diff --git a/src/main/codex-accounts/legacy-wsl-runtime-auth-drain-rollback-script.test.ts b/src/main/codex-accounts/legacy-wsl-runtime-auth-drain-rollback-script.test.ts
index 99f9442ba2a..c120de409ce 100644
--- a/src/main/codex-accounts/legacy-wsl-runtime-auth-drain-rollback-script.test.ts
+++ b/src/main/codex-accounts/legacy-wsl-runtime-auth-drain-rollback-script.test.ts
@@ -130,6 +130,8 @@ describe.skipIf(process.platform === 'win32')('legacy WSL auth drain rollback re
     rmSync(watermarkPath)
     mkdirSync(watermarkPath)
     writeFileSync(blockedSourceSessionPath, LATER_SESSION)
+    expect(() => apply(sha256(SOURCE_AUTH), '0', '0', 'full')).toThrow()
+    expect(existsSync(blockedTargetSessionPath)).toBe(false)
     expect(() => apply(sha256(SOURCE_AUTH), '0', '0', 'recent')).toThrow()
     expect(existsSync(blockedTargetSessionPath)).toBe(false)
     rmSync(watermarkPath, { recursive: true })
diff --git a/src/main/codex-accounts/legacy-wsl-runtime-auth-drain-scripts.ts b/src/main/codex-accounts/legacy-wsl-runtime-auth-drain-scripts.ts
index 94bf261ce73..b6a10e375eb 100644
--- a/src/main/codex-accounts/legacy-wsl-runtime-auth-drain-scripts.ts
+++ b/src/main/codex-accounts/legacy-wsl-runtime-auth-drain-scripts.ts
@@ -175,9 +175,9 @@ cleanup() {
   rm -f -- "$temporary_auth" "$temporary_credentials" "$temporary_previous_auth" "$temporary_destination_auth" "$temporary_source_auth" "$temporary_destination_snapshot" "$temporary_destination_path" "$temporary_source_snapshot" "$temporary_marker" "$temporary_session_scan_watermark"
 }
 trap cleanup EXIT HUP INT TERM
-if [ "$8" != 1 ] && [ "\${10}" = recent ]; then
+if [ "$8" != 1 ]; then
   session_scan_start=''; session_scan_day=$(date +%Y/%m/%d) || exit 46
-  if [ -f "$session_scan_watermark" ] && [ ! -L "$session_scan_watermark" ]; then
+  if [ "\${10}" = recent ] && [ -f "$session_scan_watermark" ] && [ ! -L "$session_scan_watermark" ]; then
     IFS= read -r session_scan_start < "$session_scan_watermark" || session_scan_start=''
   elif [ -e "$session_scan_watermark" ] && [ ! -L "$session_scan_watermark" ]; then exit 46
   fi
@@ -214,7 +214,6 @@ if [ "$7" = 1 ]; then
   rm -- "$temporary_previous_auth"
 fi
 if [ "$8" != 1 ]; then
-  session_scan_day=\${session_scan_day:-$(date +%Y/%m/%d)} || exit 46
   expected_target_hash="$6"
   [ "$7" != 1 ] || expected_target_hash="$5"
   # Keep both live auth inodes observable while links are staged, then prove