diff --git a/.github/workflows/computer-e2e.yml b/.github/workflows/computer-e2e.yml
index 731521ea8d6..f6f2c0bd13c 100644
--- a/.github/workflows/computer-e2e.yml
+++ b/.github/workflows/computer-e2e.yml
@@ -20,6 +20,7 @@ on:
       - 'config/scripts/computer-use-smoke.mjs'
       - 'config/scripts/computer-use-smoke.test.mjs'
       - 'config/scripts/daemon-boot-smoke.mjs'
+      - 'config/scripts/daemon-endpoint-handover-smoke.mjs'
       - 'config/scripts/windows-daemon-workspace-close-repro.mjs'
       - 'config/scripts/verify-computer-native.mjs'
       # Why: the native-smoke job boots the built terminal daemon under plain
@@ -135,6 +136,11 @@ jobs:
       # the PR when the built daemon cannot start on ubuntu-22.04 / windows.
       - name: Daemon boot smoke
         run: node config/scripts/daemon-boot-smoke.mjs
+      # Why: a daemon that lost its endpoint name used to delete the replacement's
+      # socket on exit, stranding a live daemon that hosts PTYs nothing can reach.
+      # Only two real processes racing the same endpoint reproduce it.
+      - name: Daemon endpoint handover smoke
+        run: node config/scripts/daemon-endpoint-handover-smoke.mjs
       # Why: workspace removal overlaps graceful renderer teardown with the
       # forced main-process sweep; exercise that exact pair against real ConPTY.
       - name: Windows daemon workspace-close repro
diff --git a/config/scripts/daemon-boot-smoke.mjs b/config/scripts/daemon-boot-smoke.mjs
index 4ed155e8c5f..22c78a21cc2 100644
--- a/config/scripts/daemon-boot-smoke.mjs
+++ b/config/scripts/daemon-boot-smoke.mjs
@@ -18,7 +18,7 @@
 import { fork } from 'node:child_process'
 import { connect } from 'node:net'
 import { randomUUID } from 'node:crypto'
-import { mkdtempSync, readFileSync, rmSync } from 'node:fs'
+import { existsSync, mkdtempSync, readFileSync, readdirSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join, resolve } from 'node:path'
 
@@ -54,30 +54,27 @@ function makeSocketPath(userDataDir) {
   return join(userDataDir, 'daemon.sock')
 }
 
-// Best-effort end-to-end PTY check over the daemon's own control-socket RPC.
-// Connects a single control socket, completes the hello handshake, and calls
-// `ptySpawnHealth` (the daemon spawns a throwaway PTY internally). Resolves
-// true on success, false on any failure — never throws.
-function runPtySpawnHealthCheck(socketPath, tokenPath, protocolVersion) {
-  return new Promise((resolveCheck) => {
+function runDaemonRpc(socketPath, tokenPath, protocolVersion, request, timeoutMs) {
+  return new Promise((resolveRpc, rejectRpc) => {
     let settled = false
     let buffer = ''
     const socket = connect(socketPath)
-    const finish = (ok, reason) => {
+    const finish = (error, response) => {
       if (settled) {
         return
       }
       settled = true
       clearTimeout(timer)
       socket.destroy()
-      if (!ok && reason) {
-        log(`PTY spawn health check skipped (best-effort): ${reason}`)
+      if (error) {
+        rejectRpc(error)
+      } else {
+        resolveRpc(response)
       }
-      resolveCheck(ok)
     }
-    const timer = setTimeout(() => finish(false, 'timed out'), PTY_HEALTH_TIMEOUT_MS)
+    const timer = setTimeout(() => finish(new Error(`${request.type} timed out`)), timeoutMs)
 
-    socket.on('error', (err) => finish(false, err.message))
+    socket.on('error', (error) => finish(error))
     socket.on('connect', () => {
       const token = readFileSync(tokenPath, 'utf8').trim()
       socket.write(
@@ -100,19 +97,19 @@ function runPtySpawnHealthCheck(socketPath, tokenPath, protocolVersion) {
         try {
           msg = JSON.parse(line)
         } catch {
-          finish(false, 'invalid response line')
+          finish(new Error('invalid response line'))
           return
         }
         if (msg.type === 'hello') {
           if (!msg.ok) {
-            finish(false, `hello rejected: ${msg.error ?? 'unknown'}`)
+            finish(new Error(`hello rejected: ${msg.error ?? 'unknown'}`))
             return
           }
-          socket.write(`${JSON.stringify({ id: 'health-1', type: 'ptySpawnHealth' })}\n`)
-        } else if (msg.id === 'health-1') {
+          socket.write(`${JSON.stringify(request)}\n`)
+        } else if (msg.id === request.id) {
           finish(
-            msg.ok === true,
-            msg.ok === true ? undefined : (msg.error ?? 'ptySpawnHealth failed')
+            msg.ok === true ? undefined : new Error(msg.error ?? `${request.type} failed`),
+            msg
           )
           return
         }
@@ -122,28 +119,61 @@ function runPtySpawnHealthCheck(socketPath, tokenPath, protocolVersion) {
   })
 }
 
+// Best-effort: constrained CI runners can make node-pty spawn flaky.
+async function runPtySpawnHealthCheck(socketPath, tokenPath, protocolVersion) {
+  try {
+    await runDaemonRpc(
+      socketPath,
+      tokenPath,
+      protocolVersion,
+      { id: 'health-1', type: 'ptySpawnHealth' },
+      PTY_HEALTH_TIMEOUT_MS
+    )
+    return true
+  } catch (error) {
+    log(`PTY spawn health check skipped (best-effort): ${error.message}`)
+    return false
+  }
+}
+
 async function main() {
   const userDataDir = mkdtempSync(join(tmpdir(), 'orca-daemon-boot-smoke-'))
   const socketPath = makeSocketPath(userDataDir)
   const tokenPath = join(userDataDir, 'daemon.token')
+  const pidPath = join(userDataDir, 'daemon.pid')
+  const launchNonce = randomUUID()
   const protocolVersion = readProtocolVersion()
 
   log(`forking ${entryPath} under plain Node (${process.execPath})`)
-  const child = fork(entryPath, ['--socket', socketPath, '--token', tokenPath], {
-    // Plain Node: no ELECTRON_RUN_AS_NODE. process.execPath is already node in
-    // CI, and this is exactly the runtime where a leaked `require("electron")`
-    // throws MODULE_NOT_FOUND — the failure this smoke exists to catch.
-    stdio: ['ignore', 'pipe', 'pipe', 'ipc'],
-    env: { ...process.env, ORCA_USER_DATA_PATH: userDataDir }
-  })
+  const child = fork(
+    entryPath,
+    [
+      '--socket',
+      socketPath,
+      '--token',
+      tokenPath,
+      '--pid-record',
+      pidPath,
+      '--launch-nonce',
+      launchNonce,
+      '--entry-path',
+      entryPath,
+      '--app-version',
+      'daemon-boot-smoke'
+    ],
+    {
+      // Plain Node: no ELECTRON_RUN_AS_NODE. process.execPath is already node in
+      // CI, and this is exactly the runtime where a leaked `require("electron")`
+      // throws MODULE_NOT_FOUND — the failure this smoke exists to catch.
+      stdio: ['ignore', 'ignore', 'pipe', 'ipc'],
+      env: { ...process.env, ORCA_USER_DATA_PATH: userDataDir }
+    }
+  )
 
   let stderr = ''
   child.stderr?.on('data', (chunk) => {
     stderr += chunk.toString('utf8')
   })
-  child.stdout?.on('data', (chunk) => {
-    process.stdout.write(chunk)
-  })
 
   const cleanup = () => {
     if (child.exitCode === null && child.signalCode === null && child.pid) {
@@ -185,6 +215,25 @@ async function main() {
       })
     })
     log('daemon signaled ready')
+    const pidRecord = JSON.parse(readFileSync(pidPath, 'utf8'))
+    if (
+      pidRecord.pid !== child.pid ||
+      pidRecord.launchNonce !== launchNonce ||
+      pidRecord.entryPath !== entryPath ||
+      pidRecord.appVersion !== 'daemon-boot-smoke'
+    ) {
+      throw new Error('daemon readiness did not publish the expected PID ownership record')
+    }
+    log('PID ownership record matches the ready daemon')
+    if (!existsSync(socketPath)) {
+      throw new Error('daemon did not publish its endpoint at the canonical socket path')
+    }
+    log('endpoint published at the canonical socket path')
+    // Production releases startup-only handles after ready; they can pin the child on Windows.
+    // Diagnostics past this point therefore carry the tail captured up to readiness only.
+    child.stderr?.destroy()
+    stderr += '[boot-smoke] stderr released at readiness, mirroring production\n'
+    child.disconnect()
 
     const ptyHealthy = await runPtySpawnHealthCheck(socketPath, tokenPath, protocolVersion)
     if (ptyHealthy) {
@@ -193,18 +242,39 @@ async function main() {
 
     await new Promise((resolveExit, rejectExit) => {
       const timer = setTimeout(() => {
-        rejectExit(new Error(`daemon did not exit within ${SHUTDOWN_TIMEOUT_MS}ms of SIGTERM`))
+        rejectExit(new Error(`daemon did not exit within ${SHUTDOWN_TIMEOUT_MS}ms of shutdown RPC`))
       }, SHUTDOWN_TIMEOUT_MS)
       child.on('exit', (code, signal) => {
         clearTimeout(timer)
-        log(`daemon exited after signal (code=${code}, signal=${signal})`)
+        log(`daemon exited after shutdown RPC (code=${code}, signal=${signal})`)
         resolveExit()
       })
-      // Why: SIGTERM is the graceful stop on POSIX (the daemon handles it);
-      // Windows has no POSIX signal delivery, so Node maps this to process
-      // termination. Either way the hard assertion is "it stops, no hang".
-      child.kill('SIGTERM')
+      void runDaemonRpc(
+        socketPath,
+        tokenPath,
+        protocolVersion,
+        {
+          id: 'shutdown-1',
+          type: 'shutdown',
+          payload: { killSessions: false }
+        },
+        SHUTDOWN_TIMEOUT_MS
+      ).catch((error) => {
+        clearTimeout(timer)
+        rejectExit(error)
+      })
     })
+    if (existsSync(pidPath)) {
+      throw new Error('daemon left its PID ownership record behind after shutdown')
+    }
+    if (process.platform !== 'win32' && existsSync(socketPath)) {
+      throw new Error('daemon left its endpoint socket behind after shutdown')
+    }
+    // The private bind name is consumed by the publish; nothing may linger in the runtime dir.
+    const leaked = readdirSync(userDataDir).filter((entry) => entry.startsWith('.b'))
+    if (leaked.length > 0) {
+      throw new Error(`daemon leaked private bind names: ${leaked.join(', ')}`)
+    }
 
     log('PASS: daemon booted, served, and shut down under plain Node')
   } finally {
diff --git a/config/scripts/daemon-endpoint-handover-smoke.mjs b/config/scripts/daemon-endpoint-handover-smoke.mjs
new file mode 100644
index 00000000000..b6c39a5b55f
--- /dev/null
+++ b/config/scripts/daemon-endpoint-handover-smoke.mjs
@@ -0,0 +1,164 @@
+/**
+ * Endpoint handover smoke — guards the split-brain failure with real daemon processes.
+ *
+ * The failure it reproduces: a daemon whose endpoint name is reclaimed while it is still
+ * alive used to delete the *replacement's* socket when it finally exited, because libuv
+ * unlinks the pathname a server bound to with no ownership check. The replacement stayed
+ * alive hosting PTYs that nothing could reach — terminals that acknowledge input and never
+ * run it, and that a user cannot fix by restarting the app.
+ *
+ * Unix only: Windows named pipes are not directory entries, so the mechanism cannot occur.
+ *
+ * Usage: node config/scripts/daemon-endpoint-handover-smoke.mjs
+ */
+import { fork } from 'node:child_process'
+import { connect } from 'node:net'
+import { randomUUID } from 'node:crypto'
+import { existsSync, mkdtempSync, rmSync, statSync, unlinkSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+
+const repoRoot = resolve(import.meta.dirname, '..', '..')
+const entryPath = join(repoRoot, 'out', 'main', 'daemon-entry.js')
+const READY_TIMEOUT_MS = 20_000
+const EXIT_TIMEOUT_MS = 15_000
+
+const log = (msg) => console.log(`[endpoint-handover-smoke] ${msg}`)
+
+function bootDaemon(tag, dir, socketPath) {
+  const tokenPath = join(dir, `${tag}.token`)
+  const pidPath = join(dir, `${tag}.pid`)
+  const child = fork(
+    entryPath,
+    [
+      '--socket',
+      socketPath,
+      '--token',
+      tokenPath,
+      '--pid-record',
+      pidPath,
+      '--launch-nonce',
+      randomUUID(),
+      '--entry-path',
+      entryPath,
+      '--app-version',
+      'endpoint-handover-smoke'
+    ],
+    {
+      stdio: ['ignore', 'ignore', 'pipe', 'ipc'],
+      env: { ...process.env, ORCA_USER_DATA_PATH: dir }
+    }
+  )
+  let stderr = ''
+  child.stderr?.on('data', (chunk) => {
+    stderr += chunk.toString('utf8')
+  })
+  return new Promise((resolveReady, rejectReady) => {
+    const timer = setTimeout(
+      () => rejectReady(new Error(`daemon ${tag} never signaled ready.\nstderr:\n${stderr}`)),
+      READY_TIMEOUT_MS
+    )
+    child.on('message', (msg) => {
+      if (msg && typeof msg === 'object' && msg.type === 'ready') {
+        clearTimeout(timer)
+        resolveReady({ child, tokenPath, pidPath })
+      }
+    })
+    child.on('exit', (code) => {
+      clearTimeout(timer)
+      rejectReady(new Error(`daemon ${tag} exited with ${code}.\nstderr:\n${stderr}`))
+    })
+  })
+}
+
+function isReachable(socketPath) {
+  return new Promise((resolveReachable) => {
+    const socket = connect({ path: socketPath })
+    socket.on('connect', () => {
+      socket.destroy()
+      resolveReachable(true)
+    })
+    socket.on('error', () => resolveReachable(false))
+  })
+}
+
+function killAndWait(child) {
+  if (child.exitCode !== null || child.signalCode !== null) {
+    return Promise.resolve()
+  }
+  return new Promise((resolveExit, rejectExit) => {
+    const timer = setTimeout(() => rejectExit(new Error('daemon did not exit')), EXIT_TIMEOUT_MS)
+    child.on('exit', () => {
+      clearTimeout(timer)
+      resolveExit()
+    })
+    child.kill('SIGTERM')
+  })
+}
+
+async function main() {
+  if (process.platform === 'win32') {
+    log('SKIP: named pipes are not filesystem entries, so endpoint handover cannot occur')
+    return
+  }
+  if (!existsSync(entryPath)) {
+    throw new Error(`missing ${entryPath} — run \`pnpm build\` first`)
+  }
+
+  const dir = mkdtempSync(join(tmpdir(), 'orca-endpoint-handover-'))
+  const socketPath = join(dir, 'daemon.sock')
+  let replaced
+  let replacement
+  try {
+    replaced = await bootDaemon('replaced', dir, socketPath)
+    const replacedInode = statSync(socketPath).ino
+    log('daemon A published the endpoint')
+
+    // Reclaim the endpoint name the way daemon replacement does, while A is still alive.
+    unlinkSync(socketPath)
+    replacement = await bootDaemon('replacement', dir, socketPath)
+    const replacementInode = statSync(socketPath).ino
+    if (replacedInode === replacementInode) {
+      throw new Error('daemon B did not publish a distinct endpoint')
+    }
+    if (!(await isReachable(socketPath))) {
+      throw new Error('daemon B is not reachable through the canonical endpoint')
+    }
+    log('daemon B took over the endpoint and is reachable')
+
+    // A exits long after losing the endpoint. This is the step that used to break B.
+    await killAndWait(replaced.child)
+    await new Promise((r) => setTimeout(r, 300))
+
+    if (!existsSync(socketPath) || statSync(socketPath).ino !== replacementInode) {
+      throw new Error("daemon A's late exit deleted daemon B's endpoint")
+    }
+    if (!(await isReachable(socketPath))) {
+      throw new Error('daemon B became unreachable after daemon A exited')
+    }
+    if (!existsSync(replacement.pidPath)) {
+      throw new Error("daemon A's late exit removed daemon B's ownership record")
+    }
+    if (existsSync(replaced.pidPath)) {
+      throw new Error('daemon A left its own ownership record behind')
+    }
+
+    log('PASS: the endpoint owner and the session host stayed the same daemon')
+  } finally {
+    for (const daemon of [replaced, replacement]) {
+      if (daemon && daemon.child.exitCode === null && daemon.child.signalCode === null) {
+        try {
+          daemon.child.kill('SIGKILL')
+        } catch {
+          // already gone
+        }
+      }
+    }
+    rmSync(dir, { recursive: true, force: true })
+  }
+}
+
+main().catch((error) => {
+  console.error(`[endpoint-handover-smoke] FAIL: ${error.message}`)
+  process.exit(1)
+})
diff --git a/config/scripts/orchestration-skill-guidance.test.mjs b/config/scripts/orchestration-skill-guidance.test.mjs
index e869f652e40..080cb4fa785 100644
--- a/config/scripts/orchestration-skill-guidance.test.mjs
+++ b/config/scripts/orchestration-skill-guidance.test.mjs
@@ -275,6 +275,16 @@ describe('orchestration skill guidance', () => {
     )
   })
 
+  it('documents per-invocation model and effort for supervised workers', () => {
+    const workerLoop = getSection(readSkill(), 'Preferred Supervised Worker Loop')
+
+    expect(workerLoop).toContain('opaque provider model id with `--model`')
+    expect(workerLoop).toContain('`--effort` requires `--model`')
+    expect(workerLoop).toContain('neither option can combine with `--terminal`')
+    expect(workerLoop).toContain('--agent claude --model aws-bedrock-opus-5 --effort high --json')
+    expect(workerLoop).toContain('`launch.requested` and `launch.effective`')
+  })
+
   it('never authorizes release from idle, timeout, or worker-side triggers', () => {
     const skill = readSkill()
     const workerLoop = getSection(skill, 'Preferred Supervised Worker Loop')
diff --git a/mobile/app/_layout.tsx b/mobile/app/_layout.tsx
index 1292b6e5f5f..9080cdedcf9 100644
--- a/mobile/app/_layout.tsx
+++ b/mobile/app/_layout.tsx
@@ -10,7 +10,7 @@ import { OrcaLogo } from '../src/components/OrcaLogo'
 import { RpcClientProvider } from '../src/transport/client-context'
 import { getNotificationNavigationTarget } from '../src/notifications/notification-routing'
 import { useOpenNotificationRoute } from '../src/notifications/use-open-notification-route'
-import { loadHosts } from '../src/transport/host-store'
+import { loadHostCatalog } from '../src/transport/host-store'
 import { extractPairingCodeFromUrl } from '../src/transport/pairing'
 import { recoverMobileRelayPairing } from '../src/transport/mobile-relay-pairing-recovery'
 
@@ -95,9 +95,12 @@ export default function RootLayout() {
     }
 
     async function getNavigationTarget(data: unknown) {
-      const hosts = await loadHosts().catch(() => null)
+      const hosts = await loadHostCatalog().catch(() => null)
       return getNotificationNavigationTarget(data, {
-        knownHostIds: hosts ? new Set(hosts.map((host) => host.id)) : undefined
+        knownHostIds: hosts ? new Set(hosts.map((host) => host.id)) : undefined,
+        credentialStatusByHostId: hosts
+          ? new Map(hosts.map((host) => [host.id, host.credentialStatus]))
+          : undefined
       })
     }
 
diff --git a/mobile/app/index.tsx b/mobile/app/index.tsx
index 642cbfac539..70da22348e6 100644
--- a/mobile/app/index.tsx
+++ b/mobile/app/index.tsx
@@ -15,7 +15,8 @@ import {
   UsageBar
 } from '../src/components/AccountUsage'
 import AsyncStorage from '@react-native-async-storage/async-storage'
-import { loadHosts } from '../src/transport/host-store'
+import { loadHostCatalog } from '../src/transport/host-store'
+import { selectConnectableHostProfiles } from '../src/transport/host-catalog-selection'
 import { useOpenMobileHostEdit } from '../src/transport/use-open-mobile-host-edit'
 import { removeHostAndCloseClient } from '../src/transport/host-removal-lifecycle'
 import { fetchHomeHostWorktreeInfo } from '../src/worktree/home-host-worktree-fetch'
@@ -26,13 +27,17 @@ import { createHostConnectRefetchGate } from '../src/transport/host-connect-refe
 import { sendSingleFlightRequest } from '../src/transport/request-single-flight'
 import { useCloseHost, useForceReconnect, usePrimeHosts } from '../src/transport/client-context'
 import { useAllHostClients } from '../src/transport/use-all-host-clients'
+import {
+  resolveHomeHostConnectionState,
+  selectHomeAutoConnectHostIds
+} from '../src/transport/home-host-auto-connect'
 import { classifyConnection } from '../src/transport/connection-health'
 import { subscribeToDesktopNotifications } from '../src/notifications/mobile-notifications'
 import {
   loadMobileOnboardingSteps,
   mobileOnboardingDestination
 } from '../src/onboarding/mobile-onboarding-plan'
-import type { ConnectionState, HostProfile } from '../src/transport/types'
+import type { ConnectionState, HostCatalogEntry, HostProfile } from '../src/transport/types'
 import { triggerMediumImpact } from '../src/platform/haptics'
 import { OrcaLogo } from '../src/components/OrcaLogo'
 import { MobileHostCard } from '../src/components/MobileHostCard'
@@ -224,9 +229,9 @@ export default function HomeScreen() {
   const insets = useSafeAreaInsets()
   // Why: cap/center content on wide/tablet canvases so cards don't stretch edge-to-edge on iPad.
   const { isWideLayout, contentMaxWidth } = useResponsiveLayout()
-  const [hosts, setHosts] = useState<HostProfile[]>([])
+  const [hostCatalog, setHostCatalog] = useState<HostCatalogEntry[]>([])
   const [actionTarget, setActionTarget] = useState<HostProfile | null>(null)
-  const [confirmRemove, setConfirmRemove] = useState<HostProfile | null>(null)
+  const [confirmRemove, setConfirmRemove] = useState<{ id: string; name: string } | null>(null)
   const [hostStates, setHostStates] = useState<Record<string, ConnectionState>>({})
   const [hostAttempts, setHostAttempts] = useState<Record<string, number>>({})
   const [hostLastConnected, setHostLastConnected] = useState<Record<string, number | null>>({})
@@ -242,10 +247,15 @@ export default function HomeScreen() {
   const onboardingOptInCheckedRef = useRef(false)
 
   // Why: shared clients from the per-host store, not N independent WebSockets. See docs/mobile-shared-client-per-host.md.
+  const hosts = useMemo(() => selectConnectableHostProfiles(hostCatalog), [hostCatalog])
   const hostIds = useMemo(() => hosts.map((h) => h.id), [hosts])
   // Why: scoped to the paired hosts so an unpaired desktop's cached reply leaves the header total.
   const stats = useMemo(() => totalHomeStats(statsByHost, hostIds), [statsByHost, hostIds])
-  const allClients = useAllHostClients(hostIds)
+  const autoConnectHostIds = useMemo(() => selectHomeAutoConnectHostIds(hosts), [hosts])
+  const allClients = useAllHostClients(hostIds, {
+    autoConnectHostIds,
+    closeUnusedOnRelease: true
+  })
   const hostPaths = useMemo(
     () => Object.fromEntries(allClients.map(({ hostId, path }) => [hostId, path])),
     [allClients]
@@ -308,12 +318,12 @@ export default function HomeScreen() {
   useFocusEffect(
     useCallback(() => {
       let stale = false
-      void loadHosts().then(async (h) => {
+      void loadHostCatalog().then(async (catalog) => {
         if (stale) {
           return
         }
-        setHosts(h)
-        if (h.length === 0 || onboardingOptInCheckedRef.current) {
+        setHostCatalog(catalog)
+        if (catalog.length === 0 || onboardingOptInCheckedRef.current) {
           return
         }
         onboardingOptInCheckedRef.current = true
@@ -351,6 +361,10 @@ export default function HomeScreen() {
     () => [...hosts].sort((a, b) => b.lastConnected - a.lastConnected),
     [hosts]
   )
+  const sortedHostCatalog = useMemo(
+    () => [...hostCatalog].sort((a, b) => b.lastConnected - a.lastConnected),
+    [hostCatalog]
+  )
 
   // Why: mirror per-host connection state into hostStates so existing render code (status dots) keeps working.
   useEffect(() => {
@@ -389,17 +403,24 @@ export default function HomeScreen() {
         }
       }
       // Why: reflect hosts that dropped from allClients, but only if already tracked — else the initial-acquire frame flips all to 'disconnected'.
-      for (const host of hosts) {
+      for (const host of hostCatalog) {
         if (liveIds.has(host.id)) {
           continue
         }
-        if (!host.publicKeyB64 || !host.deviceToken) {
+        if (host.credentialStatus === 'missing') {
           if (next[host.id] !== 'auth-failed') {
             next[host.id] = 'auth-failed'
             changed = true
           }
           continue
         }
+        if (host.credentialStatus === 'temporarily-unavailable') {
+          if (next[host.id] !== 'disconnected') {
+            next[host.id] = 'disconnected'
+            changed = true
+          }
+          continue
+        }
         const prevState = next[host.id]
         if (prevState && prevState !== 'disconnected' && prevState !== 'auth-failed') {
           next[host.id] = 'disconnected'
@@ -408,14 +429,14 @@ export default function HomeScreen() {
       }
       // Drop entries for hosts we no longer track at all.
       for (const id of Object.keys(next)) {
-        if (!liveIds.has(id) && hosts.some((h) => h.id === id) === false) {
+        if (!liveIds.has(id) && hostCatalog.some((h) => h.id === id) === false) {
           delete next[id]
           changed = true
         }
       }
       return changed ? next : prev
     })
-  }, [allClients, hosts])
+  }, [allClients, hostCatalog])
 
   // Notif/accounts subs + a snapshot read per connect for one host. Lives outside the effect body
   // because react-doctor's effect-needs-cleanup false-positives on `subscribe` inside one; the
@@ -629,7 +650,7 @@ export default function HomeScreen() {
     try {
       await removeHostAndCloseClient(hostToRemove.id, closeHostClient)
       setConfirmRemove(null)
-      setHosts(await loadHosts())
+      setHostCatalog(await loadHostCatalog())
     } catch {
       // Why: ConfirmModal closes on confirm; re-open for retry so the failure isn't silent.
       setConfirmRemove(hostToRemove)
@@ -655,7 +676,7 @@ export default function HomeScreen() {
         </Pressable>
       </View>
 
-      {hosts.length === 0 ? (
+      {hostCatalog.length === 0 ? (
         /* ─── Empty state: onboarding ─── */
         <View
           style={[
@@ -694,7 +715,7 @@ export default function HomeScreen() {
       ) : (
         /* ─── Populated state ─── */
         <FlatList
-          data={sortedHosts}
+          data={sortedHostCatalog}
           keyExtractor={(h) => h.id}
           // Why: reserve insets.bottom so the last row stays reachable above the system nav bar / home indicator.
           contentContainerStyle={[
@@ -732,7 +753,11 @@ export default function HomeScreen() {
           }
           ItemSeparatorComponent={CardGap}
           renderItem={({ item }) => {
-            const state = hostStates[item.id] ?? 'connecting'
+            const state = resolveHomeHostConnectionState(
+              item.id,
+              hostStates[item.id],
+              autoConnectHostIds
+            )
             const attempts = hostAttempts[item.id] ?? 0
             const lastConnectedAt = hostLastConnected[item.id] ?? null
             const verdict = classifyConnection({
@@ -744,14 +769,29 @@ export default function HomeScreen() {
             return (
               <MobileHostCard
                 host={item}
+                credentialStatus={item.credentialStatus}
                 state={state}
                 verdict={verdict}
                 path={hostPaths[item.id] ?? 'lan'}
                 worktreeInfo={worktreeInfo[item.id]}
-                onPress={() => router.push(`/h/${item.id}`)}
+                onPress={() => {
+                  if (item.credentialStatus === 'missing') {
+                    router.push('/pair-scan')
+                  } else if (item.credentialStatus === 'temporarily-unavailable') {
+                    void loadHostCatalog()
+                      .then(setHostCatalog)
+                      .catch(() => Alert.alert('Could not check pairing', 'Please try again.'))
+                  } else {
+                    router.push(`/h/${item.id}`)
+                  }
+                }}
                 onLongPress={() => {
                   triggerMediumImpact()
-                  setActionTarget(item)
+                  if (item.profile) {
+                    setActionTarget(item.profile)
+                  } else {
+                    setConfirmRemove(item)
+                  }
                 }}
               />
             )
@@ -920,7 +960,13 @@ export default function HomeScreen() {
         message={actionTarget ? endpointLabel(actionTarget.endpoint) : undefined}
         actions={getHostListActionSheetActions({
           host: actionTarget,
-          state: actionTarget ? (hostStates[actionTarget.id] ?? 'connecting') : 'disconnected',
+          state: actionTarget
+            ? resolveHomeHostConnectionState(
+                actionTarget.id,
+                hostStates[actionTarget.id],
+                autoConnectHostIds
+              )
+            : 'disconnected',
           hasEverConnected: actionTarget
             ? (hostLastConnected[actionTarget.id] ?? null) != null
             : false,
@@ -928,7 +974,7 @@ export default function HomeScreen() {
           onReconnect: (hostId) => void forceReconnectHost(hostId),
           onDisconnect: closeHostClient,
           onEdit: openMobileHostEdit,
-          onRemove: setConfirmRemove
+          onRemove: (host) => setConfirmRemove(host)
         })}
         onClose={() => setActionTarget(null)}
       />
diff --git a/mobile/app/terminal-settings.tsx b/mobile/app/terminal-settings.tsx
index e6aa691c76e..e55819aa22a 100644
--- a/mobile/app/terminal-settings.tsx
+++ b/mobile/app/terminal-settings.tsx
@@ -12,7 +12,7 @@ import { ChevronLeft, ChevronRight, Smartphone, Type } from 'lucide-react-native
 import { colors, radii, spacing, typography } from '../src/theme/mobile-theme'
 import { loadHosts } from '../src/transport/host-store'
 import type { HostProfile } from '../src/transport/types'
-import { useAllHostClients } from '../src/transport/use-all-host-clients'
+import { useFocusedSettingsHostClients } from '../src/transport/settings-host-client-connections'
 import type { RpcClient } from '../src/transport/rpc-client'
 import { PickerModal, type PickerOption } from '../src/components/PickerModal'
 import { TerminalShortcutSettings } from '../src/components/TerminalShortcutSettings'
@@ -127,7 +127,7 @@ export default function TerminalSettingsScreen() {
     void loadHosts().then(setHosts)
   }, [])
   const hostIds = useMemo(() => hosts.map((h) => h.id), [hosts])
-  const hostClients = useAllHostClients(hostIds)
+  const { clients: hostClients } = useFocusedSettingsHostClients(hostIds)
   const hostClientsById = useMemo(
     () => new Map(hostClients.map((entry) => [entry.hostId, entry.client])),
     [hostClients]
diff --git a/mobile/app/voice-settings.tsx b/mobile/app/voice-settings.tsx
index a09d964b388..8648a1d38e5 100644
--- a/mobile/app/voice-settings.tsx
+++ b/mobile/app/voice-settings.tsx
@@ -9,12 +9,12 @@ import {
   View
 } from 'react-native'
 import { useSafeAreaInsets } from 'react-native-safe-area-context'
-import { useFocusEffect, useRouter } from 'expo-router'
+import { useRouter } from 'expo-router'
 import { ChevronLeft, ChevronRight } from 'lucide-react-native'
 import { colors, radii, spacing, typography } from '../src/theme/mobile-theme'
 import { loadHosts } from '../src/transport/host-store'
 import type { HostProfile } from '../src/transport/types'
-import { useAllHostClients } from '../src/transport/use-all-host-clients'
+import { useFocusedSettingsHostClients } from '../src/transport/settings-host-client-connections'
 import type { RpcClient } from '../src/transport/rpc-client'
 import { BottomDrawer } from '../src/components/BottomDrawer'
 import { VoiceModelList } from '../src/components/VoiceModelList'
@@ -47,7 +47,7 @@ export default function VoiceSettingsScreen(): React.JSX.Element {
     void loadHosts().then(setHosts)
   }, [])
   const hostIds = useMemo(() => hosts.map((h) => h.id), [hosts])
-  const hostClients = useAllHostClients(hostIds)
+  const { clients: hostClients, focused: routeFocused } = useFocusedSettingsHostClients(hostIds)
   // Voice dictation runs on the paired desktop, so pick the first connected host.
   const client: RpcClient | null = useMemo(
     () => hostClients.find((entry) => entry.state === 'connected')?.client ?? null,
@@ -59,15 +59,6 @@ export default function VoiceSettingsScreen(): React.JSX.Element {
   const [error, setError] = useState<string | null>(null)
   const [busyAction, setBusyAction] = useState<ModelBusyAction | null>(null)
   const [modelDrawerOpen, setModelDrawerOpen] = useState(false)
-  const [routeFocused, setRouteFocused] = useState(false)
-
-  useFocusEffect(
-    useCallback(() => {
-      setRouteFocused(true)
-      return () => setRouteFocused(false)
-    }, [])
-  )
-
   const refresh = useCallback(async (): Promise<boolean | undefined> => {
     if (!client) {
       return false
diff --git a/mobile/src/components/MobileHostCard.test.tsx b/mobile/src/components/MobileHostCard.test.tsx
index 6138e311127..5a6855f71dc 100644
--- a/mobile/src/components/MobileHostCard.test.tsx
+++ b/mobile/src/components/MobileHostCard.test.tsx
@@ -3,7 +3,7 @@ import { act, create, type ReactTestRenderer } from 'react-test-renderer'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type { ConnectionVerdict } from '../transport/connection-health'
 import type { MobileConnectionPath } from '../transport/stable-logical-rpc-client'
-import type { ConnectionState, HostProfile } from '../transport/types'
+import type { ConnectionState, HostCredentialStatus, HostProfile } from '../transport/types'
 import {
   markHomeWorktreeCatalogUnavailable,
   type HostWorktreeInfo
@@ -54,6 +54,7 @@ describe('MobileHostCard', () => {
       state?: ConnectionState
       verdict?: ConnectionVerdict
       path?: MobileConnectionPath
+      credentialStatus?: HostCredentialStatus
     }
   ): Promise<string[]> {
     await act(async () => {
@@ -63,6 +64,7 @@ describe('MobileHostCard', () => {
           state: overrides?.state ?? 'connected',
           verdict: overrides?.verdict ?? verdict,
           path: overrides?.path ?? 'lan',
+          credentialStatus: overrides?.credentialStatus,
           worktreeInfo,
           onPress: () => {},
           onLongPress: () => {}
@@ -139,4 +141,28 @@ describe('MobileHostCard', () => {
     expect(lines).not.toContain('0 worktrees')
     expect(lines).not.toContain('Worktree list unavailable')
   })
+
+  it('offers re-pairing when the credential is missing', async () => {
+    const lines = await renderCard(loaded, {
+      state: 'connected',
+      verdict: { kind: 'auth-failed', label: 'Pairing invalid' },
+      credentialStatus: 'missing'
+    })
+
+    expect(lines).toContain('Pairing invalid')
+    expect(lines).toContain('Tap to re-pair with your desktop')
+    expect(lines).not.toContain('12 worktrees · 2 active')
+  })
+
+  it('offers a retry without declaring a transient read failure invalid', async () => {
+    const lines = await renderCard(undefined, {
+      state: 'disconnected',
+      verdict: { kind: 'normal', label: 'Disconnected' },
+      credentialStatus: 'temporarily-unavailable'
+    })
+
+    expect(lines).toContain('Pairing temporarily unavailable')
+    expect(lines).toContain('Unlock your phone, then tap to retry')
+    expect(lines).not.toContain('Pairing invalid')
+  })
 })
diff --git a/mobile/src/components/MobileHostCard.tsx b/mobile/src/components/MobileHostCard.tsx
index f81f936405a..f52f917e22a 100644
--- a/mobile/src/components/MobileHostCard.tsx
+++ b/mobile/src/components/MobileHostCard.tsx
@@ -4,13 +4,14 @@ import type { ConnectionVerdict } from '../transport/connection-health'
 import { verdictDisplayLabel } from '../transport/connection-health'
 import { mobileConnectionPathLabel } from '../transport/mobile-connection-path-label'
 import type { MobileConnectionPath } from '../transport/stable-logical-rpc-client'
-import type { ConnectionState, HostProfile } from '../transport/types'
+import type { ConnectionState, HostCatalogEntry, HostProfile } from '../transport/types'
 import { colors, radii, spacing } from '../theme/mobile-theme'
 import { homeHostWorktreeSummary, type HostWorktreeInfo } from '../worktree/home-worktree-info'
 import { StatusDot } from './StatusDot'
 
 export function MobileHostCard(props: {
-  host: HostProfile
+  host: HostProfile | HostCatalogEntry
+  credentialStatus?: HostCatalogEntry['credentialStatus']
   state: ConnectionState
   verdict: ConnectionVerdict
   path: MobileConnectionPath
@@ -20,13 +21,26 @@ export function MobileHostCard(props: {
   onPress: () => void
   onLongPress: () => void
 }) {
-  const connected = props.state === 'connected'
+  const credentialUnavailable = props.credentialStatus === 'temporarily-unavailable'
+  const credentialMissing = props.credentialStatus === 'missing'
+  const connected = props.state === 'connected' && !credentialUnavailable && !credentialMissing
   // Why: a relay dial can run for seconds behind "Connecting…"/"Reconnecting…"; naming the
   // path mid-wait tells the user the phone is off-LAN rather than hung (F5). Only 'relay' is
   // named — 'lan' doubles as the unknown-path default, so it would be a guess before connect.
   const dialingPath =
     ['connecting', 'handshaking', 'reconnecting'].includes(props.state) && props.path === 'relay'
-  const isError = ['warning', 'unreachable', 'auth-failed'].includes(props.verdict.kind)
+  const isError =
+    credentialMissing || ['warning', 'unreachable', 'auth-failed'].includes(props.verdict.kind)
+  const statusLabel = credentialMissing
+    ? 'Pairing invalid'
+    : credentialUnavailable
+      ? 'Pairing temporarily unavailable'
+      : verdictDisplayLabel(props.verdict)
+  const statusVerdict: ConnectionVerdict = credentialMissing
+    ? { kind: 'auth-failed', label: statusLabel }
+    : credentialUnavailable
+      ? { kind: 'warning', label: statusLabel }
+      : props.verdict
   const worktreeSummary = homeHostWorktreeSummary(props.worktreeInfo)
   return (
     <Pressable
@@ -46,10 +60,19 @@ export function MobileHostCard(props: {
           {props.host.name}
         </Text>
         <View style={styles.meta}>
-          <StatusDot state={props.state} verdict={props.verdict} />
-          <Text style={[styles.metaText, isError && { color: colors.statusRed }]} numberOfLines={1}>
-            {verdictDisplayLabel(props.verdict)}
-            {connected || dialingPath ? ` · ${mobileConnectionPathLabel(props.path)}` : ''}
+          <StatusDot state={props.state} verdict={statusVerdict} />
+          <Text
+            style={[
+              styles.metaText,
+              isError && { color: colors.statusRed },
+              credentialUnavailable && { color: colors.statusAmber }
+            ]}
+            numberOfLines={1}
+          >
+            {statusLabel}
+            {!credentialMissing && !credentialUnavailable && (connected || dialingPath)
+              ? ` · ${mobileConnectionPathLabel(props.path)}`
+              : ''}
           </Text>
         </View>
         {connected && worktreeSummary ? (
@@ -62,6 +85,13 @@ export function MobileHostCard(props: {
             Update desktop Orca and sign in to connect from anywhere
           </Text>
         ) : null}
+        {credentialMissing || credentialUnavailable ? (
+          <Text style={styles.discoveryHint} numberOfLines={2}>
+            {credentialMissing
+              ? 'Tap to re-pair with your desktop'
+              : 'Unlock your phone, then tap to retry'}
+          </Text>
+        ) : null}
       </View>
       <ChevronRight size={16} color={colors.textMuted} />
     </Pressable>
diff --git a/mobile/src/notifications/notification-routing.test.ts b/mobile/src/notifications/notification-routing.test.ts
index 6b5762aefb4..779aa2425e5 100644
--- a/mobile/src/notifications/notification-routing.test.ts
+++ b/mobile/src/notifications/notification-routing.test.ts
@@ -1,5 +1,9 @@
 import { describe, expect, it } from 'vitest'
-import { buildLocalNotificationData, getNotificationNavigationTarget } from './notification-routing'
+import {
+  buildLocalNotificationData,
+  getNotificationNavigationTarget,
+  notificationCredentialRecoveryRoute
+} from './notification-routing'
 
 describe('notification routing', () => {
   it('includes the host id in locally scheduled notification data', () => {
@@ -55,4 +59,32 @@ describe('notification routing', () => {
       )
     ).toBeNull()
   })
+
+  it.each([
+    ['missing', 're-pair'],
+    ['temporarily-unavailable', 'retry']
+  ] as const)('routes %s host credentials to %s recovery', (status, recovery) => {
+    const target = getNotificationNavigationTarget(
+      { hostId: 'host-1', worktreeId: 'repo::/tmp/worktree' },
+      {
+        knownHostIds: new Set(['host-1']),
+        credentialStatusByHostId: new Map([['host-1', status]])
+      }
+    )
+
+    expect(target).toMatchObject({ hostId: 'host-1', credentialRecovery: recovery })
+    expect(notificationCredentialRecoveryRoute(target!)).toBe(
+      status === 'missing' ? '/pair-scan' : '/'
+    )
+  })
+
+  it('keeps ready hosts on the requested notification destination', () => {
+    const target = getNotificationNavigationTarget(
+      { hostId: 'host-1', worktreeId: 'repo::/tmp/worktree' },
+      { credentialStatusByHostId: new Map([['host-1', 'ready']]) }
+    )
+
+    expect(target?.sessionTarget).not.toBeNull()
+    expect(notificationCredentialRecoveryRoute(target!)).toBeNull()
+  })
 })
diff --git a/mobile/src/notifications/notification-routing.ts b/mobile/src/notifications/notification-routing.ts
index feda52c596b..5f81fb3567d 100644
--- a/mobile/src/notifications/notification-routing.ts
+++ b/mobile/src/notifications/notification-routing.ts
@@ -1,5 +1,6 @@
 import type { HostStackRouteTarget } from '../navigation/host-stack-navigation'
 import { mobileSessionRouteTarget } from '../session/mobile-session-route'
+import type { HostCredentialStatus } from '../transport/types'
 
 export type DesktopNotificationSource = 'agent-task-complete' | 'terminal-bell' | 'test'
 
@@ -18,6 +19,7 @@ export type LocalNotificationData = {
 
 export type NotificationNavigationOptions = {
   knownHostIds?: ReadonlySet<string>
+  credentialStatusByHostId?: ReadonlyMap<string, HostCredentialStatus>
 }
 
 function readNonEmptyString(value: unknown): string | null {
@@ -46,8 +48,18 @@ export function buildLocalNotificationData(
 export type NotificationNavigationTarget = Readonly<{
   hostId: string
   sessionTarget: HostStackRouteTarget | null
+  credentialRecovery?: 'retry' | 're-pair'
 }>
 
+export function notificationCredentialRecoveryRoute(
+  target: NotificationNavigationTarget
+): '/' | '/pair-scan' | null {
+  if (target.credentialRecovery === 're-pair') {
+    return '/pair-scan'
+  }
+  return target.credentialRecovery === 'retry' ? '/' : null
+}
+
 export function getNotificationNavigationTarget(
   data: unknown,
   options: NotificationNavigationOptions = {}
@@ -66,8 +78,14 @@ export function getNotificationNavigationTarget(
   }
 
   const worktreeId = readNonEmptyString(record.worktreeId)
+  const credentialStatus = options.credentialStatusByHostId?.get(hostId)
   return {
     hostId,
-    sessionTarget: worktreeId ? mobileSessionRouteTarget({ hostId, worktreeId }) : null
+    sessionTarget: worktreeId ? mobileSessionRouteTarget({ hostId, worktreeId }) : null,
+    ...(credentialStatus === 'missing'
+      ? { credentialRecovery: 're-pair' as const }
+      : credentialStatus === 'temporarily-unavailable'
+        ? { credentialRecovery: 'retry' as const }
+        : {})
   }
 }
diff --git a/mobile/src/notifications/use-open-notification-route.ts b/mobile/src/notifications/use-open-notification-route.ts
index 3a0809c7be8..31d4715c43e 100644
--- a/mobile/src/notifications/use-open-notification-route.ts
+++ b/mobile/src/notifications/use-open-notification-route.ts
@@ -2,7 +2,10 @@ import { useCallback } from 'react'
 import { useRouter } from 'expo-router'
 import { hostStackHostRoute } from '../navigation/host-stack-navigation'
 import { useOpenHostStackRoute } from '../navigation/use-open-host-stack-route'
-import type { NotificationNavigationTarget } from './notification-routing'
+import {
+  notificationCredentialRecoveryRoute,
+  type NotificationNavigationTarget
+} from './notification-routing'
 
 export function useOpenNotificationRoute(): (target: NotificationNavigationTarget) => void {
   const openHostStackRoute = useOpenHostStackRoute()
@@ -10,6 +13,11 @@ export function useOpenNotificationRoute(): (target: NotificationNavigationTarge
 
   return useCallback(
     (target) => {
+      const recoveryRoute = notificationCredentialRecoveryRoute(target)
+      if (recoveryRoute) {
+        router.push(recoveryRoute)
+        return
+      }
       if (target.sessionTarget) {
         openHostStackRoute(target.hostId, target.sessionTarget)
         return
diff --git a/mobile/src/session/mobile-native-chat-controller-contract.ts b/mobile/src/session/mobile-native-chat-controller-contract.ts
new file mode 100644
index 00000000000..a817b47b3ee
--- /dev/null
+++ b/mobile/src/session/mobile-native-chat-controller-contract.ts
@@ -0,0 +1,64 @@
+import type { Dispatch, MutableRefObject, SetStateAction } from 'react'
+import type { detectAgentPermission } from './mobile-native-chat-permission'
+import type { parseAgentQuestion } from './mobile-native-chat-question'
+import type { AskAnswerSelection, AskPrompt, parseAskFromStatus } from './mobile-native-chat-ask'
+import type { MobileNativeChatSendOutcome } from './mobile-native-chat-send'
+import type { MobileNativeChatPendingMessage } from './use-mobile-native-chat-drafts'
+import type { useMobileNativeChatSession } from './use-mobile-native-chat-session'
+import type { MobileNativeChatSessionOptionPickersProps } from './MobileNativeChatSessionOptionPickers'
+
+export type MobileNativeChatController = {
+  /** Whether a tab's effective view is chat (per-tab override, else the default). */
+  isTabChatView: (tabId: string) => boolean
+  toggleTabChatView: (tabId: string) => void
+  showNativeChat: boolean
+  showNativeChatRef: MutableRefObject<boolean>
+  /** Resolved agent for the active chat tab (names the empty-state copy). */
+  nativeChatAgent: string | null
+  chatComposerText: string
+  setChatComposerText: Dispatch<SetStateAction<string>>
+  chatPending: MobileNativeChatPendingMessage[]
+  chatImagePreviewsByMessageId: Record<string, string[]>
+  nativeChatSession: ReturnType<typeof useMobileNativeChatSession>
+  nativeChatAgentWorking: boolean
+  nativeChatStreamingText?: string
+  /** Agent mid-turn, regardless of whether chat is the visible view. */
+  nativeChatStreamLive: boolean
+  /** Host/workspace/tab/session scope for stateful streaming suppression. */
+  nativeChatStreamScopeKey: string
+  nativeChatPermission: ReturnType<typeof detectAgentPermission>
+  nativeChatQuestion: ReturnType<typeof parseAgentQuestion>
+  /** The pending ask, already null while dismissed (dismissal lives here so it
+   *  survives the chat-view subtree unmounting on a view toggle). */
+  nativeChatAsk: ReturnType<typeof parseAskFromStatus>
+  /** Stable key for the current ask card (keys the card component). */
+  nativeChatAskKey: string | null
+  /** Hide the current ask until a genuinely different question arrives. */
+  dismissNativeChatAsk: () => void
+  handleNativeChatAnswerAsk: (
+    prompt: AskPrompt,
+    selections: AskAnswerSelection[]
+  ) => Promise<boolean>
+  handleNativeChatCancelAsk: () => Promise<boolean>
+  handleNativeChatRespondPermission: (text: string) => Promise<boolean>
+  handleNativeChatStop: () => void
+  nativeChatFilePaths: string[]
+  loadNativeChatFiles: (query: string) => void
+  handleNativeChatQuestionAnswer: (text: string) => Promise<boolean>
+  handleNativeChatSend: (text: string, images?: string[]) => Promise<boolean>
+  /** Outcome-preserving send: callers that pasted terminal input beforehand
+   *  (image sends) must see 'unknown' to heal a possibly-orphaned paste. Such a
+   *  caller passes its own `deadline` so the paste it already spent and this text
+   *  body share one budget instead of holding the composer for two. */
+  handleNativeChatSendWithOutcome: (
+    text: string,
+    images?: string[],
+    deadline?: number
+  ) => Promise<MobileNativeChatSendOutcome>
+  /** Launch-context text still parked on the agent's TUI input line, or null.
+   *  Image sends read it to size their leading clear (one Ctrl+U per line). */
+  readSeededLaunchDraft: () => string | null
+  /** Model/session-option pickers for the composer, or null when the active
+   *  agent has no session-option catalog. */
+  nativeChatSessionOptions: MobileNativeChatSessionOptionPickersProps | null
+}
diff --git a/mobile/src/session/use-mobile-native-chat-controller.ts b/mobile/src/session/use-mobile-native-chat-controller.ts
index eaa36fc5051..46012dadbe4 100644
--- a/mobile/src/session/use-mobile-native-chat-controller.ts
+++ b/mobile/src/session/use-mobile-native-chat-controller.ts
@@ -1,101 +1,29 @@
-import {
-  useCallback,
-  useLayoutEffect,
-  useRef,
-  type Dispatch,
-  type MutableRefObject,
-  type SetStateAction
-} from 'react'
+import { useCallback, useLayoutEffect, useRef, type MutableRefObject } from 'react'
 import { encodeNativeChatTranscriptIdentity } from '../../../src/shared/native-chat-transcript-retention'
 import { useMobileSessionViewMode } from './use-mobile-session-view-mode'
 import type { RpcClient } from '../transport/rpc-client'
 import type { ConnectionState } from '../transport/types'
-import {
-  parseAskFromStatus,
-  type AskAnswerSelection,
-  type AskPrompt
-} from './mobile-native-chat-ask'
 import { type MobileNativeChatTab, resolveMobileNativeChat } from './mobile-native-chat-eligibility'
-import { detectAgentPermission } from './mobile-native-chat-permission'
-import { parseAgentQuestion } from './mobile-native-chat-question'
 import { useMobileNativeChatPermissionSend } from './mobile-native-chat-permission-send'
-import type { MobileNativeChatSendOutcome } from './mobile-native-chat-send'
 import { useMobileNativeChatAnswerSend } from './use-mobile-native-chat-answer-send'
 import { useMobileNativeChatAskDismiss } from './use-mobile-native-chat-ask-dismiss'
 import { useMobileNativeChatCancelAsk } from './use-mobile-native-chat-cancel-ask'
-import {
-  useMobileNativeChatDrafts,
-  type MobileNativeChatPendingMessage
-} from './use-mobile-native-chat-drafts'
+import { useMobileNativeChatDrafts } from './use-mobile-native-chat-drafts'
 import { useMobileNativeChatFileSearch } from './use-mobile-native-chat-file-search'
 import { useMobileNativeChatMessageSend } from './use-mobile-native-chat-message-send'
 import { mobileNativeChatScopeKey } from './mobile-native-chat-scope-key'
 import { useMobileNativeChatSession } from './use-mobile-native-chat-session'
 import { useMobileNativeChatSessionOptions } from './use-mobile-native-chat-session-options'
-import type { MobileNativeChatSessionOptionPickersProps } from './MobileNativeChatSessionOptionPickers'
 import { useMobileNativeChatPrompts } from './use-mobile-native-chat-prompts'
 import { useMobileNativeChatStop } from './use-mobile-native-chat-stop'
 import { useNativeChatAcceptedAction } from './use-native-chat-action-outcomes'
 import { useThrottledLatestValue } from './use-throttled-latest-value'
+import type { MobileNativeChatController } from './mobile-native-chat-controller-contract'
+
+export type { MobileNativeChatController } from './mobile-native-chat-controller-contract'
 
 const NATIVE_CHAT_STREAM_THROTTLE_MS = 50
 
-export type MobileNativeChatController = {
-  /** Whether a tab's effective view is chat (per-tab override, else the default). */
-  isTabChatView: (tabId: string) => boolean
-  toggleTabChatView: (tabId: string) => void
-  showNativeChat: boolean
-  showNativeChatRef: MutableRefObject<boolean>
-  /** Resolved agent for the active chat tab (names the empty-state copy). */
-  nativeChatAgent: string | null
-  chatComposerText: string
-  setChatComposerText: Dispatch<SetStateAction<string>>
-  chatPending: MobileNativeChatPendingMessage[]
-  chatImagePreviewsByMessageId: Record<string, string[]>
-  nativeChatSession: ReturnType<typeof useMobileNativeChatSession>
-  nativeChatAgentWorking: boolean
-  nativeChatStreamingText?: string
-  /** Agent mid-turn, regardless of whether chat is the visible view. */
-  nativeChatStreamLive: boolean
-  /** Host/workspace/tab/session scope for stateful streaming suppression. */
-  nativeChatStreamScopeKey: string
-  nativeChatPermission: ReturnType<typeof detectAgentPermission>
-  nativeChatQuestion: ReturnType<typeof parseAgentQuestion>
-  /** The pending ask, already null while dismissed (dismissal lives here so it
-   *  survives the chat-view subtree unmounting on a view toggle). */
-  nativeChatAsk: ReturnType<typeof parseAskFromStatus>
-  /** Stable key for the current ask card (keys the card component). */
-  nativeChatAskKey: string | null
-  /** Hide the current ask until a genuinely different question arrives. */
-  dismissNativeChatAsk: () => void
-  handleNativeChatAnswerAsk: (
-    prompt: AskPrompt,
-    selections: AskAnswerSelection[]
-  ) => Promise<boolean>
-  handleNativeChatCancelAsk: () => Promise<boolean>
-  handleNativeChatRespondPermission: (text: string) => Promise<boolean>
-  handleNativeChatStop: () => void
-  nativeChatFilePaths: string[]
-  loadNativeChatFiles: (query: string) => void
-  handleNativeChatQuestionAnswer: (text: string) => Promise<boolean>
-  handleNativeChatSend: (text: string, images?: string[]) => Promise<boolean>
-  /** Outcome-preserving send: callers that pasted terminal input beforehand
-   *  (image sends) must see 'unknown' to heal a possibly-orphaned paste. Such a
-   *  caller passes its own `deadline` so the paste it already spent and this text
-   *  body share one budget instead of holding the composer for two. */
-  handleNativeChatSendWithOutcome: (
-    text: string,
-    images?: string[],
-    deadline?: number
-  ) => Promise<MobileNativeChatSendOutcome>
-  /** Launch-context text still parked on the agent's TUI input line, or null.
-   *  Image sends read it to size their leading clear (one Ctrl+U per line). */
-  readSeededLaunchDraft: () => string | null
-  /** Model/session-option pickers for the composer, or null when the active
-   *  agent has no session-option catalog. */
-  nativeChatSessionOptions: MobileNativeChatSessionOptionPickersProps | null
-}
-
 /** Owns mobile native-chat state and teardown outside the already dense session
  *  route. The route remains responsible only for choosing and rendering the view. */
 export function useMobileNativeChatController(args: {
diff --git a/mobile/src/transport/client-context.test.ts b/mobile/src/transport/client-context.test.ts
index e7c00008e05..b08899f5333 100644
--- a/mobile/src/transport/client-context.test.ts
+++ b/mobile/src/transport/client-context.test.ts
@@ -21,6 +21,8 @@ vi.mock('./connection-revival-triggers', () => ({
 }))
 
 import { RpcClientProvider, useCloseHost, useForceReconnect, useHostClient } from './client-context'
+import { useAllHostClients } from './use-all-host-clients'
+import { selectHomeAutoConnectHostIds } from './home-host-auto-connect'
 
 type FakeClient = RpcClient & {
   emitState: (state: ConnectionState) => void
@@ -386,3 +388,179 @@ describe('useHostClient', () => {
     expect(connectMock).not.toHaveBeenCalled()
   })
 })
+
+describe('useAllHostClients', () => {
+  it('only opens the requested startup subset', async () => {
+    const host2 = { ...HOST, id: 'host-2', name: 'Host 2' }
+    connectMock.mockReturnValue(makeFakeClient('connected'))
+    loadHostsMock.mockResolvedValue([HOST, host2])
+
+    let renderer: ReactTestRenderer | null = null
+    function Probe(): null {
+      useAllHostClients([HOST.id, host2.id], { autoConnectHostIds: [host2.id] })
+      return null
+    }
+
+    const restore = suppressReactTestRendererDeprecationWarning()
+    try {
+      await act(async () => {
+        renderer = create(createElement(RpcClientProvider, null, createElement(Probe)))
+        await Promise.resolve()
+      })
+      expect(connectMock).toHaveBeenCalledOnce()
+      expect(connectMock).toHaveBeenCalledWith(host2, expect.any(Function))
+    } finally {
+      restore()
+      act(() => renderer?.unmount())
+    }
+  })
+
+  it('keeps startup connection fanout constant for a large saved-host list', async () => {
+    const hosts = Array.from({ length: 1_000 }, (_, index) => ({
+      ...HOST,
+      id: `host-${index}`,
+      name: `Host ${index}`,
+      lastConnected: index
+    }))
+    const hostIds = hosts.map((host) => host.id)
+    const autoConnectHostIds = selectHomeAutoConnectHostIds(hosts)
+    connectMock.mockReturnValue(makeFakeClient('connected'))
+    loadHostsMock.mockResolvedValue(hosts)
+
+    let renderer: ReactTestRenderer | null = null
+    function Probe(): null {
+      useAllHostClients(hostIds, { autoConnectHostIds })
+      return null
+    }
+
+    const restore = suppressReactTestRendererDeprecationWarning()
+    try {
+      await act(async () => {
+        renderer = create(createElement(RpcClientProvider, null, createElement(Probe)))
+        await Promise.resolve()
+      })
+      expect(connectMock).toHaveBeenCalledTimes(3)
+      expect(connectMock.mock.calls.map(([host]) => host.id)).toEqual([
+        'host-999',
+        'host-998',
+        'host-997'
+      ])
+    } finally {
+      restore()
+      act(() => renderer?.unmount())
+    }
+  })
+
+  it('closes a demoted Home client when the recent-host set rotates', async () => {
+    const hosts = [
+      { ...HOST, id: 'host-a', lastConnected: 4 },
+      { ...HOST, id: 'host-b', lastConnected: 3 },
+      { ...HOST, id: 'host-c', lastConnected: 2 },
+      { ...HOST, id: 'host-d', lastConnected: 1 }
+    ]
+    const clients = new Map<string, FakeClient>()
+    connectMock.mockImplementation((profile: typeof HOST) => {
+      const client = makeFakeClient('connected')
+      clients.set(profile.id, client)
+      return client
+    })
+    loadHostsMock.mockResolvedValue(hosts)
+
+    let activeHostIds: string[] = []
+    let renderer: ReactTestRenderer | null = null
+    function Probe({ profiles }: { profiles: typeof hosts }): null {
+      const hostIds = profiles.map((host) => host.id)
+      activeHostIds = useAllHostClients(hostIds, {
+        autoConnectHostIds: selectHomeAutoConnectHostIds(profiles),
+        closeUnusedOnRelease: true
+      }).map(({ hostId }) => hostId)
+      return null
+    }
+
+    const restore = suppressReactTestRendererDeprecationWarning()
+    try {
+      await act(async () => {
+        renderer = create(
+          createElement(RpcClientProvider, null, createElement(Probe, { profiles: hosts }))
+        )
+        await Promise.resolve()
+      })
+      expect(activeHostIds.sort()).toEqual(['host-a', 'host-b', 'host-c'])
+
+      const rotatedHosts = hosts.map((host) =>
+        host.id === 'host-d' ? { ...host, lastConnected: 5 } : host
+      )
+      await act(async () => {
+        renderer?.update(
+          createElement(RpcClientProvider, null, createElement(Probe, { profiles: rotatedHosts }))
+        )
+        await Promise.resolve()
+      })
+
+      expect(connectMock).toHaveBeenCalledTimes(4)
+      expect(activeHostIds.sort()).toEqual(['host-a', 'host-b', 'host-d'])
+      expect(clients.get('host-a')?.closeMock).not.toHaveBeenCalled()
+      expect(clients.get('host-b')?.closeMock).not.toHaveBeenCalled()
+      expect(clients.get('host-c')?.closeMock).toHaveBeenCalledOnce()
+      expect(clients.get('host-d')?.closeMock).not.toHaveBeenCalled()
+    } finally {
+      restore()
+      act(() => renderer?.unmount())
+    }
+  })
+
+  it('retains connect-all behavior when no startup subset is provided', async () => {
+    const host2 = { ...HOST, id: 'host-2', name: 'Host 2' }
+    connectMock.mockReturnValue(makeFakeClient('connected'))
+    loadHostsMock.mockResolvedValue([HOST, host2])
+
+    let renderer: ReactTestRenderer | null = null
+    function Probe(): null {
+      useAllHostClients([HOST.id, host2.id])
+      return null
+    }
+
+    const restore = suppressReactTestRendererDeprecationWarning()
+    try {
+      await act(async () => {
+        renderer = create(createElement(RpcClientProvider, null, createElement(Probe)))
+        await Promise.resolve()
+      })
+      expect(connectMock).toHaveBeenCalledTimes(2)
+    } finally {
+      restore()
+      act(() => renderer?.unmount())
+    }
+  })
+
+  it('allows an excluded host to connect manually', async () => {
+    connectMock.mockReturnValue(makeFakeClient('connected'))
+    loadHostsMock.mockResolvedValue([HOST])
+
+    let reconnect: ((hostId: string) => Promise<void>) | null = null
+    let renderer: ReactTestRenderer | null = null
+    function Probe(): null {
+      useAllHostClients([HOST.id], { autoConnectHostIds: [] })
+      reconnect = useForceReconnect()
+      return null
+    }
+
+    const restore = suppressReactTestRendererDeprecationWarning()
+    try {
+      await act(async () => {
+        renderer = create(createElement(RpcClientProvider, null, createElement(Probe)))
+      })
+      expect(connectMock).not.toHaveBeenCalled()
+      if (!reconnect) {
+        throw new Error('reconnect harness did not initialize')
+      }
+      await act(async () => {
+        await reconnect?.(HOST.id)
+      })
+      expect(connectMock).toHaveBeenCalledOnce()
+    } finally {
+      restore()
+      act(() => renderer?.unmount())
+    }
+  })
+})
diff --git a/mobile/src/transport/client-context.tsx b/mobile/src/transport/client-context.tsx
index 8c00a11b2be..18ee0b7782a 100644
--- a/mobile/src/transport/client-context.tsx
+++ b/mobile/src/transport/client-context.tsx
@@ -14,9 +14,20 @@ import type { RpcClient } from './rpc-client'
 import { connectionLogStore } from './connection-log-buffer'
 import { subscribeConnectionRevivalTriggers } from './connection-revival-triggers'
 import { HostClientOpenRegistry } from './host-client-open-registry'
+import { decrementPendingAcquisition } from './host-client-acquisition-count'
+import {
+  clientActivePath,
+  listHostClients,
+  notifyAllHostListeners,
+  notifyHostStateListeners,
+  primeHostProfiles,
+  subscribeAllHostListener,
+  subscribeHostStateListener,
+  type CloseEntryOptions
+} from './host-client-context-state'
 import { loadHosts } from './host-store'
 import { openHostLogicalClient } from './host-logical-client'
-import type { MobileConnectionPath, StableLogicalRpcClient } from './stable-logical-rpc-client'
+import type { MobileConnectionPath } from './stable-logical-rpc-client'
 import type { ConnectionState, HostProfile } from './types'
 
 type StoreEntry = {
@@ -29,6 +40,8 @@ type StoreEntry = {
 export type RpcClientContextValue = {
   acquire: (hostId: string, host?: HostProfile) => RpcClient | null
   release: (hostId: string) => void
+  releaseAndCloseIfUnused: (hostId: string) => void
+  closeIfUnused: (hostId: string) => void
   forceReconnect: (hostId: string) => Promise<void>
   closeHost: (hostId: string) => void
   getState: (hostId: string) => ConnectionState
@@ -55,30 +68,27 @@ export function RpcClientProvider({ children }: { children: ReactNode }) {
 
   // Pending opens keyed by hostId so two acquire() callers in the same render don't race the host lookup.
   const pendingOpensRef = useRef(new HostClientOpenRegistry())
+  const pendingAcquisitionsRef = useRef<Map<string, number>>(new Map())
 
   // Why: cache of already-loaded HostProfiles so openEntry can skip a second loadHosts()/Keychain pass on cold start.
   const primedHostsRef = useRef<Map<string, HostProfile>>(new Map())
 
-  function notifyHostState(hostId: string, state: ConnectionState) {
-    const set = stateListenersRef.current.get(hostId)
-    if (!set) {
-      return
-    }
-    for (const listener of set) {
-      listener(state)
-    }
-  }
+  const notifyHostState = (hostId: string, state: ConnectionState) =>
+    notifyHostStateListeners(stateListenersRef.current, hostId, state)
+  const notifyAllHosts = () => notifyAllHostListeners(allHostsListenersRef.current)
 
-  function notifyAllHosts() {
-    for (const listener of allHostsListenersRef.current) {
-      listener()
-    }
-  }
-
-  const closeEntry = useCallback((hostId: string) => {
-    pendingOpensRef.current.cancel(hostId)
-    primedHostsRef.current.delete(hostId)
+  const closeEntry = useCallback((hostId: string, options: CloseEntryOptions) => {
     const entry = storeRef.current.get(hostId)
+    const acquisitionCount = entry?.refCount ?? pendingAcquisitionsRef.current.get(hostId) ?? 0
+    pendingOpensRef.current.cancel(hostId)
+    if (options.preserveAcquisitions && acquisitionCount > 0) {
+      pendingAcquisitionsRef.current.set(hostId, acquisitionCount)
+    } else {
+      pendingAcquisitionsRef.current.delete(hostId)
+    }
+    if (options.forgetPrimedHost) {
+      primedHostsRef.current.delete(hostId)
+    }
     entry?.unsubState()
     storeRef.current.delete(hostId)
     entry?.client.close()
@@ -86,6 +96,13 @@ export function RpcClientProvider({ children }: { children: ReactNode }) {
     notifyAllHosts()
   }, [])
 
+  const closeHost = useCallback(
+    (hostId: string) => {
+      closeEntry(hostId, { forgetPrimedHost: true, preserveAcquisitions: true })
+    },
+    [closeEntry]
+  )
+
   const openEntry = useCallback(async (hostId: string): Promise<StoreEntry | null> => {
     const existing = pendingOpensRef.current.getActivePromise(hostId)
     if (existing) {
@@ -151,9 +168,10 @@ export function RpcClientProvider({ children }: { children: ReactNode }) {
       const entry: StoreEntry = {
         client,
         state: client.getState(),
-        refCount: 0,
+        refCount: pendingAcquisitionsRef.current.get(hostId) ?? 0,
         unsubState
       }
+      pendingAcquisitionsRef.current.delete(hostId)
       storeRef.current.set(hostId, entry)
       notifyHostState(hostId, entry.state)
       notifyAllHosts()
@@ -175,50 +193,83 @@ export function RpcClientProvider({ children }: { children: ReactNode }) {
         existing.refCount += 1
         return existing.client
       }
+      pendingAcquisitionsRef.current.set(
+        hostId,
+        (pendingAcquisitionsRef.current.get(hostId) ?? 0) + 1
+      )
       // Trigger async open; returns null this tick — consumers re-call acquire() from an effect that re-runs on state changes.
-      void openEntry(hostId).then((entry) => {
-        if (!entry) {
-          return
-        }
-        entry.refCount += 1
-      })
+      void openEntry(hostId)
       return null
     },
     [openEntry]
   )
 
-  const primeHosts = useCallback((hosts: HostProfile[]) => {
-    for (const host of hosts) {
-      primedHostsRef.current.set(host.id, host)
-    }
-  }, [])
+  const primeHosts = useCallback(
+    (hosts: HostProfile[]) => primeHostProfiles(primedHostsRef.current, hosts),
+    []
+  )
 
   // Why: no idle-close on refcount→0 — transient nav gaps flashed false 'disconnected', so keep sockets alive while foregrounded.
   const release = useCallback((hostId: string) => {
     const entry = storeRef.current.get(hostId)
-    if (!entry) {
+    if (entry) {
+      entry.refCount = Math.max(0, entry.refCount - 1)
       return
     }
-    entry.refCount = Math.max(0, entry.refCount - 1)
+    decrementPendingAcquisition(pendingAcquisitionsRef.current, hostId)
   }, [])
 
+  const releaseAndCloseIfUnused = useCallback(
+    (hostId: string) => {
+      const entry = storeRef.current.get(hostId)
+      if (entry) {
+        entry.refCount = Math.max(0, entry.refCount - 1)
+        if (entry.refCount === 0) {
+          closeEntry(hostId, { forgetPrimedHost: false, preserveAcquisitions: false })
+        }
+        return
+      }
+      if (decrementPendingAcquisition(pendingAcquisitionsRef.current, hostId) === 0) {
+        closeEntry(hostId, { forgetPrimedHost: false, preserveAcquisitions: false })
+      }
+    },
+    [closeEntry]
+  )
+
+  const closeIfUnused = useCallback(
+    (hostId: string) => {
+      const entry = storeRef.current.get(hostId)
+      const pendingCount = pendingAcquisitionsRef.current.get(hostId)
+      const hasPendingOpen = pendingOpensRef.current.getActivePromise(hostId) !== null
+      if (!entry && pendingCount === undefined && !hasPendingOpen) {
+        return
+      }
+      if ((entry?.refCount ?? pendingCount ?? 0) === 0) {
+        closeEntry(hostId, { forgetPrimedHost: false, preserveAcquisitions: false })
+      }
+    },
+    [closeEntry]
+  )
+
   const forceReconnect = useCallback(
     async (hostId: string) => {
       const entry = storeRef.current.get(hostId)
-      // Why: preserve refcount across the swap; via Disconnect→Reconnect the entry is already gone, so fall back to listener count.
-      const listenerCount = stateListenersRef.current.get(hostId)?.size ?? 0
-      const savedRefCount = entry?.refCount ?? Math.max(1, listenerCount)
+      // Why: ownership survives explicit close/re-pair while observers never become synthetic owners.
+      const savedRefCount = entry?.refCount ?? pendingAcquisitionsRef.current.get(hostId) ?? 0
       if (entry) {
         entry.unsubState()
         entry.client.close()
         storeRef.current.delete(hostId)
       }
+      if (savedRefCount > 0) {
+        pendingAcquisitionsRef.current.set(
+          hostId,
+          Math.max(savedRefCount, pendingAcquisitionsRef.current.get(hostId) ?? 0)
+        )
+      }
       // Why: Retry must read amber for the whole reopen, not grey-then-amber.
       notifyHostState(hostId, 'connecting')
-      const fresh = await openEntry(hostId)
-      if (fresh) {
-        fresh.refCount = savedRefCount
-      }
+      await openEntry(hostId)
     },
     [openEntry]
   )
@@ -252,41 +303,17 @@ export function RpcClientProvider({ children }: { children: ReactNode }) {
   }, [])
 
   const subscribeHostState = useCallback(
-    (hostId: string, listener: (state: ConnectionState) => void) => {
-      let set = stateListenersRef.current.get(hostId)
-      if (!set) {
-        set = new Set()
-        stateListenersRef.current.set(hostId, set)
-      }
-      set.add(listener)
-      return () => {
-        const s = stateListenersRef.current.get(hostId)
-        if (!s) {
-          return
-        }
-        s.delete(listener)
-        if (s.size === 0) {
-          stateListenersRef.current.delete(hostId)
-        }
-      }
-    },
+    (hostId: string, listener: (state: ConnectionState) => void) =>
+      subscribeHostStateListener(stateListenersRef.current, hostId, listener),
     []
   )
 
-  const getAllClients = useCallback((): Array<{ hostId: string; client: RpcClient }> => {
-    const out: Array<{ hostId: string; client: RpcClient }> = []
-    for (const [hostId, entry] of storeRef.current) {
-      out.push({ hostId, client: entry.client })
-    }
-    return out
-  }, [])
+  const getAllClients = useCallback(() => listHostClients(storeRef.current), [])
 
-  const subscribeAllHosts = useCallback((listener: () => void) => {
-    allHostsListenersRef.current.add(listener)
-    return () => {
-      allHostsListenersRef.current.delete(listener)
-    }
-  }, [])
+  const subscribeAllHosts = useCallback(
+    (listener: () => void) => subscribeAllHostListener(allHostsListenersRef.current, listener),
+    []
+  )
 
   // Close all clients on provider unmount. Empty deps: [closeEntry] would let Fast Refresh tear down all live sockets.
   // eslint-disable-next-line react-hooks/exhaustive-deps
@@ -294,8 +321,9 @@ export function RpcClientProvider({ children }: { children: ReactNode }) {
     const store = storeRef.current
     return () => {
       pendingOpensRef.current.cancelAll()
+      pendingAcquisitionsRef.current.clear()
       for (const [hostId] of store) {
-        closeEntry(hostId)
+        closeEntry(hostId, { forgetPrimedHost: true, preserveAcquisitions: false })
       }
     }
   }, [])
@@ -313,8 +341,10 @@ export function RpcClientProvider({ children }: { children: ReactNode }) {
     () => ({
       acquire,
       release,
+      releaseAndCloseIfUnused,
+      closeIfUnused,
       forceReconnect,
-      closeHost: closeEntry,
+      closeHost,
       getState,
       getKnownState,
       getReconnectAttempt,
@@ -328,8 +358,10 @@ export function RpcClientProvider({ children }: { children: ReactNode }) {
     [
       acquire,
       release,
+      releaseAndCloseIfUnused,
+      closeIfUnused,
       forceReconnect,
-      closeEntry,
+      closeHost,
       getState,
       getKnownState,
       getReconnectAttempt,
@@ -437,13 +469,3 @@ export function usePrimeHosts(): (hosts: HostProfile[]) => void {
   const ctx = useRpcClientContext()
   return ctx.primeHosts
 }
-
-function clientActivePath(client: RpcClient | undefined): MobileConnectionPath {
-  const logical = client as Partial<StableLogicalRpcClient> | undefined
-  if (typeof logical?.getActivePath !== 'function') {
-    return 'lan'
-  }
-  // Why: mid-migration the active path still names the session being replaced; the
-  // pending one is what the user is actually waiting on (F5).
-  return logical.getPendingPath?.() ?? logical.getActivePath()
-}
diff --git a/mobile/src/transport/home-host-auto-connect.test.ts b/mobile/src/transport/home-host-auto-connect.test.ts
new file mode 100644
index 00000000000..ecf04934809
--- /dev/null
+++ b/mobile/src/transport/home-host-auto-connect.test.ts
@@ -0,0 +1,56 @@
+import { describe, expect, it } from 'vitest'
+import type { HostProfile } from './types'
+import {
+  HOME_AUTO_CONNECT_LIMIT,
+  resolveHomeHostConnectionState,
+  selectHomeAutoConnectHostIds
+} from './home-host-auto-connect'
+
+function host(id: string, lastConnected: number, credentials = true): HostProfile {
+  return {
+    id,
+    name: id,
+    endpoint: `ws://${id}`,
+    deviceToken: credentials ? `token-${id}` : '',
+    publicKeyB64: credentials ? `key-${id}` : '',
+    lastConnected
+  }
+}
+
+describe('home host auto-connect', () => {
+  it('limits startup connections to the most recently used credentialed hosts', () => {
+    const hosts = [
+      host('old', 1),
+      host('newest', 5),
+      host('second', 4),
+      host('third', 3),
+      host('fourth', 2),
+      host('missing-credentials', 6, false)
+    ]
+
+    expect(selectHomeAutoConnectHostIds(hosts)).toEqual(['newest', 'second', 'third'])
+    expect(selectHomeAutoConnectHostIds(hosts)).toHaveLength(HOME_AUTO_CONNECT_LIMIT)
+  })
+
+  it('does not mutate the host card order', () => {
+    const hosts = [host('old', 1), host('new', 2)]
+
+    selectHomeAutoConnectHostIds(hosts)
+
+    expect(hosts.map((item) => item.id)).toEqual(['old', 'new'])
+  })
+
+  it('only presents hosts in the startup subset as connecting before clients open', () => {
+    const autoConnectHostIds = ['recent']
+
+    expect(resolveHomeHostConnectionState('recent', undefined, autoConnectHostIds)).toBe(
+      'connecting'
+    )
+    expect(resolveHomeHostConnectionState('stale', undefined, autoConnectHostIds)).toBe(
+      'disconnected'
+    )
+    expect(resolveHomeHostConnectionState('stale', 'connected', autoConnectHostIds)).toBe(
+      'connected'
+    )
+  })
+})
diff --git a/mobile/src/transport/home-host-auto-connect.ts b/mobile/src/transport/home-host-auto-connect.ts
new file mode 100644
index 00000000000..995d653a0df
--- /dev/null
+++ b/mobile/src/transport/home-host-auto-connect.ts
@@ -0,0 +1,24 @@
+import type { ConnectionState, HostProfile } from './types'
+
+export const HOME_AUTO_CONNECT_LIMIT = 3
+
+export function selectHomeAutoConnectHostIds(
+  hosts: readonly HostProfile[],
+  limit = HOME_AUTO_CONNECT_LIMIT
+): string[] {
+  return [...hosts]
+    .filter((host) => host.deviceToken.length > 0 && host.publicKeyB64.length > 0)
+    .sort(
+      (left, right) => right.lastConnected - left.lastConnected || left.id.localeCompare(right.id)
+    )
+    .slice(0, Math.max(0, limit))
+    .map((host) => host.id)
+}
+
+export function resolveHomeHostConnectionState(
+  hostId: string,
+  state: ConnectionState | undefined,
+  autoConnectHostIds: readonly string[]
+): ConnectionState {
+  return state ?? (autoConnectHostIds.includes(hostId) ? 'connecting' : 'disconnected')
+}
diff --git a/mobile/src/transport/host-catalog-credential-join.ts b/mobile/src/transport/host-catalog-credential-join.ts
new file mode 100644
index 00000000000..e914742ff4e
--- /dev/null
+++ b/mobile/src/transport/host-catalog-credential-join.ts
@@ -0,0 +1,52 @@
+import type { MobileRelayHostOverlay } from './mobile-relay-host-overlay'
+import type { HostListSnapshot } from './host-list-load-sharing'
+import type { HostCatalogEntry, StoredHostProfile } from './types'
+
+export async function joinHostCatalogCredentials(args: {
+  storedHosts: readonly StoredHostProfile[]
+  overlays: ReadonlyMap<string, MobileRelayHostOverlay>
+  tokenCache: Map<string, string>
+  readToken: (hostId: string) => Promise<string | null>
+  getRevision: () => number
+}): Promise<HostListSnapshot> {
+  const catalog: HostCatalogEntry[] = []
+  const profiles: HostListSnapshot['profiles'] = []
+  for (const stored of args.storedHosts) {
+    let token = args.tokenCache.get(stored.id)
+    let credentialStatus: HostCatalogEntry['credentialStatus'] = 'ready'
+    if (!token) {
+      const readRevision = args.getRevision()
+      let fetched: string | null
+      try {
+        fetched = await args.readToken(stored.id)
+      } catch {
+        credentialStatus = 'temporarily-unavailable'
+        fetched = null
+      }
+      if (!fetched && credentialStatus === 'ready') {
+        credentialStatus = 'missing'
+      }
+      token = fetched ?? undefined
+      if (token && readRevision === args.getRevision()) {
+        args.tokenCache.set(stored.id, token)
+      }
+    }
+    const overlay = args.overlays.get(stored.id)
+    const base = {
+      ...stored,
+      ...(overlay
+        ? {
+            endpoints: overlay.endpoints,
+            relayHostId: overlay.relayHostId,
+            relay: overlay.relay
+          }
+        : {})
+    }
+    const profile = token ? { ...base, deviceToken: token } : null
+    catalog.push({ ...base, credentialStatus, profile })
+    if (profile) {
+      profiles.push(profile)
+    }
+  }
+  return { catalog, profiles }
+}
diff --git a/mobile/src/transport/host-catalog-selection.test.ts b/mobile/src/transport/host-catalog-selection.test.ts
new file mode 100644
index 00000000000..5f5d85ca787
--- /dev/null
+++ b/mobile/src/transport/host-catalog-selection.test.ts
@@ -0,0 +1,39 @@
+import { describe, expect, it } from 'vitest'
+import { selectConnectableHostProfiles } from './host-catalog-selection'
+import type { HostCatalogEntry, HostProfile } from './types'
+
+const profile: HostProfile = {
+  id: 'host-ready',
+  name: 'Ready',
+  endpoint: 'ws://127.0.0.1:1',
+  deviceToken: 'token',
+  publicKeyB64: 'key-ready',
+  lastConnected: 0
+}
+
+function unavailable(
+  id: string,
+  credentialStatus: 'temporarily-unavailable' | 'missing'
+): HostCatalogEntry {
+  return {
+    id,
+    name: id,
+    endpoint: `ws://127.0.0.1/${id}`,
+    publicKeyB64: `key-${id}`,
+    lastConnected: 0,
+    credentialStatus,
+    profile: null
+  }
+}
+
+describe('selectConnectableHostProfiles', () => {
+  it('excludes unavailable catalog entries from connection priming', () => {
+    expect(
+      selectConnectableHostProfiles([
+        { ...profile, credentialStatus: 'ready', profile },
+        unavailable('host-locked', 'temporarily-unavailable'),
+        unavailable('host-missing', 'missing')
+      ])
+    ).toEqual([profile])
+  })
+})
diff --git a/mobile/src/transport/host-catalog-selection.ts b/mobile/src/transport/host-catalog-selection.ts
new file mode 100644
index 00000000000..31477dd7f6d
--- /dev/null
+++ b/mobile/src/transport/host-catalog-selection.ts
@@ -0,0 +1,7 @@
+import type { HostCatalogEntry, HostProfile } from './types'
+
+export function selectConnectableHostProfiles(catalog: readonly HostCatalogEntry[]): HostProfile[] {
+  return catalog.flatMap((entry) =>
+    entry.credentialStatus === 'ready' && entry.profile ? [entry.profile] : []
+  )
+}
diff --git a/mobile/src/transport/host-client-acquisition-count.ts b/mobile/src/transport/host-client-acquisition-count.ts
new file mode 100644
index 00000000000..1a1123e5c8b
--- /dev/null
+++ b/mobile/src/transport/host-client-acquisition-count.ts
@@ -0,0 +1,9 @@
+export function decrementPendingAcquisition(pending: Map<string, number>, hostId: string): number {
+  const next = Math.max(0, (pending.get(hostId) ?? 0) - 1)
+  if (next === 0) {
+    pending.delete(hostId)
+  } else {
+    pending.set(hostId, next)
+  }
+  return next
+}
diff --git a/mobile/src/transport/host-client-context-state.ts b/mobile/src/transport/host-client-context-state.ts
new file mode 100644
index 00000000000..e0f7243baa8
--- /dev/null
+++ b/mobile/src/transport/host-client-context-state.ts
@@ -0,0 +1,72 @@
+import type { RpcClient } from './rpc-client'
+import type { MobileConnectionPath, StableLogicalRpcClient } from './stable-logical-rpc-client'
+import type { ConnectionState, HostProfile } from './types'
+
+export type CloseEntryOptions = {
+  forgetPrimedHost: boolean
+  preserveAcquisitions: boolean
+}
+
+export function notifyHostStateListeners(
+  listeners: Map<string, Set<(state: ConnectionState) => void>>,
+  hostId: string,
+  state: ConnectionState
+): void {
+  for (const listener of listeners.get(hostId) ?? []) {
+    listener(state)
+  }
+}
+
+export function notifyAllHostListeners(listeners: Set<() => void>): void {
+  for (const listener of listeners) {
+    listener()
+  }
+}
+
+export function subscribeHostStateListener(
+  listeners: Map<string, Set<(state: ConnectionState) => void>>,
+  hostId: string,
+  listener: (state: ConnectionState) => void
+): () => void {
+  let hostListeners = listeners.get(hostId)
+  if (!hostListeners) {
+    hostListeners = new Set()
+    listeners.set(hostId, hostListeners)
+  }
+  hostListeners.add(listener)
+  return () => {
+    hostListeners.delete(listener)
+    if (hostListeners.size === 0) {
+      listeners.delete(hostId)
+    }
+  }
+}
+
+export function subscribeAllHostListener(
+  listeners: Set<() => void>,
+  listener: () => void
+): () => void {
+  listeners.add(listener)
+  return () => listeners.delete(listener)
+}
+
+export function listHostClients(
+  entries: ReadonlyMap<string, { client: RpcClient }>
+): { hostId: string; client: RpcClient }[] {
+  return [...entries].map(([hostId, entry]) => ({ hostId, client: entry.client }))
+}
+
+export function primeHostProfiles(cache: Map<string, HostProfile>, hosts: HostProfile[]): void {
+  for (const host of hosts) {
+    cache.set(host.id, host)
+  }
+}
+
+export function clientActivePath(client: RpcClient | undefined): MobileConnectionPath {
+  const logical = client as Partial<StableLogicalRpcClient> | undefined
+  if (typeof logical?.getActivePath !== 'function') {
+    return 'lan'
+  }
+  // Why: during migration the pending path is what the user is waiting on.
+  return logical.getPendingPath?.() ?? logical.getActivePath()
+}
diff --git a/mobile/src/transport/host-credential-cleanup.test.ts b/mobile/src/transport/host-credential-cleanup.test.ts
index bd483a3280f..146a845a96b 100644
--- a/mobile/src/transport/host-credential-cleanup.test.ts
+++ b/mobile/src/transport/host-credential-cleanup.test.ts
@@ -1,8 +1,10 @@
 import AsyncStorage from '@react-native-async-storage/async-storage'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import {
+  cancelPendingHostCredentialCleanup,
   loadPendingHostCredentialCleanup,
   loadPendingHostCredentialCleanupIds,
+  recordHostCredentialCleanupIntent,
   resetHostCredentialCleanupForTests,
   retryPendingHostCredentialCleanups,
   scheduleHostCredentialCleanup,
@@ -66,6 +68,12 @@ describe('host credential cleanup', () => {
     expect(deleteCredential).toHaveBeenCalledOnce()
   })
 
+  it('records cleanup intent without starting native deletion', async () => {
+    await recordHostCredentialCleanupIntent('host-1')
+
+    await expect(loadPendingHostCredentialCleanupIds()).resolves.toEqual(['host-1'])
+  })
+
   it('persists cleanup intent before a rejected delete for manual retry', async () => {
     const deleteCredential = vi.fn().mockRejectedValue(new Error('keychain unavailable'))
     const listener = vi.fn()
@@ -78,6 +86,18 @@ describe('host credential cleanup', () => {
     unsubscribe()
   })
 
+  it('cancels stale cleanup intent after replacement publication', async () => {
+    const deleteCredential = vi.fn().mockRejectedValue(new Error('superseded'))
+
+    await scheduleHostCredentialCleanup('host-1', deleteCredential, 20)
+    await vi.waitFor(() => expect(deleteCredential).toHaveBeenCalledOnce())
+    await expect(loadPendingHostCredentialCleanupIds()).resolves.toEqual(['host-1'])
+
+    await cancelPendingHostCredentialCleanup('host-1')
+
+    await expect(loadPendingHostCredentialCleanupIds()).resolves.toEqual([])
+  })
+
   it('records intent before a stalled delete times out', async () => {
     vi.useFakeTimers()
     const deleteCredential = vi.fn(() => new Promise<void>(() => undefined))
diff --git a/mobile/src/transport/host-credential-cleanup.ts b/mobile/src/transport/host-credential-cleanup.ts
index d64e37a98dc..96a2623b514 100644
--- a/mobile/src/transport/host-credential-cleanup.ts
+++ b/mobile/src/transport/host-credential-cleanup.ts
@@ -155,13 +155,17 @@ function startOrJoinDelete(hostId: string, deleteCredential: DeleteHostCredentia
 
 async function recordCleanupIntent(hostId: string): Promise<boolean> {
   try {
-    await addPendingId(hostId)
+    await recordHostCredentialCleanupIntent(hostId)
     return true
   } catch {
     return false
   }
 }
 
+export async function recordHostCredentialCleanupIntent(hostId: string): Promise<void> {
+  await addPendingId(hostId)
+}
+
 async function confirmNativeCleanup(
   hostId: string,
   deleteCredential: DeleteHostCredential,
@@ -209,6 +213,11 @@ export function subscribePendingHostCredentialCleanup(listener: () => void): ()
   return () => pendingListeners.delete(listener)
 }
 
+export async function cancelPendingHostCredentialCleanup(hostId: string): Promise<void> {
+  clearUnrecordedPending(hostId)
+  await removePendingId(hostId)
+}
+
 /**
  * Record cleanup intent, then fire-and-forget the native keychain delete so
  * removeHost never blocks on SecureStore. If the durable intent write fails,
diff --git a/mobile/src/transport/host-credential-write-revision.ts b/mobile/src/transport/host-credential-write-revision.ts
new file mode 100644
index 00000000000..12207aa6a12
--- /dev/null
+++ b/mobile/src/transport/host-credential-write-revision.ts
@@ -0,0 +1,21 @@
+let nextRevision = 1
+const revisionByHostId = new Map<string, number>()
+
+export function getHostCredentialWriteRevision(hostId: string): number {
+  return revisionByHostId.get(hostId) ?? 0
+}
+
+export function markHostCredentialWrite(hostId: string): void {
+  revisionByHostId.set(hostId, nextRevision)
+  nextRevision += 1
+}
+
+export function clearHostCredentialWriteRevision(hostId: string): void {
+  revisionByHostId.delete(hostId)
+}
+
+/** Test-only: clear session credential generations between cases. */
+export function resetHostCredentialWriteRevisionsForTests(): void {
+  nextRevision = 1
+  revisionByHostId.clear()
+}
diff --git a/mobile/src/transport/host-device-token-store.ts b/mobile/src/transport/host-device-token-store.ts
new file mode 100644
index 00000000000..297177e0dbe
--- /dev/null
+++ b/mobile/src/transport/host-device-token-store.ts
@@ -0,0 +1,43 @@
+import AsyncStorage from '@react-native-async-storage/async-storage'
+import { Platform } from 'react-native'
+import {
+  deletePairingKeychainItem,
+  readPairingKeychainItem,
+  writePairingKeychainItem
+} from './pairing-keychain'
+
+// Why: SecureStore keys must match [A-Za-z0-9._-] (colons rejected), so use dots as the separator.
+const TOKEN_KEY_PREFIX = 'orca.host-token.'
+const WEB_TOKEN_KEY_PREFIX = 'orca:web-host-token:'
+
+function tokenKey(hostId: string): string {
+  return `${TOKEN_KEY_PREFIX}${hostId}`
+}
+
+function webTokenKey(hostId: string): string {
+  return `${WEB_TOKEN_KEY_PREFIX}${hostId}`
+}
+
+export async function readHostDeviceToken(hostId: string): Promise<string | null> {
+  // Why: Expo SecureStore has no working web backend; fall back to AsyncStorage only on web so native still uses the keychain.
+  if (Platform.OS === 'web') {
+    return AsyncStorage.getItem(webTokenKey(hostId))
+  }
+  return readPairingKeychainItem(tokenKey(hostId))
+}
+
+export async function writeHostDeviceToken(hostId: string, token: string): Promise<void> {
+  if (Platform.OS === 'web') {
+    await AsyncStorage.setItem(webTokenKey(hostId), token)
+    return
+  }
+  await writePairingKeychainItem(tokenKey(hostId), token)
+}
+
+export async function deleteHostDeviceToken(hostId: string): Promise<void> {
+  if (Platform.OS === 'web') {
+    await AsyncStorage.removeItem(webTokenKey(hostId))
+    return
+  }
+  await deletePairingKeychainItem(tokenKey(hostId))
+}
diff --git a/mobile/src/transport/host-list-load-sharing.ts b/mobile/src/transport/host-list-load-sharing.ts
index ab1e9e2fe89..15995e3ba25 100644
--- a/mobile/src/transport/host-list-load-sharing.ts
+++ b/mobile/src/transport/host-list-load-sharing.ts
@@ -1,15 +1,22 @@
-import type { HostProfile } from './types'
+import type { HostCatalogEntry, HostProfile } from './types'
+
+export type HostListSnapshot = {
+  catalog: HostCatalogEntry[]
+  profiles: HostProfile[]
+}
 
 // Why: concurrent callers share a slow Keychain pass; durable writes invalidate
 // it so later loads cannot receive stale snapshots (#8791).
-let inflight: Promise<HostProfile[]> | null = null
+let inflight: Promise<HostListSnapshot> | null = null
 let revision = 0
 
 export function getHostListLoadRevision(): number {
   return revision
 }
 
-export function shareHostListLoad(load: () => Promise<HostProfile[]>): Promise<HostProfile[]> {
+export function shareHostListLoad(
+  load: () => Promise<HostListSnapshot>
+): Promise<HostListSnapshot> {
   if (inflight) {
     return inflight
   }
diff --git a/mobile/src/transport/host-metadata-store.ts b/mobile/src/transport/host-metadata-store.ts
new file mode 100644
index 00000000000..7962f43dc37
--- /dev/null
+++ b/mobile/src/transport/host-metadata-store.ts
@@ -0,0 +1,51 @@
+import AsyncStorage from '@react-native-async-storage/async-storage'
+import { StoredHostProfileSchema, type HostProfile, type StoredHostProfile } from './types'
+
+const STORAGE_KEY = 'orca:hosts'
+
+export async function loadStoredHostProfiles(): Promise<StoredHostProfile[] | null> {
+  return parseStoredHostProfiles(await AsyncStorage.getItem(STORAGE_KEY))
+}
+
+export async function readStoredHostProfilesForMutation(): Promise<StoredHostProfile[]> {
+  try {
+    const parsed = await loadStoredHostProfiles()
+    if (parsed) {
+      return parsed
+    }
+  } catch {
+    // Normalize storage and payload failures for fail-closed mutations.
+  }
+  throw new Error('host list storage unreadable')
+}
+
+export function writeStoredHostProfiles(hosts: readonly StoredHostProfile[]): Promise<void> {
+  return AsyncStorage.setItem(STORAGE_KEY, JSON.stringify(hosts))
+}
+
+export function toStoredHostProfile(host: HostProfile): StoredHostProfile {
+  const { id, name, endpoint, publicKeyB64, lastConnected } = host
+  return { id, name, endpoint, publicKeyB64, lastConnected }
+}
+
+function parseStoredHostProfiles(raw: string | null): StoredHostProfile[] | null {
+  if (!raw) {
+    return []
+  }
+  try {
+    const parsed = JSON.parse(raw) as unknown
+    if (!Array.isArray(parsed)) {
+      return null
+    }
+    return parsed.flatMap((item) => {
+      // Why: pre-v0.0.3 records embedded secrets; users re-pair instead of migrating them.
+      if (item && typeof item === 'object' && 'deviceToken' in item) {
+        return []
+      }
+      const result = StoredHostProfileSchema.safeParse(item)
+      return result.success ? [result.data] : []
+    })
+  } catch {
+    return null
+  }
+}
diff --git a/mobile/src/transport/host-store.test.ts b/mobile/src/transport/host-store.test.ts
index 997e8a3d42f..ddb8f92a92b 100644
--- a/mobile/src/transport/host-store.test.ts
+++ b/mobile/src/transport/host-store.test.ts
@@ -14,6 +14,8 @@ const secureStoreMock = vi.hoisted(() => ({
 }))
 
 const scheduleCleanupMock = vi.hoisted(() => vi.fn())
+const cancelCleanupMock = vi.hoisted(() => vi.fn())
+const recordCleanupIntentMock = vi.hoisted(() => vi.fn())
 const platformMock = vi.hoisted(() => ({ OS: 'ios' }))
 
 vi.mock('@react-native-async-storage/async-storage', () => ({
@@ -30,11 +32,14 @@ vi.mock('react-native', () => ({
 }))
 
 vi.mock('./host-credential-cleanup', () => ({
+  cancelPendingHostCredentialCleanup: (...args: unknown[]) => cancelCleanupMock(...args),
+  recordHostCredentialCleanupIntent: (...args: unknown[]) => recordCleanupIntentMock(...args),
   scheduleHostCredentialCleanup: (...args: unknown[]) => scheduleCleanupMock(...args),
   retryPendingHostCredentialCleanups: vi.fn()
 }))
 
 import {
+  loadHostCatalog,
   loadHosts,
   MobileRelayUpgradeHostRemovedError,
   removeHost,
@@ -46,6 +51,7 @@ import {
   updateLastConnected
 } from './host-store'
 import { resetMobileRelayHostOverlayStoreForTests } from './mobile-relay-host-overlay-store'
+import { writeMobileRelayCredentialBundle } from './mobile-relay-credential-bundle'
 
 const HOSTS_STORAGE_KEY = 'orca:hosts'
 const OVERLAY_STORAGE_KEY = 'orca:mobile-relay:host-overlays:v2'
@@ -63,6 +69,23 @@ const HOST_TWO = {
   publicKeyB64: 'key-2',
   lastConnected: 0
 }
+const HOST_ONE_RELAY_BUNDLE = {
+  v: 1 as const,
+  hostId: HOST_ONE.id,
+  deviceToken: 'replacement-token',
+  current: {
+    token: 'A'.repeat(43),
+    hash: 'B'.repeat(43),
+    version: 1,
+    expiresAt: 10_000
+  }
+}
+
+function scheduledCleanup(hostId: string): (id: string) => Promise<void> {
+  const cleanup = scheduleCleanupMock.mock.calls.find(([id]) => id === hostId)?.[1]
+  expect(cleanup).toBeTypeOf('function')
+  return cleanup as (id: string) => Promise<void>
+}
 
 describe('host-store list mutations', () => {
   let storedHostsRaw: string
@@ -75,6 +98,10 @@ describe('host-store list mutations', () => {
     resetMobileRelayHostOverlayStoreForTests()
     scheduleCleanupMock.mockReset()
     scheduleCleanupMock.mockResolvedValue(undefined)
+    cancelCleanupMock.mockReset()
+    cancelCleanupMock.mockResolvedValue(undefined)
+    recordCleanupIntentMock.mockReset()
+    recordCleanupIntentMock.mockResolvedValue(undefined)
     storedHostsRaw = JSON.stringify([HOST_ONE, HOST_TWO])
     storedOverlayRaw = null
     asyncStorageMock.getItem.mockImplementation(async (key: string) => {
@@ -93,6 +120,7 @@ describe('host-store list mutations', () => {
         storedOverlayRaw = raw
       }
     })
+    secureStoreMock.setItemAsync.mockResolvedValue(undefined)
     secureStoreMock.getItemAsync.mockImplementation(async (key: string) =>
       key.endsWith(HOST_ONE.id) || key.endsWith(HOST_TWO.id) ? `token-${key.at(-1)}` : null
     )
@@ -114,6 +142,55 @@ describe('host-store list mutations', () => {
     expect(asyncStorageMock.getItem).toHaveBeenCalledOnce()
   })
 
+  it('keeps a host visible when its credential read temporarily fails', async () => {
+    secureStoreMock.getItemAsync.mockImplementation(async (key: string) => {
+      if (key.endsWith(HOST_ONE.id)) {
+        throw new Error('keychain locked')
+      }
+      return key.endsWith(HOST_TWO.id) ? 'token-2' : null
+    })
+
+    const catalog = await loadHostCatalog()
+    const profiles = await loadHosts()
+
+    expect(catalog.map(({ id }) => id)).toEqual([HOST_ONE.id, HOST_TWO.id])
+    expect(catalog.find(({ id }) => id === HOST_ONE.id)).toMatchObject({
+      credentialStatus: 'temporarily-unavailable',
+      profile: null
+    })
+    expect(profiles.map(({ id }) => id)).toEqual([HOST_TWO.id])
+  })
+
+  it('keeps orphaned metadata visible when its credential is missing', async () => {
+    secureStoreMock.getItemAsync.mockImplementation(async (key: string) =>
+      key.endsWith(HOST_TWO.id) ? 'token-2' : null
+    )
+
+    const catalog = await loadHostCatalog()
+
+    expect(catalog.find(({ id }) => id === HOST_ONE.id)).toMatchObject({
+      credentialStatus: 'missing',
+      profile: null
+    })
+  })
+
+  it('keeps existing metadata when pairing a distinct host', async () => {
+    await saveHost({
+      id: 'host-new',
+      name: 'Host 3',
+      endpoint: 'ws://127.0.0.1:3',
+      publicKeyB64: 'key-new',
+      deviceToken: 'token-new',
+      lastConnected: 0
+    })
+
+    expect(JSON.parse(storedHostsRaw).map(({ id }: { id: string }) => id)).toEqual([
+      HOST_ONE.id,
+      HOST_TWO.id,
+      'host-new'
+    ])
+  })
+
   it('fails closed when durable host identity storage is unreadable', async () => {
     asyncStorageMock.getItem.mockRejectedValueOnce(new Error('storage unavailable'))
 
@@ -134,9 +211,173 @@ describe('host-store list mutations', () => {
     })
 
     expect(JSON.parse(storedHostsRaw)).toEqual([{ ...HOST_ONE, endpoint: 'ws://127.0.0.1:3' }])
+    expect(recordCleanupIntentMock.mock.invocationCallOrder[0]).toBeLessThan(
+      asyncStorageMock.setItem.mock.invocationCallOrder[0]!
+    )
     expect(scheduleCleanupMock).toHaveBeenCalledWith('host-duplicate', expect.any(Function))
   })
 
+  it('does not remove same-key metadata when the replacement credential write fails', async () => {
+    const duplicate = {
+      ...HOST_TWO,
+      id: 'host-duplicate',
+      publicKeyB64: HOST_ONE.publicKeyB64
+    }
+    storedHostsRaw = JSON.stringify([HOST_ONE, duplicate])
+    secureStoreMock.setItemAsync.mockRejectedValue(new Error('keychain write failed'))
+
+    await expect(
+      saveHost({ ...HOST_ONE, endpoint: 'ws://127.0.0.1:3', deviceToken: 'replacement-token' })
+    ).rejects.toThrow('keychain write failed')
+
+    expect(JSON.parse(storedHostsRaw)).toEqual([HOST_ONE, duplicate])
+    expect(cancelCleanupMock).toHaveBeenCalledWith(duplicate.id)
+    expect(scheduleCleanupMock).not.toHaveBeenCalled()
+  })
+
+  it('serves a committed replacement token when same-key metadata persistence fails', async () => {
+    const duplicate = {
+      ...HOST_TWO,
+      id: 'host-duplicate',
+      publicKeyB64: HOST_ONE.publicKeyB64
+    }
+    storedHostsRaw = JSON.stringify([HOST_ONE, duplicate])
+    await loadHosts()
+    asyncStorageMock.setItem.mockRejectedValueOnce(new Error('metadata write failed'))
+
+    await expect(
+      saveHost({ ...HOST_ONE, endpoint: 'ws://127.0.0.1:3', deviceToken: 'replacement-token' })
+    ).rejects.toThrow('metadata write failed')
+
+    expect(JSON.parse(storedHostsRaw)).toEqual([HOST_ONE, duplicate])
+    await expect(
+      loadHosts().then((hosts) => hosts.find(({ id }) => id === HOST_ONE.id)?.deviceToken)
+    ).resolves.toBe('replacement-token')
+  })
+
+  it('records cleanup when new same-key metadata fails after its credential commits', async () => {
+    const replacement = {
+      ...HOST_TWO,
+      id: 'host-replacement',
+      publicKeyB64: HOST_ONE.publicKeyB64,
+      deviceToken: 'replacement-token'
+    }
+    asyncStorageMock.setItem.mockRejectedValueOnce(new Error('metadata write failed'))
+
+    await expect(saveHost(replacement)).rejects.toThrow('metadata write failed')
+
+    expect(JSON.parse(storedHostsRaw)).toEqual([HOST_ONE, HOST_TWO])
+    expect(recordCleanupIntentMock).toHaveBeenCalledWith(replacement.id)
+    expect(recordCleanupIntentMock.mock.invocationCallOrder[0]).toBeLessThan(
+      secureStoreMock.setItemAsync.mock.invocationCallOrder[0]!
+    )
+    expect(scheduleCleanupMock).toHaveBeenCalledWith(replacement.id, expect.any(Function))
+  })
+
+  it('does not clean a duplicate id that a later same-key save made authoritative', async () => {
+    const duplicate = {
+      ...HOST_TWO,
+      id: 'host-duplicate',
+      publicKeyB64: HOST_ONE.publicKeyB64
+    }
+    storedHostsRaw = JSON.stringify([HOST_ONE, duplicate])
+    await saveHost({ ...HOST_ONE, deviceToken: 'token-a' })
+    const staleCleanup = scheduledCleanup(duplicate.id)
+
+    await saveHost({ ...duplicate, deviceToken: 'token-b' })
+    await staleCleanup(duplicate.id)
+
+    expect(JSON.parse(storedHostsRaw)).toEqual([duplicate])
+    expect(secureStoreMock.deleteItemAsync).not.toHaveBeenCalled()
+  })
+
+  it('does not let stale removal cleanup delete a replacement relay bundle before publication', async () => {
+    await removeHost(HOST_ONE.id)
+    const staleCleanup = scheduledCleanup(HOST_ONE.id)
+    await writeMobileRelayCredentialBundle(HOST_ONE_RELAY_BUNDLE)
+
+    await expect(staleCleanup(HOST_ONE.id)).rejects.toThrow('credential write superseded cleanup')
+
+    expect(secureStoreMock.deleteItemAsync).not.toHaveBeenCalled()
+  })
+
+  it('keeps stale cleanup pending when a replacement relay write fails', async () => {
+    await removeHost(HOST_ONE.id)
+    const staleCleanup = scheduledCleanup(HOST_ONE.id)
+    secureStoreMock.setItemAsync.mockRejectedValueOnce(new Error('keychain write failed'))
+
+    await expect(writeMobileRelayCredentialBundle(HOST_ONE_RELAY_BUNDLE)).rejects.toThrow(
+      'keychain write failed'
+    )
+    await expect(staleCleanup(HOST_ONE.id)).rejects.toThrow('credential write superseded cleanup')
+
+    expect(secureStoreMock.deleteItemAsync).not.toHaveBeenCalled()
+  })
+
+  it('stops stale cleanup when a replacement relay write starts during token deletion', async () => {
+    await removeHost(HOST_ONE.id)
+    const staleCleanup = scheduledCleanup(HOST_ONE.id)
+    let releaseTokenDelete: () => void = () => {}
+    secureStoreMock.deleteItemAsync.mockReturnValueOnce(
+      new Promise<void>((resolve) => {
+        releaseTokenDelete = resolve
+      })
+    )
+
+    const cleanup = staleCleanup(HOST_ONE.id)
+    await vi.waitFor(() => {
+      expect(secureStoreMock.deleteItemAsync).toHaveBeenCalledWith(
+        'orca.host-token.host-1',
+        expect.anything()
+      )
+    })
+    const bundleWrite = writeMobileRelayCredentialBundle(HOST_ONE_RELAY_BUNDLE)
+    releaseTokenDelete()
+    await bundleWrite
+    await expect(cleanup).rejects.toThrow('credential write superseded cleanup')
+
+    expect(secureStoreMock.deleteItemAsync).not.toHaveBeenCalledWith(
+      'orca.mobile-relay.credentials.host-1',
+      expect.anything()
+    )
+  })
+
+  it('rechecks the write generation immediately before starting credential deletion', async () => {
+    await removeHost(HOST_ONE.id)
+    const staleCleanup = scheduledCleanup(HOST_ONE.id)
+    let resolveCleanupRead: (raw: string) => void = () => {}
+    const cleanupRead = new Promise<string>((resolve) => {
+      resolveCleanupRead = resolve
+    })
+    let cleanupReadStarted = false
+    asyncStorageMock.getItem.mockImplementation(async (key: string) => {
+      if (key === HOSTS_STORAGE_KEY && !cleanupReadStarted) {
+        cleanupReadStarted = true
+        return cleanupRead
+      }
+      if (key === HOSTS_STORAGE_KEY) {
+        return storedHostsRaw
+      }
+      if (key === OVERLAY_STORAGE_KEY) {
+        return storedOverlayRaw
+      }
+      return null
+    })
+
+    const cleanup = staleCleanup(HOST_ONE.id)
+    await vi.waitFor(() => expect(cleanupReadStarted).toBe(true))
+    let bundleWrite: Promise<void> | null = null
+    resolveCleanupRead(storedHostsRaw)
+    queueMicrotask(() => {
+      bundleWrite = writeMobileRelayCredentialBundle(HOST_ONE_RELAY_BUNDLE)
+    })
+    await expect(cleanup).rejects.toThrow('credential write superseded cleanup')
+    await vi.waitFor(() => expect(bundleWrite).not.toBeNull())
+    await bundleWrite
+
+    expect(secureStoreMock.deleteItemAsync).not.toHaveBeenCalled()
+  })
+
   it('clears stale relay state when an existing host is re-paired direct-only', async () => {
     const overlay: MobileRelayHostOverlay = {
       v: 2,
@@ -209,7 +450,63 @@ describe('host-store list mutations', () => {
     expect(scheduleCleanupMock).toHaveBeenCalledWith(HOST_ONE.id, expect.any(Function))
   })
 
-  it('merges v2 endpoints only onto an existing legacy base host', async () => {
+  it('cancels write-ahead cleanup when host metadata removal fails', async () => {
+    asyncStorageMock.setItem.mockRejectedValueOnce(new Error('metadata write failed'))
+
+    await expect(removeHost(HOST_ONE.id)).rejects.toThrow('metadata write failed')
+
+    expect(JSON.parse(storedHostsRaw)).toEqual([HOST_ONE, HOST_TWO])
+    expect(cancelCleanupMock).toHaveBeenCalledWith(HOST_ONE.id)
+  })
+
+  it('does not cancel cleanup from a removal committed during a stalled save', async () => {
+    let releaseTokenWrite: () => void = () => {}
+    secureStoreMock.setItemAsync.mockReturnValueOnce(
+      new Promise<void>((resolve) => {
+        releaseTokenWrite = resolve
+      })
+    )
+
+    const save = saveHost({ ...HOST_ONE, deviceToken: 'replacement-token' })
+    await vi.waitFor(() => expect(secureStoreMock.setItemAsync).toHaveBeenCalledOnce())
+    await removeHost(HOST_ONE.id)
+    releaseTokenWrite()
+    await save
+    await loadHostCatalog()
+
+    expect(JSON.parse(storedHostsRaw)).toEqual([HOST_TWO])
+    expect(scheduleCleanupMock).toHaveBeenCalledWith(HOST_ONE.id, expect.any(Function))
+    expect(cancelCleanupMock).not.toHaveBeenCalled()
+  })
+
+  it('refuses an early same-key token write without durable cleanup intent', async () => {
+    const replacement = {
+      ...HOST_TWO,
+      id: 'host-replacement',
+      publicKeyB64: HOST_ONE.publicKeyB64,
+      deviceToken: 'replacement-token'
+    }
+    recordCleanupIntentMock.mockRejectedValueOnce(new Error('intent storage unavailable'))
+
+    await expect(saveHost(replacement)).rejects.toThrow('intent storage unavailable')
+
+    expect(JSON.parse(storedHostsRaw)).toEqual([HOST_ONE, HOST_TWO])
+    expect(secureStoreMock.setItemAsync).not.toHaveBeenCalled()
+  })
+
+  it('deletes an unpaired credential when cleanup runs without a newer write', async () => {
+    await removeHost(HOST_ONE.id)
+    const cleanup = scheduledCleanup(HOST_ONE.id)
+
+    await cleanup(HOST_ONE.id)
+
+    expect(secureStoreMock.deleteItemAsync).toHaveBeenCalledWith(
+      'orca.host-token.host-1',
+      expect.anything()
+    )
+  })
+
+  it('keeps a concurrently re-published orphan overlay authoritative', async () => {
     const overlay: MobileRelayHostOverlay = {
       v: 2,
       hostId: HOST_ONE.id,
@@ -232,8 +529,26 @@ describe('host-store list mutations', () => {
       }
     }
     storedOverlayRaw = JSON.stringify([overlay, { ...overlay, hostId: 'removed-by-old-build' }])
+    let releaseCleanup: () => void = () => {}
+    scheduleCleanupMock.mockReturnValueOnce(
+      new Promise<void>((resolve) => {
+        releaseCleanup = resolve
+      })
+    )
 
-    const hosts = await loadHosts()
+    const hostsLoad = loadHosts()
+    await vi.waitFor(() => expect(scheduleCleanupMock).toHaveBeenCalled())
+    await saveHost({
+      ...HOST_ONE,
+      id: 'removed-by-old-build',
+      publicKeyB64: 'restored-key',
+      deviceToken: 'restored-token',
+      endpoints: overlay.endpoints,
+      relayHostId: overlay.relayHostId,
+      relay: overlay.relay
+    })
+    releaseCleanup()
+    const hosts = await hostsLoad
 
     expect(hosts.find(({ id }) => id === HOST_ONE.id)).toMatchObject({
       endpoints: overlay.endpoints,
@@ -241,6 +556,10 @@ describe('host-store list mutations', () => {
       relay: overlay.relay
     })
     expect(hosts.some(({ id }) => id === 'removed-by-old-build')).toBe(false)
+    expect(JSON.parse(storedOverlayRaw!)).toContainEqual({
+      ...overlay,
+      hostId: 'removed-by-old-build'
+    })
   })
 
   it('refuses to resurrect a removed host during relay upgrade publication', async () => {
@@ -270,7 +589,9 @@ describe('host-store list mutations', () => {
       expect(JSON.parse(storedHostsRaw)).toEqual([HOST_TWO])
     })
     expect(settled).toBe(false)
-    expect(scheduleCleanupMock).toHaveBeenCalledOnce()
+    expect(recordCleanupIntentMock.mock.invocationCallOrder[0]).toBeLessThan(
+      asyncStorageMock.setItem.mock.invocationCallOrder[0]!
+    )
 
     resolveSchedule?.()
     await removal
@@ -522,6 +843,10 @@ describe('host-store pairing save after an Android encryption rejection', () =>
     resetMobileRelayHostOverlayStoreForTests()
     scheduleCleanupMock.mockReset()
     scheduleCleanupMock.mockResolvedValue(undefined)
+    cancelCleanupMock.mockReset()
+    cancelCleanupMock.mockResolvedValue(undefined)
+    recordCleanupIntentMock.mockReset()
+    recordCleanupIntentMock.mockResolvedValue(undefined)
     storedHostsRaw = '[]'
     storedGenerationRaw = null
     asyncStorageMock.getItem.mockImplementation(async (key: string) => {
diff --git a/mobile/src/transport/host-store.ts b/mobile/src/transport/host-store.ts
index 43657fffe76..99421ffd192 100644
--- a/mobile/src/transport/host-store.ts
+++ b/mobile/src/transport/host-store.ts
@@ -1,20 +1,13 @@
-import AsyncStorage from '@react-native-async-storage/async-storage'
-import { Platform } from 'react-native'
-import {
-  HostProfileSchema,
-  StoredHostProfileSchema,
-  type HostProfile,
-  type StoredHostProfile
-} from './types'
+import { HostProfileSchema } from './types'
+import type { HostCatalogEntry, HostProfile, StoredHostProfile } from './types'
 import { getNextHostNameFromHosts } from './host-names'
 import * as hostListLoads from './host-list-load-sharing'
+import { joinHostCatalogCredentials } from './host-catalog-credential-join'
+import { resetPairingKeychainForTests } from './pairing-keychain'
+import { readHostDeviceToken, writeHostDeviceToken } from './host-device-token-store'
 import {
-  deletePairingKeychainItem,
-  readPairingKeychainItem,
-  resetPairingKeychainForTests,
-  writePairingKeychainItem
-} from './pairing-keychain'
-import {
+  cancelPendingHostCredentialCleanup,
+  recordHostCredentialCleanupIntent,
   retryPendingHostCredentialCleanups,
   scheduleHostCredentialCleanup
 } from './host-credential-cleanup'
@@ -24,137 +17,67 @@ import {
   removeMobileRelayHostOverlays,
   saveMobileRelayHostOverlay
 } from './mobile-relay-host-overlay-store'
-import { deleteMobileRelayCredentialBundle } from './mobile-relay-credential-bundle'
-import { deleteMobileRelayDirectUpgradeJournal } from './mobile-relay-direct-upgrade-journal'
 import { scheduleOrphanedMobileRelayCleanup } from './mobile-relay-orphan-cleanup'
+import {
+  getHostCredentialWriteRevision,
+  markHostCredentialWrite,
+  resetHostCredentialWriteRevisionsForTests
+} from './host-credential-write-revision'
+import { createUnpairedHostCredentialDeletion } from './unpaired-host-credential-deletion'
+import {
+  loadStoredHostProfiles,
+  readStoredHostProfilesForMutation,
+  toStoredHostProfile,
+  writeStoredHostProfiles
+} from './host-metadata-store'
 
-const STORAGE_KEY = 'orca:hosts'
-// Why: SecureStore keys must match [A-Za-z0-9._-] (colons rejected), so use dots as the separator.
-const TOKEN_KEY_PREFIX = 'orca.host-token.'
-const WEB_TOKEN_KEY_PREFIX = 'orca:web-host-token:'
-
-function tokenKey(hostId: string): string {
-  return `${TOKEN_KEY_PREFIX}${hostId}`
-}
-
-function webTokenKey(hostId: string): string {
-  return `${WEB_TOKEN_KEY_PREFIX}${hostId}`
-}
-
-async function readDeviceToken(hostId: string): Promise<string | null> {
-  // Why: Expo SecureStore has no working web backend; fall back to AsyncStorage only on web so native still uses the keychain.
-  if (Platform.OS === 'web') {
-    return AsyncStorage.getItem(webTokenKey(hostId))
-  }
-  return readPairingKeychainItem(tokenKey(hostId))
-}
-
-async function writeDeviceToken(hostId: string, token: string): Promise<void> {
-  if (Platform.OS === 'web') {
-    await AsyncStorage.setItem(webTokenKey(hostId), token)
-    return
-  }
-  await writePairingKeychainItem(tokenKey(hostId), token)
-}
-
-async function deleteDeviceToken(hostId: string): Promise<void> {
-  if (Platform.OS === 'web') {
-    await AsyncStorage.removeItem(webTokenKey(hostId))
-    return
-  }
-  await deletePairingKeychainItem(tokenKey(hostId))
-}
-
-async function deleteHostCredentials(hostId: string): Promise<void> {
-  await deleteDeviceToken(hostId)
-  await deleteMobileRelayCredentialBundle(hostId)
-  await deleteMobileRelayDirectUpgradeJournal(hostId)
+async function commitDeviceToken(hostId: string, token: string): Promise<void> {
+  markHostCredentialWrite(hostId)
+  await writeHostDeviceToken(hostId, token)
+  tokenCache.set(hostId, token)
+  hostListLoads.dropSharedHostListLoad()
 }
 
 // Why: Keychain reads are slow (50-200ms) and loadHosts() runs on every screen mount; cache per-hostId in memory, invalidate on save/remove.
 const tokenCache = new Map<string, string>()
-// Why: serialize RMW of the shared hosts JSON; without a queue concurrent writers drop writes (resurrect a removed host, drop a rename).
+// Why: serialize host metadata RMW so concurrent writers cannot drop updates.
 let hostListMutation: Promise<void> = Promise.resolve()
 
-function parseStoredHosts(raw: string | null): StoredHostProfile[] | null {
-  if (!raw) {
-    return []
-  }
-  try {
-    const parsed = JSON.parse(raw) as unknown
-    if (!Array.isArray(parsed)) {
-      return null
-    }
-    return parsed.flatMap((item) => {
-      // Why: pre-v0.0.3 records stored deviceToken in AsyncStorage; drop them (users re-pair) rather than carry a migration shim.
-      if (item && typeof item === 'object' && 'deviceToken' in item) {
-        return []
-      }
-      const result = StoredHostProfileSchema.safeParse(item)
-      return result.success ? [result.data] : []
-    })
-  } catch {
-    return null
-  }
-}
+export const loadHosts = async (): Promise<HostProfile[]> => (await loadHostListSnapshot()).profiles
+export const loadHostCatalog = async (): Promise<HostCatalogEntry[]> =>
+  (await loadHostListSnapshot()).catalog
 
-export async function loadHosts(): Promise<HostProfile[]> {
+async function loadHostListSnapshot(): Promise<hostListLoads.HostListSnapshot> {
   // Why: writers hold the mutation chain across their full RMW; wait so a load doesn't race a half-written list.
   await hostListMutation
   // Why: deduplicate concurrent loadHosts() calls so simultaneously mounting screens share one Keychain read pass.
-  return hostListLoads.shareHostListLoad(doLoadHosts)
+  return hostListLoads.shareHostListLoad(doLoadHostListSnapshot)
 }
 
-async function doLoadHosts(): Promise<HostProfile[]> {
-  const raw = await AsyncStorage.getItem(STORAGE_KEY)
-  const storedHosts = parseStoredHosts(raw)
+async function doLoadHostListSnapshot(): Promise<hostListLoads.HostListSnapshot> {
+  const storedHosts = await loadStoredHostProfiles()
   if (!storedHosts) {
-    return []
+    return { catalog: [], profiles: [] }
   }
   const overlayState = await loadMobileRelayHostOverlayState(
     new Set(storedHosts.map(({ id }) => id))
   )
+  const orphanWriteRevisions = new Map(
+    overlayState.orphanHostIds.map((hostId) => [hostId, getHostCredentialWriteRevision(hostId)])
+  )
   await scheduleOrphanedMobileRelayCleanup({
     hostIds: overlayState.orphanHostIds,
-    deleteCredential: deleteHostCredentials
+    deleteCredential: (hostId) =>
+      deleteUnpairedHostCredentials(hostId, orphanWriteRevisions.get(hostId) ?? 0),
+    removeOverlay: removeOrphanOverlayIfUnpaired
+  })
+  return joinHostCatalogCredentials({
+    storedHosts,
+    overlays: overlayState.overlays,
+    tokenCache,
+    readToken: readHostDeviceToken,
+    getRevision: hostListLoads.getHostListLoadRevision
   })
-  const overlays = overlayState.overlays
-
-  const out: HostProfile[] = []
-  for (const stored of storedHosts) {
-    let token = tokenCache.get(stored.id)
-    if (!token) {
-      const readRevision = hostListLoads.getHostListLoadRevision()
-      let fetched: string | null
-      try {
-        fetched = await readDeviceToken(stored.id)
-      } catch {
-        // Why: a transient Keychain failure for one entry (e.g. errSecInteractionNotAllowed while locked) must not blank the whole host list; skip it.
-        continue
-      }
-      if (!fetched) {
-        // Why: orphaned metadata with no matching keychain entry; skip rather than surface a half-broken host.
-        continue
-      }
-      token = fetched
-      if (readRevision === hostListLoads.getHostListLoadRevision()) {
-        tokenCache.set(stored.id, token)
-      }
-    }
-    const overlay = overlays.get(stored.id)
-    out.push({
-      ...stored,
-      deviceToken: token,
-      ...(overlay
-        ? {
-            endpoints: overlay.endpoints,
-            relayHostId: overlay.relayHostId,
-            relay: overlay.relay
-          }
-        : {})
-    })
-  }
-  return out
 }
 
 export async function resolvePairingHostIdentity(
@@ -163,91 +86,146 @@ export async function resolvePairingHostIdentity(
 ): Promise<{ id: string; name: string }> {
   // Why: one durable read both preserves an existing identity and names a new host, avoiding duplicate cards.
   await hostListMutation
-  const hosts = await readStoredHostsForMutation()
+  const hosts = await readStoredHostProfilesForMutation()
   const match = hosts.find((host) => host.publicKeyB64 === publicKeyB64)
   return match
     ? { id: match.id, name: match.name }
     : { id: newHostId, name: getNextHostNameFromHosts(hosts) }
 }
 
-async function readStoredHostsForMutation(): Promise<StoredHostProfile[]> {
-  try {
-    const parsed = parseStoredHosts(await AsyncStorage.getItem(STORAGE_KEY))
-    if (!parsed) {
-      // Why: refuse to RMW over unreadable payload — treating it as [] would wipe the durable host list on the next write.
-      throw new Error('host list storage unreadable')
-    }
-    return parsed
-  } catch (error) {
-    if (error instanceof Error && error.message === 'host list storage unreadable') {
-      throw error
-    }
-    throw new Error('host list storage unreadable')
+const deleteUnpairedHostCredentials = createUnpairedHostCredentialDeletion({
+  waitForHostMutations: () => hostListMutation,
+  hasStoredHost: async (hostId) =>
+    (await readStoredHostProfilesForMutation()).some(({ id }) => id === hostId),
+  onDeleted: (hostId) => {
+    tokenCache.delete(hostId)
+    hostListLoads.dropSharedHostListLoad()
   }
+})
+
+function scheduleUnpairedHostCredentialCleanup(hostId: string): Promise<void> {
+  const writeRevision = getHostCredentialWriteRevision(hostId)
+  return scheduleHostCredentialCleanup(hostId, (id) =>
+    deleteUnpairedHostCredentials(id, writeRevision)
+  )
 }
 
-async function mutateStoredHosts(
-  update: (hosts: StoredHostProfile[]) => StoredHostProfile[]
-): Promise<void> {
-  const mutation = hostListMutation.then(async () => {
-    const current = await readStoredHostsForMutation()
-    const next = update(current)
-    await AsyncStorage.setItem(STORAGE_KEY, JSON.stringify(next))
-    hostListLoads.dropSharedHostListLoad()
+function cancelCleanupForStoredHost(hostId: string): void {
+  const cancellation = hostListMutation.then(async () => {
+    const hosts = await readStoredHostProfilesForMutation()
+    if (hosts.some(({ id }) => id === hostId)) {
+      // Register before later removals enqueue their intent, without blocking host loads on cleanup storage.
+      void cancelPendingHostCredentialCleanup(hostId).catch(() => undefined)
+    }
   })
+  hostListMutation = cancellation.catch(() => {})
+}
+
+async function cancelCleanupForDurablyStoredHosts(hostIds: Iterable<string>): Promise<void> {
+  const targets = [...hostIds]
+  return enqueueHostListMutation(async () => {
+    const storedIds = new Set((await readStoredHostProfilesForMutation()).map(({ id }) => id))
+    await Promise.all(
+      targets
+        .filter((hostId) => storedIds.has(hostId))
+        .map((hostId) => cancelPendingHostCredentialCleanup(hostId).catch(() => undefined))
+    )
+  }).catch(() => undefined)
+}
+
+function enqueueHostListMutation(operation: () => Promise<void>): Promise<void> {
+  const mutation = hostListMutation.then(operation)
   hostListMutation = mutation.catch(() => {})
   return mutation
 }
 
-function toStored(host: HostProfile): StoredHostProfile {
-  return {
-    id: host.id,
-    name: host.name,
-    endpoint: host.endpoint,
-    publicKeyB64: host.publicKeyB64,
-    lastConnected: host.lastConnected
-  }
+function removeOrphanOverlayIfUnpaired(hostId: string): Promise<void> {
+  return enqueueHostListMutation(async () => {
+    const hosts = await readStoredHostProfilesForMutation()
+    if (!hosts.some(({ id }) => id === hostId)) {
+      await removeMobileRelayHostOverlay(hostId)
+    }
+  })
+}
+
+async function mutateStoredHosts(
+  update: (hosts: StoredHostProfile[]) => StoredHostProfile[] | Promise<StoredHostProfile[]>
+): Promise<void> {
+  return enqueueHostListMutation(async () => {
+    const current = await readStoredHostProfilesForMutation()
+    const next = await update(current)
+    await writeStoredHostProfiles(next)
+    hostListLoads.dropSharedHostListLoad()
+  })
 }
 
 export class MobileRelayUpgradeHostRemovedError extends Error {}
 
-export async function saveHost(host: HostProfile): Promise<void> {
-  await persistHost(host, false)
-}
+export const saveHost = (host: HostProfile): Promise<void> => persistHost(host, false)
 
-export async function saveExistingHostRelayUpgrade(host: HostProfile): Promise<void> {
-  await persistHost(host, true)
-}
+export const saveExistingHostRelayUpgrade = (host: HostProfile): Promise<void> =>
+  persistHost(host, true)
 
 async function persistHost(host: HostProfile, requireExisting: boolean): Promise<void> {
   const validated = HostProfileSchema.parse(host)
-  const stored = toStored(validated)
+  const stored = toStoredHostProfile(validated)
   const duplicateHostIds = new Set<string>()
   let updatedExistingHost = false
-  await mutateStoredHosts((hosts) => {
-    const index = hosts.findIndex((h) => h.id === stored.id)
-    for (const candidate of hosts) {
-      if (candidate.id !== stored.id && candidate.publicKeyB64 === stored.publicKeyB64) {
-        duplicateHostIds.add(candidate.id)
+  let cleanupIntentRecordedBeforeMetadata = false
+  let tokenCommittedBeforeMetadata = false
+  try {
+    await mutateStoredHosts(async (hosts) => {
+      const index = hosts.findIndex((h) => h.id === stored.id)
+      for (const candidate of hosts) {
+        if (candidate.id !== stored.id && candidate.publicKeyB64 === stored.publicKeyB64) {
+          duplicateHostIds.add(candidate.id)
+        }
+      }
+      let next: StoredHostProfile[]
+      if (index >= 0) {
+        updatedExistingHost = true
+        // Why: an authoritative save is the safe point to collapse pre-existing duplicate rows to the preserved host id.
+        next = hosts
+          .filter(({ id }) => !duplicateHostIds.has(id))
+          .map((candidate) => (candidate.id === stored.id ? stored : candidate))
+      } else if (requireExisting) {
+        // Why: an in-flight relay upgrade must not resurrect a host the user removed.
+        throw new MobileRelayUpgradeHostRemovedError('mobile relay upgrade host was removed')
+      } else {
+        next = [...hosts.filter(({ id }) => !duplicateHostIds.has(id)), stored]
+      }
+      if (duplicateHostIds.size > 0) {
+        if (index < 0) {
+          // Why: process death between the early token write and metadata publication must leave cleanup discoverable.
+          await recordHostCredentialCleanupIntent(stored.id)
+          cleanupIntentRecordedBeforeMetadata = true
+        }
+        for (const duplicateHostId of duplicateHostIds) {
+          await recordHostCredentialCleanupIntent(duplicateHostId)
+        }
+        // Why: never remove the only usable same-key row until its replacement credential is durable.
+        await commitDeviceToken(stored.id, validated.deviceToken)
+        tokenCommittedBeforeMetadata = true
+      }
+      return next
+    })
+  } catch (error) {
+    await cancelCleanupForDurablyStoredHosts(duplicateHostIds)
+    if (cleanupIntentRecordedBeforeMetadata) {
+      try {
+        await scheduleUnpairedHostCredentialCleanup(stored.id)
+      } catch {
+        // The write-ahead cleanup intent remains available for retry.
       }
     }
-    if (index >= 0) {
-      updatedExistingHost = true
-      // Why: an authoritative save is the safe point to collapse pre-existing duplicate rows to the preserved host id.
-      return hosts
-        .filter(({ id }) => !duplicateHostIds.has(id))
-        .map((candidate) => (candidate.id === stored.id ? stored : candidate))
-    }
-    if (requireExisting) {
-      // Why: an in-flight relay upgrade must not resurrect a host the user removed.
-      throw new MobileRelayUpgradeHostRemovedError('mobile relay upgrade host was removed')
-    }
-    return [...hosts.filter(({ id }) => !duplicateHostIds.has(id)), stored]
-  })
-  // Why: write metadata before the keychain token so a crash leaves recoverable orphaned metadata, not an orphaned token that persists forever.
-  await writeDeviceToken(stored.id, validated.deviceToken)
-  tokenCache.set(stored.id, validated.deviceToken)
-  hostListLoads.dropSharedHostListLoad()
+    throw error
+  }
+  if (!tokenCommittedBeforeMetadata) {
+    // Why: the catalog can now surface a failed token write for recovery instead of losing the host.
+    await commitDeviceToken(stored.id, validated.deviceToken)
+  }
+  // Why: a later removal owns its cleanup intent; cancel only while this publication remains authoritative.
+  cancelCleanupForStoredHost(stored.id)
   if (validated.endpoints) {
     await saveMobileRelayHostOverlay({
       v: 2,
@@ -268,9 +246,8 @@ async function persistHost(host: HostProfile, requireExisting: boolean): Promise
     hostListLoads.dropSharedHostListLoad()
   }
   for (const duplicateHostId of duplicateHostIds) {
-    tokenCache.delete(duplicateHostId)
     try {
-      await scheduleHostCredentialCleanup(duplicateHostId, deleteHostCredentials)
+      await scheduleUnpairedHostCredentialCleanup(duplicateHostId)
     } catch {
       // Metadata is already deduplicated; orphan-token recovery is best-effort.
     }
@@ -278,7 +255,23 @@ async function persistHost(host: HostProfile, requireExisting: boolean): Promise
 }
 
 export async function removeHost(hostId: string): Promise<void> {
-  await mutateStoredHosts((hosts) => hosts.filter((h) => h.id !== hostId))
+  let cleanupIntentRecorded = false
+  try {
+    await mutateStoredHosts(async (hosts) => {
+      try {
+        await recordHostCredentialCleanupIntent(hostId)
+        cleanupIntentRecorded = true
+      } catch {
+        // Removal remains authoritative when cleanup intent storage is unavailable.
+      }
+      return hosts.filter((h) => h.id !== hostId)
+    })
+  } catch (error) {
+    if (cleanupIntentRecorded) {
+      await cancelCleanupForDurablyStoredHosts([hostId])
+    }
+    throw error
+  }
   tokenCache.delete(hostId)
   try {
     await removeMobileRelayHostOverlay(hostId)
@@ -288,7 +281,7 @@ export async function removeHost(hostId: string): Promise<void> {
   }
   // Why: keychain delete can stall/reject; await only the durable cleanup intent so removeHost can't freeze the UI.
   try {
-    await scheduleHostCredentialCleanup(hostId, deleteHostCredentials)
+    await scheduleUnpairedHostCredentialCleanup(hostId)
   } catch {
     // Metadata is already committed; orphan-token recovery is best-effort.
   }
@@ -299,7 +292,9 @@ export async function retryPendingHostCredentialCleanup(): Promise<{
   remainingIds: string[]
   storageUnreadable: boolean
 }> {
-  return retryPendingHostCredentialCleanups(deleteHostCredentials)
+  return retryPendingHostCredentialCleanups((hostId) =>
+    deleteUnpairedHostCredentials(hostId, getHostCredentialWriteRevision(hostId))
+  )
 }
 
 // Why: single mutation pass commits name + endpoint atomically so a mid-save failure can't persist one without the other.
@@ -342,6 +337,7 @@ export async function updateLastConnected(hostId: string): Promise<void> {
 export function resetHostStoreForTests(): void {
   hostListMutation = Promise.resolve()
   tokenCache.clear()
+  resetHostCredentialWriteRevisionsForTests()
   hostListLoads.dropSharedHostListLoad()
   resetPairingKeychainForTests()
 }
diff --git a/mobile/src/transport/mobile-relay-credential-bundle.ts b/mobile/src/transport/mobile-relay-credential-bundle.ts
index a08fa052459..089c6d28c56 100644
--- a/mobile/src/transport/mobile-relay-credential-bundle.ts
+++ b/mobile/src/transport/mobile-relay-credential-bundle.ts
@@ -7,6 +7,7 @@ import {
   readPairingKeychainItem,
   writePairingKeychainItem
 } from './pairing-keychain'
+import { markHostCredentialWrite } from './host-credential-write-revision'
 
 const Base64Url32ByteSchema = z.string().regex(/^[A-Za-z0-9_-]{43}$/)
 const ResumeCredentialSchema = z
@@ -91,6 +92,7 @@ export async function writeMobileRelayCredentialBundle(
 ): Promise<void> {
   requireNativeSecretStore()
   const validated = MobileRelayCredentialBundleSchema.parse(bundle)
+  markHostCredentialWrite(validated.hostId)
   await writePairingKeychainItem(credentialKey(validated.hostId), JSON.stringify(validated))
 }
 
diff --git a/mobile/src/transport/mobile-relay-direct-upgrade-journal.ts b/mobile/src/transport/mobile-relay-direct-upgrade-journal.ts
index 2493c9e78af..e21e75a6b61 100644
--- a/mobile/src/transport/mobile-relay-direct-upgrade-journal.ts
+++ b/mobile/src/transport/mobile-relay-direct-upgrade-journal.ts
@@ -6,6 +6,7 @@ import {
   readPairingKeychainItem,
   writePairingKeychainItem
 } from './pairing-keychain'
+import { markHostCredentialWrite } from './host-credential-write-revision'
 
 const Base64Url32ByteSchema = z.string().regex(/^[A-Za-z0-9_-]{43}$/)
 
@@ -60,6 +61,7 @@ export async function writeMobileRelayDirectUpgradeJournal(
 ): Promise<void> {
   requireNativeSecretStore()
   const parsed = MobileRelayDirectUpgradeJournalSchema.parse(journal)
+  markHostCredentialWrite(parsed.hostId)
   await writePairingKeychainItem(journalKey(parsed.hostId), JSON.stringify(parsed))
 }
 
diff --git a/mobile/src/transport/settings-host-client-connections.ts b/mobile/src/transport/settings-host-client-connections.ts
new file mode 100644
index 00000000000..b2341471d2b
--- /dev/null
+++ b/mobile/src/transport/settings-host-client-connections.ts
@@ -0,0 +1,19 @@
+import { useCallback, useState } from 'react'
+import { useFocusEffect } from 'expo-router'
+import { useAllHostClients } from './use-all-host-clients'
+
+export function useFocusedSettingsHostClients(hostIds: string[]) {
+  const [focused, setFocused] = useState(false)
+
+  useFocusEffect(
+    useCallback(() => {
+      setFocused(true)
+      return () => setFocused(false)
+    }, [])
+  )
+
+  const clients = useAllHostClients(focused ? hostIds : [], {
+    closeUnusedOnRelease: true
+  })
+  return { clients, focused }
+}
diff --git a/mobile/src/transport/settings-host-client-lifecycle.test.ts b/mobile/src/transport/settings-host-client-lifecycle.test.ts
new file mode 100644
index 00000000000..7a23c86ac71
--- /dev/null
+++ b/mobile/src/transport/settings-host-client-lifecycle.test.ts
@@ -0,0 +1,776 @@
+import { createElement, Fragment, useEffect } from 'react'
+import { act, create, type ReactTestRenderer } from 'react-test-renderer'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { useAllHostClients } from './use-all-host-clients'
+import { useFocusedSettingsHostClients } from './settings-host-client-connections'
+import {
+  RpcClientProvider,
+  useHostClient,
+  usePrimeHosts,
+  useRpcClientContext,
+  type RpcClientContextValue
+} from './client-context'
+import { selectHomeAutoConnectHostIds } from './home-host-auto-connect'
+import type { RpcClient } from './rpc-client'
+import type { ConnectionState, HostProfile } from './types'
+
+const connectMock = vi.fn()
+const loadHostsMock = vi.fn()
+const routeFocus = vi.hoisted(() => ({
+  effect: null as null | (() => void | (() => void))
+}))
+
+vi.mock('expo-router', () => ({
+  useFocusEffect: (effect: () => void | (() => void)) => {
+    routeFocus.effect = effect
+  }
+}))
+
+vi.mock('./host-logical-client', () => ({
+  openHostLogicalClient: (...args: unknown[]) => connectMock(...args)
+}))
+vi.mock('./host-store', () => ({
+  loadHosts: () => loadHostsMock()
+}))
+vi.mock('./connection-revival-triggers', () => ({
+  subscribeConnectionRevivalTriggers: () => () => {}
+}))
+
+type FakeClient = RpcClient & {
+  closeMock: ReturnType<typeof vi.fn>
+}
+
+function makeFakeClient(initialState: ConnectionState): FakeClient {
+  const listeners = new Set<(state: ConnectionState) => void>()
+  const closeMock = vi.fn()
+  return {
+    sendRequest: vi.fn(),
+    subscribe: vi.fn(() => () => {}),
+    updateTerminalSubscriptionViewport: vi.fn(),
+    getState: () => initialState,
+    getReconnectAttempt: () => (initialState === 'reconnecting' ? 4 : 0),
+    getLastConnectedAt: () => null,
+    onStateChange: (listener) => {
+      listeners.add(listener)
+      return () => listeners.delete(listener)
+    },
+    notifyForeground: vi.fn(),
+    close: closeMock,
+    closeMock
+  } as FakeClient
+}
+
+function host(id: string, lastConnected: number, extra: Partial<HostProfile> = {}): HostProfile {
+  return {
+    id,
+    name: id,
+    endpoint: `ws://${id}.internal:8787`,
+    deviceToken: `token-${id}`,
+    publicKeyB64: `key-${id}`,
+    lastConnected,
+    ...extra
+  }
+}
+
+const HOSTS = [
+  host('direct-recent', 50),
+  host('relay-recent', 40, { relayHostId: 'AbCdEf0123_-xyZ9' }),
+  host('ssh-provider-recent', 30),
+  host('folder-workspace-host', 20),
+  host('offline-host', 10)
+]
+const HOST_IDS = HOSTS.map((profile) => profile.id)
+const HOME_HOST_IDS = selectHomeAutoConnectHostIds(HOSTS)
+
+let context: RpcClientContextValue | null = null
+
+function ContextProbe(): null {
+  context = useRpcClientContext()
+  return null
+}
+
+function HomeProbe(): null {
+  useAllHostClients(HOST_IDS, {
+    autoConnectHostIds: HOME_HOST_IDS,
+    closeUnusedOnRelease: true
+  })
+  const primeHosts = usePrimeHosts()
+  useEffect(() => {
+    primeHosts(HOSTS)
+  }, [primeHosts])
+  return null
+}
+
+function SettingsProbe(): null {
+  useAllHostClients(HOST_IDS, {
+    closeUnusedOnRelease: true
+  })
+  return null
+}
+
+function FocusedSettingsProbe(): null {
+  useFocusedSettingsHostClients(HOST_IDS)
+  return null
+}
+
+function DynamicSettingsProbe({ hostIds }: { hostIds: string[] }): null {
+  useAllHostClients(hostIds, { closeUnusedOnRelease: true })
+  return null
+}
+
+function DetailProbe({ hostId }: { hostId: string }): null {
+  useHostClient(hostId)
+  return null
+}
+
+type Screen = 'empty' | 'home' | 'settings'
+
+function TestApp({
+  screen,
+  detailHostId
+}: {
+  screen: Screen
+  detailHostId?: string
+}): React.JSX.Element {
+  const screenProbe =
+    screen === 'home'
+      ? createElement(HomeProbe)
+      : screen === 'settings'
+        ? createElement(SettingsProbe)
+        : null
+  return createElement(
+    RpcClientProvider,
+    null,
+    createElement(
+      Fragment,
+      null,
+      createElement(ContextProbe),
+      detailHostId ? createElement(DetailProbe, { hostId: detailHostId }) : null,
+      screenProbe
+    )
+  )
+}
+
+function suppressRendererWarning(): () => void {
+  const originalConsoleError = console.error
+  const spy = vi.spyOn(console, 'error').mockImplementation((...args) => {
+    if (typeof args[0] === 'string' && args[0].includes('react-test-renderer is deprecated')) {
+      return
+    }
+    originalConsoleError(...args)
+  })
+  return () => spy.mockRestore()
+}
+
+async function renderScreen(screen: Screen, detailHostId?: string): Promise<ReactTestRenderer> {
+  let renderer: ReactTestRenderer | null = null
+  const restore = suppressRendererWarning()
+  try {
+    await act(async () => {
+      renderer = create(createElement(TestApp, { screen, detailHostId }))
+      await Promise.resolve()
+      await Promise.resolve()
+    })
+  } finally {
+    restore()
+  }
+  if (!renderer) {
+    throw new Error('settings lifecycle harness did not render')
+  }
+  return renderer
+}
+
+async function navigate(
+  renderer: ReactTestRenderer,
+  screen: Screen,
+  detailHostId?: string
+): Promise<void> {
+  await act(async () => {
+    renderer.update(createElement(TestApp, { screen, detailHostId }))
+    await Promise.resolve()
+    await Promise.resolve()
+  })
+}
+
+function activeHostIds(): string[] {
+  if (!context) {
+    throw new Error('client context was not captured')
+  }
+  return context
+    .getAllClients()
+    .map(({ hostId }) => hostId)
+    .sort()
+}
+
+beforeEach(() => {
+  globalThis.IS_REACT_ACT_ENVIRONMENT = true
+  context = null
+  routeFocus.effect = null
+  connectMock.mockReset()
+  loadHostsMock.mockReset()
+})
+
+describe('settings host client lifecycle', () => {
+  it('closes settings-only clients while a mounted Home owner keeps its bounded set', async () => {
+    const clients = new Map<string, FakeClient[]>()
+    connectMock.mockImplementation((profile: HostProfile) => {
+      const client = makeFakeClient(profile.id === 'offline-host' ? 'reconnecting' : 'connected')
+      clients.set(profile.id, [...(clients.get(profile.id) ?? []), client])
+      return client
+    })
+    loadHostsMock.mockResolvedValue(HOSTS)
+
+    function NavigationStack({ settingsVisible }: { settingsVisible: boolean }) {
+      return createElement(
+        RpcClientProvider,
+        null,
+        createElement(
+          Fragment,
+          null,
+          createElement(ContextProbe),
+          createElement(HomeProbe),
+          settingsVisible ? createElement(SettingsProbe) : null
+        )
+      )
+    }
+
+    let renderer: ReactTestRenderer | null = null
+    const restore = suppressRendererWarning()
+    try {
+      await act(async () => {
+        renderer = create(createElement(NavigationStack, { settingsVisible: false }))
+        await Promise.resolve()
+        await Promise.resolve()
+      })
+    } finally {
+      restore()
+    }
+    if (!renderer) {
+      throw new Error('navigation stack harness did not render')
+    }
+    expect(activeHostIds()).toEqual([...HOME_HOST_IDS].sort())
+    expect(connectMock).toHaveBeenCalledTimes(3)
+
+    await act(async () => {
+      renderer?.update(createElement(NavigationStack, { settingsVisible: true }))
+      await Promise.resolve()
+      await Promise.resolve()
+    })
+    expect(activeHostIds()).toEqual([...HOST_IDS].sort())
+    expect(connectMock).toHaveBeenCalledTimes(HOSTS.length)
+    expect(loadHostsMock).toHaveBeenCalledTimes(HOME_HOST_IDS.length)
+
+    await act(async () => {
+      renderer?.update(createElement(NavigationStack, { settingsVisible: false }))
+    })
+    expect(activeHostIds()).toEqual([...HOME_HOST_IDS].sort())
+    for (const hostId of HOME_HOST_IDS) {
+      expect(clients.get(hostId)).toHaveLength(1)
+      expect(clients.get(hostId)?.[0]?.closeMock).not.toHaveBeenCalled()
+    }
+    for (const hostId of ['folder-workspace-host', 'offline-host']) {
+      expect(clients.get(hostId)?.[0]?.closeMock).toHaveBeenCalledOnce()
+    }
+
+    await act(async () => {
+      renderer?.update(createElement(NavigationStack, { settingsVisible: true }))
+      await Promise.resolve()
+      await Promise.resolve()
+    })
+    expect(loadHostsMock).toHaveBeenCalledTimes(HOME_HOST_IDS.length)
+    await act(async () => {
+      renderer?.update(createElement(NavigationStack, { settingsVisible: false }))
+    })
+    expect(activeHostIds()).toEqual([...HOME_HOST_IDS].sort())
+    for (const hostId of HOME_HOST_IDS) {
+      expect(clients.get(hostId)).toHaveLength(1)
+    }
+    for (const hostId of ['folder-workspace-host', 'offline-host']) {
+      expect(clients.get(hostId)).toHaveLength(2)
+      expect(clients.get(hostId)?.every((client) => client.closeMock.mock.calls.length === 1)).toBe(
+        true
+      )
+    }
+
+    act(() => renderer.unmount())
+  })
+
+  it('leaves no zero-reference clients after repeated settings navigation', async () => {
+    const clients = new Map<string, FakeClient[]>()
+    connectMock.mockImplementation((profile: HostProfile) => {
+      const client = makeFakeClient('reconnecting')
+      clients.set(profile.id, [...(clients.get(profile.id) ?? []), client])
+      return client
+    })
+    loadHostsMock.mockResolvedValue(HOSTS)
+
+    const renderer = await renderScreen('settings')
+    expect(activeHostIds()).toEqual([...HOST_IDS].sort())
+
+    await navigate(renderer, 'empty')
+    expect(activeHostIds()).toEqual([])
+    for (const hostClients of clients.values()) {
+      expect(hostClients).toHaveLength(1)
+      expect(hostClients[0]?.closeMock).toHaveBeenCalledOnce()
+    }
+
+    await navigate(renderer, 'settings')
+    await navigate(renderer, 'empty')
+    expect(activeHostIds()).toEqual([])
+    expect(connectMock).toHaveBeenCalledTimes(HOSTS.length * 2)
+    for (const hostClients of clients.values()) {
+      expect(hostClients).toHaveLength(2)
+      expect(hostClients.every((client) => client.closeMock.mock.calls.length === 1)).toBe(true)
+    }
+
+    act(() => renderer.unmount())
+  })
+
+  it('reconciles host-list changes without restarting retained or shared clients', async () => {
+    const clients = new Map<string, FakeClient>()
+    connectMock.mockImplementation((profile: HostProfile) => {
+      const client = makeFakeClient('reconnecting')
+      clients.set(profile.id, client)
+      return client
+    })
+    loadHostsMock.mockResolvedValue(HOSTS)
+
+    const retainedHostId = 'direct-recent'
+    const sharedHostId = 'relay-recent'
+    const removedHostId = 'folder-workspace-host'
+    const addedHostId = 'offline-host'
+    function HostListApp({ settingsHostIds }: { settingsHostIds: string[] }) {
+      return createElement(
+        RpcClientProvider,
+        null,
+        createElement(
+          Fragment,
+          null,
+          createElement(ContextProbe),
+          createElement(DetailProbe, { hostId: sharedHostId }),
+          createElement(DynamicSettingsProbe, { hostIds: settingsHostIds })
+        )
+      )
+    }
+
+    let renderer: ReactTestRenderer | null = null
+    const restore = suppressRendererWarning()
+    try {
+      await act(async () => {
+        renderer = create(
+          createElement(HostListApp, {
+            settingsHostIds: [retainedHostId, sharedHostId, removedHostId]
+          })
+        )
+        await Promise.resolve()
+        await Promise.resolve()
+      })
+    } finally {
+      restore()
+    }
+    if (!renderer) {
+      throw new Error('host-list lifecycle harness did not render')
+    }
+
+    await act(async () => {
+      renderer?.update(
+        createElement(HostListApp, {
+          settingsHostIds: [retainedHostId, addedHostId]
+        })
+      )
+      await Promise.resolve()
+      await Promise.resolve()
+    })
+
+    expect(connectMock).toHaveBeenCalledTimes(4)
+    expect(activeHostIds()).toEqual([addedHostId, retainedHostId, sharedHostId].sort())
+    expect(clients.get(retainedHostId)?.closeMock).not.toHaveBeenCalled()
+    expect(clients.get(sharedHostId)?.closeMock).not.toHaveBeenCalled()
+    expect(clients.get(removedHostId)?.closeMock).toHaveBeenCalledOnce()
+    expect(clients.get(addedHostId)?.closeMock).not.toHaveBeenCalled()
+
+    act(() => renderer.unmount())
+    expect(clients.get(retainedHostId)?.closeMock).toHaveBeenCalledOnce()
+    expect(clients.get(sharedHostId)?.closeMock).toHaveBeenCalledOnce()
+    expect(clients.get(addedHostId)?.closeMock).toHaveBeenCalledOnce()
+  })
+
+  it('does not close a settings client still held by an active consumer', async () => {
+    const clients = new Map<string, FakeClient>()
+    connectMock.mockImplementation((profile: HostProfile) => {
+      const client = makeFakeClient('connected')
+      clients.set(profile.id, client)
+      return client
+    })
+    loadHostsMock.mockResolvedValue(HOSTS)
+
+    const detailHostId = 'folder-workspace-host'
+    const renderer = await renderScreen('settings', detailHostId)
+    await navigate(renderer, 'home', detailHostId)
+
+    expect(activeHostIds()).toEqual([...HOME_HOST_IDS, detailHostId].sort())
+    expect(clients.get(detailHostId)?.closeMock).not.toHaveBeenCalled()
+
+    act(() => renderer.unmount())
+    expect(clients.get(detailHostId)?.closeMock).toHaveBeenCalledOnce()
+  })
+
+  it('keeps a reconnect alive when another consumer remains after settings leaves', async () => {
+    const retryHost = host('ssh-retry-host', 1)
+    let resolveInitial: ((hosts: HostProfile[]) => void) | null = null
+    let resolveRetry: ((hosts: HostProfile[]) => void) | null = null
+    const initialLookup = new Promise<HostProfile[]>((resolve) => {
+      resolveInitial = resolve
+    })
+    const retryLookup = new Promise<HostProfile[]>((resolve) => {
+      resolveRetry = resolve
+    })
+    loadHostsMock.mockReturnValueOnce(initialLookup).mockReturnValueOnce(retryLookup)
+    const initialClient = makeFakeClient('connected')
+    const retryClient = makeFakeClient('reconnecting')
+    connectMock.mockReturnValueOnce(initialClient).mockReturnValueOnce(retryClient)
+
+    function RetrySettingsProbe(): null {
+      useAllHostClients([retryHost.id], {
+        closeUnusedOnRelease: true
+      })
+      return null
+    }
+    function RetryApp({ settingsVisible }: { settingsVisible: boolean }): React.JSX.Element {
+      return createElement(
+        RpcClientProvider,
+        null,
+        createElement(
+          Fragment,
+          null,
+          createElement(ContextProbe),
+          createElement(DetailProbe, { hostId: retryHost.id }),
+          settingsVisible ? createElement(RetrySettingsProbe) : null
+        )
+      )
+    }
+
+    let renderer: ReactTestRenderer | null = null
+    const restore = suppressRendererWarning()
+    try {
+      act(() => {
+        renderer = create(createElement(RetryApp, { settingsVisible: true }))
+      })
+    } finally {
+      restore()
+    }
+    if (!renderer || !resolveInitial || !resolveRetry) {
+      throw new Error('retry lifecycle harness did not initialize')
+    }
+    await act(async () => {
+      resolveInitial?.([retryHost])
+      await initialLookup
+    })
+    if (!context) {
+      throw new Error('client context was not captured')
+    }
+
+    const reconnect = context.forceReconnect(retryHost.id)
+    expect(initialClient.closeMock).toHaveBeenCalledOnce()
+    act(() => renderer?.update(createElement(RetryApp, { settingsVisible: false })))
+    await act(async () => {
+      resolveRetry?.([retryHost])
+      await retryLookup
+      await reconnect
+    })
+
+    expect(activeHostIds()).toEqual([retryHost.id])
+    expect(retryClient.closeMock).not.toHaveBeenCalled()
+    act(() => renderer?.unmount())
+    expect(retryClient.closeMock).toHaveBeenCalledOnce()
+  })
+
+  it('cancels a released open without cancelling a rapid replacement acquisition', async () => {
+    const settingsOnlyHost = host('settings-only-offline', 0, {
+      deviceToken: '',
+      publicKeyB64: ''
+    })
+    let resolveFirst: ((hosts: HostProfile[]) => void) | null = null
+    let resolveSecond: ((hosts: HostProfile[]) => void) | null = null
+    const firstLookup = new Promise<HostProfile[]>((resolve) => {
+      resolveFirst = resolve
+    })
+    const secondLookup = new Promise<HostProfile[]>((resolve) => {
+      resolveSecond = resolve
+    })
+    loadHostsMock.mockReturnValueOnce(firstLookup).mockReturnValueOnce(secondLookup)
+    const client = makeFakeClient('reconnecting')
+    connectMock.mockReturnValue(client)
+
+    function PendingSettingsProbe(): null {
+      useAllHostClients([settingsOnlyHost.id], {
+        closeUnusedOnRelease: true
+      })
+      return null
+    }
+    function PendingApp({ visible }: { visible: boolean }): React.JSX.Element {
+      return createElement(
+        RpcClientProvider,
+        null,
+        visible ? createElement(PendingSettingsProbe) : null
+      )
+    }
+
+    let renderer: ReactTestRenderer | null = null
+    const restore = suppressRendererWarning()
+    try {
+      act(() => {
+        renderer = create(createElement(PendingApp, { visible: true }))
+      })
+    } finally {
+      restore()
+    }
+    if (!renderer || !resolveFirst || !resolveSecond) {
+      throw new Error('pending settings harness did not initialize')
+    }
+
+    act(() => renderer?.update(createElement(PendingApp, { visible: false })))
+    act(() => renderer?.update(createElement(PendingApp, { visible: true })))
+    await act(async () => {
+      resolveFirst?.([settingsOnlyHost])
+      await firstLookup
+    })
+    expect(connectMock).not.toHaveBeenCalled()
+
+    await act(async () => {
+      resolveSecond?.([settingsOnlyHost])
+      await secondLookup
+    })
+    expect(connectMock).toHaveBeenCalledOnce()
+
+    act(() => renderer?.update(createElement(PendingApp, { visible: false })))
+    expect(client.closeMock).toHaveBeenCalledOnce()
+    act(() => renderer?.unmount())
+  })
+
+  it('preserves Home ownership when re-pairing replaces a selected host client', async () => {
+    const clients = new Map<string, FakeClient[]>()
+    connectMock.mockImplementation((profile: HostProfile) => {
+      const client = makeFakeClient('connected')
+      clients.set(profile.id, [...(clients.get(profile.id) ?? []), client])
+      return client
+    })
+    loadHostsMock.mockResolvedValue(HOSTS)
+    const replacedHostId = HOME_HOST_IDS[0]!
+
+    function ReplacementApp({
+      detailVisible,
+      settingsVisible
+    }: {
+      detailVisible: boolean
+      settingsVisible: boolean
+    }): React.JSX.Element {
+      return createElement(
+        RpcClientProvider,
+        null,
+        createElement(
+          Fragment,
+          null,
+          createElement(ContextProbe),
+          createElement(HomeProbe),
+          detailVisible ? createElement(DetailProbe, { hostId: replacedHostId }) : null,
+          settingsVisible ? createElement(SettingsProbe) : null
+        )
+      )
+    }
+
+    let renderer: ReactTestRenderer | null = null
+    const restore = suppressRendererWarning()
+    try {
+      await act(async () => {
+        renderer = create(
+          createElement(ReplacementApp, { detailVisible: false, settingsVisible: false })
+        )
+        await Promise.resolve()
+      })
+    } finally {
+      restore()
+    }
+    if (!renderer || !context) {
+      throw new Error('replacement lifecycle harness did not initialize')
+    }
+
+    const originalClient = clients.get(replacedHostId)?.[0]
+    act(() => context?.closeHost(replacedHostId))
+    expect(originalClient?.closeMock).toHaveBeenCalledOnce()
+
+    await act(async () => {
+      renderer?.update(
+        createElement(ReplacementApp, { detailVisible: true, settingsVisible: false })
+      )
+      await Promise.resolve()
+      await Promise.resolve()
+    })
+    const replacementClient = clients.get(replacedHostId)?.[1]
+    expect(replacementClient).toBeDefined()
+
+    await act(async () => {
+      renderer?.update(
+        createElement(ReplacementApp, { detailVisible: false, settingsVisible: true })
+      )
+      await Promise.resolve()
+      await Promise.resolve()
+    })
+    act(() =>
+      renderer?.update(
+        createElement(ReplacementApp, { detailVisible: false, settingsVisible: false })
+      )
+    )
+
+    expect(activeHostIds()).toEqual([...HOME_HOST_IDS].sort())
+    expect(replacementClient?.closeMock).not.toHaveBeenCalled()
+    act(() => renderer?.unmount())
+    expect(replacementClient?.closeMock).toHaveBeenCalledOnce()
+  })
+
+  it('releases a manual host after Home demotes or stops tracking it', async () => {
+    const manualHost = host('manual-relay-host', 1, { relayHostId: 'AbCdEf0123_-xyZ9' })
+    const clients: FakeClient[] = []
+    connectMock.mockImplementation(() => {
+      const client = makeFakeClient('reconnecting')
+      clients.push(client)
+      return client
+    })
+    loadHostsMock.mockResolvedValue([manualHost])
+
+    function ManualHomeProbe({ selected }: { selected: boolean }): null {
+      useAllHostClients([manualHost.id], {
+        autoConnectHostIds: selected ? [manualHost.id] : [],
+        closeUnusedOnRelease: true
+      })
+      return null
+    }
+    function ManualApp({
+      selected,
+      homeVisible = true
+    }: {
+      selected: boolean
+      homeVisible?: boolean
+    }) {
+      return createElement(
+        RpcClientProvider,
+        null,
+        createElement(
+          Fragment,
+          null,
+          createElement(ContextProbe),
+          homeVisible ? createElement(ManualHomeProbe, { selected }) : null
+        )
+      )
+    }
+
+    let renderer: ReactTestRenderer | null = null
+    const restore = suppressRendererWarning()
+    try {
+      act(() => {
+        renderer = create(createElement(ManualApp, { selected: false }))
+      })
+    } finally {
+      restore()
+    }
+    if (!renderer || !context) {
+      throw new Error('manual connection harness did not initialize')
+    }
+    await act(async () => {
+      await context?.forceReconnect(manualHost.id)
+    })
+    expect(activeHostIds()).toEqual([manualHost.id])
+
+    await act(async () => {
+      renderer?.update(createElement(ManualApp, { selected: true }))
+      await Promise.resolve()
+    })
+    expect(activeHostIds()).toEqual([manualHost.id])
+
+    await act(async () => {
+      renderer?.update(createElement(ManualApp, { selected: false }))
+      await Promise.resolve()
+    })
+
+    expect(activeHostIds()).toEqual([])
+    expect(clients[0]?.closeMock).toHaveBeenCalledOnce()
+
+    await act(async () => {
+      await context?.forceReconnect(manualHost.id)
+    })
+    expect(activeHostIds()).toEqual([manualHost.id])
+    expect(clients).toHaveLength(2)
+
+    act(() => renderer?.update(createElement(ManualApp, { selected: false, homeVisible: false })))
+    expect(activeHostIds()).toEqual([])
+    expect(clients[1]?.closeMock).toHaveBeenCalledOnce()
+
+    act(() => renderer?.unmount())
+    expect(clients.every((client) => client.closeMock.mock.calls.length === 1)).toBe(true)
+  })
+
+  it('releases settings-only clients on blur while shared owners stay mounted', async () => {
+    const clients = new Map<string, FakeClient>()
+    connectMock.mockImplementation((profile: HostProfile) => {
+      const client = makeFakeClient('reconnecting')
+      clients.set(profile.id, client)
+      return client
+    })
+    loadHostsMock.mockResolvedValue(HOSTS)
+    const detailHostId = 'folder-workspace-host'
+
+    function FocusStack(): React.JSX.Element {
+      return createElement(
+        RpcClientProvider,
+        null,
+        createElement(
+          Fragment,
+          null,
+          createElement(ContextProbe),
+          createElement(HomeProbe),
+          createElement(DetailProbe, { hostId: detailHostId }),
+          createElement(FocusedSettingsProbe)
+        )
+      )
+    }
+
+    let renderer: ReactTestRenderer | null = null
+    const restore = suppressRendererWarning()
+    try {
+      await act(async () => {
+        renderer = create(createElement(FocusStack))
+        await Promise.resolve()
+        await Promise.resolve()
+      })
+    } finally {
+      restore()
+    }
+    if (!renderer || !routeFocus.effect) {
+      throw new Error('settings focus harness did not initialize')
+    }
+    expect(activeHostIds()).toEqual([...HOME_HOST_IDS, detailHostId].sort())
+
+    let blur: (() => void) | undefined
+    await act(async () => {
+      const cleanup = routeFocus.effect?.()
+      if (typeof cleanup === 'function') {
+        blur = cleanup
+      }
+      await Promise.resolve()
+      await Promise.resolve()
+    })
+    expect(activeHostIds()).toEqual([...HOST_IDS].sort())
+
+    await act(async () => {
+      blur?.()
+      await Promise.resolve()
+    })
+    expect(activeHostIds()).toEqual([...HOME_HOST_IDS, detailHostId].sort())
+    for (const hostId of [...HOME_HOST_IDS, detailHostId]) {
+      expect(clients.get(hostId)?.closeMock).not.toHaveBeenCalled()
+    }
+    expect(clients.get('offline-host')?.closeMock).toHaveBeenCalledOnce()
+
+    act(() => renderer?.unmount())
+  })
+})
diff --git a/mobile/src/transport/types.ts b/mobile/src/transport/types.ts
index 400deee90a6..9d96f0561ad 100644
--- a/mobile/src/transport/types.ts
+++ b/mobile/src/transport/types.ts
@@ -75,6 +75,13 @@ export type HostProfile = {
   relay?: MobileRelayHostOverlay['relay']
 }
 
+export type HostCredentialStatus = 'ready' | 'temporarily-unavailable' | 'missing'
+
+export type HostCatalogEntry = Omit<HostProfile, 'deviceToken'> & {
+  credentialStatus: HostCredentialStatus
+  profile: HostProfile | null
+}
+
 export const HostProfileSchema = z.object({
   id: z.string().min(1),
   name: z.string().min(1),
diff --git a/mobile/src/transport/unpaired-host-credential-deletion.ts b/mobile/src/transport/unpaired-host-credential-deletion.ts
new file mode 100644
index 00000000000..cc9c27e49ad
--- /dev/null
+++ b/mobile/src/transport/unpaired-host-credential-deletion.ts
@@ -0,0 +1,58 @@
+import { deleteHostDeviceToken } from './host-device-token-store'
+import {
+  clearHostCredentialWriteRevision,
+  getHostCredentialWriteRevision
+} from './host-credential-write-revision'
+import { deleteMobileRelayCredentialBundle } from './mobile-relay-credential-bundle'
+import { deleteMobileRelayDirectUpgradeJournal } from './mobile-relay-direct-upgrade-journal'
+
+type DeletionDependencies = {
+  waitForHostMutations: () => Promise<void>
+  hasStoredHost: (hostId: string) => Promise<boolean>
+  onDeleted: (hostId: string) => void
+}
+
+export function createUnpairedHostCredentialDeletion(dependencies: DeletionDependencies) {
+  function writeRevisionChanged(hostId: string, writeRevision: number): boolean {
+    return getHostCredentialWriteRevision(hostId) !== writeRevision
+  }
+
+  function assertWriteRevisionUnchanged(hostId: string, writeRevision: number): void {
+    if (writeRevisionChanged(hostId, writeRevision)) {
+      throw new Error('credential write superseded cleanup')
+    }
+  }
+
+  async function shouldSkip(hostId: string, writeRevision: number): Promise<boolean> {
+    await dependencies.waitForHostMutations()
+    if (await dependencies.hasStoredHost(hostId)) {
+      return true
+    }
+    assertWriteRevisionUnchanged(hostId, writeRevision)
+    return false
+  }
+
+  return async (hostId: string, writeRevision: number): Promise<void> => {
+    if (await shouldSkip(hostId, writeRevision)) {
+      return
+    }
+    assertWriteRevisionUnchanged(hostId, writeRevision)
+    await deleteHostDeviceToken(hostId)
+    if (await shouldSkip(hostId, writeRevision)) {
+      return
+    }
+    assertWriteRevisionUnchanged(hostId, writeRevision)
+    await deleteMobileRelayCredentialBundle(hostId)
+    if (await shouldSkip(hostId, writeRevision)) {
+      return
+    }
+    assertWriteRevisionUnchanged(hostId, writeRevision)
+    await deleteMobileRelayDirectUpgradeJournal(hostId)
+    if (await shouldSkip(hostId, writeRevision)) {
+      return
+    }
+    assertWriteRevisionUnchanged(hostId, writeRevision)
+    clearHostCredentialWriteRevision(hostId)
+    dependencies.onDeleted(hostId)
+  }
+}
diff --git a/mobile/src/transport/use-all-host-clients.ts b/mobile/src/transport/use-all-host-clients.ts
index a1e429b45b0..1000916113b 100644
--- a/mobile/src/transport/use-all-host-clients.ts
+++ b/mobile/src/transport/use-all-host-clients.ts
@@ -1,56 +1,126 @@
-import { useEffect, useMemo, useState } from 'react'
+import { useEffect, useMemo, useRef, useState } from 'react'
 import type { RpcClient } from './rpc-client'
 import type { MobileConnectionPath } from './stable-logical-rpc-client'
 import type { ConnectionState } from './types'
 import { useRpcClientContext } from './client-context'
 
-// Why: refcounting prevents a double-open when a host-detail screen shares one of these hosts.
-export function useAllHostClients(hostIds: string[]) {
+type UseAllHostClientsOptions = {
+  autoConnectHostIds?: readonly string[]
+  closeUnusedOnRelease?: boolean
+}
+
+export function useAllHostClients(hostIds: string[], options?: UseAllHostClientsOptions) {
   const ctx = useRpcClientContext()
-  // Stable key so we don't tear down on every render of the array.
-  const key = useMemo(() => [...hostIds].sort().join(','), [hostIds])
+  const autoConnectHostIds = options?.autoConnectHostIds ?? hostIds
+  const closeUnusedOnRelease = options?.closeUnusedOnRelease ?? false
+  const key = useMemo(
+    () =>
+      [
+        [...hostIds].sort().join(','),
+        [...autoConnectHostIds].sort().join(','),
+        closeUnusedOnRelease ? 'close' : 'keep'
+      ].join('|'),
+    [autoConnectHostIds, closeUnusedOnRelease, hostIds]
+  )
   const [tick, setTick] = useState(0)
+  const acquiredHostIdsRef = useRef<Set<string>>(new Set())
+  const hostUnsubscribesRef = useRef<Map<string, () => void>>(new Map())
+  const closeUnusedRef = useRef(closeUnusedOnRelease)
 
   useEffect(() => {
-    if (hostIds.length === 0) {
-      return
-    }
-    for (const id of hostIds) {
-      ctx.acquire(id)
-    }
-    const unsubs: (() => void)[] = []
-    for (const id of hostIds) {
-      unsubs.push(ctx.subscribeHostState(id, () => setTick((n) => n + 1)))
-    }
-    unsubs.push(ctx.subscribeAllHosts(() => setTick((n) => n + 1)))
+    closeUnusedRef.current = closeUnusedOnRelease
+  }, [closeUnusedOnRelease])
+
+  useEffect(() => {
+    const unsubscribeAllHosts = ctx.subscribeAllHosts(() => setTick((value) => value + 1))
     return () => {
-      for (const u of unsubs) {
-        u()
+      unsubscribeAllHosts()
+      const trackedHostIds = [...hostUnsubscribesRef.current.keys()]
+      const acquiredHostIds = new Set(acquiredHostIdsRef.current)
+      for (const unsubscribe of hostUnsubscribesRef.current.values()) {
+        unsubscribe()
       }
-      for (const id of hostIds) {
-        ctx.release(id)
+      hostUnsubscribesRef.current.clear()
+      for (const id of acquiredHostIds) {
+        if (closeUnusedRef.current) {
+          ctx.releaseAndCloseIfUnused(id)
+        } else {
+          ctx.release(id)
+        }
+      }
+      if (closeUnusedRef.current) {
+        for (const id of trackedHostIds) {
+          if (!acquiredHostIds.has(id)) {
+            ctx.closeIfUnused(id)
+          }
+        }
+      }
+      acquiredHostIdsRef.current.clear()
+    }
+  }, [ctx])
+
+  useEffect(() => {
+    const trackedHostIds = new Set(hostIds)
+    const nextAcquiredHostIds = new Set(autoConnectHostIds.filter((id) => trackedHostIds.has(id)))
+    const removedTrackedHostIds: string[] = []
+
+    for (const [id, unsubscribe] of hostUnsubscribesRef.current) {
+      if (!trackedHostIds.has(id)) {
+        unsubscribe()
+        hostUnsubscribesRef.current.delete(id)
+        removedTrackedHostIds.push(id)
       }
     }
-  }, [key])
+    for (const id of trackedHostIds) {
+      if (!hostUnsubscribesRef.current.has(id)) {
+        hostUnsubscribesRef.current.set(
+          id,
+          ctx.subscribeHostState(id, () => setTick((value) => value + 1))
+        )
+      }
+    }
+
+    for (const id of acquiredHostIdsRef.current) {
+      if (!nextAcquiredHostIds.has(id)) {
+        if (closeUnusedOnRelease) {
+          ctx.releaseAndCloseIfUnused(id)
+        } else {
+          ctx.release(id)
+        }
+      }
+    }
+    for (const id of nextAcquiredHostIds) {
+      if (!acquiredHostIdsRef.current.has(id)) {
+        ctx.acquire(id)
+      }
+    }
+    if (closeUnusedOnRelease) {
+      for (const id of removedTrackedHostIds) {
+        ctx.closeIfUnused(id)
+      }
+      for (const id of trackedHostIds) {
+        if (!nextAcquiredHostIds.has(id)) {
+          ctx.closeIfUnused(id)
+        }
+      }
+    }
+    acquiredHostIdsRef.current = nextAcquiredHostIds
+  }, [ctx, key])
 
   return useMemo(() => {
-    const out: {
+    const clientsByHostId = new Map(
+      ctx.getAllClients().map((entry) => [entry.hostId, entry.client])
+    )
+    return hostIds.flatMap<{
       hostId: string
       client: RpcClient
       state: ConnectionState
       path: MobileConnectionPath
-    }[] = []
-    for (const id of hostIds) {
-      const all = ctx.getAllClients().find((entry) => entry.hostId === id)
-      if (all) {
-        out.push({
-          hostId: id,
-          client: all.client,
-          state: ctx.getState(id),
-          path: ctx.getActivePath(id)
-        })
-      }
-    }
-    return out
-  }, [key, tick])
+    }>((hostId) => {
+      const client = clientsByHostId.get(hostId)
+      return client
+        ? [{ hostId, client, state: ctx.getState(hostId), path: ctx.getActivePath(hostId) }]
+        : []
+    })
+  }, [ctx, hostIds, tick])
 }
diff --git a/skill-guides/orchestration.md b/skill-guides/orchestration.md
index 7da8936ea1a..bc7b1cbbe3e 100644
--- a/skill-guides/orchestration.md
+++ b/skill-guides/orchestration.md
@@ -192,6 +192,14 @@ orca orchestration worker-start --task <task_b> --worktree current --agent claud
 
 `current` and exact existing worktrees create a fresh agent terminal and do not rerun setup. Reuse an existing agent only with `--terminal <handle>`.
 
+For a per-invocation Claude, Codex, or Cursor launch, pass an opaque provider model id with `--model`; add `--effort` only when that agent/model supports the level. These options apply only to fresh agent terminals, override general agent default arguments, and are reported under `launch.requested` and `launch.effective` in the receipt:
+
+```bash
+orca orchestration worker-start --task <task_id> --worktree current --agent claude --model aws-bedrock-opus-5 --effort high --json
+```
+
+`--effort` requires `--model`, and neither option can combine with `--terminal`. A connected worker server must advertise launch-preference support before Orca forwards either option.
+
 For a new worktree, setup runs by default and agent-first creation reuses the returned startup agent terminal:
 
 ```bash
diff --git a/src/cli/bundled-skill-guides.ts b/src/cli/bundled-skill-guides.ts
index fadfd439030..1fcb8e0afd1 100644
--- a/src/cli/bundled-skill-guides.ts
+++ b/src/cli/bundled-skill-guides.ts
@@ -30,7 +30,7 @@ const ORCA_LINEAR_MARKDOWN = "---\nname: orca-linear\ndescription: >-\n  Use Orc
 const ORCA_PER_WORKSPACE_ENV_MARKDOWN = "---\nname: orca-per-workspace-env\ndescription: >-\n  Set up, review, debug, or validate Orca per-workspace environment recipes —\n  on-demand, disposable runtimes (cloud sandboxes, VMs, or local) created fresh\n  for each workspace. Covers first-time setup (provider prerequisites, the\n  reusable base snapshot, the coding-agent auth snapshot, credentials, and\n  state), not just the per-workspace lifecycle scripts. Use to stand up\n  per-workspace environments, fix an `environmentRecipes` entry in `orca.yaml`, scaffold\n  provider lifecycle scripts, or resolve an `orca vm recipe doctor` failure.\n---\n\n# Per-Workspace Environments\n\nHelp a user stand up and maintain a repo-owned per-workspace environment recipe end to end. Each\nworkspace gets its own on-demand, disposable runtime (a cloud sandbox, a VM, or a local one),\ncreated fresh and torn down after.\n\nOrca is a **thin wrapper**: you guide, detect, and scaffold; you never own the user's cloud account,\nbilling, images, or credentials.\n\n- **You DO:** sequence the setup, detect what's detectable (provider CLI present/logged-in? recipe\n  present? `doctor` passing?), scaffold provider-templated scripts the user fills in, drive the slow\n  snapshot/auth phases with the user, and always show the next action.\n- **You DO NOT:** create accounts, choose plans/regions, invent org/project/scope ids, store or print\n  secrets, or run anything that spends money without an explicit user OK.\n\nFirst-time setup has **four phases before the per-workspace recipe runs** — easy to miss, so walk\nthem in order:\n\n1. **Prerequisites** — cloud account, provider CLI, scope/project, plan limits, git token (§2).\n2. **Base snapshot** — reusable image: tools + repo + headless build, snapshotted once (§3).\n3. **Agent-auth snapshot** — boot the base, run interactive device-auth, re-snapshot (§4).\n4. **State** — thread snapshot id / scope / project / port between phases via a state file (§6).\n\nThen the **per-workspace contract** (create/suspend/resume/destroy) runs fast (§8).\n\n**The one branch that shapes everything — connection mode:** **Orca-server** (`create` runs `orca serve`\nin the env and emits a `pairingCode`; §7c/§7f) vs **SSH** (`create` runs no server and emits a\n`connection.type:\"ssh\"` block Orca dials into; §7g/§7h). Settle this first — it changes the `create`\noutput shape and half the templates.\n\n**Quick-start (happy path):** interview the user (connection mode Orca-server vs SSH, provider, agent CLI,\ngit auth — §1.2) + read the provider's CLI docs → scaffold `scripts/orca-vm/` from §7 → run the\nbase-snapshot script, then the auth script (you invoke these by hand; not via `orca.yaml`) → wire\n`environmentRecipes` in `orca.yaml` → `orca vm recipe doctor <id> --json` (free) → then the `--provision`\nself-test loop (§9) until it passes.\n\n---\n\n## 1. Setup workflow\n\nDrive these with the user. **[CHECKPOINT]** steps need explicit confirmation — they spend money, take\na long time, or need the user at the keyboard. Never create an Orca workspace or commit unless asked.\n\n1. **Inspect the repo** for an existing `environmentRecipes` entry, `scripts/orca-vm/`, a state file, or setup\n   notes. If a working recipe exists, jump to Doctor (§9) instead of rebuilding.\n2. **Interview the user up front** — gather these choices and confirm them back before scaffolding\n   anything. Don't pick for them (§11); don't guess.\n   - **Connection mode:** how Orca attaches to the environment — an **Orca server** (the VM runs\n     `orca serve` and Orca pairs over its pairing URL; worked example §7f) or **SSH** (Orca connects to\n     the host over SSH; §7g). This decides the recipe's connection shape, so settle it first.\n   - **Provider:** Vercel Sandbox, Fly, Modal, an existing SSH host, … For non-obvious providers, also\n     ask scope/project/region and plan limits (§2). Then **read that provider's CLI/SDK docs** (or\n     `<cli> --help`) before scaffolding — you need its exact create/exec/snapshot/remove verbs.\n     If a provider advertises `ssh`, verify whether it exposes a real dialable SSH target\n     (host/port/user/key or proxy command) or only a provider-mediated interactive shell; Orca SSH mode\n     needs the former.\n   - **Coding-agent CLI + account:** which agent runs in the VM (`codex`, `claude`, …) and that the user\n     has an account for it — it gets logged in during the Phase-3 auth snapshot (§4).\n   - **Git auth:** the token source for cloning a private repo (`GH_TOKEN`/`GITHUB_TOKEN` or `gh auth\n     token`; §5).\n3. **Check prerequisites (§2)** — detect the provider CLI + auth and confirm the items above are in\n   place before any paid step.\n4. **Scaffold scripts + state file** from §7 (worked Vercel example: §7f; SSH host: §7g; Docker SSH:\n   §7h; Windows: §7i), filling in the provider's real commands. Make them executable.\n5. **[CHECKPOINT] Build the base snapshot (§3)** — paid, slow.\n6. **[CHECKPOINT] Authenticate the agent (§4)** — interactive; the user follows a URL/code. **You cannot\n   drive this step** — you run commands non-interactively, so there's no TTY for `docker exec -it` /\n   `ssh -t` to prompt against. The **user** runs the Phase-3 login in their own terminal (or via the\n   Claude Code harness bang-prefix — `! <cmd>`, with the required space after `!`); you scaffold and drive\n   the non-interactive phases around it. After kicking it off, **ask the user to report back once the login\n   finishes** — you can't observe it completing, and you need that confirmation before resuming the\n   non-interactive steps (base/auth commit, doctor, provision).\n7. **Wire the recipe** so `orca.yaml` points create/suspend/resume/destroy at the scripts (§8). The\n   workspace composer reads `environmentRecipes` from the project's primary checkout of `orca.yaml`, **not** from\n   a feature branch or worktree. So a recipe added only on a branch won't appear as a \"Run on\" option\n   until that `orca.yaml` change is committed and merged to the project's primary branch. Tell the user\n   this up front: `doctor`/`--provision` validate the scripts from the working copy on any branch, but\n   creating a workspace from the recipe in the picker needs it on primary.\n8. **Dry-run doctor** — `orca vm recipe doctor <recipe-id> --repo-path <repo> --json` (free, static; §9).\n   Fix every failure before going live.\n9. **[CHECKPOINT] Live self-test** — get the user's OK once, then run\n   `orca vm recipe doctor <recipe-id> --provision --json` as a loop: it runs create → validates →\n   destroys, and on failure returns a full transcript. Read it, fix the scripts, and re-run yourself until\n   it passes (§9). Spends cloud money; the one approval covers the loop.\n10. **[CHECKPOINT] Optional workspace test** — only if asked: create a workspace via the picker, then\n    verify sleep/wake/delete.\n\n---\n\n## 2. Phase 1 — Prerequisites\n\nThe user's responsibility; verify what's verifiable, ask for the rest, invent nothing. State which\nitems you verified vs. which the user asserted.\n\n- **Connection mode** (Orca server vs SSH) confirmed with the user — see §1 step 2; it shapes the recipe.\n- **Cloud account + plan** that allows sandboxes/VMs. Ask.\n- **Provider CLI installed + authenticated** — detect (`command -v <cli>`), check auth (e.g.\n  `vercel whoami`). If missing, point at the provider's docs; don't log them in.\n- **Scope / project / region** the sandboxes live under. Ask; flows into every script via state.\n- **Plan / timeout / RAM caps.** Record them — e.g. Vercel Hobby caps sandbox timeout at **45m**,\n  which limits both the base build and per-workspace runtime (see §10).\n- **Git token for private repos** (`GH_TOKEN`/`GITHUB_TOKEN`, or the provider's git auth; can fall back\n  to `gh auth token`). See §5.\n- **Coding-agent CLI choice** (`codex`, `claude`…) and that the user has an account — it gets\n  authenticated into the VM in Phase 3.\n\n---\n\n## 3. Phase 2 — Base snapshot (the reusable image)\n\nBuild **once**, snapshot, and every workspace boots from it in seconds instead of rebuilding.\nProvisioning + building takes a while (often ~20–30 min), so it runs behind a checkpoint. The script\nshape is §7a; key points:\n\n- Build the **headless Electron main only** (not the renderer) so it fits in plan RAM.\n- Use the VM image's package manager (`apt`/`dnf`/`apk`, per the base distro — not the provider brand).\n- Clone with the git token via `GIT_ASKPASS` (§5).\n- **Trap errors and remove the half-built sandbox** so a crash doesn't leave a paid resource running.\n- Snapshot the stopped sandbox, parse the snapshot id, and write it + scope/project/port/repo to state.\n\n---\n\n## 4. Phase 3 — Agent-auth snapshot (interactive)\n\nThe base snapshot has the agent CLI installed but **not logged in**, and per-workspace VMs are\nephemeral — so authenticate once and bake it into a second snapshot layer. Script shape is §7b:\n\n1. Boot a sandbox from the base `snapshotId` (from state).\n2. Run the agent's login **interactively** (`--interactive --tty`); the user completes the URL/code in\n   their browser. On a **headless VM this must be the device-auth flow** (e.g. `codex login --device-auth`),\n   **not** plain `codex login`: the default OAuth login starts a loopback callback server on a container\n   port the host browser can't reach, so it hangs. Device-auth instead prints a URL + code the user opens\n   on the **host**.\n3. Verify login; **refuse to snapshot an unauthenticated VM.** Prefer the status command's **exit code**\n   (most agent CLIs exit non-zero when unauthenticated). If you grep instead, agent status often goes to\n   **stderr** (e.g. `codex login status` prints \"Logged in using ChatGPT\" there), so **fold stderr first**\n   (`... 2>&1 | grep …`) and match the agent's **exact success line** — never `grep -qi 'logged in'`, which\n   also matches \"**not** logged in\" and would commit an unauthenticated image.\n4. Re-snapshot, parse the new id, and overwrite `snapshotId` in state to the authenticated image\n   (recording `authSourceSnapshotId`). Remove the auth sandbox.\n\n**You can't drive step 2 yourself** (you run commands non-interactively — no TTY). The **user** runs it in\ntheir own terminal, or via the Claude Code harness bang-prefix (`! <cmd>`, with the required space after\n`!`). You scaffold/boot the sandbox and run steps 3–4, but **you cannot observe the interactive login\nfinishing** — so **ask the user to tell you when it's done** before you verify and re-snapshot.\n\nIf the agent's credentials are short-lived, warn that the snapshot may need periodic re-auth (§10).\n\nFor disposable runtimes, do **not** treat a host agent config directory (for example `~/.codex`) as the\nauth snapshot by bind-mounting or copying it wholesale. Agent homes often contain sqlite state, hook\napproval state, caches, logs, and host-specific env/config. Instead, authenticate/configure the agent\ninside the disposable runtime and snapshot/commit that runtime layer.\n\n---\n\n## 5. Credentials\n\n- **Never** commit secrets or put them in `userData`, recipe JSON, comments, docs, or the state file.\n- **Git token:** read from env (`GH_TOKEN`/`GITHUB_TOKEN`), falling back to `gh auth token`. Pass to the\n  VM only via the provider's ephemeral `--env`. Inside the VM, use a `GIT_ASKPASS` helper with\n  `x-access-token` (not the token in the clone URL) and `GIT_TERMINAL_PROMPT=0` so a missing token fails\n  fast instead of hanging. When you write the helper from inside `bash -lc` under `set -u`, escape the\n  positional arg and the token (`\\$1`, `\\$GH_TOKEN`) so they land **literally** and resolve at git-runtime\n  — an unescaped `$1` aborts with \"unbound variable\", and a literal `$GH_TOKEN` keeps the real token out of\n  the written file. `rm -f` the helper after the clone/fetch.\n- **Provider auth:** rely on the provider CLI's logged-in session, not checked-in keys.\n- **Agent auth:** lives in the authenticated snapshot (Phase 3) — never a file you write or commit.\n- State holds only **non-secret** wiring (snapshot ids, scope, project, port, repo url/ref).\n\n---\n\n## 6. State file\n\nA repo-local JSON file (e.g. `scripts/orca-vm/<provider>-state.json`) threads non-secret values between\nphases. Each script resolves values as **env var → state → built-in fallback**, and merges its outputs\nback. Phase 2 writes the base `snapshotId`; Phase 3 overwrites it with the authenticated snapshot;\nper-workspace `create` boots from `snapshotId`.\n\n```json\n{\n  \"baseName\": \"orca-base\",\n  \"snapshotId\": \"snap_authenticated_image_id\",\n  \"authSourceSnapshotId\": \"snap_base_image_id\",\n  \"scope\": \"<provider-scope>\",\n  \"project\": \"<provider-project>\",\n  \"port\": 7331,\n  \"repoUrl\": \"https://host/org/repo.git\",\n  \"repoRef\": \"main\",\n  \"projectRoot\": \"/abs/path/on/remote/repo\"\n}\n```\n\n---\n\n## 7. Script templates (provider-agnostic shapes)\n\nScaffold under `scripts/orca-vm/`. These are **shapes** — fill in the provider's real commands. All\nreserve stdout for the final JSON and log progress to stderr. Include a shared `json_value <key>` /\n`env_value <NAME>` reader (env → state → fallback) in each.\n\n**Where each script runs:**\n\n- **Local-side** (`create`/`suspend`/`resume`/`destroy` + the base-snapshot/auth scripts the user\n  invokes) runs **on the user's desktop**, so it must run on their OS. macOS/Linux: `#!/usr/bin/env\n  bash`, `set -euo pipefail`, quoted paths. **Windows:** a bare `.sh` won't run — scaffold `.ps1`/`.cmd`\n  or require WSL/Git-Bash and point `orca.yaml` at the right launcher.\n- **Remote-side** (commands you `exec` *inside* the Linux VM) always runs in the VM's Linux shell, so\n  bash is fine there regardless of the user's OS.\n\n### 7a. Base-snapshot (`<provider>-base-snapshot.sh`) — Phase 2\n\n```bash\n#!/usr/bin/env bash\nset -euo pipefail\n# resolve base_name/repo_url/repo_ref/project_root/port/scope/project/timeout (env→state→fallback)\n# resolve gh token: GH_TOKEN | GITHUB_TOKEN | `gh auth token`\n# 1. provision a sandbox (timeout/vcpus/published port/snapshot retention); trap: remove on error\n# 2. remote exec (long timeout): install pkgs + gh + corepack/pnpm + agent CLI;\n#    clone with GIT_ASKPASS(token); write headless main-only build config;\n#    dev setup; pnpm install; build CLI; build headless electron main; smoke-check tools\n# 3. snapshot stopped sandbox; parse snapshot id (fail if unparseable)\n# 4. merge { baseName, snapshotId, projectRoot, repoUrl, repoRef, port, scope, project } into state\n# print only the state JSON to stdout\n```\n\nWorked Vercel commands for this phase are in §7f. You run this script by hand (not via `orca.yaml`),\nafter exporting the first-run inputs the state file doesn't have yet — e.g. provider scope/project, the\nrepo URL/ref, and a git token (`GH_TOKEN`); later runs read them back from state.\n\n### 7b. Auth (`<provider>-base-auth.sh`) — Phase 3\n\n```bash\n#!/usr/bin/env bash\nset -euo pipefail\n# read source snapshot from state.snapshotId (fail if absent); auth_name=\"${base_name}-auth\"\n# 1. boot sandbox from source snapshot; trap: remove on error\n# 2. INTERACTIVE/TTY remote exec: agent login — user completes URL/code. Headless VM: MUST use the\n#    device-auth flow (e.g. `codex login --device-auth`) — plain OAuth login binds a loopback callback\n#    port the host can't reach and hangs. User runs this themselves (you have no interactive TTY); ask\n#    them to report back when it's done before continuing.\n# 3. verify login, then refuse to snapshot if not logged in. Prefer the status command's EXIT CODE (most\n#    agent CLIs exit non-zero when unauthenticated) over string-matching. If you must grep, fold stderr\n#    first (`status 2>&1 | grep …` — many agents print the success line there) and match the agent's exact\n#    success line; never `grep -qi 'logged in'`, which also matches \"not logged in\". Codex example: §7f.\n# 4. snapshot; parse new id\n# 5. merge { snapshotId:<new>, authSourceSnapshotId:<source> } into state; remove auth sandbox\n# print only the state JSON to stdout\n```\n\n### 7c. Create (`<provider>-create.sh`) — per workspace\n\n```bash\n#!/usr/bin/env bash\nset -euo pipefail\n# read authenticated snapshotId/scope/project/port/repo*/project_root (env→state→fallback)\n# fail clearly if snapshotId is missing (point back to Phases 2–3)\n# name = orca-${ORCA_VM_RECIPE_ID}-${ORCA_VM_INSTANCE_ID} (sanitized, length-capped)\n# 1. boot sandbox from snapshotId with a published port; capture the public URL → pairing address\n#    (an externally reachable wss:// URL); trap: remove sandbox on error\n# 2. remote exec: ensure repo at desired commit; rebuild only if commit changed (cache marker)\n# 3. remote exec: start orca serve in the background and read the recipe JSON it writes (see below)\n# 4. print serve's JSON to stdout, optionally enriched with userData:\n#    { schemaVersion:1, pairingCode, projectRoot, userData:{ provider, resourceId:name, snapshotId } }\n```\n\n**The exact `orca serve` invocation and its output (verified — do not improvise the flags).** Inside the\nVM, run:\n\n```bash\norca serve \\\n  --port \"$PORT\" \\\n  --project-root \"$ABS_REPO_PATH_ON_REMOTE\" \\\n  --pairing-address \"$EXTERNAL_WSS_URL\" \\\n  --recipe-json\n```\n\n**Binary name:** in a VM built from source (the Phase-2 flow), run it as `pnpm exec orca-dev serve …`\nfrom the repo root — `orca-dev` is the in-repo entrypoint and is what the §7f example uses. Plain\n`orca serve …` is the same command when the built CLI is installed on the VM's PATH. The flags/output\nare identical either way.\n\nThere is **no `--host` flag**. `--project-root` must be an absolute directory on the remote. With\n`--recipe-json` the server **stays running** and prints exactly this single object to **stdout**, then\nkeeps serving:\n\n```json\n{ \"schemaVersion\": 1, \"pairingCode\": \"<orca pairing URL>\", \"projectRoot\": \"<the --project-root you passed>\" }\n```\n\n`pairingCode` is the pairing URL, already pointing at whatever you passed as `--pairing-address` — so set\n`--pairing-address` to the externally reachable address and **pass `pairingCode` through unchanged; never\nhand-rewrite it**. Because serve runs in the foreground and doesn't exit, redirect its stdout to a file\nand poll until that file parses as JSON (and bail if the process dies — dump its stderr log). Your\n`create` script then prints that JSON (optionally merging `userData`). Concrete pattern: §7f.\n\n### 7d. Suspend / resume / destroy — per workspace\n\n```bash\n#!/usr/bin/env bash\nset -euo pipefail\npayload=\"$(cat)\"                       # Orca passes lifecycle JSON on stdin\nresource_id=\"$(node -e 'const d=JSON.parse(process.argv[1]); process.stdout.write(d.recipeResult?.userData?.resourceId ?? \"\")' \"$payload\")\"\n[ -n \"$resource_id\" ] || { echo \"No resource id in lifecycle payload\" >&2; exit 1; }\n# suspend: provider suspend \"$resource_id\"\n# resume:  provider resume \"$resource_id\"; then RE-EMIT fresh recipe JSON (pairing may change)\n# destroy: provider remove \"$resource_id\"   (or set destroy: none in orca.yaml)\n```\n\n### 7e. State file — scaffold with scope/project/repo filled in and snapshot ids empty (§6).\n\n### 7f. Worked example — Vercel Sandbox (all three phases)\n\nA real, working shape (the Vercel surface is a CLI: `vercel sandbox create|exec|snapshot|remove`). Adapt\nnames; verify flags against `vercel sandbox --help` for the user's CLI version before relying on them.\nThese ground §7a (base snapshot) and §7b (auth), which are otherwise generic skeletons.\n\n**Phase 2 — base snapshot (§7a):** provision → install tools + clone + headless build → snapshot.\n\n```bash\n# provision a fresh build sandbox (retain a couple of snapshots); trap-remove on error\nvercel sandbox create --name \"$base\" --runtime node24 --timeout 30m --vcpus 4 --publish-port \"$port\" \\\n  --snapshot-expiration 30d --keep-last-snapshots 2 \"${vercel_args[@]}\" >&2\n# remote build (long timeout): install pkgs+gh+pnpm+agent CLI, clone with GIT_ASKPASS (write the helper\n# with LITERAL \\$1/\\$GH_TOKEN so they resolve at git-runtime, not write-time — see §5/§7f create — then\n# `rm -f /tmp/askpass.sh`), write the headless main-only build config (drop the renderer), dev setup,\n# build CLI + headless main, smoke-check\nvercel sandbox exec \"$base\" \"${vercel_args[@]}\" --timeout 25m --env \"GH_TOKEN=$gh_token\" … -- bash -lc '…build…' >&2\n# snapshot the STOPPED sandbox and parse the id from CLI output (fail if unparseable)\nout=\"$(vercel sandbox snapshot \"$base\" --stop --expiration 30d \"${vercel_args[@]}\" 2>&1)\"; printf '%s\\n' \"$out\" >&2\nsnapshot_id=\"$(printf '%s\\n' \"$out\" | sed -nE 's/.*(snap_[A-Za-z0-9]+).*/\\1/p' | tail -1)\"\n# merge { baseName, snapshotId, scope, project, port, repoUrl, repoRef, projectRoot } into state; print state JSON\n```\n\n**Phase 3 — agent-auth snapshot (§7b):** boot the base, log the agent in interactively, re-snapshot.\n(`codex` below is an example — substitute the user's chosen agent's login/status verbs, e.g. `claude`.)\n\n```bash\nvercel sandbox create --name \"$auth\" --snapshot \"$snapshot_id\" --timeout 30m --publish-port \"$port\" \"${vercel_args[@]}\" >&2\n# INTERACTIVE — the USER runs this in their own terminal (you have no interactive TTY) and completes the\n# URL/code on the HOST. --device-auth is MANDATORY on a headless VM: plain `codex login` binds a loopback\n# callback port the host browser can't reach and hangs. Ask the user to report back when login finishes.\nvercel sandbox exec --interactive --tty \"$auth\" \"${vercel_args[@]}\" -- bash -lc 'codex login --device-auth'\n# refuse to snapshot an unauthenticated VM — fold stderr, match codex's exact success line (§4)\nvercel sandbox exec \"$auth\" \"${vercel_args[@]}\" --timeout 30s -- bash -lc 'codex login status 2>&1' | grep -Eqi 'Logged in using ChatGPT|Logged in via device' \\\n  || { echo \"agent not logged in; not snapshotting\" >&2; exit 1; }\nout=\"$(vercel sandbox snapshot \"$auth\" --stop --expiration 30d \"${vercel_args[@]}\" 2>&1)\"; printf '%s\\n' \"$out\" >&2\nnew_id=\"$(printf '%s\\n' \"$out\" | sed -nE 's/.*(snap_[A-Za-z0-9]+).*/\\1/p' | tail -1)\"\n# overwrite state.snapshotId = new_id, record authSourceSnapshotId = snapshot_id; remove the auth sandbox\n```\n\n**Per-workspace `create`** (the fast path):\n\n```bash\n#!/usr/bin/env bash\nset -euo pipefail\n# resolve from env→state→fallback: snapshot_id, scope, project, port, repo_url, repo_ref, project_root\nvercel_args=(); [ -n \"$scope\" ] && vercel_args+=(--scope \"$scope\"); [ -n \"$project\" ] && vercel_args+=(--project \"$project\")\n[ -n \"$snapshot_id\" ] || { echo \"snapshotId missing — run Phases 2–3 first\" >&2; exit 1; }\ngh_token=\"${GH_TOKEN:-${GITHUB_TOKEN:-$(command -v gh >/dev/null 2>&1 && gh auth token 2>/dev/null || true)}}\"\nname=\"orca-${ORCA_VM_RECIPE_ID:-vercel-sandbox}-${ORCA_VM_INSTANCE_ID:-$(date +%s)}\"  # sanitize+cap to 63 chars\n\n# Arm cleanup BEFORE create so a failing create can't leak a half-built paid sandbox.\ncleanup_on_error() { [ \"$?\" -ne 0 ] && vercel sandbox remove \"$name\" \"${vercel_args[@]}\" >/dev/null 2>&1 || true; }\ntrap cleanup_on_error EXIT\n\n# 1. boot from the authenticated snapshot, publish the serve port\ncreate_output=\"$(vercel sandbox create --name \"$name\" --snapshot \"$snapshot_id\" \\\n  --timeout 30m --publish-port \"$port\" \"${vercel_args[@]}\" 2>&1)\"; printf '%s\\n' \"$create_output\" >&2\n# Vercel prints the published https URL; derive the external wss:// pairing address from it\npublic_url=\"$(printf '%s\\n' \"$create_output\" | sed -nE 's#.*(https://[^[:space:]]+\\.vercel\\.run).*#\\1#p' | head -1)\"\n[ -n \"$public_url\" ] || { echo \"no published URL in create output\" >&2; exit 1; }\npairing_ws=\"${public_url/https:\\/\\//wss://}\"\n\n# 2. (remote) ensure the repo is at the right commit; rebuild only if the commit changed (cache marker)\nvercel sandbox exec \"$name\" \"${vercel_args[@]}\" --timeout 20m \\\n  --env \"GH_TOKEN=$gh_token\" --env \"ORCA_PROJECT_ROOT=$project_root\" \\\n  --env \"ORCA_REPO_URL=$repo_url\" --env \"ORCA_REPO_REF=$repo_ref\" \\\n  -- bash -lc 'set -euo pipefail; cd \"$ORCA_PROJECT_ROOT\"; \\\n    # Re-establish git auth for the private-repo fetch (why + full rationale: §5); else it hangs on a prompt.\n    # Load-bearing escaping: \\$1 and \\$GH_TOKEN must land LITERALLY and resolve at git-runtime. Test after\n    # any edit here — reformatting the nested printf/node quoting silently breaks the fetch or leaks the token.\n    if [ -n \"${GH_TOKEN:-}\" ]; then \\\n      printf \"%s\\n\" \"#!/usr/bin/env bash\" \"case \\\"\\$1\\\" in *Username*) echo x-access-token;; *Password*) echo \\\"\\$GH_TOKEN\\\";; esac\" > /tmp/askpass.sh; \\\n      chmod 700 /tmp/askpass.sh; export GIT_ASKPASS=/tmp/askpass.sh GIT_TERMINAL_PROMPT=0; fi; \\\n    git fetch origin \"$ORCA_REPO_REF\"; \\\n    git checkout -B \"$ORCA_REPO_REF\" FETCH_HEAD; \\\n    rm -f /tmp/askpass.sh; \\\n    c=\"$(git rev-parse HEAD)\"; [ -f .orca-built ] && [ \"$(cat .orca-built)\" = \"$c\" ] || { \\\n      pnpm install --prefer-offline && pnpm run build:cli && \\\n      node config/scripts/run-electron-vite-build.mjs --config config/electron-vite.vm-serve.config.ts && \\\n      printf \"%s\" \"$c\" > .orca-built; }' >&2\n\n# 3. (remote) start orca serve in the background, writing recipe JSON to a file; poll until it parses\nrecipe_json=\"$(vercel sandbox exec \"$name\" \"${vercel_args[@]}\" --timeout 60s \\\n  --env \"ORCA_PORT=$port\" --env \"ORCA_PROJECT_ROOT=$project_root\" --env \"ORCA_PAIRING_ADDRESS=$pairing_ws\" \\\n  -- bash -lc 'set -euo pipefail; cd \"$ORCA_PROJECT_ROOT\"; rm -f /tmp/orca-recipe.json /tmp/orca-serve.log; \\\n    nohup pnpm exec orca-dev serve --port \"$ORCA_PORT\" --project-root \"$ORCA_PROJECT_ROOT\" \\\n      --pairing-address \"$ORCA_PAIRING_ADDRESS\" --recipe-json >/tmp/orca-recipe.json 2>/tmp/orca-serve.log </dev/null & \\\n    pid=$!; for _ in $(seq 1 80); do \\\n      node -e \"JSON.parse(require(\\\"node:fs\\\").readFileSync(\\\"/tmp/orca-recipe.json\\\",\\\"utf8\\\"))\" >/dev/null 2>&1 && { cat /tmp/orca-recipe.json; exit 0; }; \\\n      kill -0 \"$pid\" 2>/dev/null || { cat /tmp/orca-serve.log >&2; exit 1; }; sleep 0.25; \\\n    done; cat /tmp/orca-serve.log >&2; echo \"serve recipe JSON timed out\" >&2; exit 1')\"\n\n# 4. print serve's JSON enriched with userData (single object on stdout)\nnode -e 'const p=JSON.parse(process.argv[1]); console.log(JSON.stringify({...p, schemaVersion:1,\n  userData:{...p.userData, provider:\"vercel-sandbox\", resourceId:process.argv[2], snapshotId:process.argv[3]}}))' \\\n  \"$recipe_json\" \"$name\" \"$snapshot_id\"\ntrap - EXIT\n```\n\n`suspend`/`resume`/`destroy` use `vercel sandbox stop|...|remove \"$resource_id\"` reading\n`userData.resourceId` from stdin (§7d). This is the **Orca-server** connection mode (the recipe emits a\npairing URL). If the user chose **SSH** in the §1 interview, use §7g instead.\n\n### 7g. Worked example — existing SSH host (SSH connection mode)\n\nSSH mode is **fundamentally different from §7c/§7f**, not a relabeling of them:\n\n- **`create` does NOT run `orca serve` and does NOT emit a `pairingCode`.** Orca itself connects to the\n  host over its SSH relay, brings up the git + filesystem providers, and imports the repo. The script's\n  only job is to make the host ready and **print SSH connection details** Orca will dial.\n- The result uses a `connection` block with `type: \"ssh\"` and a `target`, **not** the flat\n  `pairingCode`/`projectRoot` shape. Exact shape (Orca rejects anything else):\n\n```json\n{\n  \"schemaVersion\": 1,\n  \"connection\": {\n    \"type\": \"ssh\",\n    \"projectRoot\": \"/abs/path/to/repo/on/host\",\n    \"target\": {\n      \"label\": \"my-box\",\n      \"host\": \"192.0.2.10\",\n      \"port\": 22,\n      \"username\": \"ubuntu\",\n      \"identityFile\": \"~/.ssh/id_ed25519\",\n      \"jumpHost\": \"bastion.example.com\",\n      \"proxyCommand\": \"cloudflared access ssh --hostname %h\",\n      \"relayGracePeriodSeconds\": 0,\n      \"portForwards\": []\n    }\n  }\n}\n```\n\n`label`, `host`, `port`, `username` are required; the rest are optional — omit any you don't need.\n\n**Networking → which `target` fields to set** (how *your desktop* reaches the box — there is no\n`orca serve` URL in SSH mode):\n\n- Public IP / DNS, or a Tailscale/VPN address → `host`; SSH port → `port` (usually 22).\n- Key auth → `identityFile` (add `identitiesOnly: true` if the agent has many keys).\n- Through a bastion → `jumpHost` (a `user@host` ProxyJump) **or** a full `proxyCommand` (e.g. an access\n  proxy). Use one, not both.\n- A service port the workspace needs → add entries to `portForwards`.\n- `relayGracePeriodSeconds` (optional): how long Orca keeps the SSH relay alive after the workspace\n  detaches before tearing it down; `0` = tear down immediately. Leave it off unless the user wants a\n  reconnect grace window.\n\n**Toolchain & agent auth on a persistent (no-snapshot) host — do this ONCE, by hand, before wiring the\nrecipe** (there's no base image to bake; the host *is* the base). Run the §7f Phase-2 install steps and\nthe §7f Phase-3 `<agent> login --device-auth` **directly over SSH on the host** (interactive, e.g.\n`ssh -t user@host '<agent> login --device-auth'`). After that the host stays ready across workspaces.\n\n```bash\n#!/usr/bin/env bash\nset -euo pipefail\n# resolve from env→state→fallback (default unset optionals to \"\"): ssh_username, host,\n#   ssh_port (default 22), identity_file, jump_host, proxy_command, project_root, repo_url, repo_ref\n: \"${identity_file:=}\"; : \"${jump_host:=}\"; : \"${proxy_command:=}\"   # avoid set -u aborts on optionals\ngh_token=\"${GH_TOKEN:-${GITHUB_TOKEN:-$(command -v gh >/dev/null 2>&1 && gh auth token 2>/dev/null || true)}}\"\nssh_target=\"${ssh_username}@${host}\"\nssh_opts=(-p \"$ssh_port\"); [ -n \"$identity_file\" ] && ssh_opts+=(-i \"$identity_file\")\n# Why: a fresh host's key isn't in known_hosts; a StrictHostKeyChecking prompt would HANG a\n# non-interactive create. Pre-add the key (or set the option) so it can't block.\nssh-keyscan -p \"$ssh_port\" \"$host\" >> \"$HOME/.ssh/known_hosts\" 2>/dev/null || true\n\n# 1. ensure the repo is present and at the right commit on the host (NO orca serve here)\nssh \"${ssh_opts[@]}\" \"$ssh_target\" \\\n  \"GH_TOKEN='$gh_token' GIT_TERMINAL_PROMPT=0 bash -lc '\n     set -euo pipefail\n     [ -d \\\"$project_root/.git\\\" ] || git clone \\\"$repo_url\\\" \\\"$project_root\\\"\n     cd \\\"$project_root\\\" && git fetch origin \\\"$repo_ref\\\" && git checkout -B \\\"$repo_ref\\\" FETCH_HEAD\n   '\" >&2\n\n# 2. print the SSH connection block (NO pairingCode, NO orca serve). host/port/username tell Orca's\n#    relay how to dial in; identityFile/jumpHost/proxyCommand/portForwards are emitted when set.\nnode -e 'const [host,port,user,idf,jh,pc,root]=process.argv.slice(1);\n  const target={ label:\"per-workspace-host\", host, port:Number(port), username:user };\n  if(idf) target.identityFile=idf; if(jh) target.jumpHost=jh; if(pc) target.proxyCommand=pc;\n  // add target.portForwards=[...] here if the workspace needs forwarded service ports\n  console.log(JSON.stringify({ schemaVersion:1, connection:{ type:\"ssh\", projectRoot:root, target } }))' \\\n  \"$host\" \"$ssh_port\" \"$ssh_username\" \"$identity_file\" \"$jump_host\" \"$proxy_command\" \"$project_root\"\n```\n\n`suspend`/`resume`/`destroy`: on a persistent host there's usually nothing to tear down — set\n`destroy: none` and omit suspend/resume. (Orca still disconnects/reconnects its own SSH relay on\nsleep/wake/delete — that's separate from these scripts.)\n\nIf the SSH host is instead an **ephemeral/snapshot-capable VM** (your hypervisor, or a cloud VM with\nimage support), keep the §7f Phase-2/3 base-image model for provisioning, but still emit the\n`connection.type:\"ssh\"` block above instead of starting `orca serve`.\n\n### 7h. Worked example — local Docker SSH (SSH connection mode)\n\nLocal Docker can model an ephemeral SSH VM without cloud cost: build a base image with `sshd`, tools,\nrepo prerequisites, and the agent CLI; run an **interactive auth container** once; then `docker commit`\nthat container as the authenticated image used by per-workspace `create`.\n\nKey points:\n\n- Publish container SSH to a random localhost port (`-p 127.0.0.1::22`) and emit\n  `connection.type:\"ssh\"` with `host:\"127.0.0.1\"`, that port, `username`, `identityFile`, and\n  `identitiesOnly:true`.\n- Generate a repo-local SSH key if needed, but gitignore the private/public key files.\n- **Bake SSH host keys into the base image** (`ssh-keygen -A` at **build** time; at runtime only generate\n  if absent). Ephemeral containers all present the **same** host key, so `known_hosts` on `127.0.0.1`\n  doesn't churn as the published port rotates across workspaces (otherwise every container's freshly\n  generated key collides on `localhost` and trips host-key-changed warnings).\n- The auth image is the Docker equivalent of Phase 3: the **user** runs the agent login **inside** the\n  container (you can't drive it — you have no interactive TTY), configures proxy env/config, approves\n  hooks, and you commit once they report it's done. On a headless container use the **device-auth** flow\n  (§4). Verify login before committing — exit code, or fold stderr and match the exact success line (§4).\n- Do not bind-mount or copy the host's full agent home into the image. Let each container have writable\n  agent state; only the committed auth image should carry reusable authenticated state.\n- If committing from an interactive shell, force the runtime entrypoint back to `sshd`:\n  `docker commit --change='ENTRYPOINT [\"/usr/local/bin/orca-docker-ssh-entrypoint\"]' …`.\n- `destroy` should read `recipeResult.userData.resourceId` and run `docker rm -f \"$resource_id\"`.\n\nValidation before wiring/live use:\n\n```bash\ndocker image inspect \"$auth_image\" --format '{{json .Config.Entrypoint}}'\ndocker run -d --name \"$name\" -p 127.0.0.1::22 -e \"ORCA_SSH_PUBLIC_KEY=$pubkey\" \"$auth_image\"\ndocker ps -a --filter \"name=$name\"\ndocker logs \"$name\"\nssh -i \"$key\" -p \"$port\" -o IdentitiesOnly=yes user@127.0.0.1 'codex --version'\n```\n\nIf the container exits immediately, inspect logs before the cleanup trap removes it; a committed\ninteractive image with `ENTRYPOINT [\"bash\"]` is a common cause.\n\nAlso confirm the **host key is stable** across containers: the SSH `ssh -i … 127.0.0.1` dial should not\ntrigger a host-key-changed warning when a second container reuses the port. If it does, the host keys\nweren't baked into the base image (see the `ssh-keygen -A` point above).\n\n### 7i. Windows local-side scripts\n\nThe local-side scripts run on the user's desktop. On **Windows**, a bare `.sh` won't execute. Either\nrequire WSL/Git-Bash (and point `orca.yaml` at e.g. `bash ./scripts/orca-vm/<name>.sh` via a `.cmd`\nlauncher), or scaffold PowerShell equivalents. Minimal PowerShell shape:\n\n```powershell\n#requires -Version 5\n$ErrorActionPreference = 'Stop'\n# resolve env→state→fallback; run the provider CLI / ssh the same way;\n# capture provider output; build the result object for the chosen mode and write ONE line of JSON to stdout.\n# Orca-server mode: @{ schemaVersion=1; pairingCode=$pairingCode; projectRoot=$projectRoot; userData=@{...} }\n# SSH mode:        @{ schemaVersion=1; connection=@{ type=\"ssh\"; projectRoot=$projectRoot;\n#                     target=@{ label=$label; host=$host; port=$port; username=$user } } }  (see §7g/§7h)\n($result | ConvertTo-Json -Compress -Depth 6)\n# progress/errors → Write-Error / the error stream, never stdout.\n```\n\nThe remote-side commands you run *inside* the Linux VM stay bash regardless of the desktop OS.\n\n---\n\n## 8. Per-workspace recipe contract (the fast path)\n\nOnce the authenticated snapshot exists, this runs on every workspace create. Define recipes in\n`orca.yaml`:\n\n```yaml\nenvironmentRecipes:\n  - id: cloud-sandbox\n    name: Cloud Sandbox\n    create: ./scripts/orca-vm/cloud-sandbox-create.sh\n    suspend: ./scripts/orca-vm/cloud-sandbox-suspend.sh\n    resume: ./scripts/orca-vm/cloud-sandbox-resume.sh\n    destroy: ./scripts/orca-vm/cloud-sandbox-destroy.sh\n```\n\n`create` runs **locally from the repo root** and prints **one** JSON object to stdout. Its shape depends\non the connection mode chosen in §1:\n\n**Orca-server mode** — boot the env, start `orca serve` in it, and print serve's result:\n\n```json\n{\n  \"schemaVersion\": 1,\n  \"pairingCode\": \"orca-pairing-code-or-url\",\n  \"projectRoot\": \"/absolute/path/to/repo/on/remote\",\n  \"userData\": { \"provider\": \"example\", \"resourceId\": \"provider-resource-id\" }\n}\n```\n\nHere `pairingCode` (from `orca serve --recipe-json`) and `projectRoot` are required; `schemaVersion` (`1`)\nand `userData` are optional.\n\n**SSH mode** — do **not** run `orca serve`; print the `connection.type:\"ssh\"` block instead (full shape +\nworked script in §7g). `pairingCode` is **not** used in SSH mode.\n\nLifecycle hooks (all run locally):\n\n- `create`: required. Prints recipe result JSON.\n- `suspend`: optional. Sleep; reads lifecycle payload on stdin.\n- `resume`: optional. Wake; reads payload on stdin and **prints fresh recipe JSON** (pairing may change).\n- `destroy`: optional unless `destroy: none`. Delete/cleanup; reads payload on stdin.\n\nStart Orca remotely with `orca serve --port \"$PORT\" --project-root \"$ABS_ROOT\" --pairing-address\n\"$EXTERNAL_WSS_URL\" --recipe-json` (exact flags + output in §7c). Set `--pairing-address` to the\nexternally reachable address so the emitted `pairingCode` is reachable; tunneling/port mapping is the\nscript's job.\n\nBackward compatibility: `command`→`create`, `cleanup`→`destroy`, `cleanup: none`→`destroy: none`.\nPrefer the lifecycle names.\n\n---\n\n## 9. Doctor and validation\n\nValidate in two stages — the cheap dry run first, then the live self-test.\n\n### Dry run (free, non-destructive) — always do this first\n\n`orca vm recipe doctor <recipe-id> --repo-path <repo> --json` validates **static wiring only** — it does\n**not** boot anything. It checks: local-host execution (v1), repo path, recipe id exists,\ncreate/destroy/suspend/resume command paths resolve, suspend/resume are paired, and each script is\nexecutable (POSIX exec bit; skipped on Windows). Fix every failure here before spending any cloud money.\n\n### Live self-test (`--provision`) — diagnose and iterate yourself\n\n`orca vm recipe doctor <recipe-id> --repo-path <repo> --provision --json` actually runs the recipe end\nto end: it executes `create`, validates the returned recipe JSON, then runs `destroy` to **tear the\nenvironment back down** (so the test leaves nothing running, as long as `destroy` works). It spends real\ncloud money, so get the user's OK **once** before starting — that one approval covers the whole loop\nbelow; do not re-ask before each run.\n\nOn failure, the JSON result includes a `provisionTranscript` with the **complete** captured output of\neach stage so you can self-diagnose without asking the user to relay logs:\n\n```json\n{\n  \"ok\": false,\n  \"checks\": [ { \"id\": \"recipe.provision\", \"status\": \"fail\", \"message\": \"…\" } ],\n  \"provisionTranscript\": {\n    \"provision\": { \"exitCode\": 0, \"signal\": null, \"stdout\": \"…\", \"stderr\": \"…\", \"parseError\": \"…\" },\n    \"destroy\":   { \"exitCode\": 0, \"signal\": null, \"stdout\": \"…\", \"stderr\": \"…\" }\n  }\n}\n```\n\n**Run it as a loop:** read `provisionTranscript.provision.stderr` / `.stdout` / `.parseError` (and\n`destroy.*`), fix the script, and re-run `--provision` until `ok` is `true` — iterating on your own\nrather than waiting for the user to paste errors. Common reads: a non-empty `stderr` with `exitCode 0`\nplus a `parseError` means `create` ran but printed something other than the single recipe-result JSON on\nstdout (often a stray `echo` — route it to stderr, see §10); a non-zero `exitCode` is a provider/script\nfailure described in `stderr`. Each stream is redacted and capped (head+tail) — large logs keep both the\nsetup context and the failure.\n\nThe self-test cannot see provider-side truth beyond what the scripts print, so still confirm: state has a\npopulated **authenticated** `snapshotId` (Phases 2–3 done), and `destroy` is implemented/tested (or\nexplicitly `none` — in which case the self-test won't tear down, so clean up manually).\n\nFor SSH recipes, also smoke-test the exact emitted target before declaring success: dial the host/port\nwith the identity/proxy settings, run `pwd`, verify the repo path, check the agent binary, and confirm\n`destroy` removes the provider resource/container. For Docker, inspect the auth image entrypoint and do a\nstartup-only `docker run` before the full clone/install path.\n\n---\n\n## 10. Failure modes\n\n- **Build exceeds plan timeout (e.g. Hobby 45m).** Use enough vCPUs and a timeout covering the build;\n  else split work or use a higher plan. The cap also limits per-workspace runtime — surface it.\n- **Build exceeds plan RAM.** Build the **headless main only** (drop the renderer) — the biggest fitter.\n- **Private-repo clone hangs/fails.** Wrong/missing token. Use `GIT_ASKPASS` + `GIT_TERMINAL_PROMPT=0`\n  so it fails fast instead of prompting.\n- **`GIT_ASKPASS` helper aborts the clone with \"`$1: unbound variable`\".** The `printf`/heredoc that writes\n  the helper inside `bash -lc` under `set -u` expanded `$1`/`$GH_TOKEN` at **write** time. Escape them\n  (`\\$1`, `\\$GH_TOKEN`) so they land literally and resolve at git-runtime; this also keeps the real token\n  out of the file. `rm -f` the helper afterward (§5, §7f).\n- **Agent verified as \"not logged in\" despite a good login.** `codex login status` (and similar) print\n  \"Logged in …\" to **stderr**; an stdout-only `grep` misses it. Prefer the status **exit code**; if you\n  grep, fold stderr first (`status 2>&1 | grep …`) and match the exact success line — not `grep -qi\n  'logged in'`, which also matches \"not logged in\".\n- **Headless agent login hangs.** Plain OAuth `login` starts a loopback callback server on a VM/container\n  port the host browser can't reach. Use the **device-auth** flow (`login --device-auth`) — it prints a\n  URL + code the user opens on the host.\n- **`known_hosts` host-key churn on local Docker.** Each ephemeral container regenerating its SSH host key\n  collides on `127.0.0.1` as the published port rotates. Bake host keys into the base image at build time\n  (`ssh-keygen -A`; runtime generates only if absent) so all containers share one stable key (§7h).\n- **Snapshot expired/evicted.** If `create` hits an unknown snapshot id, rerun Phases 2–3 and update\n  `snapshotId`.\n- **Agent auth didn't persist.** Confirm `snapshotId` points at the **authenticated** snapshot; re-run\n  Phase 3. Warn that short-lived tokens may need periodic re-auth.\n- **Agent auth copied from the host breaks.** Do not bind-mount/copy a full host agent home; sqlite\n  files can be unwritable or host-specific, hooks may need approval again, and config may reference\n  local-only env vars. Authenticate inside the runtime and snapshot/commit that layer.\n- **Docker auth image exits immediately.** Inspect `docker image inspect … .Config.Entrypoint` and\n  `docker logs`. If the image was committed from an interactive shell, reset the entrypoint to the SSH\n  entrypoint during `docker commit`.\n- **Leaked paid resource.** Every long script must trap errors and remove the sandbox it created.\n- **`create` emits non-JSON on stdout.** A stray `echo` corrupts the result — stdout is for the final\n  JSON only; everything else to stderr. The `--provision` self-test surfaces this as `exitCode 0` + a\n  `parseError` with the offending stdout in `provisionTranscript` (§9).\n\n---\n\n## 11. Boundaries\n\n- Don't create accounts, choose plans/regions, or invent scope/project/org/image/billing ids.\n- Don't invent or store credentials; no secrets in `userData`, state, comments, docs, or commits.\n- Don't run paid/long phases (base snapshot, auth, live test) without an explicit OK.\n- Don't hide provider errors behind generic messages — preserve actionable stderr.\n- Don't make Orca own provider lifecycle beyond invoking the configured scripts.\n- Don't commit or create an Orca workspace unless asked.\n"
 
 // oxfmt-ignore
-const ORCHESTRATION_MARKDOWN = "---\nname: orchestration\ndescription: >-\n  Use Orca orchestration for structured multi-agent coordination: threaded\n  messages, blocking ask/reply flows, task dispatch, worker_done/escalation\n  waits, task DAGs, decision gates, coordinator loops, or decomposing work\n  across agents. Use `orca-cli` instead for full ownership handoffs, including\n  requests phrased as \"hand off\", \"handoff\", \"handover\", \"give this to another\n  agent\", or \"another worktree\" when the user did not explicitly ask to\n  supervise, monitor, wait for results, or coordinate a DAG. Use `orca-cli` for\n  ordinary terminal control, lightweight terminal prompts, shell commands, Orca\n  worktree management, reading or waiting on terminals, and automation of the\n  browser embedded inside Orca. Use Computer Use for browser windows, webviews,\n  Orca app UI, or desktop UI outside Orca's embedded browser.\n---\n\n# Orca Inter-Agent Orchestration\n\nOrchestration is Orca's structured coordination layer for agent messages, task ownership, dispatch state, and worker completion tracking.\n\nUse this skill when coordination state matters. For lightweight terminal prompts or basic worktree/terminal/built-in-browser control, use `orca-cli`.\n\n## Tool Boundary\n\nIf a task says to use Orca orchestration, the coordinator must create or bind a Run, create the Task with `orca orchestration task-create`, then attach the worker with either the preferred `orca orchestration worker-start` composition or the low-level `orca orchestration dispatch --inject` path.\n\nDo not substitute non-Orca subagent tools, generic agent-spawn APIs, or chat-only parallel worker features. Those may create useful workers, but they do not create Orca task/dispatch provenance, injected lifecycle preambles, `worker_done` authority, or decision gates.\n\nBefore claiming a worker was orchestrated, verify the task/dispatch exists:\n\n```bash\norca orchestration task-list --json\norca orchestration dispatch-show --task <task_id> --json\n```\n\nIf the work was accidentally run outside Orca orchestration, say so plainly. To repair provenance, rerun or revalidate the needed work through a fresh Orca terminal plus injected dispatch; do not retroactively describe the external worker as orchestrated.\n\n## When To Use\n\n- Send/reply/ask between agent terminals with persistent messages.\n- Dispatch structured tasks to workers and wait for `worker_done` or `escalation`.\n- Track task DAGs with dependencies.\n- Run coordinator loops or decision gates.\n\nDo not use orchestration merely because the user says \"hand off\", \"handoff\", \"handover\", \"give this to another agent\", or asks for another worktree/agent/model/effort. Those are full ownership transfers unless the user explicitly asks to supervise, monitor, wait for worker completion/results, coordinate a DAG, use decision gates, or keep a blocking ask/reply loop.\n\n## Preconditions\n\n- `orca status --json` should show a running runtime.\n- `orca` must be on PATH (`orca-ide` on Linux).\n- The orchestration experimental feature must be enabled in Settings > Experimental.\n- `orca orchestration` commands are RPC calls to the running Orca runtime.\n\n## Contract Migration\n\nOrca adopts a live pre-update orchestration assignment into an ordinary Run. Adoption preserves the existing agent process, PTY/session, terminal handle, tab/leaf/pane, worktree or folder workspace, Task, and Dispatch; it never restarts or replaces the worker. The retired scheduler is not revived, and a newly created attempt uses the current grammar.\n\nTreat the authority label on injected or formatted messages as definitive:\n\n- `[LEGACY COMPATIBILITY]` is live and attested. Run only the exact supported command printed with the message, using the same CLI executable and arguments that the original prompt supplied.\n- `[LEGACY RECOVERY REPLAY — MAY HAVE BEEN SEEN]` is one bounded, at-least-once cutover replay. Process it idempotently and acknowledge it only through the exact displayed guidance.\n- `[LEGACY READ-ONLY]` is inspection-only. It has no reply, acknowledgment, or lifecycle action.\n- An unlabeled current message uses the current guide and current grammar.\n\nAn explicitly selected current Run, attested current Run binding, current Dispatch, or federated attachment takes precedence over legacy fallback. A retained adoption record alone never turns a current command into a legacy call.\n\nDatabase provenance, an old-looking terminal, or a legacy Run ID does not prove mutation authority. If the runtime cannot prove liveness, principal ownership, capability, or the exact legacy contract, it degrades to read-only inspection and must not fall back to local execution. Exact recovery may restore the already-live PTY once in its original inactive background tab. It must not spawn, write, signal, stop, switch, focus, split, or inject a terminal. Loss of lifecycle authority does not invalidate the existing assignment, process, or filesystem work.\n\nCompatibility retries have narrow guarantees. A pending ask, a reply, a final Dispatch settlement, and a consuming check have durable recovery identities. A-era heartbeat and escalation calls remain at-least-once across a manual A-to-B retry because identical later signals may be intentional. If an A-era ask may already have been answered, run the exact non-consuming recovery check printed by the runtime first; after its answer is printed and acknowledged, a new invocation with the same question creates a new question. Never guess among multiple identical question threads.\n\nWhen a compatibility or recovery command returns structured next-step arguments, run those exact arguments with the same CLI executable. The arguments intentionally omit the executable name so the guidance works with `orca`, `orca-ide`, `orca-dev`, or another configured Orca CLI command. Do not translate the command from memory, broaden its recipient, or retry it as a current mutation unless the returned guidance explicitly says to.\n\nOn packaged Windows, a legacy ask uses a two-step commit/resume protocol. The initial command durably commits the question, prints its exact `ask --resume <message_id>` command, and exits with launcher status `75`; it does not wait for the answer. Run that exact resume command after the launcher or update boundary. Resume is idempotent and read-oriented: it waits for the already-committed question and does not create another one. For a WSL process that received compatibility proof at launch, use the printed executable `orca-ide` WSL resume command so the same distro and packaged launcher authority are preserved; do not substitute a PATH-resolved local CLI. Older WSL processes that never received the hidden launch token remain lifecycle read-only after the update, even while their terminal and filesystem work continue.\n\nLegacy inspection remains available without consuming mail:\n\n```bash\norca orchestration run-list --json\n# run_legacy_local is an empty audit tombstone after adoption.\norca orchestration run-show --id run_legacy_local --json\n# In run-list, find the ordinary Run whose objective is:\n# \"Recovered orchestration work from a contract update\"\norca orchestration run-show --id <adopted_run_id> --json\norca orchestration task-list --run <adopted_run_id> --json\norca orchestration inbox --full --json\norca orchestration check --terminal <legacy_handle> --peek --format --json\norca terminal read --terminal <legacy_handle> --json\norca terminal wait --terminal <legacy_handle> --for tui-idle --timeout-ms 60000 --json\n```\n\nIf the original coordinator is unavailable or cannot prove its retained authority, a current coordinator may explicitly take over the adopted Run from its own live agent terminal:\n\n```bash\norca orchestration run-use --id <adopted_run_id> --takeover-legacy --json\norca orchestration check --run <adopted_run_id> --json\n```\n\nTakeover fences only the old coordinator, binds the current one, and moves pending worker mail into current Run Delivery. It is bound to the authenticated invoking terminal; `--from` cannot name another coordinator. Live legacy workers keep their original Tasks, Dispatches, processes, filesystems, and old prompt commands; their later questions, escalations, and completion reports route to the current coordinator. Do not use takeover while the original coordinator is still actively coordinating, because its later lifecycle mutations are rejected.\n\nDo not launch a replacement editor merely because the desktop app or runtime was updated. If adoption cannot prove continuing authority, keep the original worker as the only editor until it reaches a stable handoff point, then use a new current Dispatch in a conflict-free placement for any remaining work.\n\n## Ownership\n\nNew orchestration messages and tasks belong to one explicitly bound Run. A Run is only a durable namespace and coordinator inbox; it never schedules or places workers. Lifecycle authority comes from the active Dispatch, and terminal handles remain routing metadata rather than durable identity. Send `worker_done` and `heartbeat` from the worker's own terminal; Orca routes them to that Dispatch's Run.\n\nClassify inherited context before sending lifecycle messages:\n\n- Coordinated subtask: a live coordinator owns the DAG and waits on this dispatch. Follow the preamble exactly, including `worker_done`, heartbeat/status, `ask`, and `escalation`.\n- Full handoff means ownership transfer, not supervised dispatch. The original actor is not monitoring a DAG, so do not create lifecycle obligations unless the user explicitly asks you to supervise.\n- Classify requests containing \"hand off\", \"handoff\", \"handover\", \"give this to another agent\", \"give this to another worktree\", \"another agent\", or \"another worktree\" as full handoffs by default, even when the user names a custom model or reasoning effort.\n- Use supervised orchestration only when the user explicitly asks you to \"supervise\", \"monitor\", \"wait\", \"track completion\", \"wait for worker_done\", return results, coordinate a DAG, use a decision gate, or manage ask/reply flow.\n- Do not use `orca orchestration dispatch --inject` for full handoffs. It injects a coordinator preamble that tells the worker to send `worker_done`, heartbeat, and `ask` messages, then end its turn under the original terminal's dispatch lifecycle.\n- Do not run `orca orchestration task-create`, `orca orchestration dispatch --inject`, or `orca orchestration check --wait` for full handoffs. Do not peek at terminal output after prompt delivery to monitor progress.\n- A review-only `worker_done` reports findings; it does not authorize coordinator file edits. After a review-only completion, synthesize findings, ask a decision gate if ownership is unclear, and dispatch or hand off fixes unless the user explicitly asked the coordinator to own fixes.\n- If the user's plan names a next owner agent (for example, \"then use opencode to create a PR\"), post-review corrections and PR prep belong to that named owner. The coordinator routes, synthesizes, asks decision gates when needed, and supervises; the named owner edits files and creates the PR.\n\nIf unclear, inspect orchestration state before sending lifecycle messages:\n\n```bash\norca orchestration task-list --json\norca terminal list --json\n# If inherited context includes a task id:\norca orchestration dispatch-show --task <task_id> --json\n```\n\n## Messaging\n\n```bash\norca orchestration send --subject <text> [--to <run:id|dispatch:id|legacy_handle>] [--from <handle>] [--body <text>] [--type <type>] [--priority <level>] [--thread-id <id>] [--payload <json>] [--json]\norca orchestration check [--terminal <handle>] [--ack <delivery_id>] [--peek|--all] [--types <type,...>] [--format] [--wait] [--timeout-ms <n>] [--json]\norca orchestration reply --id <msg_id> --body <text> [--from <handle>] [--json]\norca orchestration ask (--question <text>|--resume <msg_id>) [--options <csv>] [--timeout-ms <n>] [--from <handle>] [--json]\norca orchestration inbox [--limit <n>] [--json]\n```\n\nRules:\n\n- Omit `--from` unless impersonating another terminal; Orca auto-resolves it from the current terminal.\n- A coordinator `check` returns the bound Run's oldest FIFO Delivery (up to 50 messages) and replays that exact batch until `--ack <delivery_id>`. Process every message before acknowledging; `check --ack <id> --wait` acknowledges, checks, and waits in one operation.\n- Use `--peek` and `--all` only for read-only history/debugging. Type filters decide when a waiter wakes; the returned actionable Delivery is still the oldest full batch.\n- Use `dispatch:<id>` for coordinator guidance to one supervised worker. Orca routes that stable address locally or through the connected-server relay; do not substitute a remote terminal handle.\n- Terminal handles remain appropriate for low-level pre-Dispatch messaging. Prefer `agentTerminalHandle` from the create response, fall back to `startupTerminal.handle` for older runtimes, then re-resolve with `orca terminal list --worktree ... --json` if missing or stale. Continue with the replacement handle only; never dual-send to old and new handles.\n- `terminal list --json` omits `visualLayouts` because handle recovery does not need topology. Add `--include-visual-layouts` only for explicit tab and pane inspection.\n- `orca orchestration check --peek --format --json` returns locally formatted unread mail without consuming it; it never writes to terminal input or remotely wakes another terminal. Use `orchestration dispatch --inject` to deliver a tracked task, or `terminal send` when an existing agent needs a free-form prompt.\n- While supervising workers manually, use `check --wait --types worker_done,escalation,question --timeout-ms <n>` instead of sleep/poll loops. Process the whole Delivery, reply to `question` messages with `orca orchestration reply --id <msg_id> --body <answer> --json`, then acknowledge and keep waiting.\n- Treat a `check --wait` timeout or `{count:0}` as a checkpoint, not a worker failure. Long coding tasks routinely run 15-60 minutes; keep using rolling waits unless you receive `worker_done`/`escalation`, the terminal exits or disappears, or the user explicitly asks you to stop.\n- Heartbeats and visible terminal activity mean the worker is alive, not done. Do not stop, close, kill, or restart a worker just because it has not produced a completion message yet.\n- Use `ask` when a worker needs a blocking answer from the coordinator; it defaults to the active Dispatch's Run. Timeout or disconnect leaves the question pending, so resume by its original message ID instead of asking again.\n- `check --wait` returns one bounded Delivery, not every future completion. Process every message, acknowledge it, then keep waiting until every expected Dispatch settles.\n- Group addresses include `@all`, `@idle`, `@claude`, `@codex`, `@opencode`, `@gemini`, `@droid`, `@grok`, `@cursor`, and `@worktree:<id>`.\n- Message types include `status`, `dispatch`, `worker_done`, `merge_ready`, `escalation`, `handoff`, `question`, `decision_gate` (legacy/gates), and `heartbeat`.\n- Use group addresses only for messages that are genuinely useful to many terminals, such as `status` broadcasts or intentional fan-out questions. Do not send dispatch lifecycle messages to groups.\n- `worker_done` belongs to the active Dispatch and defaults to its Run mailbox; never target a group.\n- A valid `worker_done` for the active `taskId` + `dispatchId` marks the task and dispatch completed automatically. Do not follow it with `task-update --status completed`; reserve manual updates for explicit recovery or overrides.\n- `heartbeat` is also Dispatch-scoped. Include both IDs and omit `--to` so Orca uses the owning Run; use `status` for broad progress updates.\n\n## Tasks And Dispatch\n\nA Run is the namespace/inbox, a Task is the work item, and a Dispatch assigns one Task attempt to a terminal. Create or bind a Run once before the common loop.\n\n```bash\norca orchestration run-create --objective <text> --json\norca orchestration task-create --spec <text> [--deps <json_array>] [--parent <task_id>] [--json]\norca orchestration task-list [--status <status>] [--ready] [--brief] [--json]\norca orchestration task-update --id <task_id> --status <status> [--result <json>] [--json]\norca orchestration dispatch --task <task_id> --to <handle> [--from <handle>] [--inject] [--json]\norca orchestration dispatch-show --task <task_id> [--json]\n```\n\nTask statuses: `pending`, `ready`, `dispatched`, `completed`, `failed`, `blocked`.\n\nDispatch rules:\n\n- `--inject` sends the task spec plus preamble into a recognized agent CLI so it can report `worker_done`.\n- If the target is a bare shell, omit `--inject`, dispatch for tracking if needed, then send the prompt manually with `orca terminal send --terminal <handle> --text <prompt> --enter --json`.\n- After 3 consecutive failures on one task, the dispatch context circuit-breaks and the task is marked failed.\n- Use `task-list --brief --json` for coordinator sweeps; it collapses whitespace and caps each echoed spec at 160 characters (`spec_truncated` marks shortened rows). Omit `--brief` when the full spec is required, or when an older CLI rejects it as an unknown flag.\n\n## Preferred Supervised Worker Loop\n\nUse `worker-start` for the normal supervised path. It composes the existing worktree, terminal, readiness, and dispatch primitives while returning exact created/reused effects. Agents still choose placement and concurrency; Orca does not schedule workers or infer conflicts.\n\nCreate the Run and every independent Task first, then start all independent workers before waiting:\n\n```bash\norca orchestration run-create --objective \"<objective>\" --json\norca orchestration task-create --spec \"<worker A task>\" --json\norca orchestration task-create --spec \"<worker B task>\" --json\norca orchestration worker-start --task <task_a> --worktree current --agent codex --json\norca orchestration worker-start --task <task_b> --worktree current --agent claude --json\n```\n\n`current` and exact existing worktrees create a fresh agent terminal and do not rerun setup. Reuse an existing agent only with `--terminal <handle>`.\n\nFor a new worktree, setup runs by default and agent-first creation reuses the returned startup agent terminal:\n\n```bash\norca orchestration worker-start --task <task_id> --worktree new-child --name <name> --agent codex --setup run --json\n# Independent/top-level:\norca orchestration worker-start --task <task_id> --worktree new-top-level --name <name> --agent codex --setup run --json\n```\n\nSetup normally starts alongside the agent. Only a repository explicitly configured with `wait-for-setup` delays agent launch until setup succeeds. Use `--setup skip` or `--setup inherit` only for a concrete reason.\n\nRead the returned receipt before continuing: `ready` plus setup `running` is normal for start-immediately, while wait-for-setup returns setup `succeeded` before accepting task input. A failed or unknown start exits nonzero; inspect its `stage`, `effects`, and `residualResources` instead of guessing or automatically retrying. A wait-for-setup timeout can honestly leave setup `running`, which is not proof of failure.\n\nTo run the worker on another connected Orca server, add `--on <saved-environment>`. The Run and Tasks remain authoritative on the current server; later commands route by Dispatch ID, so never repeat `--on`:\n\n```bash\n# Mac Run home -> Windows worker (the reverse is identical from a Windows Run home)\norca orchestration worker-start --task <task_id> --on windows --worktree new-top-level --repo <exact_remote_repo_selector> --name <name> --agent codex --setup run --json\norca orchestration worker-show --dispatch <dispatch_id> --json\norca orchestration worker-read --dispatch <dispatch_id> --limit 50 --json\norca orchestration send --to dispatch:<dispatch_id> --subject \"Follow-up\" --body \"<attempt-specific guidance>\" --json\n```\n\nRemote `current` and `new-child` are intentionally invalid because those words are ambiguous across servers. Use an exact discovered remote worktree selector or `new-top-level` with an explicit remote repo selector.\n\nThe follow-up is structured inbox mail, not prompt injection. The worker's next\n`orchestration check` receives it even when the Dispatch is on another connected Orca server.\n\n`worker-read` defaults to `--source auto`: Orca returns the exact hook-reported Codex, Claude, OpenClaude, or Grok transcript when it can prove the worker session, otherwise it returns bounded terminal output with `source: \"terminal\"` and a typed `fallbackReason`. Continue with the returned top-level `cursor`; it stays pinned to that exact source. If Orca reports `source_changed`, start a fresh read without the old cursor. Never supply or guess a provider session ID or transcript path.\n\nWait until every expected Dispatch settles, not for a fixed number of batches:\n\n```bash\norca orchestration check --wait --types worker_done,escalation,question --timeout-ms 900000 --json\n# Process every message. For each accepted worker_done that is not immediately reused:\norca orchestration worker-release --dispatch <dispatch_id> --json\n# Acknowledge only after every message and required release decision is handled:\norca orchestration check --ack <delivery_id> --wait --types worker_done,escalation,question --timeout-ms 900000 --json\n```\n\nAfter processing each accepted `worker_done`, choose the terminal's next owner before you acknowledge the Delivery or wait again. If the same exact agent has an immediate follow-up Task, read the `worker.agent_terminal_handle` field of `worker-show --dispatch <dispatch_id> --json`, then run `orca orchestration worker-start --task <next_task_id> --terminal <handle> --json` so Orca transfers cleanup ownership to the new Dispatch. Otherwise run `orca orchestration worker-release --dispatch <dispatch_id> --json`.\n\nRun `worker-release` after both succeeded and failed `worker_done` reports unless the user explicitly asked to keep that worker live. Release is post-completion cleanup, not cancellation: Orca first preserves inspectable output, then closes only the exact agent terminal owned by that settled Dispatch. Reused or pre-existing terminals, setup terminals, coordinators, active workers, user-taken-over terminals, and identities Orca cannot prove are retained. If the user explicitly asks to keep the live terminal for debugging, record that exception with `orca orchestration worker-retain --dispatch <dispatch_id> --json` instead of silently skipping cleanup. When the user is finished, the same Dispatch can be passed to `worker-release`, which clears the requested retention and releases the terminal.\n\nDo not release a worker because of a timeout, TUI idle state, heartbeat, status, question, escalation, or rejected/stale `worker_done`. If release returns `release_pending` or `release_unknown`, do not substitute `terminal close`; follow the exact recovery action in the receipt. A replayed Delivery may repeat `worker-release` safely.\n\nWorkers report exactly once using the IDs and capability injected by Orca; they do not supply Run/server/terminal identity:\n\n```bash\norca orchestration send --type worker_done --subject \"<status>\" --body \"<what changed, findings, and what remains>\" --task-id <task_id> --dispatch-id <dispatch_id> --outcome succeeded --files-modified \"path/a,path/b\" --json\n# On failure, use --outcome failed; never encode failure only in prose.\n```\n\nA worker question defaults to its owning Run. Timeout leaves it pending:\n\n```bash\norca orchestration ask --question \"<question>\" --options \"yes,no\" --timeout-ms 600000 --json\norca orchestration ask --resume <message_id> --timeout-ms 600000 --json\n# Coordinator:\norca orchestration reply --id <message_id> --body \"<answer>\" --json\n```\n\nRecovery is conditional, never a fixed destructive sequence:\n\n- `worker-show --dispatch <id>` says `ready`: keep waiting or read bounded output.\n- It proves `failed` or `stopped`: start a replacement with `worker-start --task <task> --retry-of <id>` plus an explicit `--on`/`--worktree` and `--agent`/`--terminal` choice. Retry does not silently inherit placement.\n- It remains `outcome_unknown`: either `worker-stop --dispatch <id>` and inspect again, or explicitly `worker-abandon --dispatch <id>` while accepting that resources may still be live. Abandon performs no remote, process, or filesystem action.\n- `worker-stop` closes only the exact supervised agent terminal. It never deletes the worktree, setup terminal, configured tabs, or unrelated processes.\n\nLow-level `worktree create`, `terminal create`, and `dispatch --inject` remain valid recipes for custom argv or topology that `worker-start` does not express.\n\n## Gates And Legacy Inspection\n\n```bash\norca orchestration gate-create --task <task_id> --question <text> [--options <json_array>] [--json]\norca orchestration gate-resolve --id <gate_id> --resolution <text> [--json]\norca orchestration gate-list [--task <task_id>] [--status <status>] [--json]\n```\n\nUse `ask` for worker-to-coordinator questions; it creates a `question` message that the coordinator answers with `reply`. Use `gate-create` only for coordinator-managed task DAG decisions, not for answering a worker's `ask`.\n\n`coordinator-start`, `coordinator-stop`, `run`, and `run-stop` are retired scheduler commands. They perform no effects and return the current-skill recovery action. They are not aliases for lightweight Run creation or binding.\n\nRecovery only: `orca orchestration reset --tasks|--messages|--all --json` clears the selected local orchestration database state. Do not run it during active coordination unless explicitly abandoning that state.\n\n## Full Handoffs\n\nFor full ownership transfer, use non-lifecycle terminal/worktree commands and then stop monitoring unless the user asks for supervision.\n\nTreat these as full handoff requests by default: \"hand off\", \"handoff\", \"handover\", \"give this to another agent\", \"give this to another worktree\", \"send this to another agent\", \"another agent\", \"another worktree\", or \"launch another agent to own this.\" Custom model or reasoning effort words such as `gpt-5.5`, `high`, or `xhigh` do not make the handoff supervised.\n\nSupervised orchestration remains available only when the user explicitly asks for supervision or coordination: \"supervise\", \"monitor\", \"wait for worker_done\", \"wait for results\", \"track completion\", \"DAG\", \"decision gate\", \"ask/reply\", or \"coordinate workers.\"\n\nDo not run `orca orchestration task-create`, `orca orchestration dispatch --inject`, or `orca orchestration check --wait` for full handoffs. `task-create` is also forbidden because it records coordinator-owned tracking state; if a task row is needed, the user asked for supervised orchestration. Do not create a `taskId`/`dispatchId`, inject a lifecycle preamble, wait for completion, or read the worker terminal after prompt delivery except to avoid losing the initial prompt.\n\nNew top-level worktree handoff:\n\n```bash\norca worktree create --name <task-name> --no-parent --agent codex --prompt \"<task brief>\" --setup run --json\n```\n\nBefore creating a new worktree from an active feature branch, decide and state whether the desired Orca lineage is child or top-level. Use child worktree lineage only when the new work is conceptually stacked under or dependent on the active worktree. For independent repo-wide fixes, standalone feature work, or unrelated follow-up tasks, create a top-level worktree with `--no-parent`.\n\nExisting terminal handoff:\n\n```bash\norca terminal send --terminal <handle> --text \"<task brief>\" --enter --json\n```\n\nCustom Codex model/effort handoff:\n\n`orca worktree create --agent codex --prompt ...` launches the known Codex agent but does not accept Codex-specific `--model` or `-c model_reasoning_effort=...` arguments. When the user asks for a specific Codex model or effort, create the independent worktree first, launch Codex with the requested command in that worktree, wait only for TUI readiness if prompt delivery would otherwise race startup, send the prompt, and stop.\n\nThe two-step custom-argv path cannot enforce a repository's explicit `wait-for-setup` startup policy because the later `terminal create` is not the startup owned by `worktree create`. Use it only when the repository starts agents immediately. If the repository requires `wait-for-setup`, use an agent-first configured launcher that can preserve sequencing, or stop and ask rather than silently bypassing the policy.\n\nNote: when no repo default-terminal configuration supplies a primary terminal, bare create opens a fallback shell before `terminal create` adds the agent. Configured default tabs are materialized instead and may run real commands. Prefer `--agent` whenever custom argv is not required. With the two-step path, target only the agent handle; close a prior terminal only after `terminal list` or `terminal show` confirms it is an unused shell.\n\nUse the exact full `<repo-id>::<path>` worktree id returned by `orca worktree create --json`; a bare repo id cannot target the new worktree.\n\n```bash\norca worktree create --name <task-name> --no-parent --setup run --json\norca terminal create --worktree id:<newFullWorktreeId> --title <task-name> --command 'codex --model gpt-5.5 -c model_reasoning_effort=\"xhigh\"' --json\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms 60000 --json\norca terminal send --terminal <handle> --text \"<task brief>\" --enter --json\n```\n\nWait only for `tui-idle` when needed to avoid losing the prompt. Do not monitor task completion.\n\n`--no-parent` only controls Orca lineage; it does not choose the Git base. If the work should start from the repo default base, omit `--base-branch` so Orca uses that default, or explicitly pass the repo default base (`origin/main`, `origin/master`, or the `orca repo show --repo <selector> --json` value); never base it on the current feature branch unless the user explicitly asks for stacked work or \"branch from current\". Put current-branch context in the prompt instead.\n\n## Worker Terminals\n\nChoose the worker location before creating a terminal. `Fresh worker` means a fresh agent session, not a new git worktree. For parallel work, create one fresh agent terminal per worker in the same required worktree, falling back to the active worktree when none is named. If the task says current worktree only, depends on uncommitted files/artifacts, or must validate/PR the current branch, keep every worker in the active worktree:\n\n```bash\norca terminal create --worktree active --title <task-name> --command \"codex\" --json\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms 60000 --json\norca orchestration dispatch --task <task_id> --to <handle> --inject --json\n```\n\nReuse an idle agent in the required worktree only if the prompt allows reuse; otherwise create a fresh terminal there. Create a new worktree only when the user explicitly requests one or a concrete checkout or filesystem conflict makes sharing unsafe or impossible; if the user did not request it, state that conflict before running `worktree create`. Independent tasks, parallel execution, convenience, or a preference for separate checkouts are not isolation requirements.\n\nWhen a new worktree is allowed, use child lineage for isolated work that is stacked under or dependent on the active worktree, and use `--no-parent` when it is not stacked. Decide the Git base separately: `--no-parent` makes the worktree top-level in Orca, while omitted `--base-branch` uses the repo default base.\n\nFor every new worktree, pass `--setup run` so any configured repository setup hook runs. This does not mean waiting for setup before agent launch: preserve the repository's startup policy, whose default starts setup and the agent side by side. Use `--setup skip` or `--setup inherit` only when there is a concrete task-specific reason, and state that reason before creating the worktree. This rule does not rerun setup for current or existing worktrees.\n\n```bash\norca worktree create --name <task-name> --agent codex --setup run --json\n# or: --agent claude | omp | pi | grok | ...\n# Read <handle> from agentTerminalHandle, falling back to startupTerminal.handle.\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms 60000 --json\norca orchestration dispatch --task <task_id> --to <handle> --inject --json\n```\n\nFor new-worktree workers, read the id and `agentTerminalHandle` from `worktree create`, falling back to `startupTerminal.handle` for older runtimes. Use that as the sole worker handle when present; otherwise use `terminal list` to resolve the agent handle. Omit `--repo` only inside an Orca-managed worktree; otherwise pass `--repo <selector>`.\n\n**For an allowed new worktree, use agent-first:** `--agent` reveals the new worktree and launches the selected agent **in its first terminal**, without adding a separate fallback shell for that worker. Pass `--setup run`; repo setup and default-terminal settings may add intentional tabs or splits. Do **not** run bare `worktree create` and then `terminal create --command <agent>` for the same worker when agent-first create is available: without configured default tabs, that two-step path leaves a fallback shell + agent pair. Only use it when custom agent argv is required (for example Codex model/effort flags) or when an older CLI rejects `--agent`; if you must, message only the agent handle. Configured default tabs are intentional surfaces, so close a prior terminal only after `terminal list` or `terminal show` confirms it is an unused shell. Do not run `worktree create` when the task must stay in the current worktree.\n\nUse `orca worktree create --prompt ...` or `orca terminal send ...` for full handoffs or untracked/lightweight prompts. Those paths do not attach `taskId`/`dispatchId`; the worker should not send lifecycle messages unless the prompt supplies a live orchestration preamble.\n\nSidebar lineage and orchestration lifecycle are related but not identical. A same-worktree worker may appear as a peer under that worktree in the sidebar while remaining a child dispatch in orchestration state; only an actual child worktree creates visible parent/child worktree lineage.\n\nOther terminal commands coordinators often need:\n\n```bash\norca terminal list [--worktree <selector>] [--include-visual-layouts] [--json]\norca terminal create [--worktree <selector>] [--title <text>] [--command <cmd>] [--json]\norca terminal split --terminal <handle> [--direction horizontal|vertical] [--command <cmd>] [--json]\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms <n> --json\norca terminal read --terminal <handle> --json\norca terminal send --terminal <handle> --text <text> --enter --json\n```\n\nIf an older CLI rejects `worktree create --agent`, create the worktree normally, then run `orca terminal create --worktree <selector> --command \"codex\" --json` or `--command \"claude\"`.\n\nWait for `tui-idle` before dispatching. Always pass `--timeout-ms`; real coding tasks can take 15-60 minutes. During supervision, use rolling `check --wait` windows. If a window returns no matching message, inspect `task-list`, `terminal read`, or `terminal wait --for tui-idle` as a liveness checkpoint; if the terminal is still working or producing activity, keep waiting instead of retrying the task.\n\n## Agent Guidance\n\n- Workers with a valid live preamble must send `worker_done` exactly once from their own terminal with an explicit `--outcome succeeded` or `--outcome failed`:\n  `orca orchestration send --type worker_done --subject \"<short status>\" --body \"<3-sentence summary: what you did, what you found, what's left>\" --task-id <task_id> --dispatch-id <dispatch_id> --outcome succeeded --files-modified \"path/a\" --report-path \"<optional>\" --json`\n- A failed outcome is still a terminal report, but Orca records both the Dispatch and Task as failed. Never encode failure only in the subject/body.\n- After sending `worker_done`, end your turn and idle at the agent prompt. The coordinator may reuse or release this terminal after it processes your report; do not start more work, poll, or attempt to close the terminal yourself. If it reuses you, it re-engages you with a fresh preamble + TASK block delivered as new terminal input.\n- For long tasks, send heartbeat/status only when the preamble asks for it, including both IDs:\n  `orca orchestration send --type heartbeat --subject \"alive\" --payload '{\"taskId\":\"<task_id>\",\"dispatchId\":\"<dispatch_id>\",\"phase\":\"implementing\"}' --json`\n- If blocked before completion, use `ask`; use `escalation` only when ownership is valid and the coordinator must intervene.\n- Treat preambles inherited through terminal history or full handoffs as stale unless the current prompt explicitly keeps that coordinator in the loop.\n- Coordinators must account for every settled worker terminal before waiting again or ending the turn: immediately reuse the exact worker for a new Dispatch, explicitly retain it at the user's request with `worker-retain`, or run `worker-release`. Do not leave a completed worker live merely to inspect output; released workers remain readable through `worker-read`.\n- Coordinators should use `task-list --ready` as external memory, dispatch parallel waves, and avoid dependency chains deeper than 3-4 steps.\n\n## Example\n\n```bash\norca terminal create --worktree active --title login-css-worker --command \"claude\" --json\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms 60000 --json\norca orchestration task-create --spec \"Fix the login button CSS\" --json\norca orchestration dispatch --task <task_id> --to <handle> --inject --json\norca orchestration check --wait --types worker_done,escalation,question --timeout-ms 900000 --json\n```\n\n## Next Action\n\nCoordinator: confirm `orca status --json`, create or bind a Run, inspect `task-list`/`dispatch-show` if inheriting state, then use the explicit supervised loop (`task-create` -> `worker-start` -> `check --wait`). Use low-level terminal creation plus `dispatch --inject` only when the composed start does not express the needed topology. After every accepted `worker_done`, either transfer the exact terminal to an immediate follow-up Dispatch or run `worker-release` before the next wait.\n\nWorker: if the current prompt contains a live dispatch preamble, do the task, use `ask` for blocking questions, and send `worker_done` once with the required payload. If the preamble is stale or absent, do not send lifecycle messages; inspect state or treat the prompt as an ordinary handoff.\n"
+const ORCHESTRATION_MARKDOWN = "---\nname: orchestration\ndescription: >-\n  Use Orca orchestration for structured multi-agent coordination: threaded\n  messages, blocking ask/reply flows, task dispatch, worker_done/escalation\n  waits, task DAGs, decision gates, coordinator loops, or decomposing work\n  across agents. Use `orca-cli` instead for full ownership handoffs, including\n  requests phrased as \"hand off\", \"handoff\", \"handover\", \"give this to another\n  agent\", or \"another worktree\" when the user did not explicitly ask to\n  supervise, monitor, wait for results, or coordinate a DAG. Use `orca-cli` for\n  ordinary terminal control, lightweight terminal prompts, shell commands, Orca\n  worktree management, reading or waiting on terminals, and automation of the\n  browser embedded inside Orca. Use Computer Use for browser windows, webviews,\n  Orca app UI, or desktop UI outside Orca's embedded browser.\n---\n\n# Orca Inter-Agent Orchestration\n\nOrchestration is Orca's structured coordination layer for agent messages, task ownership, dispatch state, and worker completion tracking.\n\nUse this skill when coordination state matters. For lightweight terminal prompts or basic worktree/terminal/built-in-browser control, use `orca-cli`.\n\n## Tool Boundary\n\nIf a task says to use Orca orchestration, the coordinator must create or bind a Run, create the Task with `orca orchestration task-create`, then attach the worker with either the preferred `orca orchestration worker-start` composition or the low-level `orca orchestration dispatch --inject` path.\n\nDo not substitute non-Orca subagent tools, generic agent-spawn APIs, or chat-only parallel worker features. Those may create useful workers, but they do not create Orca task/dispatch provenance, injected lifecycle preambles, `worker_done` authority, or decision gates.\n\nBefore claiming a worker was orchestrated, verify the task/dispatch exists:\n\n```bash\norca orchestration task-list --json\norca orchestration dispatch-show --task <task_id> --json\n```\n\nIf the work was accidentally run outside Orca orchestration, say so plainly. To repair provenance, rerun or revalidate the needed work through a fresh Orca terminal plus injected dispatch; do not retroactively describe the external worker as orchestrated.\n\n## When To Use\n\n- Send/reply/ask between agent terminals with persistent messages.\n- Dispatch structured tasks to workers and wait for `worker_done` or `escalation`.\n- Track task DAGs with dependencies.\n- Run coordinator loops or decision gates.\n\nDo not use orchestration merely because the user says \"hand off\", \"handoff\", \"handover\", \"give this to another agent\", or asks for another worktree/agent/model/effort. Those are full ownership transfers unless the user explicitly asks to supervise, monitor, wait for worker completion/results, coordinate a DAG, use decision gates, or keep a blocking ask/reply loop.\n\n## Preconditions\n\n- `orca status --json` should show a running runtime.\n- `orca` must be on PATH (`orca-ide` on Linux).\n- The orchestration experimental feature must be enabled in Settings > Experimental.\n- `orca orchestration` commands are RPC calls to the running Orca runtime.\n\n## Contract Migration\n\nOrca adopts a live pre-update orchestration assignment into an ordinary Run. Adoption preserves the existing agent process, PTY/session, terminal handle, tab/leaf/pane, worktree or folder workspace, Task, and Dispatch; it never restarts or replaces the worker. The retired scheduler is not revived, and a newly created attempt uses the current grammar.\n\nTreat the authority label on injected or formatted messages as definitive:\n\n- `[LEGACY COMPATIBILITY]` is live and attested. Run only the exact supported command printed with the message, using the same CLI executable and arguments that the original prompt supplied.\n- `[LEGACY RECOVERY REPLAY — MAY HAVE BEEN SEEN]` is one bounded, at-least-once cutover replay. Process it idempotently and acknowledge it only through the exact displayed guidance.\n- `[LEGACY READ-ONLY]` is inspection-only. It has no reply, acknowledgment, or lifecycle action.\n- An unlabeled current message uses the current guide and current grammar.\n\nAn explicitly selected current Run, attested current Run binding, current Dispatch, or federated attachment takes precedence over legacy fallback. A retained adoption record alone never turns a current command into a legacy call.\n\nDatabase provenance, an old-looking terminal, or a legacy Run ID does not prove mutation authority. If the runtime cannot prove liveness, principal ownership, capability, or the exact legacy contract, it degrades to read-only inspection and must not fall back to local execution. Exact recovery may restore the already-live PTY once in its original inactive background tab. It must not spawn, write, signal, stop, switch, focus, split, or inject a terminal. Loss of lifecycle authority does not invalidate the existing assignment, process, or filesystem work.\n\nCompatibility retries have narrow guarantees. A pending ask, a reply, a final Dispatch settlement, and a consuming check have durable recovery identities. A-era heartbeat and escalation calls remain at-least-once across a manual A-to-B retry because identical later signals may be intentional. If an A-era ask may already have been answered, run the exact non-consuming recovery check printed by the runtime first; after its answer is printed and acknowledged, a new invocation with the same question creates a new question. Never guess among multiple identical question threads.\n\nWhen a compatibility or recovery command returns structured next-step arguments, run those exact arguments with the same CLI executable. The arguments intentionally omit the executable name so the guidance works with `orca`, `orca-ide`, `orca-dev`, or another configured Orca CLI command. Do not translate the command from memory, broaden its recipient, or retry it as a current mutation unless the returned guidance explicitly says to.\n\nOn packaged Windows, a legacy ask uses a two-step commit/resume protocol. The initial command durably commits the question, prints its exact `ask --resume <message_id>` command, and exits with launcher status `75`; it does not wait for the answer. Run that exact resume command after the launcher or update boundary. Resume is idempotent and read-oriented: it waits for the already-committed question and does not create another one. For a WSL process that received compatibility proof at launch, use the printed executable `orca-ide` WSL resume command so the same distro and packaged launcher authority are preserved; do not substitute a PATH-resolved local CLI. Older WSL processes that never received the hidden launch token remain lifecycle read-only after the update, even while their terminal and filesystem work continue.\n\nLegacy inspection remains available without consuming mail:\n\n```bash\norca orchestration run-list --json\n# run_legacy_local is an empty audit tombstone after adoption.\norca orchestration run-show --id run_legacy_local --json\n# In run-list, find the ordinary Run whose objective is:\n# \"Recovered orchestration work from a contract update\"\norca orchestration run-show --id <adopted_run_id> --json\norca orchestration task-list --run <adopted_run_id> --json\norca orchestration inbox --full --json\norca orchestration check --terminal <legacy_handle> --peek --format --json\norca terminal read --terminal <legacy_handle> --json\norca terminal wait --terminal <legacy_handle> --for tui-idle --timeout-ms 60000 --json\n```\n\nIf the original coordinator is unavailable or cannot prove its retained authority, a current coordinator may explicitly take over the adopted Run from its own live agent terminal:\n\n```bash\norca orchestration run-use --id <adopted_run_id> --takeover-legacy --json\norca orchestration check --run <adopted_run_id> --json\n```\n\nTakeover fences only the old coordinator, binds the current one, and moves pending worker mail into current Run Delivery. It is bound to the authenticated invoking terminal; `--from` cannot name another coordinator. Live legacy workers keep their original Tasks, Dispatches, processes, filesystems, and old prompt commands; their later questions, escalations, and completion reports route to the current coordinator. Do not use takeover while the original coordinator is still actively coordinating, because its later lifecycle mutations are rejected.\n\nDo not launch a replacement editor merely because the desktop app or runtime was updated. If adoption cannot prove continuing authority, keep the original worker as the only editor until it reaches a stable handoff point, then use a new current Dispatch in a conflict-free placement for any remaining work.\n\n## Ownership\n\nNew orchestration messages and tasks belong to one explicitly bound Run. A Run is only a durable namespace and coordinator inbox; it never schedules or places workers. Lifecycle authority comes from the active Dispatch, and terminal handles remain routing metadata rather than durable identity. Send `worker_done` and `heartbeat` from the worker's own terminal; Orca routes them to that Dispatch's Run.\n\nClassify inherited context before sending lifecycle messages:\n\n- Coordinated subtask: a live coordinator owns the DAG and waits on this dispatch. Follow the preamble exactly, including `worker_done`, heartbeat/status, `ask`, and `escalation`.\n- Full handoff means ownership transfer, not supervised dispatch. The original actor is not monitoring a DAG, so do not create lifecycle obligations unless the user explicitly asks you to supervise.\n- Classify requests containing \"hand off\", \"handoff\", \"handover\", \"give this to another agent\", \"give this to another worktree\", \"another agent\", or \"another worktree\" as full handoffs by default, even when the user names a custom model or reasoning effort.\n- Use supervised orchestration only when the user explicitly asks you to \"supervise\", \"monitor\", \"wait\", \"track completion\", \"wait for worker_done\", return results, coordinate a DAG, use a decision gate, or manage ask/reply flow.\n- Do not use `orca orchestration dispatch --inject` for full handoffs. It injects a coordinator preamble that tells the worker to send `worker_done`, heartbeat, and `ask` messages, then end its turn under the original terminal's dispatch lifecycle.\n- Do not run `orca orchestration task-create`, `orca orchestration dispatch --inject`, or `orca orchestration check --wait` for full handoffs. Do not peek at terminal output after prompt delivery to monitor progress.\n- A review-only `worker_done` reports findings; it does not authorize coordinator file edits. After a review-only completion, synthesize findings, ask a decision gate if ownership is unclear, and dispatch or hand off fixes unless the user explicitly asked the coordinator to own fixes.\n- If the user's plan names a next owner agent (for example, \"then use opencode to create a PR\"), post-review corrections and PR prep belong to that named owner. The coordinator routes, synthesizes, asks decision gates when needed, and supervises; the named owner edits files and creates the PR.\n\nIf unclear, inspect orchestration state before sending lifecycle messages:\n\n```bash\norca orchestration task-list --json\norca terminal list --json\n# If inherited context includes a task id:\norca orchestration dispatch-show --task <task_id> --json\n```\n\n## Messaging\n\n```bash\norca orchestration send --subject <text> [--to <run:id|dispatch:id|legacy_handle>] [--from <handle>] [--body <text>] [--type <type>] [--priority <level>] [--thread-id <id>] [--payload <json>] [--json]\norca orchestration check [--terminal <handle>] [--ack <delivery_id>] [--peek|--all] [--types <type,...>] [--format] [--wait] [--timeout-ms <n>] [--json]\norca orchestration reply --id <msg_id> --body <text> [--from <handle>] [--json]\norca orchestration ask (--question <text>|--resume <msg_id>) [--options <csv>] [--timeout-ms <n>] [--from <handle>] [--json]\norca orchestration inbox [--limit <n>] [--json]\n```\n\nRules:\n\n- Omit `--from` unless impersonating another terminal; Orca auto-resolves it from the current terminal.\n- A coordinator `check` returns the bound Run's oldest FIFO Delivery (up to 50 messages) and replays that exact batch until `--ack <delivery_id>`. Process every message before acknowledging; `check --ack <id> --wait` acknowledges, checks, and waits in one operation.\n- Use `--peek` and `--all` only for read-only history/debugging. Type filters decide when a waiter wakes; the returned actionable Delivery is still the oldest full batch.\n- Use `dispatch:<id>` for coordinator guidance to one supervised worker. Orca routes that stable address locally or through the connected-server relay; do not substitute a remote terminal handle.\n- Terminal handles remain appropriate for low-level pre-Dispatch messaging. Prefer `agentTerminalHandle` from the create response, fall back to `startupTerminal.handle` for older runtimes, then re-resolve with `orca terminal list --worktree ... --json` if missing or stale. Continue with the replacement handle only; never dual-send to old and new handles.\n- `terminal list --json` omits `visualLayouts` because handle recovery does not need topology. Add `--include-visual-layouts` only for explicit tab and pane inspection.\n- `orca orchestration check --peek --format --json` returns locally formatted unread mail without consuming it; it never writes to terminal input or remotely wakes another terminal. Use `orchestration dispatch --inject` to deliver a tracked task, or `terminal send` when an existing agent needs a free-form prompt.\n- While supervising workers manually, use `check --wait --types worker_done,escalation,question --timeout-ms <n>` instead of sleep/poll loops. Process the whole Delivery, reply to `question` messages with `orca orchestration reply --id <msg_id> --body <answer> --json`, then acknowledge and keep waiting.\n- Treat a `check --wait` timeout or `{count:0}` as a checkpoint, not a worker failure. Long coding tasks routinely run 15-60 minutes; keep using rolling waits unless you receive `worker_done`/`escalation`, the terminal exits or disappears, or the user explicitly asks you to stop.\n- Heartbeats and visible terminal activity mean the worker is alive, not done. Do not stop, close, kill, or restart a worker just because it has not produced a completion message yet.\n- Use `ask` when a worker needs a blocking answer from the coordinator; it defaults to the active Dispatch's Run. Timeout or disconnect leaves the question pending, so resume by its original message ID instead of asking again.\n- `check --wait` returns one bounded Delivery, not every future completion. Process every message, acknowledge it, then keep waiting until every expected Dispatch settles.\n- Group addresses include `@all`, `@idle`, `@claude`, `@codex`, `@opencode`, `@gemini`, `@droid`, `@grok`, `@cursor`, and `@worktree:<id>`.\n- Message types include `status`, `dispatch`, `worker_done`, `merge_ready`, `escalation`, `handoff`, `question`, `decision_gate` (legacy/gates), and `heartbeat`.\n- Use group addresses only for messages that are genuinely useful to many terminals, such as `status` broadcasts or intentional fan-out questions. Do not send dispatch lifecycle messages to groups.\n- `worker_done` belongs to the active Dispatch and defaults to its Run mailbox; never target a group.\n- A valid `worker_done` for the active `taskId` + `dispatchId` marks the task and dispatch completed automatically. Do not follow it with `task-update --status completed`; reserve manual updates for explicit recovery or overrides.\n- `heartbeat` is also Dispatch-scoped. Include both IDs and omit `--to` so Orca uses the owning Run; use `status` for broad progress updates.\n\n## Tasks And Dispatch\n\nA Run is the namespace/inbox, a Task is the work item, and a Dispatch assigns one Task attempt to a terminal. Create or bind a Run once before the common loop.\n\n```bash\norca orchestration run-create --objective <text> --json\norca orchestration task-create --spec <text> [--deps <json_array>] [--parent <task_id>] [--json]\norca orchestration task-list [--status <status>] [--ready] [--brief] [--json]\norca orchestration task-update --id <task_id> --status <status> [--result <json>] [--json]\norca orchestration dispatch --task <task_id> --to <handle> [--from <handle>] [--inject] [--json]\norca orchestration dispatch-show --task <task_id> [--json]\n```\n\nTask statuses: `pending`, `ready`, `dispatched`, `completed`, `failed`, `blocked`.\n\nDispatch rules:\n\n- `--inject` sends the task spec plus preamble into a recognized agent CLI so it can report `worker_done`.\n- If the target is a bare shell, omit `--inject`, dispatch for tracking if needed, then send the prompt manually with `orca terminal send --terminal <handle> --text <prompt> --enter --json`.\n- After 3 consecutive failures on one task, the dispatch context circuit-breaks and the task is marked failed.\n- Use `task-list --brief --json` for coordinator sweeps; it collapses whitespace and caps each echoed spec at 160 characters (`spec_truncated` marks shortened rows). Omit `--brief` when the full spec is required, or when an older CLI rejects it as an unknown flag.\n\n## Preferred Supervised Worker Loop\n\nUse `worker-start` for the normal supervised path. It composes the existing worktree, terminal, readiness, and dispatch primitives while returning exact created/reused effects. Agents still choose placement and concurrency; Orca does not schedule workers or infer conflicts.\n\nCreate the Run and every independent Task first, then start all independent workers before waiting:\n\n```bash\norca orchestration run-create --objective \"<objective>\" --json\norca orchestration task-create --spec \"<worker A task>\" --json\norca orchestration task-create --spec \"<worker B task>\" --json\norca orchestration worker-start --task <task_a> --worktree current --agent codex --json\norca orchestration worker-start --task <task_b> --worktree current --agent claude --json\n```\n\n`current` and exact existing worktrees create a fresh agent terminal and do not rerun setup. Reuse an existing agent only with `--terminal <handle>`.\n\nFor a per-invocation Claude, Codex, or Cursor launch, pass an opaque provider model id with `--model`; add `--effort` only when that agent/model supports the level. These options apply only to fresh agent terminals, override general agent default arguments, and are reported under `launch.requested` and `launch.effective` in the receipt:\n\n```bash\norca orchestration worker-start --task <task_id> --worktree current --agent claude --model aws-bedrock-opus-5 --effort high --json\n```\n\n`--effort` requires `--model`, and neither option can combine with `--terminal`. A connected worker server must advertise launch-preference support before Orca forwards either option.\n\nFor a new worktree, setup runs by default and agent-first creation reuses the returned startup agent terminal:\n\n```bash\norca orchestration worker-start --task <task_id> --worktree new-child --name <name> --agent codex --setup run --json\n# Independent/top-level:\norca orchestration worker-start --task <task_id> --worktree new-top-level --name <name> --agent codex --setup run --json\n```\n\nSetup normally starts alongside the agent. Only a repository explicitly configured with `wait-for-setup` delays agent launch until setup succeeds. Use `--setup skip` or `--setup inherit` only for a concrete reason.\n\nRead the returned receipt before continuing: `ready` plus setup `running` is normal for start-immediately, while wait-for-setup returns setup `succeeded` before accepting task input. A failed or unknown start exits nonzero; inspect its `stage`, `effects`, and `residualResources` instead of guessing or automatically retrying. A wait-for-setup timeout can honestly leave setup `running`, which is not proof of failure.\n\nTo run the worker on another connected Orca server, add `--on <saved-environment>`. The Run and Tasks remain authoritative on the current server; later commands route by Dispatch ID, so never repeat `--on`:\n\n```bash\n# Mac Run home -> Windows worker (the reverse is identical from a Windows Run home)\norca orchestration worker-start --task <task_id> --on windows --worktree new-top-level --repo <exact_remote_repo_selector> --name <name> --agent codex --setup run --json\norca orchestration worker-show --dispatch <dispatch_id> --json\norca orchestration worker-read --dispatch <dispatch_id> --limit 50 --json\norca orchestration send --to dispatch:<dispatch_id> --subject \"Follow-up\" --body \"<attempt-specific guidance>\" --json\n```\n\nRemote `current` and `new-child` are intentionally invalid because those words are ambiguous across servers. Use an exact discovered remote worktree selector or `new-top-level` with an explicit remote repo selector.\n\nThe follow-up is structured inbox mail, not prompt injection. The worker's next\n`orchestration check` receives it even when the Dispatch is on another connected Orca server.\n\n`worker-read` defaults to `--source auto`: Orca returns the exact hook-reported Codex, Claude, OpenClaude, or Grok transcript when it can prove the worker session, otherwise it returns bounded terminal output with `source: \"terminal\"` and a typed `fallbackReason`. Continue with the returned top-level `cursor`; it stays pinned to that exact source. If Orca reports `source_changed`, start a fresh read without the old cursor. Never supply or guess a provider session ID or transcript path.\n\nWait until every expected Dispatch settles, not for a fixed number of batches:\n\n```bash\norca orchestration check --wait --types worker_done,escalation,question --timeout-ms 900000 --json\n# Process every message. For each accepted worker_done that is not immediately reused:\norca orchestration worker-release --dispatch <dispatch_id> --json\n# Acknowledge only after every message and required release decision is handled:\norca orchestration check --ack <delivery_id> --wait --types worker_done,escalation,question --timeout-ms 900000 --json\n```\n\nAfter processing each accepted `worker_done`, choose the terminal's next owner before you acknowledge the Delivery or wait again. If the same exact agent has an immediate follow-up Task, read the `worker.agent_terminal_handle` field of `worker-show --dispatch <dispatch_id> --json`, then run `orca orchestration worker-start --task <next_task_id> --terminal <handle> --json` so Orca transfers cleanup ownership to the new Dispatch. Otherwise run `orca orchestration worker-release --dispatch <dispatch_id> --json`.\n\nRun `worker-release` after both succeeded and failed `worker_done` reports unless the user explicitly asked to keep that worker live. Release is post-completion cleanup, not cancellation: Orca first preserves inspectable output, then closes only the exact agent terminal owned by that settled Dispatch. Reused or pre-existing terminals, setup terminals, coordinators, active workers, user-taken-over terminals, and identities Orca cannot prove are retained. If the user explicitly asks to keep the live terminal for debugging, record that exception with `orca orchestration worker-retain --dispatch <dispatch_id> --json` instead of silently skipping cleanup. When the user is finished, the same Dispatch can be passed to `worker-release`, which clears the requested retention and releases the terminal.\n\nDo not release a worker because of a timeout, TUI idle state, heartbeat, status, question, escalation, or rejected/stale `worker_done`. If release returns `release_pending` or `release_unknown`, do not substitute `terminal close`; follow the exact recovery action in the receipt. A replayed Delivery may repeat `worker-release` safely.\n\nWorkers report exactly once using the IDs and capability injected by Orca; they do not supply Run/server/terminal identity:\n\n```bash\norca orchestration send --type worker_done --subject \"<status>\" --body \"<what changed, findings, and what remains>\" --task-id <task_id> --dispatch-id <dispatch_id> --outcome succeeded --files-modified \"path/a,path/b\" --json\n# On failure, use --outcome failed; never encode failure only in prose.\n```\n\nA worker question defaults to its owning Run. Timeout leaves it pending:\n\n```bash\norca orchestration ask --question \"<question>\" --options \"yes,no\" --timeout-ms 600000 --json\norca orchestration ask --resume <message_id> --timeout-ms 600000 --json\n# Coordinator:\norca orchestration reply --id <message_id> --body \"<answer>\" --json\n```\n\nRecovery is conditional, never a fixed destructive sequence:\n\n- `worker-show --dispatch <id>` says `ready`: keep waiting or read bounded output.\n- It proves `failed` or `stopped`: start a replacement with `worker-start --task <task> --retry-of <id>` plus an explicit `--on`/`--worktree` and `--agent`/`--terminal` choice. Retry does not silently inherit placement.\n- It remains `outcome_unknown`: either `worker-stop --dispatch <id>` and inspect again, or explicitly `worker-abandon --dispatch <id>` while accepting that resources may still be live. Abandon performs no remote, process, or filesystem action.\n- `worker-stop` closes only the exact supervised agent terminal. It never deletes the worktree, setup terminal, configured tabs, or unrelated processes.\n\nLow-level `worktree create`, `terminal create`, and `dispatch --inject` remain valid recipes for custom argv or topology that `worker-start` does not express.\n\n## Gates And Legacy Inspection\n\n```bash\norca orchestration gate-create --task <task_id> --question <text> [--options <json_array>] [--json]\norca orchestration gate-resolve --id <gate_id> --resolution <text> [--json]\norca orchestration gate-list [--task <task_id>] [--status <status>] [--json]\n```\n\nUse `ask` for worker-to-coordinator questions; it creates a `question` message that the coordinator answers with `reply`. Use `gate-create` only for coordinator-managed task DAG decisions, not for answering a worker's `ask`.\n\n`coordinator-start`, `coordinator-stop`, `run`, and `run-stop` are retired scheduler commands. They perform no effects and return the current-skill recovery action. They are not aliases for lightweight Run creation or binding.\n\nRecovery only: `orca orchestration reset --tasks|--messages|--all --json` clears the selected local orchestration database state. Do not run it during active coordination unless explicitly abandoning that state.\n\n## Full Handoffs\n\nFor full ownership transfer, use non-lifecycle terminal/worktree commands and then stop monitoring unless the user asks for supervision.\n\nTreat these as full handoff requests by default: \"hand off\", \"handoff\", \"handover\", \"give this to another agent\", \"give this to another worktree\", \"send this to another agent\", \"another agent\", \"another worktree\", or \"launch another agent to own this.\" Custom model or reasoning effort words such as `gpt-5.5`, `high`, or `xhigh` do not make the handoff supervised.\n\nSupervised orchestration remains available only when the user explicitly asks for supervision or coordination: \"supervise\", \"monitor\", \"wait for worker_done\", \"wait for results\", \"track completion\", \"DAG\", \"decision gate\", \"ask/reply\", or \"coordinate workers.\"\n\nDo not run `orca orchestration task-create`, `orca orchestration dispatch --inject`, or `orca orchestration check --wait` for full handoffs. `task-create` is also forbidden because it records coordinator-owned tracking state; if a task row is needed, the user asked for supervised orchestration. Do not create a `taskId`/`dispatchId`, inject a lifecycle preamble, wait for completion, or read the worker terminal after prompt delivery except to avoid losing the initial prompt.\n\nNew top-level worktree handoff:\n\n```bash\norca worktree create --name <task-name> --no-parent --agent codex --prompt \"<task brief>\" --setup run --json\n```\n\nBefore creating a new worktree from an active feature branch, decide and state whether the desired Orca lineage is child or top-level. Use child worktree lineage only when the new work is conceptually stacked under or dependent on the active worktree. For independent repo-wide fixes, standalone feature work, or unrelated follow-up tasks, create a top-level worktree with `--no-parent`.\n\nExisting terminal handoff:\n\n```bash\norca terminal send --terminal <handle> --text \"<task brief>\" --enter --json\n```\n\nCustom Codex model/effort handoff:\n\n`orca worktree create --agent codex --prompt ...` launches the known Codex agent but does not accept Codex-specific `--model` or `-c model_reasoning_effort=...` arguments. When the user asks for a specific Codex model or effort, create the independent worktree first, launch Codex with the requested command in that worktree, wait only for TUI readiness if prompt delivery would otherwise race startup, send the prompt, and stop.\n\nThe two-step custom-argv path cannot enforce a repository's explicit `wait-for-setup` startup policy because the later `terminal create` is not the startup owned by `worktree create`. Use it only when the repository starts agents immediately. If the repository requires `wait-for-setup`, use an agent-first configured launcher that can preserve sequencing, or stop and ask rather than silently bypassing the policy.\n\nNote: when no repo default-terminal configuration supplies a primary terminal, bare create opens a fallback shell before `terminal create` adds the agent. Configured default tabs are materialized instead and may run real commands. Prefer `--agent` whenever custom argv is not required. With the two-step path, target only the agent handle; close a prior terminal only after `terminal list` or `terminal show` confirms it is an unused shell.\n\nUse the exact full `<repo-id>::<path>` worktree id returned by `orca worktree create --json`; a bare repo id cannot target the new worktree.\n\n```bash\norca worktree create --name <task-name> --no-parent --setup run --json\norca terminal create --worktree id:<newFullWorktreeId> --title <task-name> --command 'codex --model gpt-5.5 -c model_reasoning_effort=\"xhigh\"' --json\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms 60000 --json\norca terminal send --terminal <handle> --text \"<task brief>\" --enter --json\n```\n\nWait only for `tui-idle` when needed to avoid losing the prompt. Do not monitor task completion.\n\n`--no-parent` only controls Orca lineage; it does not choose the Git base. If the work should start from the repo default base, omit `--base-branch` so Orca uses that default, or explicitly pass the repo default base (`origin/main`, `origin/master`, or the `orca repo show --repo <selector> --json` value); never base it on the current feature branch unless the user explicitly asks for stacked work or \"branch from current\". Put current-branch context in the prompt instead.\n\n## Worker Terminals\n\nChoose the worker location before creating a terminal. `Fresh worker` means a fresh agent session, not a new git worktree. For parallel work, create one fresh agent terminal per worker in the same required worktree, falling back to the active worktree when none is named. If the task says current worktree only, depends on uncommitted files/artifacts, or must validate/PR the current branch, keep every worker in the active worktree:\n\n```bash\norca terminal create --worktree active --title <task-name> --command \"codex\" --json\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms 60000 --json\norca orchestration dispatch --task <task_id> --to <handle> --inject --json\n```\n\nReuse an idle agent in the required worktree only if the prompt allows reuse; otherwise create a fresh terminal there. Create a new worktree only when the user explicitly requests one or a concrete checkout or filesystem conflict makes sharing unsafe or impossible; if the user did not request it, state that conflict before running `worktree create`. Independent tasks, parallel execution, convenience, or a preference for separate checkouts are not isolation requirements.\n\nWhen a new worktree is allowed, use child lineage for isolated work that is stacked under or dependent on the active worktree, and use `--no-parent` when it is not stacked. Decide the Git base separately: `--no-parent` makes the worktree top-level in Orca, while omitted `--base-branch` uses the repo default base.\n\nFor every new worktree, pass `--setup run` so any configured repository setup hook runs. This does not mean waiting for setup before agent launch: preserve the repository's startup policy, whose default starts setup and the agent side by side. Use `--setup skip` or `--setup inherit` only when there is a concrete task-specific reason, and state that reason before creating the worktree. This rule does not rerun setup for current or existing worktrees.\n\n```bash\norca worktree create --name <task-name> --agent codex --setup run --json\n# or: --agent claude | omp | pi | grok | ...\n# Read <handle> from agentTerminalHandle, falling back to startupTerminal.handle.\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms 60000 --json\norca orchestration dispatch --task <task_id> --to <handle> --inject --json\n```\n\nFor new-worktree workers, read the id and `agentTerminalHandle` from `worktree create`, falling back to `startupTerminal.handle` for older runtimes. Use that as the sole worker handle when present; otherwise use `terminal list` to resolve the agent handle. Omit `--repo` only inside an Orca-managed worktree; otherwise pass `--repo <selector>`.\n\n**For an allowed new worktree, use agent-first:** `--agent` reveals the new worktree and launches the selected agent **in its first terminal**, without adding a separate fallback shell for that worker. Pass `--setup run`; repo setup and default-terminal settings may add intentional tabs or splits. Do **not** run bare `worktree create` and then `terminal create --command <agent>` for the same worker when agent-first create is available: without configured default tabs, that two-step path leaves a fallback shell + agent pair. Only use it when custom agent argv is required (for example Codex model/effort flags) or when an older CLI rejects `--agent`; if you must, message only the agent handle. Configured default tabs are intentional surfaces, so close a prior terminal only after `terminal list` or `terminal show` confirms it is an unused shell. Do not run `worktree create` when the task must stay in the current worktree.\n\nUse `orca worktree create --prompt ...` or `orca terminal send ...` for full handoffs or untracked/lightweight prompts. Those paths do not attach `taskId`/`dispatchId`; the worker should not send lifecycle messages unless the prompt supplies a live orchestration preamble.\n\nSidebar lineage and orchestration lifecycle are related but not identical. A same-worktree worker may appear as a peer under that worktree in the sidebar while remaining a child dispatch in orchestration state; only an actual child worktree creates visible parent/child worktree lineage.\n\nOther terminal commands coordinators often need:\n\n```bash\norca terminal list [--worktree <selector>] [--include-visual-layouts] [--json]\norca terminal create [--worktree <selector>] [--title <text>] [--command <cmd>] [--json]\norca terminal split --terminal <handle> [--direction horizontal|vertical] [--command <cmd>] [--json]\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms <n> --json\norca terminal read --terminal <handle> --json\norca terminal send --terminal <handle> --text <text> --enter --json\n```\n\nIf an older CLI rejects `worktree create --agent`, create the worktree normally, then run `orca terminal create --worktree <selector> --command \"codex\" --json` or `--command \"claude\"`.\n\nWait for `tui-idle` before dispatching. Always pass `--timeout-ms`; real coding tasks can take 15-60 minutes. During supervision, use rolling `check --wait` windows. If a window returns no matching message, inspect `task-list`, `terminal read`, or `terminal wait --for tui-idle` as a liveness checkpoint; if the terminal is still working or producing activity, keep waiting instead of retrying the task.\n\n## Agent Guidance\n\n- Workers with a valid live preamble must send `worker_done` exactly once from their own terminal with an explicit `--outcome succeeded` or `--outcome failed`:\n  `orca orchestration send --type worker_done --subject \"<short status>\" --body \"<3-sentence summary: what you did, what you found, what's left>\" --task-id <task_id> --dispatch-id <dispatch_id> --outcome succeeded --files-modified \"path/a\" --report-path \"<optional>\" --json`\n- A failed outcome is still a terminal report, but Orca records both the Dispatch and Task as failed. Never encode failure only in the subject/body.\n- After sending `worker_done`, end your turn and idle at the agent prompt. The coordinator may reuse or release this terminal after it processes your report; do not start more work, poll, or attempt to close the terminal yourself. If it reuses you, it re-engages you with a fresh preamble + TASK block delivered as new terminal input.\n- For long tasks, send heartbeat/status only when the preamble asks for it, including both IDs:\n  `orca orchestration send --type heartbeat --subject \"alive\" --payload '{\"taskId\":\"<task_id>\",\"dispatchId\":\"<dispatch_id>\",\"phase\":\"implementing\"}' --json`\n- If blocked before completion, use `ask`; use `escalation` only when ownership is valid and the coordinator must intervene.\n- Treat preambles inherited through terminal history or full handoffs as stale unless the current prompt explicitly keeps that coordinator in the loop.\n- Coordinators must account for every settled worker terminal before waiting again or ending the turn: immediately reuse the exact worker for a new Dispatch, explicitly retain it at the user's request with `worker-retain`, or run `worker-release`. Do not leave a completed worker live merely to inspect output; released workers remain readable through `worker-read`.\n- Coordinators should use `task-list --ready` as external memory, dispatch parallel waves, and avoid dependency chains deeper than 3-4 steps.\n\n## Example\n\n```bash\norca terminal create --worktree active --title login-css-worker --command \"claude\" --json\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms 60000 --json\norca orchestration task-create --spec \"Fix the login button CSS\" --json\norca orchestration dispatch --task <task_id> --to <handle> --inject --json\norca orchestration check --wait --types worker_done,escalation,question --timeout-ms 900000 --json\n```\n\n## Next Action\n\nCoordinator: confirm `orca status --json`, create or bind a Run, inspect `task-list`/`dispatch-show` if inheriting state, then use the explicit supervised loop (`task-create` -> `worker-start` -> `check --wait`). Use low-level terminal creation plus `dispatch --inject` only when the composed start does not express the needed topology. After every accepted `worker_done`, either transfer the exact terminal to an immediate follow-up Dispatch or run `worker-release` before the next wait.\n\nWorker: if the current prompt contains a live dispatch preamble, do the task, use `ask` for blocking questions, and send `worker_done` once with the required payload. If the preamble is stale or absent, do not send lifecycle messages; inspect state or treat the prompt as an ordinary handoff.\n"
 
 // Why: no current guide has bundled reference documents, so --full is byte-identical for now.
 // oxfmt-ignore
diff --git a/src/cli/handlers/orchestration-worker-cli.test.ts b/src/cli/handlers/orchestration-worker-cli.test.ts
index 95a0a7db313..a2777ec3fdb 100644
--- a/src/cli/handlers/orchestration-worker-cli.test.ts
+++ b/src/cli/handlers/orchestration-worker-cli.test.ts
@@ -8,6 +8,7 @@ vi.mock('../selectors', () => ({ getTerminalHandle: vi.fn() }))
 
 import { ORCHESTRATION_HANDLERS } from './orchestration'
 import { printResult } from '../format'
+import { ORCHESTRATION_WORKER_LAUNCH_PREFERENCES_RUNTIME_CAPABILITY } from '../../shared/protocol-version'
 
 describe('orchestration worker-start CLI contract', () => {
   beforeEach(() => {
@@ -84,6 +85,63 @@ describe('orchestration worker-start CLI contract', () => {
     expect(process.exitCode).toBeUndefined()
   })
 
+  it('capability-gates and forwards per-invocation launch preferences', async () => {
+    callMock
+      .mockResolvedValueOnce({
+        result: {
+          capabilities: [ORCHESTRATION_WORKER_LAUNCH_PREFERENCES_RUNTIME_CAPABILITY]
+        }
+      })
+      .mockResolvedValueOnce({
+        result: {
+          runId: 'run_1',
+          taskId: 'task_1',
+          dispatchId: 'ctx_1',
+          state: 'ready',
+          effects: [],
+          residualResources: []
+        }
+      })
+
+    await invokeWorkerStart(
+      new Map<string, string | boolean>([
+        ['task', 'task_1'],
+        ['agent', 'claude'],
+        ['model', 'aws-bedrock-opus-5'],
+        ['effort', 'high'],
+        ['from', 'term_coord']
+      ])
+    )
+
+    expect(callMock).toHaveBeenNthCalledWith(1, 'status.get')
+    expect(callMock).toHaveBeenNthCalledWith(
+      2,
+      'orchestration.workerStart',
+      expect.objectContaining({
+        agent: 'claude',
+        model: 'aws-bedrock-opus-5',
+        effort: 'high'
+      })
+    )
+  })
+
+  it('fails before worker-start when the runtime would strip launch preferences', async () => {
+    callMock.mockResolvedValueOnce({ result: { capabilities: [] } })
+
+    await expect(
+      invokeWorkerStart(
+        new Map<string, string | boolean>([
+          ['task', 'task_1'],
+          ['agent', 'codex'],
+          ['model', 'gpt-5.6-sol'],
+          ['from', 'term_coord']
+        ])
+      )
+    ).rejects.toMatchObject({ code: 'incompatible_runtime' })
+
+    expect(callMock).toHaveBeenCalledTimes(1)
+  })
+
   it('sets an unsuccessful exit code for failed and unknown receipts', async () => {
     callMock.mockResolvedValue({
       result: {
diff --git a/src/cli/handlers/orchestration.ts b/src/cli/handlers/orchestration.ts
index f9cbdb8a41a..6668b4e1906 100644
--- a/src/cli/handlers/orchestration.ts
+++ b/src/cli/handlers/orchestration.ts
@@ -20,7 +20,8 @@ import type {
   OrchestrationWorkerReadSource
 } from '../../shared/orchestration-worker-output'
 import type { NativeChatMessage } from '../../shared/native-chat-types'
-import type { RuntimeTerminalRead } from '../../shared/runtime-types'
+import type { RuntimeStatus, RuntimeTerminalRead } from '../../shared/runtime-types'
+import { ORCHESTRATION_WORKER_LAUNCH_PREFERENCES_RUNTIME_CAPABILITY } from '../../shared/protocol-version'
 import { orchestrationMigrationData } from '../../shared/orchestration-rpc-contract'
 import { ORCHESTRATION_RUN_PAGE_LIMIT } from '../../shared/orchestration-run-pagination'
 import {
@@ -852,6 +853,21 @@ export const ORCHESTRATION_HANDLERS: Record<string, CommandHandler> = {
   },
 
   'orchestration worker-start': async ({ flags, client, cwd, json }) => {
+    const model = getOptionalStringFlag(flags, 'model')
+    const effort = getOptionalStringFlag(flags, 'effort')
+    if (model || effort) {
+      const status = await client.call<RuntimeStatus>('status.get')
+      if (
+        !status.result.capabilities?.includes(
+          ORCHESTRATION_WORKER_LAUNCH_PREFERENCES_RUNTIME_CAPABILITY
+        )
+      ) {
+        throw new RuntimeClientError(
+          'incompatible_runtime',
+          'The connected Orca runtime does not support worker model or effort overrides. Update or restart Orca and try again.'
+        )
+      }
+    }
     const result = await callMutation<{
       runId: string
       taskId: string
@@ -873,6 +889,8 @@ export const ORCHESTRATION_HANDLERS: Record<string, CommandHandler> = {
       comment: getOptionalStringFlag(flags, 'comment'),
       setup: getOptionalStringFlag(flags, 'setup'),
       agent: getOptionalStringFlag(flags, 'agent'),
+      model,
+      effort,
       terminal: getOptionalStringFlag(flags, 'terminal'),
       retryOf: getOptionalStringFlag(flags, 'retry-of'),
       timeoutMs: getOptionalPositiveIntegerValueFlag(flags, 'timeout-ms'),
diff --git a/src/cli/help.ts b/src/cli/help.ts
index e866a91ef22..3415ddad832 100644
--- a/src/cli/help.ts
+++ b/src/cli/help.ts
@@ -552,6 +552,8 @@ export function formatFlagHelp(flag: string): string {
     local: '--local                Target the current project instead of the global install',
     skill: '--skill <name>         Bundled skill to act on; repeat for several',
     mode: '--mode <mode>          Mode such as edit, diff, or both',
+    model: '--model <id>          Provider model id for a new agent launch',
+    effort: '--effort <level>      Reasoning effort for the selected model',
     'mouse-button': '--mouse-button <btn>   Mouse button: left, right, or middle',
     modifiers: '--modifiers <chord>  Modifier keys held only for this click',
     name: '--name <name>          Name for the new worktree or automation',
diff --git a/src/cli/runtime/websocket-transport.test.ts b/src/cli/runtime/websocket-transport.test.ts
index 2764a239021..7cba4d1cdc1 100644
--- a/src/cli/runtime/websocket-transport.test.ts
+++ b/src/cli/runtime/websocket-transport.test.ts
@@ -17,6 +17,7 @@ import { launchOrcaApp } from './launch'
 import { addEnvironmentFromPairingCode } from './environments'
 import { RuntimeClientError } from './types'
 import {
+  AGENT_SESSION_BOUNDARY_RUNTIME_CAPABILITY,
   MIN_COMPATIBLE_RUNTIME_CLIENT_VERSION,
   RUNTIME_PROTOCOL_VERSION,
   SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY
@@ -61,7 +62,10 @@ describe('CLI remote WebSocket transport', () => {
     expect(response.result.runtimeId).toBe('runtime-ws-1')
     expect(runtime.authFrames).toContainEqual(
       expect.objectContaining({
-        clientCapabilities: [SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY]
+        clientCapabilities: [
+          SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY,
+          AGENT_SESSION_BOUNDARY_RUNTIME_CAPABILITY
+        ]
       })
     )
   })
diff --git a/src/cli/specs/orchestration-worker-specs.ts b/src/cli/specs/orchestration-worker-specs.ts
index a8d8b2411f5..b7f6b583a73 100644
--- a/src/cli/specs/orchestration-worker-specs.ts
+++ b/src/cli/specs/orchestration-worker-specs.ts
@@ -5,7 +5,7 @@ export const ORCHESTRATION_WORKER_COMMAND_SPECS: CommandSpec[] = [
     path: ['orchestration', 'worker-start'],
     summary: 'Start one supervised worker on the Run home or a connected Orca server',
     usage:
-      'orca orchestration worker-start --task <task_id> [--on <saved-environment>] [--worktree <current|selector|new-child|new-top-level>] (--agent <agent> | --terminal <handle>) [--name <name>] [--repo <selector>] [--base-branch <ref>] [--display-name <text>] [--comment <text>] [--setup <run|skip|inherit>] [--retry-of <dispatch_id>] [--timeout-ms <n>] [--run <run_id>] [--from <handle>] [--retry-request <id>] [--json]',
+      'orca orchestration worker-start --task <task_id> [--on <saved-environment>] [--worktree <current|selector|new-child|new-top-level>] (--agent <agent> | --terminal <handle>) [--model <id>] [--effort <level>] [--name <name>] [--repo <selector>] [--base-branch <ref>] [--display-name <text>] [--comment <text>] [--setup <run|skip|inherit>] [--retry-of <dispatch_id>] [--timeout-ms <n>] [--run <run_id>] [--from <handle>] [--retry-request <id>] [--json]',
     allowedFlags: [
       ...GLOBAL_FLAGS,
       'task',
@@ -18,6 +18,8 @@ export const ORCHESTRATION_WORKER_COMMAND_SPECS: CommandSpec[] = [
       'comment',
       'setup',
       'agent',
+      'model',
+      'effort',
       'terminal',
       'retry-of',
       'timeout-ms',
@@ -27,6 +29,7 @@ export const ORCHESTRATION_WORKER_COMMAND_SPECS: CommandSpec[] = [
     ],
     notes: [
       'Current and existing worktrees never rerun setup; a fresh agent terminal is created unless --terminal is explicit.',
+      '--model supports Claude, Codex, and Cursor opaque provider model ids; --effort requires --model. Neither can combine with --terminal.',
       'New worktrees use agent-first creation and default --setup to run. Repository start-immediately runs setup beside the agent; wait-for-setup gates agent readiness and task input.',
       'Creation flags (--name, --repo, --base-branch, --display-name, --comment, --setup) are rejected for current/existing worktrees. Use exact --repo on the selected server; project/host convenience routing remains on worktree create.',
       '--on selects only the worker server; the Run and this command remain on the current Orca server.',
diff --git a/src/main/agent-hooks/server.test.ts b/src/main/agent-hooks/server.test.ts
index 96bb121c7e7..c1870d35a7c 100644
--- a/src/main/agent-hooks/server.test.ts
+++ b/src/main/agent-hooks/server.test.ts
@@ -2257,6 +2257,36 @@ describe('AgentHookServer listener replay', () => {
     }
   })
 
+  it('accepts a resumed-session SessionStart after launch authority retires in a reusable pane', async () => {
+    const server = new AgentHookServer()
+    await server.start({ env: 'production' })
+    try {
+      const env = server.buildPtyEnv()
+      const postHook = (payload: Record<string, unknown>): Promise<Response> =>
+        fetch(`http://127.0.0.1:${env.ORCA_AGENT_HOOK_PORT}/hook/claude`, {
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/json',
+            'X-Orca-Agent-Hook-Token': env.ORCA_AGENT_HOOK_TOKEN
+          },
+          body: JSON.stringify(buildBody(payload, { launchToken: 'retired-launch-token' }))
+        })
+
+      await postHook({ hook_event_name: 'UserPromptSubmit', prompt: 'first launch' })
+      server.retirePaneAuthority(PANE)
+
+      // Why: `claude --resume` in the reused shell pane emits only SessionStart while idle;
+      // without the un-retire the resumed session stays rowless until a prompt (STA-3386).
+      await postHook({ hook_event_name: 'SessionStart', source: 'resume' })
+
+      expect(server.getStatusSnapshot()).toEqual([
+        expect.objectContaining({ paneKey: PANE, state: 'done', sessionBoundary: true })
+      ])
+    } finally {
+      server.stop()
+    }
+  })
+
   it('accepts a live remote prompt but not replay after launch authority retires', () => {
     const server = new AgentHookServer()
     server.ingestRemote(
diff --git a/src/main/agent-hooks/server.ts b/src/main/agent-hooks/server.ts
index 0f9e0a7812d..013b90d7143 100644
--- a/src/main/agent-hooks/server.ts
+++ b/src/main/agent-hooks/server.ts
@@ -415,7 +415,10 @@ function equivalentParsedAgentStatusPayload(
     a.toolInput === b.toolInput &&
     a.interactivePrompt === b.interactivePrompt &&
     a.lastAssistantMessage === b.lastAssistantMessage &&
-    a.interrupted === b.interrupted
+    a.interrupted === b.interrupted &&
+    // Why: a session-boundary done must never be deduped against a cached real done —
+    // the flag has to reach receivers deterministically (STA-3386).
+    a.sessionBoundary === b.sessionBoundary
   )
 }
 
@@ -996,7 +999,12 @@ export class AgentHookServer {
       return 'accept'
     }
     // Why: command completion retires launch authority but leaves its shell pane reusable.
-    if (event?.hookEventName === 'UserPromptSubmit' && event.isReplay !== true) {
+    // A live SessionStart proves a new agent process owns the retired pane just like a
+    // fresh prompt does — without it, a session resumed in a reused pane stays rowless (STA-3386).
+    if (
+      (event?.hookEventName === 'UserPromptSubmit' || event?.hookEventName === 'SessionStart') &&
+      event.isReplay !== true
+    ) {
       this.closedAgentStatusPaneKeys.delete(paneKey)
       this.closedAgentStatusPaneKeys.delete(ownerPaneKey)
       return 'restart'
diff --git a/src/main/claude/hook-service.test.ts b/src/main/claude/hook-service.test.ts
index cd31d5577f5..0d390c3a9e3 100644
--- a/src/main/claude/hook-service.test.ts
+++ b/src/main/claude/hook-service.test.ts
@@ -378,6 +378,9 @@ describe('ClaudeHookService.installRemote', () => {
     // Code rejects unknown shapes silently and the agent-hooks pipeline
     // goes dark.
     for (const event of [
+      // Why: SessionStart is the only signal a resumed/idle session ever emits;
+      // without it the sidebar row waits for the first prompt (STA-3386).
+      'SessionStart',
       'UserPromptSubmit',
       'Stop',
       'StopFailure',
diff --git a/src/main/claude/hook-settings.ts b/src/main/claude/hook-settings.ts
index b13c98ed6a9..de932276545 100644
--- a/src/main/claude/hook-settings.ts
+++ b/src/main/claude/hook-settings.ts
@@ -28,6 +28,9 @@ export const OPENCLAUDE_HOOK_SETTINGS: ClaudeCompatibleHookSettings = {
 }
 
 export const CLAUDE_EVENTS = [
+  // Why: SessionStart is the only event a resumed/idle session emits before the
+  // first prompt; without it the sidebar row can't exist until the user types (STA-3386).
+  { eventName: 'SessionStart', definition: { hooks: [{ type: 'command', command: '' }] } },
   { eventName: 'UserPromptSubmit', definition: { hooks: [{ type: 'command', command: '' }] } },
   { eventName: 'Stop', definition: { hooks: [{ type: 'command', command: '' }] } },
   // Why: OpenClaude skips normal Stop hooks after API/model errors and emits
diff --git a/src/main/daemon/client.test.ts b/src/main/daemon/client.test.ts
index 22e02965e0d..47b77cfb78e 100644
--- a/src/main/daemon/client.test.ts
+++ b/src/main/daemon/client.test.ts
@@ -73,6 +73,9 @@ describe('DaemonClient', () => {
       pid: number
       startedAtMs: number
       launchNonce: string
+      entryPath?: string
+      appVersion?: string
+      spawnerExecPath?: string
     }
   }): Promise<void> {
     return new Promise((resolve) => {
@@ -155,7 +158,14 @@ describe('DaemonClient', () => {
     })
 
     it('captures one matching endpoint identity from both authenticated sockets', async () => {
-      const identity = { pid: 123, startedAtMs: 456, launchNonce: 'launch-a' }
+      const identity = {
+        pid: 123,
+        startedAtMs: 456,
+        launchNonce: 'launch-a',
+        entryPath: '/Applications/Orca.app/Contents/Resources/daemon-entry.js',
+        appVersion: '1.2.3',
+        spawnerExecPath: '/Applications/Orca.app/Contents/MacOS/Orca'
+      }
       await startMockDaemon({ helloIdentity: () => identity })
 
       client = new DaemonClient({ socketPath, tokenPath })
diff --git a/src/main/daemon/client.ts b/src/main/daemon/client.ts
index b6229521c8b..d137ee84ea5 100644
--- a/src/main/daemon/client.ts
+++ b/src/main/daemon/client.ts
@@ -18,6 +18,7 @@ import type {
   DaemonEvent
 } from './types'
 import { addNodePtyRecoveryHint } from './node-pty-error-hints'
+import { decodeDaemonResponseError } from './daemon-errors'
 
 const CONNECT_TIMEOUT_MS = 5000
 const CONNECTION_ATTEMPT_WAIT_MS = CONNECT_TIMEOUT_MS * 4
@@ -429,7 +430,12 @@ export class DaemonClient {
             if (response.ok) {
               pending.resolve(response.payload)
             } else {
-              pending.reject(new DaemonProtocolError(addNodePtyRecoveryHint(response.error)))
+              const decoded = decodeDaemonResponseError(response.error)
+              pending.reject(
+                decoded instanceof DaemonProtocolError
+                  ? new DaemonProtocolError(addNodePtyRecoveryHint(response.error))
+                  : decoded
+              )
             }
           }
         }
@@ -503,7 +509,14 @@ function parseDaemonEndpointIdentity(value: unknown): DaemonEndpointIdentity | n
   if (!value || typeof value !== 'object') {
     return null
   }
-  const identity = value as { pid?: unknown; startedAtMs?: unknown; launchNonce?: unknown }
+  const identity = value as {
+    pid?: unknown
+    startedAtMs?: unknown
+    launchNonce?: unknown
+    entryPath?: unknown
+    appVersion?: unknown
+    spawnerExecPath?: unknown
+  }
   if (
     !Number.isSafeInteger(identity.pid) ||
     (identity.pid as number) <= 0 ||
@@ -518,7 +531,16 @@ function parseDaemonEndpointIdentity(value: unknown): DaemonEndpointIdentity | n
   return {
     pid: identity.pid as number,
     startedAtMs: identity.startedAtMs,
-    launchNonce: identity.launchNonce
+    launchNonce: identity.launchNonce,
+    ...(typeof identity.entryPath === 'string' && identity.entryPath.length > 0
+      ? { entryPath: identity.entryPath }
+      : {}),
+    ...(typeof identity.appVersion === 'string' && identity.appVersion.length > 0
+      ? { appVersion: identity.appVersion }
+      : {}),
+    ...(typeof identity.spawnerExecPath === 'string' && identity.spawnerExecPath.length > 0
+      ? { spawnerExecPath: identity.spawnerExecPath }
+      : {})
   }
 }
 
diff --git a/src/main/daemon/daemon-endpoint-ownership.test.ts b/src/main/daemon/daemon-endpoint-ownership.test.ts
new file mode 100644
index 00000000000..8f4e4b82f55
--- /dev/null
+++ b/src/main/daemon/daemon-endpoint-ownership.test.ts
@@ -0,0 +1,271 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  existsSync,
+  linkSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  unlinkSync,
+  writeFileSync
+} from 'node:fs'
+import { connect, createServer } from 'node:net'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { DaemonServer } from './daemon-server'
+import { getDaemonSocketPath, publishDaemonPidFile } from './daemon-spawner'
+import { readDaemonSocketIdentity } from './daemon-endpoint-ownership'
+import type { SubprocessHandle } from './session'
+
+function connectsTo(socketPath: string): Promise<boolean> {
+  return new Promise((resolve) => {
+    const socket = connect({ path: socketPath })
+    socket.on('connect', () => {
+      socket.destroy()
+      resolve(true)
+    })
+    socket.on('error', () => resolve(false))
+  })
+}
+
+function createMockSubprocess(): SubprocessHandle {
+  return {
+    pid: 55555,
+    getForegroundProcess: () => null,
+    write() {},
+    resize() {},
+    kill() {},
+    forceKill() {},
+    signal() {},
+    onData() {},
+    onExit() {},
+    dispose() {}
+  }
+}
+
+describe('daemon endpoint ownership publication', () => {
+  let dir: string
+  let socketPath: string
+  let tokenPath: string
+  let server: DaemonServer
+
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), 'daemon-endpoint-ownership-'))
+    socketPath = getDaemonSocketPath(dir)
+    tokenPath = join(dir, 'daemon.token')
+  })
+
+  afterEach(async () => {
+    await server?.shutdown()
+    rmSync(dir, { recursive: true, force: true })
+  })
+
+  it('does not publish an adoptable endpoint before durable ownership succeeds', async () => {
+    writeFileSync(tokenPath, 'previous-token')
+    const publishEndpointOwnership = vi.fn(() => {
+      expect(readFileSync(tokenPath, 'utf8')).toBe('previous-token')
+      throw Object.assign(new Error('PID record already owned'), {
+        code: 'EEXIST'
+      })
+    })
+    server = new DaemonServer({
+      socketPath,
+      tokenPath,
+      publishEndpointOwnership,
+      spawnSubprocess: () => createMockSubprocess()
+    })
+
+    await expect(server.start()).rejects.toThrow('PID record already owned')
+
+    expect(publishEndpointOwnership).toHaveBeenCalledOnce()
+    expect(readFileSync(tokenPath, 'utf8')).toBe('previous-token')
+    if (process.platform !== 'win32') {
+      expect(existsSync(socketPath)).toBe(false)
+    }
+  })
+
+  it('rolls back exact PID ownership when token publication fails', async () => {
+    const pidPath = join(dir, 'daemon.pid')
+    const launchNonce = 'failed-launch'
+    mkdirSync(tokenPath)
+    server = new DaemonServer({
+      socketPath,
+      tokenPath,
+      pidPath,
+      launchNonce,
+      publishEndpointOwnership: () =>
+        publishDaemonPidFile(pidPath, {
+          pid: process.pid,
+          startedAtMs: 1_000,
+          launchNonce
+        }),
+      spawnSubprocess: () => createMockSubprocess()
+    })
+
+    await expect(server.start()).rejects.toMatchObject({ code: 'EISDIR' })
+
+    expect(existsSync(pidPath)).toBe(false)
+    expect(existsSync(tokenPath)).toBe(true)
+  })
+
+  it.skipIf(process.platform === 'win32')(
+    'keeps a replacement endpoint when the daemon it replaced closes late',
+    async () => {
+      // Why: this is the split-brain mechanism. libuv unlinks the pathname a server bound to
+      // when that server closes, with no ownership check — so a daemon exiting late used to
+      // delete whichever socket then sat at the canonical path. The replacement stayed alive
+      // hosting PTYs that no client could reach, which is what "terminals ack but never run"
+      // looked like from the user's seat.
+      const replacedPidPath = join(dir, 'replaced.pid')
+      const replaced = new DaemonServer({
+        socketPath,
+        tokenPath,
+        pidPath: replacedPidPath,
+        launchNonce: 'replaced-daemon',
+        publishEndpointOwnership: () =>
+          publishDaemonPidFile(replacedPidPath, {
+            pid: process.pid,
+            startedAtMs: 1_000,
+            launchNonce: 'replaced-daemon'
+          }),
+        spawnSubprocess: () => createMockSubprocess()
+      })
+      await replaced.start()
+
+      // A replacement reclaims the endpoint the way killStaleDaemon does.
+      unlinkSync(socketPath)
+      const pidPath = join(dir, 'replacement.pid')
+      server = new DaemonServer({
+        socketPath,
+        tokenPath,
+        pidPath,
+        launchNonce: 'replacement-daemon',
+        publishEndpointOwnership: () =>
+          publishDaemonPidFile(pidPath, {
+            pid: process.pid,
+            startedAtMs: 2_000,
+            launchNonce: 'replacement-daemon'
+          }),
+        spawnSubprocess: () => createMockSubprocess()
+      })
+      await server.start()
+      const replacementIdentity = readDaemonSocketIdentity(socketPath)
+
+      // The daemon that lost the endpoint now exits, long after the handover.
+      await replaced.shutdown()
+
+      expect(existsSync(socketPath)).toBe(true)
+      expect(readDaemonSocketIdentity(socketPath)).toEqual(replacementIdentity)
+      // The replacement is still reachable through the canonical name.
+      await expect(connectsTo(socketPath)).resolves.toBe(true)
+      // The late exit also must not remove the replacement's ownership record.
+      expect(existsSync(pidPath)).toBe(true)
+    }
+  )
+
+  it.skipIf(process.platform === 'win32')(
+    'retires a daemon whose endpoint was taken over by another daemon',
+    async () => {
+      const pidPath = join(dir, 'daemon.pid')
+      server = new DaemonServer({
+        socketPath,
+        tokenPath,
+        pidPath,
+        launchNonce: 'original-daemon',
+        publishEndpointOwnership: () =>
+          publishDaemonPidFile(pidPath, {
+            pid: process.pid,
+            startedAtMs: 1_000,
+            launchNonce: 'original-daemon'
+          }),
+        spawnSubprocess: () => createMockSubprocess()
+      })
+      await server.start()
+
+      const daemon = server as unknown as {
+        checkEndpointOwnership: () => void
+        retirementRequested: boolean
+      }
+      // An inconclusive or matching probe must never retire a healthy daemon, however often it runs.
+      daemon.checkEndpointOwnership()
+      daemon.checkEndpointOwnership()
+      expect(daemon.retirementRequested).toBe(false)
+
+      // Another daemon takes the endpoint name.
+      unlinkSync(socketPath)
+      const usurper = createServer()
+      const usurperBind = join(dir, '.usurper')
+      await new Promise<void>((resolve) => usurper.listen(usurperBind, resolve))
+      linkSync(usurperBind, socketPath)
+      unlinkSync(usurperBind)
+
+      try {
+        // A single observation can land inside a replacement's unlink-then-link gap, so the
+        // first one must not retire anything.
+        daemon.checkEndpointOwnership()
+        expect(daemon.retirementRequested).toBe(false)
+
+        daemon.checkEndpointOwnership()
+        // Why: retirement drains rather than kills — an orphaned daemon stops being a
+        // permanent unreachable host without tearing live sessions out from under the user.
+        expect(daemon.retirementRequested).toBe(true)
+      } finally {
+        await new Promise<void>((resolve) => usurper.close(() => resolve()))
+        try {
+          unlinkSync(socketPath)
+        } catch {
+          // Already gone.
+        }
+      }
+    }
+  )
+
+  it.skipIf(process.platform === 'win32')(
+    'refuses a second listener when a live daemon socket path was removed',
+    async () => {
+      const pidPath = join(dir, 'daemon.pid')
+      server = new DaemonServer({
+        socketPath,
+        tokenPath,
+        pidPath,
+        launchNonce: 'first-launch',
+        publishEndpointOwnership: () =>
+          publishDaemonPidFile(pidPath, {
+            pid: process.pid,
+            startedAtMs: 1_000,
+            launchNonce: 'first-launch'
+          }),
+        spawnSubprocess: () => createMockSubprocess()
+      })
+      await server.start()
+      const firstToken = readFileSync(tokenPath, 'utf8')
+      unlinkSync(socketPath)
+
+      const duplicate = new DaemonServer({
+        socketPath,
+        tokenPath,
+        pidPath,
+        launchNonce: 'second-launch',
+        publishEndpointOwnership: () =>
+          publishDaemonPidFile(pidPath, {
+            pid: process.pid,
+            startedAtMs: 2_000,
+            launchNonce: 'second-launch'
+          }),
+        spawnSubprocess: () => createMockSubprocess()
+      })
+      try {
+        await expect(duplicate.start()).rejects.toMatchObject({
+          code: 'EEXIST'
+        })
+        expect(readFileSync(tokenPath, 'utf8')).toBe(firstToken)
+        expect(JSON.parse(readFileSync(pidPath, 'utf8'))).toMatchObject({
+          startedAtMs: 1_000,
+          launchNonce: 'first-launch'
+        })
+      } finally {
+        await duplicate.shutdown()
+      }
+    }
+  )
+})
diff --git a/src/main/daemon/daemon-endpoint-ownership.ts b/src/main/daemon/daemon-endpoint-ownership.ts
new file mode 100644
index 00000000000..31e22844793
--- /dev/null
+++ b/src/main/daemon/daemon-endpoint-ownership.ts
@@ -0,0 +1,169 @@
+/* Ownership of the daemon's canonical endpoint name and of the scratch entries the
+   rename-claim protocol leaves behind. Kept apart from daemon-spawner so the rule that
+   decides who may serve on the socket path is readable on its own. */
+import { randomBytes } from 'node:crypto'
+import { existsSync, linkSync, readdirSync, renameSync, statSync, unlinkSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+
+/** The exact directory entry a daemon owns. Compared before any endpoint removal. */
+export type DaemonSocketIdentity = { dev: bigint; ino: bigint }
+
+/**
+ * A private, same-directory name to bind before publishing the canonical endpoint.
+ *
+ * Why: `sockaddr_un.sun_path` caps a Unix socket path at ~104 bytes, so this must not extend
+ * the canonical path — it replaces the basename with a shorter one, which keeps the bind name
+ * strictly shorter than the endpoint the caller already requires to fit.
+ */
+export function getDaemonSocketBindPath(socketPath: string): string {
+  return join(dirname(socketPath), `.b${randomBytes(5).toString('hex')}`)
+}
+
+/**
+ * Publishes a bound listener under the canonical endpoint name.
+ *
+ * Why: Node/libuv unlinks the pathname a server bound to when that server closes,
+ * with no ownership check — a daemon exiting late therefore deletes whichever socket
+ * currently sits at that path, including a live replacement's. Binding a unique path
+ * and hard-linking it into place instead means libuv only ever unlinks the private
+ * bind name, and the exclusive link doubles as the kernel-enforced endpoint claim.
+ */
+export function publishDaemonSocketPath(
+  boundPath: string,
+  canonicalPath: string
+): DaemonSocketIdentity | null {
+  if (process.platform === 'win32') {
+    // Named pipes are not directory entries; the pipe name itself is exclusive.
+    return null
+  }
+  // Why: stat the bound name first — the link shares the inode, so a racing unlink of the
+  // canonical name cannot erase our identity and leave the endpoint unwatched and uncleanable.
+  const identity = readDaemonSocketIdentity(boundPath)
+  try {
+    linkSync(boundPath, canonicalPath)
+  } catch (error) {
+    if (isFileExistsError(error)) {
+      throw error
+    }
+    // Why: a filesystem without hard links must not stop the daemon from starting. Rename
+    // still moves the bind name out from under libuv, which preserves the property that
+    // matters most — a late close cannot delete a replacement's endpoint. Exclusivity
+    // degrades to check-then-act here, which is no weaker than binding the path directly.
+    if (existsSync(canonicalPath)) {
+      throw error
+    }
+    renameSync(boundPath, canonicalPath)
+    return identity
+  }
+  try {
+    unlinkSync(boundPath)
+  } catch {
+    // Inert: clients resolve the canonical link, and the bind name is unique to us.
+  }
+  return identity
+}
+
+function isFileExistsError(error: unknown): boolean {
+  return typeof error === 'object' && error !== null && 'code' in error && error.code === 'EEXIST'
+}
+
+export function readDaemonSocketIdentity(socketPath: string): DaemonSocketIdentity | null {
+  if (process.platform === 'win32') {
+    return null
+  }
+  try {
+    const stats = statSync(socketPath, { bigint: true })
+    return { dev: stats.dev, ino: stats.ino }
+  } catch {
+    return null
+  }
+}
+
+export function daemonSocketIdentityMatches(
+  a: DaemonSocketIdentity | null,
+  b: DaemonSocketIdentity | null
+): boolean {
+  return a !== null && b !== null && a.dev === b.dev && a.ino === b.ino
+}
+
+/** 'indeterminate' is deliberately distinct from 'lost': only positive evidence may retire a daemon. */
+export type DaemonEndpointOwnershipState = 'owned' | 'lost' | 'indeterminate'
+
+export function readDaemonEndpointOwnershipState(
+  socketPath: string,
+  owned: DaemonSocketIdentity | null
+): DaemonEndpointOwnershipState {
+  if (process.platform === 'win32' || !owned) {
+    return 'indeterminate'
+  }
+  try {
+    const stats = statSync(socketPath, { bigint: true })
+    return stats.dev === owned.dev && stats.ino === owned.ino ? 'owned' : 'lost'
+  } catch (error) {
+    // Why: a stat that failed for any reason other than "the entry is gone" proves nothing.
+    // Treating EACCES or EIO as lost ownership would retire a perfectly healthy daemon.
+    return isMissingFileError(error) ? 'lost' : 'indeterminate'
+  }
+}
+
+function isMissingFileError(error: unknown): boolean {
+  return typeof error === 'object' && error !== null && 'code' in error && error.code === 'ENOENT'
+}
+
+/** Removes the canonical endpoint name only while it still resolves to our own listener. */
+export function unlinkOwnedDaemonSocketPath(
+  socketPath: string,
+  owned: DaemonSocketIdentity | null
+): boolean {
+  if (process.platform === 'win32' || !owned) {
+    return false
+  }
+  if (!daemonSocketIdentityMatches(readDaemonSocketIdentity(socketPath), owned)) {
+    return false
+  }
+  try {
+    unlinkSync(socketPath)
+    return true
+  } catch {
+    return false
+  }
+}
+
+const ABANDONED_DAEMON_CLAIM_PATTERN =
+  /(?:\.(?:cleanup|replace)-\d+-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|^\.b[0-9a-f]{10})$/
+
+const ABANDONED_DAEMON_CLAIM_MIN_AGE_MS = 60 * 60 * 1000
+
+/**
+ * Reclaims claim/bind scratch names left behind when a rename-claim or bind publish
+ * could not remove its own temporary entry. Age-gated so a claim in flight is never touched.
+ */
+export function sweepAbandonedDaemonClaims(
+  runtimeDir: string,
+  minAgeMs = ABANDONED_DAEMON_CLAIM_MIN_AGE_MS,
+  now = Date.now()
+): number {
+  let swept = 0
+  let entries: string[]
+  try {
+    entries = readdirSync(runtimeDir)
+  } catch {
+    return 0
+  }
+  for (const entry of entries) {
+    if (!ABANDONED_DAEMON_CLAIM_PATTERN.test(entry)) {
+      continue
+    }
+    const claimPath = join(runtimeDir, entry)
+    try {
+      if (now - statSync(claimPath).mtimeMs < minAgeMs) {
+        continue
+      }
+      unlinkSync(claimPath)
+      swept++
+    } catch {
+      // Best-effort; a locked or already-removed claim is retried on a future launch.
+    }
+  }
+  return swept
+}
diff --git a/src/main/daemon/daemon-entry.test.ts b/src/main/daemon/daemon-entry.test.ts
index 6b02210d72a..ca0dc1131f7 100644
--- a/src/main/daemon/daemon-entry.test.ts
+++ b/src/main/daemon/daemon-entry.test.ts
@@ -71,6 +71,33 @@ describe('daemon-entry parseArgs', () => {
     })
   })
 
+  it('parses PID publication metadata from the launcher', () => {
+    expect(
+      parseArgs([
+        '--socket',
+        '/tmp/t.sock',
+        '--token',
+        '/tmp/t.token',
+        '--pid-record',
+        '/tmp/t.pid',
+        '--launch-nonce',
+        'launch-a',
+        '--entry-path',
+        '/app/daemon-entry.js',
+        '--app-version',
+        '1.2.3',
+        '--spawner-exec-path',
+        '/Applications/Orca.app/Contents/MacOS/Orca'
+      ])
+    ).toMatchObject({
+      pidPath: '/tmp/t.pid',
+      launchNonce: 'launch-a',
+      entryPath: '/app/daemon-entry.js',
+      appVersion: '1.2.3',
+      spawnerExecPath: '/Applications/Orca.app/Contents/MacOS/Orca'
+    })
+  })
+
   it('rejects either PID-record ownership argument without its pair', () => {
     expect(() =>
       parseArgs([
diff --git a/src/main/daemon/daemon-entry.ts b/src/main/daemon/daemon-entry.ts
index d7655758b67..9ad6b1564dd 100644
--- a/src/main/daemon/daemon-entry.ts
+++ b/src/main/daemon/daemon-entry.ts
@@ -20,12 +20,16 @@ import {
 import { MacosLoginSessionDeathWatch } from './macos-login-session-death-watch'
 import { readCurrentProcessMacSystemResolverHealth } from '../network/macos-system-resolver-health'
 import { readCurrentDaemonReadyIdentity } from './daemon-ready-identity'
+import { publishDaemonPidFile } from './daemon-spawner'
 
 export type ParsedDaemonArgs = {
   socketPath: string
   tokenPath: string
   pidPath?: string
   launchNonce?: string
+  entryPath?: string
+  appVersion?: string
+  spawnerExecPath?: string
   /** GUI-spawned daemons only — headless serve/SSH daemons must survive session loss. */
   loginSessionWatch?: boolean
   /** Optional — absent for adopted old daemons and tests, which log nothing. */
@@ -38,6 +42,9 @@ export function parseArgs(argv: string[]): ParsedDaemonArgs {
   let logFilePath = ''
   let pidPath = ''
   let launchNonce = ''
+  let entryPath = ''
+  let appVersion = ''
+  let spawnerExecPath = ''
   let loginSessionWatch = false
 
   for (let i = 0; i < argv.length; i++) {
@@ -56,6 +63,15 @@ export function parseArgs(argv: string[]): ParsedDaemonArgs {
     } else if (argv[i] === '--launch-nonce' && argv[i + 1]) {
       launchNonce = argv[i + 1]
       i++
+    } else if (argv[i] === '--entry-path' && argv[i + 1]) {
+      entryPath = argv[i + 1]
+      i++
+    } else if (argv[i] === '--app-version' && argv[i + 1]) {
+      appVersion = argv[i + 1]
+      i++
+    } else if (argv[i] === '--spawner-exec-path' && argv[i + 1]) {
+      spawnerExecPath = argv[i + 1]
+      i++
     } else if (argv[i] === '--login-session-watch') {
       loginSessionWatch = true
     }
@@ -73,6 +89,9 @@ export function parseArgs(argv: string[]): ParsedDaemonArgs {
     socketPath,
     tokenPath,
     ...(pidPath ? { pidPath, launchNonce } : {}),
+    ...(entryPath ? { entryPath } : {}),
+    ...(appVersion ? { appVersion } : {}),
+    ...(spawnerExecPath ? { spawnerExecPath } : {}),
     ...(loginSessionWatch ? { loginSessionWatch } : {}),
     ...(logFilePath ? { logFilePath } : {})
   }
@@ -86,10 +105,19 @@ async function main(): Promise<void> {
   // an otherwise healthy detached daemon. Swallow it: stderr is diagnostic only.
   process.stderr.on('error', () => {})
 
-  const { socketPath, tokenPath, pidPath, launchNonce, loginSessionWatch, logFilePath } = parseArgs(
-    process.argv.slice(2)
-  )
+  const {
+    socketPath,
+    tokenPath,
+    pidPath,
+    launchNonce,
+    entryPath,
+    appVersion,
+    spawnerExecPath,
+    loginSessionWatch,
+    logFilePath
+  } = parseArgs(process.argv.slice(2))
   const startedAtMs = Date.now() - process.uptime() * 1000
+  const readyIdentity = await readCurrentDaemonReadyIdentity(startedAtMs)
   // Fail-open: a broken log path must never block daemon startup.
   const daemonLog = logFilePath ? createDaemonFileLog(logFilePath) : createNoopDaemonFileLog()
   daemonLog.log('startup', { protocolVersion: PROTOCOL_VERSION, socketPath })
@@ -236,6 +264,22 @@ async function main(): Promise<void> {
     ...(pidPath ? { pidPath } : {}),
     ...(launchNonce ? { launchNonce } : {}),
     ...(pidPath ? { startedAtMs } : {}),
+    ...(entryPath ? { entryPath } : {}),
+    ...(appVersion ? { appVersion } : {}),
+    ...(spawnerExecPath ? { spawnerExecPath } : {}),
+    ...(pidPath && launchNonce
+      ? {
+          publishEndpointOwnership: () =>
+            publishDaemonPidFile(pidPath, {
+              pid: process.pid,
+              ...readyIdentity,
+              ...(entryPath ? { entryPath } : {}),
+              ...(appVersion ? { appVersion } : {}),
+              ...(spawnerExecPath ? { spawnerExecPath } : {}),
+              launchNonce
+            })
+        }
+      : {}),
     log: daemonLog,
     preparePtySpawn: runMacosLoginPreflight,
     ...(deathWatch
@@ -260,13 +304,18 @@ async function main(): Promise<void> {
       daemonLog.log('shutdown', { reason: 'idle' })
       daemonLog.close()
       process.exit(0)
+    },
+    onRpcShutdown: () => {
+      deathWatch?.stop()
+      shuttingDown = true
+      daemonLog.close()
+      process.exit(0)
     }
   })
   deathWatch?.start()
 
   // Signal readiness to parent via IPC (if available)
   if (process.send) {
-    const readyIdentity = await readCurrentDaemonReadyIdentity(startedAtMs)
     process.send({ type: 'ready', ...readyIdentity })
   }
   daemonLog.log('ready')
diff --git a/src/main/daemon/daemon-errors.test.ts b/src/main/daemon/daemon-errors.test.ts
new file mode 100644
index 00000000000..d12ce645ee7
--- /dev/null
+++ b/src/main/daemon/daemon-errors.test.ts
@@ -0,0 +1,20 @@
+import { describe, expect, it } from 'vitest'
+import {
+  DaemonProtocolError,
+  decodeDaemonResponseError,
+  SessionNotFoundError
+} from './daemon-errors'
+
+describe('decodeDaemonResponseError', () => {
+  it('types the exact legacy session-absence response', () => {
+    expect(decodeDaemonResponseError('Session not found: pty-1')).toBeInstanceOf(
+      SessionNotFoundError
+    )
+  })
+
+  it('keeps unrelated daemon failures non-authoritative', () => {
+    expect(decodeDaemonResponseError('proxy failed: Session not found: pty-1')).toBeInstanceOf(
+      DaemonProtocolError
+    )
+  })
+})
diff --git a/src/main/daemon/daemon-errors.ts b/src/main/daemon/daemon-errors.ts
index 8077add319a..bddb3690a4a 100644
--- a/src/main/daemon/daemon-errors.ts
+++ b/src/main/daemon/daemon-errors.ts
@@ -20,3 +20,17 @@ export class SessionNotFoundError extends Error {
     this.name = 'SessionNotFoundError'
   }
 }
+
+export class TerminalSessionOwnerUnverifiedError extends Error {
+  constructor(sessionId: string) {
+    super(`Terminal session owner could not be verified: ${sessionId}`)
+    this.name = 'TerminalSessionOwnerUnverifiedError'
+  }
+}
+
+export function decodeDaemonResponseError(message: string): Error {
+  const prefix = 'Session not found: '
+  return message.startsWith(prefix)
+    ? new SessionNotFoundError(message.slice(prefix.length))
+    : new DaemonProtocolError(message)
+}
diff --git a/src/main/daemon/daemon-health-socket-cleanup.test.ts b/src/main/daemon/daemon-health-socket-cleanup.test.ts
index 6daa6cdf00b..07294410889 100644
--- a/src/main/daemon/daemon-health-socket-cleanup.test.ts
+++ b/src/main/daemon/daemon-health-socket-cleanup.test.ts
@@ -79,7 +79,7 @@ describe('daemon health socket listener cleanup', () => {
     const result = killStaleDaemon(dir, socketPath, tokenPath)
     await vi.advanceTimersByTimeAsync(500)
 
-    await expect(result).resolves.toBe(false)
+    await expect(result).resolves.toEqual({ killed: false, liveOwnerSurvived: false })
     expect(socket.listenerCount('connect')).toBe(0)
     expect(socket.listenerCount('error')).toBe(0)
     expect(socket.destroy).toHaveBeenCalledTimes(1)
diff --git a/src/main/daemon/daemon-health.test.ts b/src/main/daemon/daemon-health.test.ts
index 05c2cae0d58..8d2ae9db120 100644
--- a/src/main/daemon/daemon-health.test.ts
+++ b/src/main/daemon/daemon-health.test.ts
@@ -1,8 +1,9 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { spawn } from 'node:child_process'
+import { existsSync, linkSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { basename, join } from 'node:path'
-import { createServer, connect, type Server } from 'node:net'
+import { createServer, connect, Socket, type Server } from 'node:net'
 import { DaemonServer } from './daemon-server'
 import { getDaemonPidPath, serializeDaemonPidFile } from './daemon-spawner'
 import {
@@ -183,7 +184,9 @@ describe('daemon health', () => {
     writeFileSync(getDaemonPidPath(dir), String(process.pid), { mode: 0o600 })
 
     try {
-      await expect(killStaleDaemon(dir, socketPath, tokenPath)).resolves.toBe(false)
+      await expect(killStaleDaemon(dir, socketPath, tokenPath)).resolves.toMatchObject({
+        killed: false
+      })
       await expect(canConnect(socketPath)).resolves.toBe(true)
     } finally {
       await closeServer(server)
@@ -435,7 +438,9 @@ describe('killStaleDaemon pid identity guards', () => {
     // signal is sent.
     const killSpy = vi.spyOn(process, 'kill').mockImplementation(() => true)
     try {
-      await expect(killStaleDaemon(dir, socketPath, tokenPath)).resolves.toBe(false)
+      await expect(killStaleDaemon(dir, socketPath, tokenPath)).resolves.toMatchObject({
+        killed: false
+      })
       const terminationSignals = killSpy.mock.calls.filter(
         ([, sig]) => sig === 'SIGTERM' || sig === 'SIGKILL'
       )
@@ -445,3 +450,125 @@ describe('killStaleDaemon pid identity guards', () => {
     }
   })
 })
+
+describe('killStaleDaemon endpoint reclamation', () => {
+  let dir: string
+  let socketPath: string
+  let tokenPath: string
+
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), 'daemon-health-kill-test-'))
+    socketPath = daemonTestSocketPath(dir)
+    tokenPath = join(dir, 'daemon.token')
+  })
+
+  afterEach(() => {
+    rmSync(dir, { recursive: true, force: true })
+  })
+
+  function listenOnSocketPath(server: Server, path: string): Promise<void> {
+    return new Promise((resolve, reject) => {
+      server.once('error', reject)
+      server.listen(path, () => {
+        server.off('error', reject)
+        resolve()
+      })
+    })
+  }
+
+  it('preserves the pid record and the endpoint when the owner cannot be proven gone', async () => {
+    if (process.platform === 'win32') {
+      return
+    }
+
+    // Why: isDaemonProcess matches on the command line, so a child carrying the daemon
+    // entry plus this endpoint's paths is adopted as the recorded owner by the first probe.
+    const child = spawn(
+      process.execPath,
+      ['-e', 'setInterval(() => {}, 1000)', 'daemon-entry', socketPath, tokenPath],
+      { stdio: 'ignore' }
+    )
+    await new Promise<void>((resolve, reject) => {
+      child.once('spawn', resolve)
+      child.once('error', reject)
+    })
+    const childPid = child.pid as number
+    const childExited = new Promise<void>((resolve) => child.once('exit', () => resolve()))
+    const server = createServer((socket) => socket.end())
+    await listenOnSocketPath(server, socketPath)
+    writeFileSync(
+      getDaemonPidPath(dir),
+      serializeDaemonPidFile({ pid: childPid, startedAtMs: null }),
+      { mode: 0o600 }
+    )
+
+    const realKill = process.kill.bind(process)
+    const killSpy = vi.spyOn(process, 'kill').mockImplementation(() => true)
+    // Why: the recorded owner vanishes mid-wait, so the pre-SIGKILL identity re-probe
+    // fails and only the still-answering endpoint proves a daemon is alive.
+    const identityBreaker = setTimeout(() => realKill(childPid, 'SIGKILL'), 800)
+    try {
+      await expect(killStaleDaemon(dir, socketPath, tokenPath)).resolves.toEqual({
+        killed: false,
+        liveOwnerSurvived: true
+      })
+      expect(existsSync(getDaemonPidPath(dir))).toBe(true)
+      expect(existsSync(socketPath)).toBe(true)
+      await expect(canConnect(socketPath)).resolves.toBe(true)
+    } finally {
+      clearTimeout(identityBreaker)
+      killSpy.mockRestore()
+      try {
+        realKill(childPid, 'SIGKILL')
+      } catch {
+        // Already gone.
+      }
+      await childExited
+      await closeServer(server)
+    }
+  })
+
+  it('unlinks a stale endpoint file once connects to it are refused', async () => {
+    if (process.platform === 'win32') {
+      return
+    }
+
+    // Why: hard-linking the bound inode leaves the endpoint name behind after the
+    // listener closes — exactly the entry a crashed daemon leaves for connect to refuse.
+    const bindPath = join(dir, '.bstale')
+    const server = createServer((socket) => socket.end())
+    await listenOnSocketPath(server, bindPath)
+    linkSync(bindPath, socketPath)
+    await closeServer(server)
+
+    await expect(killStaleDaemon(dir, socketPath, tokenPath)).resolves.toEqual({
+      killed: false,
+      liveOwnerSurvived: false
+    })
+    expect(existsSync(socketPath)).toBe(false)
+  })
+
+  it('keeps the endpoint file when the connect probe neither connects nor is refused', async () => {
+    if (process.platform === 'win32') {
+      return
+    }
+
+    writeFileSync(socketPath, '')
+    // A connect that never settles leaves the probe to time out, which is not proof
+    // the endpoint is dead — net.connect itself cannot be spied on in ESM.
+    const connectSpy = vi
+      .spyOn(Socket.prototype, 'connect')
+      .mockImplementation(function (this: Socket) {
+        return this
+      })
+    try {
+      await expect(killStaleDaemon(dir, socketPath, tokenPath)).resolves.toEqual({
+        killed: false,
+        liveOwnerSurvived: false
+      })
+      expect(existsSync(socketPath)).toBe(true)
+    } finally {
+      connectSpy.mockRestore()
+    }
+  })
+})
diff --git a/src/main/daemon/daemon-health.ts b/src/main/daemon/daemon-health.ts
index 5a77eff4fcd..b6d264c9569 100644
--- a/src/main/daemon/daemon-health.ts
+++ b/src/main/daemon/daemon-health.ts
@@ -23,6 +23,9 @@ const HEALTH_CHECK_TIMEOUT_MS = 3_000
 const RESOLVER_HEALTH_CHECK_TIMEOUT_MS = 3_000
 const KILL_WAIT_MS = 3_000
 const KILL_POLL_MS = 100
+// Why: SIGKILL is delivered on return from an uninterruptible syscall, so confirm the exit
+// rather than assume it — but keep the wait short, it only guards the rare wedged case.
+const SIGKILL_CONFIRM_WAIT_MS = 1_000
 const START_TIME_TOLERANCE_MS = 1_500
 // Why: e2e forces the failed-health preserve path without SIGSTOP races —
 // a stopped daemon also blocks listSessions, so the unhealthy guard cannot
@@ -51,10 +54,17 @@ export type ParsedDaemonPid = {
   spawnerExecPath: string | null
 }
 
-function canConnectSocket(socketPath: string): Promise<boolean> {
+/**
+ * 'connected' — something is listening. 'missing'/'refused' — nothing is, and the endpoint
+ * name is safe to reclaim. 'unknown' — the probe itself failed (timeout on a loaded host,
+ * EPERM); the endpoint must be left alone because absence of proof is not proof of death.
+ */
+type SocketProbeOutcome = 'connected' | 'missing' | 'refused' | 'unknown'
+
+function probeSocketConnect(socketPath: string): Promise<SocketProbeOutcome> {
   return new Promise((resolve) => {
     if (process.platform !== 'win32' && !existsSync(socketPath)) {
-      resolve(false)
+      resolve('missing')
       return
     }
     const sock = connect({ path: socketPath })
@@ -64,7 +74,7 @@ function canConnectSocket(socketPath: string): Promise<boolean> {
       sock.off('connect', onConnect)
       sock.off('error', onError)
     }
-    const settle = (result: boolean): void => {
+    const settle = (result: SocketProbeOutcome): void => {
       if (settled) {
         return
       }
@@ -73,14 +83,16 @@ function canConnectSocket(socketPath: string): Promise<boolean> {
       resolve(result)
     }
     const onConnect = (): void => {
-      settle(true)
+      settle('connected')
       sock.destroy()
     }
-    const onError = (): void => {
-      settle(false)
+    const onError = (error: NodeJS.ErrnoException): void => {
+      settle(
+        error.code === 'ECONNREFUSED' ? 'refused' : error.code === 'ENOENT' ? 'missing' : 'unknown'
+      )
     }
     const timer = setTimeout(() => {
-      settle(false)
+      settle('unknown')
       sock.destroy()
     }, 500)
     sock.on('connect', onConnect)
@@ -279,7 +291,12 @@ export function getMacDaemonSystemResolverHealth(
           }
           // Why: the daemon must report health from inside its own process;
           // external launchctl bsexec probes can misclassify healthy PTYs.
-          sock?.write(encodeNdjson({ id: 'resolver-health-1', type: 'systemResolverHealth' }))
+          sock?.write(
+            encodeNdjson({
+              id: 'resolver-health-1',
+              type: 'systemResolverHealth'
+            })
+          )
           continue
         }
 
@@ -370,7 +387,10 @@ function getLinuxProcessStartedAtMs(pid: number): number | null {
     const startTicks = parseLinuxProcStartTicks(stat)
     const bootTimeSeconds = parseLinuxBootTimeSeconds(readFileSync('/proc/stat', 'utf8'))
     const ticksPerSecond = Number(
-      execFileSync('getconf', ['CLK_TCK'], { encoding: 'utf8', timeout: 1_000 }).trim()
+      execFileSync('getconf', ['CLK_TCK'], {
+        encoding: 'utf8',
+        timeout: 1_000
+      }).trim()
     )
     if (
       !Number.isFinite(startTicks) ||
@@ -705,14 +725,45 @@ export async function getMacDaemonTccAttributionHealth(
   return 'unknown'
 }
 
+function isNoSuchProcessError(error: unknown): boolean {
+  return typeof error === 'object' && error !== null && 'code' in error && error.code === 'ESRCH'
+}
+
+async function waitForProcessExit(pid: number, timeoutMs: number): Promise<boolean> {
+  const deadline = Date.now() + timeoutMs
+  for (;;) {
+    try {
+      process.kill(pid, 0)
+    } catch {
+      return true
+    }
+    if (Date.now() >= deadline) {
+      return false
+    }
+    await new Promise((resolve) => setTimeout(resolve, KILL_POLL_MS))
+  }
+}
+
+export type StaleDaemonKillOutcome = {
+  /** A daemon was positively confirmed gone. Drives replacement telemetry. */
+  killed: boolean
+  /**
+   * We could not prove the recorded daemon is gone. Its PID record and endpoint are left
+   * intact and the caller must not fork a replacement beside it — that is exactly how two
+   * daemons end up alive with one owning the socket and the other hosting the sessions.
+   */
+  liveOwnerSurvived: boolean
+}
+
 export async function killStaleDaemon(
   runtimeDir: string,
   socketPath: string,
   tokenPath: string,
   protocolVersion = PROTOCOL_VERSION
-): Promise<boolean> {
+): Promise<StaleDaemonKillOutcome> {
   const pidPath = getDaemonPidPath(runtimeDir, protocolVersion)
   let killedDaemon = false
+  let liveOwnerSurvived = false
   try {
     const parsedPid = parseDaemonPidFile(readFileSync(pidPath, 'utf8'))
     if (
@@ -720,7 +771,16 @@ export async function killStaleDaemon(
       (await isDaemonProcess(parsedPid.pid, socketPath, tokenPath, parsedPid.startedAtMs))
     ) {
       const { pid, startedAtMs } = parsedPid
-      process.kill(pid, 'SIGTERM')
+      try {
+        process.kill(pid, 'SIGTERM')
+      } catch (error) {
+        // Why: ESRCH means it is already gone. Anything else (EPERM from a daemon owned by
+        // another user) means it is alive and we cannot stop it — falling through to the
+        // blanket catch would report "nothing alive" and authorize a duplicate beside it.
+        if (!isNoSuchProcessError(error)) {
+          return { killed: false, liveOwnerSurvived: true }
+        }
+      }
       const deadline = Date.now() + KILL_WAIT_MS
       let exited = false
       while (Date.now() < deadline) {
@@ -738,37 +798,70 @@ export async function killStaleDaemon(
         // daemon died during the wait. Without this, we'd SIGKILL an unrelated
         // process that happens to now own the same pid.
         if (!(await isDaemonProcess(pid, socketPath, tokenPath, startedAtMs))) {
-          console.warn('[daemon] Skipping SIGKILL for stale daemon: reason=pid_recycled')
-          exited = true
-          killedDaemon = true
+          // Why: a failed identity probe has two causes with opposite correct actions —
+          // the pid really was recycled (daemon dead, reclaim the endpoint), or the probe
+          // itself failed under load (`ps` has a 2s timeout). The endpoint settles it: if
+          // something still answers the socket, a daemon is alive and must be preserved.
+          if ((await probeSocketConnect(socketPath)) === 'connected') {
+            console.warn(
+              '[daemon] Preserving daemon that could not be identified: reason=identity_probe_failed'
+            )
+            liveOwnerSurvived = true
+          } else {
+            console.warn('[daemon] Skipping SIGKILL for stale daemon: reason=pid_recycled')
+            exited = true
+          }
         } else {
           try {
             process.kill(pid, 'SIGKILL')
-            exited = true
           } catch {
             // Already dead
+            exited = true
+          }
+          // Why: issuing SIGKILL is not proof of death — a process blocked in an
+          // uninterruptible syscall only dies once it returns. Claiming the kill without
+          // confirming it is what let the endpoint be reclaimed out from under a daemon
+          // that was still alive and still serving.
+          exited = exited || (await waitForProcessExit(pid, SIGKILL_CONFIRM_WAIT_MS))
+          if (!exited) {
+            console.warn('[daemon] Daemon survived SIGKILL: reason=unconfirmed_exit')
           }
         }
       }
-      killedDaemon = killedDaemon || exited
+      killedDaemon = exited
+      // Why: SIGTERM and SIGKILL both failed to produce an exit, so the daemon is still out
+      // there holding the endpoint. Treat it as the owner rather than racing it.
+      liveOwnerSurvived = liveOwnerSurvived || !exited
     }
   } catch {
     // PID file missing or process already dead
   }
 
+  if (liveOwnerSurvived) {
+    // Why: removing the record of a daemon we failed to kill is what let a replacement
+    // publish its own ownership beside it. Leaving it intact keeps the exclusive PID claim
+    // held, so a duplicate cannot take the endpoint.
+    return { killed: killedDaemon, liveOwnerSurvived }
+  }
+
   try {
     unlinkSync(pidPath)
   } catch {
     // Best-effort
   }
 
-  const socketIsLive = await canConnectSocket(socketPath)
-  if (process.platform !== 'win32' && existsSync(socketPath) && (killedDaemon || !socketIsLive)) {
+  const socketOutcome = await probeSocketConnect(socketPath)
+  // Why: only positive evidence of a dead endpoint authorizes reclaiming the name. A probe
+  // that merely timed out leaves a live daemon's endpoint in place instead of unlinking it
+  // and forking a duplicate onto the freed path.
+  const endpointIsReclaimable =
+    killedDaemon || socketOutcome === 'refused' || socketOutcome === 'missing'
+  if (process.platform !== 'win32' && existsSync(socketPath) && endpointIsReclaimable) {
     try {
       unlinkSync(socketPath)
     } catch {
       // Best-effort
     }
   }
-  return killedDaemon
+  return { killed: killedDaemon, liveOwnerSurvived }
 }
diff --git a/src/main/daemon/daemon-hello-protocol.ts b/src/main/daemon/daemon-hello-protocol.ts
index 4e288e4db9b..5d9d031cb9d 100644
--- a/src/main/daemon/daemon-hello-protocol.ts
+++ b/src/main/daemon/daemon-hello-protocol.ts
@@ -10,6 +10,10 @@ export type DaemonEndpointIdentity = {
   pid: number
   startedAtMs: number
   launchNonce: string
+  /** Optional launch metadata. Absent from daemons that predate it; readers must fall back. */
+  entryPath?: string
+  appVersion?: string
+  spawnerExecPath?: string
 }
 
 export type HelloResponse = {
diff --git a/src/main/daemon/daemon-init.test.ts b/src/main/daemon/daemon-init.test.ts
index 41f9af83f4f..77016298abc 100644
--- a/src/main/daemon/daemon-init.test.ts
+++ b/src/main/daemon/daemon-init.test.ts
@@ -30,7 +30,11 @@ const {
   killStaleDaemonMock,
   getProcessStartedAtMsMock,
   parseDaemonPidFileMock,
+  replaceDaemonPidFileMock,
+  getDaemonCommandLineMock,
   unlinkOwnedDaemonPidFileMock,
+  launchedStartedAtMs,
+  readLaunchedDaemonIdentity,
   daemonClientMock,
   spawnerInstances,
   ensureRunningOverrides,
@@ -87,16 +91,37 @@ const {
   const getMacDaemonTccAttributionHealthMock = vi.fn(async () => 'unknown')
   const getDaemonLaunchIdentityMock = vi.fn(() => 'match')
   const isDaemonStaleForCurrentBundleMock = vi.fn(() => false)
-  const killStaleDaemonMock = vi.fn(async () => true)
+  const killStaleDaemonMock = vi.fn(async () => ({
+    killed: true,
+    liveOwnerSurvived: false
+  }))
   const getProcessStartedAtMsMock = vi.fn((): number | null => 1_000_000)
   const parseDaemonPidFileMock = vi.fn(
     (): { pid: number; startedAtMs: number | null } | null => null
   )
+  const replaceDaemonPidFileMock = vi.fn(() => true)
+  const getDaemonCommandLineMock = vi.fn(async (_pid: number): Promise<string | null> => null)
   const unlinkOwnedDaemonPidFileMock = vi.fn(() => true)
+  const launchedStartedAtMs = { current: 1_000_000 }
+
+  const readLaunchedDaemonIdentity = () => {
+    const args = forkMock.mock.calls.at(-1)?.[1]
+    const child = forkMock.mock.results.at(-1)?.value as { pid?: unknown } | undefined
+    const launchNonceIndex = Array.isArray(args) ? args.indexOf('--launch-nonce') : -1
+    const launchNonce = launchNonceIndex >= 0 ? args[launchNonceIndex + 1] : undefined
+    return typeof child?.pid === 'number' && typeof launchNonce === 'string'
+      ? {
+          pid: child.pid,
+          startedAtMs: launchedStartedAtMs.current,
+          launchNonce
+        }
+      : null
+  }
 
   const daemonClientMock = vi.fn().mockImplementation(function MockDaemonClient() {
     return {
       ensureConnected: vi.fn(async () => {}),
+      getDaemonIdentity: vi.fn(readLaunchedDaemonIdentity),
       request: vi.fn(async () => ({ sessions: [] })),
       disconnect: vi.fn()
     }
@@ -173,7 +198,11 @@ const {
     killStaleDaemonMock,
     getProcessStartedAtMsMock,
     parseDaemonPidFileMock,
+    replaceDaemonPidFileMock,
+    getDaemonCommandLineMock,
     unlinkOwnedDaemonPidFileMock,
+    launchedStartedAtMs,
+    readLaunchedDaemonIdentity,
     daemonClientMock,
     spawnerInstances,
     ensureRunningOverrides,
@@ -253,6 +282,7 @@ vi.mock('net', () => ({ connect: netConnectMock }))
 
 vi.mock('./daemon-health', () => ({
   checkDaemonHealth: checkDaemonHealthMock,
+  getDaemonCommandLine: getDaemonCommandLineMock,
   getDaemonLaunchIdentity: getDaemonLaunchIdentityMock,
   getMacDaemonSystemResolverHealth: getMacDaemonSystemResolverHealthMock,
   getMacDaemonTccAttributionHealth: getMacDaemonTccAttributionHealthMock,
@@ -294,7 +324,10 @@ vi.mock('./daemon-spawner', () => ({
           const result = await override()
           const releaseAdoptionLease = vi.fn()
           adoptionLeaseReleases.push(releaseAdoptionLease)
-          this.handle = { releaseAdoptionLease, shutdown: vi.fn(async () => {}) }
+          this.handle = {
+            releaseAdoptionLease,
+            shutdown: vi.fn(async () => {})
+          }
           if (result.mode) {
             this.handle.mode = result.mode
           }
@@ -325,6 +358,8 @@ vi.mock('./daemon-spawner', () => ({
   getDaemonPidPath: (_dir: string, version?: number) =>
     `/fake/daemon/daemon-v${version ?? PROTOCOL_VERSION}.pid`,
   serializeDaemonPidFile: (obj: unknown) => JSON.stringify(obj),
+  replaceDaemonPidFile: replaceDaemonPidFileMock,
+  sweepAbandonedDaemonClaims: vi.fn(() => 0),
   unlinkOwnedDaemonPidFile: unlinkOwnedDaemonPidFileMock
 }))
 
@@ -425,7 +460,10 @@ async function importFresh() {
   // mockReset (not mockClear) also drops an unconsumed *Once queue, so a test that bails early
   // can't leak a queued false into the next test's confirmedReplacement gate.
   killStaleDaemonMock.mockReset()
-  killStaleDaemonMock.mockResolvedValue(true)
+  killStaleDaemonMock.mockResolvedValue({
+    killed: true,
+    liveOwnerSurvived: false
+  })
   getAppPathMock.mockReset()
   getAppPathMock.mockReturnValue('/fake/app')
   forkMock.mockReset()
@@ -435,6 +473,7 @@ async function importFresh() {
   daemonClientMock.mockImplementation(function MockDaemonClient() {
     return {
       ensureConnected: vi.fn(async () => {}),
+      getDaemonIdentity: vi.fn(readLaunchedDaemonIdentity),
       request: vi.fn(async () => ({ sessions: [] })),
       disconnect: vi.fn()
     }
@@ -450,6 +489,7 @@ async function importFresh() {
   parseDaemonPidFileMock.mockReturnValue(null)
   unlinkOwnedDaemonPidFileMock.mockReset()
   unlinkOwnedDaemonPidFileMock.mockReturnValue(true)
+  launchedStartedAtMs.current = 1_000_000
   getProcessStartedAtMsMock.mockReset()
   getProcessStartedAtMsMock.mockReturnValue(1_000_000)
   // Why: import after resetModules so module-level spawner/adapter/restartInFlight start fresh — needed to test first-init and the coalescer.
@@ -492,7 +532,10 @@ describe('daemon-init: runRestartDaemon (7-step sequence)', () => {
     probeSocketExistsMock.mockReturnValue(false)
     netConnectMock.mockReset()
     netConnectMock.mockImplementation(() => {
-      const handlers: Record<string, (() => void)[]> = { connect: [], error: [] }
+      const handlers: Record<string, (() => void)[]> = {
+        connect: [],
+        error: []
+      }
       return {
         on(event: string, cb: () => void) {
           handlers[event]?.push(cb)
@@ -607,7 +650,10 @@ describe('daemon-init: runRestartDaemon (7-step sequence)', () => {
     expect(spawnerInstances[0].ensureRunning).toHaveBeenCalledTimes(1)
 
     abortController.abort()
-    resolveEnsureRunning({ socketPath: '/fake/socket-late', tokenPath: '/fake/token-late' })
+    resolveEnsureRunning({
+      socketPath: '/fake/socket-late',
+      tokenPath: '/fake/token-late'
+    })
     await started
 
     expect(adapterInstances).toHaveLength(1)
@@ -691,7 +737,10 @@ describe('daemon-init: runRestartDaemon (7-step sequence)', () => {
     const result = await provider!.spawn({ cols: 80, rows: 24 })
 
     expect(result.id).toBe('local-fallback-pty')
-    expect(localFallbackProvider.spawn).toHaveBeenCalledWith({ cols: 80, rows: 24 })
+    expect(localFallbackProvider.spawn).toHaveBeenCalledWith({
+      cols: 80,
+      rows: 24
+    })
     expect(adapterInstances[0].listProcesses).toHaveBeenCalled()
   })
 
@@ -894,7 +943,10 @@ describe('daemon-init: runRestartDaemon (7-step sequence)', () => {
     ensureRunningOverrides.push(async () => {
       await outgoingRespawn?.('daemon_died')
       respawnedMidRestart = true
-      return { socketPath: '/fake/restarted-socket', tokenPath: '/fake/restarted-token' }
+      return {
+        socketPath: '/fake/restarted-socket',
+        tokenPath: '/fake/restarted-token'
+      }
     })
 
     await mod.restartDaemon()
@@ -915,7 +967,10 @@ describe('daemon-init: runRestartDaemon (7-step sequence)', () => {
     ensureRunningOverrides.push(async () => {
       await restartedRespawn?.('daemon_died')
       respawnedMidSecondRestart = true
-      return { socketPath: '/fake/restarted-socket-2', tokenPath: '/fake/restarted-token-2' }
+      return {
+        socketPath: '/fake/restarted-socket-2',
+        tokenPath: '/fake/restarted-token-2'
+      }
     })
 
     await mod.restartDaemon()
@@ -1066,7 +1121,10 @@ describe('daemon-init: runRestartDaemon (7-step sequence)', () => {
     // Make probeSocket return true: needs both the fs.existsSync proxy AND net.connect resolving "alive".
     probeSocketExistsMock.mockReturnValue(true)
     netConnectMock.mockImplementationOnce(() => {
-      const handlers: Record<string, (() => void)[]> = { connect: [], error: [] }
+      const handlers: Record<string, (() => void)[]> = {
+        connect: [],
+        error: []
+      }
       return {
         on(event: string, cb: () => void) {
           handlers[event]?.push(cb)
@@ -1087,7 +1145,9 @@ describe('daemon-init: runRestartDaemon (7-step sequence)', () => {
 
     // The shutdown RPC must have been issued with killSessions=true.
     expect(ensureConnectedMock).toHaveBeenCalled()
-    expect(requestMock).toHaveBeenCalledWith('shutdown', { killSessions: true })
+    expect(requestMock).toHaveBeenCalledWith('shutdown', {
+      killSessions: true
+    })
     // The fallback killStaleDaemon must NOT fire when the RPC path worked.
     expect(killStaleDaemonMock).not.toHaveBeenCalled()
   })
@@ -1125,7 +1185,10 @@ describe('daemon-init: runRestartDaemon (7-step sequence)', () => {
 
       await vi.advanceTimersByTimeAsync(1000)
 
-      await expect(cleanup).resolves.toEqual({ cleaned: false, killedCount: 0 })
+      await expect(cleanup).resolves.toEqual({
+        cleaned: false,
+        killedCount: 0
+      })
       expect(socket.destroy).toHaveBeenCalledTimes(1)
       expect(socket.listenerCount('connect')).toBe(0)
       expect(socket.listenerCount('error')).toBe(0)
@@ -1188,7 +1251,9 @@ describe('daemon-init: runRestartDaemon (7-step sequence)', () => {
 
   it('respawns instead of reusing a healthy daemon launched from another app path', async () => {
     const mod = await importFresh()
-    await mod.initDaemonPtyProvider(undefined, { macosLoginSessionWatch: true })
+    await mod.initDaemonPtyProvider(undefined, {
+      macosLoginSessionWatch: true
+    })
 
     const launcher = spawnerInstances[0].launcher as (
       socketPath: string,
@@ -1352,6 +1417,194 @@ describe('daemon-init: runRestartDaemon (7-step sequence)', () => {
     expect(disconnect).toHaveBeenCalledOnce()
   })
 
+  it('repairs a stale PID record to the authenticated socket owner before adoption', async () => {
+    const mod = await importFresh()
+    await mod.initDaemonPtyProvider()
+    const endpointIdentity = {
+      pid: 101,
+      startedAtMs: 1_000_000,
+      launchNonce: 'socket-owner'
+    }
+    daemonClientMock.mockImplementationOnce(function MockAdoptionClient() {
+      return {
+        ensureConnected: vi.fn(async () => {}),
+        getDaemonIdentity: vi.fn(() => endpointIdentity),
+        request: vi.fn(),
+        disconnect: vi.fn()
+      }
+    })
+    readFileSyncMock.mockReturnValueOnce(
+      JSON.stringify({
+        pid: 202,
+        startedAtMs: 2_000_000,
+        launchNonce: 'stale-owner'
+      })
+    )
+    readFileSyncMock.mockReturnValueOnce(JSON.stringify(endpointIdentity))
+    const launcher = spawnerInstances[0].launcher as (
+      socketPath: string,
+      tokenPath: string,
+      pidPath?: string,
+      launchNonce?: string
+    ) => Promise<{ releaseAdoptionLease?(): void; shutdown(): Promise<void> }>
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+
+    try {
+      const handle = await launcher(
+        '/fake/socket',
+        '/fake/token',
+        '/fake/daemon.pid',
+        'unused-new-launch'
+      )
+
+      expect(replaceDaemonPidFileMock).toHaveBeenCalledWith('/fake/daemon.pid', endpointIdentity)
+      expect(warn).toHaveBeenCalledWith(
+        '[daemon] Repaired daemon PID ownership to match the authenticated endpoint'
+      )
+      handle.releaseAdoptionLease?.()
+    } finally {
+      warn.mockRestore()
+    }
+  })
+
+  it('republishes the endpoint owner launch metadata into a repaired PID record', async () => {
+    const mod = await importFresh()
+    await mod.initDaemonPtyProvider()
+    // Why: the mismatched record's metadata belongs to another daemon, so freshness and
+    // host-pinning fields must come from the authenticated owner — a record without
+    // appVersion reads as a permanently stale bundle and gets needlessly replaced. The
+    // install path deliberately contains a space: re-parsing it out of a space-joined
+    // command line truncated it and made a healthy daemon look like a different app path.
+    const endpointIdentity = {
+      pid: 101,
+      startedAtMs: 1_000_000,
+      launchNonce: 'socket-owner',
+      entryPath: '/Applications/Orca 2.app/Contents/out/main/daemon-entry.js',
+      appVersion: '9.9.9',
+      spawnerExecPath: '/Applications/Orca 2.app/Contents/MacOS/Orca'
+    }
+    daemonClientMock.mockImplementationOnce(function MockAdoptionClient() {
+      return {
+        ensureConnected: vi.fn(async () => {}),
+        getDaemonIdentity: vi.fn(() => endpointIdentity),
+        request: vi.fn(),
+        disconnect: vi.fn()
+      }
+    })
+    readFileSyncMock.mockReturnValueOnce(
+      JSON.stringify({
+        pid: 202,
+        startedAtMs: 2_000_000,
+        launchNonce: 'stale-owner'
+      })
+    )
+    const launcher = spawnerInstances[0].launcher as (
+      socketPath: string,
+      tokenPath: string,
+      pidPath?: string,
+      launchNonce?: string
+    ) => Promise<{ releaseAdoptionLease?(): void; shutdown(): Promise<void> }>
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+
+    try {
+      const handle = await launcher('/fake/socket', '/fake/token', '/fake/daemon.pid', 'unused')
+
+      expect(replaceDaemonPidFileMock).toHaveBeenCalledWith('/fake/daemon.pid', {
+        pid: 101,
+        startedAtMs: 1_000_000,
+        launchNonce: 'socket-owner',
+        entryPath: '/Applications/Orca 2.app/Contents/out/main/daemon-entry.js',
+        appVersion: '9.9.9',
+        spawnerExecPath: '/Applications/Orca 2.app/Contents/MacOS/Orca'
+      })
+      handle.releaseAdoptionLease?.()
+    } finally {
+      warn.mockRestore()
+    }
+  })
+
+  it('adopts the authenticated endpoint even when the PID record cannot be repaired', async () => {
+    const mod = await importFresh()
+    await mod.initDaemonPtyProvider()
+    const endpointIdentity = {
+      pid: 101,
+      startedAtMs: 1_000_000,
+      launchNonce: 'socket-owner'
+    }
+    daemonClientMock.mockImplementationOnce(function MockAdoptionClient() {
+      return {
+        ensureConnected: vi.fn(async () => {}),
+        getDaemonIdentity: vi.fn(() => endpointIdentity),
+        request: vi.fn(),
+        disconnect: vi.fn()
+      }
+    })
+    readFileSyncMock.mockReturnValueOnce(
+      JSON.stringify({
+        pid: 202,
+        startedAtMs: 2_000_000,
+        launchNonce: 'stale-owner'
+      })
+    )
+    // Why: fail open. Losing every persistent terminal because a pid file write failed is a
+    // far worse outcome than a record that disagrees with the endpoint.
+    replaceDaemonPidFileMock.mockReturnValueOnce(false)
+    const launcher = spawnerInstances[0].launcher as (
+      socketPath: string,
+      tokenPath: string,
+      pidPath?: string,
+      launchNonce?: string
+    ) => Promise<{ releaseAdoptionLease?(): void; shutdown(): Promise<void> }>
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const forkCallsBefore = forkMock.mock.calls.length
+
+    try {
+      const handle = await launcher('/fake/socket', '/fake/token', '/fake/daemon.pid', 'unused')
+
+      expect(handle).toBeDefined()
+      // The healthy daemon is adopted, not replaced.
+      expect(forkMock.mock.calls.length).toBe(forkCallsBefore)
+      expect(warn).toHaveBeenCalledWith(
+        '[daemon] Could not repair daemon PID ownership; adopting the authenticated endpoint anyway'
+      )
+      handle.releaseAdoptionLease?.()
+    } finally {
+      warn.mockRestore()
+    }
+  })
+
+  it('degrades instead of forking beside a daemon that could not be confirmed stopped', async () => {
+    const mod = await importFresh()
+    checkDaemonHealthMock.mockResolvedValue('unreachable')
+    await mod.initDaemonPtyProvider()
+    const forkCallsBefore = forkMock.mock.calls.length
+    // Why: forking beside a survivor is exactly how the endpoint owner and the session host
+    // diverge — one daemon answers the socket while another hosts the visible terminals. But
+    // refusing outright would leave the user with no daemon at all, and something demonstrably
+    // still answers the endpoint, so adopt it degraded: live sessions keep working.
+    killStaleDaemonMock.mockResolvedValueOnce({
+      killed: false,
+      liveOwnerSurvived: true
+    })
+    const launcher = spawnerInstances[0].launcher as (
+      socketPath: string,
+      tokenPath: string,
+      pidPath?: string,
+      launchNonce?: string
+    ) => Promise<{ mode?: string; releaseAdoptionLease?(): void }>
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+
+    try {
+      const handle = await launcher('/fake/socket', '/fake/token', '/fake/daemon.pid', 'launch-new')
+
+      expect(handle.mode).toBe('degraded-new-pty-fallback')
+      expect(forkMock.mock.calls.length).toBe(forkCallsBefore)
+      handle.releaseAdoptionLease?.()
+    } finally {
+      warn.mockRestore()
+    }
+  })
+
   it('disconnects every temporary client when healthy adoption fails', async () => {
     const mod = await importFresh()
     await mod.initDaemonPtyProvider()
@@ -1663,7 +1916,10 @@ describe('daemon-init: runRestartDaemon (7-step sequence)', () => {
     const mod = await importFresh()
     await mod.initDaemonPtyProvider()
     checkDaemonHealthMock.mockResolvedValue('unreachable')
-    killStaleDaemonMock.mockResolvedValueOnce(false)
+    killStaleDaemonMock.mockResolvedValueOnce({
+      killed: false,
+      liveOwnerSurvived: false
+    })
     forkMock.mockImplementationOnce(() => {
       throw new Error('stop after replacement decision')
     })
@@ -1691,7 +1947,9 @@ describe('daemon-init: runRestartDaemon (7-step sequence)', () => {
 
     // The daemon is gone before the launcher looks: nothing answers, nothing left to kill.
     checkDaemonHealthMock.mockResolvedValue('unreachable')
-    killStaleDaemonMock.mockResolvedValueOnce(false).mockResolvedValueOnce(false)
+    killStaleDaemonMock
+      .mockResolvedValueOnce({ killed: false, liveOwnerSurvived: false })
+      .mockResolvedValueOnce({ killed: false, liveOwnerSurvived: false })
     forkMock.mockImplementationOnce(() => {
       throw new Error('stop after replacement decision')
     })
@@ -1789,12 +2047,18 @@ describe('daemon-init: runRestartDaemon (7-step sequence)', () => {
     trackDaemonReplacedMock.mockClear()
 
     getDaemonLaunchIdentityMock.mockReturnValueOnce('mismatch')
-    killStaleDaemonMock.mockResolvedValueOnce(false)
+    killStaleDaemonMock.mockResolvedValueOnce({
+      killed: false,
+      liveOwnerSurvived: false
+    })
     // The daemon answers cleanup's liveness probe, then the endpoint goes away so the self-shutdown
     // wait succeeds and cleanup reports cleaned:true.
     probeSocketExistsMock.mockReturnValue(true)
     netConnectMock.mockImplementationOnce(() => {
-      const handlers: Record<string, (() => void)[]> = { connect: [], error: [] }
+      const handlers: Record<string, (() => void)[]> = {
+        connect: [],
+        error: []
+      }
       return {
         on(event: string, cb: () => void) {
           handlers[event]?.push(cb)
@@ -1883,29 +2147,115 @@ describe('daemon-init: runRestartDaemon (7-step sequence)', () => {
     expect(handlers.exit).toHaveLength(0)
     expect(child.disconnect).toHaveBeenCalledOnce()
     expect(child.unref).toHaveBeenCalledOnce()
-    const [pidPath, pidContents, pidOptions] = writeFileSyncMock.mock.calls.at(-1) ?? []
-    expect(pidPath).toBe(`/fake/daemon/daemon-v${PROTOCOL_VERSION}.pid`)
-    expect(JSON.parse(pidContents as string)).toEqual({
-      pid: 12345,
-      startedAtMs: 1_000_000,
-      linuxStartTicks: '4242',
-      bootId: 'boot-a',
-      entryPath: FAKE_DAEMON_ENTRY_PATH,
-      appVersion: '1.2.3',
-      launchNonce: expect.stringMatching(/^[0-9a-f-]{36}$/),
-      spawnerExecPath: process.execPath
-    })
-    expect(pidOptions).toEqual({ mode: 0o600, flag: 'wx' })
+    expect(writeFileSyncMock).not.toHaveBeenCalled()
     const launchArgs = forkMock.mock.calls.at(-1)?.[1] as string[]
     const launchNonceIndex = launchArgs.indexOf('--launch-nonce')
     expect(launchArgs).toEqual(
       expect.arrayContaining([
         '--pid-record',
         `/fake/daemon/daemon-v${PROTOCOL_VERSION}.pid`,
-        '--launch-nonce'
+        '--launch-nonce',
+        expect.stringMatching(/^[0-9a-f-]{36}$/),
+        '--entry-path',
+        FAKE_DAEMON_ENTRY_PATH,
+        '--app-version',
+        '1.2.3',
+        '--spawner-exec-path',
+        process.execPath
       ])
     )
-    expect(launchArgs[launchNonceIndex + 1]).toBe(JSON.parse(pidContents as string).launchNonce)
+    expect(launchArgs[launchNonceIndex + 1]).toMatch(/^[0-9a-f-]{36}$/)
+  })
+
+  it.each([
+    [
+      'changed endpoint identity',
+      () => ({
+        getDaemonIdentity: vi.fn(() => ({
+          pid: 999,
+          startedAtMs: 900_000,
+          launchNonce: 'stale-launch'
+        }))
+      })
+    ],
+    ['missing endpoint identity reader', () => ({})]
+  ])('rejects and reaps a child with %s before adoption', async (_case, identityMethods) => {
+    const mod = await importFresh()
+    checkDaemonHealthMock.mockResolvedValue('unreachable')
+    await mod.initDaemonPtyProvider()
+    function basicClient() {
+      return {
+        ensureConnected: vi.fn(async () => {}),
+        request: vi.fn(async () => ({ sessions: [] })),
+        disconnect: vi.fn()
+      }
+    }
+    daemonClientMock.mockImplementationOnce(basicClient)
+    daemonClientMock.mockImplementationOnce(basicClient)
+    daemonClientMock.mockImplementationOnce(function postReadyClient() {
+      return {
+        ...basicClient(),
+        ...identityMethods()
+      }
+    })
+    const handlers: Record<string, ((arg?: unknown) => void)[]> = {
+      message: [],
+      error: [],
+      exit: []
+    }
+    const child = {
+      pid: 12345,
+      connected: true,
+      exitCode: null as number | null,
+      signalCode: null as NodeJS.Signals | null,
+      on(event: string, callback: (arg?: unknown) => void) {
+        handlers[event]?.push(callback)
+        if (event === 'message') {
+          queueMicrotask(() => callback({ type: 'ready', startedAtMs: 1_000_000 }))
+        }
+        return this
+      },
+      off(event: string, callback: (arg?: unknown) => void) {
+        handlers[event] = handlers[event]?.filter((handler) => handler !== callback) ?? []
+        return this
+      },
+      kill: vi.fn(() => true),
+      disconnect: vi.fn(() => {
+        child.connected = false
+      }),
+      unref: vi.fn()
+    }
+    const kill = vi.spyOn(process, 'kill').mockImplementation(() => {
+      queueMicrotask(() => {
+        child.exitCode = 0
+        for (const callback of handlers.exit.slice()) {
+          callback(0)
+        }
+      })
+      return true
+    })
+    forkMock.mockReturnValueOnce(child)
+    const launcher = spawnerInstances[0].launcher as (
+      socketPath: string,
+      tokenPath: string,
+      pidPath?: string,
+      launchNonce?: string
+    ) => Promise<{ shutdown(): Promise<void> }>
+
+    try {
+      await expect(
+        launcher('/fake/socket', '/fake/token', '/fake/daemon.pid', 'launch-new')
+      ).rejects.toThrow('Daemon endpoint ownership changed during startup')
+
+      expect(kill).toHaveBeenCalledWith(12345, 'SIGTERM')
+      expect(unlinkOwnedDaemonPidFileMock).toHaveBeenCalledWith(
+        '/fake/daemon.pid',
+        12345,
+        'launch-new'
+      )
+    } finally {
+      kill.mockRestore()
+    }
   })
 
   it('keeps a live PID record after adoption failure and removes it on exact child exit', async () => {
@@ -1969,11 +2319,7 @@ describe('daemon-init: runRestartDaemon (7-step sequence)', () => {
       launcher('/fake/socket', '/fake/token', '/fake/daemon.pid', 'launch-delayed')
     ).rejects.toThrow('adoption unavailable')
 
-    expect(writeFileSyncMock).toHaveBeenCalledWith(
-      '/fake/daemon.pid',
-      expect.stringContaining('launch-delayed'),
-      { mode: 0o600, flag: 'wx' }
-    )
+    expect(writeFileSyncMock).not.toHaveBeenCalled()
     expect(unlinkOwnedDaemonPidFileMock).not.toHaveBeenCalled()
     expect(adoptionDisconnects.at(-1)).toHaveBeenCalledOnce()
 
@@ -2077,6 +2423,7 @@ describe('daemon-init: runRestartDaemon (7-step sequence)', () => {
       expect(kill).toHaveBeenNthCalledWith(2, 12345, 'SIGKILL')
       expect(child.disconnect).toHaveBeenCalledOnce()
       expect(child.unref).toHaveBeenCalledOnce()
+      expect(unlinkOwnedDaemonPidFileMock).not.toHaveBeenCalled()
     } finally {
       kill.mockRestore()
       vi.useRealTimers()
@@ -2084,7 +2431,9 @@ describe('daemon-init: runRestartDaemon (7-step sequence)', () => {
   })
 
   it('surfaces non-ESRCH startup termination errors and releases IPC', async () => {
-    const signalError = Object.assign(new Error('operation not permitted'), { code: 'EPERM' })
+    const signalError = Object.assign(new Error('operation not permitted'), {
+      code: 'EPERM'
+    })
     const kill = vi.spyOn(process, 'kill').mockImplementation(() => {
       throw signalError
     })
@@ -2119,7 +2468,9 @@ describe('daemon-init: runRestartDaemon (7-step sequence)', () => {
 
       expect(error).toBeInstanceOf(AggregateError)
       expect((error as AggregateError).errors).toEqual([
-        expect.objectContaining({ message: 'Daemon readiness identity is incomplete' }),
+        expect.objectContaining({
+          message: 'Daemon readiness identity is incomplete'
+        }),
         signalError
       ])
       expect(child.disconnect).toHaveBeenCalledOnce()
@@ -2174,8 +2525,12 @@ describe('daemon-init: runRestartDaemon (7-step sequence)', () => {
 
       expect(error).toBeInstanceOf(AggregateError)
       expect((error as AggregateError).errors).toEqual([
-        expect.objectContaining({ message: 'Daemon readiness identity is incomplete' }),
-        expect.objectContaining({ message: 'Daemon did not exit after SIGKILL' })
+        expect.objectContaining({
+          message: 'Daemon readiness identity is incomplete'
+        }),
+        expect.objectContaining({
+          message: 'Daemon did not exit after SIGKILL'
+        })
       ])
       expect(kill).toHaveBeenNthCalledWith(1, 12345, 'SIGTERM')
       expect(kill).toHaveBeenNthCalledWith(2, 12345, 'SIGKILL')
@@ -2190,7 +2545,7 @@ describe('daemon-init: runRestartDaemon (7-step sequence)', () => {
     }
   })
 
-  it('kills and rejects a daemon when exclusive PID publication fails', async () => {
+  it('leaves exclusive PID publication to the daemon child', async () => {
     const mod = await importFresh()
     checkDaemonHealthMock.mockResolvedValue('unreachable')
     await mod.initDaemonPtyProvider()
@@ -2199,9 +2554,6 @@ describe('daemon-init: runRestartDaemon (7-step sequence)', () => {
       socketPath: string,
       tokenPath: string
     ) => Promise<{ shutdown(): Promise<void> }>
-    const kill = vi.spyOn(process, 'kill').mockImplementation(() => {
-      throw Object.assign(new Error('already exited'), { code: 'ESRCH' })
-    })
     const child = {
       pid: 12345,
       on(event: string, cb: (arg?: unknown) => void) {
@@ -2214,27 +2566,23 @@ describe('daemon-init: runRestartDaemon (7-step sequence)', () => {
       disconnect: vi.fn(),
       unref: vi.fn()
     }
-    const publicationError = Object.assign(new Error('PID record already exists'), {
-      code: 'EEXIST'
-    })
-    writeFileSyncMock.mockImplementationOnce(() => {
-      throw publicationError
-    })
     forkMock.mockReturnValueOnce(child)
 
-    try {
-      await expect(launcher('/fake/socket', '/fake/token')).rejects.toBe(publicationError)
-      expect(writeFileSyncMock).toHaveBeenCalledWith(
+    await launcher('/fake/socket', '/fake/token')
+
+    expect(writeFileSyncMock).not.toHaveBeenCalled()
+    expect(forkMock.mock.calls.at(-1)?.[1]).toEqual(
+      expect.arrayContaining([
+        '--pid-record',
         `/fake/daemon/daemon-v${PROTOCOL_VERSION}.pid`,
-        expect.any(String),
-        { mode: 0o600, flag: 'wx' }
-      )
-      expect(kill).toHaveBeenCalledWith(12345, 'SIGTERM')
-      expect(child.disconnect).not.toHaveBeenCalled()
-      expect(child.unref).toHaveBeenCalledOnce()
-    } finally {
-      kill.mockRestore()
-    }
+        '--entry-path',
+        FAKE_DAEMON_ENTRY_PATH,
+        '--app-version',
+        '1.2.3',
+        '--spawner-exec-path',
+        process.execPath
+      ])
+    )
   })
 
   it('removes detached daemon startup listeners after startup error', async () => {
@@ -2289,7 +2637,9 @@ describe('daemon-init: runRestartDaemon (7-step sequence)', () => {
 
     const launcher = spawnerInstances[0].launcher as (
       socketPath: string,
-      tokenPath: string
+      tokenPath: string,
+      pidPath?: string,
+      launchNonce?: string
     ) => Promise<{ shutdown(): Promise<void> }>
     const handlers: Record<string, ((arg?: unknown) => void)[]> = {
       message: [],
@@ -2343,11 +2693,21 @@ describe('daemon-init: runRestartDaemon (7-step sequence)', () => {
     }
     forkMock.mockReturnValueOnce(child)
 
-    const error = await launcher('/fake/socket', '/fake/token').catch((err: Error) => err)
+    const error = await launcher(
+      '/fake/socket',
+      '/fake/token',
+      '/fake/daemon.pid',
+      'failed-launch'
+    ).catch((err: Error) => err)
 
     expect(error).toBeInstanceOf(Error)
     expect((error as Error).message).toMatch(/Cannot find module 'electron'/)
     expect((error as Error).message).toMatch(/Daemon stderr \(tail\)/)
+    expect(unlinkOwnedDaemonPidFileMock).toHaveBeenCalledWith(
+      '/fake/daemon.pid',
+      4321,
+      'failed-launch'
+    )
     // Why: release the piped stderr so the detached daemon can't keep the parent event loop alive after failure.
     expect(stderrDestroy).toHaveBeenCalled()
   })
@@ -2463,7 +2823,10 @@ describe('daemon-init: runRestartDaemon (7-step sequence)', () => {
     const launcher = spawnerInstances[0].launcher as (
       socketPath: string,
       tokenPath: string
-    ) => Promise<{ mode?: 'degraded-new-pty-fallback'; shutdown(): Promise<void> }>
+    ) => Promise<{
+      mode?: 'degraded-new-pty-fallback'
+      shutdown(): Promise<void>
+    }>
     checkDaemonHealthMock.mockResolvedValueOnce('pty-spawn-unhealthy')
 
     const handle = await launcher('/fake/socket', '/fake/token')
@@ -2616,7 +2979,9 @@ describe('daemon-init: runRestartDaemon (7-step sequence)', () => {
     daemonClientMock.mockImplementationOnce(function MockDaemonClient() {
       return {
         ensureConnected: vi.fn(async () => {}),
-        request: vi.fn(async () => ({ sessions: [{ sessionId: 'wt-1@@live', isAlive: true }] })),
+        request: vi.fn(async () => ({
+          sessions: [{ sessionId: 'wt-1@@live', isAlive: true }]
+        })),
         disconnect: vi.fn()
       }
     })
@@ -2657,6 +3022,7 @@ describe('daemon-init: runRestartDaemon (7-step sequence)', () => {
             throw new Error('Hello response timed out')
           }
         }),
+        getDaemonIdentity: vi.fn(readLaunchedDaemonIdentity),
         request: vi.fn(),
         disconnect: vi.fn()
       }
@@ -2834,8 +3200,7 @@ describe('daemon-init: runRestartDaemon (7-step sequence)', () => {
     expect(forkMock).not.toHaveBeenCalled()
   })
 
-  it('writes the daemon self-reported start time to the pid file when the OS query returns null', async () => {
-    // Why: getProcessStartedAtMs has no cheap Windows impl, so the pid-recycling guard uses the ready-message fallback.
+  it('accepts the daemon self-reported start time when the OS query returns null', async () => {
     const mod = await importFresh()
     await mod.initDaemonPtyProvider()
 
@@ -2845,6 +3210,7 @@ describe('daemon-init: runRestartDaemon (7-step sequence)', () => {
     ) => Promise<{ shutdown(): Promise<void> }>
     checkDaemonHealthMock.mockResolvedValueOnce('unreachable')
     getProcessStartedAtMsMock.mockReturnValue(null)
+    launchedStartedAtMs.current = 1_700_000_123_456
     forkMock.mockImplementationOnce(() => ({
       pid: 12345,
       on(event: string, cb: (arg?: unknown) => void) {
@@ -2862,17 +3228,7 @@ describe('daemon-init: runRestartDaemon (7-step sequence)', () => {
 
     await launcher('/fake/socket', '/fake/token')
 
-    const [pidPath, pidContents, pidOptions] = writeFileSyncMock.mock.calls.at(-1) ?? []
-    expect(pidPath).toBe(`/fake/daemon/daemon-v${PROTOCOL_VERSION}.pid`)
-    expect(JSON.parse(pidContents as string)).toEqual({
-      pid: 12345,
-      startedAtMs: 1_700_000_123_456,
-      entryPath: FAKE_DAEMON_ENTRY_PATH,
-      appVersion: '1.2.3',
-      launchNonce: expect.stringMatching(/^[0-9a-f-]{36}$/),
-      spawnerExecPath: process.execPath
-    })
-    expect(pidOptions).toEqual({ mode: 0o600, flag: 'wx' })
+    expect(writeFileSyncMock).not.toHaveBeenCalled()
   })
 
   it('keeps legacy daemon pid/token files when the probe fails but the pid-file process is alive', async () => {
@@ -2880,7 +3236,10 @@ describe('daemon-init: runRestartDaemon (7-step sequence)', () => {
     const mod = await importFresh()
     readFileSyncMock.mockReturnValue('{"pid":123}')
     // process.pid is guaranteed alive, so the liveness probe succeeds.
-    parseDaemonPidFileMock.mockReturnValue({ pid: process.pid, startedAtMs: null })
+    parseDaemonPidFileMock.mockReturnValue({
+      pid: process.pid,
+      startedAtMs: null
+    })
 
     await mod.initDaemonPtyProvider()
 
diff --git a/src/main/daemon/daemon-init.ts b/src/main/daemon/daemon-init.ts
index 71a1cfcb181..13682828838 100644
--- a/src/main/daemon/daemon-init.ts
+++ b/src/main/daemon/daemon-init.ts
@@ -3,7 +3,7 @@ restart, teardown); the "swap the provider atomically" invariant keeps restart +
 import { join } from 'node:path'
 import { randomUUID } from 'node:crypto'
 import { app } from 'electron'
-import { mkdirSync, existsSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs'
+import { mkdirSync, existsSync, readFileSync, unlinkSync } from 'node:fs'
 import { fork, type ChildProcess } from 'node:child_process'
 import { connect } from 'node:net'
 import {
@@ -11,11 +11,13 @@ import {
   getDaemonPidPath,
   getDaemonSocketPath,
   getDaemonTokenPath,
-  serializeDaemonPidFile,
+  replaceDaemonPidFile,
   unlinkOwnedDaemonPidFile,
   type DaemonLauncher,
+  type DaemonPidFile,
   type DaemonProcessHandle
 } from './daemon-spawner'
+import { sweepAbandonedDaemonClaims } from './daemon-endpoint-ownership'
 import { DaemonPtyAdapter, type DaemonRespawnReason } from './daemon-pty-adapter'
 import { DaemonPtyRouter } from './daemon-pty-router'
 import { DaemonClient } from './client'
@@ -55,12 +57,16 @@ import {
   confirmSeededClaudeLivePtys,
   hasSeededUnconfirmedClaudePtys
 } from '../claude-accounts/live-pty-gate'
-import { parseDaemonReadyIdentity } from './daemon-ready-identity'
+import { parseDaemonReadyIdentity, readDaemonProcessIncarnation } from './daemon-ready-identity'
+import type { DaemonEndpointIdentity } from './daemon-hello-protocol'
 
 // Why: daemon init runs concurrent with window load, so an in-process t timestamp (not harness stderr timing) measures cold-start.
 function logDaemonMilestone(event: string, details: Record<string, unknown> = {}): void {
   if (isStartupDiagnosticsEnabled()) {
-    logStartupDiagnostic(event, { t: Math.round(performance.now()), ...details })
+    logStartupDiagnostic(event, {
+      t: Math.round(performance.now()),
+      ...details
+    })
   }
 }
 
@@ -70,6 +76,24 @@ const DAEMON_SELF_SHUTDOWN_WAIT_MS = 5_000
 const DAEMON_CHILD_TERMINATION_GRACE_MS = 5_000
 const DAEMON_CHILD_FORCE_EXIT_WAIT_MS = 1_000
 
+class DaemonEndpointOwnershipError extends Error {}
+
+/**
+ * The one method the ownership checks need from a connected client.
+ *
+ * Why: naming the capability instead of casting DaemonClient to Partial keeps a rename from
+ * silently turning the fence into a no-op — the compiler now rejects a client without it.
+ */
+type DaemonEndpointIdentityReader = {
+  getDaemonIdentity?: () => DaemonEndpointIdentity | null
+}
+
+function readDaemonEndpointIdentity(
+  client: DaemonEndpointIdentityReader
+): DaemonEndpointIdentity | null {
+  return client.getDaemonIdentity?.() ?? null
+}
+
 let spawner: DaemonSpawner | null = null
 type DaemonProvider = DaemonPtyRouter | DaemonPtyAdapter | DegradedDaemonPtyProvider
 
@@ -186,11 +210,25 @@ async function holdDaemonAdoptionLease(
   handle: DaemonProcessHandle,
   socketPath: string,
   tokenPath: string,
-  connectedClient?: DaemonClient
+  connectedClient?: DaemonClient,
+  expectedIdentity?: DaemonEndpointIdentity,
+  pidPath?: string
 ): Promise<DaemonProcessHandle> {
   const client = connectedClient ?? new DaemonClient({ socketPath, tokenPath })
   try {
     await client.ensureConnected()
+    if (expectedIdentity) {
+      const actualIdentity = readDaemonEndpointIdentity(client)
+      if (
+        !actualIdentity ||
+        actualIdentity.pid !== expectedIdentity.pid ||
+        actualIdentity.startedAtMs !== expectedIdentity.startedAtMs ||
+        actualIdentity.launchNonce !== expectedIdentity.launchNonce
+      ) {
+        throw new DaemonEndpointOwnershipError('Daemon endpoint ownership changed during startup')
+      }
+    }
+    await reconcileDaemonPidOwnership(client, pidPath)
   } catch (error) {
     client.disconnect()
     throw error
@@ -199,6 +237,79 @@ async function holdDaemonAdoptionLease(
   return handle
 }
 
+async function reconcileDaemonPidOwnership(
+  client: DaemonEndpointIdentityReader,
+  pidPath?: string
+): Promise<void> {
+  const endpointIdentity = readDaemonEndpointIdentity(client)
+  if (!pidPath || !endpointIdentity || pidRecordMatchesEndpoint(pidPath, endpointIdentity)) {
+    return
+  }
+  // Why: the mismatched record's metadata describes a different daemon and must not be copied
+  // onto this one. Re-derive it from the authenticated owner instead, so the repaired record
+  // keeps the fields freshness, host pinning and pid-recycle detection depend on.
+  const { pid, startedAtMs, launchNonce } = endpointIdentity
+  const ownerMetadata = await readDaemonOwnerMetadata(endpointIdentity)
+  if (!replaceDaemonPidFile(pidPath, { pid, startedAtMs, launchNonce, ...ownerMetadata })) {
+    // Why: fail open. A record that disagrees with the endpoint is a diagnosable nuisance;
+    // abandoning a healthy adoptable daemon over a failed file write costs the user every
+    // persistent terminal on the machine.
+    console.warn(
+      '[daemon] Could not repair daemon PID ownership; adopting the authenticated endpoint anyway'
+    )
+    return
+  }
+  console.warn('[daemon] Repaired daemon PID ownership to match the authenticated endpoint')
+}
+
+/**
+ * Recovers the owning daemon's launch metadata.
+ *
+ * Why: `entryPath`/`appVersion` gate bundle-freshness and (on Windows) which relocated daemon
+ * host directories are pinned against pruning, and the Linux pair gates pid-recycle detection.
+ * Publishing a repaired record without them makes a healthy daemon look permanently stale.
+ * The values come from the authenticated hello rather than the owner's command line: a command
+ * line is a single space-joined string, so any install path containing a space (`C:\Program
+ * Files\...`, `/Applications/Orca 2.app/...`) cannot be split back into argv unambiguously.
+ */
+async function readDaemonOwnerMetadata(
+  identity: DaemonEndpointIdentity
+): Promise<Partial<DaemonPidFile>> {
+  const metadata: Partial<DaemonPidFile> = {}
+  if (identity.entryPath) {
+    metadata.entryPath = identity.entryPath
+  }
+  if (identity.appVersion) {
+    metadata.appVersion = identity.appVersion
+  }
+  if (identity.spawnerExecPath) {
+    metadata.spawnerExecPath = identity.spawnerExecPath
+  }
+  const incarnation = await readDaemonProcessIncarnation(identity.pid)
+  if (incarnation) {
+    metadata.linuxStartTicks = incarnation.linuxStartTicks
+    metadata.bootId = incarnation.bootId
+  }
+  return metadata
+}
+
+function pidRecordMatchesEndpoint(pidPath: string, identity: DaemonEndpointIdentity): boolean {
+  try {
+    const record = JSON.parse(readFileSync(pidPath, 'utf8')) as {
+      pid?: unknown
+      startedAtMs?: unknown
+      launchNonce?: unknown
+    }
+    return (
+      record.pid === identity.pid &&
+      record.startedAtMs === identity.startedAtMs &&
+      record.launchNonce === identity.launchNonce
+    )
+  } catch {
+    return false
+  }
+}
+
 function releaseDaemonAdoptionLease(handle: DaemonProcessHandle | null): void {
   takeDaemonAdoptionLeaseRelease(handle)?.()
 }
@@ -352,10 +463,14 @@ function createOutOfProcessLauncher(
         }
       | undefined
     let confirmedReplacement = false
-    let adoptionClient: DaemonClient | null = new DaemonClient({ socketPath, tokenPath })
+    let adoptionClient: DaemonClient | null = new DaemonClient({
+      socketPath,
+      tokenPath
+    })
     try {
       // Why: acquire the full pair before control-only probes so an expired inherited deadline can't fire in the probe-to-adoption gap.
       await adoptionClient.ensureConnected()
+      await reconcileDaemonPidOwnership(adoptionClient, pidPath)
     } catch {
       adoptionClient.disconnect()
       adoptionClient = null
@@ -369,7 +484,9 @@ function createOutOfProcessLauncher(
         createPreservedDaemonHandle(runtimeDir, PROTOCOL_VERSION, mode),
         socketPath,
         tokenPath,
-        connectedClient
+        connectedClient,
+        undefined,
+        pidPath
       )
     }
     try {
@@ -387,7 +504,10 @@ function createOutOfProcessLauncher(
             return preserveDaemon()
           }
           console.warn('[daemon] Replacing daemon with unavailable macOS system resolver')
-          pendingReplacement = { reason: 'unhealthy_resolver', liveSessionCount }
+          pendingReplacement = {
+            reason: 'unhealthy_resolver',
+            liveSessionCount
+          }
           confirmedReplacement = (await cleanupDaemonForProtocol(runtimeDir, PROTOCOL_VERSION))
             .cleaned
         } else {
@@ -495,14 +615,34 @@ function createOutOfProcessLauncher(
         }
         // Why: unlike the log above, telemetry gates on confirmedReplacement below — the
         // post-kill truth — so a cold start that killed nothing never reports a replacement.
-        pendingReplacement = { reason: 'failed_health_check', liveSessionCount }
+        pendingReplacement = {
+          reason: 'failed_health_check',
+          liveSessionCount
+        }
       }
 
       // Why: a raw socket can outlive a broken daemon; kill by PID before respawn so the new daemon doesn't race the stale one.
       adoptionClient?.disconnect()
       adoptionClient = null
-      confirmedReplacement =
-        (await killStaleDaemon(runtimeDir, socketPath, tokenPath)) || confirmedReplacement
+      const killOutcome = await killStaleDaemon(runtimeDir, socketPath, tokenPath)
+      if (killOutcome.liveOwnerSurvived) {
+        // Why: forking beside a daemon we could not prove dead is precisely how the endpoint
+        // owner and the session host diverge. But refusing outright would leave the user with
+        // no daemon at all, and we have just proved something still answers the endpoint —
+        // so adopt it in degraded mode: existing sessions keep working, new PTYs run locally.
+        console.warn(
+          '[daemon] DEGRADED MODE: adopting a daemon that could not be confirmed stopped. Existing sessions keep working; fresh terminals run on the local provider WITHOUT daemon persistence until you restart the daemon (Manage Sessions → Restart).'
+        )
+        try {
+          return await preserveDaemon('degraded-new-pty-fallback')
+        } catch {
+          // It died between the probe and the adoption; the endpoint is genuinely free now.
+          throw new DaemonEndpointOwnershipError(
+            'Daemon replacement aborted: the existing daemon could not be confirmed stopped'
+          )
+        }
+      }
+      confirmedReplacement = killOutcome.killed || confirmedReplacement
       // Why: rank by how well each reason is evidenced. A confirmed kill whose reason positively
       // identified the daemon outranks the attribution, so a stale bundle caught here is not billed
       // to the resolver. failed_health_check is the residual "couldn't tell" bucket though — it also
@@ -539,6 +679,12 @@ function createOutOfProcessLauncher(
           pidPath,
           '--launch-nonce',
           launchNonce,
+          '--entry-path',
+          entryPath,
+          '--app-version',
+          app.getVersion(),
+          '--spawner-exec-path',
+          process.execPath,
           ...(macosLoginSessionWatch ? ['--login-session-watch'] : []),
           ...daemonLogArgs()
         ],
@@ -582,6 +728,7 @@ function createOutOfProcessLauncher(
       }
 
       // Wait for the daemon to signal readiness via IPC
+      let launchedIdentity: DaemonEndpointIdentity | null = null
       await new Promise<void>((resolve, reject) => {
         let timer: ReturnType<typeof setTimeout> | undefined
         let settled = false
@@ -619,6 +766,9 @@ function createOutOfProcessLauncher(
             )
             return
           }
+          if (Number.isSafeInteger(child.pid) && (child.pid as number) > 0) {
+            unlinkOwnedDaemonPidFile(pidPath, child.pid as number, launchNonce)
+          }
           reject(startupError)
         }
         function onReadyMessage(msg: unknown): void {
@@ -631,25 +781,10 @@ function createOutOfProcessLauncher(
               void fail(new Error('Daemon readiness identity is incomplete'))
               return
             }
-            try {
-              // Why: pid record shares the daemon's self time and nonce so cleanup can identify this exact process incarnation.
-              writeFileSync(
-                pidPath,
-                serializeDaemonPidFile({
-                  pid: child.pid as number,
-                  ...readyIdentity,
-                  entryPath,
-                  appVersion: app.getVersion(),
-                  launchNonce,
-                  // Why: macOS pins the daemon's TCC responsible process to this binary;
-                  // adoption re-checks it still exists so severed grants are detectable.
-                  spawnerExecPath: process.execPath
-                }),
-                { mode: 0o600, flag: 'wx' }
-              )
-            } catch (error) {
-              void fail(error instanceof Error ? error : new Error(String(error)))
-              return
+            launchedIdentity = {
+              pid: child.pid as number,
+              ...readyIdentity,
+              launchNonce
             }
             settled = true
             // Why: daemon is detached after readiness; detach startup listeners so the launch promise closure isn't retained.
@@ -680,14 +815,25 @@ function createOutOfProcessLauncher(
       })
 
       try {
+        if (!launchedIdentity) {
+          throw new Error('Daemon readiness identity is incomplete')
+        }
         return await holdDaemonAdoptionLease(
           {
             shutdown: () => terminateLaunchedDaemonChild(child)
           },
           socketPath,
-          tokenPath
+          tokenPath,
+          undefined,
+          launchedIdentity,
+          pidPath
         )
       } catch (error) {
+        if (error instanceof DaemonEndpointOwnershipError) {
+          await terminateLaunchedDaemonChild(child)
+          unlinkOwnedDaemonPidFile(pidPath, child.pid as number, launchNonce)
+          throw error
+        }
         // Why: another client may have adopted this live process; keep its pid record until exit, but remove one published after an early exit.
         let pidRecordRemoved = false
         const removeExitedPidRecord = (): void => {
@@ -726,6 +872,11 @@ export async function initDaemonPtyProvider(
   }
   const runtimeDir = getRuntimeDir()
 
+  // Why: rename-claim and bind scratch names are unlinked by their owner, but a failed unlink
+  // leaves one behind forever. Sweep before launching so a failed launch is still reclaimed;
+  // age-gated so a claim still in flight is never disturbed.
+  sweepAbandonedDaemonClaims(runtimeDir)
+
   const newSpawner = new DaemonSpawner({
     runtimeDir,
     launcher: createOutOfProcessLauncher(runtimeDir, options.macosLoginSessionWatch ?? false)
@@ -825,7 +976,9 @@ export async function initDaemonPtyProvider(
   setLocalPtyProvider(routedAdapter)
   // Why: the first window may register PTY listeners before daemon init finishes; rebind so daemon PTYs still fan out events.
   rebindLocalProviderListeners()
-  logDaemonMilestone('daemon-init-done', { legacyAdapters: legacyAdapters.length })
+  logDaemonMilestone('daemon-init-done', {
+    legacyAdapters: legacyAdapters.length
+  })
   await reconcileSeededClaudeLivePtys(routedAdapter)
 }
 
@@ -1124,7 +1277,8 @@ export async function cleanupDaemonForProtocol(
     didRequestShutdown = true
   } catch {
     // Previous-protocol daemons may be wedged or too old for the RPC path; fall back to PID cleanup (only unlinks a live socket after proving the process is killed).
-    didKillStaleDaemon = await killStaleDaemon(runtimeDir, socketPath, tokenPath, protocolVersion)
+    didKillStaleDaemon = (await killStaleDaemon(runtimeDir, socketPath, tokenPath, protocolVersion))
+      .killed
   } finally {
     client.disconnect()
   }
diff --git a/src/main/daemon/daemon-main.ts b/src/main/daemon/daemon-main.ts
index 3976c6c21e6..63e763474bc 100644
--- a/src/main/daemon/daemon-main.ts
+++ b/src/main/daemon/daemon-main.ts
@@ -7,6 +7,10 @@ export type DaemonStartOptions = {
   pidPath?: string
   launchNonce?: string
   startedAtMs?: number
+  publishEndpointOwnership?: DaemonServerOptions['publishEndpointOwnership']
+  entryPath?: string
+  appVersion?: string
+  spawnerExecPath?: string
   /** Direct-construction seam for versioned protocol fixtures; never CLI/env configured. */
   protocolVersion?: number
   spawnSubprocess: DaemonServerOptions['spawnSubprocess']
@@ -15,6 +19,7 @@ export type DaemonStartOptions = {
   onAuthenticatedClientPair?: DaemonServerOptions['onAuthenticatedClientPair']
   log?: DaemonFileLog
   onIdleShutdown?: () => void
+  onRpcShutdown?: () => void
   initialAdoptionTestConfig?: DaemonServerOptions['initialAdoptionTestConfig']
 }
 
@@ -29,6 +34,12 @@ export async function startDaemon(opts: DaemonStartOptions): Promise<DaemonHandl
     ...(opts.pidPath ? { pidPath: opts.pidPath } : {}),
     ...(opts.launchNonce ? { launchNonce: opts.launchNonce } : {}),
     ...(opts.startedAtMs ? { startedAtMs: opts.startedAtMs } : {}),
+    ...(opts.publishEndpointOwnership
+      ? { publishEndpointOwnership: opts.publishEndpointOwnership }
+      : {}),
+    ...(opts.entryPath ? { entryPath: opts.entryPath } : {}),
+    ...(opts.appVersion ? { appVersion: opts.appVersion } : {}),
+    ...(opts.spawnerExecPath ? { spawnerExecPath: opts.spawnerExecPath } : {}),
     ...(opts.protocolVersion !== undefined ? { protocolVersion: opts.protocolVersion } : {}),
     spawnSubprocess: opts.spawnSubprocess,
     ...(opts.preparePtySpawn ? { preparePtySpawn: opts.preparePtySpawn } : {}),
@@ -38,6 +49,7 @@ export async function startDaemon(opts: DaemonStartOptions): Promise<DaemonHandl
       : {}),
     ...(opts.log ? { log: opts.log } : {}),
     ...(opts.onIdleShutdown ? { onIdleShutdown: opts.onIdleShutdown } : {}),
+    ...(opts.onRpcShutdown ? { onRpcShutdown: opts.onRpcShutdown } : {}),
     ...(opts.initialAdoptionTestConfig
       ? { initialAdoptionTestConfig: opts.initialAdoptionTestConfig }
       : {})
diff --git a/src/main/daemon/daemon-pty-adapter-subscription-fanout.ts b/src/main/daemon/daemon-pty-adapter-subscription-fanout.ts
index e4855640ada..1d82ef70b7b 100644
--- a/src/main/daemon/daemon-pty-adapter-subscription-fanout.ts
+++ b/src/main/daemon/daemon-pty-adapter-subscription-fanout.ts
@@ -10,7 +10,8 @@ export class DaemonPtyAdapterSubscriptionFanout {
 
   constructor(
     private readonly adapters: readonly DaemonPtyAdapter[],
-    onAdapterExit: (id: string) => void
+    onAdapterExit: (id: string) => void,
+    onAdapterIdentityChanged?: (adapter: DaemonPtyAdapter) => void
   ) {
     for (const adapter of adapters) {
       this.unsubscribers.push(
@@ -24,7 +25,10 @@ export class DaemonPtyAdapterSubscriptionFanout {
           for (const listener of this.exitListeners) {
             listener(payload)
           }
-        })
+        }),
+        ...(onAdapterIdentityChanged && typeof adapter.onDaemonIdentityChanged === 'function'
+          ? [adapter.onDaemonIdentityChanged(() => onAdapterIdentityChanged(adapter))]
+          : [])
       )
     }
   }
diff --git a/src/main/daemon/daemon-pty-liveness-probe.ts b/src/main/daemon/daemon-pty-liveness-probe.ts
deleted file mode 100644
index ba2c448bbd2..00000000000
--- a/src/main/daemon/daemon-pty-liveness-probe.ts
+++ /dev/null
@@ -1,20 +0,0 @@
-import type { IPtyProvider } from '../providers/types'
-import type { DaemonPtyAdapter } from './daemon-pty-adapter'
-
-export async function probePtyOwners(
-  id: string,
-  routed: IPtyProvider | undefined,
-  possibleOwners: readonly DaemonPtyAdapter[]
-): Promise<boolean | null> {
-  if (routed) {
-    return routed.probePtyLiveness
-      ? await routed.probePtyLiveness(id)
-      : (routed.hasPty?.(id) ?? null)
-  }
-  const results = await Promise.all(possibleOwners.map((provider) => provider.probePtyLiveness(id)))
-  return results.some((result) => result === true)
-    ? true
-    : results.every((result) => result === false)
-      ? false
-      : null
-}
diff --git a/src/main/daemon/daemon-pty-router.test.ts b/src/main/daemon/daemon-pty-router.test.ts
index 2bee5164ce9..1930224c2d5 100644
--- a/src/main/daemon/daemon-pty-router.test.ts
+++ b/src/main/daemon/daemon-pty-router.test.ts
@@ -1,5 +1,6 @@
 import { describe, expect, it, vi } from 'vitest'
 import { DaemonPtyRouter } from './daemon-pty-router'
+import { SessionNotFoundError, TerminalSessionOwnerUnverifiedError } from './daemon-errors'
 import type { DaemonPtyAdapter } from './daemon-pty-adapter'
 import type { PtyBackgroundStreamEvent, PtySpawnOptions, PtySpawnResult } from '../providers/types'
 import {
@@ -18,6 +19,7 @@ type AdapterMock = DaemonPtyAdapter & {
   emitData: (id: string, data: string, sequenceChars?: number) => void
   emitBackground: (event: PtyBackgroundStreamEvent) => void
   emitExit: (id: string, code: number, incarnationId?: string) => void
+  emitIdentityChange: () => void
   triggerWriteUnavailable: (id: string) => void
 }
 
@@ -44,6 +46,7 @@ function createAdapter(
   const writeUnavailableListeners: ((payload: { id: string }) => void)[] = []
   const exitListeners: ((payload: { id: string; code: number; incarnationId?: string }) => void)[] =
     []
+  const identityChangeListeners: (() => void)[] = []
   return {
     protocolVersion,
     supportsGitCredentialGuardHost: () =>
@@ -136,6 +139,15 @@ function createAdapter(
         }
       }
     ),
+    onDaemonIdentityChanged: vi.fn((callback: () => void) => {
+      identityChangeListeners.push(callback)
+      return () => {
+        const idx = identityChangeListeners.indexOf(callback)
+        if (idx !== -1) {
+          identityChangeListeners.splice(idx, 1)
+        }
+      }
+    }),
     ackColdRestore: vi.fn(),
     clearTombstone: vi.fn(),
     reconcileOnStartup: vi.fn(async () => reconcileResult ?? { alive: sessions, killed: [] }),
@@ -156,6 +168,7 @@ function createAdapter(
         listener({ id, code, ...(incarnationId ? { incarnationId } : {}) })
       }
     },
+    emitIdentityChange: () => identityChangeListeners.forEach((listener) => listener()),
     triggerWriteUnavailable: (id: string) => {
       for (const listener of writeUnavailableListeners) {
         listener({ id })
@@ -498,14 +511,16 @@ describe('DaemonPtyRouter', () => {
     expect(current.hasPty).not.toHaveBeenCalledWith('legacy-session')
   })
 
-  it('probes every possible daemon owner for an unmapped session', async () => {
+  it('discovers an unmapped live session from one coalesced inventory', async () => {
     const current = createAdapter('current')
     const legacy = createAdapter('legacy', ['surviving-session'])
     const router = new DaemonPtyRouter({ current, legacy: [legacy] })
 
     await expect(router.probePtyLiveness('surviving-session')).resolves.toBe(true)
-    expect(current.probePtyLiveness).toHaveBeenCalledExactlyOnceWith('surviving-session')
-    expect(legacy.probePtyLiveness).toHaveBeenCalledExactlyOnceWith('surviving-session')
+    expect(current.listProcesses).toHaveBeenCalledOnce()
+    expect(legacy.listProcesses).toHaveBeenCalledOnce()
+    expect(current.probePtyLiveness).not.toHaveBeenCalled()
+    expect(legacy.probePtyLiveness).not.toHaveBeenCalled()
   })
 
   it('does not report absence while any possible daemon owner is unavailable', async () => {
@@ -517,6 +532,102 @@ describe('DaemonPtyRouter', () => {
     await expect(router.probePtyLiveness('unknown-session')).resolves.toBeNull()
   })
 
+  it('routes an attach to a legacy session created after startup inventory', async () => {
+    const current = createAdapter('current')
+    const legacySessions = ['legacy-at-startup']
+    const legacy = createAdapter('legacy', legacySessions)
+    const router = new DaemonPtyRouter({ current, legacy: [legacy] })
+    await router.discoverLegacySessions()
+    legacySessions.push('legacy-created-later')
+
+    await router.spawn({
+      sessionId: 'legacy-created-later',
+      attachOnly: true,
+      cols: 80,
+      rows: 24
+    })
+
+    expect(legacy.spawn).toHaveBeenCalledExactlyOnceWith({
+      sessionId: 'legacy-created-later',
+      attachOnly: true,
+      cols: 80,
+      rows: 24
+    })
+    expect(current.spawn).not.toHaveBeenCalled()
+  })
+
+  it('still routes probes for a discovered session to its owning legacy daemon', async () => {
+    const current = createAdapter('current')
+    const legacy = createAdapter('legacy', ['legacy-session'])
+    const router = new DaemonPtyRouter({ current, legacy: [legacy] })
+    await router.discoverLegacySessions()
+
+    await expect(router.probePtyLiveness('legacy-session')).resolves.toBe(true)
+    expect(legacy.probePtyLiveness).toHaveBeenCalledExactlyOnceWith('legacy-session')
+  })
+
+  it('keeps consulting a legacy daemon whose inventory listing failed', async () => {
+    const current = createAdapter('current')
+    const legacy = createAdapter('legacy', ['legacy-session'])
+    vi.mocked(legacy.listProcesses).mockRejectedValue(new Error('wedged'))
+    vi.mocked(legacy.probePtyLiveness).mockResolvedValue(null)
+    const router = new DaemonPtyRouter({ current, legacy: [legacy] })
+    await router.discoverLegacySessions()
+
+    // Without an inventory nothing proves the legacy daemon doesn't own this id.
+    await expect(router.probePtyLiveness('unknown-session')).resolves.toBeNull()
+    expect(legacy.listProcesses).toHaveBeenCalledTimes(2)
+    expect(legacy.probePtyLiveness).not.toHaveBeenCalled()
+  })
+
+  it('keeps an attach unresolved when any possible owner inventory fails', async () => {
+    const current = createAdapter('current')
+    const legacy = createAdapter('legacy')
+    const router = new DaemonPtyRouter({ current, legacy: [legacy] })
+    vi.mocked(legacy.listProcesses).mockRejectedValue(new Error('wedged'))
+
+    await expect(
+      router.spawn({ sessionId: 'unknown-session', attachOnly: true, cols: 80, rows: 24 })
+    ).rejects.toBeInstanceOf(TerminalSessionOwnerUnverifiedError)
+    expect(current.spawn).not.toHaveBeenCalled()
+    expect(legacy.spawn).not.toHaveBeenCalled()
+  })
+
+  it('re-resolves a stale positive route before declaring an owner absent', async () => {
+    const current = createAdapter('current')
+    const firstSessions = ['moved-session']
+    const secondSessions: string[] = []
+    const first = createAdapter('first', firstSessions)
+    const second = createAdapter('second', secondSessions)
+    const router = new DaemonPtyRouter({ current, legacy: [first, second] })
+    await router.discoverLegacySessions()
+    firstSessions.length = 0
+    secondSessions.push('moved-session')
+    vi.mocked(first.spawn).mockRejectedValueOnce(new SessionNotFoundError('moved-session'))
+
+    await router.spawn({ sessionId: 'moved-session', attachOnly: true, cols: 80, rows: 24 })
+
+    expect(first.spawn).toHaveBeenCalledOnce()
+    expect(second.spawn).toHaveBeenCalledOnce()
+  })
+
+  it('invalidates positive routes when a daemon endpoint identity changes', async () => {
+    const currentSessions: string[] = []
+    const legacySessions = ['moved-session']
+    const current = createAdapter('current', currentSessions)
+    const legacy = createAdapter('legacy', legacySessions)
+    const router = new DaemonPtyRouter({ current, legacy: [legacy] })
+    await router.discoverLegacySessions()
+    legacySessions.length = 0
+    currentSessions.push('moved-session')
+
+    legacy.emitIdentityChange()
+    await router.spawn({ sessionId: 'moved-session', attachOnly: true, cols: 80, rows: 24 })
+
+    expect(current.spawn).toHaveBeenCalledOnce()
+    expect(legacy.spawn).not.toHaveBeenCalled()
+  })
+
   it('hands a checkpointed pre-v30 session to the current daemon on wake', async () => {
     const current = createAdapter('current', [], undefined, HISTORY_SEED_TRANSFER_PROTOCOL_VERSION)
     const legacy = createAdapter(
@@ -582,7 +693,7 @@ describe('DaemonPtyRouter', () => {
     await expect(router.listProcesses()).rejects.toThrow('legacy exited')
     await expect(router.listProcesses()).rejects.toThrow('legacy exited')
     expect(router.getLegacyAdapters()).toEqual([legacy])
-    expect(current.listProcesses).toHaveBeenCalledTimes(2)
+    expect(current.listProcesses).toHaveBeenCalledTimes(3)
   })
 
   it('pins colliding unmapped legacy ids falling through to the current daemon', async () => {
diff --git a/src/main/daemon/daemon-pty-router.ts b/src/main/daemon/daemon-pty-router.ts
index 0f07da4dc18..8429495ed9f 100644
--- a/src/main/daemon/daemon-pty-router.ts
+++ b/src/main/daemon/daemon-pty-router.ts
@@ -9,44 +9,44 @@ import type {
   PtySpawnResult
 } from '../providers/types'
 import type { PtyProcessInspection } from '../providers/pty-process-inspection'
-import { probePtyOwners } from './daemon-pty-liveness-probe'
 import { shouldHandoffDaemonHistory } from './daemon-history-handoff'
 import type { DaemonPtyRouterDataEvent, DaemonPtyRouterExitEvent } from './daemon-pty-router-events'
+import { DaemonSessionOwnerResolver } from './daemon-session-owner-resolution'
 
 export class DaemonPtyRouter implements IPtyProvider {
   private current: DaemonPtyAdapter
   private legacy: DaemonPtyAdapter[]
   private sessionAdapters = new Map<string, DaemonPtyAdapter>()
+  private readonly ownerResolver: DaemonSessionOwnerResolver<DaemonPtyAdapter>
   private readonly subscriptions: DaemonPtyAdapterSubscriptionFanout
 
   constructor(opts: { current: DaemonPtyAdapter; legacy: DaemonPtyAdapter[] }) {
     this.current = opts.current
     this.legacy = opts.legacy
-    this.subscriptions = new DaemonPtyAdapterSubscriptionFanout(this.allAdapters(), (id) => {
-      this.sessionAdapters.delete(id)
-    })
+    this.ownerResolver = new DaemonSessionOwnerResolver(this.allAdapters(), this.sessionAdapters)
+    this.subscriptions = new DaemonPtyAdapterSubscriptionFanout(
+      this.allAdapters(),
+      (id) => {
+        this.ownerResolver.forgetRoute(id)
+      },
+      (adapter) => this.ownerResolver.invalidateProvider(adapter)
+    )
   }
 
   async discoverLegacySessions(): Promise<void> {
-    for (const adapter of this.legacy) {
-      try {
-        const sessions = await adapter.listProcesses()
-        for (const session of sessions) {
-          this.sessionAdapters.set(session.id, adapter)
-        }
-      } catch (error) {
-        console.warn('[daemon] Failed to discover legacy daemon sessions', error)
-      }
-    }
+    await this.ownerResolver.discoverRoutes()
   }
 
   async spawn(opts: PtySpawnOptions): Promise<PtySpawnResult> {
+    if (opts.attachOnly && opts.sessionId) {
+      return await this.ownerResolver.spawnAttachOnly({ ...opts, sessionId: opts.sessionId })
+    }
     const adapter = opts.sessionId ? this.sessionAdapters.get(opts.sessionId) : undefined
     const target = adapter ?? this.current
     const result = await target.spawn(opts)
     // Why: the adapter filters intentional recovery exits and canonical-ID races before publishing proof.
     if (!result.exitedBeforeSpawnReply) {
-      this.sessionAdapters.set(result.id, target)
+      this.ownerResolver.recordRoute(result.id, target, result.incarnationId)
     }
     return result
   }
@@ -86,7 +86,7 @@ export class DaemonPtyRouter implements IPtyProvider {
   }
 
   async probePtyLiveness(id: string): Promise<boolean | null> {
-    return await probePtyOwners(id, this.sessionAdapters.get(id), this.allAdapters())
+    return await this.ownerResolver.probe(id)
   }
 
   write(id: string, data: string): void {
@@ -121,7 +121,7 @@ export class DaemonPtyRouter implements IPtyProvider {
         adapter.ackColdRestore(id)
       }
       if (this.sessionAdapters.get(id) === adapter) {
-        this.sessionAdapters.delete(id)
+        this.ownerResolver.forgetRoute(id, adapter)
       }
     }
   }
@@ -240,6 +240,7 @@ export class DaemonPtyRouter implements IPtyProvider {
   }> {
     const alive: string[] = []
     const killed: string[] = []
+    const aliveProviders = new Map<string, Set<DaemonPtyAdapter>>()
     for (const adapter of this.allAdapters()) {
       const result = await adapter.reconcileOnStartup(validWorktreeIds)
       // Why: daemon startup can reconcile many restored sessions; spreading
@@ -251,10 +252,17 @@ export class DaemonPtyRouter implements IPtyProvider {
         killed.push(id)
       }
       for (const id of result.alive) {
-        this.sessionAdapters.set(id, adapter)
+        const providers = aliveProviders.get(id) ?? new Set<DaemonPtyAdapter>()
+        providers.add(adapter)
+        aliveProviders.set(id, providers)
       }
-      for (const id of result.killed) {
-        this.sessionAdapters.delete(id)
+    }
+    for (const id of new Set([...alive, ...killed])) {
+      const providers = aliveProviders.get(id)
+      if (providers?.size === 1) {
+        this.ownerResolver.recordRoute(id, providers.values().next().value!)
+      } else {
+        this.ownerResolver.forgetRoute(id)
       }
     }
     return { alive, killed }
diff --git a/src/main/daemon/daemon-ready-identity.ts b/src/main/daemon/daemon-ready-identity.ts
index 49a02bffdd0..12863ba4543 100644
--- a/src/main/daemon/daemon-ready-identity.ts
+++ b/src/main/daemon/daemon-ready-identity.ts
@@ -22,6 +22,27 @@ export async function readCurrentDaemonReadyIdentity(
   }
 }
 
+/**
+ * Reads another process's incarnation markers.
+ *
+ * Why: `readCurrentDaemonReadyIdentity` only covers /proc/self, but repairing a PID record
+ * means republishing the markers of the daemon that actually owns the endpoint.
+ */
+export async function readDaemonProcessIncarnation(
+  pid: number
+): Promise<{ linuxStartTicks: string; bootId: string } | null> {
+  if (process.platform !== 'linux') {
+    return null
+  }
+  try {
+    const linuxStartTicks = parseLinuxStartTicks(readFileSync(`/proc/${pid}/stat`, 'utf8'))
+    const bootId = await readBootIdentity()
+    return linuxStartTicks && bootId ? { linuxStartTicks, bootId } : null
+  } catch {
+    return null
+  }
+}
+
 export function parseDaemonReadyIdentity(message: unknown): DaemonReadyIdentity | null {
   if (!message || typeof message !== 'object') {
     return null
diff --git a/src/main/daemon/daemon-server.test.ts b/src/main/daemon/daemon-server.test.ts
index b6588e44e69..053c5051033 100644
--- a/src/main/daemon/daemon-server.test.ts
+++ b/src/main/daemon/daemon-server.test.ts
@@ -87,11 +87,12 @@ describe('DaemonServer', () => {
     rmSync(dir, { recursive: true, force: true })
   })
 
-  async function startServer(launchNonce?: string): Promise<void> {
+  async function startServer(launchNonce?: string, onRpcShutdown?: () => void): Promise<void> {
     server = new DaemonServer({
       socketPath,
       tokenPath,
       ...(launchNonce ? { pidPath, launchNonce } : {}),
+      ...(onRpcShutdown ? { onRpcShutdown } : {}),
       spawnSubprocess: () => createMockSubprocess()
     })
     await server.start()
@@ -842,7 +843,8 @@ describe('DaemonServer', () => {
 
   describe('shutdown', () => {
     it('waits for the ordinary shutdown reply write before destroying resources', async () => {
-      await startServer()
+      const onRpcShutdown = vi.fn()
+      await startServer(undefined, onRpcShutdown)
       const c = await connectClient()
       const daemon = server as unknown as DaemonServerPrivate & {
         host: { dispose: () => Promise<void> }
@@ -861,11 +863,14 @@ describe('DaemonServer', () => {
 
       await expect(c.request('shutdown', { killSessions: false })).resolves.toEqual({})
       expect(dispose).not.toHaveBeenCalled()
+      expect(onRpcShutdown).not.toHaveBeenCalled()
       expect(existsSync(tokenPath)).toBe(true)
 
       replyFlushed?.()
-      await waitFor(() => !existsSync(tokenPath))
+      await waitFor(() => onRpcShutdown.mock.calls.length === 1)
+      expect(existsSync(tokenPath)).toBe(false)
       expect(dispose).toHaveBeenCalledOnce()
+      expect(onRpcShutdown).toHaveBeenCalledOnce()
     })
 
     it('removes only its owned token and PID record', async () => {
diff --git a/src/main/daemon/daemon-server.ts b/src/main/daemon/daemon-server.ts
index 4c9ffd5098e..b69641e6461 100644
--- a/src/main/daemon/daemon-server.ts
+++ b/src/main/daemon/daemon-server.ts
@@ -2,7 +2,7 @@
 import { createServer, type Server, type Socket } from 'node:net'
 import { randomUUID } from 'node:crypto'
 import { performance } from 'node:perf_hooks'
-import { writeFileSync, chmodSync } from 'node:fs'
+import { writeFileSync, chmodSync, unlinkSync } from 'node:fs'
 import { StringDecoder } from 'node:string_decoder'
 import { encodeNdjson, createNdjsonParser } from './ndjson'
 import { TerminalHost } from './terminal-host'
@@ -23,6 +23,13 @@ import { createNoopDaemonFileLog, type DaemonFileLog } from './daemon-file-log'
 import { isTuiAgent } from '../../shared/tui-agent-config'
 import { parsePtyStartupIngressIntent } from '../../shared/pty-startup-ingress'
 import { unlinkOwnedDaemonPidFile, unlinkOwnedDaemonTokenFile } from './daemon-spawner'
+import {
+  getDaemonSocketBindPath,
+  publishDaemonSocketPath,
+  readDaemonEndpointOwnershipState,
+  unlinkOwnedDaemonSocketPath,
+  type DaemonSocketIdentity
+} from './daemon-endpoint-ownership'
 import {
   CLEAN_DISCONNECT_PROTOCOL_VERSION,
   PROTOCOL_VERSION,
@@ -44,9 +51,15 @@ export type DaemonServerOptions = {
   pidPath?: string
   launchNonce?: string
   startedAtMs?: number
+  publishEndpointOwnership?: () => void
+  /** Reported in the hello so a repaired PID record can carry the real owner's metadata. */
+  entryPath?: string
+  appVersion?: string
+  spawnerExecPath?: string
   /** Direct-construction seam for protocol fixture tests; production never overrides it. */
   protocolVersion?: number
   onIdleShutdown?: () => void
+  onRpcShutdown?: () => void
   /** Direct-construction-only controls; production uses the compiled initial-adoption timeout. */
   initialAdoptionTestConfig?: {
     timeoutMs: number
@@ -95,6 +108,8 @@ export class DaemonServer {
   // Why: survive long enough to adopt a first client pair, but don't orphan forever if the parent crashes first.
   private static readonly INITIAL_ADOPTION_TIMEOUT_MS = 2 * 60 * 1000
   private static readonly SHUTDOWN_REPLY_FLUSH_TIMEOUT_MS = 1_000
+  private static readonly ENDPOINT_OWNERSHIP_POLL_MS = 30 * 1000
+  private static readonly ENDPOINT_OWNERSHIP_LOSS_CONFIRMATIONS = 2
   private server: Server | null = null
   private token: string
   private host: TerminalHost
@@ -103,8 +118,16 @@ export class DaemonServer {
   private pidPath: string | null
   private launchNonce: string | null
   private startedAtMs: number | null
+  private publishEndpointOwnership: () => void
+  private entryPath: string | null
+  private appVersion: string | null
+  private spawnerExecPath: string | null
+  private ownedSocketIdentity: DaemonSocketIdentity | null = null
+  private endpointOwnershipTimer: ReturnType<typeof setInterval> | null = null
+  private endpointOwnershipLossStreak = 0
   private protocolVersion: number
   private onIdleShutdown: () => void
+  private onRpcShutdown: () => void
   private onAuthenticatedClientPair: () => void
   private ptySpawnHealthCheck: () => Promise<void>
   private preparePtySpawn: () => Promise<void>
@@ -173,7 +196,12 @@ export class DaemonServer {
       (this.protocolVersion >= CLEAN_DISCONNECT_PROTOCOL_VERSION
         ? Date.now() - process.uptime() * 1000
         : null)
+    this.publishEndpointOwnership = opts.publishEndpointOwnership ?? (() => {})
+    this.entryPath = opts.entryPath ?? null
+    this.appVersion = opts.appVersion ?? null
+    this.spawnerExecPath = opts.spawnerExecPath ?? null
     this.onIdleShutdown = opts.onIdleShutdown ?? (() => {})
+    this.onRpcShutdown = opts.onRpcShutdown ?? (() => {})
     this.initialAdoptionTimeoutMs =
       opts.initialAdoptionTestConfig?.timeoutMs ?? DaemonServer.INITIAL_ADOPTION_TIMEOUT_MS
     this.lifecycleClock = opts.initialAdoptionTestConfig?.clock ?? {
@@ -213,19 +241,58 @@ export class DaemonServer {
 
       this.server.once('error', onListenError)
 
-      this.server.listen(this.socketPath, () => {
+      // Why: bind a private name and hard-link it into place, so libuv's close-time unlink
+      // can only ever remove our own bind name — never a replacement daemon's endpoint.
+      const bindPath =
+        process.platform === 'win32' ? this.socketPath : getDaemonSocketBindPath(this.socketPath)
+
+      this.server.listen(bindPath, () => {
         // Why: drop the startup error listener after bind so it doesn't retain this closure.
         this.server?.off('error', onListenError)
-        writeFileSync(this.tokenPath, this.token, { mode: 0o600 })
         try {
-          chmodSync(this.socketPath, 0o600)
+          // Why: tighten the mode on the private bind name so the endpoint is never reachable
+          // at the canonical path with default permissions, even briefly.
+          chmodSync(bindPath, 0o600)
         } catch {
           // Best-effort on platforms that support it
         }
+        let publishedOwnership = false
+        try {
+          // Why: the exclusive link is the endpoint claim, and the PID/nonce record must
+          // exist before the token makes this listener adoptable.
+          this.ownedSocketIdentity = publishDaemonSocketPath(bindPath, this.socketPath)
+          this.publishEndpointOwnership()
+          publishedOwnership = true
+          writeFileSync(this.tokenPath, this.token, { mode: 0o600 })
+        } catch (error) {
+          // Why: roll back only a record we actually wrote. Losing the endpoint claim means
+          // the record at that path belongs to the incumbent daemon, and even the ownership-
+          // checked unlink briefly renames it aside — enough to strand a live daemon's record.
+          if (publishedOwnership && this.pidPath && this.launchNonce) {
+            unlinkOwnedDaemonPidFile(this.pidPath, process.pid, this.launchNonce)
+          }
+          unlinkOwnedDaemonSocketPath(this.socketPath, this.ownedSocketIdentity)
+          this.ownedSocketIdentity = null
+          const server = this.server
+          this.server = null
+          // Why: settle before close — an already-accepted connection defers the close
+          // callback indefinitely, and start() has no timeout of its own.
+          reject(error)
+          server?.close()
+          if (process.platform !== 'win32') {
+            try {
+              unlinkSync(bindPath)
+            } catch {
+              // Already consumed by a successful link, or never created.
+            }
+          }
+          return
+        }
         if (this.protocolVersion >= CLEAN_DISCONNECT_PROTOCOL_VERSION) {
           // Why: a parent crash before the first full client pair must not leave an empty daemon alive forever.
           this.armInitialAdoptionTimeout()
         }
+        this.startEndpointOwnershipWatch()
         resolve()
       })
     })
@@ -253,15 +320,87 @@ export class DaemonServer {
     await serverClose
   }
 
+  private async finishRpcShutdown(serverClose: Promise<void>): Promise<void> {
+    await this.finishOrdinaryShutdown(serverClose)
+    this.onRpcShutdown()
+  }
+
   private unlinkOwnedEndpointArtifacts(): void {
-    // Why: ownership checks prevent removing a late replacement's token or PID record.
+    // Why: ownership checks prevent removing a late replacement's token, PID record or endpoint.
     unlinkOwnedDaemonTokenFile(this.tokenPath, this.token)
     if (this.pidPath && this.launchNonce) {
       unlinkOwnedDaemonPidFile(this.pidPath, process.pid, this.launchNonce)
     }
+    // Why: we bound a private name, so libuv unlinks nothing at the canonical path — this
+    // is the only removal of our endpoint, and it is skipped once someone else owns it.
+    unlinkOwnedDaemonSocketPath(this.socketPath, this.ownedSocketIdentity)
+    this.ownedSocketIdentity = null
+  }
+
+  private startEndpointOwnershipWatch(): void {
+    if (process.platform === 'win32' || !this.ownedSocketIdentity) {
+      return
+    }
+    this.endpointOwnershipTimer = setInterval(
+      () => this.checkEndpointOwnership(),
+      DaemonServer.ENDPOINT_OWNERSHIP_POLL_MS
+    )
+    // Why: a liveness poll must never be the reason the process cannot exit.
+    this.endpointOwnershipTimer.unref()
+  }
+
+  private stopEndpointOwnershipWatch(): void {
+    if (this.endpointOwnershipTimer === null) {
+      return
+    }
+    clearInterval(this.endpointOwnershipTimer)
+    this.endpointOwnershipTimer = null
+  }
+
+  /**
+   * Retires a daemon that no longer owns the canonical endpoint.
+   *
+   * Why: a daemon whose endpoint name was taken over keeps hosting PTYs that no client can
+   * reach through the socket, which reads to the user as terminals that acknowledge input and
+   * never run it. Retirement drains rather than kills: live sessions finish, and the process
+   * exits once idle instead of surviving as an unreachable orphan.
+   */
+  private checkEndpointOwnership(): void {
+    if (process.platform === 'win32' || !this.ownedSocketIdentity || this.shutdownPromise) {
+      return
+    }
+    const state = readDaemonEndpointOwnershipState(this.socketPath, this.ownedSocketIdentity)
+    if (state === 'owned') {
+      this.endpointOwnershipLossStreak = 0
+      return
+    }
+    if (state === 'indeterminate') {
+      // Why: an inconclusive stat proves nothing. Retiring on EACCES or EIO would take down a
+      // daemon that is still serving every terminal on the machine. Reset the streak too, so
+      // the confirmations we act on are consecutive rather than merely cumulative.
+      this.endpointOwnershipLossStreak = 0
+      return
+    }
+    this.endpointOwnershipLossStreak++
+    // Why: a replacement publishes by unlink-then-link, so a single observation can land in
+    // that gap. Require the loss to persist before acting on it.
+    if (this.endpointOwnershipLossStreak < DaemonServer.ENDPOINT_OWNERSHIP_LOSS_CONFIRMATIONS) {
+      return
+    }
+    if (this.retirementRequested) {
+      return
+    }
+    this.log.log('endpoint-ownership-lost', { socketPath: this.socketPath })
+    console.warn(
+      '[daemon] Endpoint ownership lost to another daemon — retiring once existing sessions end'
+    )
+    this.ownedSocketIdentity = null
+    this.retirementRequested = true
+    this.reevaluateIdleShutdown()
   }
 
   private async disposeDaemonResources(): Promise<void> {
+    this.stopEndpointOwnershipWatch()
     this.stopStreamBacklogProbe()
     this.transientFactRelay.dispose()
     this.cancelAllPendingPtySpawnPreparations()
@@ -297,7 +436,9 @@ export class DaemonServer {
     return new Promise<void>((resolve) => {
       // Why: close synchronously before any awaited cleanup so no new transport enters after the empty proof.
       server.close(() => {
-        // Node owns unlinking its Unix listener; an extra unlink here could delete a concurrent replacement.
+        // Why: libuv unlinks the path this server bound, which is our private bind name and
+        // is already gone. The canonical endpoint is removed by unlinkOwnedEndpointArtifacts,
+        // under an ownership check, so closing late cannot delete a replacement's endpoint.
         resolve()
       })
     })
@@ -436,19 +577,31 @@ export class DaemonServer {
         reason: 'protocol-mismatch',
         clientVersion: hello.version
       })
-      socket.write(encodeNdjson({ type: 'hello', ok: false, error: 'Protocol version mismatch' }))
+      socket.write(
+        encodeNdjson({
+          type: 'hello',
+          ok: false,
+          error: 'Protocol version mismatch'
+        })
+      )
       socket.destroy()
       return
     }
 
     if (hello.token !== this.token) {
-      this.log.log('client-hello-rejected', { reason: 'invalid-token', role: hello.role })
+      this.log.log('client-hello-rejected', {
+        reason: 'invalid-token',
+        role: hello.role
+      })
       socket.write(encodeNdjson({ type: 'hello', ok: false, error: 'Invalid token' }))
       socket.destroy()
       return
     }
 
-    this.log.log('client-hello-accepted', { role: hello.role, clientId: hello.clientId })
+    this.log.log('client-hello-accepted', {
+      role: hello.role,
+      clientId: hello.clientId
+    })
     socket.write(
       encodeNdjson({
         type: 'hello',
@@ -458,7 +611,10 @@ export class DaemonServer {
               daemonIdentity: {
                 pid: process.pid,
                 startedAtMs: this.startedAtMs,
-                launchNonce: this.launchNonce
+                launchNonce: this.launchNonce,
+                ...(this.entryPath ? { entryPath: this.entryPath } : {}),
+                ...(this.appVersion ? { appVersion: this.appVersion } : {}),
+                ...(this.spawnerExecPath ? { spawnerExecPath: this.spawnerExecPath } : {})
               }
             }
           : {})
@@ -639,7 +795,10 @@ export class DaemonServer {
   }
 
   private async preparePtySpawnUnlessCanceled(sessionId: string, clientId: string): Promise<void> {
-    const preparation: PendingPtySpawnPreparation = { canceled: false, clientId }
+    const preparation: PendingPtySpawnPreparation = {
+      canceled: false,
+      clientId
+    }
     const pending = this.pendingPtySpawnPreparations.get(sessionId) ?? new Set()
     pending.add(preparation)
     this.pendingPtySpawnPreparations.set(sessionId, pending)
@@ -790,7 +949,10 @@ export class DaemonServer {
               },
               onExit: (code, incarnationId) => {
                 // Why: exit tears down renderer handlers, so it must ride the ordered queue behind final output.
-                this.log.log('session-exited', { sessionId: routedSessionId, code })
+                this.log.log('session-exited', {
+                  sessionId: routedSessionId,
+                  code
+                })
                 this.streamDataBatcher.enqueueControlEvent(clientId, routedSessionId, {
                   type: 'event',
                   event: 'exit',
@@ -942,7 +1104,9 @@ export class DaemonServer {
           clientId
         }
         try {
-          await this.host.kill(request.payload.sessionId, { immediate: request.payload.immediate })
+          await this.host.kill(request.payload.sessionId, {
+            immediate: request.payload.immediate
+          })
         } catch (error) {
           // Why: a kill that wins before session registration already canceled the pending spawn, so its intent is done.
           if (!(canceledPendingSpawn && error instanceof SessionNotFoundError)) {
@@ -960,14 +1124,18 @@ export class DaemonServer {
 
       case 'detach':
         // Note: detach token handling simplified — full impl would track tokens per client
-        this.log.log('session-detached', { sessionId: request.payload.sessionId })
+        this.log.log('session-detached', {
+          sessionId: request.payload.sessionId
+        })
         return {}
 
       case 'getCwd':
         return { cwd: await this.host.getCwd(request.payload.sessionId) }
 
       case 'getForegroundProcess':
-        return { foregroundProcess: this.host.getForegroundProcess(request.payload.sessionId) }
+        return {
+          foregroundProcess: this.host.getForegroundProcess(request.payload.sessionId)
+        }
 
       case 'inspectProcess':
         return this.host.inspectProcess(request.payload.sessionId)
@@ -1019,7 +1187,9 @@ export class DaemonServer {
           typeof requestedScrollbackRows === 'number' && Number.isFinite(requestedScrollbackRows)
             ? Math.max(0, Math.min(50_000, Math.floor(requestedScrollbackRows)))
             : undefined
-        const snapshot = this.host.getSnapshot(request.payload.sessionId, { scrollbackRows })
+        const snapshot = this.host.getSnapshot(request.payload.sessionId, {
+          scrollbackRows
+        })
         const snapshotMs = performance.now() - snapshotStart
         if (snapshotMs >= 25) {
           // Serialize stalls block the daemon's single thread; surface them to attribute field typing stalls (issue #5096 family).
@@ -1071,10 +1241,10 @@ export class DaemonServer {
         const controlSocket = this.clients.get(clientId)?.controlSocket
         if (controlSocket) {
           this.deferShutdownUntilReply(clientId, request.id, controlSocket, () =>
-            this.finishOrdinaryShutdown(serverClose)
+            this.finishRpcShutdown(serverClose)
           )
         } else if (!this.shutdownPromise) {
-          this.shutdownPromise = this.finishOrdinaryShutdown(serverClose)
+          this.shutdownPromise = this.finishRpcShutdown(serverClose)
         }
         return {}
       }
diff --git a/src/main/daemon/daemon-session-owner-resolution.test.ts b/src/main/daemon/daemon-session-owner-resolution.test.ts
new file mode 100644
index 00000000000..277c0750a84
--- /dev/null
+++ b/src/main/daemon/daemon-session-owner-resolution.test.ts
@@ -0,0 +1,450 @@
+import { describe, expect, it, vi } from 'vitest'
+import type {
+  IPtyProvider,
+  PtyProcessInfo,
+  PtySpawnOptions,
+  PtySpawnResult
+} from '../providers/types'
+import { SessionNotFoundError, TerminalSessionOwnerUnverifiedError } from './daemon-errors'
+import { DaemonSessionOwnerResolver } from './daemon-session-owner-resolution'
+
+function provider(
+  processes: () => Promise<PtyProcessInfo[]>,
+  spawn: (opts: PtySpawnOptions) => Promise<PtySpawnResult> = async (opts) => ({
+    id: opts.sessionId ?? 'new'
+  })
+): IPtyProvider {
+  return {
+    listProcesses: vi.fn(processes),
+    spawn: vi.fn(spawn)
+  } as unknown as IPtyProvider
+}
+
+describe('DaemonSessionOwnerResolver', () => {
+  it('coalesces concurrent all-provider inventories', async () => {
+    let release!: () => void
+    const gate = new Promise<void>((resolve) => {
+      release = resolve
+    })
+    const firstInventory = vi.fn(async () => {
+      await gate
+      return []
+    })
+    const secondInventory = vi.fn(async () => {
+      await gate
+      return []
+    })
+    const first = provider(firstInventory)
+    const second = provider(secondInventory)
+    const resolver = new DaemonSessionOwnerResolver([first, second], new Map())
+
+    const resolutions = Promise.all([resolver.resolve('one'), resolver.resolve('two')])
+    await vi.waitFor(() => expect(firstInventory).toHaveBeenCalledOnce())
+    expect(secondInventory).toHaveBeenCalledOnce()
+    release()
+
+    await expect(resolutions).resolves.toEqual([{ kind: 'unknown' }, { kind: 'unknown' }])
+    expect(firstInventory).toHaveBeenCalledOnce()
+    expect(secondInventory).toHaveBeenCalledOnce()
+  })
+
+  it('bounds restore inventory requests across many panes and daemon generations', async () => {
+    const inventories = Array.from({ length: 51 }, (_, index) =>
+      vi.fn(async () => {
+        if (index === 50) {
+          throw new Error('offline')
+        }
+        return []
+      })
+    )
+    const resolver = new DaemonSessionOwnerResolver(
+      inventories.map((inventory) => provider(inventory)),
+      new Map()
+    )
+
+    for (let index = 0; index < 40; index += 1) {
+      await resolver.resolve(`pane-${index}`)
+    }
+
+    for (const inventory of inventories) {
+      expect(inventory).toHaveBeenCalledOnce()
+    }
+  })
+
+  it('reuses incomplete inventory across serialized restores', async () => {
+    const firstInventory = vi.fn(async () => [])
+    const secondInventory = vi.fn(async () => {
+      throw new Error('offline')
+    })
+    const resolver = new DaemonSessionOwnerResolver(
+      [provider(firstInventory), provider(secondInventory)],
+      new Map()
+    )
+
+    await resolver.resolve('first')
+    await resolver.resolve('second')
+
+    expect(firstInventory).toHaveBeenCalledOnce()
+    expect(secondInventory).toHaveBeenCalledOnce()
+  })
+
+  it('does not extend incomplete inventory lifetime on cache hits', async () => {
+    let now = 1_000
+    const clock = vi.spyOn(Date, 'now').mockImplementation(() => now)
+    const inventory = vi.fn(async () => {
+      throw new Error('offline')
+    })
+    const resolver = new DaemonSessionOwnerResolver(
+      [provider(async () => []), provider(inventory)],
+      new Map()
+    )
+
+    try {
+      await resolver.resolve('first')
+      now += 900
+      await resolver.resolve('second')
+      now += 101
+      await resolver.resolve('third')
+
+      expect(inventory).toHaveBeenCalledTimes(2)
+    } finally {
+      clock.mockRestore()
+    }
+  })
+
+  it('does not let startup inventory hide a session created before restore', async () => {
+    const sessions: PtyProcessInfo[] = []
+    const inventory = vi.fn(async () => sessions)
+    const owner = provider(inventory, async (opts) => ({
+      id: opts.sessionId!,
+      incarnationId: 'live',
+      isReattach: true
+    }))
+    const resolver = new DaemonSessionOwnerResolver([owner, provider(async () => [])], new Map())
+
+    await resolver.discoverRoutes()
+    sessions.push({ id: 'session', incarnationId: 'live', cwd: '', title: 'live' })
+
+    await expect(
+      resolver.spawnAttachOnly({ sessionId: 'session', attachOnly: true, cols: 80, rows: 24 })
+    ).resolves.toMatchObject({ id: 'session', incarnationId: 'live', isReattach: true })
+    expect(inventory).toHaveBeenCalledTimes(2)
+  })
+
+  it('uses the expected incarnation to disambiguate duplicate session ids', async () => {
+    const oldOwner = provider(async () => [
+      { id: 'session', incarnationId: 'old', cwd: '', title: 'old' }
+    ])
+    const exactOwner = provider(async () => [
+      { id: 'session', incarnationId: 'expected', cwd: '', title: 'exact' }
+    ])
+    const resolver = new DaemonSessionOwnerResolver([oldOwner, exactOwner], new Map())
+
+    await expect(resolver.resolve('session', 'expected')).resolves.toMatchObject({
+      kind: 'owner',
+      provider: exactOwner
+    })
+  })
+
+  it('accepts one exact-id owner when persisted incarnation evidence is stale', async () => {
+    const liveOwner = provider(async () => [
+      { id: 'session', incarnationId: 'live', cwd: '', title: 'live' }
+    ])
+    const resolver = new DaemonSessionOwnerResolver([liveOwner], new Map())
+
+    await expect(resolver.resolve('session', 'stale')).resolves.toMatchObject({
+      kind: 'owner',
+      provider: liveOwner
+    })
+  })
+
+  it('does not inventory unrelated providers for a routed stale persisted incarnation', async () => {
+    const routedOwner = provider(
+      async () => [{ id: 'session', incarnationId: 'live', cwd: '', title: 'live' }],
+      async () => ({ id: 'session', incarnationId: 'live', isReattach: true })
+    )
+    const unrelatedInventory = vi.fn(async () => {
+      throw new Error('offline')
+    })
+    const resolver = new DaemonSessionOwnerResolver(
+      [routedOwner, provider(unrelatedInventory)],
+      new Map([['session', routedOwner]])
+    )
+
+    await expect(
+      resolver.spawnAttachOnly({
+        sessionId: 'session',
+        expectedIncarnationId: 'stale',
+        attachOnly: true,
+        cols: 80,
+        rows: 24
+      })
+    ).resolves.toMatchObject({ id: 'session', incarnationId: 'live', isReattach: true })
+    expect(unrelatedInventory).not.toHaveBeenCalled()
+  })
+
+  it('re-resolves a routed incarnation mismatch against every possible owner', async () => {
+    const staleRoute = provider(
+      async () => [{ id: 'session', incarnationId: 'other', cwd: '', title: 'stale' }],
+      async () => ({ id: 'session', incarnationId: 'other', isReattach: true })
+    )
+    const exactOwner = provider(
+      async () => [{ id: 'session', incarnationId: 'expected', cwd: '', title: 'exact' }],
+      async () => ({ id: 'session', incarnationId: 'expected', isReattach: true })
+    )
+    const resolver = new DaemonSessionOwnerResolver(
+      [staleRoute, exactOwner],
+      new Map([['session', staleRoute]])
+    )
+
+    await expect(
+      resolver.spawnAttachOnly({
+        sessionId: 'session',
+        expectedIncarnationId: 'expected',
+        expectedIncarnationIsAuthoritative: true,
+        attachOnly: true,
+        cols: 80,
+        rows: 24
+      })
+    ).resolves.toMatchObject({ incarnationId: 'expected' })
+    expect(staleRoute.spawn).not.toHaveBeenCalled()
+  })
+
+  it('refreshes incomplete inventory when a routed owner refuses a moved session', async () => {
+    let firstOwnsSession = true
+    let secondOwnsSession = false
+    const first = provider(
+      async () =>
+        firstOwnsSession
+          ? [{ id: 'session', incarnationId: 'runtime', cwd: '', title: 'first' }]
+          : [],
+      async () => {
+        throw new SessionNotFoundError('session')
+      }
+    )
+    const second = provider(
+      async () =>
+        secondOwnsSession
+          ? [{ id: 'session', incarnationId: 'runtime', cwd: '', title: 'second' }]
+          : [],
+      async () => ({ id: 'session', incarnationId: 'runtime', isReattach: true })
+    )
+    const unavailable = provider(async () => {
+      throw new Error('offline')
+    })
+    const resolver = new DaemonSessionOwnerResolver([first, second, unavailable], new Map())
+
+    await expect(resolver.resolve('session', 'runtime', true)).resolves.toMatchObject({
+      kind: 'owner',
+      provider: first
+    })
+    firstOwnsSession = false
+    secondOwnsSession = true
+
+    await expect(
+      resolver.spawnAttachOnly({
+        sessionId: 'session',
+        expectedIncarnationId: 'runtime',
+        expectedIncarnationIsAuthoritative: true,
+        attachOnly: true,
+        cols: 80,
+        rows: 24
+      })
+    ).resolves.toMatchObject({ id: 'session', incarnationId: 'runtime', isReattach: true })
+    expect(first.spawn).toHaveBeenCalledOnce()
+    expect(second.spawn).toHaveBeenCalledOnce()
+    expect(second.listProcesses).toHaveBeenCalledTimes(2)
+  })
+
+  it('accepts exact runtime proof from an incomplete inventory', async () => {
+    const exactOwner = provider(async () => [
+      { id: 'session', incarnationId: 'runtime', cwd: '', title: 'exact' }
+    ])
+    const resolver = new DaemonSessionOwnerResolver(
+      [
+        exactOwner,
+        provider(async () => {
+          throw new Error('offline')
+        })
+      ],
+      new Map()
+    )
+
+    await expect(resolver.resolve('session', 'runtime', true)).resolves.toMatchObject({
+      kind: 'owner',
+      provider: exactOwner
+    })
+  })
+
+  it('does not trust persisted incarnation proof from an incomplete inventory', async () => {
+    const resolver = new DaemonSessionOwnerResolver(
+      [
+        provider(async () => [
+          { id: 'session', incarnationId: 'persisted', cwd: '', title: 'candidate' }
+        ]),
+        provider(async () => {
+          throw new Error('offline')
+        })
+      ],
+      new Map()
+    )
+
+    await expect(resolver.resolve('session', 'persisted')).resolves.toEqual({ kind: 'unknown' })
+  })
+
+  it('accepts positive liveness proof from an incomplete inventory', async () => {
+    const resolver = new DaemonSessionOwnerResolver(
+      [
+        provider(async () => [{ id: 'session', cwd: '', title: 'live' }]),
+        provider(async () => {
+          throw new Error('offline')
+        })
+      ],
+      new Map()
+    )
+
+    await expect(resolver.probe('session')).resolves.toBe(true)
+  })
+
+  it('fails closed when duplicate owners cannot be disambiguated', async () => {
+    const first = provider(async () => [{ id: 'session', cwd: '', title: 'first' }])
+    const second = provider(async () => [{ id: 'session', cwd: '', title: 'second' }])
+    const resolver = new DaemonSessionOwnerResolver([first, second], new Map())
+
+    await expect(resolver.resolve('session')).resolves.toEqual({ kind: 'unknown' })
+  })
+
+  it('reports confirmed absence from a sole owner', async () => {
+    const owner = provider(
+      async () => [],
+      async () => {
+        throw new SessionNotFoundError('missing')
+      }
+    )
+    const resolver = new DaemonSessionOwnerResolver([owner], new Map())
+
+    await expect(
+      resolver.spawnAttachOnly({ sessionId: 'missing', attachOnly: true, cols: 80, rows: 24 })
+    ).rejects.toBeInstanceOf(SessionNotFoundError)
+    expect(owner.spawn).toHaveBeenCalledOnce()
+    expect(owner.listProcesses).not.toHaveBeenCalled()
+  })
+
+  it('keeps absence unverified when there are no possible owners', async () => {
+    const resolver = new DaemonSessionOwnerResolver([], new Map())
+
+    await expect(resolver.resolve('missing')).resolves.toEqual({ kind: 'unknown' })
+  })
+
+  it('preserves an unresolved owner when any provider inventory fails', async () => {
+    const resolver = new DaemonSessionOwnerResolver(
+      [
+        provider(async () => []),
+        provider(async () => {
+          throw new Error('offline')
+        })
+      ],
+      new Map()
+    )
+
+    await expect(
+      resolver.spawnAttachOnly({ sessionId: 'missing', attachOnly: true, cols: 80, rows: 24 })
+    ).rejects.toBeInstanceOf(TerminalSessionOwnerUnverifiedError)
+  })
+
+  it('does not turn a raced owner refusal into absence while another provider is unresolved', async () => {
+    const candidate = provider(
+      async () => [{ id: 'session', cwd: '', title: 'candidate' }],
+      async () => {
+        throw new SessionNotFoundError('session')
+      }
+    )
+    const resolver = new DaemonSessionOwnerResolver(
+      [
+        candidate,
+        provider(async () => {
+          throw new Error('offline')
+        })
+      ],
+      new Map()
+    )
+
+    await expect(
+      resolver.spawnAttachOnly({ sessionId: 'session', attachOnly: true, cols: 80, rows: 24 })
+    ).rejects.toBeInstanceOf(TerminalSessionOwnerUnverifiedError)
+  })
+
+  it('does not turn a post-inventory owner refusal into aggregate absence', async () => {
+    const candidate = provider(
+      async () => [{ id: 'session', cwd: '', title: 'candidate' }],
+      async () => {
+        throw new SessionNotFoundError('session')
+      }
+    )
+    const resolver = new DaemonSessionOwnerResolver(
+      [candidate, provider(async () => [])],
+      new Map()
+    )
+
+    await expect(
+      resolver.spawnAttachOnly({ sessionId: 'session', attachOnly: true, cols: 80, rows: 24 })
+    ).rejects.toBeInstanceOf(TerminalSessionOwnerUnverifiedError)
+  })
+
+  it('pre-routes every uniquely inventoried session for serialized restores', async () => {
+    const inventory = vi.fn(async () => [
+      { id: 'first', cwd: '', title: 'first' },
+      { id: 'second', cwd: '', title: 'second' }
+    ])
+    const owner = provider(inventory)
+    const emptyInventory = vi.fn(async () => [])
+    const resolver = new DaemonSessionOwnerResolver([owner, provider(emptyInventory)], new Map())
+
+    await resolver.spawnAttachOnly({ sessionId: 'first', attachOnly: true, cols: 80, rows: 24 })
+    await resolver.spawnAttachOnly({ sessionId: 'second', attachOnly: true, cols: 80, rows: 24 })
+
+    expect(inventory).toHaveBeenCalledOnce()
+    expect(emptyInventory).toHaveBeenCalledOnce()
+  })
+
+  it('discards an inventory completed after daemon identity replacement', async () => {
+    let release!: () => void
+    const gate = new Promise<void>((resolve) => {
+      release = resolve
+    })
+    const inventory = vi.fn(async () => {
+      await gate
+      return [{ id: 'session', cwd: '', title: 'stale' }]
+    })
+    const owner = provider(inventory)
+    const resolver = new DaemonSessionOwnerResolver([owner], new Map())
+
+    const resolution = resolver.resolve('session')
+    await vi.waitFor(() => expect(inventory).toHaveBeenCalledOnce())
+    resolver.invalidateProvider(owner)
+    release()
+
+    await expect(resolution).resolves.toEqual({ kind: 'unknown' })
+    await resolver.resolve('session')
+    expect(inventory).toHaveBeenCalledTimes(2)
+  })
+
+  it('restores a proven route when identity changes during exact reattach', async () => {
+    const routes = new Map<string, IPtyProvider>()
+    let resolver!: DaemonSessionOwnerResolver<IPtyProvider>
+    let owner!: IPtyProvider
+    owner = provider(
+      async () => [],
+      async () => {
+        resolver.invalidateProvider(owner)
+        return { id: 'session', incarnationId: 'inc', isReattach: true }
+      }
+    )
+    routes.set('session', owner)
+    resolver = new DaemonSessionOwnerResolver([owner], routes)
+
+    await resolver.spawnAttachOnly({ sessionId: 'session', attachOnly: true, cols: 80, rows: 24 })
+
+    expect(routes.get('session')).toBe(owner)
+  })
+})
diff --git a/src/main/daemon/daemon-session-owner-resolution.ts b/src/main/daemon/daemon-session-owner-resolution.ts
new file mode 100644
index 00000000000..d35d2795d56
--- /dev/null
+++ b/src/main/daemon/daemon-session-owner-resolution.ts
@@ -0,0 +1,300 @@
+import type {
+  IPtyProvider,
+  PtyProcessInfo,
+  PtySpawnOptions,
+  PtySpawnResult
+} from '../providers/types'
+import { SessionNotFoundError, TerminalSessionOwnerUnverifiedError } from './daemon-errors'
+
+export type DaemonSessionOwnerResolution<T extends IPtyProvider> =
+  | { kind: 'owner'; provider: T }
+  | { kind: 'absent' }
+  | { kind: 'unknown' }
+
+type ProviderInventory<T> = { provider: T; processes: PtyProcessInfo[] | null }
+
+type OwnerInventory<T extends IPtyProvider> = {
+  candidatesBySessionId: Map<string, { provider: T; process: PtyProcessInfo }[]>
+  complete: boolean
+  epoch: number
+}
+
+const OWNER_RESOLUTION_TIMEOUT_MS = 2_000
+const OWNER_INVENTORY_CACHE_MS = 1_000
+const FAILED_PROVIDER_COOLDOWN_MS = 1_000
+
+function assertClientConnected(signal: PtySpawnOptions['signal']): void {
+  if (signal?.aborted) {
+    throw new Error('client_disconnected')
+  }
+}
+
+export class DaemonSessionOwnerResolver<T extends IPtyProvider> {
+  private inventoryInFlight: Promise<OwnerInventory<T>> | null = null
+  private cachedInventory: { value: OwnerInventory<T>; expiresAt: number } | null = null
+  private readonly failedProviderCooldowns = new Map<T, number>()
+  private readonly routeIncarnations = new Map<string, string | undefined>()
+  private epoch = 0
+
+  constructor(
+    private readonly providers: readonly T[],
+    private readonly routes: Map<string, IPtyProvider>
+  ) {}
+
+  invalidateProvider(provider: T): void {
+    this.epoch += 1
+    this.inventoryInFlight = null
+    this.cachedInventory = null
+    this.failedProviderCooldowns.clear()
+    for (const [sessionId, routed] of this.routes) {
+      if (routed === provider) {
+        this.routes.delete(sessionId)
+        this.routeIncarnations.delete(sessionId)
+      }
+    }
+  }
+
+  async spawnAttachOnly(opts: PtySpawnOptions & { sessionId: string }): Promise<PtySpawnResult> {
+    assertClientConnected(opts.signal)
+    const routed = this.providers.find((provider) => provider === this.routes.get(opts.sessionId))
+    const direct = routed ?? (this.providers.length === 1 ? this.providers[0] : undefined)
+    const routedIncarnation = this.routeIncarnations.get(opts.sessionId)
+    const routeNeedsAuthoritativeResolution =
+      direct &&
+      routed &&
+      opts.expectedIncarnationIsAuthoritative === true &&
+      routedIncarnation !== opts.expectedIncarnationId
+    if (direct && !routeNeedsAuthoritativeResolution) {
+      try {
+        const result = await direct.spawn(opts)
+        if (
+          !result.exitedBeforeSpawnReply &&
+          result.id === opts.sessionId &&
+          result.isReattach === true
+        ) {
+          this.recordRoute(result.id, direct, result.incarnationId)
+        }
+        return result
+      } catch (error) {
+        if (!(error instanceof SessionNotFoundError)) {
+          throw error
+        }
+        if (this.providers.length === 1) {
+          throw error
+        }
+        if (routed && this.routes.get(opts.sessionId) === routed) {
+          this.forgetRoute(opts.sessionId, routed)
+        }
+      }
+    }
+
+    assertClientConnected(opts.signal)
+    const resolution = await this.resolve(
+      opts.sessionId,
+      opts.expectedIncarnationId,
+      opts.expectedIncarnationIsAuthoritative
+    )
+    assertClientConnected(opts.signal)
+    if (resolution.kind === 'unknown') {
+      throw new TerminalSessionOwnerUnverifiedError(opts.sessionId)
+    }
+    if (resolution.kind === 'absent') {
+      throw new SessionNotFoundError(opts.sessionId)
+    }
+    try {
+      const result = await resolution.provider.spawn(opts)
+      if (
+        !result.exitedBeforeSpawnReply &&
+        result.id === opts.sessionId &&
+        result.isReattach === true
+      ) {
+        this.recordRoute(result.id, resolution.provider, result.incarnationId)
+      }
+      return result
+    } catch (error) {
+      if (error instanceof SessionNotFoundError && this.providers.length > 1) {
+        throw new TerminalSessionOwnerUnverifiedError(opts.sessionId)
+      }
+      throw error
+    }
+  }
+
+  async probe(sessionId: string): Promise<boolean | null> {
+    const routed = this.providers.find((provider) => provider === this.routes.get(sessionId))
+    const direct = routed ?? (this.providers.length === 1 ? this.providers[0] : undefined)
+    if (direct) {
+      const verdict = direct.probePtyLiveness
+        ? await direct.probePtyLiveness(sessionId)
+        : (direct.hasPty?.(sessionId) ?? null)
+      if (verdict !== false || this.providers.length === 1) {
+        return verdict
+      }
+      if (this.routes.get(sessionId) === routed) {
+        this.routes.delete(sessionId)
+        this.routeIncarnations.delete(sessionId)
+      }
+    }
+    const inventory = await this.inventory(false)
+    if (inventory.epoch !== this.epoch) {
+      return null
+    }
+    if ((inventory.candidatesBySessionId.get(sessionId)?.length ?? 0) > 0) {
+      return true
+    }
+    const resolution = this.resolveInventory(inventory, sessionId)
+    if (resolution.kind === 'owner') {
+      return resolution.provider === routed ? null : true
+    }
+    return resolution.kind === 'absent' ? false : null
+  }
+
+  async resolve(
+    sessionId: string,
+    expectedIncarnationId?: string,
+    expectedIncarnationIsAuthoritative = false
+  ): Promise<DaemonSessionOwnerResolution<T>> {
+    const inventory = await this.inventory()
+    if (inventory.epoch !== this.epoch) {
+      return { kind: 'unknown' }
+    }
+    const resolution = this.resolveInventory(
+      inventory,
+      sessionId,
+      expectedIncarnationId,
+      expectedIncarnationIsAuthoritative
+    )
+    if (
+      (!inventory.complete || resolution.kind === 'unknown') &&
+      this.cachedInventory?.value !== inventory
+    ) {
+      this.cachedInventory = {
+        value: inventory,
+        expiresAt: Date.now() + OWNER_INVENTORY_CACHE_MS
+      }
+    }
+    return resolution
+  }
+
+  async discoverRoutes(): Promise<void> {
+    await this.inventory()
+    this.failedProviderCooldowns.clear()
+    this.cachedInventory = null
+  }
+
+  recordRoute(sessionId: string, provider: T, incarnationId?: string): void {
+    this.routes.set(sessionId, provider)
+    this.routeIncarnations.set(sessionId, incarnationId)
+  }
+
+  forgetRoute(sessionId: string, provider?: T): void {
+    if (provider && this.routes.get(sessionId) !== provider) {
+      return
+    }
+    this.routes.delete(sessionId)
+    this.routeIncarnations.delete(sessionId)
+    this.cachedInventory = null
+  }
+
+  private resolveInventory(
+    inventory: OwnerInventory<T>,
+    sessionId: string,
+    expectedIncarnationId?: string,
+    expectedIncarnationIsAuthoritative = false
+  ): DaemonSessionOwnerResolution<T> {
+    const candidates = inventory.candidatesBySessionId.get(sessionId) ?? []
+    const providers = new Set(candidates.map(({ provider }) => provider))
+    const exactProviders = new Set(
+      candidates
+        .filter(({ process }) => process.incarnationId === expectedIncarnationId)
+        .map(({ provider }) => provider)
+    )
+    const exactProvider =
+      expectedIncarnationId && exactProviders.size === 1
+        ? exactProviders.values().next().value
+        : undefined
+    const soleProvider = providers.size === 1 ? providers.values().next().value : undefined
+    const provider =
+      (exactProvider && (inventory.complete || expectedIncarnationIsAuthoritative)
+        ? exactProvider
+        : undefined) ??
+      (!expectedIncarnationIsAuthoritative && inventory.complete ? soleProvider : undefined)
+    if (provider) {
+      const process = candidates.find((candidate) => candidate.provider === provider)?.process
+      this.recordRoute(sessionId, provider, process?.incarnationId)
+      return { kind: 'owner', provider }
+    }
+    if (!inventory.complete || providers.size > 1 || this.providers.length !== 1) {
+      return { kind: 'unknown' }
+    }
+    return { kind: 'absent' }
+  }
+
+  private inventory(allowCached = true): Promise<OwnerInventory<T>> {
+    if (this.inventoryInFlight) {
+      return this.inventoryInFlight
+    }
+    if (
+      allowCached &&
+      this.cachedInventory?.value.epoch === this.epoch &&
+      this.cachedInventory.expiresAt > Date.now()
+    ) {
+      return Promise.resolve(this.cachedInventory.value)
+    }
+    this.cachedInventory = null
+    const deadlineMs = Date.now() + OWNER_RESOLUTION_TIMEOUT_MS
+    const epoch = this.epoch
+    const inventory = Promise.all(
+      this.providers.map(async (provider): Promise<ProviderInventory<T>> => {
+        if ((this.failedProviderCooldowns.get(provider) ?? 0) > Date.now()) {
+          return { provider, processes: null }
+        }
+        this.failedProviderCooldowns.delete(provider)
+        try {
+          return { provider, processes: await provider.listProcesses({ deadlineMs }) }
+        } catch {
+          if (epoch === this.epoch) {
+            this.failedProviderCooldowns.set(provider, Date.now() + FAILED_PROVIDER_COOLDOWN_MS)
+          }
+          return { provider, processes: null }
+        }
+      })
+    )
+      .then((entries) => this.indexInventory(entries, epoch))
+      .finally(() => {
+        if (this.inventoryInFlight === inventory) {
+          this.inventoryInFlight = null
+        }
+      })
+    this.inventoryInFlight = inventory
+    return inventory
+  }
+
+  private indexInventory(entries: ProviderInventory<T>[], epoch: number): OwnerInventory<T> {
+    const candidatesBySessionId = new Map<string, { provider: T; process: PtyProcessInfo }[]>()
+    let complete = true
+    for (const entry of entries) {
+      if (!entry.processes) {
+        complete = false
+        continue
+      }
+      for (const process of entry.processes) {
+        const candidates = candidatesBySessionId.get(process.id) ?? []
+        candidates.push({ provider: entry.provider, process })
+        candidatesBySessionId.set(process.id, candidates)
+      }
+    }
+    if (complete && epoch === this.epoch) {
+      for (const [sessionId, candidates] of candidatesBySessionId) {
+        const providers = new Set(candidates.map(({ provider }) => provider))
+        if (providers.size === 1) {
+          const provider = providers.values().next().value!
+          const process = candidates.find((candidate) => candidate.provider === provider)?.process
+          this.recordRoute(sessionId, provider, process?.incarnationId)
+        } else {
+          this.forgetRoute(sessionId)
+        }
+      }
+    }
+    return { candidatesBySessionId, complete, epoch }
+  }
+}
diff --git a/src/main/daemon/daemon-spawner.test.ts b/src/main/daemon/daemon-spawner.test.ts
index 613b9e6a149..0c5b987851e 100644
--- a/src/main/daemon/daemon-spawner.test.ts
+++ b/src/main/daemon/daemon-spawner.test.ts
@@ -1,14 +1,24 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { randomUUID } from 'node:crypto'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
-import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { chmodSync, existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { createServer, connect, type Server } from 'node:net'
 import {
   DaemonSpawner,
   getDaemonPidPath,
   getDaemonSocketPath,
   getDaemonTokenPath,
+  publishDaemonPidFile,
+  replaceDaemonPidFile,
   restoreClaimedDaemonArtifact
 } from './daemon-spawner'
+import {
+  getDaemonSocketBindPath,
+  publishDaemonSocketPath,
+  sweepAbandonedDaemonClaims,
+  unlinkOwnedDaemonSocketPath
+} from './daemon-endpoint-ownership'
 import { startDaemon, type DaemonHandle } from './daemon-main'
 import { DaemonClient } from './client'
 import type { SubprocessHandle } from './session'
@@ -235,3 +245,214 @@ describe('restoreClaimedDaemonArtifact', () => {
     ).toBe(true)
   })
 })
+
+describe('daemon PID publication', () => {
+  it('publishes ownership exclusively', () => {
+    const dir = createTestDir()
+    const pidPath = join(dir, 'daemon.pid')
+    try {
+      publishDaemonPidFile(pidPath, {
+        pid: 101,
+        startedAtMs: 1_000,
+        launchNonce: 'launch-a'
+      })
+
+      expect(() =>
+        publishDaemonPidFile(pidPath, {
+          pid: 202,
+          startedAtMs: 2_000,
+          launchNonce: 'launch-b'
+        })
+      ).toThrow()
+    } finally {
+      rmSync(dir, { recursive: true, force: true })
+    }
+  })
+
+  it('atomically replaces stale ownership with the authenticated endpoint identity', () => {
+    const dir = createTestDir()
+    const pidPath = join(dir, 'daemon.pid')
+    const endpointIdentity = {
+      pid: 202,
+      startedAtMs: 2_000,
+      launchNonce: 'launch-b'
+    }
+    try {
+      writeFileSync(pidPath, '{"pid":101,"launchNonce":"launch-a"}')
+
+      expect(replaceDaemonPidFile(pidPath, endpointIdentity)).toBe(true)
+      expect(JSON.parse(readFileSync(pidPath, 'utf8'))).toEqual(endpointIdentity)
+    } finally {
+      rmSync(dir, { recursive: true, force: true })
+    }
+  })
+
+  it('reports failure and preserves the record when the rename claim fails for any reason but absence', () => {
+    // A read-only parent denies the rename with EACCES, standing in for the Windows
+    // AV/indexer lock that fails the claim on a record which is merely open.
+    if (process.platform === 'win32' || process.getuid?.() === 0) {
+      return
+    }
+    const dir = createTestDir()
+    const pidPath = join(dir, 'daemon.pid')
+    const existingRecord = '{"pid":101,"launchNonce":"launch-a"}'
+    writeFileSync(pidPath, existingRecord)
+    try {
+      chmodSync(dir, 0o500)
+
+      expect(
+        replaceDaemonPidFile(pidPath, { pid: 202, startedAtMs: 2_000, launchNonce: 'launch-b' })
+      ).toBe(false)
+      expect(readFileSync(pidPath, 'utf8')).toBe(existingRecord)
+    } finally {
+      chmodSync(dir, 0o700)
+      rmSync(dir, { recursive: true, force: true })
+    }
+  })
+})
+
+function listenOnSocketPath(server: Server, socketPath: string): Promise<void> {
+  return new Promise((resolve, reject) => {
+    server.once('error', reject)
+    server.listen(socketPath, () => {
+      server.off('error', reject)
+      resolve()
+    })
+  })
+}
+
+function closeSocketServer(server: Server): Promise<void> {
+  return new Promise((resolve) => {
+    if (!server.listening) {
+      resolve()
+      return
+    }
+    server.close(() => resolve())
+  })
+}
+
+function connectsToSocketPath(socketPath: string): Promise<boolean> {
+  return new Promise((resolve) => {
+    const socket = connect({ path: socketPath })
+    const timer = setTimeout(() => {
+      socket.destroy()
+      resolve(false)
+    }, 500)
+    socket.on('connect', () => {
+      clearTimeout(timer)
+      socket.destroy()
+      resolve(true)
+    })
+    socket.on('error', () => {
+      clearTimeout(timer)
+      resolve(false)
+    })
+  })
+}
+
+describe('daemon socket publication', () => {
+  it('keeps the bind name shorter than the canonical endpoint', () => {
+    // sockaddr_un caps the path, so the private bind name must never extend it.
+    const canonicalPath = getDaemonSocketPath('/tmp/orca-daemon-runtime')
+
+    expect(getDaemonSocketBindPath(canonicalPath).length).toBeLessThan(canonicalPath.length)
+  })
+
+  it('publishes a bound listener under the canonical endpoint and reclaims only its own entry', async () => {
+    if (process.platform === 'win32') {
+      return
+    }
+    const dir = createTestDir()
+    const canonicalPath = getDaemonSocketPath(dir)
+    const first = createServer((socket) => socket.end())
+    const second = createServer((socket) => socket.end())
+    try {
+      const firstBindPath = getDaemonSocketBindPath(canonicalPath)
+      await listenOnSocketPath(first, firstBindPath)
+
+      const firstIdentity = publishDaemonSocketPath(firstBindPath, canonicalPath)
+      expect(firstIdentity).not.toBeNull()
+      expect(existsSync(canonicalPath)).toBe(true)
+      expect(existsSync(firstBindPath)).toBe(false)
+      await expect(connectsToSocketPath(canonicalPath)).resolves.toBe(true)
+
+      const secondBindPath = getDaemonSocketBindPath(canonicalPath)
+      await listenOnSocketPath(second, secondBindPath)
+      let publishError: NodeJS.ErrnoException | null = null
+      try {
+        publishDaemonSocketPath(secondBindPath, canonicalPath)
+      } catch (error) {
+        publishError = error as NodeJS.ErrnoException
+      }
+      expect(publishError?.code).toBe('EEXIST')
+
+      expect(unlinkOwnedDaemonSocketPath(canonicalPath, firstIdentity)).toBe(true)
+      expect(existsSync(canonicalPath)).toBe(false)
+
+      // The endpoint name now resolves to a different listener's inode.
+      const secondIdentity = publishDaemonSocketPath(secondBindPath, canonicalPath)
+      expect(secondIdentity).not.toEqual(firstIdentity)
+      expect(unlinkOwnedDaemonSocketPath(canonicalPath, firstIdentity)).toBe(false)
+      expect(existsSync(canonicalPath)).toBe(true)
+      await expect(connectsToSocketPath(canonicalPath)).resolves.toBe(true)
+    } finally {
+      await closeSocketServer(first)
+      await closeSocketServer(second)
+      rmSync(dir, { recursive: true, force: true })
+    }
+  })
+})
+
+describe('sweepAbandonedDaemonClaims', () => {
+  const claimNames = [
+    `daemon-v${PROTOCOL_VERSION}.pid.cleanup-123-${randomUUID()}`,
+    `daemon-v${PROTOCOL_VERSION}.pid.replace-123-${randomUUID()}`,
+    '.b0123456789'
+  ]
+  const preservedNames = [`daemon-v${PROTOCOL_VERSION}.pid`, `daemon-v${PROTOCOL_VERSION}.token`]
+
+  function seedClaimDir(): string {
+    const dir = createTestDir()
+    for (const name of [...claimNames, ...preservedNames]) {
+      writeFileSync(join(dir, name), 'x')
+    }
+    return dir
+  }
+
+  it('removes aged claim and bind scratch names without touching daemon artifacts', () => {
+    const dir = seedClaimDir()
+    try {
+      expect(sweepAbandonedDaemonClaims(dir, undefined, Date.now() + 24 * 60 * 60 * 1000)).toBe(
+        claimNames.length
+      )
+
+      for (const name of claimNames) {
+        expect(existsSync(join(dir, name))).toBe(false)
+      }
+      for (const name of preservedNames) {
+        expect(existsSync(join(dir, name))).toBe(true)
+      }
+    } finally {
+      rmSync(dir, { recursive: true, force: true })
+    }
+  })
+
+  it('leaves freshly written claims alone so an in-flight claim is never stolen', () => {
+    const dir = seedClaimDir()
+    try {
+      expect(sweepAbandonedDaemonClaims(dir)).toBe(0)
+
+      for (const name of [...claimNames, ...preservedNames]) {
+        expect(existsSync(join(dir, name))).toBe(true)
+      }
+    } finally {
+      rmSync(dir, { recursive: true, force: true })
+    }
+  })
+
+  it('returns zero for an unreadable runtime dir', () => {
+    expect(sweepAbandonedDaemonClaims(join(tmpdir(), `daemon-sweep-missing-${randomUUID()}`))).toBe(
+      0
+    )
+  })
+})
diff --git a/src/main/daemon/daemon-spawner.ts b/src/main/daemon/daemon-spawner.ts
index 3a571784f85..544245c5296 100644
--- a/src/main/daemon/daemon-spawner.ts
+++ b/src/main/daemon/daemon-spawner.ts
@@ -1,5 +1,13 @@
 import { createHash, randomUUID } from 'node:crypto'
-import { constants, copyFileSync, existsSync, readFileSync, renameSync, unlinkSync } from 'node:fs'
+import {
+  constants,
+  copyFileSync,
+  existsSync,
+  readFileSync,
+  renameSync,
+  unlinkSync,
+  writeFileSync
+} from 'node:fs'
 import { join } from 'node:path'
 import { PROTOCOL_VERSION } from './types'
 
@@ -113,6 +121,56 @@ export function serializeDaemonPidFile(pidFile: DaemonPidFile): string {
   return JSON.stringify(pidFile)
 }
 
+function isMissingFileError(error: unknown): boolean {
+  return typeof error === 'object' && error !== null && 'code' in error && error.code === 'ENOENT'
+}
+
+export function publishDaemonPidFile(pidPath: string, pidFile: DaemonPidFile): void {
+  writeFileSync(pidPath, serializeDaemonPidFile(pidFile), {
+    mode: 0o600,
+    flag: 'wx'
+  })
+}
+
+export function replaceDaemonPidFile(pidPath: string, pidFile: DaemonPidFile): boolean {
+  const claimedPath = `${pidPath}.replace-${process.pid}-${randomUUID()}`
+  let claimedExisting = false
+  try {
+    renameSync(pidPath, claimedPath)
+    claimedExisting = true
+  } catch (error) {
+    // Why: only a genuinely absent record is safe to treat as unclaimed. On Windows an
+    // external opener without FILE_SHARE_DELETE (AV, indexer, backup) fails the rename
+    // with EPERM/EACCES/EBUSY; falling through would then hit EEXIST on the exclusive
+    // publish and report a false ownership conflict for a record that is simply locked.
+    if (!isMissingFileError(error)) {
+      return false
+    }
+  }
+
+  try {
+    publishDaemonPidFile(pidPath, pidFile)
+  } catch {
+    if (claimedExisting && restoreClaimedDaemonArtifact(claimedPath, pidPath)) {
+      try {
+        unlinkSync(claimedPath)
+      } catch {
+        // A uniquely named restored claim is inert.
+      }
+    }
+    return false
+  }
+
+  if (claimedExisting) {
+    try {
+      unlinkSync(claimedPath)
+    } catch {
+      // The canonical record is authoritative; the uniquely named claim is inert.
+    }
+  }
+  return true
+}
+
 export function unlinkOwnedDaemonPidFile(
   pidPath: string,
   expectedPid: number,
@@ -120,7 +178,10 @@ export function unlinkOwnedDaemonPidFile(
 ): boolean {
   return claimAndUnlinkOwnedFile(pidPath, (content) => {
     try {
-      const parsed = JSON.parse(content) as { pid?: unknown; launchNonce?: unknown }
+      const parsed = JSON.parse(content) as {
+        pid?: unknown
+        launchNonce?: unknown
+      }
       return parsed.pid === expectedPid && parsed.launchNonce === expectedLaunchNonce
     } catch {
       return false
diff --git a/src/main/daemon/degraded-daemon-owner-recovery.ts b/src/main/daemon/degraded-daemon-owner-recovery.ts
new file mode 100644
index 00000000000..ec8798a5ce3
--- /dev/null
+++ b/src/main/daemon/degraded-daemon-owner-recovery.ts
@@ -0,0 +1,82 @@
+import type { IPtyProvider, PtySpawnOptions, PtySpawnResult } from '../providers/types'
+import type { DaemonPtyAdapter } from './daemon-pty-adapter'
+import { DaemonSessionOwnerResolver } from './daemon-session-owner-resolution'
+
+export class DegradedDaemonOwnerRecovery {
+  private readonly attachResolver: DaemonSessionOwnerResolver<IPtyProvider>
+  private readonly livenessResolver: DaemonSessionOwnerResolver<DaemonPtyAdapter>
+
+  constructor(
+    providers: readonly IPtyProvider[],
+    private readonly daemonAdapters: readonly DaemonPtyAdapter[],
+    routes: Map<string, IPtyProvider>,
+    private readonly spawnFresh: (opts: PtySpawnOptions) => Promise<PtySpawnResult>
+  ) {
+    this.attachResolver = new DaemonSessionOwnerResolver(providers, routes)
+    this.livenessResolver = new DaemonSessionOwnerResolver(daemonAdapters, routes)
+  }
+
+  spawn = async (opts: PtySpawnOptions): Promise<PtySpawnResult> => {
+    return opts.attachOnly && opts.sessionId
+      ? await this.attachResolver.spawnAttachOnly({ ...opts, sessionId: opts.sessionId })
+      : await this.spawnFresh(opts)
+  }
+
+  probe = async (sessionId: string): Promise<boolean | null> =>
+    await this.livenessResolver.probe(sessionId)
+
+  discoverRoutes = async (): Promise<void> => await this.attachResolver.discoverRoutes()
+
+  async reconcileOnStartup(validWorktreeIds: Set<string>): Promise<{
+    alive: string[]
+    killed: string[]
+  }> {
+    const alive: string[] = []
+    const killed: string[] = []
+    const aliveProviders = new Map<string, Set<DaemonPtyAdapter>>()
+    for (const adapter of this.daemonAdapters) {
+      const result = await adapter.reconcileOnStartup(validWorktreeIds)
+      for (const id of result.alive) {
+        alive.push(id)
+        const providers = aliveProviders.get(id) ?? new Set<DaemonPtyAdapter>()
+        providers.add(adapter)
+        aliveProviders.set(id, providers)
+      }
+      killed.push(...result.killed)
+    }
+    for (const id of new Set([...alive, ...killed])) {
+      const providers = aliveProviders.get(id)
+      if (providers?.size === 1) {
+        this.recordRoute(id, providers.values().next().value!)
+      } else {
+        this.forgetRoute(id)
+      }
+    }
+    return { alive, killed }
+  }
+
+  recordRoute(sessionId: string, provider: IPtyProvider): void {
+    this.attachResolver.recordRoute(sessionId, provider)
+    if (this.daemonAdapters.includes(provider as DaemonPtyAdapter)) {
+      this.livenessResolver.recordRoute(sessionId, provider as DaemonPtyAdapter)
+    }
+  }
+
+  forgetRoute(sessionId: string): void {
+    this.attachResolver.forgetRoute(sessionId)
+    this.livenessResolver.forgetRoute(sessionId)
+  }
+
+  subscribeIdentityChanges(): (() => void)[] {
+    return this.daemonAdapters.flatMap((adapter) =>
+      typeof adapter.onDaemonIdentityChanged === 'function'
+        ? [
+            adapter.onDaemonIdentityChanged(() => {
+              this.attachResolver.invalidateProvider(adapter)
+              this.livenessResolver.invalidateProvider(adapter)
+            })
+          ]
+        : []
+    )
+  }
+}
diff --git a/src/main/daemon/degraded-daemon-pty-provider.test.ts b/src/main/daemon/degraded-daemon-pty-provider.test.ts
index 644f732be02..af7c30d1c5d 100644
--- a/src/main/daemon/degraded-daemon-pty-provider.test.ts
+++ b/src/main/daemon/degraded-daemon-pty-provider.test.ts
@@ -4,6 +4,7 @@ import { DEGRADED_DAEMON_RECOVERY_RETRY_MS } from './degraded-daemon-fresh-spawn
 import type { DaemonPtyAdapter } from './daemon-pty-adapter'
 import type { IPtyProvider, PtySpawnOptions, PtySpawnResult } from '../providers/types'
 import type { PtyProcessInspection } from '../providers/pty-process-inspection'
+import { TerminalSessionOwnerUnverifiedError } from './daemon-errors'
 
 type ProviderMock = IPtyProvider & {
   probePtyLiveness: (id: string) => Promise<boolean | null>
@@ -158,6 +159,47 @@ it('forwards dead-endpoint write-unavailable signals from the daemon adapters',
   expect(recovered).toEqual(['daemon-pane', 'legacy-pane'])
 })
 
+it('routes attach-only to a legacy session created after startup inventory', async () => {
+  const current = createDaemonAdapter('daemon')
+  const legacySessions = ['legacy-at-startup']
+  const legacy = createDaemonAdapter('legacy', legacySessions)
+  const fallback = createProvider('fallback')
+  const provider = new DegradedDaemonPtyProvider({
+    current,
+    legacy: [legacy],
+    fallback
+  })
+  await provider.discoverDaemonSessions()
+  legacySessions.push('legacy-created-later')
+
+  await provider.spawn({
+    sessionId: 'legacy-created-later',
+    attachOnly: true,
+    cols: 80,
+    rows: 24
+  })
+
+  expect(legacy.spawn).toHaveBeenCalledOnce()
+  expect(current.spawn).not.toHaveBeenCalled()
+  expect(fallback.spawn).not.toHaveBeenCalled()
+})
+
+it('keeps an attach unresolved when a legacy inventory listing fails', async () => {
+  const current = createDaemonAdapter('daemon')
+  const legacy = createDaemonAdapter('legacy')
+  vi.mocked(legacy.listProcesses).mockRejectedValue(new Error('wedged'))
+  const provider = new DegradedDaemonPtyProvider({
+    current,
+    legacy: [legacy],
+    fallback: createProvider('fallback')
+  })
+
+  await expect(
+    provider.spawn({ sessionId: 'unknown-session', attachOnly: true, cols: 80, rows: 24 })
+  ).rejects.toBeInstanceOf(TerminalSessionOwnerUnverifiedError)
+  expect(current.spawn).not.toHaveBeenCalled()
+})
+
 it('rejects completion inspection instead of borrowing the fallback provider', async () => {
   const provider = new DegradedDaemonPtyProvider({
     current: createDaemonAdapter('daemon'),
@@ -368,7 +410,8 @@ describe('DegradedDaemonPtyProvider', () => {
   })
 
   it('probes daemon owners without borrowing fallback liveness', async () => {
-    const current = createDaemonAdapter('current')
+    const currentSessions: string[] = []
+    const current = createDaemonAdapter('current', currentSessions)
     const legacy = createDaemonAdapter('legacy')
     const fallback = createProvider('fallback', ['unknown-session'])
     const provider = new DegradedDaemonPtyProvider({ current, legacy: [legacy], fallback })
@@ -377,7 +420,7 @@ describe('DegradedDaemonPtyProvider', () => {
     await expect(provider.probePtyLiveness('unknown-session')).resolves.toBeNull()
     expect(fallback.probePtyLiveness).not.toHaveBeenCalled()
 
-    vi.mocked(current.probePtyLiveness).mockResolvedValue(true)
+    currentSessions.push('unknown-session')
     await expect(provider.probePtyLiveness('unknown-session')).resolves.toBe(true)
   })
 
@@ -529,6 +572,6 @@ describe('DegradedDaemonPtyProvider', () => {
     await expect(provider.listProcesses()).rejects.toThrow('legacy exited')
     expect(provider.getLegacyAdapters()).toEqual([legacy])
     expect(current.listProcesses).toHaveBeenCalledTimes(3)
-    expect(fallback.listProcesses).toHaveBeenCalledTimes(2)
+    expect(fallback.listProcesses).toHaveBeenCalledTimes(3)
   })
 })
diff --git a/src/main/daemon/degraded-daemon-pty-provider.ts b/src/main/daemon/degraded-daemon-pty-provider.ts
index 4fef029f03b..6b1c738b316 100644
--- a/src/main/daemon/degraded-daemon-pty-provider.ts
+++ b/src/main/daemon/degraded-daemon-pty-provider.ts
@@ -14,12 +14,11 @@ import type {
 import {
   adoptOwningProvider,
   attachDaemonOwnedSession,
-  discoverDegradedDaemonSessions,
   findDaemonAdapter,
   listProviderSessionIds
 } from './degraded-daemon-session-routing'
-import { probePtyOwners } from './daemon-pty-liveness-probe'
 import { DegradedDaemonFreshSpawnRouter } from './degraded-daemon-fresh-spawn-routing'
+import { DegradedDaemonOwnerRecovery } from './degraded-daemon-owner-recovery'
 
 export class DegradedDaemonPtyProvider implements IPtyProvider {
   readonly isDegraded = true
@@ -29,6 +28,7 @@ export class DegradedDaemonPtyProvider implements IPtyProvider {
   private fallback: IPtyProvider
   private sessionProviders = new Map<string, IPtyProvider>()
   private freshSpawns: DegradedDaemonFreshSpawnRouter
+  private ownerRecovery: DegradedDaemonOwnerRecovery
   private unsubscribers: (() => void)[] = []
   private dataListeners: ((payload: PtyDataEvent) => void)[] = []
   private exitListeners: ((payload: { id: string; code: number }) => void)[] = []
@@ -48,26 +48,27 @@ export class DegradedDaemonPtyProvider implements IPtyProvider {
       this.sessionProviders,
       opts.probeCurrentDaemonSpawn ?? null
     )
+    this.ownerRecovery = new DegradedDaemonOwnerRecovery(
+      this.allProviders(),
+      this.allDaemonAdapters(),
+      this.sessionProviders,
+      (spawnOpts) => this.freshSpawns.spawn(spawnOpts)
+    )
 
     for (const provider of this.allProviders()) {
       this.unsubscribers.push(
-        provider.onData((payload) => {
-          for (const listener of this.dataListeners) {
-            listener(payload)
-          }
-        }),
+        provider.onData((payload) => this.dataListeners.forEach((listener) => listener(payload))),
         provider.onExit((payload) => {
-          this.sessionProviders.delete(payload.id)
-          for (const listener of this.exitListeners) {
-            listener(payload)
-          }
+          this.ownerRecovery.forgetRoute(payload.id)
+          this.exitListeners.forEach((listener) => listener(payload))
         })
       )
     }
+    this.unsubscribers.push(...this.ownerRecovery.subscribeIdentityChanges())
   }
 
-  discoverDaemonSessions(): Promise<void> {
-    return discoverDegradedDaemonSessions(this.allDaemonAdapters(), this.sessionProviders)
+  async discoverDaemonSessions(): Promise<void> {
+    await this.ownerRecovery.discoverRoutes()
   }
 
   get routesFreshSpawnsToLocalProvider(): true | undefined {
@@ -82,7 +83,7 @@ export class DegradedDaemonPtyProvider implements IPtyProvider {
   canProvideAuthoritativeBufferSnapshot = (id: string): boolean =>
     this.freshSpawns.canProvideSnapshot(id)
 
-  spawn = (opts: PtySpawnOptions): Promise<PtySpawnResult> => this.freshSpawns.spawn(opts)
+  spawn = (opts: PtySpawnOptions): Promise<PtySpawnResult> => this.ownerRecovery.spawn(opts)
 
   // Why refuse the fallback route (unknown ids resolve to it): see attachDaemonOwnedSession.
   attach = (id: string): Promise<void> =>
@@ -94,7 +95,7 @@ export class DegradedDaemonPtyProvider implements IPtyProvider {
   }
 
   async probePtyLiveness(id: string): Promise<boolean | null> {
-    return await probePtyOwners(id, this.sessionProviders.get(id), this.allDaemonAdapters())
+    return await this.ownerRecovery.probe(id)
   }
 
   // Why: an unknown id cannot borrow listing authority from the fresh-spawn provider.
@@ -275,20 +276,7 @@ export class DegradedDaemonPtyProvider implements IPtyProvider {
     alive: string[]
     killed: string[]
   }> {
-    const alive: string[] = []
-    const killed: string[] = []
-    for (const adapter of this.allDaemonAdapters()) {
-      const result = await adapter.reconcileOnStartup(validWorktreeIds)
-      for (const id of result.alive) {
-        alive.push(id)
-        this.sessionProviders.set(id, adapter)
-      }
-      for (const id of result.killed) {
-        killed.push(id)
-        this.sessionProviders.delete(id)
-      }
-    }
-    return { alive, killed }
+    return await this.ownerRecovery.reconcileOnStartup(validWorktreeIds)
   }
 
   dispose(): void {
diff --git a/src/main/daemon/degraded-daemon-session-routing.ts b/src/main/daemon/degraded-daemon-session-routing.ts
index 8f0ef61d22b..688098c05f3 100644
--- a/src/main/daemon/degraded-daemon-session-routing.ts
+++ b/src/main/daemon/degraded-daemon-session-routing.ts
@@ -2,21 +2,6 @@ import type { IPtyProvider } from '../providers/types'
 import type { DaemonPtyAdapter } from './daemon-pty-adapter'
 import { SessionNotFoundError } from './daemon-errors'
 
-export async function discoverDegradedDaemonSessions(
-  adapters: readonly DaemonPtyAdapter[],
-  sessionProviders: Map<string, IPtyProvider>
-): Promise<void> {
-  for (const adapter of adapters) {
-    try {
-      for (const session of await adapter.listProcesses()) {
-        sessionProviders.set(session.id, adapter)
-      }
-    } catch (error) {
-      console.warn('[daemon] Failed to discover degraded daemon sessions', error)
-    }
-  }
-}
-
 export function listProviderSessionIds(
   sessionProviders: ReadonlyMap<string, IPtyProvider>,
   provider: IPtyProvider
diff --git a/src/main/daemon/production-launcher.test.ts b/src/main/daemon/production-launcher.test.ts
index 490f15124d7..4404c5c2c99 100644
--- a/src/main/daemon/production-launcher.test.ts
+++ b/src/main/daemon/production-launcher.test.ts
@@ -1,7 +1,7 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
-import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { existsSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import { createProductionLauncher } from './production-launcher'
 import { startDaemon, type DaemonHandle } from './daemon-main'
 import { DaemonClient } from './client'
@@ -148,18 +148,18 @@ describe('createProductionLauncher', () => {
     expect(handlers.exit).toHaveLength(0)
     expect(child.disconnect).toHaveBeenCalled()
     expect(child.unref).toHaveBeenCalled()
-    expect(JSON.parse(readFileSync(pidPath, 'utf8'))).toEqual({
-      pid: 12345,
-      startedAtMs: 123_456,
-      linuxStartTicks: '4242',
-      bootId: 'boot-a',
-      entryPath: join(dir, 'daemon-entry.js'),
-      appVersion: '1.2.3',
-      launchNonce: 'launch-a'
-    })
     expect(forkMock).toHaveBeenCalledWith(
       join(dir, 'daemon-entry.js'),
-      expect.arrayContaining(['--pid-record', pidPath, '--launch-nonce', 'launch-a']),
+      expect.arrayContaining([
+        '--pid-record',
+        pidPath,
+        '--launch-nonce',
+        'launch-a',
+        '--entry-path',
+        join(dir, 'daemon-entry.js'),
+        '--app-version',
+        '1.2.3'
+      ]),
       expect.objectContaining({ stdio: ['ignore', 'ignore', 'ignore', 'ipc'] })
     )
   })
@@ -208,7 +208,9 @@ describe('createProductionLauncher', () => {
       getDaemonEntryPath: () => join(dir, 'daemon-entry.js'),
       getAppVersion: () => '1.2.3'
     })
-    const launch = launcher(socketPathFor(dir), tokenPathFor(dir))
+    const pidPath = join(dir, 'daemon.pid')
+    writeFileSync(pidPath, JSON.stringify({ pid: 12345, launchNonce: 'launch-shutdown' }))
+    const launch = launcher(socketPathFor(dir), tokenPathFor(dir), pidPath, 'launch-shutdown')
     handlers.message[0]?.({ type: 'ready', startedAtMs: 123_456 })
     const handle = await launch
 
@@ -216,6 +218,7 @@ describe('createProductionLauncher', () => {
 
     expect(child.kill).toHaveBeenCalledWith('SIGTERM')
     expect(child.exitCode).toBe(0)
+    expect(existsSync(pidPath)).toBe(false)
   })
 
   it('rejects shutdown and releases child handles when SIGKILL never produces exit', async () => {
@@ -337,7 +340,7 @@ describe('createProductionLauncher', () => {
     }
   })
 
-  it('preserves PID publication and cleanup failures', async () => {
+  it('preserves exact PID ownership when child exit cannot be confirmed', async () => {
     const handlers: Record<string, ((arg?: unknown) => void)[]> = {
       message: [],
       error: [],
@@ -370,24 +373,65 @@ describe('createProductionLauncher', () => {
       unref: vi.fn()
     }
     forkMock.mockReturnValueOnce(child)
-    const pidPath = join(dir, 'occupied.pid')
-    writeFileSync(pidPath, 'occupied')
+    const launcher = createProductionLauncher({
+      getDaemonEntryPath: () => join(dir, 'daemon-entry.js'),
+      getAppVersion: () => '1.2.3'
+    })
+    const pidPath = join(dir, 'daemon.pid')
+    writeFileSync(pidPath, JSON.stringify({ pid: 12345, launchNonce: 'launch-b' }))
+
+    const launch = launcher(socketPathFor(dir), tokenPathFor(dir), pidPath, 'launch-b')
+    handlers.message[0]?.({ type: 'ready' })
+
+    const error = await launch.catch((caught: unknown) => caught)
+    expect(error).toBeInstanceOf(AggregateError)
+    expect((error as AggregateError).errors).toEqual([
+      expect.objectContaining({ message: 'Daemon readiness identity is incomplete' }),
+      signalError
+    ])
+    expect(child.disconnect).toHaveBeenCalledOnce()
+    expect(child.unref).toHaveBeenCalledOnce()
+    expect(existsSync(pidPath)).toBe(true)
+  })
+
+  it('removes exact child-side PID ownership after a pre-ready exit', async () => {
+    const handlers: Record<string, ((arg?: unknown) => void)[]> = {
+      message: [],
+      error: [],
+      exit: []
+    }
+    const child = {
+      pid: 12345,
+      connected: true,
+      exitCode: null as number | null,
+      signalCode: null as NodeJS.Signals | null,
+      on: vi.fn((event: string, cb: (arg?: unknown) => void) => {
+        handlers[event]?.push(cb)
+        return child
+      }),
+      off: vi.fn((event: string, cb: (arg?: unknown) => void) => {
+        handlers[event] = handlers[event]?.filter((handler) => handler !== cb) ?? []
+        return child
+      }),
+      disconnect: vi.fn(() => {
+        child.connected = false
+      }),
+      unref: vi.fn()
+    }
+    forkMock.mockReturnValueOnce(child)
+    const pidPath = join(dir, 'daemon.pid')
+    writeFileSync(pidPath, JSON.stringify({ pid: 12345, launchNonce: 'launch-c' }))
     const launcher = createProductionLauncher({
       getDaemonEntryPath: () => join(dir, 'daemon-entry.js'),
       getAppVersion: () => '1.2.3'
     })
 
-    const launch = launcher(socketPathFor(dir), tokenPathFor(dir), pidPath, 'launch-b')
-    handlers.message[0]?.({ type: 'ready', startedAtMs: 123_456 })
+    const launch = launcher(socketPathFor(dir), tokenPathFor(dir), pidPath, 'launch-c')
+    child.exitCode = 1
+    handlers.exit[0]?.(1)
 
-    const error = await launch.catch((caught: unknown) => caught)
-    expect(error).toBeInstanceOf(AggregateError)
-    expect((error as AggregateError).errors).toEqual([
-      expect.objectContaining({ code: 'EEXIST' }),
-      signalError
-    ])
-    expect(child.disconnect).toHaveBeenCalledOnce()
-    expect(child.unref).toHaveBeenCalledOnce()
+    await expect(launch).rejects.toThrow('Daemon process exited prematurely with code 1')
+    expect(existsSync(pidPath)).toBe(false)
   })
 })
 
diff --git a/src/main/daemon/production-launcher.ts b/src/main/daemon/production-launcher.ts
index 79bf439eead..342ff6e94ba 100644
--- a/src/main/daemon/production-launcher.ts
+++ b/src/main/daemon/production-launcher.ts
@@ -1,7 +1,6 @@
 import { fork, type ChildProcess } from 'node:child_process'
-import { writeFileSync } from 'node:fs'
 import {
-  serializeDaemonPidFile,
+  unlinkOwnedDaemonPidFile,
   type DaemonLauncher,
   type DaemonProcessHandle
 } from './daemon-spawner'
@@ -28,6 +27,7 @@ export function createProductionLauncher(opts: ProductionLauncherOptions): Daemo
     }
     const entryPath = opts.getDaemonEntryPath()
 
+    const appVersion = opts.getAppVersion()
     const child = fork(
       entryPath,
       [
@@ -35,7 +35,18 @@ export function createProductionLauncher(opts: ProductionLauncherOptions): Daemo
         socketPath,
         '--token',
         tokenPath,
-        ...(pidPath && launchNonce ? ['--pid-record', pidPath, '--launch-nonce', launchNonce] : [])
+        ...(pidPath && launchNonce
+          ? [
+              '--pid-record',
+              pidPath,
+              '--launch-nonce',
+              launchNonce,
+              '--entry-path',
+              entryPath,
+              '--app-version',
+              appVersion
+            ]
+          : [])
       ],
       {
         // Why: detached daemon output is not consumed; ignored streams cannot
@@ -47,31 +58,18 @@ export function createProductionLauncher(opts: ProductionLauncherOptions): Daemo
       }
     )
 
-    let readyIdentity: DaemonReadyIdentity
     try {
-      readyIdentity = await waitForReady(child)
+      await waitForReady(child)
     } catch (error) {
-      return rejectAfterChildCleanup(child, error)
+      return rejectAfterChildCleanup(child, error, pidPath, launchNonce)
     }
-    if (pidPath && launchNonce) {
-      if (!Number.isSafeInteger(child.pid) || (child.pid as number) <= 0) {
-        return rejectAfterChildCleanup(child, new Error('Daemon readiness identity is incomplete'))
-      }
-      try {
-        writeFileSync(
-          pidPath,
-          serializeDaemonPidFile({
-            pid: child.pid as number,
-            ...readyIdentity,
-            entryPath,
-            appVersion: opts.getAppVersion(),
-            launchNonce
-          }),
-          { mode: 0o600, flag: 'wx' }
-        )
-      } catch (error) {
-        return rejectAfterChildCleanup(child, error)
-      }
+    if (!Number.isSafeInteger(child.pid) || (child.pid as number) <= 0) {
+      return rejectAfterChildCleanup(
+        child,
+        new Error('Daemon readiness identity is incomplete'),
+        pidPath,
+        launchNonce
+      )
     }
 
     // Unref so the Electron process can exit without waiting for the daemon
@@ -79,7 +77,10 @@ export function createProductionLauncher(opts: ProductionLauncherOptions): Daemo
     child.disconnect()
 
     return {
-      shutdown: () => shutdownChild(child)
+      shutdown: async () => {
+        await shutdownChild(child)
+        unlinkLaunchedDaemonPidFile(child, pidPath, launchNonce)
+      }
     }
   }
 }
@@ -208,7 +209,12 @@ async function shutdownChild(child: ChildProcess): Promise<void> {
   }
 }
 
-async function rejectAfterChildCleanup(child: ChildProcess, launchError: unknown): Promise<never> {
+async function rejectAfterChildCleanup(
+  child: ChildProcess,
+  launchError: unknown,
+  pidPath?: string,
+  launchNonce?: string
+): Promise<never> {
   try {
     await shutdownChild(child)
   } catch (cleanupError) {
@@ -217,9 +223,20 @@ async function rejectAfterChildCleanup(child: ChildProcess, launchError: unknown
       'Daemon launch and child cleanup both failed'
     )
   }
+  unlinkLaunchedDaemonPidFile(child, pidPath, launchNonce)
   throw launchError
 }
 
+function unlinkLaunchedDaemonPidFile(
+  child: ChildProcess,
+  pidPath?: string,
+  launchNonce?: string
+): void {
+  if (pidPath && launchNonce && Number.isSafeInteger(child.pid) && (child.pid as number) > 0) {
+    unlinkOwnedDaemonPidFile(pidPath, child.pid as number, launchNonce)
+  }
+}
+
 function isNoSuchProcessError(error: unknown): boolean {
   return typeof error === 'object' && error !== null && 'code' in error && error.code === 'ESRCH'
 }
diff --git a/src/main/ipc/pty.test.ts b/src/main/ipc/pty.test.ts
index c91c7d23dfd..877d7d8862c 100644
--- a/src/main/ipc/pty.test.ts
+++ b/src/main/ipc/pty.test.ts
@@ -14,6 +14,7 @@ import type { TuiAgent } from '../../shared/types'
 import type { AgentSessionOwnerBinding } from '../../shared/agent-session-host-authority'
 import { AGENT_SESSION_CLAIM_DIGEST_VERSION } from '../../shared/agent-session-host-authority'
 import { PtyWriteUnavailableError } from '../providers/pty-write-unavailable-error'
+import { TerminalSessionOwnerUnverifiedError } from '../daemon/daemon-errors'
 
 const isWindowsHost = process.platform === 'win32'
 const posixOnlyIt = isWindowsHost ? it.skip : it
@@ -9009,14 +9010,15 @@ describe('registerPtyHandlers', () => {
     }
   )
 
-  it('adopts an exact persisted owner when the runtime projection is missing', async () => {
+  it('repairs a stale persisted incarnation after exact same-id reattach', async () => {
     const tabId = 'tab-persisted-owner'
     const leafId = '88888888-8888-4888-8888-888888888888'
     const paneKey = makePaneKey(tabId, leafId)
     const worktreeId = 'repo-1::/tmp/persisted-owner'
+    let attachAttempt = 0
     const providerSpawn = vi.fn(async (options: { attachOnly?: boolean; sessionId?: string }) => ({
       id: options.sessionId ?? 'unexpected-fresh-id',
-      incarnationId: 'inc-persisted-owner',
+      incarnationId: attachAttempt++ === 1 ? 'inc-wrong-owner' : 'inc-live-owner',
       isReattach: options.attachOnly === true,
       snapshot: 'persisted-owner-output'
     }))
@@ -9067,10 +9069,10 @@ describe('registerPtyHandlers', () => {
           [tabId]: { ptyIdsByLeafId: { [leafId]: 'pty-persisted-owner' } }
         },
         terminalPtyIncarnationsByPaneKey: {
-          [paneKey]: 'inc-persisted-owner'
+          [paneKey]: 'inc-stale-owner'
         }
       })),
-      persistPtyBinding: vi.fn()
+      persistPtyBinding: vi.fn(() => true)
     }
 
     registerPtyHandlers(
@@ -9081,7 +9083,7 @@ describe('registerPtyHandlers', () => {
       undefined,
       store as never
     )
-    const mounted = await handlers.get('pty:spawn')!(null, {
+    const spawnArgs = {
       cols: 80,
       rows: 24,
       cwd: '/tmp/persisted-owner',
@@ -9094,18 +9096,22 @@ describe('registerPtyHandlers', () => {
         ORCA_TAB_ID: tabId,
         ORCA_WORKTREE_ID: worktreeId
       }
-    })
+    }
+
+    const mounted = await handlers.get('pty:spawn')!(null, spawnArgs)
 
     expect(mounted).toMatchObject({
       id: 'pty-persisted-owner',
-      incarnationId: 'inc-persisted-owner',
+      incarnationId: 'inc-live-owner',
       isReattach: true
     })
-    expect(providerSpawn).toHaveBeenCalledOnce()
-    expect(providerSpawn).toHaveBeenCalledWith(
+    expect(providerSpawn).toHaveBeenNthCalledWith(
+      1,
       expect.objectContaining({
         attachOnly: true,
         sessionId: 'pty-persisted-owner',
+        expectedIncarnationId: 'inc-stale-owner',
+        expectedIncarnationIsAuthoritative: false,
         command: undefined
       })
     )
@@ -9115,10 +9121,50 @@ describe('registerPtyHandlers', () => {
     )
     expect(runtime.noteTerminalSpawnCommand).not.toHaveBeenCalled()
     expect(store.persistPtyBinding).toHaveBeenCalledOnce()
+    expect(store.persistPtyBinding).toHaveBeenCalledWith(
+      expect.objectContaining({
+        worktreeId,
+        tabId,
+        leafId,
+        ptyId: 'pty-persisted-owner',
+        incarnationId: 'inc-live-owner',
+        expectedBinding: {
+          ptyId: 'pty-persisted-owner',
+          incarnationId: 'inc-stale-owner'
+        }
+      }),
+      undefined
+    )
     expect(
       mainWindow.webContents.send.mock.calls.filter(([channel]) => channel === 'pty:spawned')
     ).toHaveLength(1)
     expect(runtime.onPtyExit).not.toHaveBeenCalled()
+
+    store.persistPtyBinding.mockClear()
+    await expect(handlers.get('pty:spawn')!(null, spawnArgs)).rejects.toThrow(
+      'terminal_pane_owner_changed'
+    )
+    expect(store.persistPtyBinding).not.toHaveBeenCalled()
+
+    runtime.assertPtyRegistrationAllowed.mockImplementationOnce(() => {
+      throw new Error('agent_session_exited_during_start')
+    })
+    await expect(handlers.get('pty:spawn')!(null, spawnArgs)).rejects.toThrow(
+      'agent_session_exited_during_start'
+    )
+    expect(store.persistPtyBinding).not.toHaveBeenCalled()
+    expect(providerSpawn).toHaveBeenCalledTimes(3)
+    expect(providerSpawn).toHaveBeenNthCalledWith(
+      2,
+      expect.objectContaining({
+        attachOnly: true,
+        sessionId: 'pty-persisted-owner',
+        expectedIncarnationId: 'inc-live-owner',
+        expectedIncarnationIsAuthoritative: true,
+        command: undefined
+      })
+    )
+    clearProviderPtyState('pty-persisted-owner')
   })
 
   it.each([
@@ -9295,29 +9341,22 @@ describe('registerPtyHandlers', () => {
     }
   )
 
-  it.each([
-    { label: 'another owner reports it alive', liveness: true },
-    { label: 'no owner could answer', liveness: null }
-  ])('keeps a persisted owner whose absence is unproven ($label)', async ({ liveness }) => {
+  it('keeps a persisted owner when daemon routing is unresolved', async () => {
     const worktreeId = 'repo-1::/tmp/unproven-owner'
     const cwd = '/tmp/unproven-owner'
     const tabId = 'tab-unproven-owner'
     const leafId = '56565656-5656-4656-8656-565656565656'
     const paneKey = makePaneKey(tabId, leafId)
-    // Why: a degraded router answers unmapped ids from the local fallback, which never
-    // owned this daemon session — the same "Session not found" a truly dead PTY yields.
     const providerSpawn = vi.fn(
       async (options: { attachOnly?: boolean; command?: string; sessionId?: string }) => {
         if (options.attachOnly) {
-          throw new Error('Session not found: pty-unproven-owner')
+          throw new TerminalSessionOwnerUnverifiedError('pty-unproven-owner')
         }
         return { id: 'pty-fresh-unproven', incarnationId: 'inc-fresh-unproven' }
       }
     )
-    const probePtyLiveness = vi.fn(async () => liveness)
     setLocalPtyProvider({
       spawn: providerSpawn,
-      probePtyLiveness,
       write: vi.fn(),
       resize: vi.fn(),
       kill: vi.fn(),
@@ -9410,7 +9449,6 @@ describe('registerPtyHandlers', () => {
       })
     ).rejects.toThrow('terminal_pane_owner_unverified')
 
-    expect(probePtyLiveness).toHaveBeenCalledWith('pty-unproven-owner')
     // The live PTY keeps its pane binding, gets no synthetic exit, and is not duplicated.
     expect(providerSpawn).toHaveBeenCalledOnce()
     expect(providerSpawn.mock.calls[0]?.[0]).toMatchObject({ attachOnly: true })
@@ -9420,11 +9458,7 @@ describe('registerPtyHandlers', () => {
     expect(session.tabsByWorktree[worktreeId]).toHaveLength(1)
   })
 
-  // Why the positive direction needs its own case: the sibling retire tests use providers with
-  // no `probePtyLiveness`, so they skip this guard entirely. Without this, the guard could be
-  // strengthened into a permanent veto — no daemon-backed pane could ever recover from a dead
-  // owner — and every suite would stay green.
-  it('still retires and respawns when a provider proves the owner is absent', async () => {
+  it('still retires and respawns when the routed provider confirms absence', async () => {
     const worktreeId = 'repo-1::/tmp/proven-absent-owner'
     const cwd = '/tmp/proven-absent-owner'
     const tabId = 'tab-proven-absent-owner'
@@ -9438,10 +9472,8 @@ describe('registerPtyHandlers', () => {
         return { id: 'pty-fresh-proven', incarnationId: 'inc-fresh-proven' }
       }
     )
-    const probePtyLiveness = vi.fn(async () => false)
     setLocalPtyProvider({
       spawn: providerSpawn,
-      probePtyLiveness,
       write: vi.fn(),
       resize: vi.fn(),
       kill: vi.fn(),
@@ -9532,8 +9564,6 @@ describe('registerPtyHandlers', () => {
       }
     })
 
-    expect(probePtyLiveness).toHaveBeenCalledWith('pty-proven-absent-owner')
-    // Proven absence is the one answer that authorizes retirement, so recovery must proceed.
     expect(mounted).toMatchObject({ id: 'pty-fresh-proven' })
     expect(providerSpawn).toHaveBeenCalledTimes(2)
     expect(providerSpawn.mock.calls[1]?.[0]).toMatchObject({
@@ -9548,6 +9578,124 @@ describe('registerPtyHandlers', () => {
     expect(store.flushOrThrow).toHaveBeenCalledOnce()
   })
 
+  it('does not poll after the routed provider confirms absence', async () => {
+    const worktreeId = 'repo-1::/tmp/probe-blip-owner'
+    const cwd = '/tmp/probe-blip-owner'
+    const tabId = 'tab-probe-blip-owner'
+    const leafId = '67676767-6767-4767-8767-676767676767'
+    const paneKey = makePaneKey(tabId, leafId)
+    const providerSpawn = vi.fn(
+      async (options: { attachOnly?: boolean; command?: string; sessionId?: string }) => {
+        if (options.attachOnly) {
+          throw new Error('Session not found: pty-probe-blip-owner')
+        }
+        return { id: 'pty-fresh-probe-blip', incarnationId: 'inc-fresh-probe-blip' }
+      }
+    )
+    const probePtyLiveness = vi.fn(async () => null)
+    setLocalPtyProvider({
+      spawn: providerSpawn,
+      probePtyLiveness,
+      write: vi.fn(),
+      resize: vi.fn(),
+      kill: vi.fn(),
+      shutdown: vi.fn(),
+      sendSignal: vi.fn(),
+      getCwd: vi.fn(),
+      getInitialCwd: vi.fn(),
+      clearBuffer: vi.fn(),
+      acknowledgeDataEvent: vi.fn(),
+      hasChildProcesses: vi.fn(),
+      getForegroundProcess: vi.fn(),
+      serialize: vi.fn(),
+      revive: vi.fn(),
+      onData: vi.fn(() => () => {}),
+      onReplay: vi.fn(() => () => {}),
+      onExit: vi.fn(() => () => {}),
+      listProcesses: vi.fn(async () => []),
+      attach: vi.fn(),
+      getDefaultShell: vi.fn(),
+      getProfiles: vi.fn()
+    } as never)
+    let session = {
+      tabsByWorktree: {
+        [worktreeId]: [{ id: tabId, worktreeId, ptyId: 'pty-probe-blip-owner' }]
+      },
+      terminalLayoutsByTabId: {
+        [tabId]: {
+          root: { type: 'leaf' as const, leafId },
+          activeLeafId: leafId,
+          expandedLeafId: null,
+          ptyIdsByLeafId: { [leafId]: 'pty-probe-blip-owner' }
+        }
+      },
+      terminalPtyIncarnationsByPaneKey: { [paneKey]: 'inc-probe-blip-owner' }
+    }
+    const store = {
+      getWorkspaceSession: vi.fn(() => session),
+      setWorkspaceSession: vi.fn((next) => {
+        session = next
+      }),
+      flushOrThrow: vi.fn(),
+      persistPtyBinding: vi.fn(),
+      getFolderWorkspace: vi.fn(() => undefined),
+      getFolderWorkspaces: vi.fn(() => []),
+      getProjectGroups: vi.fn(() => []),
+      getRepos: vi.fn(() => [])
+    }
+    const runtime = {
+      setPtyController: vi.fn(),
+      resolveTerminalPane: vi.fn(() => {
+        throw new Error('terminal_not_found')
+      }),
+      createPreAllocatedTerminalHandle: vi.fn(() => 'term-probe-blip'),
+      preAllocateHandleForPty: vi.fn(() => 'term-probe-blip'),
+      registerPreAllocatedHandleForPty: vi.fn(),
+      beginPtyRegistration: vi.fn(),
+      cancelPendingPtyRegistration: vi.fn(),
+      assertPtyRegistrationAllowed: vi.fn(),
+      registerPty: vi.fn(),
+      noteTerminalSpawnCommand: vi.fn(),
+      seedHeadlessTerminal: vi.fn(),
+      onPtySpawned: vi.fn(),
+      onPtyExit: vi.fn(),
+      onPtyData: vi.fn()
+    }
+
+    registerPtyHandlers(
+      mainWindow as never,
+      runtime as never,
+      undefined,
+      undefined,
+      undefined,
+      store as never
+    )
+
+    const mounted = await handlers.get('pty:spawn')!(null, {
+      cols: 80,
+      rows: 24,
+      cwd,
+      command: 'codex resume probe-blip-session',
+      worktreeId,
+      tabId,
+      leafId,
+      env: {
+        ORCA_PANE_KEY: paneKey,
+        ORCA_TAB_ID: tabId,
+        ORCA_WORKTREE_ID: worktreeId
+      }
+    })
+
+    expect(probePtyLiveness).not.toHaveBeenCalled()
+    expect(mounted).toMatchObject({ id: 'pty-fresh-probe-blip' })
+    expect(providerSpawn).toHaveBeenCalledTimes(2)
+    expect(runtime.onPtyExit).toHaveBeenCalledWith(
+      'pty-probe-blip-owner',
+      0,
+      'inc-probe-blip-owner'
+    )
+  })
+
   // Why: a parked pane (stopped with keepHistory) leaves the runtime holding the binding while
   // persistence has already dropped it. Reading "nothing left to retire" as a competing owner
   // aborted materialization *after* signalling the exit, which destroyed the pane instead of
@@ -9676,7 +9824,7 @@ describe('registerPtyHandlers', () => {
       }
     })
 
-    expect(probePtyLiveness).toHaveBeenCalledWith('pty-already-retired-owner')
+    expect(probePtyLiveness).not.toHaveBeenCalled()
     expect(mounted).toMatchObject({ id: 'pty-fresh-already-retired' })
     expect(providerSpawn).toHaveBeenCalledTimes(2)
     expect(providerSpawn.mock.calls[1]?.[0]).toMatchObject({
diff --git a/src/main/ipc/pty.ts b/src/main/ipc/pty.ts
index e4f50a62501..5d858cac7f3 100644
--- a/src/main/ipc/pty.ts
+++ b/src/main/ipc/pty.ts
@@ -93,6 +93,7 @@ import {
 import { resolveWslSessionContext } from '../daemon/wsl-session-context'
 import { addNodePtyRecoveryHint } from '../daemon/node-pty-error-hints'
 import { recordDaemonStreamBacklogEvent } from '../daemon/daemon-stream-backlog-probe'
+import { TerminalSessionOwnerUnverifiedError } from '../daemon/daemon-errors'
 import type { ClaudeRuntimeAuthPreparation } from '../claude-accounts/runtime-auth-service'
 import type { ClaudeAccountSelectionTarget } from '../claude-accounts/runtime-selection'
 import { CLAUDE_AUTH_ENV_VARS, hasClaudeAuthEnvConflict } from '../claude-accounts/environment'
@@ -599,6 +600,9 @@ type StablePaneOwner = {
   leafId: string
   ptyId: string
   incarnationId?: string
+  hasPersistedBinding?: true
+  persistedIncarnationId?: string
+  runtimeIncarnationId?: string
 }
 type StablePaneAdoption = {
   result: PtySpawnResult
@@ -677,13 +681,6 @@ function resolveStablePaneOwner(
     throw new Error('terminal_pane_owner_host_mismatch')
   }
   const runtimeIncarnationId = ptyIncarnationById.get(ptyId)
-  if (
-    runtimeIncarnationId &&
-    persisted?.incarnationId &&
-    runtimeIncarnationId !== persisted.incarnationId
-  ) {
-    throw new Error('terminal_pane_owner_conflict')
-  }
   const parsed = parsePaneKey(paneKey)
   if (!parsed) {
     return null
@@ -695,7 +692,10 @@ function resolveStablePaneOwner(
     ptyId,
     ...(runtimeIncarnationId || persisted?.incarnationId
       ? { incarnationId: runtimeIncarnationId ?? persisted?.incarnationId }
-      : {})
+      : {}),
+    ...(persisted ? { hasPersistedBinding: true as const } : {}),
+    ...(persisted?.incarnationId ? { persistedIncarnationId: persisted.incarnationId } : {}),
+    ...(runtimeIncarnationId ? { runtimeIncarnationId } : {})
   }
 }
 
@@ -717,7 +717,7 @@ function retirePersistedStablePaneOwner(
     // not a competing owner. Reporting failure here strands the pane after its PTY is proven dead.
     return true
   }
-  if (current.ptyId !== owner.ptyId || current.incarnationId !== owner.incarnationId) {
+  if (current.ptyId !== owner.ptyId || current.incarnationId !== owner.persistedIncarnationId) {
     return false
   }
   const session = store.getWorkspaceSession(hostId)
@@ -726,7 +726,7 @@ function retirePersistedStablePaneOwner(
     parentTabId: owner.tabId,
     leafId: owner.leafId,
     ptyId: owner.ptyId,
-    ...(owner.incarnationId ? { incarnationId: owner.incarnationId } : {})
+    ...(current.incarnationId ? { incarnationId: current.incarnationId } : {})
   })
   if (retired === session) {
     return false
@@ -748,6 +748,47 @@ type StablePaneSpawnContext = {
   onFreshSpawn?: (result: PtySpawnResult) => void
 }
 
+function stablePanePersistenceFence(
+  owner: StablePaneOwner | null
+): { ptyId: string; incarnationId?: string } | undefined {
+  return owner?.hasPersistedBinding
+    ? {
+        ptyId: owner.ptyId,
+        ...(owner.persistedIncarnationId ? { incarnationId: owner.persistedIncarnationId } : {})
+      }
+    : undefined
+}
+
+function persistAdmittedStablePaneBinding(args: {
+  store: Store | undefined
+  owner: StablePaneOwner | null
+  result: PtySpawnResult
+  worktreeId: string | undefined
+  startupCwd: string | undefined
+  connectionId: string | null | undefined
+}): boolean {
+  const expectedBinding = stablePanePersistenceFence(args.owner)
+  if (!args.store || !args.owner || !args.worktreeId || !expectedBinding) {
+    return false
+  }
+  const persisted = args.store.persistPtyBinding(
+    {
+      worktreeId: args.worktreeId,
+      tabId: args.owner.tabId,
+      leafId: args.owner.leafId,
+      ptyId: args.result.id,
+      ...(args.result.incarnationId ? { incarnationId: args.result.incarnationId } : {}),
+      ...(args.startupCwd ? { startupCwd: args.startupCwd } : {}),
+      expectedBinding
+    },
+    args.connectionId ? toSshExecutionHostId(args.connectionId) : undefined
+  )
+  if (persisted === false) {
+    throw new Error('terminal_pane_owner_changed')
+  }
+  return true
+}
+
 async function attachStablePaneOwner(
   args: StablePaneSpawnContext & { owner: StablePaneOwner }
 ): Promise<{ result: PtySpawnResult; owner: StablePaneOwner } | null> {
@@ -758,6 +799,8 @@ async function attachStablePaneOwner(
       ...spawnOptions,
       sessionId: owner.ptyId,
       attachOnly: true,
+      expectedIncarnationId: owner.runtimeIncarnationId ?? owner.persistedIncarnationId,
+      expectedIncarnationIsAuthoritative: owner.runtimeIncarnationId !== undefined,
       isNewSession: undefined,
       command: undefined,
       commandDelivery: undefined,
@@ -769,25 +812,19 @@ async function attachStablePaneOwner(
       onPtySpawnCommitted: undefined
     })
   } catch (error) {
+    if (error instanceof TerminalSessionOwnerUnverifiedError) {
+      throw new Error('terminal_pane_owner_unverified')
+    }
     if (!isPtyAlreadyGoneError(error)) {
       throw error
     }
-    // Why: "Session not found" only proves the provider we asked has no such PTY — and a
-    // degraded router answers unmapped ids from the local fallback, which never owned a
-    // daemon session. Retiring on that would signal exit and delete a live agent's pane
-    // binding. Absence must be proven across every possible owner first; `null` (nobody
-    // could answer) is not absence. Providers without a probe are their own sole owner,
-    // so their refusal stays authoritative.
-    if (provider.probePtyLiveness && (await provider.probePtyLiveness(owner.ptyId)) !== false) {
-      throw new Error('terminal_pane_owner_unverified')
-    }
     const ownerBeforeRetire = args.resolveOwner?.()
     if (
       ownerBeforeRetire &&
       (ownerBeforeRetire.ptyId !== owner.ptyId ||
-        (ownerBeforeRetire.incarnationId !== undefined &&
-          owner.incarnationId !== undefined &&
-          ownerBeforeRetire.incarnationId !== owner.incarnationId))
+        ownerBeforeRetire.runtimeIncarnationId !== owner.runtimeIncarnationId ||
+        ownerBeforeRetire.hasPersistedBinding !== owner.hasPersistedBinding ||
+        ownerBeforeRetire.persistedIncarnationId !== owner.persistedIncarnationId)
     ) {
       throw new Error('terminal_pane_owner_changed')
     }
@@ -808,7 +845,9 @@ async function attachStablePaneOwner(
   if (
     result.id !== owner.ptyId ||
     result.isReattach !== true ||
-    (owner.incarnationId !== undefined && result.incarnationId !== owner.incarnationId)
+    (owner.runtimeIncarnationId !== undefined &&
+      result.incarnationId !== owner.runtimeIncarnationId) ||
+    (result.incarnationId === undefined && owner.incarnationId !== undefined)
   ) {
     throw new Error('terminal_pane_owner_changed')
   }
@@ -4680,6 +4719,7 @@ export function registerPtyHandlers(
         : null
       let result: PtySpawnResult
       let stablePaneOwner: StablePaneOwner | null = null
+      let stablePaneBindingPersisted = false
       let rejectedRegistrationCandidate: PtySpawnResult | null = null
       let pendingRegistrationPtyId: string | null = null
       let preparedProvisionalExecutionContext = false
@@ -4902,6 +4942,24 @@ export function registerPtyHandlers(
             trustedTerminalHandleEnv.delete(args.preAllocatedHandle)
           }
         }
+        try {
+          stablePaneBindingPersisted = persistAdmittedStablePaneBinding({
+            store: hostSessionBinding?.store,
+            owner: stablePaneOwner,
+            result,
+            worktreeId: hostSessionBinding?.worktreeId,
+            startupCwd: cwd,
+            connectionId: args.connectionId
+          })
+        } catch (error) {
+          if (error instanceof Error && error.message === 'terminal_pane_owner_changed') {
+            throw error
+          }
+          console.error('[pty] failed to persist runtime PTY binding after attach:', error)
+          throw Object.assign(new Error(createTerminalSessionStateSaveFailureMessage()), {
+            agentSessionOperationOutcome: 'unknown' as const
+          })
+        }
         if (result.agentSessionEnsure?.disposition === 'adopted') {
           const owner = result.agentSessionEnsure.owner
           ptyOwnership.set(result.id, args.connectionId ?? ptyOwnership.get(result.id) ?? null)
@@ -4969,7 +5027,7 @@ export function registerPtyHandlers(
           target: codexSelectionTarget,
           settings: getSettings?.()
         })
-        if (hostSessionBinding) {
+        if (hostSessionBinding && !stablePaneBindingPersisted) {
           try {
             const binding = {
               worktreeId: hostSessionBinding.worktreeId,
@@ -5625,6 +5683,7 @@ export function registerPtyHandlers(
       let finishTerminalInstall = (): void => {}
       let result: PtySpawnResult
       let stablePaneOwner: StablePaneOwner | null = null
+      let stablePaneBindingPersisted = false
       let rejectedRegistrationCandidate: PtySpawnResult | null = null
       let pendingRegistrationPtyId: string | null = null
       let preparedProvisionalExecutionContext = false
@@ -6245,6 +6304,24 @@ export function registerPtyHandlers(
             trustedTerminalHandleEnv.delete(preAllocatedHandle)
           }
         }
+        try {
+          stablePaneBindingPersisted = persistAdmittedStablePaneBinding({
+            store,
+            owner: stablePaneOwner,
+            result,
+            worktreeId: args.worktreeId,
+            startupCwd: cwd,
+            connectionId: args.connectionId
+          })
+        } catch (error) {
+          if (error instanceof Error && error.message === 'terminal_pane_owner_changed') {
+            throw error
+          }
+          console.error('[pty] failed to persist PTY binding after attach:', error)
+          throw Object.assign(new Error(createTerminalSessionStateSaveFailureMessage()), {
+            agentSessionOperationOutcome: 'unknown' as const
+          })
+        }
         spawnTiming.log(result.id, {
           daemon: isDaemonHostSpawn,
           reattach: result.isReattach ?? false
@@ -6303,7 +6380,8 @@ export function registerPtyHandlers(
           store &&
           typeof args.worktreeId === 'string' &&
           typeof args.tabId === 'string' &&
-          validatedLeafId !== null
+          validatedLeafId !== null &&
+          !stablePaneBindingPersisted
         ) {
           try {
             const binding = {
diff --git a/src/main/persistence.test.ts b/src/main/persistence.test.ts
index 24cc6e512cc..0a48bbbb343 100644
--- a/src/main/persistence.test.ts
+++ b/src/main/persistence.test.ts
@@ -9033,6 +9033,221 @@ describe('Store', () => {
     ).toBeUndefined()
   })
 
+  it('reconciles only the incarnation of an unchanged durable PTY binding', async () => {
+    const store = await createStore()
+    const paneKey = `tab1:${TEST_LEAF_1}`
+    store.setWorkspaceSession({
+      ...getDefaultWorkspaceSession(),
+      tabsByWorktree: {
+        wt1: [makeTerminalTab({ id: 'tab1', worktreeId: 'wt1', ptyId: 'pty-1' })]
+      },
+      terminalLayoutsByTabId: {
+        tab1: {
+          root: { type: 'leaf', leafId: TEST_LEAF_1 },
+          activeLeafId: TEST_LEAF_1,
+          expandedLeafId: null,
+          ptyIdsByLeafId: { [TEST_LEAF_1]: 'pty-1' }
+        }
+      },
+      terminalPtyIncarnationsByPaneKey: { [paneKey]: 'inc-stale' }
+    })
+
+    expect(
+      store.persistPtyBinding({
+        worktreeId: 'wt1',
+        tabId: 'tab1',
+        leafId: TEST_LEAF_1,
+        ptyId: 'pty-1',
+        incarnationId: 'inc-live',
+        expectedBinding: { ptyId: 'pty-1', incarnationId: 'inc-stale' }
+      })
+    ).toBe(true)
+
+    expect(store.getWorkspaceSession().terminalPtyIncarnationsByPaneKey?.[paneKey]).toBe('inc-live')
+    const reloaded = await createStore()
+    expect(reloaded.getWorkspaceSession().terminalPtyIncarnationsByPaneKey?.[paneKey]).toBe(
+      'inc-live'
+    )
+  })
+
+  it('rejects competing PTY and incarnation changes during reconciliation', async () => {
+    const store = await createStore()
+    const paneKey = `tab1:${TEST_LEAF_1}`
+    store.setWorkspaceSession({
+      ...getDefaultWorkspaceSession(),
+      tabsByWorktree: {
+        wt1: [makeTerminalTab({ id: 'tab1', worktreeId: 'wt1', ptyId: 'pty-current' })]
+      },
+      terminalLayoutsByTabId: {
+        tab1: {
+          root: { type: 'leaf', leafId: TEST_LEAF_1 },
+          activeLeafId: TEST_LEAF_1,
+          expandedLeafId: null,
+          ptyIdsByLeafId: { [TEST_LEAF_1]: 'pty-current' }
+        }
+      },
+      terminalPtyIncarnationsByPaneKey: { [paneKey]: 'inc-current' }
+    })
+
+    for (const competing of [
+      { ptyId: 'pty-replaced', expectedIncarnationId: 'inc-current' },
+      { ptyId: 'pty-current', expectedIncarnationId: 'inc-replaced' }
+    ]) {
+      expect(
+        store.persistPtyBinding({
+          worktreeId: 'wt1',
+          tabId: 'tab1',
+          leafId: TEST_LEAF_1,
+          ptyId: competing.ptyId,
+          incarnationId: 'inc-live',
+          expectedBinding: {
+            ptyId: competing.ptyId,
+            incarnationId: competing.expectedIncarnationId
+          }
+        })
+      ).toBe(false)
+    }
+    expect(store.getWorkspaceSession().terminalPtyIncarnationsByPaneKey?.[paneKey]).toBe(
+      'inc-current'
+    )
+  })
+
+  it('reconciles only the requested execution-host partition', async () => {
+    const store = await createStore()
+    const paneKey = `tab1:${TEST_LEAF_1}`
+    const session = {
+      ...getDefaultWorkspaceSession(),
+      tabsByWorktree: {
+        wt1: [makeTerminalTab({ id: 'tab1', worktreeId: 'wt1', ptyId: 'pty-1' })]
+      },
+      terminalLayoutsByTabId: {
+        tab1: {
+          root: { type: 'leaf' as const, leafId: TEST_LEAF_1 },
+          activeLeafId: TEST_LEAF_1,
+          expandedLeafId: null,
+          ptyIdsByLeafId: { [TEST_LEAF_1]: 'pty-1' }
+        }
+      },
+      terminalPtyIncarnationsByPaneKey: { [paneKey]: 'inc-stale' }
+    }
+    store.setWorkspaceSession(structuredClone(session), 'local')
+    store.setWorkspaceSession(structuredClone(session), 'ssh:ssh-1')
+
+    expect(
+      store.persistPtyBinding(
+        {
+          worktreeId: 'wt1',
+          tabId: 'tab1',
+          leafId: TEST_LEAF_1,
+          ptyId: 'pty-1',
+          incarnationId: 'inc-remote-live',
+          expectedBinding: { ptyId: 'pty-1', incarnationId: 'inc-stale' }
+        },
+        'ssh:ssh-1'
+      )
+    ).toBe(true)
+
+    expect(store.getWorkspaceSession('local').terminalPtyIncarnationsByPaneKey?.[paneKey]).toBe(
+      'inc-stale'
+    )
+    expect(store.getWorkspaceSession('ssh:ssh-1').terminalPtyIncarnationsByPaneKey?.[paneKey]).toBe(
+      'inc-remote-live'
+    )
+  })
+
+  it.each([
+    { label: 'local', hostId: undefined },
+    { label: 'SSH', hostId: 'ssh:ssh-1' }
+  ])(
+    'preserves a reconciled incarnation across a renderer snapshot ($label)',
+    async ({ hostId }) => {
+      const store = await createStore()
+      const paneKey = `tab1:${TEST_LEAF_1}`
+      store.setWorkspaceSession(
+        {
+          ...getDefaultWorkspaceSession(),
+          tabsByWorktree: {
+            wt1: [makeTerminalTab({ id: 'tab1', worktreeId: 'wt1', ptyId: 'pty-1' })]
+          },
+          terminalLayoutsByTabId: {
+            tab1: {
+              root: { type: 'leaf', leafId: TEST_LEAF_1 },
+              activeLeafId: TEST_LEAF_1,
+              expandedLeafId: null,
+              ptyIdsByLeafId: { [TEST_LEAF_1]: 'pty-1' }
+            }
+          },
+          terminalPtyIncarnationsByPaneKey: { [paneKey]: 'inc-stale' }
+        },
+        hostId
+      )
+
+      expect(
+        store.persistPtyBinding(
+          {
+            worktreeId: 'wt1',
+            tabId: 'tab1',
+            leafId: TEST_LEAF_1,
+            ptyId: 'pty-1',
+            incarnationId: 'inc-live',
+            expectedBinding: { ptyId: 'pty-1', incarnationId: 'inc-stale' }
+          },
+          hostId
+        )
+      ).toBe(true)
+
+      const rendererSnapshot = structuredClone(store.getWorkspaceSession(hostId))
+      delete rendererSnapshot.terminalPtyIncarnationsByPaneKey
+      delete rendererSnapshot.terminalTopologyRevisionByRepoId
+      store.setWorkspaceSession(rendererSnapshot, hostId)
+
+      expect(store.getWorkspaceSession(hostId).terminalPtyIncarnationsByPaneKey?.[paneKey]).toBe(
+        'inc-live'
+      )
+      const reloaded = await createStore()
+      expect(reloaded.getWorkspaceSession(hostId).terminalPtyIncarnationsByPaneKey?.[paneKey]).toBe(
+        'inc-live'
+      )
+    }
+  )
+
+  it('rolls back incarnation reconciliation when the durability barrier fails', async () => {
+    const store = await createStore()
+    const paneKey = `tab1:${TEST_LEAF_1}`
+    store.setWorkspaceSession({
+      ...getDefaultWorkspaceSession(),
+      tabsByWorktree: {
+        wt1: [makeTerminalTab({ id: 'tab1', worktreeId: 'wt1', ptyId: 'pty-1' })]
+      },
+      terminalLayoutsByTabId: {
+        tab1: {
+          root: { type: 'leaf', leafId: TEST_LEAF_1 },
+          activeLeafId: TEST_LEAF_1,
+          expandedLeafId: null,
+          ptyIdsByLeafId: { [TEST_LEAF_1]: 'pty-1' }
+        }
+      },
+      terminalPtyIncarnationsByPaneKey: { [paneKey]: 'inc-stale' }
+    })
+    vi.spyOn(store, 'flushOrThrow').mockImplementationOnce(() => {
+      throw new Error('disk full')
+    })
+
+    expect(() =>
+      store.persistPtyBinding({
+        worktreeId: 'wt1',
+        tabId: 'tab1',
+        leafId: TEST_LEAF_1,
+        ptyId: 'pty-1',
+        incarnationId: 'inc-live',
+        expectedBinding: { ptyId: 'pty-1', incarnationId: 'inc-stale' }
+      })
+    ).toThrow('disk full')
+    expect(store.getWorkspaceSession().terminalPtyIncarnationsByPaneKey?.[paneKey]).toBe(
+      'inc-stale'
+    )
+  })
+
   it('adds a missing split leaf to the durable root when a new pane spawns before layout debounce', async () => {
     const store = await createStore()
     store.setWorkspaceSession({
diff --git a/src/main/persistence.ts b/src/main/persistence.ts
index af82bcbdd89..be3f10fd78f 100644
--- a/src/main/persistence.ts
+++ b/src/main/persistence.ts
@@ -6621,11 +6621,26 @@ export class Store {
       ptyId: string
       incarnationId?: string
       startupCwd?: string
+      expectedBinding?: { ptyId: string; incarnationId?: string }
     },
     hostId?: string | null
-  ): void {
+  ): boolean {
     const resolvedHostId = this.resolveHostId(hostId)
     const session = this.getWorkspaceSession(resolvedHostId)
+    const paneKey = `${args.tabId}:${args.leafId}`
+    if (args.expectedBinding) {
+      const tab = session.tabsByWorktree?.[args.worktreeId]?.find(
+        (candidate) => candidate.id === args.tabId && candidate.worktreeId === args.worktreeId
+      )
+      const boundPtyId = session.terminalLayoutsByTabId?.[args.tabId]?.ptyIdsByLeafId?.[args.leafId]
+      if (
+        !tab ||
+        boundPtyId !== args.expectedBinding.ptyId ||
+        session.terminalPtyIncarnationsByPaneKey?.[paneKey] !== args.expectedBinding.incarnationId
+      ) {
+        return false
+      }
+    }
     if (resolvedHostId !== LOCAL_EXECUTION_HOST_ID) {
       this.state.workspaceSessionsByHostId = {
         ...this.state.workspaceSessionsByHostId,
@@ -6633,15 +6648,17 @@ export class Store {
       }
     }
     const sessionBeforeBinding = cloneWorkspaceSessionState(session)
-    const paneKey = `${args.tabId}:${args.leafId}`
+    const reconciledIncarnation =
+      args.expectedBinding !== undefined &&
+      args.incarnationId !== args.expectedBinding.incarnationId
     let terminalMembershipChanged = false
-    const advanceTopologyAfterMembershipChange = (): void => {
+    const advanceTopologyFence = (): void => {
       const repoId = getRepoIdFromWorktreeId(args.worktreeId)
       const currentRevision = session.terminalTopologyRevisionByRepoId?.[repoId] ?? 0
-      if (!terminalMembershipChanged || currentRevision <= 0) {
+      if (!reconciledIncarnation && (!terminalMembershipChanged || currentRevision <= 0)) {
         return
       }
-      // Why: a real host-admitted spawn after a retirement must be distinguishable from a stale renderer replay.
+      // Why: host-admitted membership or incarnation changes must outrank a stale renderer replay.
       session.terminalTopologyRevisionByRepoId = {
         ...session.terminalTopologyRevisionByRepoId,
         [repoId]: currentRevision + 1
@@ -6696,14 +6713,14 @@ export class Store {
     }
     if (!isTerminalLeafId(args.leafId)) {
       // Why: keep legacy renderer-local pane ids out of durable leaf-keyed layout state after the UUID migration.
-      advanceTopologyAfterMembershipChange()
+      advanceTopologyFence()
       try {
         this.flushOrThrow()
       } catch (err) {
         restoreSession()
         throw err
       }
-      return
+      return true
     }
     const layout = session.terminalLayoutsByTabId?.[args.tabId]
     if (layout) {
@@ -6744,13 +6761,14 @@ export class Store {
         }
       }
     }
-    advanceTopologyAfterMembershipChange()
+    advanceTopologyFence()
     try {
       this.flushOrThrow()
     } catch (err) {
       restoreSession()
       throw err
     }
+    return true
   }
 
   // ── SSH Targets ────────────────────────────────────────────────────
diff --git a/src/main/providers/local-pty-provider.ts b/src/main/providers/local-pty-provider.ts
index d43158482c0..64dd9850930 100644
--- a/src/main/providers/local-pty-provider.ts
+++ b/src/main/providers/local-pty-provider.ts
@@ -38,6 +38,7 @@ import type { ShellReadySignal } from './local-pty-shell-ready'
 import { removeInheritedNoColor } from '../pty/terminal-color-env'
 import { removeAppImageRuntimeEnv } from '../pty/appimage-terminal-env'
 import { stripInheritedBuildModeEnv } from '../pty/build-mode-env'
+import { SessionNotFoundError } from '../daemon/daemon-errors'
 import { resolvePathEnvKey } from '../pty/windows-environment-path'
 import { isHostCodexHomeForWsl, isWslCodexHomeForHost } from '../pty/codex-home-wsl-env'
 import { addWslEnvKeys } from '../wsl-env'
@@ -546,7 +547,7 @@ export class LocalPtyProvider implements IPtyProvider {
       }
     }
     if (args.attachOnly) {
-      throw new Error(`Session not found: ${args.sessionId ?? ''}`)
+      throw new SessionNotFoundError(args.sessionId ?? '')
     }
     const id = allocatePtyId(reattachId ?? undefined)
     const incarnationId = randomUUID()
diff --git a/src/main/providers/pty-provider-contract.ts b/src/main/providers/pty-provider-contract.ts
index b766b11497d..98ab3d9b69b 100644
--- a/src/main/providers/pty-provider-contract.ts
+++ b/src/main/providers/pty-provider-contract.ts
@@ -64,6 +64,10 @@ export type PtySpawnOptions = {
   isNewSession?: boolean
   /** Attach the named session atomically or fail without creating a process. */
   attachOnly?: boolean
+  /** Exact persisted owner expected by an attach-only routing decision. */
+  expectedIncarnationId?: PtyIncarnationId
+  /** True when runtime state makes the expected incarnation a hard attach fence. */
+  expectedIncarnationIsAuthoritative?: boolean
   /** Why: allows the renderer to request a specific shell for a single new
    *  terminal tab (e.g. "open this tab in WSL" from the "+" submenu) without
    *  changing the user's persistent default shell setting. Only consulted on
diff --git a/src/main/runtime/orca-runtime.ts b/src/main/runtime/orca-runtime.ts
index 1a2aed7a74b..80a04d60554 100644
--- a/src/main/runtime/orca-runtime.ts
+++ b/src/main/runtime/orca-runtime.ts
@@ -1293,6 +1293,7 @@ type TerminalCreateOptions = {
   // CLI is `cursor-agent`). Callers that know the agent name it here instead of
   // guessing a command, and the runtime builds the configured launch.
   startupAgent?: TuiAgent
+  launchPreferences?: AgentLaunchPreferences
   terminalColorQueryReplies?: TerminalOscColorQueryReplyColors
   viewMode?: 'terminal' | 'chat'
   startupCommandDelivery?: WorktreeStartupLaunch['startupCommandDelivery']
@@ -20956,7 +20957,8 @@ export class OrcaRuntimeService {
   private buildStartupForAgent(
     repo: Repo,
     agent: TuiAgent,
-    prompt: string | undefined
+    prompt: string | undefined,
+    launchPreferences?: AgentLaunchPreferences
   ): { agent: TuiAgent; startup: WorktreeStartupLaunch; followup?: WorktreeStartupFollowup } {
     if (!this.store) {
       throw new Error('runtime_unavailable')
@@ -20974,12 +20976,15 @@ export class OrcaRuntimeService {
       isRemote,
       terminalWindowsShell: settings.terminalWindowsShell
     })
+    const sessionOptions = this.toAgentSessionOptions(launchPreferences)
     const startupPlan = buildAgentStartupPlan({
       agent,
       prompt: prompt ?? '',
       cmdOverrides: settings.agentCmdOverrides ?? {},
       agentArgs: resolveTuiAgentLaunchArgs(agent, settings.agentDefaultArgs),
       agentEnv: resolveTuiAgentLaunchEnv(agent, settings.agentDefaultEnv),
+      sessionOptions,
+      sessionOptionsOverrideAgentArgs: Boolean(sessionOptions),
       platform: agentLaunchPlatform,
       shell: queuedShell,
       isRemote,
@@ -21418,6 +21423,7 @@ export class OrcaRuntimeService {
     observeSetupCompletion?: boolean
     createdWithAgent?: TuiAgent
     startupAgent?: TuiAgent
+    startupLaunchPreferences?: AgentLaunchPreferences
     startupPrompt?: string
     pendingFirstAgentMessageRename?: boolean
     automationProvenance?: AutomationWorkspaceProvenance
@@ -21450,7 +21456,12 @@ export class OrcaRuntimeService {
     }
     const agentStartup =
       !args.startup && args.startupAgent
-        ? this.buildStartupForAgent(repo, args.startupAgent, args.startupPrompt)
+        ? this.buildStartupForAgent(
+            repo,
+            args.startupAgent,
+            args.startupPrompt,
+            args.startupLaunchPreferences
+          )
         : null
     const draftStartup =
       !args.startup && !agentStartup && args.startupDraft
@@ -24619,12 +24630,15 @@ export class OrcaRuntimeService {
       return opts
     }
 
+    const sessionOptions = this.toAgentSessionOptions(opts.launchPreferences)
     const startupPlan = buildAgentStartupPlan({
       agent,
       prompt: '',
       cmdOverrides: settings.agentCmdOverrides ?? {},
       agentArgs: resolveTuiAgentLaunchArgs(agent, settings.agentDefaultArgs),
       agentEnv: resolveTuiAgentLaunchEnv(agent, settings.agentDefaultEnv),
+      sessionOptions,
+      sessionOptionsOverrideAgentArgs: Boolean(sessionOptions),
       platform,
       shell: queuedShell,
       isRemote,
diff --git a/src/main/runtime/rpc/methods/orchestration-federated-worker-start.ts b/src/main/runtime/rpc/methods/orchestration-federated-worker-start.ts
index 538dadc96d0..23a6dc0928f 100644
--- a/src/main/runtime/rpc/methods/orchestration-federated-worker-start.ts
+++ b/src/main/runtime/rpc/methods/orchestration-federated-worker-start.ts
@@ -11,6 +11,14 @@ import type { OrcaRuntimeService } from '../../orca-runtime'
 import type { OrchestrationDb } from '../../orchestration/db'
 import { OrchestrationError } from '../../orchestration/orchestration-error'
 import type { WorkerStartInput } from './orchestration-worker-start-schema'
+import {
+  assertWorkerLaunchPreferencesRuntimeSupported,
+  assertWorkerLaunchPreferencesCreateTerminal,
+  createPendingWorkerLaunchReceipt,
+  resolveFederatedWorkerLaunchReceipt,
+  type OrchestrationWorkerLaunchReceipt
+} from './orchestration-worker-launch-preferences'
+import { validateFederatedWorkerStartPlacement } from './orchestration-worker-start-validation'
 
 export async function startFederatedWorker(args: {
   params: WorkerStartInput
@@ -40,7 +48,13 @@ export async function startFederatedWorker(args: {
     )
   }
   const createsWorktree = worktree === 'new-top-level'
-  validateRemoteWorkerStart(params, createsWorktree)
+  assertWorkerLaunchPreferencesCreateTerminal(params)
+  validateFederatedWorkerStartPlacement(params, createsWorktree)
+  const requestedLaunch = createPendingWorkerLaunchReceipt({
+    agent: isTuiAgent(params.agent) ? params.agent : null,
+    model: params.model,
+    effort: params.effort
+  })
 
   const server = runtime.resolveOrchestrationWorkerServer(params.on as string)
   const status = (await runtime.callOrchestrationWorkerServer(
@@ -62,6 +76,12 @@ export async function startFederatedWorker(args: {
       `Connected server ${server.name} does not support orchestration federation.`
     )
   }
+  assertWorkerLaunchPreferencesRuntimeSupported({
+    model: params.model,
+    effort: params.effort,
+    capabilities: status.capabilities,
+    serverName: server.name
+  })
   const federationProtocolVersion = status.capabilities?.includes(
     ORCHESTRATION_FEDERATION_CONTROL_MAIL_RUNTIME_CAPABILITY
   )
@@ -81,6 +101,7 @@ export async function startFederatedWorker(args: {
       baseBranch: params.baseBranch ?? null,
       terminal: params.terminal ?? null,
       agent: params.agent ?? null,
+      launch: requestedLaunch,
       timeoutMs: params.timeoutMs ?? 60_000,
       setup: setupDecision,
       setupSource: createsWorktree
@@ -122,6 +143,8 @@ export async function startFederatedWorker(args: {
           : undefined,
         terminal: params.terminal,
         agent: params.agent,
+        model: params.model,
+        effort: params.effort,
         timeoutMs: params.timeoutMs,
         devMode: params.devMode
       },
@@ -134,6 +157,11 @@ export async function startFederatedWorker(args: {
         'The worker server returned a different Dispatch attachment.'
       )
     }
+    const launch = resolveFederatedWorkerLaunchReceipt(
+      remote.launch,
+      requestedLaunch,
+      remote.state === 'ready'
+    )
     if (remote.state === 'ready' && remote.worktreeId && remote.terminalHandle) {
       db.updateFederatedDispatchResources({
         dispatchId: started.dispatch.id,
@@ -160,6 +188,7 @@ export async function startFederatedWorker(args: {
         stage: readyWorker.stage,
         server: { environmentId: server.environmentId, name: server.name },
         setup: remote.setup,
+        launch,
         timeoutMs: params.timeoutMs ?? 60_000,
         effects: remote.effects ?? [],
         residualResources: remote.residualResources ?? []
@@ -171,7 +200,7 @@ export async function startFederatedWorker(args: {
         remote.failedStage ?? 'remote_attach',
         remote.lastError ?? 'The worker server reported an unknown start outcome.'
       )
-      return federatedUnknownReceipt(worker, task.id, server.name)
+      return federatedUnknownReceipt(worker, task.id, server.name, launch)
     }
     const worker = db.failWorkerStart(
       started.dispatch.id,
@@ -188,6 +217,7 @@ export async function startFederatedWorker(args: {
       failedStage: worker.stage,
       lastError: worker.last_error,
       setup: remote.setup,
+      launch,
       effects: remote.effects ?? [],
       residualResources: remote.residualResources ?? []
     }
@@ -204,12 +234,13 @@ export async function startFederatedWorker(args: {
         server: { environmentId: server.environmentId, name: server.name },
         failedStage: worker.stage,
         lastError: worker.last_error,
+        launch: requestedLaunch,
         effects: [],
         residualResources: []
       }
     }
     const worker = db.markWorkerStartUnknown(started.dispatch.id, 'remote_attach', reason)
-    return federatedUnknownReceipt(worker, task.id, server.name)
+    return federatedUnknownReceipt(worker, task.id, server.name, requestedLaunch)
   }
 }
 
@@ -220,45 +251,13 @@ type RemoteStartReceipt = {
   worktreeId?: string
   terminalHandle?: string
   setup?: { state: string }
+  launch?: OrchestrationWorkerLaunchReceipt
   effects?: unknown[]
   residualResources?: unknown[]
   failedStage?: string
   lastError?: string
 }
 
-function validateRemoteWorkerStart(params: WorkerStartInput, createsWorktree: boolean): void {
-  if (createsWorktree && (!params.name || !params.repo)) {
-    throw new OrchestrationError(
-      'invalid_argument',
-      'Remote new-top-level requires --name and an explicit --repo from remote discovery.'
-    )
-  }
-  if (createsWorktree && params.terminal) {
-    throw new OrchestrationError(
-      'invalid_argument',
-      '--terminal cannot combine with remote new-worktree creation.'
-    )
-  }
-  if (!createsWorktree && (params.name || params.repo || params.baseBranch || params.setup)) {
-    throw new OrchestrationError(
-      'invalid_argument',
-      'Creation and setup options apply only to remote new-top-level worktrees.'
-    )
-  }
-  if (params.terminal && params.agent) {
-    throw new OrchestrationError(
-      'invalid_argument',
-      '--terminal reuses an existing agent and cannot combine with --agent.'
-    )
-  }
-  if (!params.terminal && (!params.agent || !isTuiAgent(params.agent))) {
-    throw new OrchestrationError(
-      'agent_unconfigured',
-      'A configured --agent is required when remote worker-start creates a terminal.'
-    )
-  }
-}
-
 function isKnownRemoteStartFailure(code: string): boolean {
   return [
     'invalid_argument',
@@ -272,7 +271,8 @@ function isKnownRemoteStartFailure(code: string): boolean {
 function federatedUnknownReceipt(
   worker: { dispatch_id: string; state: string; stage: string; last_error: string | null },
   taskId: string,
-  serverName: string
+  serverName: string,
+  launch: OrchestrationWorkerLaunchReceipt
 ): unknown {
   return {
     taskId,
@@ -280,6 +280,7 @@ function federatedUnknownReceipt(
     state: 'outcome_unknown',
     stage: worker.stage,
     server: { name: serverName },
+    launch,
     failedStage: worker.stage,
     lastError: worker.last_error,
     effects: [],
diff --git a/src/main/runtime/rpc/methods/orchestration-federation-agent-launch.test.ts b/src/main/runtime/rpc/methods/orchestration-federation-agent-launch.test.ts
index 15b2194140a..486821231e1 100644
--- a/src/main/runtime/rpc/methods/orchestration-federation-agent-launch.test.ts
+++ b/src/main/runtime/rpc/methods/orchestration-federation-agent-launch.test.ts
@@ -61,7 +61,9 @@ describe('federated worker agent launch', () => {
         taskSpec: 'remote cursor worker',
         protocolVersion: 1,
         worktree: 'id:repo::remote-worktree',
-        agent: 'cursor'
+        agent: 'cursor',
+        model: 'gpt-5.3-codex',
+        effort: 'high'
       }),
       {
         runtime,
@@ -72,14 +74,28 @@ describe('federated worker agent launch', () => {
           payloadHash: 'remote_payload'
         }
       }
-    )) as { state: string; failedStage?: string; lastError?: string }
+    )) as {
+      state: string
+      failedStage?: string
+      lastError?: string
+      launch: unknown
+    }
 
     // Why: assert the worker actually reached ready — a spy-only assertion would
     // stay green even if every stage after terminal_create regressed.
-    expect(result).toMatchObject({ state: 'ready' })
+    expect(result).toMatchObject({
+      state: 'ready',
+      launch: {
+        requested: { agent: 'cursor', model: 'gpt-5.3-codex', effort: 'high' },
+        effective: { agent: 'cursor', model: 'gpt-5.3-codex', effort: 'high' }
+      }
+    })
     expect(createTerminal).toHaveBeenCalledWith(
       'id:repo::remote-worktree',
-      expect.objectContaining({ startupAgent: 'cursor' })
+      expect.objectContaining({
+        startupAgent: 'cursor',
+        launchPreferences: { model: 'gpt-5.3-codex', effort: 'high' }
+      })
     )
     expect(createTerminal).toHaveBeenCalledWith(
       'id:repo::remote-worktree',
diff --git a/src/main/runtime/rpc/methods/orchestration-federation-start-receipt.ts b/src/main/runtime/rpc/methods/orchestration-federation-start-receipt.ts
index b7e2da76531..fa9b60facba 100644
--- a/src/main/runtime/rpc/methods/orchestration-federation-start-receipt.ts
+++ b/src/main/runtime/rpc/methods/orchestration-federation-start-receipt.ts
@@ -1,6 +1,7 @@
 import type { OrchestrationDb } from '../../orchestration/db'
 import { isFederationEffectUnknown } from './orchestration-federation-effects'
 import type { WorkerSetupReceipt } from './orchestration-worker-topology'
+import type { OrchestrationWorkerLaunchReceipt } from './orchestration-worker-launch-preferences'
 
 export function failFederatedAttachmentWithReceipt(args: {
   db: OrchestrationDb
@@ -9,6 +10,7 @@ export function failFederatedAttachmentWithReceipt(args: {
   failedStage: string
   error: unknown
   setup: WorkerSetupReceipt
+  launch: OrchestrationWorkerLaunchReceipt
 }): unknown {
   const reason = args.error instanceof Error ? args.error.message : String(args.error)
   const unknown = isFederationEffectUnknown(args.error, args.failedStage)
@@ -26,6 +28,7 @@ export function failFederatedAttachmentWithReceipt(args: {
     failedStage: args.failedStage,
     lastError: reason,
     setup: args.setup,
+    launch: args.launch,
     effects: JSON.parse(attachment.effects) as unknown[],
     residualResources: JSON.parse(attachment.residual_resources) as unknown[]
   }
diff --git a/src/main/runtime/rpc/methods/orchestration-federation-start-schema.ts b/src/main/runtime/rpc/methods/orchestration-federation-start-schema.ts
index a657ff7d09c..e6bea35c20a 100644
--- a/src/main/runtime/rpc/methods/orchestration-federation-start-schema.ts
+++ b/src/main/runtime/rpc/methods/orchestration-federation-start-schema.ts
@@ -1,5 +1,6 @@
 import { z } from 'zod'
 import { OptionalFiniteNumber, OptionalString, requiredString } from '../schemas'
+import { OptionalWorkerLaunchPreference } from './orchestration-worker-start-schema'
 
 export const FederationAttachStartParams = z.object({
   dispatchId: requiredString('Missing Dispatch ID'),
@@ -16,6 +17,10 @@ export const FederationAttachStartParams = z.object({
   setupSource: z.enum(['explicit_request', 'orchestration_default']).optional(),
   terminal: OptionalString,
   agent: OptionalString,
+  model: OptionalWorkerLaunchPreference,
+  effort: OptionalWorkerLaunchPreference,
   timeoutMs: OptionalFiniteNumber,
   devMode: z.boolean().optional()
 })
+
+export type FederationAttachStartInput = z.infer<typeof FederationAttachStartParams>
diff --git a/src/main/runtime/rpc/methods/orchestration-federation-test-request.ts b/src/main/runtime/rpc/methods/orchestration-federation-test-request.ts
new file mode 100644
index 00000000000..7d004775310
--- /dev/null
+++ b/src/main/runtime/rpc/methods/orchestration-federation-test-request.ts
@@ -0,0 +1,25 @@
+import { ORCHESTRATION_CONTRACT_VERSION } from '../../../../shared/protocol-version'
+import type { RpcRequest } from '../core'
+
+export function createFederationWorkerStartRequest(
+  taskId: string,
+  overrides: Record<string, unknown> = {}
+): RpcRequest {
+  return {
+    id: 'rpc_worker_start',
+    authToken: 'coordinator-token',
+    orchestrationContractVersion: ORCHESTRATION_CONTRACT_VERSION,
+    orchestrationRequestId: 'request_windows_worker',
+    method: 'orchestration.workerStart',
+    params: {
+      task: taskId,
+      from: 'term_coord',
+      on: 'windows',
+      worktree: 'new-top-level',
+      repo: 'id:windows-repo',
+      name: 'windows-audit',
+      agent: 'codex',
+      ...overrides
+    }
+  }
+}
diff --git a/src/main/runtime/rpc/methods/orchestration-federation.test.ts b/src/main/runtime/rpc/methods/orchestration-federation.test.ts
index cf9224c875c..e797a09c256 100644
--- a/src/main/runtime/rpc/methods/orchestration-federation.test.ts
+++ b/src/main/runtime/rpc/methods/orchestration-federation.test.ts
@@ -8,8 +8,8 @@ import { OrcaRuntimeService } from '../../orca-runtime'
 import { OrchestrationDb } from '../../orchestration/db'
 import type { OrchestrationEnvironmentTransport } from '../../orchestration/environment-transport'
 import { RpcDispatcher } from '../dispatcher'
-import type { RpcRequest } from '../core'
 import { ORCHESTRATION_METHODS } from './orchestration'
+import { createFederationWorkerStartRequest as startRequest } from './orchestration-federation-test-request'
 
 describe('orchestration federation', () => {
   const databases: OrchestrationDb[] = []
@@ -97,26 +97,6 @@ describe('orchestration federation', () => {
     return homeDb.createTask({ spec: 'Audit Windows behavior', runId: run.id })
   }
 
-  function startRequest(taskId: string, overrides: Record<string, unknown> = {}): RpcRequest {
-    return {
-      id: 'rpc_worker_start',
-      authToken: 'coordinator-token',
-      orchestrationContractVersion: ORCHESTRATION_CONTRACT_VERSION,
-      orchestrationRequestId: 'request_windows_worker',
-      method: 'orchestration.workerStart',
-      params: {
-        task: taskId,
-        from: 'term_coord',
-        on: 'windows',
-        worktree: 'new-top-level',
-        repo: 'id:windows-repo',
-        name: 'windows-audit',
-        agent: 'codex',
-        ...overrides
-      }
-    }
-  }
-
   function configureWorkerRuntime(runtime: OrcaRuntimeService): void {
     vi.spyOn(runtime, 'validateOrchestrationAgentLauncher').mockImplementation(() => {})
     vi.spyOn(runtime, 'showRepo').mockResolvedValue({
@@ -230,6 +210,25 @@ describe('orchestration federation', () => {
     )
   })
 
+  it('does not report remotely rejected preferences as effective', async () => {
+    const task = createHomeTask()
+
+    const response = await homeDispatcher.dispatch(
+      startRequest(task.id, { agent: 'grok', model: 'unsupported-model' })
+    )
+
+    expect(response).toMatchObject({
+      ok: true,
+      result: {
+        state: 'failed',
+        launch: {
+          requested: { agent: 'grok', model: 'unsupported-model', effort: null },
+          effective: null
+        }
+      }
+    })
+  })
+
   it('preserves wait-for-setup gating on the connected worker server', async () => {
     vi.mocked(workerRuntime.createManagedWorktree).mockResolvedValueOnce({
       worktree: { id: 'repo::windows-worktree', repoId: 'repo' },
diff --git a/src/main/runtime/rpc/methods/orchestration-federation.ts b/src/main/runtime/rpc/methods/orchestration-federation.ts
index ce173290848..ffde742ecee 100644
--- a/src/main/runtime/rpc/methods/orchestration-federation.ts
+++ b/src/main/runtime/rpc/methods/orchestration-federation.ts
@@ -1,4 +1,3 @@
-import { isTuiAgent } from '../../../../shared/tui-agent-config'
 import type { TuiAgent } from '../../../../shared/types'
 import { buildDispatchPreamble } from '../../orchestration/preamble'
 import { OrchestrationError } from '../../orchestration/orchestration-error'
@@ -18,6 +17,7 @@ import {
 } from './orchestration-federation-setup'
 import { FederationAttachStartParams } from './orchestration-federation-start-schema'
 import { failFederatedAttachmentWithReceipt } from './orchestration-federation-start-receipt'
+import { prepareFederationAttachmentWorkerStart } from './orchestration-worker-start-validation'
 
 export const ORCHESTRATION_FEDERATION_ATTACH_METHODS: RpcMethod[] = [
   defineMethod({
@@ -37,43 +37,11 @@ export const ORCHESTRATION_FEDERATION_ATTACH_METHODS: RpcMethod[] = [
         )
       }
       const createsWorktree = params.worktree === 'new-top-level'
-      if (createsWorktree && (!params.name || !params.repo)) {
-        throw new OrchestrationError(
-          'invalid_argument',
-          'A remote new-top-level worktree requires --name and an explicit --repo.'
-        )
-      }
-      if (createsWorktree && params.terminal) {
-        throw new OrchestrationError(
-          'invalid_argument',
-          '--terminal cannot combine with remote new-worktree creation.'
-        )
-      }
-      if (
-        !createsWorktree &&
-        (params.name || params.repo || params.baseBranch || params.setup || params.setupSource)
-      ) {
-        throw new OrchestrationError(
-          'invalid_argument',
-          'Creation and setup options apply only to remote new-top-level worktrees.'
-        )
-      }
-      if (params.terminal && params.agent) {
-        throw new OrchestrationError(
-          'invalid_argument',
-          '--terminal reuses an existing agent and cannot combine with --agent.'
-        )
-      }
-      const agent = params.agent
-      if (!params.terminal && (!agent || !isTuiAgent(agent))) {
-        throw new OrchestrationError(
-          'agent_unconfigured',
-          'A configured --agent is required when federated worker-start creates a terminal.'
-        )
-      }
-      if (agent) {
-        runtime.validateOrchestrationAgentLauncher(agent as TuiAgent)
-      }
+      const { agent, launch } = prepareFederationAttachmentWorkerStart({
+        params,
+        createsWorktree,
+        runtime
+      })
       if (createsWorktree) {
         await assertOrchestrationWorktreeCreationSupported({
           runtime,
@@ -126,6 +94,7 @@ export const ORCHESTRATION_FEDERATION_ATTACH_METHODS: RpcMethod[] = [
             observeSetupCompletion: true,
             createdWithAgent: agent as TuiAgent,
             startupAgent: agent as TuiAgent,
+            ...(launch.preferences ? { startupLaunchPreferences: launch.preferences } : {}),
             activate: false,
             lineage: { noParent: true }
           })
@@ -196,6 +165,7 @@ export const ORCHESTRATION_FEDERATION_ATTACH_METHODS: RpcMethod[] = [
               // Why: agent ids are not shell commands (`cursor` is the desktop app,
               // its CLI is `cursor-agent`); resolve through the TUI agent config.
               startupAgent: agent as TuiAgent,
+              ...(launch.preferences ? { launchPreferences: launch.preferences } : {}),
               title: `worker-${params.taskId}`,
               presentation: 'background'
             })
@@ -284,6 +254,7 @@ export const ORCHESTRATION_FEDERATION_ATTACH_METHODS: RpcMethod[] = [
           worktreeId: worktree.id,
           terminalHandle,
           setup,
+          launch: launch.receipt,
           effects,
           residualResources: []
         }
@@ -294,7 +265,8 @@ export const ORCHESTRATION_FEDERATION_ATTACH_METHODS: RpcMethod[] = [
           runtimeEpoch: runtime.getRuntimeId(),
           failedStage,
           error,
-          setup
+          setup,
+          launch: launch.receipt
         })
       }
     }
diff --git a/src/main/runtime/rpc/methods/orchestration-worker-launch-preferences.test.ts b/src/main/runtime/rpc/methods/orchestration-worker-launch-preferences.test.ts
new file mode 100644
index 00000000000..dd17945445c
--- /dev/null
+++ b/src/main/runtime/rpc/methods/orchestration-worker-launch-preferences.test.ts
@@ -0,0 +1,135 @@
+import { describe, expect, it } from 'vitest'
+import { ORCHESTRATION_WORKER_LAUNCH_PREFERENCES_RUNTIME_CAPABILITY } from '../../../../shared/protocol-version'
+import {
+  assertWorkerLaunchPreferencesCreateTerminal,
+  assertWorkerLaunchPreferencesRuntimeSupported,
+  createPendingWorkerLaunchReceipt,
+  resolveFederatedWorkerLaunchReceipt,
+  resolveWorkerLaunchPreferences
+} from './orchestration-worker-launch-preferences'
+import { WorkerStartParams } from './orchestration-worker-start-schema'
+
+describe('orchestration worker launch preferences', () => {
+  it('passes an opaque Claude model and portable effort through the shared catalog', () => {
+    expect(
+      resolveWorkerLaunchPreferences({
+        agent: 'claude',
+        model: 'aws-bedrock-opus-5',
+        effort: 'high'
+      })
+    ).toEqual({
+      preferences: { model: 'aws-bedrock-opus-5', effort: 'high' },
+      receipt: {
+        requested: { agent: 'claude', model: 'aws-bedrock-opus-5', effort: 'high' },
+        effective: { agent: 'claude', model: 'aws-bedrock-opus-5', effort: 'high' }
+      }
+    })
+  })
+
+  it('does not invent an effort when only a model is requested', () => {
+    expect(
+      resolveWorkerLaunchPreferences({ agent: 'codex', model: 'gpt-5.6-sol' }).preferences
+    ).toEqual({ model: 'gpt-5.6-sol' })
+  })
+
+  it('rejects model-specific effort combinations the catalog disproves', () => {
+    expect(() =>
+      resolveWorkerLaunchPreferences({
+        agent: 'codex',
+        model: 'gpt-5.6-luna',
+        effort: 'xhigh'
+      })
+    ).toThrow('does not support effort xhigh')
+  })
+
+  it('rejects effort without a model', () => {
+    expect(() => resolveWorkerLaunchPreferences({ agent: 'codex', effort: 'high' })).toThrow(
+      '--effort requires --model'
+    )
+  })
+
+  it('rejects model selection for agents without a launch catalog', () => {
+    expect(() =>
+      resolveWorkerLaunchPreferences({ agent: 'grok', model: 'grok-code-fast-1' })
+    ).toThrow('does not support launch-time model selection')
+  })
+
+  it('does not expose deprecated Gemini model selection to worker-start', () => {
+    expect(() =>
+      resolveWorkerLaunchPreferences({ agent: 'gemini', model: 'gemini-3-pro-preview' })
+    ).toThrow('does not support launch-time model selection')
+  })
+
+  it('rejects preferences when reusing an existing terminal', () => {
+    expect(() =>
+      assertWorkerLaunchPreferencesCreateTerminal({
+        terminal: 'term_existing',
+        model: 'gpt-5.6-sol'
+      })
+    ).toThrow('cannot be applied when reusing an existing terminal')
+  })
+
+  it('requires remote capability support only for explicit preferences', () => {
+    expect(() =>
+      assertWorkerLaunchPreferencesRuntimeSupported({
+        model: 'gpt-5.6-sol',
+        capabilities: [],
+        serverName: 'windows'
+      })
+    ).toThrow('does not support worker model or effort overrides')
+    expect(() =>
+      assertWorkerLaunchPreferencesRuntimeSupported({
+        capabilities: [],
+        serverName: 'windows'
+      })
+    ).not.toThrow()
+    expect(() =>
+      assertWorkerLaunchPreferencesRuntimeSupported({
+        model: 'gpt-5.6-sol',
+        capabilities: [ORCHESTRATION_WORKER_LAUNCH_PREFERENCES_RUNTIME_CAPABILITY],
+        serverName: 'windows'
+      })
+    ).not.toThrow()
+  })
+
+  it('uses the requested launch receipt when an older worker omits it', () => {
+    const requested = createPendingWorkerLaunchReceipt({
+      agent: 'codex',
+      model: 'gpt-5.6-sol',
+      effort: 'high'
+    })
+
+    expect(resolveFederatedWorkerLaunchReceipt(undefined, requested, true)).toEqual({
+      requested: requested.requested,
+      effective: requested.requested
+    })
+    expect(resolveFederatedWorkerLaunchReceipt(undefined, requested, false)).toBe(requested)
+  })
+
+  it.each([' custom-model', 'custom-model '])(
+    'rejects model ids with surrounding whitespace: %j',
+    (model) => {
+      expect(WorkerStartParams.safeParse({ task: 'task_1', agent: 'codex', model }).success).toBe(
+        false
+      )
+    }
+  )
+
+  it('bounds opaque launch preferences', () => {
+    expect(
+      WorkerStartParams.safeParse({
+        task: 'task_1',
+        agent: 'codex',
+        model: 'm'.repeat(513)
+      }).success
+    ).toBe(false)
+    expect(
+      WorkerStartParams.safeParse({
+        task: 'task_1',
+        agent: 'codex',
+        model: 'custom-model',
+        effort: 'e'.repeat(513)
+      }).success
+    ).toBe(false)
+  })
+})
diff --git a/src/main/runtime/rpc/methods/orchestration-worker-launch-preferences.ts b/src/main/runtime/rpc/methods/orchestration-worker-launch-preferences.ts
new file mode 100644
index 00000000000..76c60064691
--- /dev/null
+++ b/src/main/runtime/rpc/methods/orchestration-worker-launch-preferences.ts
@@ -0,0 +1,158 @@
+import type { AgentLaunchPreferences } from '../../../../shared/agent-session-host-authority'
+import {
+  findCatalogModel,
+  findCatalogOption,
+  getAgentSessionOptionCatalog
+} from '../../../../shared/agent-session-option-catalog'
+import { resolveAgentSessionOptionLaunch } from '../../../../shared/agent-session-option-launch'
+import { ORCHESTRATION_WORKER_LAUNCH_PREFERENCES_RUNTIME_CAPABILITY } from '../../../../shared/protocol-version'
+import type { TuiAgent } from '../../../../shared/types'
+import { OrchestrationError } from '../../orchestration/orchestration-error'
+
+export type OrchestrationWorkerLaunchSelection = {
+  agent: TuiAgent | null
+  model: string | null
+  effort: string | null
+}
+
+export type OrchestrationWorkerLaunchReceipt = {
+  requested: OrchestrationWorkerLaunchSelection
+  effective: OrchestrationWorkerLaunchSelection | null
+}
+
+export function createWorkerLaunchReceipt(args: {
+  agent: TuiAgent | null
+  model?: string
+  effort?: string
+}): OrchestrationWorkerLaunchReceipt {
+  const selection = {
+    agent: args.agent,
+    model: args.model ?? null,
+    effort: args.effort ?? null
+  }
+  return { requested: selection, effective: { ...selection } }
+}
+
+export function createPendingWorkerLaunchReceipt(args: {
+  agent: TuiAgent | null
+  model?: string
+  effort?: string
+}): OrchestrationWorkerLaunchReceipt {
+  return {
+    requested: {
+      agent: args.agent,
+      model: args.model ?? null,
+      effort: args.effort ?? null
+    },
+    effective: null
+  }
+}
+
+export function resolveWorkerLaunchPreferences(args: {
+  agent: TuiAgent
+  model?: string
+  effort?: string
+}): {
+  preferences: AgentLaunchPreferences | undefined
+  receipt: OrchestrationWorkerLaunchReceipt
+} {
+  if (args.effort && !args.model) {
+    throw new OrchestrationError('invalid_argument', '--effort requires --model.')
+  }
+  if (!args.model) {
+    return {
+      preferences: undefined,
+      receipt: createWorkerLaunchReceipt({ agent: args.agent })
+    }
+  }
+
+  const catalog = getAgentSessionOptionCatalog(args.agent)
+  if (!catalog?.supportsWorkerLaunchPreferences || !catalog.modelApply.launchArgs) {
+    throw new OrchestrationError(
+      'invalid_argument',
+      `Agent ${args.agent} does not support launch-time model selection.`
+    )
+  }
+
+  if (args.effort) {
+    const model = findCatalogModel(catalog, args.model)
+    const option =
+      findCatalogOption(model, 'effort') ??
+      (!model
+        ? catalog.unknownModelOptions?.find((candidate) => candidate.id === 'effort')
+        : undefined)
+    if (
+      option?.kind.type !== 'select' ||
+      !option.kind.choices.some((choice) => choice.value === args.effort)
+    ) {
+      throw new OrchestrationError(
+        'invalid_argument',
+        `Agent ${args.agent} model ${args.model} does not support effort ${args.effort}.`
+      )
+    }
+  }
+
+  const requested = {
+    model: args.model,
+    ...(args.effort ? { effort: args.effort } : {})
+  }
+  const resolved = resolveAgentSessionOptionLaunch(args.agent, requested, [], false)
+  if (
+    resolved.appliedValues.model !== args.model ||
+    resolved.appliedValues.effort !== args.effort
+  ) {
+    throw new OrchestrationError(
+      'invalid_argument',
+      `Agent ${args.agent} cannot apply the requested worker launch preferences.`
+    )
+  }
+
+  const preferences: AgentLaunchPreferences = requested
+  return {
+    preferences,
+    receipt: createWorkerLaunchReceipt({ agent: args.agent, ...preferences })
+  }
+}
+
+export function assertWorkerLaunchPreferencesCreateTerminal(args: {
+  terminal?: string
+  model?: string
+  effort?: string
+}): void {
+  if (args.terminal && (args.model || args.effort)) {
+    throw new OrchestrationError(
+      'invalid_argument',
+      '--model and --effort cannot be applied when reusing an existing terminal.'
+    )
+  }
+}
+
+export function assertWorkerLaunchPreferencesRuntimeSupported(args: {
+  model?: string
+  effort?: string
+  capabilities?: readonly string[]
+  serverName: string
+}): void {
+  if (
+    (args.model || args.effort) &&
+    !args.capabilities?.includes(ORCHESTRATION_WORKER_LAUNCH_PREFERENCES_RUNTIME_CAPABILITY)
+  ) {
+    throw new OrchestrationError(
+      'capability_unsupported',
+      `Connected server ${args.serverName} does not support worker model or effort overrides.`
+    )
+  }
+}
+
+export function resolveFederatedWorkerLaunchReceipt(
+  remote: OrchestrationWorkerLaunchReceipt | undefined,
+  requested: OrchestrationWorkerLaunchReceipt,
+  remoteReady: boolean
+): OrchestrationWorkerLaunchReceipt {
+  if (remote) {
+    return remote
+  }
+  return remoteReady
+    ? { requested: requested.requested, effective: { ...requested.requested } }
+    : requested
+}
diff --git a/src/main/runtime/rpc/methods/orchestration-worker-start-receipt.ts b/src/main/runtime/rpc/methods/orchestration-worker-start-receipt.ts
index 167d4610984..e58f9fff01e 100644
--- a/src/main/runtime/rpc/methods/orchestration-worker-start-receipt.ts
+++ b/src/main/runtime/rpc/methods/orchestration-worker-start-receipt.ts
@@ -3,6 +3,7 @@ import {
   isUnknownWorkerStartOutcome,
   type WorkerSetupReceipt
 } from './orchestration-worker-topology'
+import type { OrchestrationWorkerLaunchReceipt } from './orchestration-worker-launch-preferences'
 
 export function failWorkerStartWithReceipt(args: {
   db: OrchestrationDb
@@ -12,6 +13,7 @@ export function failWorkerStartWithReceipt(args: {
   failedStage: string
   error: unknown
   setup: WorkerSetupReceipt
+  launch: OrchestrationWorkerLaunchReceipt
 }): unknown {
   const reason = args.error instanceof Error ? args.error.message : String(args.error)
   const unknown = isUnknownWorkerStartOutcome(args.error, args.failedStage)
@@ -27,6 +29,7 @@ export function failWorkerStartWithReceipt(args: {
     failedStage: args.failedStage,
     lastError: reason,
     setup: args.setup,
+    launch: args.launch,
     effects: JSON.parse(worker.effects) as unknown[],
     residualResources: JSON.parse(worker.residual_resources) as unknown[],
     ...(unknown
diff --git a/src/main/runtime/rpc/methods/orchestration-worker-start-schema.ts b/src/main/runtime/rpc/methods/orchestration-worker-start-schema.ts
index d577598c966..cf081f9b36c 100644
--- a/src/main/runtime/rpc/methods/orchestration-worker-start-schema.ts
+++ b/src/main/runtime/rpc/methods/orchestration-worker-start-schema.ts
@@ -1,6 +1,13 @@
 import { z } from 'zod'
 import { OptionalFiniteNumber, OptionalString, requiredString } from '../schemas'
 
+export const OptionalWorkerLaunchPreference = z
+  .string()
+  .min(1)
+  .max(512)
+  .refine((value) => value === value.trim(), 'Surrounding whitespace is invalid')
+  .optional()
+
 export const WorkerStartParams = z.object({
   task: requiredString('Missing --task'),
   on: OptionalString,
@@ -15,6 +22,8 @@ export const WorkerStartParams = z.object({
   setup: z.enum(['run', 'skip', 'inherit']).optional(),
   terminal: OptionalString,
   agent: OptionalString,
+  model: OptionalWorkerLaunchPreference,
+  effort: OptionalWorkerLaunchPreference,
   retryOf: OptionalString,
   timeoutMs: OptionalFiniteNumber,
   devMode: z.boolean().optional()
diff --git a/src/main/runtime/rpc/methods/orchestration-worker-start-validation.ts b/src/main/runtime/rpc/methods/orchestration-worker-start-validation.ts
new file mode 100644
index 00000000000..f6bb103f37e
--- /dev/null
+++ b/src/main/runtime/rpc/methods/orchestration-worker-start-validation.ts
@@ -0,0 +1,164 @@
+import { isTuiAgent } from '../../../../shared/tui-agent-config'
+import type { TuiAgent } from '../../../../shared/types'
+import type { OrcaRuntimeService } from '../../orca-runtime'
+import { OrchestrationError } from '../../orchestration/orchestration-error'
+import type { FederationAttachStartInput } from './orchestration-federation-start-schema'
+import {
+  assertWorkerLaunchPreferencesCreateTerminal,
+  createWorkerLaunchReceipt,
+  resolveWorkerLaunchPreferences
+} from './orchestration-worker-launch-preferences'
+import type { WorkerStartInput } from './orchestration-worker-start-schema'
+
+type WorkerStartLaunch = ReturnType<typeof resolveWorkerLaunchPreferences>
+
+export function validateFederatedWorkerStartPlacement(
+  params: WorkerStartInput,
+  createsWorktree: boolean
+): void {
+  if (createsWorktree && (!params.name || !params.repo)) {
+    throw new OrchestrationError(
+      'invalid_argument',
+      'Remote new-top-level requires --name and an explicit --repo from remote discovery.'
+    )
+  }
+  if (createsWorktree && params.terminal) {
+    throw new OrchestrationError(
+      'invalid_argument',
+      '--terminal cannot combine with remote new-worktree creation.'
+    )
+  }
+  if (!createsWorktree && (params.name || params.repo || params.baseBranch || params.setup)) {
+    throw new OrchestrationError(
+      'invalid_argument',
+      'Creation and setup options apply only to remote new-top-level worktrees.'
+    )
+  }
+  if (params.terminal && params.agent) {
+    throw new OrchestrationError(
+      'invalid_argument',
+      '--terminal reuses an existing agent and cannot combine with --agent.'
+    )
+  }
+  if (!params.terminal && (!params.agent || !isTuiAgent(params.agent))) {
+    throw new OrchestrationError(
+      'agent_unconfigured',
+      'A configured --agent is required when remote worker-start creates a terminal.'
+    )
+  }
+}
+
+export function prepareLocalWorkerStart(args: {
+  params: WorkerStartInput
+  createsWorktree: boolean
+  runtime: OrcaRuntimeService
+}): { agent: TuiAgent | undefined; launch: WorkerStartLaunch } {
+  const { params, createsWorktree, runtime } = args
+  assertWorkerLaunchPreferencesCreateTerminal(params)
+  if (params.terminal && params.agent) {
+    throw new OrchestrationError(
+      'invalid_argument',
+      '--terminal reuses an existing agent and cannot combine with --agent.'
+    )
+  }
+  if (createsWorktree && params.terminal) {
+    throw new OrchestrationError(
+      'invalid_argument',
+      '--terminal cannot combine with new-worktree creation.'
+    )
+  }
+  if (createsWorktree && !params.name) {
+    throw new OrchestrationError('invalid_argument', 'New worktrees require --name.')
+  }
+  if (!createsWorktree && (params.name || params.repo || params.baseBranch || params.setup)) {
+    throw new OrchestrationError(
+      'invalid_argument',
+      'Creation and setup options apply only to new-child or new-top-level worktrees.'
+    )
+  }
+  return resolveWorkerStartAgent({
+    runtime,
+    terminal: params.terminal,
+    agent: params.agent,
+    model: params.model,
+    effort: params.effort,
+    missingAgentMessage: 'A configured --agent is required when worker-start creates a terminal.'
+  })
+}
+
+export function prepareFederationAttachmentWorkerStart(args: {
+  params: FederationAttachStartInput
+  createsWorktree: boolean
+  runtime: OrcaRuntimeService
+}): { agent: TuiAgent | undefined; launch: WorkerStartLaunch } {
+  const { params, createsWorktree, runtime } = args
+  assertWorkerLaunchPreferencesCreateTerminal(params)
+  if (createsWorktree && (!params.name || !params.repo)) {
+    throw new OrchestrationError(
+      'invalid_argument',
+      'A remote new-top-level worktree requires --name and an explicit --repo.'
+    )
+  }
+  if (createsWorktree && params.terminal) {
+    throw new OrchestrationError(
+      'invalid_argument',
+      '--terminal cannot combine with remote new-worktree creation.'
+    )
+  }
+  if (
+    !createsWorktree &&
+    (params.name || params.repo || params.baseBranch || params.setup || params.setupSource)
+  ) {
+    throw new OrchestrationError(
+      'invalid_argument',
+      'Creation and setup options apply only to remote new-top-level worktrees.'
+    )
+  }
+  if (params.terminal && params.agent) {
+    throw new OrchestrationError(
+      'invalid_argument',
+      '--terminal reuses an existing agent and cannot combine with --agent.'
+    )
+  }
+  return resolveWorkerStartAgent({
+    runtime,
+    terminal: params.terminal,
+    agent: params.agent,
+    model: params.model,
+    effort: params.effort,
+    missingAgentMessage:
+      'A configured --agent is required when federated worker-start creates a terminal.'
+  })
+}
+
+function resolveWorkerStartAgent(args: {
+  runtime: OrcaRuntimeService
+  terminal?: string
+  agent?: string
+  model?: string
+  effort?: string
+  missingAgentMessage: string
+}): { agent: TuiAgent | undefined; launch: WorkerStartLaunch } {
+  if (!args.terminal && (!args.agent || !isTuiAgent(args.agent))) {
+    throw new OrchestrationError('agent_unconfigured', args.missingAgentMessage)
+  }
+  const agent = args.agent as TuiAgent | undefined
+  if (agent) {
+    args.runtime.validateOrchestrationAgentLauncher(agent)
+    return {
+      agent,
+      launch: resolveWorkerLaunchPreferences({
+        agent,
+        model: args.model,
+        effort: args.effort
+      })
+    }
+  }
+  return {
+    agent: undefined,
+    launch: {
+      preferences: undefined,
+      receipt: createWorkerLaunchReceipt({ agent: null })
+    }
+  }
+}
diff --git a/src/main/runtime/rpc/methods/orchestration-worker-topology.ts b/src/main/runtime/rpc/methods/orchestration-worker-topology.ts
index 122a5b869ba..9672560ab1e 100644
--- a/src/main/runtime/rpc/methods/orchestration-worker-topology.ts
+++ b/src/main/runtime/rpc/methods/orchestration-worker-topology.ts
@@ -1,3 +1,4 @@
+import type { AgentLaunchPreferences } from '../../../../shared/agent-session-host-authority'
 import type { TuiAgent } from '../../../../shared/types'
 import type { OrcaRuntimeService } from '../../orca-runtime'
 import type { OrchestrationDb } from '../../orchestration/db'
@@ -56,6 +57,7 @@ export async function createExistingWorktreeWorkerTerminal(args: {
   runtime: OrcaRuntimeService
   worktreeId: string
   agent: TuiAgent
+  launchPreferences?: AgentLaunchPreferences
   taskId: string
   effects: WorkerEffect[]
 }): Promise<{ handle: string; warning?: string }> {
@@ -64,6 +66,7 @@ export async function createExistingWorktreeWorkerTerminal(args: {
     // desktop app while its CLI is `cursor-agent`. Let the runtime build the
     // configured launcher instead of executing the raw id.
     startupAgent: args.agent,
+    ...(args.launchPreferences ? { launchPreferences: args.launchPreferences } : {}),
     title: `worker-${args.taskId}`,
     // Why: dispatching a worker is background work; it must not pull the sidebar
     // to the worker's workspace while the user is reading somewhere else.
@@ -117,6 +120,7 @@ export async function createWorkerWorktree(args: {
     from: string
   }
   agent: TuiAgent
+  launchPreferences?: AgentLaunchPreferences
   effects: WorkerEffect[]
 }): Promise<{
   worktree: Awaited<ReturnType<OrcaRuntimeService['showManagedWorktree']>>
@@ -139,6 +143,7 @@ export async function createWorkerWorktree(args: {
     observeSetupCompletion: true,
     createdWithAgent: args.agent,
     startupAgent: args.agent,
+    ...(args.launchPreferences ? { startupLaunchPreferences: args.launchPreferences } : {}),
     activate: false,
     lineage: {
       parentWorktree: requestedWorktree === 'new-child' ? coordinatorWorktree.id : undefined,
diff --git a/src/main/runtime/rpc/methods/orchestration-workers-new-worktree.test.ts b/src/main/runtime/rpc/methods/orchestration-workers-new-worktree.test.ts
index 8e0a164178b..b83ab5b087b 100644
--- a/src/main/runtime/rpc/methods/orchestration-workers-new-worktree.test.ts
+++ b/src/main/runtime/rpc/methods/orchestration-workers-new-worktree.test.ts
@@ -157,6 +157,29 @@ describe('orchestration new-worktree workers', () => {
     expect(runtime.createTerminal).not.toHaveBeenCalled()
   })
 
+  it('passes launch preferences into agent-first worktree creation', async () => {
+    mockCreatedWorktree()
+
+    const { result } = await startWorker({
+      model: 'custom-codex-model',
+      effort: 'high'
+    })
+
+    expect(runtime.createManagedWorktree).toHaveBeenCalledWith(
+      expect.objectContaining({
+        startupAgent: 'codex',
+        startupLaunchPreferences: { model: 'custom-codex-model', effort: 'high' }
+      })
+    )
+    expect(result).toMatchObject({
+      state: 'ready',
+      launch: {
+        requested: { agent: 'codex', model: 'custom-codex-model', effort: 'high' },
+        effective: { agent: 'codex', model: 'custom-codex-model', effort: 'high' }
+      }
+    })
+  })
+
   it('rejects a new worktree for a folder project before creating effects', async () => {
     vi.mocked(runtime.showRepo).mockResolvedValue({
       id: 'repo',
diff --git a/src/main/runtime/rpc/methods/orchestration-workers.ts b/src/main/runtime/rpc/methods/orchestration-workers.ts
index dc659773a8a..229253ec618 100644
--- a/src/main/runtime/rpc/methods/orchestration-workers.ts
+++ b/src/main/runtime/rpc/methods/orchestration-workers.ts
@@ -1,4 +1,3 @@
-import { isTuiAgent } from '../../../../shared/tui-agent-config'
 import type { TuiAgent } from '../../../../shared/types'
 import { buildDispatchPreamble } from '../../orchestration/preamble'
 import { OrchestrationError } from '../../orchestration/orchestration-error'
@@ -20,6 +19,7 @@ import {
   persistWorkerSetupWaitOutcome
 } from './orchestration-worker-setup-gate'
 import { failWorkerStartWithReceipt } from './orchestration-worker-start-receipt'
+import { prepareLocalWorkerStart } from './orchestration-worker-start-validation'
 
 export const ORCHESTRATION_WORKER_START_METHODS: RpcMethod[] = [
   defineMethod({
@@ -57,37 +57,7 @@ export const ORCHESTRATION_WORKER_START_METHODS: RpcMethod[] = [
       const requestedWorktree = params.worktree ?? 'current'
       const createsWorktree =
         requestedWorktree === 'new-child' || requestedWorktree === 'new-top-level'
-      if (params.terminal && params.agent) {
-        throw new OrchestrationError(
-          'invalid_argument',
-          '--terminal reuses an existing agent and cannot combine with --agent.'
-        )
-      }
-      if (createsWorktree && params.terminal) {
-        throw new OrchestrationError(
-          'invalid_argument',
-          '--terminal cannot combine with new-worktree creation.'
-        )
-      }
-      if (createsWorktree && !params.name) {
-        throw new OrchestrationError('invalid_argument', 'New worktrees require --name.')
-      }
-      if (!createsWorktree && (params.name || params.repo || params.baseBranch || params.setup)) {
-        throw new OrchestrationError(
-          'invalid_argument',
-          'Creation and setup options apply only to new-child or new-top-level worktrees.'
-        )
-      }
-      const agent = params.agent
-      if (!params.terminal && (!agent || !isTuiAgent(agent))) {
-        throw new OrchestrationError(
-          'agent_unconfigured',
-          'A configured --agent is required when worker-start creates a terminal.'
-        )
-      }
-      if (agent) {
-        runtime.validateOrchestrationAgentLauncher(agent as TuiAgent)
-      }
+      const { agent, launch } = prepareLocalWorkerStart({ params, createsWorktree, runtime })
 
       const coordinatorTerminal = await runtime.showTerminal(params.from)
       const coordinatorWorktree = await runtime.showManagedWorktree(
@@ -130,6 +100,7 @@ export const ORCHESTRATION_WORKER_START_METHODS: RpcMethod[] = [
         baseBranch: params.baseBranch ?? null,
         terminal: params.terminal ?? null,
         agent: agent ?? null,
+        launch: launch.receipt,
         timeoutMs: params.timeoutMs ?? 60_000,
         setup: createsWorktree ? (params.setup ?? 'run') : 'not_applicable',
         setupSource: createsWorktree
@@ -174,6 +145,7 @@ export const ORCHESTRATION_WORKER_START_METHODS: RpcMethod[] = [
             coordinatorWorktree,
             params,
             agent: agent as TuiAgent,
+            launchPreferences: launch.preferences,
             effects
           })
           resolvedWorktree = created.worktree
@@ -190,6 +162,7 @@ export const ORCHESTRATION_WORKER_START_METHODS: RpcMethod[] = [
             runtime,
             worktreeId: resolvedWorktree!.id,
             agent: agent as TuiAgent,
+            launchPreferences: launch.preferences,
             taskId: task.id,
             effects
           })
@@ -281,6 +254,7 @@ export const ORCHESTRATION_WORKER_START_METHODS: RpcMethod[] = [
           state: worker.state,
           stage: worker.stage,
           setup: setupReceipt,
+          launch: launch.receipt,
           timeoutMs: params.timeoutMs ?? 60_000,
           effects,
           residualResources: [],
@@ -294,7 +268,8 @@ export const ORCHESTRATION_WORKER_START_METHODS: RpcMethod[] = [
           dispatchId: started.dispatch.id,
           failedStage,
           error,
-          setup: setupReceipt
+          setup: setupReceipt,
+          launch: launch.receipt
         })
       }
     }
diff --git a/src/main/runtime/rpc/methods/orchestration.test.ts b/src/main/runtime/rpc/methods/orchestration.test.ts
index 8ba154c48f7..a90bbe80410 100644
--- a/src/main/runtime/rpc/methods/orchestration.test.ts
+++ b/src/main/runtime/rpc/methods/orchestration.test.ts
@@ -2235,6 +2235,61 @@ describe('orchestration RPC methods', () => {
       )
     })
 
+    it('applies and reports opaque per-invocation model preferences', async () => {
+      setup()
+      mockCurrentWorkerStart()
+      const task = db.createTask({ spec: 'launch a custom model' })
+
+      const result = (await call('orchestration.workerStart', {
+        task: task.id,
+        from: 'term_coord',
+        agent: 'claude',
+        model: 'aws-bedrock-opus-5',
+        effort: 'high'
+      })) as {
+        dispatchId: string
+        state: string
+        launch: {
+          requested: { agent: string; model: string; effort: string }
+          effective: { agent: string; model: string; effort: string }
+        }
+      }
+
+      expect(result).toMatchObject({
+        state: 'ready',
+        launch: {
+          requested: { agent: 'claude', model: 'aws-bedrock-opus-5', effort: 'high' },
+          effective: { agent: 'claude', model: 'aws-bedrock-opus-5', effort: 'high' }
+        }
+      })
+      expect(runtime.createTerminal).toHaveBeenCalledWith(
+        'id:repo::worktree',
+        expect.objectContaining({
+          startupAgent: 'claude',
+          launchPreferences: { model: 'aws-bedrock-opus-5', effort: 'high' }
+        })
+      )
+      expect(JSON.parse(db.getWorkerDispatch(result.dispatchId)!.start_options)).toMatchObject({
+        launch: result.launch
+      })
+    })
+
+    it('rejects launch preferences for an existing terminal before creating a Dispatch', async () => {
+      setup()
+      mockCurrentWorkerStart()
+      const task = db.createTask({ spec: 'reuse exact worker' })
+
+      await expect(
+        call('orchestration.workerStart', {
+          task: task.id,
+          from: 'term_coord',
+          terminal: 'term_worker',
+          model: 'gpt-5.6-sol'
+        })
+      ).rejects.toMatchObject({ code: 'invalid_argument' })
+      expect(db.getDispatchContext(task.id)).toBeUndefined()
+    })
+
     // Why: `cursor` on PATH is the Cursor desktop app; passing the agent id as a
     // shell command opened the IDE and left a blank shell (issue #11926).
     it('never passes the agent id to the worker terminal as a shell command', async () => {
diff --git a/src/main/runtime/rpc/methods/session-tab-agent-status-projection.test.ts b/src/main/runtime/rpc/methods/session-tab-agent-status-projection.test.ts
new file mode 100644
index 00000000000..45f6613e354
--- /dev/null
+++ b/src/main/runtime/rpc/methods/session-tab-agent-status-projection.test.ts
@@ -0,0 +1,60 @@
+import { describe, expect, it } from 'vitest'
+import { AGENT_SESSION_BOUNDARY_RUNTIME_CAPABILITY } from '../../../../shared/protocol-version'
+import type { RuntimeMobileSessionTabsSnapshot } from '../../../../shared/runtime-types'
+import { projectSessionTabAgentStatus } from './session-tab-agent-status-projection'
+
+function makeSnapshot(sessionBoundary: boolean): RuntimeMobileSessionTabsSnapshot {
+  return {
+    worktree: 'wt-1',
+    publicationEpoch: 'epoch-1',
+    snapshotVersion: 1,
+    activeGroupId: null,
+    activeTabId: 'tab-1::leaf-1',
+    activeTabType: 'terminal',
+    tabs: [
+      {
+        type: 'terminal',
+        id: 'tab-1::leaf-1',
+        title: 'Claude',
+        parentTabId: 'tab-1',
+        leafId: 'leaf-1',
+        isActive: true,
+        agentStatus: {
+          state: 'done',
+          prompt: '',
+          updatedAt: 100,
+          stateStartedAt: 100,
+          paneKey: 'tab-1:leaf-1',
+          stateHistory: [],
+          sessionBoundary
+        }
+      }
+    ]
+  }
+}
+
+describe('projectSessionTabAgentStatus', () => {
+  it('withholds session boundaries from legacy paired clients', () => {
+    const projected = projectSessionTabAgentStatus(makeSnapshot(true), 'runtime', [])
+
+    expect(projected.tabs[0]).not.toHaveProperty('agentStatus')
+  })
+
+  it('publishes session boundaries to clients that negotiated them', () => {
+    const snapshot = makeSnapshot(true)
+
+    expect(
+      projectSessionTabAgentStatus(snapshot, 'runtime', [AGENT_SESSION_BOUNDARY_RUNTIME_CAPABILITY])
+    ).toBe(snapshot)
+  })
+
+  it('does not alter local, mobile, or real-completion projections', () => {
+    const localBoundary = makeSnapshot(true)
+    const mobileBoundary = makeSnapshot(true)
+    const runtimeCompletion = makeSnapshot(false)
+
+    expect(projectSessionTabAgentStatus(localBoundary, undefined, undefined)).toBe(localBoundary)
+    expect(projectSessionTabAgentStatus(mobileBoundary, 'mobile', [])).toBe(mobileBoundary)
+    expect(projectSessionTabAgentStatus(runtimeCompletion, 'runtime', [])).toBe(runtimeCompletion)
+  })
+})
diff --git a/src/main/runtime/rpc/methods/session-tab-agent-status-projection.ts b/src/main/runtime/rpc/methods/session-tab-agent-status-projection.ts
new file mode 100644
index 00000000000..125e083db4f
--- /dev/null
+++ b/src/main/runtime/rpc/methods/session-tab-agent-status-projection.ts
@@ -0,0 +1,33 @@
+import type { RuntimeCapability } from '../../../../shared/protocol-version'
+import { AGENT_SESSION_BOUNDARY_RUNTIME_CAPABILITY } from '../../../../shared/protocol-version'
+import type {
+  RuntimeMobileSessionTabsResult,
+  RuntimeMobileSessionTabsSnapshot
+} from '../../../../shared/runtime-types'
+
+type SessionTabsPayload = RuntimeMobileSessionTabsResult | RuntimeMobileSessionTabsSnapshot
+
+export function projectSessionTabAgentStatus<TPayload extends SessionTabsPayload>(
+  payload: TPayload,
+  clientKind: 'mobile' | 'runtime' | undefined,
+  clientCapabilities: readonly RuntimeCapability[] | undefined
+): TPayload {
+  // Why: only paired runtimes have legacy `done` completion side effects; mobile must keep its row without changing the exact v2 auth shape.
+  if (
+    clientKind !== 'runtime' ||
+    clientCapabilities?.includes(AGENT_SESSION_BOUNDARY_RUNTIME_CAPABILITY)
+  ) {
+    return payload
+  }
+
+  let changed = false
+  const tabs = payload.tabs.map((tab) => {
+    if (tab.type !== 'terminal' || !tab.agentStatus?.sessionBoundary) {
+      return tab
+    }
+    changed = true
+    const { agentStatus: _boundary, ...legacyTab } = tab
+    return legacyTab
+  })
+  return changed ? ({ ...payload, tabs } as TPayload) : payload
+}
diff --git a/src/main/runtime/rpc/methods/session-tabs.ts b/src/main/runtime/rpc/methods/session-tabs.ts
index 14716e0bf17..397753d609a 100644
--- a/src/main/runtime/rpc/methods/session-tabs.ts
+++ b/src/main/runtime/rpc/methods/session-tabs.ts
@@ -12,19 +12,26 @@ import {
   WorktreeTabSelector
 } from './session-tabs-schemas'
 import { SESSION_TAB_CLOSE_METHODS } from './session-tab-close-methods'
+import { projectSessionTabAgentStatus } from './session-tab-agent-status-projection'
 
 export const SESSION_TAB_METHODS: RpcAnyMethod[] = [
   defineMethod({
     name: 'session.tabs.list',
     params: WorktreeTabSelector,
-    handler: async (params, { runtime, pairedDeviceId }) =>
-      runtime.listMobileSessionTabs(params.worktree, pairedDeviceId)
+    handler: async (params, { runtime, pairedDeviceId, clientKind, clientCapabilities }) =>
+      projectSessionTabAgentStatus(
+        await runtime.listMobileSessionTabs(params.worktree, pairedDeviceId),
+        clientKind,
+        clientCapabilities
+      )
   }),
   defineMethod({
     name: 'session.tabs.listAll',
     params: null,
-    handler: async (_params, { runtime, pairedDeviceId }) => ({
-      snapshots: await runtime.listAllMobileSessionTabs(pairedDeviceId)
+    handler: async (_params, { runtime, pairedDeviceId, clientKind, clientCapabilities }) => ({
+      snapshots: (await runtime.listAllMobileSessionTabs(pairedDeviceId)).map((snapshot) =>
+        projectSessionTabAgentStatus(snapshot, clientKind, clientCapabilities)
+      )
     })
   }),
   defineMethod({
@@ -128,7 +135,11 @@ export const SESSION_TAB_METHODS: RpcAnyMethod[] = [
   defineStreamingMethod({
     name: 'session.tabs.subscribe',
     params: WorktreeTabSelector,
-    handler: async (params, { runtime, connectionId, requestId, pairedDeviceId }, emit) => {
+    handler: async (
+      params,
+      { runtime, connectionId, requestId, pairedDeviceId, clientKind, clientCapabilities },
+      emit
+    ) => {
       let subscribedWorktree: string | null = null
       let unsubscribe = (): void => {}
       let closed = false
@@ -156,7 +167,10 @@ export const SESSION_TAB_METHODS: RpcAnyMethod[] = [
       if (closed) {
         return
       }
-      emit({ type: 'snapshot', ...initial })
+      emit({
+        type: 'snapshot',
+        ...projectSessionTabAgentStatus(initial, clientKind, clientCapabilities)
+      })
       initialized = true
       if (closed) {
         return
@@ -164,7 +178,10 @@ export const SESSION_TAB_METHODS: RpcAnyMethod[] = [
 
       unsubscribe = runtime.onMobileSessionTabsChanged((snapshot) => {
         if (snapshot.worktree === subscribedWorktree) {
-          emit({ type: 'updated', ...snapshot })
+          emit({
+            type: 'updated',
+            ...projectSessionTabAgentStatus(snapshot, clientKind, clientCapabilities)
+          })
         }
       }, pairedDeviceId)
       if (closed) {
@@ -193,7 +210,11 @@ export const SESSION_TAB_METHODS: RpcAnyMethod[] = [
   defineStreamingMethod({
     name: 'session.tabs.subscribeAll',
     params: null,
-    handler: async (_params, { runtime, connectionId, requestId, pairedDeviceId }, emit) => {
+    handler: async (
+      _params,
+      { runtime, connectionId, requestId, pairedDeviceId, clientKind, clientCapabilities },
+      emit
+    ) => {
       let unsubscribe = (): void => {}
       let closed = false
       // Why: initial listAll errors should return one RPC error, not a leaked
@@ -227,14 +248,22 @@ export const SESSION_TAB_METHODS: RpcAnyMethod[] = [
       if (closed) {
         return
       }
-      emit({ type: 'snapshots', snapshots })
+      emit({
+        type: 'snapshots',
+        snapshots: snapshots.map((snapshot) =>
+          projectSessionTabAgentStatus(snapshot, clientKind, clientCapabilities)
+        )
+      })
       initialized = true
 
       if (closed) {
         return
       }
       unsubscribe = runtime.onMobileSessionTabsChanged((snapshot) => {
-        emit({ type: 'updated', ...snapshot })
+        emit({
+          type: 'updated',
+          ...projectSessionTabAgentStatus(snapshot, clientKind, clientCapabilities)
+        })
       }, pairedDeviceId)
     }
   }),
diff --git a/src/main/runtime/rpc/remote-runtime-server-heartbeat-missed-probe-tolerance.test.ts b/src/main/runtime/rpc/remote-runtime-server-heartbeat-missed-probe-tolerance.test.ts
new file mode 100644
index 00000000000..665d94b0f41
--- /dev/null
+++ b/src/main/runtime/rpc/remote-runtime-server-heartbeat-missed-probe-tolerance.test.ts
@@ -0,0 +1,167 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { WebSocket } from 'ws'
+import { RemoteRuntimeServerHeartbeat } from './remote-runtime-server-heartbeat'
+
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+const INTERVAL_MS = 100
+
+function makeSocket(): WebSocket {
+  return { ping: vi.fn(), terminate: vi.fn() } as unknown as WebSocket
+}
+
+describe('RemoteRuntimeServerHeartbeat missed-probe tolerance', () => {
+  it('keeps a client whose pong is merely delayed past one probe window', async () => {
+    vi.useFakeTimers()
+    let now = 1_000
+    const socket = makeSocket()
+    const heartbeat = new RemoteRuntimeServerHeartbeat(INTERVAL_MS, () => now)
+    heartbeat.noteAlive(socket)
+    heartbeat.start(() => [socket]) // probe #1
+    heartbeat.noteAlive(socket) // pongs probe #1
+
+    // A transient blackhole: probe #2 goes out and its pong is stuck in the network.
+    now += INTERVAL_MS
+    await vi.advanceTimersByTimeAsync(INTERVAL_MS)
+    expect(socket.ping).toHaveBeenCalledTimes(2)
+    expect(socket.terminate).not.toHaveBeenCalled()
+
+    // The path recovers and the delayed pong lands right after the next sweep would have run.
+    now += INTERVAL_MS
+    await vi.advanceTimersByTimeAsync(INTERVAL_MS)
+    heartbeat.noteAlive(socket)
+
+    // One unanswered probe is not evidence the peer is gone: it must still be connected,
+    // and it must have been re-probed rather than reaped.
+    expect(socket.terminate).not.toHaveBeenCalled()
+    expect(socket.ping).toHaveBeenCalledTimes(3)
+    heartbeat.stop()
+  })
+
+  it('reaps only after consecutive probes go unanswered, counted not timed', async () => {
+    vi.useFakeTimers()
+    let now = 1_000
+    const socket = makeSocket()
+    const heartbeat = new RemoteRuntimeServerHeartbeat(INTERVAL_MS, () => now)
+    heartbeat.noteAlive(socket)
+    heartbeat.start(() => [socket])
+    heartbeat.noteAlive(socket)
+
+    const missesBeforeReap: number[] = []
+    for (let probe = 0; probe < 6; probe += 1) {
+      now += INTERVAL_MS
+      await vi.advanceTimersByTimeAsync(INTERVAL_MS)
+      missesBeforeReap.push(
+        (socket.terminate as unknown as ReturnType<typeof vi.fn>).mock.calls.length
+      )
+    }
+
+    // Silence must be tolerated for more than a single probe, and must eventually end the socket.
+    expect(missesBeforeReap[0]).toBe(0)
+    expect(missesBeforeReap[1]).toBe(0)
+    expect(missesBeforeReap.at(-1)).toBeGreaterThan(0)
+    heartbeat.stop()
+  })
+
+  it('lets any proof of life reset accumulated misses', async () => {
+    vi.useFakeTimers()
+    let now = 1_000
+    const socket = makeSocket()
+    const heartbeat = new RemoteRuntimeServerHeartbeat(INTERVAL_MS, () => now)
+    heartbeat.noteAlive(socket)
+    heartbeat.start(() => [socket])
+    heartbeat.noteAlive(socket)
+
+    // Two silent probes, then a single inbound frame, repeated well past any fixed budget.
+    for (let cycle = 0; cycle < 5; cycle += 1) {
+      now += INTERVAL_MS
+      await vi.advanceTimersByTimeAsync(INTERVAL_MS)
+      now += INTERVAL_MS
+      await vi.advanceTimersByTimeAsync(INTERVAL_MS)
+      heartbeat.noteAlive(socket)
+    }
+
+    expect(socket.terminate).not.toHaveBeenCalled()
+    heartbeat.stop()
+  })
+
+  it('charges no miss for a paused tick but keeps the ones already banked', async () => {
+    vi.useFakeTimers()
+    let now = 1_000
+    const socket = makeSocket()
+    const heartbeat = new RemoteRuntimeServerHeartbeat(INTERVAL_MS, () => now)
+    heartbeat.noteAlive(socket)
+    heartbeat.start(() => [socket])
+    heartbeat.noteAlive(socket)
+
+    const sweep = async (): Promise<void> => {
+      now += INTERVAL_MS
+      await vi.advanceTimersByTimeAsync(INTERVAL_MS)
+    }
+    const reaped = (candidate: WebSocket): boolean =>
+      (candidate.terminate as unknown as ReturnType<typeof vi.fn>).mock.calls.length > 0
+
+    // Discover the budget rather than hardcoding it: the first sweep consumes the pong above, so
+    // every sweep after it is an unanswered probe.
+    await sweep()
+    let toleratedMisses = 0
+    // Bounded so a heartbeat that never reaps fails here instead of hanging out to the test timeout.
+    while (!reaped(socket) && toleratedMisses < 20) {
+      await sweep()
+      toleratedMisses += 1
+    }
+    expect(reaped(socket)).toBe(true)
+    expect(toleratedMisses).toBeGreaterThan(1)
+    heartbeat.stop()
+
+    // Replay on a fresh socket: bank misses to one short of the limit, then suspend. The stalled tick
+    // must charge nothing — the client had no chance to answer it — but it must not forgive the misses
+    // already banked, or a host that stalls periodically could shelter a dead socket indefinitely.
+    const resumed = new RemoteRuntimeServerHeartbeat(INTERVAL_MS, () => now)
+    const resumedSocket = makeSocket()
+    resumed.noteAlive(resumedSocket)
+    resumed.start(() => [resumedSocket])
+    resumed.noteAlive(resumedSocket)
+    await sweep()
+    for (let miss = 0; miss < toleratedMisses - 1; miss += 1) {
+      await sweep()
+    }
+    expect(reaped(resumedSocket)).toBe(false)
+
+    now += 3_600_000
+    await vi.advanceTimersByTimeAsync(INTERVAL_MS)
+    // The suspend itself costs the socket nothing.
+    expect(reaped(resumedSocket)).toBe(false)
+
+    // But the pre-suspend evidence survives, so the very next unanswered probe completes the budget.
+    await sweep()
+    expect(reaped(resumedSocket)).toBe(true)
+    resumed.stop()
+  })
+
+  // Why: pre-fix the pardon cleared banked misses, so a host stalling once every few ticks reset the
+  // budget forever and a dead socket was never reaped — the connection leak the reaper exists to stop.
+  it('still reaps a dead socket when the host stalls repeatedly', async () => {
+    vi.useFakeTimers()
+    let now = 1_000
+    const socket = makeSocket()
+    const heartbeat = new RemoteRuntimeServerHeartbeat(INTERVAL_MS, () => now)
+    heartbeat.noteAlive(socket)
+    heartbeat.start(() => [socket])
+    heartbeat.noteAlive(socket)
+
+    const reaped = (): boolean =>
+      (socket.terminate as unknown as ReturnType<typeof vi.fn>).mock.calls.length > 0
+
+    // Stall every third tick — the worst case the old pardon could not survive.
+    for (let tick = 0; tick < 30 && !reaped(); tick += 1) {
+      now += tick % 3 === 2 ? INTERVAL_MS * 2 : INTERVAL_MS
+      await vi.advanceTimersByTimeAsync(INTERVAL_MS)
+    }
+
+    expect(reaped()).toBe(true)
+    heartbeat.stop()
+  })
+})
diff --git a/src/main/runtime/rpc/remote-runtime-server-heartbeat.test.ts b/src/main/runtime/rpc/remote-runtime-server-heartbeat.test.ts
index a34b43c3c8b..e1a58d23587 100644
--- a/src/main/runtime/rpc/remote-runtime-server-heartbeat.test.ts
+++ b/src/main/runtime/rpc/remote-runtime-server-heartbeat.test.ts
@@ -7,12 +7,13 @@ afterEach(() => {
 })
 
 describe('RemoteRuntimeServerHeartbeat', () => {
-  it('still reaps a client that misses a probe while another remains alive', async () => {
+  it('still reaps a persistently silent client while another remains alive', async () => {
     vi.useFakeTimers()
     let now = 1_000
     const responsiveSocket = { ping: vi.fn(), terminate: vi.fn() } as unknown as WebSocket
     const deadSocket = { ping: vi.fn(), terminate: vi.fn() } as unknown as WebSocket
-    const heartbeat = new RemoteRuntimeServerHeartbeat(100, () => now)
+    // Limit of 2 keeps the sweep count readable; production uses the module default.
+    const heartbeat = new RemoteRuntimeServerHeartbeat(100, () => now, 128, 2)
     heartbeat.noteAlive(responsiveSocket)
     heartbeat.noteAlive(deadSocket)
     // start() probes immediately: both are pinged now (probe #1) and cleared to await a pong.
@@ -20,12 +21,20 @@ describe('RemoteRuntimeServerHeartbeat', () => {
     // Only the responsive socket pongs the immediate probe.
     heartbeat.noteAlive(responsiveSocket)
 
+    // Miss #1: not yet evidence, so the silent socket is re-probed rather than reaped.
+    now += 100
+    await vi.advanceTimersByTimeAsync(100)
+    heartbeat.noteAlive(responsiveSocket)
+    expect(deadSocket.ping).toHaveBeenCalledTimes(2)
+    expect(deadSocket.terminate).not.toHaveBeenCalled()
+
+    // Miss #2 reaches the limit: consecutive silence is evidence.
     now += 100
     await vi.advanceTimersByTimeAsync(100)
 
-    expect(responsiveSocket.ping).toHaveBeenCalledTimes(2)
+    expect(responsiveSocket.ping).toHaveBeenCalledTimes(3)
     expect(responsiveSocket.terminate).not.toHaveBeenCalled()
-    expect(deadSocket.ping).toHaveBeenCalledTimes(1)
+    expect(deadSocket.ping).toHaveBeenCalledTimes(2)
     expect(deadSocket.terminate).toHaveBeenCalledTimes(1)
     heartbeat.stop()
   })
@@ -34,7 +43,8 @@ describe('RemoteRuntimeServerHeartbeat', () => {
     vi.useFakeTimers()
     let now = 1_000
     const socket = { ping: vi.fn(), terminate: vi.fn() } as unknown as WebSocket
-    const heartbeat = new RemoteRuntimeServerHeartbeat(100, () => now)
+    // Limit of 1 isolates the resume grant: without it the very next sweep would reap.
+    const heartbeat = new RemoteRuntimeServerHeartbeat(100, () => now, 128, 1)
     heartbeat.noteAlive(socket)
     // start() probes immediately (ping #1); the socket pongs it.
     heartbeat.start(() => [socket])
diff --git a/src/main/runtime/rpc/remote-runtime-server-heartbeat.ts b/src/main/runtime/rpc/remote-runtime-server-heartbeat.ts
index 3b5bb9760df..6134259c51f 100644
--- a/src/main/runtime/rpc/remote-runtime-server-heartbeat.ts
+++ b/src/main/runtime/rpc/remote-runtime-server-heartbeat.ts
@@ -1,16 +1,27 @@
 import type { WebSocket } from 'ws'
 
+// Why: one unanswered probe is UNKNOWN, not death — a cellular/Tailscale blackhole or a stalled TCP
+// retransmit routinely swallows a single pong from a peer that is still there (STA-3320). Only a run of
+// consecutive unanswered probes is evidence. Three matches the web client's own 45s liveness budget
+// (25s idle + 20s probe grace), so both ends of a paired session give up on roughly the same evidence.
+const MISSED_PROBE_LIMIT = 3
+
 export class RemoteRuntimeServerHeartbeat {
   private timer: ReturnType<typeof setInterval> | null = null
   private lastTickAt: number | null = null
   private readonly alive = new WeakSet<WebSocket>()
+  // Why: consecutive probes a socket has left unanswered. Absent = zero, so live sockets cost nothing.
+  private readonly missedProbes = new WeakMap<WebSocket, number>()
 
   constructor(
     private readonly intervalMs: number,
     private readonly now: () => number = Date.now,
-    private readonly warningClientCount = 128
+    private readonly warningClientCount = 128,
+    private readonly missedProbeLimit = MISSED_PROBE_LIMIT
   ) {}
 
+  // Why: hot path — every inbound frame calls this. The sweep clears the miss count when it observes
+  // the flag, so proof of life stays a single WeakSet write.
   noteAlive(socket: WebSocket): void {
     this.alive.add(socket)
   }
@@ -41,22 +52,32 @@ export class RemoteRuntimeServerHeartbeat {
     const tickAt = this.now()
     const elapsedMs = tickAt - (this.lastTickAt ?? tickAt)
     this.lastTickAt = tickAt
-    const resumedFromPause = elapsedMs < 0 || elapsedMs > this.intervalMs * 1.5
+    // Why: a delayed tick cannot infer that clients missed a probe they had no chance to answer, so
+    // this sweep must not charge one. It must not *forgive* either: clearing banked misses lets a host
+    // that stalls once every few ticks protect a dead socket forever, which is the connection leak the
+    // reaper exists to prevent. Skipping the charge is enough — a live client clears its own count by
+    // answering the probe still sent below.
+    const stalledTick = elapsedMs < 0 || elapsedMs > this.intervalMs * 1.5
     let reaped = 0
     let clientCount = 0
     for (const socket of clients) {
       clientCount += 1
-      if (resumedFromPause) {
-        // Why: a delayed server tick cannot infer that clients missed a probe they had no chance to answer.
-        this.alive.add(socket)
+      if (this.alive.has(socket)) {
+        this.alive.delete(socket)
+        this.missedProbes.delete(socket)
+      } else if (!stalledTick) {
+        const missed = (this.missedProbes.get(socket) ?? 0) + 1
+        if (missed >= this.missedProbeLimit) {
+          this.missedProbes.delete(socket)
+          socket.terminate()
+          reaped += 1
+          continue
+        }
+        this.missedProbes.set(socket, missed)
       }
-      if (!this.alive.has(socket)) {
-        socket.terminate()
-        reaped += 1
-        continue
-      }
-      this.alive.delete(socket)
       try {
+        // Why: re-probe every sweep, including missed ones, so a path that just recovered can prove
+        // itself on the next tick instead of waiting out the rest of the budget.
         socket.ping()
       } catch {
         // Why: a mid-teardown socket is finalized by its close/error listener.
diff --git a/src/main/runtime/rpc/ws-transport-accept-order.test.ts b/src/main/runtime/rpc/ws-transport-accept-order.test.ts
index 4f56a2da53e..20ae28f0f0e 100644
--- a/src/main/runtime/rpc/ws-transport-accept-order.test.ts
+++ b/src/main/runtime/rpc/ws-transport-accept-order.test.ts
@@ -83,7 +83,7 @@ describe('WebSocketTransport accepted socket ordering', () => {
     ).toEqual([0, 0, 0, 0])
   })
 
-  it('reaps an unresponsive accepted socket by the first interval deadline', async () => {
+  it('reaps an unresponsive accepted socket once consecutive probes go unanswered', async () => {
     vi.useFakeTimers()
     const events: string[] = []
     let socket: WebSocket
@@ -99,19 +99,22 @@ describe('WebSocketTransport accepted socket ordering', () => {
     socket.once('open', () => events.push('open'))
     socket.emit('open')
     lifecycle.handleConnection(socket)
-    await vi.advanceTimersByTimeAsync(99)
+    // A single silent interval is not evidence: the socket is re-probed, not reaped.
+    await vi.advanceTimersByTimeAsync(100)
+    expect(socket.terminate).not.toHaveBeenCalled()
+    await vi.advanceTimersByTimeAsync(199)
     expect(socket.terminate).not.toHaveBeenCalled()
 
     await vi.advanceTimersByTimeAsync(1)
 
     expect(socket.terminate).toHaveBeenCalledTimes(1)
-    expect(events).toEqual(['open', 'ping', 'close'])
+    expect(events).toEqual(['open', 'ping', 'ping', 'ping', 'close'])
     expect(lifecycle.heartbeatConnections.size).toBe(0)
     expect(lifecycle.heartbeat.timer).toBeNull()
     expect(vi.getTimerCount()).toBe(0)
   })
 
-  it('keeps later sockets on the shared cadence and reaps them within two intervals', async () => {
+  it('keeps later sockets on the shared cadence and reaps them on the shared budget', async () => {
     vi.useFakeTimers()
     vi.setSystemTime(0)
     const firstPingTimes: number[] = []
@@ -150,13 +153,15 @@ describe('WebSocketTransport accepted socket ordering', () => {
     expect(laterPingTimes).toEqual([100])
     expect(laterSocket.terminate).not.toHaveBeenCalled()
 
-    await vi.advanceTimersByTimeAsync(99)
+    // Re-probed on every sweep while its misses bank, so a recovered path can answer immediately.
+    await vi.advanceTimersByTimeAsync(299)
+    expect(laterPingTimes).toEqual([100, 200, 300])
     expect(laterSocket.terminate).not.toHaveBeenCalled()
 
     await vi.advanceTimersByTimeAsync(1)
     expect(laterSocket.terminate).toHaveBeenCalledTimes(1)
-    expect(laterReapTimes).toEqual([200])
-    expect(firstPingTimes).toEqual([0, 100, 200])
+    expect(laterReapTimes).toEqual([400])
+    expect(firstPingTimes).toEqual([0, 100, 200, 300, 400])
     expect(
       ['pong', 'message', 'close', 'error'].map((event) => laterSocket.listenerCount(event))
     ).toEqual([0, 0, 0, 0])
diff --git a/src/main/runtime/rpc/ws-transport-transient-packet-loss.test.ts b/src/main/runtime/rpc/ws-transport-transient-packet-loss.test.ts
new file mode 100644
index 00000000000..a8a5eb9c4de
--- /dev/null
+++ b/src/main/runtime/rpc/ws-transport-transient-packet-loss.test.ts
@@ -0,0 +1,83 @@
+// Real ws server + real ws client over loopback: a live, well-behaved peer whose pong is swallowed by
+// a transient blackhole must not be terminated (STA-3320).
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import WebSocket from 'ws'
+import { WebSocketTransport } from './ws-transport'
+
+const PROBE_INTERVAL_MS = 150
+
+// Why: the heartbeat calls now() exactly once per sweep, so a per-call step makes elapsed exactly one
+// interval every sweep — real scheduler jitter can never be mistaken for a suspended loop, and no
+// assertion in this file depends on wall time.
+function createStepClock(stepMs: number): () => number {
+  let calls = 0
+  return () => 1_000_000 + calls++ * stepMs
+}
+
+describe('WebSocketTransport under transient packet loss', () => {
+  const transports: WebSocketTransport[] = []
+  const sockets: WebSocket[] = []
+
+  afterEach(async () => {
+    for (const socket of sockets) {
+      socket.removeAllListeners()
+      socket.terminate()
+    }
+    sockets.length = 0
+    await Promise.all(transports.map((t) => t.stop().catch(() => {})))
+    transports.length = 0
+  })
+
+  async function startTransport(): Promise<WebSocketTransport> {
+    const transport = new WebSocketTransport({
+      host: '127.0.0.1',
+      port: 0,
+      heartbeatIntervalMs: PROBE_INTERVAL_MS,
+      heartbeatNow: createStepClock(PROBE_INTERVAL_MS),
+      // Why: this test is about liveness, not the auth handshake; keep the pre-auth reaper out of it.
+      preAuthTimeoutMs: 600_000
+    })
+    transports.push(transport)
+    await transport.start()
+    return transport
+  }
+
+  it('keeps a live client whose pong is swallowed for a single probe', async () => {
+    const transport = await startTransport()
+    // autoPong:false hands us the protocol-level pong so we can drop exactly one, the way a
+    // cellular/Tailscale blackhole drops exactly the frames in flight during the stall.
+    const client = new WebSocket(`ws://127.0.0.1:${transport.resolvedPort}`, { autoPong: false })
+    sockets.push(client)
+
+    let probesReceived = 0
+    const pongedProbes: number[] = []
+    const swallowedProbe = 2
+    let closed = false
+    client.on('ping', () => {
+      probesReceived += 1
+      if (probesReceived === swallowedProbe) {
+        return
+      }
+      pongedProbes.push(probesReceived)
+      client.pong()
+    })
+    client.on('close', () => {
+      closed = true
+    })
+    await new Promise<void>((resolve, reject) => {
+      client.once('open', resolve)
+      client.once('error', reject)
+    })
+
+    // Bounded by counted probe events, never by elapsed time.
+    await vi.waitFor(() => expect(closed || probesReceived >= swallowedProbe + 2).toBe(true), {
+      timeout: 15_000,
+      interval: 10
+    })
+
+    expect({ closed, probesReceived }).toEqual({ closed: false, probesReceived: 4 })
+    // The peer was demonstrably alive across the blackhole: it answered the probes on both sides of it.
+    expect(pongedProbes).toEqual([1, 3, 4])
+    expect(client.readyState).toBe(WebSocket.OPEN)
+  })
+})
diff --git a/src/main/runtime/rpc/ws-transport.ts b/src/main/runtime/rpc/ws-transport.ts
index 1444813fd65..ec58f8697ae 100644
--- a/src/main/runtime/rpc/ws-transport.ts
+++ b/src/main/runtime/rpc/ws-transport.ts
@@ -21,7 +21,7 @@ type WebSocketMessageHandler = {
   ): void
 }['bivarianceHack']
 
-// Why: mobile clients background-suspend sockets with no TCP FIN, leaving half-opens that otherwise only the OS keepalive (~2h) reaps; a 15s ping/pong sweep bounds that to ~30s (clients auto-pong per RFC 6455).
+// Why: mobile clients background-suspend sockets with no TCP FIN, leaving half-opens that otherwise only the OS keepalive (~2h) reaps; a 15s ping/pong sweep bounds that to ~60s (clients auto-pong per RFC 6455), since a reap needs consecutive unanswered probes rather than one (STA-3320).
 const HEARTBEAT_INTERVAL_MS = 15_000
 
 export type WebSocketTransportOptions = {
diff --git a/src/renderer/src/components/activity/ActivityPrototypePage.test.ts b/src/renderer/src/components/activity/ActivityPrototypePage.test.ts
index b9e03ecc492..05aec890947 100644
--- a/src/renderer/src/components/activity/ActivityPrototypePage.test.ts
+++ b/src/renderer/src/components/activity/ActivityPrototypePage.test.ts
@@ -261,6 +261,25 @@ describe('buildActivityEvents', () => {
     expect(threads[0].events[0].entry.prompt).toBe('First prompt')
   })
 
+  it('does not turn a session boundary into an Agent finished event', () => {
+    const result = makeActivityResult({
+      entries: {
+        [PANE_KEY]: {
+          ...makeWorkingEntryWithoutHistory(),
+          state: 'done',
+          prompt: '',
+          sessionBoundary: true,
+          stateHistory: [{ state: 'done', prompt: 'Real turn', startedAt: 1_000 }]
+        }
+      }
+    })
+
+    // Why: the displaced real completion stays visible; the idle SessionStart does not add a second finish.
+    expect(result.events).toHaveLength(1)
+    expect(result.events[0]).toMatchObject({ state: 'done', timestamp: 1_000 })
+    expect(result.events[0].entry.prompt).toBe('Real turn')
+  })
+
   it('does not keep showing a stale live agent as running', () => {
     const result = makeActivityResult({
       entries: {
diff --git a/src/renderer/src/components/activity/ActivityPrototypePage.tsx b/src/renderer/src/components/activity/ActivityPrototypePage.tsx
index 8e732ee044c..8c8058fbeeb 100644
--- a/src/renderer/src/components/activity/ActivityPrototypePage.tsx
+++ b/src/renderer/src/components/activity/ActivityPrototypePage.tsx
@@ -590,7 +590,8 @@ function appendActivityEventsForEntry(args: {
     })
   }
 
-  if (!isActivityEventState(args.entry.state)) {
+  // Why: SessionStart creates an idle row, not an "Agent finished" activity event (STA-3386).
+  if (!isActivityEventState(args.entry.state) || args.entry.sessionBoundary === true) {
     return
   }
   appendActivityEvent({
diff --git a/src/renderer/src/components/activity/useActivityUnreadCount.test.ts b/src/renderer/src/components/activity/useActivityUnreadCount.test.ts
new file mode 100644
index 00000000000..5c28a132762
--- /dev/null
+++ b/src/renderer/src/components/activity/useActivityUnreadCount.test.ts
@@ -0,0 +1,66 @@
+import { describe, expect, it } from 'vitest'
+import type { AgentStatusEntry } from '../../../../shared/agent-status-types'
+import { countActivityUnread } from './useActivityUnreadCount'
+
+const PANE = 'tab-1:11111111-1111-4111-8111-111111111111'
+
+function makeEntry(overrides: Partial<AgentStatusEntry>): AgentStatusEntry {
+  return {
+    state: 'done',
+    prompt: '',
+    updatedAt: 2_000,
+    stateStartedAt: 2_000,
+    paneKey: PANE,
+    agentType: 'claude',
+    stateHistory: [],
+    ...overrides
+  }
+}
+
+function makeSource(entry: AgentStatusEntry, ackAt = 0) {
+  return {
+    acknowledgedAgentsByPaneKey: { [PANE]: ackAt },
+    agentStatusByPaneKey: { [PANE]: entry },
+    migrationUnsupportedByPtyId: {},
+    retainedAgentsByPaneKey: {},
+    worktreesByRepo: {}
+  }
+}
+
+describe('countActivityUnread session-boundary rows (STA-3386)', () => {
+  it('does not count a session-boundary done as unread in either mode', () => {
+    const source = makeSource(makeEntry({ sessionBoundary: true }))
+    expect(countActivityUnread(source, 'sidebar-badge')).toBe(0)
+    expect(countActivityUnread(source, 'agent-events')).toBe(0)
+  })
+
+  it('keeps counting a real completion displaced into history by a session boundary', () => {
+    // Why: agent finished (unacknowledged), then the user resumed the session — the
+    // boundary row replaces the live done but the finish must stay unread in both badges.
+    const source = makeSource(
+      makeEntry({
+        sessionBoundary: true,
+        stateHistory: [{ state: 'done', prompt: 'fix bug', startedAt: 1_000 }]
+      })
+    )
+    expect(countActivityUnread(source, 'sidebar-badge')).toBe(1)
+    expect(countActivityUnread(source, 'agent-events')).toBe(1)
+  })
+
+  it('stops counting the displaced completion once acknowledged', () => {
+    const source = makeSource(
+      makeEntry({
+        sessionBoundary: true,
+        stateHistory: [{ state: 'done', prompt: 'fix bug', startedAt: 1_000 }]
+      }),
+      1_500
+    )
+    expect(countActivityUnread(source, 'sidebar-badge')).toBe(0)
+    expect(countActivityUnread(source, 'agent-events')).toBe(0)
+  })
+
+  it('still counts an ordinary unacknowledged done in sidebar-badge mode', () => {
+    const source = makeSource(makeEntry({}))
+    expect(countActivityUnread(source, 'sidebar-badge')).toBe(1)
+  })
+})
diff --git a/src/renderer/src/components/activity/useActivityUnreadCount.ts b/src/renderer/src/components/activity/useActivityUnreadCount.ts
index b496f9146cd..91b51c4455e 100644
--- a/src/renderer/src/components/activity/useActivityUnreadCount.ts
+++ b/src/renderer/src/components/activity/useActivityUnreadCount.ts
@@ -60,8 +60,22 @@ export function countActivityUnread(
         }
       }
     }
-    if (isUnreadAgentState(entry.state) && ackAt < entry.stateStartedAt) {
+    // Why: a session-boundary done is an idle connect (STA-3386), not an event to read.
+    // History never contains a boundary, but it DOES keep the real completion a boundary
+    // displaced (the slice pushes it on done→done), so sidebar-badge mode — which skips the
+    // history loop above — must still count that displaced completion or the badge silently
+    // drops an unacknowledged finish the moment its session is resumed.
+    if (
+      isUnreadAgentState(entry.state) &&
+      entry.sessionBoundary !== true &&
+      ackAt < entry.stateStartedAt
+    ) {
       count += 1
+    } else if (mode === 'sidebar-badge' && entry.state === 'done' && entry.sessionBoundary) {
+      const displaced = entry.stateHistory.at(-1)
+      if (displaced && isUnreadAgentState(displaced.state) && ackAt < displaced.startedAt) {
+        count += 1
+      }
     }
   }
 
diff --git a/src/renderer/src/components/automations/AutomationsPage.tsx b/src/renderer/src/components/automations/AutomationsPage.tsx
index 97f15d844a6..e8a33f4dcd0 100644
--- a/src/renderer/src/components/automations/AutomationsPage.tsx
+++ b/src/renderer/src/components/automations/AutomationsPage.tsx
@@ -46,12 +46,12 @@ import {
   waitForAutomationRerunPendingVisibility
 } from './automation-run-view-state'
 import {
-  automationRunMatchesPaneKey,
   buildAutomationRunOpenLayout,
   canOpenAutomationRunOpenTarget,
   getAutomationRunOpenTabId,
   resolveAutomationRunOpenTarget
 } from './automation-run-open-target'
+import { hasAutomationRunCompletionEvidence } from './automation-run-completion-evidence'
 import { getAutomationRunWorkspaceDisplay } from './automation-run-workspace-display'
 import {
   AutomationEditorDialog,
@@ -903,21 +903,12 @@ export default function AutomationsPage(): React.JSX.Element {
       if (dispatchedAt === null) {
         return false
       }
-      const liveDone = Object.entries(agentStatusByPaneKey).some(
-        ([paneKey, entry]) =>
-          automationRunMatchesPaneKey(run, paneKey) &&
-          entry.state === 'done' &&
-          entry.updatedAt >= dispatchedAt
-      )
-      if (liveDone) {
-        return true
-      }
-      return Object.entries(retainedAgentsByPaneKey).some(
-        ([paneKey, retained]) =>
-          automationRunMatchesPaneKey(run, paneKey) &&
-          retained.entry.state === 'done' &&
-          retained.entry.updatedAt >= dispatchedAt
-      )
+      return hasAutomationRunCompletionEvidence({
+        run,
+        dispatchedAt,
+        agentStatusByPaneKey,
+        retainedAgentsByPaneKey
+      })
     })
     if (completedRuns.length === 0) {
       return
diff --git a/src/renderer/src/components/automations/automation-run-completion-evidence.test.ts b/src/renderer/src/components/automations/automation-run-completion-evidence.test.ts
new file mode 100644
index 00000000000..f46426337a8
--- /dev/null
+++ b/src/renderer/src/components/automations/automation-run-completion-evidence.test.ts
@@ -0,0 +1,88 @@
+import { describe, expect, it } from 'vitest'
+import type { AutomationRun } from '../../../../shared/automations-types'
+import type { AgentStatusEntry } from '../../../../shared/agent-status-types'
+import type { RetainedAgentEntry } from '@/store/slices/agent-status'
+import { hasAutomationRunCompletionEvidence } from './automation-run-completion-evidence'
+
+const PANE = 'tab-1:11111111-1111-4111-8111-111111111111'
+
+function run(): AutomationRun {
+  return {
+    id: 'run-1',
+    automationId: 'automation-1',
+    title: 'Run 1',
+    scheduledFor: 1,
+    status: 'dispatched',
+    trigger: 'manual',
+    workspaceId: 'wt-1',
+    sessionKind: 'terminal',
+    chatSessionId: null,
+    terminalSessionId: 'tab-1',
+    terminalPaneKey: PANE,
+    terminalPtyId: 'pty-1',
+    outputSnapshot: null,
+    precheckResult: null,
+    usage: null,
+    error: null,
+    startedAt: 1_000,
+    dispatchedAt: 1_000,
+    createdAt: 1_000
+  }
+}
+
+function entry(overrides: Partial<AgentStatusEntry> = {}): AgentStatusEntry {
+  return {
+    paneKey: PANE,
+    state: 'done',
+    prompt: '',
+    updatedAt: 2_000,
+    stateStartedAt: 2_000,
+    stateHistory: [],
+    agentType: 'claude',
+    ...overrides
+  }
+}
+
+function retained(status: AgentStatusEntry): RetainedAgentEntry {
+  return {
+    entry: status,
+    worktreeId: 'wt-1',
+    tab: {
+      id: 'tab-1',
+      ptyId: 'pty-1',
+      worktreeId: 'wt-1',
+      title: 'Agent',
+      customTitle: null,
+      color: null,
+      sortOrder: 0,
+      createdAt: 1_000
+    },
+    agentType: 'claude',
+    startedAt: status.stateStartedAt
+  }
+}
+
+describe('automation run completion evidence (STA-3386)', () => {
+  it('ignores live and retained session-boundary done rows', () => {
+    const boundary = entry({ sessionBoundary: true })
+    expect(
+      hasAutomationRunCompletionEvidence({
+        run: run(),
+        dispatchedAt: 1_000,
+        agentStatusByPaneKey: { [PANE]: boundary },
+        retainedAgentsByPaneKey: { [PANE]: retained(boundary) }
+      })
+    ).toBe(false)
+  })
+
+  it('accepts a real done after dispatch', () => {
+    expect(
+      hasAutomationRunCompletionEvidence({
+        run: run(),
+        dispatchedAt: 1_000,
+        agentStatusByPaneKey: { [PANE]: entry() },
+        retainedAgentsByPaneKey: {}
+      })
+    ).toBe(true)
+  })
+})
diff --git a/src/renderer/src/components/automations/automation-run-completion-evidence.ts b/src/renderer/src/components/automations/automation-run-completion-evidence.ts
new file mode 100644
index 00000000000..26c0b0ffc93
--- /dev/null
+++ b/src/renderer/src/components/automations/automation-run-completion-evidence.ts
@@ -0,0 +1,38 @@
+import type { AutomationRun } from '../../../../shared/automations-types'
+import type { AgentStatusEntry } from '../../../../shared/agent-status-types'
+import type { RetainedAgentEntry } from '@/store/slices/agent-status'
+import { automationRunMatchesPaneKey } from './automation-run-open-target'
+
+function isCompletionAfterDispatch(entry: AgentStatusEntry, dispatchedAt: number): boolean {
+  return entry.state === 'done' && entry.sessionBoundary !== true && entry.updatedAt >= dispatchedAt
+}
+
+export function hasAutomationRunCompletionEvidence({
+  run,
+  dispatchedAt,
+  agentStatusByPaneKey,
+  retainedAgentsByPaneKey
+}: {
+  run: AutomationRun
+  dispatchedAt: number
+  agentStatusByPaneKey: Record<string, AgentStatusEntry>
+  retainedAgentsByPaneKey: Record<string, RetainedAgentEntry>
+}): boolean {
+  for (const [paneKey, entry] of Object.entries(agentStatusByPaneKey)) {
+    if (
+      automationRunMatchesPaneKey(run, paneKey) &&
+      isCompletionAfterDispatch(entry, dispatchedAt)
+    ) {
+      return true
+    }
+  }
+  for (const [paneKey, retained] of Object.entries(retainedAgentsByPaneKey)) {
+    if (
+      automationRunMatchesPaneKey(run, paneKey) &&
+      isCompletionAfterDispatch(retained.entry, dispatchedAt)
+    ) {
+      return true
+    }
+  }
+  return false
+}
diff --git a/src/renderer/src/components/dashboard/DashboardAgentRow.tsx b/src/renderer/src/components/dashboard/DashboardAgentRow.tsx
index 60724a27dcf..460c251b98b 100644
--- a/src/renderer/src/components/dashboard/DashboardAgentRow.tsx
+++ b/src/renderer/src/components/dashboard/DashboardAgentRow.tsx
@@ -12,6 +12,7 @@ import type { AgentStatusState } from '../../../../shared/agent-status-types'
 import type { DashboardAgentRow as DashboardAgentRowData } from './useDashboardData'
 import { getAgentRowPrimaryText } from '@/lib/agent-row-primary-text'
 import { useAgentRowConversationName } from './use-agent-row-conversation-name'
+import { lastEnteredDoneAt } from './agent-finished-timestamp'
 
 // Why: narrow the dashboard's rollup states to shared dot states, defaulting unknowns to 'idle' so a row never crashes.
 function asDotState(state: AgentStatusState | 'idle'): AgentDotState {
@@ -43,24 +44,6 @@ function formatTimeAgo(ts: number, now: number): string {
   return `${days}d ago`
 }
 
-// Why: use stateStartedAt (not updatedAt, which drifts on within-state pings) for the true done-transition time.
-function lastEnteredDoneAt(agent: DashboardAgentRowData): number | null {
-  // Why: idle subagents are alive-but-idle (persist between turns); don't label them as done.
-  if (agent.rowSource === 'subagent' && agent.state === 'idle') {
-    return null
-  }
-  const entry = agent.entry
-  if (entry.state === 'done') {
-    return entry.stateStartedAt
-  }
-  for (let i = entry.stateHistory.length - 1; i >= 0; i--) {
-    if (entry.stateHistory[i].state === 'done') {
-      return entry.stateHistory[i].startedAt
-    }
-  }
-  return null
-}
-
 function stateDotTooltipLabel(agent: DashboardAgentRowData, dotState: AgentDotState): string {
   if (agent.entry.interrupted === true) {
     return 'Interrupted by user'
diff --git a/src/renderer/src/components/dashboard/agent-finished-timestamp.test.ts b/src/renderer/src/components/dashboard/agent-finished-timestamp.test.ts
new file mode 100644
index 00000000000..92df277ef9d
--- /dev/null
+++ b/src/renderer/src/components/dashboard/agent-finished-timestamp.test.ts
@@ -0,0 +1,39 @@
+import { describe, expect, it } from 'vitest'
+import type { AgentStatusEntry } from '../../../../shared/agent-status-types'
+import { lastEnteredDoneAt } from './agent-finished-timestamp'
+
+function row(entry: AgentStatusEntry) {
+  return { rowSource: 'live' as const, state: entry.state, entry }
+}
+
+function doneEntry(overrides: Partial<AgentStatusEntry> = {}): AgentStatusEntry {
+  return {
+    paneKey: 'tab-1:11111111-1111-4111-8111-111111111111',
+    state: 'done',
+    prompt: '',
+    updatedAt: 2_000,
+    stateStartedAt: 2_000,
+    stateHistory: [],
+    agentType: 'claude',
+    ...overrides
+  }
+}
+
+describe('lastEnteredDoneAt session boundaries (STA-3386)', () => {
+  it('does not report an idle SessionStart as a completed turn', () => {
+    expect(lastEnteredDoneAt(row(doneEntry({ sessionBoundary: true })))).toBeNull()
+  })
+
+  it('falls through to a real completion displaced into history', () => {
+    expect(
+      lastEnteredDoneAt(
+        row(
+          doneEntry({
+            sessionBoundary: true,
+            stateHistory: [{ state: 'done', prompt: 'Real turn', startedAt: 1_000 }]
+          })
+        )
+      )
+    ).toBe(1_000)
+  })
+})
diff --git a/src/renderer/src/components/dashboard/agent-finished-timestamp.ts b/src/renderer/src/components/dashboard/agent-finished-timestamp.ts
index 2c81cec0be2..6449e570fe1 100644
--- a/src/renderer/src/components/dashboard/agent-finished-timestamp.ts
+++ b/src/renderer/src/components/dashboard/agent-finished-timestamp.ts
@@ -15,7 +15,9 @@ export function lastEnteredDoneAt(
     return null
   }
   const entry = agent.entry
-  if (entry.state === 'done') {
+  // Why: a session-boundary done means the session connected idle (STA-3386) — nothing
+  // finished; fall through to history (which never records session boundaries).
+  if (entry.state === 'done' && entry.sessionBoundary !== true) {
     return entry.stateStartedAt
   }
   for (let i = (entry.stateHistory?.length ?? 0) - 1; i >= 0; i--) {
diff --git a/src/renderer/src/components/editor/ReviewNotesSendMenuContent.tsx b/src/renderer/src/components/editor/ReviewNotesSendMenuContent.tsx
index 25b55305c06..adb0c3d1ed8 100644
--- a/src/renderer/src/components/editor/ReviewNotesSendMenuContent.tsx
+++ b/src/renderer/src/components/editor/ReviewNotesSendMenuContent.tsx
@@ -28,6 +28,7 @@ import {
 import { track } from '@/lib/telemetry'
 import { useNow } from '@/components/dashboard/useNow'
 import type { DashboardAgentRow as DashboardAgentRowData } from '@/components/dashboard/useDashboardData'
+import { lastEnteredDoneAt } from '@/components/dashboard/agent-finished-timestamp'
 import { selectLivePtyIdsForWorktree } from '@/components/sidebar/worktree-card-status-inputs'
 import { useWorktreeAgentRows } from '@/components/sidebar/useWorktreeAgentRows'
 import type { LaunchSource } from '../../../../shared/telemetry-events'
@@ -322,19 +323,6 @@ function formatAgentRelativeTime(agent: DashboardAgentRowData, now: number): str
   return startedAt > 0 ? `${formatTimeAgo(startedAt, now)}` : null
 }
 
-function lastEnteredDoneAt(agent: DashboardAgentRowData): number | null {
-  const entry = agent.entry
-  if (entry.state === 'done') {
-    return entry.stateStartedAt
-  }
-  for (let i = entry.stateHistory.length - 1; i >= 0; i--) {
-    if (entry.stateHistory[i].state === 'done') {
-      return entry.stateHistory[i].startedAt
-    }
-  }
-  return null
-}
-
 function formatTimeAgo(ts: number, now: number): string {
   const delta = now - ts
   if (delta < 60_000) {
diff --git a/src/renderer/src/components/native-chat/claude-terminal-session-options.test.ts b/src/renderer/src/components/native-chat/claude-terminal-session-options.test.ts
index a41d62eeb7a..82f9280bffb 100644
--- a/src/renderer/src/components/native-chat/claude-terminal-session-options.test.ts
+++ b/src/renderer/src/components/native-chat/claude-terminal-session-options.test.ts
@@ -1,7 +1,277 @@
 import { describe, expect, it } from 'vitest'
 import { readClaudeSessionOptionsFromTerminalScreen } from './claude-terminal-session-options'
 
+// Captured from a live `claude` 2.1.220 startup frame by replaying the PTY
+// bytes through @xterm/headless and calling serializeAddon.serialize({
+// scrollback: 0 }) — byte-for-byte what TerminalPane hands the scraper. The two
+// widths matter: at 100 columns the frame keeps its version and prints billing
+// on the model row, at 60 it drops the version and wraps billing to its own row.
+
+const FRESH_SESSION_100_COLS = [
+  '\u001b[?1049h\u001b[H\r',
+  '\u001b[38;2;215;119;87m╭───\u001b[1CClaude Code\u001b[1C\u001b[38;2;153;153;153mv2.1.220\u001b[1C\u001b[38;2;215;119;87m─────────────────────────────────────────────────────────────────────────╮\r',
+  '│\u001b[50C\u001b[2m│\u001b[1C\u001b[22;1mTips for getting started\u001b[22C\u001b[22m│\r',
+  '│\u001b[19C\u001b[39;1mWelcome back!\u001b[18C\u001b[38;2;215;119;87;22;2m│\u001b[1C\u001b[0mRun\u001b[1C/init\u001b[1Cto\u001b[1Ccreate\u001b[1Ca\u001b[1CCLAUDE.md\u001b[1Cfile\u001b[1Cwith\u001b[1Cin…\u001b[1C\u001b[38;2;215;119;87m│\r',
+  '│\u001b[50C\u001b[2m│\u001b[1C\u001b[22m─────────────────────────────────────────────\u001b[1C│\r',
+  "│\u001b[21C ▐\u001b[48;2;0;0;0m▛███▜\u001b[49m▌\u001b[21C\u001b[2m│\u001b[1C\u001b[22;1mWhat's new\u001b[36C\u001b[22m│\r",
+  '│\u001b[21C▝▜\u001b[48;2;0;0;0m█████\u001b[49m▛▘\u001b[20C\u001b[2m│\u001b[1C\u001b[0mBug\u001b[1Cfixes\u001b[1Cand\u001b[1Creliability\u001b[1Cimprovements\u001b[8C\u001b[38;2;215;119;87m│\r',
+  '│\u001b[21C  ▘▘ ▝▝  \u001b[20C\u001b[2m│\u001b[1C\u001b[0mAdded\u001b[1CClaude\u001b[1COpus\u001b[1C5\u001b[1C(`claude-opus-5`),\u001b[1Cnow\u001b[1Ct…\u001b[1C\u001b[38;2;215;119;87m│\r',
+  '│\u001b[50C\u001b[2m│\u001b[1C\u001b[0mAdded\u001b[1C`sandbox.network.strictAllowlist`\u001b[1Csett…\u001b[1C\u001b[38;2;215;119;87m│\r',
+  '│\u001b[3C\u001b[38;2;153;153;153mFable 5 with high effort · API Usage Billing\u001b[3C\u001b[38;2;215;119;87;2m│\u001b[1C\u001b[38;2;153;153;153;22;3m/release-notes for more\u001b[23C\u001b[38;2;215;119;87;23m│\r',
+  '│\u001b[19C\u001b[38;2;153;153;153m/private/tmp\u001b[19C\u001b[38;2;215;119;87;2m│\u001b[47C\u001b[22m│\r',
+  '╰──────────────────────────────────────────────────────────────────────────────────────────────────╯\r',
+  '\r',
+  '\r',
+  '\r',
+  '\r',
+  '\r',
+  '\r',
+  '\r',
+  '\r',
+  '\r',
+  '\r',
+  '\r',
+  '\u001b[2C\u001b[38;2;255;193;7m⚠ claude.ai connectors are disabled because ANTHROPIC_API_KEY or another auth source is set and …\r',
+  '\u001b[38;2;136;136;136m────────────────────────────────────────────────────────────────────────────────────────────────────\r',
+  '\u001b[0m❯ \u001b[2mTry "fix typecheck errors"\r',
+  '\u001b[38;2;136;136;136;22m────────────────────────────────────────────────────────────────────────────────────────────────────\r',
+  '\u001b[2C\u001b[38;2;255;193;7m⚠ Transcript saving is off — inherited CLAUDE_CODE_CHILD_SESSION marker\u001b[38;2;153;153;153m · restart with CLAUDE_COD…\r',
+  '\u001b[2C\u001b[96m🤖\u001b[38;2;153;153;153m \u001b[96mFable 5\u001b[37m | \u001b[93m📁\u001b[38;2;153;153;153m \u001b[92mtmp\u001b[37m | \u001b[2C\u001b[95m⚡️ \u001b[38;2;153;153;153m \u001b[95m11.9% · 23.8k tokens\r',
+  '\u001b[2C\u001b[38;2;255;107;128m⏵⏵ bypass permissions on\u001b[38;2;153;153;153m (shift+tab to cycle)\u001b[4A\u001b[45D\u001b[0m\u001b[?2004h\u001b[?1004h\u001b[?1003h'
+].join('\n')
+
+const FRESH_SESSION_60_COLS = [
+  '\u001b[?1049h\u001b[H\r',
+  '\u001b[38;2;215;119;87m╭─ Claude Code ────────────────────────────────────────────╮\r',
+  '│\u001b[58C│\r',
+  '│\u001b[22C\u001b[39;1mWelcome back!\u001b[23C\u001b[38;2;215;119;87;22m│\r',
+  '│\u001b[58C│\r',
+  '│\u001b[25C ▐\u001b[48;2;0;0;0m▛███▜\u001b[49m▌\u001b[25C│\r',
+  '│\u001b[25C▝▜\u001b[48;2;0;0;0m█████\u001b[49m▛▘\u001b[24C│\r',
+  '│\u001b[25C  ▘▘ ▝▝  \u001b[24C│\r',
+  '│\u001b[58C│\r',
+  '│\u001b[17C\u001b[38;2;153;153;153mFable 5 with high effort\u001b[17C\u001b[38;2;215;119;87m│\r',
+  '│\u001b[20C\u001b[38;2;153;153;153mAPI Usage Billing\u001b[21C\u001b[38;2;215;119;87m│\r',
+  '│\u001b[23C\u001b[38;2;153;153;153m/private/tmp\u001b[23C\u001b[38;2;215;119;87m│\r',
+  '│\u001b[58C│\r',
+  '╰──────────────────────────────────────────────────────────╯\r',
+  '\r',
+  '\r',
+  '\r',
+  '\r',
+  '\r',
+  '\r',
+  '\r',
+  '\r',
+  '\r',
+  '\u001b[2C\u001b[38;2;255;193;7m⚠ claude.ai connectors are disabled because ANTHROPIC_AP…\r',
+  '\u001b[38;2;136;136;136m────────────────────────────────────────────────────────────\r',
+  '\u001b[0m❯ \u001b[2mTry "refactor <filepath>"\r',
+  '\u001b[38;2;136;136;136;22m────────────────────────────────────────────────────────────\r',
+  '\u001b[2C\u001b[38;2;255;193;7m⚠ Transcript saving is off — inherited CLAUDE_CODE_CHILD_…\r',
+  '\u001b[2C\u001b[96m🤖\u001b[38;2;153;153;153m \u001b[96mFable 5\u001b[37m | \u001b[93m📁\u001b[38;2;153;153;153m \u001b[92mtmp\u001b[37m | \u001b[2C\u001b[95m⚡️ \u001b[38;2;153;153;153m \u001b[95m11.9% · 23.8k tokens\r',
+  '\u001b[2C\u001b[38;2;255;107;128m⏵⏵ bypass permissions on\u001b[38;2;153;153;153m (shift+tab to cycle)\u001b[4A\u001b[45D\u001b[0m\u001b[?2004h\u001b[?1004h\u001b[?1003h'
+].join('\n')
+
+const OPTION_LESS_MODEL_60_COLS = [
+  '\u001b[?1049h\u001b[H\r',
+  '\u001b[38;2;215;119;87m╭─ Claude Code ────────────────────────────────────────────╮\r',
+  '│\u001b[58C│\r',
+  '│\u001b[22C\u001b[39;1mWelcome back!\u001b[23C\u001b[38;2;215;119;87;22m│\r',
+  '│\u001b[58C│\r',
+  '│\u001b[25C ▐\u001b[48;2;0;0;0m▛███▜\u001b[49m▌\u001b[25C│\r',
+  '│\u001b[25C▝▜\u001b[48;2;0;0;0m█████\u001b[49m▛▘\u001b[24C│\r',
+  '│\u001b[25C  ▘▘ ▝▝  \u001b[24C│\r',
+  '│\u001b[58C│\r',
+  '│\u001b[24C\u001b[38;2;153;153;153mHaiku 4.5\u001b[25C\u001b[38;2;215;119;87m│\r',
+  '│\u001b[20C\u001b[38;2;153;153;153mAPI Usage Billing\u001b[21C\u001b[38;2;215;119;87m│\r',
+  '│\u001b[23C\u001b[38;2;153;153;153m/private/tmp\u001b[23C\u001b[38;2;215;119;87m│\r',
+  '│\u001b[58C│\r',
+  '╰──────────────────────────────────────────────────────────╯\r',
+  '\r',
+  '\r',
+  '\r',
+  '\r',
+  '\r',
+  '\r',
+  '\r',
+  '\r',
+  '\r',
+  '\u001b[2C\u001b[38;2;255;193;7m⚠ claude.ai connectors are disabled because ANTHROPIC_AP…\r',
+  '\u001b[38;2;136;136;136m────────────────────────────────────────────────────────────\r',
+  '\u001b[0m❯ \u001b[2mTry "how does <filepath> work?"\r',
+  '\u001b[38;2;136;136;136;22m────────────────────────────────────────────────────────────\r',
+  '\u001b[2C\u001b[38;2;255;193;7m⚠ Transcript saving is off — inherited CLAUDE_CODE_CHILD_…\r',
+  '\u001b[2C\u001b[96m🤖\u001b[38;2;153;153;153m \u001b[96mHaiku 4.5\u001b[37m | \u001b[93m📁\u001b[38;2;153;153;153m \u001b[92mtmp\u001b[37m | \u001b[2C\u001b[95m⚡️ \u001b[38;2;153;153;153m \u001b[95m11.9% · 23.8k tokens\r',
+  '\u001b[2C\u001b[38;2;255;107;128m⏵⏵ bypass permissions on\u001b[38;2;153;153;153m (shift+tab to cycle)\u001b[4A\u001b[45D\u001b[0m\u001b[?2004h\u001b[?1004h\u001b[?1003h'
+].join('\n')
+
+const EFFORT = {
+  id: 'effort',
+  label: 'Effort',
+  kind: {
+    type: 'select' as const,
+    choices: [
+      { value: 'low', label: 'Low' },
+      { value: 'medium', label: 'Medium' },
+      { value: 'high', label: 'High' }
+    ],
+    defaultValue: 'high'
+  },
+  apply: {}
+}
+
 describe('Claude terminal session option detection', () => {
+  it('reads the model from a real 100-column startup frame', () => {
+    // The descriptor sits eight rows under the version, below the welcome art.
+    expect(readClaudeSessionOptionsFromTerminalScreen(FRESH_SESSION_100_COLS)).toEqual({
+      model: 'fable',
+      effort: 'high'
+    })
+  })
+
+  it('reads a real 60-column frame that drops the version and wraps billing', () => {
+    expect(readClaudeSessionOptionsFromTerminalScreen(FRESH_SESSION_60_COLS)).toEqual({
+      model: 'fable',
+      effort: 'high'
+    })
+  })
+
+  it('reads a real narrow frame whose option-less model carries no metadata', () => {
+    // Why: `Haiku 4.5` has no effort control and its billing wrapped to the next
+    // row, so nothing marks the row as a model — only its position above the
+    // working directory does.
+    expect(readClaudeSessionOptionsFromTerminalScreen(OPTION_LESS_MODEL_60_COLS)).toEqual({
+      model: 'haiku'
+    })
+  })
+
+  it('reads an option-less model above a Windows working directory', () => {
+    const screen = [
+      '╭─ Claude Code ───╮',
+      '│Haiku 4.5│',
+      '│API Usage Billing│',
+      '│C:\\work\\repo│',
+      '╰─────────────╯'
+    ].join('\r\n')
+
+    expect(readClaudeSessionOptionsFromTerminalScreen(screen)).toEqual({ model: 'haiku' })
+  })
+
+  it('reports nothing rather than release-notes prose when the model row is bare', () => {
+    // Why: a custom model with its billing wrapped away carries no descriptor
+    // metadata, so nothing in the frame identifies it. The panel shares rows
+    // with the art and its borders collide (`││`) — reading past them would
+    // make panel prose win the search and report a sentence as the model.
+    const screen = [
+      '╭─── Claude Codev2.1.220 ───────────────────────╮',
+      '││Runs faster · uses fewer tokens│',
+      '│ ▐▛███▜▌│What‽s new│',
+      '│acme-frontier│',
+      '│API Usage Billing│',
+      '│/repo││',
+      '╰───────────────────────────────────────────────╯'
+    ].join('\r\n')
+
+    expect(readClaudeSessionOptionsFromTerminalScreen(screen)).toBeNull()
+  })
+
+  it('reports nothing when a partial frame only contains wrapped billing', () => {
+    const screen = [
+      '╭─ Claude Code ───╮',
+      '│API Usage Billing│',
+      '│/repo│',
+      '╰─────────────╯'
+    ].join('\r\n')
+
+    expect(readClaudeSessionOptionsFromTerminalScreen(screen)).toBeNull()
+  })
+
+  it('does not reject a bare custom model whose name mentions billing', () => {
+    const screen = ['╭─ Claude Code ───╮', '│billing-model│', '│/repo│', '╰─────────────╯'].join(
+      '\r\n'
+    )
+
+    expect(readClaudeSessionOptionsFromTerminalScreen(screen)).toEqual({
+      model: 'billing-model'
+    })
+  })
+
+  // The exact catalog `claude -p` list_models returns on CLI 2.1.220: note the
+  // host offers no plain `opus`, and `sonnet` and `sonnet[1m]` are distinct.
+  const DISCOVERED = [
+    { id: 'opus[1m]', label: 'Opus (1M context)', options: [EFFORT] },
+    { id: 'sonnet', label: 'Sonnet', options: [EFFORT] },
+    { id: 'sonnet[1m]', label: 'Sonnet 5 (1M context)', options: [EFFORT] },
+    { id: 'fable', label: 'Fable', options: [EFFORT] },
+    { id: 'haiku', label: 'Haiku', options: [] }
+  ]
+
+  function frame(descriptor: string): string {
+    return `Claude Code v2.1.220\r\n${descriptor}\r\n~/repo`
+  }
+
+  it('resolves to the host id the picker lists, not the seed family', () => {
+    // Why: `opus` is not offered on this host, so reporting it would select a
+    // row the picker has to invent.
+    expect(
+      readClaudeSessionOptionsFromTerminalScreen(
+        frame('Opus 5 (1M context) with high effort · API Usage Billing'),
+        DISCOVERED
+      )
+    ).toEqual({ model: 'opus[1m]', effort: 'high' })
+  })
+
+  it('prefers the most specific variant when a family also matches', () => {
+    expect(
+      readClaudeSessionOptionsFromTerminalScreen(
+        frame('Sonnet 5 (1M context) with low effort · API Usage Billing'),
+        DISCOVERED
+      )
+    ).toEqual({ model: 'sonnet[1m]', effort: 'low' })
+  })
+
+  it('keeps the plain family when the frame names no variant', () => {
+    // Why: `Sonnet 5` must not be captured by the 1M-context row just because
+    // that row's label happens to start with the same two tokens.
+    expect(
+      readClaudeSessionOptionsFromTerminalScreen(
+        frame('Sonnet 5 with medium effort · API Usage Billing'),
+        DISCOVERED
+      )
+    ).toEqual({ model: 'sonnet', effort: 'medium' })
+  })
+
+  it('falls back to a seed family the host list no longer offers', () => {
+    expect(
+      readClaudeSessionOptionsFromTerminalScreen(
+        frame('Opus 4.8 with high effort · API Usage Billing'),
+        DISCOVERED
+      )
+    ).toEqual({ model: 'opus', effort: 'high' })
+  })
+
+  it('still reports a custom model when the host list cannot name it', () => {
+    expect(
+      readClaudeSessionOptionsFromTerminalScreen(
+        frame('company/my-haiku-v2 · API Usage Billing'),
+        DISCOVERED
+      )
+    ).toEqual({ model: 'company/my-haiku-v2' })
+  })
+
+  it('reads an effort suffix the frame truncated to an ellipsis', () => {
+    const screen =
+      'Claude Code v2.1.220\r\n' +
+      'Opus 5 (1M context) with high… · API Usage Billing\r\n' +
+      '~/repo'
+
+    expect(readClaudeSessionOptionsFromTerminalScreen(screen)).toEqual({
+      model: 'opus',
+      effort: 'high'
+    })
+  })
+
   it('reads the current model and effort from Claude header chrome', () => {
     const screen =
       '\u001b[1mClaude Code\u001b[0m v2.1.211\r\n' +
@@ -63,4 +333,60 @@ describe('Claude terminal session option detection', () => {
       readClaudeSessionOptionsFromTerminalScreen('I recommend Opus 4.8 for this task.')
     ).toBeNull()
   })
+
+  it('recovers a custom model name that is not in the catalog', () => {
+    const screen =
+      '\u001b[1mClaude Code\u001b[0m v2.1.211\r\n' +
+      '\u001b[38;2;102;102;102mmy-custom-model with high effort · API Usage Billing\r\n' +
+      '~/repo'
+
+    // Custom models have no catalog options, so effort is intentionally dropped.
+    expect(readClaudeSessionOptionsFromTerminalScreen(screen)).toEqual({
+      model: 'my-custom-model'
+    })
+  })
+
+  it('recovers a custom model with no effort suffix', () => {
+    const screen = 'Claude Code v2.1.211\r\ncompany/internal-opus · API Usage Billing\r\n~/repo'
+
+    expect(readClaudeSessionOptionsFromTerminalScreen(screen)).toEqual({
+      model: 'company/internal-opus'
+    })
+  })
+
+  it('keeps a custom model containing a catalog label', () => {
+    const screen = 'Claude Code v2.1.211\r\ncompany/my-haiku-v2 · API Usage Billing\r\n~/repo'
+
+    expect(readClaudeSessionOptionsFromTerminalScreen(screen)).toEqual({
+      model: 'company/my-haiku-v2'
+    })
+  })
+
+  it('keeps a custom model whose name only starts with a catalog family', () => {
+    // Why: the family must match as a whole leading word, not a bare prefix, or
+    // every vendor slug built off a family name would be claimed as that model.
+    const screen = 'Claude Code v2.1.211\r\nopus-internal-v3 · API Usage Billing\r\n~/repo'
+
+    expect(readClaudeSessionOptionsFromTerminalScreen(screen)).toEqual({
+      model: 'opus-internal-v3'
+    })
+  })
+
+  it('ignores catalog labels outside the descriptor row', () => {
+    const screen = 'Claude Code v2.1.211\r\nacme-frontier · API Usage Billing\r\n~/work/Haiku'
+
+    expect(readClaudeSessionOptionsFromTerminalScreen(screen)).toEqual({
+      model: 'acme-frontier'
+    })
+  })
+
+  it('recovers a custom model when xterm joins the descriptor to the header', () => {
+    const screen =
+      '\u001b[?1049h\u001b[H▐▛███▜▌Claude Codev2.1.211' +
+      '▝▜█████▛▘acme-frontier with medium effort · API Usage Billing'
+
+    expect(readClaudeSessionOptionsFromTerminalScreen(screen)).toEqual({
+      model: 'acme-frontier'
+    })
+  })
 })
diff --git a/src/renderer/src/components/native-chat/claude-terminal-session-options.ts b/src/renderer/src/components/native-chat/claude-terminal-session-options.ts
index 7a1e5b8fbd8..3b8ad86a47a 100644
--- a/src/renderer/src/components/native-chat/claude-terminal-session-options.ts
+++ b/src/renderer/src/components/native-chat/claude-terminal-session-options.ts
@@ -1,4 +1,7 @@
-import { getAgentSessionOptionCatalog } from '../../../../shared/agent-session-option-catalog'
+import {
+  getAgentSessionOptionCatalog,
+  type CatalogModel
+} from '../../../../shared/agent-session-option-catalog'
 import type { SessionOptionValue } from '../../../../shared/native-chat-session-options'
 import { stripScrollbackAnsi } from './native-chat-scrape-fallback'
 
@@ -11,41 +14,219 @@ const EFFORT_ID_BY_LABEL: Record<string, string> = {
   max: 'max'
 }
 
+// Why: narrow panes elide the trailing `effort` word to an ellipsis, so the
+// level itself is the only part of the suffix we can rely on.
+const CLAUDE_MODEL_EFFORT =
+  /\bwith\s+(extra high|xhigh|medium|high|low|max)(?:\s+effort\b|\s*…|\s*$)/i
+
+// Claude's startup frame. Chat text uses an em dash rather than these box
+// characters, so a leading corner is safe proof that a row is chrome.
+const FRAME_TOP = '╭'
+const FRAME_BOTTOM = '╰'
+const FRAME_COLUMN = '│'
+
+/** Rows of the visible screen, ANSI-stripped and whitespace-collapsed. */
 function normalizedScreenLines(screen: string): string[] {
   return stripScrollbackAnsi(screen)
     .split('\n')
     .map((line) => line.replace(/\s+/g, ' ').trim())
 }
 
+function isClaudeHeaderRow(line: string): boolean {
+  // No trailing word boundary: serialization drops the gap before the version,
+  // leaving `Claude Codev2.1.220`.
+  if (!/\bClaude Code/i.test(line)) {
+    return false
+  }
+  // Why: panes under ~70 columns drop the version from the frame entirely, so
+  // accept the frame corner as the alternative proof this is Claude's chrome.
+  // xterm serialization also drops cursor-positioning cells between the product
+  // name and version, producing `Claude Codev2.1.211`.
+  return /\bClaude Code\s*v?\d+(?:\.\d+){1,2}\b/i.test(line) || line.startsWith(FRAME_TOP)
+}
+
+/** The frame's leftmost cell on a row. Reading up to the next column border
+ *  keeps the release-notes panel out: on rows whose left cell is empty the
+ *  borders collide (`││`) and this yields nothing rather than the panel text. */
+function frameCell(line: string): string {
+  if (line.startsWith(FRAME_COLUMN)) {
+    const afterBorder = line.slice(FRAME_COLUMN.length)
+    const columnEnd = afterBorder.indexOf(FRAME_COLUMN)
+    return (columnEnd < 0 ? afterBorder : afterBorder.slice(0, columnEnd)).trim()
+  }
+  // Unframed buffers put the descriptor on the row directly, behind box art.
+  return line.replace(/^[^A-Za-z0-9]+/, '').trim()
+}
+
+/** Whether a cell carries the metadata Claude only prints on the model row, so
+ *  ordinary frame text is never mistaken for a model. */
+function isModelDescriptorCell(cell: string): boolean {
+  return cell.includes('·') || CLAUDE_MODEL_EFFORT.test(cell)
+}
+
+function isWorkingDirectoryCell(cell: string): boolean {
+  return (
+    cell.startsWith('/') ||
+    cell.startsWith('~') ||
+    /^[A-Za-z]:[\\/]/.test(cell) ||
+    /^\\\\[^\\]/.test(cell)
+  )
+}
+
+/**
+ * Claude prints the model descriptor near the bottom of its startup frame, with
+ * the welcome art and the release-notes panel in between — it is not adjacent to
+ * the version row. Search the frame from the bottom up so the panel's own text
+ * can never win over the descriptor.
+ */
+function claudeModelDescriptorCell(lines: string[], headerIndex: number): string | null {
+  const frameBottom = lines.findIndex(
+    (line, index) => index > headerIndex && line.startsWith(FRAME_BOTTOM)
+  )
+  // Why: an unframed buffer gives no bottom to bound the search, so keep the
+  // original tight window rather than reaching into conversation text.
+  const lastRow = frameBottom > 0 ? frameBottom - 1 : Math.min(headerIndex + 2, lines.length - 1)
+  for (let index = lastRow; index > headerIndex; index -= 1) {
+    const cell = frameCell(lines[index] ?? '')
+    if (isModelDescriptorCell(cell)) {
+      return cell
+    }
+  }
+  // xterm serialization can join the descriptor onto the version row itself.
+  const joined = frameCell((lines[headerIndex] ?? '').replace(/^.*?\bClaude Code\s*v?[\d.]*/i, ''))
+  if (isModelDescriptorCell(joined)) {
+    return joined
+  }
+  return frameBottom > 0 ? modelRowAboveWorkingDirectory(lines, headerIndex, frameBottom) : null
+}
+
+/**
+ * A model with no effort control whose billing wrapped away — `Haiku 4.5` on a
+ * narrow pane — leaves a bare name that no metadata identifies. Claude always
+ * closes the frame with the working directory, and prints at most the
+ * descriptor plus a wrapped billing line above it, so walk up from there.
+ */
+function modelRowAboveWorkingDirectory(
+  lines: string[],
+  headerIndex: number,
+  frameBottom: number
+): string | null {
+  let workingDirectory = -1
+  for (let index = frameBottom - 1; index > headerIndex; index -= 1) {
+    const cell = frameCell(lines[index] ?? '')
+    if (isWorkingDirectoryCell(cell)) {
+      workingDirectory = index
+      break
+    }
+  }
+  if (workingDirectory < 0) {
+    return null
+  }
+  let top = workingDirectory
+  while (top - 1 > headerIndex && frameCell(lines[top - 1] ?? '')) {
+    top -= 1
+  }
+  // Anything taller than descriptor + billing is the welcome art, not a model.
+  if (top >= workingDirectory || workingDirectory - top > 2) {
+    return null
+  }
+  const cell = frameCell(lines[top] ?? '')
+  return /^API Usage Billing$/i.test(cell) ? null : cell
+}
+
+/** The displayed model name, without the effort suffix or billing tail. */
+function parseClaudeModelName(cell: string): string | null {
+  // split always yields a non-empty first segment for a non-empty cell.
+  const beforeBilling = cell.split('·')[0]!
+  const effort = beforeBilling.match(CLAUDE_MODEL_EFFORT)
+  const name = (
+    effort?.index === undefined ? beforeBilling : beforeBilling.slice(0, effort.index)
+  ).trim()
+  return name || null
+}
+
+function modelNameTokens(value: string): string[] {
+  return value.toLowerCase().match(/[a-z]+|\d+[a-z]*/g) ?? []
+}
+
+/**
+ * Whether a catalog label names the model the frame reported. The frame prints
+ * the resolved model ("Opus 5 (1M context)") while labels name the alias
+ * ("Opus (1M context)"), so the family has to lead as a whole word and the
+ * label's remaining tokens have to appear in order. Requiring a whole word is
+ * what keeps `company/my-haiku-v2` and `opus-internal-v3` out of the catalog;
+ * requiring the rest is what stops `Sonnet` from claiming the 1M-context row.
+ */
+function labelNamesReportedModel(reportedModel: string, label: string): boolean {
+  const labelTokens = modelNameTokens(label)
+  const family = labelTokens[0]
+  if (!family) {
+    return false
+  }
+  const name = reportedModel.toLowerCase()
+  if (name !== family && !name.startsWith(`${family} `)) {
+    return false
+  }
+  const nameTokens = modelNameTokens(name)
+  let cursor = 1
+  for (const token of labelTokens.slice(1)) {
+    const found = nameTokens.indexOf(token, cursor)
+    if (found < 0) {
+      return false
+    }
+    cursor = found + 1
+  }
+  return true
+}
+
+/** The most specific catalog entry naming this model, preferring the host's
+ *  discovered list so variants like `opus[1m]` win over the seed family. */
+function findClaudeCatalogModel(
+  reportedModel: string,
+  models: readonly CatalogModel[] | undefined
+): CatalogModel | undefined {
+  const seeded = getAgentSessionOptionCatalog('claude')?.models ?? []
+  for (const candidates of [models ?? [], seeded]) {
+    const matches = candidates.filter(({ label }) => labelNamesReportedModel(reportedModel, label))
+    const best = matches.sort(
+      (left, right) => modelNameTokens(right.label).length - modelNameTokens(left.label).length
+    )[0]
+    if (best) {
+      return best
+    }
+  }
+  return undefined
+}
+
+/**
+ * @param models the host's live model list. Pass the discovered catalog so the
+ *   reported id is one the picker actually lists; omitting it falls back to the
+ *   version-neutral seed families.
+ */
 export function readClaudeSessionOptionsFromTerminalScreen(
-  screen: string | null | undefined
+  screen: string | null | undefined,
+  models?: readonly CatalogModel[]
 ): Record<string, SessionOptionValue> | null {
   if (!screen) {
     return null
   }
   const lines = normalizedScreenLines(screen)
-  const headerIndex = lines.findIndex((line) =>
-    // xterm serialization can remove cursor-positioning cells between the
-    // product name and version, producing `Claude Codev2.1.211`.
-    /\bClaude Code\s*v?\d+(?:\.\d+){1,2}\b/i.test(line)
-  )
+  const headerIndex = lines.findIndex(isClaudeHeaderRow)
   if (headerIndex < 0) {
     return null
   }
-  // Why: only Claude's fixed header rows describe live state; conversation
-  // text and old command confirmations elsewhere in the buffer can be stale.
-  const header = lines.slice(headerIndex, headerIndex + 3).join(' ')
-  const catalog = getAgentSessionOptionCatalog('claude')
-  const model = [...(catalog?.models ?? [])]
-    .sort((left, right) => right.label.length - left.label.length)
-    .find(({ label }) => header.toLowerCase().includes(label.toLowerCase()))
-  if (!model) {
+  const descriptorCell = claudeModelDescriptorCell(lines, headerIndex)
+  const reportedModel = descriptorCell ? parseClaudeModelName(descriptorCell) : null
+  if (!reportedModel) {
     return null
   }
+  const model = findClaudeCatalogModel(reportedModel, models)
+  if (!model) {
+    // A custom model carries no catalog options, so no effort is reported.
+    return { model: reportedModel }
+  }
   const result: Record<string, SessionOptionValue> = { model: model.id }
-  const effortLabel = header.match(
-    /\bwith\s+(low|medium|high|extra high|xhigh|max)\s+effort\b/i
-  )?.[1]
+  const effortLabel = descriptorCell?.match(CLAUDE_MODEL_EFFORT)?.[1]
   const effort = effortLabel ? EFFORT_ID_BY_LABEL[effortLabel.toLowerCase()] : undefined
   if (effort && model.options.some((option) => option.id === 'effort')) {
     result.effort = effort
diff --git a/src/renderer/src/components/native-chat/use-native-chat-session-options.test.ts b/src/renderer/src/components/native-chat/use-native-chat-session-options.test.ts
new file mode 100644
index 00000000000..a24d1b8f87f
--- /dev/null
+++ b/src/renderer/src/components/native-chat/use-native-chat-session-options.test.ts
@@ -0,0 +1,178 @@
+// @vitest-environment happy-dom
+
+import { renderHook, waitFor } from '@testing-library/react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { CatalogModel } from '../../../../shared/agent-session-option-catalog'
+import { clearNativeChatModelEnrichmentForTests } from './native-chat-session-option-enrichment'
+
+const discoverModels = vi.fn<() => Promise<readonly CatalogModel[] | null>>()
+
+vi.mock('./native-chat-session-option-discovery', () => ({
+  resolveNativeChatModelDiscoveryContext: () => ({ hostKey: 'host', runtime: null }),
+  discoverNativeChatCatalogModels: () => discoverModels()
+}))
+
+vi.mock('../../store', () => ({
+  useAppStore: Object.assign(() => undefined, {
+    getState: () => ({ settings: {}, updateSettings: async () => undefined })
+  })
+}))
+
+import { useNativeChatSessionOptions } from './use-native-chat-session-options'
+
+// A 1M-context Opus session: the frame names the resolved model while the
+// host's discovered catalog names the alias.
+const CLAUDE_SCREEN =
+  'Claude Code v2.1.220\r\nOpus 5 (1M context) with high effort · API Usage Billing\r\n~/repo'
+
+const DISCOVERED: CatalogModel[] = [
+  { id: 'opus[1m]', label: 'Opus (1M context)', options: [] },
+  { id: 'haiku', label: 'Haiku', options: [] }
+]
+
+function modelDescriptor(snapshot: { id: string; kind: unknown }[]): {
+  currentValue?: string
+  choices: { value: string }[]
+} {
+  const model = snapshot.find((descriptor) => descriptor.id === 'model')
+  return model?.kind as { currentValue?: string; choices: { value: string }[] }
+}
+
+describe('useNativeChatSessionOptions model reporting', () => {
+  beforeEach(() => {
+    clearNativeChatModelEnrichmentForTests()
+    discoverModels.mockReset()
+    Object.defineProperty(window, 'api', { configurable: true, value: undefined })
+  })
+
+  it('re-resolves the reported model against models discovered after the read', async () => {
+    // Why: discovery is async, so the first scrape can only reach the seed. If
+    // the reported id were left at the family the picker would show a row it
+    // had to invent — and by then the frame may have scrolled out of the buffer,
+    // so re-reading the screen is not an option.
+    let resolveDiscovery: (models: CatalogModel[]) => void = () => {}
+    discoverModels.mockReturnValue(
+      new Promise<readonly CatalogModel[]>((resolve) => {
+        resolveDiscovery = resolve
+      })
+    )
+
+    // Stable identity, and the frame scrolls out of the buffer before discovery
+    // lands — so nothing but the cached screen can drive the re-resolution.
+    let frameVisible = true
+    const readTerminalScreen = (): string | null =>
+      frameVisible ? CLAUDE_SCREEN : 'conversation has scrolled past the frame'
+    const dispatchCommand = vi.fn()
+
+    const { result } = renderHook(() =>
+      useNativeChatSessionOptions({
+        agent: 'claude',
+        terminalTabId: 'tab-1',
+        targetPtyId: 'pty-1',
+        dispatchCommand,
+        readTerminalScreen
+      })
+    )
+
+    await waitFor(() => expect(modelDescriptor(result.current.snapshot).currentValue).toBe('opus'))
+
+    frameVisible = false
+    resolveDiscovery(DISCOVERED)
+
+    await waitFor(() =>
+      expect(modelDescriptor(result.current.snapshot).currentValue).toBe('opus[1m]')
+    )
+    // The invented family row is gone: every choice is one the host listed.
+    expect(modelDescriptor(result.current.snapshot).choices.map((choice) => choice.value)).toEqual([
+      'opus[1m]',
+      'haiku'
+    ])
+  })
+
+  it('does not re-resolve a late snapshot from the previous pty', async () => {
+    let resolveDiscovery: (models: CatalogModel[]) => void = () => {}
+    discoverModels.mockReturnValue(
+      new Promise<readonly CatalogModel[]>((resolve) => {
+        resolveDiscovery = resolve
+      })
+    )
+    let resolveOldSnapshot: (snapshot: { data: string; alternateScreen: false }) => void = () => {}
+    const oldSnapshot = new Promise<{ data: string; alternateScreen: false }>((resolve) => {
+      resolveOldSnapshot = resolve
+    })
+    const getMainBufferSnapshot = vi
+      .fn()
+      .mockReturnValueOnce(oldSnapshot)
+      .mockReturnValueOnce(new Promise(() => {}))
+    Object.defineProperty(window, 'api', {
+      configurable: true,
+      value: { pty: { getMainBufferSnapshot } }
+    })
+
+    const dispatchCommand = vi.fn()
+    const { result, rerender } = renderHook(
+      ({ targetPtyId }) =>
+        useNativeChatSessionOptions({
+          agent: 'claude',
+          terminalTabId: 'tab-1',
+          targetPtyId,
+          dispatchCommand,
+          readTerminalScreen: () => null
+        }),
+      { initialProps: { targetPtyId: 'pty-old' } }
+    )
+
+    rerender({ targetPtyId: 'pty-new' })
+    resolveOldSnapshot({ data: CLAUDE_SCREEN, alternateScreen: false })
+    await Promise.resolve()
+    resolveDiscovery(DISCOVERED)
+
+    await waitFor(() =>
+      expect(
+        modelDescriptor(result.current.snapshot).choices.map((choice) => choice.value)
+      ).toEqual(['opus[1m]', 'haiku'])
+    )
+    expect(modelDescriptor(result.current.snapshot).currentValue).toBeUndefined()
+  })
+
+  it('clears a previously reported screen when the target pty changes', async () => {
+    let resolveDiscovery: (models: CatalogModel[]) => void = () => {}
+    discoverModels.mockReturnValue(
+      new Promise<readonly CatalogModel[]>((resolve) => {
+        resolveDiscovery = resolve
+      })
+    )
+    const getMainBufferSnapshot = vi
+      .fn()
+      .mockResolvedValueOnce({ data: CLAUDE_SCREEN, alternateScreen: false })
+      .mockReturnValueOnce(new Promise(() => {}))
+    Object.defineProperty(window, 'api', {
+      configurable: true,
+      value: { pty: { getMainBufferSnapshot } }
+    })
+
+    const dispatchCommand = vi.fn()
+    const { result, rerender } = renderHook(
+      ({ targetPtyId }) =>
+        useNativeChatSessionOptions({
+          agent: 'claude',
+          terminalTabId: 'tab-reset',
+          targetPtyId,
+          dispatchCommand,
+          readTerminalScreen: () => null
+        }),
+      { initialProps: { targetPtyId: 'pty-reported' } }
+    )
+    await waitFor(() => expect(modelDescriptor(result.current.snapshot).currentValue).toBe('opus'))
+
+    rerender({ targetPtyId: 'pty-empty' })
+    resolveDiscovery(DISCOVERED)
+
+    await waitFor(() =>
+      expect(
+        modelDescriptor(result.current.snapshot).choices.map((choice) => choice.value)
+      ).toEqual(['opus[1m]', 'haiku'])
+    )
+    expect(modelDescriptor(result.current.snapshot).currentValue).toBeUndefined()
+  })
+})
diff --git a/src/renderer/src/components/native-chat/use-native-chat-session-options.ts b/src/renderer/src/components/native-chat/use-native-chat-session-options.ts
index b0dfe6503fe..a722a1ffc98 100644
--- a/src/renderer/src/components/native-chat/use-native-chat-session-options.ts
+++ b/src/renderer/src/components/native-chat/use-native-chat-session-options.ts
@@ -1,4 +1,4 @@
-import { useEffect, useMemo, useSyncExternalStore } from 'react'
+import { useEffect, useMemo, useRef, useSyncExternalStore } from 'react'
 import type { AgentType } from '../../../../shared/agent-status-types'
 import { updateNativeChatSessionOptionDefaults } from '../../../../shared/native-chat-session-option-defaults'
 import type { SessionOptionDescriptor } from '../../../../shared/native-chat-session-options'
@@ -36,6 +36,9 @@ export function useNativeChatSessionOptions(args: {
 } {
   const { agent, terminalTabId, targetPtyId, dispatchCommand, onAgentPicker, readTerminalScreen } =
     args
+  // The screen text that last parsed into reported values, so a later model
+  // discovery can re-resolve it against the host's real ids.
+  const reportedScreenRef = useRef<string | null>(null)
   const discoveryContext = useMemo(
     () => resolveNativeChatModelDiscoveryContext(terminalTabId),
     [terminalTabId]
@@ -47,8 +50,16 @@ export function useNativeChatSessionOptions(args: {
       return null
     }
     const scopeKey = targetPtyId ?? terminalTabId
+    const discoveredModels = discoveryContext
+      ? readNativeChatEnrichedModels(agent, discoveryContext.hostKey)
+      : null
     const reportedValues =
-      agent === 'claude' ? readClaudeSessionOptionsFromTerminalScreen(readTerminalScreen?.()) : null
+      agent === 'claude'
+        ? readClaudeSessionOptionsFromTerminalScreen(
+            readTerminalScreen?.(),
+            discoveredModels ?? undefined
+          )
+        : null
     let settingsWrite = Promise.resolve()
     return createNativeChatPtySessionOptions({
       agent,
@@ -57,12 +68,7 @@ export function useNativeChatSessionOptions(args: {
       // Why: the catalog seed carries version-neutral family labels, so it is
       // safe on every host while the once-per-host probe runs or after it fails
       // — without it the whole picker would pop in late or never appear.
-      ...(discoveryContext
-        ? {
-            initialModels:
-              readNativeChatEnrichedModels(agent, discoveryContext.hostKey) ?? undefined
-          }
-        : {}),
+      ...(discoveryContext ? { initialModels: discoveredModels ?? undefined } : {}),
       mode: targetPtyId ? 'live' : 'draft',
       reportedValues,
       dispatchCommand,
@@ -105,6 +111,7 @@ export function useNativeChatSessionOptions(args: {
       return
     }
     let cancelled = false
+    reportedScreenRef.current = null
     const reportCurrentValues = async (): Promise<void> => {
       let authoritativeScreen: string | null = null
       if (targetPtyId && window.api?.pty?.getMainBufferSnapshot) {
@@ -119,18 +126,33 @@ export function useNativeChatSessionOptions(args: {
           // The mounted renderer buffer remains a transport-neutral fallback.
         }
       }
-      const reportedValues =
-        readClaudeSessionOptionsFromTerminalScreen(authoritativeScreen) ??
-        readClaudeSessionOptionsFromTerminalScreen(readTerminalScreen?.())
-      if (!cancelled && reportedValues) {
+      const models = discoveryContext
+        ? readNativeChatEnrichedModels(agent, discoveryContext.hostKey)
+        : null
+      for (const screen of [authoritativeScreen, readTerminalScreen?.() ?? null]) {
+        const reportedValues = readClaudeSessionOptionsFromTerminalScreen(
+          screen,
+          models ?? undefined
+        )
+        if (!reportedValues) {
+          continue
+        }
+        // Why: discovery can land after this read. Keeping the screen that
+        // parsed lets it re-resolve against the host's real ids later, when the
+        // frame itself may have already scrolled out of the buffer.
+        if (cancelled) {
+          return
+        }
+        reportedScreenRef.current = screen
         surface.reportSessionOptions(reportedValues)
+        return
       }
     }
     void reportCurrentValues()
     return () => {
       cancelled = true
     }
-  }, [agent, readTerminalScreen, surface, targetPtyId])
+  }, [agent, discoveryContext, readTerminalScreen, surface, targetPtyId])
 
   useEffect(() => {
     if (!surface || !discoveryContext) {
@@ -139,7 +161,16 @@ export function useNativeChatSessionOptions(args: {
     const unsubscribe = subscribeNativeChatEnrichedModels(
       agent,
       discoveryContext.hostKey,
-      (models) => surface.replaceModels(models)
+      (models) => {
+        surface.replaceModels(models)
+        const screen = agent === 'claude' ? reportedScreenRef.current : null
+        const reportedValues = screen
+          ? readClaudeSessionOptionsFromTerminalScreen(screen, models)
+          : null
+        if (reportedValues) {
+          surface.reportSessionOptions(reportedValues)
+        }
+      }
     )
     ensureNativeChatModelEnrichment({
       agent,
diff --git a/src/renderer/src/components/sidebar/WorktreeCard.pr-display.test.tsx b/src/renderer/src/components/sidebar/WorktreeCard.pr-display.test.tsx
index d1e95db8c74..fef27ea71cc 100644
--- a/src/renderer/src/components/sidebar/WorktreeCard.pr-display.test.tsx
+++ b/src/renderer/src/components/sidebar/WorktreeCard.pr-display.test.tsx
@@ -24,7 +24,6 @@ let issueCache: Record<string, unknown> = {}
 let prCache: Record<string, unknown> = {}
 let workspacePortScan: WorkspacePortScanResult | null = null
 let settings: Partial<GlobalSettings> | null = null
-let activityStatus = 'inactive'
 
 vi.mock('@/store', () => ({
   useAppStore: (selector: (state: unknown) => unknown) =>
@@ -61,7 +60,7 @@ vi.mock('@/components/ui/tooltip', () => ({
 }))
 
 vi.mock('./use-worktree-activity-status', () => ({
-  useWorktreeActivityStatus: () => activityStatus
+  useWorktreeActivityStatus: () => 'active'
 }))
 
 vi.mock('./CacheTimer', () => ({
@@ -163,7 +162,6 @@ describe('WorktreeCard linked PR display', () => {
     prCache = {}
     workspacePortScan = null
     settings = null
-    activityStatus = 'inactive'
   })
 
   it('keeps linked GH PR status out of the left status slot by default', async () => {
@@ -173,8 +171,8 @@ describe('WorktreeCard linked PR display', () => {
       <WorktreeCard worktree={makeWorktree({ linkedPR: 456 })} repo={makeRepo()} isActive={false} />
     )
 
-    expect(markup).toContain('Inactive')
-    expect(markup).toContain('bg-neutral-500/40')
+    expect(markup).toContain('Active')
+    expect(markup).toContain('bg-emerald-500')
     expect(markup).not.toContain('PR: Open')
     expect(markup).not.toContain('Linked PR #456')
   }, 20_000)
@@ -231,10 +229,11 @@ describe('WorktreeCard linked PR display', () => {
     )
 
     expect(unreadMarkup).not.toContain('aria-label="Mark as read"')
-    expect(unreadMarkup).toContain('Inactive · Unread')
-    expect(unreadMarkup).toContain('PR checks: Failed')
+    expect(unreadMarkup).toContain('PR checks: Failed · Unread')
     expect(unreadMarkup).not.toContain('Mark read')
-    expect(unreadMarkup).toContain('size-[13px]')
+    expect(unreadMarkup).toContain('size-[13px] translate-x-px')
+    expect(unreadMarkup).not.toContain('lucide-bell')
+    expect(unreadMarkup).not.toContain('text-amber-500')
     expect(unreadMarkup).toContain('data-worktree-status-lane-unread=""')
     expect(unreadMarkup).toContain('data-worktree-unread-alert=""')
     expect(unreadMarkup).toContain('bg-amber-500')
@@ -242,7 +241,7 @@ describe('WorktreeCard linked PR display', () => {
     expect(getInlineRenameTitleTag(readMarkup)).toContain('font-normal text-foreground/80')
   }, 20_000)
 
-  it('shows linked GH PR status in the title row before hosted review details are cached when new card style is on', async () => {
+  it('shows linked GH PR status in the left status slot before hosted review details are cached when new card style is on', async () => {
     settings = { experimentalNewWorktreeCardStyle: true }
     const { default: WorktreeCard } = await import('./WorktreeCard')
 
@@ -630,10 +629,9 @@ describe('WorktreeCard linked PR display', () => {
     expect(markup).not.toContain('58941')
   })
 
-  it('renders activity and linked PR status in independent sidebar lanes', async () => {
+  it('renders linked PR status in the left status slot instead of the right metadata list', async () => {
     settings = { experimentalNewWorktreeCardStyle: true }
     worktreeCardProperties = ['status']
-    activityStatus = 'active'
     hostedReviewCache = {
       'local::repo-1::feature/local-branch': {
         data: makeHostedReview({ status: 'failure' }),
@@ -647,13 +645,12 @@ describe('WorktreeCard linked PR display', () => {
     )
 
     expect(markup).toContain('PR checks: Failed')
-    expect(markup).toContain('Active')
-    expect(markup).toContain('bg-emerald-500')
-    expect(markup).toContain('data-worktree-card-review-status=""')
+    expect(markup).toContain('text-rose-500/85')
     expect(markup).not.toContain('Linked PR #456')
+    expect(markup).not.toContain('CI checks')
   })
 
-  it('uses branch PR cache for the title-row status before hosted-review metadata warms', async () => {
+  it('uses branch PR cache for the status slot before hosted-review metadata warms', async () => {
     settings = { experimentalNewWorktreeCardStyle: true }
     worktreeCardProperties = ['status']
     prCache = {
diff --git a/src/renderer/src/components/sidebar/WorktreeCard.quick-actions.test.tsx b/src/renderer/src/components/sidebar/WorktreeCard.quick-actions.test.tsx
index 54322d38ffc..7456cce2faa 100644
--- a/src/renderer/src/components/sidebar/WorktreeCard.quick-actions.test.tsx
+++ b/src/renderer/src/components/sidebar/WorktreeCard.quick-actions.test.tsx
@@ -21,7 +21,6 @@ let tabsByWorktree: Record<string, { id: string }[]> = {}
 let ptyIdsByTabId: Record<string, string[]> = {}
 let browserTabsByWorktree: Record<string, { id: string }[]> = {}
 let settings: Partial<GlobalSettings> | null = null
-let activityStatus = 'idle'
 let projectGroups: unknown[] = []
 let workspaceDeleteModifierPressed = false
 let gitConflictOperationByWorktree: Record<string, GitConflictOperation> = {}
@@ -61,7 +60,7 @@ vi.mock('@/components/ui/tooltip', () => ({
 }))
 
 vi.mock('./use-worktree-activity-status', () => ({
-  useWorktreeActivityStatus: () => activityStatus
+  useWorktreeActivityStatus: () => 'idle'
 }))
 
 vi.mock('./CacheTimer', () => ({
@@ -145,7 +144,6 @@ describe('WorktreeCard quick actions', () => {
     projectGroups = []
     workspaceDeleteModifierPressed = false
     gitConflictOperationByWorktree = {}
-    activityStatus = 'idle'
   })
 
   it('marks the unread toggle as a workspace-board-preserving action', () => {
@@ -254,19 +252,6 @@ describe('WorktreeCard quick actions', () => {
     expect(markup).not.toContain('lucide-git-branch')
   })
 
-  it('keeps the quiet status dot when the branch card property is off', () => {
-    settings = { experimentalNewWorktreeCardStyle: true }
-    worktreeCardProperties = ['status']
-    activityStatus = 'inactive'
-
-    const markup = renderToStaticMarkup(
-      <WorktreeCard worktree={makeWorktree()} repo={makeRepo()} isActive={false} />
-    )
-
-    expect(markup).toContain('bg-neutral-500/40')
-    expect(markup).not.toContain('lucide-git-branch')
-  })
-
   it('does not render a pending first-agent rename title badge', () => {
     const markup = renderToStaticMarkup(
       <WorktreeCard
diff --git a/src/renderer/src/components/sidebar/WorktreeCard.tsx b/src/renderer/src/components/sidebar/WorktreeCard.tsx
index 26a2d020235..b53a03ec833 100644
--- a/src/renderer/src/components/sidebar/WorktreeCard.tsx
+++ b/src/renderer/src/components/sidebar/WorktreeCard.tsx
@@ -26,7 +26,6 @@ import { LinearAgentSkillSetupPrompt } from './LinearAgentSkillSetupPrompt'
 import WorktreeCardAgents from './WorktreeCardAgents'
 import { useWorktreeAgentRows } from './useWorktreeAgentRows'
 import { WorktreeCardStatusSlot } from './WorktreeCardStatusSlot'
-import { WorktreeCardReviewStatus } from './WorktreeCardReviewStatus'
 import { cn } from '@/lib/utils'
 import { WorktreeCardSshHostControl } from './WorktreeCardSshHostControl'
 import { activateWorktreeFromSidebar } from '@/lib/sidebar-worktree-activation'
@@ -1208,13 +1207,11 @@ const WorktreeCard = React.memo(function WorktreeCard({
     !!conflictOperation && conflictOperation !== 'unknown' && conflictOperation !== 'rebase'
   const hasMetadataBadge = showConflictOperationBadge
   const showUnreadQuickAction = !affiliateListMode && showStatus && !newCardStyle
-  // Why: the slot owns activity and unread; review/check state has its own title-row indicator.
+  // Why: the slot owns the unread/status lane; legacy keeps the bell toggle, the new card keeps the glyph passive.
   const showCombinedStatusSlot = showStatus
-  const showReviewStatus = newCardStyle && showStatus && statusLaneReview !== null
   const showTitleRowPrimary = compactCards && worktree.isMainWorktree && !isFolder
   const showMetaRowDetails = !newCardStyle && !compactCards && (hasDetails || hasPorts)
-  const showTitleRowIndicators =
-    (newCardStyle || compactCards) && (hasDetails || hasPorts || showReviewStatus)
+  const showTitleRowIndicators = (newCardStyle || compactCards) && (hasDetails || hasPorts)
   // Why: grouped views can hide the repo badge; don't reserve a blank metadata lane unless there's real content.
   const hasDetailedMetaRowContent = Boolean(
     (showRepoBadgeInMetaRow && repo) ||
@@ -1373,12 +1370,7 @@ const WorktreeCard = React.memo(function WorktreeCard({
       detailsAndPortsContent
     )
   const titleRowIndicators = showTitleRowIndicators ? (
-    <div className="ml-auto flex shrink-0 items-center gap-1 pr-1.5">
-      {showReviewStatus && statusLaneReview ? (
-        <WorktreeCardReviewStatus review={statusLaneReview} />
-      ) : null}
-      {detailsAndPorts}
-    </div>
+    <div className="ml-auto flex shrink-0 items-center gap-1 pr-1.5">{detailsAndPorts}</div>
   ) : null
   const hasSecondaryCardContent =
     hasMetaRow || !!remoteBranchConflict || showInlineAgentList || showLineageChildChip
@@ -1412,8 +1404,9 @@ const WorktreeCard = React.memo(function WorktreeCard({
             unreadTooltip={unreadTooltip}
             onPointerDown={stopQuickActionPointerPropagation}
             onToggleUnread={handleToggleUnreadQuick}
+            prDisplay={statusLaneReview}
             newCardStyle={newCardStyle}
-            hasBranchIdentity={hasPathIdentityEnabled && Boolean(branchIdentityDisplay)}
+            hasBranchIdentity={Boolean(branchIdentityDisplay)}
           />
         </div>
       ) : null}
diff --git a/src/renderer/src/components/sidebar/WorktreeCardReviewStatus.test.tsx b/src/renderer/src/components/sidebar/WorktreeCardReviewStatus.test.tsx
deleted file mode 100644
index dab06044df9..00000000000
--- a/src/renderer/src/components/sidebar/WorktreeCardReviewStatus.test.tsx
+++ /dev/null
@@ -1,53 +0,0 @@
-import { renderToStaticMarkup } from 'react-dom/server'
-import type { ReactNode } from 'react'
-import { describe, expect, it, vi } from 'vitest'
-import { WorktreeCardReviewStatus } from './WorktreeCardReviewStatus'
-import type { WorktreeCardPrDisplay } from './worktree-card-pr-display'
-
-vi.mock('@/components/ui/tooltip', () => ({
-  Tooltip: ({ children }: { children: ReactNode }) => <>{children}</>,
-  TooltipContent: ({ children }: { children: ReactNode }) => <>{children}</>,
-  TooltipTrigger: ({ children }: { children: ReactNode }) => <>{children}</>
-}))
-
-type ReviewOverrides = {
-  provider?: Exclude<WorktreeCardPrDisplay['provider'], 'unsupported'>
-  state?: WorktreeCardPrDisplay['state']
-  status?: WorktreeCardPrDisplay['status']
-}
-
-function renderReview(overrides: ReviewOverrides = {}): string {
-  const review: WorktreeCardPrDisplay = {
-    provider: 'github',
-    number: 123,
-    title: 'Review me',
-    state: 'open',
-    ...overrides
-  }
-  return renderToStaticMarkup(<WorktreeCardReviewStatus review={review} />)
-}
-
-describe('WorktreeCardReviewStatus', () => {
-  it.each([
-    [{ state: 'merged' }, 'PR: Merged'],
-    [{ state: 'closed' }, 'PR: Closed'],
-    [{ state: 'draft' }, 'PR: Draft'],
-    [{ status: 'failure' }, 'PR checks: Failed'],
-    [{ status: 'pending' }, 'PR checks: Pending'],
-    [{ status: 'success' }, 'PR checks: Passing'],
-    [{}, 'PR: Open']
-  ] as const)('describes review state %o as %s', (overrides, label) => {
-    expect(renderReview(overrides)).toContain(label)
-  })
-
-  it('uses the compact generic review glyph in its own lane', () => {
-    const markup = renderReview({ provider: 'gitlab', status: 'pending' })
-
-    expect(markup).toContain('data-worktree-card-review-status=""')
-    expect(markup).toContain('MR checks: Pending')
-    expect(markup).toContain('viewBox="0 0 16 16"')
-    expect(markup).toContain('size-[13px]')
-    expect(markup).toContain('text-amber-500/85')
-    expect(markup).not.toContain('lucide-git-merge')
-  })
-})
diff --git a/src/renderer/src/components/sidebar/WorktreeCardReviewStatus.tsx b/src/renderer/src/components/sidebar/WorktreeCardReviewStatus.tsx
deleted file mode 100644
index cab5ba030c1..00000000000
--- a/src/renderer/src/components/sidebar/WorktreeCardReviewStatus.tsx
+++ /dev/null
@@ -1,52 +0,0 @@
-import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip'
-import type { WorktreeCardPrDisplay } from './worktree-card-pr-display'
-import { getReviewLabel, ReviewIcon } from './worktree-review-helpers'
-
-type WorktreeCardReviewStatusProps = {
-  review: WorktreeCardPrDisplay
-}
-
-function getReviewStatusTooltip(review: WorktreeCardPrDisplay): string {
-  const label = getReviewLabel(review)
-  if (review.state === 'merged') {
-    return `${label}: Merged`
-  }
-  if (review.state === 'closed') {
-    return `${label}: Closed`
-  }
-  if (review.state === 'draft') {
-    return `${label}: Draft`
-  }
-  if (review.status === 'failure') {
-    return `${label} checks: Failed`
-  }
-  if (review.status === 'pending') {
-    return `${label} checks: Pending`
-  }
-  if (review.status === 'success') {
-    return `${label} checks: Passing`
-  }
-  return `${label}: Open`
-}
-
-export function WorktreeCardReviewStatus({
-  review
-}: WorktreeCardReviewStatusProps): React.JSX.Element {
-  const tooltip = getReviewStatusTooltip(review)
-  return (
-    <Tooltip>
-      <TooltipTrigger asChild>
-        <span
-          data-worktree-card-review-status=""
-          className="inline-flex size-5 shrink-0 items-center justify-center p-0.5"
-        >
-          <ReviewIcon review={review} className="size-[13px]" variant="generic" />
-          <span className="sr-only">{tooltip}</span>
-        </span>
-      </TooltipTrigger>
-      <TooltipContent side="right" sideOffset={8}>
-        <span>{tooltip}</span>
-      </TooltipContent>
-    </Tooltip>
-  )
-}
diff --git a/src/renderer/src/components/sidebar/WorktreeCardStatusSlot.test.tsx b/src/renderer/src/components/sidebar/WorktreeCardStatusSlot.test.tsx
index bd1971bb614..8911c1783c5 100644
--- a/src/renderer/src/components/sidebar/WorktreeCardStatusSlot.test.tsx
+++ b/src/renderer/src/components/sidebar/WorktreeCardStatusSlot.test.tsx
@@ -2,6 +2,7 @@ import { renderToStaticMarkup } from 'react-dom/server'
 import type { ReactNode } from 'react'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { WorktreeCardStatusSlot } from './WorktreeCardStatusSlot'
+import type { WorktreeCardPrDisplay } from './worktree-card-pr-display'
 
 const mocks = vi.hoisted(() => ({
   status: 'active'
@@ -22,6 +23,21 @@ describe('WorktreeCardStatusSlot', () => {
     mocks.status = 'active'
   })
 
+  const review: WorktreeCardPrDisplay = {
+    provider: 'github',
+    number: 123,
+    title: 'Review me',
+    state: 'open',
+    status: 'failure'
+  }
+  const gitlabReview: WorktreeCardPrDisplay = {
+    provider: 'gitlab',
+    number: 456,
+    title: 'Review me',
+    state: 'open',
+    status: 'pending'
+  }
+
   it('lets the unread bell replace the visual status dot by default', () => {
     const markup = renderToStaticMarkup(
       <WorktreeCardStatusSlot
@@ -157,7 +173,7 @@ describe('WorktreeCardStatusSlot', () => {
     expect(markup).toContain('bg-emerald-500')
   })
 
-  it('keeps the emerald activity dot ahead of branch identity when new card style is on', () => {
+  it('keeps the quiet active dot ahead of PR status by default', () => {
     const markup = renderToStaticMarkup(
       <WorktreeCardStatusSlot
         worktreeId="wt-1"
@@ -167,17 +183,60 @@ describe('WorktreeCardStatusSlot', () => {
         unreadTooltip="Mark as unread"
         onPointerDown={vi.fn()}
         onToggleUnread={vi.fn()}
-        newCardStyle
-        hasBranchIdentity
+        prDisplay={review}
       />
     )
 
     expect(markup).toContain('Active')
     expect(markup).toContain('bg-emerald-500')
-    expect(markup).not.toContain('lucide-git-branch')
+    expect(markup).not.toContain('PR checks: Failed')
   })
 
-  it('shows done activity in new card style', () => {
+  it('uses PR status instead of the quiet active dot when new card style is on', () => {
+    const markup = renderToStaticMarkup(
+      <WorktreeCardStatusSlot
+        worktreeId="wt-1"
+        showStatus
+        showUnreadAction={false}
+        isUnread={false}
+        unreadTooltip="Mark as unread"
+        onPointerDown={vi.fn()}
+        onToggleUnread={vi.fn()}
+        prDisplay={review}
+        newCardStyle
+      />
+    )
+
+    expect(markup).toContain('PR checks: Failed')
+    expect(markup).toContain('inline-flex size-5 items-center justify-center')
+    expect(markup).toContain('size-[13px] translate-x-px')
+    expect(markup).toContain('text-rose-500/85')
+    expect(markup).not.toContain('bg-emerald-500')
+  })
+
+  it('uses the unified compact review glyph for GitLab MR status', () => {
+    const markup = renderToStaticMarkup(
+      <WorktreeCardStatusSlot
+        worktreeId="wt-1"
+        showStatus
+        showUnreadAction={false}
+        isUnread={false}
+        unreadTooltip="Mark as unread"
+        onPointerDown={vi.fn()}
+        onToggleUnread={vi.fn()}
+        prDisplay={gitlabReview}
+        newCardStyle
+      />
+    )
+
+    expect(markup).toContain('MR checks: Pending')
+    expect(markup).toContain('viewBox="0 0 16 16"')
+    expect(markup).toContain('size-[13px] translate-x-px')
+    expect(markup).toContain('text-amber-500/85')
+    expect(markup).not.toContain('lucide-git-merge')
+  })
+
+  it('uses PR status instead of the quiet done dot when new card style is on', () => {
     mocks.status = 'done'
     const markup = renderToStaticMarkup(
       <WorktreeCardStatusSlot
@@ -188,16 +247,37 @@ describe('WorktreeCardStatusSlot', () => {
         unreadTooltip="Mark as unread"
         onPointerDown={vi.fn()}
         onToggleUnread={vi.fn()}
+        prDisplay={review}
         newCardStyle
       />
     )
 
-    expect(markup).toContain('Done')
-    expect(markup).toContain('bg-emerald-500')
+    expect(markup).toContain('PR checks: Failed')
+    expect(markup).not.toContain('bg-emerald-500')
   })
 
-  it('uses a branch icon with branch-only tooltip copy on quiet rows', () => {
+  it('uses PR status instead of the inactive dot when new card style is on', () => {
     mocks.status = 'inactive'
+    const markup = renderToStaticMarkup(
+      <WorktreeCardStatusSlot
+        worktreeId="wt-1"
+        showStatus
+        showUnreadAction={false}
+        isUnread={false}
+        unreadTooltip="Mark as unread"
+        onPointerDown={vi.fn()}
+        onToggleUnread={vi.fn()}
+        prDisplay={review}
+        newCardStyle
+      />
+    )
+
+    expect(markup).toContain('PR checks: Failed')
+    expect(markup).toContain('text-rose-500/85')
+    expect(markup).not.toContain('bg-neutral-500/40')
+  })
+
+  it('uses a branch icon with branch-only tooltip copy by default', () => {
     const markup = renderToStaticMarkup(
       <WorktreeCardStatusSlot
         worktreeId="wt-1"
@@ -221,7 +301,6 @@ describe('WorktreeCardStatusSlot', () => {
   })
 
   it('uses context-aware branch or folder path tooltip copy', () => {
-    mocks.status = 'inactive'
     const markup = renderToStaticMarkup(
       <WorktreeCardStatusSlot
         worktreeId="wt-1"
@@ -261,7 +340,7 @@ describe('WorktreeCardStatusSlot', () => {
     expect(markup).not.toContain('lucide-git-branch')
   })
 
-  it('shows working activity in new card style', () => {
+  it('keeps working activity ahead of PR status in new card style', () => {
     mocks.status = 'working'
     const markup = renderToStaticMarkup(
       <WorktreeCardStatusSlot
@@ -272,6 +351,7 @@ describe('WorktreeCardStatusSlot', () => {
         unreadTooltip="Mark as unread"
         onPointerDown={vi.fn()}
         onToggleUnread={vi.fn()}
+        prDisplay={review}
         newCardStyle
       />
     )
@@ -279,9 +359,10 @@ describe('WorktreeCardStatusSlot', () => {
     expect(markup).toContain('Working')
     expect(markup).toContain('inline-flex size-5 items-center justify-center')
     expect(markup).toContain('border-yellow-500')
+    expect(markup).not.toContain('PR checks: Failed')
   })
 
-  it('shows permission activity in new card style', () => {
+  it('keeps permission activity ahead of PR status in new card style', () => {
     mocks.status = 'permission'
     const markup = renderToStaticMarkup(
       <WorktreeCardStatusSlot
@@ -292,6 +373,7 @@ describe('WorktreeCardStatusSlot', () => {
         unreadTooltip="Mark as unread"
         onPointerDown={vi.fn()}
         onToggleUnread={vi.fn()}
+        prDisplay={review}
         newCardStyle
       />
     )
@@ -299,10 +381,61 @@ describe('WorktreeCardStatusSlot', () => {
     expect(markup).toContain('Needs permission')
     expect(markup).toContain('lucide-message-circle-question-mark')
     expect(markup).toContain('text-amber-500')
+    expect(markup).not.toContain('PR checks: Failed')
+  })
+
+  it('keeps unread ahead of PR status by default', () => {
+    const markup = renderToStaticMarkup(
+      <WorktreeCardStatusSlot
+        worktreeId="wt-1"
+        showStatus
+        showUnreadAction
+        isUnread
+        unreadTooltip="Mark as read"
+        onPointerDown={vi.fn()}
+        onToggleUnread={vi.fn()}
+        prDisplay={review}
+      />
+    )
+
+    expect(markup).toContain('aria-label="Mark as read"')
+    expect(markup).toContain('Mark as read')
+    expect(markup).not.toContain('Active · Mark as read')
+    expect(markup).not.toContain('PR checks: Failed')
+    expect(markup).not.toContain('bg-emerald-500')
+    expect(markup).toContain('text-amber-500')
+  })
+
+  it('overlays an unread badge on PR status when new card style is on', () => {
+    const markup = renderToStaticMarkup(
+      <WorktreeCardStatusSlot
+        worktreeId="wt-1"
+        showStatus
+        showUnreadAction
+        isUnread
+        unreadTooltip="Mark as read"
+        onPointerDown={vi.fn()}
+        onToggleUnread={vi.fn()}
+        prDisplay={review}
+        newCardStyle
+      />
+    )
+
+    expect(markup).not.toContain('aria-label="Mark as read"')
+    expect(markup).not.toContain('Mark as read')
+    expect(markup).toContain('PR checks: Failed · Unread')
+    expect(markup).toContain('data-worktree-status-lane-unread=""')
+    expect(markup).toContain('data-worktree-unread-alert=""')
+    expect(markup).not.toContain('group/unread')
+    expect(markup).not.toContain('cursor-pointer')
+    expect(markup).toContain('text-rose-500/85')
+    expect(markup).toContain('bg-amber-500')
+    expect(markup).not.toContain('lucide-bell')
+    expect(markup).not.toContain('text-amber-500')
+    expect(markup).not.toContain('bg-emerald-500')
   })
 
   it('overlays an unread badge on the branch icon in new card style', () => {
-    mocks.status = 'inactive'
     const markup = renderToStaticMarkup(
       <WorktreeCardStatusSlot
         worktreeId="wt-1"
diff --git a/src/renderer/src/components/sidebar/WorktreeCardStatusSlot.tsx b/src/renderer/src/components/sidebar/WorktreeCardStatusSlot.tsx
index d1a96bcdfea..9f8dc175652 100644
--- a/src/renderer/src/components/sidebar/WorktreeCardStatusSlot.tsx
+++ b/src/renderer/src/components/sidebar/WorktreeCardStatusSlot.tsx
@@ -3,10 +3,12 @@ import { Bell, GitBranch } from 'lucide-react'
 import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip'
 import { translate } from '@/i18n/i18n'
 import { cn } from '@/lib/utils'
-import { getWorktreeStatusLabel } from '@/lib/worktree-status'
+import { getWorktreeStatusLabel, type WorktreeStatus } from '@/lib/worktree-status'
 import { FilledBellIcon } from './WorktreeCardHelpers'
 import StatusIndicator from './StatusIndicator'
 import { useWorktreeActivityStatus } from './use-worktree-activity-status'
+import type { WorktreeCardPrDisplay } from './worktree-card-pr-display'
+import { getReviewLabel, ReviewIcon } from './worktree-review-helpers'
 
 type WorktreeCardStatusSlotProps = {
   worktreeId: string
@@ -16,20 +18,23 @@ type WorktreeCardStatusSlotProps = {
   unreadTooltip: string
   onToggleUnread: React.MouseEventHandler<HTMLButtonElement>
   onPointerDown: React.PointerEventHandler<HTMLButtonElement>
+  prDisplay?: WorktreeCardPrDisplay | null
   newCardStyle?: boolean
   hasBranchIdentity?: boolean
   branchIdentityLabel?: string
   className?: string
 }
 
-// Why: the passive label names the identity cue without claiming review state.
+const QUIET_REVIEW_REPLACEABLE_STATUSES = new Set<WorktreeStatus>(['active', 'done', 'inactive'])
+// Why: a missing review display can also mean provider state is unavailable,
+// so the passive label names the identity cue without claiming no review exists.
 function getDefaultBranchIdentityLabel(): string {
   return translate('auto.components.sidebar.WorktreeCardStatusSlot.branchIdentity', 'Branch')
 }
 // Why: branch-style SVGs are optically left-heavy; this keeps them aligned with
 // the centered activity dots in the shared status column.
-const compactBranchStatusIconClassName = 'size-[13px] translate-x-px'
-const branchStatusIconClassName = `${compactBranchStatusIconClassName} text-muted-foreground/70`
+const compactReviewAndBranchStatusIconClassName = 'size-[13px] translate-x-px'
+const branchStatusIconClassName = `${compactReviewAndBranchStatusIconClassName} text-muted-foreground/70`
 // Why: a left-edge badge overlays unread on the status glyph without widening
 // the lane or indenting the title; ring-sidebar cuts the dot out from busy icons.
 const newCardUnreadAlertClassName =
@@ -58,6 +63,29 @@ function overlayNewCardUnreadStatus(
   )
 }
 
+function getReviewStatusTooltip(review: WorktreeCardPrDisplay): string {
+  const label = getReviewLabel(review)
+  if (review.state === 'merged') {
+    return `${label}: Merged`
+  }
+  if (review.state === 'closed') {
+    return `${label}: Closed`
+  }
+  if (review.state === 'draft') {
+    return `${label}: Draft`
+  }
+  if (review.status === 'failure') {
+    return `${label} checks: Failed`
+  }
+  if (review.status === 'pending') {
+    return `${label} checks: Pending`
+  }
+  if (review.status === 'success') {
+    return `${label} checks: Passing`
+  }
+  return `${label}: Open`
+}
+
 export function WorktreeCardStatusSlot({
   worktreeId,
   showStatus,
@@ -66,6 +94,7 @@ export function WorktreeCardStatusSlot({
   unreadTooltip,
   onToggleUnread,
   onPointerDown,
+  prDisplay = null,
   newCardStyle = false,
   hasBranchIdentity = false,
   branchIdentityLabel,
@@ -73,43 +102,73 @@ export function WorktreeCardStatusSlot({
 }: WorktreeCardStatusSlotProps): React.JSX.Element | null {
   const status = useWorktreeActivityStatus(worktreeId)
   const statusLabel = getWorktreeStatusLabel(status) || status
+  const canShowReviewStatus =
+    newCardStyle &&
+    showStatus &&
+    prDisplay !== null &&
+    QUIET_REVIEW_REPLACEABLE_STATUSES.has(status)
   const canShowBranchStatus =
-    newCardStyle && showStatus && hasBranchIdentity && status === 'inactive'
-  const passiveStatusLabel = canShowBranchStatus
-    ? (branchIdentityLabel ?? getDefaultBranchIdentityLabel())
-    : statusLabel
+    newCardStyle &&
+    showStatus &&
+    hasBranchIdentity &&
+    prDisplay === null &&
+    QUIET_REVIEW_REPLACEABLE_STATUSES.has(status)
+  const passiveStatusLabel =
+    canShowReviewStatus && prDisplay
+      ? getReviewStatusTooltip(prDisplay)
+      : canShowBranchStatus
+        ? (branchIdentityLabel ?? getDefaultBranchIdentityLabel())
+        : statusLabel
   const passiveStatusTooltip =
     newCardStyle && isUnread ? `${passiveStatusLabel} · Unread` : passiveStatusLabel
   // Why: working and permission already own the new-card status lane, but
   // unread state should still surface in tooltip/sr-only copy and reappear afterward.
   const showNewCardUnreadAlert =
     newCardStyle && isUnread && showStatus && status !== 'working' && status !== 'permission'
+  const reviewStatusIconClassName = compactReviewAndBranchStatusIconClassName
   const branchStatusIcon = <GitBranch className={branchStatusIconClassName} aria-hidden="true" />
-  const passiveStatus = canShowBranchStatus ? (
-    <Tooltip>
-      <TooltipTrigger asChild>
-        <span className={cn('inline-flex size-5 items-center justify-center p-0.5', className)}>
-          {branchStatusIcon}
-          <span className="sr-only">{passiveStatusTooltip}</span>
+  const passiveStatus =
+    canShowReviewStatus && prDisplay ? (
+      <Tooltip>
+        <TooltipTrigger asChild>
+          <span className={cn('inline-flex size-5 items-center justify-center p-0.5', className)}>
+            <ReviewIcon
+              review={prDisplay}
+              className={reviewStatusIconClassName}
+              variant="generic"
+            />
+            <span className="sr-only">{passiveStatusTooltip}</span>
+          </span>
+        </TooltipTrigger>
+        <TooltipContent side="right" sideOffset={8}>
+          <span>{passiveStatusTooltip}</span>
+        </TooltipContent>
+      </Tooltip>
+    ) : canShowBranchStatus ? (
+      <Tooltip>
+        <TooltipTrigger asChild>
+          <span className={cn('inline-flex size-5 items-center justify-center p-0.5', className)}>
+            {branchStatusIcon}
+            <span className="sr-only">{passiveStatusTooltip}</span>
+          </span>
+        </TooltipTrigger>
+        <TooltipContent side="right" sideOffset={8}>
+          <span>{passiveStatusTooltip}</span>
+        </TooltipContent>
+      </Tooltip>
+    ) : newCardStyle && showStatus ? (
+      <>
+        <span className={cn('inline-flex size-5 items-center justify-center', className)}>
+          <StatusIndicator status={status} aria-hidden="true" />
         </span>
-      </TooltipTrigger>
-      <TooltipContent side="right" sideOffset={8}>
-        <span>{passiveStatusTooltip}</span>
-      </TooltipContent>
-    </Tooltip>
-  ) : newCardStyle && showStatus ? (
-    <>
-      <span className={cn('inline-flex size-5 items-center justify-center', className)}>
-        <StatusIndicator status={status} aria-hidden="true" />
-      </span>
-      <span className="sr-only">{passiveStatusTooltip}</span>
-    </>
-  ) : (
-    <>
-      <StatusIndicator status={status} aria-hidden="true" className={className} />
-      <span className="sr-only">{statusLabel}</span>
-    </>
-  )
+        <span className="sr-only">{passiveStatusTooltip}</span>
+      </>
+    ) : (
+      <>
+        <StatusIndicator status={status} aria-hidden="true" className={className} />
+        <span className="sr-only">{statusLabel}</span>
+      </>
+    )
 
   const unreadActionEnabled = showUnreadAction && !newCardStyle
 
@@ -144,7 +203,15 @@ export function WorktreeCardStatusSlot({
             aria-label={actionLabel}
           >
             {newCardStyle ? (
-              showStatus && canShowBranchStatus ? (
+              showStatus && canShowReviewStatus && prDisplay ? (
+                <span className="inline-flex size-5 items-center justify-center p-0.5">
+                  <ReviewIcon
+                    review={prDisplay}
+                    className={reviewStatusIconClassName}
+                    variant="generic"
+                  />
+                </span>
+              ) : showStatus && canShowBranchStatus ? (
                 <span className="inline-flex size-5 items-center justify-center p-0.5">
                   {branchStatusIcon}
                 </span>
diff --git a/src/renderer/src/components/sidebar/smart-attention.test.ts b/src/renderer/src/components/sidebar/smart-attention.test.ts
index d32192d36a5..2c4324938cd 100644
--- a/src/renderer/src/components/sidebar/smart-attention.test.ts
+++ b/src/renderer/src/components/sidebar/smart-attention.test.ts
@@ -61,6 +61,7 @@ function makeEntry(overrides: Partial<AgentStatusEntry> & { paneKey: string }):
     terminalTitle: overrides.terminalTitle,
     stateHistory: overrides.stateHistory ?? [],
     interrupted: overrides.interrupted,
+    sessionBoundary: overrides.sessionBoundary,
     restoredUnconfirmed: overrides.restoredUnconfirmed
   }
 }
@@ -177,6 +178,23 @@ describe('resolveAttention', () => {
     expect(resolveAttention([hookPane(entry)], NOW)).toEqual(IDLE)
   })
 
+  it('treats a session boundary as idle unless it displaced a real completion', () => {
+    const boundary = makeEntry({
+      paneKey: 't:1',
+      state: 'done',
+      sessionBoundary: true,
+      stateStartedAt: NOW - 1_000,
+      updatedAt: NOW - 500
+    })
+    expect(resolveAttention([hookPane(boundary)], NOW)).toEqual(IDLE)
+
+    boundary.stateHistory = [makeHistory('done', NOW - 90_000)]
+    expect(resolveAttention([hookPane(boundary)], NOW)).toEqual({
+      cls: 2,
+      attentionTimestamp: NOW - 90_000
+    })
+  })
+
   it('classifies a working pane with prior done as Class 3 with the prior timestamp', () => {
     const entry = makeEntry({
       paneKey: 't:1',
diff --git a/src/renderer/src/components/sidebar/smart-attention.ts b/src/renderer/src/components/sidebar/smart-attention.ts
index 6c102a41405..760fd9d16ca 100644
--- a/src/renderer/src/components/sidebar/smart-attention.ts
+++ b/src/renderer/src/components/sidebar/smart-attention.ts
@@ -98,6 +98,21 @@ export function mostRecentAttentionInHistory(history: AgentStateHistoryEntry[]):
   return max > 0 ? max : null
 }
 
+function mostRecentCompletedTurnInHistory(history: AgentStateHistoryEntry[]): number | null {
+  let max = 0
+  for (const entry of history) {
+    if (
+      entry.state === 'done' &&
+      entry.interrupted !== true &&
+      Number.isFinite(entry.startedAt) &&
+      entry.startedAt > max
+    ) {
+      max = entry.startedAt
+    }
+  }
+  return max > 0 ? max : null
+}
+
 /**
  * One pane's contribution to a worktree's attention class. Fresh hook entries win; hookless
  * panes fall back to the title heuristic (design doc Edge case 9). Authority is per-pane, not per-worktree.
@@ -142,7 +157,16 @@ export function resolveAttention(panes: PaneInput[], now: number): WorktreeAtten
           continue
         }
         cls = 2
-        ts = entry.stateStartedAt
+        if (entry.sessionBoundary) {
+          // Why: idle connect is not new attention; only preserve a real completion it displaced.
+          const completedAt = mostRecentCompletedTurnInHistory(entry.stateHistory)
+          if (completedAt === null) {
+            continue
+          }
+          ts = completedAt
+        } else {
+          ts = entry.stateStartedAt
+        }
       } else {
         // working
         cls = 3
diff --git a/src/renderer/src/components/star-nag/StarNagAgentValueMomentObserver.tsx b/src/renderer/src/components/star-nag/StarNagAgentValueMomentObserver.tsx
index 1fd3099323d..42f6145b1f3 100644
--- a/src/renderer/src/components/star-nag/StarNagAgentValueMomentObserver.tsx
+++ b/src/renderer/src/components/star-nag/StarNagAgentValueMomentObserver.tsx
@@ -33,6 +33,9 @@ function hasSuccessfulDoneTransition(
       previousEntry &&
       previousEntry.state !== 'done' &&
       entry.state === 'done' &&
+      // Why: a session-boundary done is an idle connect (STA-3386), not a value moment —
+      // a stale working row + resume would otherwise nag on launch.
+      entry.sessionBoundary !== true &&
       !entry.interrupted &&
       hasMeaningfulPrompt(entry)
     ) {
diff --git a/src/renderer/src/components/terminal-pane/TerminalErrorToast.test.ts b/src/renderer/src/components/terminal-pane/TerminalErrorToast.test.ts
index 56e7ffd0afc..bd9aedd375c 100644
--- a/src/renderer/src/components/terminal-pane/TerminalErrorToast.test.ts
+++ b/src/renderer/src/components/terminal-pane/TerminalErrorToast.test.ts
@@ -1,5 +1,6 @@
 import { describe, expect, it } from 'vitest'
 import {
+  humanizeTerminalError,
   isSshReconnectOwnedTerminalError,
   shouldOfferDaemonRestart,
   stripSshReconnectOwnedErrorLines
@@ -36,6 +37,24 @@ describe('isSshReconnectOwnedTerminalError', () => {
   })
 })
 
+describe('humanizeTerminalError', () => {
+  it('replaces the pane-owner-unverified code with actionable copy', () => {
+    const humanized = humanizeTerminalError('terminal_pane_owner_unverified')
+    expect(humanized).not.toContain('terminal_pane_owner_unverified')
+    expect(humanized).toContain('Reopen this pane to retry')
+  })
+
+  it('humanizes an IPC-wrapped pane-owner-unverified error', () => {
+    const wrapped =
+      "Error invoking remote method 'pty:spawn': Error: terminal_pane_owner_unverified"
+    expect(humanizeTerminalError(wrapped)).not.toContain('terminal_pane_owner_unverified')
+  })
+
+  it('leaves other errors untouched', () => {
+    expect(humanizeTerminalError('Paste failed.')).toBe('Paste failed.')
+  })
+})
+
 describe('stripSshReconnectOwnedErrorLines', () => {
   it('clears an error that is only SSH reconnect text', () => {
     expect(stripSshReconnectOwnedErrorLines(SSH_FAILURE)).toBeNull()
diff --git a/src/renderer/src/components/terminal-pane/TerminalErrorToast.tsx b/src/renderer/src/components/terminal-pane/TerminalErrorToast.tsx
index 7f38733fa49..99a00e54f9a 100644
--- a/src/renderer/src/components/terminal-pane/TerminalErrorToast.tsx
+++ b/src/renderer/src/components/terminal-pane/TerminalErrorToast.tsx
@@ -12,6 +12,8 @@ const STALE_DAEMON_CWD_MARKERS = [
   "Daemon's working directory is gone",
   'node-pty: daemon_cwd failed: ENOENT'
 ]
+// Thrown by ipc/pty.ts when a persisted pane owner can't be proven alive or dead (STA-3536).
+const PANE_OWNER_UNVERIFIED_MARKER = 'terminal_pane_owner_unverified'
 
 function isSshError(error: string): boolean {
   return error.startsWith(SSH_PREFIX) || error.includes(SSH_RELAY_LOST_MARKER)
@@ -42,6 +44,20 @@ export function shouldOfferDaemonRestart(error: string): boolean {
   )
 }
 
+/** Swaps the raw pane-owner-unverified code for copy a user can act on. */
+export function humanizeTerminalError(error: string): string {
+  if (!error.includes(PANE_OWNER_UNVERIFIED_MARKER)) {
+    return error
+  }
+  return error.replace(
+    PANE_OWNER_UNVERIFIED_MARKER,
+    translate(
+      'auto.components.terminal.pane.TerminalErrorToast.7ee11bc0db',
+      "Orca couldn't confirm whether this terminal's previous session is still running, so it left the session untouched. Reopen this pane to retry."
+    )
+  )
+}
+
 export function TerminalErrorToast({
   error,
   onDismiss,
@@ -53,6 +69,7 @@ export function TerminalErrorToast({
 }): React.JSX.Element {
   const ssh = isSshError(error)
   const showDaemonRestart = !ssh && onRestartDaemon && shouldOfferDaemonRestart(error)
+  const displayError = humanizeTerminalError(error)
 
   return (
     <div
@@ -75,7 +92,7 @@ export function TerminalErrorToast({
     >
       <div style={{ display: 'flex', justifyContent: 'space-between', alignItems: 'start' }}>
         <span style={{ minWidth: 0 }}>
-          {error}
+          {displayError}
           {showDaemonRestart ? (
             <>
               {'\n'}
diff --git a/src/renderer/src/components/terminal-pane/agent-completion-coordinator.ts b/src/renderer/src/components/terminal-pane/agent-completion-coordinator.ts
index b948cf43da6..b3059ca6390 100644
--- a/src/renderer/src/components/terminal-pane/agent-completion-coordinator.ts
+++ b/src/renderer/src/components/terminal-pane/agent-completion-coordinator.ts
@@ -810,6 +810,13 @@ export function createAgentCompletionCoordinator(
       dispatchAttention(payload)
       return
     }
+    if (payload.state === 'done' && payload.sessionBoundary === true) {
+      // Why: a session-boundary 'done' is an idle session connecting (resume/launch/clear,
+      // STA-3386), not a completed turn — record the activity/evidence above but never
+      // complete. Pending timers stay untouched: a quiet-window done from a real prior
+      // turn must still fire.
+      return
+    }
     if (isCompletionHookState(payload.state)) {
       // Why: the turn is ending, so a debounced attention from an earlier pause must not fire after completion.
       clearPendingCodexAttention()
diff --git a/src/renderer/src/hooks/agent-hook-completion-notifications.test.ts b/src/renderer/src/hooks/agent-hook-completion-notifications.test.ts
index 228af0058eb..4803731fb70 100644
--- a/src/renderer/src/hooks/agent-hook-completion-notifications.test.ts
+++ b/src/renderer/src/hooks/agent-hook-completion-notifications.test.ts
@@ -421,6 +421,43 @@ describe('agent hook completion notifications', () => {
     )
   })
 
+  it('does not fire a completion notification for a session-boundary done row', async () => {
+    const { observeAgentHookCompletionForNotification } =
+      await import('./agent-hook-completion-notifications')
+
+    // Why: Claude SessionStart lands as a sessionBoundary 'done' so a resumed session gets
+    // its sidebar row while idle (STA-3386) — connecting to a session is not completing a turn.
+    observeAgentHookCompletionForNotification({
+      paneKey,
+      worktreeId: 'wt-1',
+      payload: {
+        state: 'done',
+        prompt: '',
+        agentType: 'claude',
+        sessionBoundary: true,
+        stateStartedAt: 1_700_000_000_000
+      }
+    })
+    vi.advanceTimersByTime(HOOK_DONE_QUIET_MS)
+
+    expect(dispatchTerminalNotification).not.toHaveBeenCalled()
+
+    // Why: the resumed session's next real turn must still notify normally.
+    observeAgentHookCompletionForNotification({
+      paneKey,
+      worktreeId: 'wt-1',
+      payload: { ...hookStatus('working'), agentType: 'claude' }
+    })
+    observeAgentHookCompletionForNotification({
+      paneKey,
+      worktreeId: 'wt-1',
+      payload: { ...hookStatus('done'), agentType: 'claude', stateStartedAt: 1_700_000_020_000 }
+    })
+    vi.advanceTimersByTime(HOOK_DONE_QUIET_MS)
+
+    expect(dispatchTerminalNotification).toHaveBeenCalledTimes(1)
+  })
+
   it('does not notify twice when the same done hook snapshot replays after activation', async () => {
     const { observeAgentHookCompletionForNotification } =
       await import('./agent-hook-completion-notifications')
diff --git a/src/renderer/src/hooks/useAutomationDispatchEvents.test.ts b/src/renderer/src/hooks/useAutomationDispatchEvents.test.ts
index 160496c3be8..d49778b3a05 100644
--- a/src/renderer/src/hooks/useAutomationDispatchEvents.test.ts
+++ b/src/renderer/src/hooks/useAutomationDispatchEvents.test.ts
@@ -539,6 +539,35 @@ describe('useAutomationDispatchEvents setup launch', () => {
     })
   })
 
+  it('ignores a session-boundary done so a connecting agent cannot complete the run (STA-3386)', async () => {
+    let launchArgs: {
+      onAgentStatus?: (payload: { state: string; sessionBoundary?: boolean }) => void
+    } = {}
+    mockLaunchAgentBackgroundSession.mockImplementation(async (args) => {
+      launchArgs = args
+      return {
+        tabId: 'agent-tab',
+        paneKey: 'agent-tab:7c6fb4e5-3bf1-4ff4-8259-03f7ae81c40d',
+        ptyId: 'agent-pty',
+        startupPlan: {},
+        terminalOwnership: {
+          finalize: mockFinalizeTerminalOwnership,
+          release: mockReleaseTerminalOwnership
+        }
+      }
+    })
+
+    await registerAndDispatch()
+    // Why: Claude fires SessionStart (a sessionBoundary done) at launch, before the argv
+    // prompt submits — treating it as run completion would close the tab on an empty run.
+    launchArgs.onAgentStatus?.({ state: 'done', sessionBoundary: true })
+    await Promise.resolve()
+    expect(mockFinalizeTerminalOwnership).not.toHaveBeenCalled()
+
+    launchArgs.onAgentStatus?.({ state: 'done' })
+    await vi.waitFor(() => expect(mockFinalizeTerminalOwnership).toHaveBeenCalledOnce())
+  })
+
   it('consumes duplicate done and zero-exit completion through one finalizer', async () => {
     let launchArgs: {
       onAgentStatus?: (payload: { state: string }) => void
diff --git a/src/renderer/src/hooks/useAutomationDispatchEvents.ts b/src/renderer/src/hooks/useAutomationDispatchEvents.ts
index d543d639ddf..09009d40011 100644
--- a/src/renderer/src/hooks/useAutomationDispatchEvents.ts
+++ b/src/renderer/src/hooks/useAutomationDispatchEvents.ts
@@ -416,6 +416,10 @@ export function useAutomationDispatchEvents(): void {
                 }
                 if (
                   entry.state === 'done' &&
+                  // Why: a session-boundary done is the agent CONNECTING (Claude SessionStart
+                  // fires at launch, before the argv prompt submits) — completing here would
+                  // close the tab and record an empty run result.
+                  entry.sessionBoundary !== true &&
                   (!options?.requireWorkingAfterStart || sawWorkingAfterStart)
                 ) {
                   latestAssistantMessage =
@@ -528,7 +532,8 @@ export function useAutomationDispatchEvents(): void {
             onAgentStatus: (payload) => {
               latestAssistantMessage =
                 payload.lastAssistantMessage?.trim() || latestAssistantMessage
-              if (payload.state !== 'done') {
+              // Why: session-boundary done = launch connect, not run completion (see observeAgentStatus).
+              if (payload.state !== 'done' || payload.sessionBoundary === true) {
                 return
               }
               handleAgentDone()
diff --git a/src/renderer/src/hooks/useIpcEvents.test.ts b/src/renderer/src/hooks/useIpcEvents.test.ts
index c13cf20057a..e2d831c9da4 100644
--- a/src/renderer/src/hooks/useIpcEvents.test.ts
+++ b/src/renderer/src/hooks/useIpcEvents.test.ts
@@ -16,6 +16,12 @@ import {
   loadIpcEventsHarness,
   type HarnessStoreState
 } from './ipc-events-test-harness'
+import {
+  createTestStore,
+  makeTab,
+  makeWorktree,
+  TEST_REPO
+} from '../store/slices/store-test-helpers'
 import type { SleepingAgentLaunchConfig } from '../../../shared/agent-session-resume'
 import type { AgentStatusClearIpcPayload } from '../../../shared/agent-status-types'
 import type { TuiAgent } from '../../../shared/types'
@@ -4949,6 +4955,7 @@ describe('useIpcEvents agent status snapshot integration', () => {
     toolInput?: string
     lastAssistantMessage?: string
     interrupted?: boolean
+    sessionBoundary?: boolean
     terminalHandle?: string
     launchToken?: string
     providerSession?: { key: 'session_id'; id: string }
@@ -7842,6 +7849,96 @@ describe('useIpcEvents agent status snapshot integration', () => {
     )
   })
 
+  it('preserves a SessionStart boundary from snapshot IPC without completion side effects', async () => {
+    const now = Date.now()
+    const refreshGitHubForWorktreeIfStale = vi.fn()
+    const observeAgentHookCompletionForNotification = vi.fn()
+    const store = createTestStore()
+    store.setState({
+      workspaceSessionReady: true,
+      repos: [{ ...TEST_REPO, connectionId: null, executionHostId: 'local' }],
+      worktreesByRepo: {
+        [TEST_REPO.id]: [makeWorktree({ id: 'wt-1', repoId: TEST_REPO.id })]
+      },
+      tabsByWorktree: {
+        'wt-1': [
+          makeTab({
+            id: 'tab-future',
+            ptyId: 'pty-1',
+            worktreeId: 'wt-1',
+            title: 'Claude'
+          })
+        ]
+      },
+      terminalLayoutsByTabId: {
+        'tab-future': {
+          root: { type: 'leaf', leafId: FUTURE_LEAF_ID },
+          activeLeafId: FUTURE_LEAF_ID,
+          expandedLeafId: null
+        }
+      },
+      refreshGitHubForWorktreeIfStale
+    })
+    store
+      .getState()
+      .setAgentStatus(
+        FUTURE_PANE_KEY,
+        { state: 'working', prompt: 'resumed task', agentType: 'claude' },
+        'Claude',
+        { updatedAt: now - 2, stateStartedAt: now - 2 },
+        { tabId: 'tab-future', worktreeId: 'wt-1' }
+      )
+
+    stubReactSyncEffect()
+    vi.doMock('../store', () => ({
+      useAppStore: {
+        subscribe: store.subscribe,
+        getState: store.getState
+      }
+    }))
+    vi.doMock('./agent-hook-completion-notifications', () => ({
+      observeAgentHookCompletionForNotification,
+      resetAgentHookCompletionNotificationCoordinators: vi.fn(),
+      syncAgentHookCompletionNotificationSettings: vi.fn(),
+      syncAgentHookCompletionNotificationsForStoreUpdate: vi.fn()
+    }))
+    stubAuxiliaryModules()
+    vi.stubGlobal(
+      'window',
+      buildWindowApi({
+        getSnapshot: () =>
+          Promise.resolve([
+            {
+              paneKey: FUTURE_PANE_KEY,
+              tabId: 'tab-future',
+              worktreeId: 'wt-1',
+              state: 'done',
+              prompt: '',
+              agentType: 'claude',
+              sessionBoundary: true,
+              receivedAt: now,
+              stateStartedAt: now
+            }
+          ]),
+        onSet: () => () => {}
+      })
+    )
+
+    const { useIpcEvents } = await import('./useIpcEvents')
+    useIpcEvents()
+
+    await vi.waitFor(() => {
+      expect(store.getState().agentStatusByPaneKey[FUTURE_PANE_KEY]).toMatchObject({
+        state: 'done',
+        sessionBoundary: true
+      })
+    })
+    await Promise.resolve()
+
+    expect(refreshGitHubForWorktreeIfStale).not.toHaveBeenCalled()
+    expect(observeAgentHookCompletionForNotification).not.toHaveBeenCalled()
+  })
+
   it('queues replayed startup snapshots until the pane hydrates', async () => {
     const setAgentStatus = vi.fn()
     const subscribeListenerRef: { current: StoreSubscribeListener | null } = { current: null }
diff --git a/src/renderer/src/hooks/useIpcEvents.ts b/src/renderer/src/hooks/useIpcEvents.ts
index bed3e4e86c8..5b719c72420 100644
--- a/src/renderer/src/hooks/useIpcEvents.ts
+++ b/src/renderer/src/hooks/useIpcEvents.ts
@@ -3100,6 +3100,7 @@ export function useIpcEvents(): void {
         interactivePrompt: data.interactivePrompt,
         lastAssistantMessage: data.lastAssistantMessage,
         interrupted: data.interrupted,
+        sessionBoundary: data.sessionBoundary,
         // Why: same trap as interactivePrompt — this rebuild is a field whitelist, so subagent child rows vanish if omitted.
         subagents: data.subagents
       })
diff --git a/src/renderer/src/i18n/locales/en.json b/src/renderer/src/i18n/locales/en.json
index f93793d8855..5ffadaeb9cf 100644
--- a/src/renderer/src/i18n/locales/en.json
+++ b/src/renderer/src/i18n/locales/en.json
@@ -2801,7 +2801,8 @@
             "e4aa243f8c": "Restart daemon",
             "a7e2fd2699": "file an issue",
             "5c8ce20be6": "If this persists, please",
-            "cc6d997c65": "Restart the terminal daemon from here to clear stale daemon state."
+            "cc6d997c65": "Restart the terminal daemon from here to clear stale daemon state.",
+            "7ee11bc0db": "Orca couldn't confirm whether this terminal's previous session is still running, so it left the session untouched. Reopen this pane to retry."
           },
           "TerminalPane": {
             "ac112e9036": "Remove title",
diff --git a/src/renderer/src/store/slices/agent-status.test.ts b/src/renderer/src/store/slices/agent-status.test.ts
index b6b2976e26b..6965ca8bbb2 100644
--- a/src/renderer/src/store/slices/agent-status.test.ts
+++ b/src/renderer/src/store/slices/agent-status.test.ts
@@ -1399,3 +1399,103 @@ describe('agent status retention + prefix sweep', () => {
     expect(retained['tab-b:0']).toBeUndefined()
   })
 })
+
+describe('session-boundary done semantics (STA-3386)', () => {
+  const PANE = 'tab-1:11111111-1111-4111-8111-111111111111'
+
+  it('keeps the launch config registry entry alive across a session-boundary done', () => {
+    const store = createTestStore()
+    store.setState({
+      agentLaunchConfigByPaneKey: {
+        [PANE]: {
+          launchConfig: { agentArgs: '', agentEnv: {} },
+          identity: { agentType: 'claude' },
+          launchToken: 'token-1'
+        }
+      }
+    } as unknown as Partial<AppState>)
+
+    store.getState().setAgentStatus(PANE, {
+      state: 'done',
+      prompt: '',
+      agentType: 'claude',
+      sessionBoundary: true
+    })
+    // Why: the session just CONNECTED — the registered-launch-agent identity must survive
+    // or an idle resumed TUI loses its pane identity evidence at startup.
+    expect(store.getState().agentLaunchConfigByPaneKey[PANE]).toBeDefined()
+
+    store.getState().setAgentStatus(PANE, {
+      state: 'done',
+      prompt: 'fix bug',
+      agentType: 'claude',
+      lastAssistantMessage: 'Done.'
+    })
+    expect(store.getState().agentLaunchConfigByPaneKey[PANE]).toBeUndefined()
+  })
+
+  it('pushes a real completion into history when a session boundary lands on it', () => {
+    const store = createTestStore()
+    store
+      .getState()
+      .setAgentStatus(PANE, { state: 'working', prompt: 'fix bug', agentType: 'claude' })
+    store.getState().setAgentStatus(PANE, {
+      state: 'done',
+      prompt: 'fix bug',
+      agentType: 'claude',
+      lastAssistantMessage: 'Done.'
+    })
+
+    store.getState().setAgentStatus(PANE, {
+      state: 'done',
+      prompt: '',
+      agentType: 'claude',
+      sessionBoundary: true
+    })
+
+    const entry = store.getState().agentStatusByPaneKey[PANE]
+    expect(entry.sessionBoundary).toBe(true)
+    // Why: the finished timestamp and unread badge fall through to history for boundary
+    // entries — losing the real done here erases an unacknowledged completion.
+    expect(entry.stateHistory.some((h) => h.state === 'done')).toBe(true)
+  })
+
+  it('never records a session boundary itself in state history', () => {
+    const store = createTestStore()
+    store.getState().setAgentStatus(PANE, {
+      state: 'done',
+      prompt: '',
+      agentType: 'claude',
+      sessionBoundary: true
+    })
+    store
+      .getState()
+      .setAgentStatus(PANE, { state: 'working', prompt: 'fix bug', agentType: 'claude' })
+
+    const entry = store.getState().agentStatusByPaneKey[PANE]
+    expect(entry.stateHistory.some((h) => h.state === 'done')).toBe(false)
+  })
+
+  it('carries the flag across metadata-less done repaints but yields to turn evidence', () => {
+    const store = createTestStore()
+    store.getState().setAgentStatus(PANE, {
+      state: 'done',
+      prompt: '',
+      agentType: 'claude',
+      sessionBoundary: true
+    })
+
+    // Why: OSC 9999 repaints and reconnect replays re-deliver a metadata-less done.
+    store.getState().setAgentStatus(PANE, { state: 'done', prompt: '', agentType: 'claude' })
+    expect(store.getState().agentStatusByPaneKey[PANE].sessionBoundary).toBe(true)
+
+    // Why: an assistant message proves a REAL completion — the flag must not suppress it.
+    store.getState().setAgentStatus(PANE, {
+      state: 'done',
+      prompt: '',
+      agentType: 'claude',
+      lastAssistantMessage: 'Done.'
+    })
+    expect(store.getState().agentStatusByPaneKey[PANE].sessionBoundary).toBeUndefined()
+  })
+})
diff --git a/src/renderer/src/store/slices/agent-status.ts b/src/renderer/src/store/slices/agent-status.ts
index fcf39188136..271ab70829a 100644
--- a/src/renderer/src/store/slices/agent-status.ts
+++ b/src/renderer/src/store/slices/agent-status.ts
@@ -1739,8 +1739,22 @@ export const createAgentStatusSlice: StateCreator<AppState, [], [], AgentStatusS
 
         // Rolling log of state transitions for the dashboard's activity blocks; push only on
         // real state changes to avoid dupes from prompt-only pings within the same state.
+        // A session-boundary 'done' (idle connect, STA-3386) is not a turn event — keep it
+        // out of history so activity feeds and unread counts never surface it. The inverse
+        // also holds: a boundary landing on a REAL done (resume//clear right after a finish)
+        // must push that completion into history, or the finished timestamp and unread badge
+        // lose the turn the moment the flag overwrites the live entry.
         let history: AgentStateHistoryEntry[] = existing?.stateHistory ?? []
-        if (existing && existing.state !== payload.state) {
+        const boundaryLandsOnRealDone =
+          existing?.state === 'done' &&
+          existing.sessionBoundary !== true &&
+          payload.state === 'done' &&
+          payload.sessionBoundary === true
+        if (
+          existing &&
+          (existing.state !== payload.state || boundaryLandsOnRealDone) &&
+          !(existing.state === 'done' && existing.sessionBoundary === true)
+        ) {
           history = [
             ...history,
             {
@@ -1930,11 +1944,25 @@ export const createAgentStatusSlice: StateCreator<AppState, [], [], AgentStatusS
           ...(promptInteractionKey ? { promptInteractionKey } : {}),
           ...(payload.restoredUnconfirmed ? { restoredUnconfirmed: true } : {}),
           // Why: `interrupted` is done-only; parseAgentStatusPayload already clamps it for non-done states, so write it through directly.
-          interrupted: payload.interrupted
+          interrupted: payload.interrupted,
+          // Why: done→done repaints (OSC 9999, reconnect snapshot replays) re-deliver a
+          // metadata-less `done`; preserving the flag there keeps completion-reactive
+          // consumers from treating the still-idle session as newly finished. Turn evidence
+          // (an assistant message or a changed prompt) proves a REAL completion — never
+          // carry the flag over one, or a genuine finish could be silently suppressed.
+          sessionBoundary:
+            payload.sessionBoundary ??
+            (existing?.state === 'done' &&
+            payload.state === 'done' &&
+            payload.lastAssistantMessage === undefined &&
+            payload.prompt === existing.prompt
+              ? existing.sessionBoundary
+              : undefined)
         }
         generatedTitleEntry.current = entry
         if (
           isAgentCompletionState(entry.state) &&
+          entry.sessionBoundary !== true &&
           existing !== undefined &&
           !isAgentCompletionState(existing.state)
         ) {
@@ -2040,8 +2068,10 @@ export const createAgentStatusSlice: StateCreator<AppState, [], [], AgentStatusS
           }
         }
         // Why: launch tokens can outlive an Orca-started TUI in the shell; once the session is done they must no longer authorize config reuse.
+        // A session-boundary done is the session CONNECTING (STA-3386) — deleting here would strip
+        // the pane's registered-launch-agent identity evidence the moment a resumed TUI sits idle.
         if (
-          (providerSessionChanged || entry.state === 'done') &&
+          (providerSessionChanged || (entry.state === 'done' && entry.sessionBoundary !== true)) &&
           paneKey in s.agentLaunchConfigByPaneKey
         ) {
           nextLaunchConfigs = { ...s.agentLaunchConfigByPaneKey }
diff --git a/src/renderer/src/web/web-runtime-client.test.ts b/src/renderer/src/web/web-runtime-client.test.ts
index 85a5575e3bf..7a402a42ba1 100644
--- a/src/renderer/src/web/web-runtime-client.test.ts
+++ b/src/renderer/src/web/web-runtime-client.test.ts
@@ -11,7 +11,10 @@ import {
   encryptBytes as encryptSharedBytes
 } from '../../../shared/e2ee-crypto'
 import type { RuntimeRpcResponse } from '../../../shared/runtime-rpc-envelope'
-import { SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY } from '../../../shared/protocol-version'
+import {
+  AGENT_SESSION_BOUNDARY_RUNTIME_CAPABILITY,
+  SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY
+} from '../../../shared/protocol-version'
 
 const fakeSockets: FakeWebSocket[] = []
 
@@ -78,7 +81,10 @@ describe('WebRuntimeClient', () => {
     expect(JSON.parse(auth!)).toEqual({
       type: 'e2ee_auth',
       deviceToken: 'token',
-      clientCapabilities: [SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY]
+      clientCapabilities: [
+        SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY,
+        AGENT_SESSION_BOUNDARY_RUNTIME_CAPABILITY
+      ]
     })
 
     client.close()
@@ -210,6 +216,8 @@ describe('WebRuntimeClient', () => {
     }
     timerWindow.setTimeout = setTimeout
     timerWindow.clearTimeout = clearTimeout
+    // Pin the one-sided reconnect jitter to zero so the redial lands on its exact backoff step.
+    const random = vi.spyOn(Math, 'random').mockReturnValue(0)
     const client = new WebRuntimeClient({
       v: 2,
       endpoint: 'ws://127.0.0.1:6768',
@@ -235,6 +243,7 @@ describe('WebRuntimeClient', () => {
       expect(replacementSocket.send).toHaveBeenCalledTimes(1)
     } finally {
       client.close()
+      random.mockRestore()
       vi.useRealTimers()
     }
   })
diff --git a/src/renderer/src/web/web-runtime-client.ts b/src/renderer/src/web/web-runtime-client.ts
index 12507f6225f..a51d93ac0d3 100644
--- a/src/renderer/src/web/web-runtime-client.ts
+++ b/src/renderer/src/web/web-runtime-client.ts
@@ -14,8 +14,12 @@ import {
   publicKeyFromBase64,
   publicKeyToBase64
 } from './web-e2ee'
-import { SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY } from '../../../shared/protocol-version'
+import {
+  AGENT_SESSION_BOUNDARY_RUNTIME_CAPABILITY,
+  SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY
+} from '../../../shared/protocol-version'
 import { createWebRuntimeUnauthorizedError } from './web-runtime-client-error'
+import { withReconnectJitter } from '../../../shared/reconnect-jitter'
 
 type WebRuntimeConnectionState =
   | 'disconnected'
@@ -455,7 +459,10 @@ export class WebRuntimeClient {
           this.sendEncrypted({
             type: 'e2ee_auth',
             deviceToken: this.pairing.deviceToken,
-            clientCapabilities: [SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY]
+            clientCapabilities: [
+              SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY,
+              AGENT_SESSION_BOUNDARY_RUNTIME_CAPABILITY
+            ]
           })
           return
         }
@@ -641,8 +648,9 @@ export class WebRuntimeClient {
     if (this.reconnectTimer || this.intentionallyClosed) {
       return
     }
-    const delay =
+    const delay = withReconnectJitter(
       RECONNECT_DELAYS_MS[Math.min(this.reconnectAttempt, RECONNECT_DELAYS_MS.length - 1)]
+    )
     this.reconnectAttempt += 1
     this.reconnectTimer = window.setTimeout(() => {
       this.reconnectTimer = null
diff --git a/src/shared/agent-hook-listener.test.ts b/src/shared/agent-hook-listener.test.ts
index 73c1aae3a6d..edab2cb88f6 100644
--- a/src/shared/agent-hook-listener.test.ts
+++ b/src/shared/agent-hook-listener.test.ts
@@ -1369,6 +1369,96 @@ describe('shared agent-hook-listener', () => {
     expect(event?.payload.lastAssistantMessage).toBeUndefined()
   })
 
+  it('maps Claude SessionStart to an idle done row so a resumed session earns its sidebar row before the first prompt', () => {
+    const event = normalizeHookPayload(
+      state,
+      'claude',
+      {
+        paneKey: PANE_KEY,
+        payload: {
+          hook_event_name: 'SessionStart',
+          source: 'resume',
+          session_id: '44444444-4444-4444-8444-444444444444'
+        }
+      },
+      'production'
+    )
+
+    // Why: 'working' would show a phantom spinner on an idle TUI; a session-boundary
+    // 'done' renders the row idle, which is the truth at SessionStart.
+    expect(event?.payload).toMatchObject({
+      state: 'done',
+      prompt: '',
+      agentType: 'claude',
+      sessionBoundary: true
+    })
+    expect(event?.payload.interrupted).toBeUndefined()
+    expect(event?.hookEventName).toBe('SessionStart')
+    // Why: SessionStart carries resume identity, so in-app resume works before any prompt.
+    expect(event?.providerSession).toMatchObject({
+      key: 'session_id',
+      id: '44444444-4444-4444-8444-444444444444'
+    })
+  })
+
+  it('resets stale Claude turn state when SessionStart announces a new session on the pane', () => {
+    normalizeAndAccept(state, 'claude', { hook_event_name: 'UserPromptSubmit', prompt: 'fix bug' })
+    normalizeAndAccept(state, 'claude', {
+      hook_event_name: 'PreToolUse',
+      tool_name: 'Bash',
+      tool_input: { command: 'ls' }
+    })
+    normalizeAndAccept(state, 'claude', { hook_event_name: 'SubagentStart', agent_id: 'agent-1' })
+
+    const event = normalizeAndAccept(state, 'claude', {
+      hook_event_name: 'SessionStart',
+      source: 'startup'
+    })
+
+    // Why: a new process owns the pane; stale prompt/tool/children must not survive
+    // into the fresh session's idle row or gate it back up to 'working'.
+    expect(event?.payload.state).toBe('done')
+    expect(event?.payload.prompt).toBe('')
+    expect(event?.payload.toolName).toBeUndefined()
+    expect(event?.payload.subagents).toBeUndefined()
+  })
+
+  it('keeps the running Claude turn when SessionStart comes from a compact restart or a child session', () => {
+    normalizeAndAccept(state, 'claude', { hook_event_name: 'UserPromptSubmit', prompt: 'say hi' })
+
+    const compacted = normalizeHookPayload(
+      state,
+      'claude',
+      { paneKey: PANE_KEY, payload: { hook_event_name: 'SessionStart', source: 'compact' } },
+      'production'
+    )
+    // Why: unknown/missing sources fail closed — only startup/resume/clear are idle boundaries.
+    const unknownSource = normalizeHookPayload(
+      state,
+      'claude',
+      { paneKey: PANE_KEY, payload: { hook_event_name: 'SessionStart' } },
+      'production'
+    )
+    const child = normalizeHookPayload(
+      state,
+      'claude',
+      {
+        paneKey: PANE_KEY,
+        payload: { hook_event_name: 'SessionStart', source: 'startup', agent_id: 'agent-7' }
+      },
+      'production'
+    )
+    const stopped = normalizeAndAccept(state, 'claude', { hook_event_name: 'Stop' })
+
+    // Why: auto-compact restarts mid-turn (PreCompact/PostCompact own that lifecycle) and a
+    // child-attributed SessionStart must not flip the lead's live turn to an idle row.
+    expect(compacted).toBeNull()
+    expect(unknownSource).toBeNull()
+    expect(child).toBeNull()
+    expect(stopped?.payload).toMatchObject({ state: 'done', prompt: 'say hi' })
+    expect(stopped?.payload.sessionBoundary).toBeUndefined()
+  })
+
   it('normalizes Devin documented lifecycle events', () => {
     const started = normalizeHookPayload(
       state,
diff --git a/src/shared/agent-hook-listener.ts b/src/shared/agent-hook-listener.ts
index 985f95b1876..9e133aa683a 100644
--- a/src/shared/agent-hook-listener.ts
+++ b/src/shared/agent-hook-listener.ts
@@ -2405,9 +2405,11 @@ function isNewTurnEvent(source: AgentHookSource, eventName: unknown): boolean {
   // Why: exhaustive switch so a new AgentHookSource fails typecheck here instead of falling through to false.
   switch (source) {
     case 'claude':
-    // Why: Kimi Code emits Claude-compatible hook events, so UserPromptSubmit is its new-turn boundary too.
-    // falls through
+      // Why: SessionStart lands an idle row (STA-3386) and must also drop stale
+      // tool/prompt caches left by the pane's previous session.
+      return eventName === 'SessionStart' || eventName === 'UserPromptSubmit'
     case 'kimi':
+      // Why: Kimi Code emits Claude-compatible hook events, so UserPromptSubmit is its new-turn boundary too.
       return eventName === 'UserPromptSubmit'
     case 'codex':
       return eventName === 'SessionStart' || eventName === 'UserPromptSubmit'
@@ -2739,6 +2741,35 @@ function normalizeClaudeEvent(
   ) {
     return normalizeClaudeSubagentLifecycleEvent(state, eventName, paneKey, hookPayload)
   }
+  if (eventName === 'SessionStart') {
+    // Why: SessionStart is the only signal a resumed session emits before its first prompt
+    // (STA-3386). Land it as a session-boundary 'done' row: 'working' would show a phantom
+    // spinner on an idle TUI (why Devin/Pi/Grok drop the event), and the sessionBoundary
+    // flag keeps completion-reactive consumers (notifications, automation runs) out of it.
+    const sessionStartSource = hookPayload['source']
+    if (
+      eventAgentId !== undefined ||
+      (sessionStartSource !== 'startup' &&
+        sessionStartSource !== 'resume' &&
+        sessionStartSource !== 'clear')
+    ) {
+      // Why: allowlist idle boundaries and fail closed — a compact restart (or any unknown
+      // source) fires mid-turn, and a child-attributed SessionStart must not flip the lead's
+      // live turn to an idle row.
+      return null
+    }
+    // Why: a new process owns the pane; stale children/tasks/crons must not gate the
+    // fresh session's idle row back up to 'working' (same reset Codex does on SessionStart).
+    state.claudeSubagentRosterByPaneKey.delete(paneKey)
+    state.claudeRunningNonAgentTaskPaneKeys.delete(paneKey)
+    state.claudeActiveSessionCronPaneKeys.delete(paneKey)
+    state.claudeLeadStateByPaneKey.set(paneKey, { state: 'done' })
+    return buildClaudeStatusPayload(state, eventName, promptText, paneKey, hookPayload, {
+      stateName: 'done',
+      updateToolSnapshot: true,
+      sessionBoundary: true
+    })
+  }
   const previousLead = state.claudeLeadStateByPaneKey.get(paneKey)
   // Why: only a turn boundary may declare an interrupt or carry a prior one forward; any other event starts a fresh turn and drops it.
   const isTurnBoundary = eventName === 'Stop' || eventName === 'StopFailure'
@@ -2890,7 +2921,12 @@ function buildClaudeStatusPayload(
   promptText: string,
   paneKey: string,
   hookPayload: Record<string, unknown>,
-  options: { stateName: AgentStatusState; updateToolSnapshot: boolean; interrupted?: boolean }
+  options: {
+    stateName: AgentStatusState
+    updateToolSnapshot: boolean
+    interrupted?: boolean
+    sessionBoundary?: boolean
+  }
 ): ParsedAgentStatusPayload | null {
   // Why: child-driven refreshes are roster bookkeeping, not lead tool activity; read the cached snapshot without merging so they can't clear a live AskUserQuestion card or clobber the tool preview.
   const snapshot = options.updateToolSnapshot
@@ -2913,6 +2949,7 @@ function buildClaudeStatusPayload(
     interactivePrompt: snapshot.interactivePrompt,
     lastAssistantMessage: snapshot.lastAssistantMessage,
     interrupted: options.interrupted,
+    sessionBoundary: options.sessionBoundary,
     subagents: claudeRosterToSnapshots(state.claudeSubagentRosterByPaneKey.get(paneKey))
   })
 }
diff --git a/src/shared/agent-session-option-agent-args.ts b/src/shared/agent-session-option-agent-args.ts
new file mode 100644
index 00000000000..d357ea57b73
--- /dev/null
+++ b/src/shared/agent-session-option-agent-args.ts
@@ -0,0 +1,35 @@
+export function agentArgOptionTokens(tokens: readonly string[]): readonly string[] {
+  const terminator = tokens.indexOf('--')
+  return terminator === -1 ? tokens : tokens.slice(0, terminator)
+}
+
+export function removeAgentArgOption(
+  tokens: readonly string[],
+  aliases: readonly string[]
+): string[] {
+  const result: string[] = []
+  for (let index = 0; index < tokens.length; index += 1) {
+    const token = tokens[index]
+    if (token === '--') {
+      result.push(...tokens.slice(index))
+      break
+    }
+    const exact = aliases.includes(token)
+    const matched = aliases.some(
+      (alias) =>
+        token.startsWith(`${alias}=`) ||
+        (alias.startsWith('-') &&
+          !alias.startsWith('--') &&
+          token.startsWith(alias) &&
+          token.length > alias.length)
+    )
+    if (!exact && !matched) {
+      result.push(token)
+      continue
+    }
+    if (exact && tokens[index + 1] && !tokens[index + 1].startsWith('-')) {
+      index += 1
+    }
+  }
+  return result
+}
diff --git a/src/shared/agent-session-option-catalog-claude-codex.ts b/src/shared/agent-session-option-catalog-claude-codex.ts
index ab13dda4dc5..0464fd1f131 100644
--- a/src/shared/agent-session-option-catalog-claude-codex.ts
+++ b/src/shared/agent-session-option-catalog-claude-codex.ts
@@ -3,6 +3,7 @@ import type {
   CatalogModel,
   CatalogOption
 } from './agent-session-option-catalog-types'
+import { agentArgOptionTokens, removeAgentArgOption } from './agent-session-option-agent-args'
 import {
   CLAUDE_MODEL_LIST_ARGS,
   CLAUDE_MODEL_LIST_STDIN,
@@ -10,7 +11,7 @@ import {
 } from './claude-model-list-probe'
 
 function hasFlag(tokens: readonly string[], flags: readonly string[]): boolean {
-  return tokens.some((token) =>
+  return agentArgOptionTokens(tokens).some((token) =>
     flags.some(
       (flag) =>
         token === flag ||
@@ -24,8 +25,9 @@ function hasCodexEffortOverride(tokens: readonly string[]): boolean {
   if (hasFlag(tokens, ['--reasoning-effort'])) {
     return true
   }
-  return tokens.some((token, index) => {
-    const previous = tokens[index - 1]
+  const optionTokens = agentArgOptionTokens(tokens)
+  return optionTokens.some((token, index) => {
+    const previous = optionTokens[index - 1]
     return (
       (token.startsWith('model_reasoning_effort=') &&
         (previous === '-c' || previous === '--config')) ||
@@ -36,6 +38,32 @@ function hasCodexEffortOverride(tokens: readonly string[]): boolean {
   })
 }
 
+function removeCodexEffortOverride(tokens: readonly string[]): string[] {
+  const withoutFlag = removeAgentArgOption(tokens, ['--reasoning-effort'])
+  const result: string[] = []
+  for (let index = 0; index < withoutFlag.length; index += 1) {
+    const token = withoutFlag[index]
+    if (token === '--') {
+      result.push(...withoutFlag.slice(index))
+      break
+    }
+    const next = withoutFlag[index + 1]
+    if ((token === '-c' || token === '--config') && next?.startsWith('model_reasoning_effort=')) {
+      index += 1
+      continue
+    }
+    if (
+      token.startsWith('-cmodel_reasoning_effort=') ||
+      token.startsWith('-c=model_reasoning_effort=') ||
+      token.startsWith('--config=model_reasoning_effort=')
+    ) {
+      continue
+    }
+    result.push(token)
+  }
+  return result
+}
+
 const STANDARD_EFFORT_CHOICES = [
   { value: 'low', label: 'Low' },
   { value: 'medium', label: 'Medium' },
@@ -67,6 +95,7 @@ function claudeEffortWithChoices(choices: typeof EXTENDED_EFFORT_CHOICES): Catal
     apply: {
       launchArgs: (value) => ['--effort', String(value)],
       agentArgsOverride: (tokens) => hasFlag(tokens, ['--effort']),
+      removeAgentArgs: (tokens) => removeAgentArgOption(tokens, ['--effort']),
       midSession: { kind: 'command', build: (value) => `/effort ${String(value)}` }
     }
   }
@@ -108,6 +137,7 @@ const CLAUDE_FAST_MODE: CatalogOption = {
 }
 
 export const CLAUDE_SESSION_OPTION_CATALOG: AgentSessionOptionCatalog = {
+  supportsWorkerLaunchPreferences: true,
   // Why: these ids are Claude CLI aliases that resolve to the newest model of
   // each family on the host's CLI (`opus` is Opus 5 on current CLIs, older
   // Opus on older CLIs), so pinned version labels lie on part of the fleet.
@@ -143,6 +173,7 @@ export const CLAUDE_SESSION_OPTION_CATALOG: AgentSessionOptionCatalog = {
   modelApply: {
     launchArgs: (value) => ['--model', String(value)],
     agentArgsOverride: (tokens) => hasFlag(tokens, ['--model']),
+    removeAgentArgs: (tokens) => removeAgentArgOption(tokens, ['--model']),
     midSession: {
       kind: 'command',
       build: (value) => `/model ${String(value)}`,
@@ -152,6 +183,7 @@ export const CLAUDE_SESSION_OPTION_CATALOG: AgentSessionOptionCatalog = {
       detectAgentInteraction: 'claude-model-switch-confirmation'
     }
   },
+  unknownModelOptions: [claudeEffort(true)],
   listModels: {
     command: `echo '${CLAUDE_MODEL_LIST_STDIN.trim()}' | claude ${CLAUDE_MODEL_LIST_ARGS.join(' ')}`,
     parse: parseClaudeCatalogModels
@@ -181,12 +213,14 @@ function codexEffort(includeExtraHigh: boolean): CatalogOption {
     apply: {
       launchArgs: (value) => ['-c', `model_reasoning_effort=${String(value)}`],
       agentArgsOverride: hasCodexEffortOverride,
+      removeAgentArgs: removeCodexEffortOverride,
       midSession: { kind: 'agent-picker', command: '/model' }
     }
   }
 }
 
 export const CODEX_SESSION_OPTION_CATALOG: AgentSessionOptionCatalog = {
+  supportsWorkerLaunchPreferences: true,
   // Why: Codex model access depends on auth. Keep this seed short and allow
   // unknown persisted ids to pass through instead of claiming a complete list.
   models: [
@@ -203,11 +237,13 @@ export const CODEX_SESSION_OPTION_CATALOG: AgentSessionOptionCatalog = {
   modelApply: {
     launchArgs: (value) => ['-m', String(value)],
     agentArgsOverride: (tokens) => hasFlag(tokens, ['-m', '--model']),
+    removeAgentArgs: (tokens) => removeAgentArgOption(tokens, ['-m', '--model']),
     // Codex accepts a model argument in its live /model command.
     midSession: {
       kind: 'command',
       build: (value) => `/model ${String(value)}`,
       pickerCommand: '/model'
     }
-  }
+  },
+  unknownModelOptions: [codexEffort(true)]
 }
diff --git a/src/shared/agent-session-option-catalog-gemini-cursor.ts b/src/shared/agent-session-option-catalog-gemini-cursor.ts
index b655c8e0637..c4f818ad549 100644
--- a/src/shared/agent-session-option-catalog-gemini-cursor.ts
+++ b/src/shared/agent-session-option-catalog-gemini-cursor.ts
@@ -3,9 +3,10 @@ import type {
   CatalogModel,
   CatalogOption
 } from './agent-session-option-catalog-types'
+import { agentArgOptionTokens, removeAgentArgOption } from './agent-session-option-agent-args'
 
 function hasModelFlag(tokens: readonly string[]): boolean {
-  return tokens.some(
+  return agentArgOptionTokens(tokens).some(
     (token) =>
       token === '-m' ||
       token === '--model' ||
@@ -77,6 +78,7 @@ function parseCursorModels(stdout: string): CatalogModel[] {
 }
 
 export const CURSOR_SESSION_OPTION_CATALOG: AgentSessionOptionCatalog = {
+  supportsWorkerLaunchPreferences: true,
   models: [
     { id: 'auto', label: 'Auto', isDefault: true, options: [] },
     {
@@ -93,6 +95,7 @@ export const CURSOR_SESSION_OPTION_CATALOG: AgentSessionOptionCatalog = {
   modelApply: {
     launchArgs: (value) => ['--model', String(value)],
     agentArgsOverride: hasModelFlag,
+    removeAgentArgs: (tokens) => removeAgentArgOption(tokens, ['-m', '--model']),
     midSession: { kind: 'command', build: (value) => `/model ${String(value)}` }
   },
   composeModelValue: (modelId, values) => {
diff --git a/src/shared/agent-session-option-catalog-types.ts b/src/shared/agent-session-option-catalog-types.ts
index a416b10913e..5475910702b 100644
--- a/src/shared/agent-session-option-catalog-types.ts
+++ b/src/shared/agent-session-option-catalog-types.ts
@@ -23,6 +23,8 @@ export type CatalogOptionApply = {
   /** Why: later free-form args win, so the launch record must discard any
    * picker value that those args may have replaced. */
   agentArgsOverride?: (tokens: readonly string[]) => boolean
+  /** Removes conflicting defaults before a more specific launch choice is inserted. */
+  removeAgentArgs?: (tokens: readonly string[]) => string[]
   composedIntoModel?: true
   midSession?: CatalogMidSessionApply
 }
@@ -53,6 +55,10 @@ export type CatalogModel = {
 export type AgentSessionOptionCatalog = {
   models: CatalogModel[]
   modelApply: CatalogOptionApply
+  /** Opts this agent into structured per-worker launch overrides. */
+  supportsWorkerLaunchPreferences?: true
+  /** Launch-safe options for opaque model ids that are absent from the static catalog. */
+  unknownModelOptions?: CatalogOption[]
   composeModelValue?: (modelId: string, values: Record<string, SessionOptionValue>) => string
   listModels?: {
     command: string
diff --git a/src/shared/agent-session-option-launch.ts b/src/shared/agent-session-option-launch.ts
index 9181039f0a7..53df967a838 100644
--- a/src/shared/agent-session-option-launch.ts
+++ b/src/shared/agent-session-option-launch.ts
@@ -7,10 +7,32 @@ export type ResolvedSessionOptionLaunch = {
   appliedValues: Record<string, SessionOptionValue>
 }
 
+export function removeOverriddenAgentSessionArgs(
+  agent: AgentType,
+  values: Record<string, SessionOptionValue> | null | undefined,
+  tokens: readonly string[]
+): string[] {
+  const catalog = getAgentSessionOptionCatalog(agent)
+  const modelId = typeof values?.model === 'string' ? values.model : null
+  if (!catalog || !values || !modelId) {
+    return [...tokens]
+  }
+  let result = catalog.modelApply.removeAgentArgs?.(tokens) ?? [...tokens]
+  const model = findCatalogModel(catalog, modelId)
+  const modelOptions = model?.options ?? catalog.unknownModelOptions ?? []
+  for (const option of modelOptions) {
+    if (values[option.id] !== undefined && option.apply.removeAgentArgs) {
+      result = option.apply.removeAgentArgs(result)
+    }
+  }
+  return result
+}
+
 export function resolveAgentSessionOptionLaunch(
   agent: AgentType,
   values: Record<string, SessionOptionValue> | null | undefined,
-  trailingAgentArgs: readonly string[] = []
+  trailingAgentArgs: readonly string[] = [],
+  includeCatalogDefaults = true
 ): ResolvedSessionOptionLaunch {
   const catalog = getAgentSessionOptionCatalog(agent)
   const modelId = typeof values?.model === 'string' ? values.model : null
@@ -21,11 +43,23 @@ export function resolveAgentSessionOptionLaunch(
   const model = findCatalogModel(catalog, modelId)
   const appliedValues: Record<string, SessionOptionValue> = {}
   const args: string[] = []
-  const modelValues = model
-    ? Object.fromEntries(
-        model.options.map((option) => [option.id, values[option.id] ?? option.kind.defaultValue])
-      )
-    : {}
+  const modelOptions = model?.options ?? catalog.unknownModelOptions ?? []
+  const modelValues = Object.fromEntries(
+    modelOptions.flatMap((option) => {
+      const explicitValue = values[option.id]
+      if (explicitValue !== undefined) {
+        if (
+          !model &&
+          option.kind.type === 'select' &&
+          !option.kind.choices.some((choice) => choice.value === explicitValue)
+        ) {
+          return []
+        }
+        return [[option.id, explicitValue]]
+      }
+      return model && includeCatalogDefaults ? [[option.id, option.kind.defaultValue]] : []
+    })
+  )
   const composedModelId = catalog.composeModelValue
     ? catalog.composeModelValue(modelId, modelValues)
     : modelId
@@ -37,11 +71,7 @@ export function resolveAgentSessionOptionLaunch(
       appliedValues.model = modelId
     }
   }
-  if (!model) {
-    return { args, appliedValues }
-  }
-
-  for (const option of model.options) {
+  for (const option of modelOptions) {
     const value = modelValues[option.id]
     if (value === undefined) {
       continue
diff --git a/src/shared/agent-status-types.test.ts b/src/shared/agent-status-types.test.ts
index 6059950b708..1dea3dc70fe 100644
--- a/src/shared/agent-status-types.test.ts
+++ b/src/shared/agent-status-types.test.ts
@@ -421,6 +421,20 @@ Fix dispatch fallback preview for normalized status prompts`
     }
   })
 
+  it('preserves sessionBoundary=true only on done (stale-signal suppression like interrupted)', () => {
+    expect(
+      parseAgentStatusPayload('{"state":"done","sessionBoundary":true}')!.sessionBoundary
+    ).toBe(true)
+    for (const state of ['working', 'blocked', 'waiting'] as const) {
+      const result = parseAgentStatusPayload(`{"state":"${state}","sessionBoundary":true}`)
+      expect(result!.sessionBoundary).toBeUndefined()
+    }
+    // Why: parser uses `=== true`, so truthy sentinels don't count.
+    expect(
+      parseAgentStatusPayload('{"state":"done","sessionBoundary":"true"}')!.sessionBoundary
+    ).toBeUndefined()
+  })
+
   it('requires strict boolean true for interrupted (rejects truthy non-boolean)', () => {
     // Why: parser uses `=== true`, so truthy string/number sentinels don't count.
     expect(
diff --git a/src/shared/agent-status-types.ts b/src/shared/agent-status-types.ts
index 0d902ecb0fc..123a1bf5eb7 100644
--- a/src/shared/agent-status-types.ts
+++ b/src/shared/agent-status-types.ts
@@ -126,6 +126,8 @@ export type AgentStatusEntry = {
   /** True when this `done` was reached via interrupt, not normal completion
    *  (agent-reported or Orca's guarded fallback). Undefined otherwise. */
   interrupted?: boolean
+  /** True when this `done` is a session boundary, not a completed turn. See AgentStatusPayload. */
+  sessionBoundary?: boolean
   /** Orchestration dispatch context for panes spawned by another agent.
    *  Why: parent/child hierarchy is pane-level state, not worktree lineage — workers often share the coordinator's worktree. */
   orchestration?: AgentStatusOrchestrationContext
@@ -170,6 +172,11 @@ export type AgentStatusPayload = {
   interactivePrompt?: string
   lastAssistantMessage?: string
   interrupted?: boolean
+  /** True when this `done` marks a session boundary (connect/resume/clear landing idle,
+   *  e.g. Claude SessionStart — STA-3386), not a completed turn. Consumers that react to
+   *  completions (notifications, automation runs, unread badges, finished timestamps)
+   *  must ignore it. Only meaningful on `done`. */
+  sessionBoundary?: boolean
   /** Live in-process children of the reporting session. See AgentStatusEntry. */
   subagents?: AgentSubagentSnapshot[]
 }
@@ -202,6 +209,7 @@ export function pickParsedAgentStatusPayload(
       ? { lastAssistantMessage: row.lastAssistantMessage }
       : {}),
     ...(row.interrupted !== undefined ? { interrupted: row.interrupted } : {}),
+    ...(row.sessionBoundary !== undefined ? { sessionBoundary: row.sessionBoundary } : {}),
     ...(row.subagents !== undefined ? { subagents: row.subagents } : {})
   }
 }
@@ -401,6 +409,7 @@ function normalizeAgentStatusObject(parsed: unknown): ParsedAgentStatusPayload |
     ),
     // Why: only meaningful on `done`; coerce to undefined elsewhere so it can't leak stale truth across transitions.
     interrupted: obj.interrupted === true && state === 'done' ? true : undefined,
+    sessionBoundary: obj.sessionBoundary === true && state === 'done' ? true : undefined,
     subagents: normalizeSubagentsField(obj.subagents)
   }
 }
diff --git a/src/shared/protocol-version.ts b/src/shared/protocol-version.ts
index c2f005ddef1..c967c66822b 100644
--- a/src/shared/protocol-version.ts
+++ b/src/shared/protocol-version.ts
@@ -32,6 +32,8 @@ export const REMOTE_RUNTIME_SHARED_CONTROL_CAPABILITY = 'remote-runtime.shared-c
 export const ORCHESTRATION_FEDERATION_RUNTIME_CAPABILITY = 'orchestration.federation.v1' as const
 export const ORCHESTRATION_FEDERATION_CONTROL_MAIL_RUNTIME_CAPABILITY =
   'orchestration.federation-control-mail.v1' as const
+export const ORCHESTRATION_WORKER_LAUNCH_PREFERENCES_RUNTIME_CAPABILITY =
+  'orchestration.worker-launch-preferences.v1' as const
 export const ORCHESTRATION_FEDERATION_CONTROL_MAIL_PROTOCOL_VERSION = 2 as const
 export const ORCHESTRATION_CONTRACT_VERSION = 1 as const
 export const ORCHESTRATION_CONTRACT_RUNTIME_CAPABILITY = 'orchestration.contract.v1' as const
@@ -70,6 +72,8 @@ export const ACCOUNT_IMPORT_RUNTIME_CAPABILITY = 'accounts.import-host-credentia
 export const TERMINAL_CREATE_IDEMPOTENCY_RUNTIME_CAPABILITY =
   'terminal.create-idempotency.v2' as const
 export const SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY = 'session-tabs.close-intent.v1' as const
+export const AGENT_SESSION_BOUNDARY_RUNTIME_CAPABILITY =
+  'agent-session.session-boundary.v1' as const
 export { REMOTE_SERVER_UPDATE_CAPABILITY } from './remote-server-update'
 export const AGENT_SESSION_HOST_AUTHORITY_RUNTIME_CAPABILITY =
   'agent-session.host-authority.v1' as const
@@ -86,6 +90,7 @@ export const RUNTIME_CAPABILITIES = [
   REMOTE_RUNTIME_SHARED_CONTROL_CAPABILITY,
   ORCHESTRATION_FEDERATION_RUNTIME_CAPABILITY,
   ORCHESTRATION_FEDERATION_CONTROL_MAIL_RUNTIME_CAPABILITY,
+  ORCHESTRATION_WORKER_LAUNCH_PREFERENCES_RUNTIME_CAPABILITY,
   ORCHESTRATION_CONTRACT_RUNTIME_CAPABILITY,
   'browser.screencast.v1',
   'terminal.binary-stream.v1',
@@ -105,6 +110,7 @@ export const RUNTIME_CAPABILITIES = [
   WORKTREE_CREATE_IDEMPOTENCY_RUNTIME_CAPABILITY,
   TERMINAL_CREATE_IDEMPOTENCY_RUNTIME_CAPABILITY,
   SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY,
+  AGENT_SESSION_BOUNDARY_RUNTIME_CAPABILITY,
   REMOTE_SERVER_UPDATE_CAPABILITY,
   AGENT_SESSION_HOST_AUTHORITY_RUNTIME_CAPABILITY,
   AGENT_SESSION_OMP_RESUME_PATH_RUNTIME_CAPABILITY,
diff --git a/src/shared/reconnect-jitter.test.ts b/src/shared/reconnect-jitter.test.ts
new file mode 100644
index 00000000000..81b0bd448dd
--- /dev/null
+++ b/src/shared/reconnect-jitter.test.ts
@@ -0,0 +1,17 @@
+import { describe, expect, it } from 'vitest'
+import { withReconnectJitter } from './reconnect-jitter'
+
+describe('withReconnectJitter', () => {
+  it('never returns less than the backoff floor', () => {
+    expect(withReconnectJitter(500, () => 0)).toBe(500)
+  })
+
+  it('spreads a fleet that was dropped by one shared blip', () => {
+    const fleet = Array.from({ length: 32 }, (_, index) =>
+      withReconnectJitter(500, () => index / 32)
+    )
+    expect(new Set(fleet).size).toBeGreaterThan(1)
+    expect(Math.min(...fleet)).toBeGreaterThanOrEqual(500)
+    expect(Math.max(...fleet)).toBeLessThanOrEqual(600)
+  })
+})
diff --git a/src/shared/reconnect-jitter.ts b/src/shared/reconnect-jitter.ts
new file mode 100644
index 00000000000..576db7f0270
--- /dev/null
+++ b/src/shared/reconnect-jitter.ts
@@ -0,0 +1,7 @@
+// Why: a blip on a shared path (Tailscale, cellular, host restart) drops every socket on that path in
+// the same instant. A jitterless backoff ladder then re-dials all of them at the same millisecond,
+// which is exactly the thundering herd the host is least able to absorb while it is still recovering.
+// One-sided so a delay is never shortened below its backoff floor.
+export function withReconnectJitter(delayMs: number, random: () => number = Math.random): number {
+  return delayMs + Math.floor(delayMs * 0.2 * random())
+}
diff --git a/src/shared/remote-runtime-client.test.ts b/src/shared/remote-runtime-client.test.ts
index 43a2a982d73..9ead47f4067 100644
--- a/src/shared/remote-runtime-client.test.ts
+++ b/src/shared/remote-runtime-client.test.ts
@@ -13,7 +13,10 @@ import {
 } from './e2ee-crypto'
 import { sendRemoteRuntimeRequest, subscribeRemoteRuntimeRequest } from './remote-runtime-client'
 import { MAX_TIMER_DELAY_MS } from './timer-delay'
-import { SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY } from './protocol-version'
+import {
+  AGENT_SESSION_BOUNDARY_RUNTIME_CAPABILITY,
+  SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY
+} from './protocol-version'
 
 const servers: WebSocketServer[] = []
 
@@ -69,7 +72,10 @@ describe('subscribeRemoteRuntimeRequest', () => {
     await expect(server.nextAuth).resolves.toEqual({
       type: 'e2ee_auth',
       deviceToken: 'device-token',
-      clientCapabilities: [SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY]
+      clientCapabilities: [
+        SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY,
+        AGENT_SESSION_BOUNDARY_RUNTIME_CAPABILITY
+      ]
     })
     const bytes = new Uint8Array([1, 2, 3])
     expect(subscription.sendBinary(bytes)).toBe(true)
diff --git a/src/shared/remote-runtime-client.ts b/src/shared/remote-runtime-client.ts
index bd424cd0852..f147ed4e7bb 100644
--- a/src/shared/remote-runtime-client.ts
+++ b/src/shared/remote-runtime-client.ts
@@ -22,7 +22,10 @@ import {
   type RuntimeRpcResponse
 } from './runtime-rpc-envelope'
 import type { RuntimeStatus } from './runtime-types'
-import { SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY } from './protocol-version'
+import {
+  AGENT_SESSION_BOUNDARY_RUNTIME_CAPABILITY,
+  SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY
+} from './protocol-version'
 // Re-export so existing value importers of `RemoteRuntimeClientError` are
 // unaffected; the class lives in a ws-free module so type-only consumers
 // (and mobile's typecheck) don't compile this file's Node-only deps.
@@ -134,7 +137,10 @@ async function sendRemoteRuntimeRequestOnSocket<TResult>(
   const serializedAuth = serializeRemoteRuntimePayload({
     type: 'e2ee_auth',
     deviceToken: pairing.deviceToken,
-    clientCapabilities: [SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY]
+    clientCapabilities: [
+      SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY,
+      AGENT_SESSION_BOUNDARY_RUNTIME_CAPABILITY
+    ]
   })
   const pendingRequest = {
     preparedRequest: prepareRemoteRuntimeRequest(new Map(), () =>
@@ -507,7 +513,10 @@ export async function subscribeRemoteRuntimeRequest<TResult>(
   const serializedAuth = serializeRemoteRuntimePayload({
     type: 'e2ee_auth',
     deviceToken: pairing.deviceToken,
-    clientCapabilities: [SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY]
+    clientCapabilities: [
+      SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY,
+      AGENT_SESSION_BOUNDARY_RUNTIME_CAPABILITY
+    ]
   })
   return await new Promise((resolve, reject) => {
     const keyPair = generateKeyPair()
diff --git a/src/shared/remote-runtime-request-connection.test.ts b/src/shared/remote-runtime-request-connection.test.ts
index 9bd5ff253d3..7f8f4e69871 100644
--- a/src/shared/remote-runtime-request-connection.test.ts
+++ b/src/shared/remote-runtime-request-connection.test.ts
@@ -11,7 +11,10 @@ import {
   publicKeyToBase64
 } from './e2ee-crypto'
 import { RemoteRuntimeRequestConnection } from './remote-runtime-request-connection'
-import { SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY } from './protocol-version'
+import {
+  AGENT_SESSION_BOUNDARY_RUNTIME_CAPABILITY,
+  SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY
+} from './protocol-version'
 
 type TestServer = {
   wss: WebSocketServer
@@ -58,7 +61,10 @@ describe('RemoteRuntimeRequestConnection', () => {
     expect(server.connectionCount()).toBe(1)
     expect(server.auths).toContainEqual(
       expect.objectContaining({
-        clientCapabilities: [SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY]
+        clientCapabilities: [
+          SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY,
+          AGENT_SESSION_BOUNDARY_RUNTIME_CAPABILITY
+        ]
       })
     )
     expect(server.requests).toMatchObject([
@@ -106,7 +112,10 @@ async function createServer(): Promise<TestServer> {
         expect(auth).toEqual({
           type: 'e2ee_auth',
           deviceToken: 'device-token',
-          clientCapabilities: [SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY]
+          clientCapabilities: [
+            SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY,
+            AGENT_SESSION_BOUNDARY_RUNTIME_CAPABILITY
+          ]
         })
         authenticated = true
         sendEncrypted(ws, sharedKey, { type: 'e2ee_authenticated' })
diff --git a/src/shared/remote-runtime-request-connection.ts b/src/shared/remote-runtime-request-connection.ts
index 8ff1f246c8e..f79c5cdd136 100644
--- a/src/shared/remote-runtime-request-connection.ts
+++ b/src/shared/remote-runtime-request-connection.ts
@@ -30,7 +30,10 @@ import {
   type RemoteRuntimeRequestReadyWaiter
 } from './remote-runtime-request-ready-waiters'
 import { openRemoteRuntimeWebSocket } from './remote-runtime-request-websocket'
-import { SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY } from './protocol-version'
+import {
+  AGENT_SESSION_BOUNDARY_RUNTIME_CAPABILITY,
+  SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY
+} from './protocol-version'
 
 type ConnectionState = 'closed' | 'awaiting_ready' | 'awaiting_authenticated' | 'ready'
 
@@ -207,7 +210,10 @@ export class RemoteRuntimeRequestConnection {
         serializeRemoteRuntimePayload({
           type: 'e2ee_auth',
           deviceToken: this.pairing.deviceToken,
-          clientCapabilities: [SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY]
+          clientCapabilities: [
+            SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY,
+            AGENT_SESSION_BOUNDARY_RUNTIME_CAPABILITY
+          ]
         }),
         sharedKey
       )
diff --git a/src/shared/remote-runtime-shared-control-connection.test.ts b/src/shared/remote-runtime-shared-control-connection.test.ts
index 43ec4473c2a..66a57a92e52 100644
--- a/src/shared/remote-runtime-shared-control-connection.test.ts
+++ b/src/shared/remote-runtime-shared-control-connection.test.ts
@@ -20,7 +20,10 @@ import { getRemoteRuntimeRequestAdmissionEvidence } from './remote-runtime-prepa
 import { RemoteRuntimeSharedControlConnection } from './remote-runtime-shared-control-connection'
 import * as sharedControlProtocol from './remote-runtime-shared-control-protocol'
 import { isRuntimeSubscriptionReplayResponse } from './runtime-subscription-replay'
-import { SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY } from './protocol-version'
+import {
+  AGENT_SESSION_BOUNDARY_RUNTIME_CAPABILITY,
+  SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY
+} from './protocol-version'
 
 const TEST_PROJECT_PATH = path.join('tmp', 'project')
 
@@ -62,7 +65,10 @@ describe('RemoteRuntimeSharedControlConnection', () => {
     expect(server.auths).toContainEqual({
       type: 'e2ee_auth',
       deviceToken: 'device-token',
-      clientCapabilities: [SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY]
+      clientCapabilities: [
+        SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY,
+        AGENT_SESSION_BOUNDARY_RUNTIME_CAPABILITY
+      ]
     })
     expect(server.requests.map((request) => request.method)).toEqual([
       'worktree.ps',
diff --git a/src/shared/remote-runtime-shared-control-frame-handler.ts b/src/shared/remote-runtime-shared-control-frame-handler.ts
index 3bf3c5cdcee..96a3e1084ad 100644
--- a/src/shared/remote-runtime-shared-control-frame-handler.ts
+++ b/src/shared/remote-runtime-shared-control-frame-handler.ts
@@ -1,6 +1,9 @@
 import { parseAuthenticatedFrame, parseReadyFrame } from './remote-runtime-request-frames'
 import type { RemoteRuntimeClientError } from './remote-runtime-client-error'
-import { SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY } from './protocol-version'
+import {
+  AGENT_SESSION_BOUNDARY_RUNTIME_CAPABILITY,
+  SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY
+} from './protocol-version'
 import { dispatchSharedControlFrame } from './remote-runtime-shared-control-frame-dispatch'
 import { parseSharedControlFrame } from './remote-runtime-shared-control-protocol'
 import type { SharedControlRetiredRequestIds } from './remote-runtime-shared-control-retired-request-ids'
@@ -38,7 +41,10 @@ export function handleSharedControlTextFrame(args: {
     args.sendEncrypted({
       type: 'e2ee_auth',
       deviceToken: args.deviceToken,
-      clientCapabilities: [SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY]
+      clientCapabilities: [
+        SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY,
+        AGENT_SESSION_BOUNDARY_RUNTIME_CAPABILITY
+      ]
     })
     return
   }
diff --git a/src/shared/remote-runtime-shared-control-state.ts b/src/shared/remote-runtime-shared-control-state.ts
index c74c50916c9..c31752cdb56 100644
--- a/src/shared/remote-runtime-shared-control-state.ts
+++ b/src/shared/remote-runtime-shared-control-state.ts
@@ -10,6 +10,7 @@ import type {
   SharedControlReadyWaiter
 } from './remote-runtime-shared-control-types'
 import { getSubscriptionId, isEndResult } from './remote-runtime-shared-control-protocol'
+import { withReconnectJitter } from './reconnect-jitter'
 import { tagRuntimeSubscriptionReplayResponse } from './runtime-subscription-replay'
 
 export function buildSharedControlDiagnostics(args: {
@@ -207,10 +208,3 @@ export function scheduleSharedControlReconnect(args: {
   }
   return { timer, reconnectAttempt: args.reconnectAttempt + 1 }
 }
-
-function withReconnectJitter(delayMs: number): number {
-  // Why: when a remote host restarts, all passive subscriptions reconnect
-  // together. A small one-sided jitter avoids synchronized retry spikes.
-  const jitterMs = Math.floor(delayMs * 0.2 * Math.random())
-  return delayMs + jitterMs
-}
diff --git a/src/shared/tui-agent-launch-command.ts b/src/shared/tui-agent-launch-command.ts
index d433fc61721..3ce20571f4e 100644
--- a/src/shared/tui-agent-launch-command.ts
+++ b/src/shared/tui-agent-launch-command.ts
@@ -1,4 +1,7 @@
-import { resolveAgentSessionOptionLaunch } from './agent-session-option-launch'
+import {
+  removeOverriddenAgentSessionArgs,
+  resolveAgentSessionOptionLaunch
+} from './agent-session-option-launch'
 import type { SessionOptionValue } from './native-chat-session-options'
 import { getTuiAgentLaunchCommand, TUI_AGENT_CONFIG } from './tui-agent-config'
 import {
@@ -25,6 +28,7 @@ export function resolveAgentLaunchCommand(args: {
   shell: AgentStartupShell
   agentArgs?: string | null
   sessionOptions?: Record<string, SessionOptionValue>
+  sessionOptionsOverrideAgentArgs?: boolean
   isRemote?: boolean
 }): ResolvedAgentLaunchCommand {
   const override = args.cmdOverrides[args.agent]
@@ -46,17 +50,60 @@ export function resolveAgentLaunchCommand(args: {
   const resolvedOptions = resolveAgentSessionOptionLaunch(
     args.agent,
     args.sessionOptions,
-    trailingTokens.tokens
+    args.sessionOptionsOverrideAgentArgs ? [] : trailingTokens.tokens,
+    !args.sessionOptionsOverrideAgentArgs
   )
+  if (override && args.sessionOptionsOverrideAgentArgs) {
+    const overrideTokens = tokenizeStartupCommand(override, args.shell)
+    if (!overrideTokens.ok) {
+      return { ok: false, error: `Agent command override is invalid: ${overrideTokens.error}` }
+    }
+    const commandOverrideOptions = resolveAgentSessionOptionLaunch(
+      args.agent,
+      args.sessionOptions,
+      overrideTokens.tokens,
+      false
+    )
+    if (
+      Object.entries(resolvedOptions.appliedValues).some(
+        ([key, value]) => commandOverrideOptions.appliedValues[key] !== value
+      )
+    ) {
+      return {
+        ok: false,
+        error:
+          'Agent command override conflicts with the requested launch preferences. Remove model or effort flags from the command override.'
+      }
+    }
+  }
   const optionSuffix = resolvedOptions.args.map((arg) => quoteStartupArg(arg, args.shell)).join(' ')
-  const commandWithOptions = optionSuffix ? `${command} ${optionSuffix}` : command
   const commandWithoutSessionOptions = suffix.suffix ? `${command} ${suffix.suffix}` : command
-  // Why: session flags precede the free-form suffix so the user's explicit
-  // repeated flag remains the final, winning occurrence.
+  const commandWithOptions = optionSuffix ? `${command} ${optionSuffix}` : command
+  const overrideTokens = args.sessionOptionsOverrideAgentArgs
+    ? insertBeforeTerminator(
+        removeOverriddenAgentSessionArgs(args.agent, args.sessionOptions, trailingTokens.tokens),
+        resolvedOptions.args
+      )
+    : []
+  const commandWithOverrides = overrideTokens.length
+    ? `${command} ${overrideTokens.map((token) => quoteStartupArg(token, args.shell)).join(' ')}`
+    : command
   return {
     ok: true,
-    command: suffix.suffix ? `${commandWithOptions} ${suffix.suffix}` : commandWithOptions,
+    command: args.sessionOptionsOverrideAgentArgs
+      ? commandWithOverrides
+      : suffix.suffix
+        ? `${commandWithOptions} ${suffix.suffix}`
+        : commandWithOptions,
     commandWithoutSessionOptions,
     appliedSessionOptions: resolvedOptions.appliedValues
   }
 }
+
+function insertBeforeTerminator(tokens: readonly string[], inserted: readonly string[]): string[] {
+  const terminator = tokens.indexOf('--')
+  if (terminator === -1) {
+    return [...tokens, ...inserted]
+  }
+  return [...tokens.slice(0, terminator), ...inserted, ...tokens.slice(terminator)]
+}
diff --git a/src/shared/tui-agent-startup-session-options.test.ts b/src/shared/tui-agent-startup-session-options.test.ts
index af97826f530..cd47d81b971 100644
--- a/src/shared/tui-agent-startup-session-options.test.ts
+++ b/src/shared/tui-agent-startup-session-options.test.ts
@@ -4,6 +4,7 @@ import {
   buildAgentResumeStartupPlan,
   buildAgentStartupPlan
 } from './tui-agent-startup'
+import { resolveAgentLaunchCommand } from './tui-agent-launch-command'
 
 describe('tui agent startup session options', () => {
   it('emits catalog options before user arguments without recording an overridden model', () => {
@@ -33,6 +34,59 @@ describe('tui agent startup session options', () => {
     expect(plan?.sessionOptions).toEqual({ model: 'opus' })
   })
 
+  it('lets explicit worker preferences override general agent arguments', () => {
+    const plan = buildAgentStartupPlan({
+      agent: 'codex',
+      prompt: '',
+      cmdOverrides: {},
+      platform: 'linux',
+      allowEmptyPromptLaunch: true,
+      sessionOptions: { model: 'custom-codex-model', effort: 'high' },
+      sessionOptionsOverrideAgentArgs: true,
+      agentArgs: '-m gpt-5.5 -c model_reasoning_effort=low'
+    })
+    expect(plan?.launchCommand).toBe(
+      "codex '-m' 'custom-codex-model' '-c' 'model_reasoning_effort=high'"
+    )
+    expect(plan?.launchConfig.agentCommand).toBe(
+      "codex '-m' 'gpt-5.5' '-c' 'model_reasoning_effort=low'"
+    )
+    expect(plan?.sessionOptions).toEqual({ model: 'custom-codex-model', effort: 'high' })
+  })
+
+  it('inserts worker preferences before an argument terminator', () => {
+    const plan = buildAgentStartupPlan({
+      agent: 'codex',
+      prompt: '',
+      cmdOverrides: {},
+      platform: 'linux',
+      allowEmptyPromptLaunch: true,
+      sessionOptions: { model: 'custom-codex-model', effort: 'high' },
+      sessionOptionsOverrideAgentArgs: true,
+      agentArgs: '--dangerously-bypass-approvals-and-sandbox -- literal'
+    })
+    expect(plan?.launchCommand).toBe(
+      "codex '--dangerously-bypass-approvals-and-sandbox' '-m' 'custom-codex-model' '-c' 'model_reasoning_effort=high' '--' 'literal'"
+    )
+  })
+
+  it('rejects conflicting singleton flags in an agent command override', () => {
+    expect(
+      resolveAgentLaunchCommand({
+        agent: 'codex',
+        cmdOverrides: { codex: 'codex --profile work -m gpt-5.5' },
+        platform: 'linux',
+        shell: 'posix',
+        sessionOptions: { model: 'custom-codex-model', effort: 'high' },
+        sessionOptionsOverrideAgentArgs: true
+      })
+    ).toEqual({
+      ok: false,
+      error:
+        'Agent command override conflicts with the requested launch preferences. Remove model or effort flags from the command override.'
+    })
+  })
+
   it('recognizes a long Codex model flag overriding the generated short flag', () => {
     const plan = buildAgentStartupPlan({
       agent: 'codex',
diff --git a/src/shared/tui-agent-startup.ts b/src/shared/tui-agent-startup.ts
index 682643f7c79..27d4b40ac8d 100644
--- a/src/shared/tui-agent-startup.ts
+++ b/src/shared/tui-agent-startup.ts
@@ -36,9 +36,7 @@ export type AgentStartupPlan = {
   sessionOptions?: Record<string, SessionOptionValue>
 }
 
-function appliedSessionOptionProps(
-  values: Record<string, SessionOptionValue>
-): Pick<AgentStartupPlan, 'sessionOptions'> {
+function appliedSessionOptionProps(values: Record<string, SessionOptionValue>) {
   return Object.keys(values).length > 0 ? { sessionOptions: { ...values } } : {}
 }
 
@@ -52,6 +50,7 @@ export function buildAgentStartupPlan(args: {
   agentArgs?: string | null
   agentEnv?: Record<string, string> | null
   sessionOptions?: Record<string, SessionOptionValue>
+  sessionOptionsOverrideAgentArgs?: boolean
   /** Why: SSH remotes deploy the CLI shim as plain `orca`, so the Linux-only
    * `orca-ide` rename must be skipped for remote launches. */
   isRemote?: boolean
@@ -68,6 +67,7 @@ export function buildAgentStartupPlan(args: {
     shell,
     agentArgs: usesQuery ? null : args.agentArgs,
     sessionOptions: args.sessionOptions,
+    sessionOptionsOverrideAgentArgs: args.sessionOptionsOverrideAgentArgs,
     isRemote: args.isRemote
   })
   if (!baseCommand.ok) {
diff --git a/tests/e2e/worktree-card-status-indicator.spec.ts b/tests/e2e/worktree-card-status-indicator.spec.ts
deleted file mode 100644
index 78075cb26c2..00000000000
--- a/tests/e2e/worktree-card-status-indicator.spec.ts
+++ /dev/null
@@ -1,84 +0,0 @@
-// Regression coverage for active status taking precedence over passive identity (#8813).
-
-import type { Locator, Page } from '@stablyai/playwright-test'
-import { test, expect } from './helpers/orca-app'
-import {
-  waitForSessionReady,
-  waitForActiveWorktree,
-  getAllWorktreeIds,
-  ensureTerminalVisible
-} from './helpers/store'
-import { worktreeRow, worktreeRowSurface } from './worktree-row-locators'
-
-function statusLane(page: Page, worktreeId: string): Locator {
-  return worktreeRow(page, worktreeId).locator('[data-worktree-card-status-slot]').first()
-}
-
-function statusDot(page: Page, worktreeId: string): Locator {
-  return statusLane(page, worktreeId).locator('span.bg-emerald-500').first()
-}
-
-function branchIdentityGlyph(page: Page, worktreeId: string): Locator {
-  return statusLane(page, worktreeId).locator('svg.lucide-git-branch')
-}
-
-// PTY liveness, not the tab row, drives the activity heuristic.
-async function waitForLivePty(page: Page, worktreeId: string): Promise<void> {
-  await expect
-    .poll(
-      async () =>
-        page.evaluate((id) => {
-          const state = window.__store!.getState()
-          return (state.tabsByWorktree[id] ?? []).some(
-            (tab) => (state.ptyIdsByTabId[tab.id] ?? []).length > 0
-          )
-        }, worktreeId),
-      { timeout: 30_000, message: `No live PTY attached for worktree ${worktreeId}` }
-    )
-    .toBe(true)
-}
-
-test.describe('Worktree card status indicator', () => {
-  test.beforeEach(async ({ orcaPage }) => {
-    await waitForSessionReady(orcaPage)
-    await waitForActiveWorktree(orcaPage)
-  })
-
-  test('paints the emerald Active dot instead of the grey branch glyph once a workspace goes live', async ({
-    orcaPage
-  }) => {
-    const liveWorktreeId = await waitForActiveWorktree(orcaPage)
-    await ensureTerminalVisible(orcaPage)
-    await waitForLivePty(orcaPage, liveWorktreeId)
-
-    // The regression requires both the new card style and branch identity.
-    await orcaPage.evaluate(async () => {
-      const state = window.__store!.getState()
-      await state.updateSettings({ experimentalNewWorktreeCardStyle: true })
-      state.setWorktreeCardProperties(['status', 'unread', 'branch'])
-    })
-
-    const quietWorktreeId = (await getAllWorktreeIds(orcaPage)).find((id) => id !== liveWorktreeId)
-    if (!quietWorktreeId) {
-      throw new Error('Seeded repo did not expose a second worktree to keep quiet')
-    }
-
-    await expect(branchIdentityGlyph(orcaPage, quietWorktreeId)).toBeVisible()
-    await expect(statusLane(orcaPage, quietWorktreeId)).toHaveText('Branch')
-
-    await expect(statusDot(orcaPage, liveWorktreeId)).toBeVisible()
-    await expect(statusLane(orcaPage, liveWorktreeId)).toHaveText('Active')
-    await expect(branchIdentityGlyph(orcaPage, liveWorktreeId)).toHaveCount(0)
-
-    await worktreeRowSurface(orcaPage, quietWorktreeId).click()
-    await expect
-      .poll(async () => orcaPage.evaluate(() => window.__store!.getState().activeWorktreeId))
-      .toBe(quietWorktreeId)
-    await ensureTerminalVisible(orcaPage)
-    await waitForLivePty(orcaPage, quietWorktreeId)
-
-    await expect(statusDot(orcaPage, quietWorktreeId)).toBeVisible()
-    await expect(statusLane(orcaPage, quietWorktreeId)).toHaveText('Active')
-    await expect(branchIdentityGlyph(orcaPage, quietWorktreeId)).toHaveCount(0)
-  })
-})