
--- a/tests/tools/google-signin-ua-probe.cjs
+++ b/tests/tools/google-signin-ua-probe.cjs
@@ -10,8 +10,8 @@ const MODES = new Set([
   'electron-fixed',
   'firefox-auth',
   'firefox-fixed',
-  // Replicates the SHIPPED app exactly (setupClientHintsOverride +
-  // applyGoogleAuthUserAgent): Firefox UA is written to the WebContents on auth
+  // Replicates the app as it shipped before the UA rewrite was removed
+  // (cleaned Chrome-shaped session UA + the Google auth Firefox switch): Firefox UA is written to the WebContents on auth
   // navs and to the request header only for auth-host URLs; every other request
   // keeps whatever UA the WebContents carries. Logs incoming vs outgoing
   // identity for ALL requests to expose cross-host mismatches during the flow.
@@ -185,7 +185,7 @@ app.whenReady().then(async () => {
         if (mode === 'app-fixed' && currentUa === identities.firefox) {
           removeClientHints(headers)
         } else {
-          // Real setupClientHintsOverride builds Chrome hints once from the
+          // The retired client-hints rewrite built Chrome hints once from the
           // session's cleaned UA (a closure), never from the per-request UA.
           applyChromeClientHints(headers, identities.cleaned)
         }
diff --git a/tests/tools/repro-terminal-send-submit.mjs b/tests/tools/repro-terminal-send-submit.mjs
index 7e1c0152012..41d2464cbbc 100644
--- a/tests/tools/repro-terminal-send-submit.mjs
+++ b/tests/tools/repro-terminal-send-submit.mjs
@@ -186,7 +186,9 @@ async function parentMain() {
   const expectBlocked = hasFlag('expect-blocked')
   const providedHandle = argValue('terminal')
   await mkdir(tempDir, { recursive: true })
-  await rm(reportPath, { force: true })
+  if (!providedHandle) {
+    await rm(reportPath, { force: true })
+  }
 
   let handle = providedHandle
   if (!handle) {
diff --git a/tests/tools/win-crash-survival-e2e/README.md b/tests/tools/win-crash-survival-e2e/README.md
index beb56cf8c67..e0e773767c4 100644
--- a/tests/tools/win-crash-survival-e2e/README.md
+++ b/tests/tools/win-crash-survival-e2e/README.md
@@ -13,8 +13,8 @@ orphaned and PowerShell hard-crashed with a `0xE9` "No process is on the other
 end of the pipe" `FailFast`. Root cause: the terminal **daemon** (which hosts the
 ConPTYs) died together with the main process, severing the console pipe.
 
-The fix re-architected the daemon into a standalone, relocated
-`orca-terminal-daemon.exe` (see
+The fix re-architected the daemon into a standalone daemon host relocated out of
+the install dir (see
 [`src/main/daemon/daemon-host-relocation.ts`](../../src/main/daemon/daemon-host-relocation.ts))
 that is spawned **detached** and **survives main-process death**.
 
diff --git a/tests/tools/win-crash-survival-e2e/crash-step.mjs b/tests/tools/win-crash-survival-e2e/crash-step.mjs
index 43dc18f04cd..3c7d80f51e1 100644
--- a/tests/tools/win-crash-survival-e2e/crash-step.mjs
+++ b/tests/tools/win-crash-survival-e2e/crash-step.mjs
@@ -4,7 +4,7 @@
 // daemon (which hosts the ConPTYs) died with it, severing the console pipe, and
 // PowerShell hard-crashed with a 0xE9 "No process is on the other end of the
 // pipe" FailFast. The fix relocates the daemon into a standalone, detached
-// orca-terminal-daemon.exe that SURVIVES main death (src/main/daemon/
+// host process outside the install dir that SURVIVES main death (src/main/daemon/
 // daemon-host-relocation.ts). This module reproduces the crash and scans for the
 // pwsh FailFast that must no longer occur.
 
diff --git a/tests/tools/win-crash-survival-e2e/run.mjs b/tests/tools/win-crash-survival-e2e/run.mjs
index 4f9d8b242b0..68d8a7a3bd6 100644
--- a/tests/tools/win-crash-survival-e2e/run.mjs
+++ b/tests/tools/win-crash-survival-e2e/run.mjs
@@ -5,7 +5,7 @@
 // process is on the other end of the pipe" FailFast, because the terminal daemon
 // (hosting the ConPTYs) died together with the main process and severed the
 // console pipe. The fix relocates the daemon into a standalone, detached
-// orca-terminal-daemon.exe that survives main death (src/main/daemon/
+// host process outside the install dir that survives main death (src/main/daemon/
 // daemon-host-relocation.ts). win-update-e2e proves the daemon survives a
 // Windows UPDATE; this harness proves it survives a CRASH of the main process.
 //